1 /* 2 * ARM V2M MPS2 board emulation, trustzone aware FPGA images 3 * 4 * Copyright (c) 2017 Linaro Limited 5 * Written by Peter Maydell 6 * 7 * This program is free software; you can redistribute it and/or modify 8 * it under the terms of the GNU General Public License version 2 or 9 * (at your option) any later version. 10 */ 11 12 /* The MPS2 and MPS2+ dev boards are FPGA based (the 2+ has a bigger 13 * FPGA but is otherwise the same as the 2). Since the CPU itself 14 * and most of the devices are in the FPGA, the details of the board 15 * as seen by the guest depend significantly on the FPGA image. 16 * This source file covers the following FPGA images, for TrustZone cores: 17 * "mps2-an505" -- Cortex-M33 as documented in ARM Application Note AN505 18 * "mps2-an521" -- Dual Cortex-M33 as documented in Application Note AN521 19 * 20 * Links to the TRM for the board itself and to the various Application 21 * Notes which document the FPGA images can be found here: 22 * https://developer.arm.com/products/system-design/development-boards/fpga-prototyping-boards/mps2 23 * 24 * Board TRM: 25 * http://infocenter.arm.com/help/topic/com.arm.doc.100112_0200_06_en/versatile_express_cortex_m_prototyping_systems_v2m_mps2_and_v2m_mps2plus_technical_reference_100112_0200_06_en.pdf 26 * Application Note AN505: 27 * http://infocenter.arm.com/help/topic/com.arm.doc.dai0505b/index.html 28 * Application Note AN521: 29 * http://infocenter.arm.com/help/topic/com.arm.doc.dai0521c/index.html 30 * 31 * The AN505 defers to the Cortex-M33 processor ARMv8M IoT Kit FVP User Guide 32 * (ARM ECM0601256) for the details of some of the device layout: 33 * http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ecm0601256/index.html 34 * Similarly, the AN521 uses the SSE-200, and the SSE-200 TRM defines 35 * most of the device layout: 36 * http://infocenter.arm.com/help/topic/com.arm.doc.101104_0100_00_en/corelink_sse200_subsystem_for_embedded_technical_reference_manual_101104_0100_00_en.pdf 37 * 38 */ 39 40 #include "qemu/osdep.h" 41 #include "qemu/units.h" 42 #include "qemu/cutils.h" 43 #include "qapi/error.h" 44 #include "qemu/error-report.h" 45 #include "hw/arm/boot.h" 46 #include "hw/arm/armv7m.h" 47 #include "hw/or-irq.h" 48 #include "hw/boards.h" 49 #include "exec/address-spaces.h" 50 #include "sysemu/sysemu.h" 51 #include "hw/misc/unimp.h" 52 #include "hw/char/cmsdk-apb-uart.h" 53 #include "hw/timer/cmsdk-apb-timer.h" 54 #include "hw/misc/mps2-scc.h" 55 #include "hw/misc/mps2-fpgaio.h" 56 #include "hw/misc/tz-mpc.h" 57 #include "hw/misc/tz-msc.h" 58 #include "hw/arm/armsse.h" 59 #include "hw/dma/pl080.h" 60 #include "hw/ssi/pl022.h" 61 #include "hw/i2c/arm_sbcon_i2c.h" 62 #include "hw/net/lan9118.h" 63 #include "net/net.h" 64 #include "hw/core/split-irq.h" 65 #include "hw/qdev-clock.h" 66 #include "qom/object.h" 67 68 #define MPS2TZ_NUMIRQ 92 69 70 typedef enum MPS2TZFPGAType { 71 FPGA_AN505, 72 FPGA_AN521, 73 } MPS2TZFPGAType; 74 75 struct MPS2TZMachineClass { 76 MachineClass parent; 77 MPS2TZFPGAType fpga_type; 78 uint32_t scc_id; 79 uint32_t sysclk_frq; /* Main SYSCLK frequency in Hz */ 80 const char *armsse_type; 81 }; 82 83 struct MPS2TZMachineState { 84 MachineState parent; 85 86 ARMSSE iotkit; 87 MemoryRegion ssram[3]; 88 MemoryRegion ssram1_m; 89 MPS2SCC scc; 90 MPS2FPGAIO fpgaio; 91 TZPPC ppc[5]; 92 TZMPC ssram_mpc[3]; 