17
#include "qemu/osdep.h"
18
#include "qemu/cutils.h"
20
#include "hw/qdev-properties.h"
22
#include "migration/vmstate.h"
23
#include "qapi/error.h"
24
#include "qemu/timer.h"
25
#include "sysemu/dma.h"
27
#include "qemu/module.h"
29
#include "qom/object.h"
31
#ifndef PL330_ERR_DEBUG
32
#define PL330_ERR_DEBUG 0
35
#define PL330_PERIPH_NUM 32
36
#define PL330_MAX_BURST_LEN 128
37
#define PL330_INSN_MAXSIZE 6
39
#define PL330_FIFO_OK 0
40
#define PL330_FIFO_STALL 1
41
#define PL330_FIFO_ERR (-1)
43
#define PL330_FAULT_UNDEF_INSTR (1 << 0)
44
#define PL330_FAULT_OPERAND_INVALID (1 << 1)
45
#define PL330_FAULT_DMAGO_ERR (1 << 4)
46
#define PL330_FAULT_EVENT_ERR (1 << 5)
47
#define PL330_FAULT_CH_PERIPH_ERR (1 << 6)
48
#define PL330_FAULT_CH_RDWR_ERR (1 << 7)
49
#define PL330_FAULT_ST_DATA_UNAVAILABLE (1 << 12)
50
#define PL330_FAULT_FIFOEMPTY_ERR (1 << 13)
51
#define PL330_FAULT_INSTR_FETCH_ERR (1 << 16)
52
#define PL330_FAULT_DATA_WRITE_ERR (1 << 17)
53
#define PL330_FAULT_DATA_READ_ERR (1 << 18)
54
#define PL330_FAULT_DBG_INSTR (1 << 30)
55
#define PL330_FAULT_LOCKUP_ERR (1 << 31)
57
#define PL330_UNTAGGED 0xff
59
#define PL330_SINGLE 0x0
60
#define PL330_BURST 0x1
62
#define PL330_WATCHDOG_LIMIT 1024
65
#define PL330_REG_DSR 0x000
66
#define PL330_REG_DPC 0x004
67
#define PL330_REG_INTEN 0x020
68
#define PL330_REG_INT_EVENT_RIS 0x024
69
#define PL330_REG_INTMIS 0x028
70
#define PL330_REG_INTCLR 0x02C
71
#define PL330_REG_FSRD 0x030
72
#define PL330_REG_FSRC 0x034
73
#define PL330_REG_FTRD 0x038
74
#define PL330_REG_FTR_BASE 0x040
75
#define PL330_REG_CSR_BASE 0x100
76
#define PL330_REG_CPC_BASE 0x104
77
#define PL330_REG_CHANCTRL 0x400
78
#define PL330_REG_DBGSTATUS 0xD00
79
#define PL330_REG_DBGCMD 0xD04
80
#define PL330_REG_DBGINST0 0xD08
81
#define PL330_REG_DBGINST1 0xD0C
82
#define PL330_REG_CR0_BASE 0xE00
83
#define PL330_REG_PERIPH_ID 0xFE0
85
#define PL330_IOMEM_SIZE 0x1000
87
#define CFG_BOOT_ADDR 2
92
static const uint32_t pl330_id[] = {
93
0x30, 0x13, 0x24, 0x00, 0x0D, 0xF0, 0x05, 0xB1
100
pl330_chan_stopped = 0,
101
pl330_chan_executing = 1,
102
pl330_chan_cache_miss = 2,
103
pl330_chan_updating_pc = 3,
104
pl330_chan_waiting_event = 4,
105
pl330_chan_at_barrier = 5,
106
pl330_chan_queue_busy = 6,
107
pl330_chan_waiting_periph = 7,
108
pl330_chan_killing = 8,
109
pl330_chan_completing = 9,
110
pl330_chan_fault_completing = 14,
111
pl330_chan_fault = 15,
114
typedef struct PL330State PL330State;
116
typedef struct PL330Chan {
124
uint32_t watchdog_timer;
127
uint8_t request_flag;
139
static const VMStateDescription vmstate_pl330_chan = {
140
.name = "pl330_chan",
142
.minimum_version_id = 1,
143
.fields = (const VMStateField[]) {
144
VMSTATE_UINT32(src, PL330Chan),
145
VMSTATE_UINT32(dst, PL330Chan),
146
VMSTATE_UINT32(pc, PL330Chan),
147
VMSTATE_UINT32(control, PL330Chan),
148
VMSTATE_UINT32(status, PL330Chan),
149
VMSTATE_UINT32_ARRAY(lc, PL330Chan, 2),
150
VMSTATE_UINT32(fault_type, PL330Chan),
151
VMSTATE_UINT32(watchdog_timer, PL330Chan),
152
VMSTATE_BOOL(ns, PL330Chan),
153
VMSTATE_UINT8(request_flag, PL330Chan),
154
VMSTATE_UINT8(wakeup, PL330Chan),
155
VMSTATE_UINT8(wfp_sbp, PL330Chan),
156
VMSTATE_UINT8(state, PL330Chan),
157
VMSTATE_UINT8(stall, PL330Chan),
158
VMSTATE_END_OF_LIST()
162
typedef struct PL330Fifo {
170
static const VMStateDescription vmstate_pl330_fifo = {
171
.name = "pl330_chan",
173
.minimum_version_id = 1,
174
.fields = (const VMStateField[]) {
175
VMSTATE_VBUFFER_UINT32(buf, PL330Fifo, 1, NULL, buf_size),
176
VMSTATE_VBUFFER_UINT32(tag, PL330Fifo, 1, NULL, buf_size),
177
VMSTATE_UINT32(head, PL330Fifo),
178
VMSTATE_UINT32(num, PL330Fifo),
179
VMSTATE_UINT32(buf_size, PL330Fifo),
180
VMSTATE_END_OF_LIST()
184
typedef struct PL330QueueEntry {
194
static const VMStateDescription vmstate_pl330_queue_entry = {
195
.name = "pl330_queue_entry",
197
.minimum_version_id = 1,
198
.fields = (const VMStateField[]) {
199
VMSTATE_UINT32(addr, PL330QueueEntry),
200
VMSTATE_UINT32(len, PL330QueueEntry),
201
VMSTATE_UINT8(n, PL330QueueEntry),
202
VMSTATE_BOOL(inc, PL330QueueEntry),
203
VMSTATE_BOOL(z, PL330QueueEntry),
204
VMSTATE_UINT8(tag, PL330QueueEntry),
205
VMSTATE_UINT8(seqn, PL330QueueEntry),
