Merge pull request #2 from haowu4682/master

Add basic NPCM8XX support

11 files changed, 420 insertions, 41 deletions

diff --git a/README.md b/README.md
index 808781d..1d0f248 100644
--- a/README.md
+++ b/README.md
@@ -1,44 +1,10 @@
-# Virtual Boot ROM for NPCM7xx SoCs
+# Virtual Boot ROM for NPCM SoCs
 
-This is not an officially supported Google product.
+This repository contains simple Boot ROMs for Nuvoton based
+BMC images that are intended to be used by [QEMU](http://www.qemu.org)
+when emulating NPCM based machines.
 
-This is a super simple Boot ROM that is intended to be used as a `-bios` image
-for [QEMU](http://www.qemu.org/) when emulating an NPCM7xx-based machine.
+## Subdirectories
 
-## Building
-
-If you have a 32-bit ARM compiler installed as `arm-none-eabi-gcc`, simply run
-`make`.
-
-If your ARM compiler has a different name, you'll need to override the
-`CROSS_COMPILE` prefix, e.g. like this:
-
-```
-make CROSS_COMPILE=arm-linux-gnueabi-
-```
-
-If either case is successful, a `npcm7xx_bootrom.bin` file will be produced.
-
-## Using
-
-The Boot ROM image may be passed to a QEMU system emulator using the `-bios` option. For example like this:
-
-```
-qemu-system-arm -machine quanta-gsj -nographic \
-    -bios "${IMAGES}/npcm7xx_bootrom.bin"
-    -drive file="${IMAGES}/image-bmc,if=mtd,bus=0,unit=0,format=raw,snapshot=on"
-```
-
-## Limitations
-
-*   Secure boot is not supported.
-*   Only booting from offset 0 of the flash at SPI0 CS0 is implemented.
-*   Fallback images (if the first image doesn't boot) are not implemented.
-*   Exception vectors are copied to SRAM, but not remapped.
-*   Most OTP bits and straps are not honored.
-*   The reset type bits are not updated.
-*   OTP protection is not implemented.
-*   No clock initialization is performed.
-*   UART programming protocol is not implemented.
-*   Host notification through the PCI mailbox is not implemented.
-*   Most fields in the ROM status structure are not set.
+npcm7xx: This subdir contains Boot ROM for NPCM7XX, a 32-bit ARM image.
+npcm8xx: This subdir contains Boot ROM for NPCM8XX, a 64-bit ARM image.
diff --git a/Makefile b/npcm7xx/Makefile
index 3b2b2f3..3b2b2f3 100644
--- a/Makefile
+++ b/npcm7xx/Makefile
diff --git a/npcm7xx/README.md b/npcm7xx/README.md
new file mode 100644
index 0000000..808781d
--- /dev/null
+++ b/npcm7xx/README.md
@@ -0,0 +1,44 @@
+# Virtual Boot ROM for NPCM7xx SoCs
+
+This is not an officially supported Google product.
+
+This is a super simple Boot ROM that is intended to be used as a `-bios` image
+for [QEMU](http://www.qemu.org/) when emulating an NPCM7xx-based machine.
+
+## Building
+
+If you have a 32-bit ARM compiler installed as `arm-none-eabi-gcc`, simply run
+`make`.
+
+If your ARM compiler has a different name, you'll need to override the
+`CROSS_COMPILE` prefix, e.g. like this:
+
+```
+make CROSS_COMPILE=arm-linux-gnueabi-
+```
+
+If either case is successful, a `npcm7xx_bootrom.bin` file will be produced.
+
+## Using
+
+The Boot ROM image may be passed to a QEMU system emulator using the `-bios` option. For example like this:
+
+```
+qemu-system-arm -machine quanta-gsj -nographic \
+    -bios "${IMAGES}/npcm7xx_bootrom.bin"
+    -drive file="${IMAGES}/image-bmc,if=mtd,bus=0,unit=0,format=raw,snapshot=on"
+```
+
+## Limitations
+
+*   Secure boot is not supported.
