1 | /* |
2 | * DEC 21272 (TSUNAMI/TYPHOON) chipset emulation. |
3 | * |
4 | * Written by Richard Henderson. |
5 | * |
6 | * This work is licensed under the GNU GPL license version 2 or later. |
7 | */ |
8 | |
9 | #include "qemu/osdep.h" |
10 | #include "qemu/module.h" |
11 | #include "qemu/units.h" |
12 | #include "qapi/error.h" |
13 | #include "cpu.h" |
14 | #include "hw/boards.h" |
15 | #include "hw/irq.h" |
16 | #include "alpha_sys.h" |
17 | #include "exec/address-spaces.h" |
18 | |
19 | |
20 | #define TYPE_TYPHOON_PCI_HOST_BRIDGE "typhoon-pcihost" |
21 | #define TYPE_TYPHOON_IOMMU_MEMORY_REGION "typhoon-iommu-memory-region" |
22 | |
23 | typedef struct TyphoonCchip { |
24 | MemoryRegion region; |
25 | uint64_t misc; |
26 | uint64_t drir; |
27 | uint64_t dim[4]; |
28 | uint32_t iic[4]; |
29 | AlphaCPU *cpu[4]; |
30 | } TyphoonCchip; |
31 | |
32 | typedef struct TyphoonWindow { |
33 | uint64_t wba; |
34 | uint64_t wsm; |
35 | uint64_t tba; |
36 | } TyphoonWindow; |
37 | |
38 | typedef struct TyphoonPchip { |
39 | MemoryRegion region; |
40 | MemoryRegion reg_iack; |
41 | MemoryRegion reg_mem; |
42 | MemoryRegion reg_io; |
43 | MemoryRegion reg_conf; |
44 | |
45 | AddressSpace iommu_as; |
46 | IOMMUMemoryRegion iommu; |
47 | |
48 | uint64_t ctl; |
49 | TyphoonWindow win[4]; |
50 | } TyphoonPchip; |
51 | |
52 | #define TYPHOON_PCI_HOST_BRIDGE(obj) \ |
53 | OBJECT_CHECK(TyphoonState, (obj), TYPE_TYPHOON_PCI_HOST_BRIDGE) |
54 | |
55 | typedef struct TyphoonState { |
56 | PCIHostState parent_obj; |
57 | |
58 | TyphoonCchip cchip; |
59 | TyphoonPchip pchip; |
60 | MemoryRegion dchip_region; |
61 | MemoryRegion ram_region; |
62 | } TyphoonState; |
63 | |
64 | /* Called when one of DRIR or DIM changes. */ |
65 | static void cpu_irq_change(AlphaCPU *cpu, uint64_t req) |
66 | { |
67 | /* If there are any non-masked interrupts, tell the cpu. */ |
68 | if (cpu != NULL) { |
69 | CPUState *cs = CPU(cpu); |
70 | if (req) { |
71 | cpu_interrupt(cs, CPU_INTERRUPT_HARD); |
72 | } else { |
73 | cpu_reset_interrupt(cs, CPU_INTERRUPT_HARD); |
74 | } |
75 | } |
76 | } |
77 | |
78 | static MemTxResult cchip_read(void *opaque, hwaddr addr, |
79 | uint64_t *data, unsigned size, |
80 | MemTxAttrs attrs) |
81 | { |
82 | CPUState *cpu = current_cpu; |
83 | TyphoonState *s = opaque; |
84 | uint64_t ret = 0; |
85 | |
86 | switch (addr) { |
87 | case 0x0000: |
88 | /* CSC: Cchip System Configuration Register. */ |
89 | /* All sorts of data here; probably the only thing relevant is |
90 | PIP<14> Pchip 1 Present = 0. */ |
91 | break; |
92 | |
93 | case 0x0040: |
94 | /* MTR: Memory Timing Register. */ |
95 | /* All sorts of stuff related to real DRAM. */ |
96 | break; |
97 | |
98 | case 0x0080: |
99 | /* MISC: Miscellaneous Register. */ |
100 | ret = s->cchip.misc | (cpu->cpu_index & 3); |
101 | break; |
102 | |
103 | case 0x00c0: |
104 | /* MPD: Memory Presence Detect Register. */ |
105 | break; |
106 | |
107 | case 0x0100: /* AAR0 */ |
108 | case 0x0140: /* AAR1 */ |
109 | case 0x0180: /* AAR2 */ |
110 | case 0x01c0: /* AAR3 */ |
111 | /* AAR: Array Address Register. */ |
112 | /* All sorts of information about DRAM. */ |
113 | break; |
114 | |
115 | case 0x0200: |
116 | /* DIM0: Device Interrupt Mask Register, CPU0. */ |
117 | ret = s->cchip.dim[0]; |
118 | break; |
119 | case 0x0240: |
120 | /* DIM1: Device Interrupt Mask Register, CPU1. */ |
121 | ret = s->cchip.dim[1]; |
122 | break; |
123 | case 0x0280: |
124 | /* DIR0: Device Interrupt Request Register, CPU0. */ |
125 | ret = s->cchip.dim[0] & s->cchip.drir; |
126 | break; |
127 | case 0x02c0: |
128 | /* DIR1: Device Interrupt Request Register, CPU1. */ |
129 | ret = s->cchip.dim[1] & s->cchip.drir; |
130 | break; |
131 | case 0x0300: |
