1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25#include "qemu/osdep.h"
26#include "hw/hw.h"
27#include "hw/mips/mips.h"
28#include "hw/sysbus.h"
29#include "qemu/timer.h"
30#include "qemu/log.h"
31#include "exec/address-spaces.h"
32#include "trace.h"
33
34
35
36
37typedef struct dma_pagetable_entry {
38 int32_t frame;
39 int32_t owner;
40} QEMU_PACKED dma_pagetable_entry;
41
42#define DMA_PAGESIZE 4096
43#define DMA_REG_ENABLE 1
44#define DMA_REG_COUNT 2
45#define DMA_REG_ADDRESS 3
46
47#define DMA_FLAG_ENABLE 0x0001
48#define DMA_FLAG_MEM_TO_DEV 0x0002
49#define DMA_FLAG_TC_INTR 0x0100
50#define DMA_FLAG_MEM_INTR 0x0200
51#define DMA_FLAG_ADDR_INTR 0x0400
52
53#define TYPE_RC4030 "rc4030"
54#define RC4030(obj) \
55 OBJECT_CHECK(rc4030State, (obj), TYPE_RC4030)
56
57#define TYPE_RC4030_IOMMU_MEMORY_REGION "rc4030-iommu-memory-region"
58
59typedef struct rc4030State
60{
61 SysBusDevice parent;
62
63 uint32_t config;
64 uint32_t revision;
65 uint32_t invalid_address_register;
66
67
68 uint32_t dma_regs[8][4];
69 uint32_t dma_tl_base;
70 uint32_t dma_tl_limit;
71
72
73 uint32_t cache_maint;
74 uint32_t remote_failed_address;
75 uint32_t memory_failed_address;
76 uint32_t cache_ptag;
77 uint32_t cache_ltag;
78 uint32_t cache_bmask;
79
80 uint32_t nmi_interrupt;
81 uint32_t memory_refresh_rate;
82 uint32_t nvram_protect;
83 uint32_t rem_speed[16];
84 uint32_t imr_jazz;
85 uint32_t isr_jazz;
86
87
88 QEMUTimer *periodic_timer;
89 uint32_t itr;
90
91 qemu_irq timer_irq;
92 qemu_irq jazz_bus_irq;
93
94
95 IOMMUMemoryRegion dma_mr;
96 AddressSpace dma_as;
97
98 MemoryRegion iomem_chipset;
99 MemoryRegion iomem_jazzio;
100} rc4030State;
101
102static void set_next_tick(rc4030State *s)
103{
104 uint32_t tm_hz;
105 qemu_irq_lower(s->timer_irq);
106
107 tm_hz = 1000 / (s->itr + 1);
108
109 timer_mod(s->periodic_timer, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) +
110 NANOSECONDS_PER_SECOND / tm_hz);
111}
112
113
114static uint64_t rc4030_read(void *opaque, hwaddr addr, unsigned int size)
115{
116 rc4030State *s = opaque;
117 uint32_t val;
118
119 addr &= 0x3fff;
120 switch (addr & ~0x3) {
121
122 case 0x0000:
123 val = s->config;
124 break;
125
126 case 0x0008:
127 val = s->revision;
128 break;
129
130 case 0x0010:
131 val = s->invalid_address_register;
132 break;
133
134 case 0x0018:
135 val = s->dma_tl_base;
136 break;
137
138 case 0x0020:
139 val = s->dma_tl_limit;
140 break;
141
142 case 0x0038:
143 val = s->remote_failed_address;
144 break;
145
146 case 0x0040:
147 val = s->memory_failed_address;
148 break;
149
150 case 0x0058:
151 val = s->cache_bmask;
152
153 if (s->cache_bmask == (uint32_t)-1)
154 s->cache_bmask = 0;
155 break;
156
157 case 0x0070:
158 case 0x0078:
159 case 0x0080:
160 case 0x0088:
161 case 0x0090:
162 case 0x0098:
163 case 0x00a0:
164 case 0x00a8:
165 case 0x00b0:
166 case 0x00b8:
167 case 0x00c0:
168 case 0x00c8:
169 case 0x00d0:
170 case 0x00d8:
171 case 0x00e0:
172 case 0x00e8:
173 val = s->rem_speed[(addr - 0x0070) >> 3];
174 break;
175
176 case 0x0100:
177 case 0x0108:
178 case 0x0110:
179 case 0x0118:
180 case 0x0120:
181 case 0x0128:
182 case 0x0130:
183 case 0x0138:
184 case 0x0140:
