hw/arm/musca.c

   1 /*
   2  * Arm Musca-B1 test chip board emulation
   3  *
   4  * Copyright (c) 2019 Linaro Limited
   5  * Written by Peter Maydell
   6  *
   7  *  This program is free software; you can redistribute it and/or modify
   8  *  it under the terms of the GNU General Public License version 2 or
   9  *  (at your option) any later version.
  10  */
  11
  12 /*
  13  * The Musca boards are a reference implementation of a system using
  14  * the SSE-200 subsystem for embedded:
  15  * https://developer.arm.com/products/system-design/development-boards/iot-test-chips-and-boards/musca-a-test-chip-board
  16  * https://developer.arm.com/products/system-design/development-boards/iot-test-chips-and-boards/musca-b-test-chip-board
  17  * We model the A and B1 variants of this board, as described in the TRMs:
  18  * http://infocenter.arm.com/help/topic/com.arm.doc.101107_0000_00_en/index.html
  19  * http://infocenter.arm.com/help/topic/com.arm.doc.101312_0000_00_en/index.html
  20  */
  21
  22 #include "qemu/osdep.h"
  23 #include "qemu/error-report.h"
  24 #include "qapi/error.h"
  25 #include "exec/address-spaces.h"
  26 #include "sysemu/sysemu.h"
  27 #include "hw/arm/boot.h"
  28 #include "hw/arm/armsse.h"
  29 #include "hw/boards.h"
  30 #include "hw/char/pl011.h"
  31 #include "hw/core/split-irq.h"
  32 #include "hw/misc/tz-mpc.h"
  33 #include "hw/misc/tz-ppc.h"
  34 #include "hw/misc/unimp.h"
  35 #include "hw/rtc/pl031.h"
  36 #include "qom/object.h"
  37
  38 #define MUSCA_NUMIRQ_MAX 96
  39 #define MUSCA_PPC_MAX 3
  40 #define MUSCA_MPC_MAX 5
  41
  42 typedef struct MPCInfo MPCInfo;
  43
  44 typedef enum MuscaType {
  45     MUSCA_A,
  46     MUSCA_B1,
  47 } MuscaType;
  48
  49 struct MuscaMachineClass {
  50     MachineClass parent;
  51     MuscaType type;
  52     uint32_t init_svtor;
  53     int sram_addr_width;
  54     int num_irqs;
  55     const MPCInfo *mpc_info;
  56     int num_mpcs;
  57 };
  58 typedef struct MuscaMachineClass MuscaMachineClass;
  59
  60 struct MuscaMachineState {
  61     MachineState parent;
  62
  63     ARMSSE sse;
  64     /* RAM and flash */
  65     MemoryRegion ram[MUSCA_MPC_MAX];
  66     SplitIRQ cpu_irq_splitter[MUSCA_NUMIRQ_MAX];
  67     SplitIRQ sec_resp_splitter;
  68     TZPPC ppc[MUSCA_PPC_MAX];
  69     MemoryRegion container;
  70     UnimplementedDeviceState eflash[2];
  71     UnimplementedDeviceState qspi;
  72     TZMPC mpc[MUSCA_MPC_MAX];
  73     UnimplementedDeviceState mhu[2];
  74     UnimplementedDeviceState pwm[3];
  75     UnimplementedDeviceState i2s;
  76     PL011State uart[2];
  77     UnimplementedDeviceState i2c[2];
  78     UnimplementedDeviceState spi;
  79     UnimplementedDeviceState scc;
  80     UnimplementedDeviceState timer;
  81     PL031State rtc;
  82     UnimplementedDeviceState pvt;
  83     UnimplementedDeviceState sdio;
  84     UnimplementedDeviceState gpio;
  85     UnimplementedDeviceState cryptoisland;
  86 };
  87 typedef struct MuscaMachineState MuscaMachineState;
  88
  89 #define TYPE_MUSCA_MACHINE "musca"
  90 #define TYPE_MUSCA_A_MACHINE MACHINE_TYPE_NAME("musca-a")
  91 #define TYPE_MUSCA_B1_MACHINE MACHINE_TYPE_NAME("musca-b1")
  92
  93 #define MUSCA_MACHINE(obj) \
  94     OBJECT_CHECK(MuscaMachineState, obj, TYPE_MUSCA_MACHINE)
  95 #define MUSCA_MACHINE_GET_CLASS(obj) \
  96     OBJECT_GET_CLASS(MuscaMachineClass, obj, TYPE_MUSCA_MACHINE)
  97 #define MUSCA_MACHINE_CLASS(klass) \
  98     OBJECT_CLASS_CHECK(MuscaMachineClass, klass, TYPE_MUSCA_MACHINE)
  99
 100 /*
 101  * Main SYSCLK frequency in Hz
 102  * TODO this should really be different for the two cores, but we
 103  * don't model that in our SSE-200 model yet.