132 | /* DRIR: Device Raw Interrupt Request Register. */ |
133 | ret = s->cchip.drir; |
134 | break; |
135 | |
136 | case 0x0340: |
137 | /* PRBEN: Probe Enable Register. */ |
138 | break; |
139 | |
140 | case 0x0380: |
141 | /* IIC0: Interval Ignore Count Register, CPU0. */ |
142 | ret = s->cchip.iic[0]; |
143 | break; |
144 | case 0x03c0: |
145 | /* IIC1: Interval Ignore Count Register, CPU1. */ |
146 | ret = s->cchip.iic[1]; |
147 | break; |
148 | |
149 | case 0x0400: /* MPR0 */ |
150 | case 0x0440: /* MPR1 */ |
151 | case 0x0480: /* MPR2 */ |
152 | case 0x04c0: /* MPR3 */ |
153 | /* MPR: Memory Programming Register. */ |
154 | break; |
155 | |
156 | case 0x0580: |
157 | /* TTR: TIGbus Timing Register. */ |
158 | /* All sorts of stuff related to interrupt delivery timings. */ |
159 | break; |
160 | case 0x05c0: |
161 | /* TDR: TIGbug Device Timing Register. */ |
162 | break; |
163 | |
164 | case 0x0600: |
165 | /* DIM2: Device Interrupt Mask Register, CPU2. */ |
166 | ret = s->cchip.dim[2]; |
167 | break; |
168 | case 0x0640: |
169 | /* DIM3: Device Interrupt Mask Register, CPU3. */ |
170 | ret = s->cchip.dim[3]; |
171 | break; |
172 | case 0x0680: |
173 | /* DIR2: Device Interrupt Request Register, CPU2. */ |
174 | ret = s->cchip.dim[2] & s->cchip.drir; |
175 | break; |
176 | case 0x06c0: |
177 | /* DIR3: Device Interrupt Request Register, CPU3. */ |
178 | ret = s->cchip.dim[3] & s->cchip.drir; |
179 | break; |
180 | |
181 | case 0x0700: |
182 | /* IIC2: Interval Ignore Count Register, CPU2. */ |
183 | ret = s->cchip.iic[2]; |
184 | break; |
185 | case 0x0740: |
186 | /* IIC3: Interval Ignore Count Register, CPU3. */ |
187 | ret = s->cchip.iic[3]; |
188 | break; |
189 | |
190 | case 0x0780: |
191 | /* PWR: Power Management Control. */ |
192 | break; |
193 | |
194 | case 0x0c00: /* CMONCTLA */ |
195 | case 0x0c40: /* CMONCTLB */ |
196 | case 0x0c80: /* CMONCNT01 */ |
197 | case 0x0cc0: /* CMONCNT23 */ |
198 | break; |
199 | |
200 | default: |
201 | return MEMTX_ERROR; |
202 | } |
203 | |
204 | *data = ret; |
205 | return MEMTX_OK; |
206 | } |
207 | |
208 | static uint64_t dchip_read(void *opaque, hwaddr addr, unsigned size) |
209 | { |
210 | /* Skip this. It's all related to DRAM timing and setup. */ |
211 | return 0; |
212 | } |
213 | |
214 | static MemTxResult pchip_read(void *opaque, hwaddr addr, uint64_t *data, |
215 | unsigned size, MemTxAttrs attrs) |
216 | { |
217 | TyphoonState *s = opaque; |
218 | uint64_t ret = 0; |
219 | |
220 | switch (addr) { |
221 | case 0x0000: |
222 | /* WSBA0: Window Space Base Address Register. */ |
223 | ret = s->pchip.win[0].wba; |
224 | break; |
225 | case 0x0040: |
226 | /* WSBA1 */ |
227 | ret = s->pchip.win[1].wba; |
228 | break; |
229 | case 0x0080: |
230 | /* WSBA2 */ |
231 | ret = s->pchip.win[2].wba; |
232 | break; |
233 | case 0x00c0: |
234 | /* WSBA3 */ |
235 | ret = s->pchip.win[3].wba; |
236 | break; |
237 | |
238 | case 0x0100: |
239 | /* WSM0: Window Space Mask Register. */ |
240 | ret = s->pchip.win[0].wsm; |
241 | break; |
242 | case 0x0140: |
243 | /* WSM1 */ |
244 | ret = s->pchip.win[1].wsm; |
245 | break; |
246 | case 0x0180: |
247 | /* WSM2 */ |
248 | ret = s->pchip.win[2].wsm; |
249 | break; |
250 | case 0x01c0: |
251 | /* WSM3 */ |
252 | ret = s->pchip.win[3].wsm; |
253 | break; |
254 | |
255 | case 0x0200: |
256 | /* TBA0: Translated Base Address Register. */ |
257 | ret = s->pchip.win[0].tba; |
258 | break; |
259 | case 0x0240: |
260 | /* TBA1 */ |
261 | ret = s->pchip.win[1].tba; |
262 | break; |
263 | case 0x0280: |
264 | /* TBA2 */ |
265 | ret = s->pchip.win[2].tba; |
266 | break; |
267 | case 0x02c0: |
268 | /* TBA3 */ |
269 | ret = s->pchip.win[3].tba; |
270 | break; |
271 | |
