xref: /openbmc/qemu/hw/dma/pl330.c (revision db725815985654007ade0fd53590d613fd657208)
1 /*
2  * ARM PrimeCell PL330 DMA Controller
3  *
4  * Copyright (c) 2009 Samsung Electronics.
5  * Contributed by Kirill Batuzov <batuzovk@ispras.ru>
6  * Copyright (c) 2012 Peter A.G. Crosthwaite (peter.crosthwaite@petalogix.com)
7  * Copyright (c) 2012 PetaLogix Pty Ltd.
8  *
9  * This program is free software; you can redistribute it and/or
10  * modify it under the terms of the GNU General Public License
11  * as published by the Free Software Foundation; version 2 or later.
12  *
13  * You should have received a copy of the GNU General Public License along
14  * with this program; if not, see <http://www.gnu.org/licenses/>.
15  */
16 
17 #include "qemu/osdep.h"
18 #include "qemu-common.h"
19 #include "hw/irq.h"
20 #include "hw/sysbus.h"
21 #include "migration/vmstate.h"
22 #include "qapi/error.h"
23 #include "qemu/timer.h"
24 #include "sysemu/dma.h"
25 #include "qemu/log.h"
26 #include "qemu/module.h"
27 
28 #ifndef PL330_ERR_DEBUG
29 #define PL330_ERR_DEBUG 0
30 #endif
31 
32 #define DB_PRINT_L(lvl, fmt, args...) do {\
33     if (PL330_ERR_DEBUG >= lvl) {\
34         fprintf(stderr, "PL330: %s:" fmt, __func__, ## args);\
35     } \
36 } while (0)
37 
38 #define DB_PRINT(fmt, args...) DB_PRINT_L(1, fmt, ## args)
39 
40 #define PL330_PERIPH_NUM            32
41 #define PL330_MAX_BURST_LEN         128
42 #define PL330_INSN_MAXSIZE          6
43 
44 #define PL330_FIFO_OK               0
45 #define PL330_FIFO_STALL            1
46 #define PL330_FIFO_ERR              (-1)
47 
48 #define PL330_FAULT_UNDEF_INSTR             (1 <<  0)
49 #define PL330_FAULT_OPERAND_INVALID         (1 <<  1)
50 #define PL330_FAULT_DMAGO_ERR               (1 <<  4)
51 #define PL330_FAULT_EVENT_ERR               (1 <<  5)
52 #define PL330_FAULT_CH_PERIPH_ERR           (1 <<  6)
53 #define PL330_FAULT_CH_RDWR_ERR             (1 <<  7)
54 #define PL330_FAULT_ST_DATA_UNAVAILABLE     (1 << 12)
55 #define PL330_FAULT_FIFOEMPTY_ERR           (1 << 13)
56 #define PL330_FAULT_INSTR_FETCH_ERR         (1 << 16)
57 #define PL330_FAULT_DATA_WRITE_ERR          (1 << 17)
58 #define PL330_FAULT_DATA_READ_ERR           (1 << 18)
59 #define PL330_FAULT_DBG_INSTR               (1 << 30)
60 #define PL330_FAULT_LOCKUP_ERR              (1 << 31)
61 
62 #define PL330_UNTAGGED              0xff
63 
64 #define PL330_SINGLE                0x0
65 #define PL330_BURST                 0x1
66 
67 #define PL330_WATCHDOG_LIMIT        1024
68 
69 /* IOMEM mapped registers */
70 #define PL330_REG_DSR               0x000
71 #define PL330_REG_DPC               0x004
72 #define PL330_REG_INTEN             0x020
73 #define PL330_REG_INT_EVENT_RIS     0x024
74 #define PL330_REG_INTMIS            0x028
75 #define PL330_REG_INTCLR            0x02C
76 #define PL330_REG_FSRD              0x030
77 #define PL330_REG_FSRC              0x034
78 #define PL330_REG_FTRD              0x038
79 #define PL330_REG_FTR_BASE          0x040
80 #define PL330_REG_CSR_BASE          0x100
81 #define PL330_REG_CPC_BASE          0x104
82 #define PL330_REG_CHANCTRL          0x400
83 #define PL330_REG_DBGSTATUS         0xD00
84 #define PL330_REG_DBGCMD            0xD04
85 #define PL330_REG_DBGINST0          0xD08
86 #define PL330_REG_DBGINST1          0xD0C
87 #define PL330_REG_CR0_BASE          0xE00
88 #define PL330_REG_PERIPH_ID         0xFE0
89 
90 #define PL330_IOMEM_SIZE    0x1000
91 
92 #define CFG_BOOT_ADDR 2
93 #define CFG_INS 3
94 #define CFG_PNS 4
95 #define CFG_CRD 5
96 
97 static const uint32_t pl330_id[] = {
98     0x30, 0x13, 0x24, 0x00, 0x0D, 0xF0, 0x05, 0xB1
99 };
100 
101 /* DMA channel states as they are described in PL330 Technical Reference Manual
102  * Most of them will not be used in emulation.
103  */
104 typedef enum  {
105     pl330_chan_stopped = 0,
106     pl330_chan_executing = 1,
107     pl330_chan_cache_miss = 2,
108     pl330_chan_updating_pc = 3,
109     pl330_chan_waiting_event = 4,
110     pl330_chan_at_barrier = 5,
111     pl330_chan_queue_busy = 6,
112     pl330_chan_waiting_periph = 7,
113     pl330_chan_killing = 8,
114     pl330_chan_completing = 9,
115     pl330_chan_fault_completing = 14,
116     pl330_chan_fault = 15,
117 } PL330ChanState;
118 
119 typedef struct PL330State PL330State;
120 
121 typedef struct PL330Chan {
122     uint32_t src;
123     uint32_t dst;
124     uint32_t pc;
125     uint32_t control;
126     uint32_t status;
127     uint32_t lc[2];
128     uint32_t fault_type;
129     uint32_t watchdog_timer;
130 
131     bool ns;
132     uint8_t request_flag;
133     uint8_t wakeup;
134     uint8_t wfp_sbp;
135 
136     uint8_t state;
137     uint8_t stall;
138 
139     bool is_manager;
140     PL330State *parent;
141     uint8_t tag;
142 } PL330Chan;
143 
144 static const VMStateDescription vmstate_pl330_chan = {
145     .name = "pl330_chan",
146     .version_id = 1,
147     .minimum_version_id = 1,
148     .fields = (VMStateField[]) {
149         VMSTATE_UINT32(src, PL330Chan),
150         VMSTATE_UINT32(dst, PL330Chan),
151         VMSTATE_UINT32(pc, PL330Chan),
152         VMSTATE_UINT32(control, PL330Chan),
153         VMSTATE_UINT32(status, PL330Chan),
154         VMSTATE_UINT32_ARRAY(lc, PL330Chan, 2),
155         VMSTATE_UINT32(fault_type, PL330Chan),
156         VMSTATE_UINT32(watchdog_timer, PL330Chan),
157         VMSTATE_BOOL(ns, PL330Chan),
158         VMSTATE_UINT8(request_flag, PL330Chan),
159         VMSTATE_UINT8(wakeup, PL330Chan),
160         VMSTATE_UINT8(wfp_sbp, PL330Chan),
161         VMSTATE_UINT8(state, PL330Chan),
162         VMSTATE_UINT8(stall, PL330Chan),
163         VMSTATE_END_OF_LIST()
164     }
165 };
166 
167 typedef struct PL330Fifo {
168     uint8_t *buf;
169     uint8_t *tag;
170     uint32_t head;
171     uint32_t num;
172     uint32_t buf_size;
173 } PL330Fifo;
174 
175 static const VMStateDescription vmstate_pl330_fifo = {
176     .name = "pl330_chan",
177     .version_id = 1,
178     .minimum_version_id = 1,
179     .fields = (VMStateField[]) {
180         VMSTATE_VBUFFER_UINT32(buf, PL330Fifo, 1, NULL, buf_size),
181         VMSTATE_VBUFFER_UINT32(tag, PL330Fifo, 1, NULL, buf_size),
182         VMSTATE_UINT32(head, PL330Fifo),
183         VMSTATE_UINT32(num, PL330Fifo),
184         VMSTATE_UINT32(buf_size, PL330Fifo),
185         VMSTATE_END_OF_LIST()
186     }
187 };
188 
189 typedef struct PL330QueueEntry {
190     uint32_t addr;
191     uint32_t len;
192     uint8_t n;
193     bool inc;
194     bool z;
195     uint8_t tag;
196     uint8_t seqn;
197 } PL330QueueEntry;
198 
199 static const VMStateDescription vmstate_pl330_queue_entry = {
200     .name = "pl330_queue_entry",
201     .version_id = 1,
202     .minimum_version_id = 1,
203     .fields = (VMStateField[]) {
