qemu/hw/arm/xilinx_zynq.c

364 lines
12 KiB
C
Raw Normal View History

/*
* Xilinx Zynq Baseboard System emulation.
*
* Copyright (c) 2010 Xilinx.
* Copyright (c) 2012 Peter A.G. Crosthwaite (peter.croshtwaite@petalogix.com)
* Copyright (c) 2012 Petalogix Pty Ltd.
* Written by Haibing Ma
*
* This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License
* as published by the Free Software Foundation; either version
* 2 of the License, or (at your option) any later version.
*
* You should have received a copy of the GNU General Public License along
* with this program; if not, see <http://www.gnu.org/licenses/>.
*/
#include "qemu/osdep.h"
#include "qemu/units.h"
2016-03-14 11:01:28 +03:00
#include "qapi/error.h"
#include "cpu.h"
#include "hw/sysbus.h"
#include "hw/arm/boot.h"
#include "net/net.h"
#include "exec/address-spaces.h"
#include "sysemu/sysemu.h"
#include "hw/boards.h"
#include "hw/block/flash.h"
#include "hw/loader.h"
#include "hw/misc/zynq-xadc.h"
#include "hw/ssi/ssi.h"
#include "hw/usb/chipidea.h"
#include "qemu/error-report.h"
#include "hw/sd/sdhci.h"
#include "hw/char/cadence_uart.h"
#include "hw/net/cadence_gem.h"
#include "hw/cpu/a9mpcore.h"
#include "hw/qdev-clock.h"
#include "sysemu/reset.h"
#define TYPE_ZYNQ_MACHINE MACHINE_TYPE_NAME("xilinx-zynq-a9")
#define ZYNQ_MACHINE(obj) \
OBJECT_CHECK(ZynqMachineState, (obj), TYPE_ZYNQ_MACHINE)
/* board base frequency: 33.333333 MHz */
#define PS_CLK_FREQUENCY (100 * 1000 * 1000 / 3)
#define NUM_SPI_FLASHES 4
#define NUM_QSPI_FLASHES 2
#define NUM_QSPI_BUSSES 2
#define FLASH_SIZE (64 * 1024 * 1024)
#define FLASH_SECTOR_SIZE (128 * 1024)
#define IRQ_OFFSET 32 /* pic interrupts start from index 32 */
#define MPCORE_PERIPHBASE 0xF8F00000
#define ZYNQ_BOARD_MIDR 0x413FC090
static const int dma_irqs[8] = {
46, 47, 48, 49, 72, 73, 74, 75
};
#define BOARD_SETUP_ADDR 0x100
#define SLCR_LOCK_OFFSET 0x004
#define SLCR_UNLOCK_OFFSET 0x008
#define SLCR_ARM_PLL_OFFSET 0x100
#define SLCR_XILINX_UNLOCK_KEY 0xdf0d
#define SLCR_XILINX_LOCK_KEY 0x767b
#define ZYNQ_SDHCI_CAPABILITIES 0x69ec0080 /* Datasheet: UG585 (v1.12.1) */
#define ARMV7_IMM16(x) (extract32((x), 0, 12) | \
extract32((x), 12, 4) << 16)
/* Write immediate val to address r0 + addr. r0 should contain base offset
* of the SLCR block. Clobbers r1.
