2 * ARM V2M MPS2 board emulation, trustzone aware FPGA images
4 * Copyright (c) 2017 Linaro Limited
5 * Written by Peter Maydell
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License version 2 or
9 * (at your option) any later version.
12 /* The MPS2 and MPS2+ dev boards are FPGA based (the 2+ has a bigger
13 * FPGA but is otherwise the same as the 2). Since the CPU itself
14 * and most of the devices are in the FPGA, the details of the board
15 * as seen by the guest depend significantly on the FPGA image.
16 * This source file covers the following FPGA images, for TrustZone cores:
17 * "mps2-an505" -- Cortex-M33 as documented in ARM Application Note AN505
18 * "mps2-an521" -- Dual Cortex-M33 as documented in Application Note AN521
20 * Links to the TRM for the board itself and to the various Application
21 * Notes which document the FPGA images can be found here:
22 * https://developer.arm.com/products/system-design/development-boards/fpga-prototyping-boards/mps2
25 * http://infocenter.arm.com/help/topic/com.arm.doc.100112_0200_06_en/versatile_express_cortex_m_prototyping_systems_v2m_mps2_and_v2m_mps2plus_technical_reference_100112_0200_06_en.pdf
26 * Application Note AN505:
27 * http://infocenter.arm.com/help/topic/com.arm.doc.dai0505b/index.html
28 * Application Note AN521:
29 * http://infocenter.arm.com/help/topic/com.arm.doc.dai0521c/index.html
31 * The AN505 defers to the Cortex-M33 processor ARMv8M IoT Kit FVP User Guide
32 * (ARM ECM0601256) for the details of some of the device layout:
33 * http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ecm0601256/index.html
34 * Similarly, the AN521 uses the SSE-200, and the SSE-200 TRM defines
35 * most of the device layout:
36 * http://infocenter.arm.com/help/topic/com.arm.doc.101104_0100_00_en/corelink_sse200_subsystem_for_embedded_technical_reference_manual_101104_0100_00_en.pdf
40 #include "qemu/osdep.h"
41 #include "qemu/units.h"
42 #include "qemu/cutils.h"
43 #include "qapi/error.h"
44 #include "qemu/error-report.h"
45 #include "hw/arm/boot.h"
46 #include "hw/arm/armv7m.h"
47 #include "hw/or-irq.h"
48 #include "hw/boards.h"
49 #include "exec/address-spaces.h"
50 #include "sysemu/sysemu.h"
51 #include "hw/misc/unimp.h"
52 #include "hw/char/cmsdk-apb-uart.h"
53 #include "hw/timer/cmsdk-apb-timer.h"
54 #include "hw/misc/mps2-scc.h"
55 #include "hw/misc/mps2-fpgaio.h"
56 #include "hw/misc/tz-mpc.h"
57 #include "hw/misc/tz-msc.h"
58 #include "hw/arm/armsse.h"
59 #include "hw/dma/pl080.h"
60 #include "hw/ssi/pl022.h"
61 #include "hw/i2c/arm_sbcon_i2c.h"
62 #include "hw/net/lan9118.h"
64 #include "hw/core/split-irq.h"
66 #define MPS2TZ_NUMIRQ 92
68 typedef enum MPS2TZFPGAType
{
75 MPS2TZFPGAType fpga_type
;
77 const char *armsse_type
;
84 MemoryRegion ssram
[3];
85 MemoryRegion ssram1_m
;
91 ArmSbconI2CState i2c
[4];
92 UnimplementedDeviceState i2s_audio
;
93 UnimplementedDeviceState gpio
[4];
94 UnimplementedDeviceState gfx
;
98 SplitIRQ sec_resp_splitter
;
99 qemu_or_irq uart_irq_orgate
;
100 DeviceState
*lan9118
;
101 SplitIRQ cpu_irq_splitter
[MPS2TZ_NUMIRQ
];
102 } MPS2TZMachineState
;
104 #define TYPE_MPS2TZ_MACHINE "mps2tz"
105 #define TYPE_MPS2TZ_AN505_MACHINE MACHINE_TYPE_NAME("mps2-an505")
106 #define TYPE_MPS2TZ_AN521_MACHINE MACHINE_TYPE_NAME("mps2-an521")
108 #define MPS2TZ_MACHINE(obj) \
109 OBJECT_CHECK(MPS2TZMachineState, obj, TYPE_MPS2TZ_MACHINE)
110 #define MPS2TZ_MACHINE_GET_CLASS(obj) \
111 OBJECT_GET_CLASS(MPS2TZMachineClass, obj, TYPE_MPS2TZ_MACHINE)
112 #define MPS2TZ_MACHINE_CLASS(klass) \
113 OBJECT_CLASS_CHECK(MPS2TZMachineClass, klass, TYPE_MPS2TZ_MACHINE)
115 /* Main SYSCLK frequency in Hz */
116 #define SYSCLK_FRQ 20000000
118 /* Create an alias of an entire original MemoryRegion @orig
119 * located at @base in the memory map.
