2 * ARM V2M MPS2 board emulation, trustzone aware FPGA images
4 * Copyright (c) 2017 Linaro Limited
5 * Written by Peter Maydell
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License version 2 or
9 * (at your option) any later version.
12 /* The MPS2 and MPS2+ dev boards are FPGA based (the 2+ has a bigger
13 * FPGA but is otherwise the same as the 2). Since the CPU itself
14 * and most of the devices are in the FPGA, the details of the board
15 * as seen by the guest depend significantly on the FPGA image.
16 * This source file covers the following FPGA images, for TrustZone cores:
17 * "mps2-an505" -- Cortex-M33 as documented in ARM Application Note AN505
18 * "mps2-an521" -- Dual Cortex-M33 as documented in Application Note AN521
19 * "mps2-an524" -- Dual Cortex-M33 as documented in Application Note AN524
20 * "mps2-an547" -- Single Cortex-M55 as documented in Application Note AN547
22 * Links to the TRM for the board itself and to the various Application
23 * Notes which document the FPGA images can be found here:
24 * https://developer.arm.com/products/system-design/development-boards/fpga-prototyping-boards/mps2
27 * https://developer.arm.com/documentation/100112/latest/
28 * Application Note AN505:
29 * https://developer.arm.com/documentation/dai0505/latest/
30 * Application Note AN521:
31 * https://developer.arm.com/documentation/dai0521/latest/
32 * Application Note AN524:
33 * https://developer.arm.com/documentation/dai0524/latest/
34 * Application Note AN547:
35 * https://developer.arm.com/documentation/dai0547/latest/
37 * The AN505 defers to the Cortex-M33 processor ARMv8M IoT Kit FVP User Guide
38 * (ARM ECM0601256) for the details of some of the device layout:
39 * https://developer.arm.com/documentation/ecm0601256/latest
40 * Similarly, the AN521 and AN524 use the SSE-200, and the SSE-200 TRM defines
41 * most of the device layout:
42 * https://developer.arm.com/documentation/101104/latest/
43 * and the AN547 uses the SSE-300, whose layout is in the SSE-300 TRM:
44 * https://developer.arm.com/documentation/101773/latest/
47 #include "qemu/osdep.h"
48 #include "qemu/units.h"
49 #include "qemu/cutils.h"
50 #include "qapi/error.h"
51 #include "qemu/error-report.h"
52 #include "hw/arm/boot.h"
53 #include "hw/arm/armv7m.h"
54 #include "hw/or-irq.h"
55 #include "hw/boards.h"
56 #include "exec/address-spaces.h"
57 #include "sysemu/sysemu.h"
58 #include "sysemu/reset.h"
59 #include "hw/misc/unimp.h"
60 #include "hw/char/cmsdk-apb-uart.h"
61 #include "hw/timer/cmsdk-apb-timer.h"
62 #include "hw/misc/mps2-scc.h"
63 #include "hw/misc/mps2-fpgaio.h"
64 #include "hw/misc/tz-mpc.h"
65 #include "hw/misc/tz-msc.h"
66 #include "hw/arm/armsse.h"
67 #include "hw/dma/pl080.h"
68 #include "hw/rtc/pl031.h"
69 #include "hw/ssi/pl022.h"
70 #include "hw/i2c/arm_sbcon_i2c.h"
71 #include "hw/net/lan9118.h"
73 #include "hw/core/split-irq.h"
74 #include "hw/qdev-clock.h"
75 #include "qom/object.h"
78 #define MPS2TZ_NUMIRQ_MAX 96
79 #define MPS2TZ_RAM_MAX 5
81 typedef enum MPS2TZFPGAType
{
89 * Define the layout of RAM in a board, including which parts are
91 * mrindex specifies the index into mms->ram[] to use for the backing RAM;
92 * -1 means "use the system RAM".
94 typedef struct RAMInfo
{
98 int mpc
; /* MPC number, -1 for "not behind an MPC" */
105 * IS_ALIAS: this RAM area is an alias to the upstream end of the
106 * MPC specified by its .mpc value
107 * IS_ROM: this RAM area is read-only
112 struct MPS2TZMachineClass
{
114 MPS2TZFPGAType fpga_type
;
116 uint32_t sysclk_frq
; /* Main SYSCLK frequency in Hz */
117 uint32_t apb_periph_frq
; /* APB peripheral frequency in Hz */
119 const uint32_t *oscclk
;
120 uint32_t fpgaio_num_leds
; /* Number of LEDs in FPGAIO LED0 register */
121 bool fpgaio_has_switches
; /* Does FPGAIO have SWITCH register? */
122 bool fpgaio_has_dbgctrl
; /* Does FPGAIO have DBGCTRL register? */
123 int numirq
; /* Number of external interrupts */
124 int uart_overflow_irq
; /* number of the combined UART overflow IRQ */
125 uint32_t init_svtor
; /* init-svtor setting for SSE */
126 uint32_t sram_addr_width
; /* SRAM_ADDR_WIDTH setting for SSE */
127 uint32_t cpu0_mpu_ns
; /* CPU0_MPU_NS setting for SSE */
128 uint32_t cpu0_mpu_s
; /* CPU0_MPU_S setting for SSE */
129 uint32_t cpu1_mpu_ns
; /* CPU1_MPU_NS setting for SSE */
130 uint32_t cpu1_mpu_s
; /* CPU1_MPU_S setting for SSE */
131 const RAMInfo
*raminfo
;
132 const char *armsse_type
;
133 uint32_t boot_ram_size
; /* size of ram at address 0; 0 == find in raminfo */
136 struct MPS2TZMachineState
{
140 MemoryRegion ram
[MPS2TZ_RAM_MAX
];
141 MemoryRegion eth_usb_container
;
148 ArmSbconI2CState i2c
[5];
149 UnimplementedDeviceState i2s_audio
;
150 UnimplementedDeviceState gpio
[4];
151 UnimplementedDeviceState gfx
;
152 UnimplementedDeviceState cldc
;
153 UnimplementedDeviceState usb
;
157 CMSDKAPBUART uart
[6];
158 SplitIRQ sec_resp_splitter
;
159 OrIRQState uart_irq_orgate
;
160 DeviceState
*lan9118
;
161 SplitIRQ cpu_irq_splitter
[MPS2TZ_NUMIRQ_MAX
];
169 #define TYPE_MPS2TZ_MACHINE "mps2tz"
170 #define TYPE_MPS2TZ_AN505_MACHINE MACHINE_TYPE_NAME("mps2-an505")
171 #define TYPE_MPS2TZ_AN521_MACHINE MACHINE_TYPE_NAME("mps2-an521")
172 #define TYPE_MPS3TZ_AN524_MACHINE MACHINE_TYPE_NAME("mps3-an524")
173 #define TYPE_MPS3TZ_AN547_MACHINE MACHINE_TYPE_NAME("mps3-an547")
175 OBJECT_DECLARE_TYPE(MPS2TZMachineState
, MPS2TZMachineClass
, MPS2TZ_MACHINE
)
177 /* Slow 32Khz S32KCLK frequency in Hz */
178 #define S32KCLK_FRQ (32 * 1000)
181 * The MPS3 DDR is 2GiB, but on a 32-bit host QEMU doesn't permit
182 * emulation of that much guest RAM, so artificially make it smaller.
184 #if HOST_LONG_BITS == 32
185 #define MPS3_DDR_SIZE (1 * GiB)
187 #define MPS3_DDR_SIZE (2 * GiB)
190 /* For cpu{0,1}_mpu_{ns,s}, means "leave at SSE's default value" */
191 #define MPU_REGION_DEFAULT UINT32_MAX
193 static const uint32_t an505_oscclk
[] = {
199 static const uint32_t an524_oscclk
[] = {
208 static const RAMInfo an505_raminfo
[] = { {
227 .name
= "ssram-0-alias",
234 /* Use the largest bit of contiguous RAM as our "system memory" */
246 * Note that the addresses and MPC numbering here should match up
247 * with those used in remap_memory(), which can swap the BRAM and QSPI.
