2 * ARM V2M MPS2 board emulation, trustzone aware FPGA images
4 * Copyright (c) 2017 Linaro Limited
5 * Written by Peter Maydell
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License version 2 or
9 * (at your option) any later version.
12 /* The MPS2 and MPS2+ dev boards are FPGA based (the 2+ has a bigger
13 * FPGA but is otherwise the same as the 2). Since the CPU itself
14 * and most of the devices are in the FPGA, the details of the board
15 * as seen by the guest depend significantly on the FPGA image.
16 * This source file covers the following FPGA images, for TrustZone cores:
17 * "mps2-an505" -- Cortex-M33 as documented in ARM Application Note AN505
18 * "mps2-an521" -- Dual Cortex-M33 as documented in Application Note AN521
19 * "mps2-an524" -- Dual Cortex-M33 as documented in Application Note AN524
21 * Links to the TRM for the board itself and to the various Application
22 * Notes which document the FPGA images can be found here:
23 * https://developer.arm.com/products/system-design/development-boards/fpga-prototyping-boards/mps2
26 * https://developer.arm.com/documentation/100112/latest/
27 * Application Note AN505:
28 * https://developer.arm.com/documentation/dai0505/latest/
29 * Application Note AN521:
30 * https://developer.arm.com/documentation/dai0521/latest/
31 * Application Note AN524:
32 * https://developer.arm.com/documentation/dai0524/latest/
34 * The AN505 defers to the Cortex-M33 processor ARMv8M IoT Kit FVP User Guide
35 * (ARM ECM0601256) for the details of some of the device layout:
36 * https://developer.arm.com/documentation/ecm0601256/latest
37 * Similarly, the AN521 and AN524 use the SSE-200, and the SSE-200 TRM defines
38 * most of the device layout:
39 * https://developer.arm.com/documentation/101104/latest/
42 #include "qemu/osdep.h"
43 #include "qemu/units.h"
44 #include "qemu/cutils.h"
45 #include "qapi/error.h"
46 #include "qemu/error-report.h"
47 #include "hw/arm/boot.h"
48 #include "hw/arm/armv7m.h"
49 #include "hw/or-irq.h"
50 #include "hw/boards.h"
51 #include "exec/address-spaces.h"
52 #include "sysemu/sysemu.h"
53 #include "hw/misc/unimp.h"
54 #include "hw/char/cmsdk-apb-uart.h"
55 #include "hw/timer/cmsdk-apb-timer.h"
56 #include "hw/misc/mps2-scc.h"
57 #include "hw/misc/mps2-fpgaio.h"
58 #include "hw/misc/tz-mpc.h"
59 #include "hw/misc/tz-msc.h"
60 #include "hw/arm/armsse.h"
61 #include "hw/dma/pl080.h"
62 #include "hw/rtc/pl031.h"
63 #include "hw/ssi/pl022.h"
64 #include "hw/i2c/arm_sbcon_i2c.h"
65 #include "hw/net/lan9118.h"
67 #include "hw/core/split-irq.h"
68 #include "hw/qdev-clock.h"
69 #include "qom/object.h"
71 #define MPS2TZ_NUMIRQ_MAX 95
72 #define MPS2TZ_RAM_MAX 4
74 typedef enum MPS2TZFPGAType
{
81 * Define the layout of RAM in a board, including which parts are
83 * mrindex specifies the index into mms->ram[] to use for the backing RAM;
84 * -1 means "use the system RAM".
86 typedef struct RAMInfo
{
90 int mpc
; /* MPC number, -1 for "not behind an MPC" */
97 * IS_ALIAS: this RAM area is an alias to the upstream end of the
98 * MPC specified by its .mpc value
99 * IS_ROM: this RAM area is read-only
104 struct MPS2TZMachineClass
{
106 MPS2TZFPGAType fpga_type
;
108 uint32_t sysclk_frq
; /* Main SYSCLK frequency in Hz */
110 const uint32_t *oscclk
;
111 uint32_t fpgaio_num_leds
; /* Number of LEDs in FPGAIO LED0 register */
112 bool fpgaio_has_switches
; /* Does FPGAIO have SWITCH register? */
113 bool fpgaio_has_dbgctrl
; /* Does FPGAIO have DBGCTRL register? */
114 int numirq
; /* Number of external interrupts */
115 int uart_overflow_irq
; /* number of the combined UART overflow IRQ */
116 const RAMInfo
*raminfo
;
117 const char *armsse_type
;
120 struct MPS2TZMachineState
{
124 MemoryRegion ram
[MPS2TZ_RAM_MAX
];
125 MemoryRegion eth_usb_container
;
132 ArmSbconI2CState i2c
[5];
133 UnimplementedDeviceState i2s_audio
;
134 UnimplementedDeviceState gpio
[4];
135 UnimplementedDeviceState gfx
;
136 UnimplementedDeviceState cldc
;
137 UnimplementedDeviceState usb
;
141 CMSDKAPBUART uart
[6];
142 SplitIRQ sec_resp_splitter
;
143 qemu_or_irq uart_irq_orgate
;
144 DeviceState
*lan9118
;
145 SplitIRQ cpu_irq_splitter
[MPS2TZ_NUMIRQ_MAX
];
150 #define TYPE_MPS2TZ_MACHINE "mps2tz"
151 #define TYPE_MPS2TZ_AN505_MACHINE MACHINE_TYPE_NAME("mps2-an505")
152 #define TYPE_MPS2TZ_AN521_MACHINE MACHINE_TYPE_NAME("mps2-an521")
153 #define TYPE_MPS3TZ_AN524_MACHINE MACHINE_TYPE_NAME("mps3-an524")
155 OBJECT_DECLARE_TYPE(MPS2TZMachineState
, MPS2TZMachineClass
, MPS2TZ_MACHINE
)
157 /* Slow 32Khz S32KCLK frequency in Hz */
158 #define S32KCLK_FRQ (32 * 1000)
161 * The MPS3 DDR is 2GiB, but on a 32-bit host QEMU doesn't permit
162 * emulation of that much guest RAM, so artificially make it smaller.
