1 /* 2 * Arm SSE (Subsystems for Embedded): IoTKit 3 * 4 * Copyright (c) 2018 Linaro Limited 5 * Written by Peter Maydell 6 * 7 * This program is free software; you can redistribute it and/or modify 8 * it under the terms of the GNU General Public License version 2 or 9 * (at your option) any later version. 10 */ 11 12 #include "qemu/osdep.h" 13 #include "qemu/log.h" 14 #include "qemu/module.h" 15 #include "qemu/bitops.h" 16 #include "qapi/error.h" 17 #include "trace.h" 18 #include "hw/sysbus.h" 19 #include "migration/vmstate.h" 20 #include "hw/registerfields.h" 21 #include "hw/arm/armsse.h" 22 #include "hw/arm/armsse-version.h" 23 #include "hw/arm/boot.h" 24 #include "hw/irq.h" 25 #include "hw/qdev-clock.h" 26 27 /* 28 * The SSE-300 puts some devices in different places to the 29 * SSE-200 (and original IoTKit). We use an array of these structs 30 * to define how each variant lays out these devices. (Parts of the 31 * SoC that are the same for all variants aren't handled via these 32 * data structures.) 33 */ 34 35 #define NO_IRQ -1 36 #define NO_PPC -1 37 38 typedef struct ARMSSEDeviceInfo { 39 const char *name; /* name to use for the QOM object; NULL terminates list */ 40 const char *type; /* QOM type name */ 41 unsigned int index; /* Which of the N devices of this type is this ? */ 42 hwaddr addr; 43 int ppc; /* Index of APB PPC this device is wired up to, or NO_PPC */ 44 int ppc_port; /* Port number of this device on the PPC */ 45 int irq; /* NO_IRQ, or 0..NUM_SSE_IRQS-1 */ 46 } ARMSSEDeviceInfo; 47 48 struct ARMSSEInfo { 49 const char *name; 50 uint32_t sse_version; 51 int sram_banks; 52 int num_cpus; 53 uint32_t sys_version; 54 uint32_t iidr; 55 uint32_t cpuwait_rst; 56 bool has_mhus; 57 bool has_ppus; 58 bool has_cachectrl; 59 bool has_cpusecctrl; 60 bool has_cpuid; 61 Property *props; 62 const ARMSSEDeviceInfo *devinfo; 63 }; 64 65 static Property iotkit_properties[] = { 66 DEFINE_PROP_LINK("memory", ARMSSE, board_memory, TYPE_MEMORY_REGION, 67 MemoryRegion *), 68 DEFINE_PROP_UINT32("EXP_NUMIRQ", ARMSSE, exp_numirq, 64), 69 DEFINE_PROP_UINT32("SRAM_ADDR_WIDTH", ARMSSE, sram_addr_width, 15), 70 DEFINE_PROP_UINT32("init-svtor", ARMSSE, init_svtor, 0x10000000), 71 DEFINE_PROP_BOOL("CPU0_FPU", ARMSSE, cpu_fpu[0], true), 72 DEFINE_PROP_BOOL("CPU0_DSP", ARMSSE, cpu_dsp[0], true), 73 DEFINE_PROP_END_OF_LIST() 74 }; 75 76 static Property armsse_properties[] = { 77 DEFINE_PROP_LINK("memory", ARMSSE, board_memory, TYPE_MEMORY_REGION, 78 MemoryRegion *), 79 DEFINE_PROP_UINT32("EXP_NUMIRQ", ARMSSE, exp_numirq, 64), 80 DEFINE_PROP_UINT32("SRAM_ADDR_WIDTH", ARMSSE, sram_addr_width, 15), 81 DEFINE_PROP_UINT32("init-svtor", ARMSSE, init_svtor, 0x10000000), 82 DEFINE_PROP_BOOL("CPU0_FPU", ARMSSE, cpu_fpu[0], false), 83 DEFINE_PROP_BOOL("CPU0_DSP", ARMSSE, cpu_dsp[0], false), 84 DEFINE_PROP_BOOL("CPU1_FPU", ARMSSE, cpu_fpu[1], true), 85 DEFINE_PROP_BOOL("CPU1_DSP", ARMSSE, cpu_dsp[1], true), 86 DEFINE_PROP_END_OF_LIST() 87 }; 88 89 static const ARMSSEDeviceInfo sse200_devices[] = { 90 { 91 .name = "timer0", 92 .type = TYPE_CMSDK_APB_TIMER, 93 .index = 0, 94 .addr = 0x40000000, 95 .ppc = 0, 96 .ppc_port = 0, 97 .irq = 3, 98 }, 99 { 100 .name = "timer1", 101 .type = TYPE_CMSDK_APB_TIMER, 102 .index = 1, 103 .addr = 0x40001000, 104 .ppc = 0, 105 .ppc_port = 1, 106 .irq = 4, 107 }, 108 { 109 .name = NULL, 110 } 111 }; 112 113 static const ARMSSEInfo armsse_variants[] = { 114 { 115 .name = TYPE_IOTKIT, 116 .sse_version = ARMSSE_IOTKIT, 117 .sram_banks = 1, 118 .num_cpus = 1, 119 .sys_version = 0x41743, 120 .iidr = 0, 121 .cpuwait_rst = 0, 122 .has_mhus = false, 123 .has_ppus = false, 124 .has_cachectrl = false, 125 .has_cpusecctrl = false, 126 .has_cpuid = false, 127 .props = iotkit_properties, 128 .devinfo = sse200_devices, 129 }, 130 { 131 .name = TYPE_SSE200, 132 .sse_version = ARMSSE_SSE200, 133 .sram_banks = 4, 134 .num_cpus = 2, 135 .sys_version = 0x22041743, 136 .iidr = 0, 137 .cpuwait_rst = 2, 138 .has_mhus = true, 139 .has_ppus = true, 140 .has_cachectrl = true, 141 .has_cpusecctrl = true, 142 .has_cpuid = true, 143 .props = armsse_properties, 144 .devinfo = sse200_devices, 145 }, 146 }; 147 148 static uint32_t armsse_sys_config_value(ARMSSE *s, const ARMSSEInfo *info) 149 { 150 /* Return the SYS_CONFIG value for this SSE */ 151 uint32_t sys_config; 152 153 switch (info->sse_version) { 154 case ARMSSE_IOTKIT: 155 sys_config = 0; 156 sys_config = deposit32(sys_config, 0, 4, info->sram_banks); 157 sys_config = deposit32(sys_config, 4, 4, s->sram_addr_width - 12); 158 break; 159 case ARMSSE_SSE200: 160 sys_config = 0; 161 sys_config = deposit32(sys_config, 0, 4, info->sram_banks); 162 sys_config = deposit32(sys_config, 4, 5, s->sram_addr_width); 163 sys_config = deposit32(sys_config, 24, 4, 2); 164 if (info->num_cpus > 1) { 165 sys_config = deposit32(sys_config, 10, 1, 1); 166 sys_config = deposit32(sys_config, 20, 4, info->sram_banks - 1); 167 sys_config = deposit32(sys_config, 28, 4, 2); 168 } 169 break; 170 case ARMSSE_SSE300: 171 sys_config = 0; 172 sys_config = deposit32(sys_config, 0, 4, info->sram_banks); 173 sys_config = deposit32(sys_config, 4, 5, s->sram_addr_width); 174 sys_config = deposit32(sys_config, 16, 3, 3); /* CPU0 = Cortex-M55 */ 175 break; 176 default: 177 g_assert_not_reached(); 178 } 179 return sys_config; 180 } 181 182 /* Clock frequency in HZ of the 32KHz "slow clock" */ 183 #define S32KCLK (32 * 1000) 184 185 /* Is internal IRQ n shared between CPUs in a multi-core SSE ? */ 186 static bool irq_is_common[32] = { 187 [0 ... 5] = true, 188 /* 6, 7: per-CPU MHU interrupts */ 189 [8 ... 12] = true, 190 /* 13: per-CPU icache interrupt */ 191 /* 14: reserved */ 192 [15 ... 