185 case 0x0148:
186 case 0x0150:
187 case 0x0158:
188 case 0x0160:
189 case 0x0168:
190 case 0x0170:
191 case 0x0178:
192 case 0x0180:
193 case 0x0188:
194 case 0x0190:
195 case 0x0198:
196 case 0x01a0:
197 case 0x01a8:
198 case 0x01b0:
199 case 0x01b8:
200 case 0x01c0:
201 case 0x01c8:
202 case 0x01d0:
203 case 0x01d8:
204 case 0x01e0:
205 case 0x01e8:
206 case 0x01f0:
207 case 0x01f8:
208 {
209 int entry = (addr - 0x0100) >> 5;
210 int idx = (addr & 0x1f) >> 3;
211 val = s->dma_regs[entry][idx];
212 }
213 break;
214
215 case 0x0200:
216 val = s->nmi_interrupt;
217 break;
218
219 case 0x0208:
220 val = 0;
221 break;
222
223 case 0x0210:
224 val = s->memory_refresh_rate;
225 break;
226
227 case 0x0220:
228 val = s->nvram_protect;
229 break;
230
231 case 0x0230:
232 val = 0;
233 qemu_irq_lower(s->timer_irq);
234 break;
235
236 case 0x0238:
237 val = 7;
238 break;
239 default:
240 qemu_log_mask(LOG_GUEST_ERROR,
241 "rc4030: invalid read at 0x%x", (int)addr);
242 val = 0;
243 break;
244 }
245
246 if ((addr & ~3) != 0x230) {
247 trace_rc4030_read(addr, val);
248 }
249
250 return val;
251}
252
253static void rc4030_write(void *opaque, hwaddr addr, uint64_t data,
254 unsigned int size)
255{
256 rc4030State *s = opaque;
257 uint32_t val = data;
258 addr &= 0x3fff;
259
260 trace_rc4030_write(addr, val);
261
262 switch (addr & ~0x3) {
263
264 case 0x0000:
265 s->config = val;
266 break;
267
268 case 0x0018:
269 s->dma_tl_base = val;
270 break;
271
272 case 0x0020:
273 s->dma_tl_limit = val;
274 break;
275
276 case 0x0028:
277 break;
278
279 case 0x0030:
280 s->cache_maint = val;
281 break;
282
283 case 0x0048:
284 s->cache_ptag = val;
285 break;
286
287 case 0x0050:
288 s->cache_ltag = val;
289 break;
290
291 case 0x0058:
292 s->cache_bmask |= val;
293 break;
294
295 case 0x0060:
296
297 if (s->cache_ltag == 0x80000001 && s->cache_bmask == 0xf0f0f0f) {
298 hwaddr dest = s->cache_ptag & ~0x1;
299 dest += (s->cache_maint & 0x3) << 3;
300 cpu_physical_memory_write(dest, &val, 4);
301 }
302 break;
303
304 case 0x0070:
305 case 0x0078:
306 case 0x0080:
307 case 0x0088:
308 case 0x0090:
309 case 0x0098:
310 case 0x00a0:
311 case 0x00a8:
312 case 0x00b0:
313 case 0x00b8:
314 case 0x00c0:
315 case 0x00c8:
316 case 0x00d0:
317 case 0x00d8:
318 case 0x00e0:
319 case 0x00e8:
320 s->rem_speed[(addr - 0x0070) >> 3] = val;
321 break;
322
323 case 0x0100:
324 case 0x0108:
325 case 0x0110:
326 case 0x0118:
327 case 0x0120:
328 case 0x0128:
329 case 0x0130:
330 case 0x0138:
331 case 0x0140:
332 case 0x0148:
333 case 0x0150:
334 case 0x0158:
335 case 0x0160:
336 case 0x0168:
337 case 0x0170:
338 case 0x0178:
339 case 0x0180:
340 case 0x0188:
341 case 0x0190:
342 case 0x0198:
343 case 0x01a0:
344 case 0x01a8:
345 case 0x01b0:
346 case 0x01b8:
347 case 0x01c0:
348 case 0x01c8:
349 case 0x01d0:
350 case 0x01d8:
351 case 0x01e0:
352 case 0x01e8:
353 case 0x01f0:
354 case 0x01f8:
355 {
356 int entry = (addr - 0x0100) >> 5;
357 int idx = (addr & 0x1f) >> 3;
358 s->dma_regs[entry][idx] = val;
359 }
360 break;
361
362 case 0x0210:
363 s->memory_refresh_rate = val;
364 break;
365
366 case 0x0228:
367 s->itr = val & 0x01FF;
368 qemu_irq_lower(s->timer_irq);