164 #if HOST_LONG_BITS == 32
165 #define MPS3_DDR_SIZE (1 * GiB)
167 #define MPS3_DDR_SIZE (2 * GiB)
170 static const uint32_t an505_oscclk
[] = {
176 static const uint32_t an524_oscclk
[] = {
185 static const RAMInfo an505_raminfo
[] = { {
204 .name
= "ssram-0-alias",
211 /* Use the largest bit of contiguous RAM as our "system memory" */
222 static const RAMInfo an524_raminfo
[] = { {
231 .size
= 32 * 4 * KiB
,
235 /* We don't model QSPI flash yet; for now expose it as simple ROM */
245 .size
= MPS3_DDR_SIZE
,
253 static const RAMInfo
*find_raminfo_for_mpc(MPS2TZMachineState
*mms
, int mpc
)
255 MPS2TZMachineClass
*mmc
= MPS2TZ_MACHINE_GET_CLASS(mms
);
258 for (p
= mmc
->raminfo
; p
->name
; p
++) {
259 if (p
->mpc
== mpc
&& !(p
->flags
& IS_ALIAS
)) {
263 /* if raminfo array doesn't have an entry for each MPC this is a bug */
264 g_assert_not_reached();
267 static MemoryRegion
*mr_for_raminfo(MPS2TZMachineState
*mms
,
268 const RAMInfo
*raminfo
)
270 /* Return an initialized MemoryRegion for the RAMInfo. */
273 if (raminfo
->mrindex
< 0) {
274 /* Means this RAMInfo is for QEMU's "system memory" */
275 MachineState
*machine
= MACHINE(mms
);
276 assert(!(raminfo
->flags
& IS_ROM
));
280 assert(raminfo
->mrindex
< MPS2TZ_RAM_MAX
);
281 ram
= &mms
->ram
[raminfo
->mrindex
];
283 memory_region_init_ram(ram
, NULL
, raminfo
->name
,
284 raminfo
->size
, &error_fatal
);
285 if (raminfo
->flags
& IS_ROM
) {
286 memory_region_set_readonly(ram
, true);
291 /* Create an alias of an entire original MemoryRegion @orig
292 * located at @base in the memory map.
294 static void make_ram_alias(MemoryRegion
*mr
, const char *name
,
295 MemoryRegion
*orig
, hwaddr base
)
297 memory_region_init_alias(mr
, NULL
, name
, orig
, 0,
298 memory_region_size(orig
));
299 memory_region_add_subregion(get_system_memory(), base
, mr
);
302 static qemu_irq
get_sse_irq_in(MPS2TZMachineState
*mms
, int irqno
)
305 * Return a qemu_irq which will signal IRQ n to all CPUs in the
306 * SSE. The irqno should be as the CPU sees it, so the first
307 * external-to-the-SSE interrupt is 32.
309 MachineClass
*mc
= MACHINE_GET_CLASS(mms
);
310 MPS2TZMachineClass
*mmc
= MPS2TZ_MACHINE_GET_CLASS(mms
);
312 assert(irqno
>= 32 && irqno
< (mmc
->numirq
+ 32));
315 * Convert from "CPU irq number" (as listed in the FPGA image
316 * documentation) to the SSE external-interrupt number.
320 if (mc
->max_cpus
> 1) {
321 return qdev_get_gpio_in(DEVICE(&mms
->cpu_irq_splitter
[irqno
]), 0);
323 return qdev_get_gpio_in_named(DEVICE(&mms
->iotkit
), "EXP_IRQ", irqno
);
327 /* Most of the devices in the AN505 FPGA image sit behind
328 * Peripheral Protection Controllers. These data structures
329 * define the layout of which devices sit behind which PPCs.
330 * The devfn for each port is a function which creates, configures
331 * and initializes the device, returning the MemoryRegion which
332 * needs to be plugged into the downstream end of the PPC port.
334 typedef MemoryRegion
*MakeDevFn(MPS2TZMachineState
*mms
, void *opaque
,
335 const char *name
, hwaddr size
,
338 typedef struct PPCPortInfo
{
344 int irqs
[3]; /* currently no device needs more IRQ lines than this */
347 typedef struct PPCInfo
{
349 PPCPortInfo ports
[TZ_NUM_PORTS
];
352 static MemoryRegion
*make_unimp_dev(MPS2TZMachineState
*mms
,
354 const char *name
, hwaddr size
,
357 /* Initialize, configure and realize a TYPE_UNIMPLEMENTED_DEVICE,
358 * and return a pointer to its MemoryRegion.
360 UnimplementedDeviceState
*uds
= opaque
;
362 object_initialize_child(OBJECT(mms
), name
, uds
, TYPE_UNIMPLEMENTED_DEVICE
);
363 qdev_prop_set_string(DEVICE(uds
), "name", name
);
364 qdev_prop_set_uint64(DEVICE(uds
), "size", size
);
365 sysbus_realize(SYS_BUS_DEVICE(uds
), &error_fatal
);
366 return sysbus_mmio_get_region(SYS_BUS_DEVICE(uds
), 0);
369 static MemoryRegion
*make_uart(MPS2TZMachineState
*mms
, void *opaque
,
370 const char *name
, hwaddr size
,
373 /* The irq[] array is tx, rx, combined, in that order */
374 MPS2TZMachineClass
*mmc
= MPS2TZ_MACHINE_GET_CLASS(mms
);
375 CMSDKAPBUART
*uart
= opaque
;
376 int i
= uart
- &mms
->uart
[0];
378 DeviceState
*orgate_dev
= DEVICE(&mms
->uart_irq_orgate
);
380 object_initialize_child(OBJECT(mms
), name
, uart
, TYPE_CMSDK_APB_UART
);
381 qdev_prop_set_chr(DEVICE(uart
), "chardev", serial_hd(i
));
382 qdev_prop_set_uint32(DEVICE(uart
), "pclk-frq", mmc
->sysclk_frq
);
383 sysbus_realize(SYS_BUS_DEVICE(uart
), &error_fatal
);
384 s
= SYS_BUS_DEVICE(uart
);
385 sysbus_connect_irq(s
, 0, get_sse_irq_in(mms
, irqs
[0]));
386 sysbus_connect_irq(s
, 1, get_sse_irq_in(mms
, irqs
[1]));
387 sysbus_connect_irq(s
, 2, qdev_get_gpio_in(orgate_dev
, i
* 2));
388 sysbus_connect_irq(s
, 3, qdev_get_gpio_in(orgate_dev
, i
* 2 + 1));
389 sysbus_connect_irq(s
, 4, get_sse_irq_in(mms
, irqs
[2]));
390 return sysbus_mmio_get_region(SYS_BUS_DEVICE(uart
), 0);
393 static MemoryRegion
*make_scc(MPS2TZMachineState
*mms
, void *opaque
,
394 const char *name
, hwaddr size
,
397 MPS2SCC
*scc
= opaque
;
399 MPS2TZMachineClass
*mmc
= MPS2TZ_MACHINE_GET_CLASS(mms
