xref: /qemu/hw/arm/armsse.c (revision 9de4ddb49595670fcbf8da16c3a6bceb083c34ce)
1 /*
2  * Arm SSE (Subsystems for Embedded): IoTKit
3  *
4  * Copyright (c) 2018 Linaro Limited
5  * Written by Peter Maydell
6  *
7  * This program is free software; you can redistribute it and/or modify
8  * it under the terms of the GNU General Public License version 2 or
9  * (at your option) any later version.
10  */
11 
12 #include "qemu/osdep.h"
13 #include "qemu/log.h"
14 #include "qemu/module.h"
15 #include "qemu/bitops.h"
16 #include "qapi/error.h"
17 #include "trace.h"
18 #include "hw/sysbus.h"
19 #include "migration/vmstate.h"
20 #include "hw/registerfields.h"
21 #include "hw/arm/armsse.h"
22 #include "hw/arm/armsse-version.h"
23 #include "hw/arm/boot.h"
24 #include "hw/irq.h"
25 #include "hw/qdev-clock.h"
26 
27 /*
28  * The SSE-300 puts some devices in different places to the
29  * SSE-200 (and original IoTKit). We use an array of these structs
30  * to define how each variant lays out these devices. (Parts of the
31  * SoC that are the same for all variants aren't handled via these
32  * data structures.)
33  */
34 
35 #define NO_IRQ -1
36 #define NO_PPC -1
37 /*
38  * Special values for ARMSSEDeviceInfo::irq to indicate that this
39  * device uses one of the inputs to the OR gate that feeds into the
40  * CPU NMI input.
41  */
42 #define NMI_0 10000
43 #define NMI_1 10001
44 
45 typedef struct ARMSSEDeviceInfo {
46     const char *name; /* name to use for the QOM object; NULL terminates list */
47     const char *type; /* QOM type name */
48     unsigned int index; /* Which of the N devices of this type is this ? */
49     hwaddr addr;
50     int ppc; /* Index of APB PPC this device is wired up to, or NO_PPC */
51     int ppc_port; /* Port number of this device on the PPC */
52     int irq; /* NO_IRQ, or 0..NUM_SSE_IRQS-1, or NMI_0 or NMI_1 */
53     bool slowclk; /* true if device uses the slow 32KHz clock */
54 } ARMSSEDeviceInfo;
55 
56 struct ARMSSEInfo {
57     const char *name;
58     uint32_t sse_version;
59     int sram_banks;
60     int num_cpus;
61     uint32_t sys_version;
62     uint32_t iidr;
63     uint32_t cpuwait_rst;
64     bool has_mhus;
65     bool has_ppus;
66     bool has_cachectrl;
67     bool has_cpusecctrl;
68     bool has_cpuid;
69     Property *props;
70     const ARMSSEDeviceInfo *devinfo;
71 };
72 
73 static Property iotkit_properties[] = {
74     DEFINE_PROP_LINK("memory", ARMSSE, board_memory, TYPE_MEMORY_REGION,
75                      MemoryRegion *),
76     DEFINE_PROP_UINT32("EXP_NUMIRQ", ARMSSE, exp_numirq, 64),
77     DEFINE_PROP_UINT32("SRAM_ADDR_WIDTH", ARMSSE, sram_addr_width, 15),
78     DEFINE_PROP_UINT32("init-svtor", ARMSSE, init_svtor, 0x10000000),
79     DEFINE_PROP_BOOL("CPU0_FPU", ARMSSE, cpu_fpu[0], true),
80     DEFINE_PROP_BOOL("CPU0_DSP", ARMSSE, cpu_dsp[0], true),
81     DEFINE_PROP_END_OF_LIST()
82 };
83 
84 static Property armsse_properties[] = {
85     DEFINE_PROP_LINK("memory", ARMSSE, board_memory, TYPE_MEMORY_REGION,
86                      MemoryRegion *),
87     DEFINE_PROP_UINT32("EXP_NUMIRQ", ARMSSE, exp_numirq, 64),
88     DEFINE_PROP_UINT32("SRAM_ADDR_WIDTH", ARMSSE, sram_addr_width, 15),
89     DEFINE_PROP_UINT32("init-svtor", ARMSSE, init_svtor, 0x10000000),
90     DEFINE_PROP_BOOL("CPU0_FPU", ARMSSE, cpu_fpu[0], false),
91     DEFINE_PROP_BOOL("CPU0_DSP", ARMSSE, cpu_dsp[0], false),
92     DEFINE_PROP_BOOL("CPU1_FPU", ARMSSE, cpu_fpu[1], true),
93     DEFINE_PROP_BOOL("CPU1_DSP", ARMSSE, cpu_dsp[1], true),
94     DEFINE_PROP_END_OF_LIST()
95 };
96 
97 static const ARMSSEDeviceInfo sse200_devices[] = {
98     {
99         .name = "timer0",
100         .type = TYPE_CMSDK_APB_TIMER,
101         .index = 0,
102         .addr = 0x40000000,
103         .ppc = 0,
104         .ppc_port = 0,
105         .irq = 3,
106     },
107     {
108         .name = "timer1",
109         .type = TYPE_CMSDK_APB_TIMER,
110         .index = 1,
111         .addr = 0x40001000,
112         .ppc = 0,
113         .ppc_port = 1,
114         .irq = 4,
115     },
116     {
117         .name = "s32ktimer",
118         .type = TYPE_CMSDK_APB_TIMER,
119         .index = 2,
120         .addr = 0x4002f000,
121         .ppc = 1,
122         .ppc_port = 0,
123         .irq = 2,
124         .slowclk = true,
125     },
126     {
127         .name = "dualtimer",
128         .type = TYPE_CMSDK_APB_DUALTIMER,
129         .index = 0,
130         .addr = 0x40002000,
131         .ppc = 0,
132         .ppc_port = 2,
133         .irq = 5,
134     },
135     {
136         .name = "s32kwatchdog",
137         .type = TYPE_CMSDK_APB_WATCHDOG,
138         .index = 0,
139         .addr = 0x5002e000,
140         .ppc = NO_PPC,
141         .irq = NMI_0,
142         .slowclk = true,
143     },
144     {
145         .name = "nswatchdog",
146         .type = TYPE_CMSDK_APB_WATCHDOG,
147         .index = 1,
148         .addr = 0x40081000,
149         .ppc = NO_PPC,
150         .irq = 1,
151     },
152     {
153         .name = "swatchdog",
154         .type = TYPE_CMSDK_APB_WATCHDOG,
155         .index = 2,
156         .addr = 0x50081000,
157         .ppc = NO_PPC,
158         .irq = NMI_1,
159     },
160     {
161         .name = "armsse-sysinfo",
162         .type = TYPE_IOTKIT_SYSINFO,
163         .index = 0,
164         .addr = 0x40020000,
165         .ppc = NO_PPC,
166         .irq = NO_IRQ,
167     },
168     {
169         .name = "armsse-sysctl",
170         .type = TYPE_IOTKIT_SYSCTL,
171         .index = 0,
172         .addr = 0x50021000,
173         .ppc = NO_PPC,
174         .irq = NO_IRQ,
175     },
176     {
177         .name = NULL,
178     }
179 };
180 
181 static const ARMSSEInfo armsse_variants[] = {
182     {
183         .name = TYPE_IOTKIT,
184         .sse_version = ARMSSE_IOTKIT,
185         .sram_banks = 1,
186         .num_cpus = 1,
187         .sys_version = 0x41743,
188         .iidr = 0,
189         .cpuwait_rst = 0,
190         .has_mhus = false,
191         .has_ppus = false,
192         .has_cachectrl = false,
193         .has_cpusecctrl = false,
194         .has_cpuid = false,
195         .props = iotkit_properties,
196         .devinfo = sse200_devices,
197     },
198     {
199         .name = TYPE_SSE200,
200         .sse_version = ARMSSE_SSE200,
201         .sram_banks = 4,
202         .num_cpus = 2,
203         .sys_version = 0x22041743,
204         .iidr = 0,
205         .cpuwait_rst = 2,
206         .has_mhus = true,
207         .has_ppus = true,
208         .has_cachectrl = true,
209         .has_cpusecctrl = true,
210         .has_cpuid = true,
211         .props = armsse_properties,
212         .devinfo = sse200_devices,
213     },
214 };
215 