20] = true, 193 /* 21: reserved */ 194 [22 ... 26] = true, 195 /* 27: reserved */ 196 /* 28, 29: per-CPU CTI interrupts */ 197 /* 30, 31: reserved */ 198 }; 199 200 /* 201 * Create an alias region in @container of @size bytes starting at @base 202 * which mirrors the memory starting at @orig. 203 */ 204 static void make_alias(ARMSSE *s, MemoryRegion *mr, MemoryRegion *container, 205 const char *name, hwaddr base, hwaddr size, hwaddr orig) 206 { 207 memory_region_init_alias(mr, NULL, name, container, orig, size); 208 /* The alias is even lower priority than unimplemented_device regions */ 209 memory_region_add_subregion_overlap(container, base, mr, -1500); 210 } 211 212 static void irq_status_forwarder(void *opaque, int n, int level) 213 { 214 qemu_irq destirq = opaque; 215 216 qemu_set_irq(destirq, level); 217 } 218 219 static void nsccfg_handler(void *opaque, int n, int level) 220 { 221 ARMSSE *s = ARM_SSE(opaque); 222 223 s->nsccfg = level; 224 } 225 226 static void armsse_forward_ppc(ARMSSE *s, const char *ppcname, int ppcnum) 227 { 228 /* Each of the 4 AHB and 4 APB PPCs that might be present in a 229 * system using the ARMSSE has a collection of control lines which 230 * are provided by the security controller and which we want to 231 * expose as control lines on the ARMSSE device itself, so the 232 * code using the ARMSSE can wire them up to the PPCs. 233 */ 234 SplitIRQ *splitter = &s->ppc_irq_splitter[ppcnum]; 235 DeviceState *armssedev = DEVICE(s); 236 DeviceState *dev_secctl = DEVICE(&s->secctl); 237 DeviceState *dev_splitter = DEVICE(splitter); 238 char *name; 239 240 name = g_strdup_printf("%s_nonsec", ppcname); 241 qdev_pass_gpios(dev_secctl, armssedev, name); 242 g_free(name); 243 name = g_strdup_printf("%s_ap", ppcname); 244 qdev_pass_gpios(dev_secctl, armssedev, name); 245 g_free(name); 246 name = g_strdup_printf("%s_irq_enable", ppcname); 247 qdev_pass_gpios(dev_secctl, armssedev, name); 248 g_free(name); 249 name = g_strdup_printf("%s_irq_clear", ppcname); 250 qdev_pass_gpios(dev_secctl, armssedev, name); 251 g_free(name); 252 253 /* irq_status is a little more tricky, because we need to 254 * split it so we can send it both to the security controller 255 * and to our OR gate for the NVIC interrupt line. 256 * Connect up the splitter's outputs, and create a GPIO input 257 * which will pass the line state to the input splitter. 258 */ 259 name = g_strdup_printf("%s_irq_status", ppcname); 260 qdev_connect_gpio_out(dev_splitter, 0, 261 qdev_get_gpio_in_named(dev_secctl, 262 name, 0)); 263 qdev_connect_gpio_out(dev_splitter, 1, 264 qdev_get_gpio_in(DEVICE(&s->ppc_irq_orgate), ppcnum)); 265 s->irq_status_in[ppcnum] = qdev_get_gpio_in(dev_splitter, 0); 266 qdev_init_gpio_in_named_with_opaque(armssedev, irq_status_forwarder, 267 s->irq_status_in[ppcnum], name, 1); 268 g_free(name); 269 } 270 271 static void armsse_forward_sec_resp_cfg(ARMSSE *s) 272 { 273 /* Forward the 3rd output from the splitter device as a 274 * named GPIO output of the armsse object. 275 */ 276 DeviceState *dev = DEVICE(s); 277 DeviceState *dev_splitter = DEVICE(&s->sec_resp_splitter); 278 279 qdev_init_gpio_out_named(dev, &s->sec_resp_cfg, "sec_resp_cfg", 1); 280 s->sec_resp_cfg_in = qemu_allocate_irq(irq_status_forwarder, 281 s->sec_resp_cfg, 1); 282 qdev_connect_gpio_out(dev_splitter, 2, s->sec_resp_cfg_in); 283 } 284 285 static void armsse_mainclk_update(void *opaque, ClockEvent event) 286 { 287 ARMSSE *s = ARM_SSE(opaque); 288 289 /* 290 * Set system_clock_scale from our Clock input; this is what 291 * controls the tick rate of the CPU SysTick timer. 292 */ 293 system_clock_scale = clock_ticks_to_ns(s->mainclk, 1); 294 } 295 296 static void armsse_init(Object *obj) 297 { 298 ARMSSE *s = ARM_SSE(obj); 299 ARMSSEClass *asc = ARM_SSE_GET_CLASS(obj); 300 const ARMSSEInfo *info = asc->info; 301 const ARMSSEDeviceInfo *devinfo; 302 int i; 303 304 assert(info->sram_banks <= MAX_SRAM_BANKS); 305 assert(info->num_cpus <= SSE_MAX_CPUS); 306 307 s->mainclk = qdev_init_clock_in(DEVICE(s), "MAINCLK", 308 armsse_mainclk_update, s, ClockUpdate); 309 s->s32kclk = qdev_init_clock_in(DEVICE(s), "S32KCLK", NULL, NULL, 0); 310 311 memory_region_init(&s->container, obj, "armsse-container", UINT64_MAX); 312 313 for (i = 0; i < info->num_cpus; i++) { 314 /* 315 * We put each CPU in its own cluster as they are logically 316 * distinct and may be configured differently. 317 */ 318 char *name; 319 320 name = g_strdup_printf("cluster%d", i); 321 object_initialize_child(obj, name, &s->cluster[i], TYPE_CPU_CLUSTER); 322 qdev_prop_set_uint32(DEVICE(&s->cluster[i]), "cluster-id", i); 323 g_free(name); 324 325 name = g_strdup_printf("armv7m%d", i); 326 object_initialize_child(OBJECT(&s->cluster[i]), name, &s->armv7m[i], 327 TYPE_ARMV7M); 328 qdev_prop_set_string(DEVICE(&s->armv7m[i]), "cpu-type", 329 ARM_CPU_TYPE_NAME("cortex-m33")); 330 g_free(name); 331 name = g_strdup_printf("arm-sse-cpu-container%d", i); 332 memory_region_init(&s->cpu_container[i], obj, name, UINT64_MAX); 333 g_free(name); 334 if (i > 0) { 335 name = g_strdup_printf("arm-sse-container-alias%d", i); 336 memory_region_init_alias(&s->container_alias[i - 1], obj, 337 name, &s->container, 0, UINT64_MAX); 338 g_free(name); 339 } 340 } 341 342 for (devinfo = info->devinfo; devinfo->name; devinfo++) { 343 assert(devinfo->ppc == NO_PPC || devinfo->ppc < ARRAY_SIZE(s->apb_ppc)); 344 if (!strcmp(devinfo->type, TYPE_CMSDK_APB_TIMER)) { 345 assert(devinfo->index < ARRAY_SIZE(s->timer)); 346 object_initialize_child(obj, devinfo->name, 347 &s->timer[devinfo->index], 348 TYPE_CMSDK_APB_TIMER); 349 } else { 350 g_assert_not_reached(); 351 } 352 } 353 354 