1 /*
2 * ARM V2M MPS2 board emulation, trustzone aware FPGA images
3 *
4 * Copyright (c) 2017 Linaro Limited
5 * Written by Peter Maydell
6 *
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License version 2 or
9 * (at your option) any later version.
10 */
11
12 /* The MPS2 and MPS2+ dev boards are FPGA based (the 2+ has a bigger
13 * FPGA but is otherwise the same as the 2). Since the CPU itself
14 * and most of the devices are in the FPGA, the details of the board
15 * as seen by the guest depend significantly on the FPGA image.
16 * This source file covers the following FPGA images, for TrustZone cores:
17 * "mps2-an505" -- Cortex-M33 as documented in ARM Application Note AN505
18 * "mps2-an521" -- Dual Cortex-M33 as documented in Application Note AN521
19 *
20 * Links to the TRM for the board itself and to the various Application
21 * Notes which document the FPGA images can be found here:
22 * https://developer.arm.com/products/system-design/development-boards/fpga-prototyping-boards/mps2
23 *
24 * Board TRM:
25 * http://infocenter.arm.com/help/topic/com.arm.doc.100112_0200_06_en/versatile_express_cortex_m_prototyping_systems_v2m_mps2_and_v2m_mps2plus_technical_reference_100112_0200_06_en.pdf
26 * Application Note AN505:
27 * http://infocenter.arm.com/help/topic/com.arm.doc.dai0505b/index.html
28 * Application Note AN521:
29 * http://infocenter.arm.com/help/topic/com.arm.doc.dai0521c/index.html
30 *
31 * The AN505 defers to the Cortex-M33 processor ARMv8M IoT Kit FVP User Guide
32 * (ARM ECM0601256) for the details of some of the device layout:
33 * http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ecm0601256/index.html
34 * Similarly, the AN521 uses the SSE-200, and the SSE-200 TRM defines
35 * most of the device layout:
36 * http://infocenter.arm.com/help/topic/com.arm.doc.101104_0100_00_en/corelink_sse200_subsystem_for_embedded_technical_reference_manual_101104_0100_00_en.pdf
37 *
38 */
39
40 #include "qemu/osdep.h"
41 #include "qemu/units.h"
42 #include "qapi/error.h"
43 #include "qemu/error-report.h"
44 #include "hw/arm/boot.h"
45 #include "hw/arm/armv7m.h"
46 #include "hw/or-irq.h"
47 #include "hw/boards.h"
48 #include "exec/address-spaces.h"
49 #include "sysemu/sysemu.h"
50 #include "hw/misc/unimp.h"
51 #include "hw/char/cmsdk-apb-uart.h"
52 #include "hw/timer/cmsdk-apb-timer.h"
53 #include "hw/misc/mps2-scc.h"
54 #include "hw/misc/mps2-fpgaio.h"
55 #include "hw/misc/tz-mpc.h"
56 #include "hw/misc/tz-msc.h"
57 #include "hw/arm/armsse.h"
58 #include "hw/dma/pl080.h"
59 #include "hw/ssi/pl022.h"
60 #include "hw/net/lan9118.h"
61 #include "net/net.h"
62 #include "hw/core/split-irq.h"
63
64 #define MPS2TZ_NUMIRQ 92
65
66 typedef enum MPS2TZFPGAType {
67 FPGA_AN505,
68 FPGA_AN521,
69 } MPS2TZFPGAType;
70
71 typedef struct {
72 MachineClass parent;
73 MPS2TZFPGAType fpga_type;
74 uint32_t scc_id;
75 const char *armsse_type;
76 } MPS2TZMachineClass;
77
78 typedef struct {
79 MachineState parent;
80
81 ARMSSE iotkit;
82 MemoryRegion psram;
83 MemoryRegion ssram[3];
84 MemoryRegion ssram1_m;
85 MPS2SCC scc;
86 MPS2FPGAIO fpgaio;
87 TZPPC ppc[5];
88 TZMPC ssram_mpc[3];
89 PL022State spi[5];
90 UnimplementedDeviceState i2c[4];
91 UnimplementedDeviceState i2s_audio;
92 UnimplementedDeviceState gpio[4];
93 UnimplementedDeviceState gfx;
94 PL080State dma[4];
95 TZMSC msc[4];
96 CMSDKAPBUART uart[5];
97 SplitIRQ sec_resp_splitter;
98 qemu_or_irq uart_irq_orgate;
99 DeviceState *lan9118;
100 SplitIRQ cpu_irq_splitter[MPS2TZ_NUMIRQ];
101 } MPS2TZMachineState;
102
103 #define TYPE_MPS2TZ_MACHINE "mps2tz"
104 #define TYPE_MPS2TZ_AN505_MACHINE MACHINE_TYPE_NAME("mps2-an505")
105 #define TYPE_MPS2TZ_AN521_MACHINE MACHINE_TYPE_NAME("mps2-an521")
106
107 #define MPS2TZ_MACHINE(obj) \
108 OBJECT_CHECK(MPS2TZMachineState, obj, TYPE_MPS2TZ_MACHINE)
109 #define MPS2TZ_MACHINE_GET_CLASS(obj) \
110 OBJECT_GET_CLASS(MPS2TZMachineClass, obj, TYPE_MPS2TZ_MACHINE)
111 #define MPS2TZ_MACHINE_CLASS(klass) \
112 OBJECT_CLASS_CHECK(MPS2TZMachineClass, klass, TYPE_MPS2TZ_MACHINE)
113
114 /* Main SYSCLK frequency in Hz */
115 #define SYSCLK_FRQ 20000000
116
117 /* Create an alias of an entire original MemoryRegion @orig
118 * located at @base in the memory map.