+*   Only booting from offset 0 of the flash at SPI0 CS0 is implemented.
+*   Fallback images (if the first image doesn't boot) are not implemented.
+*   Exception vectors are copied to SRAM, but not remapped.
+*   Most OTP bits and straps are not honored.
+*   The reset type bits are not updated.
+*   OTP protection is not implemented.
+*   No clock initialization is performed.
+*   UART programming protocol is not implemented.
+*   Host notification through the PCI mailbox is not implemented.
+*   Most fields in the ROM status structure are not set.
diff --git a/bootrom.ld b/npcm7xx/bootrom.ld
index 34d59ad..34d59ad 100644
--- a/bootrom.ld
+++ b/npcm7xx/bootrom.ld
diff --git a/image.c b/npcm7xx/image.c
index 08fe3f5..08fe3f5 100644
--- a/image.c
+++ b/npcm7xx/image.c
diff --git a/start.S b/npcm7xx/start.S
index ca7aaf6..ca7aaf6 100644
--- a/start.S
+++ b/npcm7xx/start.S
diff --git a/npcm8xx/Makefile b/npcm8xx/Makefile
new file mode 100644
index 0000000..4796326
--- /dev/null
+++ b/npcm8xx/Makefile
@@ -0,0 +1,37 @@
+# Copyright 2022 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+CROSS_COMPILE	?= aarch64-linux-gnu-
+
+CC		= $(CROSS_COMPILE)gcc
+OBJCOPY		= $(CROSS_COMPILE)objcopy
+
+CFLAGS		= -Os -g -mcpu=cortex-a35
+ASFLAGS		= $(CFLAGS) -Wa,-mcpu=cortex-a35
+LDSCRIPT	= bootrom.ld
+LDFLAGS		= -Wl,--build-id=none -static -nostdlib -T $(LDSCRIPT)
+
+OBJS		:= start.o image.o
+
+.PHONY: all clean
+all: npcm8xx_bootrom.bin
+
+clean:
+	rm -f *.o *.bin *.elf
+
+npcm8xx_bootrom.bin: npcm8xx_bootrom.elf
+	$(OBJCOPY) -O binary $< $@
+
+npcm8xx_bootrom.elf: $(OBJS) $(LDSCRIPT)
+	$(CC) -o $@ $(LDFLAGS) $(OBJS)
diff --git a/npcm8xx/README.md b/npcm8xx/README.md
new file mode 100644
index 0000000..6341583
--- /dev/null
+++ b/npcm8xx/README.md
@@ -0,0 +1,44 @@
+# Virtual Boot ROM for NPCM7xx SoCs
+
+This is not an officially supported Google product.
+
+This is a super simple Boot ROM that is intended to be used as a `-bios` image
+for [QEMU](http://www.qemu.org/) when emulating an NPCM8xx-based machine.
+
+## Building
+
+If you have a 64-bit ARM compiler installed as `aarch64-linux-gnu-gcc`, simply run
+`make`.
+
+If your ARM compiler has a different name, you'll need to override the
+`CROSS_COMPILE` prefix, e.g. like this:
+
+```
+make CROSS_COMPILE=aarch64-linux-gnueabi-
+```
+
+If either case is successful, a `npcm8xx_bootrom.bin` file will be produced.
+
+## Using
+
+The Boot ROM image may be passed to a QEMU system emulator using the `-bios` option. For example like this:
+
+```
+qemu-system-aarch64 -machine npcm845-evb -nographic \
+    -bios "${IMAGES}/npcm8xx_bootrom.bin"
+    -drive file="${IMAGES}/image-bmc,if=mtd,bus=0,unit=0,format=raw,snapshot=on"
+```
+
+## Limitations
+
+*   Secure boot is not supported.
+*   Only booting from offset 0 of the flash at SPI0 CS0 is implemented.
+*   Fallback images (if the first image doesn't boot) are not implemented.
+*   Exception vectors are copied to SRAM, but not remapped.
+*   Most OTP bits and straps are not honored.
