1 /* 2 * Arm IoT Kit 3 * 4 * Copyright (c) 2018 Linaro Limited 5 * Written by Peter Maydell 6 * 7 * This program is free software; you can redistribute it and/or modify 8 * it under the terms of the GNU General Public License version 2 or 9 * (at your option) any later version. 10 */ 11 12 #include "qemu/osdep.h" 13 #include "qemu/log.h" 14 #include "qapi/error.h" 15 #include "trace.h" 16 #include "hw/sysbus.h" 17 #include "hw/registerfields.h" 18 #include "hw/arm/iotkit.h" 19 #include "hw/misc/unimp.h" 20 #include "hw/arm/arm.h" 21 22 /* Clock frequency in HZ of the 32KHz "slow clock" */ 23 #define S32KCLK (32 * 1000) 24 25 /* Create an alias region of @size bytes starting at @base 26 * which mirrors the memory starting at @orig. 27 */ 28 static void make_alias(IoTKit *s, MemoryRegion *mr, const char *name, 29 hwaddr base, hwaddr size, hwaddr orig) 30 { 31 memory_region_init_alias(mr, NULL, name, &s->container, orig, size); 32 /* The alias is even lower priority than unimplemented_device regions */ 33 memory_region_add_subregion_overlap(&s->container, base, mr, -1500); 34 } 35 36 static void irq_status_forwarder(void *opaque, int n, int level) 37 { 38 qemu_irq destirq = opaque; 39 40 qemu_set_irq(destirq, level); 41 } 42 43 static void nsccfg_handler(void *opaque, int n, int level) 44 { 45 IoTKit *s = IOTKIT(opaque); 46 47 s->nsccfg = level; 48 } 49 50 static void iotkit_forward_ppc(IoTKit *s, const char *ppcname, int ppcnum) 51 { 52 /* Each of the 4 AHB and 4 APB PPCs that might be present in a 53 * system using the IoTKit has a collection of control lines which 54 * are provided by the security controller and which we want to 55 * expose as control lines on the IoTKit device itself, so the 56 * code using the IoTKit can wire them up to the PPCs. 57 */ 58 SplitIRQ *splitter = &s->ppc_irq_splitter[ppcnum]; 59 DeviceState *iotkitdev = DEVICE(s); 60 DeviceState *dev_secctl = DEVICE(&s->secctl); 61 DeviceState *dev_splitter = DEVICE(splitter); 62 char *name; 63 64 name = g_strdup_printf("%s_nonsec", ppcname); 65 qdev_pass_gpios(dev_secctl, iotkitdev, name); 66 g_free(name); 67 name = g_strdup_printf("%s_ap", ppcname); 68 qdev_pass_gpios(dev_secctl, iotkitdev, name); 69 g_free(name); 70 name = g_strdup_printf("%s_irq_enable", ppcname); 71 qdev_pass_gpios(dev_secctl, iotkitdev, name); 72 g_free(name); 73 name = g_strdup_printf("%s_irq_clear", ppcname); 74 qdev_pass_gpios(dev_secctl, iotkitdev, name); 75 g_free(name); 76 77 /* irq_status is a little more tricky, because we need to 78 * split it so we can send it both to the security controller 79 * and to our OR gate for the NVIC interrupt line. 80 * Connect up the splitter's outputs, and create a GPIO input 81 * which will pass the line state to the input splitter. 82 */ 83 name = g_strdup_printf("%s_irq_status", ppcname); 84 qdev_connect_gpio_out(dev_splitter, 0, 85 qdev_get_gpio_in_named(dev_secctl, 86 name, 0)); 87 qdev_connect_gpio_out(dev_splitter, 1, 88 qdev_get_gpio_in(DEVICE(&s->ppc_irq_orgate), ppcnum)); 89 s->irq_status_in[ppcnum] = qdev_get_gpio_in(dev_splitter, 0); 90 qdev_init_gpio_in_named_with_opaque(iotkitdev, irq_status_forwarder, 91 s->irq_status_in[ppcnum], name, 1); 92 g_free(name); 93 } 94 95 static void iotkit_forward_sec_resp_cfg(IoTKit *s) 96 { 97 /* Forward the 3rd output from the splitter device as a 98 * named GPIO output of the iotkit object. 