xref: /openbmc/qemu/hw/arm/mps2-tz.c (revision 3728de31925ae9658e2ce3d1ff9b63c83609f310)
1 /*
2  * ARM V2M MPS2 board emulation, trustzone aware FPGA images
3  *
4  * Copyright (c) 2017 Linaro Limited
5  * Written by Peter Maydell
6  *
7  *  This program is free software; you can redistribute it and/or modify
8  *  it under the terms of the GNU General Public License version 2 or
9  *  (at your option) any later version.
10  */
11 
12 /* The MPS2 and MPS2+ dev boards are FPGA based (the 2+ has a bigger
13  * FPGA but is otherwise the same as the 2). Since the CPU itself
14  * and most of the devices are in the FPGA, the details of the board
15  * as seen by the guest depend significantly on the FPGA image.
16  * This source file covers the following FPGA images, for TrustZone cores:
17  *  "mps2-an505" -- Cortex-M33 as documented in ARM Application Note AN505
18  *  "mps2-an521" -- Dual Cortex-M33 as documented in Application Note AN521
19  *  "mps2-an524" -- Dual Cortex-M33 as documented in Application Note AN524
20  *  "mps2-an547" -- Single Cortex-M55 as documented in Application Note AN547
21  *
22  * Links to the TRM for the board itself and to the various Application
23  * Notes which document the FPGA images can be found here:
24  * https://developer.arm.com/products/system-design/development-boards/fpga-prototyping-boards/mps2
25  *
26  * Board TRM:
27  * https://developer.arm.com/documentation/100112/latest/
28  * Application Note AN505:
29  * https://developer.arm.com/documentation/dai0505/latest/
30  * Application Note AN521:
31  * https://developer.arm.com/documentation/dai0521/latest/
32  * Application Note AN524:
33  * https://developer.arm.com/documentation/dai0524/latest/
34  * Application Note AN547:
35  * https://developer.arm.com/documentation/dai0547/latest/
36  *
37  * The AN505 defers to the Cortex-M33 processor ARMv8M IoT Kit FVP User Guide
38  * (ARM ECM0601256) for the details of some of the device layout:
39  *  https://developer.arm.com/documentation/ecm0601256/latest
40  * Similarly, the AN521 and AN524 use the SSE-200, and the SSE-200 TRM defines
41  * most of the device layout:
42  *  https://developer.arm.com/documentation/101104/latest/
43  * and the AN547 uses the SSE-300, whose layout is in the SSE-300 TRM:
44  *  https://developer.arm.com/documentation/101773/latest/
45  */
46 
47 #include "qemu/osdep.h"
48 #include "qemu/units.h"
49 #include "qemu/cutils.h"
50 #include "qapi/error.h"
51 #include "qobject/qlist.h"
52 #include "qemu/error-report.h"
53 #include "hw/arm/boot.h"
54 #include "hw/arm/armv7m.h"
55 #include "hw/arm/machines-qom.h"
56 #include "hw/or-irq.h"
57 #include "hw/boards.h"
58 #include "system/address-spaces.h"
59 #include "system/system.h"
60 #include "system/reset.h"
61 #include "hw/misc/unimp.h"
62 #include "hw/char/cmsdk-apb-uart.h"
63 #include "hw/timer/cmsdk-apb-timer.h"
64 #include "hw/misc/mps2-scc.h"
65 #include "hw/misc/mps2-fpgaio.h"
66 #include "hw/misc/tz-mpc.h"
67 #include "hw/misc/tz-msc.h"
68 #include "hw/arm/armsse.h"
69 #include "hw/dma/pl080.h"
70 #include "hw/rtc/pl031.h"
71 #include "hw/ssi/pl022.h"
72 #include "hw/i2c/arm_sbcon_i2c.h"
73 #include "hw/net/lan9118.h"
74 #include "net/net.h"
75 #include "hw/core/split-irq.h"
76 #include "hw/qdev-clock.h"
77 #include "qom/object.h"
78 #include "hw/irq.h"
79 
80 #define MPS2TZ_NUMIRQ_MAX 96
81 #define MPS2TZ_RAM_MAX 5
82 
83 typedef enum MPS2TZFPGAType {
84     FPGA_AN505,
85     FPGA_AN521,
86     FPGA_AN524,
87     FPGA_AN547,
88 } MPS2TZFPGAType;
89 
90 /*
91  * Define the layout of RAM in a board, including which parts are
92  * behind which MPCs.
93  * mrindex specifies the index into mms->ram[] to use for the backing RAM;
94  * -1 means "use the system RAM".
95  */
96 typedef struct RAMInfo {
97     const char *name;
98     uint32_t base;
99     uint32_t size;
100     int mpc; /* MPC number, -1 for "not behind an MPC" */
101     int mrindex;
102     int flags;
103 } RAMInfo;
104 
105 /*
106  * Flag values:
107  *  IS_ALIAS: this RAM area is an alias to the upstream end of the
108  *    MPC specified by its .mpc value
109  *  IS_ROM: this RAM area is read-only
110  */
111 #define IS_ALIAS 1
112 #define IS_ROM 2
113 
114 struct MPS2TZMachineClass {
115     MachineClass parent;
116     MPS2TZFPGAType fpga_type;
117     uint32_t scc_id;
118     uint32_t sysclk_frq; /* Main SYSCLK frequency in Hz */
119     uint32_t apb_periph_frq; /* APB peripheral frequency in Hz */
120     uint32_t len_oscclk;
121     const uint32_t *oscclk;
122     uint32_t fpgaio_num_leds; /* Number of LEDs in FPGAIO LED0 register */
123     bool fpgaio_has_switches; /* Does FPGAIO have SWITCH register? */
124     bool fpgaio_has_dbgctrl; /* Does FPGAIO have DBGCTRL register? */
125     int numirq; /* Number of external interrupts */
126     int uart_overflow_irq; /* number of the combined UART overflow IRQ */
127     uint32_t init_svtor; /* init-svtor setting for SSE */
128     uint32_t sram_addr_width; /* SRAM_ADDR_WIDTH setting for SSE */
129     uint32_t cpu0_mpu_ns; /* CPU0_MPU_NS setting for SSE */
130     uint32_t cpu0_mpu_s; /* CPU0_MPU_S setting for SSE */
131     uint32_t cpu1_mpu_ns; /* CPU1_MPU_NS setting for SSE */
132     uint32_t cpu1_mpu_s; /* CPU1_MPU_S setting for SSE */
133     const RAMInfo *raminfo;
134     const char *armsse_type;
135     uint32_t boot_ram_size; /* size of ram at address 0; 0 == find in raminfo */
136 };
137 
138 struct MPS2TZMachineState {
139     MachineState parent;
140 
141     ARMSSE iotkit;
142     MemoryRegion ram[MPS2TZ_RAM_MAX];
143     MemoryRegion eth_usb_container;
144 
145     MPS2SCC scc;
146     MPS2FPGAIO fpgaio;
147     TZPPC ppc[5];
148     TZMPC mpc[3];
149     PL022State spi[5];
150     ArmSbconI2CState i2c[5];
151     UnimplementedDeviceState i2s_audio;
152     UnimplementedDeviceState gpio[4];
153     UnimplementedDeviceState gfx;
154     UnimplementedDeviceState cldc;
155     UnimplementedDeviceState usb;
156     PL031State rtc;
157     PL080State dma[4];
158     TZMSC msc[4];
159     CMSDKAPBUART uart[6];
160     SplitIRQ sec_resp_splitter;
161     OrIRQState uart_irq_orgate;
162     DeviceState *lan9118;
163     SplitIRQ cpu_irq_splitter[MPS2TZ_NUMIRQ_MAX];
164     Clock *sysclk;
165     Clock *s32kclk;
166 
167     bool remap;
168     qemu_irq remap_irq;
169 };
170 
171 #define TYPE_MPS2TZ_MACHINE "mps2tz"
172 #define TYPE_MPS2TZ_AN505_MACHINE MACHINE_TYPE_NAME("mps2-an505")
173 #define TYPE_MPS2TZ_AN521_MACHINE MACHINE_TYPE_NAME("mps2-an521")
174 #define TYPE_MPS3TZ_AN524_MACHINE MACHINE_TYPE_NAME("mps3-an524")
175 #define TYPE_MPS3TZ_AN547_MACHINE MACHINE_TYPE_NAME("mps3-an547")
176 
177 OBJECT_DECLARE_TYPE(MPS2TZMachineState, MPS2TZMachineClass, MPS2TZ_MACHINE)
178 
179 /* Slow 32Khz S32KCLK frequency in Hz */
180 #define S32KCLK_FRQ (32 * 1000)
181 
182 /*
183  * The MPS3 DDR is 2GiB, but on a 32-bit host QEMU doesn't permit
184  * emulation of that much guest RAM, so artificially make it smaller.
