2 * ARM V2M MPS2 board emulation, trustzone aware FPGA images
4 * Copyright (c) 2017 Linaro Limited
5 * Written by Peter Maydell
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License version 2 or
9 * (at your option) any later version.
12 /* The MPS2 and MPS2+ dev boards are FPGA based (the 2+ has a bigger
13 * FPGA but is otherwise the same as the 2). Since the CPU itself
14 * and most of the devices are in the FPGA, the details of the board
15 * as seen by the guest depend significantly on the FPGA image.
16 * This source file covers the following FPGA images, for TrustZone cores:
17 * "mps2-an505" -- Cortex-M33 as documented in ARM Application Note AN505
19 * Links to the TRM for the board itself and to the various Application
20 * Notes which document the FPGA images can be found here:
21 * https://developer.arm.com/products/system-design/development-boards/fpga-prototyping-boards/mps2
24 * http://infocenter.arm.com/help/topic/com.arm.doc.100112_0200_06_en/versatile_express_cortex_m_prototyping_systems_v2m_mps2_and_v2m_mps2plus_technical_reference_100112_0200_06_en.pdf
25 * Application Note AN505:
26 * http://infocenter.arm.com/help/topic/com.arm.doc.dai0505b/index.html
28 * The AN505 defers to the Cortex-M33 processor ARMv8M IoT Kit FVP User Guide
29 * (ARM ECM0601256) for the details of some of the device layout:
30 * http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ecm0601256/index.html
33 #include "qemu/osdep.h"
34 #include "qapi/error.h"
35 #include "qemu/error-report.h"
36 #include "hw/arm/arm.h"
37 #include "hw/arm/armv7m.h"
38 #include "hw/or-irq.h"
39 #include "hw/boards.h"
40 #include "exec/address-spaces.h"
41 #include "sysemu/sysemu.h"
42 #include "hw/misc/unimp.h"
43 #include "hw/char/cmsdk-apb-uart.h"
44 #include "hw/timer/cmsdk-apb-timer.h"
45 #include "hw/misc/mps2-scc.h"
46 #include "hw/misc/mps2-fpgaio.h"
47 #include "hw/misc/tz-mpc.h"
48 #include "hw/arm/iotkit.h"
49 #include "hw/devices.h"
51 #include "hw/core/split-irq.h"
53 typedef enum MPS2TZFPGAType
{
59 MPS2TZFPGAType fpga_type
;
68 MemoryRegion ssram
[3];
69 MemoryRegion ssram1_m
;
74 UnimplementedDeviceState spi
[5];
75 UnimplementedDeviceState i2c
[4];
76 UnimplementedDeviceState i2s_audio
;
77 UnimplementedDeviceState gpio
[4];
78 UnimplementedDeviceState dma
[4];
79 UnimplementedDeviceState gfx
;
81 SplitIRQ sec_resp_splitter
;
82 qemu_or_irq uart_irq_orgate
;
86 #define TYPE_MPS2TZ_MACHINE "mps2tz"
87 #define TYPE_MPS2TZ_AN505_MACHINE MACHINE_TYPE_NAME("mps2-an505")
89 #define MPS2TZ_MACHINE(obj) \
90 OBJECT_CHECK(MPS2TZMachineState, obj, TYPE_MPS2TZ_MACHINE)
91 #define MPS2TZ_MACHINE_GET_CLASS(obj) \
92 OBJECT_GET_CLASS(MPS2TZMachineClass, obj, TYPE_MPS2TZ_MACHINE)
93 #define MPS2TZ_MACHINE_CLASS(klass) \
94 OBJECT_CLASS_CHECK(MPS2TZMachineClass, klass, TYPE_MPS2TZ_MACHINE)
96 /* Main SYSCLK frequency in Hz */
97 #define SYSCLK_FRQ 20000000
99 /* Create an alias of an entire original MemoryRegion @orig
100 * located at @base in the memory map.