 104  */
 105 #define SYSCLK_FRQ 40000000
 106
 107 static qemu_irq get_sse_irq_in(MuscaMachineState *mms, int irqno)
 108 {
 109     /* Return a qemu_irq which will signal IRQ n to all CPUs in the SSE. */
 110     assert(irqno < MUSCA_NUMIRQ_MAX);
 111
 112     return qdev_get_gpio_in(DEVICE(&mms->cpu_irq_splitter[irqno]), 0);
 113 }
 114
 115 /*
 116  * Most of the devices in the Musca board sit behind Peripheral Protection
 117  * Controllers. These data structures define the layout of which devices
 118  * sit behind which PPCs.
 119  * The devfn for each port is a function which creates, configures
 120  * and initializes the device, returning the MemoryRegion which
 121  * needs to be plugged into the downstream end of the PPC port.
 122  */
 123 typedef MemoryRegion *MakeDevFn(MuscaMachineState *mms, void *opaque,
 124                                 const char *name, hwaddr size);
 125
 126 typedef struct PPCPortInfo {
 127     const char *name;
 128     MakeDevFn *devfn;
 129     void *opaque;
 130     hwaddr addr;
 131     hwaddr size;
 132 } PPCPortInfo;
 133
 134 typedef struct PPCInfo {
 135     const char *name;
 136     PPCPortInfo ports[TZ_NUM_PORTS];
 137 } PPCInfo;
 138
 139 static MemoryRegion *make_unimp_dev(MuscaMachineState *mms,
 140                                     void *opaque, const char *name, hwaddr size)
 141 {
 142     /*
 143      * Initialize, configure and realize a TYPE_UNIMPLEMENTED_DEVICE,
 144      * and return a pointer to its MemoryRegion.
 145      */
 146     UnimplementedDeviceState *uds = opaque;
 147
 148     object_initialize_child(OBJECT(mms), name, uds, TYPE_UNIMPLEMENTED_DEVICE);
 149     qdev_prop_set_string(DEVICE(uds), "name", name);
 150     qdev_prop_set_uint64(DEVICE(uds), "size", size);
 151     sysbus_realize(SYS_BUS_DEVICE(uds), &error_fatal);
 152     return sysbus_mmio_get_region(SYS_BUS_DEVICE(uds), 0);
 153 }
 154
 155 typedef enum MPCInfoType {
 156     MPC_RAM,
 157     MPC_ROM,
 158     MPC_CRYPTOISLAND,
 159 } MPCInfoType;
 160
 161 struct MPCInfo {
 162     const char *name;
 163     hwaddr addr;
 164     hwaddr size;
 165     MPCInfoType type;
 166 };
 167
 168 /* Order of the MPCs here must match the order of the bits in SECMPCINTSTATUS */
 169 static const MPCInfo a_mpc_info[] = { {
 170         .name = "qspi",
 171         .type = MPC_ROM,
 172         .addr = 0x00200000,
 173         .size = 0x00800000,
 174     }, {
 175         .name = "sram",
 176         .type = MPC_RAM,
 177         .addr = 0x00000000,
 178         .size = 0x00200000,
 179     }
 180 };
 181
 182 static const MPCInfo b1_mpc_info[] = { {
 183         .name = "qspi",
 184         .type = MPC_ROM,
 185         .addr = 0x00000000,
 186         .size = 0x02000000,
 187     }, {
 188         .name = "sram",
 189         .type = MPC_RAM,
 190         .addr = 0x0a400000,
 191         .size = 0x00080000,
 192     }, {
 193         .name = "eflash0",
 194         .type = MPC_ROM,
 195         .addr = 0x0a000000,
 196         .size = 0x00200000,
 197     }, {
 198         .name = "eflash1",
 199         .type = MPC_ROM,
 200         .addr = 0x0a200000,
 201         .size = 0x00200000,
 202     }, {
 203         .name = "cryptoisland",
 204         .type = MPC_CRYPTOISLAND,
 205         .addr = 0x0a000000,
 206         .size = 0x00200000,
 207     }
 208 };
 209
 210 static MemoryRegion *make_mpc(MuscaMachineState *mms, void *opaque,
 211                               const char *name, hwaddr size)
 212 {
 213     /*
 214      * Create an MPC and the RAM or flash behind it.