);
402 object_initialize_child(OBJECT(mms
), "scc", scc
, TYPE_MPS2_SCC
);
403 sccdev
= DEVICE(scc
);
404 qdev_prop_set_uint32(sccdev
, "scc-cfg4", 0x2);
405 qdev_prop_set_uint32(sccdev
, "scc-aid", 0x00200008);
406 qdev_prop_set_uint32(sccdev
, "scc-id", mmc
->scc_id
);
407 qdev_prop_set_uint32(sccdev
, "len-oscclk", mmc
->len_oscclk
);
408 for (i
= 0; i
< mmc
->len_oscclk
; i
++) {
409 g_autofree
char *propname
= g_strdup_printf("oscclk[%u]", i
);
410 qdev_prop_set_uint32(sccdev
, propname
, mmc
->oscclk
[i
]);
412 sysbus_realize(SYS_BUS_DEVICE(scc
), &error_fatal
);
413 return sysbus_mmio_get_region(SYS_BUS_DEVICE(sccdev
), 0);
416 static MemoryRegion
*make_fpgaio(MPS2TZMachineState
*mms
, void *opaque
,
417 const char *name
, hwaddr size
,
420 MPS2FPGAIO
*fpgaio
= opaque
;
421 MPS2TZMachineClass
*mmc
= MPS2TZ_MACHINE_GET_CLASS(mms
);
423 object_initialize_child(OBJECT(mms
), "fpgaio", fpgaio
, TYPE_MPS2_FPGAIO
);
424 qdev_prop_set_uint32(DEVICE(fpgaio
), "num-leds", mmc
->fpgaio_num_leds
);
425 qdev_prop_set_bit(DEVICE(fpgaio
), "has-switches", mmc
->fpgaio_has_switches
);
426 qdev_prop_set_bit(DEVICE(fpgaio
), "has-dbgctrl", mmc
->fpgaio_has_dbgctrl
);
427 sysbus_realize(SYS_BUS_DEVICE(fpgaio
), &error_fatal
);
428 return sysbus_mmio_get_region(SYS_BUS_DEVICE(fpgaio
), 0);
431 static MemoryRegion
*make_eth_dev(MPS2TZMachineState
*mms
, void *opaque
,
432 const char *name
, hwaddr size
,
436 NICInfo
*nd
= &nd_table
[0];
438 /* In hardware this is a LAN9220; the LAN9118 is software compatible
439 * except that it doesn't support the checksum-offload feature.
441 qemu_check_nic_model(nd
, "lan9118");
442 mms
->lan9118
= qdev_new(TYPE_LAN9118
);
443 qdev_set_nic_properties(mms
->lan9118
, nd
);
445 s
= SYS_BUS_DEVICE(mms
->lan9118
);
446 sysbus_realize_and_unref(s
, &error_fatal
);
447 sysbus_connect_irq(s
, 0, get_sse_irq_in(mms
, irqs
[0]));
448 return sysbus_mmio_get_region(s
, 0);
451 static MemoryRegion
*make_eth_usb(MPS2TZMachineState
*mms
, void *opaque
,
452 const char *name
, hwaddr size
,
456 * The AN524 makes the ethernet and USB share a PPC port.
457 * irqs[] is the ethernet IRQ.
460 NICInfo
*nd
= &nd_table
[0];
462 memory_region_init(&mms
->eth_usb_container
, OBJECT(mms
),
463 "mps2-tz-eth-usb-container", 0x200000);
466 * In hardware this is a LAN9220; the LAN9118 is software compatible
467 * except that it doesn't support the checksum-offload feature.
469 qemu_check_nic_model(nd
, "lan9118");
470 mms
->lan9118
= qdev_new(TYPE_LAN9118
);
471 qdev_set_nic_properties(mms
->lan9118
, nd
);
473 s
= SYS_BUS_DEVICE(mms
->lan9118
);
474 sysbus_realize_and_unref(s
, &error_fatal
);
475 sysbus_connect_irq(s
, 0, get_sse_irq_in(mms
, irqs
[0]));
477 memory_region_add_subregion(&mms
->eth_usb_container
,
478 0, sysbus_mmio_get_region(s
, 0));
480 /* The USB OTG controller is an ISP1763; we don't have a model of it. */
481 object_initialize_child(OBJECT(mms
), "usb-otg",
482 &mms
->usb
, TYPE_UNIMPLEMENTED_DEVICE
);
483 qdev_prop_set_string(DEVICE(&mms
->usb
), "name", "usb-otg");
484 qdev_prop_set_uint64(DEVICE(&mms
->usb
), "size", 0x100000);
485 s
= SYS_BUS_DEVICE(&mms
->usb
);
486 sysbus_realize(s
, &error_fatal
);
488 memory_region_add_subregion(&mms
->eth_usb_container
,
489 0x100000, sysbus_mmio_get_region(s
, 0));
491 return &mms
->eth_usb_container
;
494 static MemoryRegion
*make_mpc(MPS2TZMachineState
*mms
, void *opaque
,
495 const char *name
, hwaddr size
,
499 int i
= mpc
- &mms
->mpc
[0];
500 MemoryRegion
*upstream
;
501 const RAMInfo
*raminfo
= find_raminfo_for_mpc(mms
, i
);
502 MemoryRegion
*ram
= mr_for_raminfo(mms
, raminfo
);
504 object_initialize_child(OBJECT(mms
), name
, mpc
, TYPE_TZ_MPC
);
505 object_property_set_link(OBJECT(mpc
), "downstream", OBJECT(ram
),
507 sysbus_realize(SYS_BUS_DEVICE(mpc
), &error_fatal
);
508 /* Map the upstream end of the MPC into system memory */
509 upstream
= sysbus_mmio_get_region(SYS_BUS_DEVICE(mpc
), 1);
510 memory_region_add_subregion(get_system_memory(), raminfo
->base
, upstream
);
511 /* and connect its interrupt to the IoTKit */
512 qdev_connect_gpio_out_named(DEVICE(mpc
), "irq", 0,
513 qdev_get_gpio_in_named(DEVICE(&mms
->iotkit
),
514 "mpcexp_status", i
));
516 /* Return the register interface MR for our caller to map behind the PPC */
517 return sysbus_mmio_get_region(SYS_BUS_DEVICE(mpc
), 0);
520 static MemoryRegion
*make_dma(MPS2TZMachineState
*mms
, void *opaque
,
521 const char *name
, hwaddr size
,
524 /* The irq[] array is DMACINTR, DMACINTERR, DMACINTTC, in that order */
525 PL080State
*dma
= opaque
;
526 int i
= dma
- &mms
->dma
[0];
528 char *mscname
= g_strdup_printf("%s-msc", name
);
529 TZMSC
*msc
= &mms
->msc
[i
];
530 DeviceState
*iotkitdev
= DEVICE(&mms
->iotkit
);
531 MemoryRegion
*msc_upstream
;
532 MemoryRegion
*msc_downstream
;
535 * Each DMA device is a PL081 whose transaction master interface
536 * is guarded by a Master Security Controller. The downstream end of
537 * the MSC connects to the IoTKit AHB Slave Expansion port, so the
538 * DMA devices can see all devices and memory that the CPU does.
