lsi: Fix value overflow in request tag processing
[qemu/mdroth.git] / hw / integratorcp.c
blobbee82988b4e064e009b068a38eece3ca7793e54a
1 /*
2 * ARM Integrator CP System emulation.
4 * Copyright (c) 2005-2007 CodeSourcery.
5 * Written by Paul Brook
7 * This code is licenced under the GPL
8 */
10 #include "sysbus.h"
11 #include "primecell.h"
12 #include "devices.h"
13 #include "sysemu.h"
14 #include "boards.h"
15 #include "arm-misc.h"
16 #include "net.h"
18 typedef struct {
19 SysBusDevice busdev;
20 uint32_t memsz;
21 uint32_t flash_offset;
22 uint32_t cm_osc;
23 uint32_t cm_ctrl;
24 uint32_t cm_lock;
25 uint32_t cm_auxosc;
26 uint32_t cm_sdram;
27 uint32_t cm_init;
28 uint32_t cm_flags;
29 uint32_t cm_nvflags;
30 uint32_t int_level;
31 uint32_t irq_enabled;
32 uint32_t fiq_enabled;
33 } integratorcm_state;
35 static uint8_t integrator_spd[128] = {
36 128, 8, 4, 11, 9, 1, 64, 0, 2, 0xa0, 0xa0, 0, 0, 8, 0, 1,
37 0xe, 4, 0x1c, 1, 2, 0x20, 0xc0, 0, 0, 0, 0, 0x30, 0x28, 0x30, 0x28, 0x40
40 static uint32_t integratorcm_read(void *opaque, target_phys_addr_t offset)
42 integratorcm_state *s = (integratorcm_state *)opaque;
43 if (offset >= 0x100 && offset < 0x200) {
44 /* CM_SPD */
45 if (offset >= 0x180)
46 return 0;
47 return integrator_spd[offset >> 2];
49 switch (offset >> 2) {
50 case 0: /* CM_ID */
51 return 0x411a3001;
52 case 1: /* CM_PROC */
53 return 0;
54 case 2: /* CM_OSC */
55 return s->cm_osc;
56 case 3: /* CM_CTRL */
57 return s->cm_ctrl;
58 case 4: /* CM_STAT */
59 return 0x00100000;
60 case 5: /* CM_LOCK */
61 if (s->cm_lock == 0xa05f) {
62 return 0x1a05f;
63 } else {
64 return s->cm_lock;
66 case 6: /* CM_LMBUSCNT */
67 /* ??? High frequency timer. */
68 hw_error("integratorcm_read: CM_LMBUSCNT");
69 case 7: /* CM_AUXOSC */
70 return s->cm_auxosc;
71 case 8: /* CM_SDRAM */
72 return s->cm_sdram;
73 case 9: /* CM_INIT */
74 return s->cm_init;
75 case 10: /* CM_REFCT */
76 /* ??? High frequency timer. */
77 hw_error("integratorcm_read: CM_REFCT");
78 case 12: /* CM_FLAGS */
79 return s->cm_flags;
80 case 14: /* CM_NVFLAGS */
81 return s->cm_nvflags;
82 case 16: /* CM_IRQ_STAT */
83 return s->int_level & s->irq_enabled;
84 case 17: /* CM_IRQ_RSTAT */
85 return s->int_level;
86 case 18: /* CM_IRQ_ENSET */
87 return s->irq_enabled;
88 case 20: /* CM_SOFT_INTSET */
89 return s->int_level & 1;
90 case 24: /* CM_FIQ_STAT */
91 return s->int_level & s->fiq_enabled;
92 case 25: /* CM_FIQ_RSTAT */
93 return s->int_level;
94 case 26: /* CM_FIQ_ENSET */
95 return s->fiq_enabled;
96 case 32: /* CM_VOLTAGE_CTL0 */
97 case 33: /* CM_VOLTAGE_CTL1 */
98 case 34: /* CM_VOLTAGE_CTL2 */
99 case 35: /* CM_VOLTAGE_CTL3 */
100 /* ??? Voltage control unimplemented. */
101 return 0;
102 default:
103 hw_error("integratorcm_read: Unimplemented offset 0x%x\n",
104 (int)offset);
105 return 0;
109 static void integratorcm_do_remap(integratorcm_state *s, int flash)