272 | case 0x0300: |
273 | /* PCTL: Pchip Control Register. */ |
274 | ret = s->pchip.ctl; |
275 | break; |
276 | case 0x0340: |
277 | /* PLAT: Pchip Master Latency Register. */ |
278 | break; |
279 | case 0x03c0: |
280 | /* PERROR: Pchip Error Register. */ |
281 | break; |
282 | case 0x0400: |
283 | /* PERRMASK: Pchip Error Mask Register. */ |
284 | break; |
285 | case 0x0440: |
286 | /* PERRSET: Pchip Error Set Register. */ |
287 | break; |
288 | case 0x0480: |
289 | /* TLBIV: Translation Buffer Invalidate Virtual Register (WO). */ |
290 | break; |
291 | case 0x04c0: |
292 | /* TLBIA: Translation Buffer Invalidate All Register (WO). */ |
293 | break; |
294 | case 0x0500: /* PMONCTL */ |
295 | case 0x0540: /* PMONCNT */ |
296 | case 0x0800: /* SPRST */ |
297 | break; |
298 | |
299 | default: |
300 | return MEMTX_ERROR; |
301 | } |
302 | |
303 | *data = ret; |
304 | return MEMTX_OK; |
305 | } |
306 | |
307 | static MemTxResult cchip_write(void *opaque, hwaddr addr, |
308 | uint64_t val, unsigned size, |
309 | MemTxAttrs attrs) |
310 | { |
311 | TyphoonState *s = opaque; |
312 | uint64_t oldval, newval; |
313 | |
314 | switch (addr) { |
315 | case 0x0000: |
316 | /* CSC: Cchip System Configuration Register. */ |
317 | /* All sorts of data here; nothing relevant RW. */ |
318 | break; |
319 | |
320 | case 0x0040: |
321 | /* MTR: Memory Timing Register. */ |
322 | /* All sorts of stuff related to real DRAM. */ |
323 | break; |
324 | |
325 | case 0x0080: |
326 | /* MISC: Miscellaneous Register. */ |
327 | newval = oldval = s->cchip.misc; |
328 | newval &= ~(val & 0x10000ff0); /* W1C fields */ |
329 | if (val & 0x100000) { |
330 | newval &= ~0xff0000ull; /* ACL clears ABT and ABW */ |
331 | } else { |
332 | newval |= val & 0x00f00000; /* ABT field is W1S */ |
333 | if ((newval & 0xf0000) == 0) { |
334 | newval |= val & 0xf0000; /* ABW field is W1S iff zero */ |
335 | } |
336 | } |
337 | newval |= (val & 0xf000) >> 4; /* IPREQ field sets IPINTR. */ |
338 | |
339 | newval &= ~0xf0000000000ull; /* WO and RW fields */ |
340 | newval |= val & 0xf0000000000ull; |
341 | s->cchip.misc = newval; |
342 | |
343 | /* Pass on changes to IPI and ITI state. */ |
344 | if ((newval ^ oldval) & 0xff0) { |
345 | int i; |
346 | for (i = 0; i < 4; ++i) { |
347 | AlphaCPU *cpu = s->cchip.cpu[i]; |
348 | if (cpu != NULL) { |
349 | CPUState *cs = CPU(cpu); |
350 | /* IPI can be either cleared or set by the write. */ |
351 | if (newval & (1 << (i + 8))) { |
352 | cpu_interrupt(cs, CPU_INTERRUPT_SMP); |
353 | } else { |
354 | cpu_reset_interrupt(cs, CPU_INTERRUPT_SMP); |
355 | } |
356 | |
357 | /* ITI can only be cleared by the write. */ |
358 | if ((newval & (1 << (i + 4))) == 0) { |
359 | cpu_reset_interrupt(cs, CPU_INTERRUPT_TIMER); |
360 | } |
361 | } |
362 | } |
363 | } |
364 | break; |
365 | |
366 | case 0x00c0: |
367 | /* MPD: Memory Presence Detect Register. */ |
368 | break; |
369 | |
370 | case 0x0100: /* AAR0 */ |
371 | case 0x0140: /* AAR1 */ |
372 | case 0x0180: /* AAR2 */ |
373 | case 0x01c0: /* AAR3 */ |
374 | /* AAR: Array Address Register. */ |
375 | /* All sorts of information about DRAM. */ |
376 | break; |
377 | |
378 | case 0x0200: /* DIM0 */ |
379 | /* DIM: Device Interrupt Mask Register, CPU0. */ |
380 | s->cchip.dim[0] = val; |
381 | cpu_irq_change(s->cchip.cpu[0], val & s->cchip.drir); |
382 | break; |
383 | case 0x0240: /* DIM1 */ |
384 | /* DIM: Device Interrupt Mask Register, CPU1. */ |
385 | s->cchip.dim[1] = val; |
386 | cpu_irq_change(s->cchip.cpu[1], val & s->cchip.drir); |
387 | break; |
388 | |
389 | case 0x0280: /* DIR0 (RO) */ |
390 | case 0x02c0: /* DIR1 (RO) */ |
391 | case 0x0300: /* DRIR (RO) */ |
392 | break; |
393 | |
394 | case 0x0340: |