369 set_next_tick(s);
370 break;
371
372 case 0x0238:
373 break;
374 default:
375 qemu_log_mask(LOG_GUEST_ERROR,
376 "rc4030: invalid write of 0x%02x at 0x%x",
377 val, (int)addr);
378 break;
379 }
380}
381
382static const MemoryRegionOps rc4030_ops = {
383 .read = rc4030_read,
384 .write = rc4030_write,
385 .impl.min_access_size = 4,
386 .impl.max_access_size = 4,
387 .endianness = DEVICE_NATIVE_ENDIAN,
388};
389
390static void update_jazz_irq(rc4030State *s)
391{
392 uint16_t pending;
393
394 pending = s->isr_jazz & s->imr_jazz;
395
396 if (pending != 0)
397 qemu_irq_raise(s->jazz_bus_irq);
398 else
399 qemu_irq_lower(s->jazz_bus_irq);
400}
401
402static void rc4030_irq_jazz_request(void *opaque, int irq, int level)
403{
404 rc4030State *s = opaque;
405
406 if (level) {
407 s->isr_jazz |= 1 << irq;
408 } else {
409 s->isr_jazz &= ~(1 << irq);
410 }
411
412 update_jazz_irq(s);
413}
414
415static void rc4030_periodic_timer(void *opaque)
416{
417 rc4030State *s = opaque;
418
419 set_next_tick(s);
420 qemu_irq_raise(s->timer_irq);
421}
422
423static uint64_t jazzio_read(void *opaque, hwaddr addr, unsigned int size)
424{
425 rc4030State *s = opaque;
426 uint32_t val;
427 uint32_t irq;
428 addr &= 0xfff;
429
430 switch (addr) {
431
432 case 0x00: {
433 uint32_t pending = s->isr_jazz & s->imr_jazz;
434 val = 0;
435 irq = 0;
436 while (pending) {
437 if (pending & 1) {
438 val = (irq + 1) << 2;
439 break;
440 }
441 irq++;
442 pending >>= 1;
443 }
444 break;
445 }
446
447 case 0x02:
448 val = s->imr_jazz;
449 break;
450 default:
451 qemu_log_mask(LOG_GUEST_ERROR,
452 "rc4030/jazzio: invalid read at 0x%x", (int)addr);
453 val = 0;
454 break;
455 }
456
457 trace_jazzio_read(addr, val);
458
459 return val;
460}
461
462static void jazzio_write(void *opaque, hwaddr addr, uint64_t data,
463 unsigned int size)
464{
465 rc4030State *s = opaque;
466 uint32_t val = data;
467 addr &= 0xfff;
468
469 trace_jazzio_write(addr, val);
470
471 switch (addr) {
472
473 case 0x02:
474 s->imr_jazz = val;
475 update_jazz_irq(s);
476 break;
477 default:
478 qemu_log_mask(LOG_GUEST_ERROR,
479 "rc4030/jazzio: invalid write of 0x%02x at 0x%x",
480 val, (int)addr);
481 break;
482 }
483}
484
485static const MemoryRegionOps jazzio_ops = {
486 .read = jazzio_read,
487 .write = jazzio_write,
488 .impl.min_access_size = 2,
489 .impl.max_access_size = 2,
490 .endianness = DEVICE_NATIVE_ENDIAN,
491};
492
493static IOMMUTLBEntry rc4030_dma_translate(IOMMUMemoryRegion *iommu, hwaddr addr,
494 IOMMUAccessFlags flag, int iommu_idx)
495{
496 rc4030State *s = container_of(iommu, rc4030State, dma_mr);
497 IOMMUTLBEntry ret = {
498 .target_as = &address_space_memory,
499 .iova = addr & ~(DMA_PAGESIZE - 1),
500 .translated_addr = 0,
501 .addr_mask = DMA_PAGESIZE - 1,
502 .perm = IOMMU_NONE,
503 };
504 uint64_t i, entry_address;
505 dma_pagetable_entry entry;
506
507 i = addr / DMA_PAGESIZE;
508 if (i < s->dma_tl_limit / sizeof(entry)) {
509 entry_address = (s->dma_tl_base & 0x7fffffff) + i * sizeof(entry);
510 if (address_space_read(ret.target_as, entry_address,
511 MEMTXATTRS_UNSPECIFIED, (unsigned char *)&entry,
512 sizeof(entry)) == MEMTX_OK) {
