LXR qemu/hw/arm/mps2-tz.c

   1/*
   2 * ARM V2M MPS2 board emulation, trustzone aware FPGA images
   3 *
   4 * Copyright (c) 2017 Linaro Limited
   5 * Written by Peter Maydell
   6 *
   7 *  This program is free software; you can redistribute it and/or modify
   8 *  it under the terms of the GNU General Public License version 2 or
   9 *  (at your option) any later version.
  10 */
  11
  12/* The MPS2 and MPS2+ dev boards are FPGA based (the 2+ has a bigger
  13 * FPGA but is otherwise the same as the 2). Since the CPU itself
  14 * and most of the devices are in the FPGA, the details of the board
  15 * as seen by the guest depend significantly on the FPGA image.
  16 * This source file covers the following FPGA images, for TrustZone cores:
  17 *  "mps2-an505" -- Cortex-M33 as documented in ARM Application Note AN505
  18 *  "mps2-an521" -- Dual Cortex-M33 as documented in Application Note AN521
  19 *
  20 * Links to the TRM for the board itself and to the various Application
  21 * Notes which document the FPGA images can be found here:
  22 * https://developer.arm.com/products/system-design/development-boards/fpga-prototyping-boards/mps2
  23 *
  24 * Board TRM:
  25 * http://infocenter.arm.com/help/topic/com.arm.doc.100112_0200_06_en/versatile_express_cortex_m_prototyping_systems_v2m_mps2_and_v2m_mps2plus_technical_reference_100112_0200_06_en.pdf
  26 * Application Note AN505:
  27 * http://infocenter.arm.com/help/topic/com.arm.doc.dai0505b/index.html
  28 * Application Note AN521:
  29 * http://infocenter.arm.com/help/topic/com.arm.doc.dai0521c/index.html
  30 *
  31 * The AN505 defers to the Cortex-M33 processor ARMv8M IoT Kit FVP User Guide
  32 * (ARM ECM0601256) for the details of some of the device layout:
  33 *   http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ecm0601256/index.html
  34 * Similarly, the AN521 uses the SSE-200, and the SSE-200 TRM defines
  35 * most of the device layout:
  36 *  http://infocenter.arm.com/help/topic/com.arm.doc.101104_0100_00_en/corelink_sse200_subsystem_for_embedded_technical_reference_manual_101104_0100_00_en.pdf
  37 *
  38 */
  39
  40#include "qemu/osdep.h"
  41#include "qemu/units.h"
  42#include "qemu/cutils.h"
  43#include "qapi/error.h"
  44#include "qemu/error-report.h"
  45#include "hw/arm/boot.h"
  46#include "hw/arm/armv7m.h"
  47#include "hw/or-irq.h"
  48#include "hw/boards.h"
  49#include "exec/address-spaces.h"
  50#include "sysemu/sysemu.h"
  51#include "hw/misc/unimp.h"
  52#include "hw/char/cmsdk-apb-uart.h"
  53#include "hw/timer/cmsdk-apb-timer.h"
  54#include "hw/misc/mps2-scc.h"
  55#include "hw/misc/mps2-fpgaio.h"
  56#include "hw/misc/tz-mpc.h"
  57#include "hw/misc/tz-msc.h"
  58#include "hw/arm/armsse.h"
  59#include "hw/dma/pl080.h"
  60#include "hw/ssi/pl022.h"
  61#include "hw/i2c/arm_sbcon_i2c.h"
  62#include "hw/net/lan9118.h"
  63#include "net/net.h"
  64#include "hw/core/split-irq.h"
  65#include "qom/object.h"
  66
  67#define MPS2TZ_NUMIRQ 92
  68
  69typedef enum MPS2TZFPGAType {
  70    FPGA_AN505,
  71    FPGA_AN521,
  72} MPS2TZFPGAType;
  73
  74struct MPS2TZMachineClass {
  75    MachineClass parent;
  76    MPS2TZFPGAType fpga_type;
  77    uint32_t scc_id;
  78    const char *armsse_type;
  79};
  80
  81struct MPS2TZMachineState {
  82    MachineState parent;
  83
  84    ARMSSE iotkit;
  85    MemoryRegion ssram[3];
  86    MemoryRegion ssram1_m;
  87    MPS2SCC scc;
  88    MPS2FPGAIO fpgaio;
  89    TZPPC ppc[5];
  90    TZMPC ssram_mpc[3];
  91    PL022State spi[5];
  92    ArmSbconI2CState i2c[4];
  93    UnimplementedDeviceState i2s_audio;
  94    UnimplementedDeviceState gpio[4];
  95    UnimplementedDeviceState gfx;
  96    PL080State dma[4];
  97    TZMSC msc[4];
  98    CMSDKAPBUART uart[5];
  99    SplitIRQ sec_resp_splitter;
 100    qemu_or_irq uart_irq_orgate;
 101    DeviceState *lan9118;
 102    SplitIRQ cpu_irq_splitter[MPS2TZ_NUMIRQ];
 103};
 104
 105#define TYPE_MPS2TZ_MACHINE "mps2tz"
 106#define TYPE_MPS2TZ_AN505_MACHINE MACHINE_TYPE_NAME("mps2-an505")
 107#define TYPE_MPS2TZ_AN521_MACHINE MACHINE_TYPE_NAME("mps2-an521")
 108
 109OBJECT_DECLARE_TYPE(MPS2TZMachineState, MPS2TZMachineClass, MPS2TZ_MACHINE)
 110
 111/* Main SYSCLK frequency in Hz */
 112#define SYSCLK_FRQ 20000000
 113
 114/* Create an alias of an entire original MemoryRegion @orig
 115 * located at @base in the memory map.
