xref: /qemu/hw/arm/npcm7xx.c (revision 0ec8384f)
1 /*
2  * Nuvoton NPCM7xx SoC family.
3  *
4  * Copyright 2020 Google LLC
5  *
6  * This program is free software; you can redistribute it and/or modify it
7  * under the terms of the GNU General Public License as published by the
8  * Free Software Foundation; either version 2 of the License, or
9  * (at your option) any later version.
10  *
11  * This program is distributed in the hope that it will be useful, but WITHOUT
12  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13  * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14  * for more details.
15  */
16 
17 #include "qemu/osdep.h"
18 
19 #include "hw/arm/boot.h"
20 #include "hw/arm/npcm7xx.h"
21 #include "hw/char/serial.h"
22 #include "hw/loader.h"
23 #include "hw/misc/unimp.h"
24 #include "hw/qdev-clock.h"
25 #include "hw/qdev-properties.h"
26 #include "qapi/error.h"
27 #include "qemu/units.h"
28 #include "sysemu/sysemu.h"
29 
30 /*
31  * This covers the whole MMIO space. We'll use this to catch any MMIO accesses
32  * that aren't handled by any device.
33  */
34 #define NPCM7XX_MMIO_BA         (0x80000000)
35 #define NPCM7XX_MMIO_SZ         (0x7ffd0000)
36 
37 /* OTP key storage and fuse strap array */
38 #define NPCM7XX_OTP1_BA         (0xf0189000)
39 #define NPCM7XX_OTP2_BA         (0xf018a000)
40 
41 /* Core system modules. */
42 #define NPCM7XX_L2C_BA          (0xf03fc000)
43 #define NPCM7XX_CPUP_BA         (0xf03fe000)
44 #define NPCM7XX_GCR_BA          (0xf0800000)
45 #define NPCM7XX_CLK_BA          (0xf0801000)
46 #define NPCM7XX_MC_BA           (0xf0824000)
47 #define NPCM7XX_RNG_BA          (0xf000b000)
48 
49 /* USB Host modules */
50 #define NPCM7XX_EHCI_BA         (0xf0806000)
51 #define NPCM7XX_OHCI_BA         (0xf0807000)
52 
53 /* ADC Module */
54 #define NPCM7XX_ADC_BA          (0xf000c000)
55 
56 /* Internal AHB SRAM */
57 #define NPCM7XX_RAM3_BA         (0xc0008000)
58 #define NPCM7XX_RAM3_SZ         (4 * KiB)
59 
60 /* Memory blocks at the end of the address space */
61 #define NPCM7XX_RAM2_BA         (0xfffd0000)
62 #define NPCM7XX_RAM2_SZ         (128 * KiB)
63 #define NPCM7XX_ROM_BA          (0xffff0000)
64 #define NPCM7XX_ROM_SZ          (64 * KiB)
65 
66 /* SDHCI Modules */
67 #define NPCM7XX_MMC_BA          (0xf0842000)
68 
69 /* Clock configuration values to be fixed up when bypassing bootloader */
70 
71 /* Run PLL1 at 1600 MHz */
72 #define NPCM7XX_PLLCON1_FIXUP_VAL   (0x00402101)
73 /* Run the CPU from PLL1 and UART from PLL2 */
74 #define NPCM7XX_CLKSEL_FIXUP_VAL    (0x004aaba9)
75 
76 /*
77  * Interrupt lines going into the GIC. This does not include internal Cortex-A9
78  * interrupts.
79  */
80 enum NPCM7xxInterrupt {
81     NPCM7XX_ADC_IRQ             = 0,
82     NPCM7XX_UART0_IRQ           = 2,
83     NPCM7XX_UART1_IRQ,
84     NPCM7XX_UART2_IRQ,
85     NPCM7XX_UART3_IRQ,
86     NPCM7XX_EMC1RX_IRQ          = 15,
87     NPCM7XX_EMC1TX_IRQ,
88     NPCM7XX_MMC_IRQ             = 26,
89     NPCM7XX_PSPI2_IRQ           = 28,
90     NPCM7XX_PSPI1_IRQ           = 31,
91     NPCM7XX_TIMER0_IRQ          = 32,   /* Timer Module 0 */
92     NPCM7XX_TIMER1_IRQ,
93     NPCM7XX_TIMER2_IRQ,
94     NPCM7XX_TIMER3_IRQ,
95     NPCM7XX_TIMER4_IRQ,
96     NPCM7XX_TIMER5_IRQ,                 /* Timer Module 1 */
97     NPCM7XX_TIMER6_IRQ,
98     NPCM7XX_TIMER7_IRQ,
99     NPCM7XX_TIMER8_IRQ,
100     NPCM7XX_TIMER9_IRQ,
101     NPCM7XX_TIMER10_IRQ,                /* Timer Module 2 */
102     NPCM7XX_TIMER11_IRQ,
103     NPCM7XX_TIMER12_IRQ,
104     NPCM7XX_TIMER13_IRQ,
105     NPCM7XX_TIMER14_IRQ,
106     NPCM7XX_WDG0_IRQ            = 47,   /* Timer Module 0 Watchdog */
107     NPCM7XX_WDG1_IRQ,                   /* Timer Module 1 Watchdog */
108     NPCM7XX_WDG2_IRQ,                   /* Timer Module 2 Watchdog */
109     NPCM7XX_EHCI_IRQ            = 61,
110     NPCM7XX_OHCI_IRQ            = 62,
111     NPCM7XX_SMBUS0_IRQ          = 64,
112     NPCM7XX_SMBUS1_IRQ,
113     NPCM7XX_SMBUS2_IRQ,
114     NPCM7XX_SMBUS3_IRQ,
115     NPCM7XX_SMBUS4_IRQ,
116     NPCM7XX_SMBUS5_IRQ,
117     NPCM7XX_SMBUS6_IRQ,
118     NPCM7XX_SMBUS7_IRQ,
119     NPCM7XX_SMBUS8_IRQ,
120     NPCM7XX_SMBUS9_IRQ,
