2 * ARM PrimeCell PL330 DMA Controller
4 * Copyright (c) 2009 Samsung Electronics.
5 * Contributed by Kirill Batuzov <batuzovk@ispras.ru>
6 * Copyright (c) 2012 Peter A.G. Crosthwaite (peter.crosthwaite@petalogix.com)
7 * Copyright (c) 2012 PetaLogix Pty Ltd.
9 * This program is free software; you can redistribute it and/or
10 * modify it under the terms of the GNU General Public License
11 * as published by the Free Software Foundation; version 2 or later.
13 * You should have received a copy of the GNU General Public License along
14 * with this program; if not, see <http://www.gnu.org/licenses/>.
17 #include "qemu/osdep.h"
18 #include "qemu-common.h"
19 #include "hw/sysbus.h"
20 #include "qapi/error.h"
21 #include "qemu/timer.h"
22 #include "sysemu/dma.h"
24 #include "qemu/module.h"
26 #ifndef PL330_ERR_DEBUG
27 #define PL330_ERR_DEBUG 0
30 #define DB_PRINT_L(lvl, fmt, args...) do {\
31 if (PL330_ERR_DEBUG >= lvl) {\
32 fprintf(stderr, "PL330: %s:" fmt, __func__, ## args);\
36 #define DB_PRINT(fmt, args...) DB_PRINT_L(1, fmt, ## args)
38 #define PL330_PERIPH_NUM 32
39 #define PL330_MAX_BURST_LEN 128
40 #define PL330_INSN_MAXSIZE 6
42 #define PL330_FIFO_OK 0
43 #define PL330_FIFO_STALL 1
44 #define PL330_FIFO_ERR (-1)
46 #define PL330_FAULT_UNDEF_INSTR (1 << 0)
47 #define PL330_FAULT_OPERAND_INVALID (1 << 1)
48 #define PL330_FAULT_DMAGO_ERR (1 << 4)
49 #define PL330_FAULT_EVENT_ERR (1 << 5)
50 #define PL330_FAULT_CH_PERIPH_ERR (1 << 6)
51 #define PL330_FAULT_CH_RDWR_ERR (1 << 7)
52 #define PL330_FAULT_ST_DATA_UNAVAILABLE (1 << 12)
53 #define PL330_FAULT_FIFOEMPTY_ERR (1 << 13)
54 #define PL330_FAULT_INSTR_FETCH_ERR (1 << 16)
55 #define PL330_FAULT_DATA_WRITE_ERR (1 << 17)
56 #define PL330_FAULT_DATA_READ_ERR (1 << 18)
57 #define PL330_FAULT_DBG_INSTR (1 << 30)
58 #define PL330_FAULT_LOCKUP_ERR (1 << 31)
60 #define PL330_UNTAGGED 0xff
62 #define PL330_SINGLE 0x0
63 #define PL330_BURST 0x1
65 #define PL330_WATCHDOG_LIMIT 1024
67 /* IOMEM mapped registers */
68 #define PL330_REG_DSR 0x000
69 #define PL330_REG_DPC 0x004
70 #define PL330_REG_INTEN 0x020
71 #define PL330_REG_INT_EVENT_RIS 0x024
72 #define PL330_REG_INTMIS 0x028
73 #define PL330_REG_INTCLR 0x02C
74 #define PL330_REG_FSRD 0x030
75 #define PL330_REG_FSRC 0x034
76 #define PL330_REG_FTRD 0x038
77 #define PL330_REG_FTR_BASE 0x040
78 #define PL330_REG_CSR_BASE 0x100
79 #define PL330_REG_CPC_BASE 0x104
80 #define PL330_REG_CHANCTRL 0x400
81 #define PL330_REG_DBGSTATUS 0xD00
82 #define PL330_REG_DBGCMD 0xD04
83 #define PL330_REG_DBGINST0 0xD08
84 #define PL330_REG_DBGINST1 0xD0C
85 #define PL330_REG_CR0_BASE 0xE00
86 #define PL330_REG_PERIPH_ID 0xFE0
88 #define PL330_IOMEM_SIZE 0x1000
90 #define CFG_BOOT_ADDR 2
95 static const uint32_t pl330_id
[] = {
96 0x30, 0x13, 0x24, 0x00, 0x0D, 0xF0, 0x05, 0xB1
99 /* DMA channel states as they are described in PL330 Technical Reference Manual
100 * Most of them will not be used in emulation.
103 pl330_chan_stopped
= 0,
104 pl330_chan_executing
= 1,
105 pl330_chan_cache_miss
= 2,
106 pl330_chan_updating_pc
= 3,
107 pl330_chan_waiting_event
= 4,
108 pl330_chan_at_barrier
= 5,
109 pl330_chan_queue_busy
= 6,
110 pl330_chan_waiting_periph
= 7,
111 pl330_chan_killing
= 8,
112 pl330_chan_completing
= 9,
113 pl330_chan_fault_completing
= 14,
114 pl330_chan_fault
= 15,
117 typedef struct PL330State PL330State
;
119 typedef struct PL330Chan
{
127 uint32_t watchdog_timer
;
130 uint8_t request_flag
;
142 static const VMStateDescription vmstate_pl330_chan
= {
143 .name
= "pl330_chan",
145 .minimum_version_id
= 1,
146 .fields
= (VMStateField
[]) {
147 VMSTATE_UINT32(src
, PL330Chan
),
148 VMSTATE_UINT32(dst
, PL330Chan
),
149 VMSTATE_UINT32(pc
, PL330Chan
),
150 VMSTATE_UINT32(control
, PL330Chan
),
151 VMSTATE_UINT32(status
, PL330Chan
),
152 VMSTATE_UINT32_ARRAY(lc
, PL330Chan
, 2),
153 VMSTATE_UINT32(fault_type
, PL330Chan
),
154 VMSTATE_UINT32(watchdog_timer
, PL330Chan
),
155 VMSTATE_BOOL(ns
, PL330Chan
),
156 VMSTATE_UINT8(request_flag
, PL330Chan
),
157 VMSTATE_UINT8(wakeup
, PL330Chan
),
158 VMSTATE_UINT8(wfp_sbp
, PL330Chan
),
159 VMSTATE_UINT8(state
, PL330Chan
),
160 VMSTATE_UINT8(stall
, PL330Chan
),
161 VMSTATE_END_OF_LIST()
165 typedef struct PL330Fifo
{
173 static const VMStateDescription vmstate_pl330_fifo
= {
174 .name
= "pl330_chan",
176 .minimum_version_id
= 1,
177 .fields
= (VMStateField
[]) {
178 VMSTATE_VBUFFER_UINT32(buf
, PL330Fifo
, 1, NULL
, buf_size
),
179 VMSTATE_VBUFFER_UINT32(tag
, PL330Fifo
, 1, NULL
, buf_size
),
180 VMSTATE_UINT32(head
, PL330Fifo
),
181 VMSTATE_UINT32(num
, PL330Fifo
),
182 VMSTATE_UINT32(buf_size
, PL330Fifo
),
183 VMSTATE_END_OF_LIST()
187 typedef struct PL330QueueEntry
{
197 static const VMStateDescription vmstate_pl330_queue_entry
= {
198 .name
= "pl330_queue_entry",
200 .minimum_version_id
= 1,
201 .fields
= (VMStateField
[]) {
202 VMSTATE_UINT32(addr
, PL330QueueEntry
),
203 VMSTATE_UINT32(len
, PL330QueueEntry
),
204 VMSTATE_UINT8(n
, PL330QueueEntry
),
205 VMSTATE_BOOL(inc
, PL330QueueEntry
),
206 VMSTATE_BOOL(z
, PL330QueueEntry
),
207 VMSTATE_UINT8(tag
, PL330QueueEntry
),
208 VMSTATE_UINT8(seqn
, PL330QueueEntry
),
209 VMSTATE_END_OF_LIST()
213 typedef struct PL330Queue
{
215 PL330QueueEntry
*queue
;
219 static const VMStateDescription vmstate_pl330_queue