119 */
make_ram_alias(MemoryRegion * mr,const char * name,MemoryRegion * orig,hwaddr base)120 static void make_ram_alias(MemoryRegion *mr, const char *name,
121 MemoryRegion *orig, hwaddr base)
122 {
123 memory_region_init_alias(mr, NULL, name, orig, 0,
124 memory_region_size(orig));
125 memory_region_add_subregion(get_system_memory(), base, mr);
126 }
127
get_sse_irq_in(MPS2TZMachineState * mms,int irqno)128 static qemu_irq get_sse_irq_in(MPS2TZMachineState *mms, int irqno)
129 {
130 /* Return a qemu_irq which will signal IRQ n to all CPUs in the SSE. */
131 MPS2TZMachineClass *mmc = MPS2TZ_MACHINE_GET_CLASS(mms);
132
133 assert(irqno < MPS2TZ_NUMIRQ);
134
135 switch (mmc->fpga_type) {
136 case FPGA_AN505:
137 return qdev_get_gpio_in_named(DEVICE(&mms->iotkit), "EXP_IRQ", irqno);
138 case FPGA_AN521:
139 return qdev_get_gpio_in(DEVICE(&mms->cpu_irq_splitter[irqno]), 0);
140 default:
141 g_assert_not_reached();
142 }
143 }
144
145 /* Most of the devices in the AN505 FPGA image sit behind
146 * Peripheral Protection Controllers. These data structures
147 * define the layout of which devices sit behind which PPCs.
148 * The devfn for each port is a function which creates, configures
149 * and initializes the device, returning the MemoryRegion which
150 * needs to be plugged into the downstream end of the PPC port.
151 */
152 typedef MemoryRegion *MakeDevFn(MPS2TZMachineState *mms, void *opaque,
153 const char *name, hwaddr size);
154
155 typedef struct PPCPortInfo {
156 const char *name;
157 MakeDevFn *devfn;
158 void *opaque;
159 hwaddr addr;
160 hwaddr size;
161 } PPCPortInfo;
162
163 typedef struct PPCInfo {
164 const char *name;
165 PPCPortInfo ports[TZ_NUM_PORTS];
166 } PPCInfo;
167
make_unimp_dev(MPS2TZMachineState * mms,void * opaque,const char * name,hwaddr size)168 static MemoryRegion *make_unimp_dev(MPS2TZMachineState *mms,
169 void *opaque,
170 const char *name, hwaddr size)
171 {
172 /* Initialize, configure and realize a TYPE_UNIMPLEMENTED_DEVICE,
173 * and return a pointer to its MemoryRegion.
