1 /* 2 * Arm SSE (Subsystems for Embedded): IoTKit 3 * 4 * Copyright (c) 2018 Linaro Limited 5 * Written by Peter Maydell 6 * 7 * This program is free software; you can redistribute it and/or modify 8 * it under the terms of the GNU General Public License version 2 or 9 * (at your option) any later version. 10 */ 11 12 #include "qemu/osdep.h" 13 #include "qemu/log.h" 14 #include "qemu/module.h" 15 #include "qemu/bitops.h" 16 #include "qapi/error.h" 17 #include "trace.h" 18 #include "hw/sysbus.h" 19 #include "migration/vmstate.h" 20 #include "hw/registerfields.h" 21 #include "hw/arm/armsse.h" 22 #include "hw/arm/armsse-version.h" 23 #include "hw/arm/boot.h" 24 #include "hw/irq.h" 25 #include "hw/qdev-clock.h" 26 27 /* 28 * The SSE-300 puts some devices in different places to the 29 * SSE-200 (and original IoTKit). We use an array of these structs 30 * to define how each variant lays out these devices. (Parts of the 31 * SoC that are the same for all variants aren't handled via these 32 * data structures.) 33 */ 34 35 #define NO_IRQ -1 36 #define NO_PPC -1 37 /* 38 * Special values for ARMSSEDeviceInfo::irq to indicate that this 39 * device uses one of the inputs to the OR gate that feeds into the 40 * CPU NMI input. 41 */ 42 #define NMI_0 10000 43 #define NMI_1 10001 44 45 typedef struct ARMSSEDeviceInfo { 46 const char *name; /* name to use for the QOM object; NULL terminates list */ 47 const char *type; /* QOM type name */ 48 unsigned int index; /* Which of the N devices of this type is this ? */ 49 hwaddr addr; 50 hwaddr size; /* only needed for TYPE_UNIMPLEMENTED_DEVICE */ 51 int ppc; /* Index of APB PPC this device is wired up to, or NO_PPC */ 52 int ppc_port; /* Port number of this device on the PPC */ 53 int irq; /* NO_IRQ, or 0..NUM_SSE_IRQS-1, or NMI_0 or NMI_1 */ 54 bool slowclk; /* true if device uses the slow 32KHz clock */ 55 } ARMSSEDeviceInfo; 56 57 struct ARMSSEInfo { 58 const char *name; 59 uint32_t sse_version; 60 int sram_banks; 61 int num_cpus; 62 uint32_t sys_version; 63 uint32_t iidr; 64 uint32_t cpuwait_rst; 65 bool has_mhus; 66 bool has_cachectrl; 67 bool has_cpusecctrl; 68 bool has_cpuid; 69 bool has_cpu_pwrctrl; 70 bool has_sse_counter; 71 Property *props; 72 const ARMSSEDeviceInfo *devinfo; 73 const bool *irq_is_common; 74 }; 75 76 static Property iotkit_properties[] = { 77 DEFINE_PROP_LINK("memory", ARMSSE, board_memory, TYPE_MEMORY_REGION, 78 MemoryRegion *), 79 DEFINE_PROP_UINT32("EXP_NUMIRQ", ARMSSE, exp_numirq, 64), 80 DEFINE_PROP_UINT32("SRAM_ADDR_WIDTH", ARMSSE, sram_addr_width, 15), 81 DEFINE_PROP_UINT32("init-svtor", ARMSSE, init_svtor, 0x10000000), 82 DEFINE_PROP_BOOL("CPU0_FPU", ARMSSE, cpu_fpu[0], true), 83 DEFINE_PROP_BOOL("CPU0_DSP", ARMSSE, cpu_dsp[0], true), 84 DEFINE_PROP_END_OF_LIST() 85 }; 86 87 static Property armsse_properties[] = { 88 DEFINE_PROP_LINK("memory", ARMSSE, board_memory, TYPE_MEMORY_REGION, 89 MemoryRegion *), 90 DEFINE_PROP_UINT32("EXP_NUMIRQ", ARMSSE, exp_numirq, 64), 91 DEFINE_PROP_UINT32("SRAM_ADDR_WIDTH", ARMSSE, sram_addr_width, 15), 92 DEFINE_PROP_UINT32("init-svtor", ARMSSE, init_svtor, 0x10000000), 93 DEFINE_PROP_BOOL("CPU0_FPU", ARMSSE, cpu_fpu[0], false), 94 DEFINE_PROP_BOOL("CPU0_DSP", ARMSSE, cpu_dsp[0], false), 95 DEFINE_PROP_BOOL("CPU1_FPU", ARMSSE, cpu_fpu[1], true), 96 DEFINE_PROP_BOOL("CPU1_DSP", ARMSSE, cpu_dsp[1], true), 97 DEFINE_PROP_END_OF_LIST() 98 }; 99 100 static const ARMSSEDeviceInfo iotkit_devices[] = { 101 { 102 .name = "timer0", 103 .type = TYPE_CMSDK_APB_TIMER, 104 .index = 0, 105 .addr = 0x40000000, 106 .ppc = 0, 107 .ppc_port = 0, 108 .irq = 3, 109 }, 110 { 111 .name = "timer1", 112 .type = TYPE_CMSDK_APB_TIMER, 113 .index = 1, 114 .addr = 0x40001000, 115 .ppc = 0, 116 .ppc_port = 1, 117 .irq = 4, 118 }, 119 { 120 .name = "s32ktimer", 121 .type = TYPE_CMSDK_APB_TIMER, 122 .index = 2, 123 .addr = 0x4002f000, 124 .ppc = 1, 125 .ppc_port = 0, 126 .irq = 2, 127 .slowclk = true, 