1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25#include "qemu/osdep.h"
26#include "qemu/units.h"
27#include "hw/irq.h"
28#include "hw/mips/mips.h"
29#include "hw/sysbus.h"
30#include "migration/vmstate.h"
31#include "qemu/timer.h"
32#include "qemu/log.h"
33#include "qemu/module.h"
34#include "exec/address-spaces.h"
35#include "trace.h"
36
37
38
39
40typedef struct dma_pagetable_entry {
41 int32_t frame;
42 int32_t owner;
43} QEMU_PACKED dma_pagetable_entry;
44
45#define DMA_PAGESIZE 4096
46#define DMA_REG_ENABLE 1
47#define DMA_REG_COUNT 2
48#define DMA_REG_ADDRESS 3
49
50#define DMA_FLAG_ENABLE 0x0001
51#define DMA_FLAG_MEM_TO_DEV 0x0002
52#define DMA_FLAG_TC_INTR 0x0100
53#define DMA_FLAG_MEM_INTR 0x0200
54#define DMA_FLAG_ADDR_INTR 0x0400
55
56#define TYPE_RC4030 "rc4030"
57#define RC4030(obj) \
58 OBJECT_CHECK(rc4030State, (obj), TYPE_RC4030)
59
60#define TYPE_RC4030_IOMMU_MEMORY_REGION "rc4030-iommu-memory-region"
61
62typedef struct rc4030State {
63
64 SysBusDevice parent;
65
66 uint32_t config;
67 uint32_t revision;
68 uint32_t invalid_address_register;
69
70
71 uint32_t dma_regs[8][4];
72 uint32_t dma_tl_base;
73 uint32_t dma_tl_limit;
74
75
76 uint32_t cache_maint;
77 uint32_t remote_failed_address;
78 uint32_t memory_failed_address;
79 uint32_t cache_ptag;
80 uint32_t cache_ltag;
81 uint32_t cache_bmask;
82
83 uint32_t nmi_interrupt;
84 uint32_t memory_refresh_rate;
85 uint32_t nvram_protect;
86 uint32_t rem_speed[16];
87 uint32_t imr_jazz;
88 uint32_t isr_jazz;
89
90
91 QEMUTimer *periodic_timer;
92 uint32_t itr;
93
94 qemu_irq timer_irq;
95 qemu_irq jazz_bus_irq;
96
97
98 IOMMUMemoryRegion dma_mr;
99 AddressSpace dma_as;
100
101 MemoryRegion iomem_chipset;
102 MemoryRegion iomem_jazzio;
103} rc4030State;
104
105static void set_next_tick(rc4030State *s)
106{
107 uint32_t tm_hz;
108 qemu_irq_lower(s->timer_irq);
109
110 tm_hz = 1000 / (s->itr + 1);
111
112 timer_mod(s->periodic_timer, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) +
113 NANOSECONDS_PER_SECOND / tm_hz);
114}
115
116
117static uint64_t rc4030_read(void *opaque, hwaddr addr, unsigned int size)
118{
119 rc4030State *s = opaque;
120 uint32_t val;
121
122 addr &= 0x3fff;
123 switch (addr & ~0x3) {
124
125 case 0x0000:
126 val = s->config;
127 break;
128
129 case 0x0008:
130 val = s->revision;
131 break;
132
133 case 0x0010:
134 val = s->invalid_address_register;
135 break;
136
137 case 0x0018:
138 val = s->dma_tl_base;
139 break;
140
141 case 0x0020:
142 val = s->dma_tl_limit;
143 break;
144
145 case 0x0038:
146 val = s->remote_failed_address;
147 break;
148
149 case 0x0040:
150 val = s->memory_failed_address;
151 break;
152
153 case 0x0058:
154 val = s->cache_bmask;
155
156 if (s->cache_bmask == (uint32_t)-1) {
157 s->cache_bmask = 0;
158 }
159 break;
160
161 case 0x0070:
162 case 0x0078:
163 case 0x0080:
164 case 0x0088:
165 case 0x0090:
166 case 0x0098:
167 case 0x00a0:
168 case 0x00a8:
169 case 0x00b0:
170 case 0x00b8:
171 case 0x00c0:
172 case 0x00c8:
173 case 0x00d0:
174 case 0x00d8:
175 case 0x00e0:
176 case 0x00e8:
177 val = s->rem_speed[(addr - 0x0070) >> 3];
178 break;
179
180 case 0x0100:
181 case 0x0108:
182 case 0x0110:
183 case 0x0118:
184 case 0x0120:
185 case 0x0128:
186 case 0x0130:
187 case 0x0138:
188 case 0x0140:
189 case 0x0148:
190 case 0x0150:
191 case 0x0158:
192 case 0x0160:
193 case 0x0168:
194 case 0x0170:
195 case 0x0178:
196 case 0x0180:
197 case 0x0188:
198 case 0x0190:
199 case 0x0198:
200 case 0x01a0:
201 case 0x01a8:
202 case 0x01b0:
203 case 0x01b8:
204 case 0x01c0:
205 case 0x01c8:
206 case 0x01d0:
207 case 0x01d8:
208 case 0x01e0:
209 case 0x01e8:
210 case 0x01f0:
211 case 0x01f8:
212 {
213 int entry = (addr - 0x0100) >> 5;
214 int idx = (addr & 0x1f) >> 3;
215 val = s->dma_regs[entry][idx];
216 }
217 break;
218
219 case 0x0200:
220 val = s->nmi_interrupt;
221 break;
222
223 case 0x0208:
224 val = 0;
225 break;
226
227 case 0x0210:
228 val = s->memory_refresh_rate;
229 break;
230
231 case 0x0220:
232 val = s->nvram_protect;
233 break;
234
235 case 0x0230:
236 val = 0;
237 qemu_irq_lower(s->timer_irq);
238 break;
239
240 case 0x0238:
241 val = 7;
242 break;
243 default:
244 qemu_log_mask(LOG_GUEST_ERROR,
245 "rc4030: invalid read at 0x%x", (int)addr);
246 val = 0;
247 break;
248 }
249
250 if ((addr & ~3) != 0x230) {
251 trace_rc4030_read(addr, val);
252 }
253
254 return val;
255}
256
257static void rc4030_write(void *opaque, hwaddr addr, uint64_t data,
258 unsigned int size)
259{
260 rc4030State *s = opaque;
261 uint32_t val = data;
262 addr &= 0x3fff;
263
264 trace_rc4030_write(addr, val);
265
266 switch (addr & ~0x3) {
267
268 case 0x0000:
269 s->config = val;
270 break;
271
272 case 0x0018:
273 s->dma_tl_base = val;
274 break;
275
276 case 0x0020:
277 s->dma_tl_limit = val;
278 break;
279
280 case 0x0028:
281 break;
282
283 case 0x0030:
284 s->cache_maint = val;
285 break;
286
287 case 0x0048:
288 s->cache_ptag = val;
289 break;
290
291 case 0x0050:
292 s->cache_ltag = val;
293 break;
294
295 case 0x0058:
296 s->cache_bmask |= val;
297 break;
298
299 case 0x0060:
300
301 if (s->cache_ltag == 0x80000001 && s->cache_bmask == 0xf0f0f0f) {
302 hwaddr dest = s->cache_ptag & ~0x1;
303 dest += (s->cache_maint & 0x3) << 3;
304 cpu_physical_memory_write(dest, &val, 4);
305 }
306 break;
307
308 case 0x0070:
309 case 0x0078:
310 case 0x0080:
311 case 0x0088:
312 case 0x0090:
313 case 0x0098:
314 case 0x00a0:
315 case 0x00a8:
316 case 0x00b0:
317 case 0x00b8:
318 case 0x00c0:
319 case 0x00c8:
320 case 0x00d0:
321 case 0x00d8:
322 case 0x00e0:
323 case 0x00e8:
324 s->rem_speed[(addr - 0x0070) >> 3] = val;
325 break;
326
327 case 0x0100:
328 case 0x0108:
329 case 0x0110:
330 case 0x0118:
331 case 0x0120:
332 case 0x0128:
333 case 0x0130:
334 case 0x0138:
335 case 0x0140:
336 case 0x0148:
337 case 0x0150:
338 case 0x0158:
339 case 0x0160:
340 case 0x0168:
341 case 0x0170:
342 case 0x0178:
343 case 0x0180:
344 case 0x0188:
345 case 0x0190:
346 case 0x0198:
347 case 0x01a0:
348 case 0x01a8:
349 case 0x01b0:
350 case 0x01b8:
351 case 0x01c0:
352 case 0x01c8:
353 case 0x01d0:
354 case 0x01d8:
355 case 0x01e0:
356 case 0x01e8:
357 case 0x01f0:
358 case 0x01f8:
359 {
360 int entry = (addr - 0x0100) >> 5;
361 int idx = (addr & 0x1f) >> 3;
362 s->dma_regs[entry][idx] = val;
363 }
364 break;
365
366 case 0x0210:
367 s->memory_refresh_rate = val;
368 break;
369
370 case 0x0228:
371 s->itr = val & 0x01FF;
372 qemu_irq_lower(s->timer_irq);
373 set_next_tick(s);
374 break;
375
376 case 0x0238:
377 break;
378 default:
379 qemu_log_mask(LOG_GUEST_ERROR,
380 "rc4030: invalid write of 0x%02x at 0x%x",
381 val, (int)addr);
382 break;
383 }
384}
385
386static const MemoryRegionOps rc4030_ops = {
387 .read = rc4030_read,
388 .write = rc4030_write,
389 .impl.min_access_size = 4,
390 .impl.max_access_size = 4,
391 .endianness = DEVICE_NATIVE_ENDIAN,
392};
393
394static void update_jazz_irq(rc4030State *s)
395{
396 uint16_t pending;
397
398 pending = s->isr_jazz & s->imr_jazz;
399
400 if (pending != 0)
401 qemu_irq_raise(s->jazz_bus_irq);
402 else
403 qemu_irq_lower(s->jazz_bus_irq);
404}
405
406static void rc4030_irq_jazz_request(void *opaque, int irq, int level)
407{
408 rc4030State *s = opaque;
409
410 if (level) {
411 s->isr_jazz |= 1 << irq;
412 } else {
413 s->isr_jazz &= ~(1 << irq);
414 }
415
416 update_jazz_irq(s);
417}
418
419static void rc4030_periodic_timer(void *opaque)
420{
421 rc4030State *s = opaque;
422
423 set_next_tick(s);
424 qemu_irq_raise(s->timer_irq);
425}
426
427static uint64_t jazzio_read(void *opaque, hwaddr addr, unsigned int size)
428{
429 rc4030State *s = opaque;
430 uint32_t val;
431 uint32_t irq;
432 addr &= 0xfff;
433
434 switch (addr) {
435
436 case 0x00: {
437 uint32_t pending = s->isr_jazz & s->imr_jazz;
438 val = 0;
439 irq = 0;
440 while (pending) {
441 if (pending & 1) {
442 val = (irq + 1) << 2;
443 break;
444 }
445 irq++;
446 pending >>= 1;
447 }
448 break;
449 }
450
451 case 0x02:
452 val = s->imr_jazz;
453 break;
454 default:
455 qemu_log_mask(LOG_GUEST_ERROR,
456 "rc4030/jazzio: invalid read at 0x%x", (int)addr);
457 val = 0;
458 break;
459 }
460
461 trace_jazzio_read(addr, val);
462
463 return val;
464}
465
466static void jazzio_write(void *opaque, hwaddr addr, uint64_t data,
467 unsigned int size)
468{
469 rc4030State *s = opaque;
470 uint32_t val = data;
471 addr &= 0xfff;
472
473 trace_jazzio_write(addr, val);
474
475 switch (addr) {
476
477 case 0x02:
478 s->imr_jazz = val;
479 update_jazz_irq(s);
480 break;
481 default:
482 qemu_log_mask(LOG_GUEST_ERROR,
483 "rc4030/jazzio: invalid write of 0x%02x at 0x%x",
484 val, (int)addr);
485 break;
486 }
487}
488
489static const MemoryRegionOps jazzio_ops = {
490 .read = jazzio_read,
491 .write = jazzio_write,
492 .impl.min_access_size = 2,
493 .impl.max_access_size = 2,
494 .endianness = DEVICE_NATIVE_ENDIAN,
495};
496
497static IOMMUTLBEntry rc4030_dma_translate(IOMMUMemoryRegion *iommu, hwaddr addr,
498 IOMMUAccessFlags flag, int iommu_idx)
499{
500 rc4030State *s = container_of(iommu, rc4030State, dma_mr);
501 IOMMUTLBEntry ret = {
502 .target_as = &address_space_memory,
503 .iova = addr & ~(DMA_PAGESIZE - 1),
504 .translated_addr = 0,
505 .addr_mask = DMA_PAGESIZE - 1,
506 .perm = IOMMU_NONE,
507 };
508 uint64_t i, entry_address;
509 dma_pagetable_entry entry;
510
511 i = addr / DMA_PAGESIZE;
512 if (i < s->dma_tl_limit / sizeof(entry)) {
513 entry_address = (s->dma_tl_base & 0x7fffffff) + i * sizeof(entry);
514 if (address_space_read(ret.target_as, entry_address,
515 MEMTXATTRS_UNSPECIFIED, (unsigned char *)&entry,
516 sizeof(entry)) == MEMTX_OK) {