93 PL022State spi[5]; 94 ArmSbconI2CState i2c[4]; 95 UnimplementedDeviceState i2s_audio; 96 UnimplementedDeviceState gpio[4]; 97 UnimplementedDeviceState gfx; 98 PL080State dma[4]; 99 TZMSC msc[4]; 100 CMSDKAPBUART uart[5]; 101 SplitIRQ sec_resp_splitter; 102 qemu_or_irq uart_irq_orgate; 103 DeviceState *lan9118; 104 SplitIRQ cpu_irq_splitter[MPS2TZ_NUMIRQ]; 105 Clock *sysclk; 106 Clock *s32kclk; 107 }; 108 109 #define TYPE_MPS2TZ_MACHINE "mps2tz" 110 #define TYPE_MPS2TZ_AN505_MACHINE MACHINE_TYPE_NAME("mps2-an505") 111 #define TYPE_MPS2TZ_AN521_MACHINE MACHINE_TYPE_NAME("mps2-an521") 112 113 OBJECT_DECLARE_TYPE(MPS2TZMachineState, MPS2TZMachineClass, MPS2TZ_MACHINE) 114 115 /* Slow 32Khz S32KCLK frequency in Hz */ 116 #define S32KCLK_FRQ (32 * 1000) 117 118 /* Create an alias of an entire original MemoryRegion @orig 119 * located at @base in the memory map. 120 */ 121 static void make_ram_alias(MemoryRegion *mr, const char *name, 122 MemoryRegion *orig, hwaddr base) 123 { 124 memory_region_init_alias(mr, NULL, name, orig, 0, 125 memory_region_size(orig)); 126 memory_region_add_subregion(get_system_memory(), base, mr); 127 } 128 129 static qemu_irq get_sse_irq_in(MPS2TZMachineState *mms, int irqno) 130 { 131 /* Return a qemu_irq which will signal IRQ n to all CPUs in the SSE. */ 132 MPS2TZMachineClass *mmc = MPS2TZ_MACHINE_GET_CLASS(mms); 133 134 assert(irqno < MPS2TZ_NUMIRQ); 135 136 switch (mmc->fpga_type) { 137 case FPGA_AN505: 138 return qdev_get_gpio_in_named(DEVICE(&mms->iotkit), "EXP_IRQ", irqno); 139 case FPGA_AN521: 140 return qdev_get_gpio_in(DEVICE(&mms->cpu_irq_splitter[irqno]), 0); 141 default: 142 g_assert_not_reached(); 143 } 144 } 145 146 /* Most of the devices in the AN505 FPGA image sit behind 147 * Peripheral Protection Controllers. These data structures 148 * define the layout of which devices sit behind which PPCs. 149 * The devfn for each port is a function which creates, configures 150 * and initializes the device, returning the MemoryRegion which 151 * needs to be plugged into the downstream end of the PPC port. 152 */ 153 typedef MemoryRegion *MakeDevFn(MPS2TZMachineState *mms, void *opaque, 154 const char *name, hwaddr size); 155 156 typedef struct PPCPortInfo { 157 const char *name; 158 MakeDevFn *devfn; 159 void *opaque; 160 hwaddr addr; 161 hwaddr size; 162 } PPCPortInfo; 163 164 typedef struct PPCInfo { 165 const char *name; 166 PPCPortInfo ports[TZ_NUM_PORTS]; 167 } PPCInfo; 168 169 static MemoryRegion *make_unimp_dev(MPS2TZMachineState *mms, 170 void *opaque, 171 const char *name, hwaddr size) 172 { 173 /* Initialize, configure and realize a TYPE_UNIMPLEMENTED_DEVICE, 174 * and return a pointer to its MemoryRegion. 175 */ 176 UnimplementedDeviceState *uds = opaque; 177 178 object_initialize_child(OBJECT(mms), name, uds, TYPE_UNIMPLEMENTED_DEVICE); 179 qdev_prop_set_string(DEVICE(uds), "name", name); 180 qdev_prop_set_uint64(DEVICE(uds), "size", size); 181 sysbus_realize(SYS_BUS_DEVICE(uds), &error_fatal); 182 return sysbus_mmio_get_region(SYS_BUS_DEVICE(uds), 0); 183 } 184 185 static MemoryRegion *make_uart(MPS2TZMachineState *mms, void *opaque, 186 const char *name, hwaddr size) 187 { 188 MPS2TZMachineClass *mmc = MPS2TZ_MACHINE_GET_CLASS(mms); 189 CMSDKAPBUART *uart = opaque; 190 int i = uart - &mms->uart[0]; 191 int rxirqno = i * 2; 192 int txirqno = i * 2 + 1; 