174 */
175 UnimplementedDeviceState *uds = opaque;
176
177 sysbus_init_child_obj(OBJECT(mms), name, uds,
178 sizeof(UnimplementedDeviceState),
179 TYPE_UNIMPLEMENTED_DEVICE);
180 qdev_prop_set_string(DEVICE(uds), "name", name);
181 qdev_prop_set_uint64(DEVICE(uds), "size", size);
182 object_property_set_bool(OBJECT(uds), true, "realized", &error_fatal);
183 return sysbus_mmio_get_region(SYS_BUS_DEVICE(uds), 0);
184 }
185
make_uart(MPS2TZMachineState * mms,void * opaque,const char * name,hwaddr size)186 static MemoryRegion *make_uart(MPS2TZMachineState *mms, void *opaque,
187 const char *name, hwaddr size)
188 {
189 CMSDKAPBUART *uart = opaque;
190 int i = uart - &mms->uart[0];
191 int rxirqno = i * 2;
192 int txirqno = i * 2 + 1;
193 int combirqno = i + 10;
194 SysBusDevice *s;
195 DeviceState *orgate_dev = DEVICE(&mms->uart_irq_orgate);
196
197 sysbus_init_child_obj(OBJECT(mms), name, uart, sizeof(mms->uart[0]),
198 TYPE_CMSDK_APB_UART);
199 qdev_prop_set_chr(DEVICE(uart), "chardev", serial_hd(i));
200 qdev_prop_set_uint32(DEVICE(uart), "pclk-frq", SYSCLK_FRQ);
201 object_property_set_bool(OBJECT(uart), true, "realized", &error_fatal);
202 s = SYS_BUS_DEVICE(uart);
203 sysbus_connect_irq(s, 0, get_sse_irq_in(mms, txirqno));
204 sysbus_connect_irq(s, 1, get_sse_irq_in(mms, rxirqno));
205 sysbus_connect_irq(s, 2, qdev_get_gpio_in(orgate_dev, i * 2));
206 sysbus_connect_irq(s, 3, qdev_get_gpio_in(orgate_dev, i * 2 + 1));
207 sysbus_connect_irq(s, 4, get_sse_irq_in(mms, combirqno));
208 return sysbus_mmio_get_region(SYS_BUS_DEVICE(uart), 0);
209 }
210
make_scc(MPS2TZMachineState * mms,void * opaque,const char * name,hwaddr size)211 static MemoryRegion *make_scc(MPS2TZMachineState *mms, void *opaque,
212 const char *name, hwaddr size)
213 {
214 MPS2SCC *scc = opaque;
215 DeviceState *sccdev;
216 MPS2TZMachineClass *mmc = MPS2TZ_MACHINE_GET_CLASS(mms);
217
218 sysbus_init_child_obj(OBJECT(mms), "scc", scc,
219 sizeof(mms->scc), TYPE_MPS2_SCC);
220 sccdev = DEVICE(scc);
221 qdev_prop_set_uint32(sccdev, "scc-cfg4", 0x2);
222 qdev_prop_set_uint32(sccdev, "scc-aid", 0x00200008);
223 qdev_prop_set_uint32(sccdev, "scc-id", mmc->scc_id);
224 object_property_set_bool(OBJECT(scc), true, "realized", &error_fatal);
225 return sysbus_mmio_get_region(SYS_BUS_DEVICE(sccdev), 0);
226 }
227
make_fpgaio(MPS2TZMachineState * mms,void * opaque,const char * name,hwaddr size)228 static MemoryRegion *make_fpgaio(MPS2TZMachineState *mms, void *opaque,
229 const char *name, hwaddr size)
230 {
231 MPS2FPGAIO *fpgaio = opaque;
232
233 sysbus_init_child_obj(OBJECT(mms), "fpgaio", fpgaio,
234 sizeof(mms->fpgaio), TYPE_MPS2_FPGAIO);
235 object_property_set_bool(OBJECT(fpgaio), true, "realized", &error_fatal);
236 return sysbus_mmio_get_region(SYS_BUS_DEVICE(fpgaio), 0);
237 }
238
make_eth_dev(MPS2TZMachineState * mms,void * opaque,const char * name,hwaddr size)239 static MemoryRegion *make_eth_dev(MPS2TZMachineState *mms, void *opaque,
240 const char *name, hwaddr size)
241 {
242 SysBusDevice *s;
243 NICInfo *nd = &nd_table[0];
244
245 /* In hardware this is a LAN9220; the LAN9118 is software compatible
246 * except that it doesn't support the checksum-offload feature.
