Merge remote-tracking branch 'remotes/philmd-gitlab/tags/renesas-20201027' into staging
[qemu.git] / hw / arm / mps2-tz.c
1 /*
2 * ARM V2M MPS2 board emulation, trustzone aware FPGA images
3 *
4 * Copyright (c) 2017 Linaro Limited
5 * Written by Peter Maydell
6 *
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License version 2 or
9 * (at your option) any later version.
10 */
11
12 /* The MPS2 and MPS2+ dev boards are FPGA based (the 2+ has a bigger
13 * FPGA but is otherwise the same as the 2). Since the CPU itself
14 * and most of the devices are in the FPGA, the details of the board
15 * as seen by the guest depend significantly on the FPGA image.
16 * This source file covers the following FPGA images, for TrustZone cores:
17 * "mps2-an505" -- Cortex-M33 as documented in ARM Application Note AN505
18 * "mps2-an521" -- Dual Cortex-M33 as documented in Application Note AN521
19 *
20 * Links to the TRM for the board itself and to the various Application
21 * Notes which document the FPGA images can be found here:
22 * https://developer.arm.com/products/system-design/development-boards/fpga-prototyping-boards/mps2
23 *
24 * Board TRM:
25 * http://infocenter.arm.com/help/topic/com.arm.doc.100112_0200_06_en/versatile_express_cortex_m_prototyping_systems_v2m_mps2_and_v2m_mps2plus_technical_reference_100112_0200_06_en.pdf
26 * Application Note AN505:
27 * http://infocenter.arm.com/help/topic/com.arm.doc.dai0505b/index.html
28 * Application Note AN521:
29 * http://infocenter.arm.com/help/topic/com.arm.doc.dai0521c/index.html
30 *
31 * The AN505 defers to the Cortex-M33 processor ARMv8M IoT Kit FVP User Guide
32 * (ARM ECM0601256) for the details of some of the device layout:
33 * http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ecm0601256/index.html
34 * Similarly, the AN521 uses the SSE-200, and the SSE-200 TRM defines
35 * most of the device layout:
36 * http://infocenter.arm.com/help/topic/com.arm.doc.101104_0100_00_en/corelink_sse200_subsystem_for_embedded_technical_reference_manual_101104_0100_00_en.pdf
37 *
38 */
39
40 #include "qemu/osdep.h"
41 #include "qemu/units.h"
42 #include "qemu/cutils.h"
43 #include "qapi/error.h"
44 #include "qemu/error-report.h"
45 #include "hw/arm/boot.h"
46 #include "hw/arm/armv7m.h"
47 #include "hw/or-irq.h"
48 #include "hw/boards.h"
49 #include "exec/address-spaces.h"
50 #include "sysemu/sysemu.h"
51 #include "hw/misc/unimp.h"
52 #include "hw/char/cmsdk-apb-uart.h"
53 #include "hw/timer/cmsdk-apb-timer.h"
54 #include "hw/misc/mps2-scc.h"
55 #include "hw/misc/mps2-fpgaio.h"
56 #include "hw/misc/tz-mpc.h"
57 #include "hw/misc/tz-msc.h"
58 #include "hw/arm/armsse.h"
59 #include "hw/dma/pl080.h"
60 #include "hw/ssi/pl022.h"
61 #include "hw/i2c/arm_sbcon_i2c.h"
62 #include "hw/net/lan9118.h"
63 #include "net/net.h"
64 #include "hw/core/split-irq.h"
65 #include "qom/object.h"
66
67 #define MPS2TZ_NUMIRQ 92
68
69 typedef enum MPS2TZFPGAType {
70 FPGA_AN505,
71 FPGA_AN521,
72 } MPS2TZFPGAType;
73
74 struct MPS2TZMachineClass {
75 MachineClass parent;
76 MPS2TZFPGAType fpga_type;
77 uint32_t scc_id;
78 const char *armsse_type;
79 };
80
81 struct MPS2TZMachineState {
82 MachineState parent;
83
84 ARMSSE iotkit;
85 MemoryRegion ssram[3];
86 MemoryRegion ssram1_m;
87 MPS2SCC scc;
88 MPS2FPGAIO fpgaio;
89 TZPPC ppc[5];
90 TZMPC ssram_mpc[3];
91 PL022State spi[5];
92 ArmSbconI2CState i2c[4];
93 UnimplementedDeviceState i2s_audio;
94 UnimplementedDeviceState gpio[4];
95 UnimplementedDeviceState gfx;
96 PL080State dma[4];
97 TZMSC msc[4];
98 CMSDKAPBUART uart[5];
99 SplitIRQ sec_resp_splitter;
100 qemu_or_irq uart_irq_orgate;
101 DeviceState *lan9118;
102 SplitIRQ cpu_irq_splitter[MPS2TZ_NUMIRQ];
103 };
104
105 #define TYPE_MPS2TZ_MACHINE "mps2tz"
106 #define TYPE_MPS2TZ_AN505_MACHINE MACHINE_TYPE_NAME("mps2-an505")
107 #define TYPE_MPS2TZ_AN521_MACHINE MACHINE_TYPE_NAME("mps2-an521")
108
109 OBJECT_DECLARE_TYPE(MPS2TZMachineState, MPS2TZMachineClass, MPS2TZ_MACHINE)
110
111 /* Main SYSCLK frequency in Hz */
112 #define SYSCLK_FRQ 20000000
113
114 /* Create an alias of an entire original MemoryRegion @orig
115 * located at @base in the memory map.