249 static const RAMInfo an524_raminfo
[] = { {
256 /* We don't model QSPI flash yet; for now expose it as simple ROM */
266 .size
= MPS3_DDR_SIZE
,
274 static const RAMInfo an547_raminfo
[] = { {
287 /* We don't model QSPI flash yet; for now expose it as simple ROM */
297 .size
= MPS3_DDR_SIZE
,
305 static const RAMInfo
*find_raminfo_for_mpc(MPS2TZMachineState
*mms
, int mpc
)
307 MPS2TZMachineClass
*mmc
= MPS2TZ_MACHINE_GET_CLASS(mms
);
309 const RAMInfo
*found
= NULL
;
311 for (p
= mmc
->raminfo
; p
->name
; p
++) {
312 if (p
->mpc
== mpc
&& !(p
->flags
& IS_ALIAS
)) {
313 /* There should only be one entry in the array for this MPC */
318 /* if raminfo array doesn't have an entry for each MPC this is a bug */
323 static MemoryRegion
*mr_for_raminfo(MPS2TZMachineState
*mms
,
324 const RAMInfo
*raminfo
)
326 /* Return an initialized MemoryRegion for the RAMInfo. */
329 if (raminfo
->mrindex
< 0) {
330 /* Means this RAMInfo is for QEMU's "system memory" */
331 MachineState
*machine
= MACHINE(mms
);
332 assert(!(raminfo
->flags
& IS_ROM
));
336 assert(raminfo
->mrindex
< MPS2TZ_RAM_MAX
);
337 ram
= &mms
->ram
[raminfo
->mrindex
];
339 memory_region_init_ram(ram
, NULL
, raminfo
->name
,
340 raminfo
->size
, &error_fatal
);
341 if (raminfo
->flags
& IS_ROM
) {
342 memory_region_set_readonly(ram
, true);
347 /* Create an alias of an entire original MemoryRegion @orig
348 * located at @base in the memory map.
350 static void make_ram_alias(MemoryRegion
*mr
, const char *name
,
351 MemoryRegion
*orig
, hwaddr base
)
353 memory_region_init_alias(mr
, NULL
, name
, orig
, 0,
354 memory_region_size(orig
));
355 memory_region_add_subregion(get_system_memory(), base
, mr
);
358 static qemu_irq
get_sse_irq_in(MPS2TZMachineState
*mms
, int irqno
)
361 * Return a qemu_irq which will signal IRQ n to all CPUs in the
362 * SSE. The irqno should be as the CPU sees it, so the first
363 * external-to-the-SSE interrupt is 32.
365 MachineClass
*mc
= MACHINE_GET_CLASS(mms
);
366 MPS2TZMachineClass
*mmc
= MPS2TZ_MACHINE_GET_CLASS(mms
);
368 assert(irqno
>= 32 && irqno
< (mmc
->numirq
+ 32));
371 * Convert from "CPU irq number" (as listed in the FPGA image
372 * documentation) to the SSE external-interrupt number.
376 if (mc
->max_cpus
> 1) {
377 return qdev_get_gpio_in(DEVICE(&mms
->cpu_irq_splitter
[irqno
]), 0);
379 return qdev_get_gpio_in_named(DEVICE(&mms
->iotkit
), "EXP_IRQ", irqno
);
383 /* Union describing the device-specific extra data we pass to the devfn. */
384 typedef union PPCExtraData
{
388 /* Most of the devices in the AN505 FPGA image sit behind
389 * Peripheral Protection Controllers. These data structures
390 * define the layout of which devices sit behind which PPCs.
391 * The devfn for each port is a function which creates, configures
392 * and initializes the device, returning the MemoryRegion which
393 * needs to be plugged into the downstream end of the PPC port.
395 typedef MemoryRegion
*MakeDevFn(MPS2TZMachineState
*mms
, void *opaque
,
396 const char *name
, hwaddr size
,
398 const PPCExtraData
*extradata
);
400 typedef struct PPCPortInfo
{
406 int irqs
[3]; /* currently no device needs more IRQ lines than this */
407 PPCExtraData extradata
; /* to pass device-specific info to the devfn */
410 typedef struct PPCInfo
{
412 PPCPortInfo ports
[TZ_NUM_PORTS
];
415 static MemoryRegion
*make_unimp_dev(MPS2TZMachineState
*mms
,
417 const char *name
, hwaddr size
,
419 const PPCExtraData
*extradata
)
421 /* Initialize, configure and realize a TYPE_UNIMPLEMENTED_DEVICE,
422 * and return a pointer to its MemoryRegion.
424 UnimplementedDeviceState
*uds
= opaque
;
426 object_initialize_child(OBJECT(mms
), name
, uds
, TYPE_UNIMPLEMENTED_DEVICE
);
427 qdev_prop_set_string(DEVICE(uds
), "name", name
);
428 qdev_prop_set_uint64(DEVICE(uds
), "size", size
);
429 sysbus_realize(SYS_BUS_DEVICE(uds
), &error_fatal
);
430 return sysbus_mmio_get_region(SYS_BUS_DEVICE(uds
), 0);
433 static MemoryRegion
*make_uart(MPS2TZMachineState
*mms
, void *opaque
,
434 const char *name
, hwaddr size
,
435 const int *irqs
, const PPCExtraData
*extradata
)
437 /* The irq[] array is tx, rx, combined, in that order */
438 MPS2TZMachineClass
*mmc
= MPS2TZ_MACHINE_GET_CLASS(mms
);
439 CMSDKAPBUART
*uart
= opaque
;
440 int i
= uart
- &mms
->uart
[0];
442 DeviceState
*orgate_dev
= DEVICE(&mms
->uart_irq_orgate
);
444 object_initialize_child(OBJECT(mms
), name
, uart
, TYPE_CMSDK_APB_UART
);
445 qdev_prop_set_chr(DEVICE(uart
), "chardev", serial_hd(i
));
446 qdev_prop_set_uint32(DEVICE(uart
), "pclk-frq", mmc
->apb_periph_frq
);
447 sysbus_realize(SYS_BUS_DEVICE(uart
), &error_fatal
);
448 s
= SYS_BUS_DEVICE(uart
);
449 sysbus_connect_irq(s
, 0, get_sse_irq_in(mms
, irqs
[0]));
450 sysbus_connect_irq(s
, 1, get_sse_irq_in(mms
, irqs
[1]));
451 sysbus_connect_irq(s
, 2, qdev_get_gpio_in(orgate_dev
, i
* 2));
452 sysbus_connect_irq(s
, 3, qdev_get_gpio_in(orgate_dev
, i
* 2 + 1));
453 sysbus_connect_irq(s
, 4, get_sse_irq_in(mms
, irqs
[2]));
454 return sysbus_mmio_get_region(SYS_BUS_DEVICE(uart
), 0);
457 static MemoryRegion
*make_scc(MPS2TZMachineState
*mms
, void *opaque
,
458 const char *name
, hwaddr size
,
459 const int *irqs
, const PPCExtraData
*extradata
)
461 MPS2SCC
*scc
= opaque
;
463 MPS2TZMachineClass
*mmc
= MPS2TZ_MACHINE_GET_CLASS(mms
);
466 object_initialize_child(OBJECT(mms
), "scc", scc
, TYPE_MPS2_SCC
);
467 sccdev
= DEVICE(scc
);
468 qdev_prop_set_uint32(sccdev
, "scc-cfg0", mms
->remap
? 1 : 0);
469 qdev_prop_set_uint32(sccdev
, "scc-cfg4", 0x2);
470 qdev_prop_set_uint32(sccdev
, "scc-aid", 0x00200008);
471 qdev_prop_set_uint32(sccdev
, "scc-id", mmc
->scc_id
);
472 qdev_prop_set_uint32(sccdev
, "len-oscclk", mmc
->len_oscclk
);
473 for (i
= 0; i
< mmc
->len_oscclk
; i
++) {
474 g_autofree
char *propname
= g_strdup_printf("oscclk[%u]", i
);
475 qdev_prop_set_uint32(sccdev
, propname
, mmc
->oscclk
[i
]);
477 sysbus_realize(SYS_BUS_DEVICE(scc
), &error_fatal
);
478 return sysbus_mmio_get_region(SYS_BUS_DEVICE(sccdev
), 0);
481 static MemoryRegion
*make_fpgaio(MPS2TZMachineState
*mms
, void *opaque
,
482 const char *name
, hwaddr size
,
483 const int *irqs
, const PPCExtraData
*extradata
)
485 MPS2FPGAIO
*fpgaio
= opaque
;
486 MPS2TZMachineClass
*mmc
= MPS2TZ_MACHINE_GET_CLASS(mms
);
488 object_initialize_child(OBJECT(mms
), "fpgaio", fpgaio
, TYPE_MPS2_FPGAIO
);
489 qdev_prop_set_uint32(DEVICE(fpgaio
), "num-leds", mmc
->fpgaio_num_leds
);
490 qdev_prop_set_bit(DEVICE(fpgaio
), "has-switches", mmc
->fpgaio_has_switches
);
491 qdev_prop_set_bit(DEVICE(fpgaio
), "has-dbgctrl", mmc
->fpgaio_has_dbgctrl
);
492 sysbus_realize(SYS_BUS_DEVICE(fpgaio
), &error_fatal
);
493 return sysbus_mmio_get_region(SYS_BUS_DEVICE(fpgaio
), 0);
496 static MemoryRegion
*make_eth_dev(MPS2TZMachineState
*mms
, void *opaque
,
497 const char *name
, hwaddr size
,
499 const PPCExtraData
*extradata
)
502 NICInfo
*nd
= &nd_table
[0];
504 /* In hardware this is a LAN9220; the LAN9118 is software compatible
505 * except that it doesn't support the checksum-offload feature.
