qemu

FORK: QEMU emulator
git clone https://git.neptards.moe/neptards/qemu.git
Log | Files | Refs | Submodules | LICENSE

musca.c (24923B)


      1 /*
      2  * Arm Musca-B1 test chip board emulation
      3  *
      4  * Copyright (c) 2019 Linaro Limited
      5  * Written by Peter Maydell
      6  *
      7  *  This program is free software; you can redistribute it and/or modify
      8  *  it under the terms of the GNU General Public License version 2 or
      9  *  (at your option) any later version.
     10  */
     11 
     12 /*
     13  * The Musca boards are a reference implementation of a system using
     14  * the SSE-200 subsystem for embedded:
     15  * https://developer.arm.com/products/system-design/development-boards/iot-test-chips-and-boards/musca-a-test-chip-board
     16  * https://developer.arm.com/products/system-design/development-boards/iot-test-chips-and-boards/musca-b-test-chip-board
     17  * We model the A and B1 variants of this board, as described in the TRMs:
     18  * https://developer.arm.com/documentation/101107/latest/
     19  * https://developer.arm.com/documentation/101312/latest/
     20  */
     21 
     22 #include "qemu/osdep.h"
     23 #include "qemu/error-report.h"
     24 #include "qapi/error.h"
     25 #include "exec/address-spaces.h"
     26 #include "sysemu/sysemu.h"
     27 #include "hw/arm/boot.h"
     28 #include "hw/arm/armsse.h"
     29 #include "hw/boards.h"
     30 #include "hw/char/pl011.h"
     31 #include "hw/core/split-irq.h"
     32 #include "hw/misc/tz-mpc.h"
     33 #include "hw/misc/tz-ppc.h"
     34 #include "hw/misc/unimp.h"
     35 #include "hw/rtc/pl031.h"
     36 #include "hw/qdev-clock.h"
     37 #include "qom/object.h"
     38 
     39 #define MUSCA_NUMIRQ_MAX 96
     40 #define MUSCA_PPC_MAX 3
     41 #define MUSCA_MPC_MAX 5
     42 
     43 typedef struct MPCInfo MPCInfo;
     44 
     45 typedef enum MuscaType {
     46     MUSCA_A,
     47     MUSCA_B1,
     48 } MuscaType;
     49 
     50 struct MuscaMachineClass {
     51     MachineClass parent;
     52     MuscaType type;
     53     uint32_t init_svtor;
     54     int sram_addr_width;
     55     int num_irqs;
     56     const MPCInfo *mpc_info;
     57     int num_mpcs;
     58 };
     59 
     60 struct MuscaMachineState {
     61     MachineState parent;
     62 
     63     ARMSSE sse;
     64     /* RAM and flash */
     65     MemoryRegion ram[MUSCA_MPC_MAX];
     66     SplitIRQ cpu_irq_splitter[MUSCA_NUMIRQ_MAX];
     67     SplitIRQ sec_resp_splitter;
     68     TZPPC ppc[MUSCA_PPC_MAX];
     69     MemoryRegion container;
     70     UnimplementedDeviceState eflash[2];
     71     UnimplementedDeviceState qspi;
     72     TZMPC mpc[MUSCA_MPC_MAX];
     73     UnimplementedDeviceState mhu[2];
     74     UnimplementedDeviceState pwm[3];
     75     UnimplementedDeviceState i2s;
     76     PL011State uart[2];
     77     UnimplementedDeviceState i2c[2];
     78     UnimplementedDeviceState spi;
     79     UnimplementedDeviceState scc;
     80     UnimplementedDeviceState timer;
     81     PL031State rtc;
     82     UnimplementedDeviceState pvt;
     83     UnimplementedDeviceState sdio;
     84     UnimplementedDeviceState gpio;
     85     UnimplementedDeviceState cryptoisland;
     86     Clock *sysclk;
     87     Clock *s32kclk;
     88 };
     89 
     90 #define TYPE_MUSCA_MACHINE "musca"
     91 #define TYPE_MUSCA_A_MACHINE MACHINE_TYPE_NAME("musca-a")
     92 #define TYPE_MUSCA_B1_MACHINE MACHINE_TYPE_NAME("musca-b1")
     93 
     94 OBJECT_DECLARE_TYPE(MuscaMachineState, MuscaMachineClass, MUSCA_MACHINE)
     95 
     96 /*
     97  * Main SYSCLK frequency in Hz
     98  * TODO this should really be different for the two cores, but we
     99  * don't model that in our SSE-200 model yet.