116 */
117 static void make_ram_alias(MemoryRegion *mr, const char *name,
118 MemoryRegion *orig, hwaddr base)
119 {
120 memory_region_init_alias(mr, NULL, name, orig, 0,
121 memory_region_size(orig));
122 memory_region_add_subregion(get_system_memory(), base, mr);
123 }
124
125 static qemu_irq get_sse_irq_in(MPS2TZMachineState *mms, int irqno)
126 {
127 /* Return a qemu_irq which will signal IRQ n to all CPUs in the SSE. */
128 MPS2TZMachineClass *mmc = MPS2TZ_MACHINE_GET_CLASS(mms);
129
130 assert(irqno < MPS2TZ_NUMIRQ);
131
132 switch (mmc->fpga_type) {
133 case FPGA_AN505:
134 return qdev_get_gpio_in_named(DEVICE(&mms->iotkit), "EXP_IRQ", irqno);
135 case FPGA_AN521:
136 return qdev_get_gpio_in(DEVICE(&mms->cpu_irq_splitter[irqno]), 0);
137 default:
138 g_assert_not_reached();
139 }
140 }
141
142 /* Most of the devices in the AN505 FPGA image sit behind
143 * Peripheral Protection Controllers. These data structures
144 * define the layout of which devices sit behind which PPCs.
145 * The devfn for each port is a function which creates, configures
146 * and initializes the device, returning the MemoryRegion which
147 * needs to be plugged into the downstream end of the PPC port.
148 */
149 typedef MemoryRegion *MakeDevFn(MPS2TZMachineState *mms, void *opaque,
150 const char *name, hwaddr size);
151
152 typedef struct PPCPortInfo {
153 const char *name;
154 MakeDevFn *devfn;
155 void *opaque;
156 hwaddr addr;
157 hwaddr size;
158 } PPCPortInfo;
159
160 typedef struct PPCInfo {
161 const char *name;
162 PPCPortInfo ports[TZ_NUM_PORTS];
163 } PPCInfo;
164
165 static MemoryRegion *make_unimp_dev(MPS2TZMachineState *mms,
166 void *opaque,
167 const char *name, hwaddr size)
168 {
169 /* Initialize, configure and realize a TYPE_UNIMPLEMENTED_DEVICE,
170 * and return a pointer to its MemoryRegion.