128 }, 129 { 130 .name = "dualtimer", 131 .type = TYPE_CMSDK_APB_DUALTIMER, 132 .index = 0, 133 .addr = 0x40002000, 134 .ppc = 0, 135 .ppc_port = 2, 136 .irq = 5, 137 }, 138 { 139 .name = "s32kwatchdog", 140 .type = TYPE_CMSDK_APB_WATCHDOG, 141 .index = 0, 142 .addr = 0x5002e000, 143 .ppc = NO_PPC, 144 .irq = NMI_0, 145 .slowclk = true, 146 }, 147 { 148 .name = "nswatchdog", 149 .type = TYPE_CMSDK_APB_WATCHDOG, 150 .index = 1, 151 .addr = 0x40081000, 152 .ppc = NO_PPC, 153 .irq = 1, 154 }, 155 { 156 .name = "swatchdog", 157 .type = TYPE_CMSDK_APB_WATCHDOG, 158 .index = 2, 159 .addr = 0x50081000, 160 .ppc = NO_PPC, 161 .irq = NMI_1, 162 }, 163 { 164 .name = "armsse-sysinfo", 165 .type = TYPE_IOTKIT_SYSINFO, 166 .index = 0, 167 .addr = 0x40020000, 168 .ppc = NO_PPC, 169 .irq = NO_IRQ, 170 }, 171 { 172 .name = "armsse-sysctl", 173 .type = TYPE_IOTKIT_SYSCTL, 174 .index = 0, 175 .addr = 0x50021000, 176 .ppc = NO_PPC, 177 .irq = NO_IRQ, 178 }, 179 { 180 .name = NULL, 181 } 182 }; 183 184 static const ARMSSEDeviceInfo sse200_devices[] = { 185 { 186 .name = "timer0", 187 .type = TYPE_CMSDK_APB_TIMER, 188 .index = 0, 189 .addr = 0x40000000, 190 .ppc = 0, 191 .ppc_port = 0, 192 .irq = 3, 193 }, 194 { 195 .name = "timer1", 196 .type = TYPE_CMSDK_APB_TIMER, 197 .index = 1, 198 .addr = 0x40001000, 199 .ppc = 0, 200 .ppc_port = 1, 201 .irq = 4, 202 }, 203 { 204 .name = "s32ktimer", 205 .type = TYPE_CMSDK_APB_TIMER, 206 .index = 2, 207 .addr = 0x4002f000, 208 .ppc = 1, 209 .ppc_port = 0, 210 .irq = 2, 211 .slowclk = true, 212 }, 213 { 214 .name = "dualtimer", 215 .type = TYPE_CMSDK_APB_DUALTIMER, 216 .index = 0, 217 .addr = 0x40002000, 218 .ppc = 0, 219 .ppc_port = 2, 220 .irq = 5, 221 }, 222 { 223 .name = "s32kwatchdog", 224 .type = TYPE_CMSDK_APB_WATCHDOG, 225 .index = 0, 226 .addr = 0x5002e000, 227 .ppc = NO_PPC, 228 .irq = NMI_0, 229 .slowclk = true, 230 }, 231 { 232 .name = "nswatchdog", 233 .type = TYPE_CMSDK_APB_WATCHDOG, 234 .index = 1, 235 .addr = 0x40081000, 236 .ppc = NO_PPC, 237 .irq = 1, 238 }, 239 { 240 .name = "swatchdog", 241 .type = TYPE_CMSDK_APB_WATCHDOG, 242 .index = 2, 243 .addr = 0x50081000, 244 .ppc = NO_PPC, 245 .irq = NMI_1, 246 }, 247 { 248 .name = "armsse-sysinfo", 249 .type = TYPE_IOTKIT_SYSINFO, 250 .index = 0, 251 .addr = 0x40020000, 252 .ppc = NO_PPC, 253 .irq = NO_IRQ, 254 }, 255 { 256 .name = "armsse-sysctl", 257 .type = TYPE_IOTKIT_SYSCTL, 258 .index = 0, 259 .addr = 0x50021000, 260 .ppc = NO_PPC, 261 .irq = NO_IRQ, 262 }, 263 { 264 .name = "CPU0CORE_PPU", 265 .type = TYPE_UNIMPLEMENTED_DEVICE, 266 .index = 0, 267 .addr = 0x50023000, 268 .size = 0x1000, 269 .ppc = NO_PPC, 270 .irq = NO_IRQ, 271 }, 272 { 273 .name = "CPU1CORE_PPU", 274 .type = TYPE_UNIMPLEMENTED_DEVICE, 275 .index = 1, 276 .addr = 0x50025000, 277 .size = 0x1000, 278 .ppc = NO_PPC, 279 .irq = NO_IRQ, 280 }, 281 { 282 .name = "DBG_PPU", 283 .type = TYPE_UNIMPLEMENTED_DEVICE, 284 .index = 2, 285 .addr = 0x50029000, 286 .size = 0x1000, 287 .ppc = NO_PPC, 288 .irq = NO_IRQ, 289 }, 290 { 291 .name = "RAM0_PPU", 292 .type = TYPE_UNIMPLEMENTED_DEVICE, 293 .index = 3, 294 .addr = 0x5002a000, 295 .size = 0x1000, 296 .ppc = NO_PPC, 297 .irq = NO_IRQ, 298 }, 299 { 300 .name = "RAM1_PPU", 301 .type = TYPE_UNIMPLEMENTED_DEVICE, 302 .index = 4, 303 .addr = 0x5002b000, 304 .size = 0x1000, 305 .ppc = NO_PPC, 306 .irq = NO_IRQ, 307 }, 308 { 309 .name = "RAM2_PPU", 310 .type = TYPE_UNIMPLEMENTED_DEVICE, 311 .index = 5, 312 .addr = 0x5002c000, 313 .size = 0x1000, 314 .ppc = NO_PPC, 315 .irq = NO_IRQ, 316 }, 317 { 318 .name = "RAM3_PPU", 319 .type = TYPE_UNIMPLEMENTED_DEVICE, 320 .index = 6, 321 .addr = 0x5002d000, 322 .size = 0x1000, 323 .ppc = NO_PPC, 324 .irq = NO_IRQ, 325 }, 326 { 327 .name = "SYS_PPU", 328 .type = TYPE_UNIMPLEMENTED_DEVICE, 329 .index = 7, 330 .addr = 0x50022000, 331 .size = 0x1000, 332 .ppc = NO_PPC, 333 .irq = NO_IRQ, 334 }, 335 { 336 .name = NULL, 337 } 338 }; 339 340 static