540 object_initialize_child(OBJECT(mms
), mscname
, msc
, TYPE_TZ_MSC
);
541 msc_downstream
= sysbus_mmio_get_region(SYS_BUS_DEVICE(&mms
->iotkit
), 0);
542 object_property_set_link(OBJECT(msc
), "downstream",
543 OBJECT(msc_downstream
), &error_fatal
);
544 object_property_set_link(OBJECT(msc
), "idau", OBJECT(mms
), &error_fatal
);
545 sysbus_realize(SYS_BUS_DEVICE(msc
), &error_fatal
);
547 qdev_connect_gpio_out_named(DEVICE(msc
), "irq", 0,
548 qdev_get_gpio_in_named(iotkitdev
,
549 "mscexp_status", i
));
550 qdev_connect_gpio_out_named(iotkitdev
, "mscexp_clear", i
,
551 qdev_get_gpio_in_named(DEVICE(msc
),
553 qdev_connect_gpio_out_named(iotkitdev
, "mscexp_ns", i
,
554 qdev_get_gpio_in_named(DEVICE(msc
),
556 qdev_connect_gpio_out(DEVICE(&mms
->sec_resp_splitter
),
557 ARRAY_SIZE(mms
->ppc
) + i
,
558 qdev_get_gpio_in_named(DEVICE(msc
),
560 msc_upstream
= sysbus_mmio_get_region(SYS_BUS_DEVICE(msc
), 0);
562 object_initialize_child(OBJECT(mms
), name
, dma
, TYPE_PL081
);
563 object_property_set_link(OBJECT(dma
), "downstream", OBJECT(msc_upstream
),
565 sysbus_realize(SYS_BUS_DEVICE(dma
), &error_fatal
);
567 s
= SYS_BUS_DEVICE(dma
);
568 /* Wire up DMACINTR, DMACINTERR, DMACINTTC */
569 sysbus_connect_irq(s
, 0, get_sse_irq_in(mms
, irqs
[0]));
570 sysbus_connect_irq(s
, 1, get_sse_irq_in(mms
, irqs
[1]));
571 sysbus_connect_irq(s
, 2, get_sse_irq_in(mms
, irqs
[2]));
574 return sysbus_mmio_get_region(s
, 0);
577 static MemoryRegion
*make_spi(MPS2TZMachineState
*mms
, void *opaque
,
578 const char *name
, hwaddr size
,
582 * The AN505 has five PL022 SPI controllers.
583 * One of these should have the LCD controller behind it; the others
584 * are connected only to the FPGA's "general purpose SPI connector"
585 * or "shield" expansion connectors.
586 * Note that if we do implement devices behind SPI, the chip select
587 * lines are set via the "MISC" register in the MPS2 FPGAIO device.
589 PL022State
*spi
= opaque
;
592 object_initialize_child(OBJECT(mms
), name
, spi
, TYPE_PL022
);
593 sysbus_realize(SYS_BUS_DEVICE(spi
), &error_fatal
);
594 s
= SYS_BUS_DEVICE(spi
);
595 sysbus_connect_irq(s
, 0, get_sse_irq_in(mms
, irqs
[0]));
596 return sysbus_mmio_get_region(s
, 0);
599 static MemoryRegion
*make_i2c(MPS2TZMachineState
*mms
, void *opaque
,
600 const char *name
, hwaddr size
,
603 ArmSbconI2CState
*i2c
= opaque
;
606 object_initialize_child(OBJECT(mms
), name
, i2c
, TYPE_ARM_SBCON_I2C
);
607 s
= SYS_BUS_DEVICE(i2c
);
608 sysbus_realize(s
, &error_fatal
);
609 return sysbus_mmio_get_region(s
, 0);
612 static MemoryRegion
*make_rtc(MPS2TZMachineState
*mms
, void *opaque
,
613 const char *name
, hwaddr size
,
616 PL031State
*pl031
= opaque
;
619 object_initialize_child(OBJECT(mms
), name
, pl031
, TYPE_PL031
);
620 s
= SYS_BUS_DEVICE(pl031
);
621 sysbus_realize(s
, &error_fatal
);
623 * The board docs don't give an IRQ number for the PL031, so
624 * presumably it is not connected.
626 return sysbus_mmio_get_region(s
, 0);
629 static void create_non_mpc_ram(MPS2TZMachineState
*mms
)
632 * Handle the RAMs which are either not behind MPCs or which are
633 * aliases to another MPC.