121     NPCM7XX_SMBUS10_IRQ,
122     NPCM7XX_SMBUS11_IRQ,
123     NPCM7XX_SMBUS12_IRQ,
124     NPCM7XX_SMBUS13_IRQ,
125     NPCM7XX_SMBUS14_IRQ,
126     NPCM7XX_SMBUS15_IRQ,
127     NPCM7XX_PWM0_IRQ            = 93,   /* PWM module 0 */
128     NPCM7XX_PWM1_IRQ,                   /* PWM module 1 */
129     NPCM7XX_MFT0_IRQ            = 96,   /* MFT module 0 */
130     NPCM7XX_MFT1_IRQ,                   /* MFT module 1 */
131     NPCM7XX_MFT2_IRQ,                   /* MFT module 2 */
132     NPCM7XX_MFT3_IRQ,                   /* MFT module 3 */
133     NPCM7XX_MFT4_IRQ,                   /* MFT module 4 */
134     NPCM7XX_MFT5_IRQ,                   /* MFT module 5 */
135     NPCM7XX_MFT6_IRQ,                   /* MFT module 6 */
136     NPCM7XX_MFT7_IRQ,                   /* MFT module 7 */
137     NPCM7XX_EMC2RX_IRQ          = 114,
138     NPCM7XX_EMC2TX_IRQ,
139     NPCM7XX_GPIO0_IRQ           = 116,
140     NPCM7XX_GPIO1_IRQ,
141     NPCM7XX_GPIO2_IRQ,
142     NPCM7XX_GPIO3_IRQ,
143     NPCM7XX_GPIO4_IRQ,
144     NPCM7XX_GPIO5_IRQ,
145     NPCM7XX_GPIO6_IRQ,
146     NPCM7XX_GPIO7_IRQ,
147 };
148 
149 /* Total number of GIC interrupts, including internal Cortex-A9 interrupts. */
150 #define NPCM7XX_NUM_IRQ         (160)
151 
152 /* Register base address for each Timer Module */
153 static const hwaddr npcm7xx_tim_addr[] = {
154     0xf0008000,
155     0xf0009000,
156     0xf000a000,
157 };
158 
159 /* Register base address for each 16550 UART */
160 static const hwaddr npcm7xx_uart_addr[] = {
161     0xf0001000,
162     0xf0002000,
163     0xf0003000,
164     0xf0004000,
165 };
166 
167 /* Direct memory-mapped access to SPI0 CS0-1. */
168 static const hwaddr npcm7xx_fiu0_flash_addr[] = {
169     0x80000000, /* CS0 */
170     0x88000000, /* CS1 */
171 };
172 
173 /* Direct memory-mapped access to SPI3 CS0-3. */
174 static const hwaddr npcm7xx_fiu3_flash_addr[] = {
175     0xa0000000, /* CS0 */
176     0xa8000000, /* CS1 */
177     0xb0000000, /* CS2 */
178     0xb8000000, /* CS3 */
179 };
180 
181 /* Register base address for each PWM Module */
182 static const hwaddr npcm7xx_pwm_addr[] = {
183     0xf0103000,
184     0xf0104000,
185 };
186 
187 /* Register base address for each MFT Module */
188 static const hwaddr npcm7xx_mft_addr[] = {
189     0xf0180000,
190     0xf0181000,
191     0xf0182000,
192     0xf0183000,
193     0xf0184000,
194     0xf0185000,
195     0xf0186000,
196     0xf0187000,
197 };
198 
199 /* Direct memory-mapped access to each SMBus Module. */
200 static const hwaddr npcm7xx_smbus_addr[] = {
201     0xf0080000,
202     0xf0081000,
203     0xf0082000,
204     0xf0083000,
205     0xf0084000,
206     0xf0085000,
207     0xf0086000,
208     0xf0087000,
209     0xf0088000,
210     0xf0089000,
211     0xf008a000,
212     0xf008b000,
213     0xf008c000,
214     0xf008d000,
215     0xf008e000,
216     0xf008f000,
217 };
218 
219 /* Register base address for each EMC Module */
220 static const hwaddr npcm7xx_emc_addr[] = {
221     0xf0825000,
222     0xf0826000,
223 };
224 
225 /* Register base address for each PSPI Module */
226 static const hwaddr npcm7xx_pspi_addr[] = {
227     0xf0200000,
228     0xf0201000,
229 };
230 
231 static const struct {
232     hwaddr regs_addr;
233     uint32_t unconnected_pins;
234     uint32_t reset_pu;
235     uint32_t reset_pd;
236     uint32_t reset_osrc;
237     uint32_t reset_odsc;
238 } npcm7xx_gpio[] = {
239     {
240         .regs_addr = 0xf0010000,
241         .reset_pu = 0xff03ffff,
242         .reset_pd = 0x00fc0000,
243     }, {
244         .regs_addr = 0xf0011000,
245         .unconnected_pins = 0x0000001e,
246         .reset_pu = 0xfefffe07,
247         .reset_pd = 0x010001e0,
248     }, {
249         .regs_addr = 0xf0012000,
250         .reset_pu = 0x780fffff,
251         .reset_pd = 0x07f00000,
252         .reset_odsc = 0x00700000,
253     }, {
254         .regs_addr = 0xf0013000,
255         .reset_pu = 0x00fc0000,
256         .reset_pd = 0xff000000,
257     }, {
258         .regs_addr = 0xf0014000,
259         .reset_pu = 0xffffffff,
260     }, {
261         .regs_addr = 0xf0015000,
262         .reset_pu = 0xbf83f801,