    100  */
    101 #define SYSCLK_FRQ 40000000
    102 /* Slow 32Khz S32KCLK frequency in Hz */
    103 #define S32KCLK_FRQ (32 * 1000)
    104 
    105 static qemu_irq get_sse_irq_in(MuscaMachineState *mms, int irqno)
    106 {
    107     /* Return a qemu_irq which will signal IRQ n to all CPUs in the SSE. */
    108     assert(irqno < MUSCA_NUMIRQ_MAX);
    109 
    110     return qdev_get_gpio_in(DEVICE(&mms->cpu_irq_splitter[irqno]), 0);
    111 }
    112 
    113 /*
    114  * Most of the devices in the Musca board sit behind Peripheral Protection
    115  * Controllers. These data structures define the layout of which devices
    116  * sit behind which PPCs.
    117  * The devfn for each port is a function which creates, configures
    118  * and initializes the device, returning the MemoryRegion which
    119  * needs to be plugged into the downstream end of the PPC port.
    120  */
    121 typedef MemoryRegion *MakeDevFn(MuscaMachineState *mms, void *opaque,
    122                                 const char *name, hwaddr size);
    123 
    124 typedef struct PPCPortInfo {
    125     const char *name;
    126     MakeDevFn *devfn;
    127     void *opaque;
    128     hwaddr addr;
    129     hwaddr size;
    130 } PPCPortInfo;
    131 
    132 typedef struct PPCInfo {
    133     const char *name;
    134     PPCPortInfo ports[TZ_NUM_PORTS];
    135 } PPCInfo;
    136 
    137 static MemoryRegion *make_unimp_dev(MuscaMachineState *mms,
    138                                     void *opaque, const char *name, hwaddr size)
    139 {
    140     /*
    141      * Initialize, configure and realize a TYPE_UNIMPLEMENTED_DEVICE,
    142      * and return a pointer to its MemoryRegion.
    143      */
    144     UnimplementedDeviceState *uds = opaque;
    145 
    146     object_initialize_child(OBJECT(mms), name, uds, TYPE_UNIMPLEMENTED_DEVICE);
    147     qdev_prop_set_string(DEVICE(uds), "name", name);
    148     qdev_prop_set_uint64(DEVICE(uds), "size", size);
    149     sysbus_realize(SYS_BUS_DEVICE(uds), &error_fatal);
    150     return sysbus_mmio_get_region(SYS_BUS_DEVICE(uds), 0);
    151 }
    152 
    153 typedef enum MPCInfoType {
    154     MPC_RAM,
    155     MPC_ROM,
    156     MPC_CRYPTOISLAND,
    157 } MPCInfoType;
    158 
    159 struct MPCInfo {
    160     const char *name;
    161     hwaddr addr;
    162     hwaddr size;
    163     MPCInfoType type;
    164 };
    165 
    166 /* Order of the MPCs here must match the order of the bits in SECMPCINTSTATUS */
    167 static const MPCInfo a_mpc_info[] = { {
    168         .name = "qspi",
    169         .type = MPC_ROM,
    170         .addr = 0x00200000,
    171         .size = 0x00800000,
    172     }, {
    173         .name = "sram",
    174         .type = MPC_RAM,
    175         .addr = 0x00000000,
    176         .size = 0x00200000,
    177     }
    178 };
    179 
    180 static const MPCInfo b1_mpc_info[] = { {
    181         .name = "qspi",
    182         .type = MPC_ROM,
    183         .addr = 0x00000000,
    184         .size = 0x02000000,
    185     }, {
    186         .name = "sram",
    187         .type = MPC_RAM,
    188         .addr = 0x0a400000,
    189         .size = 0x00080000,
    190     }, {
    191         .name = "eflash0",
    192         .type = MPC_ROM,
    193         .addr = 0x0a000000,
    194         .size = 0x00200000,
    195     }, {
    196         .name = "eflash1",
    197         .type = MPC_ROM,
    198         .addr = 0x0a200000,
    199         .size = 0x00200000,
    200     }, {
    201         .name = "cryptoisland",
    202         .type = MPC_CRYPTOISLAND,
    203         .addr = 0x0a000000,
    204         .size = 0x00200000,
    205     }
    206 };
    207 
    208 static MemoryRegion *make_mpc(MuscaMachineState *mms, void *opaque,
    209                               const char *name, hwaddr size)
    210 {
    211     /*
    212      * Create an MPC and the RAM or flash behind it.