102 static void make_ram_alias(MemoryRegion
*mr
, const char *name
,
103 MemoryRegion
*orig
, hwaddr base
)
105 memory_region_init_alias(mr
, NULL
, name
, orig
, 0,
106 memory_region_size(orig
));
107 memory_region_add_subregion(get_system_memory(), base
, mr
);
110 static void init_sysbus_child(Object
*parent
, const char *childname
,
111 void *child
, size_t childsize
,
112 const char *childtype
)
114 object_initialize(child
, childsize
, childtype
);
115 object_property_add_child(parent
, childname
, OBJECT(child
), &error_abort
);
116 qdev_set_parent_bus(DEVICE(child
), sysbus_get_default());
120 /* Most of the devices in the AN505 FPGA image sit behind
121 * Peripheral Protection Controllers. These data structures
122 * define the layout of which devices sit behind which PPCs.
123 * The devfn for each port is a function which creates, configures
124 * and initializes the device, returning the MemoryRegion which
125 * needs to be plugged into the downstream end of the PPC port.
127 typedef MemoryRegion
*MakeDevFn(MPS2TZMachineState
*mms
, void *opaque
,
128 const char *name
, hwaddr size
);
130 typedef struct PPCPortInfo
{
138 typedef struct PPCInfo
{
140 PPCPortInfo ports
[TZ_NUM_PORTS
];
143 static MemoryRegion
*make_unimp_dev(MPS2TZMachineState
*mms
,
145 const char *name
, hwaddr size
)
147 /* Initialize, configure and realize a TYPE_UNIMPLEMENTED_DEVICE,
148 * and return a pointer to its MemoryRegion.
150 UnimplementedDeviceState
*uds
= opaque
;
152 init_sysbus_child(OBJECT(mms
), name
, uds
,
153 sizeof(UnimplementedDeviceState
),
154 TYPE_UNIMPLEMENTED_DEVICE
);
155 qdev_prop_set_string(DEVICE(uds
), "name", name
);
156 qdev_prop_set_uint64(DEVICE(uds
), "size", size
);
157 object_property_set_bool(OBJECT(uds
), true, "realized", &error_fatal
);
158 return sysbus_mmio_get_region(SYS_BUS_DEVICE(uds
), 0);
161 static MemoryRegion
*make_uart(MPS2TZMachineState
*mms
, void *opaque
,
162 const char *name
, hwaddr size
)
164 CMSDKAPBUART
*uart
= opaque
;
165 int i
= uart
- &mms
->uart
[0];
167 int txirqno
= i
* 2 + 1;
168 int combirqno
= i
+ 10;
170 DeviceState
*iotkitdev
= DEVICE(&mms
->iotkit
);
171 DeviceState
*orgate_dev
= DEVICE(&mms
->uart_irq_orgate
);
173 init_sysbus_child(OBJECT(mms
), name
, uart
,
174 sizeof(mms
->uart
[0]), TYPE_CMSDK_APB_UART
);
175 qdev_prop_set_chr(DEVICE(uart
), "chardev", serial_hd(i
));
176 qdev_prop_set_uint32(DEVICE(uart
), "pclk-frq", SYSCLK_FRQ
);
177 object_property_set_bool(OBJECT(uart
), true, "realized", &error_fatal
);
178 s
= SYS_BUS_DEVICE(uart
);
179 sysbus_connect_irq(s
, 0, qdev_get_gpio_in_named(iotkitdev
,
180 "EXP_IRQ", txirqno
));
181 sysbus_connect_irq(s
, 1, qdev_get_gpio_in_named(iotkitdev
,
182 "EXP_IRQ", rxirqno
));
183 sysbus_connect_irq(s
, 2, qdev_get_gpio_in(orgate_dev
, i
* 2));
184 sysbus_connect_irq(s
, 3, qdev_get_gpio_in(orgate_dev
, i
* 2 + 1));
185 sysbus_connect_irq(s
, 4, qdev_get_gpio_in_named(iotkitdev
,
186 "EXP_IRQ", combirqno
));
187 return sysbus_mmio_get_region(SYS_BUS_DEVICE(uart
), 0);
190 static MemoryRegion