object_initialize_child(obj, "secctl", &s->secctl, TYPE_IOTKIT_SECCTL); 355 356 for (i = 0; i < ARRAY_SIZE(s->apb_ppc); i++) { 357 g_autofree char *name = g_strdup_printf("apb-ppc%d", i); 358 object_initialize_child(obj, name, &s->apb_ppc[i], TYPE_TZ_PPC); 359 } 360 361 for (i = 0; i < info->sram_banks; i++) { 362 char *name = g_strdup_printf("mpc%d", i); 363 object_initialize_child(obj, name, &s->mpc[i], TYPE_TZ_MPC); 364 g_free(name); 365 } 366 object_initialize_child(obj, "mpc-irq-orgate", &s->mpc_irq_orgate, 367 TYPE_OR_IRQ); 368 369 for (i = 0; i < IOTS_NUM_EXP_MPC + info->sram_banks; i++) { 370 char *name = g_strdup_printf("mpc-irq-splitter-%d", i); 371 SplitIRQ *splitter = &s->mpc_irq_splitter[i]; 372 373 object_initialize_child(obj, name, splitter, TYPE_SPLIT_IRQ); 374 g_free(name); 375 } 376 object_initialize_child(obj, "s32ktimer", &s->s32ktimer, 377 TYPE_CMSDK_APB_TIMER); 378 object_initialize_child(obj, "dualtimer", &s->dualtimer, 379 TYPE_CMSDK_APB_DUALTIMER); 380 object_initialize_child(obj, "s32kwatchdog", &s->s32kwatchdog, 381 TYPE_CMSDK_APB_WATCHDOG); 382 object_initialize_child(obj, "nswatchdog", &s->nswatchdog, 383 TYPE_CMSDK_APB_WATCHDOG); 384 object_initialize_child(obj, "swatchdog", &s->swatchdog, 385 TYPE_CMSDK_APB_WATCHDOG); 386 object_initialize_child(obj, "armsse-sysctl", &s->sysctl, 387 TYPE_IOTKIT_SYSCTL); 388 object_initialize_child(obj, "armsse-sysinfo", &s->sysinfo, 389 TYPE_IOTKIT_SYSINFO); 390 if (info->has_mhus) { 391 object_initialize_child(obj, "mhu0", &s->mhu[0], TYPE_ARMSSE_MHU); 392 object_initialize_child(obj, "mhu1", &s->mhu[1], TYPE_ARMSSE_MHU); 393 } 394 if (info->has_ppus) { 395 for (i = 0; i < info->num_cpus; i++) { 396 char *name = g_strdup_printf("CPU%dCORE_PPU", i); 397 int ppuidx = CPU0CORE_PPU + i; 398 399 object_initialize_child(obj, name, &s->ppu[ppuidx], 400 TYPE_UNIMPLEMENTED_DEVICE); 401 g_free(name); 402 } 403 object_initialize_child(obj, "DBG_PPU", &s->ppu[DBG_PPU], 404 TYPE_UNIMPLEMENTED_DEVICE); 405 for (i = 0; i < info->sram_banks; i++) { 406 char *name = g_strdup_printf("RAM%d_PPU", i); 407 int ppuidx = RAM0_PPU + i; 408 409 object_initialize_child(obj, name, &s->ppu[ppuidx], 410 TYPE_UNIMPLEMENTED_DEVICE); 411 g_free(name); 412 } 413 } 414 if (info->has_cachectrl) { 415 for (i = 0; i < info->num_cpus; i++) { 416 char *name = g_strdup_printf("cachectrl%d", i); 417 418 object_initialize_child(obj, name, &s->cachectrl[i], 419 TYPE_UNIMPLEMENTED_DEVICE); 420 g_free(name); 421 } 422 } 423 if (info->has_cpusecctrl) { 424 for (i = 0; i < info->num_cpus; i++) { 425 char *name = g_strdup_printf("cpusecctrl%d", i); 426 427 object_initialize_child(obj, name, &s->cpusecctrl[i], 428 TYPE_UNIMPLEMENTED_DEVICE); 429 g_free(name); 430 } 431 } 432 if (info->has_cpuid) { 433 for (i = 0; i < info->num_cpus; i++) { 434 char *name = g_strdup_printf("cpuid%d", i); 435 436 object_initialize_child(obj, name, &s->cpuid[i], 437 TYPE_ARMSSE_CPUID); 438 g_free(name); 439 } 440 } 441 object_initialize_child(obj, "nmi-orgate", &s->nmi_orgate, TYPE_OR_IRQ); 442 object_initialize_child(obj, "ppc-irq-orgate", &s->ppc_irq_orgate, 443 TYPE_OR_IRQ); 444 object_initialize_child(obj, "sec-resp-splitter", &s->sec_resp_splitter, 445 TYPE_SPLIT_IRQ); 446 for (i = 0; i < ARRAY_SIZE(s->ppc_irq_splitter); i++) { 447 char *name = g_strdup_printf("ppc-irq-splitter-%d", i); 448 SplitIRQ *splitter = &s->ppc_irq_splitter[i]; 449 450 object_initialize_child(obj, name, splitter, TYPE_SPLIT_IRQ); 451 g_free(name); 452 } 453 if (info->num_cpus > 1) { 454 for (i = 0; i < ARRAY_SIZE(s->cpu_irq_splitter); i++) { 455 if (irq_is_common[i]) { 456 char *name = g_strdup_printf("cpu-irq-splitter%d", i); 457 SplitIRQ *splitter = &s->cpu_irq_splitter[i]; 458 459 object_initialize_child(obj, name, splitter, TYPE_SPLIT_IRQ); 460 g_free(name); 461 } 462 } 463 } 464 } 465 466 static void armsse_exp_irq(void *opaque, int n, int level) 467 { 468 qemu_irq *irqarray = opaque; 469 470 qemu_set_irq(irqarray[n], level); 471 } 472 473 static void armsse_mpcexp_status(void *opaque, int n, int level) 474 { 475 ARMSSE *s = ARM_SSE(opaque); 476 qemu_set_irq(s->mpcexp_status_in[n], level); 477 } 478 479 static qemu_irq armsse_get_common_irq_in(ARMSSE *s, int irqno) 480 { 481 /* 482 * Return a qemu_irq which can be used to signal IRQ n to 483 * all CPUs in the SSE. 484 */ 485 ARMSSEClass *asc = ARM_SSE_GET_CLASS(s); 486 const ARMSSEInfo *info = asc->info; 487 488 assert(irq_is_common[irqno]); 489 490 if (info->num_cpus == 1) { 491 /* Only one CPU -- just connect directly to it */ 492 return qdev_get_gpio_in(DEVICE(&s->armv7m[0]), irqno); 493 } else { 494 /* Connect to the splitter which feeds all CPUs */ 495 return qdev_get_gpio_in(DEVICE(&s->cpu_irq_splitter[irqno]), 0); 496 } 497 } 498 499 static void map_ppu(ARMSSE *s, int ppuidx, const char *name, hwaddr addr) 500 { 501 /* Map a PPU unimplemented device stub */ 502 DeviceState *dev = DEVICE(&s->ppu[ppuidx]); 503 504 qdev_prop_set_string(dev, "name", name); 505 qdev_prop_set_uint64(dev, "size", 0x1000); 506 sysbus_realize(SYS_BUS_DEVICE(dev), &error_fatal); 507 sysbus_mmio_map(SYS_BUS_DEVICE(&s->ppu[ppuidx]), 0, addr); 508 } 509 510 static void armsse_realize(DeviceState *dev, Error **errp) 511 { 512 ARMSSE *s = ARM_SSE(dev); 513 ARMSSEClass *asc = ARM_SSE_GET_CLASS(dev); 514 const ARMSSEInfo *info = asc->info; 515 const ARMSSEDeviceInfo *devinfo; 516 int i; 517 MemoryRegion *mr; 518 Error *err = NULL; 519 SysBusDevice *sbd_apb_ppc0; 520 SysBusDevice *sbd_secctl; 521 DeviceState *dev_apb_ppc0; 522 DeviceState *dev_apb_ppc1; 523 DeviceState *dev_secctl; 524 DeviceState *dev_splitter; 525 uint32_t addr_width_max; 526 527 if (!s->board_memory) { 528 error_setg(errp, "memory property was not set"); 529 return; 530 } 531 532 if (!clock_has_source(s->mainclk)) { 533 error_setg(errp, "MAINCLK clock was not connected"); 534 } 535 if (!clock_has_source(s->s32kclk)) { 536 error_setg(errp, "S32KCLK clock was not connected"); 537 } 538 539 assert(info->num_cpus <= SSE_MAX_CPUS); 540 541 /* max SRAM_ADDR_WIDTH: 24 - log2(SRAM_NUM_BANK) */ 542 assert(is_power_of_2(info->sram_banks)); 543 addr_width_max = 24 - ctz32(info->sram_banks); 544 if (s->sram_addr_width < 1 || s->sram_addr_width > addr_width_max) { 545 error_setg(errp, "SRAM_ADDR_WIDTH must be between 1 and %d", 546 addr_width_max); 547 return; 548 } 549 550 /* Handling of which devices should be available only to secure 551 * code is usually done differently for M profile than for A profile. 