1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27#include "qemu/osdep.h"
28#include "hw/dma/xlnx-zynq-devcfg.h"
29#include "qemu/bitops.h"
30#include "sysemu/sysemu.h"
31#include "sysemu/dma.h"
32#include "qemu/log.h"
33#include "qemu/module.h"
34
35#define FREQ_HZ 900000000
36
37#define BTT_MAX 0x400
38
39#ifndef XLNX_ZYNQ_DEVCFG_ERR_DEBUG
40#define XLNX_ZYNQ_DEVCFG_ERR_DEBUG 0
41#endif
42
43#define DB_PRINT(fmt, args...) do { \
44 if (XLNX_ZYNQ_DEVCFG_ERR_DEBUG) { \
45 qemu_log("%s: " fmt, __func__, ## args); \
46 } \
47} while (0)
48
49REG32(CTRL, 0x00)
50 FIELD(CTRL, FORCE_RST, 31, 1)
51 FIELD(CTRL, PCAP_PR, 27, 1)
52 FIELD(CTRL, PCAP_MODE, 26, 1)
53 FIELD(CTRL, MULTIBOOT_EN, 24, 1)
54 FIELD(CTRL, USER_MODE, 15, 1)
55 FIELD(CTRL, PCFG_AES_FUSE, 12, 1)
56 FIELD(CTRL, PCFG_AES_EN, 9, 3)
57 FIELD(CTRL, SEU_EN, 8, 1)
58 FIELD(CTRL, SEC_EN, 7, 1)
59 FIELD(CTRL, SPNIDEN, 6, 1)
60 FIELD(CTRL, SPIDEN, 5, 1)
61 FIELD(CTRL, NIDEN, 4, 1)
62 FIELD(CTRL, DBGEN, 3, 1)
63 FIELD(CTRL, DAP_EN, 0, 3)
64
65REG32(LOCK, 0x04)
66#define AES_FUSE_LOCK 4
67#define AES_EN_LOCK 3
68#define SEU_LOCK 2
69#define SEC_LOCK 1
70#define DBG_LOCK 0
71
72
73static const uint32_t lock_ctrl_map[] = {
74 [AES_FUSE_LOCK] = R_CTRL_PCFG_AES_FUSE_MASK,
75 [AES_EN_LOCK] = R_CTRL_PCFG_AES_EN_MASK,
76 [SEU_LOCK] = R_CTRL_SEU_EN_MASK,
77 [SEC_LOCK] = R_CTRL_SEC_EN_MASK,
78 [DBG_LOCK] = R_CTRL_SPNIDEN_MASK | R_CTRL_SPIDEN_MASK |
79 R_CTRL_NIDEN_MASK | R_CTRL_DBGEN_MASK |
80 R_CTRL_DAP_EN_MASK,
81};
82
83REG32(CFG, 0x08)
84 FIELD(CFG, RFIFO_TH, 10, 2)
85 FIELD(CFG, WFIFO_TH, 8, 2)
86 FIELD(CFG, RCLK_EDGE, 7, 1)
87 FIELD(CFG, WCLK_EDGE, 6, 1)
88 FIELD(CFG, DISABLE_SRC_INC, 5, 1)
89 FIELD(CFG, DISABLE_DST_INC, 4, 1)
90#define R_CFG_RESET 0x50B
91
92REG32(INT_STS, 0x0C)
93 FIELD(INT_STS, PSS_GTS_USR_B, 31, 1)
94 FIELD(INT_STS, PSS_FST_CFG_B, 30, 1)
95 FIELD(INT_STS, PSS_CFG_RESET_B, 27, 1)
96 FIELD(INT_STS, RX_FIFO_OV, 18, 1)
97 FIELD(INT_STS, WR_FIFO_LVL, 17, 1)
98 FIELD(INT_STS, RD_FIFO_LVL, 16, 1)
99 FIELD(INT_STS, DMA_CMD_ERR, 15, 1)
100 FIELD(INT_STS, DMA_Q_OV, 14, 1)
101 FIELD(INT_STS, DMA_DONE, 13, 1)
102 FIELD(INT_STS, DMA_P_DONE, 12, 1)
103 FIELD(INT_STS, P2D_LEN_ERR, 11, 1)
104 FIELD(INT_STS, PCFG_DONE, 2, 1)
105#define R_INT_STS_RSVD ((0x7 << 24) | (0x1 << 19) | (0xF < 7))
106
107REG32(INT_MASK, 0x10)
108
109REG32(STATUS, 0x14)
110 FIELD(STATUS, DMA_CMD_Q_F, 31, 1)
111 FIELD(STATUS, DMA_CMD_Q_E, 30, 1)
112 FIELD(STATUS, DMA_DONE_CNT, 28, 2)
113 FIELD(STATUS, RX_FIFO_LVL, 20, 5)
114 FIELD(STATUS, TX_FIFO_LVL, 12, 7)
115 FIELD(STATUS, PSS_GTS_USR_B, 11, 1)
116 FIELD(STATUS, PSS_FST_CFG_B, 10, 1)
117 FIELD(STATUS, PSS_CFG_RESET_B, 5, 1)
118
119REG32(DMA_SRC_ADDR, 0x18)
120REG32(DMA_DST_ADDR, 0x1C)
121REG32(DMA_SRC_LEN, 0x20)
122REG32(DMA_DST_LEN, 0x24)
123REG32(ROM_SHADOW, 0x28)
124REG32(SW_ID, 0x30)
