qemu/hw/arm/musca.c
<<
>>
Prefs
   1/*
   2 * Arm Musca-B1 test chip board emulation
   3 *
   4 * Copyright (c) 2019 Linaro Limited
   5 * Written by Peter Maydell
   6 *
   7 *  This program is free software; you can redistribute it and/or modify
   8 *  it under the terms of the GNU General Public License version 2 or
   9 *  (at your option) any later version.
  10 */
  11
  12/*
  13 * The Musca boards are a reference implementation of a system using
  14 * the SSE-200 subsystem for embedded:
  15 * https://developer.arm.com/products/system-design/development-boards/iot-test-chips-and-boards/musca-a-test-chip-board
  16 * https://developer.arm.com/products/system-design/development-boards/iot-test-chips-and-boards/musca-b-test-chip-board
  17 * We model the A and B1 variants of this board, as described in the TRMs:
  18 * https://developer.arm.com/documentation/101107/latest/
  19 * https://developer.arm.com/documentation/101312/latest/
  20 */
  21
  22#include "qemu/osdep.h"
  23#include "qemu/error-report.h"
  24#include "qapi/error.h"
  25#include "exec/address-spaces.h"
  26#include "sysemu/sysemu.h"
  27#include "hw/arm/boot.h"
  28#include "hw/arm/armsse.h"
  29#include "hw/boards.h"
  30#include "hw/char/pl011.h"
  31#include "hw/core/split-irq.h"
  32#include "hw/misc/tz-mpc.h"
  33#include "hw/misc/tz-ppc.h"
  34#include "hw/misc/unimp.h"
  35#include "hw/rtc/pl031.h"
  36#include "hw/qdev-clock.h"
  37#include "qom/object.h"
  38
  39#define MUSCA_NUMIRQ_MAX 96
  40#define MUSCA_PPC_MAX 3
  41#define MUSCA_MPC_MAX 5
  42
  43typedef struct MPCInfo MPCInfo;
  44
  45typedef enum MuscaType {
  46    MUSCA_A,
  47    MUSCA_B1,
  48} MuscaType;
  49
  50struct MuscaMachineClass {
  51    MachineClass parent;
  52    MuscaType type;
  53    uint32_t init_svtor;
  54    int sram_addr_width;
  55    int num_irqs;
  56    const MPCInfo *mpc_info;
  57    int num_mpcs;
  58};
  59
  60struct MuscaMachineState {
  61    MachineState parent;
  62
  63    ARMSSE sse;
  64    /* RAM and flash */
  65    MemoryRegion ram[MUSCA_MPC_MAX];
  66    SplitIRQ cpu_irq_splitter[MUSCA_NUMIRQ_MAX];
  67    SplitIRQ sec_resp_splitter;
  68    TZPPC ppc[MUSCA_PPC_MAX];
  69    MemoryRegion container;
  70    UnimplementedDeviceState eflash[2];
  71    UnimplementedDeviceState qspi;
  72    TZMPC mpc[MUSCA_MPC_MAX];
  73    UnimplementedDeviceState mhu[2];
  74    UnimplementedDeviceState pwm[3];
  75    UnimplementedDeviceState i2s;
  76    PL011State uart[2];
  77    UnimplementedDeviceState i2c[2];
  78    UnimplementedDeviceState spi;
  79    UnimplementedDeviceState scc;
  80    UnimplementedDeviceState timer;
  81    PL031State rtc;
  82    UnimplementedDeviceState pvt;
  83    UnimplementedDeviceState sdio;
  84    UnimplementedDeviceState gpio;
  85    UnimplementedDeviceState cryptoisland;
  86    Clock *sysclk;
  87    Clock *s32kclk;
  88};
  89
  90#define TYPE_MUSCA_MACHINE "musca"
  91#define TYPE_MUSCA_A_MACHINE MACHINE_TYPE_NAME("musca-a")
  92#define TYPE_MUSCA_B1_MACHINE MACHINE_TYPE_NAME("musca-b1")
  93
  94OBJECT_DECLARE_TYPE(MuscaMachineState, MuscaMachineClass, MUSCA_MACHINE)
  95
  96/*
  97 * Main SYSCLK frequency in Hz
  98 * TODO this should really be different for the two cores, but we
  99 * don't model that in our SSE-200 model yet.