263         .reset_pd = 0x007c0000,
264         .reset_osrc = 0x000000f1,
265         .reset_odsc = 0x3f9f80f1,
266     }, {
267         .regs_addr = 0xf0016000,
268         .reset_pu = 0xfc00f801,
269         .reset_pd = 0x000007fe,
270         .reset_odsc = 0x00000800,
271     }, {
272         .regs_addr = 0xf0017000,
273         .unconnected_pins = 0xffffff00,
274         .reset_pu = 0x0000007f,
275         .reset_osrc = 0x0000007f,
276         .reset_odsc = 0x0000007f,
277     },
278 };
279 
280 static const struct {
281     const char *name;
282     hwaddr regs_addr;
283     int cs_count;
284     const hwaddr *flash_addr;
285 } npcm7xx_fiu[] = {
286     {
287         .name = "fiu0",
288         .regs_addr = 0xfb000000,
289         .cs_count = ARRAY_SIZE(npcm7xx_fiu0_flash_addr),
290         .flash_addr = npcm7xx_fiu0_flash_addr,
291     }, {
292         .name = "fiu3",
293         .regs_addr = 0xc0000000,
294         .cs_count = ARRAY_SIZE(npcm7xx_fiu3_flash_addr),
295         .flash_addr = npcm7xx_fiu3_flash_addr,
296     },
297 };
298 
299 static void npcm7xx_write_board_setup(ARMCPU *cpu,
300                                       const struct arm_boot_info *info)
301 {
302     uint32_t board_setup[] = {
303         0xe59f0010,     /* ldr r0, clk_base_addr */
304         0xe59f1010,     /* ldr r1, pllcon1_value */
305         0xe5801010,     /* str r1, [r0, #16] */
306         0xe59f100c,     /* ldr r1, clksel_value */
307         0xe5801004,     /* str r1, [r0, #4] */
308         0xe12fff1e,     /* bx lr */
309         NPCM7XX_CLK_BA,
310         NPCM7XX_PLLCON1_FIXUP_VAL,
311         NPCM7XX_CLKSEL_FIXUP_VAL,
312     };
313     int i;
314 
315     for (i = 0; i < ARRAY_SIZE(board_setup); i++) {
316         board_setup[i] = tswap32(board_setup[i]);
317     }
318     rom_add_blob_fixed("board-setup", board_setup, sizeof(board_setup),
319                        info->board_setup_addr);
320 }
321 
322 static void npcm7xx_write_secondary_boot(ARMCPU *cpu,
323                                          const struct arm_boot_info *info)
324 {
325     /*
326      * The default smpboot stub halts the secondary CPU with a 'wfi'
327      * instruction, but the arch/arm/mach-npcm/platsmp.c in the Linux kernel
328      * does not send an IPI to wake it up, so the second CPU fails to boot. So
329      * we need to provide our own smpboot stub that can not use 'wfi', it has
330      * to spin the secondary CPU until the first CPU writes to the SCRPAD reg.
331      */
332     uint32_t smpboot[] = {
333         0xe59f2018,     /* ldr r2, bootreg_addr */
334         0xe3a00000,     /* mov r0, #0 */
335         0xe5820000,     /* str r0, [r2] */
336         0xe320f002,     /* wfe */
337         0xe5921000,     /* ldr r1, [r2] */
338         0xe1110001,     /* tst r1, r1 */
339         0x0afffffb,     /* beq <wfe> */
340         0xe12fff11,     /* bx r1 */
341         NPCM7XX_SMP_BOOTREG_ADDR,
342     };
343     int i;
344 
345     for (i = 0; i < ARRAY_SIZE(smpboot); i++) {
346         smpboot[i] = tswap32(smpboot[i]);
347     }
348 
349     rom_add_blob_fixed("smpboot", smpboot, sizeof(smpboot),
350                        NPCM7XX_SMP_LOADER_START);
351 }
352 
353 static struct arm_boot_info npcm7xx_binfo = {
354     .loader_start           = NPCM7XX_LOADER_START,
355     .smp_loader_start       = NPCM7XX_SMP_LOADER_START,
356     .smp_bootreg_addr       = NPCM7XX_SMP_BOOTREG_ADDR,
357     .gic_cpu_if_addr        = NPCM7XX_GIC_CPU_IF_ADDR,
358     .write_secondary_boot   = npcm7xx_write_secondary_boot,
359     .board_id               = -1,
360     .board_setup_addr       = NPCM7XX_BOARD_SETUP_ADDR,
361     .write_board_setup      = npcm7xx_write_board_setup,
362 };
363 
364 void npcm7xx_load_kernel(MachineState *machine, NPCM7xxState *soc)
365 {
366     npcm7xx_binfo.ram_size = machine->ram_size;
367 
368     arm_load_kernel(&soc->cpu[0], machine, &npcm7xx_binfo);
369 }
370 
371 static void npcm7xx_init_fuses(NPCM7xxState *s)
372 {
373     NPCM7xxClass *nc = NPCM7XX_GET_CLASS(s);
374     uint32_t value;
375 
376     /*
377      * The initial mask of disabled modules indicates the chip derivative (e.g.
378      * NPCM750 or NPCM730).