125REG32(UNLOCK, 0x34)
126
127#define R_UNLOCK_MAGIC 0x757BDF0D
128
129REG32(MCTRL, 0x80)
130 FIELD(MCTRL, PS_VERSION, 28, 4)
131 FIELD(MCTRL, PCFG_POR_B, 8, 1)
132 FIELD(MCTRL, INT_PCAP_LPBK, 4, 1)
133 FIELD(MCTRL, QEMU, 3, 1)
134
135static void xlnx_zynq_devcfg_update_ixr(XlnxZynqDevcfg *s)
136{
137 qemu_set_irq(s->irq, ~s->regs[R_INT_MASK] & s->regs[R_INT_STS]);
138}
139
140static void xlnx_zynq_devcfg_reset(DeviceState *dev)
141{
142 XlnxZynqDevcfg *s = XLNX_ZYNQ_DEVCFG(dev);
143 int i;
144
145 for (i = 0; i < XLNX_ZYNQ_DEVCFG_R_MAX; ++i) {
146 register_reset(&s->regs_info[i]);
147 }
148}
149
150static void xlnx_zynq_devcfg_dma_go(XlnxZynqDevcfg *s)
151{
152 do {
153 uint8_t buf[BTT_MAX];
154 XlnxZynqDevcfgDMACmd *dmah = s->dma_cmd_fifo;
155 uint32_t btt = BTT_MAX;
156 bool loopback = s->regs[R_MCTRL] & R_MCTRL_INT_PCAP_LPBK_MASK;
157
158 btt = MIN(btt, dmah->src_len);
159 if (loopback) {
160 btt = MIN(btt, dmah->dest_len);
161 }
162 DB_PRINT("reading %x bytes from %x\n", btt, dmah->src_addr);
163 dma_memory_read(&address_space_memory, dmah->src_addr, buf, btt);
164 dmah->src_len -= btt;
165 dmah->src_addr += btt;
166 if (loopback && (dmah->src_len || dmah->dest_len)) {
167 DB_PRINT("writing %x bytes from %x\n", btt, dmah->dest_addr);
168 dma_memory_write(&address_space_memory, dmah->dest_addr, buf, btt);
169 dmah->dest_len -= btt;
170 dmah->dest_addr += btt;
171 }
172 if (!dmah->src_len && !dmah->dest_len) {
173 DB_PRINT("dma operation finished\n");
174 s->regs[R_INT_STS] |= R_INT_STS_DMA_DONE_MASK |
175 R_INT_STS_DMA_P_DONE_MASK;
176 s->dma_cmd_fifo_num--;
177 memmove(s->dma_cmd_fifo, &s->dma_cmd_fifo[1],
178 sizeof(s->dma_cmd_fifo) - sizeof(s->dma_cmd_fifo[0]));
179 }
180 xlnx_zynq_devcfg_update_ixr(s);
181 } while (s->dma_cmd_fifo_num);
182}
183
184static void r_ixr_post_write(RegisterInfo *reg, uint64_t val)
185{
186 XlnxZynqDevcfg *s = XLNX_ZYNQ_DEVCFG(reg->opaque);
187
188 xlnx_zynq_devcfg_update_ixr(s);
189}
190
191static uint64_t r_ctrl_pre_write(RegisterInfo *reg, uint64_t val)
192{
193 XlnxZynqDevcfg *s = XLNX_ZYNQ_DEVCFG(reg->opaque);
194 int i;
195
196 for (i = 0; i < ARRAY_SIZE(lock_ctrl_map); ++i) {
197 if (s->regs[R_LOCK] & 1 << i) {
198 val &= ~lock_ctrl_map[i];
199 val |= lock_ctrl_map[i] & s->regs[R_CTRL];
200 }
201 }
202 return val;
203}
204
205static void r_ctrl_post_write(RegisterInfo *reg, uint64_t val)
206{
207 const char *device_prefix = object_get_typename(OBJECT(reg->opaque));
208 uint32_t aes_en = FIELD_EX32(val, CTRL, PCFG_AES_EN);
209
210 if (aes_en != 0 && aes_en != 7) {
211 qemu_log_mask(LOG_UNIMP, "%s: warning, aes-en bits inconsistent,"
212 "unimplemented security reset should happen!\n",
213 device_prefix);
214 }
215}
216
217static void r_unlock_post_write(RegisterInfo *reg, uint64_t val)
218{
219 XlnxZynqDevcfg *s = XLNX_ZYNQ_DEVCFG(reg->opaque);