111 if (flash) {
112 cpu_register_physical_memory(0, 0x100000, IO_MEM_RAM);
113 } else {
114 cpu_register_physical_memory(0, 0x100000, s->flash_offset | IO_MEM_RAM);
116 //??? tlb_flush (cpu_single_env, 1);
119 static void integratorcm_set_ctrl(integratorcm_state *s, uint32_t value)
121 if (value & 8) {
122 hw_error("Board reset\n");
124 if ((s->cm_init ^ value) & 4) {
125 integratorcm_do_remap(s, (value & 4) == 0);
127 if ((s->cm_init ^ value) & 1) {
128 printf("Green LED %s\n", (value & 1) ? "on" : "off");
130 s->cm_init = (s->cm_init & ~ 5) | (value ^ 5);
133 static void integratorcm_update(integratorcm_state *s)
135 /* ??? The CPU irq/fiq is raised when either the core module or base PIC
136 are active. */
137 if (s->int_level & (s->irq_enabled | s->fiq_enabled))
138 hw_error("Core module interrupt\n");
141 static void integratorcm_write(void *opaque, target_phys_addr_t offset,
142 uint32_t value)
144 integratorcm_state *s = (integratorcm_state *)opaque;
145 switch (offset >> 2) {
146 case 2: /* CM_OSC */
147 if (s->cm_lock == 0xa05f)
148 s->cm_osc = value;
149 break;
150 case 3: /* CM_CTRL */
151 integratorcm_set_ctrl(s, value);
152 break;
153 case 5: /* CM_LOCK */
154 s->cm_lock = value & 0xffff;
155 break;
156 case 7: /* CM_AUXOSC */
157 if (s->cm_lock == 0xa05f)
158 s->cm_auxosc = value;
159 break;
160 case 8: /* CM_SDRAM */
161 s->cm_sdram = value;
162 break;
163 case 9: /* CM_INIT */
164 /* ??? This can change the memory bus frequency. */
165 s->cm_init = value;
166 break;
167 case 12: /* CM_FLAGSS */
168 s->cm_flags |= value;
169 break;
170 case 13: /* CM_FLAGSC */
171 s->cm_flags &= ~value;
172 break;
173 case 14: /* CM_NVFLAGSS */
174 s->cm_nvflags |= value;
175 break;
176 case 15: /* CM_NVFLAGSS */
177 s->cm_nvflags &= ~value;
178 break;
179 case 18: /* CM_IRQ_ENSET */
180 s->irq_enabled |= value;
181 integratorcm_update(s);
182 break;
183 case 19: /* CM_IRQ_ENCLR */
184 s->irq_enabled &= ~value;
185 integratorcm_update(s);
186 break;
187 case 20: /* CM_SOFT_INTSET */
188 s->int_level |= (value & 1);
189 integratorcm_update(s);
190 break;
191 case 21: /* CM_SOFT_INTCLR */
192 s->int_level &= ~(value & 1);
193 integratorcm_update(s);
194 break;
195 case 26: /* CM_FIQ_ENSET */
196 s->fiq_enabled |= value;
197 integratorcm_update(s);
198 break;
199 case 27: /* CM_FIQ_ENCLR */
200 s->fiq_enabled &= ~value;
201 integratorcm_update(s);
202 break;
203 case 32: /* CM_VOLTAGE_CTL0 */
204 case 33: /* CM_VOLTAGE_CTL1 */
205 case 34: /* CM_VOLTAGE_CTL2 */
206 case 35: /* CM_VOLTAGE_CTL3 */
207 /* ??? Voltage control unimplemented. */
208 break;
209 default:
210 hw_error("integratorcm_write: Unimplemented offset 0x%x\n",
211 (int)offset);
212 break;
216 /* Integrator/CM control registers. */
218 static CPUReadMemoryFunc * const integratorcm_readfn[] = {
219 integratorcm_read,
220 integratorcm_read,