= {
220 .name
= "pl330_queue",
222 .minimum_version_id
= 2,
223 .fields
= (VMStateField
[]) {
224 VMSTATE_STRUCT_VARRAY_POINTER_UINT32(queue
, PL330Queue
, queue_size
,
225 vmstate_pl330_queue_entry
,
227 VMSTATE_END_OF_LIST()
232 SysBusDevice parent_obj
;
238 /* Config registers. cfg[5] = CfgDn. */
240 #define EVENT_SEC_STATE 3
241 #define PERIPH_SEC_STATE 4
242 /* cfg 0 bits and pieces */
244 uint8_t num_periph_req
;
246 uint8_t mgr_ns_at_rst
;
247 /* cfg 1 bits and pieces */
249 uint8_t num_i_cache_lines
;
250 /* CRD bits and pieces */
256 uint16_t data_buffer_dep
;
261 PL330Queue read_queue
;
262 PL330Queue write_queue
;
265 QEMUTimer
*timer
; /* is used for restore dma. */
271 uint8_t debug_status
;
272 uint8_t num_faulting
;
273 uint8_t periph_busy
[PL330_PERIPH_NUM
];
277 #define TYPE_PL330 "pl330"
278 #define PL330(obj) OBJECT_CHECK(PL330State, (obj), TYPE_PL330)
280 static const VMStateDescription vmstate_pl330
= {
283 .minimum_version_id
= 2,
284 .fields
= (VMStateField
[]) {
285 VMSTATE_STRUCT(manager
, PL330State
, 0, vmstate_pl330_chan
, PL330Chan
),
286 VMSTATE_STRUCT_VARRAY_POINTER_UINT32(chan
, PL330State
, num_chnls
,
287 vmstate_pl330_chan
, PL330Chan
),
288 VMSTATE_VBUFFER_UINT32(lo_seqn
, PL330State
, 1, NULL
, num_chnls
),
289 VMSTATE_VBUFFER_UINT32(hi_seqn
, PL330State
, 1, NULL
, num_chnls
),
290 VMSTATE_STRUCT(fifo
, PL330State
, 0, vmstate_pl330_fifo
, PL330Fifo
),
291 VMSTATE_STRUCT(read_queue
, PL330State
, 0, vmstate_pl330_queue
,
293 VMSTATE_STRUCT(write_queue
, PL330State
, 0, vmstate_pl330_queue
,
295 VMSTATE_TIMER_PTR(timer
, PL330State
),
296 VMSTATE_UINT32(inten
, PL330State
),
297 VMSTATE_UINT32(int_status
, PL330State
),
298 VMSTATE_UINT32(ev_status
, PL330State
),
299 VMSTATE_UINT32_ARRAY(dbg
, PL330State
, 2),
300 VMSTATE_UINT8(debug_status
, PL330State
),
301 VMSTATE_UINT8(num_faulting
, PL330State
),
302 VMSTATE_UINT8_ARRAY(periph_busy
, PL330State
, PL330_PERIPH_NUM
),
303 VMSTATE_END_OF_LIST()
307 typedef struct PL330InsnDesc
{
308 /* OPCODE of the instruction */
310 /* Mask so we can select several sibling instructions, such as
311 DMALD, DMALDS and DMALDB */
313 /* Size of instruction in bytes */
316 void (*exec
)(PL330Chan
*, uint8_t opcode
, uint8_t *args
, int len
);
320 /* MFIFO Implementation
322 * MFIFO is implemented as a cyclic buffer of BUF_SIZE size. Tagged bytes are
323 * stored in this buffer. Data is stored in BUF field, tags - in the
324 * corresponding array elements of TAG field.
327 /* Initialize queue. */
329 static void pl330_fifo_init(PL330Fifo
*s
, uint32_t size
)
331 s
->buf
= g_malloc0(size
);
332 s
->tag
= g_malloc0(size
);
336 /* Cyclic increment */
338 static inline int pl330_fifo_inc(PL330Fifo
*s
, int x
)
340 return (x
+ 1) % s
->buf_size
;
343 /* Number of empty bytes in MFIFO */
345 static inline int pl330_fifo_num_free(PL330Fifo
*s
)
347 return s
->buf_size
- s
->num
;
350 /* Push LEN bytes of data stored in BUF to MFIFO and tag it with TAG.
351 * Zero returned on success, PL330_FIFO_STALL if there is no enough free
352 * space in MFIFO to store requested amount of data. If push was unsuccessful
353 * no data is stored to MFIFO.
356 static int pl330_fifo_push(PL330Fifo
*s
, uint8_t *buf
, int len
, uint8_t tag
)
360 if (s
->buf_size
- s
->num
< len
) {
361 return PL330_FIFO_STALL
;
363 for (i
= 0; i
< len
; i
++) {
364 int push_idx
= (s
->head
+ s
->num
+ i
) % s
->buf_size
;
365 s
->buf
[push_idx
] = buf
[i
];
366 s
->tag
[push_idx
] = tag
;
369 return PL330_FIFO_OK
;
372 /* Get LEN bytes of data from MFIFO and store it to BUF. Tag value of each
373 * byte is verified. Zero returned on success, PL330_FIFO_ERR on tag mismatch
374 * and PL330_FIFO_STALL if there is no enough data in MFIFO. If get was
375 * unsuccessful no data is removed from MFIFO.
378 static int pl330_fifo_get(PL330Fifo
*s
, uint8_t *buf
, int len
, uint8_t tag
)
383 return PL330_FIFO_STALL
;
385 for (i
= 0; i
< len
; i
++) {
386 if (s
->tag
[s
->head
] == tag
) {
387 int get_idx
= (s
->head
+ i
) % s
->buf_size
;
388 buf
[i
] = s
->buf
[get_idx
];
389 } else { /* Tag mismatch - Rollback transaction */
390 return PL330_FIFO_ERR
;
393 s
->head
= (s
->head
+ len
) % s
->buf_size
;
395 return PL330_FIFO_OK
;
398 /* Reset MFIFO. This completely erases all data in it. */
400 static inline void pl330_fifo_reset(PL330Fifo
*s
)
406 /* Return tag of the first byte stored in MFIFO. If MFIFO is empty
407 * PL330_UNTAGGED is returned.
410 static inline uint8_t pl330_fifo_tag(PL330Fifo
*s
)
412 return (!s
->num
) ? PL330_UNTAGGED
: s
->tag
[s
->head
];
415 /* Returns non-zero if tag TAG is present in fifo or zero otherwise */
417 static int pl330_fifo_has_tag(PL330Fifo
*s
, uint8_t tag
)
422 for (n
= 0; n
< s
->num
; n
++) {
423 if (s
->tag
[i
] == tag
) {
426 i
= pl330_fifo_inc(s
, i
);
431 /* Remove all entry tagged with TAG from MFIFO */
433 static void pl330_fifo_tagged_remove(PL330Fifo
*s
, uint8_t tag
)
438 for (n
= 0; n
< s
->num
; n
++) {
439 if (s
->tag
[i
] != tag
) {
440 s
->buf
[t
] = s
->buf
[i
];
441 s
->tag
[t
] = s
->tag
[i
];
442 t
= pl330_fifo_inc(s
, t
);
446 i
= pl330_fifo_inc(s
, i
);
450 /* Read-Write Queue implementation
452 * A Read-Write Queue stores up to QUEUE_SIZE instructions (loads or stores).