185  */
186 #if HOST_LONG_BITS == 32
187 #define MPS3_DDR_SIZE (1 * GiB)
188 #else
189 #define MPS3_DDR_SIZE (2 * GiB)
190 #endif
191 
192 /* For cpu{0,1}_mpu_{ns,s}, means "leave at SSE's default value" */
193 #define MPU_REGION_DEFAULT UINT32_MAX
194 
195 static const uint32_t an505_oscclk[] = {
196     40000000,
197     24580000,
198     25000000,
199 };
200 
201 static const uint32_t an524_oscclk[] = {
202     24000000,
203     32000000,
204     50000000,
205     50000000,
206     24576000,
207     23750000,
208 };
209 
210 static const RAMInfo an505_raminfo[] = { {
211         .name = "ssram-0",
212         .base = 0x00000000,
213         .size = 0x00400000,
214         .mpc = 0,
215         .mrindex = 0,
216     }, {
217         .name = "ssram-1",
218         .base = 0x28000000,
219         .size = 0x00200000,
220         .mpc = 1,
221         .mrindex = 1,
222     }, {
223         .name = "ssram-2",
224         .base = 0x28200000,
225         .size = 0x00200000,
226         .mpc = 2,
227         .mrindex = 2,
228     }, {
229         .name = "ssram-0-alias",
230         .base = 0x00400000,
231         .size = 0x00400000,
232         .mpc = 0,
233         .mrindex = 3,
234         .flags = IS_ALIAS,
235     }, {
236         /* Use the largest bit of contiguous RAM as our "system memory" */
237         .name = "mps.ram",
238         .base = 0x80000000,
239         .size = 16 * MiB,
240         .mpc = -1,
241         .mrindex = -1,
242     }, {
243         .name = NULL,
244     },
245 };
246 
247 /*
248  * Note that the addresses and MPC numbering here should match up
249  * with those used in remap_memory(), which can swap the BRAM and QSPI.
250  */
251 static const RAMInfo an524_raminfo[] = { {
252         .name = "bram",
253         .base = 0x00000000,
254         .size = 512 * KiB,
255         .mpc = 0,
256         .mrindex = 0,
257     }, {
258         /* We don't model QSPI flash yet; for now expose it as simple ROM */
259         .name = "QSPI",
260         .base = 0x28000000,
261         .size = 8 * MiB,
262         .mpc = 1,
263         .mrindex = 1,
264         .flags = IS_ROM,
265     }, {
266         .name = "DDR",
267         .base = 0x60000000,
268         .size = MPS3_DDR_SIZE,
269         .mpc = 2,
270         .mrindex = -1,
271     }, {
272         .name = NULL,
273     },
274 };
275 
276 static const RAMInfo an547_raminfo[] = { {
277         .name = "sram",
278         .base = 0x01000000,
279         .size = 2 * MiB,
280         .mpc = 0,
281         .mrindex = 1,
282     }, {
283         .name = "sram 2",
284         .base = 0x21000000,
285         .size = 4 * MiB,
286         .mpc = -1,
287         .mrindex = 3,
288     }, {
289         /* We don't model QSPI flash yet; for now expose it as simple ROM */
290         .name = "QSPI",
291         .base = 0x28000000,
292         .size = 8 * MiB,
293         .mpc = 1,
294         .mrindex = 4,
295         .flags = IS_ROM,
296     }, {
297         .name = "DDR",
298         .base = 0x60000000,
299         .size = MPS3_DDR_SIZE,
300         .mpc = 2,
301         .mrindex = -1,
302     }, {
303         .name = NULL,
304     },
305 };
306 
307 static const RAMInfo *find_raminfo_for_mpc(MPS2TZMachineState *mms, int mpc)
308 {
309     MPS2TZMachineClass *mmc = MPS2TZ_MACHINE_GET_CLASS(mms);
310     const RAMInfo *p;
311     const RAMInfo *found = NULL;
312 
313     for (p = mmc->raminfo; p->name; p++) {
314         if (p->mpc == mpc && !(p->flags & IS_ALIAS)) {
315             /* There should only be one entry in the array for this MPC */
316             g_assert(!found);
317             found = p;
318         }
319     }
320     /* if raminfo array doesn't have an entry for each MPC this is a bug */
321     assert(found);
322     return found;
323 }
324 
325 static MemoryRegion *mr_for_raminfo(MPS2TZMachineState *mms,
326                                     const RAMInfo *raminfo)
327 {
328     /* Return an initialized MemoryRegion for the RAMInfo. */
329     MemoryRegion *ram;
330 
331     if (raminfo->mrindex < 0) {
332         /* Means this RAMInfo is for QEMU's "system memory" */
333         MachineState *machine = MACHINE(mms);
334         assert(!(raminfo->flags & IS_ROM));
335         return machine->ram;
336     }
337 
338     assert(raminfo->mrindex < MPS2TZ_RAM_MAX);
339     ram = &mms->ram[raminfo->mrindex];
340 
341     memory_region_init_ram(ram, NULL, raminfo->name,
342                            raminfo->size, &error_fatal);
343     if (raminfo->flags & IS_ROM) {
344         memory_region_set_readonly(ram, true);
345     }
346     return ram;
347 }
348 
349 /* Create an alias of an entire original MemoryRegion @orig
350  * located at @base in the memory map.
351  */
352 static void make_ram_alias(MemoryRegion *mr, const char *name,
353                            MemoryRegion *orig, hwaddr base)
354 {
355     memory_region_init_alias(mr, NULL, name, orig, 0,
356                              memory_region_size(orig));
357     memory_region_add_subregion(get_system_memory(), base, mr);
358 }
359 
360 static qemu_irq get_sse_irq_in(MPS2TZMachineState *mms, int irqno)
361 {
362     /*
363      * Return a qemu_irq which will signal IRQ n to all CPUs in the
364      * SSE.  The irqno should be as the CPU sees it, so the first
365      * external-to-the-SSE interrupt is 32.
366      */
367     MachineClass *mc = MACHINE_GET_CLASS(mms);
368     MPS2TZMachineClass *mmc = MPS2TZ_MACHINE_GET_CLASS(mms);
369 
370     assert(irqno >= 32 && irqno < (mmc->numirq + 32));
371 
372     /*
373      * Convert from "CPU irq number" (as listed in the FPGA image
374      * documentation) to the SSE external-interrupt number.
375      */
376     irqno -= 32;
377 
378     if (mc->max_cpus > 1) {
379         return qdev_get_gpio_in(DEVICE(&mms->cpu_irq_splitter[irqno]), 0);
380     } else {
381         return qdev_get_gpio_in_named(DEVICE(&mms->iotkit), "EXP_IRQ", irqno);
382     }
383 }
384 
385 /* Union describing the device-specific extra data we pass to the devfn. */
386 typedef union PPCExtraData {
387     bool i2c_internal;
388 } PPCExtraData;
389 
390 /* Most of the devices in the AN505 FPGA image sit behind
391  * Peripheral Protection Controllers. These data structures
392  * define the layout of which devices sit behind which PPCs.
393  * The devfn for each port is a function which creates, configures
394  * and initializes the device, returning the MemoryRegion which
395  * needs to be plugged into the downstream end of the PPC port.
396  */
397 typedef MemoryRegion *MakeDevFn(MPS2TZMachineState *mms, void *opaque,
398                                 const char *name, hwaddr size,
399                                 const int *irqs,
400                                 const PPCExtraData *extradata);
401 
402 typedef struct PPCPortInfo {
403     const char *name;
404     MakeDevFn *devfn;
405     void *opaque;
406     hwaddr addr;
407     hwaddr size;
408     int irqs[3]; /* currently no device needs more IRQ lines than this */
409     PPCExtraData extradata; /* to pass device-specific info to the devfn */
410 } PPCPortInfo;
411 
412 typedef struct PPCInfo {
413     const char *name;
414     PPCPortInfo ports[TZ_NUM_PORTS];
415 } PPCInfo;
416 
417 static MemoryRegion *make_unimp_dev(MPS2TZMachineState *mms,
418                                     void *opaque,
419                                     const char *name, hwaddr size,
420                                     const int *irqs,
421                                     const PPCExtraData *extradata)
422 {
423     /* Initialize, configure and realize a TYPE_UNIMPLEMENTED_DEVICE,
424      * and return a pointer to its MemoryRegion.