216 static uint32_t armsse_sys_config_value(ARMSSE *s, const ARMSSEInfo *info)
217 {
218     /* Return the SYS_CONFIG value for this SSE */
219     uint32_t sys_config;
220 
221     switch (info->sse_version) {
222     case ARMSSE_IOTKIT:
223         sys_config = 0;
224         sys_config = deposit32(sys_config, 0, 4, info->sram_banks);
225         sys_config = deposit32(sys_config, 4, 4, s->sram_addr_width - 12);
226         break;
227     case ARMSSE_SSE200:
228         sys_config = 0;
229         sys_config = deposit32(sys_config, 0, 4, info->sram_banks);
230         sys_config = deposit32(sys_config, 4, 5, s->sram_addr_width);
231         sys_config = deposit32(sys_config, 24, 4, 2);
232         if (info->num_cpus > 1) {
233             sys_config = deposit32(sys_config, 10, 1, 1);
234             sys_config = deposit32(sys_config, 20, 4, info->sram_banks - 1);
235             sys_config = deposit32(sys_config, 28, 4, 2);
236         }
237         break;
238     case ARMSSE_SSE300:
239         sys_config = 0;
240         sys_config = deposit32(sys_config, 0, 4, info->sram_banks);
241         sys_config = deposit32(sys_config, 4, 5, s->sram_addr_width);
242         sys_config = deposit32(sys_config, 16, 3, 3); /* CPU0 = Cortex-M55 */
243         break;
244     default:
245         g_assert_not_reached();
246     }
247     return sys_config;
248 }
249 
250 /* Clock frequency in HZ of the 32KHz "slow clock" */
251 #define S32KCLK (32 * 1000)
252 
253 /* Is internal IRQ n shared between CPUs in a multi-core SSE ? */
254 static bool irq_is_common[32] = {
255     [0 ... 5] = true,
256     /* 6, 7: per-CPU MHU interrupts */
257     [8 ... 12] = true,
258     /* 13: per-CPU icache interrupt */
259     /* 14: reserved */
260     [15 ... 20] = true,
261     /* 21: reserved */
262     [22 ... 26] = true,
263     /* 27: reserved */
264     /* 28, 29: per-CPU CTI interrupts */
265     /* 30, 31: reserved */
266 };
267 
268 /*
269  * Create an alias region in @container of @size bytes starting at @base
270  * which mirrors the memory starting at @orig.
271  */
272 static void make_alias(ARMSSE *s, MemoryRegion *mr, MemoryRegion *container,
273                        const char *name, hwaddr base, hwaddr size, hwaddr orig)
274 {
275     memory_region_init_alias(mr, NULL, name, container, orig, size);
276     /* The alias is even lower priority than unimplemented_device regions */
277     memory_region_add_subregion_overlap(container, base, mr, -1500);
278 }
279 
280 static void irq_status_forwarder(void *opaque, int n, int level)
281 {
282     qemu_irq destirq = opaque;
283 
284     qemu_set_irq(destirq, level);
285 }
286 
287 static void nsccfg_handler(void *opaque, int n, int level)
288 {
289     ARMSSE *s = ARM_SSE(opaque);
290 
291     s->nsccfg = level;
292 }
293 
294 static void armsse_forward_ppc(ARMSSE *s, const char *ppcname, int ppcnum)
295 {
296     /* Each of the 4 AHB and 4 APB PPCs that might be present in a
297      * system using the ARMSSE has a collection of control lines which
298      * are provided by the security controller and which we want to
299      * expose as control lines on the ARMSSE device itself, so the
300      * code using the ARMSSE can wire them up to the PPCs.
301      */
302     SplitIRQ *splitter = &s->ppc_irq_splitter[ppcnum];
303     DeviceState *armssedev = DEVICE(s);
304     DeviceState *dev_secctl = DEVICE(&s->secctl);
305     DeviceState *dev_splitter = DEVICE(splitter);
306     char *name;
307 
308     name = g_strdup_printf("%s_nonsec", ppcname);
309     qdev_pass_gpios(dev_secctl, armssedev, name);
310     g_free(name);
311     name = g_strdup_printf("%s_ap", ppcname);
312     qdev_pass_gpios(dev_secctl, armssedev, name);
313     g_free(name);
314     name = g_strdup_printf("%s_irq_enable", ppcname);
315     qdev_pass_gpios(dev_secctl, armssedev, name);
316     g_free(name);
317     name = g_strdup_printf("%s_irq_clear", ppcname);
318     qdev_pass_gpios(dev_secctl, armssedev, name);
319     g_free(name);
320 
321     /* irq_status is a little more tricky, because we need to
322      * split it so we can send it both to the security controller
323      * and to our OR gate for the NVIC interrupt line.
324      * Connect up the splitter's outputs, and create a GPIO input
325      * which will pass the line state to the input splitter.
326      */
327     name = g_strdup_printf("%s_irq_status", ppcname);
328     qdev_connect_gpio_out(dev_splitter, 0,
329                           qdev_get_gpio_in_named(dev_secctl,
330                                                  name, 0));
331     qdev_connect_gpio_out(dev_splitter, 1,
332                           qdev_get_gpio_in(DEVICE(&s->ppc_irq_orgate), ppcnum));
333     s->irq_status_in[ppcnum] = qdev_get_gpio_in(dev_splitter, 0);
334     qdev_init_gpio_in_named_with_opaque(armssedev, irq_status_forwarder,
335                                         s->irq_status_in[ppcnum], name, 1);
336     g_free(name);
337 }
338 
339 static void armsse_forward_sec_resp_cfg(ARMSSE *s)
340 {
341     /* Forward the 3rd output from the splitter device as a
342      * named GPIO output of the armsse object.
343      */
344     DeviceState *dev = DEVICE(s);
345     DeviceState *dev_splitter = DEVICE(&s->sec_resp_splitter);
346 
347     qdev_init_gpio_out_named(dev, &s->sec_resp_cfg, "sec_resp_cfg", 1);
348     s->sec_resp_cfg_in = qemu_allocate_irq(irq_status_forwarder,
349                                            s->sec_resp_cfg, 1);
350     qdev_connect_gpio_out(dev_splitter, 2, s->sec_resp_cfg_in);
351 }
352 
353 static void armsse_mainclk_update(void *opaque, ClockEvent event)
354 {
355     ARMSSE *s = ARM_SSE(opaque);
356 
357     /*
358      * Set system_clock_scale from our Clock input; this is what
359      * controls the tick rate of the CPU SysTick timer.
360      */
361     system_clock_scale = clock_ticks_to_ns(s->mainclk, 1);
362 }
363 
364 static void armsse_init(Object *obj)
365 {
366     ARMSSE *s = ARM_SSE(obj);
367     ARMSSEClass *asc = ARM_SSE_GET_CLASS(obj);
368     const ARMSSEInfo *info = asc->info;
369     const ARMSSEDeviceInfo *devinfo;
370     int i;
371 
372     assert(info->sram_banks <= MAX_SRAM_BANKS);
373     assert(info->num_cpus <= SSE_MAX_CPUS);
374 
375     s->mainclk = qdev_init_clock_in(DEVICE(s), "MAINCLK",
376                                     armsse_mainclk_update, s, ClockUpdate);
377     s->s32kclk = qdev_init_clock_in(DEVICE(s), "S32KCLK", NULL, NULL, 0);
378 
379     memory_region_init(&s->container, obj, "armsse-container", UINT64_MAX);
380 
381     for (i = 0; i < info->num_cpus; i++) {
382         /*
383          * We put each CPU in its own cluster as they are logically
384          * distinct and may be configured differently.