507 qemu_check_nic_model(nd
, "lan9118");
508 mms
->lan9118
= qdev_new(TYPE_LAN9118
);
509 qdev_set_nic_properties(mms
->lan9118
, nd
);
511 s
= SYS_BUS_DEVICE(mms
->lan9118
);
512 sysbus_realize_and_unref(s
, &error_fatal
);
513 sysbus_connect_irq(s
, 0, get_sse_irq_in(mms
, irqs
[0]));
514 return sysbus_mmio_get_region(s
, 0);
517 static MemoryRegion
*make_eth_usb(MPS2TZMachineState
*mms
, void *opaque
,
518 const char *name
, hwaddr size
,
520 const PPCExtraData
*extradata
)
523 * The AN524 makes the ethernet and USB share a PPC port.
524 * irqs[] is the ethernet IRQ.
527 NICInfo
*nd
= &nd_table
[0];
529 memory_region_init(&mms
->eth_usb_container
, OBJECT(mms
),
530 "mps2-tz-eth-usb-container", 0x200000);
533 * In hardware this is a LAN9220; the LAN9118 is software compatible
534 * except that it doesn't support the checksum-offload feature.
536 qemu_check_nic_model(nd
, "lan9118");
537 mms
->lan9118
= qdev_new(TYPE_LAN9118
);
538 qdev_set_nic_properties(mms
->lan9118
, nd
);
540 s
= SYS_BUS_DEVICE(mms
->lan9118
);
541 sysbus_realize_and_unref(s
, &error_fatal
);
542 sysbus_connect_irq(s
, 0, get_sse_irq_in(mms
, irqs
[0]));
544 memory_region_add_subregion(&mms
->eth_usb_container
,
545 0, sysbus_mmio_get_region(s
, 0));
547 /* The USB OTG controller is an ISP1763; we don't have a model of it. */
548 object_initialize_child(OBJECT(mms
), "usb-otg",
549 &mms
->usb
, TYPE_UNIMPLEMENTED_DEVICE
);
550 qdev_prop_set_string(DEVICE(&mms
->usb
), "name", "usb-otg");
551 qdev_prop_set_uint64(DEVICE(&mms
->usb
), "size", 0x100000);
552 s
= SYS_BUS_DEVICE(&mms
->usb
);
553 sysbus_realize(s
, &error_fatal
);
555 memory_region_add_subregion(&mms
->eth_usb_container
,
556 0x100000, sysbus_mmio_get_region(s
, 0));
558 return &mms
->eth_usb_container
;
561 static MemoryRegion
*make_mpc(MPS2TZMachineState
*mms
, void *opaque
,
562 const char *name
, hwaddr size
,
563 const int *irqs
, const PPCExtraData
*extradata
)
566 int i
= mpc
- &mms
->mpc
[0];
567 MemoryRegion
*upstream
;
568 const RAMInfo
*raminfo
= find_raminfo_for_mpc(mms
, i
);
569 MemoryRegion
*ram
= mr_for_raminfo(mms
, raminfo
);
571 object_initialize_child(OBJECT(mms
), name
, mpc
, TYPE_TZ_MPC
);
572 object_property_set_link(OBJECT(mpc
), "downstream", OBJECT(ram
),
574 sysbus_realize(SYS_BUS_DEVICE(mpc
), &error_fatal
);
575 /* Map the upstream end of the MPC into system memory */
576 upstream
= sysbus_mmio_get_region(SYS_BUS_DEVICE(mpc
), 1);
577 memory_region_add_subregion(get_system_memory(), raminfo
->base
, upstream
);
578 /* and connect its interrupt to the IoTKit */
579 qdev_connect_gpio_out_named(DEVICE(mpc
), "irq", 0,
580 qdev_get_gpio_in_named(DEVICE(&mms
->iotkit
),
581 "mpcexp_status", i
));
583 /* Return the register interface MR for our caller to map behind the PPC */
584 return sysbus_mmio_get_region(SYS_BUS_DEVICE(mpc
), 0);
587 static hwaddr
boot_mem_base(MPS2TZMachineState
*mms
)
590 * Return the canonical address of the block which will be mapped
591 * at address 0x0 (i.e. where the vector table is).
592 * This is usually 0, but if the AN524 alternate memory map is
593 * enabled it will be the base address of the QSPI block.
595 return mms
->remap
? 0x28000000 : 0;
598 static void remap_memory(MPS2TZMachineState
*mms
, int map
)
601 * Remap the memory for the AN524. 'map' is the value of
602 * SCC CFG_REG0 bit 0, i.e. 0 for the default map and 1
603 * for the "option 1" mapping where QSPI is at address 0.
605 * Effectively we need to swap around the "upstream" ends of
608 MPS2TZMachineClass
*mmc
= MPS2TZ_MACHINE_GET_CLASS(mms
);
611 if (mmc
->fpga_type
!= FPGA_AN524
) {
615 memory_region_transaction_begin();
616 for (i
= 0; i
< 2; i
++) {
617 TZMPC
*mpc
= &mms
->mpc
[i
];
618 MemoryRegion
*upstream
= sysbus_mmio_get_region(SYS_BUS_DEVICE(mpc
), 1);
619 hwaddr addr
= (i
^ map
) ? 0x28000000 : 0;
621 memory_region_set_address(upstream
, addr
);
623 memory_region_transaction_commit();
626 static void remap_irq_fn(void *opaque
, int n
, int level
)
628 MPS2TZMachineState
*mms
= opaque
;
630 remap_memory(mms
, level
);
633 static MemoryRegion
*make_dma(MPS2TZMachineState
*mms
, void *opaque
,
634 const char *name
, hwaddr size
,
635 const int *irqs
, const PPCExtraData
*extradata
)
637 /* The irq[] array is DMACINTR, DMACINTERR, DMACINTTC, in that order */
638 PL080State
*dma
= opaque
;
639 int i
= dma
- &mms
->dma
[0];
641 char *mscname
= g_strdup_printf("%s-msc", name
);
642 TZMSC
*msc
= &mms
->msc
[i
];
643 DeviceState
*iotkitdev
= DEVICE(&mms
->iotkit
);
644 MemoryRegion
*msc_upstream
;
645 MemoryRegion
*msc_downstream
;
648 * Each DMA device is a PL081 whose transaction master interface
649 * is guarded by a Master Security Controller. The downstream end of
650 * the MSC connects to the IoTKit AHB Slave Expansion port, so the
651 * DMA devices can see all devices and memory that the CPU does.
