diff --git a/docs/system/arm/mps2.rst b/docs/system/arm/mps2.rst
index f83b15178712799aac762a8ea942047d7cc211f1..8a75beb3a08b8c50b913cb63ad50db5d291756af 100644
--- a/docs/system/arm/mps2.rst
+++ b/docs/system/arm/mps2.rst
@@ -45,3 +45,13 @@ Differences between QEMU and real hardware:
flash, but only as simple ROM, so attempting to rewrite the flash
from the guest will fail
- QEMU does not model the USB controller in MPS3 boards
+
+Machine-specific options
+""""""""""""""""""""""""
+
+The following machine-specific options are supported:
+
+remap
+ Supported for ``mps3-an524`` only.
+ Set ``BRAM``/``QSPI`` to select the initial memory mapping. The
+ default is ``BRAM``.
diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c
index 25016e464d973b716e12f9ae7b6111506e60816b..70aa31a7f6c80465aa2404b00786deb0bae088e2 100644
--- a/hw/arm/mps2-tz.c
+++ b/hw/arm/mps2-tz.c
@@ -55,6 +55,7 @@
#include "hw/boards.h"
#include "exec/address-spaces.h"
#include "sysemu/sysemu.h"
+#include "sysemu/reset.h"
#include "hw/misc/unimp.h"
#include "hw/char/cmsdk-apb-uart.h"
#include "hw/timer/cmsdk-apb-timer.h"
@@ -72,6 +73,7 @@
#include "hw/core/split-irq.h"
#include "hw/qdev-clock.h"
#include "qom/object.h"
+#include "hw/irq.h"
#define MPS2TZ_NUMIRQ_MAX 96
#define MPS2TZ_RAM_MAX 5
@@ -153,6 +155,9 @@ struct MPS2TZMachineState {
SplitIRQ cpu_irq_splitter[MPS2TZ_NUMIRQ_MAX];
Clock *sysclk;
Clock *s32kclk;
+
+ bool remap;
+ qemu_irq remap_irq;
};
#define TYPE_MPS2TZ_MACHINE "mps2tz"
@@ -228,6 +233,10 @@ static const RAMInfo an505_raminfo[] = { {
},
};
+/*
+ * Note that the addresses and MPC numbering here should match up
+ * with those used in remap_memory(), which can swap the BRAM and QSPI.
+ */
static const RAMInfo an524_raminfo[] = { {
.name = "bram",
.base = 0x00000000,
@@ -457,6 +466,7 @@ static MemoryRegion *make_scc(MPS2TZMachineState *mms, void *opaque,
object_initialize_child(OBJECT(mms), "scc", scc, TYPE_MPS2_SCC);
sccdev = DEVICE(scc);
+ qdev_prop_set_uint32(sccdev, "scc-cfg0", mms->remap ? 1 : 0);
qdev_prop_set_uint32(sccdev, "scc-cfg4", 0x2);
qdev_prop_set_uint32(sccdev, "scc-aid", 0x00200008);
qdev_prop_set_uint32(sccdev, "scc-id", mmc->scc_id);
@@ -573,6 +583,52 @@ static MemoryRegion *make_mpc(MPS2TZMachineState *mms, void *opaque,
return sysbus_mmio_get_region(SYS_BUS_DEVICE(mpc), 0);
}
+static hwaddr boot_mem_base(MPS2TZMachineState *mms)
+{
+ /*
+ * Return the canonical address of the block which will be mapped
+ * at address 0x0 (i.e. where the vector table is).
+ * This is usually 0, but if the AN524 alternate memory map is
+ * enabled it will be the base address of the QSPI block.
+ */
+ return mms->remap ? 0x28000000 : 0;
+}
+
+static void remap_memory(MPS2TZMachineState *mms, int map)
+{
+ /*
+ * Remap the memory for the AN524. 'map' is the value of
+ * SCC CFG_REG0 bit 0, i.e. 0 for the default map and 1
+ * for the "option 1" mapping where QSPI is at address 0.
+ *
+ * Effectively we need to swap around the "upstream" ends of
+ * MPC 0 and MPC 1.