385          */
386         char *name;
387 
388         name = g_strdup_printf("cluster%d", i);
389         object_initialize_child(obj, name, &s->cluster[i], TYPE_CPU_CLUSTER);
390         qdev_prop_set_uint32(DEVICE(&s->cluster[i]), "cluster-id", i);
391         g_free(name);
392 
393         name = g_strdup_printf("armv7m%d", i);
394         object_initialize_child(OBJECT(&s->cluster[i]), name, &s->armv7m[i],
395                                 TYPE_ARMV7M);
396         qdev_prop_set_string(DEVICE(&s->armv7m[i]), "cpu-type",
397                              ARM_CPU_TYPE_NAME("cortex-m33"));
398         g_free(name);
399         name = g_strdup_printf("arm-sse-cpu-container%d", i);
400         memory_region_init(&s->cpu_container[i], obj, name, UINT64_MAX);
401         g_free(name);
402         if (i > 0) {
403             name = g_strdup_printf("arm-sse-container-alias%d", i);
404             memory_region_init_alias(&s->container_alias[i - 1], obj,
405                                      name, &s->container, 0, UINT64_MAX);
406             g_free(name);
407         }
408     }
409 
410     for (devinfo = info->devinfo; devinfo->name; devinfo++) {
411         assert(devinfo->ppc == NO_PPC || devinfo->ppc < ARRAY_SIZE(s->apb_ppc));
412         if (!strcmp(devinfo->type, TYPE_CMSDK_APB_TIMER)) {
413             assert(devinfo->index < ARRAY_SIZE(s->timer));
414             object_initialize_child(obj, devinfo->name,
415                                     &s->timer[devinfo->index],
416                                     TYPE_CMSDK_APB_TIMER);
417         } else if (!strcmp(devinfo->type, TYPE_CMSDK_APB_DUALTIMER)) {
418             assert(devinfo->index == 0);
419             object_initialize_child(obj, devinfo->name, &s->dualtimer,
420                                     TYPE_CMSDK_APB_DUALTIMER);
421         } else if (!strcmp(devinfo->type, TYPE_CMSDK_APB_WATCHDOG)) {
422             assert(devinfo->index < ARRAY_SIZE(s->cmsdk_watchdog));
423             object_initialize_child(obj, devinfo->name,
424                                     &s->cmsdk_watchdog[devinfo->index],
425                                     TYPE_CMSDK_APB_WATCHDOG);
426         } else if (!strcmp(devinfo->type, TYPE_IOTKIT_SYSINFO)) {
427             assert(devinfo->index == 0);
428             object_initialize_child(obj, devinfo->name, &s->sysinfo,
429                                     TYPE_IOTKIT_SYSINFO);
430         } else if (!strcmp(devinfo->type, TYPE_IOTKIT_SYSCTL)) {
431             assert(devinfo->index == 0);
432             object_initialize_child(obj, devinfo->name, &s->sysctl,
433                                     TYPE_IOTKIT_SYSCTL);
434         } else {
435             g_assert_not_reached();
436         }
437     }
438 
439     object_initialize_child(obj, "secctl", &s->secctl, TYPE_IOTKIT_SECCTL);
440 
441     for (i = 0; i < ARRAY_SIZE(s->apb_ppc); i++) {
442         g_autofree char *name = g_strdup_printf("apb-ppc%d", i);
443         object_initialize_child(obj, name, &s->apb_ppc[i], TYPE_TZ_PPC);
444     }
445 
446     for (i = 0; i < info->sram_banks; i++) {
447         char *name = g_strdup_printf("mpc%d", i);
448         object_initialize_child(obj, name, &s->mpc[i], TYPE_TZ_MPC);
449         g_free(name);
450     }
451     object_initialize_child(obj, "mpc-irq-orgate", &s->mpc_irq_orgate,
452                             TYPE_OR_IRQ);
453 
454     for (i = 0; i < IOTS_NUM_EXP_MPC + info->sram_banks; i++) {
455         char *name = g_strdup_printf("mpc-irq-splitter-%d", i);
456         SplitIRQ *splitter = &s->mpc_irq_splitter[i];
457 
458         object_initialize_child(obj, name, splitter, TYPE_SPLIT_IRQ);
459         g_free(name);
460     }
461 
462     if (info->has_mhus) {
463         object_initialize_child(obj, "mhu0", &s->mhu[0], TYPE_ARMSSE_MHU);
464         object_initialize_child(obj, "mhu1", &s->mhu[1], TYPE_ARMSSE_MHU);
465     }
466     if (info->has_ppus) {
467         for (i = 0; i < info->num_cpus; i++) {
468             char *name = g_strdup_printf("CPU%dCORE_PPU", i);
469             int ppuidx = CPU0CORE_PPU + i;
470 
471             object_initialize_child(obj, name, &s->ppu[ppuidx],
472                                     TYPE_UNIMPLEMENTED_DEVICE);
473             g_free(name);
474         }
475         object_initialize_child(obj, "DBG_PPU", &s->ppu[DBG_PPU],
476                                 TYPE_UNIMPLEMENTED_DEVICE);
477         for (i = 0; i < info->sram_banks; i++) {
478             char *name = g_strdup_printf("RAM%d_PPU", i);
479             int ppuidx = RAM0_PPU + i;
480 
481             object_initialize_child(obj, name, &s->ppu[ppuidx],
482                                     TYPE_UNIMPLEMENTED_DEVICE);
483             g_free(name);
484         }
485     }
486     if (info->has_cachectrl) {
487         for (i = 0; i < info->num_cpus; i++) {
488             char *name = g_strdup_printf("cachectrl%d", i);
489 
490             object_initialize_child(obj, name, &s->cachectrl[i],
491                                     TYPE_UNIMPLEMENTED_DEVICE);
492             g_free(name);
493         }
494     }
495     if (info->has_cpusecctrl) {
496         for (i = 0; i < info->num_cpus; i++) {
497             char *name = g_strdup_printf("cpusecctrl%d", i);
498 
499             object_initialize_child(obj, name, &s->cpusecctrl[i],
500                                     TYPE_UNIMPLEMENTED_DEVICE);
501             g_free(name);
502         }
503     }
504     if (info->has_cpuid) {
505         for (i = 0; i < info->num_cpus; i++) {
506             char *name = g_strdup_printf("cpuid%d", i);
507 
508             object_initialize_child(obj, name, &s->cpuid[i],
509                                     TYPE_ARMSSE_CPUID);
510             g_free(name);
511         }
512     }
513     object_initialize_child(obj, "nmi-orgate", &s->nmi_orgate, TYPE_OR_IRQ);
514     object_initialize_child(obj, "ppc-irq-orgate", &s->ppc_irq_orgate,
515                             TYPE_OR_IRQ);
516     object_initialize_child(obj, "sec-resp-splitter", &s->sec_resp_splitter,
517                             TYPE_SPLIT_IRQ);
518     for (i = 0; i < ARRAY_SIZE(s->ppc_irq_splitter); i++) {
519         char *name = g_strdup_printf("ppc-irq-splitter-%d", i);
520         SplitIRQ *splitter = &s->ppc_irq_splitter[i];
521 
522         object_initialize_child(obj, name, splitter, TYPE_SPLIT_IRQ);
523         g_free(name);
524     }
525     if (info->num_cpus > 1) {
526         for (i = 0; i < ARRAY_SIZE(s->cpu_irq_splitter); i++) {
527             if (irq_is_common[i]) {
528                 char *name = g_strdup_printf("cpu-irq-splitter%d", i);
529                 SplitIRQ *splitter = &s->cpu_irq_splitter[i];
530 
531                 object_initialize_child(obj, name, splitter, TYPE_SPLIT_IRQ);
532                 g_free(name);
533             }
534         }
535     }
536 }
537 
538 static void armsse_exp_irq(void *opaque, int n, int level)
539 {
540     qemu_irq *irqarray = opaque;
541 
542     qemu_set_irq(irqarray[n], level);
543 }
544 
545 static void armsse_mpcexp_status(void *opaque, int n, int level)
546 {
547     ARMSSE *s = ARM_SSE(opaque);
548     qemu_set_irq(s->mpcexp_status_in[n], level);
549 }
550 
551 static qemu_irq armsse_get_common_irq_in(ARMSSE *s, int irqno)
552 {
553     /*
554      * Return a qemu_irq which can be used to signal IRQ n to
555      * all CPUs in the SSE.