395 | /* PRBEN: Probe Enable Register. */ |
396 | break; |
397 | |
398 | case 0x0380: /* IIC0 */ |
399 | s->cchip.iic[0] = val & 0xffffff; |
400 | break; |
401 | case 0x03c0: /* IIC1 */ |
402 | s->cchip.iic[1] = val & 0xffffff; |
403 | break; |
404 | |
405 | case 0x0400: /* MPR0 */ |
406 | case 0x0440: /* MPR1 */ |
407 | case 0x0480: /* MPR2 */ |
408 | case 0x04c0: /* MPR3 */ |
409 | /* MPR: Memory Programming Register. */ |
410 | break; |
411 | |
412 | case 0x0580: |
413 | /* TTR: TIGbus Timing Register. */ |
414 | /* All sorts of stuff related to interrupt delivery timings. */ |
415 | break; |
416 | case 0x05c0: |
417 | /* TDR: TIGbug Device Timing Register. */ |
418 | break; |
419 | |
420 | case 0x0600: |
421 | /* DIM2: Device Interrupt Mask Register, CPU2. */ |
422 | s->cchip.dim[2] = val; |
423 | cpu_irq_change(s->cchip.cpu[2], val & s->cchip.drir); |
424 | break; |
425 | case 0x0640: |
426 | /* DIM3: Device Interrupt Mask Register, CPU3. */ |
427 | s->cchip.dim[3] = val; |
428 | cpu_irq_change(s->cchip.cpu[3], val & s->cchip.drir); |
429 | break; |
430 | |
431 | case 0x0680: /* DIR2 (RO) */ |
432 | case 0x06c0: /* DIR3 (RO) */ |
433 | break; |
434 | |
435 | case 0x0700: /* IIC2 */ |
436 | s->cchip.iic[2] = val & 0xffffff; |
437 | break; |
438 | case 0x0740: /* IIC3 */ |
439 | s->cchip.iic[3] = val & 0xffffff; |
440 | break; |
441 | |
442 | case 0x0780: |
443 | /* PWR: Power Management Control. */ |
444 | break; |
445 | |
446 | case 0x0c00: /* CMONCTLA */ |
447 | case 0x0c40: /* CMONCTLB */ |
448 | case 0x0c80: /* CMONCNT01 */ |
449 | case 0x0cc0: /* CMONCNT23 */ |
450 | break; |
451 | |
452 | default: |
453 | return MEMTX_ERROR; |
454 | } |
455 | |
456 | return MEMTX_OK; |
457 | } |
458 | |
459 | static void dchip_write(void *opaque, hwaddr addr, |
460 | uint64_t val, unsigned size) |
461 | { |
462 | /* Skip this. It's all related to DRAM timing and setup. */ |
463 | } |
464 | |
465 | static MemTxResult pchip_write(void *opaque, hwaddr addr, |
466 | uint64_t val, unsigned size, |
467 | MemTxAttrs attrs) |
468 | { |
469 | TyphoonState *s = opaque; |
470 | uint64_t oldval; |
471 | |
472 | switch (addr) { |
473 | case 0x0000: |
474 | /* WSBA0: Window Space Base Address Register. */ |
475 | s->pchip.win[0].wba = val & 0xfff00003u; |
476 | break; |
477 | case 0x0040: |
478 | /* WSBA1 */ |
479 | s->pchip.win[1].wba = val & 0xfff00003u; |
480 | break; |
481 | case 0x0080: |
482 | /* WSBA2 */ |
483 | s->pchip.win[2].wba = val & 0xfff00003u; |
484 | break; |
485 | case 0x00c0: |
486 | /* WSBA3 */ |
487 | s->pchip.win[3].wba = (val & 0x80fff00001ull) | 2; |
488 | break; |
489 | |
490 | case 0x0100: |
491 | /* WSM0: Window Space Mask Register. */ |
492 | s->pchip.win[0].wsm = val & 0xfff00000u; |
493 | break; |
494 | case 0x0140: |
495 | /* WSM1 */ |
496 | s->pchip.win[1].wsm = val & 0xfff00000u; |
497 | break; |
498 | case 0x0180: |
499 | /* WSM2 */ |
500 | s->pchip.win[2].wsm = val & 0xfff00000u; |
501 | break; |
502 | case 0x01c0: |
503 | /* WSM3 */ |
504 | s->pchip.win[3].wsm = val & 0xfff00000u; |
505 | break; |
506 | |
507 | case 0x0200: |
508 | /* TBA0: Translated Base Address Register. */ |
509 | s->pchip.win[0].tba = val & 0x7fffffc00ull; |
510 | break; |
511 | case 0x0240: |
512 | /* TBA1 */ |
513 | s->pchip.win[1].tba = val & 0x7fffffc00ull; |
514 | break; |
515 | case 0x0280: |
516 | /* TBA2 */ |
517 | s->pchip.win[2].tba = val & 0x7fffffc00ull; |
518 | break; |
519 | case 0x02c0: |
520 | /* TBA3 */ |
521 | s->pchip.win[3].tba = val & 0x7fffffc00ull; |
522 | break; |
523 | |
524 | case 0x0300: |
525 | /* PCTL: Pchip Control Register. */ |
526 | oldval = s->pchip.ctl; |
527 | oldval &= ~0x00001cff0fc7ffull; /* RW fields */ |
528 | oldval |= val & 0x00001cff0fc7ffull; |