379      */
380     value = tswap32(nc->disabled_modules);
381     npcm7xx_otp_array_write(&s->fuse_array, &value, NPCM7XX_FUSE_DERIVATIVE,
382                             sizeof(value));
383 }
384 
385 static void npcm7xx_write_adc_calibration(NPCM7xxState *s)
386 {
387     /* Both ADC and the fuse array must have realized. */
388     QEMU_BUILD_BUG_ON(sizeof(s->adc.calibration_r_values) != 4);
389     npcm7xx_otp_array_write(&s->fuse_array, s->adc.calibration_r_values,
390             NPCM7XX_FUSE_ADC_CALIB, sizeof(s->adc.calibration_r_values));
391 }
392 
393 static qemu_irq npcm7xx_irq(NPCM7xxState *s, int n)
394 {
395     return qdev_get_gpio_in(DEVICE(&s->a9mpcore), n);
396 }
397 
398 static void npcm7xx_init(Object *obj)
399 {
400     NPCM7xxState *s = NPCM7XX(obj);
401     int i;
402 
403     for (i = 0; i < NPCM7XX_MAX_NUM_CPUS; i++) {
404         object_initialize_child(obj, "cpu[*]", &s->cpu[i],
405                                 ARM_CPU_TYPE_NAME("cortex-a9"));
406     }
407 
408     object_initialize_child(obj, "a9mpcore", &s->a9mpcore, TYPE_A9MPCORE_PRIV);
409     object_initialize_child(obj, "gcr", &s->gcr, TYPE_NPCM7XX_GCR);
410     object_property_add_alias(obj, "power-on-straps", OBJECT(&s->gcr),
411                               "power-on-straps");
412     object_initialize_child(obj, "clk", &s->clk, TYPE_NPCM7XX_CLK);
413     object_initialize_child(obj, "otp1", &s->key_storage,
414                             TYPE_NPCM7XX_KEY_STORAGE);
415     object_initialize_child(obj, "otp2", &s->fuse_array,
416                             TYPE_NPCM7XX_FUSE_ARRAY);
417     object_initialize_child(obj, "mc", &s->mc, TYPE_NPCM7XX_MC);
418     object_initialize_child(obj, "rng", &s->rng, TYPE_NPCM7XX_RNG);
419     object_initialize_child(obj, "adc", &s->adc, TYPE_NPCM7XX_ADC);
420 
421     for (i = 0; i < ARRAY_SIZE(s->tim); i++) {
422         object_initialize_child(obj, "tim[*]", &s->tim[i], TYPE_NPCM7XX_TIMER);
423     }
424 
425     for (i = 0; i < ARRAY_SIZE(s->gpio); i++) {
426         object_initialize_child(obj, "gpio[*]", &s->gpio[i], TYPE_NPCM7XX_GPIO);
427     }
428 
429     for (i = 0; i < ARRAY_SIZE(s->smbus); i++) {
430         object_initialize_child(obj, "smbus[*]", &s->smbus[i],
431                                 TYPE_NPCM7XX_SMBUS);
432     }
433 
434     object_initialize_child(obj, "ehci", &s->ehci, TYPE_NPCM7XX_EHCI);
435     object_initialize_child(obj, "ohci", &s->ohci, TYPE_SYSBUS_OHCI);
436 
437     QEMU_BUILD_BUG_ON(ARRAY_SIZE(npcm7xx_fiu) != ARRAY_SIZE(s->fiu));
438     for (i = 0; i < ARRAY_SIZE(s->fiu); i++) {
439         object_initialize_child(obj, npcm7xx_fiu[i].name, &s->fiu[i],
440                                 TYPE_NPCM7XX_FIU);
441     }
442 
443     for (i = 0; i < ARRAY_SIZE(s->pwm); i++) {
444         object_initialize_child(obj, "pwm[*]", &s->pwm[i], TYPE_NPCM7XX_PWM);
445     }
446 
447     for (i = 0; i < ARRAY_SIZE(s->mft); i++) {
448         object_initialize_child(obj, "mft[*]", &s->mft[i], TYPE_NPCM7XX_MFT);
449     }
450 
451     for (i = 0; i < ARRAY_SIZE(s->emc); i++) {
452         object_initialize_child(obj, "emc[*]", &s->emc[i], TYPE_NPCM7XX_EMC);
453     }
454 
455     for (i = 0; i < ARRAY_SIZE(s->pspi); i++) {
456         object_initialize_child(obj, "pspi[*]", &s->pspi[i], TYPE_NPCM_PSPI);
457     }
458 
459     object_initialize_child(obj, "mmc", &s->mmc, TYPE_NPCM7XX_SDHCI);
460 }
461 
462 static void npcm7xx_realize(DeviceState *dev, Error **errp)
463 {
464     NPCM7xxState *s = NPCM7XX(dev);
465     NPCM7xxClass *nc = NPCM7XX_GET_CLASS(s);
466     int i;
467 
468     if (memory_region_size(s->dram) > NPCM7XX_DRAM_SZ) {
469         error_setg(errp, "%s: NPCM7xx cannot address more than %" PRIu64
470                    " MiB of DRAM", __func__, NPCM7XX_DRAM_SZ / MiB);
471         return;
472     }
473 
474     /* CPUs */
475     for (i = 0; i < nc->num_cpus; i++) {
476         object_property_set_int(OBJECT(&s->cpu[i]), "mp-affinity",
477                                 arm_cpu_mp_affinity(i, NPCM7XX_MAX_NUM_CPUS),
478                                 &error_abort);
479         object_property_set_int(OBJECT(&s->cpu[i]), "reset-cbar",
480                                 NPCM7XX_GIC_CPU_IF_ADDR, &error_abort);
481         object_property_set_bool(OBJECT(&s->cpu[i]), "reset-hivecs", true,
