1 /*
2 * Renesas SH7751R R2D-PLUS emulation
3 *
4 * Copyright (c) 2007 Magnus Damm
5 * Copyright (c) 2008 Paul Mundt
6 *
7 * Permission is hereby granted, free of charge, to any person obtaining a copy
8 * of this software and associated documentation files (the "Software"), to deal
9 * in the Software without restriction, including without limitation the rights
10 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
11 * copies of the Software, and to permit persons to whom the Software is
12 * furnished to do so, subject to the following conditions:
13 *
14 * The above copyright notice and this permission notice shall be included in
15 * all copies or substantial portions of the Software.
16 *
17 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
18 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
19 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
20 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
21 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
22 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
23 * THE SOFTWARE.
24 */
25
26 #include "qemu/osdep.h"
27 #include "qemu/units.h"
28 #include "qapi/error.h"
29 #include "qemu/error-report.h"
30 #include "cpu.h"
31 #include "hw/sysbus.h"
32 #include "hw/sh4/sh.h"
33 #include "system/reset.h"
34 #include "system/runstate.h"
35 #include "system/system.h"
36 #include "hw/boards.h"
37 #include "hw/pci/pci.h"
38 #include "hw/qdev-properties.h"
39 #include "net/net.h"
40 #include "sh7750_regs.h"
41 #include "hw/ide/mmio.h"
42 #include "hw/irq.h"
43 #include "hw/loader.h"
44 #include "hw/usb.h"
45 #include "hw/block/flash.h"
46 #include "exec/tswap.h"
47
48 #define FLASH_BASE 0x00000000
49 #define FLASH_SIZE (16 * MiB)
50
51 #define SDRAM_BASE 0x0c000000 /* Physical location of SDRAM: Area 3 */
52 #define SDRAM_SIZE 0x04000000
53
54 #define SM501_VRAM_SIZE 0x800000
55
56 #define BOOT_PARAMS_OFFSET 0x0010000
57 /* CONFIG_BOOT_LINK_OFFSET of Linux kernel */
58 #define LINUX_LOAD_OFFSET 0x0800000
59 #define INITRD_LOAD_OFFSET 0x1800000
60
61 #define PA_IRLMSK 0x00
62 #define PA_POWOFF 0x30
63 #define PA_VERREG 0x32
64 #define PA_OUTPORT 0x36
65
66 enum r2d_fpga_irq {
67 PCI_INTD, CF_IDE, CF_CD, PCI_INTC, SM501, KEY, RTC_A, RTC_T,
68 SDCARD, PCI_INTA, PCI_INTB, EXT, TP,
69 NR_IRQS
70 };
71
72 typedef struct {
73 uint16_t bcr;
74 uint16_t irlmsk;
75 uint16_t irlmon;
76 uint16_t cfctl;
77 uint16_t cfpow;
78 uint16_t dispctl;
79 uint16_t sdmpow;
80 uint16_t rtcce;
81 uint16_t pcicd;
82 uint16_t voyagerrts;
83 uint16_t cfrst;
84 uint16_t admrts;
85 uint16_t extrst;
86 uint16_t cfcdintclr;
87 uint16_t keyctlclr;
88 uint16_t pad0;
89 uint16_t pad1;
90 uint16_t verreg;
91 uint16_t inport;
92 uint16_t outport;
93 uint16_t bverreg;
94
95 /* output pin */
96 qemu_irq irl;
97 IRQState irq[NR_IRQS];
98 MemoryRegion iomem;
99 } r2d_fpga_t;
100
101 static const struct { short irl; uint16_t msk; } irqtab[NR_IRQS] = {
102 [CF_IDE] = { 1, 1 << 9 },
103 [CF_CD] = { 2, 1 << 8 },
104 [PCI_INTA] = { 9, 1 << 14 },
105 [PCI_INTB] = { 10, 1 << 13 },
