1 /* 2 * QEMU aCube Sam460ex board emulation 3 * 4 * Copyright (c) 2012 François Revol 5 * Copyright (c) 2016-2019 BALATON Zoltan 6 * 7 * This file is derived from hw/ppc440_bamboo.c, 8 * the copyright for that material belongs to the original owners. 9 * 10 * This work is licensed under the GNU GPL license version 2 or later. 11 * 12 */ 13 14 #include "qemu/osdep.h" 15 #include "qemu/units.h" 16 #include "qemu/datadir.h" 17 #include "qemu/error-report.h" 18 #include "qapi/error.h" 19 #include "hw/boards.h" 20 #include "sysemu/kvm.h" 21 #include "kvm_ppc.h" 22 #include "sysemu/device_tree.h" 23 #include "sysemu/block-backend.h" 24 #include "hw/loader.h" 25 #include "elf.h" 26 #include "exec/memory.h" 27 #include "ppc440.h" 28 #include "hw/pci-host/ppc4xx.h" 29 #include "hw/block/flash.h" 30 #include "sysemu/sysemu.h" 31 #include "sysemu/reset.h" 32 #include "hw/sysbus.h" 33 #include "hw/char/serial.h" 34 #include "hw/i2c/ppc4xx_i2c.h" 35 #include "hw/i2c/smbus_eeprom.h" 36 #include "hw/ide/pci.h" 37 #include "hw/usb/hcd-ehci.h" 38 #include "hw/ppc/fdt.h" 39 #include "hw/qdev-properties.h" 40 #include "hw/intc/ppc-uic.h" 41 42 #include <libfdt.h> 43 44 #define BINARY_DEVICE_TREE_FILE "canyonlands.dtb" 45 #define UBOOT_FILENAME "u-boot-sam460-20100605.bin" 46 /* to extract the official U-Boot bin from the updater: */ 47 /* dd bs=1 skip=$(($(stat -c '%s' updater/updater-460) - 0x80000)) \ 48 if=updater/updater-460 of=u-boot-sam460-20100605.bin */ 49 50 #define PCIE0_DCRN_BASE 0x100 51 #define PCIE1_DCRN_BASE 0x120 52 53 /* from Sam460 U-Boot include/configs/Sam460ex.h */ 54 #define FLASH_BASE 0xfff00000 55 #define FLASH_BASE_H 0x4 56 #define FLASH_SIZE (1 * MiB) 57 #define UBOOT_LOAD_BASE 0xfff80000 58 #define UBOOT_SIZE 0x00080000 59 #define UBOOT_ENTRY 0xfffffffc 60 61 /* from U-Boot */ 62 #define EPAPR_MAGIC (0x45504150) 63 #define KERNEL_ADDR 0x1000000 64 #define FDT_ADDR 0x1800000 65 #define RAMDISK_ADDR 0x1900000 66 67 /* Sam460ex IRQ MAP: 68 IRQ0 = ETH_INT 69 IRQ1 = FPGA_INT 70 IRQ2 = PCI_INT (PCIA, PCIB, PCIC, PCIB) 71 IRQ3 = FPGA_INT2 72 IRQ11 = RTC_INT 73 IRQ12 = SM502_INT 74 */ 75 76 #define CPU_FREQ 1150000000 77 #define PLB_FREQ 230000000 78 #define OPB_FREQ 115000000 79 #define EBC_FREQ 115000000 80 #define UART_FREQ 11059200 81 82 struct boot_info { 83 uint32_t dt_base; 84 uint32_t dt_size; 85 uint32_t entry; 86 }; 87 88 static int sam460ex_load_uboot(void) 89 { 90 /* 91 * This first creates 1MiB of flash memory mapped at the end of 92 * the 32-bit address space (0xFFF00000..0xFFFFFFFF). 93 * 94 * If_PFLASH unit 0 is defined, the flash memory is initialized 95 * from that block backend. 96 * 97 * Else, it's initialized to zero. And then 512KiB of ROM get 98 * mapped on top of its second half (0xFFF80000..0xFFFFFFFF), 99 * initialized from u-boot-sam460-20100605.bin. 100 * 101 * This doesn't smell right. 102 * 103 * The physical hardware appears to have 512KiB flash memory. 