*/
#define SLCR_WRITE(addr, val) \
0xe3001000 + ARMV7_IMM16(extract32((val), 0, 16)), /* movw r1 ... */ \
0xe3401000 + ARMV7_IMM16(extract32((val), 16, 16)), /* movt r1 ... */ \
0xe5801000 + (addr)
typedef struct ZynqMachineState {
MachineState parent;
Clock *ps_clk;
} ZynqMachineState;
static void zynq_write_board_setup(ARMCPU *cpu,
const struct arm_boot_info *info)
{
int n;
uint32_t board_setup_blob[] = {
0xe3a004f8, /* mov r0, #0xf8000000 */
SLCR_WRITE(SLCR_UNLOCK_OFFSET, SLCR_XILINX_UNLOCK_KEY),
SLCR_WRITE(SLCR_ARM_PLL_OFFSET, 0x00014008),
SLCR_WRITE(SLCR_LOCK_OFFSET, SLCR_XILINX_LOCK_KEY),
0xe12fff1e, /* bx lr */
};
for (n = 0; n < ARRAY_SIZE(board_setup_blob); n++) {
board_setup_blob[n] = tswap32(board_setup_blob[n]);
}
rom_add_blob_fixed("board-setup", board_setup_blob,
sizeof(board_setup_blob), BOARD_SETUP_ADDR);
}
static struct arm_boot_info zynq_binfo = {};
static void gem_init(NICInfo *nd, uint32_t base, qemu_irq irq)
{
DeviceState *dev;
SysBusDevice *s;
dev = qdev_create(NULL, TYPE_CADENCE_GEM);
if (nd->used) {
qemu_check_nic_model(nd, TYPE_CADENCE_GEM);
qdev_set_nic_properties(dev, nd);
}
qdev_init_nofail(dev);
s = SYS_BUS_DEVICE(dev);
sysbus_mmio_map(s, 0, base);
sysbus_connect_irq(s, 0, irq);
}
static inline void zynq_init_spi_flashes(uint32_t base_addr, qemu_irq irq,
bool is_qspi)
{
DeviceState *dev;
SysBusDevice *busdev;
SSIBus *spi;
DeviceState *flash_dev;
int i, j;
int num_busses = is_qspi ? NUM_QSPI_BUSSES : 1;
int num_ss = is_qspi ? NUM_QSPI_FLASHES : NUM_SPI_FLASHES;
dev = qdev_create(NULL, is_qspi ? "xlnx.ps7-qspi" : "xlnx.ps7-spi");
qdev_prop_set_uint8(dev, "num-txrx-bytes", is_qspi ? 4 : 1);
qdev_prop_set_uint8(dev, "num-ss-bits", num_ss);
qdev_prop_set_uint8(dev, "num-busses", num_busses);
qdev_init_nofail(dev);
busdev = SYS_BUS_DEVICE(dev);
sysbus_mmio_map(busdev, 0, base_addr);
if (is_qspi) {
sysbus_mmio_map(busdev, 1, 0xFC000000);
}
sysbus_connect_irq(busdev, 0, irq);
for (i = 0; i < num_busses; ++i) {
char bus_name[16];
qemu_irq cs_line;
snprintf(bus_name, 16, "spi%d", i);
spi = (SSIBus *)qdev_get_child_bus(dev, bus_name);
for (j = 0; j < num_ss; ++j) {
DriveInfo *dinfo = drive_get_next(IF_MTD);
flash_dev = ssi_create_slave_no_init(spi, "n25q128");
if (dinfo) {
qdev_prop_set_drive(flash_dev, "drive",
blk_by_legacy_dinfo(dinfo), &error_fatal);
}
qdev_init_nofail(flash_dev);
cs_line = qdev_get_gpio_in_named(flash_dev, SSI_GPIO_CS, 0);
sysbus_connect_irq(busdev, i * num_ss + j + 1, cs_line);
}
}
}
static void zynq_init(MachineState *machine)
{
ZynqMachineState *zynq_machine = ZYNQ_MACHINE(machine);
ARMCPU *cpu;
MemoryRegion *address_space_mem = get_system_memory();
MemoryRegion *ocm_ram = g_new(MemoryRegion, 1);
DeviceState *dev, *slcr;
SysBusDevice *busdev;
qemu_irq pic[64];
int n;
/* max 2GB ram */
if (machine->ram_size > 2 * GiB) {
error_report("RAM size more than 2 GiB is not supported");
exit(EXIT_FAILURE);
}