206
VMSTATE_END_OF_LIST()
210
typedef struct PL330Queue {
212
PL330QueueEntry *queue;
216
static const VMStateDescription vmstate_pl330_queue = {
217
.name = "pl330_queue",
219
.minimum_version_id = 2,
220
.fields = (const VMStateField[]) {
221
VMSTATE_STRUCT_VARRAY_POINTER_UINT32(queue, PL330Queue, queue_size,
222
vmstate_pl330_queue_entry,
224
VMSTATE_END_OF_LIST()
229
SysBusDevice parent_obj;
237
#define EVENT_SEC_STATE 3
238
#define PERIPH_SEC_STATE 4
241
uint8_t num_periph_req;
243
uint8_t mgr_ns_at_rst;
246
uint8_t num_i_cache_lines;
253
uint16_t data_buffer_dep;
258
PL330Queue read_queue;
259
PL330Queue write_queue;
268
uint8_t debug_status;
269
uint8_t num_faulting;
270
uint8_t periph_busy[PL330_PERIPH_NUM];
273
MemoryRegion *mem_mr;
274
AddressSpace *mem_as;
277
#define TYPE_PL330 "pl330"
278
OBJECT_DECLARE_SIMPLE_TYPE(PL330State, PL330)
280
static const VMStateDescription vmstate_pl330 = {
283
.minimum_version_id = 2,
284
.fields = (const VMStateField[]) {
285
VMSTATE_STRUCT(manager, PL330State, 0, vmstate_pl330_chan, PL330Chan),
286
VMSTATE_STRUCT_VARRAY_POINTER_UINT32(chan, PL330State, num_chnls,
287
vmstate_pl330_chan, PL330Chan),
288
VMSTATE_VBUFFER_UINT32(lo_seqn, PL330State, 1, NULL, num_chnls),
289
VMSTATE_VBUFFER_UINT32(hi_seqn, PL330State, 1, NULL, num_chnls),
290
VMSTATE_STRUCT(fifo, PL330State, 0, vmstate_pl330_fifo, PL330Fifo),
291
VMSTATE_STRUCT(read_queue, PL330State, 0, vmstate_pl330_queue,
293
VMSTATE_STRUCT(write_queue, PL330State, 0, vmstate_pl330_queue,
295
VMSTATE_TIMER_PTR(timer, PL330State),
296
VMSTATE_UINT32(inten, PL330State),
297
VMSTATE_UINT32(int_status, PL330State),
298
VMSTATE_UINT32(ev_status, PL330State),
299
VMSTATE_UINT32_ARRAY(dbg, PL330State, 2),
300
VMSTATE_UINT8(debug_status, PL330State),
301
VMSTATE_UINT8(num_faulting, PL330State),
302
VMSTATE_UINT8_ARRAY(periph_busy, PL330State, PL330_PERIPH_NUM),
303
VMSTATE_END_OF_LIST()
307
typedef struct PL330InsnDesc {
316
void (*exec)(PL330Chan *, uint8_t opcode, uint8_t *args, int len);
319
static void pl330_hexdump(uint8_t *buf, size_t size)
321
g_autoptr(GString) str = g_string_sized_new(64);
324
for (b = 0; b < size; b += len) {
325
len = MIN(16, size - b);
326
g_string_truncate(str, 0);
327
qemu_hexdump_line(str, buf + b, len, 1, 4);
328
trace_pl330_hexdump(b, str->str);
341
static void pl330_fifo_init(PL330Fifo *s, uint32_t size)
343
s->buf = g_malloc0(size);
344
s->tag = g_malloc0(size);
350
static inline int pl330_fifo_inc(PL330Fifo *s, int x)
352
return (x + 1) % s->buf_size;
357
static inline int pl330_fifo_num_free(PL330Fifo *s)
359
return s->buf_size - s->num;
368
static int pl330_fifo_push(PL330Fifo *s, uint8_t *buf, int len, uint8_t tag)
372
if (s->buf_size - s->num < len) {
373
return PL330_FIFO_STALL;
375
for (i = 0; i < len; i++) {
376
int push_idx = (s->head + s->num + i) % s->buf_size;
377
s->buf[push_idx] = buf[i];
378
s->tag[push_idx] = tag;
381
return PL330_FIFO_OK;
390
static int pl330_fifo_get(PL330Fifo *s, uint8_t *buf, int len, uint8_t tag)
395
return PL330_FIFO_STALL;
397
for (i = 0; i < len; i++) {
398
if (s->tag[s->head] == tag) {
399
int get_idx = (s->head + i) % s->buf_size;
400
buf[i] = s->buf[get_idx];
402
return PL330_FIFO_ERR;
405
s->head = (s->head + len) % s->buf_size;
407
return PL330_FIFO_OK;
412
static inline void pl330_fifo_reset(PL330Fifo *s)
422
static inline uint8_t pl330_fifo_tag(PL330Fifo *s)
424
return (!s->num) ? PL330_UNTAGGED : s->tag[s->head];
429
static int pl330_fifo_has_tag(PL330Fifo *s, uint8_t tag)
434
for (n = 0; n < s->num; n++) {
435
if (s->tag[i] == tag) {
438
i = pl330_fifo_inc(s, i);
445
static void pl330_fifo_tagged_remove(PL330Fifo *s, uint8_t tag)
450
for (n = 0; n < s->num; n++) {
451
if (s->tag[i] != tag) {
452
s->buf[t] = s->buf[i];
453
s->tag[t] = s->tag[i];
454
t = pl330_fifo_inc(s, t);
458
i = pl330_fifo_inc(s, i);
484
static void pl330_queue_reset(PL330Queue *s)
488
for (i = 0; i < s->queue_size; i++) {
489
s->queue[i].tag = PL330_UNTAGGED;
494
static void pl330_queue_init(PL330Queue *s, int size, PL330State *parent)
497
s->queue = g_new0(PL330QueueEntry, size);
498
s->queue_size = size;
502
static PL330QueueEntry *pl330_queue_find_empty(PL330Queue *s)
