1/*
2 * ARM V2M MPS2 board emulation, trustzone aware FPGA images
3 *
4 * Copyright (c) 2017 Linaro Limited
5 * Written by Peter Maydell
6 *
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License version 2 or
9 * (at your option) any later version.
10 */
11
12/* The MPS2 and MPS2+ dev boards are FPGA based (the 2+ has a bigger
13 * FPGA but is otherwise the same as the 2). Since the CPU itself
14 * and most of the devices are in the FPGA, the details of the board
15 * as seen by the guest depend significantly on the FPGA image.
16 * This source file covers the following FPGA images, for TrustZone cores:
17 * "mps2-an505" -- Cortex-M33 as documented in ARM Application Note AN505
18 * "mps2-an521" -- Dual Cortex-M33 as documented in Application Note AN521
19 *
20 * Links to the TRM for the board itself and to the various Application
21 * Notes which document the FPGA images can be found here:
22 * https://developer.arm.com/products/system-design/development-boards/fpga-prototyping-boards/mps2
23 *
24 * Board TRM:
25 * http://infocenter.arm.com/help/topic/com.arm.doc.100112_0200_06_en/versatile_express_cortex_m_prototyping_systems_v2m_mps2_and_v2m_mps2plus_technical_reference_100112_0200_06_en.pdf
26 * Application Note AN505:
27 * http://infocenter.arm.com/help/topic/com.arm.doc.dai0505b/index.html
28 * Application Note AN521:
29 * http://infocenter.arm.com/help/topic/com.arm.doc.dai0521c/index.html
30 *
31 * The AN505 defers to the Cortex-M33 processor ARMv8M IoT Kit FVP User Guide
32 * (ARM ECM0601256) for the details of some of the device layout:
33 * http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ecm0601256/index.html
34 * Similarly, the AN521 uses the SSE-200, and the SSE-200 TRM defines
35 * most of the device layout:
36 * http://infocenter.arm.com/help/topic/com.arm.doc.101104_0100_00_en/corelink_sse200_subsystem_for_embedded_technical_reference_manual_101104_0100_00_en.pdf
37 *
38 */
39
40#include "qemu/osdep.h"
41#include "qapi/error.h"
42#include "qemu/error-report.h"
43#include "hw/arm/boot.h"
44#include "hw/arm/armv7m.h"
45#include "hw/or-irq.h"
46#include "hw/boards.h"
47#include "exec/address-spaces.h"
48#include "sysemu/sysemu.h"
49#include "hw/misc/unimp.h"
50#include "hw/char/cmsdk-apb-uart.h"
51#include "hw/timer/cmsdk-apb-timer.h"
52#include "hw/misc/mps2-scc.h"
53#include "hw/misc/mps2-fpgaio.h"
54#include "hw/misc/tz-mpc.h"
55#include "hw/misc/tz-msc.h"
56#include "hw/arm/armsse.h"
57#include "hw/dma/pl080.h"
58#include "hw/ssi/pl022.h"
59#include "hw/net/lan9118.h"
60#include "net/net.h"
61#include "hw/core/split-irq.h"
62
63#define MPS2TZ_NUMIRQ 92
64
65typedef enum MPS2TZFPGAType {
66 FPGA_AN505,
67 FPGA_AN521,
68} MPS2TZFPGAType;
69
70typedef struct {
71 MachineClass parent;
72 MPS2TZFPGAType fpga_type;
73 uint32_t scc_id;
74 const char *armsse_type;
75} MPS2TZMachineClass;
76
77typedef struct {
78 MachineState parent;
79
80 ARMSSE iotkit;
81 MemoryRegion psram;
82 MemoryRegion ssram[3];
83 MemoryRegion ssram1_m;
84 MPS2SCC scc;
85 MPS2FPGAIO fpgaio;
86 TZPPC ppc[5];
87 TZMPC ssram_mpc[3];
88 PL022State spi[5];
89 UnimplementedDeviceState i2c[4];
90 UnimplementedDeviceState i2s_audio;
91 UnimplementedDeviceState gpio[4];
92 UnimplementedDeviceState gfx;
93 PL080State dma[4];
94 TZMSC msc[4];
95 CMSDKAPBUART uart[5];
96 SplitIRQ sec_resp_splitter;
97 qemu_or_irq uart_irq_orgate;
98 DeviceState *lan9118;
99 SplitIRQ cpu_irq_splitter[MPS2TZ_NUMIRQ];
100} MPS2TZMachineState;
101
102#define TYPE_MPS2TZ_MACHINE "mps2tz"
103#define TYPE_MPS2TZ_AN505_MACHINE MACHINE_TYPE_NAME("mps2-an505")
104#define TYPE_MPS2TZ_AN521_MACHINE MACHINE_TYPE_NAME("mps2-an521")
105
106#define MPS2TZ_MACHINE(obj) \
107 OBJECT_CHECK(MPS2TZMachineState, obj, TYPE_MPS2TZ_MACHINE)
108#define MPS2TZ_MACHINE_GET_CLASS(obj) \
109 OBJECT_GET_CLASS(MPS2TZMachineClass, obj, TYPE_MPS2TZ_MACHINE)
110#define MPS2TZ_MACHINE_CLASS(klass) \
111 OBJECT_CLASS_CHECK(MPS2TZMachineClass, klass, TYPE_MPS2TZ_MACHINE)
112
113/* Main SYSCLK frequency in Hz */
114#define SYSCLK_FRQ 20000000
115
116/* Create an alias of an entire original MemoryRegion @orig
117 * located at @base in the memory map.