const ARMSSEDeviceInfo sse300_devices[] = { 341 { 342 .name = "timer0", 343 .type = TYPE_SSE_TIMER, 344 .index = 0, 345 .addr = 0x48000000, 346 .ppc = 0, 347 .ppc_port = 0, 348 .irq = 3, 349 }, 350 { 351 .name = "timer1", 352 .type = TYPE_SSE_TIMER, 353 .index = 1, 354 .addr = 0x48001000, 355 .ppc = 0, 356 .ppc_port = 1, 357 .irq = 4, 358 }, 359 { 360 .name = "timer2", 361 .type = TYPE_SSE_TIMER, 362 .index = 2, 363 .addr = 0x48002000, 364 .ppc = 0, 365 .ppc_port = 2, 366 .irq = 5, 367 }, 368 { 369 .name = "timer3", 370 .type = TYPE_SSE_TIMER, 371 .index = 3, 372 .addr = 0x48003000, 373 .ppc = 0, 374 .ppc_port = 5, 375 .irq = 27, 376 }, 377 { 378 .name = "s32ktimer", 379 .type = TYPE_CMSDK_APB_TIMER, 380 .index = 0, 381 .addr = 0x4802f000, 382 .ppc = 1, 383 .ppc_port = 0, 384 .irq = 2, 385 .slowclk = true, 386 }, 387 { 388 .name = "s32kwatchdog", 389 .type = TYPE_CMSDK_APB_WATCHDOG, 390 .index = 0, 391 .addr = 0x4802e000, 392 .ppc = NO_PPC, 393 .irq = NMI_0, 394 .slowclk = true, 395 }, 396 { 397 .name = "watchdog", 398 .type = TYPE_UNIMPLEMENTED_DEVICE, 399 .index = 0, 400 .addr = 0x48040000, 401 .size = 0x2000, 402 .ppc = NO_PPC, 403 .irq = NO_IRQ, 404 }, 405 { 406 .name = "armsse-sysinfo", 407 .type = TYPE_IOTKIT_SYSINFO, 408 .index = 0, 409 .addr = 0x48020000, 410 .ppc = NO_PPC, 411 .irq = NO_IRQ, 412 }, 413 { 414 .name = "armsse-sysctl", 415 .type = TYPE_IOTKIT_SYSCTL, 416 .index = 0, 417 .addr = 0x58021000, 418 .ppc = NO_PPC, 419 .irq = NO_IRQ, 420 }, 421 { 422 .name = "SYS_PPU", 423 .type = TYPE_UNIMPLEMENTED_DEVICE, 424 .index = 1, 425 .addr = 0x58022000, 426 .size = 0x1000, 427 .ppc = NO_PPC, 428 .irq = NO_IRQ, 429 }, 430 { 431 .name = "CPU0CORE_PPU", 432 .type = TYPE_UNIMPLEMENTED_DEVICE, 433 .index = 2, 434 .addr = 0x50023000, 435 .size = 0x1000, 436 .ppc = NO_PPC, 437 .irq = NO_IRQ, 438 }, 439 { 440 .name = "MGMT_PPU", 441 .type = TYPE_UNIMPLEMENTED_DEVICE, 442 .index = 3, 443 .addr = 0x50028000, 444 .size = 0x1000, 445 .ppc = NO_PPC, 446 .irq = NO_IRQ, 447 }, 448 { 449 .name = "DEBUG_PPU", 450 .type = TYPE_UNIMPLEMENTED_DEVICE, 451 .index = 4, 452 .addr = 0x50029000, 453 .size = 0x1000, 454 .ppc = NO_PPC, 455 .irq = NO_IRQ, 456 }, 457 { 458 .name = NULL, 459 } 460 }; 461 462 /* Is internal IRQ n shared between CPUs in a multi-core SSE ? */ 463 static const bool sse200_irq_is_common[32] = { 464 [0 ... 5] = true, 465 /* 6, 7: per-CPU MHU interrupts */ 466 [8 ... 12] = true, 467 /* 13: per-CPU icache interrupt */ 468 /* 14: reserved */ 469 [15 ... 20] = true, 470 /* 21: reserved */ 471 [22 ... 26] = true, 472 /* 27: reserved */ 473 /* 28, 29: per-CPU CTI interrupts */ 474 /* 30, 31: reserved */ 475 }; 476 477 static const bool sse300_irq_is_common[32] = { 478 [0 ... 5] = true, 479 /* 6, 7: per-CPU MHU interrupts */ 480 [8 ... 12] = true, 481 /* 13: reserved */ 482 [14 ... 16] = true, 483 /* 17-25: reserved */ 484 [26 ... 27] = true, 485 /* 28, 29: per-CPU CTI interrupts */ 486 /* 30, 31: reserved */ 487 }; 488 489 static const ARMSSEInfo armsse_variants[] = { 490 { 491 .name = TYPE_IOTKIT, 492 .sse_version = ARMSSE_IOTKIT, 493 .sram_banks = 1, 494 .num_cpus = 1, 495 .sys_version = 0x41743, 496 .iidr = 0, 497 .cpuwait_rst = 0, 498 .has_mhus = false, 499 .has_cachectrl = false, 500 .has_cpusecctrl = false, 501 .has_cpuid = false, 502 .has_cpu_pwrctrl = false, 503 .has_sse_counter = false, 504 .props = iotkit_properties, 505 .devinfo = iotkit_devices, 506 .irq_is_common = sse200_irq_is_common, 507 }, 508 { 509 .name = TYPE_SSE200, 510 .sse_version = ARMSSE_SSE200, 511 .sram_banks = 4, 512 .num_cpus = 2, 513 .sys_version = 0x22041743, 514 .iidr = 0, 515 .cpuwait_rst = 2, 516 .has_mhus = true, 517 .has_cachectrl = true, 518 .has_cpusecctrl = true, 519 .has_cpuid = true, 520 .has_cpu_pwrctrl = false, 521 .has_sse_counter = false, 522 .props = armsse_properties, 523 .devinfo = sse200_devices, 524 .irq_is_common = sse200_irq_is_common, 525 }, 526 { 527 .name = TYPE_SSE300, 528 .sse_version = ARMSSE_SSE300, 529 .sram_banks = 2, 530 .num_cpus = 1, 531 .sys_version = 0x7e00043b, 532 .iidr = 0x74a0043b, 533 .cpuwait_rst = 0, 534 .has_mhus = false, 535 .has_cachectrl = false, 536 .has_cpusecctrl = true, 537 .has_cpuid = true, 538 .has_cpu_pwrctrl = true, 539 .has_sse_counter = true, 540 .props = armsse_properties, 541 .devinfo = sse300_devices, 542 .irq_is_common = sse300_irq_is_common, 543 }, 544 }; 545 546 static uint32_t armsse_sys_config_value(ARMSSE *s, const ARMSSEInfo *info) 547 { 548 /* Return the SYS_CONFIG value for this SSE */ 549 uint32_t sys_config; 550 551 switch (info->sse_version) { 552 case ARMSSE_IOTKIT: 553 sys_config = 0; 554 sys_config = deposit32(sys_config, 0, 4, info->sram_banks); 555 sys_config = deposit32(sys_config, 4, 4, s->sram_addr_width - 12); 556 break; 557 case ARMSSE_SSE200: 558 sys_config = 0; 559 sys_config = deposit32(sys_config, 0, 4, info->sram_banks); 560 sys_config = deposit32(sys_config, 4, 5, s->sram_addr_width); 561 sys_config = deposit32(sys_config, 24, 4, 2); 562 if (info->num_cpus > 1) { 563 sys_config = deposit32(sys_config, 10, 1, 1); 564 sys_config = deposit32(sys_config, 20, 4, info->sram_banks - 1); 565 sys_config = deposit32(sys_config, 28, 4, 2); 566 } 567 break; 568 case ARMSSE_SSE300: 569 sys_config = 0; 570 sys_config = deposit32(sys_config, 0, 4, info->sram_banks); 571 sys_config = deposit32(sys_config, 4, 5, s->sram_addr_width); 572 sys_config = deposit32(sys_config, 16, 3, 3); /* CPU0 = Cortex-M55 */ 573 break; 574 default: 575 g_assert_not_reached(); 576 } 577 return sys_config; 578 } 579 580 /* Clock frequency in HZ of the 32KHz "slow clock" */ 581 #define S32KCLK (32 * 1000) 582 583 /* 584 * Create an alias region in @container of @size bytes starting at @base 585 * which mirrors the memory starting at @orig. 586 */ 587 static void make_alias(ARMSSE *s, MemoryRegion *mr, MemoryRegion *container, 588 const char *name, hwaddr base, hwaddr size, hwaddr orig) 589 { 590 memory_region_init_alias(mr, NULL, name, container, orig, size); 591 /* The alias is even lower priority than unimplemented_device regions */ 592 memory_region_add_subregion_overlap(container, base, mr, -1500); 593 } 594 595 static void irq_status_forwarder(void *opaque, int n, int level) 596 { 597 qemu_irq destirq = opaque; 598 599 qemu_set_irq(destirq, level); 600 } 601 602 static void nsccfg_handler(void *opaque, int n, int level) 603 { 604 ARMSSE *s = ARM_SSE(opaque); 605 606 s->nsccfg = level; 607 } 608 609 static void armsse_forward_ppc(ARMSSE *s, const char *ppcname, int ppcnum) 610 { 611 /* Each of the 4 AHB and 4 APB PPCs that might be present in a 612 * system using the ARMSSE has a collection of control lines which 613 * are provided by the security controller and which we want to 614 * expose as control lines on the ARMSSE device itself, so the 615 * code using the ARMSSE can wire them up to the PPCs. 616 */ 617 SplitIRQ *splitter = &s->ppc_irq_splitter[ppcnum]; 618 DeviceState *armssedev = DEVICE(s); 619 DeviceState *dev_secctl = DEVICE(&s->secctl); 620 DeviceState *dev_splitter = DEVICE(splitter); 621 char *name; 622 623 name = g_strdup_printf("%s_nonsec", ppcname); 624 qdev_pass_gpios(dev_secctl, armssedev, name); 625 g_free(name); 626 name = g_strdup_printf("%s_ap", ppcname); 627 qdev_pass_gpios(dev_secctl, armssedev, name); 628 g_free(name); 629 name = g_strdup_printf("%s_irq_enable", ppcname); 630 qdev_pass_gpios(dev_secctl, armssedev, name); 631 g_free(name); 632 name = g_strdup_printf("%s_irq_clear", ppcname); 633 qdev_pass_gpios(dev_secctl, armssedev, name); 634 g_free(name); 635 636 /* irq_status is a little more tricky, because we need to 637 * split it so we can send it both to the security controller 638 * and to our OR gate for the NVIC interrupt line. 639 * Connect up the splitter's outputs, and create a GPIO input 640 * which will pass the line state to the input splitter. 