xref: /qemu/hw/arm/armsse.c (revision 99865afc66bafca6f734712a897c0b68460f7757)
1 /*
2  * Arm SSE (Subsystems for Embedded): IoTKit
3  *
4  * Copyright (c) 2018 Linaro Limited
5  * Written by Peter Maydell
6  *
7  * This program is free software; you can redistribute it and/or modify
8  * it under the terms of the GNU General Public License version 2 or
9  * (at your option) any later version.
10  */
11 
12 #include "qemu/osdep.h"
13 #include "qemu/log.h"
14 #include "qemu/module.h"
15 #include "qemu/bitops.h"
16 #include "qapi/error.h"
17 #include "trace.h"
18 #include "hw/sysbus.h"
19 #include "migration/vmstate.h"
20 #include "hw/registerfields.h"
21 #include "hw/arm/armsse.h"
22 #include "hw/arm/armsse-version.h"
23 #include "hw/arm/boot.h"
24 #include "hw/irq.h"
25 #include "hw/qdev-clock.h"
26 
27 /*
28  * The SSE-300 puts some devices in different places to the
29  * SSE-200 (and original IoTKit). We use an array of these structs
30  * to define how each variant lays out these devices. (Parts of the
31  * SoC that are the same for all variants aren't handled via these
32  * data structures.)
33  */
34 
35 #define NO_IRQ -1
36 #define NO_PPC -1
37 /*
38  * Special values for ARMSSEDeviceInfo::irq to indicate that this
39  * device uses one of the inputs to the OR gate that feeds into the
40  * CPU NMI input.
41  */
42 #define NMI_0 10000
43 #define NMI_1 10001
44 
45 typedef struct ARMSSEDeviceInfo {
46     const char *name; /* name to use for the QOM object; NULL terminates list */
47     const char *type; /* QOM type name */
48     unsigned int index; /* Which of the N devices of this type is this ? */
49     hwaddr addr;
50     int ppc; /* Index of APB PPC this device is wired up to, or NO_PPC */
51     int ppc_port; /* Port number of this device on the PPC */
52     int irq; /* NO_IRQ, or 0..NUM_SSE_IRQS-1, or NMI_0 or NMI_1 */
53     bool slowclk; /* true if device uses the slow 32KHz clock */
54 } ARMSSEDeviceInfo;
55 
56 struct ARMSSEInfo {
57     const char *name;
58     uint32_t sse_version;
59     int sram_banks;
60     int num_cpus;
61     uint32_t sys_version;
62     uint32_t iidr;
63     uint32_t cpuwait_rst;
64     bool has_mhus;
65     bool has_ppus;
66     bool has_cachectrl;
67     bool has_cpusecctrl;
68     bool has_cpuid;
69     Property *props;
70     const ARMSSEDeviceInfo *devinfo;
71 };
72 
73 static Property iotkit_properties[] = {
74     DEFINE_PROP_LINK("memory", ARMSSE, board_memory, TYPE_MEMORY_REGION,
75                      MemoryRegion *),
76     DEFINE_PROP_UINT32("EXP_NUMIRQ", ARMSSE, exp_numirq, 64),
77     DEFINE_PROP_UINT32("SRAM_ADDR_WIDTH", ARMSSE, sram_addr_width, 15),
78     DEFINE_PROP_UINT32("init-svtor", ARMSSE, init_svtor, 0x10000000),
79     DEFINE_PROP_BOOL("CPU0_FPU", ARMSSE, cpu_fpu[0], true),
80     DEFINE_PROP_BOOL("CPU0_DSP", ARMSSE, cpu_dsp[0], true),
81     DEFINE_PROP_END_OF_LIST()
82 };
83 
84 static Property armsse_properties[] = {
85     DEFINE_PROP_LINK("memory", ARMSSE, board_memory, TYPE_MEMORY_REGION,
86                      MemoryRegion *),
87     DEFINE_PROP_UINT32("EXP_NUMIRQ", ARMSSE, exp_numirq, 64),
88     DEFINE_PROP_UINT32("SRAM_ADDR_WIDTH", ARMSSE, sram_addr_width, 15),
89     DEFINE_PROP_UINT32("init-svtor", ARMSSE, init_svtor, 0x10000000),
90     DEFINE_PROP_BOOL("CPU0_FPU", ARMSSE, cpu_fpu[0], false),
91     DEFINE_PROP_BOOL("CPU0_DSP", ARMSSE, cpu_dsp[0], false),
92     DEFINE_PROP_BOOL("CPU1_FPU", ARMSSE, cpu_fpu[1], true),
93     DEFINE_PROP_BOOL("CPU1_DSP", ARMSSE, cpu_dsp[1], true),
94     DEFINE_PROP_END_OF_LIST()
95 };
96 
97 static const ARMSSEDeviceInfo sse200_devices[] = {
98     {
99         .name = "timer0",
100         .type = TYPE_CMSDK_APB_TIMER,
101         .index = 0,
102         .addr = 0x40000000,
103         .ppc = 0,
104         .ppc_port = 0,
105         .irq = 3,
106     },
107     {
108         .name = "timer1",
109         .type = TYPE_CMSDK_APB_TIMER,
110         .index = 1,
111         .addr = 0x40001000,
112         .ppc = 0,
113         .ppc_port = 1,
114         .irq = 4,
115     },
116     {
117         .name = "s32ktimer",
118         .type = TYPE_CMSDK_APB_TIMER,
119         .index = 2,
120         .addr = 0x4002f000,
121         .ppc = 1,
122         .ppc_port = 0,
123         .irq = 2,
124         .slowclk = true,
125     },
126     {
127         .name = "dualtimer",
128         .type = TYPE_CMSDK_APB_DUALTIMER,
129         .index = 0,
130         .addr = 0x40002000,
131         .ppc = 0,
132         .ppc_port = 2,
133         .irq = 5,
134     },
135     {
136         .name = "s32kwatchdog",
137         .type = TYPE_CMSDK_APB_WATCHDOG,
138         .index = 0,
139         .addr = 0x5002e000,
140         .ppc = NO_PPC,
141         .irq = NMI_0,
142         .slowclk = true,
143     },
144     {
145         .name = "nswatchdog",
146         .type = TYPE_CMSDK_APB_WATCHDOG,
147         .index = 1,
148         .addr = 0x40081000,
149         .ppc = NO_PPC,
150         .irq = 1,
151     },
152     {
153         .name = "swatchdog",
154         .type = TYPE_CMSDK_APB_WATCHDOG,
155         .index = 2,
156         .addr = 0x50081000,
157         .ppc = NO_PPC,
158         .irq = NMI_1,
159     },
160     {
161         .name = NULL,
162     }
163 };
164 
165 static const ARMSSEInfo armsse_variants[] = {
166     {
167         .name = TYPE_IOTKIT,
168         .sse_version = ARMSSE_IOTKIT,
169         .sram_banks = 1,
170         .num_cpus = 1,
171         .sys_version = 0x41743,
172         .iidr = 0,
173         .cpuwait_rst = 0,
174         .has_mhus = false,
175         .has_ppus = false,
176         .has_cachectrl = false,
177         .has_cpusecctrl = false,
178         .has_cpuid = false,
179         .props = iotkit_properties,
180         .devinfo = sse200_devices,
181     },
182     {
183         .name = TYPE_SSE200,
184         .sse_version = ARMSSE_SSE200,
185         .sram_banks = 4,
186         .num_cpus = 2,
187         .sys_version = 0x22041743,
188         .iidr = 0,
189         .cpuwait_rst = 2,
190         .has_mhus = true,
191         .has_ppus = true,
192         .has_cachectrl = true,
193         .has_cpusecctrl = true,
194         .has_cpuid = true,
195         .props = armsse_properties,
196         .devinfo = sse200_devices,
197     },
198 };
199 
200 static uint32_t armsse_sys_config_value(ARMSSE *s, const ARMSSEInfo *info)
201 {
202     /* Return the SYS_CONFIG value for this SSE */
203     uint32_t sys_config;
204 
205     switch (info->sse_version) {
206     case ARMSSE_IOTKIT:
207         sys_config = 0;
208         sys_config = deposit32(sys_config, 0, 4, info->sram_banks);
209         sys_config = deposit32(sys_config, 4, 4, s->sram_addr_width - 12);
210         break;
211     case ARMSSE_SSE200:
212         sys_config = 0;
213         sys_config = deposit32(sys_config, 0, 4, info->sram_banks);
214         sys_config = deposit32(sys_config, 4, 5, s->sram_addr_width);
215         sys_config = deposit32(sys_config, 24, 4, 2);
216         if (info->num_cpus > 1) {
217             sys_config = deposit32(sys_config, 10, 1, 1);
218             sys_config = deposit32(sys_config, 20, 4, info->sram_banks - 1);
219             sys_config = deposit32(sys_config, 28, 4, 2);
220         }
221         break;
222     case ARMSSE_SSE300:
223         sys_config = 0;
224         sys_config = deposit32(sys_config, 0, 4, info->sram_banks);
225         sys_config = deposit32(sys_config, 4, 5, s->sram_addr_width);
226         sys_config = deposit32(sys_config, 16, 3, 3); /* CPU0 = Cortex-M55 */
227         break;
228     default:
229         g_assert_not_reached();
230     }
231     return sys_config;
232 }
233 
234 /* Clock frequency in HZ of the 32KHz "slow clock" */
235 #define S32KCLK (32 * 1000)
236 
237 /* Is internal IRQ n shared between CPUs in a multi-core SSE ? */
238 static bool irq_is_common[32] = {
239     [0 ... 5] = true,
240     /* 6, 7: per-CPU MHU interrupts */
241     [8 ... 12] = true,
242     /* 13: per-CPU icache interrupt */
243     /* 14: reserved */
244     [15 ... 20] = true,
245     /* 21: reserved */
246     [22 ... 26] = true,
247     /* 27: reserved */
248     /* 28, 29: per-CPU CTI interrupts */
249     /* 30, 31: reserved */
250 };
251 
252 /*
253  * Create an alias region in @container of @size bytes starting at @base
254  * which mirrors the memory starting at @orig.
255  */
256 static void make_alias(ARMSSE *s, MemoryRegion *mr, MemoryRegion *container,
257                        const char *name, hwaddr base, hwaddr size, hwaddr orig)
258 {
259     memory_region_init_alias(mr, NULL, name, container, orig, size);
260     /* The alias is even lower priority than unimplemented_device regions */
261     memory_region_add_subregion_overlap(container, base, mr, -1500);
262 }
263 
264 static void irq_status_forwarder(void *opaque, int n, int level)
265 {
266     qemu_irq destirq = opaque;
267 
268     qemu_set_irq(destirq, level);
269 }
270 
271 static void nsccfg_handler(void *opaque, int n, int level)
272 {
273     ARMSSE *s = ARM_SSE(opaque);
274 
275     s->nsccfg = level;
276 }
277 
278 static void armsse_forward_ppc(ARMSSE *s, const char *ppcname, int ppcnum)
279 {
280     /* Each of the 4 AHB and 4 APB PPCs that might be present in a
281      * system using the ARMSSE has a collection of control lines which
282      * are provided by the security controller and which we want to
283      * expose as control lines on the ARMSSE device itself, so the
284      * code using the ARMSSE can wire them up to the PPCs.
285      */
286     SplitIRQ *splitter = &s->ppc_irq_splitter[ppcnum];
287     DeviceState *armssedev = DEVICE(s);
288     DeviceState *dev_secctl = DEVICE(&s->secctl);
289     DeviceState *dev_splitter = DEVICE(splitter);
290     char *name;
291 
292     name = g_strdup_printf("%s_nonsec", ppcname);
293     qdev_pass_gpios(dev_secctl, armssedev, name);
294     g_free(name);
295     name = g_strdup_printf("%s_ap", ppcname);
296     qdev_pass_gpios(dev_secctl, armssedev, name);
297     g_free(name);
298     name = g_strdup_printf("%s_irq_enable", ppcname);
299     qdev_pass_gpios(dev_secctl, armssedev, name);
300     g_free(name);
301     name = g_strdup_printf("%s_irq_clear", ppcname);
302     qdev_pass_gpios(dev_secctl, armssedev, name);
303     g_free(name);
304 
305     /* irq_status is a little more tricky, because we need to
306      * split it so we can send it both to the security controller
307      * and to our OR gate for the NVIC interrupt line.
308      * Connect up the splitter's outputs, and create a GPIO input
309      * which will pass the line state to the input splitter.
310      */
311     name = g_strdup_printf("%s_irq_status", ppcname);
312     qdev_connect_gpio_out(dev_splitter, 0,
313                           qdev_get_gpio_in_named(dev_secctl,
314                                                  name, 0));
315     qdev_connect_gpio_out(dev_splitter, 1,
316                           qdev_get_gpio_in(DEVICE(&s->ppc_irq_orgate), ppcnum));
317     s->irq_status_in[ppcnum] = qdev_get_gpio_in(dev_splitter, 0);
318     qdev_init_gpio_in_named_with_opaque(armssedev, irq_status_forwarder,
319                                         s->irq_status_in[ppcnum], name, 1);
320     g_free(name);
321 }
322 
323 static void armsse_forward_sec_resp_cfg(ARMSSE *s)
324 {
325     /* Forward the 3rd output from the splitter device as a
326      * named GPIO output of the armsse object.
327      */
328     DeviceState *dev = DEVICE(s);
329     DeviceState *dev_splitter = DEVICE(&s->sec_resp_splitter);
330 
331     qdev_init_gpio_out_named(dev, &s->sec_resp_cfg, "sec_resp_cfg", 1);
332     s->sec_resp_cfg_in = qemu_allocate_irq(irq_status_forwarder,
333                                            s->sec_resp_cfg, 1);
334     qdev_connect_gpio_out(dev_splitter, 2, s->sec_resp_cfg_in);
335 }
336 
337 static void armsse_mainclk_update(void *opaque, ClockEvent event)
338 {
339     ARMSSE *s = ARM_SSE(opaque);
340 
341     /*
342      * Set system_clock_scale from our Clock input; this is what
343      * controls the tick rate of the CPU SysTick timer.
344      */
345     system_clock_scale = clock_ticks_to_ns(s->mainclk, 1);
346 }
347 
348 static void armsse_init(Object *obj)
349 {
350     ARMSSE *s = ARM_SSE(obj);
351     ARMSSEClass *asc = ARM_SSE_GET_CLASS(obj);
352     const ARMSSEInfo *info = asc->info;
353     const ARMSSEDeviceInfo *devinfo;
354     int i;
355 
356     assert(info->sram_banks <= MAX_SRAM_BANKS);
357     assert(info->num_cpus <= SSE_MAX_CPUS);
358 
359     s->mainclk = qdev_init_clock_in(DEVICE(s), "MAINCLK",
360                                     armsse_mainclk_update, s, ClockUpdate);
361     s->s32kclk = qdev_init_clock_in(DEVICE(s), "S32KCLK", NULL, NULL, 0);
362 
363     memory_region_init(&s->container, obj, "armsse-container", UINT64_MAX);
364 
365     for (i = 0; i < info->num_cpus; i++) {
366         /*
367          * We put each CPU in its own cluster as they are logically
368          * distinct and may be configured differently.