171 */
172 UnimplementedDeviceState *uds = opaque;
173
174 object_initialize_child(OBJECT(mms), name, uds, TYPE_UNIMPLEMENTED_DEVICE);
175 qdev_prop_set_string(DEVICE(uds), "name", name);
176 qdev_prop_set_uint64(DEVICE(uds), "size", size);
177 sysbus_realize(SYS_BUS_DEVICE(uds), &error_fatal);
178 return sysbus_mmio_get_region(SYS_BUS_DEVICE(uds), 0);
179 }
180
181 static MemoryRegion *make_uart(MPS2TZMachineState *mms, void *opaque,
182 const char *name, hwaddr size)
183 {
184 CMSDKAPBUART *uart = opaque;
185 int i = uart - &mms->uart[0];
186 int rxirqno = i * 2;
187 int txirqno = i * 2 + 1;
188 int combirqno = i + 10;
189 SysBusDevice *s;
190 DeviceState *orgate_dev = DEVICE(&mms->uart_irq_orgate);
191
192 object_initialize_child(OBJECT(mms), name, uart, TYPE_CMSDK_APB_UART);
193 qdev_prop_set_chr(DEVICE(uart), "chardev", serial_hd(i));
194 qdev_prop_set_uint32(DEVICE(uart), "pclk-frq", SYSCLK_FRQ);
195 sysbus_realize(SYS_BUS_DEVICE(uart), &error_fatal);
196 s = SYS_BUS_DEVICE(uart);
197 sysbus_connect_irq(s, 0, get_sse_irq_in(mms, txirqno));
198 sysbus_connect_irq(s, 1, get_sse_irq_in(mms, rxirqno));
199 sysbus_connect_irq(s, 2, qdev_get_gpio_in(orgate_dev, i * 2));
200 sysbus_connect_irq(s, 3, qdev_get_gpio_in(orgate_dev, i * 2 + 1));
201 sysbus_connect_irq(s, 4, get_sse_irq_in(mms, combirqno));
202 return sysbus_mmio_get_region(SYS_BUS_DEVICE(uart), 0);
203 }
204
205 static MemoryRegion *make_scc(MPS2TZMachineState *mms, void *opaque,
206 const char *name, hwaddr size)
207 {
208 MPS2SCC *scc = opaque;
209 DeviceState *sccdev;
210 MPS2TZMachineClass *mmc = MPS2TZ_MACHINE_GET_CLASS(mms);
211
212 object_initialize_child(OBJECT(mms), "scc", scc, TYPE_MPS2_SCC);
213 sccdev = DEVICE(scc);
214 qdev_prop_set_uint32(sccdev, "scc-cfg4", 0x2);
215 qdev_prop_set_uint32(sccdev, "scc-aid", 0x00200008);
216 qdev_prop_set_uint32(sccdev, "scc-id", mmc->scc_id);
217 sysbus_realize(SYS_BUS_DEVICE(scc), &error_fatal);
218 return sysbus_mmio_get_region(SYS_BUS_DEVICE(sccdev), 0);
219 }
220
221 static MemoryRegion *make_fpgaio(MPS2TZMachineState *mms, void *opaque,
222 const char *name, hwaddr size)
223 {
224 MPS2FPGAIO *fpgaio = opaque;
225
226 object_initialize_child(OBJECT(mms), "fpgaio", fpgaio, TYPE_MPS2_FPGAIO);
227 sysbus_realize(SYS_BUS_DEVICE(fpgaio), &error_fatal);
228 return sysbus_mmio_get_region(SYS_BUS_DEVICE(fpgaio), 0);
229 }
230
231 static MemoryRegion *make_eth_dev(MPS2TZMachineState *mms, void *opaque,
232 const char *name, hwaddr size)
233 {
234 SysBusDevice *s;
235 NICInfo *nd = &nd_table[0];
236
237 /* In hardware this is a LAN9220; the LAN9118 is software compatible
238 * except that it doesn't support the checksum-offload feature.
239 */
240 qemu_check_nic_model(nd, "lan9118");
241 mms->lan9118 = qdev_new(TYPE_LAN9118);
242 qdev_set_nic_properties(mms->lan9118, nd);
243
244 s = SYS_BUS_DEVICE(mms->lan9118);
245 sysbus_realize_and_unref(s, &error_fatal);
246 sysbus_connect_irq(s, 0, get_sse_irq_in(mms, 16));
247 return sysbus_mmio_get_region(s, 0);
248 }
249
250 static MemoryRegion *make_mpc(MPS2TZMachineState *mms, void *opaque,
251 const char *name, hwaddr size)
252 {
253 TZMPC *mpc = opaque;
254 int i = mpc - &mms->ssram_mpc[0];
255 MemoryRegion *ssram = &mms->ssram[i];
256 MemoryRegion *upstream;
257 char *mpcname = g_strdup_printf("%s-mpc", name);
258 static uint32_t ramsize[] = { 0x00400000, 0x00200000, 0x00200000 };
259 static uint32_t rambase[] = { 0x00000000, 0x28000000, 0x28200000 };
260
261 memory_region_init_ram(ssram, NULL, name, ramsize[i], &error_fatal);
262
263 object_initialize_child(OBJECT(mms), mpcname, mpc, TYPE_TZ_MPC);
264 object_property_set_link(OBJECT(mpc), "downstream", OBJECT(ssram),
265 &error_fatal);
266 sysbus_realize(SYS_BUS_DEVICE(mpc), &error_fatal);
267 /* Map the upstream end of the MPC into system memory */
268 upstream = sysbus_mmio_get_region(SYS_BUS_DEVICE(mpc), 1);
269 memory_region_add_subregion(get_system_memory(), rambase[i], upstream);
270 /* and connect its interrupt to the IoTKit */
271 qdev_connect_gpio_out_named(DEVICE(mpc), "irq", 0,
272 qdev_get_gpio_in_named(DEVICE(&mms->iotkit),
273 "mpcexp_status", i));
274
275 /* The first SSRAM is a special case as it has an alias; accesses to
276 * the alias region at 0x00400000 must also go to the MPC upstream.