204         VMSTATE_UINT32(addr, PL330QueueEntry),
205         VMSTATE_UINT32(len, PL330QueueEntry),
206         VMSTATE_UINT8(n, PL330QueueEntry),
207         VMSTATE_BOOL(inc, PL330QueueEntry),
208         VMSTATE_BOOL(z, PL330QueueEntry),
209         VMSTATE_UINT8(tag, PL330QueueEntry),
210         VMSTATE_UINT8(seqn, PL330QueueEntry),
211         VMSTATE_END_OF_LIST()
212     }
213 };
214 
215 typedef struct PL330Queue {
216     PL330State *parent;
217     PL330QueueEntry *queue;
218     uint32_t queue_size;
219 } PL330Queue;
220 
221 static const VMStateDescription vmstate_pl330_queue = {
222     .name = "pl330_queue",
223     .version_id = 2,
224     .minimum_version_id = 2,
225     .fields = (VMStateField[]) {
226         VMSTATE_STRUCT_VARRAY_POINTER_UINT32(queue, PL330Queue, queue_size,
227                                              vmstate_pl330_queue_entry,
228                                              PL330QueueEntry),
229         VMSTATE_END_OF_LIST()
230     }
231 };
232 
233 struct PL330State {
234     SysBusDevice parent_obj;
235 
236     MemoryRegion iomem;
237     qemu_irq irq_abort;
238     qemu_irq *irq;
239 
240     /* Config registers. cfg[5] = CfgDn. */
241     uint32_t cfg[6];
242 #define EVENT_SEC_STATE 3
243 #define PERIPH_SEC_STATE 4
244     /* cfg 0 bits and pieces */
245     uint32_t num_chnls;
246     uint8_t num_periph_req;
247     uint8_t num_events;
248     uint8_t mgr_ns_at_rst;
249     /* cfg 1 bits and pieces */
250     uint8_t i_cache_len;
251     uint8_t num_i_cache_lines;
252     /* CRD bits and pieces */
253     uint8_t data_width;
254     uint8_t wr_cap;
255     uint8_t wr_q_dep;
256     uint8_t rd_cap;
257     uint8_t rd_q_dep;
258     uint16_t data_buffer_dep;
259 
260     PL330Chan manager;
261     PL330Chan *chan;
262     PL330Fifo fifo;
263     PL330Queue read_queue;
264     PL330Queue write_queue;
265     uint8_t *lo_seqn;
266     uint8_t *hi_seqn;
267     QEMUTimer *timer; /* is used for restore dma. */
268 
269     uint32_t inten;
270     uint32_t int_status;
271     uint32_t ev_status;
272     uint32_t dbg[2];
273     uint8_t debug_status;
274     uint8_t num_faulting;
275     uint8_t periph_busy[PL330_PERIPH_NUM];
276 
277 };
278 
279 #define TYPE_PL330 "pl330"
280 #define PL330(obj) OBJECT_CHECK(PL330State, (obj), TYPE_PL330)
281 
282 static const VMStateDescription vmstate_pl330 = {
283     .name = "pl330",
284     .version_id = 2,
285     .minimum_version_id = 2,
286     .fields = (VMStateField[]) {
287         VMSTATE_STRUCT(manager, PL330State, 0, vmstate_pl330_chan, PL330Chan),
288         VMSTATE_STRUCT_VARRAY_POINTER_UINT32(chan, PL330State, num_chnls,
289                                              vmstate_pl330_chan, PL330Chan),
290         VMSTATE_VBUFFER_UINT32(lo_seqn, PL330State, 1, NULL, num_chnls),
291         VMSTATE_VBUFFER_UINT32(hi_seqn, PL330State, 1, NULL, num_chnls),
292         VMSTATE_STRUCT(fifo, PL330State, 0, vmstate_pl330_fifo, PL330Fifo),
293         VMSTATE_STRUCT(read_queue, PL330State, 0, vmstate_pl330_queue,
294                        PL330Queue),
295         VMSTATE_STRUCT(write_queue, PL330State, 0, vmstate_pl330_queue,
296                        PL330Queue),
297         VMSTATE_TIMER_PTR(timer, PL330State),
298         VMSTATE_UINT32(inten, PL330State),
299         VMSTATE_UINT32(int_status, PL330State),
300         VMSTATE_UINT32(ev_status, PL330State),
301         VMSTATE_UINT32_ARRAY(dbg, PL330State, 2),
302         VMSTATE_UINT8(debug_status, PL330State),
303         VMSTATE_UINT8(num_faulting, PL330State),
304         VMSTATE_UINT8_ARRAY(periph_busy, PL330State, PL330_PERIPH_NUM),
305         VMSTATE_END_OF_LIST()
306     }
307 };
308 
309 typedef struct PL330InsnDesc {
310     /* OPCODE of the instruction */
311     uint8_t opcode;
312     /* Mask so we can select several sibling instructions, such as
313        DMALD, DMALDS and DMALDB */
314     uint8_t opmask;
315     /* Size of instruction in bytes */
316     uint8_t size;
317     /* Interpreter */
318     void (*exec)(PL330Chan *, uint8_t opcode, uint8_t *args, int len);
319 } PL330InsnDesc;
320 
321 
322 /* MFIFO Implementation
323  *
324  * MFIFO is implemented as a cyclic buffer of BUF_SIZE size. Tagged bytes are
325  * stored in this buffer. Data is stored in BUF field, tags - in the
326  * corresponding array elements of TAG field.
327  */
328 
329 /* Initialize queue. */
330 
331 static void pl330_fifo_init(PL330Fifo *s, uint32_t size)
332 {
333     s->buf = g_malloc0(size);
334     s->tag = g_malloc0(size);
335     s->buf_size = size;
336 }
337 
338 /* Cyclic increment */
339 
340 static inline int pl330_fifo_inc(PL330Fifo *s, int x)
341 {
342     return (x + 1) % s->buf_size;
343 }
344 
345 /* Number of empty bytes in MFIFO */
346 
347 static inline int pl330_fifo_num_free(PL330Fifo *s)
348 {
349     return s->buf_size - s->num;
350 }
351 
352 /* Push LEN bytes of data stored in BUF to MFIFO and tag it with TAG.
353  * Zero returned on success, PL330_FIFO_STALL if there is no enough free
354  * space in MFIFO to store requested amount of data. If push was unsuccessful
355  * no data is stored to MFIFO.
356  */
357 
358 static int pl330_fifo_push(PL330Fifo *s, uint8_t *buf, int len, uint8_t tag)
359 {
360     int i;
361 
362     if (s->buf_size - s->num < len) {
363         return PL330_FIFO_STALL;
364     }
365     for (i = 0; i < len; i++) {
366         int push_idx = (s->head + s->num + i) % s->buf_size;
367         s->buf[push_idx] = buf[i];
368         s->tag[push_idx] = tag;
369     }
370     s->num += len;
371     return PL330_FIFO_OK;
372 }
373 
374 /* Get LEN bytes of data from MFIFO and store it to BUF. Tag value of each
375  * byte is verified. Zero returned on success, PL330_FIFO_ERR on tag mismatch
376  * and PL330_FIFO_STALL if there is no enough data in MFIFO. If get was
377  * unsuccessful no data is removed from MFIFO.
378  */
379 
380 static int pl330_fifo_get(PL330Fifo *s, uint8_t *buf, int len, uint8_t tag)
381 {
382     int i;
383 
384     if (s->num < len) {
385         return PL330_FIFO_STALL;
386     }
387     for (i = 0; i < len; i++) {
388         if (s->tag[s->head] == tag) {
389             int get_idx = (s->head + i) % s->buf_size;
390             buf[i] = s->buf[get_idx];
391         } else { /* Tag mismatch - Rollback transaction */
392             return PL330_FIFO_ERR;
393         }
394     }
395     s->head = (s->head + len) % s->buf_size;
396     s->num -= len;
397     return PL330_FIFO_OK;
398 }
399 
400 /* Reset MFIFO. This completely erases all data in it. */
401 
402 static inline void pl330_fifo_reset(PL330Fifo *s)
403 {
404     s->head = 0;
405     s->num = 0;
406 }
407 
408 /* Return tag of the first byte stored in MFIFO. If MFIFO is empty
409  * PL330_UNTAGGED is returned.