636 MPS2TZMachineClass
*mmc
= MPS2TZ_MACHINE_GET_CLASS(mms
);
638 for (p
= mmc
->raminfo
; p
->name
; p
++) {
639 if (p
->flags
& IS_ALIAS
) {
640 SysBusDevice
*mpc_sbd
= SYS_BUS_DEVICE(&mms
->mpc
[p
->mpc
]);
641 MemoryRegion
*upstream
= sysbus_mmio_get_region(mpc_sbd
, 1);
642 make_ram_alias(&mms
->ram
[p
->mrindex
], p
->name
, upstream
, p
->base
);
643 } else if (p
->mpc
== -1) {
644 /* RAM not behind an MPC */
645 MemoryRegion
*mr
= mr_for_raminfo(mms
, p
);
646 memory_region_add_subregion(get_system_memory(), p
->base
, mr
);
651 static uint32_t boot_ram_size(MPS2TZMachineState
*mms
)
653 /* Return the size of the RAM block at guest address zero */
655 MPS2TZMachineClass
*mmc
= MPS2TZ_MACHINE_GET_CLASS(mms
);
657 for (p
= mmc
->raminfo
; p
->name
; p
++) {
662 g_assert_not_reached();
665 static void mps2tz_common_init(MachineState
*machine
)
667 MPS2TZMachineState
*mms
= MPS2TZ_MACHINE(machine
);
668 MPS2TZMachineClass
*mmc
= MPS2TZ_MACHINE_GET_CLASS(mms
);
669 MachineClass
*mc
= MACHINE_GET_CLASS(machine
);
670 MemoryRegion
*system_memory
= get_system_memory();
671 DeviceState
*iotkitdev
;
672 DeviceState
*dev_splitter
;
677 if (strcmp(machine
->cpu_type
, mc
->default_cpu_type
) != 0) {
678 error_report("This board can only be used with CPU %s",
679 mc
->default_cpu_type
);
683 if (machine
->ram_size
!= mc
->default_ram_size
) {
684 char *sz
= size_to_str(mc
->default_ram_size
);
685 error_report("Invalid RAM size, should be %s", sz
);
690 /* These clocks don't need migration because they are fixed-frequency */
691 mms
->sysclk
= clock_new(OBJECT(machine
), "SYSCLK");
692 clock_set_hz(mms
->sysclk
, mmc
->sysclk_frq
);
693 mms
->s32kclk
= clock_new(OBJECT(machine
), "S32KCLK");
694 clock_set_hz(mms
->s32kclk
, S32KCLK_FRQ
);
696 object_initialize_child(OBJECT(machine
), TYPE_IOTKIT
, &mms
->iotkit
,
698 iotkitdev
= DEVICE(&mms
->iotkit
);
699 object_property_set_link(OBJECT(&mms
->iotkit
), "memory",
700 OBJECT(system_memory
), &error_abort
);
701 qdev_prop_set_uint32(iotkitdev
, "EXP_NUMIRQ", mmc
->numirq
);
702 qdev_connect_clock_in(iotkitdev
, "MAINCLK", mms
->sysclk
);
703 qdev_connect_clock_in(iotkitdev
, "S32KCLK", mms
->s32kclk
);
704 sysbus_realize(SYS_BUS_DEVICE(&mms
->iotkit
), &error_fatal
);
707 * If this board has more than one CPU, then we need to create splitters
708 * to feed the IRQ inputs for each CPU in the SSE from each device in the
709 * board. If there is only one CPU, we can just wire the device IRQ
710 * directly to the SSE's IRQ input.
712 assert(mmc
->numirq
<= MPS2TZ_NUMIRQ_MAX
);
713 if (mc
->max_cpus
> 1) {
714 for (i
= 0; i
< mmc
->numirq
; i
++) {
715 char *name
= g_strdup_printf("mps2-irq-splitter%d", i
);
716 SplitIRQ
*splitter
= &mms
->cpu_irq_splitter
[i
];
718 object_initialize_child_with_props(OBJECT(machine
), name
,
719 splitter
, sizeof(*splitter
),
720 TYPE_SPLIT_IRQ
, &error_fatal
,
724 object_property_set_int(OBJECT(splitter
), "num-lines", 2,
726 qdev_realize(DEVICE(splitter
), NULL
, &error_fatal
);
727 qdev_connect_gpio_out(DEVICE(splitter
), 0,
728 qdev_get_gpio_in_named(DEVICE(&mms
->iotkit
),
730 qdev_connect_gpio_out(DEVICE(splitter
), 1,
731 qdev_get_gpio_in_named(DEVICE(&mms
->iotkit
),
736 /* The sec_resp_cfg output from the IoTKit must be split into multiple
737 * lines, one for each of the PPCs we create here, plus one per MSC.
739 object_initialize_child(OBJECT(machine
), "sec-resp-splitter",
740 &mms
->sec_resp_splitter
, TYPE_SPLIT_IRQ
);
741 object_property_set_int(OBJECT(&mms
->sec_resp_splitter
), "num-lines",
742 ARRAY_SIZE(mms
->ppc
) + ARRAY_SIZE(mms
->msc
),
744 qdev_realize(DEVICE(&mms
->sec_resp_splitter
), NULL
, &error_fatal
);
745 dev_splitter
= DEVICE(&mms
->sec_resp_splitter
);
746 qdev_connect_gpio_out_named(iotkitdev
, "sec_resp_cfg", 0,
747 qdev_get_gpio_in(dev_splitter
, 0));
750 * The IoTKit sets up much of the memory layout, including
751 * the aliases between secure and non-secure regions in the
752 * address space, and also most of the devices in the system.
753 * The FPGA itself contains various RAMs and some additional devices.
754 * The FPGA images have an odd combination of different RAMs,
755 * because in hardware they are different implementations and
756 * connected to different buses, giving varying performance/size
757 * tradeoffs. For QEMU they're all just RAM, though. We arbitrarily
758 * call the largest lump our "system memory".
762 * The overflow IRQs for all UARTs are ORed together.
763 * Tx, Rx and "combined" IRQs are sent to the NVIC separately.
764 * Create the OR gate for this: it has one input for the TX overflow
765 * and one for the RX overflow for each UART we might have.
766 * (If the board has fewer than the maximum possible number of UARTs
767 * those inputs are never wired up and are treated as always-zero.)
