xref: /openbmc/qemu/hw/arm/npcm7xx.c (revision d177892d)
1 /*
2  * Nuvoton NPCM7xx SoC family.
3  *
4  * Copyright 2020 Google LLC
5  *
6  * This program is free software; you can redistribute it and/or modify it
7  * under the terms of the GNU General Public License as published by the
8  * Free Software Foundation; either version 2 of the License, or
9  * (at your option) any later version.
10  *
11  * This program is distributed in the hope that it will be useful, but WITHOUT
12  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13  * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14  * for more details.
15  */
16 
17 #include "qemu/osdep.h"
18 
19 #include "exec/address-spaces.h"
20 #include "hw/arm/boot.h"
21 #include "hw/arm/npcm7xx.h"
22 #include "hw/char/serial.h"
23 #include "hw/loader.h"
24 #include "hw/misc/unimp.h"
25 #include "hw/qdev-clock.h"
26 #include "hw/qdev-properties.h"
27 #include "qapi/error.h"
28 #include "qemu/units.h"
29 #include "sysemu/sysemu.h"
30 
31 /*
32  * This covers the whole MMIO space. We'll use this to catch any MMIO accesses
33  * that aren't handled by any device.
34  */
35 #define NPCM7XX_MMIO_BA         (0x80000000)
36 #define NPCM7XX_MMIO_SZ         (0x7ffd0000)
37 
38 /* OTP key storage and fuse strap array */
39 #define NPCM7XX_OTP1_BA         (0xf0189000)
40 #define NPCM7XX_OTP2_BA         (0xf018a000)
41 
42 /* Core system modules. */
43 #define NPCM7XX_L2C_BA          (0xf03fc000)
44 #define NPCM7XX_CPUP_BA         (0xf03fe000)
45 #define NPCM7XX_GCR_BA          (0xf0800000)
46 #define NPCM7XX_CLK_BA          (0xf0801000)
47 #define NPCM7XX_MC_BA           (0xf0824000)
48 #define NPCM7XX_RNG_BA          (0xf000b000)
49 
50 /* USB Host modules */
51 #define NPCM7XX_EHCI_BA         (0xf0806000)
52 #define NPCM7XX_OHCI_BA         (0xf0807000)
53 
54 /* ADC Module */
55 #define NPCM7XX_ADC_BA          (0xf000c000)
56 
57 /* Internal AHB SRAM */
58 #define NPCM7XX_RAM3_BA         (0xc0008000)
59 #define NPCM7XX_RAM3_SZ         (4 * KiB)
60 
61 /* Memory blocks at the end of the address space */
62 #define NPCM7XX_RAM2_BA         (0xfffd0000)
63 #define NPCM7XX_RAM2_SZ         (128 * KiB)
64 #define NPCM7XX_ROM_BA          (0xffff0000)
65 #define NPCM7XX_ROM_SZ          (64 * KiB)
66 
67 
68 /* Clock configuration values to be fixed up when bypassing bootloader */
69 
70 /* Run PLL1 at 1600 MHz */
71 #define NPCM7XX_PLLCON1_FIXUP_VAL   (0x00402101)
72 /* Run the CPU from PLL1 and UART from PLL2 */
73 #define NPCM7XX_CLKSEL_FIXUP_VAL    (0x004aaba9)
74 
75 /*
76  * Interrupt lines going into the GIC. This does not include internal Cortex-A9
77  * interrupts.
78  */
79 enum NPCM7xxInterrupt {
80     NPCM7XX_ADC_IRQ             = 0,
81     NPCM7XX_UART0_IRQ           = 2,
82     NPCM7XX_UART1_IRQ,
83     NPCM7XX_UART2_IRQ,
84     NPCM7XX_UART3_IRQ,
85     NPCM7XX_EMC1RX_IRQ          = 15,
86     NPCM7XX_EMC1TX_IRQ,
87     NPCM7XX_TIMER0_IRQ          = 32,   /* Timer Module 0 */
88     NPCM7XX_TIMER1_IRQ,
89     NPCM7XX_TIMER2_IRQ,
90     NPCM7XX_TIMER3_IRQ,
91     NPCM7XX_TIMER4_IRQ,
92     NPCM7XX_TIMER5_IRQ,                 /* Timer Module 1 */
93     NPCM7XX_TIMER6_IRQ,
94     NPCM7XX_TIMER7_IRQ,
95     NPCM7XX_TIMER8_IRQ,
96     NPCM7XX_TIMER9_IRQ,
97     NPCM7XX_TIMER10_IRQ,                /* Timer Module 2 */
98     NPCM7XX_TIMER11_IRQ,
99     NPCM7XX_TIMER12_IRQ,
100     NPCM7XX_TIMER13_IRQ,
101     NPCM7XX_TIMER14_IRQ,
102     NPCM7XX_WDG0_IRQ            = 47,   /* Timer Module 0 Watchdog */
103     NPCM7XX_WDG1_IRQ,                   /* Timer Module 1 Watchdog */
104     NPCM7XX_WDG2_IRQ,                   /* Timer Module 2 Watchdog */
105     NPCM7XX_EHCI_IRQ            = 61,
106     NPCM7XX_OHCI_IRQ            = 62,
107     NPCM7XX_SMBUS0_IRQ          = 64,
108     NPCM7XX_SMBUS1_IRQ,
109     NPCM7XX_SMBUS2_IRQ,
110     NPCM7XX_SMBUS3_IRQ,
111     NPCM7XX_SMBUS4_IRQ,
112     NPCM7XX_SMBUS5_IRQ,
113     NPCM7XX_SMBUS6_IRQ,
114     NPCM7XX_SMBUS7_IRQ,
115     NPCM7XX_SMBUS8_IRQ,
116     NPCM7XX_SMBUS9_IRQ,
117     NPCM7XX_SMBUS10_IRQ,
118     NPCM7XX_SMBUS11_IRQ,