 100 */
 101#define SYSCLK_FRQ 40000000
 102/* Slow 32Khz S32KCLK frequency in Hz */
 103#define S32KCLK_FRQ (32 * 1000)
 104
 105static qemu_irq get_sse_irq_in(MuscaMachineState *mms, int irqno)
 106{
 107    /* Return a qemu_irq which will signal IRQ n to all CPUs in the SSE. */
 108    assert(irqno < MUSCA_NUMIRQ_MAX);
 109
 110    return qdev_get_gpio_in(DEVICE(&mms->cpu_irq_splitter[irqno]), 0);
 111}
 112
 113/*
 114 * Most of the devices in the Musca board sit behind Peripheral Protection
 115 * Controllers. These data structures define the layout of which devices
 116 * sit behind which PPCs.
 117 * The devfn for each port is a function which creates, configures
 118 * and initializes the device, returning the MemoryRegion which
 119 * needs to be plugged into the downstream end of the PPC port.
 120 */
 121typedef MemoryRegion *MakeDevFn(MuscaMachineState *mms, void *opaque,
 122                                const char *name, hwaddr size);
 123
 124typedef struct PPCPortInfo {
 125    const char *name;
 126    MakeDevFn *devfn;
 127    void *opaque;
 128    hwaddr addr;
 129    hwaddr size;
 130} PPCPortInfo;
 131
 132typedef struct PPCInfo {
 133    const char *name;
 134    PPCPortInfo ports[TZ_NUM_PORTS];
 135} PPCInfo;
 136
 137static MemoryRegion *make_unimp_dev(MuscaMachineState *mms,
 138                                    void *opaque, const char *name, hwaddr size)
 139{
 140    /*
 141     * Initialize, configure and realize a TYPE_UNIMPLEMENTED_DEVICE,
 142     * and return a pointer to its MemoryRegion.
 143     */
 144    UnimplementedDeviceState *uds = opaque;
 145
 146    object_initialize_child(OBJECT(mms), name, uds, TYPE_UNIMPLEMENTED_DEVICE);
 147    qdev_prop_set_string(DEVICE(uds), "name", name);
 148    qdev_prop_set_uint64(DEVICE(uds), "size", size);
 149    sysbus_realize(SYS_BUS_DEVICE(uds), &error_fatal);
 150    return sysbus_mmio_get_region(SYS_BUS_DEVICE(uds), 0);
 151}
 152
 153typedef enum MPCInfoType {
 154    MPC_RAM,
 155    MPC_ROM,
 156    MPC_CRYPTOISLAND,
 157} MPCInfoType;
 158
 159struct MPCInfo {
 160    const char *name;
 161    hwaddr addr;
 162    hwaddr size;
 163    MPCInfoType type;
 164};
 165
 166/* Order of the MPCs here must match the order of the bits in SECMPCINTSTATUS */
 167static const MPCInfo a_mpc_info[] = { {
 168        .name = "qspi",
 169        .type = MPC_ROM,
 170        .addr = 0x00200000,
 171        .size = 0x00800000,
 172    }, {
 173        .name = "sram",
 174        .type = MPC_RAM,
 175        .addr = 0x00000000,
 176        .size = 0x00200000,
 177    }
 178};
 179
 180static const MPCInfo b1_mpc_info[] = { {
 181        .name = "qspi",
 182        .type = MPC_ROM,
 183        .addr = 0x00000000,
 184        .size = 0x02000000,
 185    }, {
 186        .name = "sram",
 187        .type = MPC_RAM,
 188        .addr = 0x0a400000,
 189        .size = 0x00080000,
 190    }, {
 191        .name = "eflash0",
 192        .type = MPC_ROM,
 193        .addr = 0x0a000000,
 194        .size = 0x00200000,
 195    }, {
 196        .name = "eflash1",
 197        .type = MPC_ROM,
 198        .addr = 0x0a200000,
 199        .size = 0x00200000,
 200    }, {
 201        .name = "cryptoisland",
 202        .type = MPC_CRYPTOISLAND,
 203        .addr = 0x0a000000,
 204        .size = 0x00200000,
 205    }
 206};
 207
 208static MemoryRegion *make_mpc(MuscaMachineState *mms, void *opaque,
 209                              const char *name, hwaddr size)
 210{
 211    /*
 212     * Create an MPC and the RAM or flash behind it.
