cachepc-qemu

Fork of AMDESE/qemu with changes for cachepc side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-qemu
Log | Files | Refs | Submodules | LICENSE | sfeed.txt

musca.c (24897B)


      1/*
      2 * Arm Musca-B1 test chip board emulation
      3 *
      4 * Copyright (c) 2019 Linaro Limited
      5 * Written by Peter Maydell
      6 *
      7 *  This program is free software; you can redistribute it and/or modify
      8 *  it under the terms of the GNU General Public License version 2 or
      9 *  (at your option) any later version.
     10 */
     11
     12/*
     13 * The Musca boards are a reference implementation of a system using
     14 * the SSE-200 subsystem for embedded:
     15 * https://developer.arm.com/products/system-design/development-boards/iot-test-chips-and-boards/musca-a-test-chip-board
     16 * https://developer.arm.com/products/system-design/development-boards/iot-test-chips-and-boards/musca-b-test-chip-board
     17 * We model the A and B1 variants of this board, as described in the TRMs:
     18 * https://developer.arm.com/documentation/101107/latest/
     19 * https://developer.arm.com/documentation/101312/latest/
     20 */
     21
     22#include "qemu/osdep.h"
     23#include "qemu/error-report.h"
     24#include "qapi/error.h"
     25#include "exec/address-spaces.h"
     26#include "sysemu/sysemu.h"
     27#include "hw/arm/boot.h"
     28#include "hw/arm/armsse.h"
     29#include "hw/boards.h"
     30#include "hw/char/pl011.h"
     31#include "hw/core/split-irq.h"
     32#include "hw/misc/tz-mpc.h"
     33#include "hw/misc/tz-ppc.h"
     34#include "hw/misc/unimp.h"
     35#include "hw/rtc/pl031.h"
     36#include "hw/qdev-clock.h"
     37#include "qom/object.h"
     38
     39#define MUSCA_NUMIRQ_MAX 96
     40#define MUSCA_PPC_MAX 3
     41#define MUSCA_MPC_MAX 5
     42
     43typedef struct MPCInfo MPCInfo;
     44
     45typedef enum MuscaType {
     46    MUSCA_A,
     47    MUSCA_B1,
     48} MuscaType;
     49
     50struct MuscaMachineClass {
     51    MachineClass parent;
     52    MuscaType type;
     53    uint32_t init_svtor;
     54    int sram_addr_width;
     55    int num_irqs;
     56    const MPCInfo *mpc_info;
     57    int num_mpcs;
     58};
     59
     60struct MuscaMachineState {
     61    MachineState parent;
     62
     63    ARMSSE sse;
     64    /* RAM and flash */
     65    MemoryRegion ram[MUSCA_MPC_MAX];
     66    SplitIRQ cpu_irq_splitter[MUSCA_NUMIRQ_MAX];
     67    SplitIRQ sec_resp_splitter;
     68    TZPPC ppc[MUSCA_PPC_MAX];
     69    MemoryRegion container;
     70    UnimplementedDeviceState eflash[2];
     71    UnimplementedDeviceState qspi;
     72    TZMPC mpc[MUSCA_MPC_MAX];
     73    UnimplementedDeviceState mhu[2];
     74    UnimplementedDeviceState pwm[3];
     75    UnimplementedDeviceState i2s;
     76    PL011State uart[2];
     77    UnimplementedDeviceState i2c[2];
     78    UnimplementedDeviceState spi;
     79    UnimplementedDeviceState scc;
     80    UnimplementedDeviceState timer;
     81    PL031State rtc;
     82    UnimplementedDeviceState pvt;
     83    UnimplementedDeviceState sdio;
     84    UnimplementedDeviceState gpio;
     85    UnimplementedDeviceState cryptoisland;
     86    Clock *sysclk;
     87    Clock *s32kclk;
     88};
     89
     90#define TYPE_MUSCA_MACHINE "musca"
     91#define TYPE_MUSCA_A_MACHINE MACHINE_TYPE_NAME("musca-a")
     92#define TYPE_MUSCA_B1_MACHINE MACHINE_TYPE_NAME("musca-b1")
     93
     94OBJECT_DECLARE_TYPE(MuscaMachineState, MuscaMachineClass, MUSCA_MACHINE)
     95
     96/*
     97 * Main SYSCLK frequency in Hz
     98 * TODO this should really be different for the two cores, but we
     99 * don't model that in our SSE-200 model yet.