    213      * MPC 0: eFlash 0
    214      * MPC 1: eFlash 1
    215      * MPC 2: SRAM
    216      * MPC 3: QSPI flash
    217      * MPC 4: CryptoIsland
    218      * For now we implement the flash regions as ROM (ie not programmable)
    219      * (with their control interface memory regions being unimplemented
    220      * stubs behind the PPCs).
    221      * The whole CryptoIsland region behind its MPC is an unimplemented stub.
    222      */
    223     MuscaMachineClass *mmc = MUSCA_MACHINE_GET_CLASS(mms);
    224     TZMPC *mpc = opaque;
    225     int i = mpc - &mms->mpc[0];
    226     MemoryRegion *downstream;
    227     MemoryRegion *upstream;
    228     UnimplementedDeviceState *uds;
    229     char *mpcname;
    230     const MPCInfo *mpcinfo = mmc->mpc_info;
    231 
    232     mpcname = g_strdup_printf("%s-mpc", mpcinfo[i].name);
    233 
    234     switch (mpcinfo[i].type) {
    235     case MPC_ROM:
    236         downstream = &mms->ram[i];
    237         memory_region_init_rom(downstream, NULL, mpcinfo[i].name,
    238                                mpcinfo[i].size, &error_fatal);
    239         break;
    240     case MPC_RAM:
    241         downstream = &mms->ram[i];
    242         memory_region_init_ram(downstream, NULL, mpcinfo[i].name,
    243                                mpcinfo[i].size, &error_fatal);
    244         break;
    245     case MPC_CRYPTOISLAND:
    246         /* We don't implement the CryptoIsland yet */
    247         uds = &mms->cryptoisland;
    248         object_initialize_child(OBJECT(mms), name, uds,
    249                                 TYPE_UNIMPLEMENTED_DEVICE);
    250         qdev_prop_set_string(DEVICE(uds), "name", mpcinfo[i].name);
    251         qdev_prop_set_uint64(DEVICE(uds), "size", mpcinfo[i].size);
    252         sysbus_realize(SYS_BUS_DEVICE(uds), &error_fatal);
    253         downstream = sysbus_mmio_get_region(SYS_BUS_DEVICE(uds), 0);
    254         break;
    255     default:
    256         g_assert_not_reached();
    257     }
    258 
    259     object_initialize_child(OBJECT(mms), mpcname, mpc, TYPE_TZ_MPC);
    260     object_property_set_link(OBJECT(mpc), "downstream", OBJECT(downstream),
    261                              &error_fatal);
    262     sysbus_realize(SYS_BUS_DEVICE(mpc), &error_fatal);
    263     /* Map the upstream end of the MPC into system memory */
    264     upstream = sysbus_mmio_get_region(SYS_BUS_DEVICE(mpc), 1);
    265     memory_region_add_subregion(get_system_memory(), mpcinfo[i].addr, upstream);
    266     /* and connect its interrupt to the SSE-200 */
    267     qdev_connect_gpio_out_named(DEVICE(mpc), "irq", 0,
    268                                 qdev_get_gpio_in_named(DEVICE(&mms->sse),
    269                                                        "mpcexp_status", i));
    270 
    271     g_free(mpcname);
    272     /* Return the register interface MR for our caller to map behind the PPC */
    273     return sysbus_mmio_get_region(SYS_BUS_DEVICE(mpc), 0);
    274 }
    275 
    276 static MemoryRegion *make_rtc(MuscaMachineState *mms, void *opaque,
    277                               const char *name, hwaddr size)
    278 {
    279     PL031State *rtc = opaque;
    280 
    281     object_initialize_child(OBJECT(mms), name, rtc, TYPE_PL031);
    282     sysbus_realize(SYS_BUS_DEVICE(rtc), &error_fatal);
    283     sysbus_connect_irq(SYS_BUS_DEVICE(rtc), 0, get_sse_irq_in(mms, 39));
    284     return sysbus_mmio_get_region(SYS_BUS_DEVICE(rtc), 0);
    285 }
    286 