 215      * MPC 0: eFlash 0
 216      * MPC 1: eFlash 1
 217      * MPC 2: SRAM
 218      * MPC 3: QSPI flash
 219      * MPC 4: CryptoIsland
 220      * For now we implement the flash regions as ROM (ie not programmable)
 221      * (with their control interface memory regions being unimplemented
 222      * stubs behind the PPCs).
 223      * The whole CryptoIsland region behind its MPC is an unimplemented stub.
 224      */
 225     MuscaMachineClass *mmc = MUSCA_MACHINE_GET_CLASS(mms);
 226     TZMPC *mpc = opaque;
 227     int i = mpc - &mms->mpc[0];
 228     MemoryRegion *downstream;
 229     MemoryRegion *upstream;
 230     UnimplementedDeviceState *uds;
 231     char *mpcname;
 232     const MPCInfo *mpcinfo = mmc->mpc_info;
 233
 234     mpcname = g_strdup_printf("%s-mpc", mpcinfo[i].name);
 235
 236     switch (mpcinfo[i].type) {
 237     case MPC_ROM:
 238         downstream = &mms->ram[i];
 239         memory_region_init_rom(downstream, NULL, mpcinfo[i].name,
 240                                mpcinfo[i].size, &error_fatal);
 241         break;
 242     case MPC_RAM:
 243         downstream = &mms->ram[i];
 244         memory_region_init_ram(downstream, NULL, mpcinfo[i].name,
 245                                mpcinfo[i].size, &error_fatal);
 246         break;
 247     case MPC_CRYPTOISLAND:
 248         /* We don't implement the CryptoIsland yet */
 249         uds = &mms->cryptoisland;
 250         object_initialize_child(OBJECT(mms), name, uds,
 251                                 TYPE_UNIMPLEMENTED_DEVICE);
 252         qdev_prop_set_string(DEVICE(uds), "name", mpcinfo[i].name);
 253         qdev_prop_set_uint64(DEVICE(uds), "size", mpcinfo[i].size);
 254         sysbus_realize(SYS_BUS_DEVICE(uds), &error_fatal);
 255         downstream = sysbus_mmio_get_region(SYS_BUS_DEVICE(uds), 0);
 256         break;
 257     default:
 258         g_assert_not_reached();
 259     }
 260
 261     object_initialize_child(OBJECT(mms), mpcname, mpc, TYPE_TZ_MPC);
 262     object_property_set_link(OBJECT(mpc), "downstream", OBJECT(downstream),
 263                              &error_fatal);
 264     sysbus_realize(SYS_BUS_DEVICE(mpc), &error_fatal);
 265     /* Map the upstream end of the MPC into system memory */
 266     upstream = sysbus_mmio_get_region(SYS_BUS_DEVICE(mpc), 1);
 267     memory_region_add_subregion(get_system_memory(), mpcinfo[i].addr, upstream);
 268     /* and connect its interrupt to the SSE-200 */
 269     qdev_connect_gpio_out_named(DEVICE(mpc), "irq", 0,
 270                                 qdev_get_gpio_in_named(DEVICE(&mms->sse),
 271                                                        "mpcexp_status", i));
 272
 273     g_free(mpcname);
 274     /* Return the register interface MR for our caller to map behind the PPC */
 275     return sysbus_mmio_get_region(SYS_BUS_DEVICE(mpc), 0);
 276 }
 277
 278 static MemoryRegion *make_rtc(MuscaMachineState *mms, void *opaque,
 279                               const char *name, hwaddr size)
 280 {
 281     PL031State *rtc = opaque;
 282
 283     object_initialize_child(OBJECT(mms), name, rtc, TYPE_PL031);
 284     sysbus_realize(SYS_BUS_DEVICE(rtc), &error_fatal);
 285     sysbus_connect_irq(SYS_BUS_DEVICE(rtc), 0, get_sse_irq_in(mms, 39));