556      */
557     ARMSSEClass *asc = ARM_SSE_GET_CLASS(s);
558     const ARMSSEInfo *info = asc->info;
559 
560     assert(irq_is_common[irqno]);
561 
562     if (info->num_cpus == 1) {
563         /* Only one CPU -- just connect directly to it */
564         return qdev_get_gpio_in(DEVICE(&s->armv7m[0]), irqno);
565     } else {
566         /* Connect to the splitter which feeds all CPUs */
567         return qdev_get_gpio_in(DEVICE(&s->cpu_irq_splitter[irqno]), 0);
568     }
569 }
570 
571 static void map_ppu(ARMSSE *s, int ppuidx, const char *name, hwaddr addr)
572 {
573     /* Map a PPU unimplemented device stub */
574     DeviceState *dev = DEVICE(&s->ppu[ppuidx]);
575 
576     qdev_prop_set_string(dev, "name", name);
577     qdev_prop_set_uint64(dev, "size", 0x1000);
578     sysbus_realize(SYS_BUS_DEVICE(dev), &error_fatal);
579     sysbus_mmio_map(SYS_BUS_DEVICE(&s->ppu[ppuidx]), 0, addr);
580 }
581 
582 static void armsse_realize(DeviceState *dev, Error **errp)
583 {
584     ARMSSE *s = ARM_SSE(dev);
585     ARMSSEClass *asc = ARM_SSE_GET_CLASS(dev);
586     const ARMSSEInfo *info = asc->info;
587     const ARMSSEDeviceInfo *devinfo;
588     int i;
589     MemoryRegion *mr;
590     Error *err = NULL;
591     SysBusDevice *sbd_apb_ppc0;
592     SysBusDevice *sbd_secctl;
593     DeviceState *dev_apb_ppc0;
594     DeviceState *dev_apb_ppc1;
595     DeviceState *dev_secctl;
596     DeviceState *dev_splitter;
597     uint32_t addr_width_max;
598 
599     if (!s->board_memory) {
600         error_setg(errp, "memory property was not set");
601         return;
602     }
603 
604     if (!clock_has_source(s->mainclk)) {
605         error_setg(errp, "MAINCLK clock was not connected");
606     }
607     if (!clock_has_source(s->s32kclk)) {
608         error_setg(errp, "S32KCLK clock was not connected");
609     }
610 
611     assert(info->num_cpus <= SSE_MAX_CPUS);
612 
613     /* max SRAM_ADDR_WIDTH: 24 - log2(SRAM_NUM_BANK) */
614     assert(is_power_of_2(info->sram_banks));
615     addr_width_max = 24 - ctz32(info->sram_banks);
616     if (s->sram_addr_width < 1 || s->sram_addr_width > addr_width_max) {
617         error_setg(errp, "SRAM_ADDR_WIDTH must be between 1 and %d",
618                    addr_width_max);
619         return;
620     }
621 
622     /* Handling of which devices should be available only to secure
623      * code is usually done differently for M profile than for A profile.
624      * Instead of putting some devices only into the secure address space,
625      * devices exist in both address spaces but with hard-wired security
626      * permissions that will cause the CPU to fault for non-secure accesses.
627      *
628      * The ARMSSE has an IDAU (Implementation Defined Access Unit),
629      * which specifies hard-wired security permissions for different
630      * areas of the physical address space. For the ARMSSE IDAU, the
631      * top 4 bits of the physical address are the IDAU region ID, and
632      * if bit 28 (ie the lowest bit of the ID) is 0 then this is an NS
633      * region, otherwise it is an S region.
634      *
635      * The various devices and RAMs are generally all mapped twice,
636      * once into a region that the IDAU defines as secure and once
637      * into a non-secure region. They sit behind either a Memory
638      * Protection Controller (for RAM) or a Peripheral Protection
639      * Controller (for devices), which allow a more fine grained
640      * configuration of whether non-secure accesses are permitted.
641      *
642      * (The other place that guest software can configure security
643      * permissions is in the architected SAU (Security Attribution
644      * Unit), which is entirely inside the CPU. The IDAU can upgrade
645      * the security attributes for a region to more restrictive than
646      * the SAU specifies, but cannot downgrade them.)
647      *
648      * 0x10000000..0x1fffffff  alias of 0x00000000..0x0fffffff
649      * 0x20000000..0x2007ffff  32KB FPGA block RAM
650      * 0x30000000..0x3fffffff  alias of 0x20000000..0x2fffffff
651      * 0x40000000..0x4000ffff  base peripheral region 1
652      * 0x40010000..0x4001ffff  CPU peripherals (none for ARMSSE)
653      * 0x40020000..0x4002ffff  system control element peripherals
654      * 0x40080000..0x400fffff  base peripheral region 2
655      * 0x50000000..0x5fffffff  alias of 0x40000000..0x4fffffff
656      */
657 
658     memory_region_add_subregion_overlap(&s->container, 0, s->board_memory, -2);
659 
660     for (i = 0; i < info->num_cpus; i++) {
661         DeviceState *cpudev = DEVICE(&s->armv7m[i]);
662         Object *cpuobj = OBJECT(&s->armv7m[i]);
663         int j;
664         char *gpioname;
665 
666         qdev_prop_set_uint32(cpudev, "num-irq", s->exp_numirq + NUM_SSE_IRQS);
667         /*
668          * In real hardware the initial Secure VTOR is set from the INITSVTOR*
669          * registers in the IoT Kit System Control Register block. In QEMU
670          * we set the initial value here, and also the reset value of the
671          * sysctl register, from this object's QOM init-svtor property.
672          * If the guest changes the INITSVTOR* registers at runtime then the
673          * code in iotkit-sysctl.c will update the CPU init-svtor property
674          * (which will then take effect on the next CPU warm-reset).
675          *
676          * Note that typically a board using the SSE-200 will have a system
677          * control processor whose boot firmware initializes the INITSVTOR*
678          * registers before powering up the CPUs. QEMU doesn't emulate
679          * the control processor, so instead we behave in the way that the
680          * firmware does: the initial value should be set by the board code
681          * (using the init-svtor property on the ARMSSE object) to match
682          * whatever its firmware does.
683          */
684         qdev_prop_set_uint32(cpudev, "init-svtor", s->init_svtor);
685         /*
686          * CPUs start powered down if the corresponding bit in the CPUWAIT
687          * register is 1. In real hardware the CPUWAIT register reset value is
688          * a configurable property of the SSE-200 (via the CPUWAIT0_RST and
689          * CPUWAIT1_RST parameters), but since all the boards we care about
690          * start CPU0 and leave CPU1 powered off, we hard-code that in
691          * info->cpuwait_rst for now. We can add QOM properties for this
692          * later if necessary.