506
for (i = 0; i < s->queue_size; i++) {
507
if (s->queue[i].tag == PL330_UNTAGGED) {
520
static int pl330_queue_put_insn(PL330Queue *s, uint32_t addr,
521
int len, int n, bool inc, bool z, uint8_t tag)
523
PL330QueueEntry *entry = pl330_queue_find_empty(s);
534
entry->seqn = s->parent->hi_seqn[tag];
535
s->parent->hi_seqn[tag]++;
549
static PL330QueueEntry *pl330_queue_find_insn(PL330Queue *s, uint8_t tag,
554
for (i = 0; i < s->queue_size; i++) {
555
if (s->queue[i].tag != PL330_UNTAGGED) {
557
s->queue[i].seqn == s->parent->lo_seqn[s->queue[i].tag]) &&
558
(s->queue[i].tag == tag || tag == PL330_UNTAGGED ||
569
static inline void pl330_queue_remove_insn(PL330Queue *s, PL330QueueEntry *e)
571
s->parent->lo_seqn[e->tag]++;
572
e->tag = PL330_UNTAGGED;
577
static inline void pl330_queue_remove_tagged(PL330Queue *s, uint8_t tag)
581
for (i = 0; i < s->queue_size; i++) {
582
if (s->queue[i].tag == tag) {
583
s->queue[i].tag = PL330_UNTAGGED;
592
static inline void pl330_fault(PL330Chan *ch, uint32_t flags)
594
trace_pl330_fault(ch, flags);
595
ch->fault_type |= flags;
596
if (ch->state == pl330_chan_fault) {
599
ch->state = pl330_chan_fault;
600
ch->parent->num_faulting++;
601
if (ch->parent->num_faulting == 1) {
602
trace_pl330_fault_abort();
603
qemu_irq_raise(ch->parent->irq_abort);
617
static void pl330_dmaadxh(PL330Chan *ch, uint8_t *args, bool ra, bool neg)
619
uint32_t im = (args[1] << 8) | args[0];
624
if (ch->is_manager) {
625
pl330_fault(ch, PL330_FAULT_UNDEF_INSTR);
635
static void pl330_dmaaddh(PL330Chan *ch, uint8_t opcode, uint8_t *args, int len)
637
pl330_dmaadxh(ch, args, extract32(opcode, 1, 1), false);
640
static void pl330_dmaadnh(PL330Chan *ch, uint8_t opcode, uint8_t *args, int len)
642
pl330_dmaadxh(ch, args, extract32(opcode, 1, 1), true);
645
static void pl330_dmaend(PL330Chan *ch, uint8_t opcode,
646
uint8_t *args, int len)
648
PL330State *s = ch->parent;
650
if (ch->state == pl330_chan_executing && !ch->is_manager) {
652
if (pl330_fifo_has_tag(&s->fifo, ch->tag) ||
653
pl330_queue_find_insn(&s->read_queue, ch->tag, false) != NULL ||
654
pl330_queue_find_insn(&s->write_queue, ch->tag, false) != NULL) {
660
trace_pl330_dmaend();
661
pl330_fifo_tagged_remove(&s->fifo, ch->tag);
662
pl330_queue_remove_tagged(&s->read_queue, ch->tag);
663
pl330_queue_remove_tagged(&s->write_queue, ch->tag);
664
ch->state = pl330_chan_stopped;
667
static void pl330_dmaflushp(PL330Chan *ch, uint8_t opcode,
668
uint8_t *args, int len)
673
pl330_fault(ch, PL330_FAULT_OPERAND_INVALID);
676
periph_id = (args[0] >> 3) & 0x1f;
677
if (periph_id >= ch->parent->num_periph_req) {
678
pl330_fault(ch, PL330_FAULT_OPERAND_INVALID);
681
if (ch->ns && !(ch->parent->cfg[CFG_PNS] & (1 << periph_id))) {
682
pl330_fault(ch, PL330_FAULT_CH_PERIPH_ERR);
688
static void pl330_dmago(PL330Chan *ch, uint8_t opcode, uint8_t *args, int len)
697
if (!ch->is_manager) {
698
pl330_fault(ch, PL330_FAULT_UNDEF_INSTR);
702
chan_id = args[0] & 7;
703
if ((args[0] >> 3)) {
704
pl330_fault(ch, PL330_FAULT_OPERAND_INVALID);
707
if (chan_id >= ch->parent->num_chnls) {
708
pl330_fault(ch, PL330_FAULT_OPERAND_INVALID);
711
pc = (((uint32_t)args[4]) << 24) | (((uint32_t)args[3]) << 16) |
712
(((uint32_t)args[2]) << 8) | (((uint32_t)args[1]));
713
if (ch->parent->chan[chan_id].state != pl330_chan_stopped) {
714
pl330_fault(ch, PL330_FAULT_OPERAND_INVALID);
718
pl330_fault(ch, PL330_FAULT_DMAGO_ERR);
721
s = &ch->parent->chan[chan_id];
724
s->state = pl330_chan_executing;
727
static void pl330_dmald(PL330Chan *ch, uint8_t opcode, uint8_t *args, int len)
729
uint8_t bs = opcode & 3;
734
pl330_fault(ch, PL330_FAULT_OPERAND_INVALID);
737
if ((bs == 1 && ch->request_flag == PL330_BURST) ||
738
(bs == 3 && ch->request_flag == PL330_SINGLE)) {
742
if (bs == 1 && ch->request_flag == PL330_SINGLE) {
745
num = ((ch->control >> 4) & 0xf) + 1;
747
size = (uint32_t)1 << ((ch->control >> 1) & 0x7);
748
inc = !!(ch->control & 1);
749
ch->stall = pl330_queue_put_insn(&ch->parent->read_queue, ch->src,
750
size, num, inc, 0, ch->tag);
752
trace_pl330_dmald(ch->tag, ch->src, size, num, inc ? 'Y' : 'N');
753
ch->src += inc ? size * num - (ch->src & (size - 1)) : 0;
