aboutsummaryrefslogtreecommitdiff
path: root/include
diff options
context:
space:
mode:
Diffstat (limited to 'include')
-rw-r--r--include/block/nbd.h53
-rw-r--r--include/hw/arm/armv7m.h5
-rw-r--r--include/hw/arm/iotkit.h109
-rw-r--r--include/hw/arm/xlnx-zynqmp.h2
-rw-r--r--include/hw/core/split-irq.h57
-rw-r--r--include/hw/irq.h4
-rw-r--r--include/hw/loader.h12
-rw-r--r--include/hw/misc/iotkit-secctl.h103
-rw-r--r--include/hw/misc/mps2-fpgaio.h43
-rw-r--r--include/hw/misc/tz-ppc.h101
-rw-r--r--include/hw/misc/unimp.h10
-rw-r--r--include/hw/or-irq.h5
-rw-r--r--include/hw/qdev-core.h30
-rw-r--r--include/hw/timer/xlnx-zynqmp-rtc.h86
14 files changed, 605 insertions, 15 deletions
diff --git a/include/block/nbd.h b/include/block/nbd.h
index fc50003003..495564c73a 100644
--- a/include/block/nbd.h
+++ b/include/block/nbd.h
@@ -41,6 +41,12 @@ struct NBDOptionReply {
} QEMU_PACKED;
typedef struct NBDOptionReply NBDOptionReply;
+typedef struct NBDOptionReplyMetaContext {
+ NBDOptionReply h; /* h.type = NBD_REP_META_CONTEXT, h.length > 4 */
+ uint32_t context_id;
+ /* meta context name follows */
+} QEMU_PACKED NBDOptionReplyMetaContext;
+
/* Transmission phase structs
*
* Note: these are _NOT_ the same as the network representation of an NBD
@@ -105,6 +111,19 @@ typedef struct NBDStructuredError {
uint16_t message_length;
} QEMU_PACKED NBDStructuredError;
+/* Header of NBD_REPLY_TYPE_BLOCK_STATUS */
+typedef struct NBDStructuredMeta {
+ NBDStructuredReplyChunk h; /* h.length >= 12 (at least one extent) */
+ uint32_t context_id;
+ /* extents follows */
+} QEMU_PACKED NBDStructuredMeta;
+
+/* Extent chunk for NBD_REPLY_TYPE_BLOCK_STATUS */
+typedef struct NBDExtent {
+ uint32_t length;
+ uint32_t flags; /* NBD_STATE_* */
+} QEMU_PACKED NBDExtent;
+
/* Transmission (export) flags: sent from server to client during handshake,
but describe what will happen during transmission */
#define NBD_FLAG_HAS_FLAGS (1 << 0) /* Flags are there */
@@ -128,21 +147,24 @@ typedef struct NBDStructuredError {
#define NBD_FLAG_C_NO_ZEROES (1 << 1) /* End handshake without zeroes. */
/* Option requests. */
-#define NBD_OPT_EXPORT_NAME (1)
-#define NBD_OPT_ABORT (2)
-#define NBD_OPT_LIST (3)
-/* #define NBD_OPT_PEEK_EXPORT (4) not in use */
-#define NBD_OPT_STARTTLS (5)
-#define NBD_OPT_INFO (6)
-#define NBD_OPT_GO (7)
-#define NBD_OPT_STRUCTURED_REPLY (8)
+#define NBD_OPT_EXPORT_NAME (1)
+#define NBD_OPT_ABORT (2)
+#define NBD_OPT_LIST (3)
+/* #define NBD_OPT_PEEK_EXPORT (4) not in use */
+#define NBD_OPT_STARTTLS (5)
+#define NBD_OPT_INFO (6)
+#define NBD_OPT_GO (7)
+#define NBD_OPT_STRUCTURED_REPLY (8)
+#define NBD_OPT_LIST_META_CONTEXT (9)
+#define NBD_OPT_SET_META_CONTEXT (10)
/* Option reply types. */
#define NBD_REP_ERR(value) ((UINT32_C(1) << 31) | (value))
-#define NBD_REP_ACK (1) /* Data sending finished. */
-#define NBD_REP_SERVER (2) /* Export description. */
-#define NBD_REP_INFO (3) /* NBD_OPT_INFO/GO. */
+#define NBD_REP_ACK (1) /* Data sending finished. */
+#define NBD_REP_SERVER (2) /* Export description. */
+#define NBD_REP_INFO (3) /* NBD_OPT_INFO/GO. */
+#define NBD_REP_META_CONTEXT (4) /* NBD_OPT_{LIST,SET}_META_CONTEXT */