517 ret.translated_addr = entry.frame & ~(DMA_PAGESIZE - 1);
518 ret.perm = IOMMU_RW;
519 }
520 }
521
522 return ret;
523}
524
525static void rc4030_reset(DeviceState *dev)
526{
527 rc4030State *s = RC4030(dev);
528 int i;
529
530 s->config = 0x410;
531 s->revision = 1;
532 s->invalid_address_register = 0;
533
534 memset(s->dma_regs, 0, sizeof(s->dma_regs));
535
536 s->remote_failed_address = s->memory_failed_address = 0;
537 s->cache_maint = 0;
538 s->cache_ptag = s->cache_ltag = 0;
539 s->cache_bmask = 0;
540
541 s->memory_refresh_rate = 0x18186;
542 s->nvram_protect = 7;
543 for (i = 0; i < 15; i++) {
544 s->rem_speed[i] = 7;
545 }
546 s->imr_jazz = 0x10;
547 s->isr_jazz = 0;
548
549 s->itr = 0;
550
551 qemu_irq_lower(s->timer_irq);
552 qemu_irq_lower(s->jazz_bus_irq);
553}
554
555static int rc4030_post_load(void *opaque, int version_id)
556{
557 rc4030State *s = opaque;
558
559 set_next_tick(s);
560 update_jazz_irq(s);
561
562 return 0;
563}
564
565static const VMStateDescription vmstate_rc4030 = {
566 .name = "rc4030",
567 .version_id = 3,
568 .post_load = rc4030_post_load,
569 .fields = (VMStateField []) {
570 VMSTATE_UINT32(config, rc4030State),
571 VMSTATE_UINT32(invalid_address_register, rc4030State),
572 VMSTATE_UINT32_2DARRAY(dma_regs, rc4030State, 8, 4),
573 VMSTATE_UINT32(dma_tl_base, rc4030State),
574 VMSTATE_UINT32(dma_tl_limit, rc4030State),
575 VMSTATE_UINT32(cache_maint, rc4030State),
576 VMSTATE_UINT32(remote_failed_address, rc4030State),
577 VMSTATE_UINT32(memory_failed_address, rc4030State),
578 VMSTATE_UINT32(cache_ptag, rc4030State),
579 VMSTATE_UINT32(cache_ltag, rc4030State),
580 VMSTATE_UINT32(cache_bmask, rc4030State),
581 VMSTATE_UINT32(memory_refresh_rate, rc4030State),
582 VMSTATE_UINT32(nvram_protect, rc4030State),
583 VMSTATE_UINT32_ARRAY(rem_speed, rc4030State, 16),
584 VMSTATE_UINT32(imr_jazz, rc4030State),
585 VMSTATE_UINT32(isr_jazz, rc4030State),
586 VMSTATE_UINT32(itr, rc4030State),
587 VMSTATE_END_OF_LIST()
588 }
589};
590
591static void rc4030_do_dma(void *opaque, int n, uint8_t *buf, int len, int is_write)
592{
593 rc4030State *s = opaque;
594 hwaddr dma_addr;
595 int dev_to_mem;
596
597 s->dma_regs[n][DMA_REG_ENABLE] &=
598 ~(DMA_FLAG_TC_INTR | DMA_FLAG_MEM_INTR | DMA_FLAG_ADDR_INTR);
599
600
601 dev_to_mem = (s->dma_regs[n][DMA_REG_ENABLE] & DMA_FLAG_MEM_TO_DEV) ? 0 : 1;
602 if (!(s->dma_regs[n][DMA_REG_ENABLE] & DMA_FLAG_ENABLE) ||
603 (is_write != dev_to_mem)) {
604 s->dma_regs[n][DMA_REG_ENABLE] |= DMA_FLAG_MEM_INTR;
605 s->nmi_interrupt |= 1 << n;
606 return;
607 }
608
609
610 if (len > s->dma_regs[n][DMA_REG_COUNT]) {
611 len = s->dma_regs[n][DMA_REG_COUNT];
612 }
613 dma_addr = s->dma_regs[n][DMA_REG_ADDRESS];
614
615
616 address_space_rw(&s->dma_as, dma_addr, MEMTXATTRS_UNSPECIFIED,
617 buf, len, is_write);
618
619 s->dma_regs[n][DMA_REG_ENABLE] |= DMA_FLAG_TC_INTR;
620 s->dma_regs[n][DMA_REG_COUNT] -= len;
621}
622
623struct rc4030DMAState {
624 void *opaque;
625 int n;
626};
627
628void rc4030_dma_read(void *dma, uint8_t *buf, int len)
629{
630 rc4030_dma s = dma;
631 rc4030_do_dma(s->opaque, s->n, buf, len, 0);
632}
633
634void rc4030_dma_write(void *dma, uint8_t *buf, int len)