119     NPCM7XX_SMBUS12_IRQ,
120     NPCM7XX_SMBUS13_IRQ,
121     NPCM7XX_SMBUS14_IRQ,
122     NPCM7XX_SMBUS15_IRQ,
123     NPCM7XX_PWM0_IRQ            = 93,   /* PWM module 0 */
124     NPCM7XX_PWM1_IRQ,                   /* PWM module 1 */
125     NPCM7XX_MFT0_IRQ            = 96,   /* MFT module 0 */
126     NPCM7XX_MFT1_IRQ,                   /* MFT module 1 */
127     NPCM7XX_MFT2_IRQ,                   /* MFT module 2 */
128     NPCM7XX_MFT3_IRQ,                   /* MFT module 3 */
129     NPCM7XX_MFT4_IRQ,                   /* MFT module 4 */
130     NPCM7XX_MFT5_IRQ,                   /* MFT module 5 */
131     NPCM7XX_MFT6_IRQ,                   /* MFT module 6 */
132     NPCM7XX_MFT7_IRQ,                   /* MFT module 7 */
133     NPCM7XX_EMC2RX_IRQ          = 114,
134     NPCM7XX_EMC2TX_IRQ,
135     NPCM7XX_GPIO0_IRQ           = 116,
136     NPCM7XX_GPIO1_IRQ,
137     NPCM7XX_GPIO2_IRQ,
138     NPCM7XX_GPIO3_IRQ,
139     NPCM7XX_GPIO4_IRQ,
140     NPCM7XX_GPIO5_IRQ,
141     NPCM7XX_GPIO6_IRQ,
142     NPCM7XX_GPIO7_IRQ,
143 };
144 
145 /* Total number of GIC interrupts, including internal Cortex-A9 interrupts. */
146 #define NPCM7XX_NUM_IRQ         (160)
147 
148 /* Register base address for each Timer Module */
149 static const hwaddr npcm7xx_tim_addr[] = {
150     0xf0008000,
151     0xf0009000,
152     0xf000a000,
153 };
154 
155 /* Register base address for each 16550 UART */
156 static const hwaddr npcm7xx_uart_addr[] = {
157     0xf0001000,
158     0xf0002000,
159     0xf0003000,
160     0xf0004000,
161 };
162 
163 /* Direct memory-mapped access to SPI0 CS0-1. */
164 static const hwaddr npcm7xx_fiu0_flash_addr[] = {
165     0x80000000, /* CS0 */
166     0x88000000, /* CS1 */
167 };
168 
169 /* Direct memory-mapped access to SPI3 CS0-3. */
170 static const hwaddr npcm7xx_fiu3_flash_addr[] = {
171     0xa0000000, /* CS0 */
172     0xa8000000, /* CS1 */
173     0xb0000000, /* CS2 */
174     0xb8000000, /* CS3 */
175 };
176 
177 /* Register base address for each PWM Module */
178 static const hwaddr npcm7xx_pwm_addr[] = {
179     0xf0103000,
180     0xf0104000,
181 };
182 
183 /* Register base address for each MFT Module */
184 static const hwaddr npcm7xx_mft_addr[] = {
185     0xf0180000,
186     0xf0181000,
187     0xf0182000,
188     0xf0183000,
189     0xf0184000,
190     0xf0185000,
191     0xf0186000,
192     0xf0187000,
193 };
194 
195 /* Direct memory-mapped access to each SMBus Module. */
196 static const hwaddr npcm7xx_smbus_addr[] = {
197     0xf0080000,
198     0xf0081000,
199     0xf0082000,
200     0xf0083000,
201     0xf0084000,
202     0xf0085000,
203     0xf0086000,
204     0xf0087000,
205     0xf0088000,
206     0xf0089000,
207     0xf008a000,
208     0xf008b000,
209     0xf008c000,
210     0xf008d000,
211     0xf008e000,
212     0xf008f000,
213 };
214 
215 /* Register base address for each EMC Module */
216 static const hwaddr npcm7xx_emc_addr[] = {
217     0xf0825000,
218     0xf0826000,
219 };
220 
221 static const struct {
222     hwaddr regs_addr;
223     uint32_t unconnected_pins;
224     uint32_t reset_pu;
225     uint32_t reset_pd;
226     uint32_t reset_osrc;
227     uint32_t reset_odsc;
228 } npcm7xx_gpio[] = {
229     {
230         .regs_addr = 0xf0010000,
231         .reset_pu = 0xff03ffff,
232         .reset_pd = 0x00fc0000,
233     }, {
234         .regs_addr = 0xf0011000,
235         .unconnected_pins = 0x0000001e,
236         .reset_pu = 0xfefffe07,
237         .reset_pd = 0x010001e0,
238     }, {
239         .regs_addr = 0xf0012000,
240         .reset_pu = 0x780fffff,
241         .reset_pd = 0x07f00000,
242         .reset_odsc = 0x00700000,
243     }, {
244         .regs_addr = 0xf0013000,
245         .reset_pu = 0x00fc0000,
246         .reset_pd = 0xff000000,
247     }, {
248         .regs_addr = 0xf0014000,
249         .reset_pu = 0xffffffff,
250     }, {
251         .regs_addr = 0xf0015000,
252         .reset_pu = 0xbf83f801,
253         .reset_pd = 0x007c0000,
254         .reset_osrc = 0x000000f1,
255         .reset_odsc = 0x3f9f80f1,
256     }, {
257         .regs_addr = 0xf0016000,