*make_scc(MPS2TZMachineState
*mms
, void *opaque
,
191 const char *name
, hwaddr size
)
193 MPS2SCC
*scc
= opaque
;
195 MPS2TZMachineClass
*mmc
= MPS2TZ_MACHINE_GET_CLASS(mms
);
197 object_initialize(scc
, sizeof(mms
->scc
), TYPE_MPS2_SCC
);
198 sccdev
= DEVICE(scc
);
199 qdev_set_parent_bus(sccdev
, sysbus_get_default());
200 qdev_prop_set_uint32(sccdev
, "scc-cfg4", 0x2);
201 qdev_prop_set_uint32(sccdev
, "scc-aid", 0x02000008);
202 qdev_prop_set_uint32(sccdev
, "scc-id", mmc
->scc_id
);
203 object_property_set_bool(OBJECT(scc
), true, "realized", &error_fatal
);
204 return sysbus_mmio_get_region(SYS_BUS_DEVICE(sccdev
), 0);
207 static MemoryRegion
*make_fpgaio(MPS2TZMachineState
*mms
, void *opaque
,
208 const char *name
, hwaddr size
)
210 MPS2FPGAIO
*fpgaio
= opaque
;
212 object_initialize(fpgaio
, sizeof(mms
->fpgaio
), TYPE_MPS2_FPGAIO
);
213 qdev_set_parent_bus(DEVICE(fpgaio
), sysbus_get_default());
214 object_property_set_bool(OBJECT(fpgaio
), true, "realized", &error_fatal
);
215 return sysbus_mmio_get_region(SYS_BUS_DEVICE(fpgaio
), 0);
218 static MemoryRegion
*make_eth_dev(MPS2TZMachineState
*mms
, void *opaque
,
219 const char *name
, hwaddr size
)
222 DeviceState
*iotkitdev
= DEVICE(&mms
->iotkit
);
223 NICInfo
*nd
= &nd_table
[0];
225 /* In hardware this is a LAN9220; the LAN9118 is software compatible
226 * except that it doesn't support the checksum-offload feature.
228 qemu_check_nic_model(nd
, "lan9118");
229 mms
->lan9118
= qdev_create(NULL
, "lan9118");
230 qdev_set_nic_properties(mms
->lan9118
, nd
);
231 qdev_init_nofail(mms
->lan9118
);
233 s
= SYS_BUS_DEVICE(mms
->lan9118
);
234 sysbus_connect_irq(s
, 0, qdev_get_gpio_in_named(iotkitdev
, "EXP_IRQ", 16));
235 return sysbus_mmio_get_region(s
, 0);
238 static MemoryRegion
*make_mpc(MPS2TZMachineState
*mms
, void *opaque
,
239 const char *name
, hwaddr size
)
242 int i
= mpc
- &mms
->ssram_mpc
[0];
243 MemoryRegion
*ssram
= &mms
->ssram
[i
];
244 MemoryRegion
*upstream
;
245 char *mpcname
= g_strdup_printf("%s-mpc", name
);
246 static uint32_t ramsize
[] = { 0x00400000, 0x00200000, 0x00200000 };
247 static uint32_t rambase
[] = { 0x00000000, 0x28000000, 0x28200000 };
249 memory_region_init_ram(ssram
, NULL
, name
, ramsize
[i
], &error_fatal
);
251 init_sysbus_child(OBJECT(mms
), mpcname
, mpc
,
252 sizeof(mms
->ssram_mpc
[0]), TYPE_TZ_MPC
);
253 object_property_set_link(OBJECT(mpc
), OBJECT(ssram
),
254 "downstream", &error_fatal
);
255 object_property_set_bool(OBJECT(mpc
), true, "realized", &error_fatal
);
256 /* Map the upstream end of the MPC into system memory */
257 upstream
= sysbus_mmio_get_region(SYS_BUS_DEVICE(mpc
), 1);
258 memory_region_add_subregion(get_system_memory(), rambase
[i
], upstream
);
259 /* and connect its interrupt to the IoTKit */
260 qdev_connect_gpio_out_named(DEVICE(mpc
), "irq", 0,
261 qdev_get_gpio_in_named(DEVICE(&mms
->iotkit
),
262 "mpcexp_status", i
));
264 /* The first SSRAM is a special case as it has an alias; accesses to
265 * the alias region at 0x00400000 must also go to the MPC upstream.