#define NBD_REP_ERR_UNSUP NBD_REP_ERR(1) /* Unknown option */
#define NBD_REP_ERR_POLICY NBD_REP_ERR(2) /* Server denied */
@@ -163,6 +185,8 @@ typedef struct NBDStructuredError {
#define NBD_CMD_FLAG_FUA (1 << 0) /* 'force unit access' during write */
#define NBD_CMD_FLAG_NO_HOLE (1 << 1) /* don't punch hole on zero run */
#define NBD_CMD_FLAG_DF (1 << 2) /* don't fragment structured read */
+#define NBD_CMD_FLAG_REQ_ONE (1 << 3) /* only one extent in BLOCK_STATUS
+ * reply chunk */
/* Supported request types */
enum {
@@ -173,6 +197,7 @@ enum {
NBD_CMD_TRIM = 4,
/* 5 reserved for failed experiment NBD_CMD_CACHE */
NBD_CMD_WRITE_ZEROES = 6,
+ NBD_CMD_BLOCK_STATUS = 7,
};
#define NBD_DEFAULT_PORT 10809
@@ -200,9 +225,15 @@ enum {
#define NBD_REPLY_TYPE_NONE 0
#define NBD_REPLY_TYPE_OFFSET_DATA 1
#define NBD_REPLY_TYPE_OFFSET_HOLE 2
+#define NBD_REPLY_TYPE_BLOCK_STATUS 5
#define NBD_REPLY_TYPE_ERROR NBD_REPLY_ERR(1)
#define NBD_REPLY_TYPE_ERROR_OFFSET NBD_REPLY_ERR(2)
+/* Flags for extents (NBDExtent.flags) of NBD_REPLY_TYPE_BLOCK_STATUS,
+ * for base:allocation meta context */
+#define NBD_STATE_HOLE (1 << 0)
+#define NBD_STATE_ZERO (1 << 1)
+
static inline bool nbd_reply_type_is_error(int type)
{
return type & (1 << 15);
diff --git a/include/hw/arm/armv7m.h b/include/hw/arm/armv7m.h
index 35ab757264..78308d1484 100644
--- a/include/hw/arm/armv7m.h
+++ b/include/hw/arm/armv7m.h
@@ -12,6 +12,7 @@
#include "hw/sysbus.h"
#include "hw/intc/armv7m_nvic.h"
+#include "target/arm/idau.h"
#define TYPE_BITBAND "ARM,bitband-memory"
#define BITBAND(obj) OBJECT_CHECK(BitBandState, (obj), TYPE_BITBAND)
@@ -40,6 +41,8 @@ typedef struct {
* + Property "memory": MemoryRegion defining the physical address space
* that CPU accesses see. (The NVIC, bitbanding and other CPU-internal
* devices will be automatically layered on top of this view.)
+ * + Property "idau": IDAU interface (forwarded to CPU object)
+ * + Property "init-svtor": secure VTOR reset value (forwarded to CPU object)
*/
typedef struct ARMv7MState {
/*< private >*/
@@ -58,6 +61,8 @@ typedef struct ARMv7MState {
char *cpu_type;
/* MemoryRegion the board provides to us (with its devices, RAM, etc) */
MemoryRegion *board_memory;
+ Object *idau;
+ uint32_t init_svtor;
} ARMv7MState;
#endif
diff --git a/include/hw/arm/iotkit.h b/include/hw/arm/iotkit.h
new file mode 100644
index 0000000000..c6129d926b
--- /dev/null
+++ b/include/hw/arm/iotkit.h
@@ -0,0 +1,109 @@
+/*
+ * ARM IoT Kit
+ *
+ * Copyright (c) 2018 Linaro Limited
+ * Written by Peter Maydell
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 or
+ * (at your option) any later version.
+ */
+
+/* This is a model of the Arm IoT Kit which is documented in
+ * http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ecm0601256/index.html
+ * It contains:
+ * a Cortex-M33
+ * the IDAU
+ * some timers and watchdogs
+ * two peripheral protection controllers
+ * a memory protection controller
+ * a security controller
+ * a bus fabric which arranges that some parts of the address
+ * space are secure and non-secure aliases of each other
+ *
+ * QEMU interface:
+ * + QOM property "memory" is a MemoryRegion containing the devices provided
+ * by the board model.