258         .reset_pu = 0xfc00f801,
259         .reset_pd = 0x000007fe,
260         .reset_odsc = 0x00000800,
261     }, {
262         .regs_addr = 0xf0017000,
263         .unconnected_pins = 0xffffff00,
264         .reset_pu = 0x0000007f,
265         .reset_osrc = 0x0000007f,
266         .reset_odsc = 0x0000007f,
267     },
268 };
269 
270 static const struct {
271     const char *name;
272     hwaddr regs_addr;
273     int cs_count;
274     const hwaddr *flash_addr;
275 } npcm7xx_fiu[] = {
276     {
277         .name = "fiu0",
278         .regs_addr = 0xfb000000,
279         .cs_count = ARRAY_SIZE(npcm7xx_fiu0_flash_addr),
280         .flash_addr = npcm7xx_fiu0_flash_addr,
281     }, {
282         .name = "fiu3",
283         .regs_addr = 0xc0000000,
284         .cs_count = ARRAY_SIZE(npcm7xx_fiu3_flash_addr),
285         .flash_addr = npcm7xx_fiu3_flash_addr,
286     },
287 };
288 
289 static void npcm7xx_write_board_setup(ARMCPU *cpu,
290                                       const struct arm_boot_info *info)
291 {
292     uint32_t board_setup[] = {
293         0xe59f0010,     /* ldr r0, clk_base_addr */
294         0xe59f1010,     /* ldr r1, pllcon1_value */
295         0xe5801010,     /* str r1, [r0, #16] */
296         0xe59f100c,     /* ldr r1, clksel_value */
297         0xe5801004,     /* str r1, [r0, #4] */
298         0xe12fff1e,     /* bx lr */
299         NPCM7XX_CLK_BA,
300         NPCM7XX_PLLCON1_FIXUP_VAL,
301         NPCM7XX_CLKSEL_FIXUP_VAL,
302     };
303     int i;
304 
305     for (i = 0; i < ARRAY_SIZE(board_setup); i++) {
306         board_setup[i] = tswap32(board_setup[i]);
307     }
308     rom_add_blob_fixed("board-setup", board_setup, sizeof(board_setup),
309                        info->board_setup_addr);
310 }
311 
312 static void npcm7xx_write_secondary_boot(ARMCPU *cpu,
313                                          const struct arm_boot_info *info)
314 {
315     /*
316      * The default smpboot stub halts the secondary CPU with a 'wfi'
317      * instruction, but the arch/arm/mach-npcm/platsmp.c in the Linux kernel
318      * does not send an IPI to wake it up, so the second CPU fails to boot. So
319      * we need to provide our own smpboot stub that can not use 'wfi', it has
320      * to spin the secondary CPU until the first CPU writes to the SCRPAD reg.
321      */
322     uint32_t smpboot[] = {
323         0xe59f2018,     /* ldr r2, bootreg_addr */
324         0xe3a00000,     /* mov r0, #0 */
325         0xe5820000,     /* str r0, [r2] */
326         0xe320f002,     /* wfe */
327         0xe5921000,     /* ldr r1, [r2] */
328         0xe1110001,     /* tst r1, r1 */
329         0x0afffffb,     /* beq <wfe> */
330         0xe12fff11,     /* bx r1 */
331         NPCM7XX_SMP_BOOTREG_ADDR,
332     };
333     int i;
334 
335     for (i = 0; i < ARRAY_SIZE(smpboot); i++) {
336         smpboot[i] = tswap32(smpboot[i]);
337     }
338 
339     rom_add_blob_fixed("smpboot", smpboot, sizeof(smpboot),
340                        NPCM7XX_SMP_LOADER_START);
341 }
342 
343 static struct arm_boot_info npcm7xx_binfo = {
344     .loader_start           = NPCM7XX_LOADER_START,
345     .smp_loader_start       = NPCM7XX_SMP_LOADER_START,
346     .smp_bootreg_addr       = NPCM7XX_SMP_BOOTREG_ADDR,
347     .gic_cpu_if_addr        = NPCM7XX_GIC_CPU_IF_ADDR,
348     .write_secondary_boot   = npcm7xx_write_secondary_boot,
349     .board_id               = -1,
350     .board_setup_addr       = NPCM7XX_BOARD_SETUP_ADDR,
351     .write_board_setup      = npcm7xx_write_board_setup,
352 };
353 
354 void npcm7xx_load_kernel(MachineState *machine, NPCM7xxState *soc)
355 {
356     NPCM7xxClass *sc = NPCM7XX_GET_CLASS(soc);
357 
358     npcm7xx_binfo.ram_size = machine->ram_size;
359     npcm7xx_binfo.nb_cpus = sc->num_cpus;
360 
361     arm_load_kernel(&soc->cpu[0], machine, &npcm7xx_binfo);
362 }
363 
364 static void npcm7xx_init_fuses(NPCM7xxState *s)
365 {
366     NPCM7xxClass *nc = NPCM7XX_GET_CLASS(s);
367     uint32_t value;
368 
369     /*
370      * The initial mask of disabled modules indicates the chip derivative (e.g.