+*   The reset type bits are not updated.
+*   OTP protection is not implemented.
+*   No clock initialization is performed.
+*   UART programming protocol is not implemented.
+*   Host notification through the PCI mailbox is not implemented.
+*   Most fields in the ROM status structure are not set.
diff --git a/npcm8xx/bootrom.ld b/npcm8xx/bootrom.ld
new file mode 100644
index 0000000..412bf3a
--- /dev/null
+++ b/npcm8xx/bootrom.ld
@@ -0,0 +1,56 @@
+/*
+ * Linker script for the Boot ROM.
+ *
+ * Copyright 2020 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+MEMORY
+{
+	rom (rx) : ORIGIN = 0x00000000, LENGTH = 32K
+	ram (a!rx) : ORIGIN = 0xFFFB0000, LENGTH = 256K
+}
+
+SECTIONS
+{
+	/* Vectors are loaded into ROM, and copied into SRAM. */
+	.text.vectors : {
+		*(.text.vectors)
+		. = 0x100;
+	} >rom AT>ram
+	/* The rest of the code follows the vectors, but is not copied. */
+	.text : {
+		*(.text .text.*)
+		*(.rodata .rodata.*)
+		. = ALIGN(32);
+		_etext = .;
+	} >rom
+	/*
+	 * Data follows the code in ROM, and is copied after the vectors in RAM.
+	 * 32-byte aligned so we can use simple and fast copy loops.
+	 */
+	.data : {
+		_data = .;
+		*(.data.rom_status)
+		*(.data .data.*)
+		. = ALIGN(32);
+		_edata = .;
+	} >rom AT>ram
+	/* BSS lives in RAM, after the data section. */
+	.bss : {
+		*(.bss .bss.*)
+		. = ALIGN(32);
+		_end = .;
+	} >ram
+}
diff --git a/npcm8xx/image.c b/npcm8xx/image.c
new file mode 100644
index 0000000..f799774
--- /dev/null
+++ b/npcm8xx/image.c
@@ -0,0 +1,86 @@
+/*
+ * Boot image parsing and loading.
+ *
+ * Copyright 2022 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <stdint.h>
+
+#define SPI0CS0 0x80000000
+#define CLK 0xf0801000
+#define FIU0 0xfb000000
+#define CLK_CLKSEL  0x04
+#define CLK_CLKSEL_DEFAULT 0x1f18fc9
+#define FIU_DRD_CFG 0x00
+
+/*
+ * This structure must reside at offset 0x100 in SRAM.
+ *
+ * See the Check_ROMCode_Status function in the Nuvoton bootblock:
+ * https://github.com/Nuvoton-Israel/bootblock/blob/master/Src/bootblock_main.c#L795
+ */
+struct rom_status {
+    uint8_t reserved[12];
+    uint8_t start_tag[8];
+    uint32_t status;
+} rom_status __attribute__((section(".data.rom_status"))) = {
+    .status = 0x21, /* SPI0 CS0 offset 0 */
+};
+
+extern void panic(const char *);
+
+static void reg_write(uintptr_t base, uintptr_t offset, uint32_t value)
+{
+    asm volatile("str   %w0, [%1, %2]"
+                 :
+                 : "r"(value), "r"(base), "i"(offset)
+                 : "memory");
+}
+
+static uint32_t image_read_u8(uintptr_t base, uintptr_t offset)
+{
+    return *(uint8_t *)(base + offset);
+}
+
+static uint32_t image_read_u32(uintptr_t base, uintptr_t offset)
+{
+    return *(uint32_t *)(base + offset);
+}
+
+void copy_boot_image(uintptr_t dest_addr, uintptr_t src_addr, int32_t len)
+{
+    uint32_t *dst = (uint32_t *)dest_addr;
+    uint32_t *src = (uint32_t *)src_addr;
+
+    while (len > 0) {
+        *dst++ = *src++;
+        len -= sizeof(*dst);
+    }
+}
+
+uintptr_t load_boot_image(void)
+{
+    uintptr_t dest_addr = 0x8000;
+
+    /* Set CLKSEL to similar values as NPCM7XX */
+    reg_write(CLK, CLK_CLKSEL, CLK_CLKSEL_DEFAULT);
+
+    /* Load the U-BOOT image to DRAM */
+    copy_boot_image(dest_addr, SPI0CS0 + 0x20200, 0xa6e80);
+    /* Set FIU to use 4 byte mode, similar to what TIP does in reality. */
+    reg_write(FIU0, FIU_DRD_CFG, 0x0301100b);
+
+    return dest_addr;
+}
diff --git a/npcm8xx/start.S b/npcm8xx/start.S
new file mode 100644
index 0000000..58b04da
--- /dev/null
+++ b/npcm8xx/start.S
@@ -0,0 +1,146 @@
+/*
+ * Top-level entry points to the Boot ROM. This includes:
+ * - Reset, exception and interrupt vectors.