104 * 105 * TODO Figure out what we really need here, and clean this up. 106 */ 107 108 DriveInfo *dinfo; 109 110 dinfo = drive_get(IF_PFLASH, 0, 0); 111 if (!pflash_cfi01_register(FLASH_BASE | ((hwaddr)FLASH_BASE_H << 32), 112 "sam460ex.flash", FLASH_SIZE, 113 dinfo ? blk_by_legacy_dinfo(dinfo) : NULL, 114 64 * KiB, 1, 0x89, 0x18, 0x0000, 0x0, 1)) { 115 error_report("Error registering flash memory"); 116 /* XXX: return an error instead? */ 117 exit(1); 118 } 119 120 if (!dinfo) { 121 /*error_report("No flash image given with the 'pflash' parameter," 122 " using default u-boot image");*/ 123 rom_add_file_fixed(UBOOT_FILENAME, 124 UBOOT_LOAD_BASE | ((hwaddr)FLASH_BASE_H << 32), 125 -1); 126 } 127 128 return 0; 129 } 130 131 static int sam460ex_load_device_tree(MachineState *machine, 132 hwaddr addr, 133 hwaddr initrd_base, 134 hwaddr initrd_size) 135 { 136 uint32_t mem_reg_property[] = { 0, 0, cpu_to_be32(machine->ram_size) }; 137 char *filename; 138 int fdt_size; 139 void *fdt; 140 uint32_t tb_freq = CPU_FREQ; 141 uint32_t clock_freq = CPU_FREQ; 142 int offset; 143 144 filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, BINARY_DEVICE_TREE_FILE); 145 if (!filename) { 146 error_report("Couldn't find dtb file `%s'", BINARY_DEVICE_TREE_FILE); 147 exit(1); 148 } 149 fdt = load_device_tree(filename, &fdt_size); 150 if (!fdt) { 151 error_report("Couldn't load dtb file `%s'", filename); 152 g_free(filename); 153 exit(1); 154 } 155 g_free(filename); 156 157 /* Manipulate device tree in memory. */ 158 159 qemu_fdt_setprop(fdt, "/memory", "reg", mem_reg_property, 160 sizeof(mem_reg_property)); 161 162 /* default FDT doesn't have a /chosen node... */ 163 qemu_fdt_add_subnode(fdt, "/chosen"); 164 165 qemu_fdt_setprop_cell(fdt, "/chosen", "linux,initrd-start", initrd_base); 166 167 qemu_fdt_setprop_cell(fdt, "/chosen", "linux,initrd-end", 168 (initrd_base + initrd_size)); 169 170 qemu_fdt_setprop_string(fdt, "/chosen", "bootargs", 171 machine->kernel_cmdline); 172 173 /* Copy data from the host device tree into the guest. Since the guest can 174 * directly access the timebase without host involvement, we must expose 175 * the correct frequencies. */ 176 if (kvm_enabled()) { 177 tb_freq = kvmppc_get_tbfreq(); 178 clock_freq = kvmppc_get_clockfreq(); 179 } 180 181 qemu_fdt_setprop_cell(fdt, "/cpus/cpu@0", "clock-frequency", 182 clock_freq); 183 qemu_fdt_setprop_cell(fdt, "/cpus/cpu@0", "timebase-frequency", 184 tb_freq); 185 186 /* Remove cpm node if it exists (it is not emulated) */ 187 offset = fdt_path_offset(fdt, "/cpm"); 188 if (offset >= 0) { 189 _FDT(fdt_nop_node(fdt, offset)); 190 } 191 192 /* set serial port clocks */ 193 offset = fdt_node_offset_by_compatible(fdt, -1, "ns16550"); 194 while (offset >= 0) { 195 _FDT(fdt_setprop_cell(fdt, offset, "clock-frequency", UART_FREQ)); 196 offset = fdt_node_offset_by_compatible(fdt, offset, "ns16550"); 197 } 198 199 /* some more clocks */ 200 qemu_fdt_setprop_cell(fdt, "/plb", "clock-frequency", 201 PLB_FREQ); 202 qemu_fdt_setprop_cell(fdt, "/plb/opb", "clock-frequency", 203 OPB_FREQ); 204 qemu_fdt_setprop_cell(fdt, "/plb/opb/ebc", "clock-frequency", 205 EBC_FREQ); 206 207 rom_add_blob_fixed(BINARY_DEVICE_TREE_FILE, fdt, fdt_size, addr); 208 209 /* Set machine->fdt for 'dumpdtb' QMP/HMP command */ 210 machine->fdt = fdt; 211 212 return fdt_size; 213 } 214 215 /* Create reset TLB entries for BookE, mapping only the flash memory. */ 216 static void mmubooke_create_initial_mapping_uboot(CPUPPCState *env) 217 { 218 ppcemb_tlb_t *tlb = &env->tlb.tlbe[0]; 219 220 /* on reset the flash is mapped by a shadow TLB, 221 * but since we don't implement them we need to use 222 * the same values U-Boot will use to avoid a fault. 223 */ 224 tlb->attr = 0; 225 tlb->prot = PAGE_VALID | ((PAGE_READ | PAGE_WRITE | PAGE_EXEC) << 4); 226 tlb->size = 0x10000000; /* up to 0xffffffff */ 227 tlb->EPN = 0xf0000000 & TARGET_PAGE_MASK; 228 tlb->RPN = (0xf0000000 & TARGET_PAGE_MASK) | 0x4; 229 tlb->PID = 0; 230 } 231 232 /* Create reset TLB entries for BookE, spanning the 32bit addr space. */ 233 static void mmubooke_create_initial_mapping(CPUPPCState *env, 234 target_ulong va, 235 hwaddr pa) 236 { 237 ppcemb_tlb_t *tlb = &env->tlb.tlbe[0]; 238 239 tlb->attr = 0; 240 tlb->prot = PAGE_VALID | ((PAGE_READ | PAGE_WRITE | PAGE_EXEC) << 4); 241 tlb->size = 1 << 31; /* up to 0x80000000 */ 242 tlb->EPN = va & TARGET_PAGE_MASK; 243 tlb->RPN = pa & TARGET_PAGE_MASK; 244 tlb->PID = 0; 245 } 246 247 static void main_cpu_reset(void *opaque) 248 { 249 PowerPCCPU *cpu = opaque; 250 CPUPPCState *env = &cpu->env; 251 struct boot_info *bi = env->load_info; 252 253 cpu_reset(CPU(cpu)); 254 255 /* either we have a kernel to boot or we jump to U-Boot */ 256 if (bi->entry != UBOOT_ENTRY) { 257 env->gpr[1] = (16 * MiB) - 8; 258 env->gpr[3] = FDT_ADDR; 259 env->nip = bi->entry; 260 261 /* Create a mapping for the kernel. */ 262 mmubooke_create_initial_mapping(env, 0, 0); 263 env->gpr[6] = tswap32(EPAPR_MAGIC); 264 env->gpr[7] = (16 * MiB) - 8; /* bi->ima_size; */ 265 266 } else { 267 env->nip = UBOOT_ENTRY; 268 mmubooke_create_initial_mapping_uboot(env); 269 } 270 } 271 272 static void sam460ex_init(MachineState *machine) 273 { 274 MemoryRegion *l2cache_ram = g_new(MemoryRegion, 1); 275 DeviceState *uic[4]; 276 int i; 277 PCIBus *pci_bus; 278 USBBus *usb_bus; 279 PowerPCCPU *cpu; 280 CPUPPCState *env; 281 I2CBus *i2c; 282 hwaddr entry = UBOOT_ENTRY; 283 target_long initrd_size = 0; 284 DeviceState *dev; 285 SysBusDevice *sbdev; 286 struct boot_info *boot_info; 287 uint8_t *spd_data; 288 int success; 289 290 cpu = POWERPC_CPU(cpu_create(machine->cpu_type)); 291 env = &cpu->env; 292 if (env->mmu_model != POWERPC_MMU_BOOKE) { 293 error_report("Only MMU model BookE is supported by this machine."); 294 exit(1); 295 } 296 297 