693          */
694         if (extract32(info->cpuwait_rst, i, 1)) {
695             if (!object_property_set_bool(cpuobj, "start-powered-off", true,
696                                           errp)) {
697                 return;
698             }
699         }
700         if (!s->cpu_fpu[i]) {
701             if (!object_property_set_bool(cpuobj, "vfp", false, errp)) {
702                 return;
703             }
704         }
705         if (!s->cpu_dsp[i]) {
706             if (!object_property_set_bool(cpuobj, "dsp", false, errp)) {
707                 return;
708             }
709         }
710 
711         if (i > 0) {
712             memory_region_add_subregion_overlap(&s->cpu_container[i], 0,
713                                                 &s->container_alias[i - 1], -1);
714         } else {
715             memory_region_add_subregion_overlap(&s->cpu_container[i], 0,
716                                                 &s->container, -1);
717         }
718         object_property_set_link(cpuobj, "memory",
719                                  OBJECT(&s->cpu_container[i]), &error_abort);
720         object_property_set_link(cpuobj, "idau", OBJECT(s), &error_abort);
721         if (!sysbus_realize(SYS_BUS_DEVICE(cpuobj), errp)) {
722             return;
723         }
724         /*
725          * The cluster must be realized after the armv7m container, as
726          * the container's CPU object is only created on realize, and the
727          * CPU must exist and have been parented into the cluster before
728          * the cluster is realized.
729          */
730         if (!qdev_realize(DEVICE(&s->cluster[i]), NULL, errp)) {
731             return;
732         }
733 
734         /* Connect EXP_IRQ/EXP_CPUn_IRQ GPIOs to the NVIC's lines 32 and up */
735         s->exp_irqs[i] = g_new(qemu_irq, s->exp_numirq);
736         for (j = 0; j < s->exp_numirq; j++) {
737             s->exp_irqs[i][j] = qdev_get_gpio_in(cpudev, j + NUM_SSE_IRQS);
738         }
739         if (i == 0) {
740             gpioname = g_strdup("EXP_IRQ");
741         } else {
742             gpioname = g_strdup_printf("EXP_CPU%d_IRQ", i);
743         }
744         qdev_init_gpio_in_named_with_opaque(dev, armsse_exp_irq,
745                                             s->exp_irqs[i],
746                                             gpioname, s->exp_numirq);
747         g_free(gpioname);
748     }
749 
750     /* Wire up the splitters that connect common IRQs to all CPUs */
751     if (info->num_cpus > 1) {
752         for (i = 0; i < ARRAY_SIZE(s->cpu_irq_splitter); i++) {
753             if (irq_is_common[i]) {
754                 Object *splitter = OBJECT(&s->cpu_irq_splitter[i]);
755                 DeviceState *devs = DEVICE(splitter);
756                 int cpunum;
757 
758                 if (!object_property_set_int(splitter, "num-lines",
759                                              info->num_cpus, errp)) {
760                     return;
761                 }
762                 if (!qdev_realize(DEVICE(splitter), NULL, errp)) {
763                     return;
764                 }
765                 for (cpunum = 0; cpunum < info->num_cpus; cpunum++) {
766                     DeviceState *cpudev = DEVICE(&s->armv7m[cpunum]);
767 
768                     qdev_connect_gpio_out(devs, cpunum,
769                                           qdev_get_gpio_in(cpudev, i));
770                 }
771             }
772         }
773     }
774 
775     /* Set up the big aliases first */
776     make_alias(s, &s->alias1, &s->container, "alias 1",
777                0x10000000, 0x10000000, 0x00000000);
778     make_alias(s, &s->alias2, &s->container,
779                "alias 2", 0x30000000, 0x10000000, 0x20000000);
780     /* The 0x50000000..0x5fffffff region is not a pure alias: it has
781      * a few extra devices that only appear there (generally the
782      * control interfaces for the protection controllers).
783      * We implement this by mapping those devices over the top of this
784      * alias MR at a higher priority. Some of the devices in this range
785      * are per-CPU, so we must put this alias in the per-cpu containers.
786      */
787     for (i = 0; i < info->num_cpus; i++) {
788         make_alias(s, &s->alias3[i], &s->cpu_container[i],
789                    "alias 3", 0x50000000, 0x10000000, 0x40000000);
790     }
791 
792     /* Security controller */
793     object_property_set_int(OBJECT(&s->secctl), "sse-version",
794                             info->sse_version, &error_abort);
795     if (!sysbus_realize(SYS_BUS_DEVICE(&s->secctl), errp)) {
796         return;
797     }
798     sbd_secctl = SYS_BUS_DEVICE(&s->secctl);
799     dev_secctl = DEVICE(&s->secctl);
800     sysbus_mmio_map(sbd_secctl, 0, 0x50080000);
801     sysbus_mmio_map(sbd_secctl, 1, 0x40080000);
802 
803     s->nsc_cfg_in = qemu_allocate_irq(nsccfg_handler, s, 1);
804     qdev_connect_gpio_out_named(dev_secctl, "nsc_cfg", 0, s->nsc_cfg_in);
805 
806     /* The sec_resp_cfg output from the security controller must be split into
807      * multiple lines, one for each of the PPCs within the ARMSSE and one
808      * that will be an output from the ARMSSE to the system.
809      */
810     if (!object_property_set_int(OBJECT(&s->sec_resp_splitter),
811                                  "num-lines", 3, errp)) {
812         return;
813     }
814     if (!qdev_realize(DEVICE(&s->sec_resp_splitter), NULL, errp)) {
815         return;
816     }
817     dev_splitter = DEVICE(&s->sec_resp_splitter);
818     qdev_connect_gpio_out_named(dev_secctl, "sec_resp_cfg", 0,
819                                 qdev_get_gpio_in(dev_splitter, 0));
820 
821     /* Each SRAM bank lives behind its own Memory Protection Controller */
822     for (i = 0; i < info->sram_banks; i++) {
823         char *ramname = g_strdup_printf("armsse.sram%d", i);
824         SysBusDevice *sbd_mpc;
825         uint32_t sram_bank_size = 1 << s->sram_addr_width;
826 
827         memory_region_init_ram(&s->sram[i], NULL, ramname,
828                                sram_bank_size, &err);
829         g_free(ramname);
830         if (err) {
831             error_propagate(errp, err);
832             return;
833         }
834         object_property_set_link(OBJECT(&s->mpc[i]), "downstream",
835                                  OBJECT(&s->sram[i]), &error_abort);
836         if (!sysbus_realize(SYS_BUS_DEVICE(&s->mpc[i]), errp)) {
837             return;
838         }
839         /* Map the upstream end of the MPC into the right place... */
840         sbd_mpc = SYS_BUS_DEVICE(&s->mpc[i]);
841         memory_region_add_subregion(&s->container,
842                                     0x20000000 + i * sram_bank_size,
843                                     sysbus_mmio_get_region(sbd_mpc, 1));
844         /* ...and its register interface */
845         memory_region_add_subregion(&s->container, 0x50083000 + i * 0x1000,
846                                     sysbus_mmio_get_region(sbd_mpc, 0));
847     }
848 
849     /* We must OR together lines from the MPC splitters to go to the NVIC */
850     if (!object_property_set_int(OBJECT(&s->mpc_irq_orgate), "num-lines",
851                                  IOTS_NUM_EXP_MPC + info->sram_banks,
852                                  errp)) {
853         return;
854     }
855     if (!qdev_realize(DEVICE(&s->mpc_irq_orgate), NULL, errp)) {
856         return;
857     }
858     qdev_connect_gpio_out(DEVICE(&s->mpc_irq_orgate), 0,
859                           armsse_get_common_irq_in(s, 9));
860 
861     /* This OR gate wires together outputs from the secure watchdogs to NMI */
862     if (!object_property_set_int(OBJECT(&s->nmi_orgate), "num-lines", 2,
863                                  errp)) {
864         return;
865     }
866     if (!qdev_realize(DEVICE(&s->nmi_orgate), NULL, errp)) {
867         return;
868     }
869     qdev_connect_gpio_out(DEVICE(&s->nmi_orgate), 0,
870                           qdev_get_gpio_in_named(DEVICE(&s->armv7m), "NMI", 0));
871 
872     /* Devices behind APB PPC0:
873      *   0x40000000: timer0
874      *   0x40001000: timer1
875      *   0x40002000: dual timer
876      *   0x40003000: MHU0 (SSE-200 only)
877      *   0x40004000: MHU1 (SSE-200 only)
878      * We must configure and realize each downstream device and connect
879      * it to the appropriate PPC port; then we can realize the PPC and
880      * map its upstream ends to the right place in the container.