118 */
119static void make_ram_alias(MemoryRegion *mr, const char *name,
120 MemoryRegion *orig, hwaddr base)
121{
122 memory_region_init_alias(mr, NULL, name, orig, 0,
123 memory_region_size(orig));
124 memory_region_add_subregion(get_system_memory(), base, mr);
125}
126
127static qemu_irq get_sse_irq_in(MPS2TZMachineState *mms, int irqno)
128{
129 /* Return a qemu_irq which will signal IRQ n to all CPUs in the SSE. */
130 MPS2TZMachineClass *mmc = MPS2TZ_MACHINE_GET_CLASS(mms);
131
132 assert(irqno < MPS2TZ_NUMIRQ);
133
134 switch (mmc->fpga_type) {
135 case FPGA_AN505:
136 return qdev_get_gpio_in_named(DEVICE(&mms->iotkit), "EXP_IRQ", irqno);
137 case FPGA_AN521:
138 return qdev_get_gpio_in(DEVICE(&mms->cpu_irq_splitter[irqno]), 0);
139 default:
140 g_assert_not_reached();
141 }
142}
143
144/* Most of the devices in the AN505 FPGA image sit behind
145 * Peripheral Protection Controllers. These data structures
146 * define the layout of which devices sit behind which PPCs.
147 * The devfn for each port is a function which creates, configures
148 * and initializes the device, returning the MemoryRegion which
149 * needs to be plugged into the downstream end of the PPC port.
150 */
151typedef MemoryRegion *MakeDevFn(MPS2TZMachineState *mms, void *opaque,
152 const char *name, hwaddr size);
153
154typedef struct PPCPortInfo {
155 const char *name;
156 MakeDevFn *devfn;
157 void *opaque;
158 hwaddr addr;
159 hwaddr size;
160} PPCPortInfo;
161
162typedef struct PPCInfo {
163 const char *name;
164 PPCPortInfo ports[TZ_NUM_PORTS];
165} PPCInfo;
166
167static MemoryRegion *make_unimp_dev(MPS2TZMachineState *mms,
168 void *opaque,
169 const char *name, hwaddr size)
170{
171 /* Initialize, configure and realize a TYPE_UNIMPLEMENTED_DEVICE,
172 * and return a pointer to its MemoryRegion.