482                                  &error_abort);
483 
484         /* Disable security extensions. */
485         object_property_set_bool(OBJECT(&s->cpu[i]), "has_el3", false,
486                                  &error_abort);
487 
488         if (!qdev_realize(DEVICE(&s->cpu[i]), NULL, errp)) {
489             return;
490         }
491     }
492 
493     /* A9MPCORE peripherals. Can only fail if we pass bad parameters here. */
494     object_property_set_int(OBJECT(&s->a9mpcore), "num-cpu", nc->num_cpus,
495                             &error_abort);
496     object_property_set_int(OBJECT(&s->a9mpcore), "num-irq", NPCM7XX_NUM_IRQ,
497                             &error_abort);
498     sysbus_realize(SYS_BUS_DEVICE(&s->a9mpcore), &error_abort);
499     sysbus_mmio_map(SYS_BUS_DEVICE(&s->a9mpcore), 0, NPCM7XX_CPUP_BA);
500 
501     for (i = 0; i < nc->num_cpus; i++) {
502         sysbus_connect_irq(SYS_BUS_DEVICE(&s->a9mpcore), i,
503                            qdev_get_gpio_in(DEVICE(&s->cpu[i]), ARM_CPU_IRQ));
504         sysbus_connect_irq(SYS_BUS_DEVICE(&s->a9mpcore), i + nc->num_cpus,
505                            qdev_get_gpio_in(DEVICE(&s->cpu[i]), ARM_CPU_FIQ));
506     }
507 
508     /* L2 cache controller */
509     sysbus_create_simple("l2x0", NPCM7XX_L2C_BA, NULL);
510 
511     /* System Global Control Registers (GCR). Can fail due to user input. */
512     object_property_set_int(OBJECT(&s->gcr), "disabled-modules",
513                             nc->disabled_modules, &error_abort);
514     object_property_add_const_link(OBJECT(&s->gcr), "dram-mr", OBJECT(s->dram));
515     if (!sysbus_realize(SYS_BUS_DEVICE(&s->gcr), errp)) {
516         return;
517     }
518     sysbus_mmio_map(SYS_BUS_DEVICE(&s->gcr), 0, NPCM7XX_GCR_BA);
519 
520     /* Clock Control Registers (CLK). Cannot fail. */
521     sysbus_realize(SYS_BUS_DEVICE(&s->clk), &error_abort);
522     sysbus_mmio_map(SYS_BUS_DEVICE(&s->clk), 0, NPCM7XX_CLK_BA);
523 
524     /* OTP key storage and fuse strap array. Cannot fail. */
525     sysbus_realize(SYS_BUS_DEVICE(&s->key_storage), &error_abort);
526     sysbus_mmio_map(SYS_BUS_DEVICE(&s->key_storage), 0, NPCM7XX_OTP1_BA);
527     sysbus_realize(SYS_BUS_DEVICE(&s->fuse_array), &error_abort);
528     sysbus_mmio_map(SYS_BUS_DEVICE(&s->fuse_array), 0, NPCM7XX_OTP2_BA);
529     npcm7xx_init_fuses(s);
530 
531     /* Fake Memory Controller (MC). Cannot fail. */
532     sysbus_realize(SYS_BUS_DEVICE(&s->mc), &error_abort);
533     sysbus_mmio_map(SYS_BUS_DEVICE(&s->mc), 0, NPCM7XX_MC_BA);
534 
535     /* ADC Modules. Cannot fail. */
536     qdev_connect_clock_in(DEVICE(&s->adc), "clock", qdev_get_clock_out(
537                           DEVICE(&s->clk), "adc-clock"));
538     sysbus_realize(SYS_BUS_DEVICE(&s->adc), &error_abort);
539     sysbus_mmio_map(SYS_BUS_DEVICE(&s->adc), 0, NPCM7XX_ADC_BA);
540     sysbus_connect_irq(SYS_BUS_DEVICE(&s->adc), 0,
541             npcm7xx_irq(s, NPCM7XX_ADC_IRQ));
542     npcm7xx_write_adc_calibration(s);
543 
544     /* Timer Modules (TIM). Cannot fail. */
545     QEMU_BUILD_BUG_ON(ARRAY_SIZE(npcm7xx_tim_addr) != ARRAY_SIZE(s->tim));
546     for (i = 0; i < ARRAY_SIZE(s->tim); i++) {
547         SysBusDevice *sbd = SYS_BUS_DEVICE(&s->tim[i]);
548         int first_irq;
549         int j;
550 
551         /* Connect the timer clock. */
552         qdev_connect_clock_in(DEVICE(&s->tim[i]), "clock", qdev_get_clock_out(
553                     DEVICE(&s->clk), "timer-clock"));
554 
555         sysbus_realize(sbd, &error_abort);
556         sysbus_mmio_map(sbd, 0, npcm7xx_tim_addr[i]);
557 
558         first_irq = NPCM7XX_TIMER0_IRQ + i * NPCM7XX_TIMERS_PER_CTRL;
559         for (j = 0; j < NPCM7XX_TIMERS_PER_CTRL; j++) {
560             qemu_irq irq = npcm7xx_irq(s, first_irq + j);
561             sysbus_connect_irq(sbd, j, irq);
562         }
563 
564         /* IRQ for watchdogs */
565         sysbus_connect_irq(sbd, NPCM7XX_TIMERS_PER_CTRL,
566                 npcm7xx_irq(s, NPCM7XX_WDG0_IRQ + i));
567         /* GPIO that connects clk module with watchdog */
568         qdev_connect_gpio_out_named(DEVICE(&s->tim[i]),
569                 NPCM7XX_WATCHDOG_RESET_GPIO_OUT, 0,
570                 qdev_get_gpio_in_named(DEVICE(&s->clk),