 116 */
 117static void make_ram_alias(MemoryRegion *mr, const char *name,
 118                           MemoryRegion *orig, hwaddr base)
 119{
 120    memory_region_init_alias(mr, NULL, name, orig, 0,
 121                             memory_region_size(orig));
 122    memory_region_add_subregion(get_system_memory(), base, mr);
 123}
 124
 125static qemu_irq get_sse_irq_in(MPS2TZMachineState *mms, int irqno)
 126{
 127    /* Return a qemu_irq which will signal IRQ n to all CPUs in the SSE. */
 128    MPS2TZMachineClass *mmc = MPS2TZ_MACHINE_GET_CLASS(mms);
 129
 130    assert(irqno < MPS2TZ_NUMIRQ);
 131
 132    switch (mmc->fpga_type) {
 133    case FPGA_AN505:
 134        return qdev_get_gpio_in_named(DEVICE(&mms->iotkit), "EXP_IRQ", irqno);
 135    case FPGA_AN521:
 136        return qdev_get_gpio_in(DEVICE(&mms->cpu_irq_splitter[irqno]), 0);
 137    default:
 138        g_assert_not_reached();
 139    }
 140}
 141
 142/* Most of the devices in the AN505 FPGA image sit behind
 143 * Peripheral Protection Controllers. These data structures
 144 * define the layout of which devices sit behind which PPCs.
 145 * The devfn for each port is a function which creates, configures
 146 * and initializes the device, returning the MemoryRegion which
 147 * needs to be plugged into the downstream end of the PPC port.
 148 */
 149typedef MemoryRegion *MakeDevFn(MPS2TZMachineState *mms, void *opaque,
 150                                const char *name, hwaddr size);
 151
 152typedef struct PPCPortInfo {
 153    const char *name;
 154    MakeDevFn *devfn;
 155    void *opaque;
 156    hwaddr addr;
 157    hwaddr size;
 158} PPCPortInfo;
 159
 160typedef struct PPCInfo {
 161    const char *name;
 162    PPCPortInfo ports[TZ_NUM_PORTS];
 163} PPCInfo;
 164
 165static MemoryRegion *make_unimp_dev(MPS2TZMachineState *mms,
 166                                       void *opaque,
 167                                       const char *name, hwaddr size)
 168{
 169    /* Initialize, configure and realize a TYPE_UNIMPLEMENTED_DEVICE,
 170     * and return a pointer to its MemoryRegion.