+ * + QOM property "MAINCLK" is the frequency of the main system clock
+ * + QOM property "EXP_NUMIRQ" sets the number of expansion interrupts
+ * + Named GPIO inputs "EXP_IRQ" 0..n are the expansion interrupts, which
+ * are wired to the NVIC lines 32 .. n+32
+ * Controlling up to 4 AHB expansion PPBs which a system using the IoTKit
+ * might provide:
+ * + named GPIO outputs apb_ppcexp{0,1,2,3}_nonsec[0..15]
+ * + named GPIO outputs apb_ppcexp{0,1,2,3}_ap[0..15]
+ * + named GPIO outputs apb_ppcexp{0,1,2,3}_irq_enable
+ * + named GPIO outputs apb_ppcexp{0,1,2,3}_irq_clear
+ * + named GPIO inputs apb_ppcexp{0,1,2,3}_irq_status
+ * Controlling each of the 4 expansion AHB PPCs which a system using the IoTKit
+ * might provide:
+ * + named GPIO outputs ahb_ppcexp{0,1,2,3}_nonsec[0..15]
+ * + named GPIO outputs ahb_ppcexp{0,1,2,3}_ap[0..15]
+ * + named GPIO outputs ahb_ppcexp{0,1,2,3}_irq_enable
+ * + named GPIO outputs ahb_ppcexp{0,1,2,3}_irq_clear
+ * + named GPIO inputs ahb_ppcexp{0,1,2,3}_irq_status
+ */
+
+#ifndef IOTKIT_H
+#define IOTKIT_H
+
+#include "hw/sysbus.h"
+#include "hw/arm/armv7m.h"
+#include "hw/misc/iotkit-secctl.h"
+#include "hw/misc/tz-ppc.h"
+#include "hw/timer/cmsdk-apb-timer.h"
+#include "hw/misc/unimp.h"
+#include "hw/or-irq.h"
+#include "hw/core/split-irq.h"
+
+#define TYPE_IOTKIT "iotkit"
+#define IOTKIT(obj) OBJECT_CHECK(IoTKit, (obj), TYPE_IOTKIT)
+
+/* We have an IRQ splitter and an OR gate input for each external PPC
+ * and the 2 internal PPCs
+ */
+#define NUM_EXTERNAL_PPCS (IOTS_NUM_AHB_EXP_PPC + IOTS_NUM_APB_EXP_PPC)
+#define NUM_PPCS (NUM_EXTERNAL_PPCS + 2)
+
+typedef struct IoTKit {
+ /*< private >*/
+ SysBusDevice parent_obj;
+
+ /*< public >*/
+ ARMv7MState armv7m;
+ IoTKitSecCtl secctl;
+ TZPPC apb_ppc0;
+ TZPPC apb_ppc1;
+ CMSDKAPBTIMER timer0;
+ CMSDKAPBTIMER timer1;
+ qemu_or_irq ppc_irq_orgate;
+ SplitIRQ sec_resp_splitter;
+ SplitIRQ ppc_irq_splitter[NUM_PPCS];
+
+ UnimplementedDeviceState dualtimer;
+ UnimplementedDeviceState s32ktimer;
+
+ MemoryRegion container;
+ MemoryRegion alias1;
+ MemoryRegion alias2;
+ MemoryRegion alias3;
+ MemoryRegion sram0;
+
+ qemu_irq *exp_irqs;
+ qemu_irq ppc0_irq;
+ qemu_irq ppc1_irq;
+ qemu_irq sec_resp_cfg;
+ qemu_irq sec_resp_cfg_in;
+ qemu_irq nsc_cfg_in;
+
+ qemu_irq irq_status_in[NUM_EXTERNAL_PPCS];
+
+ uint32_t nsccfg;
+
+ /* Properties */
+ MemoryRegion *board_memory;
+ uint32_t exp_numirq;
+ uint32_t mainclk_frq;
+} IoTKit;
+
+#endif
diff --git a/include/hw/arm/xlnx-zynqmp.h b/include/hw/arm/xlnx-zynqmp.h
index 0a2b037c6b..3b613e364d 100644
--- a/include/hw/arm/xlnx-zynqmp.h
+++ b/include/hw/arm/xlnx-zynqmp.h
@@ -29,6 +29,7 @@
#include "hw/dma/xlnx_dpdma.h"
#include "hw/display/xlnx_dp.h"
#include "hw/intc/xlnx-zynqmp-ipi.h"
+#include "hw/timer/xlnx-zynqmp-rtc.h"
#define TYPE_XLNX_ZYNQMP "xlnx,zynqmp"
#define XLNX_ZYNQMP(obj) OBJECT_CHECK(XlnxZynqMPState, (obj), \
@@ -92,6 +93,7 @@ typedef struct XlnxZynqMPState {
XlnxDPState dp;
XlnxDPDMAState dpdma;
XlnxZynqMPIPI ipi;
+ XlnxZynqMPRTC rtc;
char *boot_cpu;
ARMCPU *boot_cpu_ptr;
diff --git a/include/hw/core/split-irq.h b/include/hw/core/split-irq.h
new file mode 100644
index 0000000000..bb87157c5a
--- /dev/null
+++ b/include/hw/core/split-irq.h
@@ -0,0 +1,57 @@
+/*
+ * IRQ splitter device.