    100 */
    101#define SYSCLK_FRQ 40000000
    102/* Slow 32Khz S32KCLK frequency in Hz */
    103#define S32KCLK_FRQ (32 * 1000)
    104
    105static qemu_irq get_sse_irq_in(MuscaMachineState *mms, int irqno)
    106{
    107    /* Return a qemu_irq which will signal IRQ n to all CPUs in the SSE. */
    108    assert(irqno < MUSCA_NUMIRQ_MAX);
    109
    110    return qdev_get_gpio_in(DEVICE(&mms->cpu_irq_splitter[irqno]), 0);
    111}
    112
    113/*
    114 * Most of the devices in the Musca board sit behind Peripheral Protection
    115 * Controllers. These data structures define the layout of which devices
    116 * sit behind which PPCs.
    117 * The devfn for each port is a function which creates, configures
    118 * and initializes the device, returning the MemoryRegion which
    119 * needs to be plugged into the downstream end of the PPC port.
    120 */
    121typedef MemoryRegion *MakeDevFn(MuscaMachineState *mms, void *opaque,
    122                                const char *name, hwaddr size);
    123
    124typedef struct PPCPortInfo {
    125    const char *name;
    126    MakeDevFn *devfn;
    127    void *opaque;
    128    hwaddr addr;
    129    hwaddr size;
    130} PPCPortInfo;
    131
    132typedef struct PPCInfo {
    133    const char *name;
    134    PPCPortInfo ports[TZ_NUM_PORTS];
    135} PPCInfo;
    136
    137static MemoryRegion *make_unimp_dev(MuscaMachineState *mms,
    138                                    void *opaque, const char *name, hwaddr size)
    139{
    140    /*
    141     * Initialize, configure and realize a TYPE_UNIMPLEMENTED_DEVICE,
    142     * and return a pointer to its MemoryRegion.
    143     */
    144    UnimplementedDeviceState *uds = opaque;
    145
    146    object_initialize_child(OBJECT(mms), name, uds, TYPE_UNIMPLEMENTED_DEVICE);
    147    qdev_prop_set_string(DEVICE(uds), "name", name);
    148    qdev_prop_set_uint64(DEVICE(uds), "size", size);
    149    sysbus_realize(SYS_BUS_DEVICE(uds), &error_fatal);
    150    return sysbus_mmio_get_region(SYS_BUS_DEVICE(uds), 0);
    151}
    152
    153typedef enum MPCInfoType {
    154    MPC_RAM,
    155    MPC_ROM,
    156    MPC_CRYPTOISLAND,
    157} MPCInfoType;
    158
    159struct MPCInfo {
    160    const char *name;
    161    hwaddr addr;
    162    hwaddr size;
    163    MPCInfoType type;
    164};
    165
    166/* Order of the MPCs here must match the order of the bits in SECMPCINTSTATUS */
    167static const MPCInfo a_mpc_info[] = { {
    168        .name = "qspi",
    169        .type = MPC_ROM,
    170        .addr = 0x00200000,
    171        .size = 0x00800000,
    172    }, {
    173        .name = "sram",
    174        .type = MPC_RAM,
    175        .addr = 0x00000000,
    176        .size = 0x00200000,
    177    }
    178};
    179
    180static const MPCInfo b1_mpc_info[] = { {
    181        .name = "qspi",
    182        .type = MPC_ROM,
    183        .addr = 0x00000000,
    184        .size = 0x02000000,
    185    }, {
    186        .name = "sram",
    187        .type = MPC_RAM,
    188        .addr = 0x0a400000,
    189        .size = 0x00080000,
    190    }, {
    191        .name = "eflash0",
    192        .type = MPC_ROM,
    193        .addr = 0x0a000000,
    194        .size = 0x00200000,
    195    }, {
    196        .name = "eflash1",
    197        .type = MPC_ROM,
    198        .addr = 0x0a200000,
    199        .size = 0x00200000,
    200    }, {
    201        .name = "cryptoisland",
    202        .type = MPC_CRYPTOISLAND,
    203        .addr = 0x0a000000,
    204        .size = 0x00200000,
    205    }
    206};
    207
    208static MemoryRegion *make_mpc(MuscaMachineState *mms, void *opaque,
    209                              const char *name, hwaddr size)
    210{
    211    /*
    212     * Create an MPC and the RAM or flash behind it.