757
static void pl330_dmaldp(PL330Chan *ch, uint8_t opcode, uint8_t *args, int len)
762
pl330_fault(ch, PL330_FAULT_OPERAND_INVALID);
765
periph_id = (args[0] >> 3) & 0x1f;
766
if (periph_id >= ch->parent->num_periph_req) {
767
pl330_fault(ch, PL330_FAULT_OPERAND_INVALID);
770
if (ch->ns && !(ch->parent->cfg[CFG_PNS] & (1 << periph_id))) {
771
pl330_fault(ch, PL330_FAULT_CH_PERIPH_ERR);
774
pl330_dmald(ch, opcode, args, len);
777
static void pl330_dmalp(PL330Chan *ch, uint8_t opcode, uint8_t *args, int len)
779
uint8_t lc = (opcode & 2) >> 1;
781
ch->lc[lc] = args[0];
784
static void pl330_dmakill(PL330Chan *ch, uint8_t opcode, uint8_t *args, int len)
786
if (ch->state == pl330_chan_fault ||
787
ch->state == pl330_chan_fault_completing) {
790
ch->parent->num_faulting--;
791
if (ch->parent->num_faulting == 0) {
792
trace_pl330_dmakill();
793
qemu_irq_lower(ch->parent->irq_abort);
796
ch->state = pl330_chan_killing;
797
pl330_fifo_tagged_remove(&ch->parent->fifo, ch->tag);
798
pl330_queue_remove_tagged(&ch->parent->read_queue, ch->tag);
799
pl330_queue_remove_tagged(&ch->parent->write_queue, ch->tag);
800
ch->state = pl330_chan_stopped;
803
static void pl330_dmalpend(PL330Chan *ch, uint8_t opcode,
804
uint8_t *args, int len)
806
uint8_t nf = (opcode & 0x10) >> 4;
807
uint8_t bs = opcode & 3;
808
uint8_t lc = (opcode & 4) >> 2;
810
trace_pl330_dmalpend(nf, bs, lc, ch->lc[lc], ch->request_flag);
813
pl330_fault(ch, PL330_FAULT_OPERAND_INVALID);
816
if ((bs == 1 && ch->request_flag == PL330_BURST) ||
817
(bs == 3 && ch->request_flag == PL330_SINGLE)) {
821
if (!nf || ch->lc[lc]) {
825
trace_pl330_dmalpiter();
830
trace_pl330_dmalpfallthrough();
835
static void pl330_dmamov(PL330Chan *ch, uint8_t opcode, uint8_t *args, int len)
837
uint8_t rd = args[0] & 7;
840
if ((args[0] >> 3)) {
841
pl330_fault(ch, PL330_FAULT_OPERAND_INVALID);
844
im = (((uint32_t)args[4]) << 24) | (((uint32_t)args[3]) << 16) |
845
(((uint32_t)args[2]) << 8) | (((uint32_t)args[1]));
857
pl330_fault(ch, PL330_FAULT_OPERAND_INVALID);
862
static void pl330_dmanop(PL330Chan *ch, uint8_t opcode,
863
uint8_t *args, int len)
868
static void pl330_dmarmb(PL330Chan *ch, uint8_t opcode, uint8_t *args, int len)
870
if (pl330_queue_find_insn(&ch->parent->read_queue, ch->tag, false)) {
871
ch->state = pl330_chan_at_barrier;
875
ch->state = pl330_chan_executing;
879
static void pl330_dmasev(PL330Chan *ch, uint8_t opcode, uint8_t *args, int len)
884
pl330_fault(ch, PL330_FAULT_OPERAND_INVALID);
887
ev_id = (args[0] >> 3) & 0x1f;
888
if (ev_id >= ch->parent->num_events) {
889
pl330_fault(ch, PL330_FAULT_OPERAND_INVALID);
892
if (ch->ns && !(ch->parent->cfg[CFG_INS] & (1 << ev_id))) {
893
pl330_fault(ch, PL330_FAULT_EVENT_ERR);
896
if (ch->parent->inten & (1 << ev_id)) {
897
ch->parent->int_status |= (1 << ev_id);
898
trace_pl330_dmasev_evirq(ev_id);
899
qemu_irq_raise(ch->parent->irq[ev_id]);
901
trace_pl330_dmasev_event(ev_id);
902
ch->parent->ev_status |= (1 << ev_id);
905
static void pl330_dmast(PL330Chan *ch, uint8_t opcode, uint8_t *args, int len)
907
uint8_t bs = opcode & 3;
912
pl330_fault(ch, PL330_FAULT_OPERAND_INVALID);
915
if ((bs == 1 && ch->request_flag == PL330_BURST) ||
916
(bs == 3 && ch->request_flag == PL330_SINGLE)) {
920
num = ((ch->control >> 18) & 0xf) + 1;
921
size = (uint32_t)1 << ((ch->control >> 15) & 0x7);
922
inc = !!((ch->control >> 14) & 1);
923
ch->stall = pl330_queue_put_insn(&ch->parent->write_queue, ch->dst,
924
size, num, inc, 0, ch->tag);
926
trace_pl330_dmast(ch->tag, ch->dst, size, num, inc ? 'Y' : 'N');
927
ch->dst += inc ? size * num - (ch->dst & (size - 1)) : 0;
931
static void pl330_dmastp(PL330Chan *ch, uint8_t opcode,
932
uint8_t *args, int len)
937
pl330_fault(ch, PL330_FAULT_OPERAND_INVALID);
940
periph_id = (args[0] >> 3) & 0x1f;
941
if (periph_id >= ch->parent->num_periph_req) {
942
pl330_fault(ch, PL330_FAULT_OPERAND_INVALID);
945
if (ch->ns && !(ch->parent->cfg[CFG_PNS] & (1 << periph_id))) {
946
pl330_fault(ch, PL330_FAULT_CH_PERIPH_ERR);
949
pl330_dmast(ch, opcode, args, len);
952
static void pl330_dmastz(PL330Chan *ch, uint8_t opcode,
953
uint8_t *args, int len)
958
num = ((ch->control >> 18) & 0xf) + 1;
959