106 [PCI_INTC] = { 3, 1 << 12 },
107 [PCI_INTD] = { 0, 1 << 11 },
108 [SM501] = { 4, 1 << 10 },
109 [KEY] = { 5, 1 << 6 },
110 [RTC_A] = { 6, 1 << 5 },
111 [RTC_T] = { 7, 1 << 4 },
112 [SDCARD] = { 8, 1 << 7 },
113 [EXT] = { 11, 1 << 0 },
114 [TP] = { 12, 1 << 15 },
115 };
116
update_irl(r2d_fpga_t * fpga)117 static void update_irl(r2d_fpga_t *fpga)
118 {
119 int i, irl = 15;
120 for (i = 0; i < NR_IRQS; i++) {
121 if ((fpga->irlmon & fpga->irlmsk & irqtab[i].msk) &&
122 irqtab[i].irl < irl) {
123 irl = irqtab[i].irl;
124 }
125 }
126 qemu_set_irq(fpga->irl, irl ^ 15);
127 }
128
r2d_fpga_irq_set(void * opaque,int n,int level)129 static void r2d_fpga_irq_set(void *opaque, int n, int level)
130 {
131 r2d_fpga_t *fpga = opaque;
132 if (level) {
133 fpga->irlmon |= irqtab[n].msk;
134 } else {
135 fpga->irlmon &= ~irqtab[n].msk;
136 }
137 update_irl(fpga);
138 }
139
r2d_fpga_read(void * opaque,hwaddr addr,unsigned int size)140 static uint64_t r2d_fpga_read(void *opaque, hwaddr addr, unsigned int size)
141 {
142 r2d_fpga_t *s = opaque;
143
144 switch (addr) {
145 case PA_IRLMSK:
146 return s->irlmsk;
147 case PA_OUTPORT:
148 return s->outport;
149 case PA_POWOFF:
150 return 0x00;
151 case PA_VERREG:
152 return 0x10;
153 }
154
155 return 0;
156 }
157
158 static void
r2d_fpga_write(void * opaque,hwaddr addr,uint64_t value,unsigned int size)159 r2d_fpga_write(void *opaque, hwaddr addr, uint64_t value, unsigned int size)
160 {
161 r2d_fpga_t *s = opaque;
162
163 switch (addr) {
164 case PA_IRLMSK:
165 s->irlmsk = value;
166 update_irl(s);
167 break;
168 case PA_OUTPORT:
169 s->outport = value;
170 break;
171 case PA_POWOFF:
172 if (value & 1) {
173 qemu_system_shutdown_request(SHUTDOWN_CAUSE_GUEST_SHUTDOWN);
174 }
175 break;
176 case PA_VERREG:
177 /* Discard writes */
178 break;
179 }
180 }
181
182 static const MemoryRegionOps r2d_fpga_ops = {
183 .read = r2d_fpga_read,
184 .write = r2d_fpga_write,
185 .impl.min_access_size = 2,
186 .impl.max_access_size = 2,
187 .endianness = DEVICE_NATIVE_ENDIAN,
188 };
189
r2d_fpga_init(MemoryRegion * sysmem,hwaddr base,qemu_irq irl)190 static r2d_fpga_t *r2d_fpga_init(MemoryRegion *sysmem,
191 hwaddr base, qemu_irq irl)
192 {
193 r2d_fpga_t *s;
194
195 s = g_new0(r2d_fpga_t, 1);
196
197 s->irl = irl;
198
199 memory_region_init_io(&s->iomem, NULL, &r2d_fpga_ops, s, "r2d-fpga", 0x40);
200 memory_region_add_subregion(sysmem, base, &s->iomem);
201
202 qemu_init_irqs(s->irq, NR_IRQS, r2d_fpga_irq_set, s);
203
204 return s;
205 }
206
207 typedef struct ResetData {
208 SuperHCPU *cpu;
209 uint32_t vector;
210 } ResetData;
211
main_cpu_reset(void * opaque)212 static void main_cpu_reset(void *opaque)
213 {
214 ResetData *s = (ResetData *)opaque;
215 CPUSH4State *env = &s->cpu->env;
216
217 cpu_reset(CPU(s->cpu));
218 env->pc = s->vector;
219 }
220
221 static struct QEMU_PACKED
222 {
223 int mount_root_rdonly;
224 int ramdisk_flags;
225 int orig_root_dev;
226 int loader_type;
227 int initrd_start;
228 int initrd_size;
229
230 char pad[232];
231