 213     * MPC 0: eFlash 0
 214     * MPC 1: eFlash 1
 215     * MPC 2: SRAM
 216     * MPC 3: QSPI flash
 217     * MPC 4: CryptoIsland
 218     * For now we implement the flash regions as ROM (ie not programmable)
 219     * (with their control interface memory regions being unimplemented
 220     * stubs behind the PPCs).
 221     * The whole CryptoIsland region behind its MPC is an unimplemented stub.
 222     */
 223    MuscaMachineClass *mmc = MUSCA_MACHINE_GET_CLASS(mms);
 224    TZMPC *mpc = opaque;
 225    int i = mpc - &mms->mpc[0];
 226    MemoryRegion *downstream;
 227    MemoryRegion *upstream;
 228    UnimplementedDeviceState *uds;
 229    char *mpcname;
 230    const MPCInfo *mpcinfo = mmc->mpc_info;
 231
 232    mpcname = g_strdup_printf("%s-mpc", mpcinfo[i].name);
 233
 234    switch (mpcinfo[i].type) {
 235    case MPC_ROM:
 236        downstream = &mms->ram[i];
 237        memory_region_init_rom(downstream, NULL, mpcinfo[i].name,
 238                               mpcinfo[i].size, &error_fatal);
 239        break;
 240    case MPC_RAM:
 241        downstream = &mms->ram[i];
 242        memory_region_init_ram(downstream, NULL, mpcinfo[i].name,
 243                               mpcinfo[i].size, &error_fatal);
 244        break;
 245    case MPC_CRYPTOISLAND:
 246        /* We don't implement the CryptoIsland yet */
 247        uds = &mms->cryptoisland;
 248        object_initialize_child(OBJECT(mms), name, uds,
 249                                TYPE_UNIMPLEMENTED_DEVICE);
 250        qdev_prop_set_string(DEVICE(uds), "name", mpcinfo[i].name);
 251        qdev_prop_set_uint64(DEVICE(uds), "size", mpcinfo[i].size);
 252        sysbus_realize(SYS_BUS_DEVICE(uds), &error_fatal);
 253        downstream = sysbus_mmio_get_region(SYS_BUS_DEVICE(uds), 0);
 254        break;
 255    default:
 256        g_assert_not_reached();
 257    }
 258
 259    object_initialize_child(OBJECT(mms), mpcname, mpc, TYPE_TZ_MPC);
 260    object_property_set_link(OBJECT(mpc), "downstream", OBJECT(downstream),
 261                             &error_fatal);
 262    sysbus_realize(SYS_BUS_DEVICE(mpc), &error_fatal);
 263    /* Map the upstream end of the MPC into system memory */
 264    upstream = sysbus_mmio_get_region(SYS_BUS_DEVICE(mpc), 1);
 265    memory_region_add_subregion(get_system_memory(), mpcinfo[i].addr, upstream);
 266    /* and connect its interrupt to the SSE-200 */
 267    qdev_connect_gpio_out_named(DEVICE(mpc), "irq", 0,
 268                                qdev_get_gpio_in_named(DEVICE(&mms->sse),
 269                                                       "mpcexp_status", i));
 270
 271    g_free(mpcname);
 272    /* Return the register interface MR for our caller to map behind the PPC */
 273    return sysbus_mmio_get_region(SYS_BUS_DEVICE(mpc), 0);
 274}
 275
 276static MemoryRegion *make_rtc(MuscaMachineState *mms, void *opaque,
 277                              const char *name, hwaddr size)
 278{
 279    PL031State *rtc = opaque;
 280
 281    object_initialize_child(OBJECT(mms), name, rtc, TYPE_PL031);
 282    sysbus_realize(SYS_BUS_DEVICE(rtc), &error_fatal);
 283    sysbus_connect_irq(SYS_BUS_DEVICE(rtc), 0, get_sse_irq_in(mms, 39));
 284    return sysbus_mmio_get_region(SYS_BUS_DEVICE(rtc), 0);
 285}
 286