qemu_register_reset(main_cpu_reset, cpu); 298 boot_info = g_malloc0(sizeof(*boot_info)); 299 env->load_info = boot_info; 300 301 ppc_booke_timers_init(cpu, CPU_FREQ, 0); 302 ppc_dcr_init(env, NULL, NULL); 303 304 /* PLB arbitrer */ 305 dev = qdev_new(TYPE_PPC4xx_PLB); 306 ppc4xx_dcr_realize(PPC4xx_DCR_DEVICE(dev), cpu, &error_fatal); 307 object_unref(OBJECT(dev)); 308 309 /* interrupt controllers */ 310 for (i = 0; i < ARRAY_SIZE(uic); i++) { 311 /* 312 * UICs 1, 2 and 3 are cascaded through UIC 0. 313 * input_ints[n] is the interrupt number on UIC 0 which 314 * the INT output of UIC n is connected to. The CINT output 315 * of UIC n connects to input_ints[n] + 1. 316 * The entry in input_ints[] for UIC 0 is ignored, because UIC 0's 317 * INT and CINT outputs are connected to the CPU. 318 */ 319 const int input_ints[] = { -1, 30, 10, 16 }; 320 321 uic[i] = qdev_new(TYPE_PPC_UIC); 322 qdev_prop_set_uint32(uic[i], "dcr-base", 0xc0 + i * 0x10); 323 ppc4xx_dcr_realize(PPC4xx_DCR_DEVICE(uic[i]), cpu, &error_fatal); 324 object_unref(OBJECT(uic[i])); 325 326 sbdev = SYS_BUS_DEVICE(uic[i]); 327 if (i == 0) { 328 sysbus_connect_irq(sbdev, PPCUIC_OUTPUT_INT, 329 qdev_get_gpio_in(DEVICE(cpu), PPC40x_INPUT_INT)); 330 sysbus_connect_irq(sbdev, PPCUIC_OUTPUT_CINT, 331 qdev_get_gpio_in(DEVICE(cpu), PPC40x_INPUT_CINT)); 332 } else { 333 sysbus_connect_irq(sbdev, PPCUIC_OUTPUT_INT, 334 qdev_get_gpio_in(uic[0], input_ints[i])); 335 sysbus_connect_irq(sbdev, PPCUIC_OUTPUT_CINT, 336 qdev_get_gpio_in(uic[0], input_ints[i] + 1)); 337 } 338 } 339 340 /* SDRAM controller */ 341 /* The SoC could also handle 4 GiB but firmware does not work with that. */ 342 if (machine->ram_size > 2 * GiB) { 343 error_report("Memory over 2 GiB is not supported"); 344 exit(1); 345 } 346 /* Firmware needs at least 64 MiB */ 347 if (machine->ram_size < 64 * MiB) { 348 error_report("Memory below 64 MiB is not supported"); 349 exit(1); 350 } 351 dev = qdev_new(TYPE_PPC4xx_SDRAM_DDR2); 352 object_property_set_link(OBJECT(dev), "dram", OBJECT(machine->ram), 353 &error_abort); 354 /* 355 * Put all RAM on first bank because board has one slot 356 * and firmware only checks that 357 */ 358 object_property_set_int(OBJECT(dev), "nbanks", 1, &error_abort); 359 ppc4xx_dcr_realize(PPC4xx_DCR_DEVICE(dev), cpu, &error_fatal); 360 object_unref(OBJECT(dev)); 361 /* FIXME: does 460EX have ECC interrupts? */ 362 /* Enable SDRAM memory regions as we may boot without firmware */ 363 ppc4xx_sdram_ddr2_enable(PPC4xx_SDRAM_DDR2(dev)); 364 365 /* IIC controllers and devices */ 366 dev = sysbus_create_simple(TYPE_PPC4xx_I2C, 0x4ef600700, 367 qdev_get_gpio_in(uic[0], 2)); 368 i2c = PPC4xx_I2C(dev)->bus; 369 /* SPD EEPROM on RAM module */ 370 spd_data = spd_data_generate(machine->ram_size < 128 * MiB ? DDR : DDR2, 371 machine->ram_size); 372 spd_data[20] = 4; /* SO-DIMM module */ 373 smbus_eeprom_init_one(i2c, 0x50, spd_data); 374 /* RTC */ 375 i2c_slave_create_simple(i2c, "m41t80", 0x68); 376 377 dev = sysbus_create_simple(TYPE_PPC4xx_I2C, 0x4ef600800, 378 qdev_get_gpio_in(uic[0], 3)); 379 380 /* External bus controller */ 381 dev = qdev_new(TYPE_PPC4xx_EBC); 382 ppc4xx_dcr_realize(PPC4xx_DCR_DEVICE(dev), cpu, &error_fatal); 383 object_unref(OBJECT(dev)); 384 385 /* CPR */ 386 ppc4xx_cpr_init(env); 387 388 /* PLB to AHB bridge */ 389 ppc4xx_ahb_init(env); 390 391 /* System DCRs */ 392 ppc4xx_sdr_init(env); 393 394 /* MAL */ 395 dev = qdev_new(TYPE_PPC4xx_MAL); 396 qdev_prop_set_uint8(dev, "txc-num", 4); 397 qdev_prop_set_uint8(dev, "rxc-num", 16); 398 ppc4xx_dcr_realize(PPC4xx_DCR_DEVICE(dev), cpu, &error_fatal); 399 object_unref(OBJECT(dev)); 400 sbdev = SYS_BUS_DEVICE(dev); 401 for (i = 0; i < ARRAY_SIZE(PPC4xx_MAL(dev)->irqs); i++) { 402 sysbus_connect_irq(sbdev, i, qdev_get_gpio_in(uic[2], 3 + i)); 403 } 404 405 /* DMA */ 406 ppc4xx_dma_init(env, 0x200); 407 408 /* 256K of L2 cache as memory */ 409 ppc4xx_l2sram_init(env); 410 /* FIXME: remove this after fixing l2sram mapping in ppc440_uc.c? */ 411 memory_region_init_ram(l2cache_ram, NULL, "ppc440.l2cache_ram", 256 * KiB, 412 &error_abort); 413 memory_region_add_subregion(get_system_memory(), 0x400000000LL, 414 l2cache_ram); 415 416 /* USB */ 417 sysbus_create_simple(TYPE_PPC4xx_EHCI, 0x4bffd0400, 418 qdev_get_gpio_in(uic[2], 29)); 419 dev = qdev_new("sysbus-ohci"); 420 qdev_prop_set_string(dev, "masterbus", "usb-bus.0"); 421 qdev_prop_set_uint32(dev, "num-ports", 6); 422 sbdev = SYS_BUS_DEVICE(dev); 423 sysbus_realize_and_unref(sbdev, &error_fatal); 424 sysbus_mmio_map(sbdev, 0, 0x4bffd0000); 425 sysbus_connect_irq(sbdev, 0, qdev_get_gpio_in(uic[2], 30)); 426 usb_bus = USB_BUS(object_resolve_type_unambiguous(TYPE_USB_BUS, 427 &error_abort)); 428 usb_create_simple(usb_bus, "usb-kbd"); 429 usb_create_simple(usb_bus, "usb-mouse"); 430 431 /* PCIe buses */ 432 dev = qdev_new(TYPE_PPC460EX_PCIE_HOST); 433 qdev_prop_set_int32(dev, "busnum", 0); 434 qdev_prop_set_int32(dev, "dcrn-base", PCIE0_DCRN_BASE); 435 object_property_set_link(OBJECT(dev), "cpu", OBJECT(cpu), &error_abort); 436 sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal); 437 438 dev = qdev_new(TYPE_PPC460EX_PCIE_HOST); 439 qdev_prop_set_int32(dev, "busnum", 1); 440 qdev_prop_set_int32(dev, "dcrn-base", PCIE1_DCRN_BASE); 441 object_property_set_link(OBJECT(dev), "cpu", OBJECT(cpu), &error_abort); 442 sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal); 443 444 /* PCI bus */ 445 /* All PCI irqs are connected to the same UIC pin (cf. UBoot source) */ 446 dev = sysbus_create_simple(TYPE_PPC440_PCIX_HOST, 0xc0ec00000, 447 qdev_get_gpio_in(uic[1], 0)); 448 sysbus_mmio_map(SYS_BUS_DEVICE(dev), 1, 0xc08000000); 449 pci_bus = PCI_BUS(qdev_get_child_bus(dev, "pci.0")); 450 451 /* PCI devices */ 452 pci_create_simple(pci_bus, PCI_DEVFN(6, 0), "sm501"); 453 /* 454 * SoC has a single