size = (uint32_t)1 << ((ch->control >> 15) & 0x7);
960
inc = !!((ch->control >> 14) & 1);
961
ch->stall = pl330_queue_put_insn(&ch->parent->write_queue, ch->dst,
962
size, num, inc, 1, ch->tag);
964
ch->dst += size * num;
968
static void pl330_dmawfe(PL330Chan *ch, uint8_t opcode,
969
uint8_t *args, int len)
975
pl330_fault(ch, PL330_FAULT_OPERAND_INVALID);
978
ev_id = (args[0] >> 3) & 0x1f;
979
if (ev_id >= ch->parent->num_events) {
980
pl330_fault(ch, PL330_FAULT_OPERAND_INVALID);
983
if (ch->ns && !(ch->parent->cfg[CFG_INS] & (1 << ev_id))) {
984
pl330_fault(ch, PL330_FAULT_EVENT_ERR);
988
ch->state = pl330_chan_waiting_event;
989
if (~ch->parent->inten & ch->parent->ev_status & 1 << ev_id) {
990
ch->state = pl330_chan_executing;
994
for (i = 0; i < ch->parent->num_chnls; ++i) {
995
PL330Chan *peer = &ch->parent->chan[i];
996
if (peer->state == pl330_chan_waiting_event &&
997
peer->wakeup == ev_id) {
1001
ch->parent->ev_status &= ~(1 << ev_id);
1002
trace_pl330_dmawfe(ev_id);
1008
static void pl330_dmawfp(PL330Chan *ch, uint8_t opcode,
1009
uint8_t *args, int len)
1011
uint8_t bs = opcode & 3;
1015
pl330_fault(ch, PL330_FAULT_OPERAND_INVALID);
1018
periph_id = (args[0] >> 3) & 0x1f;
1019
if (periph_id >= ch->parent->num_periph_req) {
1020
pl330_fault(ch, PL330_FAULT_OPERAND_INVALID);
1023
if (ch->ns && !(ch->parent->cfg[CFG_PNS] & (1 << periph_id))) {
1024
pl330_fault(ch, PL330_FAULT_CH_PERIPH_ERR);
1029
ch->request_flag = PL330_SINGLE;
1033
ch->request_flag = PL330_BURST;
1037
ch->request_flag = PL330_BURST;
1041
pl330_fault(ch, PL330_FAULT_OPERAND_INVALID);
1045
if (ch->parent->periph_busy[periph_id]) {
1046
ch->state = pl330_chan_waiting_periph;
1048
} else if (ch->state == pl330_chan_waiting_periph) {
1049
ch->state = pl330_chan_executing;
1053
static void pl330_dmawmb(PL330Chan *ch, uint8_t opcode,
1054
uint8_t *args, int len)
1056
if (pl330_queue_find_insn(&ch->parent->write_queue, ch->tag, false)) {
1057
ch->state = pl330_chan_at_barrier;
1061
ch->state = pl330_chan_executing;
1066
static const PL330InsnDesc insn_desc[] = {
1067
{ .opcode = 0x54, .opmask = 0xFD, .size = 3, .exec = pl330_dmaaddh, },
1068
{ .opcode = 0x5c, .opmask = 0xFD, .size = 3, .exec = pl330_dmaadnh, },
1069
{ .opcode = 0x00, .opmask = 0xFF, .size = 1, .exec = pl330_dmaend, },
1070
{ .opcode = 0x35, .opmask = 0xFF, .size = 2, .exec = pl330_dmaflushp, },
1071
{ .opcode = 0xA0, .opmask = 0xFD, .size = 6, .exec = pl330_dmago, },
1072
{ .opcode = 0x04, .opmask = 0xFC, .size = 1, .exec = pl330_dmald, },
1073
{ .opcode = 0x25, .opmask = 0xFD, .size = 2, .exec = pl330_dmaldp, },
1074
{ .opcode = 0x20, .opmask = 0xFD, .size = 2, .exec = pl330_dmalp, },
1078
{ .opcode = 0x29, .opmask = 0xFD, .size = 2, .exec = pl330_dmastp, },
1079
{ .opcode = 0x28, .opmask = 0xE8, .size = 2, .exec = pl330_dmalpend, },
1080
{ .opcode = 0x01, .opmask = 0xFF, .size = 1, .exec = pl330_dmakill, },
1081
{ .opcode = 0xBC, .opmask = 0xFF, .size = 6, .exec = pl330_dmamov, },
1082
{ .opcode = 0x18, .opmask = 0xFF, .size = 1, .exec = pl330_dmanop, },
1083
{ .opcode = 0x12, .opmask = 0xFF, .size = 1, .exec = pl330_dmarmb, },
1084
{ .opcode = 0x34, .opmask = 0xFF, .size = 2, .exec = pl330_dmasev, },
1085
{ .opcode = 0x08, .opmask = 0xFC, .size = 1, .exec = pl330_dmast, },
1086
{ .opcode = 0x0C, .opmask = 0xFF, .size = 1, .exec = pl330_dmastz, },
1087
{ .opcode = 0x36, .opmask = 0xFF, .size = 2, .exec = pl330_dmawfe, },
1088
{ .opcode = 0x30, .opmask = 0xFC, .size = 2, .exec = pl330_dmawfp, },
1089
{ .opcode = 0x13, .opmask = 0xFF, .size = 1, .exec = pl330_dmawmb, },
1090
{ .opcode = 0x00, .opmask = 0x00, .size = 0, .exec = NULL, }
1094
static const PL330InsnDesc debug_insn_desc[] = {
1095
{ .opcode = 0xA0, .opmask = 0xFD, .size = 6, .exec = pl330_dmago, },
1096
{ .opcode = 0x01, .opmask = 0xFF, .size = 1, .exec = pl330_dmakill, },
1097
{ .opcode = 0x34, .opmask = 0xFF, .size = 2, .exec = pl330_dmasev, },
1098
{ .opcode = 0x00, .opmask = 0x00, .size = 0, .exec = NULL, }
1101
static inline const PL330InsnDesc *pl330_fetch_insn(PL330Chan *ch)
1106
dma_memory_read(ch->parent->mem_as, ch->pc, &opcode, 1,
1107
MEMTXATTRS_UNSPECIFIED);
1108
for (i = 0; insn_desc[i].size; i++) {