371      * NPCM750 or NPCM730).
372      */
373     value = tswap32(nc->disabled_modules);
374     npcm7xx_otp_array_write(&s->fuse_array, &value, NPCM7XX_FUSE_DERIVATIVE,
375                             sizeof(value));
376 }
377 
378 static void npcm7xx_write_adc_calibration(NPCM7xxState *s)
379 {
380     /* Both ADC and the fuse array must have realized. */
381     QEMU_BUILD_BUG_ON(sizeof(s->adc.calibration_r_values) != 4);
382     npcm7xx_otp_array_write(&s->fuse_array, s->adc.calibration_r_values,
383             NPCM7XX_FUSE_ADC_CALIB, sizeof(s->adc.calibration_r_values));
384 }
385 
386 static qemu_irq npcm7xx_irq(NPCM7xxState *s, int n)
387 {
388     return qdev_get_gpio_in(DEVICE(&s->a9mpcore), n);
389 }
390 
391 static void npcm7xx_init(Object *obj)
392 {
393     NPCM7xxState *s = NPCM7XX(obj);
394     int i;
395 
396     for (i = 0; i < NPCM7XX_MAX_NUM_CPUS; i++) {
397         object_initialize_child(obj, "cpu[*]", &s->cpu[i],
398                                 ARM_CPU_TYPE_NAME("cortex-a9"));
399     }
400 
401     object_initialize_child(obj, "a9mpcore", &s->a9mpcore, TYPE_A9MPCORE_PRIV);
402     object_initialize_child(obj, "gcr", &s->gcr, TYPE_NPCM7XX_GCR);
403     object_property_add_alias(obj, "power-on-straps", OBJECT(&s->gcr),
404                               "power-on-straps");
405     object_initialize_child(obj, "clk", &s->clk, TYPE_NPCM7XX_CLK);
406     object_initialize_child(obj, "otp1", &s->key_storage,
407                             TYPE_NPCM7XX_KEY_STORAGE);
408     object_initialize_child(obj, "otp2", &s->fuse_array,
409                             TYPE_NPCM7XX_FUSE_ARRAY);
410     object_initialize_child(obj, "mc", &s->mc, TYPE_NPCM7XX_MC);
411     object_initialize_child(obj, "rng", &s->rng, TYPE_NPCM7XX_RNG);
412     object_initialize_child(obj, "adc", &s->adc, TYPE_NPCM7XX_ADC);
413 
414     for (i = 0; i < ARRAY_SIZE(s->tim); i++) {
415         object_initialize_child(obj, "tim[*]", &s->tim[i], TYPE_NPCM7XX_TIMER);
416     }
417 
418     for (i = 0; i < ARRAY_SIZE(s->gpio); i++) {
419         object_initialize_child(obj, "gpio[*]", &s->gpio[i], TYPE_NPCM7XX_GPIO);
420     }
421 
422     for (i = 0; i < ARRAY_SIZE(s->smbus); i++) {
423         object_initialize_child(obj, "smbus[*]", &s->smbus[i],
424                                 TYPE_NPCM7XX_SMBUS);
425     }
426 
427     object_initialize_child(obj, "ehci", &s->ehci, TYPE_NPCM7XX_EHCI);
428     object_initialize_child(obj, "ohci", &s->ohci, TYPE_SYSBUS_OHCI);
429 
430     QEMU_BUILD_BUG_ON(ARRAY_SIZE(npcm7xx_fiu) != ARRAY_SIZE(s->fiu));
431     for (i = 0; i < ARRAY_SIZE(s->fiu); i++) {
432         object_initialize_child(obj, npcm7xx_fiu[i].name, &s->fiu[i],
433                                 TYPE_NPCM7XX_FIU);
434     }
435 
436     for (i = 0; i < ARRAY_SIZE(s->pwm); i++) {
437         object_initialize_child(obj, "pwm[*]", &s->pwm[i], TYPE_NPCM7XX_PWM);
438     }
439 
440     for (i = 0; i < ARRAY_SIZE(s->mft); i++) {
441         object_initialize_child(obj, "mft[*]", &s->mft[i], TYPE_NPCM7XX_MFT);
442     }
443 
444     for (i = 0; i < ARRAY_SIZE(s->emc); i++) {
445         object_initialize_child(obj, "emc[*]", &s->emc[i], TYPE_NPCM7XX_EMC);
446     }
447 }
448 
449 static void npcm7xx_realize(DeviceState *dev, Error **errp)
450 {
451     NPCM7xxState *s = NPCM7XX(dev);
452     NPCM7xxClass *nc = NPCM7XX_GET_CLASS(s);
453     int i;
454 
455     if (memory_region_size(s->dram) > NPCM7XX_DRAM_SZ) {
456         error_setg(errp, "%s: NPCM7xx cannot address more than %" PRIu64
457                    " MiB of DRAM", __func__, NPCM7XX_DRAM_SZ / MiB);
458         return;
459     }
460 
461     /* CPUs */
462     for (i = 0; i < nc->num_cpus; i++) {
463         object_property_set_int(OBJECT(&s->cpu[i]), "mp-affinity",
464                                 arm_cpu_mp_affinity(i, NPCM7XX_MAX_NUM_CPUS),
465                                 &error_abort);
466         object_property_set_int(OBJECT(&s->cpu[i]), "reset-cbar",
467                                 NPCM7XX_GIC_CPU_IF_ADDR, &error_abort);
468         object_property_set_bool(OBJECT(&s->cpu[i]), "reset-hivecs", true,
469                                  &error_abort);
470 
471         /* Disable security extensions. */