425      */
426     UnimplementedDeviceState *uds = opaque;
427 
428     object_initialize_child(OBJECT(mms), name, uds, TYPE_UNIMPLEMENTED_DEVICE);
429     qdev_prop_set_string(DEVICE(uds), "name", name);
430     qdev_prop_set_uint64(DEVICE(uds), "size", size);
431     sysbus_realize(SYS_BUS_DEVICE(uds), &error_fatal);
432     return sysbus_mmio_get_region(SYS_BUS_DEVICE(uds), 0);
433 }
434 
435 static MemoryRegion *make_uart(MPS2TZMachineState *mms, void *opaque,
436                                const char *name, hwaddr size,
437                                const int *irqs, const PPCExtraData *extradata)
438 {
439     /* The irq[] array is rx, tx, combined, in that order */
440     MPS2TZMachineClass *mmc = MPS2TZ_MACHINE_GET_CLASS(mms);
441     CMSDKAPBUART *uart = opaque;
442     int i = uart - &mms->uart[0];
443     SysBusDevice *s;
444     DeviceState *orgate_dev = DEVICE(&mms->uart_irq_orgate);
445 
446     object_initialize_child(OBJECT(mms), name, uart, TYPE_CMSDK_APB_UART);
447     qdev_prop_set_chr(DEVICE(uart), "chardev", serial_hd(i));
448     qdev_prop_set_uint32(DEVICE(uart), "pclk-frq", mmc->apb_periph_frq);
449     sysbus_realize(SYS_BUS_DEVICE(uart), &error_fatal);
450     s = SYS_BUS_DEVICE(uart);
451     sysbus_connect_irq(s, 0, get_sse_irq_in(mms, irqs[1]));
452     sysbus_connect_irq(s, 1, get_sse_irq_in(mms, irqs[0]));
453     sysbus_connect_irq(s, 2, qdev_get_gpio_in(orgate_dev, i * 2));
454     sysbus_connect_irq(s, 3, qdev_get_gpio_in(orgate_dev, i * 2 + 1));
455     sysbus_connect_irq(s, 4, get_sse_irq_in(mms, irqs[2]));
456     return sysbus_mmio_get_region(SYS_BUS_DEVICE(uart), 0);
457 }
458 
459 static MemoryRegion *make_scc(MPS2TZMachineState *mms, void *opaque,
460                               const char *name, hwaddr size,
461                               const int *irqs, const PPCExtraData *extradata)
462 {
463     MPS2SCC *scc = opaque;
464     DeviceState *sccdev;
465     MPS2TZMachineClass *mmc = MPS2TZ_MACHINE_GET_CLASS(mms);
466     QList *oscclk;
467     uint32_t i;
468 
469     object_initialize_child(OBJECT(mms), "scc", scc, TYPE_MPS2_SCC);
470     sccdev = DEVICE(scc);
471     qdev_prop_set_uint32(sccdev, "scc-cfg0", mms->remap ? 1 : 0);
472     qdev_prop_set_uint32(sccdev, "scc-cfg4", 0x2);
473     qdev_prop_set_uint32(sccdev, "scc-aid", 0x00200008);
474     qdev_prop_set_uint32(sccdev, "scc-id", mmc->scc_id);
475 
476     oscclk = qlist_new();
477     for (i = 0; i < mmc->len_oscclk; i++) {
478         qlist_append_int(oscclk, mmc->oscclk[i]);
479     }
480     qdev_prop_set_array(sccdev, "oscclk", oscclk);
481 
482     sysbus_realize(SYS_BUS_DEVICE(scc), &error_fatal);
483     return sysbus_mmio_get_region(SYS_BUS_DEVICE(sccdev), 0);
484 }
485 
486 static MemoryRegion *make_fpgaio(MPS2TZMachineState *mms, void *opaque,
487                                  const char *name, hwaddr size,
488                                  const int *irqs, const PPCExtraData *extradata)
489 {
490     MPS2FPGAIO *fpgaio = opaque;
491     MPS2TZMachineClass *mmc = MPS2TZ_MACHINE_GET_CLASS(mms);
492 
493     object_initialize_child(OBJECT(mms), "fpgaio", fpgaio, TYPE_MPS2_FPGAIO);
494     qdev_prop_set_uint32(DEVICE(fpgaio), "num-leds", mmc->fpgaio_num_leds);
495     qdev_prop_set_bit(DEVICE(fpgaio), "has-switches", mmc->fpgaio_has_switches);
496     qdev_prop_set_bit(DEVICE(fpgaio), "has-dbgctrl", mmc->fpgaio_has_dbgctrl);
497     sysbus_realize(SYS_BUS_DEVICE(fpgaio), &error_fatal);
498     return sysbus_mmio_get_region(SYS_BUS_DEVICE(fpgaio), 0);
499 }
500 
501 static MemoryRegion *make_eth_dev(MPS2TZMachineState *mms, void *opaque,
502                                   const char *name, hwaddr size,
503                                   const int *irqs,
504                                   const PPCExtraData *extradata)
505 {
506     SysBusDevice *s;
507 
508     /* In hardware this is a LAN9220; the LAN9118 is software compatible
509      * except that it doesn't support the checksum-offload feature.
510      */
511     mms->lan9118 = qdev_new(TYPE_LAN9118);
512     qemu_configure_nic_device(mms->lan9118, true, NULL);
513 
514     s = SYS_BUS_DEVICE(mms->lan9118);
515     sysbus_realize_and_unref(s, &error_fatal);
516     sysbus_connect_irq(s, 0, get_sse_irq_in(mms, irqs[0]));
517     return sysbus_mmio_get_region(s, 0);
518 }
519 
520 static MemoryRegion *make_eth_usb(MPS2TZMachineState *mms, void *opaque,
521                                   const char *name, hwaddr size,
522                                   const int *irqs,
523                                   const PPCExtraData *extradata)
524 {
525     /*
526      * The AN524 makes the ethernet and USB share a PPC port.
527      * irqs[] is the ethernet IRQ.
528      */
529     SysBusDevice *s;
530 
531     memory_region_init(&mms->eth_usb_container, OBJECT(mms),
532                        "mps2-tz-eth-usb-container", 0x200000);
533 
534     /*
535      * In hardware this is a LAN9220; the LAN9118 is software compatible
536      * except that it doesn't support the checksum-offload feature.
537      */
538     mms->lan9118 = qdev_new(TYPE_LAN9118);
539     qemu_configure_nic_device(mms->lan9118, true, NULL);
540 
541     s = SYS_BUS_DEVICE(mms->lan9118);
542     sysbus_realize_and_unref(s, &error_fatal);
543     sysbus_connect_irq(s, 0, get_sse_irq_in(mms, irqs[0]));
544 
545     memory_region_add_subregion(&mms->eth_usb_container,
546                                 0, sysbus_mmio_get_region(s, 0));
547 
548     /* The USB OTG controller is an ISP1763; we don't have a model of it. */
549     object_initialize_child(OBJECT(mms), "usb-otg",
550                             &mms->usb, TYPE_UNIMPLEMENTED_DEVICE);
551     qdev_prop_set_string(DEVICE(&mms->usb), "name", "usb-otg");
552     qdev_prop_set_uint64(DEVICE(&mms->usb), "size", 0x100000);
553     s = SYS_BUS_DEVICE(&mms->usb);
554     sysbus_realize(s, &error_fatal);
555 
556     memory_region_add_subregion(&mms->eth_usb_container,
557                                 0x100000, sysbus_mmio_get_region(s, 0));
558 
559     return &mms->eth_usb_container;
560 }
561 
562 static MemoryRegion *make_mpc(MPS2TZMachineState *mms, void *opaque,
563                               const char *name, hwaddr size,
564                               const int *irqs, const PPCExtraData *extradata)
565 {
566     TZMPC *mpc = opaque;
567     int i = mpc - &mms->mpc[0];
568     MemoryRegion *upstream;
569     const RAMInfo *raminfo = find_raminfo_for_mpc(mms, i);
570     MemoryRegion *ram = mr_for_raminfo(mms, raminfo);
571 
572     object_initialize_child(OBJECT(mms), name, mpc, TYPE_TZ_MPC);
573     object_property_set_link(OBJECT(mpc), "downstream", OBJECT(ram),
574                              &error_fatal);
575     sysbus_realize(SYS_BUS_DEVICE(mpc), &error_fatal);
576     /* Map the upstream end of the MPC into system memory */
577     upstream = sysbus_mmio_get_region(SYS_BUS_DEVICE(mpc), 1);
578     memory_region_add_subregion(get_system_memory(), raminfo->base, upstream);
579     /* and connect its interrupt to the IoTKit */
580     qdev_connect_gpio_out_named(DEVICE(mpc), "irq", 0,
581                                 qdev_get_gpio_in_named(DEVICE(&mms->iotkit),
582                                                        "mpcexp_status", i));
583 
584     /* Return the register interface MR for our caller to map behind the PPC */
585     return sysbus_mmio_get_region(SYS_BUS_DEVICE(mpc), 0);
586 }
587 
588 static hwaddr boot_mem_base(MPS2TZMachineState *mms)
589 {
590     /*
591      * Return the canonical address of the block which will be mapped
592      * at address 0x0 (i.e. where the vector table is).
593      * This is usually 0, but if the AN524 alternate memory map is
594      * enabled it will be the base address of the QSPI block.
595      */
596     return mms->remap ? 0x28000000 : 0;
597 }
598 
599 static void remap_memory(MPS2TZMachineState *mms, int map)
600 {
601     /*
602      * Remap the memory for the AN524. 'map' is the value of
603      * SCC CFG_REG0 bit 0, i.e. 0 for the default map and 1
604      * for the "option 1" mapping where QSPI is at address 0.
605      *
606      * Effectively we need to swap around the "upstream" ends of
607      * MPC 0 and MPC 1.