1109
if ((opcode & insn_desc[i].opmask) == insn_desc[i].opcode) {
1110
return &insn_desc[i];
1116
static inline void pl330_exec_insn(PL330Chan *ch, const PL330InsnDesc *insn)
1118
uint8_t buf[PL330_INSN_MAXSIZE];
1120
assert(insn->size <= PL330_INSN_MAXSIZE);
1121
dma_memory_read(ch->parent->mem_as, ch->pc, buf, insn->size,
1122
MEMTXATTRS_UNSPECIFIED);
1123
insn->exec(ch, buf[0], &buf[1], insn->size - 1);
1126
static inline void pl330_update_pc(PL330Chan *ch,
1127
const PL330InsnDesc *insn)
1129
ch->pc += insn->size;
1134
static int pl330_chan_exec(PL330Chan *ch)
1136
const PL330InsnDesc *insn;
1138
if (ch->state != pl330_chan_executing &&
1139
ch->state != pl330_chan_waiting_periph &&
1140
ch->state != pl330_chan_at_barrier &&
1141
ch->state != pl330_chan_waiting_event) {
1145
insn = pl330_fetch_insn(ch);
1147
trace_pl330_chan_exec_undef();
1148
pl330_fault(ch, PL330_FAULT_UNDEF_INSTR);
1151
pl330_exec_insn(ch, insn);
1153
pl330_update_pc(ch, insn);
1154
ch->watchdog_timer = 0;
1157
} else if (ch->state == pl330_chan_executing) {
1158
ch->watchdog_timer++;
1159
if (ch->watchdog_timer >= PL330_WATCHDOG_LIMIT) {
1160
pl330_fault(ch, PL330_FAULT_LOCKUP_ERR);
1169
static int pl330_exec_cycle(PL330Chan *channel)
1171
PL330State *s = channel->parent;
1176
uint8_t buf[PL330_MAX_BURST_LEN];
1179
num_exec += pl330_chan_exec(channel);
1182
q = pl330_queue_find_insn(&s->read_queue, PL330_UNTAGGED, true);
1183
if (q != NULL && q->len <= pl330_fifo_num_free(&s->fifo)) {
1184
int len = q->len - (q->addr & (q->len - 1));
1186
dma_memory_read(s->mem_as, q->addr, buf, len,
1187
MEMTXATTRS_UNSPECIFIED);
1188
trace_pl330_exec_cycle(q->addr, len);
1189
if (trace_event_get_state_backends(TRACE_PL330_HEXDUMP)) {
1190
pl330_hexdump(buf, len);
1192
fifo_res = pl330_fifo_push(&s->fifo, buf, len, q->tag);
1193
if (fifo_res == PL330_FIFO_OK) {
1199
pl330_queue_remove_insn(&s->read_queue, q);
1206
q = pl330_queue_find_insn(&s->write_queue, pl330_fifo_tag(&s->fifo), true);
1208
int len = q->len - (q->addr & (q->len - 1));
1211
for (i = 0; i < len; i++) {
1215
fifo_res = pl330_fifo_get(&s->fifo, buf, len, q->tag);
1217
if (fifo_res == PL330_FIFO_OK || q->z) {
1218
dma_memory_write(s->mem_as, q->addr, buf, len,
1219
MEMTXATTRS_UNSPECIFIED);
1220
trace_pl330_exec_cycle(q->addr, len);
1221
if (trace_event_get_state_backends(TRACE_PL330_HEXDUMP)) {
1222
pl330_hexdump(buf, len);
1228
} else if (fifo_res == PL330_FIFO_STALL) {
1229
pl330_fault(&channel->parent->chan[q->tag],
1230
PL330_FAULT_FIFOEMPTY_ERR);
1234
pl330_queue_remove_insn(&s->write_queue, q);
1241
static int pl330_exec_channel(PL330Chan *channel)
1247
while (pl330_exec_cycle(channel)) {
1252
if (channel->state == pl330_chan_executing) {
1253
pl330_fault(channel, PL330_FAULT_LOCKUP_ERR);
1262
static inline void pl330_exec(PL330State *s)
1267
insr_exec = pl330_exec_channel(&s->manager);
1269
for (i = 0; i < s->num_chnls; i++) {
1270
insr_exec += pl330_exec_channel(&s->chan[i]);
1272
} while (insr_exec);
1275
static void pl330_exec_cycle_timer(void *opaque)
1277
PL330State *s = (PL330State *)opaque;
1283
static void pl330_dma_stop_irq(void *opaque, int irq, int level)
1285
PL330State *s = (PL330State *)opaque;
1287
if (s->periph_busy[irq] != level) {
1288
s->periph_busy[irq] = level;
1289
timer_mod(s->timer, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL));
1293
static void pl330_debug_exec(PL330State *s)
1300
const PL330InsnDesc *insn;
1302
s->debug_status = 1;
1303
chan_id = (s->dbg[0] >> 8) & 0x07;
1304
opcode = (s->dbg[0] >> 16) & 0xff;
1305
args[0] = (s->dbg[0] >> 24) & 0xff;
1306
args[1] = (s->dbg[1] >> 0) & 0xff;
1307
args[2] = (s->dbg[1] >> 8) & 0xff;
1308
args[3] = (s->dbg[1] >> 16) & 0xff;
1309
args[4] = (s->dbg[1] >> 24) & 0xff;
1310
trace_pl330_debug_exec(chan_id);
1311
if (s->dbg[0] & 1) {
1312
ch = &s->chan[chan_id];
1317
for (i = 0; debug_insn_desc[i].size; i++) {
1318
if ((opcode & debug_insn_desc[i].opmask) == debug_insn_desc[i].opcode) {
1319
insn = &debug_insn_desc[i];
1323
pl330_fault(ch, PL330_FAULT_UNDEF_INSTR | PL330_FAULT_DBG_INSTR);
1327
insn->exec(ch, opcode, args, insn->size - 1);
1328
if (ch->fault_type) {
1329
ch->fault_type |= PL330_FAULT_DBG_INSTR;