247 */
248 qemu_check_nic_model(nd, "lan9118");
249 mms->lan9118 = qdev_create(NULL, TYPE_LAN9118);
250 qdev_set_nic_properties(mms->lan9118, nd);
251 qdev_init_nofail(mms->lan9118);
252
253 s = SYS_BUS_DEVICE(mms->lan9118);
254 sysbus_connect_irq(s, 0, get_sse_irq_in(mms, 16));
255 return sysbus_mmio_get_region(s, 0);
256 }
257
make_mpc(MPS2TZMachineState * mms,void * opaque,const char * name,hwaddr size)258 static MemoryRegion *make_mpc(MPS2TZMachineState *mms, void *opaque,
259 const char *name, hwaddr size)
260 {
261 TZMPC *mpc = opaque;
262 int i = mpc - &mms->ssram_mpc[0];
263 MemoryRegion *ssram = &mms->ssram[i];
264 MemoryRegion *upstream;
265 char *mpcname = g_strdup_printf("%s-mpc", name);
266 static uint32_t ramsize[] = { 0x00400000, 0x00200000, 0x00200000 };
267 static uint32_t rambase[] = { 0x00000000, 0x28000000, 0x28200000 };
268
269 memory_region_init_ram(ssram, NULL, name, ramsize[i], &error_fatal);
270
271 sysbus_init_child_obj(OBJECT(mms), mpcname, mpc, sizeof(mms->ssram_mpc[0]),
272 TYPE_TZ_MPC);
273 object_property_set_link(OBJECT(mpc), OBJECT(ssram),
274 "downstream", &error_fatal);
275 object_property_set_bool(OBJECT(mpc), true, "realized", &error_fatal);
276 /* Map the upstream end of the MPC into system memory */
277 upstream = sysbus_mmio_get_region(SYS_BUS_DEVICE(mpc), 1);
278 memory_region_add_subregion(get_system_memory(), rambase[i], upstream);
279 /* and connect its interrupt to the IoTKit */
280 qdev_connect_gpio_out_named(DEVICE(mpc), "irq", 0,
281 qdev_get_gpio_in_named(DEVICE(&mms->iotkit),
282 "mpcexp_status", i));
283
284 /* The first SSRAM is a special case as it has an alias; accesses to
285 * the alias region at 0x00400000 must also go to the MPC upstream.
286 */
287 if (i == 0) {
288 make_ram_alias(&mms->ssram1_m, "mps.ssram1_m", upstream, 0x00400000);
289 }
290
291 g_free(mpcname);
292 /* Return the register interface MR for our caller to map behind the PPC */
293 return sysbus_mmio_get_region(SYS_BUS_DEVICE(mpc), 0);
294 }
295
make_dma(MPS2TZMachineState * mms,void * opaque,const char * name,hwaddr size)296 static MemoryRegion *make_dma(MPS2TZMachineState *mms, void *opaque,
297 const char *name, hwaddr size)
298 {
299 PL080State *dma = opaque;
300 int i = dma - &mms->dma[0];
301 SysBusDevice *s;
302 char *mscname = g_strdup_printf("%s-msc", name);
303 TZMSC *msc = &mms->msc[i];
304 DeviceState *iotkitdev = DEVICE(&mms->iotkit);
305 MemoryRegion *msc_upstream;
306 MemoryRegion *msc_downstream;
307
308 /*
309 * Each DMA device is a PL081 whose transaction master interface
310 * is guarded by a Master Security Controller. The downstream end of
311 * the MSC connects to the IoTKit AHB Slave Expansion port, so the
312 * DMA devices can see all devices and memory that the CPU does.
313 */
314 sysbus_init_child_obj(OBJECT(mms), mscname, msc, sizeof(*msc), TYPE_TZ_MSC);
315 msc_downstream = sysbus_mmio_get_region(SYS_BUS_DEVICE(&mms->iotkit), 0);
316 object_property_set_link(OBJECT(msc), OBJECT(msc_downstream),
317 "downstream", &error_fatal);
318 object_property_set_link(OBJECT(msc), OBJECT(mms),
319 "idau", &error_fatal);
320 object_property_set_bool(OBJECT(msc), true, "realized", &error_fatal);
321
322 qdev_connect_gpio_out_named(DEVICE(msc), "irq", 0,
323 qdev_get_gpio_in_named(iotkitdev,
324 "mscexp_status", i));
325 qdev_connect_gpio_out_named(iotkitdev, "mscexp_clear", i,
326 qdev_get_gpio_in_named(DEVICE(msc),
327 "irq_clear", 0));
328 qdev_connect_gpio_out_named(iotkitdev, "mscexp_ns", i,
329 qdev_get_gpio_in_named(DEVICE(msc),
330 "cfg_nonsec", 0));
331 qdev_connect_gpio_out(DEVICE(&mms->sec_resp_splitter),
332 ARRAY_SIZE(mms->ppc) + i,
333 qdev_get_gpio_in_named(DEVICE(msc),
334 "cfg_sec_resp", 0));
335 msc_upstream = sysbus_mmio_get_region(SYS_BUS_DEVICE(msc), 0);
336
337 sysbus_init_child_obj(OBJECT(mms), name, dma, sizeof(*dma), TYPE_PL081);
338 object_property_set_link(OBJECT(dma), OBJECT(msc_upstream),
339 "downstream", &error_fatal);
340 object_property_set_bool(OBJECT(dma), true, "realized", &error_fatal);
341
342 s = SYS_BUS_DEVICE(dma);
343 /* Wire up DMACINTR, DMACINTERR, DMACINTTC */
344 sysbus_connect_irq(s, 0, get_sse_irq_in(mms, 58 + i * 3));
345 sysbus_connect_irq(s, 1, get_sse_irq_in(mms, 56 + i * 3));
346 sysbus_connect_irq(s, 2, get_sse_irq_in(mms, 57 + i * 3));
347
348 g_free(mscname);
349 return sysbus_mmio_get_region(s, 0);
350 }
351
make_spi(MPS2TZMachineState * mms,void * opaque,const char * name,hwaddr size)352 static MemoryRegion *make_spi(MPS2TZMachineState *mms, void *opaque,
353 const char *name, hwaddr size)
354 {
355 /*
356 * The AN505 has five PL022 SPI controllers.