193 int combirqno = i + 10; 194 SysBusDevice *s; 195 DeviceState *orgate_dev = DEVICE(&mms->uart_irq_orgate); 196 197 object_initialize_child(OBJECT(mms), name, uart, TYPE_CMSDK_APB_UART); 198 qdev_prop_set_chr(DEVICE(uart), "chardev", serial_hd(i)); 199 qdev_prop_set_uint32(DEVICE(uart), "pclk-frq", mmc->sysclk_frq); 200 sysbus_realize(SYS_BUS_DEVICE(uart), &error_fatal); 201 s = SYS_BUS_DEVICE(uart); 202 sysbus_connect_irq(s, 0, get_sse_irq_in(mms, txirqno)); 203 sysbus_connect_irq(s, 1, get_sse_irq_in(mms, rxirqno)); 204 sysbus_connect_irq(s, 2, qdev_get_gpio_in(orgate_dev, i * 2)); 205 sysbus_connect_irq(s, 3, qdev_get_gpio_in(orgate_dev, i * 2 + 1)); 206 sysbus_connect_irq(s, 4, get_sse_irq_in(mms, combirqno)); 207 return sysbus_mmio_get_region(SYS_BUS_DEVICE(uart), 0); 208 } 209 210 static MemoryRegion *make_scc(MPS2TZMachineState *mms, void *opaque, 211 const char *name, hwaddr size) 212 { 213 MPS2SCC *scc = opaque; 214 DeviceState *sccdev; 215 MPS2TZMachineClass *mmc = MPS2TZ_MACHINE_GET_CLASS(mms); 216 217 object_initialize_child(OBJECT(mms), "scc", scc, TYPE_MPS2_SCC); 218 sccdev = DEVICE(scc); 219 qdev_prop_set_uint32(sccdev, "scc-cfg4", 0x2); 220 qdev_prop_set_uint32(sccdev, "scc-aid", 0x00200008); 221 qdev_prop_set_uint32(sccdev, "scc-id", mmc->scc_id); 222 /* This will need to be per-FPGA image eventually */ 223 qdev_prop_set_uint32(sccdev, "len-oscclk", 3); 224 qdev_prop_set_uint32(sccdev, "oscclk[0]", 50000000); 225 qdev_prop_set_uint32(sccdev, "oscclk[1]", 24576000); 226 qdev_prop_set_uint32(sccdev, "oscclk[2]", 25000000); 227 sysbus_realize(SYS_BUS_DEVICE(scc), &error_fatal); 228 return sysbus_mmio_get_region(SYS_BUS_DEVICE(sccdev), 0); 229 } 230 231 static MemoryRegion *make_fpgaio(MPS2TZMachineState *mms, void *opaque, 232 const char *name, hwaddr size) 233 { 234 MPS2FPGAIO *fpgaio = opaque; 235 236 object_initialize_child(OBJECT(mms), "fpgaio", fpgaio, TYPE_MPS2_FPGAIO); 237 sysbus_realize(SYS_BUS_DEVICE(fpgaio), &error_fatal); 238 return sysbus_mmio_get_region(SYS_BUS_DEVICE(fpgaio), 0); 239 } 240 241 static MemoryRegion *make_eth_dev(MPS2TZMachineState *mms, void *opaque, 242 const char *name, hwaddr size) 243 { 244 SysBusDevice *s; 245 NICInfo *nd = &nd_table[0]; 246 247 /* In hardware this is a LAN9220; the LAN9118 is software compatible 248 * except that it doesn't support the checksum-offload feature. 249 */ 250 qemu_check_nic_model(nd, "lan9118"); 251 mms->lan9118 = qdev_new(TYPE_LAN9118); 252 qdev_set_nic_properties(mms->lan9118, nd); 253 254 s = SYS_BUS_DEVICE(mms->lan9118); 255 sysbus_realize_and_unref(s, &error_fatal); 256 sysbus_connect_irq(s, 0, get_sse_irq_in(mms, 16)); 257 return sysbus_mmio_get_region(s, 0); 258 } 259 260 static MemoryRegion *make_mpc(MPS2TZMachineState *mms, void *opaque, 261 const char *name, hwaddr size) 262 { 263 TZMPC *mpc = opaque; 264 int i = mpc - &mms->ssram_mpc[0]; 265 MemoryRegion *ssram = &mms->ssram[i]; 266 MemoryRegion *upstream; 267 char *mpcname = g_strdup_printf("%s-mpc", name); 268 static uint32_t ramsize[] = { 0x00400000, 0x00200000, 0x00200000 }; 269 static uint32_t rambase[] = { 0x00000000, 0x28000000, 0x28200000 }; 270 271 memory_region_init_ram(ssram, NULL, name, ramsize[i], &error_fatal); 272 273 object_initialize_child(OBJECT(mms), mpcname, mpc, TYPE_TZ_MPC); 274 object_property_set_link(OBJECT(mpc), "downstream", OBJECT(ssram), 