99 */ 100 DeviceState *dev = DEVICE(s); 101 DeviceState *dev_splitter = DEVICE(&s->sec_resp_splitter); 102 103 qdev_init_gpio_out_named(dev, &s->sec_resp_cfg, "sec_resp_cfg", 1); 104 s->sec_resp_cfg_in = qemu_allocate_irq(irq_status_forwarder, 105 s->sec_resp_cfg, 1); 106 qdev_connect_gpio_out(dev_splitter, 2, s->sec_resp_cfg_in); 107 } 108 109 static void iotkit_init(Object *obj) 110 { 111 IoTKit *s = IOTKIT(obj); 112 int i; 113 114 memory_region_init(&s->container, obj, "iotkit-container", UINT64_MAX); 115 116 sysbus_init_child_obj(obj, "armv7m", &s->armv7m, sizeof(s->armv7m), 117 TYPE_ARMV7M); 118 qdev_prop_set_string(DEVICE(&s->armv7m), "cpu-type", 119 ARM_CPU_TYPE_NAME("cortex-m33")); 120 121 sysbus_init_child_obj(obj, "secctl", &s->secctl, sizeof(s->secctl), 122 TYPE_IOTKIT_SECCTL); 123 sysbus_init_child_obj(obj, "apb-ppc0", &s->apb_ppc0, sizeof(s->apb_ppc0), 124 TYPE_TZ_PPC); 125 sysbus_init_child_obj(obj, "apb-ppc1", &s->apb_ppc1, sizeof(s->apb_ppc1), 126 TYPE_TZ_PPC); 127 sysbus_init_child_obj(obj, "mpc", &s->mpc, sizeof(s->mpc), TYPE_TZ_MPC); 128 object_initialize_child(obj, "mpc-irq-orgate", &s->mpc_irq_orgate, 129 sizeof(s->mpc_irq_orgate), TYPE_OR_IRQ, 130 &error_abort, NULL); 131 132 for (i = 0; i < ARRAY_SIZE(s->mpc_irq_splitter); i++) { 133 char *name = g_strdup_printf("mpc-irq-splitter-%d", i); 134 SplitIRQ *splitter = &s->mpc_irq_splitter[i]; 135 136 object_initialize_child(obj, name, splitter, sizeof(*splitter), 137 TYPE_SPLIT_IRQ, &error_abort, NULL); 138 g_free(name); 139 } 140 sysbus_init_child_obj(obj, "timer0", &s->timer0, sizeof(s->timer0), 141 TYPE_CMSDK_APB_TIMER); 142 sysbus_init_child_obj(obj, "timer1", &s->timer1, sizeof(s->timer1), 143 TYPE_CMSDK_APB_TIMER); 144 sysbus_init_child_obj(obj, "s32ktimer", &s->s32ktimer, sizeof(s->s32ktimer), 145 TYPE_CMSDK_APB_TIMER); 146 sysbus_init_child_obj(obj, "dualtimer", &s->dualtimer, sizeof(s->dualtimer), 147 TYPE_CMSDK_APB_DUALTIMER); 148 sysbus_init_child_obj(obj, "s32kwatchdog", &s->s32kwatchdog, 149 sizeof(s->s32kwatchdog), TYPE_CMSDK_APB_WATCHDOG); 150 sysbus_init_child_obj(obj, "nswatchdog", &s->nswatchdog, 151 sizeof(s->nswatchdog), TYPE_CMSDK_APB_WATCHDOG); 152 sysbus_init_child_obj(obj, "swatchdog", &s->swatchdog, 153 sizeof(s->swatchdog), TYPE_CMSDK_APB_WATCHDOG); 154 object_initialize_child(obj, "nmi-orgate", &s->nmi_orgate, 155 sizeof(s->nmi_orgate), TYPE_OR_IRQ, 156 &error_abort, NULL); 157 object_initialize_child(obj, "ppc-irq-orgate", &s->ppc_irq_orgate, 158 sizeof(s->ppc_irq_orgate), TYPE_OR_IRQ, 159 &error_abort, NULL); 160 object_initialize_child(obj, "sec-resp-splitter", &s->sec_resp_splitter, 161 sizeof(s->sec_resp_splitter), TYPE_SPLIT_IRQ, 162 &error_abort, NULL); 163 for (i = 0; i < ARRAY_SIZE(s->ppc_irq_splitter); i++) { 164 char *name = g_strdup_printf("ppc-irq-splitter-%d", i); 165 SplitIRQ *splitter = &s->ppc_irq_splitter[i]; 166 167 object_initialize_child(obj, name, splitter, sizeof(*splitter), 168 TYPE_SPLIT_IRQ, &error_abort, NULL); 169 g_free(name); 170 } 171 } 172 173 static void iotkit_exp_irq(void *opaque, int n, int level) 174 { 175 IoTKit *s = IOTKIT(opaque); 176 177 qemu_set_irq(s->exp_irqs[n], level); 178 } 179 180 static void iotkit_mpcexp_status(void *opaque, int n, int level) 181 { 182 IoTKit *s = IOTKIT(opaque); 183 qemu_set_irq(s->mpcexp_status_in[n], level); 184 } 185 186 static void iotkit_realize(DeviceState *dev, Error **errp) 187 { 188 IoTKit *s = IOTKIT(dev); 189 int i; 190 MemoryRegion *mr; 191 Error *err = NULL; 192 SysBusDevice *sbd_apb_ppc0; 193 SysBusDevice *sbd_secctl; 194 DeviceState *dev_apb_ppc0; 195 DeviceState *dev_apb_ppc1; 196 DeviceState *dev_secctl; 197 DeviceState *dev_splitter; 198 199 if (!s->board_memory) { 200 error_setg(errp, "memory property was not set"); 201 return; 202 } 203 204 if (!s->mainclk_frq) { 205 error_setg(errp, "MAINCLK property was not set"); 206 return; 207 } 208 209 /* Handling of which devices should be available only to secure 210 * code is usually done differently for M profile than for A profile. 211 * Instead of putting some devices only into the secure address space, 212 * devices exist in both address spaces but with hard-wired security 213 * permissions that will cause the CPU to fault for non-secure accesses. 214 * 215 * The IoTKit has an IDAU (Implementation Defined Access Unit), 216 * which specifies hard-wired security permissions for different 217 * areas of the physical address space. For the IoTKit IDAU, the 218 * top 4 bits of the physical address are the IDAU region ID, and 219 * if bit 28 (ie the lowest bit of the ID) is 0 then this is an NS 220 * region, otherwise it is an S region. 221 * 222 * The various devices and RAMs are generally all mapped twice, 223 * once into a region that the IDAU defines as secure and once 224 * into a non-secure region. They sit behind either a Memory 225 * Protection Controller (for RAM) or a Peripheral Protection 226 * Controller (for devices), which allow a more fine grained 227 * configuration of whether non-secure accesses are permitted. 228 * 229 * (The other place that guest software can configure security 230 * permissions is in the architected SAU (Security Attribution 231 * Unit), which is entirely inside the CPU. The IDAU can upgrade 232 * the security attributes for a region to more restrictive than 233 * the SAU specifies, but cannot downgrade them.) 234 * 235 * 0x10000000..0x1fffffff alias of 0x00000000..0x0fffffff 236 * 0x20000000..0x2007ffff 32KB FPGA block RAM 237 * 0x30000000..0x3fffffff alias of 0x20000000..0x2fffffff 238 * 0x40000000..0x4000ffff base peripheral region 1 239 * 0x40010000..0x4001ffff CPU peripherals (none for IoTKit) 240 * 0x40020000..0x4002ffff system control element peripherals 241 * 0x40080000..0x400fffff base peripheral region 2 242 * 0x50000000..0x5fffffff alias of 0x40000000..0x4fffffff 243 */ 244 245 memory_region_add_subregion_overlap(&s->container, 0, s->board_memory, -1); 246 247 qdev_prop_set_uint32(DEVICE(&s->armv7m), "num-irq", s->exp_numirq + 32); 248 /* In real hardware the initial Secure VTOR is set from the INITSVTOR0 249 * register in the IoT Kit System Control Register block, and the 250 * initial value of that is in turn specifiable by the FPGA that 251 * instantiates the IoT Kit. In QEMU we don't implement this wrinkle, 252 * and simply set the CPU's init-svtor to the IoT Kit default value. 