277 */
278 if (i == 0) {
279 make_ram_alias(&mms->ssram1_m, "mps.ssram1_m", upstream, 0x00400000);
280 }
281
282 g_free(mpcname);
283 /* Return the register interface MR for our caller to map behind the PPC */
284 return sysbus_mmio_get_region(SYS_BUS_DEVICE(mpc), 0);
285 }
286
287 static MemoryRegion *make_dma(MPS2TZMachineState *mms, void *opaque,
288 const char *name, hwaddr size)
289 {
290 PL080State *dma = opaque;
291 int i = dma - &mms->dma[0];
292 SysBusDevice *s;
293 char *mscname = g_strdup_printf("%s-msc", name);
294 TZMSC *msc = &mms->msc[i];
295 DeviceState *iotkitdev = DEVICE(&mms->iotkit);
296 MemoryRegion *msc_upstream;
297 MemoryRegion *msc_downstream;
298
299 /*
300 * Each DMA device is a PL081 whose transaction master interface
301 * is guarded by a Master Security Controller. The downstream end of
302 * the MSC connects to the IoTKit AHB Slave Expansion port, so the
303 * DMA devices can see all devices and memory that the CPU does.
304 */
305 object_initialize_child(OBJECT(mms), mscname, msc, TYPE_TZ_MSC);
306 msc_downstream = sysbus_mmio_get_region(SYS_BUS_DEVICE(&mms->iotkit), 0);
307 object_property_set_link(OBJECT(msc), "downstream",
308 OBJECT(msc_downstream), &error_fatal);
309 object_property_set_link(OBJECT(msc), "idau", OBJECT(mms), &error_fatal);
310 sysbus_realize(SYS_BUS_DEVICE(msc), &error_fatal);
311
312 qdev_connect_gpio_out_named(DEVICE(msc), "irq", 0,
313 qdev_get_gpio_in_named(iotkitdev,
314 "mscexp_status", i));
315 qdev_connect_gpio_out_named(iotkitdev, "mscexp_clear", i,
316 qdev_get_gpio_in_named(DEVICE(msc),
317 "irq_clear", 0));
318 qdev_connect_gpio_out_named(iotkitdev, "mscexp_ns", i,
319 qdev_get_gpio_in_named(DEVICE(msc),
320 "cfg_nonsec", 0));
321 qdev_connect_gpio_out(DEVICE(&mms->sec_resp_splitter),
322 ARRAY_SIZE(mms->ppc) + i,
323 qdev_get_gpio_in_named(DEVICE(msc),
324 "cfg_sec_resp", 0));
325 msc_upstream = sysbus_mmio_get_region(SYS_BUS_DEVICE(msc), 0);
326
327 object_initialize_child(OBJECT(mms), name, dma, TYPE_PL081);
328 object_property_set_link(OBJECT(dma), "downstream", OBJECT(msc_upstream),
329 &error_fatal);
330 sysbus_realize(SYS_BUS_DEVICE(dma), &error_fatal);
331
332 s = SYS_BUS_DEVICE(dma);
333 /* Wire up DMACINTR, DMACINTERR, DMACINTTC */
334 sysbus_connect_irq(s, 0, get_sse_irq_in(mms, 58 + i * 3));
335 sysbus_connect_irq(s, 1, get_sse_irq_in(mms, 56 + i * 3));
336 sysbus_connect_irq(s, 2, get_sse_irq_in(mms, 57 + i * 3));
337
338 g_free(mscname);
339 return sysbus_mmio_get_region(s, 0);
340 }
341
342 static MemoryRegion *make_spi(MPS2TZMachineState *mms, void *opaque,
343 const char *name, hwaddr size)
344 {
345 /*
346 * The AN505 has five PL022 SPI controllers.
347 * One of these should have the LCD controller behind it; the others
348 * are connected only to the FPGA's "general purpose SPI connector"
349 * or "shield" expansion connectors.