369          */
370         char *name;
371 
372         name = g_strdup_printf("cluster%d", i);
373         object_initialize_child(obj, name, &s->cluster[i], TYPE_CPU_CLUSTER);
374         qdev_prop_set_uint32(DEVICE(&s->cluster[i]), "cluster-id", i);
375         g_free(name);
376 
377         name = g_strdup_printf("armv7m%d", i);
378         object_initialize_child(OBJECT(&s->cluster[i]), name, &s->armv7m[i],
379                                 TYPE_ARMV7M);
380         qdev_prop_set_string(DEVICE(&s->armv7m[i]), "cpu-type",
381                              ARM_CPU_TYPE_NAME("cortex-m33"));
382         g_free(name);
383         name = g_strdup_printf("arm-sse-cpu-container%d", i);
384         memory_region_init(&s->cpu_container[i], obj, name, UINT64_MAX);
385         g_free(name);
386         if (i > 0) {
387             name = g_strdup_printf("arm-sse-container-alias%d", i);
388             memory_region_init_alias(&s->container_alias[i - 1], obj,
389                                      name, &s->container, 0, UINT64_MAX);
390             g_free(name);
391         }
392     }
393 
394     for (devinfo = info->devinfo; devinfo->name; devinfo++) {
395         assert(devinfo->ppc == NO_PPC || devinfo->ppc < ARRAY_SIZE(s->apb_ppc));
396         if (!strcmp(devinfo->type, TYPE_CMSDK_APB_TIMER)) {
397             assert(devinfo->index < ARRAY_SIZE(s->timer));
398             object_initialize_child(obj, devinfo->name,
399                                     &s->timer[devinfo->index],
400                                     TYPE_CMSDK_APB_TIMER);
401         } else if (!strcmp(devinfo->type, TYPE_CMSDK_APB_DUALTIMER)) {
402             assert(devinfo->index == 0);
403             object_initialize_child(obj, devinfo->name, &s->dualtimer,
404                                     TYPE_CMSDK_APB_DUALTIMER);
405         } else if (!strcmp(devinfo->type, TYPE_CMSDK_APB_WATCHDOG)) {
406             assert(devinfo->index < ARRAY_SIZE(s->cmsdk_watchdog));
407             object_initialize_child(obj, devinfo->name,
408                                     &s->cmsdk_watchdog[devinfo->index],
409                                     TYPE_CMSDK_APB_WATCHDOG);
410         } else {
411             g_assert_not_reached();
412         }
413     }
414 
415     object_initialize_child(obj, "secctl", &s->secctl, TYPE_IOTKIT_SECCTL);
416 
417     for (i = 0; i < ARRAY_SIZE(s->apb_ppc); i++) {
418         g_autofree char *name = g_strdup_printf("apb-ppc%d", i);
419         object_initialize_child(obj, name, &s->apb_ppc[i], TYPE_TZ_PPC);
420     }
421 
422     for (i = 0; i < info->sram_banks; i++) {
423         char *name = g_strdup_printf("mpc%d", i);
424         object_initialize_child(obj, name, &s->mpc[i], TYPE_TZ_MPC);
425         g_free(name);
426     }
427     object_initialize_child(obj, "mpc-irq-orgate", &s->mpc_irq_orgate,
428                             TYPE_OR_IRQ);
429 
430     for (i = 0; i < IOTS_NUM_EXP_MPC + info->sram_banks; i++) {
431         char *name = g_strdup_printf("mpc-irq-splitter-%d", i);
432         SplitIRQ *splitter = &s->mpc_irq_splitter[i];
433 
434         object_initialize_child(obj, name, splitter, TYPE_SPLIT_IRQ);
435         g_free(name);
436     }
437 
438     object_initialize_child(obj, "armsse-sysctl", &s->sysctl,
439                             TYPE_IOTKIT_SYSCTL);
440     object_initialize_child(obj, "armsse-sysinfo", &s->sysinfo,
441                             TYPE_IOTKIT_SYSINFO);
442     if (info->has_mhus) {
443         object_initialize_child(obj, "mhu0", &s->mhu[0], TYPE_ARMSSE_MHU);
444         object_initialize_child(obj, "mhu1", &s->mhu[1], TYPE_ARMSSE_MHU);
445     }
446     if (info->has_ppus) {
447         for (i = 0; i < info->num_cpus; i++) {
448             char *name = g_strdup_printf("CPU%dCORE_PPU", i);
449             int ppuidx = CPU0CORE_PPU + i;
450 
451             object_initialize_child(obj, name, &s->ppu[ppuidx],
452                                     TYPE_UNIMPLEMENTED_DEVICE);
453             g_free(name);
454         }
455         object_initialize_child(obj, "DBG_PPU", &s->ppu[DBG_PPU],
456                                 TYPE_UNIMPLEMENTED_DEVICE);
457         for (i = 0; i < info->sram_banks; i++) {
458             char *name = g_strdup_printf("RAM%d_PPU", i);
459             int ppuidx = RAM0_PPU + i;
460 
461             object_initialize_child(obj, name, &s->ppu[ppuidx],
462                                     TYPE_UNIMPLEMENTED_DEVICE);
463             g_free(name);
464         }
465     }
466     if (info->has_cachectrl) {
467         for (i = 0; i < info->num_cpus; i++) {
468             char *name = g_strdup_printf("cachectrl%d", i);
469 
470             object_initialize_child(obj, name, &s->cachectrl[i],
471                                     TYPE_UNIMPLEMENTED_DEVICE);
472             g_free(name);
473         }
474     }
475     if (info->has_cpusecctrl) {
476         for (i = 0; i < info->num_cpus; i++) {
477             char *name = g_strdup_printf("cpusecctrl%d", i);
478 
479             object_initialize_child(obj, name, &s->cpusecctrl[i],
480                                     TYPE_UNIMPLEMENTED_DEVICE);
481             g_free(name);
482         }
483     }
484     if (info->has_cpuid) {
485         for (i = 0; i < info->num_cpus; i++) {
486             char *name = g_strdup_printf("cpuid%d", i);
487 
488             object_initialize_child(obj, name, &s->cpuid[i],
489                                     TYPE_ARMSSE_CPUID);
490             g_free(name);
491         }
492     }
493     object_initialize_child(obj, "nmi-orgate", &s->nmi_orgate, TYPE_OR_IRQ);
494     object_initialize_child(obj, "ppc-irq-orgate", &s->ppc_irq_orgate,
495                             TYPE_OR_IRQ);
496     object_initialize_child(obj, "sec-resp-splitter", &s->sec_resp_splitter,
497                             TYPE_SPLIT_IRQ);
498     for (i = 0; i < ARRAY_SIZE(s->ppc_irq_splitter); i++) {
499         char *name = g_strdup_printf("ppc-irq-splitter-%d", i);
500         SplitIRQ *splitter = &s->ppc_irq_splitter[i];
501 
502         object_initialize_child(obj, name, splitter, TYPE_SPLIT_IRQ);
503         g_free(name);
504     }
505     if (info->num_cpus > 1) {
506         for (i = 0; i < ARRAY_SIZE(s->cpu_irq_splitter); i++) {
507             if (irq_is_common[i]) {
508                 char *name = g_strdup_printf("cpu-irq-splitter%d", i);
509                 SplitIRQ *splitter = &s->cpu_irq_splitter[i];
510 
511                 object_initialize_child(obj, name, splitter, TYPE_SPLIT_IRQ);
512                 g_free(name);
513             }
514         }
515     }
516 }
517 
518 static void armsse_exp_irq(void *opaque, int n, int level)
519 {
520     qemu_irq *irqarray = opaque;
521 
522     qemu_set_irq(irqarray[n], level);
523 }
524 
525 static void armsse_mpcexp_status(void *opaque, int n, int level)
526 {
527     ARMSSE *s = ARM_SSE(opaque);
528     qemu_set_irq(s->mpcexp_status_in[n], level);
529 }
530 
531 static qemu_irq armsse_get_common_irq_in(ARMSSE *s, int irqno)
532 {
533     /*
534      * Return a qemu_irq which can be used to signal IRQ n to
535      * all CPUs in the SSE.