552 * Instead of putting some devices only into the secure address space, 553 * devices exist in both address spaces but with hard-wired security 554 * permissions that will cause the CPU to fault for non-secure accesses. 555 * 556 * The ARMSSE has an IDAU (Implementation Defined Access Unit), 557 * which specifies hard-wired security permissions for different 558 * areas of the physical address space. For the ARMSSE IDAU, the 559 * top 4 bits of the physical address are the IDAU region ID, and 560 * if bit 28 (ie the lowest bit of the ID) is 0 then this is an NS 561 * region, otherwise it is an S region. 562 * 563 * The various devices and RAMs are generally all mapped twice, 564 * once into a region that the IDAU defines as secure and once 565 * into a non-secure region. They sit behind either a Memory 566 * Protection Controller (for RAM) or a Peripheral Protection 567 * Controller (for devices), which allow a more fine grained 568 * configuration of whether non-secure accesses are permitted. 569 * 570 * (The other place that guest software can configure security 571 * permissions is in the architected SAU (Security Attribution 572 * Unit), which is entirely inside the CPU. The IDAU can upgrade 573 * the security attributes for a region to more restrictive than 574 * the SAU specifies, but cannot downgrade them.) 575 * 576 * 0x10000000..0x1fffffff alias of 0x00000000..0x0fffffff 577 * 0x20000000..0x2007ffff 32KB FPGA block RAM 578 * 0x30000000..0x3fffffff alias of 0x20000000..0x2fffffff 579 * 0x40000000..0x4000ffff base peripheral region 1 580 * 0x40010000..0x4001ffff CPU peripherals (none for ARMSSE) 581 * 0x40020000..0x4002ffff system control element peripherals 582 * 0x40080000..0x400fffff base peripheral region 2 583 * 0x50000000..0x5fffffff alias of 0x40000000..0x4fffffff 584 */ 585 586 memory_region_add_subregion_overlap(&s->container, 0, s->board_memory, -2); 587 588 for (i = 0; i < info->num_cpus; i++) { 589 DeviceState *cpudev = DEVICE(&s->armv7m[i]); 590 Object *cpuobj = OBJECT(&s->armv7m[i]); 591 int j; 592 char *gpioname; 593 594 qdev_prop_set_uint32(cpudev, "num-irq", s->exp_numirq + NUM_SSE_IRQS); 595 /* 596 * In real hardware the initial Secure VTOR is set from the INITSVTOR* 597 * registers in the IoT Kit System Control Register block. In QEMU 598 * we set the initial value here, and also the reset value of the 599 * sysctl register, from this object's QOM init-svtor property. 600 * If the guest changes the INITSVTOR* registers at runtime then the 601 * code in iotkit-sysctl.c will update the CPU init-svtor property 602 * (which will then take effect on the next CPU warm-reset). 603 * 604 * Note that typically a board using the SSE-200 will have a system 605 * control processor whose boot firmware initializes the INITSVTOR* 606 * registers before powering up the CPUs. QEMU doesn't emulate 607 * the control processor, so instead we behave in the way that the 608 * firmware does: the initial value should be set by the board code 609 * (using the init-svtor property on the ARMSSE object) to match 610 * whatever its firmware does. 611 */ 612 qdev_prop_set_uint32(cpudev, "init-svtor", s->init_svtor); 613 /* 614 * CPUs start powered down if the corresponding bit in the CPUWAIT 615 * register is 1. In real hardware the CPUWAIT register reset value is 616 * a configurable property of the SSE-200 (via the CPUWAIT0_RST and 617 * CPUWAIT1_RST parameters), but since all the boards we care about 618 * start CPU0 and leave CPU1 powered off, we hard-code that in 619 * info->cpuwait_rst for now. We can add QOM properties for this 620 * later if necessary. 621 */ 622 if (extract32(info->cpuwait_rst, i, 1)) { 623 if (!object_property_set_bool(cpuobj, "start-powered-off", true, 624 errp)) { 625 return; 626 } 627 } 628 if (!s->cpu_fpu[i]) { 629 if (!object_property_set_bool(cpuobj, "vfp", false, errp)) { 630 return; 631 } 632 } 633 if (!s->cpu_dsp[i]) { 634 if (!object_property_set_bool(cpuobj, "dsp", false, errp)) { 635 return; 636 } 637 } 638 639 if (i > 0) { 640 memory_region_add_subregion_overlap(&s->cpu_container[i], 0, 641 &s->container_alias[i - 1], -1); 642 } else { 643 memory_region_add_subregion_overlap(&s->cpu_container[i], 0, 644 &s->container, -1); 645 } 646 object_property_set_link(cpuobj, "memory", 647 OBJECT(&s->cpu_container[i]), &error_abort); 648 object_property_set_link(cpuobj, "idau", OBJECT(s), &error_abort); 649 if (!sysbus_realize(SYS_BUS_DEVICE(cpuobj), errp)) { 650 return; 651 } 652 /* 653 * The cluster must be realized after the armv7m container, as 654 * the container's CPU object is only created on realize, and the 655 * CPU must exist and have been parented into the cluster before 656 * the cluster is realized. 