1 /* 2 * QEMU model of the Xilinx Zynq Devcfg Interface 3 * 4 * (C) 2011 PetaLogix Pty Ltd 5 * (C) 2014 Xilinx Inc. 6 * Written by Peter Crosthwaite <peter.crosthwaite@xilinx.com> 7 * 8 * Permission is hereby granted, free of charge, to any person obtaining a copy 9 * of this software and associated documentation files (the "Software"), to deal 10 * in the Software without restriction, including without limitation the rights 11 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 12 * copies of the Software, and to permit persons to whom the Software is 13 * furnished to do so, subject to the following conditions: 14 * 15 * The above copyright notice and this permission notice shall be included in 16 * all copies or substantial portions of the Software. 17 * 18 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 19 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 20 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL 21 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 22 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 23 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 24 * THE SOFTWARE. 25 */ 26 27 #include "qemu/osdep.h" 28 #include "hw/dma/xlnx-zynq-devcfg.h" 29 #include "qemu/bitops.h" 30 #include "sysemu/sysemu.h" 31 #include "sysemu/dma.h" 32 #include "qemu/log.h" 33 #include "qemu/module.h" 34 35 #define FREQ_HZ 900000000 36 37 #define BTT_MAX 0x400 38 39 #ifndef XLNX_ZYNQ_DEVCFG_ERR_DEBUG 40 #define XLNX_ZYNQ_DEVCFG_ERR_DEBUG 0 41 #endif 42 43 #define DB_PRINT(fmt, args...) do { \ 44 if (XLNX_ZYNQ_DEVCFG_ERR_DEBUG) { \ 45 qemu_log("%s: " fmt, __func__, ## args); \ 46 } \ 47 } while (0) 48 49 REG32(CTRL, 0x00) 50 FIELD(CTRL, FORCE_RST, 31, 1) /* Not supported, wr ignored */ 51 FIELD(CTRL, PCAP_PR, 27, 1) /* Forced to 0 on bad unlock */ 52 FIELD(CTRL, PCAP_MODE, 26, 1) 53 FIELD(CTRL, MULTIBOOT_EN, 24, 1) 54 FIELD(CTRL, USER_MODE, 15, 1) 55 FIELD(CTRL, PCFG_AES_FUSE, 12, 1) 56 FIELD(CTRL, PCFG_AES_EN, 9, 3) 57 FIELD(CTRL, SEU_EN, 8, 1) 58 FIELD(CTRL, SEC_EN, 7, 1) 59 FIELD(CTRL, SPNIDEN, 6, 1) 60 FIELD(CTRL, SPIDEN, 5, 1) 61 FIELD(CTRL, NIDEN, 4, 1) 62 FIELD(CTRL, DBGEN, 3, 1) 63 FIELD(CTRL, DAP_EN, 0, 3) 64 65 REG32(LOCK, 0x04) 66 #define AES_FUSE_LOCK 4 67 #define AES_EN_LOCK 3 68 #define SEU_LOCK 2 69 #define SEC_LOCK 1 70 #define DBG_LOCK 0 71 72 /* mapping bits in R_LOCK to what they lock in R_CTRL */ 73 static const uint32_t lock_ctrl_map[] = { 74 [AES_FUSE_LOCK] = R_CTRL_PCFG_AES_FUSE_MASK, 75 [AES_EN_LOCK] = R_CTRL_PCFG_AES_EN_MASK, 76 [SEU_LOCK] = R_CTRL_SEU_EN_MASK, 77 [SEC_LOCK] = R_CTRL_SEC_EN_MASK, 78 [DBG_LOCK] = R_CTRL_SPNIDEN_MASK | R_CTRL_SPIDEN_MASK | 79 R_CTRL_NIDEN_MASK | R_CTRL_DBGEN_MASK | 80 R_CTRL_DAP_EN_MASK, 81 }; 82 83 REG32(CFG, 0x08) 84 FIELD(CFG, RFIFO_TH, 10, 2) 85 FIELD(CFG, WFIFO_TH, 8, 2) 86 FIELD(CFG, RCLK_EDGE, 7, 1) 87 FIELD(CFG, WCLK_EDGE, 6, 1) 88 FIELD(CFG, DISABLE_SRC_INC, 5, 1) 89 FIELD(CFG, DISABLE_DST_INC, 4, 1) 90 #define R_CFG_RESET 0x50B 91 92 REG32(INT_STS, 0x0C) 93 FIELD(INT_STS, PSS_GTS_USR_B, 31, 1) 94 FIELD(INT_STS, PSS_FST_CFG_B, 30, 1) 95 FIELD(INT_STS, PSS_CFG_RESET_B, 27, 1) 96 FIELD(INT_STS, RX_FIFO_OV, 18, 1) 97 FIELD(INT_STS, WR_FIFO_LVL, 17, 1) 98 FIELD(INT_STS, RD_FIFO_LVL, 16, 1) 99 FIELD(INT_STS, DMA_CMD_ERR, 15, 1) 100 FIELD(INT_STS, DMA_Q_OV, 14, 1) 101 FIELD(INT_STS, DMA_DONE, 13, 1) 102 FIELD(INT_STS, DMA_P_DONE, 12, 1) 103 FIELD(INT_STS, P2D_LEN_ERR, 11, 1) 104 FIELD(INT_STS, PCFG_DONE, 2, 1) 105 #define R_INT_STS_RSVD ((0x7 << 24) | (0x1 << 19) | (0xF < 7)) 106 107 REG32(INT_MASK, 0x10) 108 109 REG32(STATUS, 0x14) 110 FIELD(STATUS, DMA_CMD_Q_F, 31, 1) 111 FIELD(STATUS, DMA_CMD_Q_E, 30, 1) 112 FIELD(STATUS, DMA_DONE_CNT, 28, 2) 113 FIELD(STATUS, RX_FIFO_LVL, 20, 5) 114 FIELD(STATUS, TX_FIFO_LVL, 12, 7) 115 FIELD(STATUS, PSS_GTS_USR_B, 11, 1) 116 FIELD(STATUS, PSS_FST_CFG_B, 10, 1) 117 FIELD(STATUS, PSS_CFG_RESET_B, 5, 1) 118 119 REG32(DMA_SRC_ADDR, 0x18) 120 REG32(DMA_DST_ADDR, 0x1C) 121 REG32(DMA_SRC_LEN, 0x20) 122 REG32(DMA_DST_LEN, 0x24) 123 REG32(ROM_SHADOW, 0x28) 124 REG32(SW_ID, 0x30) 125 REG32(UNLOCK, 0x34) 126 127 #define R_UNLOCK_MAGIC 0x757BDF0D 128 129 REG32(MCTRL, 0x80) 130 FIELD(MCTRL, PS_VERSION, 28, 4) 131 FIELD(MCTRL, PCFG_POR_B, 8, 1) 132 FIELD(MCTRL, INT_PCAP_LPBK, 4, 1) 133 FIELD(MCTRL, QEMU, 3, 1) 134 135 static void xlnx_zynq_devcfg_update_ixr(XlnxZynqDevcfg *s) 136 { 137 qemu_set_irq(s->irq, ~s->regs[R_INT_MASK] & s->regs[R_INT_STS]); 138 } 139 140 static void xlnx_zynq_devcfg_reset(DeviceState *dev) 141 { 142 XlnxZynqDevcfg *s = XLNX_ZYNQ_DEVCFG(dev); 143 int i; 144 145 for (i = 0; i < XLNX_ZYNQ_DEVCFG_R_MAX; ++i) { 146 register_reset(&s->regs_info[i]); 147 } 148 } 149 150 static void xlnx_zynq_devcfg_dma_go(XlnxZynqDevcfg *s) 151 { 152 do { 153 uint8_t buf[BTT_MAX]; 154 XlnxZynqDevcfgDMACmd *dmah = s->dma_cmd_fifo; 155 uint32_t btt = BTT_MAX; 156 bool loopback = s->regs[R_MCTRL] & R_MCTRL_INT_PCAP_LPBK_MASK; 157 158 btt = MIN(btt, dmah->src_len); 159 if (loopback) { 160 btt = MIN(btt, dmah->dest_len); 161 } 162 DB_PRINT("reading %x bytes from %x\n", btt, dmah->src_addr); 163 