769 object_initialize_child(OBJECT(mms
), "uart-irq-orgate",
770 &mms
->uart_irq_orgate
, TYPE_OR_IRQ
);
771 object_property_set_int(OBJECT(&mms
->uart_irq_orgate
), "num-lines",
772 2 * ARRAY_SIZE(mms
->uart
),
774 qdev_realize(DEVICE(&mms
->uart_irq_orgate
), NULL
, &error_fatal
);
775 qdev_connect_gpio_out(DEVICE(&mms
->uart_irq_orgate
), 0,
776 get_sse_irq_in(mms
, mmc
->uart_overflow_irq
));
778 /* Most of the devices in the FPGA are behind Peripheral Protection
779 * Controllers. The required order for initializing things is:
780 * + initialize the PPC
781 * + initialize, configure and realize downstream devices
782 * + connect downstream device MemoryRegions to the PPC
784 * + map the PPC's MemoryRegions to the places in the address map
785 * where the downstream devices should appear
786 * + wire up the PPC's control lines to the IoTKit object
789 const PPCInfo an505_ppcs
[] = { {
790 .name
= "apb_ppcexp0",
792 { "ssram-0-mpc", make_mpc
, &mms
->mpc
[0], 0x58007000, 0x1000 },
793 { "ssram-1-mpc", make_mpc
, &mms
->mpc
[1], 0x58008000, 0x1000 },
794 { "ssram-2-mpc", make_mpc
, &mms
->mpc
[2], 0x58009000, 0x1000 },
797 .name
= "apb_ppcexp1",
799 { "spi0", make_spi
, &mms
->spi
[0], 0x40205000, 0x1000, { 51 } },
800 { "spi1", make_spi
, &mms
->spi
[1], 0x40206000, 0x1000, { 52 } },
801 { "spi2", make_spi
, &mms
->spi
[2], 0x40209000, 0x1000, { 53 } },
802 { "spi3", make_spi
, &mms
->spi
[3], 0x4020a000, 0x1000, { 54 } },
803 { "spi4", make_spi
, &mms
->spi
[4], 0x4020b000, 0x1000, { 55 } },
804 { "uart0", make_uart
, &mms
->uart
[0], 0x40200000, 0x1000, { 32, 33, 42 } },
805 { "uart1", make_uart
, &mms
->uart
[1], 0x40201000, 0x1000, { 34, 35, 43 } },
806 { "uart2", make_uart
, &mms
->uart
[2], 0x40202000, 0x1000, { 36, 37, 44 } },
807 { "uart3", make_uart
, &mms
->uart
[3], 0x40203000, 0x1000, { 38, 39, 45 } },
808 { "uart4", make_uart
, &mms
->uart
[4], 0x40204000, 0x1000, { 40, 41, 46 } },
809 { "i2c0", make_i2c
, &mms
->i2c
[0], 0x40207000, 0x1000 },
810 { "i2c1", make_i2c
, &mms
->i2c
[1], 0x40208000, 0x1000 },
811 { "i2c2", make_i2c
, &mms
->i2c
[2], 0x4020c000, 0x1000 },
812 { "i2c3", make_i2c
, &mms
->i2c
[3], 0x4020d000, 0x1000 },
815 .name
= "apb_ppcexp2",
817 { "scc", make_scc
, &mms
->scc
, 0x40300000, 0x1000 },
818 { "i2s-audio", make_unimp_dev
, &mms
->i2s_audio
,
819 0x40301000, 0x1000 },
820 { "fpgaio", make_fpgaio
, &mms
->fpgaio
, 0x40302000, 0x1000 },
823 .name
= "ahb_ppcexp0",
825 { "gfx", make_unimp_dev
, &mms
->gfx
, 0x41000000, 0x140000 },
826 { "gpio0", make_unimp_dev
, &mms
->gpio
[0], 0x40100000, 0x1000 },
827 { "gpio1", make_unimp_dev
, &mms
->gpio
[1], 0x40101000, 0x1000 },
828 { "gpio2", make_unimp_dev
, &mms
->gpio
[2], 0x40102000, 0x1000 },
829 { "gpio3", make_unimp_dev
, &mms
->gpio
[3], 0x40103000, 0x1000 },
830 { "eth", make_eth_dev
, NULL
, 0x42000000, 0x100000, { 48 } },
833 .name
= "ahb_ppcexp1",
835 { "dma0", make_dma
, &mms
->dma
[0], 0x40110000, 0x1000, { 58, 56, 57 } },
836 { "dma1", make_dma
, &mms
->dma
[1], 0x40111000, 0x1000, { 61, 59, 60 } },
837 { "dma2", make_dma
, &mms
->dma
[2], 0x40112000, 0x1000, { 64, 62, 63 } },
838 { "dma3", make_dma
, &mms
->dma
[3], 0x40113000, 0x1000, { 67, 65, 66 } },
843 const PPCInfo an524_ppcs
[] = { {
844 .name
= "apb_ppcexp0",
846 { "bram-mpc", make_mpc
, &mms
->mpc
[0], 0x58007000, 0x1000 },
847 { "qspi-mpc", make_mpc
, &mms
->mpc
[1], 0x58008000, 0x1000 },
848 { "ddr-mpc", make_mpc
, &mms
->mpc
[2], 0x58009000, 0x1000 },
851 .name
= "apb_ppcexp1",
853 { "i2c0", make_i2c
, &mms
->i2c
[0], 0x41200000, 0x1000 },
854 { "i2c1", make_i2c
, &mms
->i2c
[1], 0x41201000, 0x1000 },
855 { "spi0", make_spi
, &mms
->spi
[0], 0x41202000, 0x1000, { 52 } },
856 { "spi1", make_spi
, &mms
->spi
[1], 0x41203000, 0x1000, { 53 } },
857 { "spi2", make_spi
, &mms
->spi
[2], 0x41204000, 0x1000, { 54 } },
858 { "i2c2", make_i2c
, &mms
->i2c
[2], 0x41205000, 0x1000 },
859 { "i2c3", make_i2c
, &mms
->i2c
[3], 0x41206000, 0x1000 },
860 { /* port 7 reserved */ },
861 { "i2c4", make_i2c
, &mms
->i2c
[4], 0x41208000, 0x1000 },
864 .name
= "apb_ppcexp2",
866 { "scc", make_scc
, &mms