472         object_property_set_bool(OBJECT(&s->cpu[i]), "has_el3", false,
473                                  &error_abort);
474 
475         if (!qdev_realize(DEVICE(&s->cpu[i]), NULL, errp)) {
476             return;
477         }
478     }
479 
480     /* A9MPCORE peripherals. Can only fail if we pass bad parameters here. */
481     object_property_set_int(OBJECT(&s->a9mpcore), "num-cpu", nc->num_cpus,
482                             &error_abort);
483     object_property_set_int(OBJECT(&s->a9mpcore), "num-irq", NPCM7XX_NUM_IRQ,
484                             &error_abort);
485     sysbus_realize(SYS_BUS_DEVICE(&s->a9mpcore), &error_abort);
486     sysbus_mmio_map(SYS_BUS_DEVICE(&s->a9mpcore), 0, NPCM7XX_CPUP_BA);
487 
488     for (i = 0; i < nc->num_cpus; i++) {
489         sysbus_connect_irq(SYS_BUS_DEVICE(&s->a9mpcore), i,
490                            qdev_get_gpio_in(DEVICE(&s->cpu[i]), ARM_CPU_IRQ));
491         sysbus_connect_irq(SYS_BUS_DEVICE(&s->a9mpcore), i + nc->num_cpus,
492                            qdev_get_gpio_in(DEVICE(&s->cpu[i]), ARM_CPU_FIQ));
493     }
494 
495     /* L2 cache controller */
496     sysbus_create_simple("l2x0", NPCM7XX_L2C_BA, NULL);
497 
498     /* System Global Control Registers (GCR). Can fail due to user input. */
499     object_property_set_int(OBJECT(&s->gcr), "disabled-modules",
500                             nc->disabled_modules, &error_abort);
501     object_property_add_const_link(OBJECT(&s->gcr), "dram-mr", OBJECT(s->dram));
502     if (!sysbus_realize(SYS_BUS_DEVICE(&s->gcr), errp)) {
503         return;
504     }
505     sysbus_mmio_map(SYS_BUS_DEVICE(&s->gcr), 0, NPCM7XX_GCR_BA);
506 
507     /* Clock Control Registers (CLK). Cannot fail. */
508     sysbus_realize(SYS_BUS_DEVICE(&s->clk), &error_abort);
509     sysbus_mmio_map(SYS_BUS_DEVICE(&s->clk), 0, NPCM7XX_CLK_BA);
510 
511     /* OTP key storage and fuse strap array. Cannot fail. */
512     sysbus_realize(SYS_BUS_DEVICE(&s->key_storage), &error_abort);
513     sysbus_mmio_map(SYS_BUS_DEVICE(&s->key_storage), 0, NPCM7XX_OTP1_BA);
514     sysbus_realize(SYS_BUS_DEVICE(&s->fuse_array), &error_abort);
515     sysbus_mmio_map(SYS_BUS_DEVICE(&s->fuse_array), 0, NPCM7XX_OTP2_BA);
516     npcm7xx_init_fuses(s);
517 
518     /* Fake Memory Controller (MC). Cannot fail. */
519     sysbus_realize(SYS_BUS_DEVICE(&s->mc), &error_abort);
520     sysbus_mmio_map(SYS_BUS_DEVICE(&s->mc), 0, NPCM7XX_MC_BA);
521 
522     /* ADC Modules. Cannot fail. */
523     qdev_connect_clock_in(DEVICE(&s->adc), "clock", qdev_get_clock_out(
524                           DEVICE(&s->clk), "adc-clock"));
525     sysbus_realize(SYS_BUS_DEVICE(&s->adc), &error_abort);
526     sysbus_mmio_map(SYS_BUS_DEVICE(&s->adc), 0, NPCM7XX_ADC_BA);
527     sysbus_connect_irq(SYS_BUS_DEVICE(&s->adc), 0,
528             npcm7xx_irq(s, NPCM7XX_ADC_IRQ));
529     npcm7xx_write_adc_calibration(s);
530 
531     /* Timer Modules (TIM). Cannot fail. */
532     QEMU_BUILD_BUG_ON(ARRAY_SIZE(npcm7xx_tim_addr) != ARRAY_SIZE(s->tim));
533     for (i = 0; i < ARRAY_SIZE(s->tim); i++) {
534         SysBusDevice *sbd = SYS_BUS_DEVICE(&s->tim[i]);
535         int first_irq;
536         int j;
537 
538         /* Connect the timer clock. */
539         qdev_connect_clock_in(DEVICE(&s->tim[i]), "clock", qdev_get_clock_out(
540                     DEVICE(&s->clk), "timer-clock"));
541 
542         sysbus_realize(sbd, &error_abort);
543         sysbus_mmio_map(sbd, 0, npcm7xx_tim_addr[i]);
544 
545         first_irq = NPCM7XX_TIMER0_IRQ + i * NPCM7XX_TIMERS_PER_CTRL;
546         for (j = 0; j < NPCM7XX_TIMERS_PER_CTRL; j++) {
547             qemu_irq irq = npcm7xx_irq(s, first_irq + j);
548             sysbus_connect_irq(sbd, j, irq);
549         }
550 
551         /* IRQ for watchdogs */
552         sysbus_connect_irq(sbd, NPCM7XX_TIMERS_PER_CTRL,
553                 npcm7xx_irq(s, NPCM7XX_WDG0_IRQ + i));
554         /* GPIO that connects clk module with watchdog */
555         qdev_connect_gpio_out_named(DEVICE(&s->tim[i]),
556                 NPCM7XX_WATCHDOG_RESET_GPIO_OUT, 0,
557                 qdev_get_gpio_in_named(DEVICE(&s->clk),
558                         NPCM7XX_WATCHDOG_RESET_GPIO_IN, i));