173 */
174 UnimplementedDeviceState *uds = opaque;
175
176 sysbus_init_child_obj(OBJECT(mms), name, uds,
177 sizeof(UnimplementedDeviceState),
178 TYPE_UNIMPLEMENTED_DEVICE);
179 qdev_prop_set_string(DEVICE(uds), "name", name);
180 qdev_prop_set_uint64(DEVICE(uds), "size", size);
181 object_property_set_bool(OBJECT(uds), true, "realized", &error_fatal);
182 return sysbus_mmio_get_region(SYS_BUS_DEVICE(uds), 0);
183}
184
185static MemoryRegion *make_uart(MPS2TZMachineState *mms, void *opaque,
186 const char *name, hwaddr size)
187{
188 CMSDKAPBUART *uart = opaque;
189 int i = uart - &mms->uart[0];
190 int rxirqno = i * 2;
191 int txirqno = i * 2 + 1;
192 int combirqno = i + 10;
193 SysBusDevice *s;
194 DeviceState *orgate_dev = DEVICE(&mms->uart_irq_orgate);
195
196 sysbus_init_child_obj(OBJECT(mms), name, uart, sizeof(mms->uart[0]),
197 TYPE_CMSDK_APB_UART);
198 qdev_prop_set_chr(DEVICE(uart), "chardev", serial_hd(i));
199 qdev_prop_set_uint32(DEVICE(uart), "pclk-frq", SYSCLK_FRQ);
200 object_property_set_bool(OBJECT(uart), true, "realized", &error_fatal);
201 s = SYS_BUS_DEVICE(uart);
202 sysbus_connect_irq(s, 0, get_sse_irq_in(mms, txirqno));
203 sysbus_connect_irq(s, 1, get_sse_irq_in(mms, rxirqno));
204 sysbus_connect_irq(s, 2, qdev_get_gpio_in(orgate_dev, i * 2));
205 sysbus_connect_irq(s, 3, qdev_get_gpio_in(orgate_dev, i * 2 + 1));
206 sysbus_connect_irq(s, 4, get_sse_irq_in(mms, combirqno));
207 return sysbus_mmio_get_region(SYS_BUS_DEVICE(uart), 0);
208}
209
210static MemoryRegion *make_scc(MPS2TZMachineState *mms, void *opaque,
211 const char *name, hwaddr size)
212{
213 MPS2SCC *scc = opaque;
214 DeviceState *sccdev;
215 MPS2TZMachineClass *mmc = MPS2TZ_MACHINE_GET_CLASS(mms);
216
217 sysbus_init_child_obj(OBJECT(mms), "scc", scc,
218 sizeof(mms->scc), TYPE_MPS2_SCC);
219 sccdev = DEVICE(scc);
220 qdev_prop_set_uint32(sccdev, "scc-cfg4", 0x2);
221 qdev_prop_set_uint32(sccdev, "scc-aid", 0x00200008);
222 qdev_prop_set_uint32(sccdev, "scc-id", mmc->scc_id);
223 object_property_set_bool(OBJECT(scc), true, "realized", &error_fatal);
224 return sysbus_mmio_get_region(SYS_BUS_DEVICE(sccdev), 0);
225}
226
227static MemoryRegion *make_fpgaio(MPS2TZMachineState *mms, void *opaque,
228 const char *name, hwaddr size)
229{
230 MPS2FPGAIO *fpgaio = opaque;
231
232 sysbus_init_child_obj(OBJECT(mms), "fpgaio", fpgaio,
233 sizeof(mms->fpgaio), TYPE_MPS2_FPGAIO);
234 object_property_set_bool(OBJECT(fpgaio), true, "realized", &error_fatal);
235 return sysbus_mmio_get_region(SYS_BUS_DEVICE(fpgaio), 0);
236}
237
238static MemoryRegion *make_eth_dev(MPS2TZMachineState *mms, void *opaque,
239 const char *name, hwaddr size)
240{
241 SysBusDevice *s;
242 NICInfo *nd = &nd_table[0];
243
244 /* In hardware this is a LAN9220; the LAN9118 is software compatible
245 * except that it doesn't support the checksum-offload feature.
246 */
247 qemu_check_nic_model(nd, "lan9118");
248 mms->lan9118 = qdev_create(NULL, TYPE_LAN9118);
249 qdev_set_nic_properties(mms->lan9118, nd);
250 qdev_init_nofail(mms->lan9118);
251
252 s = SYS_BUS_DEVICE(mms->lan9118);
253 sysbus_connect_irq(s, 0, get_sse_irq_in(mms, 16));
254 return sysbus_mmio_get_region(s, 0);
255}
256
257static MemoryRegion *make_mpc(MPS2TZMachineState *mms, void *opaque,
258 const char *name, hwaddr size)
259{
260 TZMPC *mpc = opaque;
261 int i = mpc - &mms->ssram_mpc[0];
262 MemoryRegion *ssram = &mms->ssram[i];
263 MemoryRegion *upstream;
264 char *mpcname = g_strdup_printf("%s-mpc", name);
265 static uint32_t ramsize[] = { 0x00400000, 0x00200000, 0x00200000 };
266 static uint32_t rambase[] = { 0x00000000, 0x28000000, 0x28200000 };
267
268 memory_region_init_ram(ssram, NULL, name, ramsize[i], &error_fatal);
269
270 sysbus_init_child_obj(OBJECT(mms), mpcname, mpc, sizeof(mms->ssram_mpc[0]),
271 TYPE_TZ_MPC);
272 object_property_set_link(OBJECT(mpc), OBJECT(ssram),
273 "downstream", &error_fatal);
274 object_property_set_bool(OBJECT(mpc), true, "realized", &error_fatal);
275 /* Map the upstream end of the MPC into system memory */
276 upstream = sysbus_mmio_get_region(SYS_BUS_DEVICE(mpc), 1);
277 memory_region_add_subregion(get_system_memory(), rambase[i], upstream);
278 /* and connect its interrupt to the IoTKit */
279 qdev_connect_gpio_out_named(DEVICE(mpc), "irq", 0,
280 qdev_get_gpio_in_named(DEVICE(&mms->iotkit),
281 "mpcexp_status", i));
282
283 /* The first SSRAM is a special case as it has an alias; accesses to
284 * the alias region at 0x00400000 must also go to the MPC upstream.