453 * Each instruction is described by source (for loads) or destination (for
454 * stores) address ADDR, width of data to be loaded/stored LEN, number of
455 * stores/loads to be performed N, INC bit, Z bit and TAG to identify channel
456 * this instruction belongs to. Queue does not store any information about
457 * nature of the instruction: is it load or store. PL330 has different queues
458 * for loads and stores so this is already known at the top level where it
461 * Queue works as FIFO for instructions with equivalent tags, but can issue
462 * instructions with different tags in arbitrary order. SEQN field attached to
463 * each instruction helps to achieve this. For each TAG queue contains
464 * instructions with consecutive SEQN values ranging from LO_SEQN[TAG] to
465 * HI_SEQN[TAG]-1 inclusive. SEQN is 8-bit unsigned integer, so SEQN=255 is
466 * followed by SEQN=0.
468 * Z bit indicates that zeroes should be stored. No MFIFO fetches are performed
472 static void pl330_queue_reset(PL330Queue
*s
)
476 for (i
= 0; i
< s
->queue_size
; i
++) {
477 s
->queue
[i
].tag
= PL330_UNTAGGED
;
481 /* Initialize queue */
482 static void pl330_queue_init(PL330Queue
*s
, int size
, PL330State
*parent
)
485 s
->queue
= g_new0(PL330QueueEntry
, size
);
486 s
->queue_size
= size
;
489 /* Returns pointer to an empty slot or NULL if queue is full */
490 static PL330QueueEntry
*pl330_queue_find_empty(PL330Queue
*s
)
494 for (i
= 0; i
< s
->queue_size
; i
++) {
495 if (s
->queue
[i
].tag
== PL330_UNTAGGED
) {
502 /* Put instruction in queue.
505 * - non-zero - queue is full
508 static int pl330_queue_put_insn(PL330Queue
*s
, uint32_t addr
,
509 int len
, int n
, bool inc
, bool z
, uint8_t tag
)
511 PL330QueueEntry
*entry
= pl330_queue_find_empty(s
);
522 entry
->seqn
= s
->parent
->hi_seqn
[tag
];
523 s
->parent
->hi_seqn
[tag
]++;
527 /* Returns a pointer to queue slot containing instruction which satisfies
528 * following conditions:
529 * - it has valid tag value (not PL330_UNTAGGED)
530 * - if enforce_seq is set it has to be issuable without violating queue
532 * - if TAG argument is not PL330_UNTAGGED this instruction has tag value
533 * equivalent to the argument TAG value.
534 * If such instruction cannot be found NULL is returned.
537 static PL330QueueEntry
*pl330_queue_find_insn(PL330Queue
*s
, uint8_t tag
,
542 for (i
= 0; i
< s
->queue_size
; i
++) {
543 if (s
->queue
[i
].tag
!= PL330_UNTAGGED
) {
545 s
->queue
[i
].seqn
== s
->parent
->lo_seqn
[s
->queue
[i
].tag
]) &&
546 (s
->queue
[i
].tag
== tag
|| tag
== PL330_UNTAGGED
||
555 /* Removes instruction from queue. */
557 static inline void pl330_queue_remove_insn(PL330Queue
*s
, PL330QueueEntry
*e
)
559 s
->parent
->lo_seqn
[e
->tag
]++;
560 e
->tag
= PL330_UNTAGGED
;
563 /* Removes all instructions tagged with TAG from queue. */
565 static inline void pl330_queue_remove_tagged(PL330Queue
*s
, uint8_t tag
)
569 for (i
= 0; i
< s
->queue_size
; i
++) {
570 if (s
->queue
[i
].tag
== tag
) {
571 s
->queue
[i
].tag
= PL330_UNTAGGED
;
576 /* DMA instruction execution engine */
578 /* Moves DMA channel to the FAULT state and updates it's status. */
580 static inline void pl330_fault(PL330Chan
*ch
, uint32_t flags
)
582 DB_PRINT("ch: %p, flags: %" PRIx32
"\n", ch
, flags
);
583 ch
->fault_type
|= flags
;
584 if (ch
->state
== pl330_chan_fault
) {
587 ch
->state
= pl330_chan_fault
;
588 ch
->parent
->num_faulting
++;
589 if (ch
->parent
->num_faulting
== 1) {
590 DB_PRINT("abort interrupt raised\n");
591 qemu_irq_raise(ch
->parent
->irq_abort
);
596 * For information about instructions see PL330 Technical Reference Manual.
599 * CH - channel executing the instruction
601 * ARGS - array of 8-bit arguments
602 * LEN - number of elements in ARGS array
605 static void pl330_dmaadxh(PL330Chan
*ch
, uint8_t *args
, bool ra
, bool neg
)
607 uint32_t im
= (args
[1] << 8) | args
[0];
612 if (ch
->is_manager
) {
613 pl330_fault(ch
, PL330_FAULT_UNDEF_INSTR
);
623 static void pl330_dmaaddh(PL330Chan
*ch
, uint8_t opcode
, uint8_t *args
, int len
)
625 pl330_dmaadxh(ch
, args
, extract32(opcode
, 1, 1), false);
628 static void pl330_dmaadnh(PL330Chan
*ch
, uint8_t opcode
, uint8_t *args
, int len
)
630 pl330_dmaadxh(ch
, args
, extract32(opcode
, 1, 1), true);
633 static void pl330_dmaend(PL330Chan
*ch
, uint8_t opcode
,
634 uint8_t *args
, int len
)
636 PL330State
*s
= ch
->parent
;
638 if (ch
->state
== pl330_chan_executing
&& !ch
->is_manager
) {
639 /* Wait for all transfers to complete */
640 if (pl330_fifo_has_tag(&s
->fifo
, ch
->tag
) ||
641 pl330_queue_find_insn(&s
->read_queue
, ch
->tag
, false) != NULL
||
642 pl330_queue_find_insn(&s
->write_queue
, ch
->tag
, false) != NULL
) {
648 DB_PRINT("DMA ending!\n");
649 pl330_fifo_tagged_remove(&s
->fifo
, ch
->tag
);
650 pl330_queue_remove_tagged(&s
->read_queue
, ch
->tag
);
651 pl330_queue_remove_tagged(&s
->write_queue
, ch
->tag
);
652 ch
->state
= pl330_chan_stopped
;