559     }
560 
561     /* UART0..3 (16550 compatible) */
562     for (i = 0; i < ARRAY_SIZE(npcm7xx_uart_addr); i++) {
563         serial_mm_init(get_system_memory(), npcm7xx_uart_addr[i], 2,
564                        npcm7xx_irq(s, NPCM7XX_UART0_IRQ + i), 115200,
565                        serial_hd(i), DEVICE_LITTLE_ENDIAN);
566     }
567 
568     /* Random Number Generator. Cannot fail. */
569     sysbus_realize(SYS_BUS_DEVICE(&s->rng), &error_abort);
570     sysbus_mmio_map(SYS_BUS_DEVICE(&s->rng), 0, NPCM7XX_RNG_BA);
571 
572     /* GPIO modules. Cannot fail. */
573     QEMU_BUILD_BUG_ON(ARRAY_SIZE(npcm7xx_gpio) != ARRAY_SIZE(s->gpio));
574     for (i = 0; i < ARRAY_SIZE(s->gpio); i++) {
575         Object *obj = OBJECT(&s->gpio[i]);
576 
577         object_property_set_uint(obj, "reset-pullup",
578                                  npcm7xx_gpio[i].reset_pu, &error_abort);
579         object_property_set_uint(obj, "reset-pulldown",
580                                  npcm7xx_gpio[i].reset_pd, &error_abort);
581         object_property_set_uint(obj, "reset-osrc",
582                                  npcm7xx_gpio[i].reset_osrc, &error_abort);
583         object_property_set_uint(obj, "reset-odsc",
584                                  npcm7xx_gpio[i].reset_odsc, &error_abort);
585         sysbus_realize(SYS_BUS_DEVICE(obj), &error_abort);
586         sysbus_mmio_map(SYS_BUS_DEVICE(obj), 0, npcm7xx_gpio[i].regs_addr);
587         sysbus_connect_irq(SYS_BUS_DEVICE(obj), 0,
588                            npcm7xx_irq(s, NPCM7XX_GPIO0_IRQ + i));
589     }
590 
591     /* SMBus modules. Cannot fail. */
592     QEMU_BUILD_BUG_ON(ARRAY_SIZE(npcm7xx_smbus_addr) != ARRAY_SIZE(s->smbus));
593     for (i = 0; i < ARRAY_SIZE(s->smbus); i++) {
594         Object *obj = OBJECT(&s->smbus[i]);
595 
596         sysbus_realize(SYS_BUS_DEVICE(obj), &error_abort);
597         sysbus_mmio_map(SYS_BUS_DEVICE(obj), 0, npcm7xx_smbus_addr[i]);
598         sysbus_connect_irq(SYS_BUS_DEVICE(obj), 0,
599                            npcm7xx_irq(s, NPCM7XX_SMBUS0_IRQ + i));
600     }
601 
602     /* USB Host */
603     object_property_set_bool(OBJECT(&s->ehci), "companion-enable", true,
604                              &error_abort);
605     sysbus_realize(SYS_BUS_DEVICE(&s->ehci), &error_abort);
606     sysbus_mmio_map(SYS_BUS_DEVICE(&s->ehci), 0, NPCM7XX_EHCI_BA);
607     sysbus_connect_irq(SYS_BUS_DEVICE(&s->ehci), 0,
608                        npcm7xx_irq(s, NPCM7XX_EHCI_IRQ));
609 
610     object_property_set_str(OBJECT(&s->ohci), "masterbus", "usb-bus.0",
611                             &error_abort);
612     object_property_set_uint(OBJECT(&s->ohci), "num-ports", 1, &error_abort);
613     sysbus_realize(SYS_BUS_DEVICE(&s->ohci), &error_abort);
614     sysbus_mmio_map(SYS_BUS_DEVICE(&s->ohci), 0, NPCM7XX_OHCI_BA);
615     sysbus_connect_irq(SYS_BUS_DEVICE(&s->ohci), 0,
616                        npcm7xx_irq(s, NPCM7XX_OHCI_IRQ));
617 
618     /* PWM Modules. Cannot fail. */
619     QEMU_BUILD_BUG_ON(ARRAY_SIZE(npcm7xx_pwm_addr) != ARRAY_SIZE(s->pwm));
620     for (i = 0; i < ARRAY_SIZE(s->pwm); i++) {
621         SysBusDevice *sbd = SYS_BUS_DEVICE(&s->pwm[i]);
622 
623         qdev_connect_clock_in(DEVICE(&s->pwm[i]), "clock", qdev_get_clock_out(
624                     DEVICE(&s->clk), "apb3-clock"));
625         sysbus_realize(sbd, &error_abort);
626         sysbus_mmio_map(sbd, 0, npcm7xx_pwm_addr[i]);
627         sysbus_connect_irq(sbd, i, npcm7xx_irq(s, NPCM7XX_PWM0_IRQ + i));
628     }
629 
630     /* MFT Modules. Cannot fail. */
631     QEMU_BUILD_BUG_ON(ARRAY_SIZE(npcm7xx_mft_addr) != ARRAY_SIZE(s->mft));
632     for (i = 0; i < ARRAY_SIZE(s->mft); i++) {
633         SysBusDevice *sbd = SYS_BUS_DEVICE(&s->mft[i]);
634 
635         qdev_connect_clock_in(DEVICE(&s->mft[i]), "clock-in",
636                               qdev_get_clock_out(DEVICE(&s->clk),
637                                                  "apb4-clock"));
638         sysbus_realize(sbd, &error_abort);
639         sysbus_mmio_map(sbd, 0, npcm7xx_mft_addr[i]);
640         sysbus_connect_irq(sbd, 0, npcm7xx_irq(s, NPCM7XX_MFT0_IRQ + i));
641     }
642 
643     /*
644      * EMC Modules. Cannot fail.