221 integratorcm_read
224 static CPUWriteMemoryFunc * const integratorcm_writefn[] = {
225 integratorcm_write,
226 integratorcm_write,
227 integratorcm_write
230 static int integratorcm_init(SysBusDevice *dev)
232 int iomemtype;
233 integratorcm_state *s = FROM_SYSBUS(integratorcm_state, dev);
235 s->cm_osc = 0x01000048;
236 /* ??? What should the high bits of this value be? */
237 s->cm_auxosc = 0x0007feff;
238 s->cm_sdram = 0x00011122;
239 if (s->memsz >= 256) {
240 integrator_spd[31] = 64;
241 s->cm_sdram |= 0x10;
242 } else if (s->memsz >= 128) {
243 integrator_spd[31] = 32;
244 s->cm_sdram |= 0x0c;
245 } else if (s->memsz >= 64) {
246 integrator_spd[31] = 16;
247 s->cm_sdram |= 0x08;
248 } else if (s->memsz >= 32) {
249 integrator_spd[31] = 4;
250 s->cm_sdram |= 0x04;
251 } else {
252 integrator_spd[31] = 2;
254 memcpy(integrator_spd + 73, "QEMU-MEMORY", 11);
255 s->cm_init = 0x00000112;
256 s->flash_offset = qemu_ram_alloc(0x100000);
258 iomemtype = cpu_register_io_memory(integratorcm_readfn,
259 integratorcm_writefn, s);
260 sysbus_init_mmio(dev, 0x00800000, iomemtype);
261 integratorcm_do_remap(s, 1);
262 /* ??? Save/restore. */
263 return 0;
266 /* Integrator/CP hardware emulation. */
267 /* Primary interrupt controller. */
269 typedef struct icp_pic_state
271 SysBusDevice busdev;
272 uint32_t level;
273 uint32_t irq_enabled;
274 uint32_t fiq_enabled;
275 qemu_irq parent_irq;
276 qemu_irq parent_fiq;
277 } icp_pic_state;
279 static void icp_pic_update(icp_pic_state *s)
281 uint32_t flags;
283 flags = (s->level & s->irq_enabled);
284 qemu_set_irq(s->parent_irq, flags != 0);
285 flags = (s->level & s->fiq_enabled);
286 qemu_set_irq(s->parent_fiq, flags != 0);
289 static void icp_pic_set_irq(void *opaque, int irq, int level)
291 icp_pic_state *s = (icp_pic_state *)opaque;
292 if (level)
293 s->level |= 1 << irq;
294 else
295 s->level &= ~(1 << irq);
296 icp_pic_update(s);
299 static uint32_t icp_pic_read(void *opaque, target_phys_addr_t offset)
301 icp_pic_state *s = (icp_pic_state *)opaque;
303 switch (offset >> 2) {
304 case 0: /* IRQ_STATUS */
305 return s->level & s->irq_enabled;
306 case 1: /* IRQ_RAWSTAT */
307 return s->level;
308 case 2: /* IRQ_ENABLESET */
309 return s->irq_enabled;
310 case 4: /* INT_SOFTSET */
311 return s->level & 1;
312 case 8: /* FRQ_STATUS */
313 return s->level & s->fiq_enabled;
314 case 9: /* FRQ_RAWSTAT */
315 return s->level;
316 case 10: /* FRQ_ENABLESET */
317 return s->fiq_enabled;
318 case 3: /* IRQ_ENABLECLR */
319 case 5: /* INT_SOFTCLR */
320 case 11: /* FRQ_ENABLECLR */
321 default:
322 printf ("icp_pic_read: Bad register offset 0x%x\n", (int)offset);
323 return 0;
327 static void icp_pic_write(void *opaque, target_phys_addr_t offset,
328 uint32_t value)
330 icp_pic_state *s = (icp_pic_state *)opaque;
332 switch (offset >> 2) {
333 case 2: /* IRQ_ENABLESET */
334 s->irq_enabled |= value;