635{
636 rc4030_dma s = dma;
637 rc4030_do_dma(s->opaque, s->n, buf, len, 1);
638}
639
640static rc4030_dma *rc4030_allocate_dmas(void *opaque, int n)
641{
642 rc4030_dma *s;
643 struct rc4030DMAState *p;
644 int i;
645
646 s = (rc4030_dma *)g_malloc0(sizeof(rc4030_dma) * n);
647 p = (struct rc4030DMAState *)g_malloc0(sizeof(struct rc4030DMAState) * n);
648 for (i = 0; i < n; i++) {
649 p->opaque = opaque;
650 p->n = i;
651 s[i] = p;
652 p++;
653 }
654 return s;
655}
656
657static void rc4030_initfn(Object *obj)
658{
659 DeviceState *dev = DEVICE(obj);
660 rc4030State *s = RC4030(obj);
661 SysBusDevice *sysbus = SYS_BUS_DEVICE(obj);
662
663 qdev_init_gpio_in(dev, rc4030_irq_jazz_request, 16);
664
665 sysbus_init_irq(sysbus, &s->timer_irq);
666 sysbus_init_irq(sysbus, &s->jazz_bus_irq);
667
668 sysbus_init_mmio(sysbus, &s->iomem_chipset);
669 sysbus_init_mmio(sysbus, &s->iomem_jazzio);
670}
671
672static void rc4030_realize(DeviceState *dev, Error **errp)
673{
674 rc4030State *s = RC4030(dev);
675 Object *o = OBJECT(dev);
676
677 s->periodic_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,
678 rc4030_periodic_timer, s);
679
680 memory_region_init_io(&s->iomem_chipset, NULL, &rc4030_ops, s,
681 "rc4030.chipset", 0x300);
682 memory_region_init_io(&s->iomem_jazzio, NULL, &jazzio_ops, s,
683 "rc4030.jazzio", 0x00001000);
684
685 memory_region_init_iommu(&s->dma_mr, sizeof(s->dma_mr),
686 TYPE_RC4030_IOMMU_MEMORY_REGION,
687 o, "rc4030.dma", 4 * GiB);
688 address_space_init(&s->dma_as, MEMORY_REGION(&s->dma_mr), "rc4030-dma");
689}
690
691static void rc4030_unrealize(DeviceState *dev, Error **errp)
692{
693 rc4030State *s = RC4030(dev);
694
695 timer_free(s->periodic_timer);
696
697 address_space_destroy(&s->dma_as);
698 object_unparent(OBJECT(&s->dma_mr));
699}
700
701static void rc4030_class_init(ObjectClass *klass, void *class_data)
702{
703 DeviceClass *dc = DEVICE_CLASS(klass);
704
705 dc->realize = rc4030_realize;
706 dc->unrealize = rc4030_unrealize;
707 dc->reset = rc4030_reset;
708 dc->vmsd = &vmstate_rc4030;
709}
710
711static const TypeInfo rc4030_info = {
712 .name = TYPE_RC4030,
713 .parent = TYPE_SYS_BUS_DEVICE,
714 .instance_size = sizeof(rc4030State),
715 .instance_init = rc4030_initfn,
716 .class_init = rc4030_class_init,
717};
718
719static void rc4030_iommu_memory_region_class_init(ObjectClass *klass,
720 void *data)
721{
722 IOMMUMemoryRegionClass *imrc = IOMMU_MEMORY_REGION_CLASS(klass);
723
724 imrc->translate = rc4030_dma_translate;
725}
726
727static const TypeInfo rc4030_iommu_memory_region_info = {
728 .parent = TYPE_IOMMU_MEMORY_REGION,
729 .name = TYPE_RC4030_IOMMU_MEMORY_REGION,
730 .class_init = rc4030_iommu_memory_region_class_init,
731};
732
733static void rc4030_register_types(void)
734{
735 type_register_static(&rc4030_info);
736 type_register_static(&rc4030_iommu_memory_region_info);
737}
738
739type_init(rc4030_register_types)
740
741DeviceState *rc4030_init(rc4030_dma **dmas, IOMMUMemoryRegion **dma_mr)
742{
743 DeviceState *dev;
744
745 dev = qdev_create(NULL, TYPE_RC4030);
746 qdev_init_nofail(dev);
747
748 *dmas = rc4030_allocate_dmas(dev, 4);
749 *dma_mr = &RC4030(dev)->dma_mr;
750 return dev;
751}
752