 286     return sysbus_mmio_get_region(SYS_BUS_DEVICE(rtc), 0);
 287 }
 288
 289 static MemoryRegion *make_uart(MuscaMachineState *mms, void *opaque,
 290                                const char *name, hwaddr size)
 291 {
 292     PL011State *uart = opaque;
 293     int i = uart - &mms->uart[0];
 294     int irqbase = 7 + i * 6;
 295     SysBusDevice *s;
 296
 297     object_initialize_child(OBJECT(mms), name, uart, TYPE_PL011);
 298     qdev_prop_set_chr(DEVICE(uart), "chardev", serial_hd(i));
 299     sysbus_realize(SYS_BUS_DEVICE(uart), &error_fatal);
 300     s = SYS_BUS_DEVICE(uart);
 301     sysbus_connect_irq(s, 0, get_sse_irq_in(mms, irqbase + 5)); /* combined */
 302     sysbus_connect_irq(s, 1, get_sse_irq_in(mms, irqbase + 0)); /* RX */
 303     sysbus_connect_irq(s, 2, get_sse_irq_in(mms, irqbase + 1)); /* TX */
 304     sysbus_connect_irq(s, 3, get_sse_irq_in(mms, irqbase + 2)); /* RT */
 305     sysbus_connect_irq(s, 4, get_sse_irq_in(mms, irqbase + 3)); /* MS */
 306     sysbus_connect_irq(s, 5, get_sse_irq_in(mms, irqbase + 4)); /* E */
 307     return sysbus_mmio_get_region(SYS_BUS_DEVICE(uart), 0);
 308 }
 309
 310 static MemoryRegion *make_musca_a_devs(MuscaMachineState *mms, void *opaque,
 311                                        const char *name, hwaddr size)
 312 {
 313     /*
 314      * Create the container MemoryRegion for all the devices that live
 315      * behind the Musca-A PPC's single port. These devices don't have a PPC
 316      * port each, but we use the PPCPortInfo struct as a convenient way
 317      * to describe them. Note that addresses here are relative to the base
 318      * address of the PPC port region: 0x40100000, and devices appear both
 319      * at the 0x4... NS region and the 0x5... S region.
 320      */
 321     int i;
 322     MemoryRegion *container = &mms->container;
 323
 324     const PPCPortInfo devices[] = {
 325         { "uart0", make_uart, &mms->uart[0], 0x1000, 0x1000 },
 326         { "uart1", make_uart, &mms->uart[1], 0x2000, 0x1000 },
 327         { "spi", make_unimp_dev, &mms->spi, 0x3000, 0x1000 },
 328         { "i2c0", make_unimp_dev, &mms->i2c[0], 0x4000, 0x1000 },
 329         { "i2c1", make_unimp_dev, &mms->i2c[1], 0x5000, 0x1000 },
 330         { "i2s", make_unimp_dev, &mms->i2s, 0x6000, 0x1000 },
 331         { "pwm0", make_unimp_dev, &mms->pwm[0], 0x7000, 0x1000 },
 332         { "rtc", make_rtc, &mms->rtc, 0x8000, 0x1000 },
 333         { "qspi", make_unimp_dev, &mms->qspi, 0xa000, 0x1000 },
 334         { "timer", make_unimp_dev, &mms->timer, 0xb000, 0x1000 },
 335         { "scc", make_unimp_dev, &mms->scc, 0xc000, 0x1000 },
 336         { "pwm1", make_unimp_dev, &mms->pwm[1], 0xe000, 0x1000 },
 337         { "pwm2", make_unimp_dev, &mms->pwm[2], 0xf000, 0x1000 },
 338         { "gpio", make_unimp_dev, &mms->gpio, 0x10000, 0x1000 },
 339         { "mpc0", make_mpc, &mms->mpc[0], 0x12000, 0x1000 },
 340         { "mpc1", make_mpc, &mms->mpc[1], 0x13000, 0x1000 },
 341     };
 342
 343     memory_region_init(container, OBJECT(mms), "musca-device-container", size);
 344
 345     for (i = 0; i < ARRAY_SIZE(devices); i++) {
 346         const PPCPortInfo *pinfo = &devices[i];
 347         MemoryRegion *mr;
 348