dma_memory_read(&address_space_memory, dmah->src_addr, buf, btt); 164 dmah->src_len -= btt; 165 dmah->src_addr += btt; 166 if (loopback && (dmah->src_len || dmah->dest_len)) { 167 DB_PRINT("writing %x bytes from %x\n", btt, dmah->dest_addr); 168 dma_memory_write(&address_space_memory, dmah->dest_addr, buf, btt); 169 dmah->dest_len -= btt; 170 dmah->dest_addr += btt; 171 } 172 if (!dmah->src_len && !dmah->dest_len) { 173 DB_PRINT("dma operation finished\n"); 174 s->regs[R_INT_STS] |= R_INT_STS_DMA_DONE_MASK | 175 R_INT_STS_DMA_P_DONE_MASK; 176 s->dma_cmd_fifo_num--; 177 memmove(s->dma_cmd_fifo, &s->dma_cmd_fifo[1], 178 sizeof(s->dma_cmd_fifo) - sizeof(s->dma_cmd_fifo[0])); 179 } 180 xlnx_zynq_devcfg_update_ixr(s); 181 } while (s->dma_cmd_fifo_num); 182 } 183 184 static void r_ixr_post_write(RegisterInfo *reg, uint64_t val) 185 { 186 XlnxZynqDevcfg *s = XLNX_ZYNQ_DEVCFG(reg->opaque); 187 188 xlnx_zynq_devcfg_update_ixr(s); 189 } 190 191 static uint64_t r_ctrl_pre_write(RegisterInfo *reg, uint64_t val) 192 { 193 XlnxZynqDevcfg *s = XLNX_ZYNQ_DEVCFG(reg->opaque); 194 int i; 195 196 for (i = 0; i < ARRAY_SIZE(lock_ctrl_map); ++i) { 197 if (s->regs[R_LOCK] & 1 << i) { 198 val &= ~lock_ctrl_map[i]; 199 val |= lock_ctrl_map[i] & s->regs[R_CTRL]; 200 } 201 } 202 return val; 203 } 204 205 static void r_ctrl_post_write(RegisterInfo *reg, uint64_t val) 206 { 207 const char *device_prefix = object_get_typename(OBJECT(reg->opaque)); 208 uint32_t aes_en = FIELD_EX32(val, CTRL, PCFG_AES_EN); 209 210 if (aes_en != 0 && aes_en != 7) { 211 qemu_log_mask(LOG_UNIMP, "%s: warning, aes-en bits inconsistent," 212 "unimplemented security reset should happen!\n", 213 device_prefix); 214 } 215 } 216 217 static void r_unlock_post_write(RegisterInfo *reg, uint64_t val) 218 { 219 XlnxZynqDevcfg *s = XLNX_ZYNQ_DEVCFG(reg->opaque); 220 const char *device_prefix = object_get_typename(OBJECT(s)); 221 222 if (val == R_UNLOCK_MAGIC) { 223 DB_PRINT("successful unlock\n"); 224 s->regs[R_CTRL] |= R_CTRL_PCAP_PR_MASK; 225 s->regs[R_CTRL] |= R_CTRL_PCFG_AES_EN_MASK; 226 memory_region_set_enabled(&s->iomem, true); 227 } else { /* bad unlock attempt */ 228 qemu_log_mask(LOG_GUEST_ERROR, "%s: failed unlock\n", device_prefix); 229 s->regs[R_CTRL] &= ~R_CTRL_PCAP_PR_MASK; 230 s->regs[R_CTRL] &= ~R_CTRL_PCFG_AES_EN_MASK; 231 /* core becomes inaccessible */ 232 memory_region_set_enabled(&s->iomem, false); 233 } 234 } 235 236 static uint64_t r_lock_pre_write(RegisterInfo *reg, uint64_t val) 237 { 238 XlnxZynqDevcfg *s = XLNX_ZYNQ_DEVCFG(reg->opaque); 239 240 /* once bits are locked they stay