+ */
+ MPS2TZMachineClass *mmc = MPS2TZ_MACHINE_GET_CLASS(mms);
+ int i;
+
+ if (mmc->fpga_type != FPGA_AN524) {
+ return;
+ }
+
+ memory_region_transaction_begin();
+ for (i = 0; i < 2; i++) {
+ TZMPC *mpc = &mms->mpc[i];
+ MemoryRegion *upstream = sysbus_mmio_get_region(SYS_BUS_DEVICE(mpc), 1);
+ hwaddr addr = (i ^ map) ? 0x28000000 : 0;
+
+ memory_region_set_address(upstream, addr);
+ }
+ memory_region_transaction_commit();
+}
+
+static void remap_irq_fn(void *opaque, int n, int level)
+{
+ MPS2TZMachineState *mms = opaque;
+
+ remap_memory(mms, level);
+}
+
static MemoryRegion *make_dma(MPS2TZMachineState *mms, void *opaque,
const char *name, hwaddr size,
const int *irqs)
@@ -711,7 +767,7 @@ static uint32_t boot_ram_size(MPS2TZMachineState *mms)
MPS2TZMachineClass *mmc = MPS2TZ_MACHINE_GET_CLASS(mms);
for (p = mmc->raminfo; p->name; p++) {
- if (p->base == 0) {
+ if (p->base == boot_mem_base(mms)) {
return p->size;
}
}
@@ -1095,6 +1151,16 @@ static void mps2tz_common_init(MachineState *machine)
create_non_mpc_ram(mms);
+ if (mmc->fpga_type == FPGA_AN524) {
+ /*
+ * Connect the line from the SCC so that we can remap when the
+ * guest updates that register.
+ */
+ mms->remap_irq = qemu_allocate_irq(remap_irq_fn, mms, 0);
+ qdev_connect_gpio_out_named(DEVICE(&mms->scc), "remap", 0,
+ mms->remap_irq);
+ }
+
armv7m_load_kernel(ARM_CPU(first_cpu), machine->kernel_filename,
boot_ram_size(mms));
}
@@ -1117,12 +1183,47 @@ static void mps2_tz_idau_check(IDAUInterface *ii, uint32_t address,
*iregion = region;
}
+static char *mps2_get_remap(Object *obj, Error **errp)
+{
+ MPS2TZMachineState *mms = MPS2TZ_MACHINE(obj);
+ const char *val = mms->remap ? "QSPI" : "BRAM";
+ return g_strdup(val);
+}
+
+static void mps2_set_remap(Object *obj, const char *value, Error **errp)
+{
+ MPS2TZMachineState *mms = MPS2TZ_MACHINE(obj);
+
+ if (!strcmp(value, "BRAM")) {
+ mms->remap = false;
+ } else if (!strcmp(value, "QSPI")) {
+ mms->remap = true;
+ } else {
+ error_setg(errp, "Invalid remap value");
+ error_append_hint(errp, "Valid values are BRAM and QSPI.\n");
+ }
+}
+
+static void mps2_machine_reset(MachineState *machine)
+{
+ MPS2TZMachineState *mms = MPS2TZ_MACHINE(machine);
+
+ /*
+ * Set the initial memory mapping before triggering the reset of
+ * the rest of the system, so that the guest image loader and CPU
+ * reset see the correct mapping.
+ */
+ remap_memory(mms, mms->remap);
+ qemu_devices_reset();
+}
+
static void mps2tz_class_init(ObjectClass *oc, void *data)
{
MachineClass *mc = MACHINE_CLASS(oc);
IDAUInterfaceClass *iic = IDAU_INTERFACE_CLASS(oc);
mc->init = mps2tz_common_init;
+ mc->reset = mps2_machine_reset;
iic->check = mps2_tz_idau_check;
}
@@ -1225,6 +1326,11 @@ static void mps3tz_an524_class_init(ObjectClass *oc, void *data)
mmc->raminfo = an524_raminfo;
mmc->armsse_type = TYPE_SSE200;
mps2tz_set_default_ram_info(mmc);
+
+ object_class_property_add_str(oc, "remap", mps2_get_remap, mps2_set_remap);
+ object_class_property_set_description(oc, "remap",
+ "Set memory mapping. Valid values "
+ "are BRAM (default) and QSPI.");
}
static void mps3tz_an547_class_init(ObjectClass *oc, void *data)