1332
trace_pl330_debug_exec_stall();
1333
qemu_log_mask(LOG_UNIMP, "pl330: stall of debug instruction not "
1336
s->debug_status = 0;
1341
static void pl330_iomem_write(void *opaque, hwaddr offset,
1342
uint64_t value, unsigned size)
1344
PL330State *s = (PL330State *) opaque;
1347
trace_pl330_iomem_write((unsigned)offset, (unsigned)value);
1350
case PL330_REG_INTEN:
1353
case PL330_REG_INTCLR:
1354
for (i = 0; i < s->num_events; i++) {
1355
if (s->int_status & s->inten & value & (1 << i)) {
1356
trace_pl330_iomem_write_clr(i);
1357
qemu_irq_lower(s->irq[i]);
1360
s->ev_status &= ~(value & s->inten);
1361
s->int_status &= ~(value & s->inten);
1363
case PL330_REG_DBGCMD:
1364
if ((value & 3) == 0) {
1365
pl330_debug_exec(s);
1368
qemu_log_mask(LOG_GUEST_ERROR, "pl330: write of illegal value %u "
1369
"for offset " HWADDR_FMT_plx "\n", (unsigned)value,
1373
case PL330_REG_DBGINST0:
1376
case PL330_REG_DBGINST1:
1380
qemu_log_mask(LOG_GUEST_ERROR, "pl330: bad write offset " HWADDR_FMT_plx
1386
static inline uint32_t pl330_iomem_read_imp(void *opaque,
1389
PL330State *s = (PL330State *)opaque;
1394
if (offset >= PL330_REG_PERIPH_ID && offset < PL330_REG_PERIPH_ID + 32) {
1395
return pl330_id[(offset - PL330_REG_PERIPH_ID) >> 2];
1397
if (offset >= PL330_REG_CR0_BASE && offset < PL330_REG_CR0_BASE + 24) {
1398
return s->cfg[(offset - PL330_REG_CR0_BASE) >> 2];
1400
if (offset >= PL330_REG_CHANCTRL && offset < PL330_REG_DBGSTATUS) {
1401
offset -= PL330_REG_CHANCTRL;
1402
chan_id = offset >> 5;
1403
if (chan_id >= s->num_chnls) {
1404
qemu_log_mask(LOG_GUEST_ERROR, "pl330: bad read offset "
1405
HWADDR_FMT_plx "\n", offset);
1408
switch (offset & 0x1f) {
1410
return s->chan[chan_id].src;
1412
return s->chan[chan_id].dst;
1414
return s->chan[chan_id].control;
1416
return s->chan[chan_id].lc[0];
1418
return s->chan[chan_id].lc[1];
1420
qemu_log_mask(LOG_GUEST_ERROR, "pl330: bad read offset "
1421
HWADDR_FMT_plx "\n", offset);
1425
if (offset >= PL330_REG_CSR_BASE && offset < 0x400) {
1426
offset -= PL330_REG_CSR_BASE;
1427
chan_id = offset >> 3;
1428
if (chan_id >= s->num_chnls) {
1429
qemu_log_mask(LOG_GUEST_ERROR, "pl330: bad read offset "
1430
HWADDR_FMT_plx "\n", offset);
1433
switch ((offset >> 2) & 1) {
1435
res = (s->chan[chan_id].ns << 21) |
1436
(s->chan[chan_id].wakeup << 4) |
1437
(s->chan[chan_id].state) |
1438
(s->chan[chan_id].wfp_sbp << 14);
1441
return s->chan[chan_id].pc;
1443
qemu_log_mask(LOG_GUEST_ERROR, "pl330: read error\n");
1447
if (offset >= PL330_REG_FTR_BASE && offset < 0x100) {
1448
offset -= PL330_REG_FTR_BASE;
1449
chan_id = offset >> 2;
1450
if (chan_id >= s->num_chnls) {
1451
qemu_log_mask(LOG_GUEST_ERROR, "pl330: bad read offset "
1452
HWADDR_FMT_plx "\n", offset);
1455
return s->chan[chan_id].fault_type;
1459
return (s->manager.ns << 9) | (s->manager.wakeup << 4) |
1460
(s->manager.state & 0xf);
1462
return s->manager.pc;
1463
case PL330_REG_INTEN:
1465
case PL330_REG_INT_EVENT_RIS:
1466
return s->ev_status;
1467
case PL330_REG_INTMIS:
1468
return s->int_status;
1469
case PL330_REG_INTCLR:
1474
case PL330_REG_FSRD:
1475
return s->manager.state ? 1 : 0;
1476
case PL330_REG_FSRC:
1478
for (i = 0; i < s->num_chnls; i++) {
1479
if (s->chan[i].state == pl330_chan_fault ||
1480
s->chan[i].state == pl330_chan_fault_completing) {
1485
case PL330_REG_FTRD:
1486
return s->manager.fault_type;
1487
case PL330_REG_DBGSTATUS:
1488
return s->debug_status;
1490
qemu_log_mask(LOG_GUEST_ERROR, "pl330: bad read offset "
1491
HWADDR_FMT_plx "\n", offset);
1496
static uint64_t pl330_iomem_read(void *opaque, hwaddr offset,
1499
uint32_t ret = pl330_iomem_read_imp(opaque, offset);
1500
trace_pl330_iomem_read((uint32_t)offset, ret);
1504
static const MemoryRegionOps pl330_ops = {
1505
.read = pl330_iomem_read,
1506
.write = pl330_iomem_write,
1507
.endianness = DEVICE_NATIVE_ENDIAN,
1509
.min_access_size = 4,
1510
.max_access_size = 4,
1516
static void pl330_chan_reset(PL330Chan *ch)
1521
ch->state = pl330_chan_stopped;
1522
ch->watchdog_timer = 0;
1529
static void pl330_reset(DeviceState *d)
1532
PL330State *s = PL330(d);
1537
s->debug_status = 0;
1538
s->num_faulting = 0;
1539
s->manager.ns = s->mgr_ns_at_rst;