121 static void make_ram_alias(MemoryRegion
*mr
, const char *name
,
122 MemoryRegion
*orig
, hwaddr base
)
124 memory_region_init_alias(mr
, NULL
, name
, orig
, 0,
125 memory_region_size(orig
));
126 memory_region_add_subregion(get_system_memory(), base
, mr
);
129 static qemu_irq
get_sse_irq_in(MPS2TZMachineState
*mms
, int irqno
)
131 /* Return a qemu_irq which will signal IRQ n to all CPUs in the SSE. */
132 MPS2TZMachineClass
*mmc
= MPS2TZ_MACHINE_GET_CLASS(mms
);
134 assert(irqno
< MPS2TZ_NUMIRQ
);
136 switch (mmc
->fpga_type
) {
138 return qdev_get_gpio_in_named(DEVICE(&mms
->iotkit
), "EXP_IRQ", irqno
);
140 return qdev_get_gpio_in(DEVICE(&mms
->cpu_irq_splitter
[irqno
]), 0);
142 g_assert_not_reached();
146 /* Most of the devices in the AN505 FPGA image sit behind
147 * Peripheral Protection Controllers. These data structures
148 * define the layout of which devices sit behind which PPCs.
149 * The devfn for each port is a function which creates, configures
150 * and initializes the device, returning the MemoryRegion which
151 * needs to be plugged into the downstream end of the PPC port.
153 typedef MemoryRegion
*MakeDevFn(MPS2TZMachineState
*mms
, void *opaque
,
154 const char *name
, hwaddr size
);
156 typedef struct PPCPortInfo
{
164 typedef struct PPCInfo
{
166 PPCPortInfo ports
[TZ_NUM_PORTS
];
169 static MemoryRegion
*make_unimp_dev(MPS2TZMachineState
*mms
,
171 const char *name
, hwaddr size
)
173 /* Initialize, configure and realize a TYPE_UNIMPLEMENTED_DEVICE,
174 * and return a pointer to its MemoryRegion.
176 UnimplementedDeviceState
*uds
= opaque
;
178 object_initialize_child(OBJECT(mms
), name
, uds
, TYPE_UNIMPLEMENTED_DEVICE
);
179 qdev_prop_set_string(DEVICE(uds
), "name", name
);
180 qdev_prop_set_uint64(DEVICE(uds
), "size", size
);
181 sysbus_realize(SYS_BUS_DEVICE(uds
), &error_fatal
);
182 return sysbus_mmio_get_region(SYS_BUS_DEVICE(uds
), 0);
185 static MemoryRegion
*make_uart(MPS2TZMachineState
*mms
, void *opaque
,
186 const char *name
, hwaddr size
)
188 CMSDKAPBUART
*uart
= opaque
;
189 int i
= uart
- &mms
->uart
[0];
191 int txirqno
= i
* 2 + 1;
192 int combirqno
= i
+ 10;
194 DeviceState
*orgate_dev
= DEVICE(&mms
->uart_irq_orgate
);
196 object_initialize_child(OBJECT(mms
), name
, uart
, TYPE_CMSDK_APB_UART
);
197 qdev_prop_set_chr(DEVICE(uart
), "chardev", serial_hd(i
));
198 qdev_prop_set_uint32(DEVICE(uart
), "pclk-frq", SYSCLK_FRQ
);
199 sysbus_realize(SYS_BUS_DEVICE(uart
), &error_fatal
);
200 s
= SYS_BUS_DEVICE(uart
);
201 sysbus_connect_irq(s
, 0, get_sse_irq_in(mms
, txirqno
));
202 sysbus_connect_irq(s
, 1, get_sse_irq_in(mms
, rxirqno
));
203 sysbus_connect_irq(s
, 2, qdev_get_gpio_in(orgate_dev
, i
* 2));
204 sysbus_connect_irq(s
, 3, qdev_get_gpio_in(orgate_dev
, i
* 2 + 1));
205 sysbus_connect_irq(s
, 4, get_sse_irq_in(mms
, combirqno
));