653 object_initialize_child(OBJECT(mms
), mscname
, msc
, TYPE_TZ_MSC
);
654 msc_downstream
= sysbus_mmio_get_region(SYS_BUS_DEVICE(&mms
->iotkit
), 0);
655 object_property_set_link(OBJECT(msc
), "downstream",
656 OBJECT(msc_downstream
), &error_fatal
);
657 object_property_set_link(OBJECT(msc
), "idau", OBJECT(mms
), &error_fatal
);
658 sysbus_realize(SYS_BUS_DEVICE(msc
), &error_fatal
);
660 qdev_connect_gpio_out_named(DEVICE(msc
), "irq", 0,
661 qdev_get_gpio_in_named(iotkitdev
,
662 "mscexp_status", i
));
663 qdev_connect_gpio_out_named(iotkitdev
, "mscexp_clear", i
,
664 qdev_get_gpio_in_named(DEVICE(msc
),
666 qdev_connect_gpio_out_named(iotkitdev
, "mscexp_ns", i
,
667 qdev_get_gpio_in_named(DEVICE(msc
),
669 qdev_connect_gpio_out(DEVICE(&mms
->sec_resp_splitter
),
670 ARRAY_SIZE(mms
->ppc
) + i
,
671 qdev_get_gpio_in_named(DEVICE(msc
),
673 msc_upstream
= sysbus_mmio_get_region(SYS_BUS_DEVICE(msc
), 0);
675 object_initialize_child(OBJECT(mms
), name
, dma
, TYPE_PL081
);
676 object_property_set_link(OBJECT(dma
), "downstream", OBJECT(msc_upstream
),
678 sysbus_realize(SYS_BUS_DEVICE(dma
), &error_fatal
);
680 s
= SYS_BUS_DEVICE(dma
);
681 /* Wire up DMACINTR, DMACINTERR, DMACINTTC */
682 sysbus_connect_irq(s
, 0, get_sse_irq_in(mms
, irqs
[0]));
683 sysbus_connect_irq(s
, 1, get_sse_irq_in(mms
, irqs
[1]));
684 sysbus_connect_irq(s
, 2, get_sse_irq_in(mms
, irqs
[2]));
687 return sysbus_mmio_get_region(s
, 0);
690 static MemoryRegion
*make_spi(MPS2TZMachineState
*mms
, void *opaque
,
691 const char *name
, hwaddr size
,
692 const int *irqs
, const PPCExtraData
*extradata
)
695 * The AN505 has five PL022 SPI controllers.
696 * One of these should have the LCD controller behind it; the others
697 * are connected only to the FPGA's "general purpose SPI connector"
698 * or "shield" expansion connectors.
699 * Note that if we do implement devices behind SPI, the chip select
700 * lines are set via the "MISC" register in the MPS2 FPGAIO device.
702 PL022State
*spi
= opaque
;
705 object_initialize_child(OBJECT(mms
), name
, spi
, TYPE_PL022
);
706 sysbus_realize(SYS_BUS_DEVICE(spi
), &error_fatal
);
707 s
= SYS_BUS_DEVICE(spi
);
708 sysbus_connect_irq(s
, 0, get_sse_irq_in(mms
, irqs
[0]));
709 return sysbus_mmio_get_region(s
, 0);
712 static MemoryRegion
*make_i2c(MPS2TZMachineState
*mms
, void *opaque
,
713 const char *name
, hwaddr size
,
714 const int *irqs
, const PPCExtraData
*extradata
)
716 ArmSbconI2CState
*i2c
= opaque
;
719 object_initialize_child(OBJECT(mms
), name
, i2c
, TYPE_ARM_SBCON_I2C
);
720 s
= SYS_BUS_DEVICE(i2c
);
721 sysbus_realize(s
, &error_fatal
);
724 * If this is an internal-use-only i2c bus, mark it full
725 * so that user-created i2c devices are not plugged into it.
726 * If we implement models of any on-board i2c devices that
727 * plug in to one of the internal-use-only buses, then we will
728 * need to create and plugging those in here before we mark the
731 if (extradata
->i2c_internal
) {
732 BusState
*qbus
= qdev_get_child_bus(DEVICE(i2c
), "i2c");
733 qbus_mark_full(qbus
);
736 return sysbus_mmio_get_region(s
, 0);
739 static MemoryRegion
*make_rtc(MPS2TZMachineState
*mms
, void *opaque
,
740 const char *name
, hwaddr size
,
741 const int *irqs
, const PPCExtraData
*extradata
)
743 PL031State
*pl031
= opaque
;
746 object_initialize_child(OBJECT(mms
), name
, pl031
, TYPE_PL031
);
747 s
= SYS_BUS_DEVICE(pl031
);
748 sysbus_realize(s
, &error_fatal
);
750 * The board docs don't give an IRQ number for the PL031, so
751 * presumably it is not connected.
753 return sysbus_mmio_get_region(s
, 0);
756 static void create_non_mpc_ram(MPS2TZMachineState
*mms
)
759 * Handle the RAMs which are either not behind MPCs or which are
760 * aliases to another MPC.
763 MPS2TZMachineClass
*mmc
= MPS2TZ_MACHINE_GET_CLASS(mms
);
765 for (p
= mmc
->raminfo
; p
->name
; p
++) {
766 if (p
->flags
& IS_ALIAS
) {
767 SysBusDevice
*mpc_sbd
= SYS_BUS_DEVICE(&mms
->mpc
[p
->mpc
]);
768 MemoryRegion
*upstream
= sysbus_mmio_get_region(mpc_sbd
, 1);
769 make_ram_alias(&mms
->ram
[p
->mrindex
], p
->name
, upstream
, p
->base
);
770 } else if (p
->mpc
== -1) {
771 /* RAM not behind an MPC */
772 MemoryRegion
*mr
= mr_for_raminfo(mms
, p
);
773 memory_region_add_subregion(get_system_memory(), p
->base
, mr
);
778 static uint32_t boot_ram_size(MPS2TZMachineState
*mms
)
780 /* Return the size of the RAM block at guest address zero */
782 MPS2TZMachineClass
*mmc
= MPS2TZ_MACHINE_GET_CLASS(mms
);
785 * Use a per-board specification (for when the boot RAM is in
786 * the SSE and so doesn't have a RAMInfo list entry)
788 if (mmc
->boot_ram_size
) {
789 return mmc
->boot_ram_size
;
792 for (p
= mmc
->raminfo
; p
->name
; p
++) {
793 if (p
->base
== boot_mem_base(mms
)) {
797 g_assert_not_reached();
800 static void mps2tz_common_init(MachineState
*machine
)
802 MPS2TZMachineState
*mms
= MPS2TZ_MACHINE(machine
);
803 MPS2TZMachineClass
*mmc
= MPS2TZ_MACHINE_GET_CLASS(mms
);
804 MachineClass
*mc
= MACHINE_GET_CLASS(machine
);
805 MemoryRegion
*system_memory
= get_system_memory();
806 DeviceState
*iotkitdev
;
807 DeviceState
*dev_splitter
;
812 if (strcmp(machine
->cpu_type
, mc
->default_cpu_type
) != 0) {
813 error_report("This board can only be used with CPU %s",
814 mc
->default_cpu_type
);
818 if (machine
->ram_size
!= mc
->default_ram_size
) {
819 char *sz
= size_to_str(mc
->default_ram_size
);
820 error_report("Invalid RAM size, should be %s", sz
);
825 /* These clocks don't need migration because they are fixed-frequency */
826 mms
->sysclk
= clock_new(OBJECT(machine
), "SYSCLK");
827 clock_set_hz(mms
->sysclk
, mmc
->sysclk_frq
);
828 mms
->s32kclk
= clock_new(OBJECT(machine
), "S32KCLK");
829 clock_set_hz(mms
->s32kclk
, S32KCLK_FRQ
);
831 object_initialize_child(OBJECT(machine
), TYPE_IOTKIT
, &mms
->iotkit
,
833 iotkitdev
= DEVICE(&mms
->iotkit
);
834 object_property_set_link(OBJECT(&mms
->iotkit
), "memory",
835 OBJECT(system_memory
), &error_abort
);
836 qdev_prop_set_uint32(iotkitdev
, "EXP_NUMIRQ", mmc
->numirq
);
837 qdev_prop_set_uint32(iotkitdev
, "init-svtor", mmc
->init_svtor
);
838 if (mmc
->cpu0_mpu_ns
!= MPU_REGION_DEFAULT
) {
839 qdev_prop_set_uint32(iotkitdev
, "CPU0_MPU_NS", mmc
->cpu0_mpu_ns
);
841 if (mmc
->cpu0_mpu_s
!= MPU_REGION_DEFAULT
) {
842 qdev_prop_set_uint32(iotkitdev
, "CPU0_MPU_S", mmc
->cpu0_mpu_s
);
844 if (object_property_find(OBJECT(iotkitdev
), "CPU1_MPU_NS")) {
845 if (mmc
->cpu1_mpu_ns
!= MPU_REGION_DEFAULT
) {
846 qdev_prop_set_uint32(iotkitdev
, "CPU1_MPU_NS", mmc
->cpu1_mpu_ns
);
848 if (mmc
->cpu1_mpu_s
!= MPU_REGION_DEFAULT
) {
849 qdev_prop_set_uint32(iotkitdev
, "CPU1_MPU_S", mmc
->cpu1_mpu_s
);
852 qdev_prop_set_uint32(iotkitdev
, "SRAM_ADDR_WIDTH", mmc
->sram_addr_width
);
853 qdev_connect_clock_in(iotkitdev
, "MAINCLK", mms
->sysclk
);
854 qdev_connect_clock_in(iotkitdev
, "S32KCLK", mms
->s32kclk
);
855 sysbus_realize(SYS_BUS_DEVICE(&mms
->iotkit
), &error_fatal
);
858 * If this board has more than one CPU, then we need to create splitters
859 * to feed the IRQ inputs for each CPU in the SSE from each device in the
860 * board. If there is only one CPU, we can just wire the device IRQ
861 * directly to the SSE's IRQ input.
