1 /* 2 * Arm SSE (Subsystems for Embedded): IoTKit 3 * 4 * Copyright (c) 2018 Linaro Limited 5 * Written by Peter Maydell 6 * 7 * This program is free software; you can redistribute it and/or modify 8 * it under the terms of the GNU General Public License version 2 or 9 * (at your option) any later version. 10 */ 11 12 #include "qemu/osdep.h" 13 #include "qemu/log.h" 14 #include "qemu/module.h" 15 #include "qemu/bitops.h" 16 #include "qapi/error.h" 17 #include "trace.h" 18 #include "hw/sysbus.h" 19 #include "migration/vmstate.h" 20 #include "hw/registerfields.h" 21 #include "hw/arm/armsse.h" 22 #include "hw/arm/armsse-version.h" 23 #include "hw/arm/boot.h" 24 #include "hw/irq.h" 25 #include "hw/qdev-clock.h" 26 27 /* 28 * The SSE-300 puts some devices in different places to the 29 * SSE-200 (and original IoTKit). We use an array of these structs 30 * to define how each variant lays out these devices. (Parts of the 31 * SoC that are the same for all variants aren't handled via these 32 * data structures.) 33 */ 34 35 #define NO_IRQ -1 36 #define NO_PPC -1 37 /* 38 * Special values for ARMSSEDeviceInfo::irq to indicate that this 39 * device uses one of the inputs to the OR gate that feeds into the 40 * CPU NMI input. 41 */ 42 #define NMI_0 10000 43 #define NMI_1 10001 44 45 typedef struct ARMSSEDeviceInfo { 46 const char *name; /* name to use for the QOM object; NULL terminates list */ 47 const char *type; /* QOM type name */ 48 unsigned int index; /* Which of the N devices of this type is this ? */ 49 hwaddr addr; 50 int ppc; /* Index of APB PPC this device is wired up to, or NO_PPC */ 51 int ppc_port; /* Port number of this device on the PPC */ 52 int irq; /* NO_IRQ, or 0..NUM_SSE_IRQS-1, or NMI_0 or NMI_1 */ 53 bool slowclk; /* true if device uses the slow 32KHz clock */ 54 } ARMSSEDeviceInfo; 55 56 struct ARMSSEInfo { 57 const char *name; 58 uint32_t sse_version; 59 int sram_banks; 60 int num_cpus; 61 uint32_t sys_version; 62 uint32_t iidr; 63 uint32_t cpuwait_rst; 64 bool has_mhus; 65 bool has_ppus; 66 bool has_cachectrl; 67 bool has_cpusecctrl; 68 bool has_cpuid; 69 Property *props; 70 const ARMSSEDeviceInfo *devinfo; 71 }; 72 73 static Property iotkit_properties[] = { 74 DEFINE_PROP_LINK("memory", ARMSSE, board_memory, TYPE_MEMORY_REGION, 75 MemoryRegion *), 76 DEFINE_PROP_UINT32("EXP_NUMIRQ", ARMSSE, exp_numirq, 64), 77 DEFINE_PROP_UINT32("SRAM_ADDR_WIDTH", ARMSSE, sram_addr_width, 15), 78 DEFINE_PROP_UINT32("init-svtor", ARMSSE, init_svtor, 0x10000000), 79 DEFINE_PROP_BOOL("CPU0_FPU", ARMSSE, cpu_fpu[0], true), 80 DEFINE_PROP_BOOL("CPU0_DSP", ARMSSE, cpu_dsp[0], true), 81 DEFINE_PROP_END_OF_LIST() 82 }; 83 84 static Property armsse_properties[] = { 85 DEFINE_PROP_LINK("memory", ARMSSE, board_memory, TYPE_MEMORY_REGION, 86 MemoryRegion *), 87 DEFINE_PROP_UINT32("EXP_NUMIRQ", ARMSSE, exp_numirq, 64), 88 DEFINE_PROP_UINT32("SRAM_ADDR_WIDTH", ARMSSE, sram_addr_width, 15), 89 DEFINE_PROP_UINT32("init-svtor", ARMSSE, init_svtor, 0x10000000), 90 DEFINE_PROP_BOOL("CPU0_FPU", ARMSSE, cpu_fpu[0], false), 91 DEFINE_PROP_BOOL("CPU0_DSP", ARMSSE, cpu_dsp[0], false), 92 DEFINE_PROP_BOOL("CPU1_FPU", ARMSSE, cpu_fpu[1], true), 93 DEFINE_PROP_BOOL("CPU1_DSP", ARMSSE, cpu_dsp[1], true), 94 DEFINE_PROP_END_OF_LIST() 95 }; 96 97 static const ARMSSEDeviceInfo sse200_devices[] = { 98 { 99 .name = "timer0", 100 .type = TYPE_CMSDK_APB_TIMER, 101 .index = 0, 102 .addr = 0x40000000, 103 .ppc = 0, 104 .ppc_port = 0, 105 .irq = 3, 106 }, 107 { 108 .name = "timer1", 109 .type = TYPE_CMSDK_APB_TIMER, 110 .index = 1, 111 .addr = 0x40001000, 112 .ppc = 0, 113 .ppc_port = 1, 114 .irq = 4, 115 }, 116 { 117 .name = "s32ktimer", 118 .type = TYPE_CMSDK_APB_TIMER, 119 .index = 2, 120 .addr = 0x4002f000, 121 .ppc = 1, 122 .ppc_port = 0, 123 .irq = 2, 124 .slowclk = true, 125 }, 126 { 127 .name = "dualtimer", 128 .type = TYPE_CMSDK_APB_DUALTIMER, 129 .index = 0, 130 .addr = 0x40002000, 131 .ppc = 0, 132 .ppc_port = 2, 133 .irq = 5, 134 }, 135 { 136 .name = "s32kwatchdog", 137 .type = TYPE_CMSDK_APB_WATCHDOG, 138 .index = 0, 139 .addr = 0x5002e000, 140 .ppc = NO_PPC, 141 .irq = NMI_0, 142 .slowclk = true, 143 }, 144 { 145 .name = "nswatchdog", 146 .type = TYPE_CMSDK_APB_WATCHDOG, 147 .index = 1, 148 .addr = 0x40081000, 149 .ppc = NO_PPC, 150 .irq = 1, 151 }, 152 { 153 .name = "swatchdog", 154 .type = TYPE_CMSDK_APB_WATCHDOG, 155 .index = 2, 156 .addr = 0x50081000, 157 .ppc = NO_PPC, 158 .irq = NMI_1, 159 }, 160 { 161 .name = "armsse-sysinfo", 162 .type = TYPE_IOTKIT_SYSINFO, 163 .index = 0, 164 .addr = 0x40020000, 165 .ppc = NO_PPC, 166 .irq = NO_IRQ, 167 }, 168 { 169 .name = "armsse-sysctl", 170 .type = TYPE_IOTKIT_SYSCTL, 171 .index = 0, 172 .addr = 0x50021000, 173 .ppc = NO_PPC, 174 .irq = NO_IRQ, 175 }, 176 { 177 .name = NULL, 178 } 179 }; 180 181 static const ARMSSEInfo armsse_variants[] = { 182 { 183 .name = TYPE_IOTKIT, 184 .sse_version = ARMSSE_IOTKIT, 185 .sram_banks = 1, 186 .num_cpus = 1, 187 .sys_version = 0x41743, 188 .iidr = 0, 189 .cpuwait_rst = 0, 190 .has_mhus = false, 191 .has_ppus = false, 192 .has_cachectrl = false, 193 .has_cpusecctrl = false, 194 .has_cpuid = false, 195 .props = iotkit_properties, 196 .devinfo = sse200_devices, 197 }, 198 { 199 .name = TYPE_SSE200, 200 .sse_version = ARMSSE_SSE200, 201 .sram_banks = 4, 202 .num_cpus = 2, 203 .sys_version = 0x22041743, 204 .iidr = 0, 205 .cpuwait_rst = 2, 206 .has_mhus = true, 207 .has_ppus = true, 208 .has_cachectrl = true, 209 .has_cpusecctrl = true, 210 .has_cpuid = true, 211 .props = armsse_properties, 212 .devinfo = sse200_devices, 213 }, 214 }; 215 216 static uint32_t armsse_sys_config_value(ARMSSE *s, const ARMSSEInfo *info) 217 { 218 /* Return the SYS_CONFIG