645      * The mapping of the device to its netdev backend works as follows:
646      * emc[i] = nd_table[i]
647      * This works around the inability to specify the netdev property for the
648      * emc device: it's not pluggable and thus the -device option can't be
649      * used.
650      */
651     QEMU_BUILD_BUG_ON(ARRAY_SIZE(npcm7xx_emc_addr) != ARRAY_SIZE(s->emc));
652     QEMU_BUILD_BUG_ON(ARRAY_SIZE(s->emc) != 2);
653     for (i = 0; i < ARRAY_SIZE(s->emc); i++) {
654         s->emc[i].emc_num = i;
655         SysBusDevice *sbd = SYS_BUS_DEVICE(&s->emc[i]);
656         if (nd_table[i].used) {
657             qemu_check_nic_model(&nd_table[i], TYPE_NPCM7XX_EMC);
658             qdev_set_nic_properties(DEVICE(sbd), &nd_table[i]);
659         }
660         /*
661          * The device exists regardless of whether it's connected to a QEMU
662          * netdev backend. So always instantiate it even if there is no
663          * backend.
664          */
665         sysbus_realize(sbd, &error_abort);
666         sysbus_mmio_map(sbd, 0, npcm7xx_emc_addr[i]);
667         int tx_irq = i == 0 ? NPCM7XX_EMC1TX_IRQ : NPCM7XX_EMC2TX_IRQ;
668         int rx_irq = i == 0 ? NPCM7XX_EMC1RX_IRQ : NPCM7XX_EMC2RX_IRQ;
669         /*
670          * N.B. The values for the second argument sysbus_connect_irq are
671          * chosen to match the registration order in npcm7xx_emc_realize.
672          */
673         sysbus_connect_irq(sbd, 0, npcm7xx_irq(s, tx_irq));
674         sysbus_connect_irq(sbd, 1, npcm7xx_irq(s, rx_irq));
675     }
676 
677     /*
678      * Flash Interface Unit (FIU). Can fail if incorrect number of chip selects
679      * specified, but this is a programming error.
680      */
681     QEMU_BUILD_BUG_ON(ARRAY_SIZE(npcm7xx_fiu) != ARRAY_SIZE(s->fiu));
682     for (i = 0; i < ARRAY_SIZE(s->fiu); i++) {
683         SysBusDevice *sbd = SYS_BUS_DEVICE(&s->fiu[i]);
684         int j;
685 
686         object_property_set_int(OBJECT(sbd), "cs-count",
687                                 npcm7xx_fiu[i].cs_count, &error_abort);
688         sysbus_realize(sbd, &error_abort);
689 
690         sysbus_mmio_map(sbd, 0, npcm7xx_fiu[i].regs_addr);
691         for (j = 0; j < npcm7xx_fiu[i].cs_count; j++) {
692             sysbus_mmio_map(sbd, j + 1, npcm7xx_fiu[i].flash_addr[j]);
693         }
694     }
695 
696     /* RAM2 (SRAM) */
697     memory_region_init_ram(&s->sram, OBJECT(dev), "ram2",
698                            NPCM7XX_RAM2_SZ, &error_abort);
699     memory_region_add_subregion(get_system_memory(), NPCM7XX_RAM2_BA, &s->sram);
700 
701     /* RAM3 (SRAM) */
702     memory_region_init_ram(&s->ram3, OBJECT(dev), "ram3",
703                            NPCM7XX_RAM3_SZ, &error_abort);
704     memory_region_add_subregion(get_system_memory(), NPCM7XX_RAM3_BA, &s->ram3);
705 
706     /* Internal ROM */
707     memory_region_init_rom(&s->irom, OBJECT(dev), "irom", NPCM7XX_ROM_SZ,
708                            &error_abort);
709     memory_region_add_subregion(get_system_memory(), NPCM7XX_ROM_BA, &s->irom);
710 
711     create_unimplemented_device("npcm7xx.shm",          0xc0001000,   4 * KiB);
712     create_unimplemented_device("npcm7xx.vdmx",         0xe0800000,   4 * KiB);
713     create_unimplemented_device("npcm7xx.pcierc",       0xe1000000,  64 * KiB);
714     create_unimplemented_device("npcm7xx.kcs",          0xf0007000,   4 * KiB);
715     create_unimplemented_device("npcm7xx.gfxi",         0xf000e000,   4 * KiB);
716     create_unimplemented_device("npcm7xx.espi",         0xf009f000,   4 * KiB);
717     create_unimplemented_device("npcm7xx.peci",         0xf0100000,   4 * KiB);
718     create_unimplemented_device("npcm7xx.siox[1]",      0xf0101000,   4 * KiB);
719     create_unimplemented_device("npcm7xx.siox[2]",      0xf0102000,   4 * KiB);
720     create_unimplemented_device("npcm7xx.pspi1",        0xf0200000,   4 * KiB);
721     create_unimplemented_device("npcm7xx.pspi2",        0xf0201000,   4 * KiB);