285 */
286 if (i == 0) {
287 make_ram_alias(&mms->ssram1_m, "mps.ssram1_m", upstream, 0x00400000);
288 }
289
290 g_free(mpcname);
291 /* Return the register interface MR for our caller to map behind the PPC */
292 return sysbus_mmio_get_region(SYS_BUS_DEVICE(mpc), 0);
293}
294
295static MemoryRegion *make_dma(MPS2TZMachineState *mms, void *opaque,
296 const char *name, hwaddr size)
297{
298 PL080State *dma = opaque;
299 int i = dma - &mms->dma[0];
300 SysBusDevice *s;
301 char *mscname = g_strdup_printf("%s-msc", name);
302 TZMSC *msc = &mms->msc[i];
303 DeviceState *iotkitdev = DEVICE(&mms->iotkit);
304 MemoryRegion *msc_upstream;
305 MemoryRegion *msc_downstream;
306
307 /*
308 * Each DMA device is a PL081 whose transaction master interface
309 * is guarded by a Master Security Controller. The downstream end of
310 * the MSC connects to the IoTKit AHB Slave Expansion port, so the
311 * DMA devices can see all devices and memory that the CPU does.
312 */
313 sysbus_init_child_obj(OBJECT(mms), mscname, msc, sizeof(*msc), TYPE_TZ_MSC);
314 msc_downstream = sysbus_mmio_get_region(SYS_BUS_DEVICE(&mms->iotkit), 0);
315 object_property_set_link(OBJECT(msc), OBJECT(msc_downstream),
316 "downstream", &error_fatal);
317 object_property_set_link(OBJECT(msc), OBJECT(mms),
318 "idau", &error_fatal);
319 object_property_set_bool(OBJECT(msc), true, "realized", &error_fatal);
320
321 qdev_connect_gpio_out_named(DEVICE(msc), "irq", 0,
322 qdev_get_gpio_in_named(iotkitdev,
323 "mscexp_status", i));
324 qdev_connect_gpio_out_named(iotkitdev, "mscexp_clear", i,
325 qdev_get_gpio_in_named(DEVICE(msc),
326 "irq_clear", 0));
327 qdev_connect_gpio_out_named(iotkitdev, "mscexp_ns", i,
328 qdev_get_gpio_in_named(DEVICE(msc),
329 "cfg_nonsec", 0));
330 qdev_connect_gpio_out(DEVICE(&mms->sec_resp_splitter),
331 ARRAY_SIZE(mms->ppc) + i,
332 qdev_get_gpio_in_named(DEVICE(msc),
333 "cfg_sec_resp", 0));
334 msc_upstream = sysbus_mmio_get_region(SYS_BUS_DEVICE(msc), 0);
335
336 sysbus_init_child_obj(OBJECT(mms), name, dma, sizeof(*dma), TYPE_PL081);
337 object_property_set_link(OBJECT(dma), OBJECT(msc_upstream),
338 "downstream", &error_fatal);
339 object_property_set_bool(OBJECT(dma), true, "realized", &error_fatal);
340
341 s = SYS_BUS_DEVICE(dma);
342 /* Wire up DMACINTR, DMACINTERR, DMACINTTC */
343 sysbus_connect_irq(s, 0, get_sse_irq_in(mms, 58 + i * 3));
344 sysbus_connect_irq(s, 1, get_sse_irq_in(mms, 56 + i * 3));
345 sysbus_connect_irq(s, 2, get_sse_irq_in(mms, 57 + i * 3));
346
347 g_free(mscname);
348 return sysbus_mmio_get_region(s, 0);
349}
350
351static MemoryRegion *make_spi(MPS2TZMachineState *mms, void *opaque,
352 const char *name, hwaddr size)
353{
354 /*
355 * The AN505 has five PL022 SPI controllers.