+ *
+ * Copyright (c) 2018 Linaro Limited.
+ * Written by Peter Maydell
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+/* This is a simple device which has one GPIO input line and multiple
+ * GPIO output lines. Any change on the input line is forwarded to all
+ * of the outputs.
+ *
+ * QEMU interface:
+ * + one unnamed GPIO input: the input line
+ * + N unnamed GPIO outputs: the output lines
+ * + QOM property "num-lines": sets the number of output lines
+ */
+#ifndef HW_SPLIT_IRQ_H
+#define HW_SPLIT_IRQ_H
+
+#include "hw/irq.h"
+#include "hw/sysbus.h"
+#include "qom/object.h"
+
+#define TYPE_SPLIT_IRQ "split-irq"
+
+#define MAX_SPLIT_LINES 16
+
+typedef struct SplitIRQ SplitIRQ;
+
+#define SPLIT_IRQ(obj) OBJECT_CHECK(SplitIRQ, (obj), TYPE_SPLIT_IRQ)
+
+struct SplitIRQ {
+ DeviceState parent_obj;
+
+ qemu_irq out_irq[MAX_SPLIT_LINES];
+ uint16_t num_lines;
+};
+
+#endif
diff --git a/include/hw/irq.h b/include/hw/irq.h
index 4c4c2eaf9a..7a40e3ed26 100644
--- a/include/hw/irq.h
+++ b/include/hw/irq.h
@@ -50,7 +50,9 @@ void qemu_free_irq(qemu_irq irq);
/* Returns a new IRQ with opposite polarity. */
qemu_irq qemu_irq_invert(qemu_irq irq);
-/* Returns a new IRQ which feeds into both the passed IRQs */
+/* Returns a new IRQ which feeds into both the passed IRQs.
+ * It's probably better to use the TYPE_SPLIT_IRQ device instead.
+ */
qemu_irq qemu_irq_split(qemu_irq irq1, qemu_irq irq2);
/* Returns a new IRQ set which connects 1:1 to another IRQ set, which
diff --git a/include/hw/loader.h b/include/hw/loader.h
index 5edbe02b1c..2504cc2259 100644
--- a/include/hw/loader.h
+++ b/include/hw/loader.h
@@ -162,16 +162,26 @@ int load_uimage(const char *filename, hwaddr *ep,
void *translate_opaque);
/**
- * load_ramdisk:
+ * load_ramdisk_as:
* @filename: Path to the ramdisk image
* @addr: Memory address to load the ramdisk to
* @max_sz: Maximum allowed ramdisk size (for non-u-boot ramdisks)
+ * @as: The AddressSpace to load the ELF to. The value of address_space_memory
+ * is used if nothing is supplied here.
*
* Load a ramdisk image with U-Boot header to the specified memory
* address.
*
* Returns the size of the loaded image on success, -1 otherwise.
*/
+int load_ramdisk_as(const char *filename, hwaddr addr, uint64_t max_sz,
+ AddressSpace *as);
+
+/**
+ * load_ramdisk:
+ * Same as load_ramdisk_as(), but doesn't allow the caller to specify
+ * an AddressSpace.
+ */
int load_ramdisk(const char *filename, hwaddr addr, uint64_t max_sz);
ssize_t gunzip(void *dst, size_t dstlen, uint8_t *src, size_t srclen);
diff --git a/include/hw/misc/iotkit-secctl.h b/include/hw/misc/iotkit-secctl.h
new file mode 100644
index 0000000000..faad0c9190
--- /dev/null
+++ b/include/hw/misc/iotkit-secctl.h
@@ -0,0 +1,103 @@
+/*
+ * ARM IoT Kit security controller
+ *
+ * Copyright (c) 2018 Linaro Limited
+ * Written by Peter Maydell
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 or
+ * (at your option) any later version.