253 */ 254 qdev_prop_set_uint32(DEVICE(&s->armv7m), "init-svtor", 0x10000000); 255 object_property_set_link(OBJECT(&s->armv7m), OBJECT(&s->container), 256 "memory", &err); 257 if (err) { 258 error_propagate(errp, err); 259 return; 260 } 261 object_property_set_link(OBJECT(&s->armv7m), OBJECT(s), "idau", &err); 262 if (err) { 263 error_propagate(errp, err); 264 return; 265 } 266 object_property_set_bool(OBJECT(&s->armv7m), true, "realized", &err); 267 if (err) { 268 error_propagate(errp, err); 269 return; 270 } 271 272 /* Connect our EXP_IRQ GPIOs to the NVIC's lines 32 and up. */ 273 s->exp_irqs = g_new(qemu_irq, s->exp_numirq); 274 for (i = 0; i < s->exp_numirq; i++) { 275 s->exp_irqs[i] = qdev_get_gpio_in(DEVICE(&s->armv7m), i + 32); 276 } 277 qdev_init_gpio_in_named(dev, iotkit_exp_irq, "EXP_IRQ", s->exp_numirq); 278 279 /* Set up the big aliases first */ 280 make_alias(s, &s->alias1, "alias 1", 0x10000000, 0x10000000, 0x00000000); 281 make_alias(s, &s->alias2, "alias 2", 0x30000000, 0x10000000, 0x20000000); 282 /* The 0x50000000..0x5fffffff region is not a pure alias: it has 283 * a few extra devices that only appear there (generally the 284 * control interfaces for the protection controllers). 285 * We implement this by mapping those devices over the top of this 286 * alias MR at a higher priority. 287 */ 288 make_alias(s, &s->alias3, "alias 3", 0x50000000, 0x10000000, 0x40000000); 289 290 291 /* Security controller */ 292 object_property_set_bool(OBJECT(&s->secctl), true, "realized", &err); 293 if (err) { 294 error_propagate(errp, err); 295 return; 296 } 297 sbd_secctl = SYS_BUS_DEVICE(&s->secctl); 298 dev_secctl = DEVICE(&s->secctl); 299 sysbus_mmio_map(sbd_secctl, 0, 0x50080000); 300 sysbus_mmio_map(sbd_secctl, 1, 0x40080000); 301 302 s->nsc_cfg_in = qemu_allocate_irq(nsccfg_handler, s, 1); 303 qdev_connect_gpio_out_named(dev_secctl, "nsc_cfg", 0, s->nsc_cfg_in); 304 305 /* The sec_resp_cfg output from the security controller must be split into 306 * multiple lines, one for each of the PPCs within the IoTKit and one 307 * that will be an output from the IoTKit to the system. 308 */ 309 object_property_set_int(OBJECT(&s->sec_resp_splitter), 3, 310 "num-lines", &err); 311 if (err) { 312 error_propagate(errp, err); 313 return; 314 } 315 object_property_set_bool(OBJECT(&s->sec_resp_splitter), true, 316 "realized", &err); 317 if (err) { 318 error_propagate(errp, err); 319 return; 320 } 321 dev_splitter = DEVICE(&s->sec_resp_splitter); 322 qdev_connect_gpio_out_named(dev_secctl, "sec_resp_cfg", 0, 323 qdev_get_gpio_in(dev_splitter, 0)); 324 325 /* This RAM lives behind the Memory Protection Controller */ 326 memory_region_init_ram(&s->sram0, NULL, "iotkit.sram0", 0x00008000, &err); 327 if (err) { 328 error_propagate(errp, err); 329 return; 330 } 331 object_property_set_link(OBJECT(&s->mpc), OBJECT(&s->sram0), 332 "downstream", &err); 333 if (err) { 334 error_propagate(errp, err); 335 return; 336 } 337 object_property_set_bool(OBJECT(&s->mpc), true, "realized", &err); 338 if (err) { 339 error_propagate(errp, err); 340 return; 341 } 342 /* Map the upstream end of the MPC into the right place... */ 343 memory_region_add_subregion(&s->container, 0x20000000, 344 sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->mpc), 345 1)); 346 /* ...and its register interface */ 347 memory_region_add_subregion(&s->container, 0x50083000, 348 sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->mpc), 