335 break;
336 case 3: /* IRQ_ENABLECLR */
337 s->irq_enabled &= ~value;
338 break;
339 case 4: /* INT_SOFTSET */
340 if (value & 1)
341 icp_pic_set_irq(s, 0, 1);
342 break;
343 case 5: /* INT_SOFTCLR */
344 if (value & 1)
345 icp_pic_set_irq(s, 0, 0);
346 break;
347 case 10: /* FRQ_ENABLESET */
348 s->fiq_enabled |= value;
349 break;
350 case 11: /* FRQ_ENABLECLR */
351 s->fiq_enabled &= ~value;
352 break;
353 case 0: /* IRQ_STATUS */
354 case 1: /* IRQ_RAWSTAT */
355 case 8: /* FRQ_STATUS */
356 case 9: /* FRQ_RAWSTAT */
357 default:
358 printf ("icp_pic_write: Bad register offset 0x%x\n", (int)offset);
359 return;
361 icp_pic_update(s);
364 static CPUReadMemoryFunc * const icp_pic_readfn[] = {
365 icp_pic_read,
366 icp_pic_read,
367 icp_pic_read
370 static CPUWriteMemoryFunc * const icp_pic_writefn[] = {
371 icp_pic_write,
372 icp_pic_write,
373 icp_pic_write
376 static int icp_pic_init(SysBusDevice *dev)
378 icp_pic_state *s = FROM_SYSBUS(icp_pic_state, dev);
379 int iomemtype;
381 qdev_init_gpio_in(&dev->qdev, icp_pic_set_irq, 32);
382 sysbus_init_irq(dev, &s->parent_irq);
383 sysbus_init_irq(dev, &s->parent_fiq);
384 iomemtype = cpu_register_io_memory(icp_pic_readfn,
385 icp_pic_writefn, s);
386 sysbus_init_mmio(dev, 0x00800000, iomemtype);
387 return 0;
390 /* CP control registers. */
391 static uint32_t icp_control_read(void *opaque, target_phys_addr_t offset)
393 switch (offset >> 2) {
394 case 0: /* CP_IDFIELD */
395 return 0x41034003;
396 case 1: /* CP_FLASHPROG */
397 return 0;
398 case 2: /* CP_INTREG */
399 return 0;
400 case 3: /* CP_DECODE */
401 return 0x11;
402 default:
403 hw_error("icp_control_read: Bad offset %x\n", (int)offset);
404 return 0;
408 static void icp_control_write(void *opaque, target_phys_addr_t offset,
409 uint32_t value)
411 switch (offset >> 2) {
412 case 1: /* CP_FLASHPROG */
413 case 2: /* CP_INTREG */
414 case 3: /* CP_DECODE */
415 /* Nothing interesting implemented yet. */
416 break;
417 default:
418 hw_error("icp_control_write: Bad offset %x\n", (int)offset);
421 static CPUReadMemoryFunc * const icp_control_readfn[] = {
422 icp_control_read,
423 icp_control_read,
424 icp_control_read
427 static CPUWriteMemoryFunc * const icp_control_writefn[] = {
428 icp_control_write,
429 icp_control_write,
430 icp_control_write
433 static void icp_control_init(uint32_t base)
435 int iomemtype;
437 iomemtype = cpu_register_io_memory(icp_control_readfn,
438 icp_control_writefn, NULL);
439 cpu_register_physical_memory(base, 0x00800000, iomemtype);
440 /* ??? Save/restore. */
444 /* Board init. */
446 static struct arm_boot_info integrator_binfo = {
447 .loader_start = 0x0,
448 .board_id = 0x113,
451 static void integratorcp_init(ram_addr_t ram_size,
452 const char *boot_device,
453 const char *kernel_filename, const char *kernel_cmdline,
454 const char *initrd_filename, const char *cpu_model)