+ */
+
+/* This is a model of the security controller which is part of the
+ * Arm IoT Kit and documented in
+ * http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ecm0601256/index.html
+ *
+ * QEMU interface:
+ * + sysbus MMIO region 0 is the "secure privilege control block" registers
+ * + sysbus MMIO region 1 is the "non-secure privilege control block" registers
+ * + named GPIO output "sec_resp_cfg" indicating whether blocked accesses
+ * should RAZ/WI or bus error
+ * + named GPIO output "nsc_cfg" whose value tracks the NSCCFG register value
+ * Controlling the 2 APB PPCs in the IoTKit:
+ * + named GPIO outputs apb_ppc0_nonsec[0..2] and apb_ppc1_nonsec
+ * + named GPIO outputs apb_ppc0_ap[0..2] and apb_ppc1_ap
+ * + named GPIO outputs apb_ppc{0,1}_irq_enable
+ * + named GPIO outputs apb_ppc{0,1}_irq_clear
+ * + named GPIO inputs apb_ppc{0,1}_irq_status
+ * Controlling each of the 4 expansion APB PPCs which a system using the IoTKit
+ * might provide:
+ * + named GPIO outputs apb_ppcexp{0,1,2,3}_nonsec[0..15]
+ * + named GPIO outputs apb_ppcexp{0,1,2,3}_ap[0..15]
+ * + named GPIO outputs apb_ppcexp{0,1,2,3}_irq_enable
+ * + named GPIO outputs apb_ppcexp{0,1,2,3}_irq_clear
+ * + named GPIO inputs apb_ppcexp{0,1,2,3}_irq_status
+ * Controlling each of the 4 expansion AHB PPCs which a system using the IoTKit
+ * might provide:
+ * + named GPIO outputs ahb_ppcexp{0,1,2,3}_nonsec[0..15]
+ * + named GPIO outputs ahb_ppcexp{0,1,2,3}_ap[0..15]
+ * + named GPIO outputs ahb_ppcexp{0,1,2,3}_irq_enable
+ * + named GPIO outputs ahb_ppcexp{0,1,2,3}_irq_clear
+ * + named GPIO inputs ahb_ppcexp{0,1,2,3}_irq_status
+ */
+
+#ifndef IOTKIT_SECCTL_H
+#define IOTKIT_SECCTL_H
+
+#include "hw/sysbus.h"
+
+#define TYPE_IOTKIT_SECCTL "iotkit-secctl"
+#define IOTKIT_SECCTL(obj) OBJECT_CHECK(IoTKitSecCtl, (obj), TYPE_IOTKIT_SECCTL)
+
+#define IOTS_APB_PPC0_NUM_PORTS 3
+#define IOTS_APB_PPC1_NUM_PORTS 1
+#define IOTS_PPC_NUM_PORTS 16
+#define IOTS_NUM_APB_PPC 2
+#define IOTS_NUM_APB_EXP_PPC 4
+#define IOTS_NUM_AHB_EXP_PPC 4
+
+typedef struct IoTKitSecCtl IoTKitSecCtl;
+
+/* State and IRQ lines relating to a PPC. For the
+ * PPCs in the IoTKit not all the IRQ lines are used.
+ */
+typedef struct IoTKitSecCtlPPC {
+ qemu_irq nonsec[IOTS_PPC_NUM_PORTS];
+ qemu_irq ap[IOTS_PPC_NUM_PORTS];
+ qemu_irq irq_enable;
+ qemu_irq irq_clear;
+
+ uint32_t ns;
+ uint32_t sp;
+ uint32_t nsp;
+
+ /* Number of ports actually present */
+ int numports;
+ /* Offset of this PPC's interrupt bits in SECPPCINTSTAT */
+ int irq_bit_offset;
+ IoTKitSecCtl *parent;
+} IoTKitSecCtlPPC;
+
+struct IoTKitSecCtl {
+ /*< private >*/
+ SysBusDevice parent_obj;
+
+ /*< public >*/
+ qemu_irq sec_resp_cfg;
+ qemu_irq nsc_cfg_irq;
+
+ MemoryRegion s_regs;
+ MemoryRegion ns_regs;
+
+ uint32_t secppcintstat;
+ uint32_t secppcinten;
+ uint32_t secrespcfg;
+ uint32_t nsccfg;
+ uint32_t brginten;
+
+ IoTKitSecCtlPPC apb[IOTS_NUM_APB_PPC];
+ IoTKitSecCtlPPC apbexp[IOTS_NUM_APB_EXP_PPC];
+ IoTKitSecCtlPPC ahbexp[IOTS_NUM_APB_EXP_PPC];
+};
+
+#endif
diff --git a/include/hw/misc/mps2-fpgaio.h b/include/hw/misc/mps2-fpgaio.h
new file mode 100644
index 0000000000..eedf17ebc6
--- /dev/null
+++ b/include/hw/misc/mps2-fpgaio.h
@@ -0,0 +1,43 @@
+/*
+ * ARM MPS2 FPGAIO emulation
+ *
+ * Copyright (c) 2018 Linaro Limited
+ * Written by Peter Maydell
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 or
+ * (at your option) any later version.