arm: drop intermediate cpu_model -> cpu type parsing and use cpu type directly there are 2 use cases to deal with: 1: fixed CPU models per board/soc 2: boards with user configurable cpu_model and fallback to default cpu_model if user hasn't specified one explicitly For the 1st drop intermediate cpu_model parsing and use const cpu type directly, which replaces: typename = object_class_get_name( cpu_class_by_name(TYPE_ARM_CPU, cpu_model)) object_new(typename) with object_new(FOO_CPU_TYPE_NAME) or cpu_generic_init(BASE_CPU_TYPE, "my cpu model") with cpu_create(FOO_CPU_TYPE_NAME) as result 1st use case doesn't have to invoke not necessary translation and not needed code is removed. For the 2nd 1: set default cpu type with MachineClass::default_cpu_type and 2: use generic cpu_model parsing that done before machine_init() is run and: 2.1: drop custom cpu_model parsing where pattern is: typename = object_class_get_name( cpu_class_by_name(TYPE_ARM_CPU, cpu_model)) [parse_features(typename, cpu_model, &err) ] 2.2: or replace cpu_generic_init() which does what 2.1 does + create_cpu(typename) with just create_cpu(machine->cpu_type) as result cpu_name -> cpu_type translation is done using generic machine code one including parsing optional features if supported/present (removes a bunch of duplicated cpu_model parsing code) and default cpu type is defined in an uniform way within machine_class_init callbacks instead of adhoc places in boadr's machine_init code. Signed-off-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Message-Id: <1505318697-77161-6-git-send-email-imammedo@redhat.com> Reviewed-by: Alistair Francis <alistair.francis@xilinx.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2017-09-13 19:04:57 +03:00
cpu = ARM_CPU(object_new(machine->cpu_type));
/* By default A9 CPUs have EL3 enabled. This board does not
* currently support EL3 so the CPU EL3 property is disabled before
* realization.
*/
if (object_property_find(OBJECT(cpu), "has_el3", NULL)) {
object_property_set_bool(OBJECT(cpu), false, "has_el3", &error_fatal);
}
object_property_set_int(OBJECT(cpu), ZYNQ_BOARD_MIDR, "midr",
&error_fatal);
object_property_set_int(OBJECT(cpu), MPCORE_PERIPHBASE, "reset-cbar",
&error_fatal);
object_property_set_bool(OBJECT(cpu), true, "realized", &error_fatal);
/* DDR remapped to address zero. */
memory_region_add_subregion(address_space_mem, 0, machine->ram);
/* 256K of on-chip memory */
memory_region_init_ram(ocm_ram, NULL, "zynq.ocm_ram", 256 * KiB,
Fix bad error handling after memory_region_init_ram() Symptom: $ qemu-system-x86_64 -m 10000000 Unexpected error in ram_block_add() at /work/armbru/qemu/exec.c:1456: upstream-qemu: cannot set up guest memory 'pc.ram': Cannot allocate memory Aborted (core dumped) Root cause: commit ef701d7 screwed up handling of out-of-memory conditions. Before the commit, we report the error and exit(1), in one place, ram_block_add(). The commit lifts the error handling up the call chain some, to three places. Fine. Except it uses &error_abort in these places, changing the behavior from exit(1) to abort(), and thus undoing the work of commit 3922825 "exec: Don't abort when we can't allocate guest memory". The three places are: * memory_region_init_ram() Commit 4994653 (right after commit ef701d7) lifted the error handling further, through memory_region_init_ram(), multiplying the incorrect use of &error_abort. Later on, imitation of existing (bad) code may have created more. * memory_region_init_ram_ptr() The &error_abort is still there. * memory_region_init_rom_device() Doesn't need fixing, because commit 33e0eb5 (soon after commit ef701d7) lifted the error handling further, and in the process changed it from &error_abort to passing it up the call chain. Correct, because the callers are realize() methods. Fix the error handling after