value for this SSE */ 219 uint32_t sys_config; 220 221 switch (info->sse_version) { 222 case ARMSSE_IOTKIT: 223 sys_config = 0; 224 sys_config = deposit32(sys_config, 0, 4, info->sram_banks); 225 sys_config = deposit32(sys_config, 4, 4, s->sram_addr_width - 12); 226 break; 227 case ARMSSE_SSE200: 228 sys_config = 0; 229 sys_config = deposit32(sys_config, 0, 4, info->sram_banks); 230 sys_config = deposit32(sys_config, 4, 5, s->sram_addr_width); 231 sys_config = deposit32(sys_config, 24, 4, 2); 232 if (info->num_cpus > 1) { 233 sys_config = deposit32(sys_config, 10, 1, 1); 234 sys_config = deposit32(sys_config, 20, 4, info->sram_banks - 1); 235 sys_config = deposit32(sys_config, 28, 4, 2); 236 } 237 break; 238 case ARMSSE_SSE300: 239 sys_config = 0; 240 sys_config = deposit32(sys_config, 0, 4, info->sram_banks); 241 sys_config = deposit32(sys_config, 4, 5, s->sram_addr_width); 242 sys_config = deposit32(sys_config, 16, 3, 3); /* CPU0 = Cortex-M55 */ 243 break; 244 default: 245 g_assert_not_reached(); 246 } 247 return sys_config; 248 } 249 250 /* Clock frequency in HZ of the 32KHz "slow clock" */ 251 #define S32KCLK (32 * 1000) 252 253 /* Is internal IRQ n shared between CPUs in a multi-core SSE ? */ 254 static bool irq_is_common[32] = { 255 [0 ... 5] = true, 256 /* 6, 7: per-CPU MHU interrupts */ 257 [8 ... 12] = true, 258 /* 13: per-CPU icache interrupt */ 259 /* 14: reserved */ 260 [15 ... 20] = true, 261 /* 21: reserved */ 262 [22 ... 26] = true, 263 /* 27: reserved */ 264 /* 28, 29: per-CPU CTI interrupts */ 265 /* 30, 31: reserved */ 266 }; 267 268 /* 269 * Create an alias region in @container of @size bytes starting at @base 270 * which mirrors the memory starting at @orig. 271 */ 272 static void make_alias(ARMSSE *s, MemoryRegion *mr, MemoryRegion *container, 273 const char *name, hwaddr base, hwaddr size, hwaddr orig) 274 { 275 memory_region_init_alias(mr, NULL, name, container, orig, size); 276 /* The alias is even lower priority than unimplemented_device regions */ 277 memory_region_add_subregion_overlap(container, base, mr, -1500); 278 } 279 280 static void irq_status_forwarder(void *opaque, int n, int level) 281 { 282 qemu_irq destirq = opaque; 283 284 qemu_set_irq(destirq, level); 285 } 286 287 static void nsccfg_handler(void *opaque, int n, int level) 288 { 289 ARMSSE *s = ARM_SSE(opaque); 290 291 s->nsccfg = level; 292 } 293 294 static void armsse_forward_ppc(ARMSSE *s, const char *ppcname, int ppcnum) 295 { 296 /* Each of the 4 AHB and 4 APB PPCs that might be present in a 297 * system using the ARMSSE has a collection of control lines which 298 * are provided by the security controller and which we want to 299 * expose as control lines on the ARMSSE device itself, so the 300 * code using the ARMSSE can wire them up to the PPCs. 301 */ 302 SplitIRQ *splitter = &s->ppc_irq_splitter[ppcnum]; 303 DeviceState *armssedev = DEVICE(s); 304 DeviceState *dev_secctl = DEVICE(&s->secctl); 305 DeviceState *dev_splitter = DEVICE(splitter); 306 char *name; 307 308 name = g_strdup_printf("%s_nonsec", ppcname); 309 qdev_pass_gpios(dev_secctl, armssedev, name); 310 g_free(name); 311 name = g_strdup_printf("%s_ap", ppcname); 312 qdev_pass_gpios(dev_secctl, armssedev, name); 313 g_free(name); 314 name = g_strdup_printf("%s_irq_enable", ppcname); 315 qdev_pass_gpios(dev_secctl, armssedev, name); 316 g_free(name); 317 name = g_strdup_printf("%s_irq_clear", ppcname); 318 qdev_pass_gpios(dev_secctl, armssedev, name); 319 g_free(name); 320 321 /* irq_status is a little more tricky, because we need to 322 * split it so we can send it both to the security controller 323 * and to our OR gate for the NVIC interrupt line. 324 * Connect up the splitter's outputs, and create a GPIO input 325 * which will pass the line state to the input splitter. 326 */ 327 name = g_strdup_printf("%s_irq_status", ppcname); 328 qdev_connect_gpio_out(dev_splitter, 0, 329 qdev_get_gpio_in_named(dev_secctl, 330 name, 0)); 331 qdev_connect_gpio_out(dev_splitter, 1, 332 qdev_get_gpio_in(DEVICE(&s->ppc_irq_orgate), ppcnum)); 333 s->irq_status_in[ppcnum] = qdev_get_gpio_in(dev_splitter, 0); 334 qdev_init_gpio_in_named_with_opaque(armssedev, irq_status_forwarder, 335 s->irq_status_in[ppcnum], name, 1); 336 g_free(name); 337 } 338 339 static void armsse_forward_sec_resp_cfg(ARMSSE *s) 340 { 341 /* Forward the 3rd output from the splitter device as a 342 * named GPIO output of the armsse object. 343 */ 344 DeviceState *dev = DEVICE(s); 345 DeviceState *dev_splitter = DEVICE(&s->sec_resp_splitter); 346 347 qdev_init_gpio_out_named(dev, &s->sec_resp_cfg, "sec_resp_cfg", 1); 348 s->sec_resp_cfg_in = qemu_allocate_irq(irq_status_forwarder, 349 s->sec_resp_cfg, 1); 350 qdev_connect_gpio_out(dev_splitter, 2, s->sec_resp_cfg_in); 351 } 352 353 static void armsse_mainclk_update(void *opaque, ClockEvent event) 354 { 355 ARMSSE *s = ARM_SSE(opaque); 356 357 /* 358 * Set system_clock_scale from our Clock input; this is what 359 * controls the tick rate of the CPU SysTick timer. 360 */ 361 system_clock_scale = clock_ticks_to_ns(s->mainclk, 1); 362 } 363 364 static void armsse_init(Object *obj) 365 { 366 ARMSSE *s = ARM_SSE(obj); 367 ARMSSEClass *asc = ARM_SSE_GET_CLASS(obj); 368 const ARMSSEInfo *info = asc->info; 369 const ARMSSEDeviceInfo *devinfo; 370 int i; 371 372 assert(info->sram_banks <= MAX_SRAM_BANKS); 373 assert(info->num_cpus <= SSE_MAX_CPUS); 374 375 s->mainclk = qdev_init_clock_in(DEVICE(s), "MAINCLK", 376 armsse_mainclk_update, s, ClockUpdate); 377 s->s32kclk = qdev_init_clock_in(DEVICE(s), "S32KCLK", NULL, NULL, 0); 378 379 memory_region_init(&s->container, obj, "armsse-container", UINT64_MAX); 380 381 for (i = 0; i < info->num_cpus; i++) { 382 /* 383 * We put each CPU in its own cluster as they are logically 384 * distinct and may be configured differently. 