+ * - C run-time initialization.
+ * - Secondary CPU boot code.
+ *
+ * Copyright 2022 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define KiB (1024)
+
+#define SRAM_SIZE (256 * KiB)
+
+.section .text.vectors, "ax"
+
+.global _start
+.type _start, %function
+_start:
+b    reset
+. = 0x04
+b    undefined_instruction
+. = 0x08
+b    software_interrupt
+. = 0x0c
+b    prefetch_abort
+. = 0x10
+b    data_abort
+. = 0x18
+b    interrupt
+. = 0x1c
+b    fast_interrupt
+
+undefined_instruction:
+mov    x0, #1
+b      handle_exception
+
+software_interrupt:
+mov    x0, #2
+b      handle_exception
+
+prefetch_abort:
+mov    x0, #3
+b    handle_exception
+
+data_abort:
+mov    x0, #4
+b    handle_exception
+
+interrupt:
+mov    x0, #6
+b    handle_exception
+
+fast_interrupt:
+mov    x0, #7
+b    handle_exception
+
+vectors_end:
+
+.text
+.align 2
+handle_exception:
+
+.global panic
+.type panic, %function
+panic:
+1:    wfi
+b    1b
+.size panic, . - panic
+
+.type reset, %function
+reset:
+mov    x0, #0
+// Read the CPU ID from MPIDR_EL1.
+mrs    x1, MPIDR_EL1
+and    x1, x1, #0x03
+cbz    x1, cpu0_init
+
+// Not CPU0 -- clear the SCRPAD register and wait for it to change.
+ldr    x2, scrpad_addr
+str    x0, [x2]
+dsb    st
+sev
+1:     wfe
+ldr    x3, [x2]
+cmp    x3, #0
+beq    1b
+
+// SCRPAD is no longer NULL, so jump there.
+ret   x3
+.size reset, . - reset
+
+.type scrpad_addr, %object
+scrpad_addr:
+.dword    0xF0800E00
+.size scrpad_addr, . - scrpad_addr
+
+.type cpu0_init, %function
+cpu0_init:
+ldr    x1, sram_base_addr
+add    sp, x1, #SRAM_SIZE
+
+// Load the boot image into SRAM. Returns the entry address.
+bl    load_boot_image
+
+// Jump to the boot image. Panic if it returns back to us.
+ret  x0
+b    panic
+
+.size cpu0_init, . - cpu0_init
+
+.type sram_base_addr, %object
+sram_base_addr:
+.dword    0xFFFB0000
+.size sram_base_addr, . - sram_base_addr
+
+.type sdram_base_addr, %object
+sdram_base_addr:
+.dword    0x00000000
+.size sdram_base_addr, . - sdram_base_addr
+
+.type etext_addr, %object
+etext_addr:
+.dword    _etext
+.size etext_addr, . - etext_addr
+
+.type edata_addr, %object
+edata_addr:
+.dword    _edata
+.size edata_addr, . - edata_addr
+
+.type end_addr, %object
+end_addr:
+.dword    _end
+.size end_addr, . - end_addr