863 assert(mmc
->numirq
<= MPS2TZ_NUMIRQ_MAX
);
864 if (mc
->max_cpus
> 1) {
865 for (i
= 0; i
< mmc
->numirq
; i
++) {
866 char *name
= g_strdup_printf("mps2-irq-splitter%d", i
);
867 SplitIRQ
*splitter
= &mms
->cpu_irq_splitter
[i
];
869 object_initialize_child_with_props(OBJECT(machine
), name
,
870 splitter
, sizeof(*splitter
),
871 TYPE_SPLIT_IRQ
, &error_fatal
,
875 object_property_set_int(OBJECT(splitter
), "num-lines", 2,
877 qdev_realize(DEVICE(splitter
), NULL
, &error_fatal
);
878 qdev_connect_gpio_out(DEVICE(splitter
), 0,
879 qdev_get_gpio_in_named(DEVICE(&mms
->iotkit
),
881 qdev_connect_gpio_out(DEVICE(splitter
), 1,
882 qdev_get_gpio_in_named(DEVICE(&mms
->iotkit
),
887 /* The sec_resp_cfg output from the IoTKit must be split into multiple
888 * lines, one for each of the PPCs we create here, plus one per MSC.
890 object_initialize_child(OBJECT(machine
), "sec-resp-splitter",
891 &mms
->sec_resp_splitter
, TYPE_SPLIT_IRQ
);
892 object_property_set_int(OBJECT(&mms
->sec_resp_splitter
), "num-lines",
893 ARRAY_SIZE(mms
->ppc
) + ARRAY_SIZE(mms
->msc
),
895 qdev_realize(DEVICE(&mms
->sec_resp_splitter
), NULL
, &error_fatal
);
896 dev_splitter
= DEVICE(&mms
->sec_resp_splitter
);
897 qdev_connect_gpio_out_named(iotkitdev
, "sec_resp_cfg", 0,
898 qdev_get_gpio_in(dev_splitter
, 0));
901 * The IoTKit sets up much of the memory layout, including
902 * the aliases between secure and non-secure regions in the
903 * address space, and also most of the devices in the system.
904 * The FPGA itself contains various RAMs and some additional devices.
905 * The FPGA images have an odd combination of different RAMs,
906 * because in hardware they are different implementations and
907 * connected to different buses, giving varying performance/size
908 * tradeoffs. For QEMU they're all just RAM, though. We arbitrarily
909 * call the largest lump our "system memory".
913 * The overflow IRQs for all UARTs are ORed together.
914 * Tx, Rx and "combined" IRQs are sent to the NVIC separately.
915 * Create the OR gate for this: it has one input for the TX overflow
916 * and one for the RX overflow for each UART we might have.
917 * (If the board has fewer than the maximum possible number of UARTs
918 * those inputs are never wired up and are treated as always-zero.)
920 object_initialize_child(OBJECT(mms
), "uart-irq-orgate",
921 &mms
->uart_irq_orgate
, TYPE_OR_IRQ
);
922 object_property_set_int(OBJECT(&mms
->uart_irq_orgate
), "num-lines",
923 2 * ARRAY_SIZE(mms
->uart
),
925 qdev_realize(DEVICE(&mms
->uart_irq_orgate
), NULL
, &error_fatal
);
926 qdev_connect_gpio_out(DEVICE(&mms
->uart_irq_orgate
), 0,
927 get_sse_irq_in(mms
, mmc
->uart_overflow_irq
));
929 /* Most of the devices in the FPGA are behind Peripheral Protection
930 * Controllers. The required order for initializing things is:
931 * + initialize the PPC
932 * + initialize, configure and realize downstream devices
933 * + connect downstream device MemoryRegions to the PPC
935 * + map the PPC's MemoryRegions to the places in the address map
936 * where the downstream devices should appear
937 * + wire up the PPC's control lines to the IoTKit object
940 const PPCInfo an505_ppcs
[] = { {
941 .name
= "apb_ppcexp0",
943 { "ssram-0-mpc", make_mpc
, &mms
->mpc
[0], 0x58007000, 0x1000 },
944 { "ssram-1-mpc", make_mpc
, &mms
->mpc
[1], 0x58008000, 0x1000 },
945 { "ssram-2-mpc", make_mpc
, &mms
->mpc
[2], 0x58009000, 0x1000 },
948 .name
= "apb_ppcexp1",
950 { "spi0", make_spi
, &mms
->spi
[0], 0x40205000, 0x1000, { 51 } },
951 { "spi1", make_spi
, &mms
->spi
[1], 0x40206000, 0x1000, { 52 } },
952 { "spi2", make_spi
, &mms
->spi
[2], 0x40209000, 0x1000, { 53 } },
953 { "spi3", make_spi
, &mms
->spi
[3], 0x4020a000, 0x1000, { 54 } },
954 { "spi4", make_spi
, &mms
->spi
[4], 0x4020b000, 0x1000, { 55 } },
955 { "uart0", make_uart
, &mms
->uart
[0], 0x40200000, 0x1000, { 32, 33, 42 } },
956 { "uart1", make_uart
, &mms
->uart
[1], 0x40201000, 0x1000, { 34, 35, 43 } },
957 { "uart2", make_uart
, &mms
->uart
[2], 0x40202000, 0x1000, { 36, 37, 44 } },
958 { "uart3", make_uart
, &mms
->uart
[3], 0x40203000, 0x1000, { 38, 39, 45 } },
959 { "uart4", make_uart
, &mms
->uart
[4], 0x40204000, 0x1000, { 40, 41, 46 } },
960 { "i2c0", make_i2c
, &mms
->i2c
[0], 0x40207000, 0x1000, {},
961 { .i2c_internal
= true /* touchscreen */ } },
962 { "i2c1", make_i2c
, &mms
->i2c
[1], 0x40208000, 0x1000, {},
963 { .i2c_internal
= true /* audio conf */ } },
964 { "i2c2", make_i2c
, &mms
->i2c
[2], 0x4020c000, 0x1000, {},
965 { .i2c_internal
= false /* shield 0 */ } },
966 { "i2c3", make_i2c
, &mms
->i2c
[3], 0x4020d000, 0x1000, {},
967 { .i2c_internal
= false /* shield 1 */ } },
970 .name
= "apb_ppcexp2",
972 { "scc", make_scc
, &mms
->scc
, 0x40300000, 0x1000 },
973 { "i2s-audio", make_unimp_dev
, &mms
->i2s_audio
,
974 0x40301000, 0x1000 },
975 { "fpgaio", make_fpgaio
, &mms
->fpgaio
, 0x40302000, 0x1000 },
978 .name
= "ahb_ppcexp0",
980 { "gfx", make_unimp_dev
, &mms
->gfx
, 0x41000000, 0x140000 },
981 { "gpio0", make_unimp_dev
, &mms
->gpio
[0], 0x40100000, 0x1000 },
982 { "gpio1", make_unimp_dev
, &mms
->gpio
[1], 0x40101000, 0x1000 },
983 { "gpio2", make_unimp_dev
, &mms
->gpio