385 */ 386 char *name; 387 388 name = g_strdup_printf("cluster%d", i); 389 object_initialize_child(obj, name, &s->cluster[i], TYPE_CPU_CLUSTER); 390 qdev_prop_set_uint32(DEVICE(&s->cluster[i]), "cluster-id", i); 391 g_free(name); 392 393 name = g_strdup_printf("armv7m%d", i); 394 object_initialize_child(OBJECT(&s->cluster[i]), name, &s->armv7m[i], 395 TYPE_ARMV7M); 396 qdev_prop_set_string(DEVICE(&s->armv7m[i]), "cpu-type", 397 ARM_CPU_TYPE_NAME("cortex-m33")); 398 g_free(name); 399 name = g_strdup_printf("arm-sse-cpu-container%d", i); 400 memory_region_init(&s->cpu_container[i], obj, name, UINT64_MAX); 401 g_free(name); 402 if (i > 0) { 403 name = g_strdup_printf("arm-sse-container-alias%d", i); 404 memory_region_init_alias(&s->container_alias[i - 1], obj, 405 name, &s->container, 0, UINT64_MAX); 406 g_free(name); 407 } 408 } 409 410 for (devinfo = info->devinfo; devinfo->name; devinfo++) { 411 assert(devinfo->ppc == NO_PPC || devinfo->ppc < ARRAY_SIZE(s->apb_ppc)); 412 if (!strcmp(devinfo->type, TYPE_CMSDK_APB_TIMER)) { 413 assert(devinfo->index < ARRAY_SIZE(s->timer)); 414 object_initialize_child(obj, devinfo->name, 415 &s->timer[devinfo->index], 416 TYPE_CMSDK_APB_TIMER); 417 } else if (!strcmp(devinfo->type, TYPE_CMSDK_APB_DUALTIMER)) { 418 assert(devinfo->index == 0); 419 object_initialize_child(obj, devinfo->name, &s->dualtimer, 420 TYPE_CMSDK_APB_DUALTIMER); 421 } else if (!strcmp(devinfo->type, TYPE_CMSDK_APB_WATCHDOG)) { 422 assert(devinfo->index < ARRAY_SIZE(s->cmsdk_watchdog)); 423 object_initialize_child(obj, devinfo->name, 424 &s->cmsdk_watchdog[devinfo->index], 425 TYPE_CMSDK_APB_WATCHDOG); 426 } else if (!strcmp(devinfo->type, TYPE_IOTKIT_SYSINFO)) { 427 assert(devinfo->index == 0); 428 object_initialize_child(obj, devinfo->name, &s->sysinfo, 429 TYPE_IOTKIT_SYSINFO); 430 } else if (!strcmp(devinfo->type, TYPE_IOTKIT_SYSCTL)) { 431 assert(devinfo->index == 0); 432 object_initialize_child(obj, devinfo->name, &s->sysctl, 433 TYPE_IOTKIT_SYSCTL); 434 } else { 435 g_assert_not_reached(); 436 } 437 } 438 439 object_initialize_child(obj, "secctl", &s->secctl, TYPE_IOTKIT_SECCTL); 440 441 for (i = 0; i < ARRAY_SIZE(s->apb_ppc); i++) { 442 g_autofree char *name = g_strdup_printf("apb-ppc%d", i); 443 object_initialize_child(obj, name, &s->apb_ppc[i], TYPE_TZ_PPC); 444 } 445 446 for (i = 0; i < info->sram_banks; i++) { 447 char *name = g_strdup_printf("mpc%d", i); 448 object_initialize_child(obj, name, &s->mpc[i], TYPE_TZ_MPC); 449 g_free(name); 450 } 451 object_initialize_child(obj, "mpc-irq-orgate", &s->mpc_irq_orgate, 452 TYPE_OR_IRQ); 453 454 for (i = 0; i < IOTS_NUM_EXP_MPC + info->sram_banks; i++) { 455 char *name = g_strdup_printf("mpc-irq-splitter-%d", i); 456 SplitIRQ *splitter = &s->mpc_irq_splitter[i]; 457 458 object_initialize_child(obj, name, splitter, TYPE_SPLIT_IRQ); 459 g_free(name); 460 } 461 462 if (info->has_mhus) { 463 object_initialize_child(obj, "mhu0", &s->mhu[0], TYPE_ARMSSE_MHU); 464 object_initialize_child(obj, "mhu1", &s->mhu[1], TYPE_ARMSSE_MHU); 465 } 466 if (info->has_ppus) { 467 for (i = 0; i < info->num_cpus; i++) { 468 char *name = g_strdup_printf("CPU%dCORE_PPU", i); 469 int ppuidx = CPU0CORE_PPU + i; 470 471 object_initialize_child(obj, name, &s->ppu[ppuidx], 472 TYPE_UNIMPLEMENTED_DEVICE); 473 g_free(name); 474 } 475 object_initialize_child(obj, "DBG_PPU", &s->ppu[DBG_PPU], 476 TYPE_UNIMPLEMENTED_DEVICE); 477 for (i = 0; i < info->sram_banks; i++) { 478 char *name = g_strdup_printf("RAM%d_PPU", i); 479 int ppuidx = RAM0_PPU + i; 480 481 object_initialize_child(obj, name, &s->ppu[ppuidx], 482 TYPE_UNIMPLEMENTED_DEVICE); 483 g_free(name); 484 } 485 } 486 if (info->has_cachectrl) { 487 for (i = 0; i < info->num_cpus; i++) { 488 char *name = g_strdup_printf("cachectrl%d", i); 489 490 object_initialize_child(obj, name, &s->cachectrl[i], 491 TYPE_UNIMPLEMENTED_DEVICE); 492 g_free(name); 493 } 494 } 495 if (info->has_cpusecctrl) { 496 for (i = 0; i < info->num_cpus; i++) { 497 char *name = g_strdup_printf("cpusecctrl%d", i); 498 499 object_initialize_child(obj, name, &s->cpusecctrl[i], 500 TYPE_UNIMPLEMENTED_DEVICE); 501 g_free(name); 502 } 503 } 504 if (info->has_cpuid) { 505 for (i = 0; i < info->num_cpus; i++) { 506 char *name = g_strdup_printf("cpuid%d", i); 507 508 object_initialize_child(obj, name, &s->cpuid[i], 509 TYPE_ARMSSE_CPUID); 510 g_free(name); 511 } 512 } 513 object_initialize_child(obj, "nmi-orgate", &s->nmi_orgate, TYPE_OR_IRQ); 514 object_initialize_child(obj, "ppc-irq-orgate", &s->ppc_irq_orgate, 515 TYPE_OR_IRQ); 516 object_initialize_child(obj, "sec-resp-splitter", &s->sec_resp_splitter, 517 TYPE_SPLIT_IRQ); 518 for (i = 0; i < ARRAY_SIZE(s->ppc_irq_splitter); i++) { 519 char *name = g_strdup_printf("ppc-irq-splitter-%d", i); 520 SplitIRQ *splitter = &s->ppc_irq_splitter[i]; 521 522 object_initialize_child(obj, name, splitter, TYPE_SPLIT_IRQ); 523 g_free(name); 524 } 525 if (info->num_cpus > 1) { 526 for (i = 0; i < ARRAY_SIZE(s->cpu_irq_splitter); i++) { 527 if (irq_is_common[i]) { 528 char *name = g_strdup_printf("cpu-irq-splitter%d", i); 529 SplitIRQ *splitter = &s->cpu_irq_splitter[i]; 530 531 object_initialize_child(obj, name, splitter, TYPE_SPLIT_IRQ); 532 g_free(name); 533 } 534 } 535 } 536 } 537 538 static void armsse_exp_irq(void *opaque, int n, int level) 539 { 540 qemu_irq *irqarray = opaque; 541 542 qemu_set_irq(irqarray[n], level); 543 } 544 545 static void armsse_mpcexp_status(void *opaque, int n, int level) 546 { 547 ARMSSE *s = ARM_SSE(opaque); 548 qemu_set_irq(s->mpcexp_status_in[n], level); 549 } 550 