SATA port but we don't emulate that 455 * However, firmware and usual clients have driver for SiI311x 456 * PCI SATA card so add one for convenience by default 457 */ 458 if (defaults_enabled()) { 459 PCIIDEState *s = PCI_IDE(pci_create_simple(pci_bus, -1, "sii3112")); 460 DriveInfo *di; 461 462 di = drive_get_by_index(IF_IDE, 0); 463 if (di) { 464 ide_bus_create_drive(&s->bus[0], 0, di); 465 } 466 /* Use index 2 only if 1 does not exist, this allows -cdrom */ 467 di = drive_get_by_index(IF_IDE, 1) ?: drive_get_by_index(IF_IDE, 2); 468 if (di) { 469 ide_bus_create_drive(&s->bus[1], 0, di); 470 } 471 } 472 473 /* SoC has 4 UARTs but board has only one wired and two described in fdt */ 474 if (serial_hd(0) != NULL) { 475 serial_mm_init(get_system_memory(), 0x4ef600300, 0, 476 qdev_get_gpio_in(uic[1], 1), 477 PPC_SERIAL_MM_BAUDBASE, serial_hd(0), 478 DEVICE_BIG_ENDIAN); 479 } 480 if (serial_hd(1) != NULL) { 481 serial_mm_init(get_system_memory(), 0x4ef600400, 0, 482 qdev_get_gpio_in(uic[0], 1), 483 PPC_SERIAL_MM_BAUDBASE, serial_hd(1), 484 DEVICE_BIG_ENDIAN); 485 } 486 487 /* Load U-Boot image. */ 488 if (!machine->kernel_filename) { 489 success = sam460ex_load_uboot(); 490 if (success < 0) { 491 error_report("could not load firmware"); 492 exit(1); 493 } 494 } 495 496 /* Load kernel. */ 497 if (machine->kernel_filename) { 498 hwaddr loadaddr = LOAD_UIMAGE_LOADADDR_INVALID; 499 success = load_uimage(machine->kernel_filename, &entry, &loadaddr, 500 NULL, NULL, NULL); 501 if (success < 0) { 502 uint64_t elf_entry; 503 504 success = load_elf(machine->kernel_filename, NULL, NULL, NULL, 505 &elf_entry, NULL, NULL, NULL, 506 1, PPC_ELF_MACHINE, 0, 0); 507 entry = elf_entry; 508 } 509 /* XXX try again as binary */ 510 if (success < 0) { 511 error_report("could not load kernel '%s'", 512 machine->kernel_filename); 513 exit(1); 514 } 515 } 516 517 /* Load initrd. */ 518 if (machine->initrd_filename) { 519 initrd_size = load_image_targphys(machine->initrd_filename, 520 RAMDISK_ADDR, 521 machine->ram_size - RAMDISK_ADDR); 522 if (initrd_size < 0) { 523 error_report("could not load ram disk '%s' at %x", 524 machine->initrd_filename, RAMDISK_ADDR); 525 exit(1); 526 } 527 } 528 529 /* If we're loading a kernel directly, we must load the device tree too. */ 530 if (machine->kernel_filename) { 531 int dt_size; 532 533 dt_size = sam460ex_load_device_tree(machine, FDT_ADDR, 534 RAMDISK_ADDR, initrd_size); 535 536 boot_info->dt_base = FDT_ADDR; 537 boot_info->dt_size = dt_size; 538 } 539 540 boot_info->entry = entry; 541 } 542 543 static void sam460ex_machine_init(MachineClass *mc) 544 { 545 mc->desc = "aCube Sam460ex"; 546 mc->init = sam460ex_init; 547 mc->block_default_type = IF_IDE; 548 mc->default_cpu_type = POWERPC_CPU_TYPE_NAME("460exb"); 549 mc->default_ram_size = 512 * MiB; 550 mc->default_ram_id = "ppc4xx.sdram"; 551 } 552 553 DEFINE_MACHINE("sam460ex", sam460ex_machine_init) 554