xref: /qemu/hw/arm/musca.c (revision 834e8bf1)
1 /*
2  * Arm Musca-B1 test chip board emulation
3  *
4  * Copyright (c) 2019 Linaro Limited
5  * Written by Peter Maydell
6  *
7  *  This program is free software; you can redistribute it and/or modify
8  *  it under the terms of the GNU General Public License version 2 or
9  *  (at your option) any later version.
10  */
11 
12 /*
13  * The Musca boards are a reference implementation of a system using
14  * the SSE-200 subsystem for embedded:
15  * https://developer.arm.com/products/system-design/development-boards/iot-test-chips-and-boards/musca-a-test-chip-board
16  * https://developer.arm.com/products/system-design/development-boards/iot-test-chips-and-boards/musca-b-test-chip-board
17  * We model the A and B1 variants of this board, as described in the TRMs:
18  * http://infocenter.arm.com/help/topic/com.arm.doc.101107_0000_00_en/index.html
19  * http://infocenter.arm.com/help/topic/com.arm.doc.101312_0000_00_en/index.html
20  */
21 
22 #include "qemu/osdep.h"
23 #include "qemu/error-report.h"
24 #include "qapi/error.h"
25 #include "exec/address-spaces.h"
26 #include "sysemu/sysemu.h"
27 #include "hw/arm/boot.h"
28 #include "hw/arm/armsse.h"
29 #include "hw/boards.h"
30 #include "hw/char/pl011.h"
31 #include "hw/core/split-irq.h"
32 #include "hw/misc/tz-mpc.h"
33 #include "hw/misc/tz-ppc.h"
34 #include "hw/misc/unimp.h"
35 #include "hw/rtc/pl031.h"
36 
37 #define MUSCA_NUMIRQ_MAX 96
38 #define MUSCA_PPC_MAX 3
39 #define MUSCA_MPC_MAX 5
40 
41 typedef struct MPCInfo MPCInfo;
42 
43 typedef enum MuscaType {
44     MUSCA_A,
45     MUSCA_B1,
46 } MuscaType;
47 
48 typedef struct {
49     MachineClass parent;
50     MuscaType type;
51     uint32_t init_svtor;
52     int sram_addr_width;
53     int num_irqs;
54     const MPCInfo *mpc_info;
55     int num_mpcs;
56 } MuscaMachineClass;
57 
58 typedef struct {
59     MachineState parent;
60 
61     ARMSSE sse;
62     /* RAM and flash */
63     MemoryRegion ram[MUSCA_MPC_MAX];
64     SplitIRQ cpu_irq_splitter[MUSCA_NUMIRQ_MAX];
65     SplitIRQ sec_resp_splitter;
66     TZPPC ppc[MUSCA_PPC_MAX];
67     MemoryRegion container;
68     UnimplementedDeviceState eflash[2];
69     UnimplementedDeviceState qspi;
70     TZMPC mpc[MUSCA_MPC_MAX];
71     UnimplementedDeviceState mhu[2];
72     UnimplementedDeviceState pwm[3];
73     UnimplementedDeviceState i2s;
74     PL011State uart[2];
75     UnimplementedDeviceState i2c[2];
76     UnimplementedDeviceState spi;
77     UnimplementedDeviceState scc;
78     UnimplementedDeviceState timer;
79     PL031State rtc;
80     UnimplementedDeviceState pvt;
81     UnimplementedDeviceState sdio;
82     UnimplementedDeviceState gpio;
83     UnimplementedDeviceState cryptoisland;
84 } MuscaMachineState;
85 
86 #define TYPE_MUSCA_MACHINE "musca"
87 #define TYPE_MUSCA_A_MACHINE MACHINE_TYPE_NAME("musca-a")
88 #define TYPE_MUSCA_B1_MACHINE MACHINE_TYPE_NAME("musca-b1")
89 
90 #define MUSCA_MACHINE(obj) \
91     OBJECT_CHECK(MuscaMachineState, obj, TYPE_MUSCA_MACHINE)
92 #define MUSCA_MACHINE_GET_CLASS(obj) \
93     OBJECT_GET_CLASS(MuscaMachineClass, obj, TYPE_MUSCA_MACHINE)
94 #define MUSCA_MACHINE_CLASS(klass) \
95     OBJECT_CLASS_CHECK(MuscaMachineClass, klass, TYPE_MUSCA_MACHINE)
96 
97 /*
98  * Main SYSCLK frequency in Hz
99  * TODO this should really be different for the two cores, but we
100  * don't model that in our SSE-200 model yet.