410  */
411 
412 static inline uint8_t pl330_fifo_tag(PL330Fifo *s)
413 {
414     return (!s->num) ? PL330_UNTAGGED : s->tag[s->head];
415 }
416 
417 /* Returns non-zero if tag TAG is present in fifo or zero otherwise */
418 
419 static int pl330_fifo_has_tag(PL330Fifo *s, uint8_t tag)
420 {
421     int i, n;
422 
423     i = s->head;
424     for (n = 0; n < s->num; n++) {
425         if (s->tag[i] == tag) {
426             return 1;
427         }
428         i = pl330_fifo_inc(s, i);
429     }
430     return 0;
431 }
432 
433 /* Remove all entry tagged with TAG from MFIFO */
434 
435 static void pl330_fifo_tagged_remove(PL330Fifo *s, uint8_t tag)
436 {
437     int i, t, n;
438 
439     t = i = s->head;
440     for (n = 0; n < s->num; n++) {
441         if (s->tag[i] != tag) {
442             s->buf[t] = s->buf[i];
443             s->tag[t] = s->tag[i];
444             t = pl330_fifo_inc(s, t);
445         } else {
446             s->num = s->num - 1;
447         }
448         i = pl330_fifo_inc(s, i);
449     }
450 }
451 
452 /* Read-Write Queue implementation
453  *
454  * A Read-Write Queue stores up to QUEUE_SIZE instructions (loads or stores).
455  * Each instruction is described by source (for loads) or destination (for
456  * stores) address ADDR, width of data to be loaded/stored LEN, number of
457  * stores/loads to be performed N, INC bit, Z bit and TAG to identify channel
458  * this instruction belongs to. Queue does not store any information about
459  * nature of the instruction: is it load or store. PL330 has different queues
460  * for loads and stores so this is already known at the top level where it
461  * matters.
462  *
463  * Queue works as FIFO for instructions with equivalent tags, but can issue
464  * instructions with different tags in arbitrary order. SEQN field attached to
465  * each instruction helps to achieve this. For each TAG queue contains
466  * instructions with consecutive SEQN values ranging from LO_SEQN[TAG] to
467  * HI_SEQN[TAG]-1 inclusive. SEQN is 8-bit unsigned integer, so SEQN=255 is
468  * followed by SEQN=0.
469  *
470  * Z bit indicates that zeroes should be stored. No MFIFO fetches are performed
471  * in this case.
472  */
473 
474 static void pl330_queue_reset(PL330Queue *s)
475 {
476     int i;
477 
478     for (i = 0; i < s->queue_size; i++) {
479         s->queue[i].tag = PL330_UNTAGGED;
480     }
481 }
482 
483 /* Initialize queue */
484 static void pl330_queue_init(PL330Queue *s, int size, PL330State *parent)
485 {
486     s->parent = parent;
487     s->queue = g_new0(PL330QueueEntry, size);
488     s->queue_size = size;
489 }
490 
491 /* Returns pointer to an empty slot or NULL if queue is full */
492 static PL330QueueEntry *pl330_queue_find_empty(PL330Queue *s)
493 {
494     int i;
495 
496     for (i = 0; i < s->queue_size; i++) {
497         if (s->queue[i].tag == PL330_UNTAGGED) {
498             return &s->queue[i];
499         }
500     }
501     return NULL;
502 }
503 
504 /* Put instruction in queue.
505  * Return value:
506  * - zero - OK
507  * - non-zero - queue is full
508  */
509 
510 static int pl330_queue_put_insn(PL330Queue *s, uint32_t addr,
511                                 int len, int n, bool inc, bool z, uint8_t tag)
512 {
513     PL330QueueEntry *entry = pl330_queue_find_empty(s);
514 
515     if (!entry) {
516         return 1;
517     }
518     entry->tag = tag;
519     entry->addr = addr;
520     entry->len = len;
521     entry->n = n;
522     entry->z = z;
523     entry->inc = inc;
524     entry->seqn = s->parent->hi_seqn[tag];
525     s->parent->hi_seqn[tag]++;
526     return 0;
527 }
528 
529 /* Returns a pointer to queue slot containing instruction which satisfies
530  *  following conditions:
531  *   - it has valid tag value (not PL330_UNTAGGED)
532  *   - if enforce_seq is set it has to be issuable without violating queue
533  *     logic (see above)
534  *   - if TAG argument is not PL330_UNTAGGED this instruction has tag value
535  *     equivalent to the argument TAG value.
536  *  If such instruction cannot be found NULL is returned.
537  */
538 
539 static PL330QueueEntry *pl330_queue_find_insn(PL330Queue *s, uint8_t tag,
540                                               bool enforce_seq)
541 {
542     int i;
543 
544     for (i = 0; i < s->queue_size; i++) {
545         if (s->queue[i].tag != PL330_UNTAGGED) {
546             if ((!enforce_seq ||
547                     s->queue[i].seqn == s->parent->lo_seqn[s->queue[i].tag]) &&
548                     (s->queue[i].tag == tag || tag == PL330_UNTAGGED ||
549                     s->queue[i].z)) {
550                 return &s->queue[i];
551             }
552         }
553     }
554     return NULL;
555 }
556 
557 /* Removes instruction from queue. */
558 
559 static inline void pl330_queue_remove_insn(PL330Queue *s, PL330QueueEntry *e)
560 {
561     s->parent->lo_seqn[e->tag]++;
562     e->tag = PL330_UNTAGGED;
563 }
564 
565 /* Removes all instructions tagged with TAG from queue. */
566 
567 static inline void pl330_queue_remove_tagged(PL330Queue *s, uint8_t tag)
568 {
569     int i;
570 
571     for (i = 0; i < s->queue_size; i++) {
572         if (s->queue[i].tag == tag) {
573             s->queue[i].tag = PL330_UNTAGGED;
574         }
575     }
576 }
577 
578 /* DMA instruction execution engine */
579 
580 /* Moves DMA channel to the FAULT state and updates it's status. */
581 
582 static inline void pl330_fault(PL330Chan *ch, uint32_t flags)
583 {
584     DB_PRINT("ch: %p, flags: %" PRIx32 "\n", ch, flags);
585     ch->fault_type |= flags;
586     if (ch->state == pl330_chan_fault) {
587         return;
588     }
589     ch->state = pl330_chan_fault;
590     ch->parent->num_faulting++;
591     if (ch->parent->num_faulting == 1) {
592         DB_PRINT("abort interrupt raised\n");
593         qemu_irq_raise(ch->parent->irq_abort);
594     }
595 }
596 
597 /*
598  * For information about instructions see PL330 Technical Reference Manual.