350 * Note that if we do implement devices behind SPI, the chip select
351 * lines are set via the "MISC" register in the MPS2 FPGAIO device.
352 */
353 PL022State *spi = opaque;
354 int i = spi - &mms->spi[0];
355 SysBusDevice *s;
356
357 object_initialize_child(OBJECT(mms), name, spi, TYPE_PL022);
358 sysbus_realize(SYS_BUS_DEVICE(spi), &error_fatal);
359 s = SYS_BUS_DEVICE(spi);
360 sysbus_connect_irq(s, 0, get_sse_irq_in(mms, 51 + i));
361 return sysbus_mmio_get_region(s, 0);
362 }
363
364 static MemoryRegion *make_i2c(MPS2TZMachineState *mms, void *opaque,
365 const char *name, hwaddr size)
366 {
367 ArmSbconI2CState *i2c = opaque;
368 SysBusDevice *s;
369
370 object_initialize_child(OBJECT(mms), name, i2c, TYPE_ARM_SBCON_I2C);
371 s = SYS_BUS_DEVICE(i2c);
372 sysbus_realize(s, &error_fatal);
373 return sysbus_mmio_get_region(s, 0);
374 }
375
376 static void mps2tz_common_init(MachineState *machine)
377 {
378 MPS2TZMachineState *mms = MPS2TZ_MACHINE(machine);
379 MPS2TZMachineClass *mmc = MPS2TZ_MACHINE_GET_CLASS(mms);
380 MachineClass *mc = MACHINE_GET_CLASS(machine);
381 MemoryRegion *system_memory = get_system_memory();
382 DeviceState *iotkitdev;
383 DeviceState *dev_splitter;
384 int i;
385
386 if (strcmp(machine->cpu_type, mc->default_cpu_type) != 0) {
387 error_report("This board can only be used with CPU %s",
388 mc->default_cpu_type);
389 exit(1);
390 }
391
392 if (machine->ram_size != mc->default_ram_size) {
393 char *sz = size_to_str(mc->default_ram_size);
394 error_report("Invalid RAM size, should be %s", sz);
395 g_free(sz);
396 exit(EXIT_FAILURE);
397 }
398
399 object_initialize_child(OBJECT(machine), TYPE_IOTKIT, &mms->iotkit,
400 mmc->armsse_type);
401 iotkitdev = DEVICE(&mms->iotkit);
402 object_property_set_link(OBJECT(&mms->iotkit), "memory",
403 OBJECT(system_memory), &error_abort);
404 qdev_prop_set_uint32(iotkitdev, "EXP_NUMIRQ", MPS2TZ_NUMIRQ);
405 qdev_prop_set_uint32(iotkitdev, "MAINCLK", SYSCLK_FRQ);
406 sysbus_realize(SYS_BUS_DEVICE(&mms->iotkit), &error_fatal);
407
408 /*
409 * The AN521 needs us to create splitters to feed the IRQ inputs
410 * for each CPU in the SSE-200 from each device in the board.
411 */
412 if (mmc->fpga_type == FPGA_AN521) {
413 for (i = 0; i < MPS2TZ_NUMIRQ; i++) {
414 char *name = g_strdup_printf("mps2-irq-splitter%d", i);
415 SplitIRQ *splitter = &mms->cpu_irq_splitter[i];
416
417 object_initialize_child_with_props(OBJECT(machine), name,
418 splitter, sizeof(*splitter),
419 TYPE_SPLIT_IRQ, &error_fatal,
420 NULL);
421 g_free(name);
422
423 object_property_set_int(OBJECT(splitter), "num-lines", 2,
424 &error_fatal);
425 qdev_realize(DEVICE(splitter), NULL, &error_fatal);
426 qdev_connect_gpio_out(DEVICE(splitter), 0,
427 qdev_get_gpio_in_named(DEVICE(&mms->iotkit),
428 "EXP_IRQ", i));
429 qdev_connect_gpio_out(DEVICE(splitter), 1,
430 qdev_get_gpio_in_named(DEVICE(&mms->iotkit),
431 "EXP_CPU1_IRQ", i));
432 }
433 }
434
435 /* The sec_resp_cfg output from the IoTKit must be split into multiple
436 * lines, one for each of the PPCs we create here, plus one per MSC.
