dex: hw/mips.h =================================================================== --- hw/mips.h (revision 5499) +++ hw/mips.h (working copy) @@ -27,6 +27,8 @@ extern void cpu_mips_clock_init(CPUState *); /* rc4030.c */ -qemu_irq *rc4030_init(qemu_irq timer, qemu_irq jazz_bus); +typedef void (*dma_function)(void *opaque, int channel, uint8_t *buf, int len, int is_write); +qemu_irq *rc4030_init(qemu_irq timer, qemu_irq jazz_bus, void **dma_opaque, + dma_function *dma_func); #endif Index: hw/mips_jazz.c =================================================================== --- hw/mips_jazz.c (revision 5499) +++ hw/mips_jazz.c (working copy) @@ -1,7 +1,7 @@ /* * QEMU MIPS Jazz support * - * Copyright (c) 2007-2008 Hervé Poussineau + * Copyright (c) 2007-2008 Herve Poussineau * * Permission is hereby granted, free of charge, to any person obtaining a copy * of this software and associated documentation files (the "Software"), to deal @@ -45,6 +45,13 @@ JAZZ_PICA61, }; +typedef struct jazzState +{ + /* DMA */ + void *dma_opaque; + dma_function dma_func; +} jazzState; + static void main_cpu_reset(void *opaque) { CPUState *env = opaque; @@ -102,14 +109,17 @@ } #endif +#define JAZZ_SCSI_DMA 0 void espdma_memory_read(void *opaque, uint8_t *buf, int len) { - printf("espdma_memory_read(buf %p, len %d) not implemented\n", buf, len); + jazzState *s = opaque; + (*s->dma_func)(s->dma_opaque, JAZZ_SCSI_DMA, buf, len, 0); } void espdma_memory_write(void *opaque, uint8_t *buf, int len) { - printf("espdma_memory_write(buf %p, len %d) not implemented\n", buf, len); + jazzState *s = opaque; + (*s->dma_func)(s->dma_opaque, JAZZ_SCSI_DMA, buf, len, 1); } #define MAGNUM_BIOS_SIZE_MAX 0x7e000 @@ -131,7 +141,13 @@ PITState *pit; BlockDriverState *fds[MAX_FD]; qemu_irq esp_reset; + jazzState *s; + /* allocate state */ + s = qemu_mallocz(sizeof(jazzState)); + if (!s) + return; + /* init CPUs */ if (cpu_model == NULL) { #ifdef TARGET_MIPS64 @@ -153,7 +169,9 @@ /* load the BIOS image. */ bios_offset = ram_size + vga_ram_size; - snprintf(buf, sizeof(buf), "%s/%s", bios_dir, BIOS_FILENAME); + if (bios_name == NULL) + bios_name = BIOS_FILENAME; + snprintf(buf, sizeof(buf), "%s/%s", bios_dir, bios_name); bios_size = load_image(buf, phys_ram_base + bios_offset); if (bios_size < 0 || bios_size > MAGNUM_BIOS_SIZE) { fprintf(stderr, "qemu: Could not load MIPS bios '%s'\n", @@ -171,7 +189,8 @@ cpu_mips_clock_init(env); /* Chipset */ - rc4030 = rc4030_init(env->irq[6], env->irq[3]); + rc4030 = rc4030_init(env->irq[6], env->irq[3], + &s->dma_opaque, &s->dma_func); /* ISA devices */ i8259 = i8259_init(env->irq[4]); @@ -200,7 +219,7 @@ /* SCSI adapter */ scsi_hba = esp_init(0x80002000, 0, - espdma_memory_read, espdma_memory_write, NULL, + espdma_memory_read, espdma_memory_write, s, rc4030[5], &esp_reset); for (n = 0; n < ESP_MAX_DEVS; n++) { hd = drive_get_index(IF_SCSI, 0, n); @@ -278,6 +297,7 @@ .init = mips_magnum_init, .ram_require = MAGNUM_BIOS_SIZE + VGA_RAM_SIZE, .nodisk_ok = 1, + .use_scsi = 1, .max_cpus = 1, }; @@ -287,5 +307,6 @@ .init = mips_pica61_init, .ram_require = MAGNUM_BIOS_SIZE + VGA_RAM_SIZE, .nodisk_ok = 1, + .use_scsi = 1, .max_cpus = 1, }; Index: hw/rc4030.c =================================================================== --- hw/rc4030.c (revision 5499) +++ hw/rc4030.c (working copy) @@ -1,7 +1,7 @@ /* * QEMU JAZZ RC4030 chipset * - * Copyright (c) 2007-2008 Hervé Poussineau + * Copyright (c) 2007-2008 Herve Poussineau * * Permission is hereby granted, free of charge, to any person obtaining a copy * of this software and associated documentation files (the "Software"), to deal @@ -23,15 +23,43 @@ */ #include "hw.h" +#include "mips.h" #include "qemu-timer.h" +/********************************************************/ +/* debug rc4030 */ + //#define DEBUG_RC4030 +//#define DEBUG_RC4030_DMA #ifdef DEBUG_RC4030 +#define DPRINTF(fmt, args...) \ +do { printf("rc4030: " fmt , ##args); } while (0) static const char* irq_names[] = { "parallel", "floppy", "sound", "video", "network", "scsi", "keyboard", "mouse", "serial0", "serial1" }; +#else +#define DPRINTF(fmt, args...) #endif +#define RC4030_ERROR(fmt, args...) \ +do { printf("rc4030 ERROR: %s: " fmt, __func__ , ##args); } while (0) + +/********************************************************/ +/* rc4030 emulation */ + +typedef struct dma_pagetable_entry { + int32_t frame; + int32_t owner; +} __attribute__((packed)) dma_pagetable_entry; + +#define DMA_PAGESIZE 4096 +#define DMA_REG_ENABLE 1 +#define DMA_REG_COUNT 2 +#define DMA_REG_ADDRESS 3 + +#define DMA_FLAG_ENABLE 0x1 +#define DMA_FLAG_MEM_TO_DEV 0x2 + typedef struct rc4030State { uint32_t config; /* 0x0000: RC4030 config register */ @@ -39,8 +67,10 @@ /* DMA */ uint32_t dma_regs[8][4]; - uint32_t dma_tl_base; /* 0x0018: DMA transl. table base */ + target_phys_addr_t dma_tl_base; /* 0x0018: DMA transl. table base */ uint32_t dma_tl_limit; /* 0x0020: DMA transl. table limit */ + dma_pagetable_entry *dma_table; + uint32_t dma_table_count; /* cache */ uint32_t remote_failed_address; /* 0x0038: Remote Failed Address */ @@ -50,7 +80,6 @@ uint32_t cache_bmask; /* 0x0058: I/O Cache Byte Mask */ uint32_t cache_bwin; /* 0x0060: I/O Cache Buffer Window */ - uint32_t offset208; uint32_t offset210; uint32_t nvram_protect; /* 0x0220: NV ram protect register */ uint32_t offset238; @@ -62,11 +91,33 @@ QEMUTimer *periodic_timer; uint32_t itr; /* Interval timer reload */ - uint32_t dummy32; qemu_irq timer_irq; qemu_irq jazz_bus_irq; } rc4030State; +static void reload_dma_table(rc4030State *s) +{ + /* DMA transl. table is in memory at virtual address + * dma_tl_base, and is dma_tl_limit bytes long */ + + target_phys_addr_t addr = s->dma_tl_base; + +#ifdef DEBUG_RC4030_DMA + printf("rc4030 dma: Reading DMA table at " TARGET_FMT_lx ", size is %u bytes\n", + s->dma_tl_base, s->dma_tl_limit); +#endif + + if (s->dma_table) + qemu_free(s->dma_table); + + s->dma_table = qemu_malloc(s->dma_tl_limit); + if (!s->dma_table) + return; + s->dma_table_count = s->dma_tl_limit / sizeof(dma_pagetable_entry); + + cpu_memory_rw_debug(cpu_single_env, addr, (uint8_t *)s->dma_table, s->dma_tl_limit, 0); +} + static void set_next_tick(rc4030State *s) { qemu_irq_lower(s->timer_irq); @@ -164,7 +215,7 @@ case 0x01d0: case 0x01d8: case 0x01e0: - case 0x1e8: + case 0x01e8: case 0x01f0: case 0x01f8: { @@ -175,7 +226,7 @@ break; /* Offset 0x0208 */ case 0x0208: - val = s->offset208; + val = 0; break; /* Offset 0x0210 */ case 0x0210: @@ -187,7 +238,7 @@ break; /* Interval timer count */ case 0x0230: - val = s->dummy32; + val = 0; qemu_irq_lower(s->timer_irq); break; /* Offset 0x0238 */ @@ -195,17 +246,13 @@ val = s->offset238; break; default: -#ifdef DEBUG_RC4030 - printf("rc4030: invalid read [" TARGET_FMT_lx "]\n", addr); -#endif + RC4030_ERROR("invalid read [" TARGET_FMT_lx "]\n", addr); val = 0; break; } -#ifdef DEBUG_RC4030 if ((addr & ~3) != 0x230) - printf("rc4030: read 0x%02x at " TARGET_FMT_lx "\n", val, addr); -#endif + DPRINTF("read 0x%02x at " TARGET_FMT_lx "\n", val, addr); return val; } @@ -230,9 +277,7 @@ rc4030State *s = opaque; addr &= 0x3fff; -#ifdef DEBUG_RC4030 - printf("rc4030: write 0x%02x at " TARGET_FMT_lx "\n", val, addr); -#endif + DPRINTF("write 0x%02x at " TARGET_FMT_lx "\n", val, addr); switch (addr & ~0x3) { /* Global config register */ @@ -241,12 +286,20 @@ break; /* DMA transl. table base */ case 0x0018: - s->dma_tl_base = val; + s->dma_tl_base = (int32_t)val; break; /* DMA transl. table limit */ case 0x0020: s->dma_tl_limit = val; break; + /* DMA transl. table invalidated */ + case 0x0028: + reload_dma_table(s); + break; + /* Cache Maintenance */ + case 0x0030: + RC4030_ERROR("Cache maintenance not handled yet (val 0x%02x)\n", val); + break; /* I/O Cache Physical Tag */ case 0x0048: s->cache_ptag = val; @@ -321,7 +374,7 @@ case 0x01d0: case 0x01d8: case 0x01e0: - case 0x1e8: + case 0x01e8: case 0x01f0: case 0x01f8: { @@ -341,9 +394,7 @@ set_next_tick(s); break; default: -#ifdef DEBUG_RC4030 - printf("rc4030: invalid write of 0x%02x at [" TARGET_FMT_lx "]\n", val, addr); -#endif + RC4030_ERROR("invalid write of 0x%02x at [" TARGET_FMT_lx "]\n", val, addr); break; } } @@ -401,7 +452,7 @@ #ifdef DEBUG_RC4030 if (s->isr_jazz != 0) { uint32_t irq = 0; - printf("jazz pending:"); + DPRINTF("pending irqs:"); for (irq = 0; irq < sizeof(irq_names)/sizeof(irq_names[0]); irq++) { if (s->isr_jazz & (1 << irq)) { printf(" %s", irq_names[irq]); @@ -441,7 +492,7 @@ qemu_irq_raise(s->timer_irq); } -static uint32_t int_readb(void *opaque, target_phys_addr_t addr) +static uint32_t jazzio_readw(void *opaque, target_phys_addr_t addr) { rc4030State *s = opaque; uint32_t val; @@ -449,14 +500,14 @@ addr &= 0xfff; switch (addr) { + /* Local bus int source */ case 0x00: { - /* Local bus int source */ uint32_t pending = s->isr_jazz & s->imr_jazz; val = 0; irq = 0; while (pending) { if (pending & 1) { - //printf("returning irq %s\n", irq_names[irq]); + DPRINTF("returning irq %s\n", irq_names[irq]); val = (irq + 1) << 2; break; } @@ -465,100 +516,93 @@ } break; } + /* Local bus int enable mask */ + case 0x02: + val = s->imr_jazz; + break; default: -#ifdef DEBUG_RC4030 - printf("rc4030: (interrupt controller) invalid read [" TARGET_FMT_lx "]\n", addr); -#endif - val = 0; + RC4030_ERROR("(jazz io controller) invalid read [" TARGET_FMT_lx "]\n", addr); + val = 0; } -#ifdef DEBUG_RC4030 - printf("rc4030: (interrupt controller) read 0x%02x at " TARGET_FMT_lx "\n", val, addr); -#endif + DPRINTF("(jazz io controller) read 0x%04x at " TARGET_FMT_lx "\n", val, addr); return val; } -static uint32_t int_readw(void *opaque, target_phys_addr_t addr) +static uint32_t jazzio_readb(void *opaque, target_phys_addr_t addr) { uint32_t v; - v = int_readb(opaque, addr); - v |= int_readb(opaque, addr + 1) << 8; - return v; + v = jazzio_readw(opaque, addr & ~0x1); + return (v >> (8 * (addr & 0x1))) & 0xff; } -static uint32_t int_readl(void *opaque, target_phys_addr_t addr) +static uint32_t jazzio_readl(void *opaque, target_phys_addr_t addr) { uint32_t v; - v = int_readb(opaque, addr); - v |= int_readb(opaque, addr + 1) << 8; - v |= int_readb(opaque, addr + 2) << 16; - v |= int_readb(opaque, addr + 3) << 24; + v = jazzio_readw(opaque, addr); + v |= jazzio_readw(opaque, addr + 2) << 16; return v; } -static void int_writeb(void *opaque, target_phys_addr_t addr, uint32_t val) +static void jazzio_writew(void *opaque, target_phys_addr_t addr, uint32_t val) { rc4030State *s = opaque; addr &= 0xfff; -#ifdef DEBUG_RC4030 - printf("rc4030: (interrupt controller) write 0x%02x at " TARGET_FMT_lx "\n", val, addr); -#endif + DPRINTF("(jazz io controller) write 0x%04x at " TARGET_FMT_lx "\n", val, addr); switch (addr) { /* Local bus int enable mask */ case 0x02: - s->imr_jazz = (s->imr_jazz & 0xff00) | (val << 0); update_jazz_irq(s); + s->imr_jazz = val; + update_jazz_irq(s); break; - case 0x03: - s->imr_jazz = (s->imr_jazz & 0x00ff) | (val << 8); update_jazz_irq(s); - break; default: -#ifdef DEBUG_RC4030 - printf("rc4030: (interrupt controller) invalid write of 0x%02x at [" TARGET_FMT_lx "]\n", val, addr); -#endif + RC4030_ERROR("(jazz io controller) invalid write of 0x%04x at [" TARGET_FMT_lx "]\n", val, addr); break; } } -static void int_writew(void *opaque, target_phys_addr_t addr, uint32_t val) +static void jazzio_writeb(void *opaque, target_phys_addr_t addr, uint32_t val) { - int_writeb(opaque, addr, val & 0xff); - int_writeb(opaque, addr + 1, (val >> 8) & 0xff); + uint32_t old_val = jazzio_readw(opaque, addr & ~0x1); + + switch (addr & 1) { + case 0: + val = val | (old_val & 0xff00); + break; + case 1: + val = (val << 8) | (old_val & 0x00ff); + break; + } + jazzio_writew(opaque, addr & ~0x1, val); } -static void int_writel(void *opaque, target_phys_addr_t addr, uint32_t val) +static void jazzio_writel(void *opaque, target_phys_addr_t addr, uint32_t val) { - int_writeb(opaque, addr, val & 0xff); - int_writeb(opaque, addr + 1, (val >> 8) & 0xff); - int_writeb(opaque, addr + 2, (val >> 16) & 0xff); - int_writeb(opaque, addr + 3, (val >> 24) & 0xff); + jazzio_writew(opaque, addr, val & 0xffff); + jazzio_writew(opaque, addr + 2, (val >> 16) & 0xffff); } -static CPUReadMemoryFunc *int_read[3] = { - int_readb, - int_readw, - int_readl, +static CPUReadMemoryFunc *jazzio_read[3] = { + jazzio_readb, + jazzio_readw, + jazzio_readl, }; -static CPUWriteMemoryFunc *int_write[3] = { - int_writeb, - int_writew, - int_writel, +static