[2], 0x40102000, 0x1000 },
984 { "gpio3", make_unimp_dev
, &mms
->gpio
[3], 0x40103000, 0x1000 },
985 { "eth", make_eth_dev
, NULL
, 0x42000000, 0x100000, { 48 } },
988 .name
= "ahb_ppcexp1",
990 { "dma0", make_dma
, &mms
->dma
[0], 0x40110000, 0x1000, { 58, 56, 57 } },
991 { "dma1", make_dma
, &mms
->dma
[1], 0x40111000, 0x1000, { 61, 59, 60 } },
992 { "dma2", make_dma
, &mms
->dma
[2], 0x40112000, 0x1000, { 64, 62, 63 } },
993 { "dma3", make_dma
, &mms
->dma
[3], 0x40113000, 0x1000, { 67, 65, 66 } },
998 const PPCInfo an524_ppcs
[] = { {
999 .name
= "apb_ppcexp0",
1001 { "bram-mpc", make_mpc
, &mms
->mpc
[0], 0x58007000, 0x1000 },
1002 { "qspi-mpc", make_mpc
, &mms
->mpc
[1], 0x58008000, 0x1000 },
1003 { "ddr-mpc", make_mpc
, &mms
->mpc
[2], 0x58009000, 0x1000 },
1006 .name
= "apb_ppcexp1",
1008 { "i2c0", make_i2c
, &mms
->i2c
[0], 0x41200000, 0x1000, {},
1009 { .i2c_internal
= true /* touchscreen */ } },
1010 { "i2c1", make_i2c
, &mms
->i2c
[1], 0x41201000, 0x1000, {},
1011 { .i2c_internal
= true /* audio conf */ } },
1012 { "spi0", make_spi
, &mms
->spi
[0], 0x41202000, 0x1000, { 52 } },
1013 { "spi1", make_spi
, &mms
->spi
[1], 0x41203000, 0x1000, { 53 } },
1014 { "spi2", make_spi
, &mms
->spi
[2], 0x41204000, 0x1000, { 54 } },
1015 { "i2c2", make_i2c
, &mms
->i2c
[2], 0x41205000, 0x1000, {},
1016 { .i2c_internal
= false /* shield 0 */ } },
1017 { "i2c3", make_i2c
, &mms
->i2c
[3], 0x41206000, 0x1000, {},
1018 { .i2c_internal
= false /* shield 1 */ } },
1019 { /* port 7 reserved */ },
1020 { "i2c4", make_i2c
, &mms
->i2c
[4], 0x41208000, 0x1000, {},
1021 { .i2c_internal
= true /* DDR4 EEPROM */ } },
1024 .name
= "apb_ppcexp2",
1026 { "scc", make_scc
, &mms
->scc
, 0x41300000, 0x1000 },
1027 { "i2s-audio", make_unimp_dev
, &mms
->i2s_audio
,
1028 0x41301000, 0x1000 },
1029 { "fpgaio", make_fpgaio
, &mms
->fpgaio
, 0x41302000, 0x1000 },
1030 { "uart0", make_uart
, &mms
->uart
[0], 0x41303000, 0x1000, { 32, 33, 42 } },
1031 { "uart1", make_uart
, &mms
->uart
[1], 0x41304000, 0x1000, { 34, 35, 43 } },
1032 { "uart2", make_uart
, &mms
->uart
[2], 0x41305000, 0x1000, { 36, 37, 44 } },
1033 { "uart3", make_uart
, &mms
->uart
[3], 0x41306000, 0x1000, { 38, 39, 45 } },
1034 { "uart4", make_uart
, &mms
->uart
[4], 0x41307000, 0x1000, { 40, 41, 46 } },
1035 { "uart5", make_uart
, &mms
->uart
[5], 0x41308000, 0x1000, { 124, 125, 126 } },
1037 { /* port 9 reserved */ },
1038 { "clcd", make_unimp_dev
, &mms
->cldc
, 0x4130a000, 0x1000 },
1039 { "rtc", make_rtc
, &mms
->rtc
, 0x4130b000, 0x1000 },
1042 .name
= "ahb_ppcexp0",
1044 { "gpio0", make_unimp_dev
, &mms
->gpio
[0], 0x41100000, 0x1000 },
1045 { "gpio1", make_unimp_dev
, &mms
->gpio
[1], 0x41101000, 0x1000 },
1046 { "gpio2", make_unimp_dev
, &mms
->gpio
[2], 0x41102000, 0x1000 },
1047 { "gpio3", make_unimp_dev
, &mms
->gpio
[3], 0x41103000, 0x1000 },
1048 { "eth-usb", make_eth_usb
, NULL
, 0x41400000, 0x200000, { 48 } },
1053 const PPCInfo an547_ppcs
[] = { {
1054 .name
= "apb_ppcexp0",
1056 { "ssram-mpc", make_mpc
, &mms
->mpc
[0], 0x57000000, 0x1000 },
1057 { "qspi-mpc", make_mpc
, &mms
->mpc
[1], 0x57001000, 0x1000 },
1058 { "ddr-mpc", make_mpc
, &mms
->mpc
[2], 0x57002000, 0x1000 },
1061 .name
= "apb_ppcexp1",
1063 { "i2c0", make_i2c
, &mms
->i2c
[0], 0x49200000, 0x1000, {},
1064 { .i2c_internal
= true /* touchscreen */ } },
1065 { "i2c1", make_i2c
, &mms
->i2c
[1], 0x49201000, 0x1000, {},
1066 { .i2c_internal
= true /* audio conf */ } },
1067 { "spi0", make_spi
, &mms
->spi
[0], 0x49202000, 0x1000, { 53 } },
1068 { "spi1", make_spi
, &mms
->spi
[1], 0x49203000, 0x1000, { 54 } },
1069 { "spi2", make_spi
, &mms
->spi
[2], 0x49204000, 0x1000, { 55 } },
1070 { "i2c2", make_i2c
, &mms
->i2c
[2], 0x49205000, 0x1000, {},
1071 { .i2c_internal
= false /* shield 0 */ } },
1072 { "i2c3", make_i2c
, &mms
->i2c
[3], 0x49206000, 0x1000, {},
1073 { .i2c_internal
= false /* shield 1 */ } },
1074 { /* port 7 reserved */ },
1075 { "i2c4", make_i2c
, &mms
->i2c
[4], 0x49208000, 0x1000, {},
1076 { .i2c_internal
= true /* DDR4 EEPROM */ } },
1079 .name
= "apb_ppcexp2",
1081 { "scc", make_scc
, &mms
->scc
, 0x49300000, 0x1000 },
1082 { "i2s-audio", make_unimp_dev
, &mms
->i2s_audio
, 0x49301000, 0x1000 },
1083 { "fpgaio", make_fpgaio
, &mms
->fpgaio
, 0x49302000, 0x1000 },
1084 { "uart0", make_uart
, &mms
->uart
[0], 0x49303000, 0x1000, { 33, 34, 43 } },
1085 { "uart1", make_uart
, &mms
->uart
[1], 0x49304000, 0x1000, { 35, 36, 44 } },
1086 { "uart2", make_uart
, &mms
->uart
[2], 0x49305000, 0x1000, { 37, 38, 45 } },
1087 { "uart3", make_uart
, &mms
->uart
[3], 0x49306000, 0x1000, { 39, 40, 46 } },
1088 { "uart4", make_uart
, &mms
->uart
[4], 0x49307000, 0x1000, { 41, 42, 47 } },
1089 { "uart5", make_uart
, &mms
->uart
[5], 0x49308000, 0x1000, { 125, 126, 127 } },
1091 { /* port 9 reserved */ },
1092 { "clcd", make_unimp_dev
, &mms
->cldc
, 0x4930a000, 0x1000 },
1093 { "rtc", make_rtc
, &mms
->rtc
, 0x4930b000, 0x1000 },
1096 .name
= "ahb_ppcexp0",
1098 { "gpio0", make_unimp_dev
, &mms
->gpio
[0], 0x41100000, 0x1000 },
1099 { "gpio1", make_unimp_dev
, &mms
->gpio
[1], 0x41101000, 0x1000 },
1100 { "gpio2", make_unimp_dev
, &mms
->gpio
[2], 0x41102000, 0x1000 },
1101 { "gpio3", make_unimp_dev