    213     * MPC 0: eFlash 0
    214     * MPC 1: eFlash 1
    215     * MPC 2: SRAM
    216     * MPC 3: QSPI flash
    217     * MPC 4: CryptoIsland
    218     * For now we implement the flash regions as ROM (ie not programmable)
    219     * (with their control interface memory regions being unimplemented
    220     * stubs behind the PPCs).
    221     * The whole CryptoIsland region behind its MPC is an unimplemented stub.
    222     */
    223    MuscaMachineClass *mmc = MUSCA_MACHINE_GET_CLASS(mms);
    224    TZMPC *mpc = opaque;
    225    int i = mpc - &mms->mpc[0];
    226    MemoryRegion *downstream;
    227    MemoryRegion *upstream;
    228    UnimplementedDeviceState *uds;
    229    char *mpcname;
    230    const MPCInfo *mpcinfo = mmc->mpc_info;
    231
    232    mpcname = g_strdup_printf("%s-mpc", mpcinfo[i].name);
    233
    234    switch (mpcinfo[i].type) {
    235    case MPC_ROM:
    236        downstream = &mms->ram[i];
    237        memory_region_init_rom(downstream, NULL, mpcinfo[i].name,
    238                               mpcinfo[i].size, &error_fatal);
    239        break;
    240    case MPC_RAM:
    241        downstream = &mms->ram[i];
    242        memory_region_init_ram(downstream, NULL, mpcinfo[i].name,
    243                               mpcinfo[i].size, &error_fatal);
    244        break;
    245    case MPC_CRYPTOISLAND:
    246        /* We don't implement the CryptoIsland yet */
    247        uds = &mms->cryptoisland;
    248        object_initialize_child(OBJECT(mms), name, uds,
    249                                TYPE_UNIMPLEMENTED_DEVICE);
    250        qdev_prop_set_string(DEVICE(uds), "name", mpcinfo[i].name);
    251        qdev_prop_set_uint64(DEVICE(uds), "size", mpcinfo[i].size);
    252        sysbus_realize(SYS_BUS_DEVICE(uds), &error_fatal);
    253        downstream = sysbus_mmio_get_region(SYS_BUS_DEVICE(uds), 0);
    254        break;
    255    default:
    256        g_assert_not_reached();
    257    }
    258
    259    object_initialize_child(OBJECT(mms), mpcname, mpc, TYPE_TZ_MPC);
    260    object_property_set_link(OBJECT(mpc), "downstream", OBJECT(downstream),
    261                             &error_fatal);
    262    sysbus_realize(SYS_BUS_DEVICE(mpc), &error_fatal);
    263    /* Map the upstream end of the MPC into system memory */
    264    upstream = sysbus_mmio_get_region(SYS_BUS_DEVICE(mpc), 1);
    265    memory_region_add_subregion(get_system_memory(), mpcinfo[i].addr, upstream);
    266    /* and connect its interrupt to the SSE-200 */
    267    qdev_connect_gpio_out_named(DEVICE(mpc), "irq", 0,
    268                                qdev_get_gpio_in_named(DEVICE(&mms->sse),
    269                                                       "mpcexp_status", i));
    270
    271    g_free(mpcname);
    272    /* Return the register interface MR for our caller to map behind the PPC */
    273    return sysbus_mmio_get_region(SYS_BUS_DEVICE(mpc), 0);
    274}
    275
    276static MemoryRegion *make_rtc(MuscaMachineState *mms, void *opaque,
    277                              const char *name, hwaddr size)
    278{
    279    PL031State *rtc = opaque;
    280
    281    object_initialize_child(OBJECT(mms), name, rtc, TYPE_PL031);
    282    sysbus_realize(SYS_BUS_DEVICE(rtc), &error_fatal);
    283    sysbus_connect_irq(SYS_BUS_DEVICE(rtc), 0, get_sse_irq_in(mms, 39));
    284    return sysbus_mmio_get_region(SYS_BUS_DEVICE(rtc), 0);
    285}
    286