536      */
537     ARMSSEClass *asc = ARM_SSE_GET_CLASS(s);
538     const ARMSSEInfo *info = asc->info;
539 
540     assert(irq_is_common[irqno]);
541 
542     if (info->num_cpus == 1) {
543         /* Only one CPU -- just connect directly to it */
544         return qdev_get_gpio_in(DEVICE(&s->armv7m[0]), irqno);
545     } else {
546         /* Connect to the splitter which feeds all CPUs */
547         return qdev_get_gpio_in(DEVICE(&s->cpu_irq_splitter[irqno]), 0);
548     }
549 }
550 
551 static void map_ppu(ARMSSE *s, int ppuidx, const char *name, hwaddr addr)
552 {
553     /* Map a PPU unimplemented device stub */
554     DeviceState *dev = DEVICE(&s->ppu[ppuidx]);
555 
556     qdev_prop_set_string(dev, "name", name);
557     qdev_prop_set_uint64(dev, "size", 0x1000);
558     sysbus_realize(SYS_BUS_DEVICE(dev), &error_fatal);
559     sysbus_mmio_map(SYS_BUS_DEVICE(&s->ppu[ppuidx]), 0, addr);
560 }
561 
562 static void armsse_realize(DeviceState *dev, Error **errp)
563 {
564     ARMSSE *s = ARM_SSE(dev);
565     ARMSSEClass *asc = ARM_SSE_GET_CLASS(dev);
566     const ARMSSEInfo *info = asc->info;
567     const ARMSSEDeviceInfo *devinfo;
568     int i;
569     MemoryRegion *mr;
570     Error *err = NULL;
571     SysBusDevice *sbd_apb_ppc0;
572     SysBusDevice *sbd_secctl;
573     DeviceState *dev_apb_ppc0;
574     DeviceState *dev_apb_ppc1;
575     DeviceState *dev_secctl;
576     DeviceState *dev_splitter;
577     uint32_t addr_width_max;
578 
579     if (!s->board_memory) {
580         error_setg(errp, "memory property was not set");
581         return;
582     }
583 
584     if (!clock_has_source(s->mainclk)) {
585         error_setg(errp, "MAINCLK clock was not connected");
586     }
587     if (!clock_has_source(s->s32kclk)) {
588         error_setg(errp, "S32KCLK clock was not connected");
589     }
590 
591     assert(info->num_cpus <= SSE_MAX_CPUS);
592 
593     /* max SRAM_ADDR_WIDTH: 24 - log2(SRAM_NUM_BANK) */
594     assert(is_power_of_2(info->sram_banks));
595     addr_width_max = 24 - ctz32(info->sram_banks);
596     if (s->sram_addr_width < 1 || s->sram_addr_width > addr_width_max) {
597         error_setg(errp, "SRAM_ADDR_WIDTH must be between 1 and %d",
598                    addr_width_max);
599         return;
600     }
601 
602     /* Handling of which devices should be available only to secure
603      * code is usually done differently for M profile than for A profile.
604      * Instead of putting some devices only into the secure address space,
605      * devices exist in both address spaces but with hard-wired security
606      * permissions that will cause the CPU to fault for non-secure accesses.
607      *
608      * The ARMSSE has an IDAU (Implementation Defined Access Unit),
609      * which specifies hard-wired security permissions for different
610      * areas of the physical address space. For the ARMSSE IDAU, the
611      * top 4 bits of the physical address are the IDAU region ID, and
612      * if bit 28 (ie the lowest bit of the ID) is 0 then this is an NS
613      * region, otherwise it is an S region.
614      *
615      * The various devices and RAMs are generally all mapped twice,
616      * once into a region that the IDAU defines as secure and once
617      * into a non-secure region. They sit behind either a Memory
618      * Protection Controller (for RAM) or a Peripheral Protection
619      * Controller (for devices), which allow a more fine grained
620      * configuration of whether non-secure accesses are permitted.
621      *
622      * (The other place that guest software can configure security
623      * permissions is in the architected SAU (Security Attribution
624      * Unit), which is entirely inside the CPU. The IDAU can upgrade
625      * the security attributes for a region to more restrictive than
626      * the SAU specifies, but cannot downgrade them.)
627      *
628      * 0x10000000..0x1fffffff  alias of 0x00000000..0x0fffffff
629      * 0x20000000..0x2007ffff  32KB FPGA block RAM
630      * 0x30000000..0x3fffffff  alias of 0x20000000..0x2fffffff
631      * 0x40000000..0x4000ffff  base peripheral region 1
632      * 0x40010000..0x4001ffff  CPU peripherals (none for ARMSSE)
633      * 0x40020000..0x4002ffff  system control element peripherals
634      * 0x40080000..0x400fffff  base peripheral region 2
635      * 0x50000000..0x5fffffff  alias of 0x40000000..0x4fffffff
636      */
637 
638     memory_region_add_subregion_overlap(&s->container, 0, s->board_memory, -2);
639 
640     for (i = 0; i < info->num_cpus; i++) {
641         DeviceState *cpudev = DEVICE(&s->armv7m[i]);
642         Object *cpuobj = OBJECT(&s->armv7m[i]);
643         int j;
644         char *gpioname;
645 
646         qdev_prop_set_uint32(cpudev, "num-irq", s->exp_numirq + NUM_SSE_IRQS);
647         /*
648          * In real hardware the initial Secure VTOR is set from the INITSVTOR*
649          * registers in the IoT Kit System Control Register block. In QEMU
650          * we set the initial value here, and also the reset value of the
651          * sysctl register, from this object's QOM init-svtor property.
652          * If the guest changes the INITSVTOR* registers at runtime then the
653          * code in iotkit-sysctl.c will update the CPU init-svtor property
654          * (which will then take effect on the next CPU warm-reset).
655          *
656          * Note that typically a board using the SSE-200 will have a system
657          * control processor whose boot firmware initializes the INITSVTOR*
658          * registers before powering up the CPUs. QEMU doesn't emulate
659          * the control processor, so instead we behave in the way that the
660          * firmware does: the initial value should be set by the board code
661          * (using the init-svtor property on the ARMSSE object) to match
662          * whatever its firmware does.
663          */
664         qdev_prop_set_uint32(cpudev, "init-svtor", s->init_svtor);
665         /*
666          * CPUs start powered down if the corresponding bit in the CPUWAIT
667          * register is 1. In real hardware the CPUWAIT register reset value is
668          * a configurable property of the SSE-200 (via the CPUWAIT0_RST and
669          * CPUWAIT1_RST parameters), but since all the boards we care about
670          * start CPU0 and leave CPU1 powered off, we hard-code that in
671          * info->cpuwait_rst for now. We can add QOM properties for this
672          * later if necessary.
673          */
674         if (extract32(info->cpuwait_rst, i, 1)) {
675             if (!object_property_set_bool(cpuobj, "start-powered-off", true,
676                                           errp)) {
677                 return;
678             }
679         }
680         if (!s->cpu_fpu[i]) {
681             if (!object_property_set_bool(cpuobj, "vfp", false, errp)) {
682                 return;
683             }
684         }
685         if (!s->cpu_dsp[i]) {
686             if (!object_property_set_bool(cpuobj, "dsp", false, errp)) {
687                 return;
688             }
689         }
690 
691         if (i > 0) {
692             memory_region_add_subregion_overlap(&s->cpu_container[i], 0,
693                                                 &s->container_alias[i - 1], -1);
694         } else {
695             memory_region_add_subregion_overlap(&s->cpu_container[i], 0,
696                                                 &s->container, -1);
697         }
698         object_property_set_link(cpuobj, "memory",
699                                  OBJECT(&s->cpu_container[i]), &error_abort);
700         object_property_set_link(cpuobj, "idau", OBJECT(s), &error_abort);
701         if (!sysbus_realize(SYS_BUS_DEVICE(cpuobj), errp)) {
702             return;
703         }
704         /*
705          * The cluster must be realized after the armv7m container, as
706          * the container's CPU object is only created on realize, and the
707          * CPU must exist and have been parented into the cluster before
708          * the cluster is realized.