+ */
+
+/* This is a model of the FPGAIO register block in the AN505
+ * FPGA image for the MPS2 dev board; it is documented in the
+ * application note:
+ * http://infocenter.arm.com/help/topic/com.arm.doc.dai0505b/index.html
+ *
+ * QEMU interface:
+ * + sysbus MMIO region 0: the register bank
+ */
+
+#ifndef MPS2_FPGAIO_H
+#define MPS2_FPGAIO_H
+
+#include "hw/sysbus.h"
+
+#define TYPE_MPS2_FPGAIO "mps2-fpgaio"
+#define MPS2_FPGAIO(obj) OBJECT_CHECK(MPS2FPGAIO, (obj), TYPE_MPS2_FPGAIO)
+
+typedef struct {
+ /*< private >*/
+ SysBusDevice parent_obj;
+
+ /*< public >*/
+ MemoryRegion iomem;
+
+ uint32_t led0;
+ uint32_t prescale;
+ uint32_t misc;
+
+ uint32_t prescale_clk;
+} MPS2FPGAIO;
+
+#endif
diff --git a/include/hw/misc/tz-ppc.h b/include/hw/misc/tz-ppc.h
new file mode 100644
index 0000000000..fc8b806e4d
--- /dev/null
+++ b/include/hw/misc/tz-ppc.h
@@ -0,0 +1,101 @@
+/*
+ * ARM TrustZone peripheral protection controller emulation
+ *
+ * Copyright (c) 2018 Linaro Limited
+ * Written by Peter Maydell
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 or
+ * (at your option) any later version.
+ */
+
+/* This is a model of the TrustZone peripheral protection controller (PPC).
+ * It is documented in the ARM CoreLink SIE-200 System IP for Embedded TRM
+ * (DDI 0571G):
+ * https://developer.arm.com/products/architecture/m-profile/docs/ddi0571/g
+ *
+ * The PPC sits in front of peripherals and allows secure software to
+ * configure it to either pass through or reject transactions.
+ * Rejected transactions may be configured to either be aborted, or to
+ * behave as RAZ/WI. An interrupt can be signalled for a rejected transaction.
+ *
+ * The PPC has no register interface -- it is configured purely by a
+ * collection of input signals from other hardware in the system. Typically
+ * they are either hardwired or exposed in an ad-hoc register interface by
+ * the SoC that uses the PPC.
+ *
+ * This QEMU model can be used to model either the AHB5 or APB4 TZ PPC,
+ * since the only difference between them is that the AHB version has a
+ * "default" port which has no security checks applied. In QEMU the default
+ * port can be emulated simply by wiring its downstream devices directly
+ * into the parent address space, since the PPC does not need to intercept
+ * transactions there.
+ *
+ * In the hardware, selection of which downstream port to use is done by
+ * the user's decode logic asserting one of the hsel[] signals. In QEMU,
+ * we provide 16 MMIO regions, one per port, and the user maps these into
+ * the desired addresses to implement the address decode.
+ *
+ * QEMU interface:
+ * + sysbus MMIO regions 0..15: MemoryRegions defining the upstream end
+ * of each of the 16 ports of the PPC
+ * + Property "port[0..15]": MemoryRegion defining the downstream device(s)
+ * for each of the 16 ports of the PPC
+ * + Named GPIO inputs "cfg_nonsec[0..15]": set to 1 if the port should be
+ * accessible to NonSecure transactions
+ * + Named GPIO inputs "cfg_ap[0..15]": set to 1 if the port should be
+ * accessible to non-privileged transactions
+ * + Named GPIO input "cfg_sec_resp": set to 1 if a rejected transaction should
+ * result in a transaction error, or 0 for the transaction to RAZ/WI
+ * + Named GPIO input "irq_enable": set to 1 to enable interrupts
+ * + Named GPIO input "irq_clear": set to 1 to clear a pending interrupt
+ * + Named GPIO output "irq": set for a transaction-failed interrupt
+ * + Property "NONSEC_MASK": if a bit is set in this mask then accesses to
+ * the associated port do not have the TZ security check performed. (This
+ * corresponds to the hardware allowing this to be set as a Verilog
+ * parameter.)