1540
pl330_fifo_reset(&s->fifo);
1541
pl330_queue_reset(&s->read_queue);
1542
pl330_queue_reset(&s->write_queue);
1544
for (i = 0; i < s->num_chnls; i++) {
1545
pl330_chan_reset(&s->chan[i]);
1547
for (i = 0; i < s->num_periph_req; i++) {
1548
s->periph_busy[i] = 0;
1551
timer_del(s->timer);
1554
static void pl330_realize(DeviceState *dev, Error **errp)
1557
PL330State *s = PL330(dev);
1559
sysbus_init_irq(SYS_BUS_DEVICE(dev), &s->irq_abort);
1560
memory_region_init_io(&s->iomem, OBJECT(s), &pl330_ops, s,
1561
"dma", PL330_IOMEM_SIZE);
1562
sysbus_init_mmio(SYS_BUS_DEVICE(dev), &s->iomem);
1565
error_setg(errp, "'memory' link is not set");
1567
} else if (s->mem_mr == get_system_memory()) {
1569
s->mem_as = &address_space_memory;
1571
s->mem_as = g_new0(AddressSpace, 1);
1572
address_space_init(s->mem_as, s->mem_mr,
1573
memory_region_name(s->mem_mr));
1576
s->timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, pl330_exec_cycle_timer, s);
1578
s->cfg[0] = (s->mgr_ns_at_rst ? 0x4 : 0) |
1579
(s->num_periph_req > 0 ? 1 : 0) |
1580
((s->num_chnls - 1) & 0x7) << 4 |
1581
((s->num_periph_req - 1) & 0x1f) << 12 |
1582
((s->num_events - 1) & 0x1f) << 17;
1584
switch (s->i_cache_len) {
1598
error_setg(errp, "Bad value for i-cache_len property: %" PRIx8,
1602
s->cfg[1] |= ((s->num_i_cache_lines - 1) & 0xf) << 4;
1604
s->chan = g_new0(PL330Chan, s->num_chnls);
1605
s->hi_seqn = g_new0(uint8_t, s->num_chnls);
1606
s->lo_seqn = g_new0(uint8_t, s->num_chnls);
1607
for (i = 0; i < s->num_chnls; i++) {
1608
s->chan[i].parent = s;
1609
s->chan[i].tag = (uint8_t)i;
1611
s->manager.parent = s;
1612
s->manager.tag = s->num_chnls;
1613
s->manager.is_manager = true;
1615
s->irq = g_new0(qemu_irq, s->num_events);
1616
for (i = 0; i < s->num_events; i++) {
1617
sysbus_init_irq(SYS_BUS_DEVICE(dev), &s->irq[i]);
1620
qdev_init_gpio_in(dev, pl330_dma_stop_irq, PL330_PERIPH_NUM);
1622
switch (s->data_width) {
1624
s->cfg[CFG_CRD] |= 0x2;
1627
s->cfg[CFG_CRD] |= 0x3;
1630
s->cfg[CFG_CRD] |= 0x4;
1633
error_setg(errp, "Bad value for data_width property: %" PRIx8,
1638
s->cfg[CFG_CRD] |= ((s->wr_cap - 1) & 0x7) << 4 |
1639
((s->wr_q_dep - 1) & 0xf) << 8 |
1640
((s->rd_cap - 1) & 0x7) << 12 |
1641
((s->rd_q_dep - 1) & 0xf) << 16 |
1642
((s->data_buffer_dep - 1) & 0x1ff) << 20;
1644
pl330_queue_init(&s->read_queue, s->rd_q_dep, s);
1645
pl330_queue_init(&s->write_queue, s->wr_q_dep, s);
1646
pl330_fifo_init(&s->fifo, s->data_width / 4 * s->data_buffer_dep);
1649
static Property pl330_properties[] = {
1651
DEFINE_PROP_UINT32("num_chnls", PL330State, num_chnls, 8),
1652
DEFINE_PROP_UINT8("num_periph_req", PL330State, num_periph_req, 4),
1653
DEFINE_PROP_UINT8("num_events", PL330State, num_events, 16),
1654
DEFINE_PROP_UINT8("mgr_ns_at_rst", PL330State, mgr_ns_at_rst, 0),
1656
DEFINE_PROP_UINT8("i-cache_len", PL330State, i_cache_len, 4),
1657
DEFINE_PROP_UINT8("num_i-cache_lines", PL330State, num_i_cache_lines, 8),
1659
DEFINE_PROP_UINT32("boot_addr", PL330State, cfg[CFG_BOOT_ADDR], 0),
1660
DEFINE_PROP_UINT32("INS", PL330State, cfg[CFG_INS], 0),
1661
DEFINE_PROP_UINT32("PNS", PL330State, cfg[CFG_PNS], 0),
1663
DEFINE_PROP_UINT8("data_width", PL330State, data_width, 64),
1664
DEFINE_PROP_UINT8("wr_cap", PL330State, wr_cap, 8),
1665
DEFINE_PROP_UINT8("wr_q_dep", PL330State, wr_q_dep, 16),
1666
DEFINE_PROP_UINT8("rd_cap", PL330State, rd_cap, 8),
1667
DEFINE_PROP_UINT8("rd_q_dep", PL330State, rd_q_dep, 16),
1668
DEFINE_PROP_UINT16("data_buffer_dep", PL330State, data_buffer_dep, 256),
1670
DEFINE_PROP_LINK("memory", PL330State, mem_mr,
1671
TYPE_MEMORY_REGION, MemoryRegion *),
1673
DEFINE_PROP_END_OF_LIST(),
1676
static void pl330_class_init(ObjectClass *klass, void *data)
1678
DeviceClass *dc = DEVICE_CLASS(klass);
1680
dc->realize = pl330_realize;
1681
dc->reset = pl330_reset;
1682
device_class_set_props(dc, pl330_properties);
1683
dc->vmsd = &vmstate_pl330;
1686
static const TypeInfo pl330_type_info = {
1688
.parent = TYPE_SYS_BUS_DEVICE,
1689
.instance_size = sizeof(PL330State),
1690
.class_init = pl330_class_init,
1693
static void pl330_register_types(void)
1695
type_register_static(&pl330_type_info);
1698
type_init(pl330_register_types)