275 &error_fatal); 276 sysbus_realize(SYS_BUS_DEVICE(mpc), &error_fatal); 277 /* Map the upstream end of the MPC into system memory */ 278 upstream = sysbus_mmio_get_region(SYS_BUS_DEVICE(mpc), 1); 279 memory_region_add_subregion(get_system_memory(), rambase[i], upstream); 280 /* and connect its interrupt to the IoTKit */ 281 qdev_connect_gpio_out_named(DEVICE(mpc), "irq", 0, 282 qdev_get_gpio_in_named(DEVICE(&mms->iotkit), 283 "mpcexp_status", i)); 284 285 /* The first SSRAM is a special case as it has an alias; accesses to 286 * the alias region at 0x00400000 must also go to the MPC upstream. 287 */ 288 if (i == 0) { 289 make_ram_alias(&mms->ssram1_m, "mps.ssram1_m", upstream, 0x00400000); 290 } 291 292 g_free(mpcname); 293 /* Return the register interface MR for our caller to map behind the PPC */ 294 return sysbus_mmio_get_region(SYS_BUS_DEVICE(mpc), 0); 295 } 296 297 static MemoryRegion *make_dma(MPS2TZMachineState *mms, void *opaque, 298 const char *name, hwaddr size) 299 { 300 PL080State *dma = opaque; 301 int i = dma - &mms->dma[0]; 302 SysBusDevice *s; 303 char *mscname = g_strdup_printf("%s-msc", name); 304 TZMSC *msc = &mms->msc[i]; 305 DeviceState *iotkitdev = DEVICE(&mms->iotkit); 306 MemoryRegion *msc_upstream; 307 MemoryRegion *msc_downstream; 308 309 /* 310 * Each DMA device is a PL081 whose transaction master interface 311 * is guarded by a Master Security Controller. The downstream end of 312 * the MSC connects to the IoTKit AHB Slave Expansion port, so the 313 * DMA devices can see all devices and memory that the CPU does. 314 */ 315 object_initialize_child(OBJECT(mms), mscname, msc, TYPE_TZ_MSC); 316 msc_downstream = sysbus_mmio_get_region(SYS_BUS_DEVICE(&mms->iotkit), 0); 317 object_property_set_link(OBJECT(msc), "downstream", 318 OBJECT(msc_downstream), &error_fatal); 319 object_property_set_link(OBJECT(msc), "idau", OBJECT(mms), &error_fatal); 320 sysbus_realize(SYS_BUS_DEVICE(msc), &error_fatal); 321 322 qdev_connect_gpio_out_named(DEVICE(msc), "irq", 0, 323 qdev_get_gpio_in_named(iotkitdev, 324 "mscexp_status", i)); 325 qdev_connect_gpio_out_named(iotkitdev, "mscexp_clear", i, 326 qdev_get_gpio_in_named(DEVICE(msc), 327 "irq_clear", 0)); 328 qdev_connect_gpio_out_named(iotkitdev, "mscexp_ns", i, 329 qdev_get_gpio_in_named(DEVICE(msc), 330 "cfg_nonsec", 0)); 331 qdev_connect_gpio_out(DEVICE(&mms->sec_resp_splitter), 332 ARRAY_SIZE(mms->ppc) + i, 333 qdev_get_gpio_in_named(DEVICE(msc), 334 "cfg_sec_resp", 0)); 335 msc_upstream = sysbus_mmio_get_region(SYS_BUS_DEVICE(msc), 0); 336 337 object_initialize_child(OBJECT(mms), name, dma, TYPE_PL081); 338 object_property_set_link(OBJECT(dma), "downstream", OBJECT(msc_upstream), 339 &error_fatal); 340 sysbus_realize(SYS_BUS_DEVICE(dma), &error_fatal); 341 342 s = SYS_BUS_DEVICE(dma); 343 /* Wire up DMACINTR, DMACINTERR, DMACINTTC */ 344 sysbus_connect_irq(s, 0, get_sse_irq_in(mms, 58 + i * 3)); 345 sysbus_connect_irq(s, 1, get_sse_irq_in(mms, 56 + i * 3)); 346 sysbus_connect_irq(s, 2, get_sse_irq_in(mms, 57 + i * 3)); 347 348 g_free(mscname); 349 return sysbus_mmio_get_region(s, 0); 350 } 351 352 static MemoryRegion *make_spi(MPS2TZMachineState *mms, void *opaque, 353 const char *name, hwaddr size) 354 { 355 /* 356 * The AN505 has five PL022 SPI controllers. 