+ */
+
+#ifndef TZ_PPC_H
+#define TZ_PPC_H
+
+#include "hw/sysbus.h"
+
+#define TYPE_TZ_PPC "tz-ppc"
+#define TZ_PPC(obj) OBJECT_CHECK(TZPPC, (obj), TYPE_TZ_PPC)
+
+#define TZ_NUM_PORTS 16
+
+typedef struct TZPPC TZPPC;
+
+typedef struct TZPPCPort {
+ TZPPC *ppc;
+ MemoryRegion upstream;
+ AddressSpace downstream_as;
+ MemoryRegion *downstream;
+} TZPPCPort;
+
+struct TZPPC {
+ /*< private >*/
+ SysBusDevice parent_obj;
+
+ /*< public >*/
+
+ /* State: these just track the values of our input signals */
+ bool cfg_nonsec[TZ_NUM_PORTS];
+ bool cfg_ap[TZ_NUM_PORTS];
+ bool cfg_sec_resp;
+ bool irq_enable;
+ bool irq_clear;
+ /* State: are we asserting irq ? */
+ bool irq_status;
+
+ qemu_irq irq;
+
+ /* Properties */
+ uint32_t nonsec_mask;
+
+ TZPPCPort port[TZ_NUM_PORTS];
+};
+
+#endif
diff --git a/include/hw/misc/unimp.h b/include/hw/misc/unimp.h
index 52e068ec3e..2a291ca42d 100644
--- a/include/hw/misc/unimp.h
+++ b/include/hw/misc/unimp.h
@@ -12,6 +12,16 @@
#define TYPE_UNIMPLEMENTED_DEVICE "unimplemented-device"
+#define UNIMPLEMENTED_DEVICE(obj) \
+ OBJECT_CHECK(UnimplementedDeviceState, (obj), TYPE_UNIMPLEMENTED_DEVICE)
+
+typedef struct {
+ SysBusDevice parent_obj;
+ MemoryRegion iomem;
+ char *name;
+ uint64_t size;
+} UnimplementedDeviceState;
+
/**
* create_unimplemented_device: create and map a dummy device
* @name: name of the device for debug logging
diff --git a/include/hw/or-irq.h b/include/hw/or-irq.h
index fd900fcf19..3f6fc1b58a 100644
--- a/include/hw/or-irq.h
+++ b/include/hw/or-irq.h
@@ -22,6 +22,9 @@
* THE SOFTWARE.
*/
+#ifndef HW_OR_IRQ_H
+#define HW_OR_IRQ_H
+
#include "hw/irq.h"
#include "hw/sysbus.h"
#include "qom/object.h"
@@ -41,3 +44,5 @@ struct OrIRQState {
bool levels[MAX_OR_LINES];
uint16_t num_lines;
};
+
+#endif
diff --git a/include/hw/qdev-core.h b/include/hw/qdev-core.h
index fc9d617a76..9453588160 100644
--- a/include/hw/qdev-core.h
+++ b/include/hw/qdev-core.h
@@ -311,10 +311,36 @@ BusState *qdev_get_child_bus(DeviceState *dev, const char *name);
/* GPIO inputs also double as IRQ sinks. */
void qdev_init_gpio_in(DeviceState *dev, qemu_irq_handler handler, int n);
void qdev_init_gpio_out(DeviceState *dev, qemu_irq *pins, int n);
-void qdev_init_gpio_in_named(DeviceState *dev, qemu_irq_handler handler,
- const char *name, int n);
void qdev_init_gpio_out_named(DeviceState *dev, qemu_irq *pins,
const char *name, int n);
+/**
+ * qdev_init_gpio_in_named_with_opaque: create an array of input GPIO lines
+ * for the specified device
+ *
+ * @dev: Device to create input GPIOs for
+ * @handler: Function to call when GPIO line value is set
+ * @opaque: Opaque data pointer to pass to @handler
+ * @name: Name of the GPIO input (must be unique for this device)
+ * @n: Number of GPIO lines in this input set
+ */
+void qdev_init_gpio_in_named_with_opaque(DeviceState *dev,
+ qemu_irq_handler handler,
+ void *opaque,
+ const char *name, int n);
+
+/**
+ * qdev_init_gpio_in_named: create an array of input GPIO lines
+ * for the specified device
+ *
+ * Like qdev_init_gpio_in_named_with_opaque(), but the opaque pointer
+ * passed to the handler is @dev (which is the most commonly desired behaviour).