 287static MemoryRegion *make_uart(MuscaMachineState *mms, void *opaque,
 288                               const char *name, hwaddr size)
 289{
 290    PL011State *uart = opaque;
 291    int i = uart - &mms->uart[0];
 292    int irqbase = 7 + i * 6;
 293    SysBusDevice *s;
 294
 295    object_initialize_child(OBJECT(mms), name, uart, TYPE_PL011);
 296    qdev_prop_set_chr(DEVICE(uart), "chardev", serial_hd(i));
 297    sysbus_realize(SYS_BUS_DEVICE(uart), &error_fatal);
 298    s = SYS_BUS_DEVICE(uart);
 299    sysbus_connect_irq(s, 0, get_sse_irq_in(mms, irqbase + 5)); /* combined */
 300    sysbus_connect_irq(s, 1, get_sse_irq_in(mms, irqbase + 0)); /* RX */
 301    sysbus_connect_irq(s, 2, get_sse_irq_in(mms, irqbase + 1)); /* TX */
 302    sysbus_connect_irq(s, 3, get_sse_irq_in(mms, irqbase + 2)); /* RT */
 303    sysbus_connect_irq(s, 4, get_sse_irq_in(mms, irqbase + 3)); /* MS */
 304    sysbus_connect_irq(s, 5, get_sse_irq_in(mms, irqbase + 4)); /* E */
 305    return sysbus_mmio_get_region(SYS_BUS_DEVICE(uart), 0);
 306}
 307
 308static MemoryRegion *make_musca_a_devs(MuscaMachineState *mms, void *opaque,
 309                                       const char *name, hwaddr size)
 310{
 311    /*
 312     * Create the container MemoryRegion for all the devices that live
 313     * behind the Musca-A PPC's single port. These devices don't have a PPC
 314     * port each, but we use the PPCPortInfo struct as a convenient way
 315     * to describe them. Note that addresses here are relative to the base
 316     * address of the PPC port region: 0x40100000, and devices appear both
 317     * at the 0x4... NS region and the 0x5... S region.
 318     */
 319    int i;
 320    MemoryRegion *container = &mms->container;
 321
 322    const PPCPortInfo devices[] = {
 323        { "uart0", make_uart, &mms->uart[0], 0x1000, 0x1000 },
 324        { "uart1", make_uart, &mms->uart[1], 0x2000, 0x1000 },
 325        { "spi", make_unimp_dev, &mms->spi, 0x3000, 0x1000 },
 326        { "i2c0", make_unimp_dev, &mms->i2c[0], 0x4000, 0x1000 },
 327        { "i2c1", make_unimp_dev, &mms->i2c[1], 0x5000, 0x1000 },
 328        { "i2s", make_unimp_dev, &mms->i2s, 0x6000, 0x1000 },
 329        { "pwm0", make_unimp_dev, &mms->pwm[0], 0x7000, 0x1000 },
 330        { "rtc", make_rtc, &mms->rtc, 0x8000, 0x1000 },
 331        { "qspi", make_unimp_dev, &mms->qspi, 0xa000, 0x1000 },
 332        { "timer", make_unimp_dev, &mms->timer, 0xb000, 0x1000 },
 333        { "scc", make_unimp_dev, &mms->scc, 0xc000, 0x1000 },
 334        { "pwm1", make_unimp_dev, &mms->pwm[1], 0xe000, 0x1000 },
 335        { "pwm2", make_unimp_dev, &mms->pwm[2], 0xf000, 0x1000 },
 336        { "gpio", make_unimp_dev, &mms->gpio, 0x10000, 0x1000 },
 337        { "mpc0", make_mpc, &mms->mpc[0], 0x12000, 0x1000 },
 338        { "mpc1", make_mpc, &mms->mpc[1], 0x13000, 0x1000 },
 339    };
 340
 341    memory_region_init(container, OBJECT(mms), "musca-device-container", size);
 342
 343    for (i = 0; i < ARRAY_SIZE(devices); i++) {
 344        const PPCPortInfo *pinfo = &devices[i];
 345        MemoryRegion *mr;
 346
 347        mr = pinfo->devfn(mms, pinfo->opaque, pinfo->name, pinfo->size);
 348        memory_region_add_subregion(container, pinfo->addr, mr);
 349    }
 350
 351    return &mms->container;