357 * One of these should have the LCD controller behind it; the others
358 * are connected only to the FPGA's "general purpose SPI connector"
359 * or "shield" expansion connectors.
360 * Note that if we do implement devices behind SPI, the chip select
361 * lines are set via the "MISC" register in the MPS2 FPGAIO device.
362 */
363 PL022State *spi = opaque;
364 int i = spi - &mms->spi[0];
365 SysBusDevice *s;
366
367 sysbus_init_child_obj(OBJECT(mms), name, spi, sizeof(mms->spi[0]),
368 TYPE_PL022);
369 object_property_set_bool(OBJECT(spi), true, "realized", &error_fatal);
370 s = SYS_BUS_DEVICE(spi);
371 sysbus_connect_irq(s, 0, get_sse_irq_in(mms, 51 + i));
372 return sysbus_mmio_get_region(s, 0);
373 }
374
mps2tz_common_init(MachineState * machine)375 static void mps2tz_common_init(MachineState *machine)
376 {
377 MPS2TZMachineState *mms = MPS2TZ_MACHINE(machine);
378 MPS2TZMachineClass *mmc = MPS2TZ_MACHINE_GET_CLASS(mms);
379 MachineClass *mc = MACHINE_GET_CLASS(machine);
380 MemoryRegion *system_memory = get_system_memory();
381 DeviceState *iotkitdev;
382 DeviceState *dev_splitter;
383 int i;
384
385 if (strcmp(machine->cpu_type, mc->default_cpu_type) != 0) {
386 error_report("This board can only be used with CPU %s",
387 mc->default_cpu_type);
388 exit(1);
389 }
390
391 sysbus_init_child_obj(OBJECT(machine), "iotkit", &mms->iotkit,
392 sizeof(mms->iotkit), mmc->armsse_type);
393 iotkitdev = DEVICE(&mms->iotkit);
394 object_property_set_link(OBJECT(&mms->iotkit), OBJECT(system_memory),
395 "memory", &error_abort);
396 qdev_prop_set_uint32(iotkitdev, "EXP_NUMIRQ", MPS2TZ_NUMIRQ);
397 qdev_prop_set_uint32(iotkitdev, "MAINCLK", SYSCLK_FRQ);
398 object_property_set_bool(OBJECT(&mms->iotkit), true, "realized",
399 &error_fatal);
400
401 /*
402 * The AN521 needs us to create splitters to feed the IRQ inputs
403 * for each CPU in the SSE-200 from each device in the board.
404 */
405 if (mmc->fpga_type == FPGA_AN521) {
406 for (i = 0; i < MPS2TZ_NUMIRQ; i++) {
407 char *name = g_strdup_printf("mps2-irq-splitter%d", i);
408 SplitIRQ *splitter = &mms->cpu_irq_splitter[i];
409
410 object_initialize_child(OBJECT(machine), name,
411 splitter, sizeof(*splitter),
412 TYPE_SPLIT_IRQ, &error_fatal, NULL);
413 g_free(name);
414
415 object_property_set_int(OBJECT(splitter), 2, "num-lines",
416 &error_fatal);
417 object_property_set_bool(OBJECT(splitter), true, "realized",
418 &error_fatal);
419 qdev_connect_gpio_out(DEVICE(splitter), 0,
420 qdev_get_gpio_in_named(DEVICE(&mms->iotkit),
421 "EXP_IRQ", i));
422 qdev_connect_gpio_out(DEVICE(splitter), 1,
423 qdev_get_gpio_in_named(DEVICE(&mms->iotkit),
424 "EXP_CPU1_IRQ", i));
425 }
426 }
427
428 /* The sec_resp_cfg output from the IoTKit must be split into multiple
429 * lines, one for each of the PPCs we create here, plus one per MSC.