    287 static MemoryRegion *make_uart(MuscaMachineState *mms, void *opaque,
    288                                const char *name, hwaddr size)
    289 {
    290     PL011State *uart = opaque;
    291     int i = uart - &mms->uart[0];
    292     int irqbase = 7 + i * 6;
    293     SysBusDevice *s;
    294 
    295     object_initialize_child(OBJECT(mms), name, uart, TYPE_PL011);
    296     qdev_prop_set_chr(DEVICE(uart), "chardev", serial_hd(i));
    297     sysbus_realize(SYS_BUS_DEVICE(uart), &error_fatal);
    298     s = SYS_BUS_DEVICE(uart);
    299     sysbus_connect_irq(s, 0, get_sse_irq_in(mms, irqbase + 5)); /* combined */
    300     sysbus_connect_irq(s, 1, get_sse_irq_in(mms, irqbase + 0)); /* RX */
    301     sysbus_connect_irq(s, 2, get_sse_irq_in(mms, irqbase + 1)); /* TX */
    302     sysbus_connect_irq(s, 3, get_sse_irq_in(mms, irqbase + 2)); /* RT */
    303     sysbus_connect_irq(s, 4, get_sse_irq_in(mms, irqbase + 3)); /* MS */
    304     sysbus_connect_irq(s, 5, get_sse_irq_in(mms, irqbase + 4)); /* E */
    305     return sysbus_mmio_get_region(SYS_BUS_DEVICE(uart), 0);
    306 }
    307 
    308 static MemoryRegion *make_musca_a_devs(MuscaMachineState *mms, void *opaque,
    309                                        const char *name, hwaddr size)
    310 {
    311     /*
    312      * Create the container MemoryRegion for all the devices that live
    313      * behind the Musca-A PPC's single port. These devices don't have a PPC
    314      * port each, but we use the PPCPortInfo struct as a convenient way
    315      * to describe them. Note that addresses here are relative to the base
    316      * address of the PPC port region: 0x40100000, and devices appear both
    317      * at the 0x4... NS region and the 0x5... S region.
    318      */
    319     int i;
    320     MemoryRegion *container = &mms->container;
    321 
    322     const PPCPortInfo devices[] = {
    323         { "uart0", make_uart, &mms->uart[0], 0x1000, 0x1000 },
    324         { "uart1", make_uart, &mms->uart[1], 0x2000, 0x1000 },
    325         { "spi", make_unimp_dev, &mms->spi, 0x3000, 0x1000 },
    326         { "i2c0", make_unimp_dev, &mms->i2c[0], 0x4000, 0x1000 },
    327         { "i2c1", make_unimp_dev, &mms->i2c[1], 0x5000, 0x1000 },
    328         { "i2s", make_unimp_dev, &mms->i2s, 0x6000, 0x1000 },
    329         { "pwm0", make_unimp_dev, &mms->pwm[0], 0x7000, 0x1000 },
    330         { "rtc", make_rtc, &mms->rtc, 0x8000, 0x1000 },
    331         { "qspi", make_unimp_dev, &mms->qspi, 0xa000, 0x1000 },
    332         { "timer", make_unimp_dev, &mms->timer, 0xb000, 0x1000 },
    333         { "scc", make_unimp_dev, &mms->scc, 0xc000, 0x1000 },
    334         { "pwm1", make_unimp_dev, &mms->pwm[1], 0xe000, 0x1000 },
    335         { "pwm2", make_unimp_dev, &mms->pwm[2], 0xf000, 0x1000 },
    336         { "gpio", make_unimp_dev, &mms->gpio, 0x10000, 0x1000 },
    337         { "mpc0", make_mpc, &mms->mpc[0], 0x12000, 0x1000 },
    338         { "mpc1", make_mpc, &mms->mpc[1], 0x13000, 0x1000 },
    339     };
    340 
    341     memory_region_init(container, OBJECT(mms), "musca-device-container", size);
    342 
    343     for (i = 0; i < ARRAY_SIZE(devices); i++) {
    344         const PPCPortInfo *pinfo = &devices[i];
    345         MemoryRegion *mr;
    346 
    347         mr = pinfo->devfn(mms, pinfo->opaque, pinfo->name, pinfo->size);
    348         memory_region_add_subregion(container, pinfo->addr, mr);
    349     }
    350 
    351     return &mms->container;
    352 }