599  *
600  * Arguments:
601  *   CH - channel executing the instruction
602  *   OPCODE - opcode
603  *   ARGS - array of 8-bit arguments
604  *   LEN - number of elements in ARGS array
605  */
606 
607 static void pl330_dmaadxh(PL330Chan *ch, uint8_t *args, bool ra, bool neg)
608 {
609     uint32_t im = (args[1] << 8) | args[0];
610     if (neg) {
611         im |= 0xffffu << 16;
612     }
613 
614     if (ch->is_manager) {
615         pl330_fault(ch, PL330_FAULT_UNDEF_INSTR);
616         return;
617     }
618     if (ra) {
619         ch->dst += im;
620     } else {
621         ch->src += im;
622     }
623 }
624 
625 static void pl330_dmaaddh(PL330Chan *ch, uint8_t opcode, uint8_t *args, int len)
626 {
627     pl330_dmaadxh(ch, args, extract32(opcode, 1, 1), false);
628 }
629 
630 static void pl330_dmaadnh(PL330Chan *ch, uint8_t opcode, uint8_t *args, int len)
631 {
632     pl330_dmaadxh(ch, args, extract32(opcode, 1, 1), true);
633 }
634 
635 static void pl330_dmaend(PL330Chan *ch, uint8_t opcode,
636                          uint8_t *args, int len)
637 {
638     PL330State *s = ch->parent;
639 
640     if (ch->state == pl330_chan_executing && !ch->is_manager) {
641         /* Wait for all transfers to complete */
642         if (pl330_fifo_has_tag(&s->fifo, ch->tag) ||
643             pl330_queue_find_insn(&s->read_queue, ch->tag, false) != NULL ||
644             pl330_queue_find_insn(&s->write_queue, ch->tag, false) != NULL) {
645 
646             ch->stall = 1;
647             return;
648         }
649     }
650     DB_PRINT("DMA ending!\n");
651     pl330_fifo_tagged_remove(&s->fifo, ch->tag);
652     pl330_queue_remove_tagged(&s->read_queue, ch->tag);
653     pl330_queue_remove_tagged(&s->write_queue, ch->tag);
654     ch->state = pl330_chan_stopped;
655 }
656 
657 static void pl330_dmaflushp(PL330Chan *ch, uint8_t opcode,
658                                             uint8_t *args, int len)
659 {
660     uint8_t periph_id;
661 
662     if (args[0] & 7) {
663         pl330_fault(ch, PL330_FAULT_OPERAND_INVALID);
664         return;
665     }
666     periph_id = (args[0] >> 3) & 0x1f;
667     if (periph_id >= ch->parent->num_periph_req) {
668         pl330_fault(ch, PL330_FAULT_OPERAND_INVALID);
669         return;
670     }
671     if (ch->ns && !(ch->parent->cfg[CFG_PNS] & (1 << periph_id))) {
672         pl330_fault(ch, PL330_FAULT_CH_PERIPH_ERR);
673         return;
674     }
675     /* Do nothing */
676 }
677 
678 static void pl330_dmago(PL330Chan *ch, uint8_t opcode, uint8_t *args, int len)
679 {
680     uint8_t chan_id;
681     uint8_t ns;
682     uint32_t pc;
683     PL330Chan *s;
684 
685     DB_PRINT("\n");
686 
687     if (!ch->is_manager) {
688         pl330_fault(ch, PL330_FAULT_UNDEF_INSTR);
689         return;
690     }
691     ns = !!(opcode & 2);
692     chan_id = args[0] & 7;
693     if ((args[0] >> 3)) {
694         pl330_fault(ch, PL330_FAULT_OPERAND_INVALID);
695         return;
696     }
697     if (chan_id >= ch->parent->num_chnls) {
698         pl330_fault(ch, PL330_FAULT_OPERAND_INVALID);
699         return;
700     }
701     pc = (((uint32_t)args[4]) << 24) | (((uint32_t)args[3]) << 16) |
702          (((uint32_t)args[2]) << 8)  | (((uint32_t)args[1]));
703     if (ch->parent->chan[chan_id].state != pl330_chan_stopped) {
704         pl330_fault(ch, PL330_FAULT_OPERAND_INVALID);
705         return;
706     }
707     if (ch->ns && !ns) {
708         pl330_fault(ch, PL330_FAULT_DMAGO_ERR);
709         return;
710     }
711     s = &ch->parent->chan[chan_id];
712     s->ns = ns;
713     s->pc = pc;
714     s->state = pl330_chan_executing;
715 }
716 
717 static void pl330_dmald(PL330Chan *ch, uint8_t opcode, uint8_t *args, int len)
718 {
719     uint8_t bs = opcode & 3;
720     uint32_t size, num;
721     bool inc;
722 
723     if (bs == 2) {
724         pl330_fault(ch, PL330_FAULT_OPERAND_INVALID);
725         return;
726     }
727     if ((bs == 1 && ch->request_flag == PL330_BURST) ||
728         (bs == 3 && ch->request_flag == PL330_SINGLE)) {
729         /* Perform NOP */
730         return;
731     }
732     if (bs == 1 && ch->request_flag == PL330_SINGLE) {
733         num = 1;
734     } else {
735         num = ((ch->control >> 4) & 0xf) + 1;
736     }
737     size = (uint32_t)1 << ((ch->control >> 1) & 0x7);
738     inc = !!(ch->control & 1);
739     ch->stall = pl330_queue_put_insn(&ch->parent->read_queue, ch->src,
740                                     size, num, inc, 0, ch->tag);
741     if (!ch->stall) {
742         DB_PRINT("channel:%" PRId8 " address:%08" PRIx32 " size:%" PRIx32
743                  " num:%" PRId32 " %c\n",
744                  ch->tag, ch->src, size, num, inc ? 'Y' : 'N');
745         ch->src += inc ? size * num - (ch->src & (size - 1)) : 0;
746     }
747 }
748 
749 static void pl330_dmaldp(PL330Chan *ch, uint8_t opcode, uint8_t *args, int len)
750 {
751     uint8_t periph_id;
752 
753     if (args[0] & 7) {
754         pl330_fault(ch, PL330_FAULT_OPERAND_INVALID);
755         return;
756     }
757     periph_id = (args[0] >> 3) & 0x1f;
758     if (periph_id >= ch->parent->num_periph_req) {
759         pl330_fault(ch, PL330_FAULT_OPERAND_INVALID);
760         return;
761     }
762     if (ch->ns && !(ch->parent->cfg[CFG_PNS] & (1 << periph_id))) {
763         pl330_fault(ch, PL330_FAULT_CH_PERIPH_ERR);
764         return;
765     }
766     pl330_dmald(ch, opcode, args, len);
767 }
768 
769 static void pl330_dmalp(PL330Chan *ch, uint8_t opcode, uint8_t *args, int len)
770 {
771     uint8_t lc = (opcode & 2) >> 1;
772 
773     ch->lc[lc] = args[0];
774 }
775 
776 static void pl330_dmakill(PL330Chan *ch, uint8_t opcode, uint8_t *args, int len)
777 {
778     if (ch->state == pl330_chan_fault ||
779         ch->state == pl330_chan_fault_completing) {
780         /* This is the only way for a channel to leave the faulting state */
781         ch->fault_type = 0;
782         ch->parent->num_faulting--;
783         if (ch->parent->num_faulting == 0) {
784             DB_PRINT("abort interrupt lowered\n");
785             qemu_irq_lower(ch->parent->irq_abort);
786         }
787     }
788     ch->state = pl330_chan_killing;
789     pl330_fifo_tagged_remove(&ch->parent->fifo, ch->tag);
790     pl330_queue_remove_tagged(&ch->parent->read_queue, ch->tag);
791     pl330_queue_remove_tagged(&ch->parent->write_queue, ch->tag);
792     ch->state = pl330_chan_stopped;
793 }
794 
795 static void pl330_dmalpend(PL330Chan *ch, uint8_t opcode,
796                                     uint8_t *args, int len)
797 {
798     uint8_t nf = (opcode & 0x10) >> 4;
799     uint8_t bs = opcode & 3;
800     uint8_t lc = (opcode & 4) >> 2;
801 
802     if (bs == 2) {
803         pl330_fault(ch, PL330_FAULT_OPERAND_INVALID);
804         return;
805     }
806     if ((bs == 1 && ch->request_flag == PL330_BURST) ||
807         (bs == 3 && ch->request_flag == PL330_SINGLE)) {
808         /* Perform NOP */
809         return;
810     }
811     if (!nf || ch->lc[lc]) {
812         if (nf) {
813             ch->lc[lc]--;
814         }
815         DB_PRINT("loop reiteration\n");
816         ch->pc -= args[0];
817         ch->pc -= len + 1;
818         /* "ch->pc -= args[0] + len + 1" is incorrect when args[0] == 256 */
819     } else {
820         DB_PRINT("loop fallthrough\n");
821     }
822 }
823 
824 
825 static void pl330_dmamov(PL330Chan *ch, uint8_t opcode, uint8_t *args, int len)
826 {
827     uint8_t rd = args[0] & 7;
828     uint32_t im;
829 
830     if ((args[0] >> 3)) {
831         pl330_fault(ch, PL330_FAULT_OPERAND_INVALID);
832         return;
833     }