268 make_ram_alias(&mms
->ssram1_m
, "mps.ssram1_m", upstream
, 0x00400000);
272 /* Return the register interface MR for our caller to map behind the PPC */
273 return sysbus_mmio_get_region(SYS_BUS_DEVICE(mpc
), 0);
276 static void mps2tz_common_init(MachineState
*machine
)
278 MPS2TZMachineState
*mms
= MPS2TZ_MACHINE(machine
);
279 MachineClass
*mc
= MACHINE_GET_CLASS(machine
);
280 MemoryRegion
*system_memory
= get_system_memory();
281 DeviceState
*iotkitdev
;
282 DeviceState
*dev_splitter
;
285 if (strcmp(machine
->cpu_type
, mc
->default_cpu_type
) != 0) {
286 error_report("This board can only be used with CPU %s",
287 mc
->default_cpu_type
);
291 init_sysbus_child(OBJECT(machine
), "iotkit", &mms
->iotkit
,
292 sizeof(mms
->iotkit
), TYPE_IOTKIT
);
293 iotkitdev
= DEVICE(&mms
->iotkit
);
294 object_property_set_link(OBJECT(&mms
->iotkit
), OBJECT(system_memory
),
295 "memory", &error_abort
);
296 qdev_prop_set_uint32(iotkitdev
, "EXP_NUMIRQ", 92);
297 qdev_prop_set_uint32(iotkitdev
, "MAINCLK", SYSCLK_FRQ
);
298 object_property_set_bool(OBJECT(&mms
->iotkit
), true, "realized",
301 /* The sec_resp_cfg output from the IoTKit must be split into multiple
302 * lines, one for each of the PPCs we create here.
304 object_initialize(&mms
->sec_resp_splitter
, sizeof(mms
->sec_resp_splitter
),
306 object_property_add_child(OBJECT(machine
), "sec-resp-splitter",
307 OBJECT(&mms
->sec_resp_splitter
), &error_abort
);
308 object_property_set_int(OBJECT(&mms
->sec_resp_splitter
), 5,
309 "num-lines", &error_fatal
);
310 object_property_set_bool(OBJECT(&mms
->sec_resp_splitter
), true,
311 "realized", &error_fatal
);
312 dev_splitter
= DEVICE(&mms
->sec_resp_splitter
);
313 qdev_connect_gpio_out_named(iotkitdev
, "sec_resp_cfg", 0,
314 qdev_get_gpio_in(dev_splitter
, 0));
316 /* The IoTKit sets up much of the memory layout, including
317 * the aliases between secure and non-secure regions in the
318 * address space. The FPGA itself contains:
320 * 0x00000000..0x003fffff SSRAM1
321 * 0x00400000..0x007fffff alias of SSRAM1
322 * 0x28000000..0x283fffff 4MB SSRAM2 + SSRAM3
323 * 0x40100000..0x4fffffff AHB Master Expansion 1 interface devices
324 * 0x80000000..0x80ffffff 16MB PSRAM
327 /* The FPGA images have an odd combination of different RAMs,
328 * because in hardware they are different implementations and
329 * connected to different buses, giving varying performance/size
330 * tradeoffs. For QEMU they're all just RAM, though. We arbitrarily
331 * call the 16MB our "system memory", as it's the largest lump.
333 memory_region_allocate_system_memory(&mms
->psram
,
334 NULL
, "mps.ram", 0x01000000);
335 memory_region_add_subregion(system_memory
, 0x80000000, &mms
->psram
);
337 /* The overflow IRQs for all UARTs are ORed together.
338 * Tx, Rx and "combined" IRQs are sent to the NVIC separately.
339 * Create the OR gate for this.