    287static MemoryRegion *make_uart(MuscaMachineState *mms, void *opaque,
    288                               const char *name, hwaddr size)
    289{
    290    PL011State *uart = opaque;
    291    int i = uart - &mms->uart[0];
    292    int irqbase = 7 + i * 6;
    293    SysBusDevice *s;
    294
    295    object_initialize_child(OBJECT(mms), name, uart, TYPE_PL011);
    296    qdev_prop_set_chr(DEVICE(uart), "chardev", serial_hd(i));
    297    sysbus_realize(SYS_BUS_DEVICE(uart), &error_fatal);
    298    s = SYS_BUS_DEVICE(uart);
    299    sysbus_connect_irq(s, 0, get_sse_irq_in(mms, irqbase + 5)); /* combined */
    300    sysbus_connect_irq(s, 1, get_sse_irq_in(mms, irqbase + 0)); /* RX */
    301    sysbus_connect_irq(s, 2, get_sse_irq_in(mms, irqbase + 1)); /* TX */
    302    sysbus_connect_irq(s, 3, get_sse_irq_in(mms, irqbase + 2)); /* RT */
    303    sysbus_connect_irq(s, 4, get_sse_irq_in(mms, irqbase + 3)); /* MS */
    304    sysbus_connect_irq(s, 5, get_sse_irq_in(mms, irqbase + 4)); /* E */
    305    return sysbus_mmio_get_region(SYS_BUS_DEVICE(uart), 0);
    306}
    307
    308static MemoryRegion *make_musca_a_devs(MuscaMachineState *mms, void *opaque,
    309                                       const char *name, hwaddr size)
    310{
    311    /*
    312     * Create the container MemoryRegion for all the devices that live
    313     * behind the Musca-A PPC's single port. These devices don't have a PPC
    314     * port each, but we use the PPCPortInfo struct as a convenient way
    315     * to describe them. Note that addresses here are relative to the base
    316     * address of the PPC port region: 0x40100000, and devices appear both
    317     * at the 0x4... NS region and the 0x5... S region.
    318     */
    319    int i;
    320    MemoryRegion *container = &mms->container;
    321
    322    const PPCPortInfo devices[] = {
    323        { "uart0", make_uart, &mms->uart[0], 0x1000, 0x1000 },
    324        { "uart1", make_uart, &mms->uart[1], 0x2000, 0x1000 },
    325        { "spi", make_unimp_dev, &mms->spi, 0x3000, 0x1000 },
    326        { "i2c0", make_unimp_dev, &mms->i2c[0], 0x4000, 0x1000 },
    327        { "i2c1", make_unimp_dev, &mms->i2c[1], 0x5000, 0x1000 },
    328        { "i2s", make_unimp_dev, &mms->i2s, 0x6000, 0x1000 },
    329        { "pwm0", make_unimp_dev, &mms->pwm[0], 0x7000, 0x1000 },
    330        { "rtc", make_rtc, &mms->rtc, 0x8000, 0x1000 },
    331        { "qspi", make_unimp_dev, &mms->qspi, 0xa000, 0x1000 },
    332        { "timer", make_unimp_dev, &mms->timer, 0xb000, 0x1000 },
    333        { "scc", make_unimp_dev, &mms->scc, 0xc000, 0x1000 },
    334        { "pwm1", make_unimp_dev, &mms->pwm[1], 0xe000, 0x1000 },
    335        { "pwm2", make_unimp_dev, &mms->pwm[2], 0xf000, 0x1000 },
    336        { "gpio", make_unimp_dev, &mms->gpio, 0x10000, 0x1000 },
    337        { "mpc0", make_mpc, &mms->mpc[0], 0x12000, 0x1000 },
    338        { "mpc1", make_mpc, &mms->mpc[1], 0x13000, 0x1000 },
    339    };
    340
    341    memory_region_init(container, OBJECT(mms), "musca-device-container", size);
    342
    343    for (i = 0; i < ARRAY_SIZE(devices); i++) {
    344        const PPCPortInfo *pinfo = &devices[i];
    345        MemoryRegion *mr;
    346
    347        mr = pinfo->devfn(mms, pinfo->opaque, pinfo->name, pinfo->size);
    348        memory_region_add_subregion(container, pinfo->addr, mr);
    349    }
    350
    351    return &mms->container;
    352}