834     im = (((uint32_t)args[4]) << 24) | (((uint32_t)args[3]) << 16) |
835          (((uint32_t)args[2]) << 8)  | (((uint32_t)args[1]));
836     switch (rd) {
837     case 0:
838         ch->src = im;
839         break;
840     case 1:
841         ch->control = im;
842         break;
843     case 2:
844         ch->dst = im;
845         break;
846     default:
847         pl330_fault(ch, PL330_FAULT_OPERAND_INVALID);
848         return;
849     }
850 }
851 
852 static void pl330_dmanop(PL330Chan *ch, uint8_t opcode,
853                          uint8_t *args, int len)
854 {
855     /* NOP is NOP. */
856 }
857 
858 static void pl330_dmarmb(PL330Chan *ch, uint8_t opcode, uint8_t *args, int len)
859 {
860    if (pl330_queue_find_insn(&ch->parent->read_queue, ch->tag, false)) {
861         ch->state = pl330_chan_at_barrier;
862         ch->stall = 1;
863         return;
864     } else {
865         ch->state = pl330_chan_executing;
866     }
867 }
868 
869 static void pl330_dmasev(PL330Chan *ch, uint8_t opcode, uint8_t *args, int len)
870 {
871     uint8_t ev_id;
872 
873     if (args[0] & 7) {
874         pl330_fault(ch, PL330_FAULT_OPERAND_INVALID);
875         return;
876     }
877     ev_id = (args[0] >> 3) & 0x1f;
878     if (ev_id >= ch->parent->num_events) {
879         pl330_fault(ch, PL330_FAULT_OPERAND_INVALID);
880         return;
881     }
882     if (ch->ns && !(ch->parent->cfg[CFG_INS] & (1 << ev_id))) {
883         pl330_fault(ch, PL330_FAULT_EVENT_ERR);
884         return;
885     }
886     if (ch->parent->inten & (1 << ev_id)) {
887         ch->parent->int_status |= (1 << ev_id);
888         DB_PRINT("event interrupt raised %" PRId8 "\n", ev_id);
889         qemu_irq_raise(ch->parent->irq[ev_id]);
890     }
891     DB_PRINT("event raised %" PRId8 "\n", ev_id);
892     ch->parent->ev_status |= (1 << ev_id);
893 }
894 
895 static void pl330_dmast(PL330Chan *ch, uint8_t opcode, uint8_t *args, int len)
896 {
897     uint8_t bs = opcode & 3;
898     uint32_t size, num;
899     bool inc;
900 
901     if (bs == 2) {
902         pl330_fault(ch, PL330_FAULT_OPERAND_INVALID);
903         return;
904     }
905     if ((bs == 1 && ch->request_flag == PL330_BURST) ||
906         (bs == 3 && ch->request_flag == PL330_SINGLE)) {
907         /* Perform NOP */
908         return;
909     }
910     num = ((ch->control >> 18) & 0xf) + 1;
911     size = (uint32_t)1 << ((ch->control >> 15) & 0x7);
912     inc = !!((ch->control >> 14) & 1);
913     ch->stall = pl330_queue_put_insn(&ch->parent->write_queue, ch->dst,
914                                     size, num, inc, 0, ch->tag);
915     if (!ch->stall) {
916         DB_PRINT("channel:%" PRId8 " address:%08" PRIx32 " size:%" PRIx32
917                  " num:%" PRId32 " %c\n",
918                  ch->tag, ch->dst, size, num, inc ? 'Y' : 'N');
919         ch->dst += inc ? size * num - (ch->dst & (size - 1)) : 0;
920     }
921 }
922 
923 static void pl330_dmastp(PL330Chan *ch, uint8_t opcode,
924                          uint8_t *args, int len)
925 {
926     uint8_t periph_id;
927 
928     if (args[0] & 7) {
929         pl330_fault(ch, PL330_FAULT_OPERAND_INVALID);
930         return;
931     }
932     periph_id = (args[0] >> 3) & 0x1f;
933     if (periph_id >= ch->parent->num_periph_req) {
934         pl330_fault(ch, PL330_FAULT_OPERAND_INVALID);
935         return;
936     }
937     if (ch->ns && !(ch->parent->cfg[CFG_PNS] & (1 << periph_id))) {
938         pl330_fault(ch, PL330_FAULT_CH_PERIPH_ERR);
939         return;
940     }
941     pl330_dmast(ch, opcode, args, len);
942 }
943 
944 static void pl330_dmastz(PL330Chan *ch, uint8_t opcode,
945                          uint8_t *args, int len)
946 {
947     uint32_t size, num;
948     bool inc;
949 
950     num = ((ch->control >> 18) & 0xf) + 1;
951     size = (uint32_t)1 << ((ch->control >> 15) & 0x7);
952     inc = !!((ch->control >> 14) & 1);
953     ch->stall = pl330_queue_put_insn(&ch->parent->write_queue, ch->dst,
954                                     size, num, inc, 1, ch->tag);
955     if (inc) {
956         ch->dst += size * num;
957     }
958 }
959 
960 static void pl330_dmawfe(PL330Chan *ch, uint8_t opcode,
961                          uint8_t *args, int len)
962 {
963     uint8_t ev_id;
964     int i;
965 
966     if (args[0] & 5) {
967         pl330_fault(ch, PL330_FAULT_OPERAND_INVALID);
968         return;
969     }
970     ev_id = (args[0] >> 3) & 0x1f;
971     if (ev_id >= ch->parent->num_events) {
972         pl330_fault(ch, PL330_FAULT_OPERAND_INVALID);
973         return;
974     }
975     if (ch->ns && !(ch->parent->cfg[CFG_INS] & (1 << ev_id))) {
976         pl330_fault(ch, PL330_FAULT_EVENT_ERR);
977         return;
978     }
979     ch->wakeup = ev_id;
980     ch->state = pl330_chan_waiting_event;
981     if (~ch->parent->inten & ch->parent->ev_status & 1 << ev_id) {
982         ch->state = pl330_chan_executing;
983         /* If anyone else is currently waiting on the same event, let them
984          * clear the ev_status so they pick up event as well
985          */
986         for (i = 0; i < ch->parent->num_chnls; ++i) {
987             PL330Chan *peer = &ch->parent->chan[i];
988             if (peer->state == pl330_chan_waiting_event &&
989                     peer->wakeup == ev_id) {
990                 return;
991             }
992         }
993         ch->parent->ev_status &= ~(1 << ev_id);
994         DB_PRINT("event lowered %" PRIx8 "\n", ev_id);
995     } else {
996         ch->stall = 1;
997     }
998 }
999 
1000 static void pl330_dmawfp(PL330Chan *ch, uint8_t opcode,
1001                          uint8_t *args, int len)
1002 {
1003     uint8_t bs = opcode & 3;
1004     uint8_t periph_id;
1005 
1006     if (args[0] & 7) {
1007         pl330_fault(ch, PL330_FAULT_OPERAND_INVALID);
1008         return;
1009     }
1010     periph_id = (args[0] >> 3) & 0x1f;
1011     if (periph_id >= ch->parent->num_periph_req) {
1012         pl330_fault(ch, PL330_FAULT_OPERAND_INVALID);
1013         return;
1014     }
1015     if (ch->ns && !(ch->parent->cfg[CFG_PNS] & (1 << periph_id))) {
1016         pl330_fault(ch, PL330_FAULT_CH_PERIPH_ERR);
1017         return;
1018     }
1019     switch (bs) {
1020     case 0: /* S */
1021         ch->request_flag = PL330_SINGLE;
1022         ch->wfp_sbp = 0;
1023         break;
1024     case 1: /* P */
1025         ch->request_flag = PL330_BURST;
1026         ch->wfp_sbp = 2;
1027         break;
1028     case 2: /* B */
1029         ch->request_flag = PL330_BURST;
1030         ch->wfp_sbp = 1;
1031         break;
1032     default:
1033         pl330_fault(ch, PL330_FAULT_OPERAND_INVALID);
1034         return;
1035     }
1036 
1037     if (ch->parent->periph_busy[periph_id]) {
1038         ch->state = pl330_chan_waiting_periph;
1039         ch->stall = 1;
1040     } else if (ch->state == pl330_chan_waiting_periph) {
1041         ch->state = pl330_chan_executing;
1042     }
1043 }
1044 
1045 static void pl330_dmawmb(PL330Chan *ch, uint8_t opcode,
1046                          uint8_t *args, int len)
1047 {
1048     if (pl330_queue_find_insn(&ch->parent->write_queue, ch->tag, false)) {
1049         ch->state = pl330_chan_at_barrier;
1050         ch->stall = 1;
1051         return;
1052     } else {
1053         ch->state = pl330_chan_executing;
1054     }
1055 }
1056 
1057 /* NULL terminated array of the instruction descriptions. */
1058 static const PL330InsnDesc insn_desc[] = {
1059     { .opcode = 0x54, .opmask = 0xFD, .size = 3, .exec = pl330_dmaaddh, },
1060     { .opcode = 0x5c, .opmask = 0xFD, .size = 3, .exec = pl330_dmaadnh, },