 352}
 353
 354static void musca_init(MachineState *machine)
 355{
 356    MuscaMachineState *mms = MUSCA_MACHINE(machine);
 357    MuscaMachineClass *mmc = MUSCA_MACHINE_GET_CLASS(mms);
 358    MachineClass *mc = MACHINE_GET_CLASS(machine);
 359    MemoryRegion *system_memory = get_system_memory();
 360    DeviceState *ssedev;
 361    DeviceState *dev_splitter;
 362    const PPCInfo *ppcs;
 363    int num_ppcs;
 364    int i;
 365
 366    assert(mmc->num_irqs <= MUSCA_NUMIRQ_MAX);
 367    assert(mmc->num_mpcs <= MUSCA_MPC_MAX);
 368
 369    if (strcmp(machine->cpu_type, mc->default_cpu_type) != 0) {
 370        error_report("This board can only be used with CPU %s",
 371                     mc->default_cpu_type);
 372        exit(1);
 373    }
 374
 375    mms->sysclk = clock_new(OBJECT(machine), "SYSCLK");
 376    clock_set_hz(mms->sysclk, SYSCLK_FRQ);
 377    mms->s32kclk = clock_new(OBJECT(machine), "S32KCLK");
 378    clock_set_hz(mms->s32kclk, S32KCLK_FRQ);
 379
 380    object_initialize_child(OBJECT(machine), "sse-200", &mms->sse,
 381                            TYPE_SSE200);
 382    ssedev = DEVICE(&mms->sse);
 383    object_property_set_link(OBJECT(&mms->sse), "memory",
 384                             OBJECT(system_memory), &error_fatal);
 385    qdev_prop_set_uint32(ssedev, "EXP_NUMIRQ", mmc->num_irqs);
 386    qdev_prop_set_uint32(ssedev, "init-svtor", mmc->init_svtor);
 387    qdev_prop_set_uint32(ssedev, "SRAM_ADDR_WIDTH", mmc->sram_addr_width);
 388    qdev_connect_clock_in(ssedev, "MAINCLK", mms->sysclk);
 389    qdev_connect_clock_in(ssedev, "S32KCLK", mms->s32kclk);
 390    /*
 391     * Musca-A takes the default SSE-200 FPU/DSP settings (ie no for
 392     * CPU0 and yes for CPU1); Musca-B1 explicitly enables them for CPU0.
 393     */
 394    if (mmc->type == MUSCA_B1) {
 395        qdev_prop_set_bit(ssedev, "CPU0_FPU", true);
 396        qdev_prop_set_bit(ssedev, "CPU0_DSP", true);
 397    }
 398    sysbus_realize(SYS_BUS_DEVICE(&mms->sse), &error_fatal);
 399
 400    /*
 401     * We need to create splitters to feed the IRQ inputs
 402     * for each CPU in the SSE-200 from each device in the board.
 403     */
 404    for (i = 0; i < mmc->num_irqs; i++) {
 405        char *name = g_strdup_printf("musca-irq-splitter%d", i);
 406        SplitIRQ *splitter = &mms->cpu_irq_splitter[i];
 407
 408        object_initialize_child_with_props(OBJECT(machine), name, splitter,
 409                                           sizeof(*splitter), TYPE_SPLIT_IRQ,
 410                                           &error_fatal, NULL);
 411        g_free(name);
 412
 413        object_property_set_int(OBJECT(splitter), "num-lines", 2,
 414                                &error_fatal);
 415        qdev_realize(DEVICE(splitter), NULL, &error_fatal);
 416        qdev_connect_gpio_out(DEVICE(splitter), 0,
 417                              qdev_get_gpio_in_named(ssedev, "EXP_IRQ", i));
 418        qdev_connect_gpio_out(DEVICE(splitter), 1,
 419                              qdev_get_gpio_in_named(ssedev,
 420                                                     "EXP_CPU1_IRQ", i));
 421    }
 422
 423    /*
 424     * The sec_resp_cfg output from the SSE-200 must be split into multiple
 425     * lines, one for each of the PPCs we create here.