881      */
882     for (devinfo = info->devinfo; devinfo->name; devinfo++) {
883         SysBusDevice *sbd;
884         qemu_irq irq;
885 
886         if (!strcmp(devinfo->type, TYPE_CMSDK_APB_TIMER)) {
887             sbd = SYS_BUS_DEVICE(&s->timer[devinfo->index]);
888 
889             qdev_connect_clock_in(DEVICE(sbd), "pclk",
890                                   devinfo->slowclk ? s->s32kclk : s->mainclk);
891             if (!sysbus_realize(sbd, errp)) {
892                 return;
893             }
894             mr = sysbus_mmio_get_region(sbd, 0);
895         } else if (!strcmp(devinfo->type, TYPE_CMSDK_APB_DUALTIMER)) {
896             sbd = SYS_BUS_DEVICE(&s->dualtimer);
897 
898             qdev_connect_clock_in(DEVICE(sbd), "TIMCLK", s->mainclk);
899             if (!sysbus_realize(sbd, errp)) {
900                 return;
901             }
902             mr = sysbus_mmio_get_region(sbd, 0);
903         } else if (!strcmp(devinfo->type, TYPE_CMSDK_APB_WATCHDOG)) {
904             sbd = SYS_BUS_DEVICE(&s->cmsdk_watchdog[devinfo->index]);
905 
906             qdev_connect_clock_in(DEVICE(sbd), "WDOGCLK",
907                                   devinfo->slowclk ? s->s32kclk : s->mainclk);
908             if (!sysbus_realize(sbd, errp)) {
909                 return;
910             }
911             mr = sysbus_mmio_get_region(sbd, 0);
912         } else if (!strcmp(devinfo->type, TYPE_IOTKIT_SYSINFO)) {
913             sbd = SYS_BUS_DEVICE(&s->sysinfo);
914 
915             object_property_set_int(OBJECT(&s->sysinfo), "SYS_VERSION",
916                                     info->sys_version, &error_abort);
917             object_property_set_int(OBJECT(&s->sysinfo), "SYS_CONFIG",
918                                     armsse_sys_config_value(s, info),
919                                     &error_abort);
920             object_property_set_int(OBJECT(&s->sysinfo), "sse-version",
921                                     info->sse_version, &error_abort);
922             object_property_set_int(OBJECT(&s->sysinfo), "IIDR",
923                                     info->iidr, &error_abort);
924             if (!sysbus_realize(sbd, errp)) {
925                 return;
926             }
927             mr = sysbus_mmio_get_region(sbd, 0);
928         } else if (!strcmp(devinfo->type, TYPE_IOTKIT_SYSCTL)) {
929             /* System control registers */
930             sbd = SYS_BUS_DEVICE(&s->sysctl);
931 
932             object_property_set_int(OBJECT(&s->sysctl), "sse-version",
933                                     info->sse_version, &error_abort);
934             object_property_set_int(OBJECT(&s->sysctl), "CPUWAIT_RST",
935                                     info->cpuwait_rst, &error_abort);
936             object_property_set_int(OBJECT(&s->sysctl), "INITSVTOR0_RST",
937                                     s->init_svtor, &error_abort);
938             object_property_set_int(OBJECT(&s->sysctl), "INITSVTOR1_RST",
939                                     s->init_svtor, &error_abort);
940             if (!sysbus_realize(sbd, errp)) {
941                 return;
942             }
943             mr = sysbus_mmio_get_region(sbd, 0);
944         } else {
945             g_assert_not_reached();
946         }
947 
948         switch (devinfo->irq) {
949         case NO_IRQ:
950             irq = NULL;
951             break;
952         case 0 ... NUM_SSE_IRQS - 1:
953             irq = armsse_get_common_irq_in(s, devinfo->irq);
954             break;
955         case NMI_0:
956         case NMI_1:
957             irq = qdev_get_gpio_in(DEVICE(&s->nmi_orgate),
958                                    devinfo->irq - NMI_0);
959             break;
960         default:
961             g_assert_not_reached();
962         }
963 
964         if (irq) {
965             sysbus_connect_irq(sbd, 0, irq);
966         }
967 
968         /*
969          * Devices connected to a PPC are connected to the port here;
970          * we will map the upstream end of that port to the right address
971          * in the container later after the PPC has been realized.
972          * Devices not connected to a PPC can be mapped immediately.
973          */
974         if (devinfo->ppc != NO_PPC) {
975             TZPPC *ppc = &s->apb_ppc[devinfo->ppc];
976             g_autofree char *portname = g_strdup_printf("port[%d]",
977                                                         devinfo->ppc_port);
978             object_property_set_link(OBJECT(ppc), portname, OBJECT(mr),
979                                      &error_abort);
980         } else {
981             memory_region_add_subregion(&s->container, devinfo->addr, mr);
982         }
983     }
984 
985     if (info->has_mhus) {
986         /*
987          * An SSE-200 with only one CPU should have only one MHU created,
988          * with the region where the second MHU usually is being RAZ/WI.
989          * We don't implement that SSE-200 config; if we want to support
990          * it then this code needs to be enhanced to handle creating the
991          * RAZ/WI region instead of the second MHU.
992          */
993         assert(info->num_cpus == ARRAY_SIZE(s->mhu));
994 
995         for (i = 0; i < ARRAY_SIZE(s->mhu); i++) {
996             char *port;
997             int cpunum;
998             SysBusDevice *mhu_sbd = SYS_BUS_DEVICE(&s->mhu[i]);
999 
1000             if (!sysbus_realize(SYS_BUS_DEVICE(&s->mhu[i]), errp)) {
1001                 return;
1002             }
1003             port = g_strdup_printf("port[%d]", i + 3);
1004             mr = sysbus_mmio_get_region(mhu_sbd, 0);
1005             object_property_set_link(OBJECT(&s->apb_ppc[0]), port, OBJECT(mr),
1006                                      &error_abort);
1007             g_free(port);
1008 
1009             /*
1010              * Each MHU has an irq line for each CPU:
1011              *  MHU 0 irq line 0 -> CPU 0 IRQ 6
1012              *  MHU 0 irq line 1 -> CPU 1 IRQ 6
1013              *  MHU 1 irq line 0 -> CPU 0 IRQ 7
1014              *  MHU 1 irq line 1 -> CPU 1 IRQ 7
1015              */
1016             for (cpunum = 0; cpunum < info->num_cpus; cpunum++) {
1017                 DeviceState *cpudev = DEVICE(&s->armv7m[cpunum]);
1018 
1019                 sysbus_connect_irq(mhu_sbd, cpunum,
1020                                    qdev_get_gpio_in(cpudev, 6 + i));
1021             }
1022         }
1023     }
1024 
1025     if (!sysbus_realize(SYS_BUS_DEVICE(&s->apb_ppc[0]), errp)) {
1026         return;
1027     }
1028 
1029     sbd_apb_ppc0 = SYS_BUS_DEVICE(&s->apb_ppc[0]);
1030     dev_apb_ppc0 = DEVICE(&s->apb_ppc[0]);
1031 
1032     if (info->has_mhus) {
1033         mr = sysbus_mmio_get_region(sbd_apb_ppc0, 3);
1034         memory_region_add_subregion(&s->container, 0x40003000, mr);
1035         mr = sysbus_mmio_get_region(sbd_apb_ppc0, 4);
1036         memory_region_add_subregion(&s->container, 0x40004000, mr);
1037     }
1038     for (i = 0; i < IOTS_APB_PPC0_NUM_PORTS; i++) {
1039         qdev_connect_gpio_out_named(dev_secctl, "apb_ppc0_nonsec", i,
1040                                     qdev_get_gpio_in_named(dev_apb_ppc0,
1041                                                            "cfg_nonsec", i));
1042         qdev_connect_gpio_out_named(dev_secctl, "apb_ppc0_ap", i,
1043                                     qdev_get_gpio_in_named(dev_apb_ppc0,
1044                                                            "cfg_ap", i));
1045     }
1046     qdev_connect_gpio_out_named(dev_secctl, "apb_ppc0_irq_enable", 0,
1047                                 qdev_get_gpio_in_named(dev_apb_ppc0,
1048                                                        "irq_enable", 0));
1049     qdev_connect_gpio_out_named(dev_secctl, "apb_ppc0_irq_clear", 0,
1050                                 qdev_get_gpio_in_named(dev_apb_ppc0,
1051                                                        "irq_clear", 0));
1052     qdev_connect_gpio_out(dev_splitter, 0,
1053                           qdev_get_gpio_in_named(dev_apb_ppc0,
1054                                                  "cfg_sec_resp", 0));
1055 
1056     /* All the PPC irq lines (from the 2 internal PPCs and the 8 external
1057      * ones) are sent individually to the security controller, and also
1058      * ORed together to give a single combined PPC interrupt to the NVIC.