356 * One of these should have the LCD controller behind it; the others
357 * are connected only to the FPGA's "general purpose SPI connector"
358 * or "shield" expansion connectors.
359 * Note that if we do implement devices behind SPI, the chip select
360 * lines are set via the "MISC" register in the MPS2 FPGAIO device.
361 */
362 PL022State *spi = opaque;
363 int i = spi - &mms->spi[0];
364 SysBusDevice *s;
365
366 sysbus_init_child_obj(OBJECT(mms), name, spi, sizeof(mms->spi[0]),
367 TYPE_PL022);
368 object_property_set_bool(OBJECT(spi), true, "realized", &error_fatal);
369 s = SYS_BUS_DEVICE(spi);
370 sysbus_connect_irq(s, 0, get_sse_irq_in(mms, 51 + i));
371 return sysbus_mmio_get_region(s, 0);
372}
373
374static void mps2tz_common_init(MachineState *machine)
375{
376 MPS2TZMachineState *mms = MPS2TZ_MACHINE(machine);
377 MPS2TZMachineClass *mmc = MPS2TZ_MACHINE_GET_CLASS(mms);
378 MachineClass *mc = MACHINE_GET_CLASS(machine);
379 MemoryRegion *system_memory = get_system_memory();
380 DeviceState *iotkitdev;
381 DeviceState *dev_splitter;
382 int i;
383
384 if (strcmp(machine->cpu_type, mc->default_cpu_type) != 0) {
385 error_report("This board can only be used with CPU %s",
386 mc->default_cpu_type);
387 exit(1);
388 }
389
390 sysbus_init_child_obj(OBJECT(machine), "iotkit", &mms->iotkit,
391 sizeof(mms->iotkit), mmc->armsse_type);
392 iotkitdev = DEVICE(&mms->iotkit);
393 object_property_set_link(OBJECT(&mms->iotkit), OBJECT(system_memory),
394 "memory", &error_abort);
395 qdev_prop_set_uint32(iotkitdev, "EXP_NUMIRQ", MPS2TZ_NUMIRQ);
396 qdev_prop_set_uint32(iotkitdev, "MAINCLK", SYSCLK_FRQ);
397 object_property_set_bool(OBJECT(&mms->iotkit), true, "realized",
398 &error_fatal);
399
400 /*
401 * The AN521 needs us to create splitters to feed the IRQ inputs
402 * for each CPU in the SSE-200 from each device in the board.
403 */
404 if (mmc->fpga_type == FPGA_AN521) {
405 for (i = 0; i < MPS2TZ_NUMIRQ; i++) {
406 char *name = g_strdup_printf("mps2-irq-splitter%d", i);
407 SplitIRQ *splitter = &mms->cpu_irq_splitter[i];
408
409 object_initialize_child(OBJECT(machine), name,
410 splitter, sizeof(*splitter),
411 TYPE_SPLIT_IRQ, &error_fatal, NULL);
412 g_free(name);
413
414 object_property_set_int(OBJECT(splitter), 2, "num-lines",
415 &error_fatal);
416 object_property_set_bool(OBJECT(splitter), true, "realized",
417 &error_fatal);
418 qdev_connect_gpio_out(DEVICE(splitter), 0,
419 qdev_get_gpio_in_named(DEVICE(&mms->iotkit),
420 "EXP_IRQ", i));
421 qdev_connect_gpio_out(DEVICE(splitter), 1,
422 qdev_get_gpio_in_named(DEVICE(&mms->iotkit),
423 "EXP_CPU1_IRQ", i));
424 }
425 }
426
427 /* The sec_resp_cfg output from the IoTKit must be split into multiple
428 * lines, one for each of the PPCs we create here, plus one per MSC.