571                         NPCM7XX_WATCHDOG_RESET_GPIO_IN, i));
572     }
573 
574     /* UART0..3 (16550 compatible) */
575     for (i = 0; i < ARRAY_SIZE(npcm7xx_uart_addr); i++) {
576         serial_mm_init(get_system_memory(), npcm7xx_uart_addr[i], 2,
577                        npcm7xx_irq(s, NPCM7XX_UART0_IRQ + i), 115200,
578                        serial_hd(i), DEVICE_LITTLE_ENDIAN);
579     }
580 
581     /* Random Number Generator. Cannot fail. */
582     sysbus_realize(SYS_BUS_DEVICE(&s->rng), &error_abort);
583     sysbus_mmio_map(SYS_BUS_DEVICE(&s->rng), 0, NPCM7XX_RNG_BA);
584 
585     /* GPIO modules. Cannot fail. */
586     QEMU_BUILD_BUG_ON(ARRAY_SIZE(npcm7xx_gpio) != ARRAY_SIZE(s->gpio));
587     for (i = 0; i < ARRAY_SIZE(s->gpio); i++) {
588         Object *obj = OBJECT(&s->gpio[i]);
589 
590         object_property_set_uint(obj, "reset-pullup",
591                                  npcm7xx_gpio[i].reset_pu, &error_abort);
592         object_property_set_uint(obj, "reset-pulldown",
593                                  npcm7xx_gpio[i].reset_pd, &error_abort);
594         object_property_set_uint(obj, "reset-osrc",
595                                  npcm7xx_gpio[i].reset_osrc, &error_abort);
596         object_property_set_uint(obj, "reset-odsc",
597                                  npcm7xx_gpio[i].reset_odsc, &error_abort);
598         sysbus_realize(SYS_BUS_DEVICE(obj), &error_abort);
599         sysbus_mmio_map(SYS_BUS_DEVICE(obj), 0, npcm7xx_gpio[i].regs_addr);
600         sysbus_connect_irq(SYS_BUS_DEVICE(obj), 0,
601                            npcm7xx_irq(s, NPCM7XX_GPIO0_IRQ + i));
602     }
603 
604     /* SMBus modules. Cannot fail. */
605     QEMU_BUILD_BUG_ON(ARRAY_SIZE(npcm7xx_smbus_addr) != ARRAY_SIZE(s->smbus));
606     for (i = 0; i < ARRAY_SIZE(s->smbus); i++) {
607         Object *obj = OBJECT(&s->smbus[i]);
608 
609         sysbus_realize(SYS_BUS_DEVICE(obj), &error_abort);
610         sysbus_mmio_map(SYS_BUS_DEVICE(obj), 0, npcm7xx_smbus_addr[i]);
611         sysbus_connect_irq(SYS_BUS_DEVICE(obj), 0,
612                            npcm7xx_irq(s, NPCM7XX_SMBUS0_IRQ + i));
613     }
614 
615     /* USB Host */
616     object_property_set_bool(OBJECT(&s->ehci), "companion-enable", true,
617                              &error_abort);
618     sysbus_realize(SYS_BUS_DEVICE(&s->ehci), &error_abort);
619     sysbus_mmio_map(SYS_BUS_DEVICE(&s->ehci), 0, NPCM7XX_EHCI_BA);
620     sysbus_connect_irq(SYS_BUS_DEVICE(&s->ehci), 0,
621                        npcm7xx_irq(s, NPCM7XX_EHCI_IRQ));
622 
623     object_property_set_str(OBJECT(&s->ohci), "masterbus", "usb-bus.0",
624                             &error_abort);
625     object_property_set_uint(OBJECT(&s->ohci), "num-ports", 1, &error_abort);
626     sysbus_realize(SYS_BUS_DEVICE(&s->ohci), &error_abort);
627     sysbus_mmio_map(SYS_BUS_DEVICE(&s->ohci), 0, NPCM7XX_OHCI_BA);
628     sysbus_connect_irq(SYS_BUS_DEVICE(&s->ohci), 0,
629                        npcm7xx_irq(s, NPCM7XX_OHCI_IRQ));
630 
631     /* PWM Modules. Cannot fail. */
632     QEMU_BUILD_BUG_ON(ARRAY_SIZE(npcm7xx_pwm_addr) != ARRAY_SIZE(s->pwm));
633     for (i = 0; i < ARRAY_SIZE(s->pwm); i++) {
634         SysBusDevice *sbd = SYS_BUS_DEVICE(&s->pwm[i]);
635 
636         qdev_connect_clock_in(DEVICE(&s->pwm[i]), "clock", qdev_get_clock_out(
637                     DEVICE(&s->clk), "apb3-clock"));
638         sysbus_realize(sbd, &error_abort);
639         sysbus_mmio_map(sbd, 0, npcm7xx_pwm_addr[i]);
640         sysbus_connect_irq(sbd, i, npcm7xx_irq(s, NPCM7XX_PWM0_IRQ + i));
641     }
642 
643     /* MFT Modules. Cannot fail. */
644     QEMU_BUILD_BUG_ON(ARRAY_SIZE(npcm7xx_mft_addr) != ARRAY_SIZE(s->mft));
645     for (i = 0; i < ARRAY_SIZE(s->mft); i++) {
646         SysBusDevice *sbd = SYS_BUS_DEVICE(&s->mft[i]);
647 
648         qdev_connect_clock_in(DEVICE(&s->mft[i]), "clock-in",
649                               qdev_get_clock_out(DEVICE(&s->clk),
650                                                  "apb4-clock"));
651         sysbus_realize(sbd, &error_abort);
652         sysbus_mmio_map(sbd, 0, npcm7xx_mft_addr[i]);
653         sysbus_connect_irq(sbd, 0, npcm7xx_irq(s, NPCM7XX_MFT0_IRQ + i));
654     }
655 
656     /*
657      * EMC Modules. Cannot fail.