341 object_initialize(&mms
->uart_irq_orgate
, sizeof(mms
->uart_irq_orgate
),
343 object_property_add_child(OBJECT(mms
), "uart-irq-orgate",
344 OBJECT(&mms
->uart_irq_orgate
), &error_abort
);
345 object_property_set_int(OBJECT(&mms
->uart_irq_orgate
), 10, "num-lines",
347 object_property_set_bool(OBJECT(&mms
->uart_irq_orgate
), true,
348 "realized", &error_fatal
);
349 qdev_connect_gpio_out(DEVICE(&mms
->uart_irq_orgate
), 0,
350 qdev_get_gpio_in_named(iotkitdev
, "EXP_IRQ", 15));
352 /* Most of the devices in the FPGA are behind Peripheral Protection
353 * Controllers. The required order for initializing things is:
354 * + initialize the PPC
355 * + initialize, configure and realize downstream devices
356 * + connect downstream device MemoryRegions to the PPC
358 * + map the PPC's MemoryRegions to the places in the address map
359 * where the downstream devices should appear
360 * + wire up the PPC's control lines to the IoTKit object
363 const PPCInfo ppcs
[] = { {
364 .name
= "apb_ppcexp0",
366 { "ssram-0", make_mpc
, &mms
->ssram_mpc
[0], 0x58007000, 0x1000 },
367 { "ssram-1", make_mpc
, &mms
->ssram_mpc
[1], 0x58008000, 0x1000 },
368 { "ssram-2", make_mpc
, &mms
->ssram_mpc
[2], 0x58009000, 0x1000 },
371 .name
= "apb_ppcexp1",
373 { "spi0", make_unimp_dev
, &mms
->spi
[0], 0x40205000, 0x1000 },
374 { "spi1", make_unimp_dev
, &mms
->spi
[1], 0x40206000, 0x1000 },
375 { "spi2", make_unimp_dev
, &mms
->spi
[2], 0x40209000, 0x1000 },
376 { "spi3", make_unimp_dev
, &mms
->spi
[3], 0x4020a000, 0x1000 },
377 { "spi4", make_unimp_dev
, &mms
->spi
[4], 0x4020b000, 0x1000 },
378 { "uart0", make_uart
, &mms
->uart
[0], 0x40200000, 0x1000 },
379 { "uart1", make_uart
, &mms
->uart
[1], 0x40201000, 0x1000 },
380 { "uart2", make_uart
, &mms
->uart
[2], 0x40202000, 0x1000 },
381 { "uart3", make_uart
, &mms
->uart
[3], 0x40203000, 0x1000 },
382 { "uart4", make_uart
, &mms
->uart
[4], 0x40204000, 0x1000 },
383 { "i2c0", make_unimp_dev
, &mms
->i2c
[0], 0x40207000, 0x1000 },
384 { "i2c1", make_unimp_dev
, &mms
->i2c
[1], 0x40208000, 0x1000 },
385 { "i2c2", make_unimp_dev
, &mms
->i2c
[2], 0x4020c000, 0x1000 },
386 { "i2c3", make_unimp_dev
, &mms
->i2c
[3], 0x4020d000, 0x1000 },
389 .name
= "apb_ppcexp2",
391 { "scc", make_scc
, &mms
->scc
, 0x40300000, 0x1000 },
392 { "i2s-audio", make_unimp_dev
, &mms
->i2s_audio
,
393 0x40301000, 0x1000 },
394 { "fpgaio", make_fpgaio
, &mms
->fpgaio
, 0x40302000, 0x1000 },
397 .name
= "ahb_ppcexp0",
399 { "gfx", make_unimp_dev
, &mms
->gfx
, 0x41000000, 0x140000 },
400 { "gpio0", make_unimp_dev
, &mms
->gpio
[0], 0x40100000, 0x1000 },
401 { "gpio1", make_unimp_dev
, &mms
->gpio
[1], 0x40101000, 0x1000 },
402 { "gpio2", make_unimp_dev
, &mms
->gpio
[2], 0x40102000, 0x1000 },
403 { "gpio3", make_unimp_dev
, &mms
->gpio
[3], 0x40103000, 0x1000 },
404 { "eth", make_eth_dev
, NULL
, 0x42000000, 0x100000 },
407 .name
= "ahb_ppcexp1",
409 { "dma0", make_unimp_dev
, &mms
->dma
[0], 0x40110000, 0x1000 },
410 { "dma1", make_unimp_dev
, &mms
->dma
[1], 0x40111000, 0x1000 },
411 { "dma2", make_unimp_dev