locked */ 241 return s->regs[R_LOCK] | val; 242 } 243 244 static void r_dma_dst_len_post_write(RegisterInfo *reg, uint64_t val) 245 { 246 XlnxZynqDevcfg *s = XLNX_ZYNQ_DEVCFG(reg->opaque); 247 248 s->dma_cmd_fifo[s->dma_cmd_fifo_num] = (XlnxZynqDevcfgDMACmd) { 249 .src_addr = s->regs[R_DMA_SRC_ADDR] & ~0x3UL, 250 .dest_addr = s->regs[R_DMA_DST_ADDR] & ~0x3UL, 251 .src_len = s->regs[R_DMA_SRC_LEN] << 2, 252 .dest_len = s->regs[R_DMA_DST_LEN] << 2, 253 }; 254 s->dma_cmd_fifo_num++; 255 DB_PRINT("dma transfer started; %d total transfers pending\n", 256 s->dma_cmd_fifo_num); 257 xlnx_zynq_devcfg_dma_go(s); 258 } 259 260 static const RegisterAccessInfo xlnx_zynq_devcfg_regs_info[] = { 261 { .name = "CTRL", .addr = A_CTRL, 262 .reset = R_CTRL_PCAP_PR_MASK | R_CTRL_PCAP_MODE_MASK | 0x3 << 13, 263 .rsvd = 0x1 << 28 | 0x3ff << 13 | 0x3 << 13, 264 .pre_write = r_ctrl_pre_write, 265 .post_write = r_ctrl_post_write, 266 }, 267 { .name = "LOCK", .addr = A_LOCK, 268 .rsvd = MAKE_64BIT_MASK(5, 64 - 5), 269 .pre_write = r_lock_pre_write, 270 }, 271 { .name = "CFG", .addr = A_CFG, 272 .reset = R_CFG_RESET, 273 .rsvd = 0xfffff00f, 274 }, 275 { .name = "INT_STS", .addr = A_INT_STS, 276 .w1c = ~R_INT_STS_RSVD, 277 .reset = R_INT_STS_PSS_GTS_USR_B_MASK | 278 R_INT_STS_PSS_CFG_RESET_B_MASK | 279 R_INT_STS_WR_FIFO_LVL_MASK, 280 .rsvd = R_INT_STS_RSVD, 281 .post_write = r_ixr_post_write, 282 }, 283 { .name = "INT_MASK", .addr = A_INT_MASK, 284 .reset = ~0, 285 .rsvd = R_INT_STS_RSVD, 286 .post_write = r_ixr_post_write, 287 }, 288 { .name = "STATUS", .addr = A_STATUS, 289 .reset = R_STATUS_DMA_CMD_Q_E_MASK | 290 R_STATUS_PSS_GTS_USR_B_MASK | 291 R_STATUS_PSS_CFG_RESET_B_MASK, 292 .ro = ~0, 293 }, 294 { .name = "DMA_SRC_ADDR", .addr = A_DMA_SRC_ADDR, }, 295 { .name = "DMA_DST_ADDR", .addr = A_DMA_DST_ADDR, }, 296 { .name = "DMA_SRC_LEN", .addr = A_DMA_SRC_LEN, 297 .ro = MAKE_64BIT_MASK(27, 64 - 27) }, 298 { .name = "DMA_DST_LEN", .addr = A_DMA_DST_LEN, 299 .ro = MAKE_64BIT_MASK(27, 64 - 27), 300 .post_write = r_dma_dst_len_post_write, 301 }, 302 { .name = "ROM_SHADOW", .addr = A_ROM_SHADOW, 303 .rsvd = ~0ull, 304 }, 305 { .name = "SW_ID", .addr = A_SW_ID, }, 306 { .name = "UNLOCK", .addr = A_UNLOCK, 307 .post_write = r_unlock_post_write, 308 }, 309 { .name = "MCTRL", .addr = R_MCTRL * 4, 310 /* Silicon 3.0 for version field, the mysterious reserved bit 23 311 * and QEMU platform identifier. 