349 0)); 350 351 /* We must OR together lines from the MPC splitters to go to the NVIC */ 352 object_property_set_int(OBJECT(&s->mpc_irq_orgate), 353 IOTS_NUM_EXP_MPC + IOTS_NUM_MPC, "num-lines", &err); 354 if (err) { 355 error_propagate(errp, err); 356 return; 357 } 358 object_property_set_bool(OBJECT(&s->mpc_irq_orgate), true, 359 "realized", &err); 360 if (err) { 361 error_propagate(errp, err); 362 return; 363 } 364 qdev_connect_gpio_out(DEVICE(&s->mpc_irq_orgate), 0, 365 qdev_get_gpio_in(DEVICE(&s->armv7m), 9)); 366 367 /* Devices behind APB PPC0: 368 * 0x40000000: timer0 369 * 0x40001000: timer1 370 * 0x40002000: dual timer 371 * We must configure and realize each downstream device and connect 372 * it to the appropriate PPC port; then we can realize the PPC and 373 * map its upstream ends to the right place in the container. 374 */ 375 qdev_prop_set_uint32(DEVICE(&s->timer0), "pclk-frq", s->mainclk_frq); 376 object_property_set_bool(OBJECT(&s->timer0), true, "realized", &err); 377 if (err) { 378 error_propagate(errp, err); 379 return; 380 } 381 sysbus_connect_irq(SYS_BUS_DEVICE(&s->timer0), 0, 382 qdev_get_gpio_in(DEVICE(&s->armv7m), 3)); 383 mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->timer0), 0); 384 object_property_set_link(OBJECT(&s->apb_ppc0), OBJECT(mr), "port[0]", &err); 385 if (err) { 386 error_propagate(errp, err); 387 return; 388 } 389 390 qdev_prop_set_uint32(DEVICE(&s->timer1), "pclk-frq", s->mainclk_frq); 391 object_property_set_bool(OBJECT(&s->timer1), true, "realized", &err); 392 if (err) { 393 error_propagate(errp, err); 394 return; 395 } 396 sysbus_connect_irq(SYS_BUS_DEVICE(&s->timer1), 0, 397 qdev_get_gpio_in(DEVICE(&s->armv7m), 4)); 398 mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->timer1), 0); 399 object_property_set_link(OBJECT(&s->apb_ppc0), OBJECT(mr), "port[1]", &err); 400 if (err) { 401 error_propagate(errp, err); 402 return; 403 } 404 405 406 qdev_prop_set_uint32(DEVICE(&s->dualtimer), "pclk-frq", s->mainclk_frq); 407 object_property_set_bool(OBJECT(&s->dualtimer), true, "realized", &err); 408 if (err) { 409 error_propagate(errp, err); 410 return; 411 } 412 sysbus_connect_irq(SYS_BUS_DEVICE(&s->dualtimer), 0, 413 qdev_get_gpio_in(DEVICE(&s->armv7m), 5)); 414 mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->dualtimer), 0); 415 object_property_set_link(OBJECT(&s->apb_ppc0), OBJECT(mr), "port[2]", &err); 416 if (err) { 417 error_propagate(errp, err); 418 return; 419 } 420 421 object_property_set_bool(OBJECT(&s->apb_ppc0), true, "realized", &err); 422 if (err) { 423 error_propagate(errp, err); 424 return; 425 } 426 427 sbd_apb_ppc0 = SYS_BUS_DEVICE(&s->apb_ppc0); 428 dev_apb_ppc0 = DEVICE(&s->apb_ppc0); 429 430 mr = sysbus_mmio_get_region(sbd_apb_ppc0, 0); 431 memory_region_add_subregion(&s->container, 0x40000000, mr); 432 mr = sysbus_mmio_get_region(sbd_apb_ppc0, 1); 433 memory_region_add_subregion(&s->container, 0x40001000, mr); 434 mr = sysbus_mmio_get_region(sbd_apb_ppc0, 2); 435 memory_region_add_subregion(&s->container, 0x40002000, mr); 436 for (i = 0; i < IOTS_APB_PPC0_NUM_PORTS; i++) { 437 qdev_connect_gpio_out_named(dev_secctl, "apb_ppc0_nonsec", i, 438 qdev_get_gpio_in_named(dev_apb_ppc0, 439 "cfg_nonsec", i)); 440 qdev_connect_gpio_out_named(dev_secctl, "apb_ppc0_ap", i, 