 171     */
 172    UnimplementedDeviceState *uds = opaque;
 173
 174    object_initialize_child(OBJECT(mms), name, uds, TYPE_UNIMPLEMENTED_DEVICE);
 175    qdev_prop_set_string(DEVICE(uds), "name", name);
 176    qdev_prop_set_uint64(DEVICE(uds), "size", size);
 177    sysbus_realize(SYS_BUS_DEVICE(uds), &error_fatal);
 178    return sysbus_mmio_get_region(SYS_BUS_DEVICE(uds), 0);
 179}
 180
 181static MemoryRegion *make_uart(MPS2TZMachineState *mms, void *opaque,
 182                               const char *name, hwaddr size)
 183{
 184    CMSDKAPBUART *uart = opaque;
 185    int i = uart - &mms->uart[0];
 186    int rxirqno = i * 2;
 187    int txirqno = i * 2 + 1;
 188    int combirqno = i + 10;
 189    SysBusDevice *s;
 190    DeviceState *orgate_dev = DEVICE(&mms->uart_irq_orgate);
 191
 192    object_initialize_child(OBJECT(mms), name, uart, TYPE_CMSDK_APB_UART);
 193    qdev_prop_set_chr(DEVICE(uart), "chardev", serial_hd(i));
 194    qdev_prop_set_uint32(DEVICE(uart), "pclk-frq", SYSCLK_FRQ);
 195    sysbus_realize(SYS_BUS_DEVICE(uart), &error_fatal);
 196    s = SYS_BUS_DEVICE(uart);
 197    sysbus_connect_irq(s, 0, get_sse_irq_in(mms, txirqno));
 198    sysbus_connect_irq(s, 1, get_sse_irq_in(mms, rxirqno));
 199    sysbus_connect_irq(s, 2, qdev_get_gpio_in(orgate_dev, i * 2));
 200    sysbus_connect_irq(s, 3, qdev_get_gpio_in(orgate_dev, i * 2 + 1));
 201    sysbus_connect_irq(s, 4, get_sse_irq_in(mms, combirqno));
 202    return sysbus_mmio_get_region(SYS_BUS_DEVICE(uart), 0);
 203}
 204
 205static MemoryRegion *make_scc(MPS2TZMachineState *mms, void *opaque,
 206                              const char *name, hwaddr size)
 207{
 208    MPS2SCC *scc = opaque;
 209    DeviceState *sccdev;
 210    MPS2TZMachineClass *mmc = MPS2TZ_MACHINE_GET_CLASS(mms);
 211
 212    object_initialize_child(OBJECT(mms), "scc", scc, TYPE_MPS2_SCC);
 213    sccdev = DEVICE(scc);
 214    qdev_prop_set_uint32(sccdev, "scc-cfg4", 0x2);
 215    qdev_prop_set_uint32(sccdev, "scc-aid", 0x00200008);
 216    qdev_prop_set_uint32(sccdev, "scc-id", mmc->scc_id);
 217    sysbus_realize(SYS_BUS_DEVICE(scc), &error_fatal);
 218    return sysbus_mmio_get_region(SYS_BUS_DEVICE(sccdev), 0);
 219}
 220
 221static MemoryRegion *make_fpgaio(MPS2TZMachineState *mms, void *opaque,
 222                                 const char *name, hwaddr size)
 223{
 224    MPS2FPGAIO *fpgaio = opaque;
 225
 226    object_initialize_child(OBJECT(mms), "fpgaio", fpgaio, TYPE_MPS2_FPGAIO);
 227    sysbus_realize(SYS_BUS_DEVICE(fpgaio), &error_fatal);
 228    return sysbus_mmio_get_region(SYS_BUS_DEVICE(fpgaio), 0);
 229}
 230
 231static MemoryRegion *make_eth_dev(MPS2TZMachineState *mms, void *opaque,
 232                                  const char *name, hwaddr size)
 233{
 234    SysBusDevice *s;
 235    NICInfo *nd = &nd_table[0];
 236
 237    /* In hardware this is a LAN9220; the LAN9118 is software compatible
 238     * except that it doesn't support the checksum-offload feature.
 239     */
 240    qemu_check_nic_model(nd, "lan9118");
 241    mms->lan9118 = qdev_new(TYPE_LAN9118);
 242    qdev_set_nic_properties(mms->lan9118, nd);
 243
 244    s = SYS_BUS_DEVICE(mms->lan9118);
 245    sysbus_realize_and_unref(s, &error_fatal);
 246    sysbus_connect_irq(s, 0, get_sse_irq_in(mms, 16));
 247    return sysbus_mmio_get_region(s, 0);
 248}
 249
 250static MemoryRegion *make_mpc(MPS2TZMachineState *mms, void *opaque,
 251                              const char *name, hwaddr size)
 252{
 253    TZMPC *mpc = opaque;
 254    int i = mpc - &mms->ssram_mpc[0];
 255    MemoryRegion *ssram = &mms->ssram[i];
 256    MemoryRegion *upstream;
 257    char *mpcname = g_strdup_printf("%s-mpc", name);
 258    static uint32_t ramsize[] = { 0x00400000, 0x00200000, 0x00200000 };
 259    static uint32_t rambase[] = { 0x00000000, 0x28000000, 0x28200000 };
 260
 261    memory_region_init_ram(ssram, NULL, name, ramsize[i], &error_fatal);
 262
 263    object_initialize_child(OBJECT(mms), mpcname, mpc, TYPE_TZ_MPC);
 264    object_property_set_link(OBJECT(mpc), "downstream", OBJECT(ssram),
 265                             &error_fatal);
 266    sysbus_realize(SYS_BUS_DEVICE(mpc), &error_fatal);
 267    /* Map the upstream end of the MPC into system memory */
 268    upstream = sysbus_mmio_get_region(SYS_BUS_DEVICE(mpc), 1);
 269    memory_region_add_subregion(get_system_memory(), rambase[i], upstream);
 270    /* and connect its interrupt to the IoTKit */
 271    qdev_connect_gpio_out_named(DEVICE(mpc), "irq", 0,
 272                                qdev_get_gpio_in_named(DEVICE(&mms->iotkit),
 273                                                       "mpcexp_status", i));
 274
 275    /* The first SSRAM is a special case as it has an alias; accesses to
 276     * the alias region at 0x00400000 must also go to the MPC upstream.