 349         mr = pinfo->devfn(mms, pinfo->opaque, pinfo->name, pinfo->size);
 350         memory_region_add_subregion(container, pinfo->addr, mr);
 351     }
 352
 353     return &mms->container;
 354 }
 355
 356 static void musca_init(MachineState *machine)
 357 {
 358     MuscaMachineState *mms = MUSCA_MACHINE(machine);
 359     MuscaMachineClass *mmc = MUSCA_MACHINE_GET_CLASS(mms);
 360     MachineClass *mc = MACHINE_GET_CLASS(machine);
 361     MemoryRegion *system_memory = get_system_memory();
 362     DeviceState *ssedev;
 363     DeviceState *dev_splitter;
 364     const PPCInfo *ppcs;
 365     int num_ppcs;
 366     int i;
 367
 368     assert(mmc->num_irqs <= MUSCA_NUMIRQ_MAX);
 369     assert(mmc->num_mpcs <= MUSCA_MPC_MAX);
 370
 371     if (strcmp(machine->cpu_type, mc->default_cpu_type) != 0) {
 372         error_report("This board can only be used with CPU %s",
 373                      mc->default_cpu_type);
 374         exit(1);
 375     }
 376
 377     object_initialize_child(OBJECT(machine), "sse-200", &mms->sse,
 378                             TYPE_SSE200);
 379     ssedev = DEVICE(&mms->sse);
 380     object_property_set_link(OBJECT(&mms->sse), "memory",
 381                              OBJECT(system_memory), &error_fatal);
 382     qdev_prop_set_uint32(ssedev, "EXP_NUMIRQ", mmc->num_irqs);
 383     qdev_prop_set_uint32(ssedev, "init-svtor", mmc->init_svtor);
 384     qdev_prop_set_uint32(ssedev, "SRAM_ADDR_WIDTH", mmc->sram_addr_width);
 385     qdev_prop_set_uint32(ssedev, "MAINCLK", SYSCLK_FRQ);
 386     /*
 387      * Musca-A takes the default SSE-200 FPU/DSP settings (ie no for
 388      * CPU0 and yes for CPU1); Musca-B1 explicitly enables them for CPU0.
 389      */
 390     if (mmc->type == MUSCA_B1) {
 391         qdev_prop_set_bit(ssedev, "CPU0_FPU", true);
 392         qdev_prop_set_bit(ssedev, "CPU0_DSP", true);
 393     }
 394     sysbus_realize(SYS_BUS_DEVICE(&mms->sse), &error_fatal);
 395
 396     /*
 397      * We need to create splitters to feed the IRQ inputs
 398      * for each CPU in the SSE-200 from each device in the board.
 399      */
 400     for (i = 0; i < mmc->num_irqs; i++) {
 401         char *name = g_strdup_printf("musca-irq-splitter%d", i);
 402         SplitIRQ *splitter = &mms->cpu_irq_splitter[i];
 403
 404         object_initialize_child_with_props(OBJECT(machine), name, splitter,
 405                                            sizeof(*splitter), TYPE_SPLIT_IRQ,
 406                                            &error_fatal, NULL);
 407         g_free(name);
 408
 409         object_property_set_int(OBJECT(splitter), "num-lines", 2,
 410                                 &error_fatal);
 411         qdev_realize(DEVICE(splitter), NULL, &error_fatal);
 412         qdev_connect_gpio_out(DEVICE(splitter), 0,
 413                               qdev_get_gpio_in_named(ssedev, "EXP_IRQ", i));
 414         qdev_connect_gpio_out(DEVICE(splitter), 1,
 415                               qdev_get_gpio_in_named(ssedev,
 416                                                      "EXP_CPU1_IRQ", i));
 417     }
 418
 419     /*
 420      * The sec_resp_cfg output from the SSE-200 must be split into multiple
 421      * lines, one for each of the PPCs we create here.