220 const char *device_prefix = object_get_typename(OBJECT(s));
221
222 if (val == R_UNLOCK_MAGIC) {
223 DB_PRINT("successful unlock\n");
224 s->regs[R_CTRL] |= R_CTRL_PCAP_PR_MASK;
225 s->regs[R_CTRL] |= R_CTRL_PCFG_AES_EN_MASK;
226 memory_region_set_enabled(&s->iomem, true);
227 } else {
228 qemu_log_mask(LOG_GUEST_ERROR, "%s: failed unlock\n", device_prefix);
229 s->regs[R_CTRL] &= ~R_CTRL_PCAP_PR_MASK;
230 s->regs[R_CTRL] &= ~R_CTRL_PCFG_AES_EN_MASK;
231
232 memory_region_set_enabled(&s->iomem, false);
233 }
234}
235
236static uint64_t r_lock_pre_write(RegisterInfo *reg, uint64_t val)
237{
238 XlnxZynqDevcfg *s = XLNX_ZYNQ_DEVCFG(reg->opaque);
239
240
241 return s->regs[R_LOCK] | val;
242}
243
244static void r_dma_dst_len_post_write(RegisterInfo *reg, uint64_t val)
245{
246 XlnxZynqDevcfg *s = XLNX_ZYNQ_DEVCFG(reg->opaque);
247
248 s->dma_cmd_fifo[s->dma_cmd_fifo_num] = (XlnxZynqDevcfgDMACmd) {
249 .src_addr = s->regs[R_DMA_SRC_ADDR] & ~0x3UL,
250 .dest_addr = s->regs[R_DMA_DST_ADDR] & ~0x3UL,
251 .src_len = s->regs[R_DMA_SRC_LEN] << 2,
252 .dest_len = s->regs[R_DMA_DST_LEN] << 2,
253 };
254 s->dma_cmd_fifo_num++;
255 DB_PRINT("dma transfer started; %d total transfers pending\n",
256 s->dma_cmd_fifo_num);
257 xlnx_zynq_devcfg_dma_go(s);
258}
259
260static const RegisterAccessInfo xlnx_zynq_devcfg_regs_info[] = {
261 { .name = "CTRL", .addr = A_CTRL,
262 .reset = R_CTRL_PCAP_PR_MASK | R_CTRL_PCAP_MODE_MASK | 0x3 << 13,
263 .rsvd = 0x1 << 28 | 0x3ff << 13 | 0x3 << 13,
264 .pre_write = r_ctrl_pre_write,
265 .post_write = r_ctrl_post_write,
266 },
267 { .name = "LOCK", .addr = A_LOCK,
268 .rsvd = MAKE_64BIT_MASK(5, 64 - 5),
269 .pre_write = r_lock_pre_write,
270 },
271 { .name = "CFG", .addr = A_CFG,
272 .reset = R_CFG_RESET,
273 .rsvd = 0xfffff00f,
274 },
275 { .name = "INT_STS", .addr = A_INT_STS,
276 .w1c = ~R_INT_STS_RSVD,
277 .reset = R_INT_STS_PSS_GTS_USR_B_MASK |
278 R_INT_STS_PSS_CFG_RESET_B_MASK |
279 R_INT_STS_WR_FIFO_LVL_MASK,
280 .rsvd = R_INT_STS_RSVD,
281 .post_write = r_ixr_post_write,
282 },
283 { .name = "INT_MASK", .addr = A_INT_MASK,
284 .reset = ~0,
285 .rsvd = R_INT_STS_RSVD,
286 .post_write = r_ixr_post_write,
287 },
288 { .name = "STATUS", .addr = A_STATUS,
289 .reset = R_STATUS_DMA_CMD_Q_E_MASK |
290 R_STATUS_PSS_GTS_USR_B_MASK |
291 R_STATUS_PSS_CFG_RESET_B_MASK,
292 .ro = ~0,
293 },
294 { .name = "DMA_SRC_ADDR", .addr = A_DMA_SRC_ADDR, },
295 { .name = "DMA_DST_ADDR", .addr = A_DMA_DST_ADDR, },
296 { .name = "DMA_SRC_LEN", .addr = A_DMA_SRC_LEN,
297 .ro = MAKE_64BIT_MASK(27, 64 - 27) },
298 { .name = "DMA_DST_LEN", .addr = A_DMA_DST_LEN,
299 .ro = MAKE_64BIT_MASK(27, 64 - 27),
300 .post_write = r_dma_dst_len_post_write,
301 },
302 { .name = "ROM_SHADOW", .addr = A_ROM_SHADOW,
303 .rsvd = ~0ull,
304 },
305 { .name = "SW_ID", .addr = A_SW_ID, },