722     create_unimplemented_device("npcm7xx.ahbpci",       0xf0400000,   1 * MiB);
723     create_unimplemented_device("npcm7xx.mcphy",        0xf05f0000,  64 * KiB);
724     create_unimplemented_device("npcm7xx.gmac1",        0xf0802000,   8 * KiB);
725     create_unimplemented_device("npcm7xx.gmac2",        0xf0804000,   8 * KiB);
726     create_unimplemented_device("npcm7xx.vcd",          0xf0810000,  64 * KiB);
727     create_unimplemented_device("npcm7xx.ece",          0xf0820000,   8 * KiB);
728     create_unimplemented_device("npcm7xx.vdma",         0xf0822000,   8 * KiB);
729     create_unimplemented_device("npcm7xx.usbd[0]",      0xf0830000,   4 * KiB);
730     create_unimplemented_device("npcm7xx.usbd[1]",      0xf0831000,   4 * KiB);
731     create_unimplemented_device("npcm7xx.usbd[2]",      0xf0832000,   4 * KiB);
732     create_unimplemented_device("npcm7xx.usbd[3]",      0xf0833000,   4 * KiB);
733     create_unimplemented_device("npcm7xx.usbd[4]",      0xf0834000,   4 * KiB);
734     create_unimplemented_device("npcm7xx.usbd[5]",      0xf0835000,   4 * KiB);
735     create_unimplemented_device("npcm7xx.usbd[6]",      0xf0836000,   4 * KiB);
736     create_unimplemented_device("npcm7xx.usbd[7]",      0xf0837000,   4 * KiB);
737     create_unimplemented_device("npcm7xx.usbd[8]",      0xf0838000,   4 * KiB);
738     create_unimplemented_device("npcm7xx.usbd[9]",      0xf0839000,   4 * KiB);
739     create_unimplemented_device("npcm7xx.sd",           0xf0840000,   8 * KiB);
740     create_unimplemented_device("npcm7xx.mmc",          0xf0842000,   8 * KiB);
741     create_unimplemented_device("npcm7xx.pcimbx",       0xf0848000, 512 * KiB);
742     create_unimplemented_device("npcm7xx.aes",          0xf0858000,   4 * KiB);
743     create_unimplemented_device("npcm7xx.des",          0xf0859000,   4 * KiB);
744     create_unimplemented_device("npcm7xx.sha",          0xf085a000,   4 * KiB);
745     create_unimplemented_device("npcm7xx.secacc",       0xf085b000,   4 * KiB);
746     create_unimplemented_device("npcm7xx.spixcs0",      0xf8000000,  16 * MiB);
747     create_unimplemented_device("npcm7xx.spixcs1",      0xf9000000,  16 * MiB);
748     create_unimplemented_device("npcm7xx.spix",         0xfb001000,   4 * KiB);
749 }
750 
751 static Property npcm7xx_properties[] = {
752     DEFINE_PROP_LINK("dram-mr", NPCM7xxState, dram, TYPE_MEMORY_REGION,
753                      MemoryRegion *),
754     DEFINE_PROP_END_OF_LIST(),
755 };
756 
757 static void npcm7xx_class_init(ObjectClass *oc, void *data)
758 {
759     DeviceClass *dc = DEVICE_CLASS(oc);
760 
761     dc->realize = npcm7xx_realize;
762     dc->user_creatable = false;
763     device_class_set_props(dc, npcm7xx_properties);
764 }
765 
766 static void npcm730_class_init(ObjectClass *oc, void *data)
767 {
768     NPCM7xxClass *nc = NPCM7XX_CLASS(oc);
769 
770     /* NPCM730 is optimized for data center use, so no graphics, etc. */
771     nc->disabled_modules = 0x00300395;
772     nc->num_cpus = 2;
773 }
774 
775 static void npcm750_class_init(ObjectClass *oc, void *data)
776 {
777     NPCM7xxClass *nc = NPCM7XX_CLASS(oc);
778 
779     /* NPCM750 has 2 cores and a full set of peripherals */
780     nc->disabled_modules = 0x00000000;
781     nc->num_cpus = 2;
782 }
783 
784 static const TypeInfo npcm7xx_soc_types[] = {
785     {
786         .name           = TYPE_NPCM7XX,
787         .parent         = TYPE_DEVICE,
788         .instance_size  = sizeof(NPCM7xxState),
789         .instance_init  = npcm7xx_init,
790         .class_size     = sizeof(NPCM7xxClass),
791         .class_init     = npcm7xx_class_init,
792         .abstract       = true,
793     }, {
794         .name           = TYPE_NPCM730,
795         .parent         = TYPE_NPCM7XX,
796         .class_init     = npcm730_class_init,
797     }, {
798         .name           = TYPE_NPCM750,
799         .parent         = TYPE_NPCM7XX,
800         .class_init     = npcm750_class_init,
801     },
802 };
803 
804 DEFINE_TYPES(npcm7xx_soc_types);
805