232 char kernel_cmdline[256] QEMU_NONSTRING;
233 } boot_params;
234
r2d_init(MachineState * machine)235 static void r2d_init(MachineState *machine)
236 {
237 const char *kernel_filename = machine->kernel_filename;
238 const char *kernel_cmdline = machine->kernel_cmdline;
239 const char *initrd_filename = machine->initrd_filename;
240 MachineClass *mc = MACHINE_GET_CLASS(machine);
241 SuperHCPU *cpu;
242 CPUSH4State *env;
243 ResetData *reset_info;
244 struct SH7750State *s;
245 MemoryRegion *sdram = g_new(MemoryRegion, 1);
246 DriveInfo *dinfo;
247 DeviceState *dev;
248 SysBusDevice *busdev;
249 MemoryRegion *address_space_mem = get_system_memory();
250 PCIBus *pci_bus;
251 USBBus *usb_bus;
252 r2d_fpga_t *fpga;
253
254 cpu = SUPERH_CPU(cpu_create(machine->cpu_type));
255 env = &cpu->env;
256
257 reset_info = g_new0(ResetData, 1);
258 reset_info->cpu = cpu;
259 reset_info->vector = env->pc;
260 qemu_register_reset(main_cpu_reset, reset_info);
261
262 /* Allocate memory space */
263 memory_region_init_ram(sdram, NULL, "r2d.sdram", SDRAM_SIZE, &error_fatal);
264 memory_region_add_subregion(address_space_mem, SDRAM_BASE, sdram);
265 /* Register peripherals */
266 s = sh7750_init(cpu, address_space_mem);
267 fpga = r2d_fpga_init(address_space_mem, 0x04000000, sh7750_irl(s));
268
269 dev = qdev_new("sh_pci");
270 busdev = SYS_BUS_DEVICE(dev);
271 sysbus_realize_and_unref(busdev, &error_fatal);
272 pci_bus = PCI_BUS(qdev_get_child_bus(dev, "pci"));
273 sysbus_mmio_map(busdev, 0, P4ADDR(0x1e200000));
274 sysbus_mmio_map(busdev, 1, A7ADDR(0x1e200000));
275 sysbus_connect_irq(busdev, 0, &fpga->irq[PCI_INTA]);
276 sysbus_connect_irq(busdev, 1, &fpga->irq[PCI_INTB]);
277 sysbus_connect_irq(busdev, 2, &fpga->irq[PCI_INTC]);
278 sysbus_connect_irq(busdev, 3, &fpga->irq[PCI_INTD]);
279
280 dev = qdev_new("sysbus-sm501");
281 busdev = SYS_BUS_DEVICE(dev);
282 qdev_prop_set_uint32(dev, "vram-size", SM501_VRAM_SIZE);
283 qdev_prop_set_uint64(dev, "dma-offset", 0x10000000);
284 qdev_prop_set_chr(dev, "chardev", serial_hd(2));
285 sysbus_realize_and_unref(busdev, &error_fatal);
286 sysbus_mmio_map(busdev, 0, 0x10000000);
287 sysbus_mmio_map(busdev, 1, 0x13e00000);
288 sysbus_connect_irq(busdev, 0, &fpga->irq[SM501]);
289
290 /* onboard CF (True IDE mode, Master only). */
291 dinfo = drive_get(IF_IDE, 0, 0);
292 dev = qdev_new("mmio-ide");
293 busdev = SYS_BUS_DEVICE(dev);
294 sysbus_connect_irq(busdev, 0, &fpga->irq[CF_IDE]);
295 qdev_prop_set_uint32(dev, "shift", 1);
296 sysbus_realize_and_unref(busdev, &error_fatal);
297 sysbus_mmio_map(busdev, 0, 0x14001000);
298 sysbus_mmio_map(busdev, 1, 0x1400080c);
299 mmio_ide_init_drives(dev, dinfo, NULL);
300
301 /*
302 * Onboard flash memory
303 * According to the old board user document in Japanese (under
304 * NDA) what is referred to as FROM (Area0) is connected via a
305 * 32-bit bus and CS0 to CN8. The docs mention a Cypress
306 * S29PL127J60TFI130 chipsset. Per the 'S29PL-J 002-00615
307 * Rev. *E' datasheet, it is a 128Mbit NOR parallel flash
308 * addressable in words of 16bit.