206 return sysbus_mmio_get_region(SYS_BUS_DEVICE(uart
), 0);
209 static MemoryRegion
*make_scc(MPS2TZMachineState
*mms
, void *opaque
,
210 const char *name
, hwaddr size
)
212 MPS2SCC
*scc
= opaque
;
214 MPS2TZMachineClass
*mmc
= MPS2TZ_MACHINE_GET_CLASS(mms
);
216 object_initialize_child(OBJECT(mms
), "scc", scc
, TYPE_MPS2_SCC
);
217 sccdev
= DEVICE(scc
);
218 qdev_prop_set_uint32(sccdev
, "scc-cfg4", 0x2);
219 qdev_prop_set_uint32(sccdev
, "scc-aid", 0x00200008);
220 qdev_prop_set_uint32(sccdev
, "scc-id", mmc
->scc_id
);
221 sysbus_realize(SYS_BUS_DEVICE(scc
), &error_fatal
);
222 return sysbus_mmio_get_region(SYS_BUS_DEVICE(sccdev
), 0);
225 static MemoryRegion
*make_fpgaio(MPS2TZMachineState
*mms
, void *opaque
,
226 const char *name
, hwaddr size
)
228 MPS2FPGAIO
*fpgaio
= opaque
;
230 object_initialize_child(OBJECT(mms
), "fpgaio", fpgaio
, TYPE_MPS2_FPGAIO
);
231 sysbus_realize(SYS_BUS_DEVICE(fpgaio
), &error_fatal
);
232 return sysbus_mmio_get_region(SYS_BUS_DEVICE(fpgaio
), 0);
235 static MemoryRegion
*make_eth_dev(MPS2TZMachineState
*mms
, void *opaque
,
236 const char *name
, hwaddr size
)
239 NICInfo
*nd
= &nd_table
[0];
241 /* In hardware this is a LAN9220; the LAN9118 is software compatible
242 * except that it doesn't support the checksum-offload feature.
244 qemu_check_nic_model(nd
, "lan9118");
245 mms
->lan9118
= qdev_new(TYPE_LAN9118
);
246 qdev_set_nic_properties(mms
->lan9118
, nd
);
248 s
= SYS_BUS_DEVICE(mms
->lan9118
);
249 sysbus_realize_and_unref(s
, &error_fatal
);
250 sysbus_connect_irq(s
, 0, get_sse_irq_in(mms
, 16));
251 return sysbus_mmio_get_region(s
, 0);
254 static MemoryRegion
*make_mpc(MPS2TZMachineState
*mms
, void *opaque
,
255 const char *name
, hwaddr size
)
258 int i
= mpc
- &mms
->ssram_mpc
[0];
259 MemoryRegion
*ssram
= &mms
->ssram
[i
];
260 MemoryRegion
*upstream
;
261 char *mpcname
= g_strdup_printf("%s-mpc", name
);
262 static uint32_t ramsize
[] = { 0x00400000, 0x00200000, 0x00200000 };
263 static uint32_t rambase
[] = { 0x00000000, 0x28000000, 0x28200000 };
265 memory_region_init_ram(ssram
, NULL
, name
, ramsize
[i
], &error_fatal
);
267 object_initialize_child(OBJECT(mms
), mpcname
, mpc
, TYPE_TZ_MPC
);
268 object_property_set_link(OBJECT(mpc
), OBJECT(ssram
),
269 "downstream", &error_fatal
);
270 sysbus_realize(SYS_BUS_DEVICE(mpc
), &error_fatal
);
271 /* Map the upstream end of the MPC into system memory */
272 upstream
= sysbus_mmio_get_region(SYS_BUS_DEVICE(mpc
), 1);
273 memory_region_add_subregion(get_system_memory(), rambase
[i
], upstream
);
274 /* and connect its interrupt to the IoTKit */
275 qdev_connect_gpio_out_named(DEVICE(mpc
), "irq", 0,
276 qdev_get_gpio_in_named(DEVICE(&mms
->iotkit
),
277 "mpcexp_status", i
));
279 /* The first SSRAM is a special case as it has an alias; accesses to
280 * the alias region at 0x00400000 must also go to the MPC upstream.