    353 
    354 static void musca_init(MachineState *machine)
    355 {
    356     MuscaMachineState *mms = MUSCA_MACHINE(machine);
    357     MuscaMachineClass *mmc = MUSCA_MACHINE_GET_CLASS(mms);
    358     MachineClass *mc = MACHINE_GET_CLASS(machine);
    359     MemoryRegion *system_memory = get_system_memory();
    360     DeviceState *ssedev;
    361     DeviceState *dev_splitter;
    362     const PPCInfo *ppcs;
    363     int num_ppcs;
    364     int i;
    365 
    366     assert(mmc->num_irqs <= MUSCA_NUMIRQ_MAX);
    367     assert(mmc->num_mpcs <= MUSCA_MPC_MAX);
    368 
    369     if (strcmp(machine->cpu_type, mc->default_cpu_type) != 0) {
    370         error_report("This board can only be used with CPU %s",
    371                      mc->default_cpu_type);
    372         exit(1);
    373     }
    374 
    375     mms->sysclk = clock_new(OBJECT(machine), "SYSCLK");
    376     clock_set_hz(mms->sysclk, SYSCLK_FRQ);
    377     mms->s32kclk = clock_new(OBJECT(machine), "S32KCLK");
    378     clock_set_hz(mms->s32kclk, S32KCLK_FRQ);
    379 
    380     object_initialize_child(OBJECT(machine), "sse-200", &mms->sse,
    381                             TYPE_SSE200);
    382     ssedev = DEVICE(&mms->sse);
    383     object_property_set_link(OBJECT(&mms->sse), "memory",
    384                              OBJECT(system_memory), &error_fatal);
    385     qdev_prop_set_uint32(ssedev, "EXP_NUMIRQ", mmc->num_irqs);
    386     qdev_prop_set_uint32(ssedev, "init-svtor", mmc->init_svtor);
    387     qdev_prop_set_uint32(ssedev, "SRAM_ADDR_WIDTH", mmc->sram_addr_width);
    388     qdev_connect_clock_in(ssedev, "MAINCLK", mms->sysclk);
    389     qdev_connect_clock_in(ssedev, "S32KCLK", mms->s32kclk);
    390     /*
    391      * Musca-A takes the default SSE-200 FPU/DSP settings (ie no for
    392      * CPU0 and yes for CPU1); Musca-B1 explicitly enables them for CPU0.
    393      */
    394     if (mmc->type == MUSCA_B1) {
    395         qdev_prop_set_bit(ssedev, "CPU0_FPU", true);
    396         qdev_prop_set_bit(ssedev, "CPU0_DSP", true);
    397     }
    398     sysbus_realize(SYS_BUS_DEVICE(&mms->sse), &error_fatal);
    399 
    400     /*
    401      * We need to create splitters to feed the IRQ inputs
    402      * for each CPU in the SSE-200 from each device in the board.
    403      */
    404     for (i = 0; i < mmc->num_irqs; i++) {
    405         char *name = g_strdup_printf("musca-irq-splitter%d", i);
    406         SplitIRQ *splitter = &mms->cpu_irq_splitter[i];
    407 
    408         object_initialize_child_with_props(OBJECT(machine), name, splitter,
    409                                            sizeof(*splitter), TYPE_SPLIT_IRQ,
    410                                            &error_fatal, NULL);
    411         g_free(name);
    412 
    413         object_property_set_int(OBJECT(splitter), "num-lines", 2,
    414                                 &error_fatal);
    415         qdev_realize(DEVICE(splitter), NULL, &error_fatal);
    416         qdev_connect_gpio_out(DEVICE(splitter), 0,
    417                               qdev_get_gpio_in_named(ssedev, "EXP_IRQ", i));
    418         qdev_connect_gpio_out(DEVICE(splitter), 1,
    419                               qdev_get_gpio_in_named(ssedev,
    420                                                      "EXP_CPU1_IRQ", i));
    421     }
    422 
    423     /*
    424      * The sec_resp_cfg output from the SSE-200 must be split into multiple
    425      * lines, one for each of the PPCs we create here.