    353
    354static void musca_init(MachineState *machine)
    355{
    356    MuscaMachineState *mms = MUSCA_MACHINE(machine);
    357    MuscaMachineClass *mmc = MUSCA_MACHINE_GET_CLASS(mms);
    358    MachineClass *mc = MACHINE_GET_CLASS(machine);
    359    MemoryRegion *system_memory = get_system_memory();
    360    DeviceState *ssedev;
    361    DeviceState *dev_splitter;
    362    const PPCInfo *ppcs;
    363    int num_ppcs;
    364    int i;
    365
    366    assert(mmc->num_irqs <= MUSCA_NUMIRQ_MAX);
    367    assert(mmc->num_mpcs <= MUSCA_MPC_MAX);
    368
    369    if (strcmp(machine->cpu_type, mc->default_cpu_type) != 0) {
    370        error_report("This board can only be used with CPU %s",
    371                     mc->default_cpu_type);
    372        exit(1);
    373    }
    374
    375    mms->sysclk = clock_new(OBJECT(machine), "SYSCLK");
    376    clock_set_hz(mms->sysclk, SYSCLK_FRQ);
    377    mms->s32kclk = clock_new(OBJECT(machine), "S32KCLK");
    378    clock_set_hz(mms->s32kclk, S32KCLK_FRQ);
    379
    380    object_initialize_child(OBJECT(machine), "sse-200", &mms->sse,
    381                            TYPE_SSE200);
    382    ssedev = DEVICE(&mms->sse);
    383    object_property_set_link(OBJECT(&mms->sse), "memory",
    384                             OBJECT(system_memory), &error_fatal);
    385    qdev_prop_set_uint32(ssedev, "EXP_NUMIRQ", mmc->num_irqs);
    386    qdev_prop_set_uint32(ssedev, "init-svtor", mmc->init_svtor);
    387    qdev_prop_set_uint32(ssedev, "SRAM_ADDR_WIDTH", mmc->sram_addr_width);
    388    qdev_connect_clock_in(ssedev, "MAINCLK", mms->sysclk);
    389    qdev_connect_clock_in(ssedev, "S32KCLK", mms->s32kclk);
    390    /*
    391     * Musca-A takes the default SSE-200 FPU/DSP settings (ie no for
    392     * CPU0 and yes for CPU1); Musca-B1 explicitly enables them for CPU0.
    393     */
    394    if (mmc->type == MUSCA_B1) {
    395        qdev_prop_set_bit(ssedev, "CPU0_FPU", true);
    396        qdev_prop_set_bit(ssedev, "CPU0_DSP", true);
    397    }
    398    sysbus_realize(SYS_BUS_DEVICE(&mms->sse), &error_fatal);
    399
    400    /*
    401     * We need to create splitters to feed the IRQ inputs
    402     * for each CPU in the SSE-200 from each device in the board.
    403     */
    404    for (i = 0; i < mmc->num_irqs; i++) {
    405        char *name = g_strdup_printf("musca-irq-splitter%d", i);
    406        SplitIRQ *splitter = &mms->cpu_irq_splitter[i];
    407
    408        object_initialize_child_with_props(OBJECT(machine), name, splitter,
    409                                           sizeof(*splitter), TYPE_SPLIT_IRQ,
    410                                           &error_fatal, NULL);
    411        g_free(name);
    412
    413        object_property_set_int(OBJECT(splitter), "num-lines", 2,
    414                                &error_fatal);
    415        qdev_realize(DEVICE(splitter), NULL, &error_fatal);
    416        qdev_connect_gpio_out(DEVICE(splitter), 0,
    417                              qdev_get_gpio_in_named(ssedev, "EXP_IRQ", i));
    418        qdev_connect_gpio_out(DEVICE(splitter), 1,
    419                              qdev_get_gpio_in_named(ssedev,
    420                                                     "EXP_CPU1_IRQ", i));
    421    }
    422
    423    /*
    424     * The sec_resp_cfg output from the SSE-200 must be split into multiple
    425     * lines, one for each of the PPCs we create here.