memory_region_init_ram() with a Coccinelle semantic patch: @r@ expression mr, owner, name, size, err; position p; @@ memory_region_init_ram(mr, owner, name, size, ( - &error_abort + &error_fatal | err@p ) ); @script:python@ p << r.p; @@ print "%s:%s:%s" % (p[0].file, p[0].line, p[0].column) When the last argument is &error_abort, it gets replaced by &error_fatal. This is the fix. If the last argument is anything else, its position is reported. This lets us check the fix is complete. Four positions get reported: * ram_backend_memory_alloc() Error is passed up the call chain, ultimately through user_creatable_complete(). As far as I can tell, it's callers all handle the error sanely. * fsl_imx25_realize(), fsl_imx31_realize(), dp8393x_realize() DeviceClass.realize() methods, errors handled sanely further up the call chain. We're good. Test case again behaves: $ qemu-system-x86_64 -m 10000000 qemu-system-x86_64: cannot set up guest memory 'pc.ram': Cannot allocate memory [Exit 1 ] The next commits will repair the rest of commit ef701d7's damage. Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <1441983105-26376-3-git-send-email-armbru@redhat.com> Reviewed-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
2015-09-11 17:51:43 +03:00
&error_fatal);
memory_region_add_subregion(address_space_mem, 0xFFFC0000, ocm_ram);
DriveInfo *dinfo = drive_get(IF_PFLASH, 0, 0);
/* AMD */
pflash_cfi02_register(0xe2000000, "zynq.pflash", FLASH_SIZE,
dinfo ? blk_by_legacy_dinfo(dinfo) : NULL,
FLASH_SECTOR_SIZE, 1,
1, 0x0066, 0x0022, 0x0000, 0x0000, 0x0555, 0x2aa,
0);
/* Create slcr, keep a pointer to connect clocks */
slcr = qdev_create(NULL, "xilinx,zynq_slcr");
qdev_init_nofail(slcr);
sysbus_mmio_map(SYS_BUS_DEVICE(slcr), 0, 0xF8000000);
/* Create the main clock source, and feed slcr with it */
zynq_machine->ps_clk = CLOCK(object_new(TYPE_CLOCK));
object_property_add_child(OBJECT(zynq_machine), "ps_clk",
qom: Drop parameter @errp of object_property_add() & friends The only way object_property_add() can fail is when a property with the same name already exists. Since our property names are all hardcoded, failure is a programming error, and the appropriate way to handle it is passing &error_abort. Same for its variants, except for object_property_add_child(), which additionally fails when the child already has a parent. Parentage is also under program control, so this is a programming error, too. We have a bit over 500 callers. Almost half of them pass &error_abort, slightly fewer ignore errors, one test case handles errors, and the remaining few callers pass them to their own callers. The previous few commits demonstrated once again that ignoring programming errors is a bad idea. Of the few ones that pass on errors, several violate the Error API. The Error ** argument must be NULL, &error_abort, &error_fatal, or a pointer to a variable containing NULL. Passing an argument of the latter kind twice without clearing it in between is wrong: if the first call sets an error, it no longer points to NULL for the second call. ich9_pm_add_properties(), sparc32_ledma_realize(), sparc32_dma_realize(), xilinx_axidma_realize(), xilinx_enet_realize() are wrong that way. When the one appropriate choice of argument is &error_abort, letting users pick the argument is a bad idea. Drop parameter @errp and assert the preconditions instead. There's one exception to "duplicate property name is a programming error": the way object_property_add() implements the magic (and undocumented) "automatic arrayification". Don't drop @errp there. Instead, rename object_property_add() to object_property_try_add(), and add the obvious wrapper object_property_add(). Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <20200505152926.18877-15-armbru@redhat.com> [Two semantic rebase conflicts resolved]