    426      */
    427     object_initialize_child_with_props(OBJECT(machine), "sec-resp-splitter",
    428                                        &mms->sec_resp_splitter,
    429                                        sizeof(mms->sec_resp_splitter),
    430                                        TYPE_SPLIT_IRQ, &error_fatal, NULL);
    431 
    432     object_property_set_int(OBJECT(&mms->sec_resp_splitter), "num-lines",
    433                             ARRAY_SIZE(mms->ppc), &error_fatal);
    434     qdev_realize(DEVICE(&mms->sec_resp_splitter), NULL, &error_fatal);
    435     dev_splitter = DEVICE(&mms->sec_resp_splitter);
    436     qdev_connect_gpio_out_named(ssedev, "sec_resp_cfg", 0,
    437                                 qdev_get_gpio_in(dev_splitter, 0));
    438 
    439     /*
    440      * Most of the devices in the board are behind Peripheral Protection
    441      * Controllers. The required order for initializing things is:
    442      *  + initialize the PPC
    443      *  + initialize, configure and realize downstream devices
    444      *  + connect downstream device MemoryRegions to the PPC
    445      *  + realize the PPC
    446      *  + map the PPC's MemoryRegions to the places in the address map
    447      *    where the downstream devices should appear
    448      *  + wire up the PPC's control lines to the SSE object
    449      *
    450      * The PPC mapping differs for the -A and -B1 variants; the -A version
    451      * is much simpler, using only a single port of a single PPC and putting
    452      * all the devices behind that.
    453      */
    454     const PPCInfo a_ppcs[] = { {
    455             .name = "ahb_ppcexp0",
    456             .ports = {
    457                 { "musca-devices", make_musca_a_devs, 0, 0x40100000, 0x100000 },
    458             },
    459         },
    460     };
    461 
    462     /*
    463      * Devices listed with an 0x4.. address appear in both the NS 0x4.. region
    464      * and the 0x5.. S region. Devices listed with an 0x5.. address appear
    465      * only in the S region.
    466      */
    467     const PPCInfo b1_ppcs[] = { {
    468             .name = "apb_ppcexp0",
    469             .ports = {
    470                 { "eflash0", make_unimp_dev, &mms->eflash[0],
    471                   0x52400000, 0x1000 },
    472                 { "eflash1", make_unimp_dev, &mms->eflash[1],
    473                   0x52500000, 0x1000 },
    474                 { "qspi", make_unimp_dev, &mms->qspi, 0x42800000, 0x100000 },
    475                 { "mpc0", make_mpc, &mms->mpc[0], 0x52000000, 0x1000 },
    476                 { "mpc1", make_mpc, &mms->mpc[1], 0x52100000, 0x1000 },
    477                 { "mpc2", make_mpc, &mms->mpc[2], 0x52200000, 0x1000 },
    478                 { "mpc3", make_mpc, &mms->mpc[3], 0x52300000, 0x1000 },
    479                 { "mhu0", make_unimp_dev, &mms->mhu[0], 0x42600000, 0x100000 },
    480                 { "mhu1", make_unimp_dev, &mms->mhu[1], 0x42700000, 0x100000 },
    481                 { }, /* port 9: unused */
    482                 { }, /* port 10: unused */
    483                 { }, /* port 11: unused */
    484                 { }, /* port 12: unused */
    485                 { }, /* port 13: unused */
    486                 { "mpc4", make_mpc, &mms->mpc[4], 0x52e00000, 0x1000 },
    487             },
    488         }, {
    489             .name = "apb_ppcexp1",
    490             .ports = {
    491                 { "pwm0", make_unimp_dev, &mms->pwm[0], 0x40101000, 0x1000 },
    492                 { "pwm1", make_unimp_dev, &mms->pwm[1], 0x40102000, 0x1000 },
    493                 { "pwm2", make_unimp_dev, &mms->pwm[2], 0x40103000, 0x1000 },
    494                 { "i2s", make_unimp_dev, &mms->i2s, 0x40104000, 0x1000 },
    495                 { "uart0", make_uart, &mms->uart[0], 0x40105000, 0x1000 },