357 * One of these should have the LCD controller behind it; the others 358 * are connected only to the FPGA's "general purpose SPI connector" 359 * or "shield" expansion connectors. 360 * Note that if we do implement devices behind SPI, the chip select 361 * lines are set via the "MISC" register in the MPS2 FPGAIO device. 362 */ 363 PL022State *spi = opaque; 364 int i = spi - &mms->spi[0]; 365 SysBusDevice *s; 366 367 object_initialize_child(OBJECT(mms), name, spi, TYPE_PL022); 368 sysbus_realize(SYS_BUS_DEVICE(spi), &error_fatal); 369 s = SYS_BUS_DEVICE(spi); 370 sysbus_connect_irq(s, 0, get_sse_irq_in(mms, 51 + i)); 371 return sysbus_mmio_get_region(s, 0); 372 } 373 374 static MemoryRegion *make_i2c(MPS2TZMachineState *mms, void *opaque, 375 const char *name, hwaddr size) 376 { 377 ArmSbconI2CState *i2c = opaque; 378 SysBusDevice *s; 379 380 object_initialize_child(OBJECT(mms), name, i2c, TYPE_ARM_SBCON_I2C); 381 s = SYS_BUS_DEVICE(i2c); 382 sysbus_realize(s, &error_fatal); 383 return sysbus_mmio_get_region(s, 0); 384 } 385 386 static void mps2tz_common_init(MachineState *machine) 387 { 388 MPS2TZMachineState *mms = MPS2TZ_MACHINE(machine); 389 MPS2TZMachineClass *mmc = MPS2TZ_MACHINE_GET_CLASS(mms); 390 MachineClass *mc = MACHINE_GET_CLASS(machine); 391 MemoryRegion *system_memory = get_system_memory(); 392 DeviceState *iotkitdev; 393 DeviceState *dev_splitter; 394 int i; 395 396 if (strcmp(machine->cpu_type, mc->default_cpu_type) != 0) { 397 error_report("This board can only be used with CPU %s", 398 mc->default_cpu_type); 399 exit(1); 400 } 401 402 if (machine->ram_size != mc->default_ram_size) { 403 char *sz = size_to_str(mc->default_ram_size); 404 error_report("Invalid RAM size, should be %s", sz); 405 g_free(sz); 406 exit(EXIT_FAILURE); 407 } 408 409 /* These clocks don't need migration because they are fixed-frequency */ 410 mms->sysclk = clock_new(OBJECT(machine), "SYSCLK"); 411 clock_set_hz(mms->sysclk, mmc->sysclk_frq); 412 mms->s32kclk = clock_new(OBJECT(machine), "S32KCLK"); 413 clock_set_hz(mms->s32kclk, S32KCLK_FRQ); 414 415 object_initialize_child(OBJECT(machine), TYPE_IOTKIT, &mms->iotkit, 416 mmc->armsse_type); 417 iotkitdev = DEVICE(&mms->iotkit); 418 object_property_set_link(OBJECT(&mms->iotkit), "memory", 419 OBJECT(system_memory), &error_abort); 420 qdev_prop_set_uint32(iotkitdev, "EXP_NUMIRQ", MPS2TZ_NUMIRQ); 421 qdev_connect_clock_in(iotkitdev, "MAINCLK", mms->sysclk); 422 qdev_connect_clock_in(iotkitdev, "S32KCLK", mms->s32kclk); 423 sysbus_realize(SYS_BUS_DEVICE(&mms->iotkit), &error_fatal); 424 425 /* 426 * The AN521 needs us to create splitters to feed the IRQ inputs 427 * for each CPU in the SSE-200 from each device in the board. 428 */ 429 if (mmc->fpga_type == FPGA_AN521) { 430 for (i = 0; i < MPS2TZ_NUMIRQ; i++) { 431 char *name = g_strdup_printf("mps2-irq-splitter%d", i); 432 SplitIRQ *splitter = &mms->cpu_irq_splitter[i]; 433 434 object_initialize_child_with_props(OBJECT(machine), name, 435 splitter, sizeof(*splitter), 436 TYPE_SPLIT_IRQ, &error_fatal, 437 NULL); 438 g_free(name); 439 440 object_property_set_int(OBJECT(splitter), "num-lines", 2, 441 &error_fatal); 442 qdev_realize(DEVICE(splitter), NULL, &error_fatal); 443 qdev_connect_gpio_out(DEVICE(splitter), 0, 444 qdev_get_gpio_in_named(DEVICE(&mms->iotkit), 445 "EXP_IRQ", i)); 446 qdev_connect_gpio_out(DEVICE(splitter), 1, 447 qdev_get_gpio_in_named(DEVICE(&mms->iotkit), 448 "EXP_CPU1_IRQ", i)); 