551 static qemu_irq armsse_get_common_irq_in(ARMSSE *s, int irqno) 552 { 553 /* 554 * Return a qemu_irq which can be used to signal IRQ n to 555 * all CPUs in the SSE. 556 */ 557 ARMSSEClass *asc = ARM_SSE_GET_CLASS(s); 558 const ARMSSEInfo *info = asc->info; 559 560 assert(irq_is_common[irqno]); 561 562 if (info->num_cpus == 1) { 563 /* Only one CPU -- just connect directly to it */ 564 return qdev_get_gpio_in(DEVICE(&s->armv7m[0]), irqno); 565 } else { 566 /* Connect to the splitter which feeds all CPUs */ 567 return qdev_get_gpio_in(DEVICE(&s->cpu_irq_splitter[irqno]), 0); 568 } 569 } 570 571 static void map_ppu(ARMSSE *s, int ppuidx, const char *name, hwaddr addr) 572 { 573 /* Map a PPU unimplemented device stub */ 574 DeviceState *dev = DEVICE(&s->ppu[ppuidx]); 575 576 qdev_prop_set_string(dev, "name", name); 577 qdev_prop_set_uint64(dev, "size", 0x1000); 578 sysbus_realize(SYS_BUS_DEVICE(dev), &error_fatal); 579 sysbus_mmio_map(SYS_BUS_DEVICE(&s->ppu[ppuidx]), 0, addr); 580 } 581 582 static void armsse_realize(DeviceState *dev, Error **errp) 583 { 584 ARMSSE *s = ARM_SSE(dev); 585 ARMSSEClass *asc = ARM_SSE_GET_CLASS(dev); 586 const ARMSSEInfo *info = asc->info; 587 const ARMSSEDeviceInfo *devinfo; 588 int i; 589 MemoryRegion *mr; 590 Error *err = NULL; 591 SysBusDevice *sbd_apb_ppc0; 592 SysBusDevice *sbd_secctl; 593 DeviceState *dev_apb_ppc0; 594 DeviceState *dev_apb_ppc1; 595 DeviceState *dev_secctl; 596 DeviceState *dev_splitter; 597 uint32_t addr_width_max; 598 599 if (!s->board_memory) { 600 error_setg(errp, "memory property was not set"); 601 return; 602 } 603 604 if (!clock_has_source(s->mainclk)) { 605 error_setg(errp, "MAINCLK clock was not connected"); 606 } 607 if (!clock_has_source(s->s32kclk)) { 608 error_setg(errp, "S32KCLK clock was not connected"); 609 } 610 611 assert(info->num_cpus <= SSE_MAX_CPUS); 612 613 /* max SRAM_ADDR_WIDTH: 24 - log2(SRAM_NUM_BANK) */ 614 assert(is_power_of_2(info->sram_banks)); 615 addr_width_max = 24 - ctz32(info->sram_banks); 616 if (s->sram_addr_width < 1 || s->sram_addr_width > addr_width_max) { 617 error_setg(errp, "SRAM_ADDR_WIDTH must be between 1 and %d", 618 addr_width_max); 619 return; 620 } 621 622 /* Handling of which devices should be available only to secure 623 * code is usually done differently for M profile than for A profile. 624 * Instead of putting some devices only into the secure address space, 625 * devices exist in both address spaces but with hard-wired security 626 * permissions that will cause the CPU to fault for non-secure accesses. 627 * 628 * The ARMSSE has an IDAU (Implementation Defined Access Unit), 629 * which specifies hard-wired security permissions for different 630 * areas of the physical address space. For the ARMSSE IDAU, the 631 * top 4 bits of the physical address are the IDAU region ID, and 632 * if bit 28 (ie the lowest bit of the ID) is 0 then this is an NS 633 * region, otherwise it is an S region. 634 * 635 * The various devices and RAMs are generally all mapped twice, 636 * once into a region that the IDAU defines as secure and once 637 * into a non-secure region. They sit behind either a Memory 638 * Protection Controller (for RAM) or a Peripheral Protection 639 * Controller (for devices), which allow a more fine grained 640 * configuration of whether non-secure accesses are permitted. 641 * 642 * (The other place that guest software can configure security 643 * permissions is in the architected SAU (Security Attribution 644 * Unit), which is entirely inside the CPU. The IDAU can upgrade 645 * the security attributes for a region to more restrictive than 646 * the SAU specifies, but cannot downgrade them.) 647 * 648 * 0x10000000..0x1fffffff alias of 0x00000000..0x0fffffff 649 * 0x20000000..0x2007ffff 32KB FPGA block RAM 650 * 0x30000000..0x3fffffff alias of 0x20000000..0x2fffffff 651 * 0x40000000..0x4000ffff base peripheral region 1 652 * 0x40010000..0x4001ffff CPU peripherals (none for ARMSSE) 653 * 0x40020000..0x4002ffff system control element peripherals 654 * 0x40080000..0x400fffff base peripheral region 2 655 * 0x50000000..0x5fffffff alias of 0x40000000..0x4fffffff 656 */ 657 658 memory_region_add_subregion_overlap(&s->container, 0, s->board_memory, -2); 659 660 for (i = 0; i < info->num_cpus; i++) { 661 DeviceState *cpudev = DEVICE(&s->armv7m[i]); 662 Object *cpuobj = OBJECT(&s->armv7m[i]); 663 int j; 664 char *gpioname; 665 666 qdev_prop_set_uint32(cpudev, "num-irq", s->exp_numirq + NUM_SSE_IRQS); 667 /* 668 * In real hardware the initial Secure VTOR is set from the INITSVTOR* 669 * registers in the IoT Kit System Control Register block. In QEMU 670 * we set the initial value here, and also the reset value of the 671 * sysctl register, from this object's QOM init-svtor property. 672 * If the guest changes the INITSVTOR* registers at runtime then the 673 * code in iotkit-sysctl.c will update the CPU init-svtor property 674 * (which will then take effect on the next CPU warm-reset). 675 * 676 * Note that typically a board using the SSE-200 will have a system 677 * control processor whose boot firmware initializes the INITSVTOR* 678 * registers before powering up the CPUs. QEMU doesn't emulate 679 * the control processor, so instead we behave in the way that the 680 * firmware does: the initial value should be set by the board code 681 * (using the init-svtor property on the ARMSSE object) to match 682 * whatever its firmware does. 683 */ 684 qdev_prop_set_uint32(cpudev, "init-svtor", s->init_svtor); 685 /* 686 * CPUs start powered down if the corresponding bit in the CPUWAIT 687 * register is 1. In real hardware the CPUWAIT register reset value is 688 * a configurable property of the SSE-200 (via the CPUWAIT0_RST and 689 * CPUWAIT1_RST parameters), but since all the boards we care about 690 * start CPU0 and leave CPU1 powered off, we hard-code that in 691 * info->cpuwait_rst for now. We can add QOM properties for this 692 * later if necessary. 