, &mms
->gpio
[3], 0x41103000, 0x1000 },
1102 { /* port 4 USER AHB interface 0 */ },
1103 { /* port 5 USER AHB interface 1 */ },
1104 { /* port 6 USER AHB interface 2 */ },
1105 { /* port 7 USER AHB interface 3 */ },
1106 { "eth-usb", make_eth_usb
, NULL
, 0x41400000, 0x200000, { 49 } },
1111 switch (mmc
->fpga_type
) {
1115 num_ppcs
= ARRAY_SIZE(an505_ppcs
);
1119 num_ppcs
= ARRAY_SIZE(an524_ppcs
);
1123 num_ppcs
= ARRAY_SIZE(an547_ppcs
);
1126 g_assert_not_reached();
1129 for (i
= 0; i
< num_ppcs
; i
++) {
1130 const PPCInfo
*ppcinfo
= &ppcs
[i
];
1131 TZPPC
*ppc
= &mms
->ppc
[i
];
1132 DeviceState
*ppcdev
;
1136 object_initialize_child(OBJECT(machine
), ppcinfo
->name
, ppc
,
1138 ppcdev
= DEVICE(ppc
);
1140 for (port
= 0; port
< TZ_NUM_PORTS
; port
++) {
1141 const PPCPortInfo
*pinfo
= &ppcinfo
->ports
[port
];
1145 if (!pinfo
->devfn
) {
1149 mr
= pinfo
->devfn(mms
, pinfo
->opaque
, pinfo
->name
, pinfo
->size
,
1150 pinfo
->irqs
, &pinfo
->extradata
);
1151 portname
= g_strdup_printf("port[%d]", port
);
1152 object_property_set_link(OBJECT(ppc
), portname
, OBJECT(mr
),
1157 sysbus_realize(SYS_BUS_DEVICE(ppc
), &error_fatal
);
1159 for (port
= 0; port
< TZ_NUM_PORTS
; port
++) {
1160 const PPCPortInfo
*pinfo
= &ppcinfo
->ports
[port
];
1162 if (!pinfo
->devfn
) {
1165 sysbus_mmio_map(SYS_BUS_DEVICE(ppc
), port
, pinfo
->addr
);
1167 gpioname
= g_strdup_printf("%s_nonsec", ppcinfo
->name
);
1168 qdev_connect_gpio_out_named(iotkitdev
, gpioname
, port
,
1169 qdev_get_gpio_in_named(ppcdev
,
1173 gpioname
= g_strdup_printf("%s_ap", ppcinfo
->name
);
1174 qdev_connect_gpio_out_named(iotkitdev
, gpioname
, port
,
1175 qdev_get_gpio_in_named(ppcdev
,
1180 gpioname
= g_strdup_printf("%s_irq_enable", ppcinfo
->name
);
1181 qdev_connect_gpio_out_named(iotkitdev
, gpioname
, 0,
1182 qdev_get_gpio_in_named(ppcdev
,
1185 gpioname
= g_strdup_printf("%s_irq_clear", ppcinfo
->name
);
1186 qdev_connect_gpio_out_named(iotkitdev
, gpioname
, 0,
1187 qdev_get_gpio_in_named(ppcdev
,
1190 gpioname
= g_strdup_printf("%s_irq_status", ppcinfo
->name
);
1191 qdev_connect_gpio_out_named(ppcdev
, "irq", 0,
1192 qdev_get_gpio_in_named(iotkitdev
,
1196 qdev_connect_gpio_out(dev_splitter
, i
,
1197 qdev_get_gpio_in_named(ppcdev
,
1198 "cfg_sec_resp", 0));
1201 create_unimplemented_device("FPGA NS PC", 0x48007000, 0x1000);
1203 if (mmc
->fpga_type
== FPGA_AN547
) {
1204 create_unimplemented_device("U55 timing adapter 0", 0x48102000, 0x1000);
1205 create_unimplemented_device("U55 timing adapter 1", 0x48103000, 0x1000);
1208 create_non_mpc_ram(mms
);
1210 if (mmc
->fpga_type
== FPGA_AN524
) {
1212 * Connect the line from the SCC so that we can remap when the
1213 * guest updates that register.
1215 mms
->remap_irq
= qemu_allocate_irq(remap_irq_fn
, mms
, 0);
1216 qdev_connect_gpio_out_named(DEVICE(&mms
->scc
), "remap", 0,
1220 armv7m_load_kernel(ARM_CPU(first_cpu
), machine
->kernel_filename
,
1221 0, boot_ram_size(mms
));
1224 static void mps2_tz_idau_check(IDAUInterface
*ii
, uint32_t address
,
1225 int *iregion
, bool *exempt
, bool *ns
, bool *nsc
)
1228 * The MPS2 TZ FPGA images have IDAUs in them which are connected to
1229 * the Master Security Controllers. These have the same logic as
1230 * is used by the IoTKit for the IDAU connected to the CPU, except
1231 * that MSCs don't care about the NSC attribute.
1233 int region
= extract32(address
, 28, 4);
1235 *ns
= !(region
& 1);
1237 /* 0xe0000000..0xe00fffff and 0xf0000000..0xf00fffff are exempt */
1238 *exempt
= (address
& 0xeff00000) == 0xe0000000;
1242 static char *mps2_get_remap(Object
*obj
, Error
**errp
)
1244 MPS2TZMachineState
*mms
= MPS2TZ_MACHINE(obj
);
1245 const char *val
= mms
->remap
? "QSPI" : "BRAM";
1246 return g_strdup(val
);
1249 static void mps2_set_remap(Object
*obj
, const char *value
, Error
**errp
)
1251 MPS2TZMachineState
*mms
= MPS2TZ_MACHINE(obj
);
1253 if (!strcmp(value
, "BRAM")) {
1255 } else if (!strcmp(value
, "QSPI")) {
1258 error_setg(errp
, "Invalid remap value");
1259 error_append_hint(errp
, "Valid values are BRAM and QSPI.\n");
1263 static void mps2_machine_reset(MachineState
*machine
, ShutdownCause reason
)
1265 MPS2TZMachineState
*mms
= MPS2TZ_MACHINE(machine
);
1268 * Set the initial memory mapping before triggering the reset of
1269 * the rest of the system, so that the guest image loader and CPU
1270 * reset see the correct mapping.
1272 remap_memory(mms
, mms
->remap
);
1273 qemu_devices_reset(reason
);
1276 static void mps2tz_class_init(ObjectClass
*oc
, void *data
)
1278 MachineClass
*mc
= MACHINE_CLASS(oc
);
1279 IDAUInterfaceClass
*iic
= IDAU_INTERFACE_CLASS(oc
);
1280 MPS2TZMachineClass
*mmc
= MPS2TZ_MACHINE_CLASS(oc
);
1282 mc
->init
= mps2tz_common_init
;
1283 mc
->reset
= mps2_machine_reset
;
1284 iic
->check
= mps2_tz_idau_check
;
1286 /* Most machines leave these at the SSE defaults */
1287 mmc
->cpu0_mpu_ns
= MPU_REGION_DEFAULT
;
1288 mmc
->cpu0_mpu_s
= MPU_REGION_DEFAULT
;
1289 mmc
->cpu1_mpu_ns
= MPU_REGION_DEFAULT
;
1290 mmc
->cpu1_mpu_s
= MPU_REGION_DEFAULT
;
1293 static void mps2tz_set_default_ram_info(MPS2TZMachineClass
*mmc
)
1296 * Set mc->default_ram_size and default_ram_id from the
1297 * information in mmc->raminfo.