657 */ 658 if (!qdev_realize(DEVICE(&s->cluster[i]), NULL, errp)) { 659 return; 660 } 661 662 /* Connect EXP_IRQ/EXP_CPUn_IRQ GPIOs to the NVIC's lines 32 and up */ 663 s->exp_irqs[i] = g_new(qemu_irq, s->exp_numirq); 664 for (j = 0; j < s->exp_numirq; j++) { 665 s->exp_irqs[i][j] = qdev_get_gpio_in(cpudev, j + NUM_SSE_IRQS); 666 } 667 if (i == 0) { 668 gpioname = g_strdup("EXP_IRQ"); 669 } else { 670 gpioname = g_strdup_printf("EXP_CPU%d_IRQ", i); 671 } 672 qdev_init_gpio_in_named_with_opaque(dev, armsse_exp_irq, 673 s->exp_irqs[i], 674 gpioname, s->exp_numirq); 675 g_free(gpioname); 676 } 677 678 /* Wire up the splitters that connect common IRQs to all CPUs */ 679 if (info->num_cpus > 1) { 680 for (i = 0; i < ARRAY_SIZE(s->cpu_irq_splitter); i++) { 681 if (irq_is_common[i]) { 682 Object *splitter = OBJECT(&s->cpu_irq_splitter[i]); 683 DeviceState *devs = DEVICE(splitter); 684 int cpunum; 685 686 if (!object_property_set_int(splitter, "num-lines", 687 info->num_cpus, errp)) { 688 return; 689 } 690 if (!qdev_realize(DEVICE(splitter), NULL, errp)) { 691 return; 692 } 693 for (cpunum = 0; cpunum < info->num_cpus; cpunum++) { 694 DeviceState *cpudev = DEVICE(&s->armv7m[cpunum]); 695 696 qdev_connect_gpio_out(devs, cpunum, 697 qdev_get_gpio_in(cpudev, i)); 698 } 699 } 700 } 701 } 702 703 /* Set up the big aliases first */ 704 make_alias(s, &s->alias1, &s->container, "alias 1", 705 0x10000000, 0x10000000, 0x00000000); 706 make_alias(s, &s->alias2, &s->container, 707 "alias 2", 0x30000000, 0x10000000, 0x20000000); 708 /* The 0x50000000..0x5fffffff region is not a pure alias: it has 709 * a few extra devices that only appear there (generally the 710 * control interfaces for the protection controllers). 711 * We implement this by mapping those devices over the top of this 712 * alias MR at a higher priority. Some of the devices in this range 713 * are per-CPU, so we must put this alias in the per-cpu containers. 714 */ 715 for (i = 0; i < info->num_cpus; i++) { 716 make_alias(s, &s->alias3[i], &s->cpu_container[i], 717 "alias 3", 0x50000000, 0x10000000, 0x40000000); 718 } 719 720 /* Security controller */ 721 object_property_set_int(OBJECT(&s->secctl), "sse-version", 722 info->sse_version, &error_abort); 723 if (!sysbus_realize(SYS_BUS_DEVICE(&s->secctl), errp)) { 724 return; 725 } 726 sbd_secctl = SYS_BUS_DEVICE(&s->secctl); 727 dev_secctl = DEVICE(&s->secctl); 728 sysbus_mmio_map(sbd_secctl, 0, 0x50080000); 729 sysbus_mmio_map(sbd_secctl, 1, 0x40080000); 730 731 s->nsc_cfg_in = qemu_allocate_irq(nsccfg_handler, s, 1); 732 qdev_connect_gpio_out_named(dev_secctl, "nsc_cfg", 0, s->nsc_cfg_in); 733 734 /* The sec_resp_cfg output from the security controller must be split into 735 * multiple lines, one for each of the PPCs within the ARMSSE and one 736 * that will be an output from the ARMSSE to the system. 737 */ 738 if (!object_property_set_int(OBJECT(&s->sec_resp_splitter), 739 "num-lines", 3, errp)) { 740 return; 741 } 742 if (!qdev_realize(DEVICE(&s->sec_resp_splitter), NULL, errp)) { 743 return; 744 } 745 dev_splitter = DEVICE(&s->sec_resp_splitter); 746 qdev_connect_gpio_out_named(dev_secctl, "sec_resp_cfg", 0, 747 qdev_get_gpio_in(dev_splitter, 0)); 748 749 /* Each SRAM bank lives behind its own Memory Protection Controller */ 750 for (i = 0; i < info->sram_banks; i++) { 751 char *ramname = g_strdup_printf("armsse.sram%d", i); 752 SysBusDevice *sbd_mpc; 753 uint32_t sram_bank_size = 1 << s->sram_addr_width; 754 755 memory_region_init_ram(&s->sram[i], NULL, ramname, 756 sram_bank_size, &err); 757 g_free(ramname); 758 if (err) { 759 error_propagate(errp, err); 760 return; 761 } 762 object_property_set_link(OBJECT(&s->mpc[i]), "downstream", 763 OBJECT(&s->sram[i]), &error_abort); 764 if (!sysbus_realize(SYS_BUS_DEVICE(&s->mpc[i]), errp)) { 765 return; 766 } 767 /* Map the upstream end of the MPC into the right place... */ 768 sbd_mpc = SYS_BUS_DEVICE(&s->mpc[i]); 769 memory_region_add_subregion(&s->container, 770 0x20000000 + i * sram_bank_size, 771 sysbus_mmio_get_region(sbd_mpc, 1)); 772 /* ...and its register interface */ 773 memory_region_add_subregion(&s->container, 0x50083000 + i * 0x1000, 774 sysbus_mmio_get_region(sbd_mpc, 0)); 775 } 776 777 /* We must OR together lines from the MPC splitters to go to the NVIC */ 778 if (!object_property_set_int(OBJECT(&s->mpc_irq_orgate), "num-lines", 779 IOTS_NUM_EXP_MPC + info->sram_banks, 780 errp)) { 781 return; 782 } 783 if (!qdev_realize(DEVICE(&s->mpc_irq_orgate), NULL, errp)) { 784 return; 785 } 786 qdev_connect_gpio_out(DEVICE(&s->mpc_irq_orgate), 0, 787 armsse_get_common_irq_in(s, 9)); 788 789 /* Devices behind APB PPC0: 790 * 0x40000000: timer0 791 * 0x40001000: timer1 792 * 0x40002000: dual timer 793 * 0x40003000: MHU0 (SSE-200 only) 794 * 0x40004000: MHU1 (SSE-200 only) 795 * We must configure and realize each downstream device and connect 796 * it to the appropriate PPC port; then we can realize the PPC and 797 * map its upstream ends to the right place in the container. 798 */ 799 for (devinfo = info->devinfo; devinfo->name; devinfo++) { 800 SysBusDevice *sbd; 801 qemu_irq irq; 802 803 if (!strcmp(devinfo->type, TYPE_CMSDK_APB_TIMER)) { 804 sbd = SYS_BUS_DEVICE(&s->timer[devinfo->index]); 805 806 qdev_connect_clock_in(DEVICE(sbd), "pclk", s->mainclk); 807 if (!sysbus_realize(sbd, errp)) { 808 return; 809 } 810 mr = sysbus_mmio_get_region(sbd, 0); 811 } else { 812 g_assert_not_reached(); 813 } 814 815 switch (devinfo->irq) { 816 case NO_IRQ: 817 irq = NULL; 818 break; 819 case 0 ... NUM_SSE_IRQS - 1: 820 irq = armsse_get_common_irq_in(s, devinfo->irq); 821 break; 822 default: 823 g_assert_not_reached(); 824 } 825 826 if (irq) { 827 sysbus_connect_irq(sbd, 0, irq); 828 } 829 830 /* 831 * Devices connected to a PPC are connected to the port here; 832 * we will map the upstream end of that port to the right address 833 * in the container later after the PPC has been realized. 