608      */
609     MPS2TZMachineClass *mmc = MPS2TZ_MACHINE_GET_CLASS(mms);
610     int i;
611 
612     if (mmc->fpga_type != FPGA_AN524) {
613         return;
614     }
615 
616     memory_region_transaction_begin();
617     for (i = 0; i < 2; i++) {
618         TZMPC *mpc = &mms->mpc[i];
619         MemoryRegion *upstream = sysbus_mmio_get_region(SYS_BUS_DEVICE(mpc), 1);
620         hwaddr addr = (i ^ map) ? 0x28000000 : 0;
621 
622         memory_region_set_address(upstream, addr);
623     }
624     memory_region_transaction_commit();
625 }
626 
627 static void remap_irq_fn(void *opaque, int n, int level)
628 {
629     MPS2TZMachineState *mms = opaque;
630 
631     remap_memory(mms, level);
632 }
633 
634 static MemoryRegion *make_dma(MPS2TZMachineState *mms, void *opaque,
635                               const char *name, hwaddr size,
636                               const int *irqs, const PPCExtraData *extradata)
637 {
638     /* The irq[] array is DMACINTR, DMACINTERR, DMACINTTC, in that order */
639     PL080State *dma = opaque;
640     int i = dma - &mms->dma[0];
641     SysBusDevice *s;
642     char *mscname = g_strdup_printf("%s-msc", name);
643     TZMSC *msc = &mms->msc[i];
644     DeviceState *iotkitdev = DEVICE(&mms->iotkit);
645     MemoryRegion *msc_upstream;
646     MemoryRegion *msc_downstream;
647 
648     /*
649      * Each DMA device is a PL081 whose transaction master interface
650      * is guarded by a Master Security Controller. The downstream end of
651      * the MSC connects to the IoTKit AHB Slave Expansion port, so the
652      * DMA devices can see all devices and memory that the CPU does.
653      */
654     object_initialize_child(OBJECT(mms), mscname, msc, TYPE_TZ_MSC);
655     msc_downstream = sysbus_mmio_get_region(SYS_BUS_DEVICE(&mms->iotkit), 0);
656     object_property_set_link(OBJECT(msc), "downstream",
657                              OBJECT(msc_downstream), &error_fatal);
658     object_property_set_link(OBJECT(msc), "idau", OBJECT(mms), &error_fatal);
659     sysbus_realize(SYS_BUS_DEVICE(msc), &error_fatal);
660 
661     qdev_connect_gpio_out_named(DEVICE(msc), "irq", 0,
662                                 qdev_get_gpio_in_named(iotkitdev,
663                                                        "mscexp_status", i));
664     qdev_connect_gpio_out_named(iotkitdev, "mscexp_clear", i,
665                                 qdev_get_gpio_in_named(DEVICE(msc),
666                                                        "irq_clear", 0));
667     qdev_connect_gpio_out_named(iotkitdev, "mscexp_ns", i,
668                                 qdev_get_gpio_in_named(DEVICE(msc),
669                                                        "cfg_nonsec", 0));
670     qdev_connect_gpio_out(DEVICE(&mms->sec_resp_splitter),
671                           ARRAY_SIZE(mms->ppc) + i,
672                           qdev_get_gpio_in_named(DEVICE(msc),
673                                                  "cfg_sec_resp", 0));
674     msc_upstream = sysbus_mmio_get_region(SYS_BUS_DEVICE(msc), 0);
675 
676     object_initialize_child(OBJECT(mms), name, dma, TYPE_PL081);
677     object_property_set_link(OBJECT(dma), "downstream", OBJECT(msc_upstream),
678                              &error_fatal);
679     sysbus_realize(SYS_BUS_DEVICE(dma), &error_fatal);
680 
681     s = SYS_BUS_DEVICE(dma);
682     /* Wire up DMACINTR, DMACINTERR, DMACINTTC */
683     sysbus_connect_irq(s, 0, get_sse_irq_in(mms, irqs[0]));
684     sysbus_connect_irq(s, 1, get_sse_irq_in(mms, irqs[1]));
685     sysbus_connect_irq(s, 2, get_sse_irq_in(mms, irqs[2]));
686 
687     g_free(mscname);
688     return sysbus_mmio_get_region(s, 0);
689 }
690 
691 static MemoryRegion *make_spi(MPS2TZMachineState *mms, void *opaque,
692                               const char *name, hwaddr size,
693                               const int *irqs, const PPCExtraData *extradata)
694 {
695     /*
696      * The AN505 has five PL022 SPI controllers.
697      * One of these should have the LCD controller behind it; the others
698      * are connected only to the FPGA's "general purpose SPI connector"
699      * or "shield" expansion connectors.
700      * Note that if we do implement devices behind SPI, the chip select
701      * lines are set via the "MISC" register in the MPS2 FPGAIO device.
702      */
703     PL022State *spi = opaque;
704     SysBusDevice *s;
705 
706     object_initialize_child(OBJECT(mms), name, spi, TYPE_PL022);
707     sysbus_realize(SYS_BUS_DEVICE(spi), &error_fatal);
708     s = SYS_BUS_DEVICE(spi);
709     sysbus_connect_irq(s, 0, get_sse_irq_in(mms, irqs[0]));
710     return sysbus_mmio_get_region(s, 0);
711 }
712 
713 static MemoryRegion *make_i2c(MPS2TZMachineState *mms, void *opaque,
714                               const char *name, hwaddr size,
715                               const int *irqs, const PPCExtraData *extradata)
716 {
717     ArmSbconI2CState *i2c = opaque;
718     SysBusDevice *s;
719 
720     object_initialize_child(OBJECT(mms), name, i2c, TYPE_ARM_SBCON_I2C);
721     s = SYS_BUS_DEVICE(i2c);
722     sysbus_realize(s, &error_fatal);
723 
724     /*
725      * If this is an internal-use-only i2c bus, mark it full
726      * so that user-created i2c devices are not plugged into it.
727      * If we implement models of any on-board i2c devices that
728      * plug in to one of the internal-use-only buses, then we will
729      * need to create and plugging those in here before we mark the
730      * bus as full.
731      */
732     if (extradata->i2c_internal) {
733         BusState *qbus = qdev_get_child_bus(DEVICE(i2c), "i2c");
734         qbus_mark_full(qbus);
735     }
736 
737     return sysbus_mmio_get_region(s, 0);
738 }
739 
740 static MemoryRegion *make_rtc(MPS2TZMachineState *mms, void *opaque,
741                               const char *name, hwaddr size,
742                               const int *irqs, const PPCExtraData *extradata)
743 {
744     PL031State *pl031 = opaque;
745     SysBusDevice *s;
746 
747     object_initialize_child(OBJECT(mms), name, pl031, TYPE_PL031);
748     s = SYS_BUS_DEVICE(pl031);
749     sysbus_realize(s, &error_fatal);
750     /*
751      * The board docs don't give an IRQ number for the PL031, so
752      * presumably it is not connected.
753      */
754     return sysbus_mmio_get_region(s, 0);
755 }
756 
757 static void create_non_mpc_ram(MPS2TZMachineState *mms)
758 {
759     /*
760      * Handle the RAMs which are either not behind MPCs or which are
761      * aliases to another MPC.
762      */
763     const RAMInfo *p;
764     MPS2TZMachineClass *mmc = MPS2TZ_MACHINE_GET_CLASS(mms);
765 
766     for (p = mmc->raminfo; p->name; p++) {
767         if (p->flags & IS_ALIAS) {
768             SysBusDevice *mpc_sbd = SYS_BUS_DEVICE(&mms->mpc[p->mpc]);
769             MemoryRegion *upstream = sysbus_mmio_get_region(mpc_sbd, 1);
770             make_ram_alias(&mms->ram[p->mrindex], p->name, upstream, p->base);
771         } else if (p->mpc == -1) {
772             /* RAM not behind an MPC */
773             MemoryRegion *mr = mr_for_raminfo(mms, p);
774             memory_region_add_subregion(get_system_memory(), p->base, mr);
775         }
776     }
777 }
778 
779 static uint32_t boot_ram_size(MPS2TZMachineState *mms)
780 {
781     /* Return the size of the RAM block at guest address zero */
782     const RAMInfo *p;
783     MPS2TZMachineClass *mmc = MPS2TZ_MACHINE_GET_CLASS(mms);
784 
785     /*
786      * Use a per-board specification (for when the boot RAM is in
787      * the SSE and so doesn't have a RAMInfo list entry)
788      */
789     if (mmc->boot_ram_size) {
790         return mmc->boot_ram_size;
791     }
792 
793     for (p = mmc->raminfo; p->name; p++) {
794         if (p->base == boot_mem_base(mms)) {
795             return p->size;
796         }
797     }
798     g_assert_not_reached();
799 }
800 
801 static void mps2tz_common_init(MachineState *machine)
802 {
803     MPS2TZMachineState *mms = MPS2TZ_MACHINE(machine);
804     MPS2TZMachineClass *mmc = MPS2TZ_MACHINE_GET_CLASS(mms);
805     MachineClass *mc = MACHINE_GET_CLASS(machine);
806     MemoryRegion *system_memory = get_system_memory();
807     DeviceState *iotkitdev;
808     DeviceState *dev_splitter;
809     const PPCInfo *ppcs;
810     int num_ppcs;
811     int i;
812 
813     if (machine->ram_size != mc->default_ram_size) {
814         char *sz = size_to_str(mc->default_ram_size);
815         error_report("Invalid RAM size, should be %s", sz);
816         g_free(sz);
817         exit(EXIT_FAILURE);
818     }
819 
820     /* These clocks don't need migration because they are fixed-frequency */
821     mms->sysclk = clock_new(OBJECT(machine), "SYSCLK");
822     clock_set_hz(mms->sysclk, mmc->sysclk_frq);
823     mms->s32kclk = clock_new(OBJECT(machine), "S32KCLK");
824     clock_set_hz(mms->s32kclk, S32KCLK_FRQ);
825 
826     object_initialize_child(OBJECT(machine), TYPE_IOTKIT, &mms->iotkit,
827                             mmc->armsse_type);
828     iotkitdev = DEVICE(&mms->iotkit);
829     object_property_set_link(OBJECT(&mms->iotkit), "memory",
830                              OBJECT(system_memory), &error_abort);
831     qdev_prop_set_uint32(iotkitdev, "EXP_NUMIRQ", mmc->numirq);
832     qdev_prop_set_uint32(iotkitdev, "init-svtor", mmc->init_svtor);
833     if (mmc->cpu0_mpu_ns != MPU_REGION_DEFAULT) {
834         qdev_prop_set_uint32(iotkitdev, "CPU0_MPU_NS", mmc->cpu0_mpu_ns);
835     }
836     if (mmc->cpu0_mpu_s != MPU_REGION_DEFAULT) {
837         qdev_prop_set_uint32(iotkitdev, "CPU0_MPU_S", mmc->cpu0_mpu_s);
838     }
839     if (object_property_find(OBJECT(iotkitdev), "CPU1_MPU_NS")) {
840         if (mmc->cpu1_mpu_ns != MPU_REGION_DEFAULT) {
841             qdev_prop_set_uint32(iotkitdev, "CPU1_MPU_NS", mmc->cpu1_mpu_ns);
842         }
843         if (mmc->cpu1_mpu_s != MPU_REGION_DEFAULT) {
844             qdev_prop_set_uint32(iotkitdev, "CPU1_MPU_S", mmc->cpu1_mpu_s);
845         }
846     }
847     qdev_prop_set_uint32(iotkitdev, "SRAM_ADDR_WIDTH", mmc->sram_addr_width);
848     qdev_connect_clock_in(iotkitdev, "MAINCLK", mms->sysclk);
849     qdev_connect_clock_in(iotkitdev, "S32KCLK", mms->s32kclk);
850     sysbus_realize(SYS_BUS_DEVICE(&mms->iotkit), &error_fatal);
851 
852     /*
853      * If this board has more than one CPU, then we need to create splitters
854      * to feed the IRQ inputs for each CPU in the SSE from each device in the
855      * board. If there is only one CPU, we can just wire the device IRQ
856      * directly to the SSE's IRQ input.