709          */
710         if (!qdev_realize(DEVICE(&s->cluster[i]), NULL, errp)) {
711             return;
712         }
713 
714         /* Connect EXP_IRQ/EXP_CPUn_IRQ GPIOs to the NVIC's lines 32 and up */
715         s->exp_irqs[i] = g_new(qemu_irq, s->exp_numirq);
716         for (j = 0; j < s->exp_numirq; j++) {
717             s->exp_irqs[i][j] = qdev_get_gpio_in(cpudev, j + NUM_SSE_IRQS);
718         }
719         if (i == 0) {
720             gpioname = g_strdup("EXP_IRQ");
721         } else {
722             gpioname = g_strdup_printf("EXP_CPU%d_IRQ", i);
723         }
724         qdev_init_gpio_in_named_with_opaque(dev, armsse_exp_irq,
725                                             s->exp_irqs[i],
726                                             gpioname, s->exp_numirq);
727         g_free(gpioname);
728     }
729 
730     /* Wire up the splitters that connect common IRQs to all CPUs */
731     if (info->num_cpus > 1) {
732         for (i = 0; i < ARRAY_SIZE(s->cpu_irq_splitter); i++) {
733             if (irq_is_common[i]) {
734                 Object *splitter = OBJECT(&s->cpu_irq_splitter[i]);
735                 DeviceState *devs = DEVICE(splitter);
736                 int cpunum;
737 
738                 if (!object_property_set_int(splitter, "num-lines",
739                                              info->num_cpus, errp)) {
740                     return;
741                 }
742                 if (!qdev_realize(DEVICE(splitter), NULL, errp)) {
743                     return;
744                 }
745                 for (cpunum = 0; cpunum < info->num_cpus; cpunum++) {
746                     DeviceState *cpudev = DEVICE(&s->armv7m[cpunum]);
747 
748                     qdev_connect_gpio_out(devs, cpunum,
749                                           qdev_get_gpio_in(cpudev, i));
750                 }
751             }
752         }
753     }
754 
755     /* Set up the big aliases first */
756     make_alias(s, &s->alias1, &s->container, "alias 1",
757                0x10000000, 0x10000000, 0x00000000);
758     make_alias(s, &s->alias2, &s->container,
759                "alias 2", 0x30000000, 0x10000000, 0x20000000);
760     /* The 0x50000000..0x5fffffff region is not a pure alias: it has
761      * a few extra devices that only appear there (generally the
762      * control interfaces for the protection controllers).
763      * We implement this by mapping those devices over the top of this
764      * alias MR at a higher priority. Some of the devices in this range
765      * are per-CPU, so we must put this alias in the per-cpu containers.
766      */
767     for (i = 0; i < info->num_cpus; i++) {
768         make_alias(s, &s->alias3[i], &s->cpu_container[i],
769                    "alias 3", 0x50000000, 0x10000000, 0x40000000);
770     }
771 
772     /* Security controller */
773     object_property_set_int(OBJECT(&s->secctl), "sse-version",
774                             info->sse_version, &error_abort);
775     if (!sysbus_realize(SYS_BUS_DEVICE(&s->secctl), errp)) {
776         return;
777     }
778     sbd_secctl = SYS_BUS_DEVICE(&s->secctl);
779     dev_secctl = DEVICE(&s->secctl);
780     sysbus_mmio_map(sbd_secctl, 0, 0x50080000);
781     sysbus_mmio_map(sbd_secctl, 1, 0x40080000);
782 
783     s->nsc_cfg_in = qemu_allocate_irq(nsccfg_handler, s, 1);
784     qdev_connect_gpio_out_named(dev_secctl, "nsc_cfg", 0, s->nsc_cfg_in);
785 
786     /* The sec_resp_cfg output from the security controller must be split into
787      * multiple lines, one for each of the PPCs within the ARMSSE and one
788      * that will be an output from the ARMSSE to the system.
789      */
790     if (!object_property_set_int(OBJECT(&s->sec_resp_splitter),
791                                  "num-lines", 3, errp)) {
792         return;
793     }
794     if (!qdev_realize(DEVICE(&s->sec_resp_splitter), NULL, errp)) {
795         return;
796     }
797     dev_splitter = DEVICE(&s->sec_resp_splitter);
798     qdev_connect_gpio_out_named(dev_secctl, "sec_resp_cfg", 0,
799                                 qdev_get_gpio_in(dev_splitter, 0));
800 
801     /* Each SRAM bank lives behind its own Memory Protection Controller */
802     for (i = 0; i < info->sram_banks; i++) {
803         char *ramname = g_strdup_printf("armsse.sram%d", i);
804         SysBusDevice *sbd_mpc;
805         uint32_t sram_bank_size = 1 << s->sram_addr_width;
806 
807         memory_region_init_ram(&s->sram[i], NULL, ramname,
808                                sram_bank_size, &err);
809         g_free(ramname);
810         if (err) {
811             error_propagate(errp, err);
812             return;
813         }
814         object_property_set_link(OBJECT(&s->mpc[i]), "downstream",
815                                  OBJECT(&s->sram[i]), &error_abort);
816         if (!sysbus_realize(SYS_BUS_DEVICE(&s->mpc[i]), errp)) {
817             return;
818         }
819         /* Map the upstream end of the MPC into the right place... */
820         sbd_mpc = SYS_BUS_DEVICE(&s->mpc[i]);
821         memory_region_add_subregion(&s->container,
822                                     0x20000000 + i * sram_bank_size,
823                                     sysbus_mmio_get_region(sbd_mpc, 1));
824         /* ...and its register interface */
825         memory_region_add_subregion(&s->container, 0x50083000 + i * 0x1000,
826                                     sysbus_mmio_get_region(sbd_mpc, 0));
827     }
828 
829     /* We must OR together lines from the MPC splitters to go to the NVIC */
830     if (!object_property_set_int(OBJECT(&s->mpc_irq_orgate), "num-lines",
831                                  IOTS_NUM_EXP_MPC + info->sram_banks,
832                                  errp)) {
833         return;
834     }
835     if (!qdev_realize(DEVICE(&s->mpc_irq_orgate), NULL, errp)) {
836         return;
837     }
838     qdev_connect_gpio_out(DEVICE(&s->mpc_irq_orgate), 0,
839                           armsse_get_common_irq_in(s, 9));
840 
841     /* This OR gate wires together outputs from the secure watchdogs to NMI */
842     if (!object_property_set_int(OBJECT(&s->nmi_orgate), "num-lines", 2,
843                                  errp)) {
844         return;
845     }
846     if (!qdev_realize(DEVICE(&s->nmi_orgate), NULL, errp)) {
847         return;
848     }
849     qdev_connect_gpio_out(DEVICE(&s->nmi_orgate), 0,
850                           qdev_get_gpio_in_named(DEVICE(&s->armv7m), "NMI", 0));
851 
852     /* Devices behind APB PPC0:
853      *   0x40000000: timer0
854      *   0x40001000: timer1
855      *   0x40002000: dual timer
856      *   0x40003000: MHU0 (SSE-200 only)
857      *   0x40004000: MHU1 (SSE-200 only)
858      * We must configure and realize each downstream device and connect
859      * it to the appropriate PPC port; then we can realize the PPC and
860      * map its upstream ends to the right place in the container.