658      * The mapping of the device to its netdev backend works as follows:
659      * emc[i] = nd_table[i]
660      * This works around the inability to specify the netdev property for the
661      * emc device: it's not pluggable and thus the -device option can't be
662      * used.
663      */
664     QEMU_BUILD_BUG_ON(ARRAY_SIZE(npcm7xx_emc_addr) != ARRAY_SIZE(s->emc));
665     QEMU_BUILD_BUG_ON(ARRAY_SIZE(s->emc) != 2);
666     for (i = 0; i < ARRAY_SIZE(s->emc); i++) {
667         s->emc[i].emc_num = i;
668         SysBusDevice *sbd = SYS_BUS_DEVICE(&s->emc[i]);
669         if (nd_table[i].used) {
670             qemu_check_nic_model(&nd_table[i], TYPE_NPCM7XX_EMC);
671             qdev_set_nic_properties(DEVICE(sbd), &nd_table[i]);
672         }
673         /*
674          * The device exists regardless of whether it's connected to a QEMU
675          * netdev backend. So always instantiate it even if there is no
676          * backend.
677          */
678         sysbus_realize(sbd, &error_abort);
679         sysbus_mmio_map(sbd, 0, npcm7xx_emc_addr[i]);
680         int tx_irq = i == 0 ? NPCM7XX_EMC1TX_IRQ : NPCM7XX_EMC2TX_IRQ;
681         int rx_irq = i == 0 ? NPCM7XX_EMC1RX_IRQ : NPCM7XX_EMC2RX_IRQ;
682         /*
683          * N.B. The values for the second argument sysbus_connect_irq are
684          * chosen to match the registration order in npcm7xx_emc_realize.
685          */
686         sysbus_connect_irq(sbd, 0, npcm7xx_irq(s, tx_irq));
687         sysbus_connect_irq(sbd, 1, npcm7xx_irq(s, rx_irq));
688     }
689 
690     /*
691      * Flash Interface Unit (FIU). Can fail if incorrect number of chip selects
692      * specified, but this is a programming error.
693      */
694     QEMU_BUILD_BUG_ON(ARRAY_SIZE(npcm7xx_fiu) != ARRAY_SIZE(s->fiu));
695     for (i = 0; i < ARRAY_SIZE(s->fiu); i++) {
696         SysBusDevice *sbd = SYS_BUS_DEVICE(&s->fiu[i]);
697         int j;
698 
699         object_property_set_int(OBJECT(sbd), "cs-count",
700                                 npcm7xx_fiu[i].cs_count, &error_abort);
701         sysbus_realize(sbd, &error_abort);
702 
703         sysbus_mmio_map(sbd, 0, npcm7xx_fiu[i].regs_addr);
704         for (j = 0; j < npcm7xx_fiu[i].cs_count; j++) {
705             sysbus_mmio_map(sbd, j + 1, npcm7xx_fiu[i].flash_addr[j]);
706         }
707     }
708 
709     /* RAM2 (SRAM) */
710     memory_region_init_ram(&s->sram, OBJECT(dev), "ram2",
711                            NPCM7XX_RAM2_SZ, &error_abort);
712     memory_region_add_subregion(get_system_memory(), NPCM7XX_RAM2_BA, &s->sram);
713 
714     /* RAM3 (SRAM) */
715     memory_region_init_ram(&s->ram3, OBJECT(dev), "ram3",
716                            NPCM7XX_RAM3_SZ, &error_abort);
717     memory_region_add_subregion(get_system_memory(), NPCM7XX_RAM3_BA, &s->ram3);
718 
719     /* Internal ROM */
720     memory_region_init_rom(&s->irom, OBJECT(dev), "irom", NPCM7XX_ROM_SZ,
721                            &error_abort);
722     memory_region_add_subregion(get_system_memory(), NPCM7XX_ROM_BA, &s->irom);
723 
724     /* SDHCI */
725     sysbus_realize(SYS_BUS_DEVICE(&s->mmc), &error_abort);
726     sysbus_mmio_map(SYS_BUS_DEVICE(&s->mmc), 0, NPCM7XX_MMC_BA);
727     sysbus_connect_irq(SYS_BUS_DEVICE(&s->mmc), 0,
728             npcm7xx_irq(s, NPCM7XX_MMC_IRQ));
729 
730     /* PSPI */
731     QEMU_BUILD_BUG_ON(ARRAY_SIZE(npcm7xx_pspi_addr) != ARRAY_SIZE(s->pspi));
732     for (i = 0; i < ARRAY_SIZE(s->pspi); i++) {
733         SysBusDevice *sbd = SYS_BUS_DEVICE(&s->pspi[i]);
734         int irq = (i == 0) ? NPCM7XX_PSPI1_IRQ : NPCM7XX_PSPI2_IRQ;
735 
736         sysbus_realize(sbd, &error_abort);
737         sysbus_mmio_map(sbd, 0, npcm7xx_pspi_addr[i]);
738         sysbus_connect_irq(sbd, 0, npcm7xx_irq(s, irq));
739     }
740 
741     create_unimplemented_device("npcm7xx.shm",          0xc0001000,   4 * KiB);
742     create_unimplemented_device("npcm7xx.vdmx",         0xe0800000,   4 * KiB);
743     create_unimplemented_device("npcm7xx.pcierc",       0xe1000000,  64 * KiB);
744     create_unimplemented_device("npcm7xx.kcs",          0xf0007000,   4 * KiB);
745     create_unimplemented_device("npcm7xx.gfxi",         0xf000e000,   4 * KiB);