309 */
310 dinfo = drive_get(IF_PFLASH, 0, 0);
311 pflash_cfi02_register(0x0, "r2d.flash", FLASH_SIZE,
312 dinfo ? blk_by_legacy_dinfo(dinfo) : NULL,
313 64 * KiB, 1, 2, 0x0001, 0x227e, 0x2220, 0x2200,
314 0x555, 0x2aa, 0);
315
316 /* NIC: rtl8139 on-board, and 2 slots. */
317 pci_init_nic_in_slot(pci_bus, mc->default_nic, NULL, "2");
318 pci_init_nic_devices(pci_bus, mc->default_nic);
319
320 /* USB keyboard */
321 usb_bus = USB_BUS(object_resolve_type_unambiguous(TYPE_USB_BUS,
322 &error_abort));
323 usb_create_simple(usb_bus, "usb-kbd");
324
325 /* Todo: register on board registers */
326 memset(&boot_params, 0, sizeof(boot_params));
327
328 if (kernel_filename) {
329 int kernel_size;
330
331 kernel_size = load_image_targphys(kernel_filename,
332 SDRAM_BASE + LINUX_LOAD_OFFSET,
333 INITRD_LOAD_OFFSET - LINUX_LOAD_OFFSET);
334 if (kernel_size < 0) {
335 error_report("qemu: could not load kernel '%s'", kernel_filename);
336 exit(1);
337 }
338
339 /* initialization which should be done by firmware */
340 address_space_stl(&address_space_memory, SH7750_BCR1, 1 << 3,
341 MEMTXATTRS_UNSPECIFIED, NULL); /* cs3 SDRAM */
342 address_space_stw(&address_space_memory, SH7750_BCR2, 3 << (3 * 2),
343 MEMTXATTRS_UNSPECIFIED, NULL); /* cs3 32bit */
344 /* Start from P2 area */
345 reset_info->vector = (SDRAM_BASE + LINUX_LOAD_OFFSET) | 0xa0000000;
346 }
347
348 if (initrd_filename) {
349 int initrd_size;
350
351 initrd_size = load_image_targphys(initrd_filename,
352 SDRAM_BASE + INITRD_LOAD_OFFSET,
353 SDRAM_SIZE - INITRD_LOAD_OFFSET);
354
355 if (initrd_size < 0) {
356 error_report("qemu: could not load initrd '%s'", initrd_filename);
357 exit(1);
358 }
359
360 /* initialization which should be done by firmware */
361 boot_params.loader_type = tswap32(1);
362 boot_params.initrd_start = tswap32(INITRD_LOAD_OFFSET);
363 boot_params.initrd_size = tswap32(initrd_size);
364 }
365
366 if (kernel_cmdline) {
367 /*
368 * I see no evidence that this .kernel_cmdline buffer requires
369 * NUL-termination, so using strncpy should be ok.
370 */
371 strncpy(boot_params.kernel_cmdline, kernel_cmdline,
372 sizeof(boot_params.kernel_cmdline));
373 }
374
375 rom_add_blob_fixed("boot_params", &boot_params, sizeof(boot_params),
376 SDRAM_BASE + BOOT_PARAMS_OFFSET);
377 }
378
r2d_machine_init(MachineClass * mc)379 static void r2d_machine_init(MachineClass *mc)
380 {
381 mc->desc = "r2d-plus board";
382 mc->init = r2d_init;
383 mc->block_default_type = IF_IDE;
384 mc->default_cpu_type = TYPE_SH7751R_CPU;
385 mc->default_nic = "rtl8139";
386 }
387
388 DEFINE_MACHINE("r2d", r2d_machine_init)
389