    426     */
    427    object_initialize_child_with_props(OBJECT(machine), "sec-resp-splitter",
    428                                       &mms->sec_resp_splitter,
    429                                       sizeof(mms->sec_resp_splitter),
    430                                       TYPE_SPLIT_IRQ, &error_fatal, NULL);
    431
    432    object_property_set_int(OBJECT(&mms->sec_resp_splitter), "num-lines",
    433                            ARRAY_SIZE(mms->ppc), &error_fatal);
    434    qdev_realize(DEVICE(&mms->sec_resp_splitter), NULL, &error_fatal);
    435    dev_splitter = DEVICE(&mms->sec_resp_splitter);
    436    qdev_connect_gpio_out_named(ssedev, "sec_resp_cfg", 0,
    437                                qdev_get_gpio_in(dev_splitter, 0));
    438
    439    /*
    440     * Most of the devices in the board are behind Peripheral Protection
    441     * Controllers. The required order for initializing things is:
    442     *  + initialize the PPC
    443     *  + initialize, configure and realize downstream devices
    444     *  + connect downstream device MemoryRegions to the PPC
    445     *  + realize the PPC
    446     *  + map the PPC's MemoryRegions to the places in the address map
    447     *    where the downstream devices should appear
    448     *  + wire up the PPC's control lines to the SSE object
    449     *
    450     * The PPC mapping differs for the -A and -B1 variants; the -A version
    451     * is much simpler, using only a single port of a single PPC and putting
    452     * all the devices behind that.
    453     */
    454    const PPCInfo a_ppcs[] = { {
    455            .name = "ahb_ppcexp0",
    456            .ports = {
    457                { "musca-devices", make_musca_a_devs, 0, 0x40100000, 0x100000 },
    458            },
    459        },
    460    };
    461
    462    /*
    463     * Devices listed with an 0x4.. address appear in both the NS 0x4.. region
    464     * and the 0x5.. S region. Devices listed with an 0x5.. address appear
    465     * only in the S region.
    466     */
    467    const PPCInfo b1_ppcs[] = { {
    468            .name = "apb_ppcexp0",
    469            .ports = {
    470                { "eflash0", make_unimp_dev, &mms->eflash[0],
    471                  0x52400000, 0x1000 },
    472                { "eflash1", make_unimp_dev, &mms->eflash[1],
    473                  0x52500000, 0x1000 },
    474                { "qspi", make_unimp_dev, &mms->qspi, 0x42800000, 0x100000 },
    475                { "mpc0", make_mpc, &mms->mpc[0], 0x52000000, 0x1000 },
    476                { "mpc1", make_mpc, &mms->mpc[1], 0x52100000, 0x1000 },
    477                { "mpc2", make_mpc, &mms->mpc[2], 0x52200000, 0x1000 },
    478                { "mpc3", make_mpc, &mms->mpc[3], 0x52300000, 0x1000 },
    479                { "mhu0", make_unimp_dev, &mms->mhu[0], 0x42600000, 0x100000 },
    480                { "mhu1", make_unimp_dev, &mms->mhu[1], 0x42700000, 0x100000 },
    481                { }, /* port 9: unused */
    482                { }, /* port 10: unused */
    483                { }, /* port 11: unused */
    484                { }, /* port 12: unused */
    485                { }, /* port 13: unused */
    486                { "mpc4", make_mpc, &mms->mpc[4], 0x52e00000, 0x1000 },
    487            },
    488        }, {
    489            .name = "apb_ppcexp1",
    490            .ports = {
    491                { "pwm0", make_unimp_dev, &mms->pwm[0], 0x40101000, 0x1000 },
    492                { "pwm1", make_unimp_dev, &mms->pwm[1], 0x40102000, 0x1000 },
    493                { "pwm2", make_unimp_dev, &mms->pwm[2], 0x40103000, 0x1000 },
    494                { "i2s", make_unimp_dev, &mms->i2s, 0x40104000, 0x1000 },
    495                { "uart0", make_uart, &mms->uart[0], 0x40105000, 0x1000 },