693 */ 694 if (extract32(info->cpuwait_rst, i, 1)) { 695 if (!object_property_set_bool(cpuobj, "start-powered-off", true, 696 errp)) { 697 return; 698 } 699 } 700 if (!s->cpu_fpu[i]) { 701 if (!object_property_set_bool(cpuobj, "vfp", false, errp)) { 702 return; 703 } 704 } 705 if (!s->cpu_dsp[i]) { 706 if (!object_property_set_bool(cpuobj, "dsp", false, errp)) { 707 return; 708 } 709 } 710 711 if (i > 0) { 712 memory_region_add_subregion_overlap(&s->cpu_container[i], 0, 713 &s->container_alias[i - 1], -1); 714 } else { 715 memory_region_add_subregion_overlap(&s->cpu_container[i], 0, 716 &s->container, -1); 717 } 718 object_property_set_link(cpuobj, "memory", 719 OBJECT(&s->cpu_container[i]), &error_abort); 720 object_property_set_link(cpuobj, "idau", OBJECT(s), &error_abort); 721 if (!sysbus_realize(SYS_BUS_DEVICE(cpuobj), errp)) { 722 return; 723 } 724 /* 725 * The cluster must be realized after the armv7m container, as 726 * the container's CPU object is only created on realize, and the 727 * CPU must exist and have been parented into the cluster before 728 * the cluster is realized. 729 */ 730 if (!qdev_realize(DEVICE(&s->cluster[i]), NULL, errp)) { 731 return; 732 } 733 734 /* Connect EXP_IRQ/EXP_CPUn_IRQ GPIOs to the NVIC's lines 32 and up */ 735 s->exp_irqs[i] = g_new(qemu_irq, s->exp_numirq); 736 for (j = 0; j < s->exp_numirq; j++) { 737 s->exp_irqs[i][j] = qdev_get_gpio_in(cpudev, j + NUM_SSE_IRQS); 738 } 739 if (i == 0) { 740 gpioname = g_strdup("EXP_IRQ"); 741 } else { 742 gpioname = g_strdup_printf("EXP_CPU%d_IRQ", i); 743 } 744 qdev_init_gpio_in_named_with_opaque(dev, armsse_exp_irq, 745 s->exp_irqs[i], 746 gpioname, s->exp_numirq); 747 g_free(gpioname); 748 } 749 750 /* Wire up the splitters that connect common IRQs to all CPUs */ 751 if (info->num_cpus > 1) { 752 for (i = 0; i < ARRAY_SIZE(s->cpu_irq_splitter); i++) { 753 if (irq_is_common[i]) { 754 Object *splitter = OBJECT(&s->cpu_irq_splitter[i]); 755 DeviceState *devs = DEVICE(splitter); 756 int cpunum; 757 758 if (!object_property_set_int(splitter, "num-lines", 759 info->num_cpus, errp)) { 760 return; 761 } 762 if (!qdev_realize(DEVICE(splitter), NULL, errp)) { 763 return; 764 } 765 for (cpunum = 0; cpunum < info->num_cpus; cpunum++) { 766 DeviceState *cpudev = DEVICE(&s->armv7m[cpunum]); 767 768 qdev_connect_gpio_out(devs, cpunum, 769 qdev_get_gpio_in(cpudev, i)); 770 } 771 } 772 } 773 } 774 775 /* Set up the big aliases first */ 776 make_alias(s, &s->alias1, &s->container, "alias 1", 777 0x10000000, 0x10000000, 0x00000000); 778 make_alias(s, &s->alias2, &s->container, 779 "alias 2", 0x30000000, 0x10000000, 0x20000000); 780 /* The 0x50000000..0x5fffffff region is not a pure alias: it has 781 * a few extra devices that only appear there (generally the 782 * control interfaces for the protection controllers). 783 * We implement this by mapping those devices over the top of this 784 * alias MR at a higher priority. Some of the devices in this range 785 * are per-CPU, so we must put this alias in the per-cpu containers. 786 */ 787 for (i = 0; i < info->num_cpus; i++) { 788 make_alias(s, &s->alias3[i], &s->cpu_container[i], 789 "alias 3", 0x50000000, 0x10000000, 0x40000000); 790 } 791 792 /* Security controller */ 793 object_property_set_int(OBJECT(&s->secctl), "sse-version", 794 info->sse_version, &error_abort); 795 if (!sysbus_realize(SYS_BUS_DEVICE(&s->secctl), errp)) { 796 return; 797 } 798 sbd_secctl = SYS_BUS_DEVICE(&s->secctl); 799 dev_secctl = DEVICE(&s->secctl); 800 sysbus_mmio_map(sbd_secctl, 0, 0x50080000); 801 sysbus_mmio_map(sbd_secctl, 1, 0x40080000); 802 803 s->nsc_cfg_in = qemu_allocate_irq(nsccfg_handler, s, 1); 804 qdev_connect_gpio_out_named(dev_secctl, "nsc_cfg", 0, s->nsc_cfg_in); 805 806 /* The sec_resp_cfg output from the security controller must be split into 807 * multiple lines, one for each of the PPCs within the ARMSSE and one 808 * that will be an output from the ARMSSE to the system. 809 */ 810 if (!object_property_set_int(OBJECT(&s->sec_resp_splitter), 811 "num-lines", 3, errp)) { 812 return; 813 } 814 if (!qdev_realize(DEVICE(&s->sec_resp_splitter), NULL, errp)) { 815 return; 816 } 817 dev_splitter = DEVICE(&s->sec_resp_splitter); 818 qdev_connect_gpio_out_named(dev_secctl, "sec_resp_cfg", 0, 819 qdev_get_gpio_in(dev_splitter, 0)); 820 821 /* Each SRAM bank lives behind its own Memory Protection Controller */ 822 for (i = 0; i < info->sram_banks; i++) { 823 char *ramname = g_strdup_printf("armsse.sram%d", i); 824 SysBusDevice *sbd_mpc; 825 uint32_t sram_bank_size = 1 << s->sram_addr_width; 826 827 memory_region_init_ram(&s->sram[i], NULL, ramname, 828 sram_bank_size, &err); 829 g_free(ramname); 830 if (err) { 831 error_propagate(errp, err); 832 return; 833 } 834 object_property_set_link(OBJECT(&s->mpc[i]), "downstream", 835 OBJECT(&s->sram[i]), &error_abort); 836 if (!sysbus_realize(SYS_BUS_DEVICE(&s->mpc[i]), errp)) { 837 return; 838 } 839 /* Map the upstream end of the MPC into the right place... */ 840 sbd_mpc = SYS_BUS_DEVICE(&s->mpc[i]); 841 memory_region_add_subregion(&s->container, 842 0x20000000 + i * sram_bank_size, 843 sysbus_mmio_get_region(sbd_mpc, 1)); 844 /* ...and its register interface */ 845 memory_region_add_subregion(&s->container, 0x50083000 + i * 0x1000, 846 sysbus_mmio_get_region(sbd_mpc, 0)); 847 } 848 849 /* We must OR together lines from the MPC splitters to go to the NVIC */ 850 if (!object_property_set_int(OBJECT(&s->mpc_irq_orgate), "num-lines", 