306 { .name = "UNLOCK", .addr = A_UNLOCK,
307 .post_write = r_unlock_post_write,
308 },
309 { .name = "MCTRL", .addr = R_MCTRL * 4,
310
311
312
313 .reset = 0x2 << R_MCTRL_PS_VERSION_SHIFT | 1 << 23 | R_MCTRL_QEMU_MASK,
314 .ro = ~R_MCTRL_INT_PCAP_LPBK_MASK,
315 .rsvd = 0x00f00303,
316 },
317};
318
319static const MemoryRegionOps xlnx_zynq_devcfg_reg_ops = {
320 .read = register_read_memory,
321 .write = register_write_memory,
322 .endianness = DEVICE_LITTLE_ENDIAN,
323 .valid = {
324 .min_access_size = 4,
325 .max_access_size = 4,
326 }
327};
328
329static const VMStateDescription vmstate_xlnx_zynq_devcfg_dma_cmd = {
330 .name = "xlnx_zynq_devcfg_dma_cmd",
331 .version_id = 1,
332 .minimum_version_id = 1,
333 .fields = (VMStateField[]) {
334 VMSTATE_UINT32(src_addr, XlnxZynqDevcfgDMACmd),
335 VMSTATE_UINT32(dest_addr, XlnxZynqDevcfgDMACmd),
336 VMSTATE_UINT32(src_len, XlnxZynqDevcfgDMACmd),
337 VMSTATE_UINT32(dest_len, XlnxZynqDevcfgDMACmd),
338 VMSTATE_END_OF_LIST()
339 }
340};
341
342static const VMStateDescription vmstate_xlnx_zynq_devcfg = {
343 .name = "xlnx_zynq_devcfg",
344 .version_id = 1,
345 .minimum_version_id = 1,
346 .fields = (VMStateField[]) {
347 VMSTATE_STRUCT_ARRAY(dma_cmd_fifo, XlnxZynqDevcfg,
348 XLNX_ZYNQ_DEVCFG_DMA_CMD_FIFO_LEN, 0,
349 vmstate_xlnx_zynq_devcfg_dma_cmd,
350 XlnxZynqDevcfgDMACmd),
351 VMSTATE_UINT8(dma_cmd_fifo_num, XlnxZynqDevcfg),
352 VMSTATE_UINT32_ARRAY(regs, XlnxZynqDevcfg, XLNX_ZYNQ_DEVCFG_R_MAX),
353 VMSTATE_END_OF_LIST()
354 }
355};
356
357static void xlnx_zynq_devcfg_init(Object *obj)
358{
359 SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
360 XlnxZynqDevcfg *s = XLNX_ZYNQ_DEVCFG(obj);
361 RegisterInfoArray *reg_array;
362
363 sysbus_init_irq(sbd, &s->irq);
364
365 memory_region_init(&s->iomem, obj, "devcfg", XLNX_ZYNQ_DEVCFG_R_MAX * 4);
366 reg_array =
367 register_init_block32(DEVICE(obj), xlnx_zynq_devcfg_regs_info,
368 ARRAY_SIZE(xlnx_zynq_devcfg_regs_info),
369 s->regs_info, s->regs,
370 &xlnx_zynq_devcfg_reg_ops,
371 XLNX_ZYNQ_DEVCFG_ERR_DEBUG,
372 XLNX_ZYNQ_DEVCFG_R_MAX);
373 memory_region_add_subregion(&s->iomem,
374 A_CTRL,
375 ®_array->mem);
376
377 sysbus_init_mmio(sbd, &s->iomem);
378}
379
380static void xlnx_zynq_devcfg_class_init(ObjectClass *klass, void *data)
381{
382 DeviceClass *dc = DEVICE_CLASS(klass);
383
384 dc->reset = xlnx_zynq_devcfg_reset;
385 dc->vmsd = &vmstate_xlnx_zynq_devcfg;
386}
387
388static const TypeInfo xlnx_zynq_devcfg_info = {
389 .name = TYPE_XLNX_ZYNQ_DEVCFG,
390 .parent = TYPE_SYS_BUS_DEVICE,
391 .instance_size = sizeof(XlnxZynqDevcfg),
392 .instance_init = xlnx_zynq_devcfg_init,
393 .class_init = xlnx_zynq_devcfg_class_init,
394};
395
396static void xlnx_zynq_devcfg_register_types(void)
397{
398 type_register_static(&xlnx_zynq_devcfg_info);
399}
400
401type_init(xlnx_zynq_devcfg_register_types)
402