101  */
102 #define SYSCLK_FRQ 40000000
103 
104 static qemu_irq get_sse_irq_in(MuscaMachineState *mms, int irqno)
105 {
106     /* Return a qemu_irq which will signal IRQ n to all CPUs in the SSE. */
107     assert(irqno < MUSCA_NUMIRQ_MAX);
108 
109     return qdev_get_gpio_in(DEVICE(&mms->cpu_irq_splitter[irqno]), 0);
110 }
111 
112 /*
113  * Most of the devices in the Musca board sit behind Peripheral Protection
114  * Controllers. These data structures define the layout of which devices
115  * sit behind which PPCs.
116  * The devfn for each port is a function which creates, configures
117  * and initializes the device, returning the MemoryRegion which
118  * needs to be plugged into the downstream end of the PPC port.
119  */
120 typedef MemoryRegion *MakeDevFn(MuscaMachineState *mms, void *opaque,
121                                 const char *name, hwaddr size);
122 
123 typedef struct PPCPortInfo {
124     const char *name;
125     MakeDevFn *devfn;
126     void *opaque;
127     hwaddr addr;
128     hwaddr size;
129 } PPCPortInfo;
130 
131 typedef struct PPCInfo {
132     const char *name;
133     PPCPortInfo ports[TZ_NUM_PORTS];
134 } PPCInfo;
135 
136 static MemoryRegion *make_unimp_dev(MuscaMachineState *mms,
137                                     void *opaque, const char *name, hwaddr size)
138 {
139     /*
140      * Initialize, configure and realize a TYPE_UNIMPLEMENTED_DEVICE,
141      * and return a pointer to its MemoryRegion.
142      */
143     UnimplementedDeviceState *uds = opaque;
144 
145     sysbus_init_child_obj(OBJECT(mms), name, uds,
146                           sizeof(UnimplementedDeviceState),
147                           TYPE_UNIMPLEMENTED_DEVICE);
148     qdev_prop_set_string(DEVICE(uds), "name", name);
149     qdev_prop_set_uint64(DEVICE(uds), "size", size);
150     object_property_set_bool(OBJECT(uds), true, "realized", &error_fatal);
151     return sysbus_mmio_get_region(SYS_BUS_DEVICE(uds), 0);
152 }
153 
154 typedef enum MPCInfoType {
155     MPC_RAM,
156     MPC_ROM,
157     MPC_CRYPTOISLAND,
158 } MPCInfoType;
159 
160 struct MPCInfo {
161     const char *name;
162     hwaddr addr;
163     hwaddr size;
164     MPCInfoType type;
165 };
166 
167 /* Order of the MPCs here must match the order of the bits in SECMPCINTSTATUS */
168 static const MPCInfo a_mpc_info[] = { {
169         .name = "qspi",
170         .type = MPC_ROM,
171         .addr = 0x00200000,
172         .size = 0x00800000,
173     }, {
174         .name = "sram",
175         .type = MPC_RAM,
176         .addr = 0x00000000,
177         .size = 0x00200000,
178     }
179 };
180 
181 static const MPCInfo b1_mpc_info[] = { {
182         .name = "qspi",
183         .type = MPC_ROM,
184         .addr = 0x00000000,
185         .size = 0x02000000,
186     }, {
187         .name = "sram",
188         .type = MPC_RAM,
189         .addr = 0x0a400000,
190         .size = 0x00080000,
191     }, {
192         .name = "eflash0",
193         .type = MPC_ROM,
194         .addr = 0x0a000000,
195         .size = 0x00200000,
196     }, {
197         .name = "eflash1",
198         .type = MPC_ROM,
199         .addr = 0x0a200000,
200         .size = 0x00200000,
201     }, {
202         .name = "cryptoisland",
203         .type = MPC_CRYPTOISLAND,
204         .addr = 0x0a000000,
205         .size = 0x00200000,
206     }
207 };
208 
209 static MemoryRegion *make_mpc(MuscaMachineState *mms, void *opaque,
210                               const char *name, hwaddr size)
211 {
212     /*
213      * Create an MPC and the RAM or flash behind it.