 426     */
 427    object_initialize_child_with_props(OBJECT(machine), "sec-resp-splitter",
 428                                       &mms->sec_resp_splitter,
 429                                       sizeof(mms->sec_resp_splitter),
 430                                       TYPE_SPLIT_IRQ, &error_fatal, NULL);
 431
 432    object_property_set_int(OBJECT(&mms->sec_resp_splitter), "num-lines",
 433                            ARRAY_SIZE(mms->ppc), &error_fatal);
 434    qdev_realize(DEVICE(&mms->sec_resp_splitter), NULL, &error_fatal);
 435    dev_splitter = DEVICE(&mms->sec_resp_splitter);
 436    qdev_connect_gpio_out_named(ssedev, "sec_resp_cfg", 0,
 437                                qdev_get_gpio_in(dev_splitter, 0));
 438
 439    /*
 440     * Most of the devices in the board are behind Peripheral Protection
 441     * Controllers. The required order for initializing things is:
 442     *  + initialize the PPC
 443     *  + initialize, configure and realize downstream devices
 444     *  + connect downstream device MemoryRegions to the PPC
 445     *  + realize the PPC
 446     *  + map the PPC's MemoryRegions to the places in the address map
 447     *    where the downstream devices should appear
 448     *  + wire up the PPC's control lines to the SSE object
 449     *
 450     * The PPC mapping differs for the -A and -B1 variants; the -A version
 451     * is much simpler, using only a single port of a single PPC and putting
 452     * all the devices behind that.
 453     */
 454    const PPCInfo a_ppcs[] = { {
 455            .name = "ahb_ppcexp0",
 456            .ports = {
 457                { "musca-devices", make_musca_a_devs, 0, 0x40100000, 0x100000 },
 458            },
 459        },
 460    };
 461
 462    /*
 463     * Devices listed with an 0x4.. address appear in both the NS 0x4.. region
 464     * and the 0x5.. S region. Devices listed with an 0x5.. address appear
 465     * only in the S region.
 466     */
 467    const PPCInfo b1_ppcs[] = { {
 468            .name = "apb_ppcexp0",
 469            .ports = {
 470                { "eflash0", make_unimp_dev, &mms->eflash[0],
 471                  0x52400000, 0x1000 },
 472                { "eflash1", make_unimp_dev, &mms->eflash[1],
 473                  0x52500000, 0x1000 },
 474                { "qspi", make_unimp_dev, &mms->qspi, 0x42800000, 0x100000 },
 475                { "mpc0", make_mpc, &mms->mpc[0], 0x52000000, 0x1000 },
 476                { "mpc1", make_mpc, &mms->mpc[1], 0x52100000, 0x1000 },
 477                { "mpc2", make_mpc, &mms->mpc[2], 0x52200000, 0x1000 },
 478                { "mpc3", make_mpc, &mms->mpc[3], 0x52300000, 0x1000 },
 479                { "mhu0", make_unimp_dev, &mms->mhu[0], 0x42600000, 0x100000 },
 480                { "mhu1", make_unimp_dev, &mms->mhu[1], 0x42700000, 0x100000 },
 481                { }, /* port 9: unused */
 482                { }, /* port 10: unused */
 483                { }, /* port 11: unused */
 484                { }, /* port 12: unused */
 485                { }, /* port 13: unused */
 486                { "mpc4", make_mpc, &mms->mpc[4], 0x52e00000, 0x1000 },
 487            },
 488        }, {
 489            .name = "apb_ppcexp1",
 490            .ports = {
 491                { "pwm0", make_unimp_dev, &mms->pwm[0], 0x40101000, 0x1000 },
 492                { "pwm1", make_unimp_dev, &mms->pwm[1], 0x40102000, 0x1000 },
 493                { "pwm2", make_unimp_dev, &mms->pwm[2], 0x40103000, 0x1000 },
 494                { "i2s", make_unimp_dev, &mms->i2s, 0x40104000, 0x1000 },
 495                { "uart0", make_uart, &mms->uart[0], 0x40105000, 0x1000 },