857      */
858     assert(mmc->numirq <= MPS2TZ_NUMIRQ_MAX);
859     if (mc->max_cpus > 1) {
860         for (i = 0; i < mmc->numirq; i++) {
861             char *name = g_strdup_printf("mps2-irq-splitter%d", i);
862             SplitIRQ *splitter = &mms->cpu_irq_splitter[i];
863 
864             object_initialize_child_with_props(OBJECT(machine), name,
865                                                splitter, sizeof(*splitter),
866                                                TYPE_SPLIT_IRQ, &error_fatal,
867                                                NULL);
868             g_free(name);
869 
870             object_property_set_int(OBJECT(splitter), "num-lines", 2,
871                                     &error_fatal);
872             qdev_realize(DEVICE(splitter), NULL, &error_fatal);
873             qdev_connect_gpio_out(DEVICE(splitter), 0,
874                                   qdev_get_gpio_in_named(DEVICE(&mms->iotkit),
875                                                          "EXP_IRQ", i));
876             qdev_connect_gpio_out(DEVICE(splitter), 1,
877                                   qdev_get_gpio_in_named(DEVICE(&mms->iotkit),
878                                                          "EXP_CPU1_IRQ", i));
879         }
880     }
881 
882     /* The sec_resp_cfg output from the IoTKit must be split into multiple
883      * lines, one for each of the PPCs we create here, plus one per MSC.
884      */
885     object_initialize_child(OBJECT(machine), "sec-resp-splitter",
886                             &mms->sec_resp_splitter, TYPE_SPLIT_IRQ);
887     object_property_set_int(OBJECT(&mms->sec_resp_splitter), "num-lines",
888                             ARRAY_SIZE(mms->ppc) + ARRAY_SIZE(mms->msc),
889                             &error_fatal);
890     qdev_realize(DEVICE(&mms->sec_resp_splitter), NULL, &error_fatal);
891     dev_splitter = DEVICE(&mms->sec_resp_splitter);
892     qdev_connect_gpio_out_named(iotkitdev, "sec_resp_cfg", 0,
893                                 qdev_get_gpio_in(dev_splitter, 0));
894 
895     /*
896      * The IoTKit sets up much of the memory layout, including
897      * the aliases between secure and non-secure regions in the
898      * address space, and also most of the devices in the system.
899      * The FPGA itself contains various RAMs and some additional devices.
900      * The FPGA images have an odd combination of different RAMs,
901      * because in hardware they are different implementations and
902      * connected to different buses, giving varying performance/size
903      * tradeoffs. For QEMU they're all just RAM, though. We arbitrarily
904      * call the largest lump our "system memory".
905      */
906 
907     /*
908      * The overflow IRQs for all UARTs are ORed together.
909      * Tx, Rx and "combined" IRQs are sent to the NVIC separately.
910      * Create the OR gate for this: it has one input for the TX overflow
911      * and one for the RX overflow for each UART we might have.
912      * (If the board has fewer than the maximum possible number of UARTs
913      * those inputs are never wired up and are treated as always-zero.)
914      */
915     object_initialize_child(OBJECT(mms), "uart-irq-orgate",
916                             &mms->uart_irq_orgate, TYPE_OR_IRQ);
917     object_property_set_int(OBJECT(&mms->uart_irq_orgate), "num-lines",
918                             2 * ARRAY_SIZE(mms->uart),
919                             &error_fatal);
920     qdev_realize(DEVICE(&mms->uart_irq_orgate), NULL, &error_fatal);
921     qdev_connect_gpio_out(DEVICE(&mms->uart_irq_orgate), 0,
922                           get_sse_irq_in(mms, mmc->uart_overflow_irq));
923 
924     /* Most of the devices in the FPGA are behind Peripheral Protection
925      * Controllers. The required order for initializing things is:
926      *  + initialize the PPC
927      *  + initialize, configure and realize downstream devices
928      *  + connect downstream device MemoryRegions to the PPC
929      *  + realize the PPC
930      *  + map the PPC's MemoryRegions to the places in the address map
931      *    where the downstream devices should appear
932      *  + wire up the PPC's control lines to the IoTKit object
933      */
934 
935     const PPCInfo an505_ppcs[] = { {
936             .name = "apb_ppcexp0",
937             .ports = {
938                 { "ssram-0-mpc", make_mpc, &mms->mpc[0], 0x58007000, 0x1000 },
939                 { "ssram-1-mpc", make_mpc, &mms->mpc[1], 0x58008000, 0x1000 },
940                 { "ssram-2-mpc", make_mpc, &mms->mpc[2], 0x58009000, 0x1000 },
941             },
942         }, {
943             .name = "apb_ppcexp1",
944             .ports = {
945                 { "spi0", make_spi, &mms->spi[0], 0x40205000, 0x1000, { 51 } },
946                 { "spi1", make_spi, &mms->spi[1], 0x40206000, 0x1000, { 52 } },
947                 { "spi2", make_spi, &mms->spi[2], 0x40209000, 0x1000, { 53 } },
948                 { "spi3", make_spi, &mms->spi[3], 0x4020a000, 0x1000, { 54 } },
949                 { "spi4", make_spi, &mms->spi[4], 0x4020b000, 0x1000, { 55 } },
950                 { "uart0", make_uart, &mms->uart[0], 0x40200000, 0x1000, { 32, 33, 42 } },
951                 { "uart1", make_uart, &mms->uart[1], 0x40201000, 0x1000, { 34, 35, 43 } },
952                 { "uart2", make_uart, &mms->uart[2], 0x40202000, 0x1000, { 36, 37, 44 } },
953                 { "uart3", make_uart, &mms->uart[3], 0x40203000, 0x1000, { 38, 39, 45 } },
954                 { "uart4", make_uart, &mms->uart[4], 0x40204000, 0x1000, { 40, 41, 46 } },
955                 { "i2c0", make_i2c, &mms->i2c[0], 0x40207000, 0x1000, {},
956                   { .i2c_internal = true /* touchscreen */ } },
957                 { "i2c1", make_i2c, &mms->i2c[1], 0x40208000, 0x1000, {},
958                   { .i2c_internal = true /* audio conf */ } },
959                 { "i2c2", make_i2c, &mms->i2c[2], 0x4020c000, 0x1000, {},
960                   { .i2c_internal = false /* shield 0 */ } },
961                 { "i2c3", make_i2c, &mms->i2c[3], 0x4020d000, 0x1000, {},
962                   { .i2c_internal = false /* shield 1 */ } },
963             },
964         }, {
965             .name = "apb_ppcexp2",
966             .ports = {
967                 { "scc", make_scc, &mms->scc, 0x40300000, 0x1000 },
968                 { "i2s-audio", make_unimp_dev, &mms->i2s_audio,
969                   0x40301000, 0x1000 },
970                 { "fpgaio", make_fpgaio, &mms->fpgaio, 0x40302000, 0x1000 },
971             },
972         }, {
973             .name = "ahb_ppcexp0",
974             .ports = {
975                 { "gfx", make_unimp_dev, &mms->gfx, 0x41000000, 0x140000 },
976                 { "gpio0", make_unimp_dev, &mms->gpio[0], 0x40100000, 0x1000 },
977                 { "gpio1", make_unimp_dev, &mms->gpio[1], 0x40101000, 0x1000 },
978                 { "gpio2", make_unimp_dev, &mms->gpio[2], 0x40102000, 0x1000 },
979                 { "gpio3", make_unimp_dev, &mms->gpio[3], 0x40103000, 0x1000 },
980                 { "eth", make_eth_dev, NULL, 0x42000000, 0x100000, { 48 } },
981             },
982         }, {
983             .name = "ahb_ppcexp1",
984             .ports = {
985                 { "dma0", make_dma, &mms->dma[0], 0x40110000, 0x1000, { 58, 56, 57 } },