283 make_ram_alias(&mms
->ssram1_m
, "mps.ssram1_m", upstream
, 0x00400000);
287 /* Return the register interface MR for our caller to map behind the PPC */
288 return sysbus_mmio_get_region(SYS_BUS_DEVICE(mpc
), 0);
291 static MemoryRegion
*make_dma(MPS2TZMachineState
*mms
, void *opaque
,
292 const char *name
, hwaddr size
)
294 PL080State
*dma
= opaque
;
295 int i
= dma
- &mms
->dma
[0];
297 char *mscname
= g_strdup_printf("%s-msc", name
);
298 TZMSC
*msc
= &mms
->msc
[i
];
299 DeviceState
*iotkitdev
= DEVICE(&mms
->iotkit
);
300 MemoryRegion
*msc_upstream
;
301 MemoryRegion
*msc_downstream
;
304 * Each DMA device is a PL081 whose transaction master interface
305 * is guarded by a Master Security Controller. The downstream end of
306 * the MSC connects to the IoTKit AHB Slave Expansion port, so the
307 * DMA devices can see all devices and memory that the CPU does.
309 object_initialize_child(OBJECT(mms
), mscname
, msc
, TYPE_TZ_MSC
);
310 msc_downstream
= sysbus_mmio_get_region(SYS_BUS_DEVICE(&mms
->iotkit
), 0);
311 object_property_set_link(OBJECT(msc
), OBJECT(msc_downstream
),
312 "downstream", &error_fatal
);
313 object_property_set_link(OBJECT(msc
), OBJECT(mms
),
314 "idau", &error_fatal
);
315 sysbus_realize(SYS_BUS_DEVICE(msc
), &error_fatal
);
317 qdev_connect_gpio_out_named(DEVICE(msc
), "irq", 0,
318 qdev_get_gpio_in_named(iotkitdev
,
319 "mscexp_status", i
));
320 qdev_connect_gpio_out_named(iotkitdev
, "mscexp_clear", i
,
321 qdev_get_gpio_in_named(DEVICE(msc
),
323 qdev_connect_gpio_out_named(iotkitdev
, "mscexp_ns", i
,
324 qdev_get_gpio_in_named(DEVICE(msc
),
326 qdev_connect_gpio_out(DEVICE(&mms
->sec_resp_splitter
),
327 ARRAY_SIZE(mms
->ppc
) + i
,
328 qdev_get_gpio_in_named(DEVICE(msc
),
330 msc_upstream
= sysbus_mmio_get_region(SYS_BUS_DEVICE(msc
), 0);
332 object_initialize_child(OBJECT(mms
), name
, dma
, TYPE_PL081
);
333 object_property_set_link(OBJECT(dma
), OBJECT(msc_upstream
),
334 "downstream", &error_fatal
);
335 sysbus_realize(SYS_BUS_DEVICE(dma
), &error_fatal
);
337 s
= SYS_BUS_DEVICE(dma
);
338 /* Wire up DMACINTR, DMACINTERR, DMACINTTC */
339 sysbus_connect_irq(s
, 0, get_sse_irq_in(mms
, 58 + i
* 3));
340 sysbus_connect_irq(s
, 1, get_sse_irq_in(mms
, 56 + i
* 3));
341 sysbus_connect_irq(s
, 2, get_sse_irq_in(mms
, 57 + i
* 3));
344 return sysbus_mmio_get_region(s
, 0);
347 static MemoryRegion
*make_spi(MPS2TZMachineState
*mms
, void *opaque
,
348 const char *name
, hwaddr size
)
351 * The AN505 has five PL022 SPI controllers.
352 * One of these should have the LCD controller behind it; the others
353 * are connected only to the FPGA's "general purpose SPI connector"
354 * or "shield" expansion connectors.
355 * Note that if we do implement devices behind SPI, the chip select
356 * lines are set via the "MISC" register in the MPS2 FPGAIO device.