861      */
862     for (devinfo = info->devinfo; devinfo->name; devinfo++) {
863         SysBusDevice *sbd;
864         qemu_irq irq;
865 
866         if (!strcmp(devinfo->type, TYPE_CMSDK_APB_TIMER)) {
867             sbd = SYS_BUS_DEVICE(&s->timer[devinfo->index]);
868 
869             qdev_connect_clock_in(DEVICE(sbd), "pclk",
870                                   devinfo->slowclk ? s->s32kclk : s->mainclk);
871             if (!sysbus_realize(sbd, errp)) {
872                 return;
873             }
874             mr = sysbus_mmio_get_region(sbd, 0);
875         } else if (!strcmp(devinfo->type, TYPE_CMSDK_APB_DUALTIMER)) {
876             sbd = SYS_BUS_DEVICE(&s->dualtimer);
877 
878             qdev_connect_clock_in(DEVICE(sbd), "TIMCLK", s->mainclk);
879             if (!sysbus_realize(sbd, errp)) {
880                 return;
881             }
882             mr = sysbus_mmio_get_region(sbd, 0);
883         } else if (!strcmp(devinfo->type, TYPE_CMSDK_APB_WATCHDOG)) {
884             sbd = SYS_BUS_DEVICE(&s->cmsdk_watchdog[devinfo->index]);
885 
886             qdev_connect_clock_in(DEVICE(sbd), "WDOGCLK",
887                                   devinfo->slowclk ? s->s32kclk : s->mainclk);
888             if (!sysbus_realize(sbd, errp)) {
889                 return;
890             }
891             mr = sysbus_mmio_get_region(sbd, 0);
892         } else {
893             g_assert_not_reached();
894         }
895 
896         switch (devinfo->irq) {
897         case NO_IRQ:
898             irq = NULL;
899             break;
900         case 0 ... NUM_SSE_IRQS - 1:
901             irq = armsse_get_common_irq_in(s, devinfo->irq);
902             break;
903         case NMI_0:
904         case NMI_1:
905             irq = qdev_get_gpio_in(DEVICE(&s->nmi_orgate),
906                                    devinfo->irq - NMI_0);
907             break;
908         default:
909             g_assert_not_reached();
910         }
911 
912         if (irq) {
913             sysbus_connect_irq(sbd, 0, irq);
914         }
915 
916         /*
917          * Devices connected to a PPC are connected to the port here;
918          * we will map the upstream end of that port to the right address
919          * in the container later after the PPC has been realized.
920          * Devices not connected to a PPC can be mapped immediately.
921          */
922         if (devinfo->ppc != NO_PPC) {
923             TZPPC *ppc = &s->apb_ppc[devinfo->ppc];
924             g_autofree char *portname = g_strdup_printf("port[%d]",
925                                                         devinfo->ppc_port);
926             object_property_set_link(OBJECT(ppc), portname, OBJECT(mr),
927                                      &error_abort);
928         } else {
929             memory_region_add_subregion(&s->container, devinfo->addr, mr);
930         }
931     }
932 
933     if (info->has_mhus) {
934         /*
935          * An SSE-200 with only one CPU should have only one MHU created,
936          * with the region where the second MHU usually is being RAZ/WI.
937          * We don't implement that SSE-200 config; if we want to support
938          * it then this code needs to be enhanced to handle creating the
939          * RAZ/WI region instead of the second MHU.
940          */
941         assert(info->num_cpus == ARRAY_SIZE(s->mhu));
942 
943         for (i = 0; i < ARRAY_SIZE(s->mhu); i++) {
944             char *port;
945             int cpunum;
946             SysBusDevice *mhu_sbd = SYS_BUS_DEVICE(&s->mhu[i]);
947 
948             if (!sysbus_realize(SYS_BUS_DEVICE(&s->mhu[i]), errp)) {
949                 return;
950             }
951             port = g_strdup_printf("port[%d]", i + 3);
952             mr = sysbus_mmio_get_region(mhu_sbd, 0);
953             object_property_set_link(OBJECT(&s->apb_ppc[0]), port, OBJECT(mr),
954                                      &error_abort);
955             g_free(port);
956 
957             /*
958              * Each MHU has an irq line for each CPU:
959              *  MHU 0 irq line 0 -> CPU 0 IRQ 6
960              *  MHU 0 irq line 1 -> CPU 1 IRQ 6
961              *  MHU 1 irq line 0 -> CPU 0 IRQ 7
962              *  MHU 1 irq line 1 -> CPU 1 IRQ 7
963              */
964             for (cpunum = 0; cpunum < info->num_cpus; cpunum++) {
965                 DeviceState *cpudev = DEVICE(&s->armv7m[cpunum]);
966 
967                 sysbus_connect_irq(mhu_sbd, cpunum,
968                                    qdev_get_gpio_in(cpudev, 6 + i));
969             }
970         }
971     }
972 
973     if (!sysbus_realize(SYS_BUS_DEVICE(&s->apb_ppc[0]), errp)) {
974         return;
975     }
976 
977     sbd_apb_ppc0 = SYS_BUS_DEVICE(&s->apb_ppc[0]);
978     dev_apb_ppc0 = DEVICE(&s->apb_ppc[0]);
979 
980     if (info->has_mhus) {
981         mr = sysbus_mmio_get_region(sbd_apb_ppc0, 3);
982         memory_region_add_subregion(&s->container, 0x40003000, mr);
983         mr = sysbus_mmio_get_region(sbd_apb_ppc0, 4);
984         memory_region_add_subregion(&s->container, 0x40004000, mr);
985     }
986     for (i = 0; i < IOTS_APB_PPC0_NUM_PORTS; i++) {
987         qdev_connect_gpio_out_named(dev_secctl, "apb_ppc0_nonsec", i,
988                                     qdev_get_gpio_in_named(dev_apb_ppc0,
989                                                            "cfg_nonsec", i));
990         qdev_connect_gpio_out_named(dev_secctl, "apb_ppc0_ap", i,
991                                     qdev_get_gpio_in_named(dev_apb_ppc0,
992                                                            "cfg_ap", i));
993     }
994     qdev_connect_gpio_out_named(dev_secctl, "apb_ppc0_irq_enable", 0,
995                                 qdev_get_gpio_in_named(dev_apb_ppc0,
996                                                        "irq_enable", 0));
997     qdev_connect_gpio_out_named(dev_secctl, "apb_ppc0_irq_clear", 0,
998                                 qdev_get_gpio_in_named(dev_apb_ppc0,
999                                                        "irq_clear", 0));
1000     qdev_connect_gpio_out(dev_splitter, 0,
1001                           qdev_get_gpio_in_named(dev_apb_ppc0,
1002                                                  "cfg_sec_resp", 0));
1003 
1004     /* All the PPC irq lines (from the 2 internal PPCs and the 8 external
1005      * ones) are sent individually to the security controller, and also
1006      * ORed together to give a single combined PPC interrupt to the NVIC.