437 */
438 object_initialize_child(OBJECT(machine), "sec-resp-splitter",
439 &mms->sec_resp_splitter, TYPE_SPLIT_IRQ);
440 object_property_set_int(OBJECT(&mms->sec_resp_splitter), "num-lines",
441 ARRAY_SIZE(mms->ppc) + ARRAY_SIZE(mms->msc),
442 &error_fatal);
443 qdev_realize(DEVICE(&mms->sec_resp_splitter), NULL, &error_fatal);
444 dev_splitter = DEVICE(&mms->sec_resp_splitter);
445 qdev_connect_gpio_out_named(iotkitdev, "sec_resp_cfg", 0,
446 qdev_get_gpio_in(dev_splitter, 0));
447
448 /* The IoTKit sets up much of the memory layout, including
449 * the aliases between secure and non-secure regions in the
450 * address space. The FPGA itself contains:
451 *
452 * 0x00000000..0x003fffff SSRAM1
453 * 0x00400000..0x007fffff alias of SSRAM1
454 * 0x28000000..0x283fffff 4MB SSRAM2 + SSRAM3
455 * 0x40100000..0x4fffffff AHB Master Expansion 1 interface devices
456 * 0x80000000..0x80ffffff 16MB PSRAM
457 */
458
459 /* The FPGA images have an odd combination of different RAMs,
460 * because in hardware they are different implementations and
461 * connected to different buses, giving varying performance/size
462 * tradeoffs. For QEMU they're all just RAM, though. We arbitrarily
463 * call the 16MB our "system memory", as it's the largest lump.
464 */
465 memory_region_add_subregion(system_memory, 0x80000000, machine->ram);
466
467 /* The overflow IRQs for all UARTs are ORed together.
468 * Tx, Rx and "combined" IRQs are sent to the NVIC separately.
469 * Create the OR gate for this.
470 */
471 object_initialize_child(OBJECT(mms), "uart-irq-orgate",
472 &mms->uart_irq_orgate, TYPE_OR_IRQ);
473 object_property_set_int(OBJECT(&mms->uart_irq_orgate), "num-lines", 10,
474 &error_fatal);
475 qdev_realize(DEVICE(&mms->uart_irq_orgate), NULL, &error_fatal);
476 qdev_connect_gpio_out(DEVICE(&mms->uart_irq_orgate), 0,
477 get_sse_irq_in(mms, 15));
478
479 /* Most of the devices in the FPGA are behind Peripheral Protection
480 * Controllers. The required order for initializing things is:
481 * + initialize the PPC
482 * + initialize, configure and realize downstream devices
483 * + connect downstream device MemoryRegions to the PPC
484 * + realize the PPC
485 * + map the PPC's MemoryRegions to the places in the address map
486 * where the downstream devices should appear
487 * + wire up the PPC's control lines to the IoTKit object
488 */
489
490 const PPCInfo ppcs[] = { {
491 .name = "apb_ppcexp0",
492 .ports = {
493 { "ssram-0", make_mpc, &mms->ssram_mpc[0], 0x58007000, 0x1000 },
494 { "ssram-1", make_mpc, &mms->ssram_mpc[1], 0x58008000, 0x1000 },
495 { "ssram-2", make_mpc, &mms->ssram_mpc[2], 0x58009000, 0x1000 },
496 },
497 }, {
498 .name = "apb_ppcexp1",
499 .ports = {
500 { "spi0", make_spi, &mms->spi[0], 0x40205000, 0x1000 },
501 { "spi1", make_spi, &mms->spi[1], 0x40206000, 0x1000 },
502 { "spi2", make_spi, &mms->spi[2], 0x40209000, 0x1000 },
503 { "spi3", make_spi, &mms->spi[3], 0x4020a000, 0x1000 },
504 { "spi4", make_spi, &mms->spi[4], 0x4020b000, 0x1000 },
505 { "uart0", make_uart, &mms->uart[0], 0x40200000, 0x1000 },
506 { "uart1", make_uart, &mms->uart[1], 0x40201000, 0x1000 },
507 { "uart2", make_uart, &mms->uart[2], 0x40202000, 0x1000 },
508 { "uart3", make_uart, &mms->uart[3], 0x40203000, 0x1000 },
509 { "uart4", make_uart, &mms->uart[4], 0x40204000, 0x1000 },
510 { "i2c0", make_i2c, &mms->i2c[0], 0x40207000, 0x1000 },
511 { "i2c1", make_i2c, &mms->i2c[1], 0x40208000, 0x1000 },
512 { "i2c2", make_i2c, &mms->i2c[2], 0x4020c000, 0x1000 },
513 { "i2c3", make_i2c, &mms->i2c[3], 0x4020d000, 0x1000 },
514 },
515 }, {
516 .name = "apb_ppcexp2",
517 .ports = {