312 */ 313 .reset = 0x2 << R_MCTRL_PS_VERSION_SHIFT | 1 << 23 | R_MCTRL_QEMU_MASK, 314 .ro = ~R_MCTRL_INT_PCAP_LPBK_MASK, 315 .rsvd = 0x00f00303, 316 }, 317 }; 318 319 static const MemoryRegionOps xlnx_zynq_devcfg_reg_ops = { 320 .read = register_read_memory, 321 .write = register_write_memory, 322 .endianness = DEVICE_LITTLE_ENDIAN, 323 .valid = { 324 .min_access_size = 4, 325 .max_access_size = 4, 326 } 327 }; 328 329 static const VMStateDescription vmstate_xlnx_zynq_devcfg_dma_cmd = { 330 .name = "xlnx_zynq_devcfg_dma_cmd", 331 .version_id = 1, 332 .minimum_version_id = 1, 333 .fields = (VMStateField[]) { 334 VMSTATE_UINT32(src_addr, XlnxZynqDevcfgDMACmd), 335 VMSTATE_UINT32(dest_addr, XlnxZynqDevcfgDMACmd), 336 VMSTATE_UINT32(src_len, XlnxZynqDevcfgDMACmd), 337 VMSTATE_UINT32(dest_len, XlnxZynqDevcfgDMACmd), 338 VMSTATE_END_OF_LIST() 339 } 340 }; 341 342 static const VMStateDescription vmstate_xlnx_zynq_devcfg = { 343 .name = "xlnx_zynq_devcfg", 344 .version_id = 1, 345 .minimum_version_id = 1, 346 .fields = (VMStateField[]) { 347 VMSTATE_STRUCT_ARRAY(dma_cmd_fifo, XlnxZynqDevcfg, 348 XLNX_ZYNQ_DEVCFG_DMA_CMD_FIFO_LEN, 0, 349 vmstate_xlnx_zynq_devcfg_dma_cmd, 350 XlnxZynqDevcfgDMACmd), 351 VMSTATE_UINT8(dma_cmd_fifo_num, XlnxZynqDevcfg), 352 VMSTATE_UINT32_ARRAY(regs, XlnxZynqDevcfg, XLNX_ZYNQ_DEVCFG_R_MAX), 353 VMSTATE_END_OF_LIST() 354 } 355 }; 356 357 static void xlnx_zynq_devcfg_init(Object *obj) 358 { 359 SysBusDevice *sbd = SYS_BUS_DEVICE(obj); 360 XlnxZynqDevcfg *s = XLNX_ZYNQ_DEVCFG(obj); 361 RegisterInfoArray *reg_array; 362 363 sysbus_init_irq(sbd, &s->irq); 364 365 memory_region_init(&s->iomem, obj, "devcfg", XLNX_ZYNQ_DEVCFG_R_MAX * 4); 366 reg_array = 367 register_init_block32(DEVICE(obj), xlnx_zynq_devcfg_regs_info, 368 ARRAY_SIZE(xlnx_zynq_devcfg_regs_info), 369 s->regs_info, s->regs, 370 &xlnx_zynq_devcfg_reg_ops, 371 XLNX_ZYNQ_DEVCFG_ERR_DEBUG, 372 XLNX_ZYNQ_DEVCFG_R_MAX); 373 memory_region_add_subregion(&s->iomem, 374 A_CTRL, 375 ®_array->mem); 376 377 sysbus_init_mmio(sbd, &s->iomem); 378 } 379 380 static void xlnx_zynq_devcfg_class_init(ObjectClass *klass, void *data) 381 { 382 DeviceClass *dc = DEVICE_CLASS(klass); 383 384 dc->reset = xlnx_zynq_devcfg_reset; 385 dc->vmsd = &vmstate_xlnx_zynq_devcfg; 386 } 387 388 static const TypeInfo xlnx_zynq_devcfg_info = { 389 .name = TYPE_XLNX_ZYNQ_DEVCFG, 390 .parent = TYPE_SYS_BUS_DEVICE, 391 .instance_size = sizeof(XlnxZynqDevcfg), 392 .instance_init = xlnx_zynq_devcfg_init, 393 .class_init = xlnx_zynq_devcfg_class_init, 394 }; 395 396 static void xlnx_zynq_devcfg_register_types(void) 397 { 398 type_register_static(&xlnx_zynq_devcfg_info); 399 } 400 401 type_init(xlnx_zynq_devcfg_register_types) 402