1299 MachineClass
*mc
= MACHINE_CLASS(mmc
);
1302 for (p
= mmc
->raminfo
; p
->name
; p
++) {
1303 if (p
->mrindex
< 0) {
1304 /* Found the entry for "system memory" */
1305 mc
->default_ram_size
= p
->size
;
1306 mc
->default_ram_id
= p
->name
;
1310 g_assert_not_reached();
1313 static void mps2tz_an505_class_init(ObjectClass
*oc
, void *data
)
1315 MachineClass
*mc
= MACHINE_CLASS(oc
);
1316 MPS2TZMachineClass
*mmc
= MPS2TZ_MACHINE_CLASS(oc
);
1318 mc
->desc
= "ARM MPS2 with AN505 FPGA image for Cortex-M33";
1319 mc
->default_cpus
= 1;
1320 mc
->min_cpus
= mc
->default_cpus
;
1321 mc
->max_cpus
= mc
->default_cpus
;
1322 mmc
->fpga_type
= FPGA_AN505
;
1323 mc
->default_cpu_type
= ARM_CPU_TYPE_NAME("cortex-m33");
1324 mmc
->scc_id
= 0x41045050;
1325 mmc
->sysclk_frq
= 20 * 1000 * 1000; /* 20MHz */
1326 mmc
->apb_periph_frq
= mmc
->sysclk_frq
;
1327 mmc
->oscclk
= an505_oscclk
;
1328 mmc
->len_oscclk
= ARRAY_SIZE(an505_oscclk
);
1329 mmc
->fpgaio_num_leds
= 2;
1330 mmc
->fpgaio_has_switches
= false;
1331 mmc
->fpgaio_has_dbgctrl
= false;
1333 mmc
->uart_overflow_irq
= 47;
1334 mmc
->init_svtor
= 0x10000000;
1335 mmc
->sram_addr_width
= 15;
1336 mmc
->raminfo
= an505_raminfo
;
1337 mmc
->armsse_type
= TYPE_IOTKIT
;
1338 mmc
->boot_ram_size
= 0;
1339 mps2tz_set_default_ram_info(mmc
);
1342 static void mps2tz_an521_class_init(ObjectClass
*oc
, void *data
)
1344 MachineClass
*mc
= MACHINE_CLASS(oc
);
1345 MPS2TZMachineClass
*mmc
= MPS2TZ_MACHINE_CLASS(oc
);
1347 mc
->desc
= "ARM MPS2 with AN521 FPGA image for dual Cortex-M33";
1348 mc
->default_cpus
= 2;
1349 mc
->min_cpus
= mc
->default_cpus
;
1350 mc
->max_cpus
= mc
->default_cpus
;
1351 mmc
->fpga_type
= FPGA_AN521
;
1352 mc
->default_cpu_type
= ARM_CPU_TYPE_NAME("cortex-m33");
1353 mmc
->scc_id
= 0x41045210;
1354 mmc
->sysclk_frq
= 20 * 1000 * 1000; /* 20MHz */
1355 mmc
->apb_periph_frq
= mmc
->sysclk_frq
;
1356 mmc
->oscclk
= an505_oscclk
; /* AN521 is the same as AN505 here */
1357 mmc
->len_oscclk
= ARRAY_SIZE(an505_oscclk
);
1358 mmc
->fpgaio_num_leds
= 2;
1359 mmc
->fpgaio_has_switches
= false;
1360 mmc
->fpgaio_has_dbgctrl
= false;
1362 mmc
->uart_overflow_irq
= 47;
1363 mmc
->init_svtor
= 0x10000000;
1364 mmc
->sram_addr_width
= 15;
1365 mmc
->raminfo
= an505_raminfo
; /* AN521 is the same as AN505 here */
1366 mmc
->armsse_type
= TYPE_SSE200
;
1367 mmc
->boot_ram_size
= 0;
1368 mps2tz_set_default_ram_info(mmc
);
1371 static void mps3tz_an524_class_init(ObjectClass
*oc
, void *data
)
1373 MachineClass
*mc
= MACHINE_CLASS(oc
);
1374 MPS2TZMachineClass
*mmc
= MPS2TZ_MACHINE_CLASS(oc
);
1376 mc
->desc
= "ARM MPS3 with AN524 FPGA image for dual Cortex-M33";
1377 mc
->default_cpus
= 2;
1378 mc
->min_cpus
= mc
->default_cpus
;
1379 mc
->max_cpus
= mc
->default_cpus
;
1380 mmc
->fpga_type
= FPGA_AN524
;
1381 mc
->default_cpu_type
= ARM_CPU_TYPE_NAME("cortex-m33");
1382 mmc
->scc_id
= 0x41045240;
1383 mmc
->sysclk_frq
= 32 * 1000 * 1000; /* 32MHz */
1384 mmc
->apb_periph_frq
= mmc
->sysclk_frq
;
1385 mmc
->oscclk
= an524_oscclk
;
1386 mmc
->len_oscclk
= ARRAY_SIZE(an524_oscclk
);
1387 mmc
->fpgaio_num_leds
= 10;
1388 mmc
->fpgaio_has_switches
= true;
1389 mmc
->fpgaio_has_dbgctrl
= false;
1391 mmc
->uart_overflow_irq
= 47;
1392 mmc
->init_svtor
= 0x10000000;
1393 mmc
->sram_addr_width
= 15;
1394 mmc
->raminfo
= an524_raminfo
;
1395 mmc
->armsse_type
= TYPE_SSE200
;
1396 mmc
->boot_ram_size
= 0;
1397 mps2tz_set_default_ram_info(mmc
);
1399 object_class_property_add_str(oc
, "remap", mps2_get_remap
, mps2_set_remap
);
1400 object_class_property_set_description(oc
, "remap",
1401 "Set memory mapping. Valid values "
1402 "are BRAM (default) and QSPI.");
1405 static void mps3tz_an547_class_init(ObjectClass
*oc
, void *data
)
1407 MachineClass
*mc
= MACHINE_CLASS(oc
);
1408 MPS2TZMachineClass
*mmc
= MPS2TZ_MACHINE_CLASS(oc
);
1410 mc
->desc
= "ARM MPS3 with AN547 FPGA image for Cortex-M55";
1411 mc
->default_cpus
= 1;
1412 mc
->min_cpus
= mc
->default_cpus
;
1413 mc
->max_cpus
= mc
->default_cpus
;
1414 mmc
->fpga_type
= FPGA_AN547
;
1415 mc
->default_cpu_type
= ARM_CPU_TYPE_NAME("cortex-m55");
1416 mmc
->scc_id
= 0x41055470;
1417 mmc
->sysclk_frq
= 32 * 1000 * 1000; /* 32MHz */
1418 mmc
->apb_periph_frq
= 25 * 1000 * 1000; /* 25MHz */
1419 mmc
->oscclk
= an524_oscclk
; /* same as AN524 */
1420 mmc
->len_oscclk
= ARRAY_SIZE(an524_oscclk
);
1421 mmc
->fpgaio_num_leds
= 10;
1422 mmc
->fpgaio_has_switches
= true;
1423 mmc
->fpgaio_has_dbgctrl
= true;
1425 mmc
->uart_overflow_irq
= 48;
1426 mmc
->init_svtor
= 0x00000000;
1427 mmc
->cpu0_mpu_s
= mmc
->cpu0_mpu_ns
= 16;
1428 mmc
->sram_addr_width
= 21;
1429 mmc
->raminfo
= an547_raminfo
;
1430 mmc
->armsse_type
= TYPE_SSE300
;
1431 mmc
->boot_ram_size
= 512 * KiB
;
1432 mps2tz_set_default_ram_info(mmc
);
1435 static const TypeInfo mps2tz_info
= {
1436 .name
= TYPE_MPS2TZ_MACHINE
,
1437 .parent
= TYPE_MACHINE
,
1439 .instance_size
= sizeof(MPS2TZMachineState
),
1440 .class_size
= sizeof(MPS2TZMachineClass
),
1441 .class_init
= mps2tz_class_init
,
1442 .interfaces
= (InterfaceInfo
[]) {
1443 { TYPE_IDAU_INTERFACE
},
1448 static const TypeInfo mps2tz_an505_info
= {
1449 .name
= TYPE_MPS2TZ_AN505_MACHINE
,
1450 .parent
= TYPE_MPS2TZ_MACHINE
,
1451 .class_init
= mps2tz_an505_class_init
,
1454 static const TypeInfo mps2tz_an521_info
= {
1455 .name
= TYPE_MPS2TZ_AN521_MACHINE
,
1456 .parent
= TYPE_MPS2TZ_MACHINE
,
1457 .class_init
= mps2tz_an521_class_init
,
1460 static const TypeInfo mps3tz_an524_info
= {
1461 .name
= TYPE_MPS3TZ_AN524_MACHINE
,
1462 .parent
= TYPE_MPS2TZ_MACHINE
,
1463 .class_init
= mps3tz_an524_class_init
,
1466 static const TypeInfo mps3tz_an547_info
= {
1467 .name
= TYPE_MPS3TZ_AN547_MACHINE
,
1468 .parent
= TYPE_MPS2TZ_MACHINE
,
1469 .class_init
= mps3tz_an547_class_init
,
1472 static void mps2tz_machine_init(void)
1474 type_register_static(&mps2tz_info
);
1475 type_register_static(&mps2tz_an505_info
);
1476 type_register_static(&mps2tz_an521_info
);
1477 type_register_static(&mps3tz_an524_info
);
1478 type_register_static(&mps3tz_an547_info
);
1481 type_init(mps2tz_machine_init
);