429 */
430 object_initialize_child(OBJECT(machine), "sec-resp-splitter",
431 &mms->sec_resp_splitter,
432 sizeof(mms->sec_resp_splitter),
433 TYPE_SPLIT_IRQ, &error_abort, NULL);
434 object_property_set_int(OBJECT(&mms->sec_resp_splitter),
435 ARRAY_SIZE(mms->ppc) + ARRAY_SIZE(mms->msc),
436 "num-lines", &error_fatal);
437 object_property_set_bool(OBJECT(&mms->sec_resp_splitter), true,
438 "realized", &error_fatal);
439 dev_splitter = DEVICE(&mms->sec_resp_splitter);
440 qdev_connect_gpio_out_named(iotkitdev, "sec_resp_cfg", 0,
441 qdev_get_gpio_in(dev_splitter, 0));
442
443 /* The IoTKit sets up much of the memory layout, including
444 * the aliases between secure and non-secure regions in the
445 * address space. The FPGA itself contains:
446 *
447 * 0x00000000..0x003fffff SSRAM1
448 * 0x00400000..0x007fffff alias of SSRAM1
449 * 0x28000000..0x283fffff 4MB SSRAM2 + SSRAM3
450 * 0x40100000..0x4fffffff AHB Master Expansion 1 interface devices
451 * 0x80000000..0x80ffffff 16MB PSRAM
452 */
453
454 /* The FPGA images have an odd combination of different RAMs,
455 * because in hardware they are different implementations and
456 * connected to different buses, giving varying performance/size
457 * tradeoffs. For QEMU they're all just RAM, though. We arbitrarily
458 * call the 16MB our "system memory", as it's the largest lump.
459 */
460 memory_region_allocate_system_memory(&mms->psram,
461 NULL, "mps.ram", 0x01000000);
462 memory_region_add_subregion(system_memory, 0x80000000, &mms->psram);
463
464 /* The overflow IRQs for all UARTs are ORed together.
465 * Tx, Rx and "combined" IRQs are sent to the NVIC separately.
466 * Create the OR gate for this.
467 */
468 object_initialize_child(OBJECT(mms), "uart-irq-orgate",
469 &mms->uart_irq_orgate, sizeof(mms->uart_irq_orgate),
470 TYPE_OR_IRQ, &error_abort, NULL);
471 object_property_set_int(OBJECT(&mms->uart_irq_orgate), 10, "num-lines",
472 &error_fatal);
473 object_property_set_bool(OBJECT(&mms->uart_irq_orgate), true,
474 "realized", &error_fatal);
475 qdev_connect_gpio_out(DEVICE(&mms->uart_irq_orgate), 0,
476 get_sse_irq_in(mms, 15));
477
478 /* Most of the devices in the FPGA are behind Peripheral Protection
479 * Controllers. The required order for initializing things is:
480 * + initialize the PPC
481 * + initialize, configure and realize downstream devices
482 * + connect downstream device MemoryRegions to the PPC
483 * + realize the PPC
484 * + map the PPC's MemoryRegions to the places in the address map
485 * where the downstream devices should appear
486 * + wire up the PPC's control lines to the IoTKit object
487 */
488
489 const PPCInfo ppcs[] = { {
490 .name = "apb_ppcexp0",
491 .ports = {
492 { "ssram-0", make_mpc, &mms->ssram_mpc[0], 0x58007000, 0x1000 },
493 { "ssram-1", make_mpc, &mms->ssram_mpc[1], 0x58008000, 0x1000 },
494 { "ssram-2", make_mpc, &mms->ssram_mpc[2], 0x58009000, 0x1000 },
495 },
496 }, {
497 .name = "apb_ppcexp1",
498 .ports = {
499 { "spi0", make_spi, &mms->spi[0], 0x40205000, 0x1000 },
500 { "spi1", make_spi, &mms->spi[1], 0x40206000, 0x1000 },
501 { "spi2", make_spi, &mms->spi[2], 0x40209000, 0x1000 },
502 { "spi3", make_spi, &mms->spi[3], 0x4020a000, 0x1000 },
503 { "spi4", make_spi, &mms->spi[4], 0x4020b000, 0x1000 },
504 { "uart0", make_uart, &mms->uart[0], 0x40200000, 0x1000 },
505 { "uart1", make_uart, &mms->uart[1], 0x40201000, 0x1000 },
506 { "uart2", make_uart, &mms->uart[2], 0x40202000, 0x1000 },
507 { "uart3", make_uart, &mms->uart[3], 0x40203000, 0x1000 },
508 { "uart4", make_uart, &mms->uart[4], 0x40204000, 0x1000 },
509 { "i2c0", make_unimp_dev, &mms->i2c[0], 0x40207000, 0x1000 },
510 { "i2c1", make_unimp_dev, &mms->i2c[1], 0x40208000, 0x1000 },
511 { "i2c2", make_unimp_dev, &mms->i2c[2], 0x4020c000, 0x1000 },