 496                { "uart1", make_uart, &mms->uart[1], 0x40106000, 0x1000 },
 497                { "i2c0", make_unimp_dev, &mms->i2c[0], 0x40108000, 0x1000 },
 498                { "i2c1", make_unimp_dev, &mms->i2c[1], 0x40109000, 0x1000 },
 499                { "spi", make_unimp_dev, &mms->spi, 0x4010a000, 0x1000 },
 500                { "scc", make_unimp_dev, &mms->scc, 0x5010b000, 0x1000 },
 501                { "timer", make_unimp_dev, &mms->timer, 0x4010c000, 0x1000 },
 502                { "rtc", make_rtc, &mms->rtc, 0x4010d000, 0x1000 },
 503                { "pvt", make_unimp_dev, &mms->pvt, 0x4010e000, 0x1000 },
 504                { "sdio", make_unimp_dev, &mms->sdio, 0x4010f000, 0x1000 },
 505            },
 506        }, {
 507            .name = "ahb_ppcexp0",
 508            .ports = {
 509                { }, /* port 0: unused */
 510                { "gpio", make_unimp_dev, &mms->gpio, 0x41000000, 0x1000 },
 511            },
 512        },
 513    };
 514
 515    switch (mmc->type) {
 516    case MUSCA_A:
 517        ppcs = a_ppcs;
 518        num_ppcs = ARRAY_SIZE(a_ppcs);
 519        break;
 520    case MUSCA_B1:
 521        ppcs = b1_ppcs;
 522        num_ppcs = ARRAY_SIZE(b1_ppcs);
 523        break;
 524    default:
 525        g_assert_not_reached();
 526    }
 527    assert(num_ppcs <= MUSCA_PPC_MAX);
 528
 529    for (i = 0; i < num_ppcs; i++) {
 530        const PPCInfo *ppcinfo = &ppcs[i];
 531        TZPPC *ppc = &mms->ppc[i];
 532        DeviceState *ppcdev;
 533        int port;
 534        char *gpioname;
 535
 536        object_initialize_child(OBJECT(machine), ppcinfo->name, ppc,
 537                                TYPE_TZ_PPC);
 538        ppcdev = DEVICE(ppc);
 539
 540        for (port = 0; port < TZ_NUM_PORTS; port++) {
 541            const PPCPortInfo *pinfo = &ppcinfo->ports[port];
 542            MemoryRegion *mr;
 543            char *portname;
 544
 545            if (!pinfo->devfn) {
 546                continue;
 547            }
 548
 549            mr = pinfo->devfn(mms, pinfo->opaque, pinfo->name, pinfo->size);
 550            portname = g_strdup_printf("port[%d]", port);
 551            object_property_set_link(OBJECT(ppc), portname, OBJECT(mr),
 552                                     &error_fatal);
 553            g_free(portname);
 554        }
 555
 556        sysbus_realize(SYS_BUS_DEVICE(ppc), &error_fatal);
 557
 558        for (port = 0; port < TZ_NUM_PORTS; port++) {
 559            const PPCPortInfo *pinfo = &ppcinfo->ports[port];
 560
 561            if (!pinfo->devfn) {
 562                continue;
 563            }
 564            sysbus_mmio_map(SYS_BUS_DEVICE(ppc), port, pinfo->addr);
 565
 566            gpioname = g_strdup_printf("%s_nonsec", ppcinfo->name);
 567            qdev_connect_gpio_out_named(ssedev, gpioname, port,
 568                                        qdev_get_gpio_in_named(ppcdev,
 569                                                               "cfg_nonsec",
 570                                                               port));
 571            g_free(gpioname);
 572            gpioname = g_strdup_printf("%s_ap", ppcinfo->name);
 573            qdev_connect_gpio_out_named(ssedev, gpioname, port,
 574                                        qdev_get_gpio_in_named(ppcdev,
 575                                                               "cfg_ap", port));
 576            g_free(gpioname);
 577        }
 578
 579        gpioname = g_strdup_printf("%s_irq_enable", ppcinfo->name);
 580        qdev_connect_gpio_out_named(ssedev, gpioname, 0,