449 } 450 } 451 452 /* The sec_resp_cfg output from the IoTKit must be split into multiple 453 * lines, one for each of the PPCs we create here, plus one per MSC. 454 */ 455 object_initialize_child(OBJECT(machine), "sec-resp-splitter", 456 &mms->sec_resp_splitter, TYPE_SPLIT_IRQ); 457 object_property_set_int(OBJECT(&mms->sec_resp_splitter), "num-lines", 458 ARRAY_SIZE(mms->ppc) + ARRAY_SIZE(mms->msc), 459 &error_fatal); 460 qdev_realize(DEVICE(&mms->sec_resp_splitter), NULL, &error_fatal); 461 dev_splitter = DEVICE(&mms->sec_resp_splitter); 462 qdev_connect_gpio_out_named(iotkitdev, "sec_resp_cfg", 0, 463 qdev_get_gpio_in(dev_splitter, 0)); 464 465 /* The IoTKit sets up much of the memory layout, including 466 * the aliases between secure and non-secure regions in the 467 * address space. The FPGA itself contains: 468 * 469 * 0x00000000..0x003fffff SSRAM1 470 * 0x00400000..0x007fffff alias of SSRAM1 471 * 0x28000000..0x283fffff 4MB SSRAM2 + SSRAM3 472 * 0x40100000..0x4fffffff AHB Master Expansion 1 interface devices 473 * 0x80000000..0x80ffffff 16MB PSRAM 474 */ 475 476 /* The FPGA images have an odd combination of different RAMs, 477 * because in hardware they are different implementations and 478 * connected to different buses, giving varying performance/size 479 * tradeoffs. For QEMU they're all just RAM, though. We arbitrarily 480 * call the 16MB our "system memory", as it's the largest lump. 481 */ 482 memory_region_add_subregion(system_memory, 0x80000000, machine->ram); 483 484 /* The overflow IRQs for all UARTs are ORed together. 485 * Tx, Rx and "combined" IRQs are sent to the NVIC separately. 486 * Create the OR gate for this. 487 */ 488 object_initialize_child(OBJECT(mms), "uart-irq-orgate", 489 &mms->uart_irq_orgate, TYPE_OR_IRQ); 490 object_property_set_int(OBJECT(&mms->uart_irq_orgate), "num-lines", 10, 491 &error_fatal); 492 qdev_realize(DEVICE(&mms->uart_irq_orgate), NULL, &error_fatal); 493 qdev_connect_gpio_out(DEVICE(&mms->uart_irq_orgate), 0, 494 get_sse_irq_in(mms, 15)); 495 496 /* Most of the devices in the FPGA are behind Peripheral Protection 497 * Controllers. The required order for initializing things is: 498 * + initialize the PPC 499 * + initialize, configure and realize downstream devices 500 * + connect downstream device MemoryRegions to the PPC 501 * + realize the PPC 502 * + map the PPC's MemoryRegions to the places in the address map 503 * where the downstream devices should appear 504 * + wire up the PPC's control lines to the IoTKit object 505 */ 506 507 const PPCInfo ppcs[] = { { 508 .name = "apb_ppcexp0", 509 .ports = { 510 { "ssram-0", make_mpc, &mms->ssram_mpc[0], 0x58007000, 0x1000 }, 511 { "ssram-1", make_mpc, &mms->ssram_mpc[1], 0x58008000, 0x1000 }, 512 { "ssram-2", make_mpc, &mms->ssram_mpc[2], 0x58009000, 0x1000 }, 513 }, 514 }, { 515 .name = "apb_ppcexp1", 516 .ports = { 517 { "spi0", make_spi, &mms->spi[0], 0x40205000, 0x1000 }, 518 { "spi1", make_spi, &mms->spi[1], 0x40206000, 0x1000 }, 519 { "spi2", make_spi, &mms->spi[2], 0x40209000, 0x1000 }, 520 { "spi3", make_spi, &mms->spi[3], 0x4020a000, 0x1000 }, 521 { "spi4", make_spi, &mms->spi[4], 0x4020b000, 0x1000 }, 522 { "uart0", make_uart, &mms->uart[0], 0x40200000, 0x1000 }, 523 { "uart1", make_uart, &mms->uart[1], 0x40201000, 0x1000 }, 524 { "uart2", make_uart, &mms->uart[2], 0x40202000, 0x1000 }, 