512 { "i2c3", make_unimp_dev, &mms->i2c[3], 0x4020d000, 0x1000 },
513 },
514 }, {
515 .name = "apb_ppcexp2",
516 .ports = {
517 { "scc", make_scc, &mms->scc, 0x40300000, 0x1000 },
518 { "i2s-audio", make_unimp_dev, &mms->i2s_audio,
519 0x40301000, 0x1000 },
520 { "fpgaio", make_fpgaio, &mms->fpgaio, 0x40302000, 0x1000 },
521 },
522 }, {
523 .name = "ahb_ppcexp0",
524 .ports = {
525 { "gfx", make_unimp_dev, &mms->gfx, 0x41000000, 0x140000 },
526 { "gpio0", make_unimp_dev, &mms->gpio[0], 0x40100000, 0x1000 },
527 { "gpio1", make_unimp_dev, &mms->gpio[1], 0x40101000, 0x1000 },
528 { "gpio2", make_unimp_dev, &mms->gpio[2], 0x40102000, 0x1000 },
529 { "gpio3", make_unimp_dev, &mms->gpio[3], 0x40103000, 0x1000 },
530 { "eth", make_eth_dev, NULL, 0x42000000, 0x100000 },
531 },
532 }, {
533 .name = "ahb_ppcexp1",
534 .ports = {
535 { "dma0", make_dma, &mms->dma[0], 0x40110000, 0x1000 },
536 { "dma1", make_dma, &mms->dma[1], 0x40111000, 0x1000 },
537 { "dma2", make_dma, &mms->dma[2], 0x40112000, 0x1000 },
538 { "dma3", make_dma, &mms->dma[3], 0x40113000, 0x1000 },
539 },
540 },
541 };
542
543 for (i = 0; i < ARRAY_SIZE(ppcs); i++) {
544 const PPCInfo *ppcinfo = &ppcs[i];
545 TZPPC *ppc = &mms->ppc[i];
546 DeviceState *ppcdev;
547 int port;
548 char *gpioname;
549
550 sysbus_init_child_obj(OBJECT(machine), ppcinfo->name, ppc,
551 sizeof(TZPPC), TYPE_TZ_PPC);
552 ppcdev = DEVICE(ppc);
553
554 for (port = 0; port < TZ_NUM_PORTS; port++) {
555 const PPCPortInfo *pinfo = &ppcinfo->ports[port];
556 MemoryRegion *mr;
557 char *portname;
558
559 if (!pinfo->devfn) {
560 continue;
561 }
562
563 mr = pinfo->devfn(mms, pinfo->opaque, pinfo->name, pinfo->size);
564 portname = g_strdup_printf("port[%d]", port);
565 object_property_set_link(OBJECT(ppc), OBJECT(mr),
566 portname, &error_fatal);
567 g_free(portname);
568 }
569
570 object_property_set_bool(OBJECT(ppc), true, "realized", &error_fatal);
571
572 for (port = 0; port < TZ_NUM_PORTS; port++) {
573 const PPCPortInfo *pinfo = &ppcinfo->ports[port];
574
575 if (!pinfo->devfn) {
576 continue;
577 }
578 sysbus_mmio_map(SYS_BUS_DEVICE(ppc), port, pinfo->addr);
579
580 gpioname = g_strdup_printf("%s_nonsec", ppcinfo->name);
581 qdev_connect_gpio_out_named(iotkitdev, gpioname, port,
582 qdev_get_gpio_in_named(ppcdev,
583 "cfg_nonsec",
584 port));
585 g_free(gpioname);
586 gpioname = g_strdup_printf("%s_ap", ppcinfo->name);
587 qdev_connect_gpio_out_named(iotkitdev, gpioname, port,
588 qdev_get_gpio_in_named(ppcdev,
589 "cfg_ap", port));
590 g_free(gpioname);
591 }
592
593 gpioname = g_strdup_printf("%s_irq_enable", ppcinfo->name);
594 qdev_connect_gpio_out_named(iotkitdev, gpioname, 0,
595 qdev_get_gpio_in_named(ppcdev,
596 "irq_enable", 0));
597 g_free(gpioname);
598 gpioname = g_strdup_printf("%s_irq_clear", ppcinfo->name);
599 qdev_connect_gpio_out_named(iotkitdev, gpioname, 0,
600 qdev_get_gpio_in_named(ppcdev,
601 "irq_clear", 0));
602 g_free(gpioname);
603 gpioname = g_strdup_printf("%s_irq_status", ppcinfo->name);
604 qdev_connect_gpio_out_named(ppcdev, "irq", 0,
605 qdev_get_gpio_in_named(iotkitdev,
606 gpioname, 0));
607 g_free(gpioname);
608
609 qdev_connect_gpio_out(dev_splitter, i,
610 qdev_get_gpio_in_named(ppcdev,
611 "cfg_sec_resp", 0));
612 }
613
614 create_unimplemented_device("FPGA NS PC", 0x48007000, 0x1000);
615
616 armv7m_load_kernel(ARM_CPU(first_cpu), machine->kernel_filename, 0x400000);
617}
618
619static void mps2_tz_idau_check(IDAUInterface *ii, uint32_t address,
620 int *iregion, bool *exempt, bool *ns, bool *nsc)
621{
622 /*
623 * The MPS2 TZ FPGA images have IDAUs in them which are connected to
624 * the Master Security Controllers. Thes have the same logic as
625 * is used by the IoTKit for the IDAU connected to the CPU, except
626 * that MSCs don't care about the NSC attribute.