834 * Devices not connected to a PPC can be mapped immediately. 835 */ 836 if (devinfo->ppc != NO_PPC) { 837 TZPPC *ppc = &s->apb_ppc[devinfo->ppc]; 838 g_autofree char *portname = g_strdup_printf("port[%d]", 839 devinfo->ppc_port); 840 object_property_set_link(OBJECT(ppc), portname, OBJECT(mr), 841 &error_abort); 842 } else { 843 memory_region_add_subregion(&s->container, devinfo->addr, mr); 844 } 845 } 846 847 qdev_connect_clock_in(DEVICE(&s->dualtimer), "TIMCLK", s->mainclk); 848 if (!sysbus_realize(SYS_BUS_DEVICE(&s->dualtimer), errp)) { 849 return; 850 } 851 sysbus_connect_irq(SYS_BUS_DEVICE(&s->dualtimer), 0, 852 armsse_get_common_irq_in(s, 5)); 853 mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->dualtimer), 0); 854 object_property_set_link(OBJECT(&s->apb_ppc[0]), "port[2]", OBJECT(mr), 855 &error_abort); 856 857 if (info->has_mhus) { 858 /* 859 * An SSE-200 with only one CPU should have only one MHU created, 860 * with the region where the second MHU usually is being RAZ/WI. 861 * We don't implement that SSE-200 config; if we want to support 862 * it then this code needs to be enhanced to handle creating the 863 * RAZ/WI region instead of the second MHU. 864 */ 865 assert(info->num_cpus == ARRAY_SIZE(s->mhu)); 866 867 for (i = 0; i < ARRAY_SIZE(s->mhu); i++) { 868 char *port; 869 int cpunum; 870 SysBusDevice *mhu_sbd = SYS_BUS_DEVICE(&s->mhu[i]); 871 872 if (!sysbus_realize(SYS_BUS_DEVICE(&s->mhu[i]), errp)) { 873 return; 874 } 875 port = g_strdup_printf("port[%d]", i + 3); 876 mr = sysbus_mmio_get_region(mhu_sbd, 0); 877 object_property_set_link(OBJECT(&s->apb_ppc[0]), port, OBJECT(mr), 878 &error_abort); 879 g_free(port); 880 881 /* 882 * Each MHU has an irq line for each CPU: 883 * MHU 0 irq line 0 -> CPU 0 IRQ 6 884 * MHU 0 irq line 1 -> CPU 1 IRQ 6 885 * MHU 1 irq line 0 -> CPU 0 IRQ 7 886 * MHU 1 irq line 1 -> CPU 1 IRQ 7 887 */ 888 for (cpunum = 0; cpunum < info->num_cpus; cpunum++) { 889 DeviceState *cpudev = DEVICE(&s->armv7m[cpunum]); 890 891 sysbus_connect_irq(mhu_sbd, cpunum, 892 qdev_get_gpio_in(cpudev, 6 + i)); 893 } 894 } 895 } 896 897 if (!sysbus_realize(SYS_BUS_DEVICE(&s->apb_ppc[0]), errp)) { 898 return; 899 } 900 901 sbd_apb_ppc0 = SYS_BUS_DEVICE(&s->apb_ppc[0]); 902 dev_apb_ppc0 = DEVICE(&s->apb_ppc[0]); 903 904 mr = sysbus_mmio_get_region(sbd_apb_ppc0, 2); 905 memory_region_add_subregion(&s->container, 0x40002000, mr); 906 if (info->has_mhus) { 907 mr = sysbus_mmio_get_region(sbd_apb_ppc0, 3); 908 memory_region_add_subregion(&s->container, 0x40003000, mr); 909 mr = sysbus_mmio_get_region(sbd_apb_ppc0, 4); 910 memory_region_add_subregion(&s->container, 0x40004000, mr); 911 } 912 for (i = 0; i < IOTS_APB_PPC0_NUM_PORTS; i++) { 913 qdev_connect_gpio_out_named(dev_secctl, "apb_ppc0_nonsec", i, 914 qdev_get_gpio_in_named(dev_apb_ppc0, 915 "cfg_nonsec", i)); 916 qdev_connect_gpio_out_named(dev_secctl, "apb_ppc0_ap", i, 917 qdev_get_gpio_in_named(dev_apb_ppc0, 918 "cfg_ap", i)); 919 } 920 qdev_connect_gpio_out_named(dev_secctl, "apb_ppc0_irq_enable", 0, 921 qdev_get_gpio_in_named(dev_apb_ppc0, 922 "irq_enable", 0)); 923 qdev_connect_gpio_out_named(dev_secctl, "apb_ppc0_irq_clear", 0, 924 qdev_get_gpio_in_named(dev_apb_ppc0, 925 "irq_clear", 0)); 926 qdev_connect_gpio_out(dev_splitter, 0, 927 qdev_get_gpio_in_named(dev_apb_ppc0, 928 "cfg_sec_resp", 0)); 929 930 /* All the PPC irq lines (from the 2 internal PPCs and the 8 external 931 * ones) are sent individually to the security controller, and also 932 * ORed together to give a single combined PPC interrupt to the NVIC. 933 */ 934 if (!object_property_set_int(OBJECT(&s->ppc_irq_orgate), 935 "num-lines", NUM_PPCS, errp)) { 936 return; 937 } 938 if (!qdev_realize(DEVICE(&s->ppc_irq_orgate), NULL, errp)) { 939 return; 940 } 941 qdev_connect_gpio_out(DEVICE(&s->ppc_irq_orgate), 0, 942 armsse_get_common_irq_in(s, 10)); 943 944 /* 945 * 0x40010000 .. 0x4001ffff (and the 0x5001000... secure-only alias): 946 * private per-CPU region (all these devices are SSE-200 only): 947 * 0x50010000: L1 icache control registers 948 * 0x50011000: CPUSECCTRL (CPU local security control registers) 949 * 0x4001f000 and 0x5001f000: CPU_IDENTITY register block 950 */ 951 if (info->has_cachectrl) { 952 for (i = 0; i < info->num_cpus; i++) { 953 char *name = g_strdup_printf("cachectrl%d", i); 954 MemoryRegion *mr; 955 956 qdev_prop_set_string(DEVICE(&s->cachectrl[i]), "name", name); 957 g_free(name); 958 qdev_prop_set_uint64(DEVICE(&s->cachectrl[i]), "size", 0x1000); 959 if (!sysbus_realize(SYS_BUS_DEVICE(&s->cachectrl[i]), errp)) { 960 return; 961 } 962 963 mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->cachectrl[i]), 0); 964 memory_region_add_subregion(&s->cpu_container[i], 0x50010000, mr); 965 } 966 } 967 if (info->has_cpusecctrl) { 968 for (i = 0; i < info->num_cpus; i++) { 969 char *name = g_strdup_printf("CPUSECCTRL%d", i); 970 MemoryRegion *mr; 971 972 qdev_prop_set_string(DEVICE(&s->cpusecctrl[i]), "name", name); 973 g_free(name); 974 qdev_prop_set_uint64(DEVICE(&s->cpusecctrl[i]), "size", 0x1000); 975 if (!sysbus_realize(SYS_BUS_DEVICE(&s->cpusecctrl[i]), errp)) { 976 return; 977 } 978 979 mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->cpusecctrl[i]), 0); 980 memory_region_add_subregion(&s->cpu_container[i], 0x50011000, mr); 981 } 982 } 983 if (info->has_cpuid) { 984 for (i = 0; i < info->num_cpus; i++) { 985 MemoryRegion *mr; 986 987 qdev_prop_set_uint32(DEVICE(&s->cpuid[i]), "CPUID", i); 988 if (!sysbus_realize(SYS_BUS_DEVICE(&s->cpuid[i]), errp)) { 989 return; 990 } 991 992 mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->cpuid[i]), 0); 993 memory_region_add_subregion(&s->cpu_container[i], 0x4001F000, mr); 994 } 995 } 996 997 /* 0x40020000 .. 