    496                { "uart1", make_uart, &mms->uart[1], 0x40106000, 0x1000 },
    497                { "i2c0", make_unimp_dev, &mms->i2c[0], 0x40108000, 0x1000 },
    498                { "i2c1", make_unimp_dev, &mms->i2c[1], 0x40109000, 0x1000 },
    499                { "spi", make_unimp_dev, &mms->spi, 0x4010a000, 0x1000 },
    500                { "scc", make_unimp_dev, &mms->scc, 0x5010b000, 0x1000 },
    501                { "timer", make_unimp_dev, &mms->timer, 0x4010c000, 0x1000 },
    502                { "rtc", make_rtc, &mms->rtc, 0x4010d000, 0x1000 },
    503                { "pvt", make_unimp_dev, &mms->pvt, 0x4010e000, 0x1000 },
    504                { "sdio", make_unimp_dev, &mms->sdio, 0x4010f000, 0x1000 },
    505            },
    506        }, {
    507            .name = "ahb_ppcexp0",
    508            .ports = {
    509                { }, /* port 0: unused */
    510                { "gpio", make_unimp_dev, &mms->gpio, 0x41000000, 0x1000 },
    511            },
    512        },
    513    };
    514
    515    switch (mmc->type) {
    516    case MUSCA_A:
    517        ppcs = a_ppcs;
    518        num_ppcs = ARRAY_SIZE(a_ppcs);
    519        break;
    520    case MUSCA_B1:
    521        ppcs = b1_ppcs;
    522        num_ppcs = ARRAY_SIZE(b1_ppcs);
    523        break;
    524    default:
    525        g_assert_not_reached();
    526    }
    527    assert(num_ppcs <= MUSCA_PPC_MAX);
    528
    529    for (i = 0; i < num_ppcs; i++) {
    530        const PPCInfo *ppcinfo = &ppcs[i];
    531        TZPPC *ppc = &mms->ppc[i];
    532        DeviceState *ppcdev;
    533        int port;
    534        char *gpioname;
    535
    536        object_initialize_child(OBJECT(machine), ppcinfo->name, ppc,
    537                                TYPE_TZ_PPC);
    538        ppcdev = DEVICE(ppc);
    539
    540        for (port = 0; port < TZ_NUM_PORTS; port++) {
    541            const PPCPortInfo *pinfo = &ppcinfo->ports[port];
    542            MemoryRegion *mr;
    543            char *portname;
    544
    545            if (!pinfo->devfn) {
    546                continue;
    547            }
    548
    549            mr = pinfo->devfn(mms, pinfo->opaque, pinfo->name, pinfo->size);
    550            portname = g_strdup_printf("port[%d]", port);
    551            object_property_set_link(OBJECT(ppc), portname, OBJECT(mr),
    552                                     &error_fatal);
    553            g_free(portname);
    554        }
    555
    556        sysbus_realize(SYS_BUS_DEVICE(ppc), &error_fatal);
    557
    558        for (port = 0; port < TZ_NUM_PORTS; port++) {
    559            const PPCPortInfo *pinfo = &ppcinfo->ports[port];
    560
    561            if (!pinfo->devfn) {
    562                continue;
    563            }
    564            sysbus_mmio_map(SYS_BUS_DEVICE(ppc), port, pinfo->addr);
    565
    566            gpioname = g_strdup_printf("%s_nonsec", ppcinfo->name);
    567            qdev_connect_gpio_out_named(ssedev, gpioname, port,
    568                                        qdev_get_gpio_in_named(ppcdev,
    569                                                               "cfg_nonsec",
    570                                                               port));
    571            g_free(gpioname);
    572            gpioname = g_strdup_printf("%s_ap", ppcinfo->name);
    573            qdev_connect_gpio_out_named(ssedev, gpioname, port,
    574                                        qdev_get_gpio_in_named(ppcdev,
    575                                                               "cfg_ap", port));
    576            g_free(gpioname);
    577        }
    578
    579        gpioname = g_strdup_printf("%s_irq_enable", ppcinfo->name);
    580        qdev_connect_gpio_out_named(ssedev, gpioname, 0,
    581                                    qdev_get_gpio_in_named(ppcdev,