529 | s->pchip.ctl = oldval; |
530 | break; |
531 | |
532 | case 0x0340: |
533 | /* PLAT: Pchip Master Latency Register. */ |
534 | break; |
535 | case 0x03c0: |
536 | /* PERROR: Pchip Error Register. */ |
537 | break; |
538 | case 0x0400: |
539 | /* PERRMASK: Pchip Error Mask Register. */ |
540 | break; |
541 | case 0x0440: |
542 | /* PERRSET: Pchip Error Set Register. */ |
543 | break; |
544 | |
545 | case 0x0480: |
546 | /* TLBIV: Translation Buffer Invalidate Virtual Register. */ |
547 | break; |
548 | |
549 | case 0x04c0: |
550 | /* TLBIA: Translation Buffer Invalidate All Register (WO). */ |
551 | break; |
552 | |
553 | case 0x0500: |
554 | /* PMONCTL */ |
555 | case 0x0540: |
556 | /* PMONCNT */ |
557 | case 0x0800: |
558 | /* SPRST */ |
559 | break; |
560 | |
561 | default: |
562 | return MEMTX_ERROR; |
563 | } |
564 | |
565 | return MEMTX_OK; |
566 | } |
567 | |
568 | static const MemoryRegionOps cchip_ops = { |
569 | .read_with_attrs = cchip_read, |
570 | .write_with_attrs = cchip_write, |
571 | .endianness = DEVICE_LITTLE_ENDIAN, |
572 | .valid = { |
573 | .min_access_size = 8, |
574 | .max_access_size = 8, |
575 | }, |
576 | .impl = { |
577 | .min_access_size = 8, |
578 | .max_access_size = 8, |
579 | }, |
580 | }; |
581 | |
582 | static const MemoryRegionOps dchip_ops = { |
583 | .read = dchip_read, |
584 | .write = dchip_write, |
585 | .endianness = DEVICE_LITTLE_ENDIAN, |
586 | .valid = { |
587 | .min_access_size = 8, |
588 | .max_access_size = 8, |
589 | }, |
590 | .impl = { |
591 | .min_access_size = 8, |
592 | .max_access_size = 8, |
593 | }, |
594 | }; |
595 | |
596 | static const MemoryRegionOps pchip_ops = { |
597 | .read_with_attrs = pchip_read, |
598 | .write_with_attrs = pchip_write, |
599 | .endianness = DEVICE_LITTLE_ENDIAN, |
600 | .valid = { |
601 | .min_access_size = 8, |
602 | .max_access_size = 8, |
603 | }, |
604 | .impl = { |
605 | .min_access_size = 8, |
606 | .max_access_size = 8, |
607 | }, |
608 | }; |
609 | |
610 | /* A subroutine of typhoon_translate_iommu that builds an IOMMUTLBEntry |
611 | using the given translated address and mask. */ |
612 | static bool make_iommu_tlbe(hwaddr taddr, hwaddr mask, IOMMUTLBEntry *ret) |
613 | { |
614 | *ret = (IOMMUTLBEntry) { |
615 | .target_as = &address_space_memory, |
616 | .translated_addr = taddr, |
617 | .addr_mask = mask, |
618 | .perm = IOMMU_RW, |
619 | }; |
620 | return true; |
621 | } |
622 | |
623 | /* A subroutine of typhoon_translate_iommu that handles scatter-gather |
624 | translation, given the address of the PTE. */ |
625 | static bool pte_translate(hwaddr pte_addr, IOMMUTLBEntry *ret) |
626 | { |
627 | uint64_t pte = address_space_ldq(&address_space_memory, pte_addr, |
628 | MEMTXATTRS_UNSPECIFIED, NULL); |
629 | |
630 | /* Check valid bit. */ |
631 | if ((pte & 1) == 0) { |
632 | return false; |
633 | } |
634 | |
635 | return make_iommu_tlbe((pte & 0x3ffffe) << 12, 0x1fff, ret); |
636 | } |
637 | |
638 | /* A subroutine of typhoon_translate_iommu that handles one of the |
639 | four single-address-cycle translation windows. */ |
640 | static bool window_translate(TyphoonWindow *win, hwaddr addr, |
641 | IOMMUTLBEntry *ret) |
642 | { |
643 | uint32_t wba = win->wba; |
644 | uint64_t wsm = win->wsm; |
645 | uint64_t tba = win->tba; |
646 | uint64_t wsm_ext = wsm | 0xfffff; |
647 | |
648 | /* Check for window disabled. */ |
649 | if ((wba & 1) == 0) { |
650 | return false; |
651 | } |
652 | |
653 | /* Check for window hit. */ |
654 | if ((addr & ~wsm_ext) != (wba & 0xfff00000u)) { |
655 | return false; |
656 | } |
657 | |
658 | if (wba & 2) { |
659 | /* Scatter-gather translation. */ |
660 | hwaddr pte_addr; |
661 | |
662 | /* See table 10-6, Generating PTE address for PCI DMA Address. */ |