358 PL022State
*spi
= opaque
;
359 int i
= spi
- &mms
->spi
[0];
362 object_initialize_child(OBJECT(mms
), name
, spi
, TYPE_PL022
);
363 sysbus_realize(SYS_BUS_DEVICE(spi
), &error_fatal
);
364 s
= SYS_BUS_DEVICE(spi
);
365 sysbus_connect_irq(s
, 0, get_sse_irq_in(mms
, 51 + i
));
366 return sysbus_mmio_get_region(s
, 0);
369 static MemoryRegion
*make_i2c(MPS2TZMachineState
*mms
, void *opaque
,
370 const char *name
, hwaddr size
)
372 ArmSbconI2CState
*i2c
= opaque
;
375 object_initialize_child(OBJECT(mms
), name
, i2c
, TYPE_ARM_SBCON_I2C
);
376 s
= SYS_BUS_DEVICE(i2c
);
377 sysbus_realize(s
, &error_fatal
);
378 return sysbus_mmio_get_region(s
, 0);
381 static void mps2tz_common_init(MachineState
*machine
)
383 MPS2TZMachineState
*mms
= MPS2TZ_MACHINE(machine
);
384 MPS2TZMachineClass
*mmc
= MPS2TZ_MACHINE_GET_CLASS(mms
);
385 MachineClass
*mc
= MACHINE_GET_CLASS(machine
);
386 MemoryRegion
*system_memory
= get_system_memory();
387 DeviceState
*iotkitdev
;
388 DeviceState
*dev_splitter
;
391 if (strcmp(machine
->cpu_type
, mc
->default_cpu_type
) != 0) {
392 error_report("This board can only be used with CPU %s",
393 mc
->default_cpu_type
);
397 if (machine
->ram_size
!= mc
->default_ram_size
) {
398 char *sz
= size_to_str(mc
->default_ram_size
);
399 error_report("Invalid RAM size, should be %s", sz
);
404 object_initialize_child(OBJECT(machine
), TYPE_IOTKIT
, &mms
->iotkit
,
406 iotkitdev
= DEVICE(&mms
->iotkit
);
407 object_property_set_link(OBJECT(&mms
->iotkit
), OBJECT(system_memory
),
408 "memory", &error_abort
);
409 qdev_prop_set_uint32(iotkitdev
, "EXP_NUMIRQ", MPS2TZ_NUMIRQ
);
410 qdev_prop_set_uint32(iotkitdev
, "MAINCLK", SYSCLK_FRQ
);
411 sysbus_realize(SYS_BUS_DEVICE(&mms
->iotkit
), &error_fatal
);
414 * The AN521 needs us to create splitters to feed the IRQ inputs
415 * for each CPU in the SSE-200 from each device in the board.
417 if (mmc
->fpga_type
== FPGA_AN521
) {
418 for (i
= 0; i
< MPS2TZ_NUMIRQ
; i
++) {
419 char *name
= g_strdup_printf("mps2-irq-splitter%d", i
);
420 SplitIRQ
*splitter
= &mms
->cpu_irq_splitter
[i
];
422 object_initialize_child_with_props(OBJECT(machine
), name
,
423 splitter
, sizeof(*splitter
),
424 TYPE_SPLIT_IRQ
, &error_fatal
,
428 object_property_set_int(OBJECT(splitter
), 2, "num-lines",
430 qdev_realize(DEVICE(splitter
), NULL
, &error_fatal
);
431 qdev_connect_gpio_out(DEVICE(splitter
), 0,
432 qdev_get_gpio_in_named(DEVICE(&mms
->iotkit
),
434 qdev_connect_gpio_out(DEVICE(splitter
), 1,
435 qdev_get_gpio_in_named(DEVICE(&mms
->iotkit
),
440 /* The sec_resp_cfg output from the IoTKit must be split into multiple
441 * lines, one for each of the PPCs we create here, plus one per MSC.