746     create_unimplemented_device("npcm7xx.espi",         0xf009f000,   4 * KiB);
747     create_unimplemented_device("npcm7xx.peci",         0xf0100000,   4 * KiB);
748     create_unimplemented_device("npcm7xx.siox[1]",      0xf0101000,   4 * KiB);
749     create_unimplemented_device("npcm7xx.siox[2]",      0xf0102000,   4 * KiB);
750     create_unimplemented_device("npcm7xx.ahbpci",       0xf0400000,   1 * MiB);
751     create_unimplemented_device("npcm7xx.mcphy",        0xf05f0000,  64 * KiB);
752     create_unimplemented_device("npcm7xx.gmac1",        0xf0802000,   8 * KiB);
753     create_unimplemented_device("npcm7xx.gmac2",        0xf0804000,   8 * KiB);
754     create_unimplemented_device("npcm7xx.vcd",          0xf0810000,  64 * KiB);
755     create_unimplemented_device("npcm7xx.ece",          0xf0820000,   8 * KiB);
756     create_unimplemented_device("npcm7xx.vdma",         0xf0822000,   8 * KiB);
757     create_unimplemented_device("npcm7xx.usbd[0]",      0xf0830000,   4 * KiB);
758     create_unimplemented_device("npcm7xx.usbd[1]",      0xf0831000,   4 * KiB);
759     create_unimplemented_device("npcm7xx.usbd[2]",      0xf0832000,   4 * KiB);
760     create_unimplemented_device("npcm7xx.usbd[3]",      0xf0833000,   4 * KiB);
761     create_unimplemented_device("npcm7xx.usbd[4]",      0xf0834000,   4 * KiB);
762     create_unimplemented_device("npcm7xx.usbd[5]",      0xf0835000,   4 * KiB);
763     create_unimplemented_device("npcm7xx.usbd[6]",      0xf0836000,   4 * KiB);
764     create_unimplemented_device("npcm7xx.usbd[7]",      0xf0837000,   4 * KiB);
765     create_unimplemented_device("npcm7xx.usbd[8]",      0xf0838000,   4 * KiB);
766     create_unimplemented_device("npcm7xx.usbd[9]",      0xf0839000,   4 * KiB);
767     create_unimplemented_device("npcm7xx.sd",           0xf0840000,   8 * KiB);
768     create_unimplemented_device("npcm7xx.pcimbx",       0xf0848000, 512 * KiB);
769     create_unimplemented_device("npcm7xx.aes",          0xf0858000,   4 * KiB);
770     create_unimplemented_device("npcm7xx.des",          0xf0859000,   4 * KiB);
771     create_unimplemented_device("npcm7xx.sha",          0xf085a000,   4 * KiB);
772     create_unimplemented_device("npcm7xx.secacc",       0xf085b000,   4 * KiB);
773     create_unimplemented_device("npcm7xx.spixcs0",      0xf8000000,  16 * MiB);
774     create_unimplemented_device("npcm7xx.spixcs1",      0xf9000000,  16 * MiB);
775     create_unimplemented_device("npcm7xx.spix",         0xfb001000,   4 * KiB);
776 }
777 
778 static Property npcm7xx_properties[] = {
779     DEFINE_PROP_LINK("dram-mr", NPCM7xxState, dram, TYPE_MEMORY_REGION,
780                      MemoryRegion *),
781     DEFINE_PROP_END_OF_LIST(),
782 };
783 
784 static void npcm7xx_class_init(ObjectClass *oc, void *data)
785 {
786     DeviceClass *dc = DEVICE_CLASS(oc);
787 
788     dc->realize = npcm7xx_realize;
789     dc->user_creatable = false;
790     device_class_set_props(dc, npcm7xx_properties);
791 }
792 
793 static void npcm730_class_init(ObjectClass *oc, void *data)
794 {
795     NPCM7xxClass *nc = NPCM7XX_CLASS(oc);
796 
797     /* NPCM730 is optimized for data center use, so no graphics, etc. */
798     nc->disabled_modules = 0x00300395;
799     nc->num_cpus = 2;
800 }
801 
802 static void npcm750_class_init(ObjectClass *oc, void *data)
803 {
804     NPCM7xxClass *nc = NPCM7XX_CLASS(oc);
805 
806     /* NPCM750 has 2 cores and a full set of peripherals */
807     nc->disabled_modules = 0x00000000;
808     nc->num_cpus = 2;
809 }
810 
811 static const TypeInfo npcm7xx_soc_types[] = {
812     {
813         .name           = TYPE_NPCM7XX,
814         .parent         = TYPE_DEVICE,
815         .instance_size  = sizeof(NPCM7xxState),
816         .instance_init  = npcm7xx_init,
817         .class_size     = sizeof(NPCM7xxClass),
818         .class_init     = npcm7xx_class_init,
819         .abstract       = true,
820     }, {
821         .name           = TYPE_NPCM730,
822         .parent         = TYPE_NPCM7XX,
823         .class_init     = npcm730_class_init,
824     }, {
825         .name           = TYPE_NPCM750,
826         .parent         = TYPE_NPCM7XX,
827         .class_init     = npcm750_class_init,
828     },
829 };
830 
831 DEFINE_TYPES(npcm7xx_soc_types);
832