 277     */
 278    if (i == 0) {
 279        make_ram_alias(&mms->ssram1_m, "mps.ssram1_m", upstream, 0x00400000);
 280    }
 281
 282    g_free(mpcname);
 283    /* Return the register interface MR for our caller to map behind the PPC */
 284    return sysbus_mmio_get_region(SYS_BUS_DEVICE(mpc), 0);
 285}
 286
 287static MemoryRegion *make_dma(MPS2TZMachineState *mms, void *opaque,
 288                              const char *name, hwaddr size)
 289{
 290    PL080State *dma = opaque;
 291    int i = dma - &mms->dma[0];
 292    SysBusDevice *s;
 293    char *mscname = g_strdup_printf("%s-msc", name);
 294    TZMSC *msc = &mms->msc[i];
 295    DeviceState *iotkitdev = DEVICE(&mms->iotkit);
 296    MemoryRegion *msc_upstream;
 297    MemoryRegion *msc_downstream;
 298
 299    /*
 300     * Each DMA device is a PL081 whose transaction master interface
 301     * is guarded by a Master Security Controller. The downstream end of
 302     * the MSC connects to the IoTKit AHB Slave Expansion port, so the
 303     * DMA devices can see all devices and memory that the CPU does.
 304     */
 305    object_initialize_child(OBJECT(mms), mscname, msc, TYPE_TZ_MSC);
 306    msc_downstream = sysbus_mmio_get_region(SYS_BUS_DEVICE(&mms->iotkit), 0);
 307    object_property_set_link(OBJECT(msc), "downstream",
 308                             OBJECT(msc_downstream), &error_fatal);
 309    object_property_set_link(OBJECT(msc), "idau", OBJECT(mms), &error_fatal);
 310    sysbus_realize(SYS_BUS_DEVICE(msc), &error_fatal);
 311
 312    qdev_connect_gpio_out_named(DEVICE(msc), "irq", 0,
 313                                qdev_get_gpio_in_named(iotkitdev,
 314                                                       "mscexp_status", i));
 315    qdev_connect_gpio_out_named(iotkitdev, "mscexp_clear", i,
 316                                qdev_get_gpio_in_named(DEVICE(msc),
 317                                                       "irq_clear", 0));
 318    qdev_connect_gpio_out_named(iotkitdev, "mscexp_ns", i,
 319                                qdev_get_gpio_in_named(DEVICE(msc),
 320                                                       "cfg_nonsec", 0));
 321    qdev_connect_gpio_out(DEVICE(&mms->sec_resp_splitter),
 322                          ARRAY_SIZE(mms->ppc) + i,
 323                          qdev_get_gpio_in_named(DEVICE(msc),
 324                                                 "cfg_sec_resp", 0));
 325    msc_upstream = sysbus_mmio_get_region(SYS_BUS_DEVICE(msc), 0);
 326
 327    object_initialize_child(OBJECT(mms), name, dma, TYPE_PL081);
 328    object_property_set_link(OBJECT(dma), "downstream", OBJECT(msc_upstream),
 329                             &error_fatal);
 330    sysbus_realize(SYS_BUS_DEVICE(dma), &error_fatal);
 331
 332    s = SYS_BUS_DEVICE(dma);
 333    /* Wire up DMACINTR, DMACINTERR, DMACINTTC */
 334    sysbus_connect_irq(s, 0, get_sse_irq_in(mms, 58 + i * 3));
 335    sysbus_connect_irq(s, 1, get_sse_irq_in(mms, 56 + i * 3));
 336    sysbus_connect_irq(s, 2, get_sse_irq_in(mms, 57 + i * 3));
 337
 338    g_free(mscname);
 339    return sysbus_mmio_get_region(s, 0);
 340}
 341
 342static MemoryRegion *make_spi(MPS2TZMachineState *mms, void *opaque,
 343                              const char *name, hwaddr size)
 344{
 345    /*
 346     * The AN505 has five PL022 SPI controllers.
 347     * One of these should have the LCD controller behind it; the others
 348     * are connected only to the FPGA's "general purpose SPI connector"
 349     * or "shield" expansion connectors.
 350     * Note that if we do implement devices behind SPI, the chip select
 351     * lines are set via the "MISC" register in the MPS2 FPGAIO device.