443 object_initialize_child(OBJECT(machine
), "sec-resp-splitter",
444 &mms
->sec_resp_splitter
, TYPE_SPLIT_IRQ
);
445 object_property_set_int(OBJECT(&mms
->sec_resp_splitter
),
446 ARRAY_SIZE(mms
->ppc
) + ARRAY_SIZE(mms
->msc
),
447 "num-lines", &error_fatal
);
448 qdev_realize(DEVICE(&mms
->sec_resp_splitter
), NULL
, &error_fatal
);
449 dev_splitter
= DEVICE(&mms
->sec_resp_splitter
);
450 qdev_connect_gpio_out_named(iotkitdev
, "sec_resp_cfg", 0,
451 qdev_get_gpio_in(dev_splitter
, 0));
453 /* The IoTKit sets up much of the memory layout, including
454 * the aliases between secure and non-secure regions in the
455 * address space. The FPGA itself contains:
457 * 0x00000000..0x003fffff SSRAM1
458 * 0x00400000..0x007fffff alias of SSRAM1
459 * 0x28000000..0x283fffff 4MB SSRAM2 + SSRAM3
460 * 0x40100000..0x4fffffff AHB Master Expansion 1 interface devices
461 * 0x80000000..0x80ffffff 16MB PSRAM
464 /* The FPGA images have an odd combination of different RAMs,
465 * because in hardware they are different implementations and
466 * connected to different buses, giving varying performance/size
467 * tradeoffs. For QEMU they're all just RAM, though. We arbitrarily
468 * call the 16MB our "system memory", as it's the largest lump.
470 memory_region_add_subregion(system_memory
, 0x80000000, machine
->ram
);
472 /* The overflow IRQs for all UARTs are ORed together.
473 * Tx, Rx and "combined" IRQs are sent to the NVIC separately.
474 * Create the OR gate for this.
476 object_initialize_child(OBJECT(mms
), "uart-irq-orgate",
477 &mms
->uart_irq_orgate
, TYPE_OR_IRQ
);
478 object_property_set_int(OBJECT(&mms
->uart_irq_orgate
), 10, "num-lines",
480 qdev_realize(DEVICE(&mms
->uart_irq_orgate
), NULL
, &error_fatal
);
481 qdev_connect_gpio_out(DEVICE(&mms
->uart_irq_orgate
), 0,
482 get_sse_irq_in(mms
, 15));
484 /* Most of the devices in the FPGA are behind Peripheral Protection
485 * Controllers. The required order for initializing things is:
486 * + initialize the PPC
487 * + initialize, configure and realize downstream devices
488 * + connect downstream device MemoryRegions to the PPC
490 * + map the PPC's MemoryRegions to the places in the address map
491 * where the downstream devices should appear
492 * + wire up the PPC's control lines to the IoTKit object
495 const PPCInfo ppcs
[] = { {
496 .name
= "apb_ppcexp0",
498 { "ssram-0", make_mpc
, &mms
->ssram_mpc
[0], 0x58007000, 0x1000 },
499 { "ssram-1", make_mpc
, &mms
->ssram_mpc
[1], 0x58008000, 0x1000 },
500 { "ssram-2", make_mpc
, &mms
->ssram_mpc
[2], 0x58009000, 0x1000 },
503 .name
= "apb_ppcexp1",
505 { "spi0", make_spi
, &mms
->spi
[0], 0x40205000, 0x1000 },
506 { "spi1", make_spi
, &mms
->spi
[1], 0x40206000, 0x1000 },
507 { "spi2", make_spi
, &mms
->spi
[2], 0x40209000, 0x1000 },
508 { "spi3", make_spi
, &mms
->spi
[3], 0x4020a000, 0x1000 },
509 { "spi4", make_spi
, &mms
->spi
[4], 0x4020b000, 0x1000 },
510 { "uart0", make_uart
, &mms
->uart
[0], 0x40200000, 0x1000 },
511 { "uart1", make_uart
, &mms
->uart
[1], 0x40201000, 0x1000 },
512 { "uart2", make_uart
, &mms
->uart
[2], 0x40202000, 0x1000 },
513 { "uart3", make_uart
, &mms
->uart
[3], 0x40203000, 0x1000 },
514 { "uart4", make_uart
, &mms
->uart
[4], 0x40204000, 0x1000 },
515 { "i2c0", make_i2c
, &mms
->i2c
[0], 0x40207000, 0x1000 },