441 qdev_get_gpio_in_named(dev_apb_ppc0, 442 "cfg_ap", i)); 443 } 444 qdev_connect_gpio_out_named(dev_secctl, "apb_ppc0_irq_enable", 0, 445 qdev_get_gpio_in_named(dev_apb_ppc0, 446 "irq_enable", 0)); 447 qdev_connect_gpio_out_named(dev_secctl, "apb_ppc0_irq_clear", 0, 448 qdev_get_gpio_in_named(dev_apb_ppc0, 449 "irq_clear", 0)); 450 qdev_connect_gpio_out(dev_splitter, 0, 451 qdev_get_gpio_in_named(dev_apb_ppc0, 452 "cfg_sec_resp", 0)); 453 454 /* All the PPC irq lines (from the 2 internal PPCs and the 8 external 455 * ones) are sent individually to the security controller, and also 456 * ORed together to give a single combined PPC interrupt to the NVIC. 457 */ 458 object_property_set_int(OBJECT(&s->ppc_irq_orgate), 459 NUM_PPCS, "num-lines", &err); 460 if (err) { 461 error_propagate(errp, err); 462 return; 463 } 464 object_property_set_bool(OBJECT(&s->ppc_irq_orgate), true, 465 "realized", &err); 466 if (err) { 467 error_propagate(errp, err); 468 return; 469 } 470 qdev_connect_gpio_out(DEVICE(&s->ppc_irq_orgate), 0, 471 qdev_get_gpio_in(DEVICE(&s->armv7m), 10)); 472 473 /* 0x40010000 .. 0x4001ffff: private CPU region: unused in IoTKit */ 474 475 /* 0x40020000 .. 0x4002ffff : IoTKit system control peripheral region */ 476 /* Devices behind APB PPC1: 477 * 0x4002f000: S32K timer 478 */ 479 qdev_prop_set_uint32(DEVICE(&s->s32ktimer), "pclk-frq", S32KCLK); 480 object_property_set_bool(OBJECT(&s->s32ktimer), true, "realized", &err); 481 if (err) { 482 error_propagate(errp, err); 483 return; 484 } 485 sysbus_connect_irq(SYS_BUS_DEVICE(&s->s32ktimer), 0, 486 qdev_get_gpio_in(DEVICE(&s->armv7m), 2)); 487 mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->s32ktimer), 0); 488 object_property_set_link(OBJECT(&s->apb_ppc1), OBJECT(mr), "port[0]", &err); 489 if (err) { 490 error_propagate(errp, err); 491 return; 492 } 493 494 object_property_set_bool(OBJECT(&s->apb_ppc1), true, "realized", &err); 495 if (err) { 496 error_propagate(errp, err); 497 return; 498 } 499 mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->apb_ppc1), 0); 500 memory_region_add_subregion(&s->container, 0x4002f000, mr); 501 502 dev_apb_ppc1 = DEVICE(&s->apb_ppc1); 503 qdev_connect_gpio_out_named(dev_secctl, "apb_ppc1_nonsec", 0, 504 qdev_get_gpio_in_named(dev_apb_ppc1, 505 "cfg_nonsec", 0)); 506 qdev_connect_gpio_out_named(dev_secctl, "apb_ppc1_ap", 0, 507 qdev_get_gpio_in_named(dev_apb_ppc1, 508 "cfg_ap", 0)); 509 qdev_connect_gpio_out_named(dev_secctl, "apb_ppc1_irq_enable", 0, 510 qdev_get_gpio_in_named(dev_apb_ppc1, 511 "irq_enable", 0)); 512 qdev_connect_gpio_out_named(dev_secctl, "apb_ppc1_irq_clear", 0, 513 qdev_get_gpio_in_named(dev_apb_ppc1, 514 "irq_clear", 0)); 515 qdev_connect_gpio_out(dev_splitter, 1, 516 qdev_get_gpio_in_named(dev_apb_ppc1, 517 "cfg_sec_resp", 0)); 518 519 /* Using create_unimplemented_device() maps the stub into the 520 * system address space rather than into our container, but the 521 * overall effect to the guest is the same. 522 */ 523 create_unimplemented_device("SYSINFO", 0x40020000, 0x1000); 524 525 create_unimplemented_device("SYSCONTROL", 0x50021000, 0x1000); 526 527 /* This OR gate wires together outputs from the secure watchdogs to NMI */ 528 object_property_set_int(OBJECT(&s->nmi_orgate), 