, &mms
->dma
[2], 0x40112000, 0x1000 },
412 { "dma3", make_unimp_dev
, &mms
->dma
[3], 0x40113000, 0x1000 },
417 for (i
= 0; i
< ARRAY_SIZE(ppcs
); i
++) {
418 const PPCInfo
*ppcinfo
= &ppcs
[i
];
419 TZPPC
*ppc
= &mms
->ppc
[i
];
424 init_sysbus_child(OBJECT(machine
), ppcinfo
->name
, ppc
,
425 sizeof(TZPPC
), TYPE_TZ_PPC
);
426 ppcdev
= DEVICE(ppc
);
428 for (port
= 0; port
< TZ_NUM_PORTS
; port
++) {
429 const PPCPortInfo
*pinfo
= &ppcinfo
->ports
[port
];
437 mr
= pinfo
->devfn(mms
, pinfo
->opaque
, pinfo
->name
, pinfo
->size
);
438 portname
= g_strdup_printf("port[%d]", port
);
439 object_property_set_link(OBJECT(ppc
), OBJECT(mr
),
440 portname
, &error_fatal
);
444 object_property_set_bool(OBJECT(ppc
), true, "realized", &error_fatal
);
446 for (port
= 0; port
< TZ_NUM_PORTS
; port
++) {
447 const PPCPortInfo
*pinfo
= &ppcinfo
->ports
[port
];
452 sysbus_mmio_map(SYS_BUS_DEVICE(ppc
), port
, pinfo
->addr
);
454 gpioname
= g_strdup_printf("%s_nonsec", ppcinfo
->name
);
455 qdev_connect_gpio_out_named(iotkitdev
, gpioname
, port
,
456 qdev_get_gpio_in_named(ppcdev
,
460 gpioname
= g_strdup_printf("%s_ap", ppcinfo
->name
);
461 qdev_connect_gpio_out_named(iotkitdev
, gpioname
, port
,
462 qdev_get_gpio_in_named(ppcdev
,
467 gpioname
= g_strdup_printf("%s_irq_enable", ppcinfo
->name
);
468 qdev_connect_gpio_out_named(iotkitdev
, gpioname
, 0,
469 qdev_get_gpio_in_named(ppcdev
,
472 gpioname
= g_strdup_printf("%s_irq_clear", ppcinfo
->name
);
473 qdev_connect_gpio_out_named(iotkitdev
, gpioname
, 0,
474 qdev_get_gpio_in_named(ppcdev
,
477 gpioname
= g_strdup_printf("%s_irq_status", ppcinfo
->name
);
478 qdev_connect_gpio_out_named(ppcdev
, "irq", 0,
479 qdev_get_gpio_in_named(iotkitdev
,
483 qdev_connect_gpio_out(dev_splitter
, i
,
484 qdev_get_gpio_in_named(ppcdev
,
488 create_unimplemented_device("FPGA NS PC", 0x48007000, 0x1000);
490 armv7m_load_kernel(ARM_CPU(first_cpu
), machine
->kernel_filename
, 0x400000);
493 static void mps2tz_class_init(ObjectClass
*oc
, void *data
)
495 MachineClass
*mc
= MACHINE_CLASS(oc
);
497 mc
->init
= mps2tz_common_init
;
501 static void mps2tz_an505_class_init(ObjectClass
*oc
, void *data
)
503 MachineClass
*mc
= MACHINE_CLASS(oc
);
504 MPS2TZMachineClass
*mmc
= MPS2TZ_MACHINE_CLASS(oc
);
506 mc
->desc
= "ARM MPS2 with AN505 FPGA image for Cortex-M33";
507 mmc
->fpga_type
= FPGA_AN505
;
508 mc
->default_cpu_type
= ARM_CPU_TYPE_NAME("cortex-m33");
509 mmc
->scc_id
= 0x41040000 | (505 << 4);
512 static const TypeInfo mps2tz_info
= {
513 .name
= TYPE_MPS2TZ_MACHINE
,
514 .parent
= TYPE_MACHINE
,
516 .instance_size
= sizeof(MPS2TZMachineState
),
517 .class_size
= sizeof(MPS2TZMachineClass
),
518 .class_init
= mps2tz_class_init
,
521 static const TypeInfo mps2tz_an505_info
= {
522 .name
= TYPE_MPS2TZ_AN505_MACHINE
,
523 .parent
= TYPE_MPS2TZ_MACHINE
,
524 .class_init
= mps2tz_an505_class_init
,
527 static void mps2tz_machine_init(void)
529 type_register_static(&mps2tz_info
);
530 type_register_static(&mps2tz_an505_info
);
533 type_init(mps2tz_machine_init
);