516 { "i2c1", make_i2c
, &mms
->i2c
[1], 0x40208000, 0x1000 },
517 { "i2c2", make_i2c
, &mms
->i2c
[2], 0x4020c000, 0x1000 },
518 { "i2c3", make_i2c
, &mms
->i2c
[3], 0x4020d000, 0x1000 },
521 .name
= "apb_ppcexp2",
523 { "scc", make_scc
, &mms
->scc
, 0x40300000, 0x1000 },
524 { "i2s-audio", make_unimp_dev
, &mms
->i2s_audio
,
525 0x40301000, 0x1000 },
526 { "fpgaio", make_fpgaio
, &mms
->fpgaio
, 0x40302000, 0x1000 },
529 .name
= "ahb_ppcexp0",
531 { "gfx", make_unimp_dev
, &mms
->gfx
, 0x41000000, 0x140000 },
532 { "gpio0", make_unimp_dev
, &mms
->gpio
[0], 0x40100000, 0x1000 },
533 { "gpio1", make_unimp_dev
, &mms
->gpio
[1], 0x40101000, 0x1000 },
534 { "gpio2", make_unimp_dev
, &mms
->gpio
[2], 0x40102000, 0x1000 },
535 { "gpio3", make_unimp_dev
, &mms
->gpio
[3], 0x40103000, 0x1000 },
536 { "eth", make_eth_dev
, NULL
, 0x42000000, 0x100000 },
539 .name
= "ahb_ppcexp1",
541 { "dma0", make_dma
, &mms
->dma
[0], 0x40110000, 0x1000 },
542 { "dma1", make_dma
, &mms
->dma
[1], 0x40111000, 0x1000 },
543 { "dma2", make_dma
, &mms
->dma
[2], 0x40112000, 0x1000 },
544 { "dma3", make_dma
, &mms
->dma
[3], 0x40113000, 0x1000 },
549 for (i
= 0; i
< ARRAY_SIZE(ppcs
); i
++) {
550 const PPCInfo
*ppcinfo
= &ppcs
[i
];
551 TZPPC
*ppc
= &mms
->ppc
[i
];
556 object_initialize_child(OBJECT(machine
), ppcinfo
->name
, ppc
,
558 ppcdev
= DEVICE(ppc
);
560 for (port
= 0; port
< TZ_NUM_PORTS
; port
++) {
561 const PPCPortInfo
*pinfo
= &ppcinfo
->ports
[port
];
569 mr
= pinfo
->devfn(mms
, pinfo
->opaque
, pinfo
->name
, pinfo
->size
);
570 portname
= g_strdup_printf("port[%d]", port
);
571 object_property_set_link(OBJECT(ppc
), OBJECT(mr
),
572 portname
, &error_fatal
);
576 sysbus_realize(SYS_BUS_DEVICE(ppc
), &error_fatal
);
578 for (port
= 0; port
< TZ_NUM_PORTS
; port
++) {
579 const PPCPortInfo
*pinfo
= &ppcinfo
->ports
[port
];
584 sysbus_mmio_map(SYS_BUS_DEVICE(ppc
), port
, pinfo
->addr
);
586 gpioname
= g_strdup_printf("%s_nonsec", ppcinfo
->name
);
587 qdev_connect_gpio_out_named(iotkitdev
, gpioname
, port
,
588 qdev_get_gpio_in_named(ppcdev
,
592 gpioname
= g_strdup_printf("%s_ap", ppcinfo
->name
);
593 qdev_connect_gpio_out_named(iotkitdev
, gpioname
, port
,
594 qdev_get_gpio_in_named(ppcdev
,
599 gpioname
= g_strdup_printf("%s_irq_enable", ppcinfo
->name
);
600 qdev_connect_gpio_out_named(iotkitdev
, gpioname
, 0,
601 qdev_get_gpio_in_named(ppcdev
,
604 gpioname
= g_strdup_printf("%s_irq_clear", ppcinfo
->name
);
605 qdev_connect_gpio_out_named(iotkitdev
, gpioname
, 0,
606 qdev_get_gpio_in_named(ppcdev
,
609 gpioname
= g_strdup_printf("%s_irq_status", ppcinfo
->name
);
610 qdev_connect_gpio_out_named(ppcdev
, "irq", 0,
611 qdev_get_gpio_in_named(iotkitdev
,
615 qdev_connect_gpio_out(dev_splitter
, i
,
616 qdev_get_gpio_in_named(ppcdev
,
620 create_unimplemented_device("FPGA NS PC", 0x48007000, 0x1000);
622 armv7m_load_kernel(ARM_CPU(first_cpu
), machine
->kernel_filename
, 0x400000);
625 static void mps2_tz_idau_check(IDAUInterface
*ii
, uint32_t address
,
626 int *iregion
, bool *exempt
, bool *ns
, bool *nsc
)
629 * The MPS2 TZ FPGA images have IDAUs in them which are connected to
630 * the Master Security Controllers. Thes have the same logic as
631 * is used by the IoTKit for the IDAU connected to the CPU, except
632 * that MSCs don't care about the NSC attribute.