 422      */
 423     object_initialize_child_with_props(OBJECT(machine), "sec-resp-splitter",
 424                                        &mms->sec_resp_splitter,
 425                                        sizeof(mms->sec_resp_splitter),
 426                                        TYPE_SPLIT_IRQ, &error_fatal, NULL);
 427
 428     object_property_set_int(OBJECT(&mms->sec_resp_splitter), "num-lines",
 429                             ARRAY_SIZE(mms->ppc), &error_fatal);
 430     qdev_realize(DEVICE(&mms->sec_resp_splitter), NULL, &error_fatal);
 431     dev_splitter = DEVICE(&mms->sec_resp_splitter);
 432     qdev_connect_gpio_out_named(ssedev, "sec_resp_cfg", 0,
 433                                 qdev_get_gpio_in(dev_splitter, 0));
 434
 435     /*
 436      * Most of the devices in the board are behind Peripheral Protection
 437      * Controllers. The required order for initializing things is:
 438      *  + initialize the PPC
 439      *  + initialize, configure and realize downstream devices
 440      *  + connect downstream device MemoryRegions to the PPC
 441      *  + realize the PPC
 442      *  + map the PPC's MemoryRegions to the places in the address map
 443      *    where the downstream devices should appear
 444      *  + wire up the PPC's control lines to the SSE object
 445      *
 446      * The PPC mapping differs for the -A and -B1 variants; the -A version
 447      * is much simpler, using only a single port of a single PPC and putting
 448      * all the devices behind that.
 449      */
 450     const PPCInfo a_ppcs[] = { {
 451             .name = "ahb_ppcexp0",
 452             .ports = {
 453                 { "musca-devices", make_musca_a_devs, 0, 0x40100000, 0x100000 },
 454             },
 455         },
 456     };
 457
 458     /*
 459      * Devices listed with an 0x4.. address appear in both the NS 0x4.. region
 460      * and the 0x5.. S region. Devices listed with an 0x5.. address appear
 461      * only in the S region.
 462      */
 463     const PPCInfo b1_ppcs[] = { {
 464             .name = "apb_ppcexp0",
 465             .ports = {
 466                 { "eflash0", make_unimp_dev, &mms->eflash[0],
 467                   0x52400000, 0x1000 },
 468                 { "eflash1", make_unimp_dev, &mms->eflash[1],
 469                   0x52500000, 0x1000 },
 470                 { "qspi", make_unimp_dev, &mms->qspi, 0x42800000, 0x100000 },
 471                 { "mpc0", make_mpc, &mms->mpc[0], 0x52000000, 0x1000 },
 472                 { "mpc1", make_mpc, &mms->mpc[1], 0x52100000, 0x1000 },
 473                 { "mpc2", make_mpc, &mms->mpc[2], 0x52200000, 0x1000 },
 474                 { "mpc3", make_mpc, &mms->mpc[3], 0x52300000, 0x1000 },
 475                 { "mhu0", make_unimp_dev, &mms->mhu[0], 0x42600000, 0x100000 },
 476                 { "mhu1", make_unimp_dev, &mms->mhu[1], 0x42700000, 0x100000 },
 477                 { }, /* port 9: unused */
 478                 { }, /* port 10: unused */
 479                 { }, /* port 11: unused */
 480                 { }, /* port 12: unused */
 481                 { }, /* port 13: unused */
 482                 { "mpc4", make_mpc, &mms->mpc[4], 0x52e00000, 0x1000 },
 483             },
 484         }, {
 485             .name = "apb_ppcexp1",
 486             .ports = {
 487                 { "pwm0", make_unimp_dev, &mms->pwm[0], 0x40101000, 0x1000 },
 488                 { "pwm1", make_unimp_dev, &mms->pwm[1], 0x40102000, 0x1000 },
 489                 { "pwm2", make_unimp_dev, &mms->pwm[2], 0x40103000, 0x1000 },
 490                 { "i2s", make_unimp_dev, &mms->i2s, 0x40104000, 0x1000 },
 491                 { "uart0", make_uart, &mms->uart[0], 0x40105000, 0x1000 },