986                 { "dma1", make_dma, &mms->dma[1], 0x40111000, 0x1000, { 61, 59, 60 } },
987                 { "dma2", make_dma, &mms->dma[2], 0x40112000, 0x1000, { 64, 62, 63 } },
988                 { "dma3", make_dma, &mms->dma[3], 0x40113000, 0x1000, { 67, 65, 66 } },
989             },
990         },
991     };
992 
993     const PPCInfo an524_ppcs[] = { {
994             .name = "apb_ppcexp0",
995             .ports = {
996                 { "bram-mpc", make_mpc, &mms->mpc[0], 0x58007000, 0x1000 },
997                 { "qspi-mpc", make_mpc, &mms->mpc[1], 0x58008000, 0x1000 },
998                 { "ddr-mpc", make_mpc, &mms->mpc[2], 0x58009000, 0x1000 },
999             },
1000         }, {
1001             .name = "apb_ppcexp1",
1002             .ports = {
1003                 { "i2c0", make_i2c, &mms->i2c[0], 0x41200000, 0x1000, {},
1004                   { .i2c_internal = true /* touchscreen */ } },
1005                 { "i2c1", make_i2c, &mms->i2c[1], 0x41201000, 0x1000, {},
1006                   { .i2c_internal = true /* audio conf */ } },
1007                 { "spi0", make_spi, &mms->spi[0], 0x41202000, 0x1000, { 52 } },
1008                 { "spi1", make_spi, &mms->spi[1], 0x41203000, 0x1000, { 53 } },
1009                 { "spi2", make_spi, &mms->spi[2], 0x41204000, 0x1000, { 54 } },
1010                 { "i2c2", make_i2c, &mms->i2c[2], 0x41205000, 0x1000, {},
1011                   { .i2c_internal = false /* shield 0 */ } },
1012                 { "i2c3", make_i2c, &mms->i2c[3], 0x41206000, 0x1000, {},
1013                   { .i2c_internal = false /* shield 1 */ } },
1014                 { /* port 7 reserved */ },
1015                 { "i2c4", make_i2c, &mms->i2c[4], 0x41208000, 0x1000, {},
1016                   { .i2c_internal = true /* DDR4 EEPROM */ } },
1017             },
1018         }, {
1019             .name = "apb_ppcexp2",
1020             .ports = {
1021                 { "scc", make_scc, &mms->scc, 0x41300000, 0x1000 },
1022                 { "i2s-audio", make_unimp_dev, &mms->i2s_audio,
1023                   0x41301000, 0x1000 },
1024                 { "fpgaio", make_fpgaio, &mms->fpgaio, 0x41302000, 0x1000 },
1025                 { "uart0", make_uart, &mms->uart[0], 0x41303000, 0x1000, { 32, 33, 42 } },
1026                 { "uart1", make_uart, &mms->uart[1], 0x41304000, 0x1000, { 34, 35, 43 } },
1027                 { "uart2", make_uart, &mms->uart[2], 0x41305000, 0x1000, { 36, 37, 44 } },
1028                 { "uart3", make_uart, &mms->uart[3], 0x41306000, 0x1000, { 38, 39, 45 } },
1029                 { "uart4", make_uart, &mms->uart[4], 0x41307000, 0x1000, { 40, 41, 46 } },
1030                 { "uart5", make_uart, &mms->uart[5], 0x41308000, 0x1000, { 124, 125, 126 } },
1031 
1032                 { /* port 9 reserved */ },
1033                 { "clcd", make_unimp_dev, &mms->cldc, 0x4130a000, 0x1000 },
1034                 { "rtc", make_rtc, &mms->rtc, 0x4130b000, 0x1000 },
1035             },
1036         }, {
1037             .name = "ahb_ppcexp0",
1038             .ports = {
1039                 { "gpio0", make_unimp_dev, &mms->gpio[0], 0x41100000, 0x1000 },
1040                 { "gpio1", make_unimp_dev, &mms->gpio[1], 0x41101000, 0x1000 },
1041                 { "gpio2", make_unimp_dev, &mms->gpio[2], 0x41102000, 0x1000 },
1042                 { "gpio3", make_unimp_dev, &mms->gpio[3], 0x41103000, 0x1000 },
1043                 { "eth-usb", make_eth_usb, NULL, 0x41400000, 0x200000, { 48 } },
1044             },
1045         },
1046     };
1047 
1048     const PPCInfo an547_ppcs[] = { {
1049             .name = "apb_ppcexp0",
1050             .ports = {
1051                 { "ssram-mpc", make_mpc, &mms->mpc[0], 0x57000000, 0x1000 },
1052                 { "qspi-mpc", make_mpc, &mms->mpc[1], 0x57001000, 0x1000 },
1053                 { "ddr-mpc", make_mpc, &mms->mpc[2], 0x57002000, 0x1000 },
1054             },
1055         }, {
1056             .name = "apb_ppcexp1",
1057             .ports = {
1058                 { "i2c0", make_i2c, &mms->i2c[0], 0x49200000, 0x1000, {},
1059                   { .i2c_internal = true /* touchscreen */ } },
1060                 { "i2c1", make_i2c, &mms->i2c[1], 0x49201000, 0x1000, {},
1061                   { .i2c_internal = true /* audio conf */ } },
1062                 { "spi0", make_spi, &mms->spi[0], 0x49202000, 0x1000, { 53 } },
1063                 { "spi1", make_spi, &mms->spi[1], 0x49203000, 0x1000, { 54 } },
1064                 { "spi2", make_spi, &mms->spi[2], 0x49204000, 0x1000, { 55 } },
1065                 { "i2c2", make_i2c, &mms->i2c[2], 0x49205000, 0x1000, {},
1066                   { .i2c_internal = false /* shield 0 */ } },
1067                 { "i2c3", make_i2c, &mms->i2c[3], 0x49206000, 0x1000, {},
1068                   { .i2c_internal = false /* shield 1 */ } },
1069                 { /* port 7 reserved */ },
1070                 { "i2c4", make_i2c, &mms->i2c[4], 0x49208000, 0x1000, {},
1071                   { .i2c_internal = true /* DDR4 EEPROM */ } },
1072             },
1073         }, {
1074             .name = "apb_ppcexp2",
1075             .ports = {
1076                 { "scc", make_scc, &mms->scc, 0x49300000, 0x1000 },
1077                 { "i2s-audio", make_unimp_dev, &mms->i2s_audio, 0x49301000, 0x1000 },
1078                 { "fpgaio", make_fpgaio, &mms->fpgaio, 0x49302000, 0x1000 },
1079                 { "uart0", make_uart, &mms->uart[0], 0x49303000, 0x1000, { 33, 34, 43 } },
1080                 { "uart1", make_uart, &mms->uart[1], 0x49304000, 0x1000, { 35, 36, 44 } },
1081                 { "uart2", make_uart, &mms->uart[2], 0x49305000, 0x1000, { 37, 38, 45 } },
1082                 { "uart3", make_uart, &mms->uart[3], 0x49306000, 0x1000, { 39, 40, 46 } },
1083                 { "uart4", make_uart, &mms->uart[4], 0x49307000, 0x1000, { 41, 42, 47 } },
1084                 { "uart5", make_uart, &mms->uart[5], 0x49308000, 0x1000, { 125, 126, 127 } },
1085 
1086                 { /* port 9 reserved */ },
1087                 { "clcd", make_unimp_dev, &mms->cldc, 0x4930a000, 0x1000 },
1088                 { "rtc", make_rtc, &mms->rtc, 0x4930b000, 0x1000 },
1089             },
1090         }, {
1091             .name = "ahb_ppcexp0",
1092             .ports = {
1093                 { "gpio0", make_unimp_dev, &mms->gpio[0], 0x41100000, 0x1000 },
1094                 { "gpio1", make_unimp_dev, &mms->gpio[1], 0x41101000, 0x1000 },
1095                 { "gpio2", make_unimp_dev, &mms->gpio[2], 0x41102000, 0x1000 },
1096                 { "gpio3", make_unimp_dev, &mms->gpio[3], 0x41103000, 0x1000 },
1097                 { /* port 4 USER AHB interface 0 */ },
1098                 { /* port 5 USER AHB interface 1 */ },
1099                 { /* port 6 USER AHB interface 2 */ },
1100                 { /* port 7 USER AHB interface 3 */ },
1101                 { "eth-usb", make_eth_usb, NULL, 0x41400000, 0x200000, { 49 } },
1102             },
1103         },
1104     };
1105 
1106     switch (mmc->fpga_type) {
1107     case FPGA_AN505:
1108     case FPGA_AN521:
1109         ppcs = an505_ppcs;
1110         num_ppcs = ARRAY_SIZE(an505_ppcs);
1111         break;
1112     case FPGA_AN524:
1113         ppcs = an524_ppcs;