663 | pte_addr = tba & ~(wsm >> 10); |
664 | pte_addr |= (addr & (wsm | 0xfe000)) >> 10; |
665 | return pte_translate(pte_addr, ret); |
666 | } else { |
667 | /* Direct-mapped translation. */ |
668 | return make_iommu_tlbe(tba & ~wsm_ext, wsm_ext, ret); |
669 | } |
670 | } |
671 | |
672 | /* Handle PCI-to-system address translation. */ |
673 | /* TODO: A translation failure here ought to set PCI error codes on the |
674 | Pchip and generate a machine check interrupt. */ |
675 | static IOMMUTLBEntry typhoon_translate_iommu(IOMMUMemoryRegion *iommu, |
676 | hwaddr addr, |
677 | IOMMUAccessFlags flag, |
678 | int iommu_idx) |
679 | { |
680 | TyphoonPchip *pchip = container_of(iommu, TyphoonPchip, iommu); |
681 | IOMMUTLBEntry ret; |
682 | int i; |
683 | |
684 | if (addr <= 0xffffffffu) { |
685 | /* Single-address cycle. */ |
686 | |
687 | /* Check for the Window Hole, inhibiting matching. */ |
688 | if ((pchip->ctl & 0x20) |
689 | && addr >= 0x80000 |
690 | && addr <= 0xfffff) { |
691 | goto failure; |
692 | } |
693 | |
694 | /* Check the first three windows. */ |
695 | for (i = 0; i < 3; ++i) { |
696 | if (window_translate(&pchip->win[i], addr, &ret)) { |
697 | goto success; |
698 | } |
699 | } |
700 | |
701 | /* Check the fourth window for DAC disable. */ |
702 | if ((pchip->win[3].wba & 0x80000000000ull) == 0 |
703 | && window_translate(&pchip->win[3], addr, &ret)) { |
704 | goto success; |
705 | } |
706 | } else { |
707 | /* Double-address cycle. */ |
708 | |
709 | if (addr >= 0x10000000000ull && addr < 0x20000000000ull) { |
710 | /* Check for the DMA monster window. */ |
711 | if (pchip->ctl & 0x40) { |
712 | /* See 10.1.4.4; in particular <39:35> is ignored. */ |
713 | make_iommu_tlbe(0, 0x007ffffffffull, &ret); |
714 | goto success; |
715 | } |
716 | } |
717 | |
718 | if (addr >= 0x80000000000ull && addr <= 0xfffffffffffull) { |
719 | /* Check the fourth window for DAC enable and window enable. */ |
720 | if ((pchip->win[3].wba & 0x80000000001ull) == 0x80000000001ull) { |
721 | uint64_t pte_addr; |
722 | |
723 | pte_addr = pchip->win[3].tba & 0x7ffc00000ull; |
724 | pte_addr |= (addr & 0xffffe000u) >> 10; |
725 | if (pte_translate(pte_addr, &ret)) { |
726 | goto success; |
727 | } |
728 | } |
729 | } |
730 | } |
731 | |
732 | failure: |
733 | ret = (IOMMUTLBEntry) { .perm = IOMMU_NONE }; |
734 | success: |
735 | return ret; |
736 | } |
737 | |
738 | static AddressSpace *typhoon_pci_dma_iommu(PCIBus *bus, void *opaque, int devfn) |
739 | { |
740 | TyphoonState *s = opaque; |
741 | return &s->pchip.iommu_as; |
742 | } |
743 | |
744 | static void typhoon_set_irq(void *opaque, int irq, int level) |
745 | { |
746 | TyphoonState *s = opaque; |
747 | uint64_t drir; |
748 | int i; |
749 | |
750 | /* Set/Reset the bit in CCHIP.DRIR based on IRQ+LEVEL. */ |
751 | drir = s->cchip.drir; |
752 | if (level) { |
753 | drir |= 1ull << irq; |
754 | } else { |
755 | drir &= ~(1ull << irq); |
756 | } |
757 | s->cchip.drir = drir; |
758 | |
759 | for (i = 0; i < 4; ++i) { |
760 | cpu_irq_change(s->cchip.cpu[i], s->cchip.dim[i] & drir); |
761 | } |
762 | } |
763 | |
764 | static void typhoon_set_isa_irq(void *opaque, int irq, int level) |
765 | { |
766 | typhoon_set_irq(opaque, 55, level); |
767 | } |
768 | |
769 | static void typhoon_set_timer_irq(void *opaque, int irq, int level) |
770 | { |
771 | TyphoonState *s = opaque; |
772 | int i; |
773 | |
774 | /* Thankfully, the mc146818rtc code doesn't track the IRQ state, |
775 | and so we don't have to worry about missing interrupts just |
776 | because we never actually ACK the interrupt. Just ignore any |
777 | case of the interrupt level going low. */ |
778 | if (level == 0) { |
779 | return; |
780 | } |