 492                 { "uart1", make_uart, &mms->uart[1], 0x40106000, 0x1000 },
 493                 { "i2c0", make_unimp_dev, &mms->i2c[0], 0x40108000, 0x1000 },
 494                 { "i2c1", make_unimp_dev, &mms->i2c[1], 0x40109000, 0x1000 },
 495                 { "spi", make_unimp_dev, &mms->spi, 0x4010a000, 0x1000 },
 496                 { "scc", make_unimp_dev, &mms->scc, 0x5010b000, 0x1000 },
 497                 { "timer", make_unimp_dev, &mms->timer, 0x4010c000, 0x1000 },
 498                 { "rtc", make_rtc, &mms->rtc, 0x4010d000, 0x1000 },
 499                 { "pvt", make_unimp_dev, &mms->pvt, 0x4010e000, 0x1000 },
 500                 { "sdio", make_unimp_dev, &mms->sdio, 0x4010f000, 0x1000 },
 501             },
 502         }, {
 503             .name = "ahb_ppcexp0",
 504             .ports = {
 505                 { }, /* port 0: unused */
 506                 { "gpio", make_unimp_dev, &mms->gpio, 0x41000000, 0x1000 },
 507             },
 508         },
 509     };
 510
 511     switch (mmc->type) {
 512     case MUSCA_A:
 513         ppcs = a_ppcs;
 514         num_ppcs = ARRAY_SIZE(a_ppcs);
 515         break;
 516     case MUSCA_B1:
 517         ppcs = b1_ppcs;
 518         num_ppcs = ARRAY_SIZE(b1_ppcs);
 519         break;
 520     default:
 521         g_assert_not_reached();
 522     }
 523     assert(num_ppcs <= MUSCA_PPC_MAX);
 524
 525     for (i = 0; i < num_ppcs; i++) {
 526         const PPCInfo *ppcinfo = &ppcs[i];
 527         TZPPC *ppc = &mms->ppc[i];
 528         DeviceState *ppcdev;
 529         int port;
 530         char *gpioname;
 531
 532         object_initialize_child(OBJECT(machine), ppcinfo->name, ppc,
 533                                 TYPE_TZ_PPC);
 534         ppcdev = DEVICE(ppc);
 535
 536         for (port = 0; port < TZ_NUM_PORTS; port++) {
 537             const PPCPortInfo *pinfo = &ppcinfo->ports[port];
 538             MemoryRegion *mr;
 539             char *portname;
 540
 541             if (!pinfo->devfn) {
 542                 continue;
 543             }
 544
 545             mr = pinfo->devfn(mms, pinfo->opaque, pinfo->name, pinfo->size);
 546             portname = g_strdup_printf("port[%d]", port);
 547             object_property_set_link(OBJECT(ppc), portname, OBJECT(mr),
 548                                      &error_fatal);
 549             g_free(portname);
 550         }
 551
 552         sysbus_realize(SYS_BUS_DEVICE(ppc), &error_fatal);
 553
 554         for (port = 0; port < TZ_NUM_PORTS; port++) {
 555             const PPCPortInfo *pinfo = &ppcinfo->ports[port];
 556
 557             if (!pinfo->devfn) {
 558                 continue;
 559             }
 560             sysbus_mmio_map(SYS_BUS_DEVICE(ppc), port, pinfo->addr);
 561
 562             gpioname = g_strdup_printf("%s_nonsec", ppcinfo->name);
 563             qdev_connect_gpio_out_named(ssedev, gpioname, port,
 564                                         qdev_get_gpio_in_named(ppcdev,
 565                                                                "cfg_nonsec",
 566                                                                port));
 567             g_free(gpioname);
 568             gpioname = g_strdup_printf("%s_ap", ppcinfo->name);
 569             qdev_connect_gpio_out_named(ssedev, gpioname, port,
 570                                         qdev_get_gpio_in_named(ppcdev,
 571                                                                "cfg_ap", port));
 572             g_free(gpioname);
 573         }
 574
 575         gpioname = g_strdup_printf("%s_irq_enable", ppcinfo->name);
 576         qdev_connect_gpio_out_named(ssedev, gpioname, 0,