655 static void pl330_dmaflushp(PL330Chan
*ch
, uint8_t opcode
,
656 uint8_t *args
, int len
)
661 pl330_fault(ch
, PL330_FAULT_OPERAND_INVALID
);
664 periph_id
= (args
[0] >> 3) & 0x1f;
665 if (periph_id
>= ch
->parent
->num_periph_req
) {
666 pl330_fault(ch
, PL330_FAULT_OPERAND_INVALID
);
669 if (ch
->ns
&& !(ch
->parent
->cfg
[CFG_PNS
] & (1 << periph_id
))) {
670 pl330_fault(ch
, PL330_FAULT_CH_PERIPH_ERR
);
676 static void pl330_dmago(PL330Chan
*ch
, uint8_t opcode
, uint8_t *args
, int len
)
685 if (!ch
->is_manager
) {
686 pl330_fault(ch
, PL330_FAULT_UNDEF_INSTR
);
690 chan_id
= args
[0] & 7;
691 if ((args
[0] >> 3)) {
692 pl330_fault(ch
, PL330_FAULT_OPERAND_INVALID
);
695 if (chan_id
>= ch
->parent
->num_chnls
) {
696 pl330_fault(ch
, PL330_FAULT_OPERAND_INVALID
);
699 pc
= (((uint32_t)args
[4]) << 24) | (((uint32_t)args
[3]) << 16) |
700 (((uint32_t)args
[2]) << 8) | (((uint32_t)args
[1]));
701 if (ch
->parent
->chan
[chan_id
].state
!= pl330_chan_stopped
) {
702 pl330_fault(ch
, PL330_FAULT_OPERAND_INVALID
);
706 pl330_fault(ch
, PL330_FAULT_DMAGO_ERR
);
709 s
= &ch
->parent
->chan
[chan_id
];
712 s
->state
= pl330_chan_executing
;
715 static void pl330_dmald(PL330Chan
*ch
, uint8_t opcode
, uint8_t *args
, int len
)
717 uint8_t bs
= opcode
& 3;
722 pl330_fault(ch
, PL330_FAULT_OPERAND_INVALID
);
725 if ((bs
== 1 && ch
->request_flag
== PL330_BURST
) ||
726 (bs
== 3 && ch
->request_flag
== PL330_SINGLE
)) {
730 if (bs
== 1 && ch
->request_flag
== PL330_SINGLE
) {
733 num
= ((ch
->control
>> 4) & 0xf) + 1;
735 size
= (uint32_t)1 << ((ch
->control
>> 1) & 0x7);
736 inc
= !!(ch
->control
& 1);
737 ch
->stall
= pl330_queue_put_insn(&ch
->parent
->read_queue
, ch
->src
,
738 size
, num
, inc
, 0, ch
->tag
);
740 DB_PRINT("channel:%" PRId8
" address:%08" PRIx32
" size:%" PRIx32
741 " num:%" PRId32
" %c\n",
742 ch
->tag
, ch
->src
, size
, num
, inc
? 'Y' : 'N');
743 ch
->src
+= inc
? size
* num
- (ch
->src
& (size
- 1)) : 0;
747 static void pl330_dmaldp(PL330Chan
*ch
, uint8_t opcode
, uint8_t *args
, int len
)
752 pl330_fault(ch
, PL330_FAULT_OPERAND_INVALID
);
755 periph_id
= (args
[0] >> 3) & 0x1f;
756 if (periph_id
>= ch
->parent
->num_periph_req
) {
757 pl330_fault(ch
, PL330_FAULT_OPERAND_INVALID
);
760 if (ch
->ns
&& !(ch
->parent
->cfg
[CFG_PNS
] & (1 << periph_id
))) {
761 pl330_fault(ch
, PL330_FAULT_CH_PERIPH_ERR
);
764 pl330_dmald(ch
, opcode
, args
, len
);
767 static void pl330_dmalp(PL330Chan
*ch
, uint8_t opcode
, uint8_t *args
, int len
)
769 uint8_t lc
= (opcode
& 2) >> 1;
771 ch
->lc
[lc
] = args
[0];
774 static void pl330_dmakill(PL330Chan
*ch
, uint8_t opcode
, uint8_t *args
, int len
)
776 if (ch
->state
== pl330_chan_fault
||
777 ch
->state
== pl330_chan_fault_completing
) {
778 /* This is the only way for a channel to leave the faulting state */
780 ch
->parent
->num_faulting
--;
781 if (ch
->parent
->num_faulting
== 0) {
782 DB_PRINT("abort interrupt lowered\n");
783 qemu_irq_lower(ch
->parent
->irq_abort
);
786 ch
->state
= pl330_chan_killing
;
787 pl330_fifo_tagged_remove(&ch
->parent
->fifo
, ch
->tag
);
788 pl330_queue_remove_tagged(&ch
->parent
->read_queue
, ch
->tag
);
789 pl330_queue_remove_tagged(&ch
->parent
->write_queue
, ch
->tag
);
790 ch
->state
= pl330_chan_stopped
;
793 static void pl330_dmalpend(PL330Chan
*ch
, uint8_t opcode
,
794 uint8_t *args
, int len
)
796 uint8_t nf
= (opcode
& 0x10) >> 4;
797 uint8_t bs
= opcode
& 3;
798 uint8_t lc
= (opcode
& 4) >> 2;
801 pl330_fault(ch
, PL330_FAULT_OPERAND_INVALID
);
804 if ((bs
== 1 && ch
->request_flag
== PL330_BURST
) ||
805 (bs
== 3 && ch
->request_flag
== PL330_SINGLE
)) {
809 if (!nf
|| ch
->lc
[lc
]) {
813 DB_PRINT("loop reiteration\n");
816 /* "ch->pc -= args[0] + len + 1" is incorrect when args[0] == 256 */
818 DB_PRINT("loop fallthrough\n");
823 static void pl330_dmamov(PL330Chan
*ch
, uint8_t opcode
, uint8_t *args
, int len
)
825 uint8_t rd
= args
[0] & 7;
828 if ((args
[0] >> 3)) {
829 pl330_fault(ch
, PL330_FAULT_OPERAND_INVALID
);
832 im
= (((uint32_t)args
[4]) << 24) | (((uint32_t)args
[3]) << 16) |
833 (((uint32_t)args
[2]) << 8) | (((uint32_t)args
[1]));
845 pl330_fault(ch
, PL330_FAULT_OPERAND_INVALID
);
850 static void pl330_dmanop(PL330Chan
*ch
, uint8_t opcode
,
851 uint8_t *args
, int len
)
856 static void pl330_dmarmb(PL330Chan
*ch
, uint8_t opcode
, uint8_t *args
, int len
)
858 if (pl330_queue_find_insn(&ch
->parent
->read_queue
, ch
->tag
, false)) {
859 ch
->state
= pl330_chan_at_barrier
;
863 ch
->state
= pl330_chan_executing
;
867 static void pl330_dmasev(PL330Chan
*ch
, uint8_t opcode
, uint8_t *args
, int len
)
872 pl330_fault(ch
, PL330_FAULT_OPERAND_INVALID
);
875 ev_id
= (args
[0] >> 3) & 0x1f;
876 if (ev_id
>= ch
->parent
->num_events
) {
877 pl330_fault(ch
, PL330_FAULT_OPERAND_INVALID
);
880 if (ch
->ns
&& !(ch
->parent
->cfg
[CFG_INS
] & (1 << ev_id
))) {
881 pl330_fault(ch
, PL330_FAULT_EVENT_ERR
);
884 if (ch
->parent
->inten
& (1 << ev_id