851 IOTS_NUM_EXP_MPC + info->sram_banks, 852 errp)) { 853 return; 854 } 855 if (!qdev_realize(DEVICE(&s->mpc_irq_orgate), NULL, errp)) { 856 return; 857 } 858 qdev_connect_gpio_out(DEVICE(&s->mpc_irq_orgate), 0, 859 armsse_get_common_irq_in(s, 9)); 860 861 /* This OR gate wires together outputs from the secure watchdogs to NMI */ 862 if (!object_property_set_int(OBJECT(&s->nmi_orgate), "num-lines", 2, 863 errp)) { 864 return; 865 } 866 if (!qdev_realize(DEVICE(&s->nmi_orgate), NULL, errp)) { 867 return; 868 } 869 qdev_connect_gpio_out(DEVICE(&s->nmi_orgate), 0, 870 qdev_get_gpio_in_named(DEVICE(&s->armv7m), "NMI", 0)); 871 872 /* Devices behind APB PPC0: 873 * 0x40000000: timer0 874 * 0x40001000: timer1 875 * 0x40002000: dual timer 876 * 0x40003000: MHU0 (SSE-200 only) 877 * 0x40004000: MHU1 (SSE-200 only) 878 * We must configure and realize each downstream device and connect 879 * it to the appropriate PPC port; then we can realize the PPC and 880 * map its upstream ends to the right place in the container. 881 */ 882 for (devinfo = info->devinfo; devinfo->name; devinfo++) { 883 SysBusDevice *sbd; 884 qemu_irq irq; 885 886 if (!strcmp(devinfo->type, TYPE_CMSDK_APB_TIMER)) { 887 sbd = SYS_BUS_DEVICE(&s->timer[devinfo->index]); 888 889 qdev_connect_clock_in(DEVICE(sbd), "pclk", 890 devinfo->slowclk ? s->s32kclk : s->mainclk); 891 if (!sysbus_realize(sbd, errp)) { 892 return; 893 } 894 mr = sysbus_mmio_get_region(sbd, 0); 895 } else if (!strcmp(devinfo->type, TYPE_CMSDK_APB_DUALTIMER)) { 896 sbd = SYS_BUS_DEVICE(&s->dualtimer); 897 898 qdev_connect_clock_in(DEVICE(sbd), "TIMCLK", s->mainclk); 899 if (!sysbus_realize(sbd, errp)) { 900 return; 901 } 902 mr = sysbus_mmio_get_region(sbd, 0); 903 } else if (!strcmp(devinfo->type, TYPE_CMSDK_APB_WATCHDOG)) { 904 sbd = SYS_BUS_DEVICE(&s->cmsdk_watchdog[devinfo->index]); 905 906 qdev_connect_clock_in(DEVICE(sbd), "WDOGCLK", 907 devinfo->slowclk ? s->s32kclk : s->mainclk); 908 if (!sysbus_realize(sbd, errp)) { 909 return; 910 } 911 mr = sysbus_mmio_get_region(sbd, 0); 912 } else if (!strcmp(devinfo->type, TYPE_IOTKIT_SYSINFO)) { 913 sbd = SYS_BUS_DEVICE(&s->sysinfo); 914 915 object_property_set_int(OBJECT(&s->sysinfo), "SYS_VERSION", 916 info->sys_version, &error_abort); 917 object_property_set_int(OBJECT(&s->sysinfo), "SYS_CONFIG", 918 armsse_sys_config_value(s, info), 919 &error_abort); 920 object_property_set_int(OBJECT(&s->sysinfo), "sse-version", 921 info->sse_version, &error_abort); 922 object_property_set_int(OBJECT(&s->sysinfo), "IIDR", 923 info->iidr, &error_abort); 924 if (!sysbus_realize(sbd, errp)) { 925 return; 926 } 927 mr = sysbus_mmio_get_region(sbd, 0); 928 } else if (!strcmp(devinfo->type, TYPE_IOTKIT_SYSCTL)) { 929 /* System control registers */ 930 sbd = SYS_BUS_DEVICE(&s->sysctl); 931 932 object_property_set_int(OBJECT(&s->sysctl), "sse-version", 933 info->sse_version, &error_abort); 934 object_property_set_int(OBJECT(&s->sysctl), "CPUWAIT_RST", 935 info->cpuwait_rst, &error_abort); 936 object_property_set_int(OBJECT(&s->sysctl), "INITSVTOR0_RST", 937 s->init_svtor, &error_abort); 938 object_property_set_int(OBJECT(&s->sysctl), "INITSVTOR1_RST", 939 s->init_svtor, &error_abort); 940 if (!sysbus_realize(sbd, errp)) { 941 return; 942 } 943 mr = sysbus_mmio_get_region(sbd, 0); 944 } else { 945 g_assert_not_reached(); 946 } 947 948 switch (devinfo->irq) { 949 case NO_IRQ: 950 irq = NULL; 951 break; 952 case 0 ... NUM_SSE_IRQS - 1: 953 irq = armsse_get_common_irq_in(s, devinfo->irq); 954 break; 955 case NMI_0: 956 case NMI_1: 957 irq = qdev_get_gpio_in(DEVICE(&s->nmi_orgate), 958 devinfo->irq - NMI_0); 959 break; 960 default: 961 g_assert_not_reached(); 962 } 963 964 if (irq) { 965 sysbus_connect_irq(sbd, 0, irq); 966 } 967 968 /* 969 * Devices connected to a PPC are connected to the port here; 970 * we will map the upstream end of that port to the right address 971 * in the container later after the PPC has been realized. 972 * Devices not connected to a PPC can be mapped immediately. 973 */ 974 if (devinfo->ppc != NO_PPC) { 975 TZPPC *ppc = &s->apb_ppc[devinfo->ppc]; 976 g_autofree char *portname = g_strdup_printf("port[%d]", 977 devinfo->ppc_port); 978 object_property_set_link(OBJECT(ppc), portname, OBJECT(mr), 979 &error_abort); 980 } else { 981 memory_region_add_subregion(&s->container, devinfo->addr, mr); 982 } 983 } 984 985 if (info->has_mhus) { 986 /* 987 * An SSE-200 with only one CPU should have only one MHU created, 988 * with the region where the second MHU usually is being RAZ/WI. 989 * We don't implement that SSE-200 config; if we want to support 990 * it then this code needs to be enhanced to handle creating the 991 * RAZ/WI region instead of the second MHU. 992 */ 993 assert(info->num_cpus == ARRAY_SIZE(s->mhu)); 994 995 for (i = 0; i < ARRAY_SIZE(s->mhu); i++) { 996 char *port; 997 int cpunum; 998 SysBusDevice *mhu_sbd = SYS_BUS_DEVICE(&s->mhu[i]); 999 1000 if (!sysbus_realize(SYS_BUS_DEVICE(&s->mhu[i]), errp)) { 1001 return; 1002 } 1003 port = g_strdup_printf("port[%d]", i + 3); 1004 mr = sysbus_mmio_get_region(mhu_sbd, 0); 1005 object_property_set_link(OBJECT(&s->apb_ppc[0]), port, OBJECT(mr), 1006 &error_abort); 1007 g_free(port); 1008 1009 /* 1010 * Each MHU has an irq line for each CPU: 1011 * MHU 0 irq line 0 -> CPU 0 IRQ 6 1012 * MHU 0 irq line 1 -> CPU 1 IRQ 6 1013 * MHU 1 irq line 0 -> CPU 0 IRQ 7 1014 * MHU 1 irq line 1 -> CPU 1 IRQ 7 1015 */ 1016 for (cpunum = 0; cpunum < info->num_cpus; cpunum++) { 1017 DeviceState *cpudev = DEVICE(&s->armv7m[cpunum]); 1018 1019 sysbus_connect_irq(mhu_sbd, cpunum, 1020 qdev_get_gpio_in(cpudev, 6 + i)); 1021 } 1022 } 1023 } 1024 1025 if (!sysbus_realize(SYS_BUS_DEVICE(&s->apb_ppc[0]), errp)) { 