 577                                     qdev_get_gpio_in_named(ppcdev,
 578                                                            "irq_enable", 0));
 579         g_free(gpioname);
 580         gpioname = g_strdup_printf("%s_irq_clear", ppcinfo->name);
 581         qdev_connect_gpio_out_named(ssedev, gpioname, 0,
 582                                     qdev_get_gpio_in_named(ppcdev,
 583                                                            "irq_clear", 0));
 584         g_free(gpioname);
 585         gpioname = g_strdup_printf("%s_irq_status", ppcinfo->name);
 586         qdev_connect_gpio_out_named(ppcdev, "irq", 0,
 587                                     qdev_get_gpio_in_named(ssedev,
 588                                                            gpioname, 0));
 589         g_free(gpioname);
 590
 591         qdev_connect_gpio_out(dev_splitter, i,
 592                               qdev_get_gpio_in_named(ppcdev,
 593                                                      "cfg_sec_resp", 0));
 594     }
 595
 596     armv7m_load_kernel(ARM_CPU(first_cpu), machine->kernel_filename, 0x2000000);
 597 }
 598
 599 static void musca_class_init(ObjectClass *oc, void *data)
 600 {
 601     MachineClass *mc = MACHINE_CLASS(oc);
 602
 603     mc->default_cpus = 2;
 604     mc->min_cpus = mc->default_cpus;
 605     mc->max_cpus = mc->default_cpus;
 606     mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-m33");
 607     mc->init = musca_init;
 608 }
 609
 610 static void musca_a_class_init(ObjectClass *oc, void *data)
 611 {
 612     MachineClass *mc = MACHINE_CLASS(oc);
 613     MuscaMachineClass *mmc = MUSCA_MACHINE_CLASS(oc);
 614
 615     mc->desc = "ARM Musca-A board (dual Cortex-M33)";
 616     mmc->type = MUSCA_A;
 617     mmc->init_svtor = 0x10200000;
 618     mmc->sram_addr_width = 15;
 619     mmc->num_irqs = 64;
 620     mmc->mpc_info = a_mpc_info;
 621     mmc->num_mpcs = ARRAY_SIZE(a_mpc_info);
 622 }
 623
 624 static void musca_b1_class_init(ObjectClass *oc, void *data)
 625 {
 626     MachineClass *mc = MACHINE_CLASS(oc);
 627     MuscaMachineClass *mmc = MUSCA_MACHINE_CLASS(oc);
 628
 629     mc->desc = "ARM Musca-B1 board (dual Cortex-M33)";
 630     mmc->type = MUSCA_B1;
 631     /*
 632      * This matches the DAPlink firmware which boots from QSPI. There
 633      * is also a firmware blob which boots from the eFlash, which
 634      * uses init_svtor = 0x1A000000. QEMU doesn't currently support that,
 635      * though we could in theory expose a machine property on the command
 636      * line to allow the user to request eFlash boot.
 637      */
 638     mmc->init_svtor = 0x10000000;
 639     mmc->sram_addr_width = 17;
 640     mmc->num_irqs = 96;
 641     mmc->mpc_info = b1_mpc_info;
 642     mmc->num_mpcs = ARRAY_SIZE(b1_mpc_info);
 643 }
 644
 645 static const TypeInfo musca_info = {
 646     .name = TYPE_MUSCA_MACHINE,
 647     .parent = TYPE_MACHINE,
 648     .abstract = true,
 649     .instance_size = sizeof(MuscaMachineState),
 650     .class_size = sizeof(MuscaMachineClass),
 651     .class_init = musca_class_init,
 652 };
 653
 654 static const TypeInfo musca_a_info = {
 655     .name = TYPE_MUSCA_A_MACHINE,
 656     .parent = TYPE_MUSCA_MACHINE,
 657     .class_init = musca_a_class_init,
 658 };
 659
 660 static const TypeInfo musca_b1_info = {
 661     .name = TYPE_MUSCA_B1_MACHINE,
 662     .parent = TYPE_MUSCA_MACHINE,
 663     .class_init = musca_b1_class_init,
 664 };
 665
 666 static void musca_machine_init(void)
 667 {
 668     type_register_static(&musca_info);
 669     type_register_static(&musca_a_info);
 670     type_register_static(&musca_b1_info);
 671 }
 672
 673 type_init(musca_machine_init);