1061     { .opcode = 0x00, .opmask = 0xFF, .size = 1, .exec = pl330_dmaend, },
1062     { .opcode = 0x35, .opmask = 0xFF, .size = 2, .exec = pl330_dmaflushp, },
1063     { .opcode = 0xA0, .opmask = 0xFD, .size = 6, .exec = pl330_dmago, },
1064     { .opcode = 0x04, .opmask = 0xFC, .size = 1, .exec = pl330_dmald, },
1065     { .opcode = 0x25, .opmask = 0xFD, .size = 2, .exec = pl330_dmaldp, },
1066     { .opcode = 0x20, .opmask = 0xFD, .size = 2, .exec = pl330_dmalp, },
1067     /* dmastp  must be before dmalpend in this list, because their maps
1068      * are overlapping
1069      */
1070     { .opcode = 0x29, .opmask = 0xFD, .size = 2, .exec = pl330_dmastp, },
1071     { .opcode = 0x28, .opmask = 0xE8, .size = 2, .exec = pl330_dmalpend, },
1072     { .opcode = 0x01, .opmask = 0xFF, .size = 1, .exec = pl330_dmakill, },
1073     { .opcode = 0xBC, .opmask = 0xFF, .size = 6, .exec = pl330_dmamov, },
1074     { .opcode = 0x18, .opmask = 0xFF, .size = 1, .exec = pl330_dmanop, },
1075     { .opcode = 0x12, .opmask = 0xFF, .size = 1, .exec = pl330_dmarmb, },
1076     { .opcode = 0x34, .opmask = 0xFF, .size = 2, .exec = pl330_dmasev, },
1077     { .opcode = 0x08, .opmask = 0xFC, .size = 1, .exec = pl330_dmast, },
1078     { .opcode = 0x0C, .opmask = 0xFF, .size = 1, .exec = pl330_dmastz, },
1079     { .opcode = 0x36, .opmask = 0xFF, .size = 2, .exec = pl330_dmawfe, },
1080     { .opcode = 0x30, .opmask = 0xFC, .size = 2, .exec = pl330_dmawfp, },
1081     { .opcode = 0x13, .opmask = 0xFF, .size = 1, .exec = pl330_dmawmb, },
1082     { .opcode = 0x00, .opmask = 0x00, .size = 0, .exec = NULL, }
1083 };
1084 
1085 /* Instructions which can be issued via debug registers. */
1086 static const PL330InsnDesc debug_insn_desc[] = {
1087     { .opcode = 0xA0, .opmask = 0xFD, .size = 6, .exec = pl330_dmago, },
1088     { .opcode = 0x01, .opmask = 0xFF, .size = 1, .exec = pl330_dmakill, },
1089     { .opcode = 0x34, .opmask = 0xFF, .size = 2, .exec = pl330_dmasev, },
1090     { .opcode = 0x00, .opmask = 0x00, .size = 0, .exec = NULL, }
1091 };
1092 
1093 static inline const PL330InsnDesc *pl330_fetch_insn(PL330Chan *ch)
1094 {
1095     uint8_t opcode;
1096     int i;
1097 
1098     dma_memory_read(&address_space_memory, ch->pc, &opcode, 1);
1099     for (i = 0; insn_desc[i].size; i++) {
1100         if ((opcode & insn_desc[i].opmask) == insn_desc[i].opcode) {
1101             return &insn_desc[i];
1102         }
1103     }
1104     return NULL;
1105 }
1106 
1107 static inline void pl330_exec_insn(PL330Chan *ch, const PL330InsnDesc *insn)
1108 {
1109     uint8_t buf[PL330_INSN_MAXSIZE];
1110 
1111     assert(insn->size <= PL330_INSN_MAXSIZE);
1112     dma_memory_read(&address_space_memory, ch->pc, buf, insn->size);
1113     insn->exec(ch, buf[0], &buf[1], insn->size - 1);
1114 }
1115 
1116 static inline void pl330_update_pc(PL330Chan *ch,
1117                                    const PL330InsnDesc *insn)
1118 {
1119     ch->pc += insn->size;
1120 }
1121 
1122 /* Try to execute current instruction in channel CH. Number of executed
1123    instructions is returned (0 or 1). */
1124 static int pl330_chan_exec(PL330Chan *ch)
1125 {
1126     const PL330InsnDesc *insn;
1127 
1128     if (ch->state != pl330_chan_executing &&
1129             ch->state != pl330_chan_waiting_periph &&
1130             ch->state != pl330_chan_at_barrier &&
1131             ch->state != pl330_chan_waiting_event) {
1132         return 0;
1133     }
1134     ch->stall = 0;
1135     insn = pl330_fetch_insn(ch);
1136     if (!insn) {
1137         DB_PRINT("pl330 undefined instruction\n");
1138         pl330_fault(ch, PL330_FAULT_UNDEF_INSTR);
1139         return 0;
1140     }
1141     pl330_exec_insn(ch, insn);
1142     if (!ch->stall) {
1143         pl330_update_pc(ch, insn);
1144         ch->watchdog_timer = 0;
1145         return 1;
1146     /* WDT only active in exec state */
1147     } else if (ch->state == pl330_chan_executing) {
1148         ch->watchdog_timer++;
1149         if (ch->watchdog_timer >= PL330_WATCHDOG_LIMIT) {
1150             pl330_fault(ch, PL330_FAULT_LOCKUP_ERR);
1151         }
1152     }
1153     return 0;
1154 }
1155 
1156 /* Try to execute 1 instruction in each channel, one instruction from read
1157    queue and one instruction from write queue. Number of successfully executed
1158    instructions is returned. */
1159 static int pl330_exec_cycle(PL330Chan *channel)
1160 {
1161     PL330State *s = channel->parent;
1162     PL330QueueEntry *q;
1163     int i;
1164     int num_exec = 0;
1165     int fifo_res = 0;
1166     uint8_t buf[PL330_MAX_BURST_LEN];
1167 
1168     /* Execute one instruction in each channel */
1169     num_exec += pl330_chan_exec(channel);
1170 
1171     /* Execute one instruction from read queue */
1172     q = pl330_queue_find_insn(&s->read_queue, PL330_UNTAGGED, true);
1173     if (q != NULL && q->len <= pl330_fifo_num_free(&s->fifo)) {
1174         int len = q->len - (q->addr & (q->len - 1));
1175 
1176         dma_memory_read(&address_space_memory, q->addr, buf, len);
1177         if (PL330_ERR_DEBUG > 1) {
1178             DB_PRINT("PL330 read from memory @%08" PRIx32 " (size = %08x):\n",
1179                       q->addr, len);
1180             qemu_hexdump((char *)buf, stderr, "", len);
1181         }
1182         fifo_res = pl330_fifo_push(&s->fifo, buf, len, q->tag);
1183         if (fifo_res == PL330_FIFO_OK) {
1184             if (q->inc) {
1185                 q->addr += len;
1186             }
1187             q->n--;
1188             if (!q->n) {
1189                 pl330_queue_remove_insn(&s->read_queue, q);
1190             }
1191             num_exec++;
1192         }
1193     }
1194 
1195     /* Execute one instruction from write queue. */
1196     q = pl330_queue_find_insn(&s->write_queue, pl330_fifo_tag(&s->fifo), true);
1197     if (q != NULL) {
1198         int len = q->len - (q->addr & (q->len - 1));
1199 
1200         if (q->z) {
1201             for (i = 0; i < len; i++) {
1202                 buf[i] = 0;
1203             }
1204         } else {
1205             fifo_res = pl330_fifo_get(&s->fifo, buf, len, q->tag);
1206         }
1207         if (fifo_res == PL330_FIFO_OK || q->z) {
1208             dma_memory_write(&address_space_memory, q->addr, buf, len);
1209             if (PL330_ERR_DEBUG > 1) {
1210                 DB_PRINT("PL330 read from memory @%08" PRIx32
1211                          " (size = %08x):\n", q->addr, len);
1212                 qemu_hexdump((char *)buf, stderr, "", len);
1213             }
1214             if (q->inc) {
1215                 q->addr += len;
1216             }
1217             num_exec++;
1218         } else if (fifo_res == PL330_FIFO_STALL) {
1219             pl330_fault(&channel->parent->chan[q->tag],
1220                                 PL330_FAULT_FIFOEMPTY_ERR);
1221         }
1222         q->n--;
1223         if (!q->n) {
1224             pl330_queue_remove_insn(&s->write_queue, q);
1225         }
1226     }
1227 
1228     return num_exec;
1229 }
1230 
1231 static int pl330_exec_channel(PL330Chan *channel)
1232 {
1233     int insr_exec = 0;
1234 
1235     /* TODO: Is it all right to execute everything or should we do per-cycle
1236        simulation? */
1237     while (pl330_exec_cycle(channel)) {
1238         insr_exec++;
1239     }
1240 
1241     /* Detect deadlock */
1242     if (channel->state == pl330_chan_executing) {
1243         pl330_fault(channel, PL330_FAULT_LOCKUP_ERR);
1244     }
1245     /* Situation when one of the queues has deadlocked but all channels
1246      * have finished their programs should be impossible.