+ */
+static inline void qdev_init_gpio_in_named(DeviceState *dev,
+ qemu_irq_handler handler,
+ const char *name, int n)
+{
+ qdev_init_gpio_in_named_with_opaque(dev, handler, dev, name, n);
+}
void qdev_pass_gpios(DeviceState *dev, DeviceState *container,
const char *name);
diff --git a/include/hw/timer/xlnx-zynqmp-rtc.h b/include/hw/timer/xlnx-zynqmp-rtc.h
new file mode 100644
index 0000000000..5ba4d8bc4a
--- /dev/null
+++ b/include/hw/timer/xlnx-zynqmp-rtc.h
@@ -0,0 +1,86 @@
+/*
+ * QEMU model of the Xilinx ZynqMP Real Time Clock (RTC).
+ *
+ * Copyright (c) 2017 Xilinx Inc.
+ *
+ * Written-by: Alistair Francis <alistair.francis@xilinx.com>
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#include "hw/register.h"
+
+#define TYPE_XLNX_ZYNQMP_RTC "xlnx-zynmp.rtc"
+
+#define XLNX_ZYNQMP_RTC(obj) \
+ OBJECT_CHECK(XlnxZynqMPRTC, (obj), TYPE_XLNX_ZYNQMP_RTC)
+
+REG32(SET_TIME_WRITE, 0x0)
+REG32(SET_TIME_READ, 0x4)
+REG32(CALIB_WRITE, 0x8)
+ FIELD(CALIB_WRITE, FRACTION_EN, 20, 1)
+ FIELD(CALIB_WRITE, FRACTION_DATA, 16, 4)
+ FIELD(CALIB_WRITE, MAX_TICK, 0, 16)
+REG32(CALIB_READ, 0xc)
+ FIELD(CALIB_READ, FRACTION_EN, 20, 1)
+ FIELD(CALIB_READ, FRACTION_DATA, 16, 4)
+ FIELD(CALIB_READ, MAX_TICK, 0, 16)
+REG32(CURRENT_TIME, 0x10)
+REG32(CURRENT_TICK, 0x14)
+ FIELD(CURRENT_TICK, VALUE, 0, 16)
+REG32(ALARM, 0x18)
+REG32(RTC_INT_STATUS, 0x20)
+ FIELD(RTC_INT_STATUS, ALARM, 1, 1)
+ FIELD(RTC_INT_STATUS, SECONDS, 0, 1)
+REG32(RTC_INT_MASK, 0x24)
+ FIELD(RTC_INT_MASK, ALARM, 1, 1)
+ FIELD(RTC_INT_MASK, SECONDS, 0, 1)
+REG32(RTC_INT_EN, 0x28)
+ FIELD(RTC_INT_EN, ALARM, 1, 1)
+ FIELD(RTC_INT_EN, SECONDS, 0, 1)
+REG32(RTC_INT_DIS, 0x2c)
+ FIELD(RTC_INT_DIS, ALARM, 1, 1)
+ FIELD(RTC_INT_DIS, SECONDS, 0, 1)
+REG32(ADDR_ERROR, 0x30)
+ FIELD(ADDR_ERROR, STATUS, 0, 1)
+REG32(ADDR_ERROR_INT_MASK, 0x34)
+ FIELD(ADDR_ERROR_INT_MASK, MASK, 0, 1)
+REG32(ADDR_ERROR_INT_EN, 0x38)
+ FIELD(ADDR_ERROR_INT_EN, MASK, 0, 1)
+REG32(ADDR_ERROR_INT_DIS, 0x3c)
+ FIELD(ADDR_ERROR_INT_DIS, MASK, 0, 1)
+REG32(CONTROL, 0x40)
+ FIELD(CONTROL, BATTERY_DISABLE, 31, 1)
+ FIELD(CONTROL, OSC_CNTRL, 24, 4)
+ FIELD(CONTROL, SLVERR_ENABLE, 0, 1)
+REG32(SAFETY_CHK, 0x50)
+
+#define XLNX_ZYNQMP_RTC_R_MAX (R_SAFETY_CHK + 1)
+
+typedef struct XlnxZynqMPRTC {
+ SysBusDevice parent_obj;
+ MemoryRegion iomem;
+ qemu_irq irq_rtc_int;
+ qemu_irq irq_addr_error_int;
+
+ uint32_t tick_offset;
+
+ uint32_t regs[XLNX_ZYNQMP_RTC_R_MAX];
+ RegisterInfo regs_info[XLNX_ZYNQMP_RTC_R_MAX];
+} XlnxZynqMPRTC;
generated by cgit v1.2.3 (git 2.26.2) at 2025-01-02 06:49:55 +0000