1059      */
1060     if (!object_property_set_int(OBJECT(&s->ppc_irq_orgate),
1061                                  "num-lines", NUM_PPCS, errp)) {
1062         return;
1063     }
1064     if (!qdev_realize(DEVICE(&s->ppc_irq_orgate), NULL, errp)) {
1065         return;
1066     }
1067     qdev_connect_gpio_out(DEVICE(&s->ppc_irq_orgate), 0,
1068                           armsse_get_common_irq_in(s, 10));
1069 
1070     /*
1071      * 0x40010000 .. 0x4001ffff (and the 0x5001000... secure-only alias):
1072      * private per-CPU region (all these devices are SSE-200 only):
1073      *  0x50010000: L1 icache control registers
1074      *  0x50011000: CPUSECCTRL (CPU local security control registers)
1075      *  0x4001f000 and 0x5001f000: CPU_IDENTITY register block
1076      */
1077     if (info->has_cachectrl) {
1078         for (i = 0; i < info->num_cpus; i++) {
1079             char *name = g_strdup_printf("cachectrl%d", i);
1080             MemoryRegion *mr;
1081 
1082             qdev_prop_set_string(DEVICE(&s->cachectrl[i]), "name", name);
1083             g_free(name);
1084             qdev_prop_set_uint64(DEVICE(&s->cachectrl[i]), "size", 0x1000);
1085             if (!sysbus_realize(SYS_BUS_DEVICE(&s->cachectrl[i]), errp)) {
1086                 return;
1087             }
1088 
1089             mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->cachectrl[i]), 0);
1090             memory_region_add_subregion(&s->cpu_container[i], 0x50010000, mr);
1091         }
1092     }
1093     if (info->has_cpusecctrl) {
1094         for (i = 0; i < info->num_cpus; i++) {
1095             char *name = g_strdup_printf("CPUSECCTRL%d", i);
1096             MemoryRegion *mr;
1097 
1098             qdev_prop_set_string(DEVICE(&s->cpusecctrl[i]), "name", name);
1099             g_free(name);
1100             qdev_prop_set_uint64(DEVICE(&s->cpusecctrl[i]), "size", 0x1000);
1101             if (!sysbus_realize(SYS_BUS_DEVICE(&s->cpusecctrl[i]), errp)) {
1102                 return;
1103             }
1104 
1105             mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->cpusecctrl[i]), 0);
1106             memory_region_add_subregion(&s->cpu_container[i], 0x50011000, mr);
1107         }
1108     }
1109     if (info->has_cpuid) {
1110         for (i = 0; i < info->num_cpus; i++) {
1111             MemoryRegion *mr;
1112 
1113             qdev_prop_set_uint32(DEVICE(&s->cpuid[i]), "CPUID", i);
1114             if (!sysbus_realize(SYS_BUS_DEVICE(&s->cpuid[i]), errp)) {
1115                 return;
1116             }
1117 
1118             mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->cpuid[i]), 0);
1119             memory_region_add_subregion(&s->cpu_container[i], 0x4001F000, mr);
1120         }
1121     }
1122 
1123     if (!sysbus_realize(SYS_BUS_DEVICE(&s->apb_ppc[1]), errp)) {
1124         return;
1125     }
1126 
1127     dev_apb_ppc1 = DEVICE(&s->apb_ppc[1]);
1128     qdev_connect_gpio_out_named(dev_secctl, "apb_ppc1_nonsec", 0,
1129                                 qdev_get_gpio_in_named(dev_apb_ppc1,
1130                                                        "cfg_nonsec", 0));
1131     qdev_connect_gpio_out_named(dev_secctl, "apb_ppc1_ap", 0,
1132                                 qdev_get_gpio_in_named(dev_apb_ppc1,
1133                                                        "cfg_ap", 0));
1134     qdev_connect_gpio_out_named(dev_secctl, "apb_ppc1_irq_enable", 0,
1135                                 qdev_get_gpio_in_named(dev_apb_ppc1,
1136                                                        "irq_enable", 0));
1137     qdev_connect_gpio_out_named(dev_secctl, "apb_ppc1_irq_clear", 0,
1138                                 qdev_get_gpio_in_named(dev_apb_ppc1,
1139                                                        "irq_clear", 0));
1140     qdev_connect_gpio_out(dev_splitter, 1,
1141                           qdev_get_gpio_in_named(dev_apb_ppc1,
1142                                                  "cfg_sec_resp", 0));
1143 
1144     /*
1145      * Now both PPCs are realized we can map the upstream ends of
1146      * ports which correspond to entries in the devinfo array.
1147      * The ports which are connected to non-devinfo devices have
1148      * already been mapped.
1149      */
1150     for (devinfo = info->devinfo; devinfo->name; devinfo++) {
1151         SysBusDevice *ppc_sbd;
1152 
1153         if (devinfo->ppc == NO_PPC) {
1154             continue;
1155         }
1156         ppc_sbd = SYS_BUS_DEVICE(&s->apb_ppc[devinfo->ppc]);
1157         mr = sysbus_mmio_get_region(ppc_sbd, devinfo->ppc_port);
1158         memory_region_add_subregion(&s->container, devinfo->addr, mr);
1159     }
1160 
1161     if (info->has_ppus) {
1162         /* CPUnCORE_PPU for each CPU */
1163         for (i = 0; i < info->num_cpus; i++) {
1164             char *name = g_strdup_printf("CPU%dCORE_PPU", i);
1165 
1166             map_ppu(s, CPU0CORE_PPU + i, name, 0x50023000 + i * 0x2000);
1167             /*
1168              * We don't support CPU debug so don't create the
1169              * CPU0DEBUG_PPU at 0x50024000 and 0x50026000.