 352     */
 353    PL022State *spi = opaque;
 354    int i = spi - &mms->spi[0];
 355    SysBusDevice *s;
 356
 357    object_initialize_child(OBJECT(mms), name, spi, TYPE_PL022);
 358    sysbus_realize(SYS_BUS_DEVICE(spi), &error_fatal);
 359    s = SYS_BUS_DEVICE(spi);
 360    sysbus_connect_irq(s, 0, get_sse_irq_in(mms, 51 + i));
 361    return sysbus_mmio_get_region(s, 0);
 362}
 363
 364static MemoryRegion *make_i2c(MPS2TZMachineState *mms, void *opaque,
 365                              const char *name, hwaddr size)
 366{
 367    ArmSbconI2CState *i2c = opaque;
 368    SysBusDevice *s;
 369
 370    object_initialize_child(OBJECT(mms), name, i2c, TYPE_ARM_SBCON_I2C);
 371    s = SYS_BUS_DEVICE(i2c);
 372    sysbus_realize(s, &error_fatal);
 373    return sysbus_mmio_get_region(s, 0);
 374}
 375
 376static void mps2tz_common_init(MachineState *machine)
 377{
 378    MPS2TZMachineState *mms = MPS2TZ_MACHINE(machine);
 379    MPS2TZMachineClass *mmc = MPS2TZ_MACHINE_GET_CLASS(mms);
 380    MachineClass *mc = MACHINE_GET_CLASS(machine);
 381    MemoryRegion *system_memory = get_system_memory();
 382    DeviceState *iotkitdev;
 383    DeviceState *dev_splitter;
 384    int i;
 385
 386    if (strcmp(machine->cpu_type, mc->default_cpu_type) != 0) {
 387        error_report("This board can only be used with CPU %s",
 388                     mc->default_cpu_type);
 389        exit(1);
 390    }
 391
 392    if (machine->ram_size != mc->default_ram_size) {
 393        char *sz = size_to_str(mc->default_ram_size);
 394        error_report("Invalid RAM size, should be %s", sz);
 395        g_free(sz);
 396        exit(EXIT_FAILURE);
 397    }
 398
 399    object_initialize_child(OBJECT(machine), TYPE_IOTKIT, &mms->iotkit,
 400                            mmc->armsse_type);
 401    iotkitdev = DEVICE(&mms->iotkit);
 402    object_property_set_link(OBJECT(&mms->iotkit), "memory",
 403                             OBJECT(system_memory), &error_abort);
 404    qdev_prop_set_uint32(iotkitdev, "EXP_NUMIRQ", MPS2TZ_NUMIRQ);
 405    qdev_prop_set_uint32(iotkitdev, "MAINCLK", SYSCLK_FRQ);
 406    sysbus_realize(SYS_BUS_DEVICE(&mms->iotkit), &error_fatal);
 407
 408    /*
 409     * The AN521 needs us to create splitters to feed the IRQ inputs
 410     * for each CPU in the SSE-200 from each device in the board.
 411     */
 412    if (mmc->fpga_type == FPGA_AN521) {
 413        for (i = 0; i < MPS2TZ_NUMIRQ; i++) {
 414            char *name = g_strdup_printf("mps2-irq-splitter%d", i);
 415            SplitIRQ *splitter = &mms->cpu_irq_splitter[i];
 416
 417            object_initialize_child_with_props(OBJECT(machine), name,
 418                                               splitter, sizeof(*splitter),
 419                                               TYPE_SPLIT_IRQ, &error_fatal,
 420                                               NULL);
 421            g_free(name);
 422
 423            object_property_set_int(OBJECT(splitter), "num-lines", 2,
 424                                    &error_fatal);
 425            qdev_realize(DEVICE(splitter), NULL, &error_fatal);
 426            qdev_connect_gpio_out(DEVICE(splitter), 0,
 427                                  qdev_get_gpio_in_named(DEVICE(&mms->iotkit),
 428                                                         "EXP_IRQ", i));
 429            qdev_connect_gpio_out(DEVICE(splitter), 1,
 430                                  qdev_get_gpio_in_named(DEVICE(&mms->iotkit),
 431                                                         "EXP_CPU1_IRQ", i));
 432        }
 433    }
 434
 435    /* The sec_resp_cfg output from the IoTKit must be split into multiple
 436     * lines, one for each of the PPCs we create here, plus one per MSC.