->scc
, 0x41300000, 0x1000 },
867 { "i2s-audio", make_unimp_dev
, &mms
->i2s_audio
,
868 0x41301000, 0x1000 },
869 { "fpgaio", make_fpgaio
, &mms
->fpgaio
, 0x41302000, 0x1000 },
870 { "uart0", make_uart
, &mms
->uart
[0], 0x41303000, 0x1000, { 32, 33, 42 } },
871 { "uart1", make_uart
, &mms
->uart
[1], 0x41304000, 0x1000, { 34, 35, 43 } },
872 { "uart2", make_uart
, &mms
->uart
[2], 0x41305000, 0x1000, { 36, 37, 44 } },
873 { "uart3", make_uart
, &mms
->uart
[3], 0x41306000, 0x1000, { 38, 39, 45 } },
874 { "uart4", make_uart
, &mms
->uart
[4], 0x41307000, 0x1000, { 40, 41, 46 } },
875 { "uart5", make_uart
, &mms
->uart
[5], 0x41308000, 0x1000, { 124, 125, 126 } },
877 { /* port 9 reserved */ },
878 { "clcd", make_unimp_dev
, &mms
->cldc
, 0x4130a000, 0x1000 },
879 { "rtc", make_rtc
, &mms
->rtc
, 0x4130b000, 0x1000 },
882 .name
= "ahb_ppcexp0",
884 { "gpio0", make_unimp_dev
, &mms
->gpio
[0], 0x41100000, 0x1000 },
885 { "gpio1", make_unimp_dev
, &mms
->gpio
[1], 0x41101000, 0x1000 },
886 { "gpio2", make_unimp_dev
, &mms
->gpio
[2], 0x41102000, 0x1000 },
887 { "gpio3", make_unimp_dev
, &mms
->gpio
[3], 0x41103000, 0x1000 },
888 { "eth-usb", make_eth_usb
, NULL
, 0x41400000, 0x200000, { 48 } },
893 switch (mmc
->fpga_type
) {
897 num_ppcs
= ARRAY_SIZE(an505_ppcs
);
901 num_ppcs
= ARRAY_SIZE(an524_ppcs
);
904 g_assert_not_reached();
907 for (i
= 0; i
< num_ppcs
; i
++) {
908 const PPCInfo
*ppcinfo
= &ppcs
[i
];
909 TZPPC
*ppc
= &mms
->ppc
[i
];
914 object_initialize_child(OBJECT(machine
), ppcinfo
->name
, ppc
,
916 ppcdev
= DEVICE(ppc
);
918 for (port
= 0; port
< TZ_NUM_PORTS
; port
++) {
919 const PPCPortInfo
*pinfo
= &ppcinfo
->ports
[port
];
927 mr
= pinfo
->devfn(mms
, pinfo
->opaque
, pinfo
->name
, pinfo
->size
,
929 portname
= g_strdup_printf("port[%d]", port
);
930 object_property_set_link(OBJECT(ppc
), portname
, OBJECT(mr
),
935 sysbus_realize(SYS_BUS_DEVICE(ppc
), &error_fatal
);
937 for (port
= 0; port
< TZ_NUM_PORTS
; port
++) {
938 const PPCPortInfo
*pinfo
= &ppcinfo
->ports
[port
];
943 sysbus_mmio_map(SYS_BUS_DEVICE(ppc
), port
, pinfo
->addr
);
945 gpioname
= g_strdup_printf("%s_nonsec", ppcinfo
->name
);
946 qdev_connect_gpio_out_named(iotkitdev
, gpioname
, port
,
947 qdev_get_gpio_in_named(ppcdev
,
951 gpioname
= g_strdup_printf("%s_ap", ppcinfo
->name
);
952 qdev_connect_gpio_out_named(iotkitdev
, gpioname
, port
,
953 qdev_get_gpio_in_named(ppcdev
,
958 gpioname
= g_strdup_printf("%s_irq_enable", ppcinfo
->name
);
959 qdev_connect_gpio_out_named(iotkitdev
, gpioname
, 0,
960 qdev_get_gpio_in_named(ppcdev
,
963 gpioname
= g_strdup_printf("%s_irq_clear", ppcinfo
->name
);
964 qdev_connect_gpio_out_named(iotkitdev
, gpioname
, 0,
965 qdev_get_gpio_in_named(ppcdev
,
968 gpioname
= g_strdup_printf("%s_irq_status", ppcinfo
->name
);
969 qdev_connect_gpio_out_named(ppcdev
, "irq", 0,
970 qdev_get_gpio_in_named(iotkitdev
,
974 qdev_connect_gpio_out(dev_splitter
, i
,
975 qdev_get_gpio_in_named(ppcdev
,
979 create_unimplemented_device("FPGA NS PC", 0x48007000, 0x1000);
981 create_non_mpc_ram(mms
);
983 armv7m_load_kernel(ARM_CPU(first_cpu
), machine
->kernel_filename
,
987 static void mps2_tz_idau_check(IDAUInterface
*ii
, uint32_t address
,
988 int *iregion
, bool *exempt
, bool *ns
, bool *nsc
)
991 * The MPS2 TZ FPGA images have IDAUs in them which are connected to
992 * the Master Security Controllers. Thes have the same logic as
993 * is used by the IoTKit for the IDAU connected to the CPU, except
994 * that MSCs don't care about the NSC attribute.
996 int region
= extract32(address
, 28, 4);
1000 /* 0xe0000000..0xe00fffff and 0xf0000000..0xf00fffff are exempt */
1001 *exempt
= (address
& 0xeff00000) == 0xe0000000;
1005 static void mps2tz_class_init(ObjectClass
*oc
, void *data
)
1007 MachineClass
*mc
= MACHINE_CLASS(oc
);
1008 IDAUInterfaceClass
*iic
= IDAU_INTERFACE_CLASS(oc
);
1010 mc
->init
= mps2tz_common_init
;
1011 iic
->check
= mps2_tz_idau_check
;
1014 static void mps2tz_set_default_ram_info(MPS2TZMachineClass
*mmc
)
1017 * Set mc->default_ram_size and default_ram_id from the
1018 * information in mmc->raminfo.