214      * MPC 0: eFlash 0
215      * MPC 1: eFlash 1
216      * MPC 2: SRAM
217      * MPC 3: QSPI flash
218      * MPC 4: CryptoIsland
219      * For now we implement the flash regions as ROM (ie not programmable)
220      * (with their control interface memory regions being unimplemented
221      * stubs behind the PPCs).
222      * The whole CryptoIsland region behind its MPC is an unimplemented stub.
223      */
224     MuscaMachineClass *mmc = MUSCA_MACHINE_GET_CLASS(mms);
225     TZMPC *mpc = opaque;
226     int i = mpc - &mms->mpc[0];
227     MemoryRegion *downstream;
228     MemoryRegion *upstream;
229     UnimplementedDeviceState *uds;
230     char *mpcname;
231     const MPCInfo *mpcinfo = mmc->mpc_info;
232 
233     mpcname = g_strdup_printf("%s-mpc", mpcinfo[i].name);
234 
235     switch (mpcinfo[i].type) {
236     case MPC_ROM:
237         downstream = &mms->ram[i];
238         memory_region_init_rom(downstream, NULL, mpcinfo[i].name,
239                                mpcinfo[i].size, &error_fatal);
240         break;
241     case MPC_RAM:
242         downstream = &mms->ram[i];
243         memory_region_init_ram(downstream, NULL, mpcinfo[i].name,
244                                mpcinfo[i].size, &error_fatal);
245         break;
246     case MPC_CRYPTOISLAND:
247         /* We don't implement the CryptoIsland yet */
248         uds = &mms->cryptoisland;
249         sysbus_init_child_obj(OBJECT(mms), name, uds,
250                               sizeof(UnimplementedDeviceState),
251                               TYPE_UNIMPLEMENTED_DEVICE);
252         qdev_prop_set_string(DEVICE(uds), "name", mpcinfo[i].name);
253         qdev_prop_set_uint64(DEVICE(uds), "size", mpcinfo[i].size);
254         object_property_set_bool(OBJECT(uds), true, "realized", &error_fatal);
255         downstream = sysbus_mmio_get_region(SYS_BUS_DEVICE(uds), 0);
256         break;
257     default:
258         g_assert_not_reached();
259     }
260 
261     sysbus_init_child_obj(OBJECT(mms), mpcname, mpc, sizeof(mms->mpc[0]),
262                           TYPE_TZ_MPC);
263     object_property_set_link(OBJECT(mpc), OBJECT(downstream),
264                              "downstream", &error_fatal);
265     object_property_set_bool(OBJECT(mpc), true, "realized", &error_fatal);
266     /* Map the upstream end of the MPC into system memory */
267     upstream = sysbus_mmio_get_region(SYS_BUS_DEVICE(mpc), 1);
268     memory_region_add_subregion(get_system_memory(), mpcinfo[i].addr, upstream);
269     /* and connect its interrupt to the SSE-200 */
270     qdev_connect_gpio_out_named(DEVICE(mpc), "irq", 0,
271                                 qdev_get_gpio_in_named(DEVICE(&mms->sse),
272                                                        "mpcexp_status", i));
273 
274     g_free(mpcname);
275     /* Return the register interface MR for our caller to map behind the PPC */
276     return sysbus_mmio_get_region(SYS_BUS_DEVICE(mpc), 0);
277 }
278 
279 static MemoryRegion *make_rtc(MuscaMachineState *mms, void *opaque,
280                               const char *name, hwaddr size)
281 {
282     PL031State *rtc = opaque;
283 
284     sysbus_init_child_obj(OBJECT(mms), name, rtc, sizeof(mms->rtc), TYPE_PL031);
285     object_property_set_bool(OBJECT(rtc), true, "realized", &error_fatal);