430 */
431 object_initialize_child(OBJECT(machine), "sec-resp-splitter",
432 &mms->sec_resp_splitter,
433 sizeof(mms->sec_resp_splitter),
434 TYPE_SPLIT_IRQ, &error_abort, NULL);
435 object_property_set_int(OBJECT(&mms->sec_resp_splitter),
436 ARRAY_SIZE(mms->ppc) + ARRAY_SIZE(mms->msc),
437 "num-lines", &error_fatal);
438 object_property_set_bool(OBJECT(&mms->sec_resp_splitter), true,
439 "realized", &error_fatal);
440 dev_splitter = DEVICE(&mms->sec_resp_splitter);
441 qdev_connect_gpio_out_named(iotkitdev, "sec_resp_cfg", 0,
442 qdev_get_gpio_in(dev_splitter, 0));
443
444 /* The IoTKit sets up much of the memory layout, including
445 * the aliases between secure and non-secure regions in the
446 * address space. The FPGA itself contains:
447 *
448 * 0x00000000..0x003fffff SSRAM1
449 * 0x00400000..0x007fffff alias of SSRAM1
450 * 0x28000000..0x283fffff 4MB SSRAM2 + SSRAM3
451 * 0x40100000..0x4fffffff AHB Master Expansion 1 interface devices
452 * 0x80000000..0x80ffffff 16MB PSRAM
453 */
454
455 /* The FPGA images have an odd combination of different RAMs,
456 * because in hardware they are different implementations and
457 * connected to different buses, giving varying performance/size
458 * tradeoffs. For QEMU they're all just RAM, though. We arbitrarily
459 * call the 16MB our "system memory", as it's the largest lump.
460 */
461 memory_region_allocate_system_memory(&mms->psram,
462 NULL, "mps.ram", 16 * MiB);
463 memory_region_add_subregion(system_memory, 0x80000000, &mms->psram);
464
465 /* The overflow IRQs for all UARTs are ORed together.
466 * Tx, Rx and "combined" IRQs are sent to the NVIC separately.
467 * Create the OR gate for this.
468 */
469 object_initialize_child(OBJECT(mms), "uart-irq-orgate",
470 &mms->uart_irq_orgate, sizeof(mms->uart_irq_orgate),
471 TYPE_OR_IRQ, &error_abort, NULL);
472 object_property_set_int(OBJECT(&mms->uart_irq_orgate), 10, "num-lines",
473 &error_fatal);
474 object_property_set_bool(OBJECT(&mms->uart_irq_orgate), true,
475 "realized", &error_fatal);
476 qdev_connect_gpio_out(DEVICE(&mms->uart_irq_orgate), 0,
477 get_sse_irq_in(mms, 15));
478
479 /* Most of the devices in the FPGA are behind Peripheral Protection
480 * Controllers. The required order for initializing things is:
481 * + initialize the PPC
482 * + initialize, configure and realize downstream devices
483 * + connect downstream device MemoryRegions to the PPC
484 * + realize the PPC
485 * + map the PPC's MemoryRegions to the places in the address map
486 * where the downstream devices should appear
487 * + wire up the PPC's control lines to the IoTKit object
488 */
489
490 const PPCInfo ppcs[] = { {
491 .name = "apb_ppcexp0",
492 .ports = {
493 { "ssram-0", make_mpc, &mms->ssram_mpc[0], 0x58007000, 0x1000 },
494 { "ssram-1", make_mpc, &mms->ssram_mpc[1], 0x58008000, 0x1000 },
495 { "ssram-2", make_mpc, &mms->ssram_mpc[2], 0x58009000, 0x1000 },
496 },
497 }, {
498 .name = "apb_ppcexp1",
499 .ports = {
500 { "spi0", make_spi, &mms->spi[0], 0x40205000, 0x1000 },
501 { "spi1", make_spi, &mms->spi[1], 0x40206000, 0x1000 },
502 { "spi2", make_spi, &mms->spi[2], 0x40209000, 0x1000 },
503 { "spi3", make_spi, &mms->spi[3], 0x4020a000, 0x1000 },
504 { "spi4", make_spi, &mms->spi[4], 0x4020b000, 0x1000 },
505 { "uart0", make_uart, &mms->uart[0], 0x40200000, 0x1000 },
506 { "uart1", make_uart, &mms->uart[1], 0x40201000, 0x1000 },
507 { "uart2", make_uart, &mms->uart[2], 0x40202000, 0x1000 },
508 { "uart3", make_uart, &mms->uart[3], 0x40203000, 0x1000 },
509 { "uart4", make_uart, &mms->uart[4], 0x40204000, 0x1000 },
510 { "i2c0", make_unimp_dev, &mms->i2c[0], 0x40207000, 0x1000 },
511 { "i2c1", make_unimp_dev, &mms->i2c[1], 0x40208000, 0x1000 },
512 { "i2c2", make_unimp_dev, &mms->i2c[2], 0x4020c000, 0x1000 },
513 { "i2c3", make_unimp_dev, &mms->i2c[3], 0x4020d000, 0x1000 },
514 },