781 | |
782 | /* Deliver the interrupt to each CPU, considering each CPU's IIC. */ |
783 | for (i = 0; i < 4; ++i) { |
784 | AlphaCPU *cpu = s->cchip.cpu[i]; |
785 | if (cpu != NULL) { |
786 | uint32_t iic = s->cchip.iic[i]; |
787 | |
788 | /* ??? The verbage in Section 10.2.2.10 isn't 100% clear. |
789 | Bit 24 is the OverFlow bit, RO, and set when the count |
790 | decrements past 0. When is OF cleared? My guess is that |
791 | OF is actually cleared when the IIC is written, and that |
792 | the ICNT field always decrements. At least, that's an |
793 | interpretation that makes sense, and "allows the CPU to |
794 | determine exactly how mant interval timer ticks were |
795 | skipped". At least within the next 4M ticks... */ |
796 | |
797 | iic = ((iic - 1) & 0x1ffffff) | (iic & 0x1000000); |
798 | s->cchip.iic[i] = iic; |
799 | |
800 | if (iic & 0x1000000) { |
801 | /* Set the ITI bit for this cpu. */ |
802 | s->cchip.misc |= 1 << (i + 4); |
803 | /* And signal the interrupt. */ |
804 | cpu_interrupt(CPU(cpu), CPU_INTERRUPT_TIMER); |
805 | } |
806 | } |
807 | } |
808 | } |
809 | |
810 | static void typhoon_alarm_timer(void *opaque) |
811 | { |
812 | TyphoonState *s = (TyphoonState *)((uintptr_t)opaque & ~3); |
813 | int cpu = (uintptr_t)opaque & 3; |
814 | |
815 | /* Set the ITI bit for this cpu. */ |
816 | s->cchip.misc |= 1 << (cpu + 4); |
817 | cpu_interrupt(CPU(s->cchip.cpu[cpu]), CPU_INTERRUPT_TIMER); |
818 | } |
819 | |
820 | PCIBus *typhoon_init(ram_addr_t ram_size, ISABus **isa_bus, |
821 | qemu_irq *p_rtc_irq, |
822 | AlphaCPU *cpus[4], pci_map_irq_fn sys_map_irq) |
823 | { |
824 | MemoryRegion *addr_space = get_system_memory(); |
825 | DeviceState *dev; |
826 | TyphoonState *s; |
827 | PCIHostState *phb; |
828 | PCIBus *b; |
829 | int i; |
830 | |
831 | dev = qdev_create(NULL, TYPE_TYPHOON_PCI_HOST_BRIDGE); |
832 | |
833 | s = TYPHOON_PCI_HOST_BRIDGE(dev); |
834 | phb = PCI_HOST_BRIDGE(dev); |
835 | |
836 | s->cchip.misc = 0x800000000ull; /* Revision: Typhoon. */ |
837 | s->pchip.win[3].wba = 2; /* Window 3 SG always enabled. */ |
838 | |
839 | /* Remember the CPUs so that we can deliver interrupts to them. */ |
840 | for (i = 0; i < 4; i++) { |
841 | AlphaCPU *cpu = cpus[i]; |
842 | s->cchip.cpu[i] = cpu; |
843 | if (cpu != NULL) { |
844 | cpu->alarm_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, |
845 | typhoon_alarm_timer, |
846 | (void *)((uintptr_t)s + i)); |
847 | } |
848 | } |
849 | |
850 | *p_rtc_irq = qemu_allocate_irq(typhoon_set_timer_irq, s, 0); |
851 | |
852 | /* Main memory region, 0x00.0000.0000. Real hardware supports 32GB, |
853 | but the address space hole reserved at this point is 8TB. */ |
854 | memory_region_allocate_system_memory(&s->ram_region, OBJECT(s), "ram" , |
855 | ram_size); |
856 | memory_region_add_subregion(addr_space, 0, &s->ram_region); |
857 | |
858 | /* TIGbus, 0x801.0000.0000, 1GB. */ |
859 | /* ??? The TIGbus is used for delivering interrupts, and access to |
860 | the flash ROM. I'm not sure that we need to implement it at all. */ |
861 | |
862 | /* Pchip0 CSRs, 0x801.8000.0000, 256MB. */ |
863 | memory_region_init_io(&s->pchip.region, OBJECT(s), &pchip_ops, s, "pchip0" , |
864 | 256 * MiB); |
865 | memory_region_add_subregion(addr_space, 0x80180000000ULL, |
866 | &s->pchip.region); |
867 | |
868 | /* Cchip CSRs, 0x801.A000.0000, 256MB. */ |
869 | memory_region_init_io(&s->cchip.region, OBJECT(s), &cchip_ops, s, "cchip0" , |
870 | 256 * MiB); |
871 | memory_region_add_subregion(addr_space, 0x801a0000000ULL, |
872 | &s->cchip.region); |
873 | |
874 | /* Dchip CSRs, 0x801.B000.0000, 256MB. */ |
875 | memory_region_init_io(&s->dchip_region, OBJECT(s), &dchip_ops, s, "dchip0" , |
876 | 256 * MiB); |