)) {
885 ch
->parent
->int_status
|= (1 << ev_id
);
886 DB_PRINT("event interrupt raised %" PRId8
"\n", ev_id
);
887 qemu_irq_raise(ch
->parent
->irq
[ev_id
]);
889 DB_PRINT("event raised %" PRId8
"\n", ev_id
);
890 ch
->parent
->ev_status
|= (1 << ev_id
);
893 static void pl330_dmast(PL330Chan
*ch
, uint8_t opcode
, uint8_t *args
, int len
)
895 uint8_t bs
= opcode
& 3;
900 pl330_fault(ch
, PL330_FAULT_OPERAND_INVALID
);
903 if ((bs
== 1 && ch
->request_flag
== PL330_BURST
) ||
904 (bs
== 3 && ch
->request_flag
== PL330_SINGLE
)) {
908 num
= ((ch
->control
>> 18) & 0xf) + 1;
909 size
= (uint32_t)1 << ((ch
->control
>> 15) & 0x7);
910 inc
= !!((ch
->control
>> 14) & 1);
911 ch
->stall
= pl330_queue_put_insn(&ch
->parent
->write_queue
, ch
->dst
,
912 size
, num
, inc
, 0, ch
->tag
);
914 DB_PRINT("channel:%" PRId8
" address:%08" PRIx32
" size:%" PRIx32
915 " num:%" PRId32
" %c\n",
916 ch
->tag
, ch
->dst
, size
, num
, inc
? 'Y' : 'N');
917 ch
->dst
+= inc
? size
* num
- (ch
->dst
& (size
- 1)) : 0;
921 static void pl330_dmastp(PL330Chan
*ch
, uint8_t opcode
,
922 uint8_t *args
, int len
)
927 pl330_fault(ch
, PL330_FAULT_OPERAND_INVALID
);
930 periph_id
= (args
[0] >> 3) & 0x1f;
931 if (periph_id
>= ch
->parent
->num_periph_req
) {
932 pl330_fault(ch
, PL330_FAULT_OPERAND_INVALID
);
935 if (ch
->ns
&& !(ch
->parent
->cfg
[CFG_PNS
] & (1 << periph_id
))) {
936 pl330_fault(ch
, PL330_FAULT_CH_PERIPH_ERR
);
939 pl330_dmast(ch
, opcode
, args
, len
);
942 static void pl330_dmastz(PL330Chan
*ch
, uint8_t opcode
,
943 uint8_t *args
, int len
)
948 num
= ((ch
->control
>> 18) & 0xf) + 1;
949 size
= (uint32_t)1 << ((ch
->control
>> 15) & 0x7);
950 inc
= !!((ch
->control
>> 14) & 1);
951 ch
->stall
= pl330_queue_put_insn(&ch
->parent
->write_queue
, ch
->dst
,
952 size
, num
, inc
, 1, ch
->tag
);
954 ch
->dst
+= size
* num
;
958 static void pl330_dmawfe(PL330Chan
*ch
, uint8_t opcode
,
959 uint8_t *args
, int len
)
965 pl330_fault(ch
, PL330_FAULT_OPERAND_INVALID
);
968 ev_id
= (args
[0] >> 3) & 0x1f;
969 if (ev_id
>= ch
->parent
->num_events
) {
970 pl330_fault(ch
, PL330_FAULT_OPERAND_INVALID
);
973 if (ch
->ns
&& !(ch
->parent
->cfg
[CFG_INS
] & (1 << ev_id
))) {
974 pl330_fault(ch
, PL330_FAULT_EVENT_ERR
);
978 ch
->state
= pl330_chan_waiting_event
;
979 if (~ch
->parent
->inten
& ch
->parent
->ev_status
& 1 << ev_id
) {
980 ch
->state
= pl330_chan_executing
;
981 /* If anyone else is currently waiting on the same event, let them
982 * clear the ev_status so they pick up event as well
984 for (i
= 0; i
< ch
->parent
->num_chnls
; ++i
) {
985 PL330Chan
*peer
= &ch
->parent
->chan
[i
];
986 if (peer
->state
== pl330_chan_waiting_event
&&
987 peer
->wakeup
== ev_id
) {
991 ch
->parent
->ev_status
&= ~(1 << ev_id
);
992 DB_PRINT("event lowered %" PRIx8
"\n", ev_id
);
998 static void pl330_dmawfp(PL330Chan
*ch
, uint8_t opcode
,
999 uint8_t *args
, int len
)
1001 uint8_t bs
= opcode
& 3;
1005 pl330_fault(ch
, PL330_FAULT_OPERAND_INVALID
);
1008 periph_id
= (args
[0] >> 3) & 0x1f;
1009 if (periph_id
>= ch
->parent
->num_periph_req
) {
1010 pl330_fault(ch
, PL330_FAULT_OPERAND_INVALID
);
1013 if (ch
->ns
&& !(ch
->parent
->cfg
[CFG_PNS
] & (1 << periph_id
))) {
1014 pl330_fault(ch
, PL330_FAULT_CH_PERIPH_ERR
);
1019 ch
->request_flag
= PL330_SINGLE
;
1023 ch
->request_flag
= PL330_BURST
;
1027 ch
->request_flag
= PL330_BURST
;
1031 pl330_fault(ch
, PL330_FAULT_OPERAND_INVALID
);
1035 if (ch
->parent
->periph_busy
[periph_id
]) {
1036 ch
->state
= pl330_chan_waiting_periph
;
1038 } else if (ch
->state
== pl330_chan_waiting_periph
) {
1039 ch
->state
= pl330_chan_executing
;
1043 static void pl330_dmawmb(PL330Chan
*ch
, uint8_t opcode
,
1044 uint8_t *args
, int len
)
1046 if (pl330_queue_find_insn(&ch
->parent
->write_queue
, ch
->tag
, false)) {
1047 ch
->state
= pl330_chan_at_barrier
;
1051 ch
->state
= pl330_chan_executing
;
1055 /* NULL terminated array of the instruction descriptions. */
1056 static const PL330InsnDesc insn_desc
[] = {
1057 { .opcode
= 0x54, .opmask
= 0xFD, .size
= 3, .exec
= pl330_dmaaddh
, },
1058 { .opcode
= 0x5c, .opmask
= 0xFD, .size
= 3, .exec
= pl330_dmaadnh
, },
1059 { .opcode
= 0x00, .opmask
= 0xFF, .size
= 1, .exec
= pl330_dmaend
, },
1060 { .opcode
= 0x35, .opmask
= 0xFF, .size
= 2, .exec
= pl330_dmaflushp
, },
1061 { .opcode
= 0xA0, .opmask
= 0xFD, .size
= 6, .exec
= pl330_dmago
, },
1062 { .opcode
= 0x04, .opmask
= 0xFC, .size
= 1, .exec
= pl330_dmald
, },
1063 { .opcode
= 0x25, .opmask
= 0xFD, .size
= 2, .exec
= pl330_dmaldp
, },
1064 { .opcode
= 0x20, .opmask
= 0xFD, .size
= 2, .exec
= pl330_dmalp
, },
1065 /* dmastp must be before dmalpend in this list, because their maps
1068 { .opcode
= 0x29, .opmask
= 0xFD, .size
= 2, .exec
= pl330_dmastp
, },
1069 { .opcode
= 0x28, .opmask
= 0xE8, .size
= 2, .exec
= pl330_dmalpend
, },
1070 { .opcode
= 0x01, .opmask
= 0xFF, .size
= 1, .exec
= pl330_dmakill
, },
1071 { .opcode
= 0xBC, .opmask
= 0xFF, .size