515 }, {
516 .name = "apb_ppcexp2",
517 .ports = {
518 { "scc", make_scc, &mms->scc, 0x40300000, 0x1000 },
519 { "i2s-audio", make_unimp_dev, &mms->i2s_audio,
520 0x40301000, 0x1000 },
521 { "fpgaio", make_fpgaio, &mms->fpgaio, 0x40302000, 0x1000 },
522 },
523 }, {
524 .name = "ahb_ppcexp0",
525 .ports = {
526 { "gfx", make_unimp_dev, &mms->gfx, 0x41000000, 0x140000 },
527 { "gpio0", make_unimp_dev, &mms->gpio[0], 0x40100000, 0x1000 },
528 { "gpio1", make_unimp_dev, &mms->gpio[1], 0x40101000, 0x1000 },
529 { "gpio2", make_unimp_dev, &mms->gpio[2], 0x40102000, 0x1000 },
530 { "gpio3", make_unimp_dev, &mms->gpio[3], 0x40103000, 0x1000 },
531 { "eth", make_eth_dev, NULL, 0x42000000, 0x100000 },
532 },
533 }, {
534 .name = "ahb_ppcexp1",
535 .ports = {
536 { "dma0", make_dma, &mms->dma[0], 0x40110000, 0x1000 },
537 { "dma1", make_dma, &mms->dma[1], 0x40111000, 0x1000 },
538 { "dma2", make_dma, &mms->dma[2], 0x40112000, 0x1000 },
539 { "dma3", make_dma, &mms->dma[3], 0x40113000, 0x1000 },
540 },
541 },
542 };
543
544 for (i = 0; i < ARRAY_SIZE(ppcs); i++) {
545 const PPCInfo *ppcinfo = &ppcs[i];
546 TZPPC *ppc = &mms->ppc[i];
547 DeviceState *ppcdev;
548 int port;
549 char *gpioname;
550
551 sysbus_init_child_obj(OBJECT(machine), ppcinfo->name, ppc,
552 sizeof(TZPPC), TYPE_TZ_PPC);
553 ppcdev = DEVICE(ppc);
554
555 for (port = 0; port < TZ_NUM_PORTS; port++) {
556 const PPCPortInfo *pinfo = &ppcinfo->ports[port];
557 MemoryRegion *mr;
558 char *portname;
559
560 if (!pinfo->devfn) {
561 continue;
562 }
563
564 mr = pinfo->devfn(mms, pinfo->opaque, pinfo->name, pinfo->size);
565 portname = g_strdup_printf("port[%d]", port);
566 object_property_set_link(OBJECT(ppc), OBJECT(mr),
567 portname, &error_fatal);
568 g_free(portname);
569 }
570
571 object_property_set_bool(OBJECT(ppc), true, "realized", &error_fatal);
572
573 for (port = 0; port < TZ_NUM_PORTS; port++) {
574 const PPCPortInfo *pinfo = &ppcinfo->ports[port];
575
576 if (!pinfo->devfn) {
577 continue;
578 }
579 sysbus_mmio_map(SYS_BUS_DEVICE(ppc), port, pinfo->addr);
580
581 gpioname = g_strdup_printf("%s_nonsec", ppcinfo->name);
582 qdev_connect_gpio_out_named(iotkitdev, gpioname, port,
583 qdev_get_gpio_in_named(ppcdev,
584 "cfg_nonsec",
585 port));
586 g_free(gpioname);
587 gpioname = g_strdup_printf("%s_ap", ppcinfo->name);
588 qdev_connect_gpio_out_named(iotkitdev, gpioname, port,
589 qdev_get_gpio_in_named(ppcdev,
590 "cfg_ap", port));
591 g_free(gpioname);
592 }
593
594 gpioname = g_strdup_printf("%s_irq_enable", ppcinfo->name);
595 qdev_connect_gpio_out_named(iotkitdev, gpioname, 0,
596 qdev_get_gpio_in_named(ppcdev,
597 "irq_enable", 0));
598 g_free(gpioname);
599 gpioname = g_strdup_printf("%s_irq_clear", ppcinfo->name);
600 qdev_connect_gpio_out_named(iotkitdev, gpioname, 0,
601 qdev_get_gpio_in_named(ppcdev,
602 "irq_clear", 0));
603 g_free(gpioname);
604 gpioname = g_strdup_printf("%s_irq_status", ppcinfo->name);
605 qdev_connect_gpio_out_named(ppcdev, "irq", 0,
606 qdev_get_gpio_in_named(iotkitdev,
607 gpioname, 0));
608 g_free(gpioname);
609
610 qdev_connect_gpio_out(dev_splitter, i,
611 qdev_get_gpio_in_named(ppcdev,
612 "cfg_sec_resp", 0));
613 }
614
615 create_unimplemented_device("FPGA NS PC", 0x48007000, 0x1000);
616
617 armv7m_load_kernel(ARM_CPU(first_cpu), machine->kernel_filename, 0x400000);
618 }
619
mps2_tz_idau_check(IDAUInterface * ii,uint32_t address,int * iregion,bool * exempt,bool * ns,bool * nsc)620 static void mps2_tz_idau_check(IDAUInterface *ii, uint32_t address,
621 int *iregion, bool *exempt, bool *ns, bool *nsc)
622 {
623 /*
624 * The MPS2 TZ FPGA images have IDAUs in them which are connected to
625 * the Master Security Controllers. Thes have the same logic as
626 * is used by the IoTKit for the IDAU connected to the CPU, except
627 * that MSCs don't care about the NSC attribute.