1114         num_ppcs = ARRAY_SIZE(an524_ppcs);
1115         break;
1116     case FPGA_AN547:
1117         ppcs = an547_ppcs;
1118         num_ppcs = ARRAY_SIZE(an547_ppcs);
1119         break;
1120     default:
1121         g_assert_not_reached();
1122     }
1123 
1124     for (i = 0; i < num_ppcs; i++) {
1125         const PPCInfo *ppcinfo = &ppcs[i];
1126         TZPPC *ppc = &mms->ppc[i];
1127         DeviceState *ppcdev;
1128         int port;
1129         char *gpioname;
1130 
1131         object_initialize_child(OBJECT(machine), ppcinfo->name, ppc,
1132                                 TYPE_TZ_PPC);
1133         ppcdev = DEVICE(ppc);
1134 
1135         for (port = 0; port < TZ_NUM_PORTS; port++) {
1136             const PPCPortInfo *pinfo = &ppcinfo->ports[port];
1137             MemoryRegion *mr;
1138             char *portname;
1139 
1140             if (!pinfo->devfn) {
1141                 continue;
1142             }
1143 
1144             mr = pinfo->devfn(mms, pinfo->opaque, pinfo->name, pinfo->size,
1145                               pinfo->irqs, &pinfo->extradata);
1146             portname = g_strdup_printf("port[%d]", port);
1147             object_property_set_link(OBJECT(ppc), portname, OBJECT(mr),
1148                                      &error_fatal);
1149             g_free(portname);
1150         }
1151 
1152         sysbus_realize(SYS_BUS_DEVICE(ppc), &error_fatal);
1153 
1154         for (port = 0; port < TZ_NUM_PORTS; port++) {
1155             const PPCPortInfo *pinfo = &ppcinfo->ports[port];
1156 
1157             if (!pinfo->devfn) {
1158                 continue;
1159             }
1160             sysbus_mmio_map(SYS_BUS_DEVICE(ppc), port, pinfo->addr);
1161 
1162             gpioname = g_strdup_printf("%s_nonsec", ppcinfo->name);
1163             qdev_connect_gpio_out_named(iotkitdev, gpioname, port,
1164                                         qdev_get_gpio_in_named(ppcdev,
1165                                                                "cfg_nonsec",
1166                                                                port));
1167             g_free(gpioname);
1168             gpioname = g_strdup_printf("%s_ap", ppcinfo->name);
1169             qdev_connect_gpio_out_named(iotkitdev, gpioname, port,
1170                                         qdev_get_gpio_in_named(ppcdev,
1171                                                                "cfg_ap", port));
1172             g_free(gpioname);
1173         }
1174 
1175         gpioname = g_strdup_printf("%s_irq_enable", ppcinfo->name);
1176         qdev_connect_gpio_out_named(iotkitdev, gpioname, 0,
1177                                     qdev_get_gpio_in_named(ppcdev,
1178                                                            "irq_enable", 0));
1179         g_free(gpioname);
1180         gpioname = g_strdup_printf("%s_irq_clear", ppcinfo->name);
1181         qdev_connect_gpio_out_named(iotkitdev, gpioname, 0,
1182                                     qdev_get_gpio_in_named(ppcdev,
1183                                                            "irq_clear", 0));
1184         g_free(gpioname);
1185         gpioname = g_strdup_printf("%s_irq_status", ppcinfo->name);
1186         qdev_connect_gpio_out_named(ppcdev, "irq", 0,
1187                                     qdev_get_gpio_in_named(iotkitdev,
1188                                                            gpioname, 0));
1189         g_free(gpioname);
1190 
1191         qdev_connect_gpio_out(dev_splitter, i,
1192                               qdev_get_gpio_in_named(ppcdev,
1193                                                      "cfg_sec_resp", 0));
1194     }
1195 
1196     create_unimplemented_device("FPGA NS PC", 0x48007000, 0x1000);
1197 
1198     if (mmc->fpga_type == FPGA_AN547) {
1199         create_unimplemented_device("U55 timing adapter 0", 0x48102000, 0x1000);
1200         create_unimplemented_device("U55 timing adapter 1", 0x48103000, 0x1000);
1201     }
1202 
1203     create_non_mpc_ram(mms);
1204 
1205     if (mmc->fpga_type == FPGA_AN524) {
1206         /*
1207          * Connect the line from the SCC so that we can remap when the
1208          * guest updates that register.
1209          */
1210         mms->remap_irq = qemu_allocate_irq(remap_irq_fn, mms, 0);
1211         qdev_connect_gpio_out_named(DEVICE(&mms->scc), "remap", 0,
1212                                     mms->remap_irq);
1213     }
1214 
1215     armv7m_load_kernel(mms->iotkit.armv7m[0].cpu, machine->kernel_filename,
1216                        0, boot_ram_size(mms));
1217 }
1218 
1219 static void mps2_tz_idau_check(IDAUInterface *ii, uint32_t address,
1220                                int *iregion, bool *exempt, bool *ns, bool *nsc)
1221 {
1222     /*
1223      * The MPS2 TZ FPGA images have IDAUs in them which are connected to
1224      * the Master Security Controllers. These have the same logic as
1225      * is used by the IoTKit for the IDAU connected to the CPU, except
1226      * that MSCs don't care about the NSC attribute.
1227      */
1228     int region = extract32(address, 28, 4);
1229 
1230     *ns = !(region & 1);
1231     *nsc = false;
1232     /* 0xe0000000..0xe00fffff and 0xf0000000..0xf00fffff are exempt */
1233     *exempt = (address & 0xeff00000) == 0xe0000000;
1234     *iregion = region;
1235 }
1236 
1237 static char *mps2_get_remap(Object *obj, Error **errp)
1238 {
1239     MPS2TZMachineState *mms = MPS2TZ_MACHINE(obj);
1240     const char *val = mms->remap ? "QSPI" : "BRAM";
1241     return g_strdup(val);
1242 }
1243 
1244 static void mps2_set_remap(Object *obj, const char *value, Error **errp)
1245 {
1246     MPS2TZMachineState *mms = MPS2TZ_MACHINE(obj);
1247 
1248     if (!strcmp(value, "BRAM")) {
1249         mms->remap = false;
1250     } else if (!strcmp(value, "QSPI")) {
1251         mms->remap = true;
1252     } else {
1253         error_setg(errp, "Invalid remap value");
1254         error_append_hint(errp, "Valid values are BRAM and QSPI.\n");
1255     }
1256 }
1257 
1258 static void mps2_machine_reset(MachineState *machine, ResetType type)
1259 {
1260     MPS2TZMachineState *mms = MPS2TZ_MACHINE(machine);
1261 
1262     /*
1263      * Set the initial memory mapping before triggering the reset of
1264      * the rest of the system, so that the guest image loader and CPU
1265      * reset see the correct mapping.
1266      */
1267     remap_memory(mms, mms->remap);
1268     qemu_devices_reset(type);
1269 }
1270 
1271 static void mps2tz_class_init(ObjectClass *oc, const void *data)
1272 {
1273     MachineClass *mc = MACHINE_CLASS(oc);
1274     IDAUInterfaceClass *iic = IDAU_INTERFACE_CLASS(oc);
1275     MPS2TZMachineClass *mmc = MPS2TZ_MACHINE_CLASS(oc);
1276 
1277     mc->init = mps2tz_common_init;
1278     mc->reset = mps2_machine_reset;
1279     iic->check = mps2_tz_idau_check;
1280 
1281     /* Most machines leave these at the SSE defaults */
1282     mmc->cpu0_mpu_ns = MPU_REGION_DEFAULT;
1283     mmc->cpu0_mpu_s = MPU_REGION_DEFAULT;
1284     mmc->cpu1_mpu_ns = MPU_REGION_DEFAULT;
1285     mmc->cpu1_mpu_s = MPU_REGION_DEFAULT;
1286 }
1287 
1288 static void mps2tz_set_default_ram_info(MPS2TZMachineClass *mmc)
1289 {
1290     /*
1291      * Set mc->default_ram_size and default_ram_id from the
1292      * information in mmc->raminfo.