1007      */
1008     if (!object_property_set_int(OBJECT(&s->ppc_irq_orgate),
1009                                  "num-lines", NUM_PPCS, errp)) {
1010         return;
1011     }
1012     if (!qdev_realize(DEVICE(&s->ppc_irq_orgate), NULL, errp)) {
1013         return;
1014     }
1015     qdev_connect_gpio_out(DEVICE(&s->ppc_irq_orgate), 0,
1016                           armsse_get_common_irq_in(s, 10));
1017 
1018     /*
1019      * 0x40010000 .. 0x4001ffff (and the 0x5001000... secure-only alias):
1020      * private per-CPU region (all these devices are SSE-200 only):
1021      *  0x50010000: L1 icache control registers
1022      *  0x50011000: CPUSECCTRL (CPU local security control registers)
1023      *  0x4001f000 and 0x5001f000: CPU_IDENTITY register block
1024      */
1025     if (info->has_cachectrl) {
1026         for (i = 0; i < info->num_cpus; i++) {
1027             char *name = g_strdup_printf("cachectrl%d", i);
1028             MemoryRegion *mr;
1029 
1030             qdev_prop_set_string(DEVICE(&s->cachectrl[i]), "name", name);
1031             g_free(name);
1032             qdev_prop_set_uint64(DEVICE(&s->cachectrl[i]), "size", 0x1000);
1033             if (!sysbus_realize(SYS_BUS_DEVICE(&s->cachectrl[i]), errp)) {
1034                 return;
1035             }
1036 
1037             mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->cachectrl[i]), 0);
1038             memory_region_add_subregion(&s->cpu_container[i], 0x50010000, mr);
1039         }
1040     }
1041     if (info->has_cpusecctrl) {
1042         for (i = 0; i < info->num_cpus; i++) {
1043             char *name = g_strdup_printf("CPUSECCTRL%d", i);
1044             MemoryRegion *mr;
1045 
1046             qdev_prop_set_string(DEVICE(&s->cpusecctrl[i]), "name", name);
1047             g_free(name);
1048             qdev_prop_set_uint64(DEVICE(&s->cpusecctrl[i]), "size", 0x1000);
1049             if (!sysbus_realize(SYS_BUS_DEVICE(&s->cpusecctrl[i]), errp)) {
1050                 return;
1051             }
1052 
1053             mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->cpusecctrl[i]), 0);
1054             memory_region_add_subregion(&s->cpu_container[i], 0x50011000, mr);
1055         }
1056     }
1057     if (info->has_cpuid) {
1058         for (i = 0; i < info->num_cpus; i++) {
1059             MemoryRegion *mr;
1060 
1061             qdev_prop_set_uint32(DEVICE(&s->cpuid[i]), "CPUID", i);
1062             if (!sysbus_realize(SYS_BUS_DEVICE(&s->cpuid[i]), errp)) {
1063                 return;
1064             }
1065 
1066             mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->cpuid[i]), 0);
1067             memory_region_add_subregion(&s->cpu_container[i], 0x4001F000, mr);
1068         }
1069     }
1070 
1071     if (!sysbus_realize(SYS_BUS_DEVICE(&s->apb_ppc[1]), errp)) {
1072         return;
1073     }
1074 
1075     dev_apb_ppc1 = DEVICE(&s->apb_ppc[1]);
1076     qdev_connect_gpio_out_named(dev_secctl, "apb_ppc1_nonsec", 0,
1077                                 qdev_get_gpio_in_named(dev_apb_ppc1,
1078                                                        "cfg_nonsec", 0));
1079     qdev_connect_gpio_out_named(dev_secctl, "apb_ppc1_ap", 0,
1080                                 qdev_get_gpio_in_named(dev_apb_ppc1,
1081                                                        "cfg_ap", 0));
1082     qdev_connect_gpio_out_named(dev_secctl, "apb_ppc1_irq_enable", 0,
1083                                 qdev_get_gpio_in_named(dev_apb_ppc1,
1084                                                        "irq_enable", 0));
1085     qdev_connect_gpio_out_named(dev_secctl, "apb_ppc1_irq_clear", 0,
1086                                 qdev_get_gpio_in_named(dev_apb_ppc1,
1087                                                        "irq_clear", 0));
1088     qdev_connect_gpio_out(dev_splitter, 1,
1089                           qdev_get_gpio_in_named(dev_apb_ppc1,
1090                                                  "cfg_sec_resp", 0));
1091 
1092     /*
1093      * Now both PPCs are realized we can map the upstream ends of
1094      * ports which correspond to entries in the devinfo array.
1095      * The ports which are connected to non-devinfo devices have
1096      * already been mapped.
1097      */
1098     for (devinfo = info->devinfo; devinfo->name; devinfo++) {
1099         SysBusDevice *ppc_sbd;
1100 
1101         if (devinfo->ppc == NO_PPC) {
1102             continue;
1103         }
1104         ppc_sbd = SYS_BUS_DEVICE(&s->apb_ppc[devinfo->ppc]);
1105         mr = sysbus_mmio_get_region(ppc_sbd, devinfo->ppc_port);
1106         memory_region_add_subregion(&s->container, devinfo->addr, mr);
1107     }
1108 
1109     if (!object_property_set_int(OBJECT(&s->sysinfo), "SYS_VERSION",
1110                                  info->sys_version, errp)) {
1111         return;
1112     }
1113     if (!object_property_set_int(OBJECT(&s->sysinfo), "SYS_CONFIG",
1114                                  armsse_sys_config_value(s, info), errp)) {
1115         return;
1116     }
1117     object_property_set_int(OBJECT(&s->sysinfo), "sse-version",
1118                             info->sse_version, &error_abort);
1119     object_property_set_int(OBJECT(&s->sysinfo), "IIDR",
1120                             info->iidr, &error_abort);
1121     if (!sysbus_realize(SYS_BUS_DEVICE(&s->sysinfo), errp)) {
1122         return;
1123     }
1124     /* System information registers */
1125     sysbus_mmio_map(SYS_BUS_DEVICE(&s->sysinfo), 0, 0x40020000);
1126     /* System control registers */
1127     object_property_set_int(OBJECT(&s->sysctl), "sse-version",
1128                             info->sse_version, &error_abort);
1129     object_property_set_int(OBJECT(&s->sysctl), "CPUWAIT_RST",
1130                             info->cpuwait_rst, &error_abort);
1131     object_property_set_int(OBJECT(&s->sysctl), "INITSVTOR0_RST",
1132                             s->init_svtor, &error_abort);
1133     object_property_set_int(OBJECT(&s->sysctl), "INITSVTOR1_RST",
1134                             s->init_svtor, &error_abort);
1135     if (!sysbus_realize(SYS_BUS_DEVICE(&s->sysctl), errp)) {
1136         return;
1137     }
1138     sysbus_mmio_map(SYS_BUS_DEVICE(&s->sysctl), 0, 0x50021000);
1139 
1140     if (info->has_ppus) {
1141         /* CPUnCORE_PPU for each CPU */
1142         for (i = 0; i < info->num_cpus; i++) {
1143             char *name = g_strdup_printf("CPU%dCORE_PPU", i);
1144 
1145             map_ppu(s, CPU0CORE_PPU + i, name, 0x50023000 + i * 0x2000);
1146             /*
1147              * We don't support CPU debug so don't create the
1148              * CPU0DEBUG_PPU at 0x50024000 and 0x50026000.