 437     */
 438    object_initialize_child(OBJECT(machine), "sec-resp-splitter",
 439                            &mms->sec_resp_splitter, TYPE_SPLIT_IRQ);
 440    object_property_set_int(OBJECT(&mms->sec_resp_splitter), "num-lines",
 441                            ARRAY_SIZE(mms->ppc) + ARRAY_SIZE(mms->msc),
 442                            &error_fatal);
 443    qdev_realize(DEVICE(&mms->sec_resp_splitter), NULL, &error_fatal);
 444    dev_splitter = DEVICE(&mms->sec_resp_splitter);
 445    qdev_connect_gpio_out_named(iotkitdev, "sec_resp_cfg", 0,
 446                                qdev_get_gpio_in(dev_splitter, 0));
 447
 448    /* The IoTKit sets up much of the memory layout, including
 449     * the aliases between secure and non-secure regions in the
 450     * address space. The FPGA itself contains:
 451     *
 452     * 0x00000000..0x003fffff  SSRAM1
 453     * 0x00400000..0x007fffff  alias of SSRAM1
 454     * 0x28000000..0x283fffff  4MB SSRAM2 + SSRAM3
 455     * 0x40100000..0x4fffffff  AHB Master Expansion 1 interface devices
 456     * 0x80000000..0x80ffffff  16MB PSRAM
 457     */
 458
 459    /* The FPGA images have an odd combination of different RAMs,
 460     * because in hardware they are different implementations and
 461     * connected to different buses, giving varying performance/size
 462     * tradeoffs. For QEMU they're all just RAM, though. We arbitrarily
 463     * call the 16MB our "system memory", as it's the largest lump.
 464     */
 465    memory_region_add_subregion(system_memory, 0x80000000, machine->ram);
 466
 467    /* The overflow IRQs for all UARTs are ORed together.
 468     * Tx, Rx and "combined" IRQs are sent to the NVIC separately.
 469     * Create the OR gate for this.
 470     */
 471    object_initialize_child(OBJECT(mms), "uart-irq-orgate",
 472                            &mms->uart_irq_orgate, TYPE_OR_IRQ);
 473    object_property_set_int(OBJECT(&mms->uart_irq_orgate), "num-lines", 10,
 474                            &error_fatal);
 475    qdev_realize(DEVICE(&mms->uart_irq_orgate), NULL, &error_fatal);
 476    qdev_connect_gpio_out(DEVICE(&mms->uart_irq_orgate), 0,
 477                          get_sse_irq_in(mms, 15));
 478
 479    /* Most of the devices in the FPGA are behind Peripheral Protection
 480     * Controllers. The required order for initializing things is:
 481     *  + initialize the PPC
 482     *  + initialize, configure and realize downstream devices
 483     *  + connect downstream device MemoryRegions to the PPC
 484     *  + realize the PPC
 485     *  + map the PPC's MemoryRegions to the places in the address map
 486     *    where the downstream devices should appear
 487     *  + wire up the PPC's control lines to the IoTKit object
 488     */
 489
 490    const PPCInfo ppcs[] = { {
 491            .name = "apb_ppcexp0",
 492            .ports = {
 493                { "ssram-0", make_mpc, &mms->ssram_mpc[0], 0x58007000, 0x1000 },
 494                { "ssram-1", make_mpc, &mms->ssram_mpc[1], 0x58008000, 0x1000 },
 495                { "ssram-2", make_mpc, &mms->ssram_mpc[2], 0x58009000, 0x1000 },
 496            },
 497        }, {
 498            .name = "apb_ppcexp1",
 499            .ports = {
 500                { "spi0", make_spi, &mms->spi[0], 0x40205000, 0x1000 },
 501                { "spi1", make_spi, &mms->spi[1], 0x40206000, 0x1000 },
 502                { "spi2", make_spi, &mms->spi[2], 0x40209000, 0x1000 },
 503                { "spi3", make_spi, &mms->spi[3], 0x4020a000, 0x1000 },
 504                { "spi4", make_spi, &mms->spi[4], 0x4020b000, 0x1000 },
 505                { "uart0", make_uart, &mms->uart[0], 0x40200000, 0x1000 },
 506                { "uart1", make_uart, &mms->uart[1], 0x40201000, 0x1000 },
 507                { "uart2", make_uart, &mms->uart[2], 0x40202000, 0x1000 },
 508                { "uart3", make_uart, &mms->uart[3], 0x40203000, 0x1000 },
 509                { "uart4", make_uart, &mms->uart[4], 0x40204000, 0x1000 },
 510                { "i2c0", make_i2c, &mms->i2c[0], 0x40207000, 0x1000 },
 511                { "i2c1", make_i2c, &mms->i2c[1], 0x40208000, 0x1000 },
 512                { "i2c2", make_i2c, &mms->i2c[2], 0x4020c000, 0x1000 },
 513                { "i2c3", make_i2c, &mms->i2c[3], 0x4020d000, 0x1000 },
 514            },
 515        }, {
 516            .name = "apb_ppcexp2",
 517            .ports = {
 518                { "scc", make_scc, &mms->scc, 0x40300000, 0x1000 },
 519                { "i2s-audio", make_unimp_dev, &mms->i2s_audio,
 520                  0x40301000, 0x1000 },
 521                { "fpgaio", make_fpgaio, &mms->fpgaio, 0x40302000, 0x1000 },
 522            },
 523        }, {
 524            .name = "ahb_ppcexp0",
 525            .ports = {