286     sysbus_connect_irq(SYS_BUS_DEVICE(rtc), 0, get_sse_irq_in(mms, 39));
287     return sysbus_mmio_get_region(SYS_BUS_DEVICE(rtc), 0);
288 }
289 
290 static MemoryRegion *make_uart(MuscaMachineState *mms, void *opaque,
291                                const char *name, hwaddr size)
292 {
293     PL011State *uart = opaque;
294     int i = uart - &mms->uart[0];
295     int irqbase = 7 + i * 6;
296     SysBusDevice *s;
297 
298     sysbus_init_child_obj(OBJECT(mms), name, uart, sizeof(mms->uart[0]),
299                           TYPE_PL011);
300     qdev_prop_set_chr(DEVICE(uart), "chardev", serial_hd(i));
301     object_property_set_bool(OBJECT(uart), true, "realized", &error_fatal);
302     s = SYS_BUS_DEVICE(uart);
303     sysbus_connect_irq(s, 0, get_sse_irq_in(mms, irqbase + 5)); /* combined */
304     sysbus_connect_irq(s, 1, get_sse_irq_in(mms, irqbase + 0)); /* RX */
305     sysbus_connect_irq(s, 2, get_sse_irq_in(mms, irqbase + 1)); /* TX */
306     sysbus_connect_irq(s, 3, get_sse_irq_in(mms, irqbase + 2)); /* RT */
307     sysbus_connect_irq(s, 4, get_sse_irq_in(mms, irqbase + 3)); /* MS */
308     sysbus_connect_irq(s, 5, get_sse_irq_in(mms, irqbase + 4)); /* E */
309     return sysbus_mmio_get_region(SYS_BUS_DEVICE(uart), 0);
310 }
311 
312 static MemoryRegion *make_musca_a_devs(MuscaMachineState *mms, void *opaque,
313                                        const char *name, hwaddr size)
314 {
315     /*
316      * Create the container MemoryRegion for all the devices that live
317      * behind the Musca-A PPC's single port. These devices don't have a PPC
318      * port each, but we use the PPCPortInfo struct as a convenient way
319      * to describe them. Note that addresses here are relative to the base
320      * address of the PPC port region: 0x40100000, and devices appear both
321      * at the 0x4... NS region and the 0x5... S region.
322      */
323     int i;
324     MemoryRegion *container = &mms->container;
325 
326     const PPCPortInfo devices[] = {
327         { "uart0", make_uart, &mms->uart[0], 0x1000, 0x1000 },
328         { "uart1", make_uart, &mms->uart[1], 0x2000, 0x1000 },
329         { "spi", make_unimp_dev, &mms->spi, 0x3000, 0x1000 },
330         { "i2c0", make_unimp_dev, &mms->i2c[0], 0x4000, 0x1000 },
331         { "i2c1", make_unimp_dev, &mms->i2c[1], 0x5000, 0x1000 },
332         { "i2s", make_unimp_dev, &mms->i2s, 0x6000, 0x1000 },
333         { "pwm0", make_unimp_dev, &mms->pwm[0], 0x7000, 0x1000 },
334         { "rtc", make_rtc, &mms->rtc, 0x8000, 0x1000 },
335         { "qspi", make_unimp_dev, &mms->qspi, 0xa000, 0x1000 },
336         { "timer", make_unimp_dev, &mms->timer, 0xb000, 0x1000 },
337         { "scc", make_unimp_dev, &mms->scc, 0xc000, 0x1000 },
338         { "pwm1", make_unimp_dev, &mms->pwm[1], 0xe000, 0x1000 },
339         { "pwm2", make_unimp_dev, &mms->pwm[2], 0xf000, 0x1000 },
340         { "gpio", make_unimp_dev, &mms->gpio, 0x10000, 0x1000 },
341         { "mpc0", make_mpc, &mms->mpc[0], 0x12000, 0x1000 },
342         { "mpc1", make_mpc, &mms->mpc[1], 0x13000, 0x1000 },
343     };
344 
345     memory_region_init(container, OBJECT(mms), "musca-device-container", size);
346 
347     for (i = 0; i < ARRAY_SIZE(devices); i++) {
348         const PPCPortInfo *pinfo = &devices[i];