525 { "uart3", make_uart, &mms->uart[3], 0x40203000, 0x1000 }, 526 { "uart4", make_uart, &mms->uart[4], 0x40204000, 0x1000 }, 527 { "i2c0", make_i2c, &mms->i2c[0], 0x40207000, 0x1000 }, 528 { "i2c1", make_i2c, &mms->i2c[1], 0x40208000, 0x1000 }, 529 { "i2c2", make_i2c, &mms->i2c[2], 0x4020c000, 0x1000 }, 530 { "i2c3", make_i2c, &mms->i2c[3], 0x4020d000, 0x1000 }, 531 }, 532 }, { 533 .name = "apb_ppcexp2", 534 .ports = { 535 { "scc", make_scc, &mms->scc, 0x40300000, 0x1000 }, 536 { "i2s-audio", make_unimp_dev, &mms->i2s_audio, 537 0x40301000, 0x1000 }, 538 { "fpgaio", make_fpgaio, &mms->fpgaio, 0x40302000, 0x1000 }, 539 }, 540 }, { 541 .name = "ahb_ppcexp0", 542 .ports = { 543 { "gfx", make_unimp_dev, &mms->gfx, 0x41000000, 0x140000 }, 544 { "gpio0", make_unimp_dev, &mms->gpio[0], 0x40100000, 0x1000 }, 545 { "gpio1", make_unimp_dev, &mms->gpio[1], 0x40101000, 0x1000 }, 546 { "gpio2", make_unimp_dev, &mms->gpio[2], 0x40102000, 0x1000 }, 547 { "gpio3", make_unimp_dev, &mms->gpio[3], 0x40103000, 0x1000 }, 548 { "eth", make_eth_dev, NULL, 0x42000000, 0x100000 }, 549 }, 550 }, { 551 .name = "ahb_ppcexp1", 552 .ports = { 553 { "dma0", make_dma, &mms->dma[0], 0x40110000, 0x1000 }, 554 { "dma1", make_dma, &mms->dma[1], 0x40111000, 0x1000 }, 555 { "dma2", make_dma, &mms->dma[2], 0x40112000, 0x1000 }, 556 { "dma3", make_dma, &mms->dma[3], 0x40113000, 0x1000 }, 557 }, 558 }, 559 }; 560 561 for (i = 0; i < ARRAY_SIZE(ppcs); i++) { 562 const PPCInfo *ppcinfo = &ppcs[i]; 563 TZPPC *ppc = &mms->ppc[i]; 564 DeviceState *ppcdev; 565 int port; 566 char *gpioname; 567 568 object_initialize_child(OBJECT(machine), ppcinfo->name, ppc, 569 TYPE_TZ_PPC); 570 ppcdev = DEVICE(ppc); 571 572 for (port = 0; port < TZ_NUM_PORTS; port++) { 573 const PPCPortInfo *pinfo = &ppcinfo->ports[port]; 574 MemoryRegion *mr; 575 char *portname; 576 577 if (!pinfo->devfn) { 578 continue; 579 } 580 581 mr = pinfo->devfn(mms, pinfo->opaque, pinfo->name, pinfo->size); 582 portname = g_strdup_printf("port[%d]", port); 583 object_property_set_link(OBJECT(ppc), portname, OBJECT(mr), 584 &error_fatal); 585 g_free(portname); 586 } 587 588 sysbus_realize(SYS_BUS_DEVICE(ppc), &error_fatal); 589 590 for (port = 0; port < TZ_NUM_PORTS; port++) { 591 const PPCPortInfo *pinfo = &ppcinfo->ports[port]; 592 593 if (!pinfo->devfn) { 594 continue; 595 } 596 sysbus_mmio_map(SYS_BUS_DEVICE(ppc), port, pinfo->addr); 597 598 gpioname = g_strdup_printf("%s_nonsec", ppcinfo->name); 599 qdev_connect_gpio_out_named(iotkitdev, gpioname, port, 600 qdev_get_gpio_in_named(ppcdev, 601 "cfg_nonsec", 602 port)); 603 g_free(gpioname); 604 gpioname = g_strdup_printf("%s_ap", ppcinfo->name); 605 qdev_connect_gpio_out_named(iotkitdev, gpioname, port, 606 qdev_get_gpio_in_named(ppcdev, 607 "cfg_ap", port)); 608 g_free(gpioname); 609 } 610 611 gpioname = g_strdup_printf("%s_irq_enable", ppcinfo->name); 612 qdev_connect_gpio_out_named(iotkitdev, gpioname, 0, 613 qdev_get_gpio_in_named(ppcdev, 614 "irq_enable", 0)); 615 g_free(gpioname); 616 gpioname = g_strdup_printf("%s_irq_clear", ppcinfo->name); 617 qdev_connect_gpio_out_named(iotkitdev, gpioname, 0, 618 qdev_get_gpio_in_named(ppcdev, 619 "irq_clear", 0)); 620 g_free(gpioname); 621 gpioname = g_strdup_printf("%s_irq_status", ppcinfo->name); 622 qdev_connect_gpio_out_named(ppcdev, "irq", 0, 623 qdev_get_gpio_in_named(iotkitdev, 624 