    496                 { "uart1", make_uart, &mms->uart[1], 0x40106000, 0x1000 },
    497                 { "i2c0", make_unimp_dev, &mms->i2c[0], 0x40108000, 0x1000 },
    498                 { "i2c1", make_unimp_dev, &mms->i2c[1], 0x40109000, 0x1000 },
    499                 { "spi", make_unimp_dev, &mms->spi, 0x4010a000, 0x1000 },
    500                 { "scc", make_unimp_dev, &mms->scc, 0x5010b000, 0x1000 },
    501                 { "timer", make_unimp_dev, &mms->timer, 0x4010c000, 0x1000 },
    502                 { "rtc", make_rtc, &mms->rtc, 0x4010d000, 0x1000 },
    503                 { "pvt", make_unimp_dev, &mms->pvt, 0x4010e000, 0x1000 },
    504                 { "sdio", make_unimp_dev, &mms->sdio, 0x4010f000, 0x1000 },
    505             },
    506         }, {
    507             .name = "ahb_ppcexp0",
    508             .ports = {
    509                 { }, /* port 0: unused */
    510                 { "gpio", make_unimp_dev, &mms->gpio, 0x41000000, 0x1000 },
    511             },
    512         },
    513     };
    514 
    515     switch (mmc->type) {
    516     case MUSCA_A:
    517         ppcs = a_ppcs;
    518         num_ppcs = ARRAY_SIZE(a_ppcs);
    519         break;
    520     case MUSCA_B1:
    521         ppcs = b1_ppcs;
    522         num_ppcs = ARRAY_SIZE(b1_ppcs);
    523         break;
    524     default:
    525         g_assert_not_reached();
    526     }
    527     assert(num_ppcs <= MUSCA_PPC_MAX);
    528 
    529     for (i = 0; i < num_ppcs; i++) {
    530         const PPCInfo *ppcinfo = &ppcs[i];
    531         TZPPC *ppc = &mms->ppc[i];
    532         DeviceState *ppcdev;
    533         int port;
    534         char *gpioname;
    535 
    536         object_initialize_child(OBJECT(machine), ppcinfo->name, ppc,
    537                                 TYPE_TZ_PPC);
    538         ppcdev = DEVICE(ppc);
    539 
    540         for (port = 0; port < TZ_NUM_PORTS; port++) {
    541             const PPCPortInfo *pinfo = &ppcinfo->ports[port];
    542             MemoryRegion *mr;
    543             char *portname;
    544 
    545             if (!pinfo->devfn) {
    546                 continue;
    547             }
    548 
    549             mr = pinfo->devfn(mms, pinfo->opaque, pinfo->name, pinfo->size);
    550             portname = g_strdup_printf("port[%d]", port);
    551             object_property_set_link(OBJECT(ppc), portname, OBJECT(mr),
    552                                      &error_fatal);
    553             g_free(portname);
    554         }
    555 
    556         sysbus_realize(SYS_BUS_DEVICE(ppc), &error_fatal);
    557 
    558         for (port = 0; port < TZ_NUM_PORTS; port++) {
    559             const PPCPortInfo *pinfo = &ppcinfo->ports[port];
    560 
    561             if (!pinfo->devfn) {
    562                 continue;
    563             }
    564             sysbus_mmio_map(SYS_BUS_DEVICE(ppc), port, pinfo->addr);
    565 
    566             gpioname = g_strdup_printf("%s_nonsec", ppcinfo->name);
    567             qdev_connect_gpio_out_named(ssedev, gpioname, port,
    568                                         qdev_get_gpio_in_named(ppcdev,
    569                                                                "cfg_nonsec",
    570                                                                port));
    571             g_free(gpioname);
    572             gpioname = g_strdup_printf("%s_ap", ppcinfo->name);
    573             qdev_connect_gpio_out_named(ssedev, gpioname, port,
    574                                         qdev_get_gpio_in_named(ppcdev,
    575                                                                "cfg_ap", port));
    576             g_free(gpioname);
    577         }
    578 
    579         gpioname = g_strdup_printf("%s_irq_enable", ppcinfo->name);
    580         qdev_connect_gpio_out_named(ssedev, gpioname, 0,
    581                                     qdev_get_gpio_in_named(ppcdev,