634 int region
= extract32(address
, 28, 4);
638 /* 0xe0000000..0xe00fffff and 0xf0000000..0xf00fffff are exempt */
639 *exempt
= (address
& 0xeff00000) == 0xe0000000;
643 static void mps2tz_class_init(ObjectClass
*oc
, void *data
)
645 MachineClass
*mc
= MACHINE_CLASS(oc
);
646 IDAUInterfaceClass
*iic
= IDAU_INTERFACE_CLASS(oc
);
648 mc
->init
= mps2tz_common_init
;
649 iic
->check
= mps2_tz_idau_check
;
650 mc
->default_ram_size
= 16 * MiB
;
651 mc
->default_ram_id
= "mps.ram";
654 static void mps2tz_an505_class_init(ObjectClass
*oc
, void *data
)
656 MachineClass
*mc
= MACHINE_CLASS(oc
);
657 MPS2TZMachineClass
*mmc
= MPS2TZ_MACHINE_CLASS(oc
);
659 mc
->desc
= "ARM MPS2 with AN505 FPGA image for Cortex-M33";
660 mc
->default_cpus
= 1;
661 mc
->min_cpus
= mc
->default_cpus
;
662 mc
->max_cpus
= mc
->default_cpus
;
663 mmc
->fpga_type
= FPGA_AN505
;
664 mc
->default_cpu_type
= ARM_CPU_TYPE_NAME("cortex-m33");
665 mmc
->scc_id
= 0x41045050;
666 mmc
->armsse_type
= TYPE_IOTKIT
;
669 static void mps2tz_an521_class_init(ObjectClass
*oc
, void *data
)
671 MachineClass
*mc
= MACHINE_CLASS(oc
);
672 MPS2TZMachineClass
*mmc
= MPS2TZ_MACHINE_CLASS(oc
);
674 mc
->desc
= "ARM MPS2 with AN521 FPGA image for dual Cortex-M33";
675 mc
->default_cpus
= 2;
676 mc
->min_cpus
= mc
->default_cpus
;
677 mc
->max_cpus
= mc
->default_cpus
;
678 mmc
->fpga_type
= FPGA_AN521
;
679 mc
->default_cpu_type
= ARM_CPU_TYPE_NAME("cortex-m33");
680 mmc
->scc_id
= 0x41045210;
681 mmc
->armsse_type
= TYPE_SSE200
;
684 static const TypeInfo mps2tz_info
= {
685 .name
= TYPE_MPS2TZ_MACHINE
,
686 .parent
= TYPE_MACHINE
,
688 .instance_size
= sizeof(MPS2TZMachineState
),
689 .class_size
= sizeof(MPS2TZMachineClass
),
690 .class_init
= mps2tz_class_init
,
691 .interfaces
= (InterfaceInfo
[]) {
692 { TYPE_IDAU_INTERFACE
},
697 static const TypeInfo mps2tz_an505_info
= {
698 .name
= TYPE_MPS2TZ_AN505_MACHINE
,
699 .parent
= TYPE_MPS2TZ_MACHINE
,
700 .class_init
= mps2tz_an505_class_init
,
703 static const TypeInfo mps2tz_an521_info
= {
704 .name
= TYPE_MPS2TZ_AN521_MACHINE
,
705 .parent
= TYPE_MPS2TZ_MACHINE
,
706 .class_init
= mps2tz_an521_class_init
,
709 static void mps2tz_machine_init(void)
711 type_register_static(&mps2tz_info
);
712 type_register_static(&mps2tz_an505_info
);
713 type_register_static(&mps2tz_an521_info
);
716 type_init(mps2tz_machine_init
);