877 | memory_region_add_subregion(addr_space, 0x801b0000000ULL, |
878 | &s->dchip_region); |
879 | |
880 | /* Pchip0 PCI memory, 0x800.0000.0000, 4GB. */ |
881 | memory_region_init(&s->pchip.reg_mem, OBJECT(s), "pci0-mem" , 4 * GiB); |
882 | memory_region_add_subregion(addr_space, 0x80000000000ULL, |
883 | &s->pchip.reg_mem); |
884 | |
885 | /* Pchip0 PCI I/O, 0x801.FC00.0000, 32MB. */ |
886 | memory_region_init_io(&s->pchip.reg_io, OBJECT(s), &alpha_pci_ignore_ops, |
887 | NULL, "pci0-io" , 32 * MiB); |
888 | memory_region_add_subregion(addr_space, 0x801fc000000ULL, |
889 | &s->pchip.reg_io); |
890 | |
891 | b = pci_register_root_bus(dev, "pci" , |
892 | typhoon_set_irq, sys_map_irq, s, |
893 | &s->pchip.reg_mem, &s->pchip.reg_io, |
894 | 0, 64, TYPE_PCI_BUS); |
895 | phb->bus = b; |
896 | qdev_init_nofail(dev); |
897 | |
898 | /* Host memory as seen from the PCI side, via the IOMMU. */ |
899 | memory_region_init_iommu(&s->pchip.iommu, sizeof(s->pchip.iommu), |
900 | TYPE_TYPHOON_IOMMU_MEMORY_REGION, OBJECT(s), |
901 | "iommu-typhoon" , UINT64_MAX); |
902 | address_space_init(&s->pchip.iommu_as, MEMORY_REGION(&s->pchip.iommu), |
903 | "pchip0-pci" ); |
904 | pci_setup_iommu(b, typhoon_pci_dma_iommu, s); |
905 | |
906 | /* Pchip0 PCI special/interrupt acknowledge, 0x801.F800.0000, 64MB. */ |
907 | memory_region_init_io(&s->pchip.reg_iack, OBJECT(s), &alpha_pci_iack_ops, |
908 | b, "pci0-iack" , 64 * MiB); |
909 | memory_region_add_subregion(addr_space, 0x801f8000000ULL, |
910 | &s->pchip.reg_iack); |
911 | |
912 | /* Pchip0 PCI configuration, 0x801.FE00.0000, 16MB. */ |
913 | memory_region_init_io(&s->pchip.reg_conf, OBJECT(s), &alpha_pci_conf1_ops, |
914 | b, "pci0-conf" , 16 * MiB); |
915 | memory_region_add_subregion(addr_space, 0x801fe000000ULL, |
916 | &s->pchip.reg_conf); |
917 | |
918 | /* For the record, these are the mappings for the second PCI bus. |
919 | We can get away with not implementing them because we indicate |
920 | via the Cchip.CSC<PIP> bit that Pchip1 is not present. */ |
921 | /* Pchip1 PCI memory, 0x802.0000.0000, 4GB. */ |
922 | /* Pchip1 CSRs, 0x802.8000.0000, 256MB. */ |
923 | /* Pchip1 PCI special/interrupt acknowledge, 0x802.F800.0000, 64MB. */ |
924 | /* Pchip1 PCI I/O, 0x802.FC00.0000, 32MB. */ |
925 | /* Pchip1 PCI configuration, 0x802.FE00.0000, 16MB. */ |
926 | |
927 | /* Init the ISA bus. */ |
928 | /* ??? Technically there should be a cy82c693ub pci-isa bridge. */ |
929 | { |
930 | qemu_irq *isa_irqs; |
931 | |
932 | *isa_bus = isa_bus_new(NULL, get_system_memory(), &s->pchip.reg_io, |
933 | &error_abort); |
934 | isa_irqs = i8259_init(*isa_bus, |
935 | qemu_allocate_irq(typhoon_set_isa_irq, s, 0)); |
936 | isa_bus_irqs(*isa_bus, isa_irqs); |
937 | } |
938 | |
939 | return b; |
940 | } |
941 | |
942 | static const TypeInfo typhoon_pcihost_info = { |
943 | .name = TYPE_TYPHOON_PCI_HOST_BRIDGE, |
944 | .parent = TYPE_PCI_HOST_BRIDGE, |
945 | .instance_size = sizeof(TyphoonState), |
946 | }; |
947 | |
948 | static void typhoon_iommu_memory_region_class_init(ObjectClass *klass, |
949 | void *data) |
950 | { |
951 | IOMMUMemoryRegionClass *imrc = IOMMU_MEMORY_REGION_CLASS(klass); |
952 | |
953 | imrc->translate = typhoon_translate_iommu; |
954 | } |
955 | |
956 | static const TypeInfo typhoon_iommu_memory_region_info = { |
957 | .parent = TYPE_IOMMU_MEMORY_REGION, |
958 | .name = TYPE_TYPHOON_IOMMU_MEMORY_REGION, |
959 | .class_init = typhoon_iommu_memory_region_class_init, |
960 | }; |
961 | |
962 | static void typhoon_register_types(void) |
963 | { |
964 | type_register_static(&typhoon_pcihost_info); |
965 | type_register_static(&typhoon_iommu_memory_region_info); |
966 | } |
967 | |
968 | type_init(typhoon_register_types) |
969 | |