1026 return; 1027 } 1028 1029 sbd_apb_ppc0 = SYS_BUS_DEVICE(&s->apb_ppc[0]); 1030 dev_apb_ppc0 = DEVICE(&s->apb_ppc[0]); 1031 1032 if (info->has_mhus) { 1033 mr = sysbus_mmio_get_region(sbd_apb_ppc0, 3); 1034 memory_region_add_subregion(&s->container, 0x40003000, mr); 1035 mr = sysbus_mmio_get_region(sbd_apb_ppc0, 4); 1036 memory_region_add_subregion(&s->container, 0x40004000, mr); 1037 } 1038 for (i = 0; i < IOTS_APB_PPC0_NUM_PORTS; i++) { 1039 qdev_connect_gpio_out_named(dev_secctl, "apb_ppc0_nonsec", i, 1040 qdev_get_gpio_in_named(dev_apb_ppc0, 1041 "cfg_nonsec", i)); 1042 qdev_connect_gpio_out_named(dev_secctl, "apb_ppc0_ap", i, 1043 qdev_get_gpio_in_named(dev_apb_ppc0, 1044 "cfg_ap", i)); 1045 } 1046 qdev_connect_gpio_out_named(dev_secctl, "apb_ppc0_irq_enable", 0, 1047 qdev_get_gpio_in_named(dev_apb_ppc0, 1048 "irq_enable", 0)); 1049 qdev_connect_gpio_out_named(dev_secctl, "apb_ppc0_irq_clear", 0, 1050 qdev_get_gpio_in_named(dev_apb_ppc0, 1051 "irq_clear", 0)); 1052 qdev_connect_gpio_out(dev_splitter, 0, 1053 qdev_get_gpio_in_named(dev_apb_ppc0, 1054 "cfg_sec_resp", 0)); 1055 1056 /* All the PPC irq lines (from the 2 internal PPCs and the 8 external 1057 * ones) are sent individually to the security controller, and also 1058 * ORed together to give a single combined PPC interrupt to the NVIC. 1059 */ 1060 if (!object_property_set_int(OBJECT(&s->ppc_irq_orgate), 1061 "num-lines", NUM_PPCS, errp)) { 1062 return; 1063 } 1064 if (!qdev_realize(DEVICE(&s->ppc_irq_orgate), NULL, errp)) { 1065 return; 1066 } 1067 qdev_connect_gpio_out(DEVICE(&s->ppc_irq_orgate), 0, 1068 armsse_get_common_irq_in(s, 10)); 1069 1070 /* 1071 * 0x40010000 .. 0x4001ffff (and the 0x5001000... secure-only alias): 1072 * private per-CPU region (all these devices are SSE-200 only): 1073 * 0x50010000: L1 icache control registers 1074 * 0x50011000: CPUSECCTRL (CPU local security control registers) 1075 * 0x4001f000 and 0x5001f000: CPU_IDENTITY register block 1076 */ 1077 if (info->has_cachectrl) { 1078 for (i = 0; i < info->num_cpus; i++) { 1079 char *name = g_strdup_printf("cachectrl%d", i); 1080 MemoryRegion *mr; 1081 1082 qdev_prop_set_string(DEVICE(&s->cachectrl[i]), "name", name); 1083 g_free(name); 1084 qdev_prop_set_uint64(DEVICE(&s->cachectrl[i]), "size", 0x1000); 1085 if (!sysbus_realize(SYS_BUS_DEVICE(&s->cachectrl[i]), errp)) { 1086 return; 1087 } 1088 1089 mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->cachectrl[i]), 0); 1090 memory_region_add_subregion(&s->cpu_container[i], 0x50010000, mr); 1091 } 1092 } 1093 if (info->has_cpusecctrl) { 1094 for (i = 0; i < info->num_cpus; i++) { 1095 char *name = g_strdup_printf("CPUSECCTRL%d", i); 1096 MemoryRegion *mr; 1097 1098 qdev_prop_set_string(DEVICE(&s->cpusecctrl[i]), "name", name); 1099 g_free(name); 1100 qdev_prop_set_uint64(DEVICE(&s->cpusecctrl[i]), "size", 0x1000); 1101 if (!sysbus_realize(SYS_BUS_DEVICE(&s->cpusecctrl[i]), errp)) { 1102 return; 1103 } 1104 1105 mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->cpusecctrl[i]), 0); 1106 memory_region_add_subregion(&s->cpu_container[i], 0x50011000, mr); 1107 } 1108 } 1109 if (info->has_cpuid) { 1110 for (i = 0; i < info->num_cpus; i++) { 1111 MemoryRegion *mr; 1112 1113 qdev_prop_set_uint32(DEVICE(&s->cpuid[i]), "CPUID", i); 1114 if (!sysbus_realize(SYS_BUS_DEVICE(&s->cpuid[i]), errp)) { 1115 return; 1116 } 1117 1118 mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->cpuid[i]), 0); 1119 memory_region_add_subregion(&s->cpu_container[i], 0x4001F000, mr); 1120 } 1121 } 1122 1123 if (!sysbus_realize(SYS_BUS_DEVICE(&s->apb_ppc[1]), errp)) { 1124 return; 1125 } 1126 1127 dev_apb_ppc1 = DEVICE(&s->apb_ppc[1]); 1128 qdev_connect_gpio_out_named(dev_secctl, "apb_ppc1_nonsec", 0, 1129 qdev_get_gpio_in_named(dev_apb_ppc1, 1130 "cfg_nonsec", 0)); 1131 qdev_connect_gpio_out_named(dev_secctl, "apb_ppc1_ap", 0, 1132 qdev_get_gpio_in_named(dev_apb_ppc1, 1133 "cfg_ap", 0)); 1134 qdev_connect_gpio_out_named(dev_secctl, "apb_ppc1_irq_enable", 0, 1135 qdev_get_gpio_in_named(dev_apb_ppc1, 1136 "irq_enable", 0)); 1137 qdev_connect_gpio_out_named(dev_secctl, "apb_ppc1_irq_clear", 0, 1138 qdev_get_gpio_in_named(dev_apb_ppc1, 1139 "irq_clear", 0)); 1140 qdev_connect_gpio_out(dev_splitter, 1, 1141 qdev_get_gpio_in_named(dev_apb_ppc1, 1142 "cfg_sec_resp", 0)); 1143 1144 /* 1145 * Now both PPCs are realized we can map the upstream ends of 1146 * ports which correspond to entries in the devinfo array. 1147 * The ports which are connected to non-devinfo devices have 1148 * already been mapped. 1149 */ 1150 for (devinfo = info->devinfo; devinfo->name; devinfo++) { 1151 SysBusDevice *ppc_sbd; 1152 1153 if (devinfo->ppc == NO_PPC) { 1154 continue; 1155 } 1156 ppc_sbd = SYS_BUS_DEVICE(&s->apb_ppc[devinfo->ppc]); 1157 mr = sysbus_mmio_get_region(ppc_sbd, devinfo->ppc_port); 1158 memory_region_add_subregion(&s->container, devinfo->addr, mr); 1159 } 1160 1161 if (info->has_ppus) { 1162 /* CPUnCORE_PPU for each CPU */ 1163 for (i = 0; i < info->num_cpus; i++) { 1164 char *name = g_strdup_printf("CPU%dCORE_PPU", i); 1165 1166 map_ppu(s, CPU0CORE_PPU + i, name, 0x50023000 + i * 0x2000); 1167 /* 1168 * We don't support CPU debug so don't create the 1169 * CPU0DEBUG_PPU at 0x50024000 and 0x50026000. 