628 */
629 int region = extract32(address, 28, 4);
630
631 *ns = !(region & 1);
632 *nsc = false;
633 /* 0xe0000000..0xe00fffff and 0xf0000000..0xf00fffff are exempt */
634 *exempt = (address & 0xeff00000) == 0xe0000000;
635 *iregion = region;
636 }
637
mps2tz_class_init(ObjectClass * oc,void * data)638 static void mps2tz_class_init(ObjectClass *oc, void *data)
639 {
640 MachineClass *mc = MACHINE_CLASS(oc);
641 IDAUInterfaceClass *iic = IDAU_INTERFACE_CLASS(oc);
642
643 mc->init = mps2tz_common_init;
644 iic->check = mps2_tz_idau_check;
645 }
646
mps2tz_an505_class_init(ObjectClass * oc,void * data)647 static void mps2tz_an505_class_init(ObjectClass *oc, void *data)
648 {
649 MachineClass *mc = MACHINE_CLASS(oc);
650 MPS2TZMachineClass *mmc = MPS2TZ_MACHINE_CLASS(oc);
651
652 mc->desc = "ARM MPS2 with AN505 FPGA image for Cortex-M33";
653 mc->default_cpus = 1;
654 mc->min_cpus = mc->default_cpus;
655 mc->max_cpus = mc->default_cpus;
656 mmc->fpga_type = FPGA_AN505;
657 mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-m33");
658 mmc->scc_id = 0x41045050;
659 mmc->armsse_type = TYPE_IOTKIT;
660 }
661
mps2tz_an521_class_init(ObjectClass * oc,void * data)662 static void mps2tz_an521_class_init(ObjectClass *oc, void *data)
663 {
664 MachineClass *mc = MACHINE_CLASS(oc);
665 MPS2TZMachineClass *mmc = MPS2TZ_MACHINE_CLASS(oc);
666
667 mc->desc = "ARM MPS2 with AN521 FPGA image for dual Cortex-M33";
668 mc->default_cpus = 2;
669 mc->min_cpus = mc->default_cpus;
670 mc->max_cpus = mc->default_cpus;
671 mmc->fpga_type = FPGA_AN521;
672 mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-m33");
673 mmc->scc_id = 0x41045210;
674 mmc->armsse_type = TYPE_SSE200;
675 }
676
677 static const TypeInfo mps2tz_info = {
678 .name = TYPE_MPS2TZ_MACHINE,
679 .parent = TYPE_MACHINE,
680 .abstract = true,
681 .instance_size = sizeof(MPS2TZMachineState),
682 .class_size = sizeof(MPS2TZMachineClass),
683 .class_init = mps2tz_class_init,
684 .interfaces = (InterfaceInfo[]) {
685 { TYPE_IDAU_INTERFACE },
686 { }
687 },
688 };
689
690 static const TypeInfo mps2tz_an505_info = {
691 .name = TYPE_MPS2TZ_AN505_MACHINE,
692 .parent = TYPE_MPS2TZ_MACHINE,
693 .class_init = mps2tz_an505_class_init,
694 };
695
696 static const TypeInfo mps2tz_an521_info = {
697 .name = TYPE_MPS2TZ_AN521_MACHINE,
698 .parent = TYPE_MPS2TZ_MACHINE,
699 .class_init = mps2tz_an521_class_init,
700 };
701
mps2tz_machine_init(void)702 static void mps2tz_machine_init(void)
703 {
704 type_register_static(&mps2tz_info);
705 type_register_static(&mps2tz_an505_info);
706 type_register_static(&mps2tz_an521_info);
707 }
708
709 type_init(mps2tz_machine_init);
710