1247      */
1248 
1249     return insr_exec;
1250 }
1251 
1252 static inline void pl330_exec(PL330State *s)
1253 {
1254     DB_PRINT("\n");
1255     int i, insr_exec;
1256     do {
1257         insr_exec = pl330_exec_channel(&s->manager);
1258 
1259         for (i = 0; i < s->num_chnls; i++) {
1260             insr_exec += pl330_exec_channel(&s->chan[i]);
1261         }
1262     } while (insr_exec);
1263 }
1264 
1265 static void pl330_exec_cycle_timer(void *opaque)
1266 {
1267     PL330State *s = (PL330State *)opaque;
1268     pl330_exec(s);
1269 }
1270 
1271 /* Stop or restore dma operations */
1272 
1273 static void pl330_dma_stop_irq(void *opaque, int irq, int level)
1274 {
1275     PL330State *s = (PL330State *)opaque;
1276 
1277     if (s->periph_busy[irq] != level) {
1278         s->periph_busy[irq] = level;
1279         timer_mod(s->timer, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL));
1280     }
1281 }
1282 
1283 static void pl330_debug_exec(PL330State *s)
1284 {
1285     uint8_t args[5];
1286     uint8_t opcode;
1287     uint8_t chan_id;
1288     int i;
1289     PL330Chan *ch;
1290     const PL330InsnDesc *insn;
1291 
1292     s->debug_status = 1;
1293     chan_id = (s->dbg[0] >>  8) & 0x07;
1294     opcode  = (s->dbg[0] >> 16) & 0xff;
1295     args[0] = (s->dbg[0] >> 24) & 0xff;
1296     args[1] = (s->dbg[1] >>  0) & 0xff;
1297     args[2] = (s->dbg[1] >>  8) & 0xff;
1298     args[3] = (s->dbg[1] >> 16) & 0xff;
1299     args[4] = (s->dbg[1] >> 24) & 0xff;
1300     DB_PRINT("chan id: %" PRIx8 "\n", chan_id);
1301     if (s->dbg[0] & 1) {
1302         ch = &s->chan[chan_id];
1303     } else {
1304         ch = &s->manager;
1305     }
1306     insn = NULL;
1307     for (i = 0; debug_insn_desc[i].size; i++) {
1308         if ((opcode & debug_insn_desc[i].opmask) == debug_insn_desc[i].opcode) {
1309             insn = &debug_insn_desc[i];
1310         }
1311     }
1312     if (!insn) {
1313         pl330_fault(ch, PL330_FAULT_UNDEF_INSTR | PL330_FAULT_DBG_INSTR);
1314         return ;
1315     }
1316     ch->stall = 0;
1317     insn->exec(ch, opcode, args, insn->size - 1);
1318     if (ch->fault_type) {
1319         ch->fault_type |= PL330_FAULT_DBG_INSTR;
1320     }
1321     if (ch->stall) {
1322         qemu_log_mask(LOG_UNIMP, "pl330: stall of debug instruction not "
1323                       "implemented\n");
1324     }
1325     s->debug_status = 0;
1326 }
1327 
1328 /* IOMEM mapped registers */
1329 
1330 static void pl330_iomem_write(void *opaque, hwaddr offset,
1331                               uint64_t value, unsigned size)
1332 {
1333     PL330State *s = (PL330State *) opaque;
1334     int i;
1335 
1336     DB_PRINT("addr: %08x data: %08x\n", (unsigned)offset, (unsigned)value);
1337 
1338     switch (offset) {
1339     case PL330_REG_INTEN:
1340         s->inten = value;
1341         break;
1342     case PL330_REG_INTCLR:
1343         for (i = 0; i < s->num_events; i++) {
1344             if (s->int_status & s->inten & value & (1 << i)) {
1345                 DB_PRINT("event interrupt lowered %d\n", i);
1346                 qemu_irq_lower(s->irq[i]);
1347             }
1348         }
1349         s->ev_status &= ~(value & s->inten);
1350         s->int_status &= ~(value & s->inten);
1351         break;
1352     case PL330_REG_DBGCMD:
1353         if ((value & 3) == 0) {
1354             pl330_debug_exec(s);
1355             pl330_exec(s);
1356         } else {
1357             qemu_log_mask(LOG_GUEST_ERROR, "pl330: write of illegal value %u "
1358                           "for offset " TARGET_FMT_plx "\n", (unsigned)value,
1359                           offset);
1360         }
1361         break;
1362     case PL330_REG_DBGINST0:
1363         DB_PRINT("s->dbg[0] = %08x\n", (unsigned)value);
1364         s->dbg[0] = value;
1365         break;
1366     case PL330_REG_DBGINST1:
1367         DB_PRINT("s->dbg[1] = %08x\n", (unsigned)value);
1368         s->dbg[1] = value;
1369         break;
1370     default:
1371         qemu_log_mask(LOG_GUEST_ERROR, "pl330: bad write offset " TARGET_FMT_plx
1372                       "\n", offset);
1373         break;
1374     }
1375 }
1376 
1377 static inline uint32_t pl330_iomem_read_imp(void *opaque,
1378         hwaddr offset)
1379 {
1380     PL330State *s = (PL330State *)opaque;
1381     int chan_id;
1382     int i;
1383     uint32_t res;
1384 
1385     if (offset >= PL330_REG_PERIPH_ID && offset < PL330_REG_PERIPH_ID + 32) {
1386         return pl330_id[(offset - PL330_REG_PERIPH_ID) >> 2];
1387     }
1388     if (offset >= PL330_REG_CR0_BASE && offset < PL330_REG_CR0_BASE + 24) {
1389         return s->cfg[(offset - PL330_REG_CR0_BASE) >> 2];
1390     }
1391     if (offset >= PL330_REG_CHANCTRL && offset < PL330_REG_DBGSTATUS) {
1392         offset -= PL330_REG_CHANCTRL;
1393         chan_id = offset >> 5;
1394         if (chan_id >= s->num_chnls) {
1395             qemu_log_mask(LOG_GUEST_ERROR, "pl330: bad read offset "
1396                           TARGET_FMT_plx "\n", offset);
1397             return 0;
1398         }
1399         switch (offset & 0x1f) {
1400         case 0x00:
1401             return s->chan[chan_id].src;
1402         case 0x04:
1403             return s->chan[chan_id].dst;
1404         case 0x08:
1405             return s->chan[chan_id].control;
1406         case 0x0C:
1407             return s->chan[chan_id].lc[0];
1408         case 0x10:
1409             return s->chan[chan_id].lc[1];
1410         default:
1411             qemu_log_mask(LOG_GUEST_ERROR, "pl330: bad read offset "
1412                           TARGET_FMT_plx "\n", offset);
1413             return 0;
1414         }
1415     }
1416     if (offset >= PL330_REG_CSR_BASE && offset < 0x400) {
1417         offset -= PL330_REG_CSR_BASE;
1418         chan_id = offset >> 3;
1419         if (chan_id >= s->num_chnls) {
1420             qemu_log_mask(LOG_GUEST_ERROR, "pl330: bad read offset "
1421                           TARGET_FMT_plx "\n", offset);
1422             return 0;
1423         }
1424         switch ((offset >> 2) & 1) {
1425         case 0x0:
1426             res = (s->chan[chan_id].ns << 21) |
1427                     (s->chan[chan_id].wakeup << 4) |
1428                     (s->chan[chan_id].state) |
1429                     (s->chan[chan_id].wfp_sbp << 14);
1430             return res;
1431         case 0x1:
1432             return s->chan[chan_id].pc;
1433         default:
1434             qemu_log_mask(LOG_GUEST_ERROR, "pl330: read error\n");
1435             return 0;
1436         }
1437     }
1438     if (offset >= PL330_REG_FTR_BASE && offset < 0x100) {
1439         offset -= PL330_REG_FTR_BASE;
1440         chan_id = offset >> 2;
1441         if (chan_id >= s->num_chnls) {
1442             qemu_log_mask(LOG_GUEST_ERROR, "pl330: bad read offset "
1443                           TARGET_FMT_plx "\n", offset);
1444             return 0;
1445         }
1446         return s->chan[chan_id].fault_type;
1447     }
1448     switch (offset) {
1449     case PL330_REG_DSR:
1450         return (s->manager.ns << 9) | (s->manager.wakeup << 4) |
1451             (s->manager.state & 0xf);
1452     case PL330_REG_DPC:
1453         return s->manager.pc;
1454     case PL330_REG_INTEN:
1455         return s->inten;
1456     case PL330_REG_INT_EVENT_RIS:
1457         return s->ev_status;
1458     case PL330_REG_INTMIS:
1459         return s->int_status;
1460     case PL330_REG_INTCLR:
1461         /* Documentation says that we can't read this register
1462          * but linux kernel does it
1463          */
1464         return 0;
1465     case PL330_REG_FSRD:
1466         return s->manager.state ? 1 : 0;
1467     case PL330_REG_FSRC:
1468         res = 0;
1469         for (i = 0; i < s->num_chnls; i++) {
1470             if (s->chan[i].state == pl330_chan_fault ||
1471                 s->chan[i].state == pl330_chan_fault_completing) {
1472                 res |= 1 << i;
1473             }
1474         }
1475         return res;
1476     case PL330_REG_FTRD:
1477         return s->manager.fault_type;
1478     case PL330_REG_DBGSTATUS:
1479         return s->debug_status;
1480     default:
1481         qemu_log_mask(LOG_GUEST_ERROR, "pl330: bad read offset "
1482                       TARGET_FMT_plx "\n", offset);
1483     }
1484     return 0;
1485 }
1486 
1487 static uint64_t pl330_iomem_read(void *opaque, hwaddr offset,
1488         unsigned size)
1489 {
1490     uint32_t ret = pl330_iomem_read_imp(opaque, offset);
1491     DB_PRINT("addr: %08" HWADDR_PRIx " data: %08" PRIx32 "\n", offset, ret);
1492     return ret;
1493 }
1494 
1495 static const MemoryRegionOps pl330_ops = {
1496     .read = pl330_iomem_read,
1497     .write = pl330_iomem_write,
1498     .endianness = DEVICE_NATIVE_ENDIAN,
1499     .impl = {
1500         .min_access_size = 4,
1501         .max_access_size = 4,
1502     }
1503 };
1504 
1505 /* Controller logic and initialization */
1506 
1507 static void pl330_chan_reset(PL330Chan *ch)
1508 {
1509     ch->src = 0;
1510     ch->dst = 0;
1511     ch->pc = 0;
1512     ch->state = pl330_chan_stopped;
1513     ch->watchdog_timer = 0;
1514     ch->stall = 0;
1515     ch->control = 0;
1516     ch->status = 0;
1517     ch->fault_type = 0;
1518 }
1519 
1520 static void pl330_reset(DeviceState *d)
1521 {
1522     int i;
1523     PL330State *s = PL330(d);
1524 
1525     s->inten = 0;
1526     s->int_status = 0;
1527     s->ev_status = 0;
1528     s->debug_status = 0;
1529     s->num_faulting = 0;
1530     s->manager.ns = s->mgr_ns_at_rst;
1531     pl330_fifo_reset(&s->fifo);
1532     pl330_queue_reset(&s->read_queue);
1533     pl330_queue_reset(&s->write_queue);
1534 
1535     for (i = 0; i < s->num_chnls; i++) {
1536         pl330_chan_reset(&s->chan[i]);
1537     }
1538     for (i = 0; i < s->num_periph_req; i++) {
1539         s->periph_busy[i] = 0;
1540     }
1541 
1542     timer_del(s->timer);
1543 }
1544 
1545 static void pl330_realize(DeviceState *dev, Error **errp)
1546 {
1547     int i;
1548     PL330State *s = PL330(dev);
1549 
1550     sysbus_init_irq(SYS_BUS_DEVICE(dev), &s->irq_abort);
1551     memory_region_init_io(&s->iomem, OBJECT(s), &pl330_ops, s,
1552                           "dma", PL330_IOMEM_SIZE);
1553     sysbus_init_mmio(SYS_BUS_DEVICE(dev), &s->iomem);
1554 
1555     s->timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, pl330_exec_cycle_timer, s);
1556 
1557     s->cfg[0] = (s->mgr_ns_at_rst ? 0x4 : 0) |
1558                 (s->num_periph_req > 0 ? 1 : 0) |
1559                 ((s->num_chnls - 1) & 0x7) << 4 |
1560                 ((s->num_periph_req - 1) & 0x1f) << 12 |
1561                 ((s->num_events - 1) & 0x1f) << 17;
1562 
1563     switch (s->i_cache_len) {
1564     case (4):
1565         s->cfg[1] |= 2;
1566         break;
1567     case (8):
1568         s->cfg[1] |= 3;
1569         break;
1570     case (16):
1571         s->cfg[1] |= 4;
1572         break;
1573     case (32):
1574         s->cfg[1] |= 5;
1575         break;
1576     default:
1577         error_setg(errp, "Bad value for i-cache_len property: %" PRIx8,
1578                    s->i_cache_len);
1579         return;
1580     }
1581     s->cfg[1] |= ((s->num_i_cache_lines - 1) & 0xf) << 4;
1582 
1583     s->chan = g_new0(PL330Chan, s->num_chnls);
1584     s->hi_seqn = g_new0(uint8_t, s->num_chnls);
1585     s->lo_seqn = g_new0(uint8_t, s->num_chnls);
1586     for (i = 0; i < s->num_chnls; i++) {
1587         s->chan[i].parent = s;
1588         s->chan[i].tag = (uint8_t)i;
1589     }
1590     s->manager.parent = s;
1591     s->manager.tag = s->num_chnls;
1592     s->manager.is_manager = true;
1593 
1594     s->irq = g_new0(qemu_irq, s->num_events);
1595     for (i = 0; i < s->num_events; i++) {
1596         sysbus_init_irq(SYS_BUS_DEVICE(dev), &s->irq[i]);
1597     }
1598 
1599     qdev_init_gpio_in(dev, pl330_dma_stop_irq, PL330_PERIPH_NUM);
1600 
1601     switch (s->data_width) {
1602     case (32):
1603         s->cfg[CFG_CRD] |= 0x2;
1604         break;
1605     case (64):
1606         s->cfg[CFG_CRD] |= 0x3;
1607         break;
1608     case (128):
1609         s->cfg[CFG_CRD] |= 0x4;
1610         break;
1611     default:
1612         error_setg(errp, "Bad value for data_width property: %" PRIx8,
1613                    s->data_width);
1614         return;
1615     }
1616 
1617     s->cfg[CFG_CRD] |= ((s->wr_cap - 1) & 0x7) << 4 |
1618                     ((s->wr_q_dep - 1) & 0xf) << 8 |
1619                     ((s->rd_cap - 1) & 0x7) << 12 |
1620                     ((s->rd_q_dep - 1) & 0xf) << 16 |
1621                     ((s->data_buffer_dep - 1) & 0x1ff) << 20;
1622 
1623     pl330_queue_init(&s->read_queue, s->rd_q_dep, s);
1624     pl330_queue_init(&s->write_queue, s->wr_q_dep, s);
1625     pl330_fifo_init(&s->fifo, s->data_width / 4 * s->data_buffer_dep);
1626 }
1627 
1628 static Property pl330_properties[] = {
1629     /* CR0 */
1630     DEFINE_PROP_UINT32("num_chnls", PL330State, num_chnls, 8),
1631     DEFINE_PROP_UINT8("num_periph_req", PL330State, num_periph_req, 4),
1632     DEFINE_PROP_UINT8("num_events", PL330State, num_events, 16),
1633     DEFINE_PROP_UINT8("mgr_ns_at_rst", PL330State, mgr_ns_at_rst, 0),
1634     /* CR1 */
1635     DEFINE_PROP_UINT8("i-cache_len", PL330State, i_cache_len, 4),
1636     DEFINE_PROP_UINT8("num_i-cache_lines", PL330State, num_i_cache_lines, 8),
1637     /* CR2-4 */
1638     DEFINE_PROP_UINT32("boot_addr", PL330State, cfg[CFG_BOOT_ADDR], 0),
1639     DEFINE_PROP_UINT32("INS", PL330State, cfg[CFG_INS], 0),
1640     DEFINE_PROP_UINT32("PNS", PL330State, cfg[CFG_PNS], 0),
1641     /* CRD */
1642     DEFINE_PROP_UINT8("data_width", PL330State, data_width, 64),
1643     DEFINE_PROP_UINT8("wr_cap", PL330State, wr_cap, 8),
1644     DEFINE_PROP_UINT8("wr_q_dep", PL330State, wr_q_dep, 16),
1645     DEFINE_PROP_UINT8("rd_cap", PL330State, rd_cap, 8),
1646     DEFINE_PROP_UINT8("rd_q_dep", PL330State, rd_q_dep, 16),
1647     DEFINE_PROP_UINT16("data_buffer_dep", PL330State, data_buffer_dep, 256),
1648 
1649     DEFINE_PROP_END_OF_LIST(),
1650 };
1651 
1652 static void pl330_class_init(ObjectClass *klass, void *data)
1653 {
1654     DeviceClass *dc = DEVICE_CLASS(klass);
1655 
1656     dc->realize = pl330_realize;
1657     dc->reset = pl330_reset;
1658     dc->props = pl330_properties;
1659     dc->vmsd = &vmstate_pl330;
1660 }
1661 
1662 static const TypeInfo pl330_type_info = {
1663     .name           = TYPE_PL330,
1664     .parent         = TYPE_SYS_BUS_DEVICE,
1665     .instance_size  = sizeof(PL330State),
1666     .class_init      = pl330_class_init,
1667 };
1668 
1669 static void pl330_register_types(void)
1670 {
1671     type_register_static(&pl330_type_info);
1672 }
1673 
1674 type_init(pl330_register_types)
1675