349         MemoryRegion *mr;
350 
351         mr = pinfo->devfn(mms, pinfo->opaque, pinfo->name, pinfo->size);
352         memory_region_add_subregion(container, pinfo->addr, mr);
353     }
354 
355     return &mms->container;
356 }
357 
358 static void musca_init(MachineState *machine)
359 {
360     MuscaMachineState *mms = MUSCA_MACHINE(machine);
361     MuscaMachineClass *mmc = MUSCA_MACHINE_GET_CLASS(mms);
362     MachineClass *mc = MACHINE_GET_CLASS(machine);
363     MemoryRegion *system_memory = get_system_memory();
364     DeviceState *ssedev;
365     DeviceState *dev_splitter;
366     const PPCInfo *ppcs;
367     int num_ppcs;
368     int i;
369 
370     assert(mmc->num_irqs <= MUSCA_NUMIRQ_MAX);
371     assert(mmc->num_mpcs <= MUSCA_MPC_MAX);
372 
373     if (strcmp(machine->cpu_type, mc->default_cpu_type) != 0) {
374         error_report("This board can only be used with CPU %s",
375                      mc->default_cpu_type);
376         exit(1);
377     }
378 
379     sysbus_init_child_obj(OBJECT(machine), "sse-200", &mms->sse,
380                           sizeof(mms->sse), TYPE_SSE200);
381     ssedev = DEVICE(&mms->sse);
382     object_property_set_link(OBJECT(&mms->sse), OBJECT(system_memory),
383                              "memory", &error_fatal);
384     qdev_prop_set_uint32(ssedev, "EXP_NUMIRQ", mmc->num_irqs);
385     qdev_prop_set_uint32(ssedev, "init-svtor", mmc->init_svtor);
386     qdev_prop_set_uint32(ssedev, "SRAM_ADDR_WIDTH", mmc->sram_addr_width);
387     qdev_prop_set_uint32(ssedev, "MAINCLK", SYSCLK_FRQ);
388     /*
389      * Musca-A takes the default SSE-200 FPU/DSP settings (ie no for
390      * CPU0 and yes for CPU1); Musca-B1 explicitly enables them for CPU0.
391      */
392     if (mmc->type == MUSCA_B1) {
393         qdev_prop_set_bit(ssedev, "CPU0_FPU", true);
394         qdev_prop_set_bit(ssedev, "CPU0_DSP", true);
395     }
396     object_property_set_bool(OBJECT(&mms->sse), true, "realized",
397                              &error_fatal);
398 
399     /*
400      * We need to create splitters to feed the IRQ inputs
401      * for each CPU in the SSE-200 from each device in the board.
402      */
403     for (i = 0; i < mmc->num_irqs; i++) {
404         char *name = g_strdup_printf("musca-irq-splitter%d", i);
405         SplitIRQ *splitter = &mms->cpu_irq_splitter[i];
406 
407         object_initialize_child(OBJECT(machine), name,
408                                 splitter, sizeof(*splitter),
409                                 TYPE_SPLIT_IRQ, &error_fatal, NULL);
410         g_free(name);
411 
412         object_property_set_int(OBJECT(splitter), 2, "num-lines",
413                                 &error_fatal);
414         object_property_set_bool(OBJECT(splitter), true, "realized",
415                                  &error_fatal);
416         qdev_connect_gpio_out(DEVICE(splitter), 0,
417                               qdev_get_gpio_in_named(ssedev, "EXP_IRQ", i));
418         qdev_connect_gpio_out(DEVICE(splitter), 1,
419                               qdev_get_gpio_in_named(ssedev,
420                                                      "EXP_CPU1_IRQ", i));
421     }
422 
423     /*
424      * The sec_resp_cfg output from the SSE-200 must be split into multiple
425      * lines, one for each of the PPCs we create here.