0x4002ffff : ARMSSE system control peripheral region */ 998 /* Devices behind APB PPC1: 999 * 0x4002f000: S32K timer 1000 */ 1001 qdev_connect_clock_in(DEVICE(&s->s32ktimer), "pclk", s->s32kclk); 1002 if (!sysbus_realize(SYS_BUS_DEVICE(&s->s32ktimer), errp)) { 1003 return; 1004 } 1005 sysbus_connect_irq(SYS_BUS_DEVICE(&s->s32ktimer), 0, 1006 armsse_get_common_irq_in(s, 2)); 1007 mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->s32ktimer), 0); 1008 object_property_set_link(OBJECT(&s->apb_ppc[1]), "port[0]", OBJECT(mr), 1009 &error_abort); 1010 1011 if (!sysbus_realize(SYS_BUS_DEVICE(&s->apb_ppc[1]), errp)) { 1012 return; 1013 } 1014 mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->apb_ppc[1]), 0); 1015 memory_region_add_subregion(&s->container, 0x4002f000, mr); 1016 1017 dev_apb_ppc1 = DEVICE(&s->apb_ppc[1]); 1018 qdev_connect_gpio_out_named(dev_secctl, "apb_ppc1_nonsec", 0, 1019 qdev_get_gpio_in_named(dev_apb_ppc1, 1020 "cfg_nonsec", 0)); 1021 qdev_connect_gpio_out_named(dev_secctl, "apb_ppc1_ap", 0, 1022 qdev_get_gpio_in_named(dev_apb_ppc1, 1023 "cfg_ap", 0)); 1024 qdev_connect_gpio_out_named(dev_secctl, "apb_ppc1_irq_enable", 0, 1025 qdev_get_gpio_in_named(dev_apb_ppc1, 1026 "irq_enable", 0)); 1027 qdev_connect_gpio_out_named(dev_secctl, "apb_ppc1_irq_clear", 0, 1028 qdev_get_gpio_in_named(dev_apb_ppc1, 1029 "irq_clear", 0)); 1030 qdev_connect_gpio_out(dev_splitter, 1, 1031 qdev_get_gpio_in_named(dev_apb_ppc1, 1032 "cfg_sec_resp", 0)); 1033 1034 /* 1035 * Now both PPCs are realized we can map the upstream ends of 1036 * ports which correspond to entries in the devinfo array. 1037 * The ports which are connected to non-devinfo devices have 1038 * already been mapped. 1039 */ 1040 for (devinfo = info->devinfo; devinfo->name; devinfo++) { 1041 SysBusDevice *ppc_sbd; 1042 1043 if (devinfo->ppc == NO_PPC) { 1044 continue; 1045 } 1046 ppc_sbd = SYS_BUS_DEVICE(&s->apb_ppc[devinfo->ppc]); 1047 mr = sysbus_mmio_get_region(ppc_sbd, devinfo->ppc_port); 1048 memory_region_add_subregion(&s->container, devinfo->addr, mr); 1049 } 1050 1051 if (!object_property_set_int(OBJECT(&s->sysinfo), "SYS_VERSION", 1052 info->sys_version, errp)) { 1053 return; 1054 } 1055 if (!object_property_set_int(OBJECT(&s->sysinfo), "SYS_CONFIG", 1056 armsse_sys_config_value(s, info), errp)) { 1057 return; 1058 } 1059 object_property_set_int(OBJECT(&s->sysinfo), "sse-version", 1060 info->sse_version, &error_abort); 1061 object_property_set_int(OBJECT(&s->sysinfo), "IIDR", 1062 info->iidr, &error_abort); 1063 if (!sysbus_realize(SYS_BUS_DEVICE(&s->sysinfo), errp)) { 1064 return; 1065 } 1066 /* System information registers */ 1067 sysbus_mmio_map(SYS_BUS_DEVICE(&s->sysinfo), 0, 0x40020000); 1068 /* System control registers */ 1069 object_property_set_int(OBJECT(&s->sysctl), "sse-version", 1070 info->sse_version, &error_abort); 1071 object_property_set_int(OBJECT(&s->sysctl), "CPUWAIT_RST", 1072 info->cpuwait_rst, &error_abort); 1073 object_property_set_int(OBJECT(&s->sysctl), "INITSVTOR0_RST", 1074 s->init_svtor, &error_abort); 1075 object_property_set_int(OBJECT(&s->sysctl), "INITSVTOR1_RST", 1076 s->init_svtor, &error_abort); 1077 if (!sysbus_realize(SYS_BUS_DEVICE(&s->sysctl), errp)) { 1078 return; 1079 } 1080 sysbus_mmio_map(SYS_BUS_DEVICE(&s->sysctl), 0, 0x50021000); 1081 1082 if (info->has_ppus) { 1083 /* CPUnCORE_PPU for each CPU */ 1084 for (i = 0; i < info->num_cpus; i++) { 1085 char *name = g_strdup_printf("CPU%dCORE_PPU", i); 1086 1087 map_ppu(s, CPU0CORE_PPU + i, name, 0x50023000 + i * 0x2000); 1088 /* 1089 * We don't support CPU debug so don't create the 1090 * CPU0DEBUG_PPU at 0x50024000 and 0x50026000. 1091 */ 1092 g_free(name); 1093 } 1094 map_ppu(s, DBG_PPU, "DBG_PPU", 0x50029000); 1095 1096 for (i = 0; i < info->sram_banks; i++) { 1097 char *name = g_strdup_printf("RAM%d_PPU", i); 1098 1099 map_ppu(s, RAM0_PPU + i, name, 0x5002a000 + i * 0x1000); 1100 g_free(name); 1101 } 1102 } 1103 1104 /* This OR gate wires together outputs from the secure watchdogs to NMI */ 1105 if (!object_property_set_int(OBJECT(&s->nmi_orgate), "num-lines", 2, 1106 errp)) { 1107 return; 1108 } 1109 if (!qdev_realize(DEVICE(&s->nmi_orgate), NULL, errp)) { 1110 return; 1111 } 1112 qdev_connect_gpio_out(DEVICE(&s->nmi_orgate), 0, 1113 qdev_get_gpio_in_named(DEVICE(&s->armv7m), "NMI", 0)); 1114 1115 qdev_connect_clock_in(DEVICE(&s->s32kwatchdog), "WDOGCLK", s->s32kclk); 1116 if (!sysbus_realize(SYS_BUS_DEVICE(&s->s32kwatchdog), errp)) { 1117 return; 1118 } 1119 sysbus_connect_irq(SYS_BUS_DEVICE(&s->s32kwatchdog), 0, 1120 qdev_get_gpio_in(DEVICE(&s->nmi_orgate), 0)); 1121 sysbus_mmio_map(SYS_BUS_DEVICE(&s->s32kwatchdog), 0, 0x5002e000); 1122 1123 /* 0x40080000 .. 0x4008ffff : ARMSSE second Base peripheral region */ 1124 1125 qdev_connect_clock_in(DEVICE(&s->nswatchdog), "WDOGCLK", s->mainclk); 1126 if (!sysbus_realize(SYS_BUS_DEVICE(&s->nswatchdog), errp)) { 1127 return; 1128 } 1129 sysbus_connect_irq(SYS_BUS_DEVICE(&s->nswatchdog), 0, 1130 armsse_get_common_irq_in(s, 1)); 1131 sysbus_mmio_map(SYS_BUS_DEVICE(&s->nswatchdog), 0, 0x40081000); 1132 1133 qdev_connect_clock_in(DEVICE(&s->swatchdog), "WDOGCLK", s->mainclk); 1134 if (!sysbus_realize(SYS_BUS_DEVICE(&s->swatchdog), errp)) { 1135 return; 1136 } 1137 sysbus_connect_irq(SYS_BUS_DEVICE(&s->swatchdog), 0, 1138 qdev_get_gpio_in(DEVICE(&s->nmi_orgate), 1)); 1139 sysbus_mmio_map(SYS_BUS_DEVICE(&s->swatchdog), 0, 0x50081000); 1140 1141 for (i = 0; i < ARRAY_SIZE(s->ppc_irq_splitter); i++) { 1142 Object *splitter = OBJECT(&s->ppc_irq_splitter[i]); 1143 1144 if (!object_property_set_int(splitter, "num-lines", 2, errp)) { 1145 return; 1146 } 1147 if (!qdev_realize(DEVICE(splitter), NULL, errp)) { 1148 return; 1149 } 1150 } 1151 1152 for (i = 0; i < IOTS_NUM_AHB_EXP_PPC; i++) { 1153 char *ppcname = g_strdup_printf("ahb_ppcexp%d", i); 1154 1155 armsse_forward_ppc(s, ppcname, i); 1156 g_free(ppcname); 1157 } 1158 1159 for (i = 0; i < IOTS_NUM_APB_EXP_PPC; i++) { 1160 char *ppcname = g_strdup_printf("apb_ppcexp%d", i); 1161 1162 armsse_forward_ppc(s, ppcname, i + IOTS_NUM_AHB_EXP_PPC); 1163 g_free(ppcname); 1164 } 1165 1166 for (i = NUM_EXTERNAL_PPCS; i < NUM_PPCS; i++) { 1167 /* Wire up IRQ splitter for internal PPCs */ 1168 DeviceState *devs = DEVICE(&s->ppc_irq_splitter[i]); 1169 char *gpioname = g_strdup_printf("apb_ppc%d_irq_status", 1170 i - NUM_EXTERNAL_PPCS); 1171 TZPPC *ppc = &s->apb_ppc[i - NUM_EXTERNAL_PPCS]; 1172 1173 qdev_connect_gpio_out(devs, 0, 1174 qdev_get_gpio_in_named(dev_secctl, gpioname, 0)); 1175 qdev_connect_gpio_out(devs, 1, 1176 qdev_get_gpio_in(DEVICE(&s->ppc_irq_orgate), i)); 1177 qdev_connect_gpio_out_named(DEVICE(ppc), "irq", 0, 1178 qdev_get_gpio_in(devs, 0)); 1179 g_free(gpioname); 1180 } 1181 1182 /* Wire up the splitters for the MPC IRQs */ 1183 for (i = 0; i < IOTS_NUM_EXP_MPC + info->sram_banks; i++) { 1184 SplitIRQ *splitter = &s->mpc_irq_splitter[i]; 1185 DeviceState *dev_splitter = DEVICE(splitter); 1186 1187 if (!object_property_set_int(OBJECT(splitter), "num-lines", 2, 1188 errp)) { 1189 return; 1190 } 1191 if (!qdev_realize(DEVICE(splitter), NULL, errp)) { 1192 return; 1193 } 1194 1195 if (i < IOTS_NUM_EXP_MPC) { 1196 /* Splitter input is from GPIO input line */ 1197 s->mpcexp_status_in[i] = qdev_get_gpio_in(dev_splitter, 0); 1198 qdev_connect_gpio_out(dev_splitter, 0, 1199 qdev_get_gpio_in_named(dev_secctl, 1200 "mpcexp_status", i)); 1201 } else { 1202 /* Splitter input is from our own MPC */ 1203 qdev_connect_gpio_out_named(DEVICE(&s->mpc[i - IOTS_NUM_EXP_MPC]), 1204 "irq", 0, 1205 qdev_get_gpio_in(dev_splitter, 0)); 1206 qdev_connect_gpio_out(dev_splitter, 0, 1207 qdev_get_gpio_in_named(dev_secctl, 1208 "mpc_status", 1209 i - IOTS_NUM_EXP_MPC)); 1210 } 1211 1212 qdev_connect_gpio_out(dev_splitter, 1, 1213 qdev_get_gpio_in(DEVICE(&s->mpc_irq_orgate), i)); 1214 } 1215 /* Create GPIO inputs which will pass the line state for our 1216 * mpcexp_irq inputs to the correct splitter devices. 1217 */ 1218 qdev_init_gpio_in_named(dev, armsse_mpcexp_status, "mpcexp_status", 1219 IOTS_NUM_EXP_MPC); 1220 1221 armsse_forward_sec_resp_cfg(s); 1222 1223 /* Forward the MSC related signals */ 1224 qdev_pass_gpios(dev_secctl, dev, "mscexp_status"); 1225 qdev_pass_gpios(dev_secctl, dev, "mscexp_clear"); 1226 qdev_pass_gpios(dev_secctl, dev, "mscexp_ns"); 1227 qdev_connect_gpio_out_named(dev_secctl, "msc_irq", 0, 1228 armsse_get_common_irq_in(s, 11)); 1229 1230 /* 1231 * Expose our container region to the board model; this corresponds 1232 * to the AHB Slave Expansion ports which allow bus master devices 1233 * (eg DMA controllers) in the board model to make transactions into 1234 * devices in the ARMSSE. 1235 */ 1236 sysbus_init_mmio(SYS_BUS_DEVICE(s), &s->container); 1237 1238 /* Set initial system_clock_scale from MAINCLK */ 1239 armsse_mainclk_update(s, ClockUpdate); 1240 } 1241 1242 static void armsse_idau_check(IDAUInterface *ii, uint32_t address, 1243 int *iregion, bool *exempt, bool *ns, bool *nsc) 1244 { 1245 /* 1246 * For ARMSSE systems the IDAU responses are simple logical functions 1247 * of the address bits. The NSC attribute is guest-adjustable via the 1248 * NSCCFG register in the security controller. 1249 */ 1250 ARMSSE *s = ARM_SSE(ii); 1251 int region = extract32(address, 28, 4); 1252 1253 *ns = !(region & 1); 1254 *nsc = (region == 1 && (s->nsccfg & 1)) || (region == 3 && (s->nsccfg & 2)); 1255 /* 0xe0000000..0xe00fffff and 0xf0000000..0xf00fffff are exempt */ 1256 *exempt = (address & 0xeff00000) == 0xe0000000; 1257 *iregion = region; 1258 } 1259 1260 static const VMStateDescription armsse_vmstate = { 1261 .name = "iotkit", 1262 .version_id = 2, 1263 .minimum_version_id = 2, 1264 .fields = (VMStateField[]) { 1265 VMSTATE_CLOCK(mainclk, ARMSSE), 1266 VMSTATE_CLOCK(s32kclk, ARMSSE), 1267 VMSTATE_UINT32(nsccfg, ARMSSE), 1268 VMSTATE_END_OF_LIST() 1269 } 1270 }; 1271 1272 static void armsse_reset(DeviceState *dev) 1273 { 1274 ARMSSE *s = ARM_SSE(dev); 1275 1276 s->nsccfg = 0; 1277 } 1278 1279 static void armsse_class_init(ObjectClass *klass, void *data) 1280 { 1281 DeviceClass *dc = DEVICE_CLASS(klass); 1282 IDAUInterfaceClass *iic = IDAU_INTERFACE_CLASS(klass); 1283 ARMSSEClass *asc = ARM_SSE_CLASS(klass); 1284 const ARMSSEInfo *info = data; 1285 1286 dc->realize = armsse_realize; 1287 dc->vmsd = &armsse_vmstate; 1288 device_class_set_props(dc, info->props); 1289 dc->reset = armsse_reset; 1290 iic->check = armsse_idau_check; 1291 asc->info = info; 1292 } 1293 1294 static const TypeInfo armsse_info = { 1295 .name = TYPE_ARM_SSE, 1296 .parent = TYPE_SYS_BUS_DEVICE, 1297 .instance_size = sizeof(ARMSSE), 1298 .class_size = sizeof(ARMSSEClass), 1299 .instance_init = armsse_init, 1300 .abstract = true, 1301 .interfaces = (InterfaceInfo[]) { 1302 { TYPE_IDAU_INTERFACE }, 1303 { } 1304 } 1305 }; 1306 1307 static void armsse_register_types(void) 1308 { 1309 int i; 1310 1311 type_register_static(&armsse_info); 1312 1313 for (i = 0; i < ARRAY_SIZE(armsse_variants); i++) { 1314 TypeInfo ti = { 1315 .name = armsse_variants[i].name, 1316 .parent = TYPE_ARM_SSE, 1317 .class_init = armsse_class_init, 1318 .class_data = (void *)&armsse_variants[i], 1319 }; 1320 type_register(&ti); 1321 } 1322 } 1323 1324 type_init(armsse_register_types); 1325