1170              */
1171             g_free(name);
1172         }
1173         map_ppu(s, DBG_PPU, "DBG_PPU", 0x50029000);
1174 
1175         for (i = 0; i < info->sram_banks; i++) {
1176             char *name = g_strdup_printf("RAM%d_PPU", i);
1177 
1178             map_ppu(s, RAM0_PPU + i, name, 0x5002a000 + i * 0x1000);
1179             g_free(name);
1180         }
1181     }
1182 
1183     for (i = 0; i < ARRAY_SIZE(s->ppc_irq_splitter); i++) {
1184         Object *splitter = OBJECT(&s->ppc_irq_splitter[i]);
1185 
1186         if (!object_property_set_int(splitter, "num-lines", 2, errp)) {
1187             return;
1188         }
1189         if (!qdev_realize(DEVICE(splitter), NULL, errp)) {
1190             return;
1191         }
1192     }
1193 
1194     for (i = 0; i < IOTS_NUM_AHB_EXP_PPC; i++) {
1195         char *ppcname = g_strdup_printf("ahb_ppcexp%d", i);
1196 
1197         armsse_forward_ppc(s, ppcname, i);
1198         g_free(ppcname);
1199     }
1200 
1201     for (i = 0; i < IOTS_NUM_APB_EXP_PPC; i++) {
1202         char *ppcname = g_strdup_printf("apb_ppcexp%d", i);
1203 
1204         armsse_forward_ppc(s, ppcname, i + IOTS_NUM_AHB_EXP_PPC);
1205         g_free(ppcname);
1206     }
1207 
1208     for (i = NUM_EXTERNAL_PPCS; i < NUM_PPCS; i++) {
1209         /* Wire up IRQ splitter for internal PPCs */
1210         DeviceState *devs = DEVICE(&s->ppc_irq_splitter[i]);
1211         char *gpioname = g_strdup_printf("apb_ppc%d_irq_status",
1212                                          i - NUM_EXTERNAL_PPCS);
1213         TZPPC *ppc = &s->apb_ppc[i - NUM_EXTERNAL_PPCS];
1214 
1215         qdev_connect_gpio_out(devs, 0,
1216                               qdev_get_gpio_in_named(dev_secctl, gpioname, 0));
1217         qdev_connect_gpio_out(devs, 1,
1218                               qdev_get_gpio_in(DEVICE(&s->ppc_irq_orgate), i));
1219         qdev_connect_gpio_out_named(DEVICE(ppc), "irq", 0,
1220                                     qdev_get_gpio_in(devs, 0));
1221         g_free(gpioname);
1222     }
1223 
1224     /* Wire up the splitters for the MPC IRQs */
1225     for (i = 0; i < IOTS_NUM_EXP_MPC + info->sram_banks; i++) {
1226         SplitIRQ *splitter = &s->mpc_irq_splitter[i];
1227         DeviceState *dev_splitter = DEVICE(splitter);
1228 
1229         if (!object_property_set_int(OBJECT(splitter), "num-lines", 2,
1230                                      errp)) {
1231             return;
1232         }
1233         if (!qdev_realize(DEVICE(splitter), NULL, errp)) {
1234             return;
1235         }
1236 
1237         if (i < IOTS_NUM_EXP_MPC) {
1238             /* Splitter input is from GPIO input line */
1239             s->mpcexp_status_in[i] = qdev_get_gpio_in(dev_splitter, 0);
1240             qdev_connect_gpio_out(dev_splitter, 0,
1241                                   qdev_get_gpio_in_named(dev_secctl,
1242                                                          "mpcexp_status", i));
1243         } else {
1244             /* Splitter input is from our own MPC */
1245             qdev_connect_gpio_out_named(DEVICE(&s->mpc[i - IOTS_NUM_EXP_MPC]),
1246                                         "irq", 0,
1247                                         qdev_get_gpio_in(dev_splitter, 0));
1248             qdev_connect_gpio_out(dev_splitter, 0,
1249                                   qdev_get_gpio_in_named(dev_secctl,
1250                                                          "mpc_status",
1251                                                          i - IOTS_NUM_EXP_MPC));
1252         }
1253 
1254         qdev_connect_gpio_out(dev_splitter, 1,
1255                               qdev_get_gpio_in(DEVICE(&s->mpc_irq_orgate), i));
1256     }
1257     /* Create GPIO inputs which will pass the line state for our
1258      * mpcexp_irq inputs to the correct splitter devices.
1259      */
1260     qdev_init_gpio_in_named(dev, armsse_mpcexp_status, "mpcexp_status",
1261                             IOTS_NUM_EXP_MPC);
1262 
1263     armsse_forward_sec_resp_cfg(s);
1264 
1265     /* Forward the MSC related signals */
1266     qdev_pass_gpios(dev_secctl, dev, "mscexp_status");
1267     qdev_pass_gpios(dev_secctl, dev, "mscexp_clear");
1268     qdev_pass_gpios(dev_secctl, dev, "mscexp_ns");
1269     qdev_connect_gpio_out_named(dev_secctl, "msc_irq", 0,
1270                                 armsse_get_common_irq_in(s, 11));
1271 
1272     /*
1273      * Expose our container region to the board model; this corresponds
1274      * to the AHB Slave Expansion ports which allow bus master devices
1275      * (eg DMA controllers) in the board model to make transactions into
1276      * devices in the ARMSSE.
1277      */
1278     sysbus_init_mmio(SYS_BUS_DEVICE(s), &s->container);
1279 
1280     /* Set initial system_clock_scale from MAINCLK */
1281     armsse_mainclk_update(s, ClockUpdate);
1282 }
1283 
1284 static void armsse_idau_check(IDAUInterface *ii, uint32_t address,
1285                               int *iregion, bool *exempt, bool *ns, bool *nsc)
1286 {
1287     /*
1288      * For ARMSSE systems the IDAU responses are simple logical functions
1289      * of the address bits. The NSC attribute is guest-adjustable via the
1290      * NSCCFG register in the security controller.
1291      */
1292     ARMSSE *s = ARM_SSE(ii);
1293     int region = extract32(address, 28, 4);
1294 
1295     *ns = !(region & 1);
1296     *nsc = (region == 1 && (s->nsccfg & 1)) || (region == 3 && (s->nsccfg & 2));
1297     /* 0xe0000000..0xe00fffff and 0xf0000000..0xf00fffff are exempt */
1298     *exempt = (address & 0xeff00000) == 0xe0000000;
1299     *iregion = region;
1300 }
1301 
1302 static const VMStateDescription armsse_vmstate = {
1303     .name = "iotkit",
1304     .version_id = 2,
1305     .minimum_version_id = 2,
1306     .fields = (VMStateField[]) {
1307         VMSTATE_CLOCK(mainclk, ARMSSE),
1308         VMSTATE_CLOCK(s32kclk, ARMSSE),
1309         VMSTATE_UINT32(nsccfg, ARMSSE),
1310         VMSTATE_END_OF_LIST()
1311     }
1312 };
1313 
1314 static void armsse_reset(DeviceState *dev)
1315 {
1316     ARMSSE *s = ARM_SSE(dev);
1317 
1318     s->nsccfg = 0;
1319 }
1320 
1321 static void armsse_class_init(ObjectClass *klass, void *data)
1322 {
1323     DeviceClass *dc = DEVICE_CLASS(klass);
1324     IDAUInterfaceClass *iic = IDAU_INTERFACE_CLASS(klass);
1325     ARMSSEClass *asc = ARM_SSE_CLASS(klass);
1326     const ARMSSEInfo *info = data;
1327 
1328     dc->realize = armsse_realize;
1329     dc->vmsd = &armsse_vmstate;
1330     device_class_set_props(dc, info->props);
1331     dc->reset = armsse_reset;
1332     iic->check = armsse_idau_check;
1333     asc->info = info;
1334 }
1335 
1336 static const TypeInfo armsse_info = {
1337     .name = TYPE_ARM_SSE,
1338     .parent = TYPE_SYS_BUS_DEVICE,
1339     .instance_size = sizeof(ARMSSE),
1340     .class_size = sizeof(ARMSSEClass),
1341     .instance_init = armsse_init,
1342     .abstract = true,
1343     .interfaces = (InterfaceInfo[]) {
1344         { TYPE_IDAU_INTERFACE },
1345         { }
1346     }
1347 };
1348 
1349 static void armsse_register_types(void)
1350 {
1351     int i;
1352 
1353     type_register_static(&armsse_info);
1354 
1355     for (i = 0; i < ARRAY_SIZE(armsse_variants); i++) {
1356         TypeInfo ti = {
1357             .name = armsse_variants[i].name,
1358             .parent = TYPE_ARM_SSE,
1359             .class_init = armsse_class_init,
1360             .class_data = (void *)&armsse_variants[i],
1361         };
1362         type_register(&ti);
1363     }
1364 }
1365 
1366 type_init(armsse_register_types);
1367