CPUWriteMemoryFunc *jazzio_write[3] = { + jazzio_writeb, + jazzio_writew, + jazzio_writel, }; -#define G364_512KB_RAM (0x0) -#define G364_2MB_RAM (0x1) -#define G364_8MB_RAM (0x2) -#define G364_32MB_RAM (0x3) - static void rc4030_reset(void *opaque) { rc4030State *s = opaque; int i; - s->config = (G364_2MB_RAM << 8) | 0x04; + s->config = 0x104; s->invalid_address_register = 0; memset(s->dma_regs, 0, sizeof(s->dma_regs)); @@ -568,7 +612,6 @@ s->cache_ptag = s->cache_ltag = 0; s->cache_bmask = s->cache_bwin = 0; - s->offset208 = 0; s->offset210 = 0x18186; s->nvram_protect = 7; s->offset238 = 7; @@ -577,21 +620,66 @@ s->imr_jazz = s->isr_jazz = 0; s->itr = 0; - s->dummy32 = 0; qemu_irq_lower(s->timer_irq); qemu_irq_lower(s->jazz_bus_irq); } -qemu_irq *rc4030_init(qemu_irq timer, qemu_irq jazz_bus) +static void rc4030_memory_dma_rw(void *opaque, int channel, uint8_t *buf, int len, int is_write) { + rc4030State *s = opaque; + target_phys_addr_t addr; + dma_pagetable_entry *entry; + int index; + + /* XXX: return errors to the caller? */ + + /* Check DMA channel consistency */ + if (!(s->dma_regs[channel][DMA_REG_ENABLE] & DMA_FLAG_ENABLE)) return; + if (is_write && (s->dma_regs[channel][DMA_REG_ENABLE] & DMA_FLAG_MEM_TO_DEV)) return; + if (!is_write && !(s->dma_regs[channel][DMA_REG_ENABLE] & DMA_FLAG_MEM_TO_DEV)) return; + if (len > s->dma_regs[channel][DMA_REG_COUNT]) len = s->dma_regs[channel][DMA_REG_COUNT]; + + /* Get DMA translation table entry */ + if (!s->dma_table) return; + index = s->dma_regs[channel][DMA_REG_ADDRESS] / DMA_PAGESIZE; + if (index > s->dma_table_count) return; + entry = &s->dma_table[index]; + + /* Read/write data at right place */ + addr = entry->frame + (s->dma_regs[channel][DMA_REG_ADDRESS] & (DMA_PAGESIZE - 1)); + cpu_physical_memory_rw(addr, buf, len, is_write); + s->dma_regs[channel][DMA_REG_COUNT] -= len; + +#ifdef DEBUG_RC4030_DMA + { + int i; + if (is_write) + printf("rc4030 dma: Copying %d bytes from host %p to guest " TARGET_FMT_lx "\n", + len, buf, addr); + else + printf("rc4030 dma: Copying %d bytes from guest " TARGET_FMT_lx " to host %p\n", + len, addr, buf); + for (i = 0; i < len; i++) + printf("%c", isprint(buf[i]) ? buf[i] : '.'); + printf("\n"); + } +#endif +} + +qemu_irq *rc4030_init(qemu_irq timer, qemu_irq jazz_bus, void **dma_opaque, + dma_function *dma_func) +{ rc4030State *s; - int s_chipset, s_int; + int s_chipset, s_jazzio; s = qemu_mallocz(sizeof(rc4030State)); if (!s) return NULL; + *dma_opaque = s; + *dma_func = rc4030_memory_dma_rw; + s->periodic_timer = qemu_new_timer(vm_clock, rc4030_periodic_timer, s); s->timer_irq = timer; s->jazz_bus_irq = jazz_bus; @@ -601,8 +689,8 @@ s_chipset = cpu_register_io_memory(0, rc4030_read, rc4030_write, s); cpu_register_physical_memory(0x80000000, 0x300, s_chipset); - s_int = cpu_register_io_memory(0, int_read, int_write, s); - cpu_register_physical_memory(0xf0000000, 0x00001000, s_int); + s_jazzio = cpu_register_io_memory(0, jazzio_read, jazzio_write, s); + cpu_register_physical_memory(0xf0000000, 0x00001000, s_jazzio); return qemu_allocate_irqs(rc4030_irq_jazz_request, s, 16); }