2, "num-lines", &err); 529 if (err) { 530 error_propagate(errp, err); 531 return; 532 } 533 object_property_set_bool(OBJECT(&s->nmi_orgate), true, "realized", &err); 534 if (err) { 535 error_propagate(errp, err); 536 return; 537 } 538 qdev_connect_gpio_out(DEVICE(&s->nmi_orgate), 0, 539 qdev_get_gpio_in_named(DEVICE(&s->armv7m), "NMI", 0)); 540 541 qdev_prop_set_uint32(DEVICE(&s->s32kwatchdog), "wdogclk-frq", S32KCLK); 542 object_property_set_bool(OBJECT(&s->s32kwatchdog), true, "realized", &err); 543 if (err) { 544 error_propagate(errp, err); 545 return; 546 } 547 sysbus_connect_irq(SYS_BUS_DEVICE(&s->s32kwatchdog), 0, 548 qdev_get_gpio_in(DEVICE(&s->nmi_orgate), 0)); 549 sysbus_mmio_map(SYS_BUS_DEVICE(&s->s32kwatchdog), 0, 0x5002e000); 550 551 /* 0x40080000 .. 0x4008ffff : IoTKit second Base peripheral region */ 552 553 qdev_prop_set_uint32(DEVICE(&s->nswatchdog), "wdogclk-frq", s->mainclk_frq); 554 object_property_set_bool(OBJECT(&s->nswatchdog), true, "realized", &err); 555 if (err) { 556 error_propagate(errp, err); 557 return; 558 } 559 sysbus_connect_irq(SYS_BUS_DEVICE(&s->nswatchdog), 0, 560 qdev_get_gpio_in(DEVICE(&s->armv7m), 1)); 561 sysbus_mmio_map(SYS_BUS_DEVICE(&s->nswatchdog), 0, 0x40081000); 562 563 qdev_prop_set_uint32(DEVICE(&s->swatchdog), "wdogclk-frq", s->mainclk_frq); 564 object_property_set_bool(OBJECT(&s->swatchdog), true, "realized", &err); 565 if (err) { 566 error_propagate(errp, err); 567 return; 568 } 569 sysbus_connect_irq(SYS_BUS_DEVICE(&s->swatchdog), 0, 570 qdev_get_gpio_in(DEVICE(&s->nmi_orgate), 1)); 571 sysbus_mmio_map(SYS_BUS_DEVICE(&s->swatchdog), 0, 0x50081000); 572 573 for (i = 0; i < ARRAY_SIZE(s->ppc_irq_splitter); i++) { 574 Object *splitter = OBJECT(&s->ppc_irq_splitter[i]); 575 576 object_property_set_int(splitter, 2, "num-lines", &err); 577 if (err) { 578 error_propagate(errp, err); 579 return; 580 } 581 object_property_set_bool(splitter, true, "realized", &err); 582 if (err) { 583 error_propagate(errp, err); 584 return; 585 } 586 } 587 588 for (i = 0; i < IOTS_NUM_AHB_EXP_PPC; i++) { 589 char *ppcname = g_strdup_printf("ahb_ppcexp%d", i); 590 591 iotkit_forward_ppc(s, ppcname, i); 592 g_free(ppcname); 593 } 594 595 for (i = 0; i < IOTS_NUM_APB_EXP_PPC; i++) { 596 char *ppcname = g_strdup_printf("apb_ppcexp%d", i); 597 598 iotkit_forward_ppc(s, ppcname, i + IOTS_NUM_AHB_EXP_PPC); 599 g_free(ppcname); 600 } 601 602 for (i = NUM_EXTERNAL_PPCS; i < NUM_PPCS; i++) { 603 /* Wire up IRQ splitter for internal PPCs */ 604 DeviceState *devs = DEVICE(&s->ppc_irq_splitter[i]); 605 char *gpioname = g_strdup_printf("apb_ppc%d_irq_status", 606 i - NUM_EXTERNAL_PPCS); 607 TZPPC *ppc = (i == NUM_EXTERNAL_PPCS) ? &s->apb_ppc0 : &s->apb_ppc1; 608 609 qdev_connect_gpio_out(devs, 0, 610 qdev_get_gpio_in_named(dev_secctl, gpioname, 0)); 611 qdev_connect_gpio_out(devs, 1, 612 qdev_get_gpio_in(DEVICE(&s->ppc_irq_orgate), i)); 613 qdev_connect_gpio_out_named(DEVICE(ppc), "irq", 0, 614 qdev_get_gpio_in(devs, 0)); 615 g_free(gpioname); 616 } 617 618 /* Wire up the splitters for the MPC IRQs */ 619 for (i = 0; i < IOTS_NUM_EXP_MPC + IOTS_NUM_MPC; i++) { 620 SplitIRQ *splitter = &s->mpc_irq_splitter[i]; 621 DeviceState *dev_splitter = DEVICE(splitter); 622 623 object_property_set_int(OBJECT(splitter), 2, "num-lines", &err); 624 if (err) { 625 error_propagate(errp, err); 626 return; 627 } 628 object_property_set_bool(OBJECT(splitter), true, "realized", &err); 629 if (err) { 630 error_propagate(errp, err); 631 return; 632 } 633 634 if (i < IOTS_NUM_EXP_MPC) { 635 /* Splitter input is from GPIO input line */ 636 s->mpcexp_status_in[i] = qdev_get_gpio_in(dev_splitter, 0); 637 qdev_connect_gpio_out(dev_splitter, 0, 638 qdev_get_gpio_in_named(dev_secctl, 639 "mpcexp_status", i)); 640 } else { 641 /* Splitter input is from our own MPC */ 642 qdev_connect_gpio_out_named(DEVICE(&s->mpc), "irq", 0, 643 qdev_get_gpio_in(dev_splitter, 0)); 644 qdev_connect_gpio_out(dev_splitter, 0, 645 qdev_get_gpio_in_named(dev_secctl, 646 "mpc_status", 0)); 647 } 648 649 qdev_connect_gpio_out(dev_splitter, 1, 650 qdev_get_gpio_in(DEVICE(&s->mpc_irq_orgate), i)); 651 } 652 /* Create GPIO inputs which will pass the line state for our 653 * mpcexp_irq inputs to the correct splitter devices. 654 */ 655 qdev_init_gpio_in_named(dev, iotkit_mpcexp_status, "mpcexp_status", 656 IOTS_NUM_EXP_MPC); 657 658 iotkit_forward_sec_resp_cfg(s); 659 660 system_clock_scale = NANOSECONDS_PER_SECOND / s->mainclk_frq; 661 } 662 663 static void iotkit_idau_check(IDAUInterface *ii, uint32_t address, 664 int *iregion, bool *exempt, bool *ns, bool *nsc) 665 { 666 /* For IoTKit systems the IDAU responses are simple logical functions 667 * of the address bits. The NSC attribute is guest-adjustable via the 668 * NSCCFG register in the security controller. 669 */ 670 IoTKit *s = IOTKIT(ii); 671 int region = extract32(address, 28, 4); 672 673 *ns = !(region & 1); 674 *nsc = (region == 1 && (s->nsccfg & 1)) || (region == 3 && (s->nsccfg & 2)); 675 /* 0xe0000000..0xe00fffff and 0xf0000000..0xf00fffff are exempt */ 676 *exempt = (address & 0xeff00000) == 0xe0000000; 677 *iregion = region; 678 } 679 680 static const VMStateDescription iotkit_vmstate = { 681 .name = "iotkit", 682 .version_id = 1, 683 .minimum_version_id = 1, 684 .fields = (VMStateField[]) { 685 VMSTATE_UINT32(nsccfg, IoTKit), 686 VMSTATE_END_OF_LIST() 687 } 688 }; 689 690 static Property iotkit_properties[] = { 691 DEFINE_PROP_LINK("memory", IoTKit, board_memory, TYPE_MEMORY_REGION, 692 MemoryRegion *), 693 DEFINE_PROP_UINT32("EXP_NUMIRQ", IoTKit, exp_numirq, 64), 694 DEFINE_PROP_UINT32("MAINCLK", IoTKit, mainclk_frq, 0), 695 DEFINE_PROP_END_OF_LIST() 696 }; 697 698 static void iotkit_reset(DeviceState *dev) 699 { 700 IoTKit *s = IOTKIT(dev); 701 702 s->nsccfg = 0; 703 } 704 705 static void iotkit_class_init(ObjectClass *klass, void *data) 706 { 707 DeviceClass *dc = DEVICE_CLASS(klass); 708 IDAUInterfaceClass *iic = IDAU_INTERFACE_CLASS(klass); 709 710 dc->realize = iotkit_realize; 711 dc->vmsd = &iotkit_vmstate; 712 dc->props = iotkit_properties; 713 dc->reset = iotkit_reset; 714 iic->check = iotkit_idau_check; 715 } 716 717 static const TypeInfo iotkit_info = { 718 .name = TYPE_IOTKIT, 719 .parent = TYPE_SYS_BUS_DEVICE, 720 .instance_size = sizeof(IoTKit), 721 .instance_init = iotkit_init, 722 .class_init = iotkit_class_init, 723 .interfaces = (InterfaceInfo[]) { 724 { TYPE_IDAU_INTERFACE }, 725 { } 726 } 727 }; 728 729 static void iotkit_register_types(void) 730 { 731 type_register_static(&iotkit_info); 732 } 733 734 type_init(iotkit_register_types); 735