1020 MachineClass
*mc
= MACHINE_CLASS(mmc
);
1023 for (p
= mmc
->raminfo
; p
->name
; p
++) {
1024 if (p
->mrindex
< 0) {
1025 /* Found the entry for "system memory" */
1026 mc
->default_ram_size
= p
->size
;
1027 mc
->default_ram_id
= p
->name
;
1031 g_assert_not_reached();
1034 static void mps2tz_an505_class_init(ObjectClass
*oc
, void *data
)
1036 MachineClass
*mc
= MACHINE_CLASS(oc
);
1037 MPS2TZMachineClass
*mmc
= MPS2TZ_MACHINE_CLASS(oc
);
1039 mc
->desc
= "ARM MPS2 with AN505 FPGA image for Cortex-M33";
1040 mc
->default_cpus
= 1;
1041 mc
->min_cpus
= mc
->default_cpus
;
1042 mc
->max_cpus
= mc
->default_cpus
;
1043 mmc
->fpga_type
= FPGA_AN505
;
1044 mc
->default_cpu_type
= ARM_CPU_TYPE_NAME("cortex-m33");
1045 mmc
->scc_id
= 0x41045050;
1046 mmc
->sysclk_frq
= 20 * 1000 * 1000; /* 20MHz */
1047 mmc
->oscclk
= an505_oscclk
;
1048 mmc
->len_oscclk
= ARRAY_SIZE(an505_oscclk
);
1049 mmc
->fpgaio_num_leds
= 2;
1050 mmc
->fpgaio_has_switches
= false;
1051 mmc
->fpgaio_has_dbgctrl
= false;
1053 mmc
->uart_overflow_irq
= 47;
1054 mmc
->raminfo
= an505_raminfo
;
1055 mmc
->armsse_type
= TYPE_IOTKIT
;
1056 mps2tz_set_default_ram_info(mmc
);
1059 static void mps2tz_an521_class_init(ObjectClass
*oc
, void *data
)
1061 MachineClass
*mc
= MACHINE_CLASS(oc
);
1062 MPS2TZMachineClass
*mmc
= MPS2TZ_MACHINE_CLASS(oc
);
1064 mc
->desc
= "ARM MPS2 with AN521 FPGA image for dual Cortex-M33";
1065 mc
->default_cpus
= 2;
1066 mc
->min_cpus
= mc
->default_cpus
;
1067 mc
->max_cpus
= mc
->default_cpus
;
1068 mmc
->fpga_type
= FPGA_AN521
;
1069 mc
->default_cpu_type
= ARM_CPU_TYPE_NAME("cortex-m33");
1070 mmc
->scc_id
= 0x41045210;
1071 mmc
->sysclk_frq
= 20 * 1000 * 1000; /* 20MHz */
1072 mmc
->oscclk
= an505_oscclk
; /* AN521 is the same as AN505 here */
1073 mmc
->len_oscclk
= ARRAY_SIZE(an505_oscclk
);
1074 mmc
->fpgaio_num_leds
= 2;
1075 mmc
->fpgaio_has_switches
= false;
1076 mmc
->fpgaio_has_dbgctrl
= false;
1078 mmc
->uart_overflow_irq
= 47;
1079 mmc
->raminfo
= an505_raminfo
; /* AN521 is the same as AN505 here */
1080 mmc
->armsse_type
= TYPE_SSE200
;
1081 mps2tz_set_default_ram_info(mmc
);
1084 static void mps3tz_an524_class_init(ObjectClass
*oc
, void *data
)
1086 MachineClass
*mc
= MACHINE_CLASS(oc
);
1087 MPS2TZMachineClass
*mmc
= MPS2TZ_MACHINE_CLASS(oc
);
1089 mc
->desc
= "ARM MPS3 with AN524 FPGA image for dual Cortex-M33";
1090 mc
->default_cpus
= 2;
1091 mc
->min_cpus
= mc
->default_cpus
;
1092 mc
->max_cpus
= mc
->default_cpus
;
1093 mmc
->fpga_type
= FPGA_AN524
;
1094 mc
->default_cpu_type
= ARM_CPU_TYPE_NAME("cortex-m33");
1095 mmc
->scc_id
= 0x41045240;
1096 mmc
->sysclk_frq
= 32 * 1000 * 1000; /* 32MHz */
1097 mmc
->oscclk
= an524_oscclk
;
1098 mmc
->len_oscclk
= ARRAY_SIZE(an524_oscclk
);
1099 mmc
->fpgaio_num_leds
= 10;
1100 mmc
->fpgaio_has_switches
= true;
1101 mmc
->fpgaio_has_dbgctrl
= false;
1103 mmc
->uart_overflow_irq
= 47;
1104 mmc
->raminfo
= an524_raminfo
;
1105 mmc
->armsse_type
= TYPE_SSE200
;
1106 mps2tz_set_default_ram_info(mmc
);
1109 static const TypeInfo mps2tz_info
= {
1110 .name
= TYPE_MPS2TZ_MACHINE
,
1111 .parent
= TYPE_MACHINE
,
1113 .instance_size
= sizeof(MPS2TZMachineState
),
1114 .class_size
= sizeof(MPS2TZMachineClass
),
1115 .class_init
= mps2tz_class_init
,
1116 .interfaces
= (InterfaceInfo
[]) {
1117 { TYPE_IDAU_INTERFACE
},
1122 static const TypeInfo mps2tz_an505_info
= {
1123 .name
= TYPE_MPS2TZ_AN505_MACHINE
,
1124 .parent
= TYPE_MPS2TZ_MACHINE
,
1125 .class_init
= mps2tz_an505_class_init
,
1128 static const TypeInfo mps2tz_an521_info
= {
1129 .name
= TYPE_MPS2TZ_AN521_MACHINE
,
1130 .parent
= TYPE_MPS2TZ_MACHINE
,
1131 .class_init
= mps2tz_an521_class_init
,
1134 static const TypeInfo mps3tz_an524_info
= {
1135 .name
= TYPE_MPS3TZ_AN524_MACHINE
,
1136 .parent
= TYPE_MPS2TZ_MACHINE
,
1137 .class_init
= mps3tz_an524_class_init
,
1140 static void mps2tz_machine_init(void)
1142 type_register_static(&mps2tz_info
);
1143 type_register_static(&mps2tz_an505_info
);
1144 type_register_static(&mps2tz_an521_info
);
1145 type_register_static(&mps3tz_an524_info
);
1148 type_init(mps2tz_machine_init
);