    582                                                            "irq_enable", 0));
    583         g_free(gpioname);
    584         gpioname = g_strdup_printf("%s_irq_clear", ppcinfo->name);
    585         qdev_connect_gpio_out_named(ssedev, gpioname, 0,
    586                                     qdev_get_gpio_in_named(ppcdev,
    587                                                            "irq_clear", 0));
    588         g_free(gpioname);
    589         gpioname = g_strdup_printf("%s_irq_status", ppcinfo->name);
    590         qdev_connect_gpio_out_named(ppcdev, "irq", 0,
    591                                     qdev_get_gpio_in_named(ssedev,
    592                                                            gpioname, 0));
    593         g_free(gpioname);
    594 
    595         qdev_connect_gpio_out(dev_splitter, i,
    596                               qdev_get_gpio_in_named(ppcdev,
    597                                                      "cfg_sec_resp", 0));
    598     }
    599 
    600     armv7m_load_kernel(ARM_CPU(first_cpu), machine->kernel_filename,
    601                        0, 0x2000000);
    602 }
    603 
    604 static void musca_class_init(ObjectClass *oc, void *data)
    605 {
    606     MachineClass *mc = MACHINE_CLASS(oc);
    607 
    608     mc->default_cpus = 2;
    609     mc->min_cpus = mc->default_cpus;
    610     mc->max_cpus = mc->default_cpus;
    611     mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-m33");
    612     mc->init = musca_init;
    613 }
    614 
    615 static void musca_a_class_init(ObjectClass *oc, void *data)
    616 {
    617     MachineClass *mc = MACHINE_CLASS(oc);
    618     MuscaMachineClass *mmc = MUSCA_MACHINE_CLASS(oc);
    619 
    620     mc->desc = "ARM Musca-A board (dual Cortex-M33)";
    621     mmc->type = MUSCA_A;
    622     mmc->init_svtor = 0x10200000;
    623     mmc->sram_addr_width = 15;
    624     mmc->num_irqs = 64;
    625     mmc->mpc_info = a_mpc_info;
    626     mmc->num_mpcs = ARRAY_SIZE(a_mpc_info);
    627 }
    628 
    629 static void musca_b1_class_init(ObjectClass *oc, void *data)
    630 {
    631     MachineClass *mc = MACHINE_CLASS(oc);
    632     MuscaMachineClass *mmc = MUSCA_MACHINE_CLASS(oc);
    633 
    634     mc->desc = "ARM Musca-B1 board (dual Cortex-M33)";
    635     mmc->type = MUSCA_B1;
    636     /*
    637      * This matches the DAPlink firmware which boots from QSPI. There
    638      * is also a firmware blob which boots from the eFlash, which
    639      * uses init_svtor = 0x1A000000. QEMU doesn't currently support that,
    640      * though we could in theory expose a machine property on the command
    641      * line to allow the user to request eFlash boot.
    642      */
    643     mmc->init_svtor = 0x10000000;
    644     mmc->sram_addr_width = 17;
    645     mmc->num_irqs = 96;
    646     mmc->mpc_info = b1_mpc_info;
    647     mmc->num_mpcs = ARRAY_SIZE(b1_mpc_info);
    648 }
    649 
    650 static const TypeInfo musca_info = {
    651     .name = TYPE_MUSCA_MACHINE,
    652     .parent = TYPE_MACHINE,
    653     .abstract = true,
    654     .instance_size = sizeof(MuscaMachineState),
    655     .class_size = sizeof(MuscaMachineClass),
    656     .class_init = musca_class_init,
    657 };
    658 
    659 static const TypeInfo musca_a_info = {
    660     .name = TYPE_MUSCA_A_MACHINE,
    661     .parent = TYPE_MUSCA_MACHINE,
    662     .class_init = musca_a_class_init,
    663 };
    664 
    665 static const TypeInfo musca_b1_info = {
    666     .name = TYPE_MUSCA_B1_MACHINE,
    667     .parent = TYPE_MUSCA_MACHINE,
    668     .class_init = musca_b1_class_init,
    669 };
    670 
    671 static void musca_machine_init(void)
    672 {
    673     type_register_static(&musca_info);
    674     type_register_static(&musca_a_info);
    675     type_register_static(&musca_b1_info);
    676 }
    677 
    678 type_init(musca_machine_init);