513 ret.translated_addr = entry.frame & ~(DMA_PAGESIZE - 1);
514 ret.perm = IOMMU_RW;
515 }
516 }
517
518 return ret;
519}
520
521static void rc4030_reset(DeviceState *dev)
522{
523 rc4030State *s = RC4030(dev);
524 int i;
525
526 s->config = 0x410;
527 s->revision = 1;
528 s->invalid_address_register = 0;
529
530 memset(s->dma_regs, 0, sizeof(s->dma_regs));
531
532 s->remote_failed_address = s->memory_failed_address = 0;
533 s->cache_maint = 0;
534 s->cache_ptag = s->cache_ltag = 0;
535 s->cache_bmask = 0;
536
537 s->memory_refresh_rate = 0x18186;
538 s->nvram_protect = 7;
539 for (i = 0; i < 15; i++)
540 s->rem_speed[i] = 7;
541 s->imr_jazz = 0x10;
542 s->isr_jazz = 0;
543
544 s->itr = 0;
545
546 qemu_irq_lower(s->timer_irq);
547 qemu_irq_lower(s->jazz_bus_irq);
548}
549
550static int rc4030_post_load(void *opaque, int version_id)
551{
552 rc4030State* s = opaque;
553
554 set_next_tick(s);
555 update_jazz_irq(s);
556
557 return 0;
558}
559
560static const VMStateDescription vmstate_rc4030 = {
561 .name = "rc4030",
562 .version_id = 3,
563 .post_load = rc4030_post_load,
564 .fields = (VMStateField []) {
565 VMSTATE_UINT32(config, rc4030State),
566 VMSTATE_UINT32(invalid_address_register, rc4030State),
567 VMSTATE_UINT32_2DARRAY(dma_regs, rc4030State, 8, 4),
568 VMSTATE_UINT32(dma_tl_base, rc4030State),
569 VMSTATE_UINT32(dma_tl_limit, rc4030State),
570 VMSTATE_UINT32(cache_maint, rc4030State),
571 VMSTATE_UINT32(remote_failed_address, rc4030State),
572 VMSTATE_UINT32(memory_failed_address, rc4030State),
573 VMSTATE_UINT32(cache_ptag, rc4030State),
574 VMSTATE_UINT32(cache_ltag, rc4030State),
575 VMSTATE_UINT32(cache_bmask, rc4030State),
576 VMSTATE_UINT32(memory_refresh_rate, rc4030State),
577 VMSTATE_UINT32(nvram_protect, rc4030State),
578 VMSTATE_UINT32_ARRAY(rem_speed, rc4030State, 16),
579 VMSTATE_UINT32(imr_jazz, rc4030State),
580 VMSTATE_UINT32(isr_jazz, rc4030State),
581 VMSTATE_UINT32(itr, rc4030State),
582 VMSTATE_END_OF_LIST()
583 }
584};
585
586static void rc4030_do_dma(void *opaque, int n, uint8_t *buf, int len, int is_write)
587{
588 rc4030State *s = opaque;
589 hwaddr dma_addr;
590 int dev_to_mem;
591
592 s->dma_regs[n][DMA_REG_ENABLE] &= ~(DMA_FLAG_TC_INTR | DMA_FLAG_MEM_INTR | DMA_FLAG_ADDR_INTR);
593
594
595 dev_to_mem = (s->dma_regs[n][DMA_REG_ENABLE] & DMA_FLAG_MEM_TO_DEV) ? 0 : 1;
596 if (!(s->dma_regs[n][DMA_REG_ENABLE] & DMA_FLAG_ENABLE) ||
597 (is_write != dev_to_mem)) {
598 s->dma_regs[n][DMA_REG_ENABLE] |= DMA_FLAG_MEM_INTR;
599 s->nmi_interrupt |= 1 << n;
600 return;
601 }
602
603
604 if (len > s->dma_regs[n][DMA_REG_COUNT])
605 len = s->dma_regs[n][DMA_REG_COUNT];
606 dma_addr = s->dma_regs[n][DMA_REG_ADDRESS];
607
608
609 address_space_rw(&s->dma_as, dma_addr, MEMTXATTRS_UNSPECIFIED,
610 buf, len, is_write);
611
612 s->dma_regs[n][DMA_REG_ENABLE] |= DMA_FLAG_TC_INTR;
613 s->dma_regs[n][DMA_REG_COUNT] -= len;
614}
615
616struct rc4030DMAState {
617 void *opaque;
618 int n;
619};
620
621void rc4030_dma_read(void *dma, uint8_t *buf, int len)
622{
623 rc4030_dma s = dma;
624 rc4030_do_dma(s->opaque, s->n, buf, len, 0);
625}
626
627void rc4030_dma_write(void *dma, uint8_t *buf, int len)
628{
629 rc4030_dma s = dma;