426      */
427     object_initialize_child(OBJECT(machine), "sec-resp-splitter",
428                             &mms->sec_resp_splitter,
429                             sizeof(mms->sec_resp_splitter),
430                             TYPE_SPLIT_IRQ, &error_fatal, NULL);
431 
432     object_property_set_int(OBJECT(&mms->sec_resp_splitter),
433                             ARRAY_SIZE(mms->ppc), "num-lines", &error_fatal);
434     object_property_set_bool(OBJECT(&mms->sec_resp_splitter), true,
435                              "realized", &error_fatal);
436     dev_splitter = DEVICE(&mms->sec_resp_splitter);
437     qdev_connect_gpio_out_named(ssedev, "sec_resp_cfg", 0,
438                                 qdev_get_gpio_in(dev_splitter, 0));
439 
440     /*
441      * Most of the devices in the board are behind Peripheral Protection
442      * Controllers. The required order for initializing things is:
443      *  + initialize the PPC
444      *  + initialize, configure and realize downstream devices
445      *  + connect downstream device MemoryRegions to the PPC
446      *  + realize the PPC
447      *  + map the PPC's MemoryRegions to the places in the address map
448      *    where the downstream devices should appear
449      *  + wire up the PPC's control lines to the SSE object
450      *
451      * The PPC mapping differs for the -A and -B1 variants; the -A version
452      * is much simpler, using only a single port of a single PPC and putting
453      * all the devices behind that.
454      */
455     const PPCInfo a_ppcs[] = { {
456             .name = "ahb_ppcexp0",
457             .ports = {
458                 { "musca-devices", make_musca_a_devs, 0, 0x40100000, 0x100000 },
459             },
460         },
461     };
462 
463     /*
464      * Devices listed with an 0x4.. address appear in both the NS 0x4.. region
465      * and the 0x5.. S region. Devices listed with an 0x5.. address appear
466      * only in the S region.
467      */
468     const PPCInfo b1_ppcs[] = { {
469             .name = "apb_ppcexp0",
470             .ports = {
471                 { "eflash0", make_unimp_dev, &mms->eflash[0],
472                   0x52400000, 0x1000 },
473                 { "eflash1", make_unimp_dev, &mms->eflash[1],
474                   0x52500000, 0x1000 },
475                 { "qspi", make_unimp_dev, &mms->qspi, 0x42800000, 0x100000 },
476                 { "mpc0", make_mpc, &mms->mpc[0], 0x52000000, 0x1000 },
477                 { "mpc1", make_mpc, &mms->mpc[1], 0x52100000, 0x1000 },
478                 { "mpc2", make_mpc, &mms->mpc[2], 0x52200000, 0x1000 },
479                 { "mpc3", make_mpc, &mms->mpc[3], 0x52300000, 0x1000 },
480                 { "mhu0", make_unimp_dev, &mms->mhu[0], 0x42600000, 0x100000 },
481                 { "mhu1", make_unimp_dev, &mms->mhu[1], 0x42700000, 0x100000 },
482                 { }, /* port 9: unused */
483                 { }, /* port 10: unused */
484                 { }, /* port 11: unused */
485                 { }, /* port 12: unused */
486                 { }, /* port 13: unused */
487                 { "mpc4", make_mpc, &mms->mpc[4], 0x52e00000, 0x1000 },
488             },
489         }, {
490             .name = "apb_ppcexp1",
491             .ports = {
492                 { "pwm0", make_unimp_dev, &mms->pwm[0], 0x40101000, 0x1000 },
493                 { "pwm1", make_unimp_dev, &mms->pwm[1], 0x40102000, 0x1000 },
494                 { "pwm2", make_unimp_dev, &mms->pwm[2], 0x40103000, 0x1000 },
495                 { "i2s", make_unimp_dev, &mms->i2s, 0x40104000, 0x1000 },
496                 { "uart0", make_uart, &mms->uart[0], 0x40105000, 0x1000 },