641 */ 642 name = g_strdup_printf("%s_irq_status", ppcname); 643 qdev_connect_gpio_out(dev_splitter, 0, 644 qdev_get_gpio_in_named(dev_secctl, 645 name, 0)); 646 qdev_connect_gpio_out(dev_splitter, 1, 647 qdev_get_gpio_in(DEVICE(&s->ppc_irq_orgate), ppcnum)); 648 s->irq_status_in[ppcnum] = qdev_get_gpio_in(dev_splitter, 0); 649 qdev_init_gpio_in_named_with_opaque(armssedev, irq_status_forwarder, 650 s->irq_status_in[ppcnum], name, 1); 651 g_free(name); 652 } 653 654 static void armsse_forward_sec_resp_cfg(ARMSSE *s) 655 { 656 /* Forward the 3rd output from the splitter device as a 657 * named GPIO output of the armsse object. 658 */ 659 DeviceState *dev = DEVICE(s); 660 DeviceState *dev_splitter = DEVICE(&s->sec_resp_splitter); 661 662 qdev_init_gpio_out_named(dev, &s->sec_resp_cfg, "sec_resp_cfg", 1); 663 s->sec_resp_cfg_in = qemu_allocate_irq(irq_status_forwarder, 664 s->sec_resp_cfg, 1); 665 qdev_connect_gpio_out(dev_splitter, 2, s->sec_resp_cfg_in); 666 } 667 668 static void armsse_mainclk_update(void *opaque, ClockEvent event) 669 { 670 ARMSSE *s = ARM_SSE(opaque); 671 672 /* 673 * Set system_clock_scale from our Clock input; this is what 674 * controls the tick rate of the CPU SysTick timer. 675 */ 676 system_clock_scale = clock_ticks_to_ns(s->mainclk, 1); 677 } 678 679 static void armsse_init(Object *obj) 680 { 681 ARMSSE *s = ARM_SSE(obj); 682 ARMSSEClass *asc = ARM_SSE_GET_CLASS(obj); 683 const ARMSSEInfo *info = asc->info; 684 const ARMSSEDeviceInfo *devinfo; 685 int i; 686 687 assert(info->sram_banks <= MAX_SRAM_BANKS); 688 assert(info->num_cpus <= SSE_MAX_CPUS); 689 690 s->mainclk = qdev_init_clock_in(DEVICE(s), "MAINCLK", 691 armsse_mainclk_update, s, ClockUpdate); 692 s->s32kclk = qdev_init_clock_in(DEVICE(s), "S32KCLK", NULL, NULL, 0); 693 694 memory_region_init(&s->container, obj, "armsse-container", UINT64_MAX); 695 696 for (i = 0; i < info->num_cpus; i++) { 697 /* 698 * We put each CPU in its own cluster as they are logically 699 * distinct and may be configured differently. 700 */ 701 char *name; 702 703 name = g_strdup_printf("cluster%d", i); 704 object_initialize_child(obj, name, &s->cluster[i], TYPE_CPU_CLUSTER); 705 qdev_prop_set_uint32(DEVICE(&s->cluster[i]), "cluster-id", i); 706 g_free(name); 707 708 name = g_strdup_printf("armv7m%d", i); 709 object_initialize_child(OBJECT(&s->cluster[i]), name, &s->armv7m[i], 710 TYPE_ARMV7M); 711 qdev_prop_set_string(DEVICE(&s->armv7m[i]), "cpu-type", 712 ARM_CPU_TYPE_NAME("cortex-m33")); 713 g_free(name); 714 name = g_strdup_printf("arm-sse-cpu-container%d", i); 715 memory_region_init(&s->cpu_container[i], obj, name, UINT64_MAX); 716 g_free(name); 717 if (i > 0) { 718 name = g_strdup_printf("arm-sse-container-alias%d", i); 719 memory_region_init_alias(&s->container_alias[i - 1], obj, 720 name, &s->container, 0, UINT64_MAX); 721 g_free(name); 722 } 723 } 724 725 for (devinfo = info->devinfo; devinfo->name; devinfo++) { 726 assert(devinfo->ppc == NO_PPC || devinfo->ppc < ARRAY_SIZE(s->apb_ppc)); 727 if (!strcmp(devinfo->type, TYPE_CMSDK_APB_TIMER)) { 728 assert(devinfo->index < ARRAY_SIZE(s->timer)); 729 object_initialize_child(obj, devinfo->name, 730 &s->timer[devinfo->index], 731 TYPE_CMSDK_APB_TIMER); 732 } else if (!strcmp(devinfo->type, TYPE_CMSDK_APB_DUALTIMER)) { 733 assert(devinfo->index == 0); 734 object_initialize_child(obj, devinfo->name, &s->dualtimer, 735 TYPE_CMSDK_APB_DUALTIMER); 736 } else if (!strcmp(devinfo->type, TYPE_SSE_TIMER)) { 737 assert(devinfo->index < ARRAY_SIZE(s->sse_timer)); 738 object_initialize_child(obj, devinfo->name, 739 &s->sse_timer[devinfo->index], 740 TYPE_SSE_TIMER); 741 } else if (!strcmp(devinfo->type, TYPE_CMSDK_APB_WATCHDOG)) { 742 assert(devinfo->index < ARRAY_SIZE(s->cmsdk_watchdog)); 743 object_initialize_child(obj, devinfo->name, 744 &s->cmsdk_watchdog[devinfo->index], 745 TYPE_CMSDK_APB_WATCHDOG); 746 } else if (!strcmp(devinfo->type, TYPE_IOTKIT_SYSINFO)) { 