456 CPUState *env;
457 ram_addr_t ram_offset;
458 qemu_irq pic[32];
459 qemu_irq *cpu_pic;
460 DeviceState *dev;
461 int i;
463 if (!cpu_model)
464 cpu_model = "arm926";
465 env = cpu_init(cpu_model);
466 if (!env) {
467 fprintf(stderr, "Unable to find CPU definition\n");
468 exit(1);
470 ram_offset = qemu_ram_alloc(ram_size);
471 /* ??? On a real system the first 1Mb is mapped as SSRAM or boot flash. */
472 /* ??? RAM should repeat to fill physical memory space. */
473 /* SDRAM at address zero*/
474 cpu_register_physical_memory(0, ram_size, ram_offset | IO_MEM_RAM);
475 /* And again at address 0x80000000 */
476 cpu_register_physical_memory(0x80000000, ram_size, ram_offset | IO_MEM_RAM);
478 dev = qdev_create(NULL, "integrator_core");
479 qdev_prop_set_uint32(dev, "memsz", ram_size >> 20);
480 qdev_init_nofail(dev);
481 sysbus_mmio_map((SysBusDevice *)dev, 0, 0x10000000);
483 cpu_pic = arm_pic_init_cpu(env);
484 dev = sysbus_create_varargs("integrator_pic", 0x14000000,
485 cpu_pic[ARM_PIC_CPU_IRQ],
486 cpu_pic[ARM_PIC_CPU_FIQ], NULL);
487 for (i = 0; i < 32; i++) {
488 pic[i] = qdev_get_gpio_in(dev, i);
490 sysbus_create_simple("integrator_pic", 0xca000000, pic[26]);
491 sysbus_create_varargs("integrator_pit", 0x13000000,
492 pic[5], pic[6], pic[7], NULL);
493 sysbus_create_simple("pl031", 0x15000000, pic[8]);
494 sysbus_create_simple("pl011", 0x16000000, pic[1]);
495 sysbus_create_simple("pl011", 0x17000000, pic[2]);
496 icp_control_init(0xcb000000);
497 sysbus_create_simple("pl050_keyboard", 0x18000000, pic[3]);
498 sysbus_create_simple("pl050_mouse", 0x19000000, pic[4]);
499 sysbus_create_varargs("pl181", 0x1c000000, pic[23], pic[24], NULL);
500 if (nd_table[0].vlan)
501 smc91c111_init(&nd_table[0], 0xc8000000, pic[27]);
503 sysbus_create_simple("pl110", 0xc0000000, pic[22]);
505 integrator_binfo.ram_size = ram_size;
506 integrator_binfo.kernel_filename = kernel_filename;
507 integrator_binfo.kernel_cmdline = kernel_cmdline;
508 integrator_binfo.initrd_filename = initrd_filename;
509 arm_load_kernel(env, &integrator_binfo);
512 static QEMUMachine integratorcp_machine = {
513 .name = "integratorcp",
514 .desc = "ARM Integrator/CP (ARM926EJ-S)",
515 .init = integratorcp_init,
516 .is_default = 1,
519 static void integratorcp_machine_init(void)
521 qemu_register_machine(&integratorcp_machine);
524 machine_init(integratorcp_machine_init);
526 static SysBusDeviceInfo core_info = {
527 .init = integratorcm_init,
528 .qdev.name = "integrator_core",
529 .qdev.size = sizeof(integratorcm_state),
530 .qdev.props = (Property[]) {
531 DEFINE_PROP_UINT32("memsz", integratorcm_state, memsz, 0),
532 DEFINE_PROP_END_OF_LIST(),
536 static void integratorcp_register_devices(void)
538 sysbus_register_dev("integrator_pic", sizeof(icp_pic_state), icp_pic_init);
539 sysbus_register_withprop(&core_info);
542 device_init(integratorcp_register_devices)