497                 { "uart1", make_uart, &mms->uart[1], 0x40106000, 0x1000 },
498                 { "i2c0", make_unimp_dev, &mms->i2c[0], 0x40108000, 0x1000 },
499                 { "i2c1", make_unimp_dev, &mms->i2c[1], 0x40109000, 0x1000 },
500                 { "spi", make_unimp_dev, &mms->spi, 0x4010a000, 0x1000 },
501                 { "scc", make_unimp_dev, &mms->scc, 0x5010b000, 0x1000 },
502                 { "timer", make_unimp_dev, &mms->timer, 0x4010c000, 0x1000 },
503                 { "rtc", make_rtc, &mms->rtc, 0x4010d000, 0x1000 },
504                 { "pvt", make_unimp_dev, &mms->pvt, 0x4010e000, 0x1000 },
505                 { "sdio", make_unimp_dev, &mms->sdio, 0x4010f000, 0x1000 },
506             },
507         }, {
508             .name = "ahb_ppcexp0",
509             .ports = {
510                 { }, /* port 0: unused */
511                 { "gpio", make_unimp_dev, &mms->gpio, 0x41000000, 0x1000 },
512             },
513         },
514     };
515 
516     switch (mmc->type) {
517     case MUSCA_A:
518         ppcs = a_ppcs;
519         num_ppcs = ARRAY_SIZE(a_ppcs);
520         break;
521     case MUSCA_B1:
522         ppcs = b1_ppcs;
523         num_ppcs = ARRAY_SIZE(b1_ppcs);
524         break;
525     default:
526         g_assert_not_reached();
527     }
528     assert(num_ppcs <= MUSCA_PPC_MAX);
529 
530     for (i = 0; i < num_ppcs; i++) {
531         const PPCInfo *ppcinfo = &ppcs[i];
532         TZPPC *ppc = &mms->ppc[i];
533         DeviceState *ppcdev;
534         int port;
535         char *gpioname;
536 
537         sysbus_init_child_obj(OBJECT(machine), ppcinfo->name, ppc,
538                               sizeof(TZPPC), TYPE_TZ_PPC);
539         ppcdev = DEVICE(ppc);
540 
541         for (port = 0; port < TZ_NUM_PORTS; port++) {
542             const PPCPortInfo *pinfo = &ppcinfo->ports[port];
543             MemoryRegion *mr;
544             char *portname;
545 
546             if (!pinfo->devfn) {
547                 continue;
548             }
549 
550             mr = pinfo->devfn(mms, pinfo->opaque, pinfo->name, pinfo->size);
551             portname = g_strdup_printf("port[%d]", port);
552             object_property_set_link(OBJECT(ppc), OBJECT(mr),
553                                      portname, &error_fatal);
554             g_free(portname);
555         }
556 
557         object_property_set_bool(OBJECT(ppc), true, "realized", &error_fatal);
558 
559         for (port = 0; port < TZ_NUM_PORTS; port++) {
560             const PPCPortInfo *pinfo = &ppcinfo->ports[port];
561 
562             if (!pinfo->devfn) {
563                 continue;
564             }
565             sysbus_mmio_map(SYS_BUS_DEVICE(ppc), port, pinfo->addr);
566 
567             gpioname = g_strdup_printf("%s_nonsec", ppcinfo->name);
568             qdev_connect_gpio_out_named(ssedev, gpioname, port,
569                                         qdev_get_gpio_in_named(ppcdev,
570                                                                "cfg_nonsec",
571                                                                port));
572             g_free(gpioname);
573             gpioname = g_strdup_printf("%s_ap", ppcinfo->name);
574             qdev_connect_gpio_out_named(ssedev, gpioname, port,
575                                         qdev_get_gpio_in_named(ppcdev,
576                                                                "cfg_ap", port));
577             g_free(gpioname);
578         }
579 
580         gpioname = g_strdup_printf("%s_irq_enable", ppcinfo->name);
581         qdev_connect_gpio_out_named(ssedev, gpioname, 0,