1149              */
1150             g_free(name);
1151         }
1152         map_ppu(s, DBG_PPU, "DBG_PPU", 0x50029000);
1153 
1154         for (i = 0; i < info->sram_banks; i++) {
1155             char *name = g_strdup_printf("RAM%d_PPU", i);
1156 
1157             map_ppu(s, RAM0_PPU + i, name, 0x5002a000 + i * 0x1000);
1158             g_free(name);
1159         }
1160     }
1161 
1162     for (i = 0; i < ARRAY_SIZE(s->ppc_irq_splitter); i++) {
1163         Object *splitter = OBJECT(&s->ppc_irq_splitter[i]);
1164 
1165         if (!object_property_set_int(splitter, "num-lines", 2, errp)) {
1166             return;
1167         }
1168         if (!qdev_realize(DEVICE(splitter), NULL, errp)) {
1169             return;
1170         }
1171     }
1172 
1173     for (i = 0; i < IOTS_NUM_AHB_EXP_PPC; i++) {
1174         char *ppcname = g_strdup_printf("ahb_ppcexp%d", i);
1175 
1176         armsse_forward_ppc(s, ppcname, i);
1177         g_free(ppcname);
1178     }
1179 
1180     for (i = 0; i < IOTS_NUM_APB_EXP_PPC; i++) {
1181         char *ppcname = g_strdup_printf("apb_ppcexp%d", i);
1182 
1183         armsse_forward_ppc(s, ppcname, i + IOTS_NUM_AHB_EXP_PPC);
1184         g_free(ppcname);
1185     }
1186 
1187     for (i = NUM_EXTERNAL_PPCS; i < NUM_PPCS; i++) {
1188         /* Wire up IRQ splitter for internal PPCs */
1189         DeviceState *devs = DEVICE(&s->ppc_irq_splitter[i]);
1190         char *gpioname = g_strdup_printf("apb_ppc%d_irq_status",
1191                                          i - NUM_EXTERNAL_PPCS);
1192         TZPPC *ppc = &s->apb_ppc[i - NUM_EXTERNAL_PPCS];
1193 
1194         qdev_connect_gpio_out(devs, 0,
1195                               qdev_get_gpio_in_named(dev_secctl, gpioname, 0));
1196         qdev_connect_gpio_out(devs, 1,
1197                               qdev_get_gpio_in(DEVICE(&s->ppc_irq_orgate), i));
1198         qdev_connect_gpio_out_named(DEVICE(ppc), "irq", 0,
1199                                     qdev_get_gpio_in(devs, 0));
1200         g_free(gpioname);
1201     }
1202 
1203     /* Wire up the splitters for the MPC IRQs */
1204     for (i = 0; i < IOTS_NUM_EXP_MPC + info->sram_banks; i++) {
1205         SplitIRQ *splitter = &s->mpc_irq_splitter[i];
1206         DeviceState *dev_splitter = DEVICE(splitter);
1207 
1208         if (!object_property_set_int(OBJECT(splitter), "num-lines", 2,
1209                                      errp)) {
1210             return;
1211         }
1212         if (!qdev_realize(DEVICE(splitter), NULL, errp)) {
1213             return;
1214         }
1215 
1216         if (i < IOTS_NUM_EXP_MPC) {
1217             /* Splitter input is from GPIO input line */
1218             s->mpcexp_status_in[i] = qdev_get_gpio_in(dev_splitter, 0);
1219             qdev_connect_gpio_out(dev_splitter, 0,
1220                                   qdev_get_gpio_in_named(dev_secctl,
1221                                                          "mpcexp_status", i));
1222         } else {
1223             /* Splitter input is from our own MPC */
1224             qdev_connect_gpio_out_named(DEVICE(&s->mpc[i - IOTS_NUM_EXP_MPC]),
1225                                         "irq", 0,
1226                                         qdev_get_gpio_in(dev_splitter, 0));
1227             qdev_connect_gpio_out(dev_splitter, 0,
1228                                   qdev_get_gpio_in_named(dev_secctl,
1229                                                          "mpc_status",
1230                                                          i - IOTS_NUM_EXP_MPC));
1231         }
1232 
1233         qdev_connect_gpio_out(dev_splitter, 1,
1234                               qdev_get_gpio_in(DEVICE(&s->mpc_irq_orgate), i));
1235     }
1236     /* Create GPIO inputs which will pass the line state for our
1237      * mpcexp_irq inputs to the correct splitter devices.
1238      */
1239     qdev_init_gpio_in_named(dev, armsse_mpcexp_status, "mpcexp_status",
1240                             IOTS_NUM_EXP_MPC);
1241 
1242     armsse_forward_sec_resp_cfg(s);
1243 
1244     /* Forward the MSC related signals */
1245     qdev_pass_gpios(dev_secctl, dev, "mscexp_status");
1246     qdev_pass_gpios(dev_secctl, dev, "mscexp_clear");
1247     qdev_pass_gpios(dev_secctl, dev, "mscexp_ns");
1248     qdev_connect_gpio_out_named(dev_secctl, "msc_irq", 0,
1249                                 armsse_get_common_irq_in(s, 11));
1250 
1251     /*
1252      * Expose our container region to the board model; this corresponds
1253      * to the AHB Slave Expansion ports which allow bus master devices
1254      * (eg DMA controllers) in the board model to make transactions into
1255      * devices in the ARMSSE.
1256      */
1257     sysbus_init_mmio(SYS_BUS_DEVICE(s), &s->container);
1258 
1259     /* Set initial system_clock_scale from MAINCLK */
1260     armsse_mainclk_update(s, ClockUpdate);
1261 }
1262 
1263 static void armsse_idau_check(IDAUInterface *ii, uint32_t address,
1264                               int *iregion, bool *exempt, bool *ns, bool *nsc)
1265 {
1266     /*
1267      * For ARMSSE systems the IDAU responses are simple logical functions
1268      * of the address bits. The NSC attribute is guest-adjustable via the
1269      * NSCCFG register in the security controller.
1270      */
1271     ARMSSE *s = ARM_SSE(ii);
1272     int region = extract32(address, 28, 4);
1273 
1274     *ns = !(region & 1);
1275     *nsc = (region == 1 && (s->nsccfg & 1)) || (region == 3 && (s->nsccfg & 2));
1276     /* 0xe0000000..0xe00fffff and 0xf0000000..0xf00fffff are exempt */
1277     *exempt = (address & 0xeff00000) == 0xe0000000;
1278     *iregion = region;
1279 }
1280 
1281 static const VMStateDescription armsse_vmstate = {
1282     .name = "iotkit",
1283     .version_id = 2,
1284     .minimum_version_id = 2,
1285     .fields = (VMStateField[]) {
1286         VMSTATE_CLOCK(mainclk, ARMSSE),
1287         VMSTATE_CLOCK(s32kclk, ARMSSE),
1288         VMSTATE_UINT32(nsccfg, ARMSSE),
1289         VMSTATE_END_OF_LIST()
1290     }
1291 };
1292 
1293 static void armsse_reset(DeviceState *dev)
1294 {
1295     ARMSSE *s = ARM_SSE(dev);
1296 
1297     s->nsccfg = 0;
1298 }
1299 
1300 static void armsse_class_init(ObjectClass *klass, void *data)
1301 {
1302     DeviceClass *dc = DEVICE_CLASS(klass);
1303     IDAUInterfaceClass *iic = IDAU_INTERFACE_CLASS(klass);
1304     ARMSSEClass *asc = ARM_SSE_CLASS(klass);
1305     const ARMSSEInfo *info = data;
1306 
1307     dc->realize = armsse_realize;
1308     dc->vmsd = &armsse_vmstate;
1309     device_class_set_props(dc, info->props);
1310     dc->reset = armsse_reset;
1311     iic->check = armsse_idau_check;
1312     asc->info = info;
1313 }
1314 
1315 static const TypeInfo armsse_info = {
1316     .name = TYPE_ARM_SSE,
1317     .parent = TYPE_SYS_BUS_DEVICE,
1318     .instance_size = sizeof(ARMSSE),
1319     .class_size = sizeof(ARMSSEClass),
1320     .instance_init = armsse_init,
1321     .abstract = true,
1322     .interfaces = (InterfaceInfo[]) {
1323         { TYPE_IDAU_INTERFACE },
1324         { }
1325     }
1326 };
1327 
1328 static void armsse_register_types(void)
1329 {
1330     int i;
1331 
1332     type_register_static(&armsse_info);
1333 
1334     for (i = 0; i < ARRAY_SIZE(armsse_variants); i++) {
1335         TypeInfo ti = {
1336             .name = armsse_variants[i].name,
1337             .parent = TYPE_ARM_SSE,
1338             .class_init = armsse_class_init,
1339             .class_data = (void *)&armsse_variants[i],
1340         };
1341         type_register(&ti);
1342     }
1343 }
1344 
1345 type_init(armsse_register_types);
1346