518 { "scc", make_scc, &mms->scc, 0x40300000, 0x1000 },
519 { "i2s-audio", make_unimp_dev, &mms->i2s_audio,
520 0x40301000, 0x1000 },
521 { "fpgaio", make_fpgaio, &mms->fpgaio, 0x40302000, 0x1000 },
522 },
523 }, {
524 .name = "ahb_ppcexp0",
525 .ports = {
526 { "gfx", make_unimp_dev, &mms->gfx, 0x41000000, 0x140000 },
527 { "gpio0", make_unimp_dev, &mms->gpio[0], 0x40100000, 0x1000 },
528 { "gpio1", make_unimp_dev, &mms->gpio[1], 0x40101000, 0x1000 },
529 { "gpio2", make_unimp_dev, &mms->gpio[2], 0x40102000, 0x1000 },
530 { "gpio3", make_unimp_dev, &mms->gpio[3], 0x40103000, 0x1000 },
531 { "eth", make_eth_dev, NULL, 0x42000000, 0x100000 },
532 },
533 }, {
534 .name = "ahb_ppcexp1",
535 .ports = {
536 { "dma0", make_dma, &mms->dma[0], 0x40110000, 0x1000 },
537 { "dma1", make_dma, &mms->dma[1], 0x40111000, 0x1000 },
538 { "dma2", make_dma, &mms->dma[2], 0x40112000, 0x1000 },
539 { "dma3", make_dma, &mms->dma[3], 0x40113000, 0x1000 },
540 },
541 },
542 };
543
544 for (i = 0; i < ARRAY_SIZE(ppcs); i++) {
545 const PPCInfo *ppcinfo = &ppcs[i];
546 TZPPC *ppc = &mms->ppc[i];
547 DeviceState *ppcdev;
548 int port;
549 char *gpioname;
550
551 object_initialize_child(OBJECT(machine), ppcinfo->name, ppc,
552 TYPE_TZ_PPC);
553 ppcdev = DEVICE(ppc);
554
555 for (port = 0; port < TZ_NUM_PORTS; port++) {
556 const PPCPortInfo *pinfo = &ppcinfo->ports[port];
557 MemoryRegion *mr;
558 char *portname;
559
560 if (!pinfo->devfn) {
561 continue;
562 }
563
564 mr = pinfo->devfn(mms, pinfo->opaque, pinfo->name, pinfo->size);
565 portname = g_strdup_printf("port[%d]", port);
566 object_property_set_link(OBJECT(ppc), portname, OBJECT(mr),
567 &error_fatal);
568 g_free(portname);
569 }
570
571 sysbus_realize(SYS_BUS_DEVICE(ppc), &error_fatal);
572
573 for (port = 0; port < TZ_NUM_PORTS; port++) {
574 const PPCPortInfo *pinfo = &ppcinfo->ports[port];
575
576 if (!pinfo->devfn) {
577 continue;
578 }
579 sysbus_mmio_map(SYS_BUS_DEVICE(ppc), port, pinfo->addr);
580
581 gpioname = g_strdup_printf("%s_nonsec", ppcinfo->name);
582 qdev_connect_gpio_out_named(iotkitdev, gpioname, port,
583 qdev_get_gpio_in_named(ppcdev,
584 "cfg_nonsec",
585 port));
586 g_free(gpioname);
587 gpioname = g_strdup_printf("%s_ap", ppcinfo->name);
588 qdev_connect_gpio_out_named(iotkitdev, gpioname, port,
589 qdev_get_gpio_in_named(ppcdev,
590 "cfg_ap", port));
591 g_free(gpioname);
592 }
593
594 gpioname = g_strdup_printf("%s_irq_enable", ppcinfo->name);
595 qdev_connect_gpio_out_named(iotkitdev, gpioname, 0,
596 qdev_get_gpio_in_named(ppcdev,
597 "irq_enable", 0));
598 g_free(gpioname);
599 gpioname = g_strdup_printf("%s_irq_clear", ppcinfo->name);
600 qdev_connect_gpio_out_named(iotkitdev, gpioname, 0,
601 qdev_get_gpio_in_named(ppcdev,
602 "irq_clear", 0));
603 g_free(gpioname);
604 gpioname = g_strdup_printf("%s_irq_status", ppcinfo->name);
605 qdev_connect_gpio_out_named(ppcdev, "irq", 0,
606 qdev_get_gpio_in_named(iotkitdev,
607 gpioname, 0));
608 g_free(gpioname);
609
610 qdev_connect_gpio_out(dev_splitter, i,
611 qdev_get_gpio_in_named(ppcdev,
612 "cfg_sec_resp", 0));
613 }
614
615 create_unimplemented_device("FPGA NS PC", 0x48007000, 0x1000);
616
617 armv7m_load_kernel(ARM_CPU(first_cpu), machine->kernel_filename, 0x400000);
618 }
619
620 static void mps2_tz_idau_check(IDAUInterface *ii, uint32_t address,
621 int *iregion, bool *exempt, bool *ns, bool *nsc)
622 {
623 /*
624 * The MPS2 TZ FPGA images have IDAUs in them which are connected to
625 * the Master Security Controllers. Thes have the same logic as
626 * is used by the IoTKit for the IDAU connected to the CPU, except
627 * that MSCs don't care about the NSC attribute.