582                                     qdev_get_gpio_in_named(ppcdev,
583                                                            "irq_enable", 0));
584         g_free(gpioname);
585         gpioname = g_strdup_printf("%s_irq_clear", ppcinfo->name);
586         qdev_connect_gpio_out_named(ssedev, gpioname, 0,
587                                     qdev_get_gpio_in_named(ppcdev,
588                                                            "irq_clear", 0));
589         g_free(gpioname);
590         gpioname = g_strdup_printf("%s_irq_status", ppcinfo->name);
591         qdev_connect_gpio_out_named(ppcdev, "irq", 0,
592                                     qdev_get_gpio_in_named(ssedev,
593                                                            gpioname, 0));
594         g_free(gpioname);
595 
596         qdev_connect_gpio_out(dev_splitter, i,
597                               qdev_get_gpio_in_named(ppcdev,
598                                                      "cfg_sec_resp", 0));
599     }
600 
601     armv7m_load_kernel(ARM_CPU(first_cpu), machine->kernel_filename, 0x2000000);
602 }
603 
604 static void musca_class_init(ObjectClass *oc, void *data)
605 {
606     MachineClass *mc = MACHINE_CLASS(oc);
607 
608     mc->default_cpus = 2;
609     mc->min_cpus = mc->default_cpus;
610     mc->max_cpus = mc->default_cpus;
611     mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-m33");
612     mc->init = musca_init;
613 }
614 
615 static void musca_a_class_init(ObjectClass *oc, void *data)
616 {
617     MachineClass *mc = MACHINE_CLASS(oc);
618     MuscaMachineClass *mmc = MUSCA_MACHINE_CLASS(oc);
619 
620     mc->desc = "ARM Musca-A board (dual Cortex-M33)";
621     mmc->type = MUSCA_A;
622     mmc->init_svtor = 0x10200000;
623     mmc->sram_addr_width = 15;
624     mmc->num_irqs = 64;
625     mmc->mpc_info = a_mpc_info;
626     mmc->num_mpcs = ARRAY_SIZE(a_mpc_info);
627 }
628 
629 static void musca_b1_class_init(ObjectClass *oc, void *data)
630 {
631     MachineClass *mc = MACHINE_CLASS(oc);
632     MuscaMachineClass *mmc = MUSCA_MACHINE_CLASS(oc);
633 
634     mc->desc = "ARM Musca-B1 board (dual Cortex-M33)";
635     mmc->type = MUSCA_B1;
636     /*
637      * This matches the DAPlink firmware which boots from QSPI. There
638      * is also a firmware blob which boots from the eFlash, which
639      * uses init_svtor = 0x1A000000. QEMU doesn't currently support that,
640      * though we could in theory expose a machine property on the command
641      * line to allow the user to request eFlash boot.
642      */
643     mmc->init_svtor = 0x10000000;
644     mmc->sram_addr_width = 17;
645     mmc->num_irqs = 96;
646     mmc->mpc_info = b1_mpc_info;
647     mmc->num_mpcs = ARRAY_SIZE(b1_mpc_info);
648 }
649 
650 static const TypeInfo musca_info = {
651     .name = TYPE_MUSCA_MACHINE,
652     .parent = TYPE_MACHINE,
653     .abstract = true,
654     .instance_size = sizeof(MuscaMachineState),
655     .class_size = sizeof(MuscaMachineClass),
656     .class_init = musca_class_init,
657 };
658 
659 static const TypeInfo musca_a_info = {
660     .name = TYPE_MUSCA_A_MACHINE,
661     .parent = TYPE_MUSCA_MACHINE,
662     .class_init = musca_a_class_init,
663 };
664 
665 static const TypeInfo musca_b1_info = {
666     .name = TYPE_MUSCA_B1_MACHINE,
667     .parent = TYPE_MUSCA_MACHINE,
668     .class_init = musca_b1_class_init,
669 };
670 
671 static void musca_machine_init(void)
672 {
673     type_register_static(&musca_info);
674     type_register_static(&musca_a_info);
675     type_register_static(&musca_b1_info);
676 }
677 
678 type_init(musca_machine_init);
679