1170 */ 1171 g_free(name); 1172 } 1173 map_ppu(s, DBG_PPU, "DBG_PPU", 0x50029000); 1174 1175 for (i = 0; i < info->sram_banks; i++) { 1176 char *name = g_strdup_printf("RAM%d_PPU", i); 1177 1178 map_ppu(s, RAM0_PPU + i, name, 0x5002a000 + i * 0x1000); 1179 g_free(name); 1180 } 1181 } 1182 1183 for (i = 0; i < ARRAY_SIZE(s->ppc_irq_splitter); i++) { 1184 Object *splitter = OBJECT(&s->ppc_irq_splitter[i]); 1185 1186 if (!object_property_set_int(splitter, "num-lines", 2, errp)) { 1187 return; 1188 } 1189 if (!qdev_realize(DEVICE(splitter), NULL, errp)) { 1190 return; 1191 } 1192 } 1193 1194 for (i = 0; i < IOTS_NUM_AHB_EXP_PPC; i++) { 1195 char *ppcname = g_strdup_printf("ahb_ppcexp%d", i); 1196 1197 armsse_forward_ppc(s, ppcname, i); 1198 g_free(ppcname); 1199 } 1200 1201 for (i = 0; i < IOTS_NUM_APB_EXP_PPC; i++) { 1202 char *ppcname = g_strdup_printf("apb_ppcexp%d", i); 1203 1204 armsse_forward_ppc(s, ppcname, i + IOTS_NUM_AHB_EXP_PPC); 1205 g_free(ppcname); 1206 } 1207 1208 for (i = NUM_EXTERNAL_PPCS; i < NUM_PPCS; i++) { 1209 /* Wire up IRQ splitter for internal PPCs */ 1210 DeviceState *devs = DEVICE(&s->ppc_irq_splitter[i]); 1211 char *gpioname = g_strdup_printf("apb_ppc%d_irq_status", 1212 i - NUM_EXTERNAL_PPCS); 1213 TZPPC *ppc = &s->apb_ppc[i - NUM_EXTERNAL_PPCS]; 1214 1215 qdev_connect_gpio_out(devs, 0, 1216 qdev_get_gpio_in_named(dev_secctl, gpioname, 0)); 1217 qdev_connect_gpio_out(devs, 1, 1218 qdev_get_gpio_in(DEVICE(&s->ppc_irq_orgate), i)); 1219 qdev_connect_gpio_out_named(DEVICE(ppc), "irq", 0, 1220 qdev_get_gpio_in(devs, 0)); 1221 g_free(gpioname); 1222 } 1223 1224 /* Wire up the splitters for the MPC IRQs */ 1225 for (i = 0; i < IOTS_NUM_EXP_MPC + info->sram_banks; i++) { 1226 SplitIRQ *splitter = &s->mpc_irq_splitter[i]; 1227 DeviceState *dev_splitter = DEVICE(splitter); 1228 1229 if (!object_property_set_int(OBJECT(splitter), "num-lines", 2, 1230 errp)) { 1231 return; 1232 } 1233 if (!qdev_realize(DEVICE(splitter), NULL, errp)) { 1234 return; 1235 } 1236 1237 if (i < IOTS_NUM_EXP_MPC) { 1238 /* Splitter input is from GPIO input line */ 1239 s->mpcexp_status_in[i] = qdev_get_gpio_in(dev_splitter, 0); 1240 qdev_connect_gpio_out(dev_splitter, 0, 1241 qdev_get_gpio_in_named(dev_secctl, 1242 "mpcexp_status", i)); 1243 } else { 1244 /* Splitter input is from our own MPC */ 1245 qdev_connect_gpio_out_named(DEVICE(&s->mpc[i - IOTS_NUM_EXP_MPC]), 1246 "irq", 0, 1247 qdev_get_gpio_in(dev_splitter, 0)); 1248 qdev_connect_gpio_out(dev_splitter, 0, 1249 qdev_get_gpio_in_named(dev_secctl, 1250 "mpc_status", 1251 i - IOTS_NUM_EXP_MPC)); 1252 } 1253 1254 qdev_connect_gpio_out(dev_splitter, 1, 1255 qdev_get_gpio_in(DEVICE(&s->mpc_irq_orgate), i)); 1256 } 1257 /* Create GPIO inputs which will pass the line state for our 1258 * mpcexp_irq inputs to the correct splitter devices. 1259 */ 1260 qdev_init_gpio_in_named(dev, armsse_mpcexp_status, "mpcexp_status", 1261 IOTS_NUM_EXP_MPC); 1262 1263 armsse_forward_sec_resp_cfg(s); 1264 1265 /* Forward the MSC related signals */ 1266 qdev_pass_gpios(dev_secctl, dev, "mscexp_status"); 1267 qdev_pass_gpios(dev_secctl, dev, "mscexp_clear"); 1268 qdev_pass_gpios(dev_secctl, dev, "mscexp_ns"); 1269 qdev_connect_gpio_out_named(dev_secctl, "msc_irq", 0, 1270 armsse_get_common_irq_in(s, 11)); 1271 1272 /* 1273 * Expose our container region to the board model; this corresponds 1274 * to the AHB Slave Expansion ports which allow bus master devices 1275 * (eg DMA controllers) in the board model to make transactions into 1276 * devices in the ARMSSE. 1277 */ 1278 sysbus_init_mmio(SYS_BUS_DEVICE(s), &s->container); 1279 1280 /* Set initial system_clock_scale from MAINCLK */ 1281 armsse_mainclk_update(s, ClockUpdate); 1282 } 1283 1284 static void armsse_idau_check(IDAUInterface *ii, uint32_t address, 1285 int *iregion, bool *exempt, bool *ns, bool *nsc) 1286 { 1287 /* 1288 * For ARMSSE systems the IDAU responses are simple logical functions 1289 * of the address bits. The NSC attribute is guest-adjustable via the 1290 * NSCCFG register in the security controller. 1291 */ 1292 ARMSSE *s = ARM_SSE(ii); 1293 int region = extract32(address, 28, 4); 1294 1295 *ns = !(region & 1); 1296 *nsc = (region == 1 && (s->nsccfg & 1)) || (region == 3 && (s->nsccfg & 2)); 1297 /* 0xe0000000..0xe00fffff and 0xf0000000..0xf00fffff are exempt */ 1298 *exempt = (address & 0xeff00000) == 0xe0000000; 1299 *iregion = region; 1300 } 1301 1302 static const VMStateDescription armsse_vmstate = { 1303 .name = "iotkit", 1304 .version_id = 2, 1305 .minimum_version_id = 2, 1306 .fields = (VMStateField[]) { 1307 VMSTATE_CLOCK(mainclk, ARMSSE), 1308 VMSTATE_CLOCK(s32kclk, ARMSSE), 1309 VMSTATE_UINT32(nsccfg, ARMSSE), 1310 VMSTATE_END_OF_LIST() 1311 } 1312 }; 1313 1314 static void armsse_reset(DeviceState *dev) 1315 { 1316 ARMSSE *s = ARM_SSE(dev); 1317 1318 s->nsccfg = 0; 1319 } 1320 1321 static void armsse_class_init(ObjectClass *klass, void *data) 1322 { 1323 DeviceClass *dc = DEVICE_CLASS(klass); 1324 IDAUInterfaceClass *iic = IDAU_INTERFACE_CLASS(klass); 1325 ARMSSEClass *asc = ARM_SSE_CLASS(klass); 1326 const ARMSSEInfo *info = data; 1327 1328 dc->realize = armsse_realize; 1329 dc->vmsd = &armsse_vmstate; 1330 device_class_set_props(dc, info->props); 1331 dc->reset = armsse_reset; 1332 iic->check = armsse_idau_check; 1333 asc->info = info; 1334 } 1335 1336 static const TypeInfo armsse_info = { 1337 .name = TYPE_ARM_SSE, 1338 .parent = TYPE_SYS_BUS_DEVICE, 1339 .instance_size = sizeof(ARMSSE), 1340 .class_size = sizeof(ARMSSEClass), 1341 .instance_init = armsse_init, 1342 .abstract = true, 1343 .interfaces = (InterfaceInfo[]) { 1344 { TYPE_IDAU_INTERFACE }, 1345 { } 1346 } 1347 }; 1348 1349 static void armsse_register_types(void) 1350 { 1351 int i; 1352 1353 type_register_static(&armsse_info); 1354 1355 for (i = 0; i < ARRAY_SIZE(armsse_variants); i++) { 1356 TypeInfo ti = { 1357 .name = armsse_variants[i].name, 1358 .parent = TYPE_ARM_SSE, 1359 .class_init = armsse_class_init, 1360 .class_data = (void *)&armsse_variants[i], 1361 }; 1362 type_register(&ti); 1363 } 1364 } 1365 1366 type_init(armsse_register_types); 1367