    582                                                           "irq_enable", 0));
    583        g_free(gpioname);
    584        gpioname = g_strdup_printf("%s_irq_clear", ppcinfo->name);
    585        qdev_connect_gpio_out_named(ssedev, gpioname, 0,
    586                                    qdev_get_gpio_in_named(ppcdev,
    587                                                           "irq_clear", 0));
    588        g_free(gpioname);
    589        gpioname = g_strdup_printf("%s_irq_status", ppcinfo->name);
    590        qdev_connect_gpio_out_named(ppcdev, "irq", 0,
    591                                    qdev_get_gpio_in_named(ssedev,
    592                                                           gpioname, 0));
    593        g_free(gpioname);
    594
    595        qdev_connect_gpio_out(dev_splitter, i,
    596                              qdev_get_gpio_in_named(ppcdev,
    597                                                     "cfg_sec_resp", 0));
    598    }
    599
    600    armv7m_load_kernel(ARM_CPU(first_cpu), machine->kernel_filename, 0x2000000);
    601}
    602
    603static void musca_class_init(ObjectClass *oc, void *data)
    604{
    605    MachineClass *mc = MACHINE_CLASS(oc);
    606
    607    mc->default_cpus = 2;
    608    mc->min_cpus = mc->default_cpus;
    609    mc->max_cpus = mc->default_cpus;
    610    mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-m33");
    611    mc->init = musca_init;
    612}
    613
    614static void musca_a_class_init(ObjectClass *oc, void *data)
    615{
    616    MachineClass *mc = MACHINE_CLASS(oc);
    617    MuscaMachineClass *mmc = MUSCA_MACHINE_CLASS(oc);
    618
    619    mc->desc = "ARM Musca-A board (dual Cortex-M33)";
    620    mmc->type = MUSCA_A;
    621    mmc->init_svtor = 0x10200000;
    622    mmc->sram_addr_width = 15;
    623    mmc->num_irqs = 64;
    624    mmc->mpc_info = a_mpc_info;
    625    mmc->num_mpcs = ARRAY_SIZE(a_mpc_info);
    626}
    627
    628static void musca_b1_class_init(ObjectClass *oc, void *data)
    629{
    630    MachineClass *mc = MACHINE_CLASS(oc);
    631    MuscaMachineClass *mmc = MUSCA_MACHINE_CLASS(oc);
    632
    633    mc->desc = "ARM Musca-B1 board (dual Cortex-M33)";
    634    mmc->type = MUSCA_B1;
    635    /*
    636     * This matches the DAPlink firmware which boots from QSPI. There
    637     * is also a firmware blob which boots from the eFlash, which
    638     * uses init_svtor = 0x1A000000. QEMU doesn't currently support that,
    639     * though we could in theory expose a machine property on the command
    640     * line to allow the user to request eFlash boot.
    641     */
    642    mmc->init_svtor = 0x10000000;
    643    mmc->sram_addr_width = 17;
    644    mmc->num_irqs = 96;
    645    mmc->mpc_info = b1_mpc_info;
    646    mmc->num_mpcs = ARRAY_SIZE(b1_mpc_info);
    647}
    648
    649static const TypeInfo musca_info = {
    650    .name = TYPE_MUSCA_MACHINE,
    651    .parent = TYPE_MACHINE,
    652    .abstract = true,
    653    .instance_size = sizeof(MuscaMachineState),
    654    .class_size = sizeof(MuscaMachineClass),
    655    .class_init = musca_class_init,
    656};
    657
    658static const TypeInfo musca_a_info = {
    659    .name = TYPE_MUSCA_A_MACHINE,
    660    .parent = TYPE_MUSCA_MACHINE,
    661    .class_init = musca_a_class_init,
    662};
    663
    664static const TypeInfo musca_b1_info = {
    665    .name = TYPE_MUSCA_B1_MACHINE,
    666    .parent = TYPE_MUSCA_MACHINE,
    667    .class_init = musca_b1_class_init,
    668};
    669
    670static void musca_machine_init(void)
    671{
    672    type_register_static(&musca_info);
    673    type_register_static(&musca_a_info);
    674    type_register_static(&musca_b1_info);
    675}
    676
    677type_init(musca_machine_init);