 526                { "gfx", make_unimp_dev, &mms->gfx, 0x41000000, 0x140000 },
 527                { "gpio0", make_unimp_dev, &mms->gpio[0], 0x40100000, 0x1000 },
 528                { "gpio1", make_unimp_dev, &mms->gpio[1], 0x40101000, 0x1000 },
 529                { "gpio2", make_unimp_dev, &mms->gpio[2], 0x40102000, 0x1000 },
 530                { "gpio3", make_unimp_dev, &mms->gpio[3], 0x40103000, 0x1000 },
 531                { "eth", make_eth_dev, NULL, 0x42000000, 0x100000 },
 532            },
 533        }, {
 534            .name = "ahb_ppcexp1",
 535            .ports = {
 536                { "dma0", make_dma, &mms->dma[0], 0x40110000, 0x1000 },
 537                { "dma1", make_dma, &mms->dma[1], 0x40111000, 0x1000 },
 538                { "dma2", make_dma, &mms->dma[2], 0x40112000, 0x1000 },
 539                { "dma3", make_dma, &mms->dma[3], 0x40113000, 0x1000 },
 540            },
 541        },
 542    };
 543
 544    for (i = 0; i < ARRAY_SIZE(ppcs); i++) {
 545        const PPCInfo *ppcinfo = &ppcs[i];
 546        TZPPC *ppc = &mms->ppc[i];
 547        DeviceState *ppcdev;
 548        int port;
 549        char *gpioname;
 550
 551        object_initialize_child(OBJECT(machine), ppcinfo->name, ppc,
 552                                TYPE_TZ_PPC);
 553        ppcdev = DEVICE(ppc);
 554
 555        for (port = 0; port < TZ_NUM_PORTS; port++) {
 556            const PPCPortInfo *pinfo = &ppcinfo->ports[port];
 557            MemoryRegion *mr;
 558            char *portname;
 559
 560            if (!pinfo->devfn) {
 561                continue;
 562            }
 563
 564            mr = pinfo->devfn(mms, pinfo->opaque, pinfo->name, pinfo->size);
 565            portname = g_strdup_printf("port[%d]", port);
 566            object_property_set_link(OBJECT(ppc), portname, OBJECT(mr),
 567                                     &error_fatal);
 568            g_free(portname);
 569        }
 570
 571        sysbus_realize(SYS_BUS_DEVICE(ppc), &error_fatal);
 572
 573        for (port = 0; port < TZ_NUM_PORTS; port++) {
 574            const PPCPortInfo *pinfo = &ppcinfo->ports[port];
 575
 576            if (!pinfo->devfn) {
 577                continue;
 578            }
 579            sysbus_mmio_map(SYS_BUS_DEVICE(ppc), port, pinfo->addr);
 580
 581            gpioname = g_strdup_printf("%s_nonsec", ppcinfo->name);
 582            qdev_connect_gpio_out_named(iotkitdev, gpioname, port,
 583                                        qdev_get_gpio_in_named(ppcdev,
 584                                                               "cfg_nonsec",
 585                                                               port));
 586            g_free(gpioname);
 587            gpioname = g_strdup_printf("%s_ap", ppcinfo->name);
 588            qdev_connect_gpio_out_named(iotkitdev, gpioname, port,
 589                                        qdev_get_gpio_in_named(ppcdev,
 590                                                               "cfg_ap", port));
 591            g_free(gpioname);
 592        }
 593
 594        gpioname = g_strdup_printf("%s_irq_enable", ppcinfo->name);
 595        qdev_connect_gpio_out_named(iotkitdev, gpioname, 0,
 596                                    qdev_get_gpio_in_named(ppcdev,
 597                                                           "irq_enable", 0));
 598        g_free(gpioname);
 599        gpioname = g_strdup_printf("%s_irq_clear", ppcinfo->name);
 600        qdev_connect_gpio_out_named(iotkitdev, gpioname, 0,
 601                                    qdev_get_gpio_in_named(ppcdev,
 602                                                           "irq_clear", 0));
 603        g_free(gpioname);
 604        gpioname = g_strdup_printf("%s_irq_status", ppcinfo->name);
 605        qdev_connect_gpio_out_named(ppcdev, "irq", 0,
 606                                    qdev_get_gpio_in_named(iotkitdev,
 607                                                           gpioname, 0));
 608        g_free(gpioname);
 609
 610        qdev_connect_gpio_out(dev_splitter, i,
 611                              qdev_get_gpio_in_named(ppcdev,
 612                                                     "cfg_sec_resp", 0));
 613    }
 614
 615    create_unimplemented_device("FPGA NS PC", 0x48007000, 0x1000);
 616
 617    armv7m_load_kernel(ARM_CPU(first_cpu), machine->kernel_filename, 0x400000);
 618}
 619
 620static void mps2_tz_idau_check(IDAUInterface *ii, uint32_t address,
 621                               int *iregion, bool *exempt, bool *ns, bool *nsc)
 622{
 623    /*
 624     * The MPS2 TZ FPGA images have IDAUs in them which are connected to
 625     * the Master Security Controllers. Thes have the same logic as
 626     * is used by the IoTKit for the IDAU connected to the CPU, except
 627     * that MSCs don't care about the NSC attribute.