747 assert(devinfo->index == 0); 748 object_initialize_child(obj, devinfo->name, &s->sysinfo, 749 TYPE_IOTKIT_SYSINFO); 750 } else if (!strcmp(devinfo->type, TYPE_IOTKIT_SYSCTL)) { 751 assert(devinfo->index == 0); 752 object_initialize_child(obj, devinfo->name, &s->sysctl, 753 TYPE_IOTKIT_SYSCTL); 754 } else if (!strcmp(devinfo->type, TYPE_UNIMPLEMENTED_DEVICE)) { 755 assert(devinfo->index < ARRAY_SIZE(s->unimp)); 756 object_initialize_child(obj, devinfo->name, 757 &s->unimp[devinfo->index], 758 TYPE_UNIMPLEMENTED_DEVICE); 759 } else { 760 g_assert_not_reached(); 761 } 762 } 763 764 object_initialize_child(obj, "secctl", &s->secctl, TYPE_IOTKIT_SECCTL); 765 766 for (i = 0; i < ARRAY_SIZE(s->apb_ppc); i++) { 767 g_autofree char *name = g_strdup_printf("apb-ppc%d", i); 768 object_initialize_child(obj, name, &s->apb_ppc[i], TYPE_TZ_PPC); 769 } 770 771 for (i = 0; i < info->sram_banks; i++) { 772 char *name = g_strdup_printf("mpc%d", i); 773 object_initialize_child(obj, name, &s->mpc[i], TYPE_TZ_MPC); 774 g_free(name); 775 } 776 object_initialize_child(obj, "mpc-irq-orgate", &s->mpc_irq_orgate, 777 TYPE_OR_IRQ); 778 779 for (i = 0; i < IOTS_NUM_EXP_MPC + info->sram_banks; i++) { 780 char *name = g_strdup_printf("mpc-irq-splitter-%d", i); 781 SplitIRQ *splitter = &s->mpc_irq_splitter[i]; 782 783 object_initialize_child(obj, name, splitter, TYPE_SPLIT_IRQ); 784 g_free(name); 785 } 786 787 if (info->has_mhus) { 788 object_initialize_child(obj, "mhu0", &s->mhu[0], TYPE_ARMSSE_MHU); 789 object_initialize_child(obj, "mhu1", &s->mhu[1], TYPE_ARMSSE_MHU); 790 } 791 if (info->has_cachectrl) { 792 for (i = 0; i < info->num_cpus; i++) { 793 char *name = g_strdup_printf("cachectrl%d", i); 794 795 object_initialize_child(obj, name, &s->cachectrl[i], 796 TYPE_UNIMPLEMENTED_DEVICE); 797 g_free(name); 798 } 799 } 800 if (info->has_cpusecctrl) { 801 for (i = 0; i < info->num_cpus; i++) { 802 char *name = g_strdup_printf("cpusecctrl%d", i); 803 804 object_initialize_child(obj, name, &s->cpusecctrl[i], 805 TYPE_UNIMPLEMENTED_DEVICE); 806 g_free(name); 807 } 808 } 809 if (info->has_cpuid) { 810 for (i = 0; i < info->num_cpus; i++) { 811 char *name = g_strdup_printf("cpuid%d", i); 812 813 object_initialize_child(obj, name, &s->cpuid[i], 814 TYPE_ARMSSE_CPUID); 815 g_free(name); 816 } 817 } 818 if (info->has_cpu_pwrctrl) { 819 for (i = 0; i < info->num_cpus; i++) { 820 char *name = g_strdup_printf("cpu_pwrctrl%d", i); 821 822 object_initialize_child(obj, name, &s->cpu_pwrctrl[i], 823 TYPE_ARMSSE_CPU_PWRCTRL); 824 g_free(name); 825 } 826 } 827 if (info->has_sse_counter) { 828 object_initialize_child(obj, "sse-counter", &s->sse_counter, 829 TYPE_SSE_COUNTER); 830 } 831 832 object_initialize_child(obj, "nmi-orgate", &s->nmi_orgate, TYPE_OR_IRQ); 833 object_initialize_child(obj, "ppc-irq-orgate", &s->ppc_irq_orgate, 834 TYPE_OR_IRQ); 835 object_initialize_child(obj, "sec-resp-splitter", &s->sec_resp_splitter, 836 TYPE_SPLIT_IRQ); 837 for (i = 0; i < ARRAY_SIZE(s->ppc_irq_splitter); i++) { 838 char *name = g_strdup_printf("ppc-irq-splitter-%d", i); 839 SplitIRQ *splitter = &s->ppc_irq_splitter[i]; 840 841 object_initialize_child(obj, name, splitter, TYPE_SPLIT_IRQ); 842 g_free(name); 843 } 844 if (info->num_cpus > 1) { 845 for (i = 0; i < ARRAY_SIZE(s->cpu_irq_splitter); i++) { 846 if (info->irq_is_common[i]) { 847 char *name = g_strdup_printf("cpu-irq-splitter%d", i); 848 SplitIRQ *splitter = &s->cpu_irq_splitter[i]; 849 850 object_initialize_child(obj, name, splitter, TYPE_SPLIT_IRQ); 851 g_free(name); 852 } 853 } 854 } 855 } 856 857 static void armsse_exp_irq(void *opaque, int n, int level) 858 { 859 qemu_irq *irqarray = opaque; 860 861 qemu_set_irq(irqarray[n], level); 862 } 863 864 static void armsse_mpcexp_status(void *opaque, int n, int level) 865 { 866 ARMSSE *s = ARM_SSE(opaque); 867 qemu_set_irq(s->mpcexp_status_in[n], level); 868 } 869 870 static qemu_irq armsse_get_common_irq_in(ARMSSE *s, int irqno) 871 { 872 /* 873 * Return a qemu_irq which can be used to signal IRQ n to 874 * all CPUs in the SSE. 875 */ 876 ARMSSEClass *asc = ARM_SSE_GET_CLASS(s); 877 const ARMSSEInfo *info = asc->info; 878 879 assert(info->irq_is_common[irqno]); 880 881 if (info->num_cpus == 1) { 882 /* Only one CPU -- just connect directly to it */ 883 return qdev_get_gpio_in(DEVICE(&s->armv7m[0]), irqno); 884 } else { 885 /* Connect to the splitter which feeds all CPUs */ 886 return qdev_get_gpio_in(DEVICE(&s->cpu_irq_splitter[irqno]), 0); 887 } 888 } 889 890 static void armsse_realize(DeviceState *dev, Error **errp) 891 { 892 ARMSSE *s = ARM_SSE(dev); 893 ARMSSEClass *asc = ARM_SSE_GET_CLASS(dev); 894 const ARMSSEInfo *info = asc->info; 895 const ARMSSEDeviceInfo *devinfo; 896 int i; 897 MemoryRegion *mr; 898 Error *err = NULL; 899 SysBusDevice *sbd_apb_ppc0; 900 SysBusDevice *sbd_secctl; 901 DeviceState *dev_apb_ppc0; 902 DeviceState *dev_apb_ppc1; 903 DeviceState *dev_secctl; 904 DeviceState *dev_splitter; 905 uint32_t addr_width_max; 906 907 if (!s->board_memory) { 908 error_setg(errp, "memory property was not set"); 909 return; 910 } 911 912 if (!clock_has_source(s->mainclk)) { 913 error_setg(errp, "MAINCLK clock was not connected"); 914 } 915 if (!clock_has_source(s->s32kclk)) { 916 error_setg(errp, "S32KCLK clock was not connected"); 917 } 918 919 assert(info->num_cpus <= SSE_MAX_CPUS); 920 921 /* max SRAM_ADDR_WIDTH: 24 - log2(SRAM_NUM_BANK) */ 922 assert(is_power_of_2(info->sram_banks)); 923 addr_width_max = 24 - ctz32(info->sram_banks); 924 if (s->sram_addr_width < 1 || s->sram_addr_width > addr_width_max) { 925 error_setg(errp, "SRAM_ADDR_WIDTH must be between 1 and %d", 926 addr_width_max); 927 return; 928 } 929 930 /* Handling of which devices should be available only to secure 931 * code is usually done differently for M profile than for A profile. 932 * Instead of putting some devices only into the secure address space, 933 * devices exist in both address spaces but with hard-wired security 934 * permissions that will cause the CPU to fault for non-secure accesses. 935 * 936 * The ARMSSE has an IDAU (Implementation Defined Access Unit), 937 * which specifies hard-wired security permissions for different 938 * areas of the physical address space. For the ARMSSE IDAU, the 939 * top 4 bits of the physical address are the IDAU region ID, and 940 * if bit 28 (ie the lowest bit of the ID) is 0 then this is an NS 941 * region, otherwise it is an S region. 942 * 943 * The various devices and RAMs are generally all mapped twice, 944 * once into a region that the IDAU defines as secure and once 945 * into a non-secure region. They sit behind either a Memory 946 * Protection Controller (for RAM) or a Peripheral Protection 947 * Controller (for devices), which allow a more fine grained 948 * configuration of whether non-secure accesses are permitted. 949 * 950 * (The other place that guest software can configure security 951 * permissions is in the architected SAU (Security Attribution 952 * Unit), which is entirely inside the CPU. The IDAU can upgrade 953 * the security attributes for a region to more restrictive than 954 * the SAU specifies, but cannot downgrade them.) 955 * 956 * 0x10000000..0x1fffffff alias of 0x00000000..0x0fffffff 957 * 0x20000000..0x2007ffff 32KB FPGA block RAM 958 * 0x30000000..0x3fffffff alias of 0x20000000..0x2fffffff 959 * 0x40000000..0x4000ffff base peripheral region 1 960 * 0x40010000..0x4001ffff CPU peripherals (none for ARMSSE) 961 * 0x40020000..0x4002ffff system control element peripherals 962 * 0x40080000..0x400fffff base peripheral region 2 963 * 0x50000000..0x5fffffff alias of 0x40000000..0x4fffffff 964 */ 965 966 memory_region_add_subregion_overlap(&s->container, 0, s->board_memory, -2); 967 968 for (i = 0; i < info->num_cpus; i++) { 969 DeviceState *cpudev = DEVICE(&s->armv7m[i]); 970 Object *cpuobj = OBJECT(&s->armv7m[i]); 971 int j; 972 char *gpioname; 973 974 qdev_prop_set_uint32(cpudev, "num-irq", s->exp_numirq + NUM_SSE_IRQS); 975 /* 976 * In real hardware the initial Secure VTOR is set from the INITSVTOR* 977 * registers in the IoT Kit System Control Register block. In QEMU 978 * we set the initial value here, and also the reset value of the 979 * sysctl register, from this object's QOM init-svtor property. 