627 */
628 int region = extract32(address, 28, 4);
629
630 *ns = !(region & 1);
631 *nsc = false;
632 /* 0xe0000000..0xe00fffff and 0xf0000000..0xf00fffff are exempt */
633 *exempt = (address & 0xeff00000) == 0xe0000000;
634 *iregion = region;
635}
636
637static void mps2tz_class_init(ObjectClass *oc, void *data)
638{
639 MachineClass *mc = MACHINE_CLASS(oc);
640 IDAUInterfaceClass *iic = IDAU_INTERFACE_CLASS(oc);
641
642 mc->init = mps2tz_common_init;
643 iic->check = mps2_tz_idau_check;
644}
645
646static void mps2tz_an505_class_init(ObjectClass *oc, void *data)
647{
648 MachineClass *mc = MACHINE_CLASS(oc);
649 MPS2TZMachineClass *mmc = MPS2TZ_MACHINE_CLASS(oc);
650
651 mc->desc = "ARM MPS2 with AN505 FPGA image for Cortex-M33";
652 mc->default_cpus = 1;
653 mc->min_cpus = mc->default_cpus;
654 mc->max_cpus = mc->default_cpus;
655 mmc->fpga_type = FPGA_AN505;
656 mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-m33");
657 mmc->scc_id = 0x41045050;
658 mmc->armsse_type = TYPE_IOTKIT;
659}
660
661static void mps2tz_an521_class_init(ObjectClass *oc, void *data)
662{
663 MachineClass *mc = MACHINE_CLASS(oc);
664 MPS2TZMachineClass *mmc = MPS2TZ_MACHINE_CLASS(oc);
665
666 mc->desc = "ARM MPS2 with AN521 FPGA image for dual Cortex-M33";
667 mc->default_cpus = 2;
668 mc->min_cpus = mc->default_cpus;
669 mc->max_cpus = mc->default_cpus;
670 mmc->fpga_type = FPGA_AN521;
671 mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-m33");
672 mmc->scc_id = 0x41045210;
673 mmc->armsse_type = TYPE_SSE200;
674}
675
676static const TypeInfo mps2tz_info = {
677 .name = TYPE_MPS2TZ_MACHINE,
678 .parent = TYPE_MACHINE,
679 .abstract = true,
680 .instance_size = sizeof(MPS2TZMachineState),
681 .class_size = sizeof(MPS2TZMachineClass),
682 .class_init = mps2tz_class_init,
683 .interfaces = (InterfaceInfo[]) {
684 { TYPE_IDAU_INTERFACE },
685 { }
686 },
687};
688
689static const TypeInfo mps2tz_an505_info = {
690 .name = TYPE_MPS2TZ_AN505_MACHINE,
691 .parent = TYPE_MPS2TZ_MACHINE,
692 .class_init = mps2tz_an505_class_init,
693};
694
695static const TypeInfo mps2tz_an521_info = {
696 .name = TYPE_MPS2TZ_AN521_MACHINE,
697 .parent = TYPE_MPS2TZ_MACHINE,
698 .class_init = mps2tz_an521_class_init,
699};
700
701static void mps2tz_machine_init(void)
702{
703 type_register_static(&mps2tz_info);
704 type_register_static(&mps2tz_an505_info);
705 type_register_static(&mps2tz_an521_info);
706}
707
708type_init(mps2tz_machine_init);
709