1293      */
1294     MachineClass *mc = MACHINE_CLASS(mmc);
1295     const RAMInfo *p;
1296 
1297     for (p = mmc->raminfo; p->name; p++) {
1298         if (p->mrindex < 0) {
1299             /* Found the entry for "system memory" */
1300             mc->default_ram_size = p->size;
1301             mc->default_ram_id = p->name;
1302             return;
1303         }
1304     }
1305     g_assert_not_reached();
1306 }
1307 
1308 static void mps2tz_an505_class_init(ObjectClass *oc, const void *data)
1309 {
1310     MachineClass *mc = MACHINE_CLASS(oc);
1311     MPS2TZMachineClass *mmc = MPS2TZ_MACHINE_CLASS(oc);
1312     static const char * const valid_cpu_types[] = {
1313         ARM_CPU_TYPE_NAME("cortex-m33"),
1314         NULL
1315     };
1316 
1317     mc->desc = "ARM MPS2 with AN505 FPGA image for Cortex-M33";
1318     mc->default_cpus = 1;
1319     mc->min_cpus = mc->default_cpus;
1320     mc->max_cpus = mc->default_cpus;
1321     mmc->fpga_type = FPGA_AN505;
1322     mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-m33");
1323     mc->valid_cpu_types = valid_cpu_types;
1324     mmc->scc_id = 0x41045050;
1325     mmc->sysclk_frq = 20 * 1000 * 1000; /* 20MHz */
1326     mmc->apb_periph_frq = mmc->sysclk_frq;
1327     mmc->oscclk = an505_oscclk;
1328     mmc->len_oscclk = ARRAY_SIZE(an505_oscclk);
1329     mmc->fpgaio_num_leds = 2;
1330     mmc->fpgaio_has_switches = false;
1331     mmc->fpgaio_has_dbgctrl = false;
1332     mmc->numirq = 92;
1333     mmc->uart_overflow_irq = 47;
1334     mmc->init_svtor = 0x10000000;
1335     mmc->sram_addr_width = 15;
1336     mmc->raminfo = an505_raminfo;
1337     mmc->armsse_type = TYPE_IOTKIT;
1338     mmc->boot_ram_size = 0;
1339     mps2tz_set_default_ram_info(mmc);
1340 }
1341 
1342 static void mps2tz_an521_class_init(ObjectClass *oc, const void *data)
1343 {
1344     MachineClass *mc = MACHINE_CLASS(oc);
1345     MPS2TZMachineClass *mmc = MPS2TZ_MACHINE_CLASS(oc);
1346     static const char * const valid_cpu_types[] = {
1347         ARM_CPU_TYPE_NAME("cortex-m33"),
1348         NULL
1349     };
1350 
1351     mc->desc = "ARM MPS2 with AN521 FPGA image for dual Cortex-M33";
1352     mc->default_cpus = 2;
1353     mc->min_cpus = mc->default_cpus;
1354     mc->max_cpus = mc->default_cpus;
1355     mmc->fpga_type = FPGA_AN521;
1356     mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-m33");
1357     mc->valid_cpu_types = valid_cpu_types;
1358     mmc->scc_id = 0x41045210;
1359     mmc->sysclk_frq = 20 * 1000 * 1000; /* 20MHz */
1360     mmc->apb_periph_frq = mmc->sysclk_frq;
1361     mmc->oscclk = an505_oscclk; /* AN521 is the same as AN505 here */
1362     mmc->len_oscclk = ARRAY_SIZE(an505_oscclk);
1363     mmc->fpgaio_num_leds = 2;
1364     mmc->fpgaio_has_switches = false;
1365     mmc->fpgaio_has_dbgctrl = false;
1366     mmc->numirq = 92;
1367     mmc->uart_overflow_irq = 47;
1368     mmc->init_svtor = 0x10000000;
1369     mmc->sram_addr_width = 15;
1370     mmc->raminfo = an505_raminfo; /* AN521 is the same as AN505 here */
1371     mmc->armsse_type = TYPE_SSE200;
1372     mmc->boot_ram_size = 0;
1373     mps2tz_set_default_ram_info(mmc);
1374 }
1375 
1376 static void mps3tz_an524_class_init(ObjectClass *oc, const void *data)
1377 {
1378     MachineClass *mc = MACHINE_CLASS(oc);
1379     MPS2TZMachineClass *mmc = MPS2TZ_MACHINE_CLASS(oc);
1380     static const char * const valid_cpu_types[] = {
1381         ARM_CPU_TYPE_NAME("cortex-m33"),
1382         NULL
1383     };
1384 
1385     mc->desc = "ARM MPS3 with AN524 FPGA image for dual Cortex-M33";
1386     mc->default_cpus = 2;
1387     mc->min_cpus = mc->default_cpus;
1388     mc->max_cpus = mc->default_cpus;
1389     mmc->fpga_type = FPGA_AN524;
1390     mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-m33");
1391     mc->valid_cpu_types = valid_cpu_types;
1392     mmc->scc_id = 0x41045240;
1393     mmc->sysclk_frq = 32 * 1000 * 1000; /* 32MHz */
1394     mmc->apb_periph_frq = mmc->sysclk_frq;
1395     mmc->oscclk = an524_oscclk;
1396     mmc->len_oscclk = ARRAY_SIZE(an524_oscclk);
1397     mmc->fpgaio_num_leds = 10;
1398     mmc->fpgaio_has_switches = true;
1399     mmc->fpgaio_has_dbgctrl = false;
1400     mmc->numirq = 95;
1401     mmc->uart_overflow_irq = 47;
1402     mmc->init_svtor = 0x10000000;
1403     mmc->sram_addr_width = 15;
1404     mmc->raminfo = an524_raminfo;
1405     mmc->armsse_type = TYPE_SSE200;
1406     mmc->boot_ram_size = 0;
1407     mps2tz_set_default_ram_info(mmc);
1408 
1409     object_class_property_add_str(oc, "remap", mps2_get_remap, mps2_set_remap);
1410     object_class_property_set_description(oc, "remap",
1411                                           "Set memory mapping. Valid values "
1412                                           "are BRAM (default) and QSPI.");
1413 }
1414 
1415 static void mps3tz_an547_class_init(ObjectClass *oc, const void *data)
1416 {
1417     MachineClass *mc = MACHINE_CLASS(oc);
1418     MPS2TZMachineClass *mmc = MPS2TZ_MACHINE_CLASS(oc);
1419     static const char * const valid_cpu_types[] = {
1420         ARM_CPU_TYPE_NAME("cortex-m55"),
1421         NULL
1422     };
1423 
1424     mc->desc = "ARM MPS3 with AN547 FPGA image for Cortex-M55";
1425     mc->default_cpus = 1;
1426     mc->min_cpus = mc->default_cpus;
1427     mc->max_cpus = mc->default_cpus;
1428     mmc->fpga_type = FPGA_AN547;
1429     mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-m55");
1430     mc->valid_cpu_types = valid_cpu_types;
1431     mmc->scc_id = 0x41055470;
1432     mmc->sysclk_frq = 32 * 1000 * 1000; /* 32MHz */
1433     mmc->apb_periph_frq = 25 * 1000 * 1000; /* 25MHz */
1434     mmc->oscclk = an524_oscclk; /* same as AN524 */
1435     mmc->len_oscclk = ARRAY_SIZE(an524_oscclk);
1436     mmc->fpgaio_num_leds = 10;
1437     mmc->fpgaio_has_switches = true;
1438     mmc->fpgaio_has_dbgctrl = true;
1439     mmc->numirq = 96;
1440     mmc->uart_overflow_irq = 48;
1441     mmc->init_svtor = 0x00000000;
1442     mmc->cpu0_mpu_s = mmc->cpu0_mpu_ns = 16;
1443     mmc->sram_addr_width = 21;
1444     mmc->raminfo = an547_raminfo;
1445     mmc->armsse_type = TYPE_SSE300;
1446     mmc->boot_ram_size = 512 * KiB;
1447     mps2tz_set_default_ram_info(mmc);
1448 }
1449 
1450 static const TypeInfo mps2tz_info = {
1451     .name = TYPE_MPS2TZ_MACHINE,
1452     .parent = TYPE_MACHINE,
1453     .abstract = true,
1454     .instance_size = sizeof(MPS2TZMachineState),
1455     .class_size = sizeof(MPS2TZMachineClass),
1456     .class_init = mps2tz_class_init,
1457     .interfaces = (const InterfaceInfo[]) {
1458         { TYPE_IDAU_INTERFACE },
1459         { }
1460     },
1461 };
1462 
1463 static const TypeInfo mps2tz_an505_info = {
1464     .name = TYPE_MPS2TZ_AN505_MACHINE,
1465     .parent = TYPE_MPS2TZ_MACHINE,
1466     .class_init = mps2tz_an505_class_init,
1467     .interfaces = arm_machine_interfaces,
1468 };
1469 
1470 static const TypeInfo mps2tz_an521_info = {
1471     .name = TYPE_MPS2TZ_AN521_MACHINE,
1472     .parent = TYPE_MPS2TZ_MACHINE,
1473     .class_init = mps2tz_an521_class_init,
1474     .interfaces = arm_machine_interfaces,
1475 };
1476 
1477 static const TypeInfo mps3tz_an524_info = {
1478     .name = TYPE_MPS3TZ_AN524_MACHINE,
1479     .parent = TYPE_MPS2TZ_MACHINE,
1480     .class_init = mps3tz_an524_class_init,
1481     .interfaces = arm_machine_interfaces,
1482 };
1483 
1484 static const TypeInfo mps3tz_an547_info = {
1485     .name = TYPE_MPS3TZ_AN547_MACHINE,
1486     .parent = TYPE_MPS2TZ_MACHINE,
1487     .class_init = mps3tz_an547_class_init,
1488     .interfaces = arm_machine_interfaces,
1489 };
1490 
1491 static void mps2tz_machine_init(void)
1492 {
1493     type_register_static(&mps2tz_info);
1494     type_register_static(&mps2tz_an505_info);
1495     type_register_static(&mps2tz_an521_info);
1496     type_register_static(&mps3tz_an524_info);
1497     type_register_static(&mps3tz_an547_info);
1498 }
1499 
1500 type_init(mps2tz_machine_init);
1501