630 rc4030_do_dma(s->opaque, s->n, buf, len, 1);
631}
632
633static rc4030_dma *rc4030_allocate_dmas(void *opaque, int n)
634{
635 rc4030_dma *s;
636 struct rc4030DMAState *p;
637 int i;
638
639 s = (rc4030_dma *)g_malloc0(sizeof(rc4030_dma) * n);
640 p = (struct rc4030DMAState *)g_malloc0(sizeof(struct rc4030DMAState) * n);
641 for (i = 0; i < n; i++) {
642 p->opaque = opaque;
643 p->n = i;
644 s[i] = p;
645 p++;
646 }
647 return s;
648}
649
650static void rc4030_initfn(Object *obj)
651{
652 DeviceState *dev = DEVICE(obj);
653 rc4030State *s = RC4030(obj);
654 SysBusDevice *sysbus = SYS_BUS_DEVICE(obj);
655
656 qdev_init_gpio_in(dev, rc4030_irq_jazz_request, 16);
657
658 sysbus_init_irq(sysbus, &s->timer_irq);
659 sysbus_init_irq(sysbus, &s->jazz_bus_irq);
660
661 sysbus_init_mmio(sysbus, &s->iomem_chipset);
662 sysbus_init_mmio(sysbus, &s->iomem_jazzio);
663}
664
665static void rc4030_realize(DeviceState *dev, Error **errp)
666{
667 rc4030State *s = RC4030(dev);
668 Object *o = OBJECT(dev);
669
670 s->periodic_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,
671 rc4030_periodic_timer, s);
672
673 memory_region_init_io(&s->iomem_chipset, NULL, &rc4030_ops, s,
674 "rc4030.chipset", 0x300);
675 memory_region_init_io(&s->iomem_jazzio, NULL, &jazzio_ops, s,
676 "rc4030.jazzio", 0x00001000);
677
678 memory_region_init_iommu(&s->dma_mr, sizeof(s->dma_mr),
679 TYPE_RC4030_IOMMU_MEMORY_REGION,
680 o, "rc4030.dma", UINT32_MAX);
681 address_space_init(&s->dma_as, MEMORY_REGION(&s->dma_mr), "rc4030-dma");
682}
683
684static void rc4030_unrealize(DeviceState *dev, Error **errp)
685{
686 rc4030State *s = RC4030(dev);
687
688 timer_free(s->periodic_timer);
689
690 address_space_destroy(&s->dma_as);
691 object_unparent(OBJECT(&s->dma_mr));
692}
693
694static void rc4030_class_init(ObjectClass *klass, void *class_data)
695{
696 DeviceClass *dc = DEVICE_CLASS(klass);
697
698 dc->realize = rc4030_realize;
699 dc->unrealize = rc4030_unrealize;
700 dc->reset = rc4030_reset;
701 dc->vmsd = &vmstate_rc4030;
702}
703
704static const TypeInfo rc4030_info = {
705 .name = TYPE_RC4030,
706 .parent = TYPE_SYS_BUS_DEVICE,
707 .instance_size = sizeof(rc4030State),
708 .instance_init = rc4030_initfn,
709 .class_init = rc4030_class_init,
710};
711
712static void rc4030_iommu_memory_region_class_init(ObjectClass *klass,
713 void *data)
714{
715 IOMMUMemoryRegionClass *imrc = IOMMU_MEMORY_REGION_CLASS(klass);
716
717 imrc->translate = rc4030_dma_translate;
718}
719
720static const TypeInfo rc4030_iommu_memory_region_info = {
721 .parent = TYPE_IOMMU_MEMORY_REGION,
722 .name = TYPE_RC4030_IOMMU_MEMORY_REGION,
723 .class_init = rc4030_iommu_memory_region_class_init,
724};
725
726static void rc4030_register_types(void)
727{
728 type_register_static(&rc4030_info);
729 type_register_static(&rc4030_iommu_memory_region_info);
730}
731
732type_init(rc4030_register_types)
733
734DeviceState *rc4030_init(rc4030_dma **dmas, IOMMUMemoryRegion **dma_mr)
735{
736 DeviceState *dev;
737
738 dev = qdev_create(NULL, TYPE_RC4030);
739 qdev_init_nofail(dev);
740
741 *dmas = rc4030_allocate_dmas(dev, 4);
742 *dma_mr = &RC4030(dev)->dma_mr;
743 return dev;
744}
745