= 6, .exec
= pl330_dmamov
, },
1072 { .opcode
= 0x18, .opmask
= 0xFF, .size
= 1, .exec
= pl330_dmanop
, },
1073 { .opcode
= 0x12, .opmask
= 0xFF, .size
= 1, .exec
= pl330_dmarmb
, },
1074 { .opcode
= 0x34, .opmask
= 0xFF, .size
= 2, .exec
= pl330_dmasev
, },
1075 { .opcode
= 0x08, .opmask
= 0xFC, .size
= 1, .exec
= pl330_dmast
, },
1076 { .opcode
= 0x0C, .opmask
= 0xFF, .size
= 1, .exec
= pl330_dmastz
, },
1077 { .opcode
= 0x36, .opmask
= 0xFF, .size
= 2, .exec
= pl330_dmawfe
, },
1078 { .opcode
= 0x30, .opmask
= 0xFC, .size
= 2, .exec
= pl330_dmawfp
, },
1079 { .opcode
= 0x13, .opmask
= 0xFF, .size
= 1, .exec
= pl330_dmawmb
, },
1080 { .opcode
= 0x00, .opmask
= 0x00, .size
= 0, .exec
= NULL
, }
1083 /* Instructions which can be issued via debug registers. */
1084 static const PL330InsnDesc debug_insn_desc
[] = {
1085 { .opcode
= 0xA0, .opmask
= 0xFD, .size
= 6, .exec
= pl330_dmago
, },
1086 { .opcode
= 0x01, .opmask
= 0xFF, .size
= 1, .exec
= pl330_dmakill
, },
1087 { .opcode
= 0x34, .opmask
= 0xFF, .size
= 2, .exec
= pl330_dmasev
, },
1088 { .opcode
= 0x00, .opmask
= 0x00, .size
= 0, .exec
= NULL
, }
1091 static inline const PL330InsnDesc
*pl330_fetch_insn(PL330Chan
*ch
)
1096 dma_memory_read(&address_space_memory
, ch
->pc
, &opcode
, 1);
1097 for (i
= 0; insn_desc
[i
].size
; i
++) {
1098 if ((opcode
& insn_desc
[i
].opmask
) == insn_desc
[i
].opcode
) {
1099 return &insn_desc
[i
];
1105 static inline void pl330_exec_insn(PL330Chan
*ch
, const PL330InsnDesc
*insn
)
1107 uint8_t buf
[PL330_INSN_MAXSIZE
];
1109 assert(insn
->size
<= PL330_INSN_MAXSIZE
);
1110 dma_memory_read(&address_space_memory
, ch
->pc
, buf
, insn
->size
);
1111 insn
->exec(ch
, buf
[0], &buf
[1], insn
->size
- 1);
1114 static inline void pl330_update_pc(PL330Chan
*ch
,
1115 const PL330InsnDesc
*insn
)
1117 ch
->pc
+= insn
->size
;
1120 /* Try to execute current instruction in channel CH. Number of executed
1121 instructions is returned (0 or 1). */
1122 static int pl330_chan_exec(PL330Chan
*ch
)
1124 const PL330InsnDesc
*insn
;
1126 if (ch
->state
!= pl330_chan_executing
&&
1127 ch
->state
!= pl330_chan_waiting_periph
&&
1128 ch
->state
!= pl330_chan_at_barrier
&&
1129 ch
->state
!= pl330_chan_waiting_event
) {
1133 insn
= pl330_fetch_insn(ch
);
1135 DB_PRINT("pl330 undefined instruction\n");
1136 pl330_fault(ch
, PL330_FAULT_UNDEF_INSTR
);
1139 pl330_exec_insn(ch
, insn
);
1141 pl330_update_pc(ch
, insn
);
1142 ch
->watchdog_timer
= 0;
1144 /* WDT only active in exec state */
1145 } else if (ch
->state
== pl330_chan_executing
) {
1146 ch
->watchdog_timer
++;
1147 if (ch
->watchdog_timer
>= PL330_WATCHDOG_LIMIT
) {
1148 pl330_fault(ch
, PL330_FAULT_LOCKUP_ERR
);
1154 /* Try to execute 1 instruction in each channel, one instruction from read
1155 queue and one instruction from write queue. Number of successfully executed
1156 instructions is returned. */
1157 static int pl330_exec_cycle(PL330Chan
*channel
)
1159 PL330State
*s
= channel
->parent
;
1164 uint8_t buf
[PL330_MAX_BURST_LEN
];
1166 /* Execute one instruction in each channel */
1167 num_exec
+= pl330_chan_exec(channel
);
1169 /* Execute one instruction from read queue */
1170 q
= pl330_queue_find_insn(&s
->read_queue
, PL330_UNTAGGED
, true);
1171 if (q
!= NULL
&& q
->len
<= pl330_fifo_num_free(&s
->fifo
)) {
1172 int len
= q
->len
- (q
->addr
& (q
->len
- 1));
1174 dma_memory_read(&address_space_memory
, q
->addr
, buf
, len
);
1175 if (PL330_ERR_DEBUG
> 1) {
1176 DB_PRINT("PL330 read from memory @%08" PRIx32
" (size = %08x):\n",
1178 qemu_hexdump((char *)buf
, stderr
, "", len
);
1180 fifo_res
= pl330_fifo_push(&s
->fifo
, buf
, len
, q
->tag
);
1181 if (fifo_res
== PL330_FIFO_OK
) {
1187 pl330_queue_remove_insn(&s
->read_queue
, q
);
1193 /* Execute one instruction from write queue. */
1194 q
= pl330_queue_find_insn(&s
->write_queue
, pl330_fifo_tag(&s
->fifo
), true);
1196 int len
= q
->len
- (q
->addr
& (q
->len
- 1));
1199 for (i
= 0; i
< len
; i
++) {
1203 fifo_res
= pl330_fifo_get(&s
->fifo
, buf
, len
, q
->tag
);
1205 if (fifo_res
== PL330_FIFO_OK
|| q
->z
) {
1206 dma_memory_write(&address_space_memory
, q
->addr
, buf
, len
);
1207 if (PL330_ERR_DEBUG
> 1) {
1208 DB_PRINT("PL330 read from memory @%08" PRIx32
1209 " (size = %08x):\n", q
->addr
, len
);
1210 qemu_hexdump((char *)buf
, stderr
, "", len
);
1216 } else if (fifo_res
== PL330_FIFO_STALL
) {
1217 pl330_fault(&channel
->parent
->chan
[q
->tag
],
1218 PL330_FAULT_FIFOEMPTY_ERR
);
1222 pl330_queue_remove_insn(&s
->write_queue
, q
);
1229 static int pl330_exec_channel(PL330Chan
*channel
)
1233 /* TODO: Is it all right to execute everything or should we do per-cycle
1235 while (pl330_exec_cycle(channel
)) {
1239 /* Detect deadlock */
1240 if (channel
->state
== pl330_chan_executing
) {
1241 pl330_fault(channel
, PL330_FAULT_LOCKUP_ERR
);
1243 /* Situation when one of the queues has deadlocked but all channels
1244 * have finished their programs should be impossible.