2020-05-05 18:29:22 +03:00
OBJECT(zynq_machine->ps_clk));
object_unref(OBJECT(zynq_machine->ps_clk));
clock_set_hz(zynq_machine->ps_clk, PS_CLK_FREQUENCY);
qdev_connect_clock_in(slcr, "ps_clk", zynq_machine->ps_clk);
dev = qdev_create(NULL, TYPE_A9MPCORE_PRIV);
qdev_prop_set_uint32(dev, "num-cpu", 1);
qdev_init_nofail(dev);
busdev = SYS_BUS_DEVICE(dev);
sysbus_mmio_map(busdev, 0, MPCORE_PERIPHBASE);
sysbus_connect_irq(busdev, 0,
qdev_get_gpio_in(DEVICE(cpu), ARM_CPU_IRQ));
for (n = 0; n < 64; n++) {
pic[n] = qdev_get_gpio_in(dev, n);
}
zynq_init_spi_flashes(0xE0006000, pic[58-IRQ_OFFSET], false);
zynq_init_spi_flashes(0xE0007000, pic[81-IRQ_OFFSET], false);
zynq_init_spi_flashes(0xE000D000, pic[51-IRQ_OFFSET], true);
sysbus_create_simple(TYPE_CHIPIDEA, 0xE0002000, pic[53 - IRQ_OFFSET]);
sysbus_create_simple(TYPE_CHIPIDEA, 0xE0003000, pic[76 - IRQ_OFFSET]);
dev = cadence_uart_create(0xE0000000, pic[59 - IRQ_OFFSET], serial_hd(0));
qdev_connect_clock_in(dev, "refclk",
qdev_get_clock_out(slcr, "uart0_ref_clk"));
dev = cadence_uart_create(0xE0001000, pic[82 - IRQ_OFFSET], serial_hd(1));
qdev_connect_clock_in(dev, "refclk",
qdev_get_clock_out(slcr, "uart1_ref_clk"));
sysbus_create_varargs("cadence_ttc", 0xF8001000,
pic[42-IRQ_OFFSET], pic[43-IRQ_OFFSET], pic[44-IRQ_OFFSET], NULL);
sysbus_create_varargs("cadence_ttc", 0xF8002000,
pic[69-IRQ_OFFSET], pic[70-IRQ_OFFSET], pic[71-IRQ_OFFSET], NULL);
gem_init(&nd_table[0], 0xE000B000, pic[54-IRQ_OFFSET]);
gem_init(&nd_table[1], 0xE000C000, pic[77-IRQ_OFFSET]);
for (n = 0; n < 2; n++) {
int hci_irq = n ? 79 : 56;
hwaddr hci_addr = n ? 0xE0101000 : 0xE0100000;
DriveInfo *di;
BlockBackend *blk;
DeviceState *carddev;
/* Compatible with:
* - SD Host Controller Specification Version 2.0 Part A2
* - SDIO Specification Version 2.0
* - MMC Specification Version 3.31
*/
dev = qdev_create(NULL, TYPE_SYSBUS_SDHCI);
qdev_prop_set_uint8(dev, "sd-spec-version", 2);
qdev_prop_set_uint64(dev, "capareg", ZYNQ_SDHCI_CAPABILITIES);
qdev_init_nofail(dev);
sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, hci_addr);
sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0, pic[hci_irq - IRQ_OFFSET]);
di = drive_get_next(IF_SD);
blk = di ? blk_by_legacy_dinfo(di) : NULL;
carddev = qdev_create(qdev_get_child_bus(dev, "sd-bus"), TYPE_SD_CARD);
qdev_prop_set_drive(carddev, "drive", blk, &error_fatal);
object_property_set_bool(OBJECT(carddev), true, "realized",
&error_fatal);
}
dev = qdev_create(NULL, TYPE_ZYNQ_XADC);
qdev_init_nofail(dev);
sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, 0xF8007100);
sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0, pic[39-IRQ_OFFSET]);
dev = qdev_create(NULL, "pl330");
qdev_prop_set_uint8(dev, "num_chnls", 8);
qdev_prop_set_uint8(dev, "num_periph_req", 4);
qdev_prop_set_uint8(dev, "num_events", 16);
qdev_prop_set_uint8(dev, "data_width", 64);
qdev_prop_set_uint8(dev, "wr_cap", 8);