628 */
629 int region = extract32(address, 28, 4);
630
631 *ns = !(region & 1);
632 *nsc = false;
633 /* 0xe0000000..0xe00fffff and 0xf0000000..0xf00fffff are exempt */
634 *exempt = (address & 0xeff00000) == 0xe0000000;
635 *iregion = region;
636 }
637
638 static void mps2tz_class_init(ObjectClass *oc, void *data)
639 {
640 MachineClass *mc = MACHINE_CLASS(oc);
641 IDAUInterfaceClass *iic = IDAU_INTERFACE_CLASS(oc);
642
643 mc->init = mps2tz_common_init;
644 iic->check = mps2_tz_idau_check;
645 mc->default_ram_size = 16 * MiB;
646 mc->default_ram_id = "mps.ram";
647 }
648
649 static void mps2tz_an505_class_init(ObjectClass *oc, void *data)
650 {
651 MachineClass *mc = MACHINE_CLASS(oc);
652 MPS2TZMachineClass *mmc = MPS2TZ_MACHINE_CLASS(oc);
653
654 mc->desc = "ARM MPS2 with AN505 FPGA image for Cortex-M33";
655 mc->default_cpus = 1;
656 mc->min_cpus = mc->default_cpus;
657 mc->max_cpus = mc->default_cpus;
658 mmc->fpga_type = FPGA_AN505;
659 mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-m33");
660 mmc->scc_id = 0x41045050;
661 mmc->armsse_type = TYPE_IOTKIT;
662 }
663
664 static void mps2tz_an521_class_init(ObjectClass *oc, void *data)
665 {
666 MachineClass *mc = MACHINE_CLASS(oc);
667 MPS2TZMachineClass *mmc = MPS2TZ_MACHINE_CLASS(oc);
668
669 mc->desc = "ARM MPS2 with AN521 FPGA image for dual Cortex-M33";
670 mc->default_cpus = 2;
671 mc->min_cpus = mc->default_cpus;
672 mc->max_cpus = mc->default_cpus;
673 mmc->fpga_type = FPGA_AN521;
674 mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-m33");
675 mmc->scc_id = 0x41045210;
676 mmc->armsse_type = TYPE_SSE200;
677 }
678
679 static const TypeInfo mps2tz_info = {
680 .name = TYPE_MPS2TZ_MACHINE,
681 .parent = TYPE_MACHINE,
682 .abstract = true,
683 .instance_size = sizeof(MPS2TZMachineState),
684 .class_size = sizeof(MPS2TZMachineClass),
685 .class_init = mps2tz_class_init,
686 .interfaces = (InterfaceInfo[]) {
687 { TYPE_IDAU_INTERFACE },
688 { }
689 },
690 };
691
692 static const TypeInfo mps2tz_an505_info = {
693 .name = TYPE_MPS2TZ_AN505_MACHINE,
694 .parent = TYPE_MPS2TZ_MACHINE,
695 .class_init = mps2tz_an505_class_init,
696 };
697
698 static const TypeInfo mps2tz_an521_info = {
699 .name = TYPE_MPS2TZ_AN521_MACHINE,
700 .parent = TYPE_MPS2TZ_MACHINE,
701 .class_init = mps2tz_an521_class_init,
702 };
703
704 static void mps2tz_machine_init(void)
705 {
706 type_register_static(&mps2tz_info);
707 type_register_static(&mps2tz_an505_info);
708 type_register_static(&mps2tz_an521_info);
709 }
710
711 type_init(mps2tz_machine_init);