gpioname, 0)); 625 g_free(gpioname); 626 627 qdev_connect_gpio_out(dev_splitter, i, 628 qdev_get_gpio_in_named(ppcdev, 629 "cfg_sec_resp", 0)); 630 } 631 632 create_unimplemented_device("FPGA NS PC", 0x48007000, 0x1000); 633 634 armv7m_load_kernel(ARM_CPU(first_cpu), machine->kernel_filename, 0x400000); 635 } 636 637 static void mps2_tz_idau_check(IDAUInterface *ii, uint32_t address, 638 int *iregion, bool *exempt, bool *ns, bool *nsc) 639 { 640 /* 641 * The MPS2 TZ FPGA images have IDAUs in them which are connected to 642 * the Master Security Controllers. Thes have the same logic as 643 * is used by the IoTKit for the IDAU connected to the CPU, except 644 * that MSCs don't care about the NSC attribute. 645 */ 646 int region = extract32(address, 28, 4); 647 648 *ns = !(region & 1); 649 *nsc = false; 650 /* 0xe0000000..0xe00fffff and 0xf0000000..0xf00fffff are exempt */ 651 *exempt = (address & 0xeff00000) == 0xe0000000; 652 *iregion = region; 653 } 654 655 static void mps2tz_class_init(ObjectClass *oc, void *data) 656 { 657 MachineClass *mc = MACHINE_CLASS(oc); 658 IDAUInterfaceClass *iic = IDAU_INTERFACE_CLASS(oc); 659 660 mc->init = mps2tz_common_init; 661 iic->check = mps2_tz_idau_check; 662 mc->default_ram_size = 16 * MiB; 663 mc->default_ram_id = "mps.ram"; 664 } 665 666 static void mps2tz_an505_class_init(ObjectClass *oc, void *data) 667 { 668 MachineClass *mc = MACHINE_CLASS(oc); 669 MPS2TZMachineClass *mmc = MPS2TZ_MACHINE_CLASS(oc); 670 671 mc->desc = "ARM MPS2 with AN505 FPGA image for Cortex-M33"; 672 mc->default_cpus = 1; 673 mc->min_cpus = mc->default_cpus; 674 mc->max_cpus = mc->default_cpus; 675 mmc->fpga_type = FPGA_AN505; 676 mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-m33"); 677 mmc->scc_id = 0x41045050; 678 mmc->sysclk_frq = 20 * 1000 * 1000; /* 20MHz */ 679 mmc->armsse_type = TYPE_IOTKIT; 680 } 681 682 static void mps2tz_an521_class_init(ObjectClass *oc, void *data) 683 { 684 MachineClass *mc = MACHINE_CLASS(oc); 685 MPS2TZMachineClass *mmc = MPS2TZ_MACHINE_CLASS(oc); 686 687 mc->desc = "ARM MPS2 with AN521 FPGA image for dual Cortex-M33"; 688 mc->default_cpus = 2; 689 mc->min_cpus = mc->default_cpus; 690 mc->max_cpus = mc->default_cpus; 691 mmc->fpga_type = FPGA_AN521; 692 mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-m33"); 693 mmc->scc_id = 0x41045210; 694 mmc->sysclk_frq = 20 * 1000 * 1000; /* 20MHz */ 695 mmc->armsse_type = TYPE_SSE200; 696 } 697 698 static const TypeInfo mps2tz_info = { 699 .name = TYPE_MPS2TZ_MACHINE, 700 .parent = TYPE_MACHINE, 701 .abstract = true, 702 .instance_size = sizeof(MPS2TZMachineState), 703 .class_size = sizeof(MPS2TZMachineClass), 704 .class_init = mps2tz_class_init, 705 .interfaces = (InterfaceInfo[]) { 706 { TYPE_IDAU_INTERFACE }, 707 { } 708 }, 709 }; 710 711 static const TypeInfo mps2tz_an505_info = { 712 .name = TYPE_MPS2TZ_AN505_MACHINE, 713 .parent = TYPE_MPS2TZ_MACHINE, 714 .class_init = mps2tz_an505_class_init, 715 }; 716 717 static const TypeInfo mps2tz_an521_info = { 718 .name = TYPE_MPS2TZ_AN521_MACHINE, 719 .parent = TYPE_MPS2TZ_MACHINE, 720 .class_init = mps2tz_an521_class_init, 721 }; 722 723 static void mps2tz_machine_init(void) 724 { 725 type_register_static(&mps2tz_info); 726 type_register_static(&mps2tz_an505_info); 727 type_register_static(&mps2tz_an521_info); 728 } 729 730 type_init(mps2tz_machine_init); 731