 628     */
 629    int region = extract32(address, 28, 4);
 630
 631    *ns = !(region & 1);
 632    *nsc = false;
 633    /* 0xe0000000..0xe00fffff and 0xf0000000..0xf00fffff are exempt */
 634    *exempt = (address & 0xeff00000) == 0xe0000000;
 635    *iregion = region;
 636}
 637
 638static void mps2tz_class_init(ObjectClass *oc, void *data)
 639{
 640    MachineClass *mc = MACHINE_CLASS(oc);
 641    IDAUInterfaceClass *iic = IDAU_INTERFACE_CLASS(oc);
 642
 643    mc->init = mps2tz_common_init;
 644    iic->check = mps2_tz_idau_check;
 645    mc->default_ram_size = 16 * MiB;
 646    mc->default_ram_id = "mps.ram";
 647}
 648
 649static void mps2tz_an505_class_init(ObjectClass *oc, void *data)
 650{
 651    MachineClass *mc = MACHINE_CLASS(oc);
 652    MPS2TZMachineClass *mmc = MPS2TZ_MACHINE_CLASS(oc);
 653
 654    mc->desc = "ARM MPS2 with AN505 FPGA image for Cortex-M33";
 655    mc->default_cpus = 1;
 656    mc->min_cpus = mc->default_cpus;
 657    mc->max_cpus = mc->default_cpus;
 658    mmc->fpga_type = FPGA_AN505;
 659    mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-m33");
 660    mmc->scc_id = 0x41045050;
 661    mmc->armsse_type = TYPE_IOTKIT;
 662}
 663
 664static void mps2tz_an521_class_init(ObjectClass *oc, void *data)
 665{
 666    MachineClass *mc = MACHINE_CLASS(oc);
 667    MPS2TZMachineClass *mmc = MPS2TZ_MACHINE_CLASS(oc);
 668
 669    mc->desc = "ARM MPS2 with AN521 FPGA image for dual Cortex-M33";
 670    mc->default_cpus = 2;
 671    mc->min_cpus = mc->default_cpus;
 672    mc->max_cpus = mc->default_cpus;
 673    mmc->fpga_type = FPGA_AN521;
 674    mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-m33");
 675    mmc->scc_id = 0x41045210;
 676    mmc->armsse_type = TYPE_SSE200;
 677}
 678
 679static const TypeInfo mps2tz_info = {
 680    .name = TYPE_MPS2TZ_MACHINE,
 681    .parent = TYPE_MACHINE,
 682    .abstract = true,
 683    .instance_size = sizeof(MPS2TZMachineState),
 684    .class_size = sizeof(MPS2TZMachineClass),
 685    .class_init = mps2tz_class_init,
 686    .interfaces = (InterfaceInfo[]) {
 687        { TYPE_IDAU_INTERFACE },
 688        { }
 689    },
 690};
 691
 692static const TypeInfo mps2tz_an505_info = {
 693    .name = TYPE_MPS2TZ_AN505_MACHINE,
 694    .parent = TYPE_MPS2TZ_MACHINE,
 695    .class_init = mps2tz_an505_class_init,
 696};
 697
 698static const TypeInfo mps2tz_an521_info = {
 699    .name = TYPE_MPS2TZ_AN521_MACHINE,
 700    .parent = TYPE_MPS2TZ_MACHINE,
 701    .class_init = mps2tz_an521_class_init,
 702};
 703
 704static void mps2tz_machine_init(void)
 705{
 706    type_register_static(&mps2tz_info);
 707    type_register_static(&mps2tz_an505_info);
 708    type_register_static(&mps2tz_an521_info);
 709}
 710
 711type_init(mps2tz_machine_init);
 712