 581                                    qdev_get_gpio_in_named(ppcdev,
 582                                                           "irq_enable", 0));
 583        g_free(gpioname);
 584        gpioname = g_strdup_printf("%s_irq_clear", ppcinfo->name);
 585        qdev_connect_gpio_out_named(ssedev, gpioname, 0,
 586                                    qdev_get_gpio_in_named(ppcdev,
 587                                                           "irq_clear", 0));
 588        g_free(gpioname);
 589        gpioname = g_strdup_printf("%s_irq_status", ppcinfo->name);
 590        qdev_connect_gpio_out_named(ppcdev, "irq", 0,
 591                                    qdev_get_gpio_in_named(ssedev,
 592                                                           gpioname, 0));
 593        g_free(gpioname);
 594
 595        qdev_connect_gpio_out(dev_splitter, i,
 596                              qdev_get_gpio_in_named(ppcdev,
 597                                                     "cfg_sec_resp", 0));
 598    }
 599
 600    armv7m_load_kernel(ARM_CPU(first_cpu), machine->kernel_filename, 0x2000000);
 601}
 602
 603static void musca_class_init(ObjectClass *oc, void *data)
 604{
 605    MachineClass *mc = MACHINE_CLASS(oc);
 606
 607    mc->default_cpus = 2;
 608    mc->min_cpus = mc->default_cpus;
 609    mc->max_cpus = mc->default_cpus;
 610    mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-m33");
 611    mc->init = musca_init;
 612}
 613
 614static void musca_a_class_init(ObjectClass *oc, void *data)
 615{
 616    MachineClass *mc = MACHINE_CLASS(oc);
 617    MuscaMachineClass *mmc = MUSCA_MACHINE_CLASS(oc);
 618
 619    mc->desc = "ARM Musca-A board (dual Cortex-M33)";
 620    mmc->type = MUSCA_A;
 621    mmc->init_svtor = 0x10200000;
 622    mmc->sram_addr_width = 15;
 623    mmc->num_irqs = 64;
 624    mmc->mpc_info = a_mpc_info;
 625    mmc->num_mpcs = ARRAY_SIZE(a_mpc_info);
 626}
 627
 628static void musca_b1_class_init(ObjectClass *oc, void *data)
 629{
 630    MachineClass *mc = MACHINE_CLASS(oc);
 631    MuscaMachineClass *mmc = MUSCA_MACHINE_CLASS(oc);
 632
 633    mc->desc = "ARM Musca-B1 board (dual Cortex-M33)";
 634    mmc->type = MUSCA_B1;
 635    /*
 636     * This matches the DAPlink firmware which boots from QSPI. There
 637     * is also a firmware blob which boots from the eFlash, which
 638     * uses init_svtor = 0x1A000000. QEMU doesn't currently support that,
 639     * though we could in theory expose a machine property on the command
 640     * line to allow the user to request eFlash boot.
 641     */
 642    mmc->init_svtor = 0x10000000;
 643    mmc->sram_addr_width = 17;
 644    mmc->num_irqs = 96;
 645    mmc->mpc_info = b1_mpc_info;
 646    mmc->num_mpcs = ARRAY_SIZE(b1_mpc_info);
 647}
 648
 649static const TypeInfo musca_info = {
 650    .name = TYPE_MUSCA_MACHINE,
 651    .parent = TYPE_MACHINE,
 652    .abstract = true,
 653    .instance_size = sizeof(MuscaMachineState),
 654    .class_size = sizeof(MuscaMachineClass),
 655    .class_init = musca_class_init,
 656};
 657
 658static const TypeInfo musca_a_info = {
 659    .name = TYPE_MUSCA_A_MACHINE,
 660    .parent = TYPE_MUSCA_MACHINE,
 661    .class_init = musca_a_class_init,
 662};
 663
 664static const TypeInfo musca_b1_info = {
 665    .name = TYPE_MUSCA_B1_MACHINE,
 666    .parent = TYPE_MUSCA_MACHINE,
 667    .class_init = musca_b1_class_init,
 668};
 669
 670static void musca_machine_init(void)
 671{
 672    type_register_static(&musca_info);
 673    type_register_static(&musca_a_info);
 674    type_register_static(&musca_b1_info);
 675}
 676
 677type_init(musca_machine_init);
 678