qdev_prop_set_uint8(dev, "wr_q_dep", 16);
qdev_prop_set_uint8(dev, "rd_cap", 8);
qdev_prop_set_uint8(dev, "rd_q_dep", 16);
qdev_prop_set_uint16(dev, "data_buffer_dep", 256);
qdev_init_nofail(dev);
busdev = SYS_BUS_DEVICE(dev);
sysbus_mmio_map(busdev, 0, 0xF8003000);
sysbus_connect_irq(busdev, 0, pic[45-IRQ_OFFSET]); /* abort irq line */
for (n = 0; n < ARRAY_SIZE(dma_irqs); ++n) { /* event irqs */
sysbus_connect_irq(busdev, n + 1, pic[dma_irqs[n] - IRQ_OFFSET]);
}
dev = qdev_create(NULL, "xlnx.ps7-dev-cfg");
qdev_init_nofail(dev);
busdev = SYS_BUS_DEVICE(dev);
sysbus_connect_irq(busdev, 0, pic[40 - IRQ_OFFSET]);
sysbus_mmio_map(busdev, 0, 0xF8007000);
zynq_binfo.ram_size = machine->ram_size;
zynq_binfo.nb_cpus = 1;
zynq_binfo.board_id = 0xd32;
zynq_binfo.loader_start = 0;
zynq_binfo.board_setup_addr = BOARD_SETUP_ADDR;
zynq_binfo.write_board_setup = zynq_write_board_setup;
arm_load_kernel(ARM_CPU(first_cpu), machine, &zynq_binfo);
}
static void zynq_machine_class_init(ObjectClass *oc, void *data)
{
MachineClass *mc = MACHINE_CLASS(oc);
mc->desc = "Xilinx Zynq Platform Baseboard for Cortex-A9";
mc->init = zynq_init;
mc->max_cpus = 1;
mc->no_sdcard = 1;
mc->ignore_memory_transaction_failures = true;
arm: drop intermediate cpu_model -> cpu type parsing and use cpu type directly there are 2 use cases to deal with: 1: fixed CPU models per board/soc 2: boards with user configurable cpu_model and fallback to default cpu_model if user hasn't specified one explicitly For the 1st drop intermediate cpu_model parsing and use const cpu type directly, which replaces: typename = object_class_get_name( cpu_class_by_name(TYPE_ARM_CPU, cpu_model)) object_new(typename) with object_new(FOO_CPU_TYPE_NAME) or cpu_generic_init(BASE_CPU_TYPE, "my cpu model") with cpu_create(FOO_CPU_TYPE_NAME) as result 1st use case doesn't have to invoke not necessary translation and not needed code is removed. For the 2nd 1: set default cpu type with MachineClass::default_cpu_type and 2: use generic cpu_model parsing that done before machine_init() is run and: 2.1: drop custom cpu_model parsing where pattern is: typename = object_class_get_name( cpu_class_by_name(TYPE_ARM_CPU, cpu_model)) [parse_features(typename, cpu_model, &err) ] 2.2: or replace cpu_generic_init() which does what 2.1 does + create_cpu(typename) with just create_cpu(machine->cpu_type) as result cpu_name -> cpu_type translation is done using generic machine code one including parsing optional features if supported/present (removes a bunch of duplicated cpu_model parsing code) and default cpu type is defined in an uniform way within machine_class_init callbacks instead of adhoc places in boadr's machine_init code. Signed-off-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Message-Id: <1505318697-77161-6-git-send-email-imammedo@redhat.com> Reviewed-by: Alistair Francis <alistair.francis@xilinx.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2017-09-13 19:04:57 +03:00
mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-a9");
mc->default_ram_id = "zynq.ext_ram";
}
static const TypeInfo zynq_machine_type = {
.name = TYPE_ZYNQ_MACHINE,
.parent = TYPE_MACHINE,
.class_init = zynq_machine_class_init,
.instance_size = sizeof(ZynqMachineState),
};
static void zynq_machine_register_types(void)
{
type_register_static(&zynq_machine_type);
}
type_init(zynq_machine_register_types)