1250 static inline void pl330_exec(PL330State
*s
)
1255 insr_exec
= pl330_exec_channel(&s
->manager
);
1257 for (i
= 0; i
< s
->num_chnls
; i
++) {
1258 insr_exec
+= pl330_exec_channel(&s
->chan
[i
]);
1260 } while (insr_exec
);
1263 static void pl330_exec_cycle_timer(void *opaque
)
1265 PL330State
*s
= (PL330State
*)opaque
;
1269 /* Stop or restore dma operations */
1271 static void pl330_dma_stop_irq(void *opaque
, int irq
, int level
)
1273 PL330State
*s
= (PL330State
*)opaque
;
1275 if (s
->periph_busy
[irq
] != level
) {
1276 s
->periph_busy
[irq
] = level
;
1277 timer_mod(s
->timer
, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL
));
1281 static void pl330_debug_exec(PL330State
*s
)
1288 const PL330InsnDesc
*insn
;
1290 s
->debug_status
= 1;
1291 chan_id
= (s
->dbg
[0] >> 8) & 0x07;
1292 opcode
= (s
->dbg
[0] >> 16) & 0xff;
1293 args
[0] = (s
->dbg
[0] >> 24) & 0xff;
1294 args
[1] = (s
->dbg
[1] >> 0) & 0xff;
1295 args
[2] = (s
->dbg
[1] >> 8) & 0xff;
1296 args
[3] = (s
->dbg
[1] >> 16) & 0xff;
1297 args
[4] = (s
->dbg
[1] >> 24) & 0xff;
1298 DB_PRINT("chan id: %" PRIx8
"\n", chan_id
);
1299 if (s
->dbg
[0] & 1) {
1300 ch
= &s
->chan
[chan_id
];
1305 for (i
= 0; debug_insn_desc
[i
].size
; i
++) {
1306 if ((opcode
& debug_insn_desc
[i
].opmask
) == debug_insn_desc
[i
].opcode
) {
1307 insn
= &debug_insn_desc
[i
];
1311 pl330_fault(ch
, PL330_FAULT_UNDEF_INSTR
| PL330_FAULT_DBG_INSTR
);
1315 insn
->exec(ch
, opcode
, args
, insn
->size
- 1);
1316 if (ch
->fault_type
) {
1317 ch
->fault_type
|= PL330_FAULT_DBG_INSTR
;
1320 qemu_log_mask(LOG_UNIMP
, "pl330: stall of debug instruction not "
1323 s
->debug_status
= 0;
1326 /* IOMEM mapped registers */
1328 static void pl330_iomem_write(void *opaque
, hwaddr offset
,
1329 uint64_t value
, unsigned size
)
1331 PL330State
*s
= (PL330State
*) opaque
;
1334 DB_PRINT("addr: %08x data: %08x\n", (unsigned)offset
, (unsigned)value
);
1337 case PL330_REG_INTEN
:
1340 case PL330_REG_INTCLR
:
1341 for (i
= 0; i
< s
->num_events
; i
++) {
1342 if (s
->int_status
& s
->inten
& value
& (1 << i
)) {
1343 DB_PRINT("event interrupt lowered %d\n", i
);
1344 qemu_irq_lower(s
->irq
[i
]);
1347 s
->ev_status
&= ~(value
& s
->inten
);
1348 s
->int_status
&= ~(value
& s
->inten
);
1350 case PL330_REG_DBGCMD
:
1351 if ((value
& 3) == 0) {
1352 pl330_debug_exec(s
);
1355 qemu_log_mask(LOG_GUEST_ERROR
, "pl330: write of illegal value %u "
1356 "for offset " TARGET_FMT_plx
"\n", (unsigned)value
,
1360 case PL330_REG_DBGINST0
:
1361 DB_PRINT("s->dbg[0] = %08x\n", (unsigned)value
);
1364 case PL330_REG_DBGINST1
:
1365 DB_PRINT("s->dbg[1] = %08x\n", (unsigned)value
);
1369 qemu_log_mask(LOG_GUEST_ERROR
, "pl330: bad write offset " TARGET_FMT_plx
1375 static inline uint32_t pl330_iomem_read_imp(void *opaque
,
1378 PL330State
*s
= (PL330State
*)opaque
;
1383 if (offset
>= PL330_REG_PERIPH_ID
&& offset
< PL330_REG_PERIPH_ID
+ 32) {
1384 return pl330_id
[(offset
- PL330_REG_PERIPH_ID
) >> 2];
1386 if (offset
>= PL330_REG_CR0_BASE
&& offset
< PL330_REG_CR0_BASE
+ 24) {
1387 return s
->cfg
[(offset
- PL330_REG_CR0_BASE
) >> 2];
1389 if (offset
>= PL330_REG_CHANCTRL
&& offset
< PL330_REG_DBGSTATUS
) {
1390 offset
-= PL330_REG_CHANCTRL
;
1391 chan_id
= offset
>> 5;
1392 if (chan_id
>= s
->num_chnls
) {
1393 qemu_log_mask(LOG_GUEST_ERROR
, "pl330: bad read offset "
1394 TARGET_FMT_plx
"\n", offset
);
1397 switch (offset
& 0x1f) {
1399 return s
->chan
[chan_id
].src
;
1401 return s
->chan
[chan_id
].dst
;
1403 return s
->chan
[chan_id
].control
;
1405 return s
->chan
[chan_id
].lc
[0];
1407 return s
->chan
[chan_id
].lc
[1];
1409 qemu_log_mask(LOG_GUEST_ERROR
, "pl330: bad read offset "
1410 TARGET_FMT_plx
"\n", offset
);
1414 if (offset
>= PL330_REG_CSR_BASE
&& offset
< 0x400) {
1415 offset
-= PL330_REG_CSR_BASE
;
1416 chan_id
= offset
>> 3;
1417 if (chan_id
>= s
->num_chnls
) {
1418 qemu_log_mask(LOG_GUEST_ERROR
, "pl330: bad read offset "
1419 TARGET_FMT_plx
"\n", offset
);
1422 switch ((offset
>> 2) & 1) {
1424 res
= (s
->chan
[chan_id
].ns
<< 21) |
1425 (s
->chan
[chan_id
].wakeup
<< 4) |
1426 (s
->chan
[chan_id
].state
) |
1427 (s
->chan
[chan_id
].wfp_sbp
<< 14);
1430 return s
->chan
[chan_id
].pc
;
1432 qemu_log_mask(LOG_GUEST_ERROR
, "pl330: read error\n");
1436 if (offset
>= PL330_REG_FTR_BASE
&& offset
< 0x100) {
1437 offset
-= PL330_REG_FTR_BASE
;
1438 chan_id
= offset
>> 2;
1439 if (chan_id
>= s
->num_chnls
) {
1440 qemu_log_mask(LOG_GUEST_ERROR
, "pl330: bad read offset "
1441 TARGET_FMT_plx
"\n", offset
);
1444 return s
->chan
[chan_id
].fault_type
;
1448 return (s
->manager
.ns
<< 9) | (s
->manager
.wakeup
<< 4) |
1449 (s
->manager
.state
& 0xf);
1451 return s
->manager
.pc
;
1452 case PL330_REG_INTEN
:
1454 case PL330_REG_INT_EVENT_RIS
:
1455 return s
->ev_status
;
1456 case PL330_REG_INTMIS
:
1457 return s
->int_status
;
1458 case PL330_REG_INTCLR
:
1459 /* Documentation says that we can't read this register
1460 * but linux kernel does it
1463 case PL330_REG_FSRD
:
1464 return s
->manager
.state
? 1 : 0;
1465 case PL330_REG_FSRC
:
1467 for (i
= 0; i
< s
->num_chnls
; i
++) {
1468 if (s
->chan
[i
].state
== pl330_chan_fault
||
1469 s
->chan
[i
].state
== pl330_chan_fault_completing
) {
1474 case PL330_REG_FTRD
:
1475 return s
->manager
.fault_type
;
1476 case PL330_REG_DBGSTATUS
:
1477 return s
->debug_status
;
1479 qemu_log_mask(LOG_GUEST_ERROR
, "pl330: bad read offset "
1480 TARGET_FMT_plx
"\n", offset
);
1485 static uint64_t pl330_iomem_read(void *opaque
, hwaddr offset
,
1488 uint32_t ret
= pl330_iomem_read_imp(opaque
, offset
);
1489 DB_PRINT("addr: %08" HWADDR_PRIx
" data: %08" PRIx32
"\n", offset
, ret
);
1493 static const MemoryRegionOps pl330_ops
= {
1494 .read
= pl330_iomem_read
,
1495 .write
= pl330_iomem_write
,
1496 .endianness
= DEVICE_NATIVE_ENDIAN
,
1498 .min_access_size
= 4,
1499 .max_access_size
= 4,
1503 /* Controller logic and initialization */
1505 static void pl330_chan_reset(PL330Chan
*ch
)
1510 ch
->state
= pl330_chan_stopped
;
1511 ch
->watchdog_timer
= 0;
1518 static void pl330_reset(DeviceState
*d
)
1521 PL330State
*s
= PL330(d
);
1526 s
->debug_status
= 0;
1527 s
->num_faulting
= 0;
1528 s
->manager
.ns
= s
->mgr_ns_at_rst
;
1529 pl330_fifo_reset(&s
->fifo
);
1530 pl330_queue_reset(&s
->read_queue
);
1531 pl330_queue_reset(&s
->write_queue
);
1533 for (i
= 0; i
< s
->num_chnls
; i
++) {
1534 pl330_chan_reset(&s
->chan
[i
]);
1536 for (i
= 0; i
< s
->num_periph_req
; i
++) {
1537 s
->periph_busy
[i
] = 0;
1540 timer_del(s
->timer
);
1543 static void pl330_realize(DeviceState
*dev
, Error
**errp
)
1546 PL330State
*s
= PL330(dev
);
1548 sysbus_init_irq(SYS_BUS_DEVICE(dev
), &s
->irq_abort
);
1549 memory_region_init_io(&s
->iomem
, OBJECT(s
), &pl330_ops
, s
,
1550 "dma", PL330_IOMEM_SIZE
);
1551 sysbus_init_mmio(SYS_BUS_DEVICE(dev
), &s
->iomem
);
1553 s
->timer
= timer_new_ns(QEMU_CLOCK_VIRTUAL
, pl330_exec_cycle_timer
, s
);
1555 s
->cfg
[0] = (s
->mgr_ns_at_rst
? 0x4 : 0) |
1556 (s
->num_periph_req
> 0 ? 1 : 0) |
1557 ((s
->num_chnls
- 1) & 0x7) << 4 |
1558 ((s
->num_periph_req
- 1) & 0x1f) << 12 |
1559 ((s
->num_events
- 1) & 0x1f) << 17;
1561 switch (s
->i_cache_len
) {
1575 error_setg(errp
, "Bad value for i-cache_len property: %" PRIx8
,
1579 s
->cfg
[1] |= ((s
->num_i_cache_lines
- 1) & 0xf) << 4;
1581 s
->chan
= g_new0(PL330Chan
, s
->num_chnls
);
1582 s
->hi_seqn
= g_new0(uint8_t, s
->num_chnls
);
1583 s
->lo_seqn
= g_new0(uint8_t, s
->num_chnls
);
1584 for (i
= 0; i
< s
->num_chnls
; i
++) {
1585 s
->chan
[i
].parent
= s
;
1586 s
->chan
[i
].tag
= (uint8_t)i
;
1588 s
->manager
.parent
= s
;
1589 s
->manager
.tag
= s
->num_chnls
;
1590 s
->manager
.is_manager
= true;
1592 s
->irq
= g_new0(qemu_irq
, s
->num_events
);
1593 for (i
= 0; i
< s
->num_events
; i
++) {
1594 sysbus_init_irq(SYS_BUS_DEVICE(dev
), &s
->irq
[i
]);
1597 qdev_init_gpio_in(dev
, pl330_dma_stop_irq
, PL330_PERIPH_NUM
);
1599 switch (s
->data_width
) {
1601 s
->cfg
[CFG_CRD
] |= 0x2;
1604 s
->cfg
[CFG_CRD
] |= 0x3;
1607 s
->cfg
[CFG_CRD
] |= 0x4;
1610 error_setg(errp
, "Bad value for data_width property: %" PRIx8
,
1615 s
->cfg
[CFG_CRD
] |= ((s
->wr_cap
- 1) & 0x7) << 4 |
1616 ((s
->wr_q_dep
- 1) & 0xf) << 8 |
1617 ((s
->rd_cap
- 1) & 0x7) << 12 |
1618 ((s
->rd_q_dep
- 1) & 0xf) << 16 |
1619 ((s
->data_buffer_dep
- 1) & 0x1ff) << 20;
1621 pl330_queue_init(&s
->read_queue
, s
->rd_q_dep
, s
);
1622 pl330_queue_init(&s
->write_queue
, s
->wr_q_dep
, s
);
1623 pl330_fifo_init(&s
->fifo
, s
->data_width
/ 4 * s
->data_buffer_dep
);
1626 static Property pl330_properties
[] = {
1628 DEFINE_PROP_UINT32("num_chnls", PL330State
, num_chnls
, 8),
1629 DEFINE_PROP_UINT8("num_periph_req", PL330State
, num_periph_req
, 4),
1630 DEFINE_PROP_UINT8("num_events", PL330State
, num_events
, 16),
1631 DEFINE_PROP_UINT8("mgr_ns_at_rst", PL330State
, mgr_ns_at_rst
, 0),
1633 DEFINE_PROP_UINT8("i-cache_len", PL330State
, i_cache_len
, 4),
1634 DEFINE_PROP_UINT8("num_i-cache_lines", PL330State
, num_i_cache_lines
, 8),
1636 DEFINE_PROP_UINT32("boot_addr", PL330State
, cfg
[CFG_BOOT_ADDR
], 0),
1637 DEFINE_PROP_UINT32("INS", PL330State
, cfg
[CFG_INS
], 0),
1638 DEFINE_PROP_UINT32("PNS", PL330State
, cfg
[CFG_PNS
], 0),
1640 DEFINE_PROP_UINT8("data_width", PL330State
, data_width
, 64),
1641 DEFINE_PROP_UINT8("wr_cap", PL330State
, wr_cap
, 8),
1642 DEFINE_PROP_UINT8("wr_q_dep", PL330State
, wr_q_dep
, 16),
1643 DEFINE_PROP_UINT8("rd_cap", PL330State
, rd_cap
, 8),
1644 DEFINE_PROP_UINT8("rd_q_dep", PL330State
, rd_q_dep
, 16),
1645 DEFINE_PROP_UINT16("data_buffer_dep", PL330State
, data_buffer_dep
, 256),
1647 DEFINE_PROP_END_OF_LIST(),
1650 static void pl330_class_init(ObjectClass
*klass
, void *data
)
1652 DeviceClass
*dc
= DEVICE_CLASS(klass
);
1654 dc
->realize
= pl330_realize
;
1655 dc
->reset
= pl330_reset
;
1656 dc
->props
= pl330_properties
;
1657 dc
->vmsd
= &vmstate_pl330
;
1660 static const TypeInfo pl330_type_info
= {
1662 .parent
= TYPE_SYS_BUS_DEVICE
,
1663 .instance_size
= sizeof(PL330State
),
1664 .class_init
= pl330_class_init
,
1667 static void pl330_register_types(void)
1669 type_register_static(&pl330_type_info
);
1672 type_init(pl330_register_types
)