980 * If the guest changes the INITSVTOR* registers at runtime then the 981 * code in iotkit-sysctl.c will update the CPU init-svtor property 982 * (which will then take effect on the next CPU warm-reset). 983 * 984 * Note that typically a board using the SSE-200 will have a system 985 * control processor whose boot firmware initializes the INITSVTOR* 986 * registers before powering up the CPUs. QEMU doesn't emulate 987 * the control processor, so instead we behave in the way that the 988 * firmware does: the initial value should be set by the board code 989 * (using the init-svtor property on the ARMSSE object) to match 990 * whatever its firmware does. 991 */ 992 qdev_prop_set_uint32(cpudev, "init-svtor", s->init_svtor); 993 /* 994 * CPUs start powered down if the corresponding bit in the CPUWAIT 995 * register is 1. In real hardware the CPUWAIT register reset value is 996 * a configurable property of the SSE-200 (via the CPUWAIT0_RST and 997 * CPUWAIT1_RST parameters), but since all the boards we care about 998 * start CPU0 and leave CPU1 powered off, we hard-code that in 999 * info->cpuwait_rst for now. We can add QOM properties for this 1000 * later if necessary. 1001 */ 1002 if (extract32(info->cpuwait_rst, i, 1)) { 1003 if (!object_property_set_bool(cpuobj, "start-powered-off", true, 1004 errp)) { 1005 return; 1006 } 1007 } 1008 if (!s->cpu_fpu[i]) { 1009 if (!object_property_set_bool(cpuobj, "vfp", false, errp)) { 1010 return; 1011 } 1012 } 1013 if (!s->cpu_dsp[i]) { 1014 if (!object_property_set_bool(cpuobj, "dsp", false, errp)) { 1015 return; 1016 } 1017 } 1018 1019 if (i > 0) { 1020 memory_region_add_subregion_overlap(&s->cpu_container[i], 0, 1021 &s->container_alias[i - 1], -1); 1022 } else { 1023 memory_region_add_subregion_overlap(&s->cpu_container[i], 0, 1024 &s->container, -1); 1025 } 1026 object_property_set_link(cpuobj, "memory", 1027 OBJECT(&s->cpu_container[i]), &error_abort); 1028 object_property_set_link(cpuobj, "idau", OBJECT(s), &error_abort); 1029 if (!sysbus_realize(SYS_BUS_DEVICE(cpuobj), errp)) { 1030 return; 1031 } 1032 /* 1033 * The cluster must be realized after the armv7m container, as 1034 * the container's CPU object is only created on realize, and the 1035 * CPU must exist and have been parented into the cluster before 1036 * the cluster is realized. 1037 */ 1038 if (!qdev_realize(DEVICE(&s->cluster[i]), NULL, errp)) { 1039 return; 1040 } 1041 1042 /* Connect EXP_IRQ/EXP_CPUn_IRQ GPIOs to the NVIC's lines 32 and up */ 1043 s->exp_irqs[i] = g_new(qemu_irq, s->exp_numirq); 1044 for (j = 0; j < s->exp_numirq; j++) { 1045 s->exp_irqs[i][j] = qdev_get_gpio_in(cpudev, j + NUM_SSE_IRQS); 1046 } 1047 if (i == 0) { 1048 gpioname = g_strdup("EXP_IRQ"); 1049 } else { 1050 gpioname = g_strdup_printf("EXP_CPU%d_IRQ", i); 1051 } 1052 qdev_init_gpio_in_named_with_opaque(dev, armsse_exp_irq, 1053 s->exp_irqs[i], 1054 gpioname, s->exp_numirq); 1055 g_free(gpioname); 1056 } 1057 1058 /* Wire up the splitters that connect common IRQs to all CPUs */ 1059 if (info->num_cpus > 1) { 1060 for (i = 0; i < ARRAY_SIZE(s->cpu_irq_splitter); i++) { 1061 if (info->irq_is_common[i]) { 1062 Object *splitter = OBJECT(&s->cpu_irq_splitter[i]); 1063 DeviceState *devs = DEVICE(splitter); 1064 int cpunum; 1065 1066 if (!object_property_set_int(splitter, "num-lines", 1067 info->num_cpus, errp)) { 1068 return; 1069 } 1070 if (!qdev_realize(DEVICE(splitter), NULL, errp)) { 1071 return; 1072 } 1073 for (cpunum = 0; cpunum < info->num_cpus; cpunum++) { 1074 DeviceState *cpudev = DEVICE(&s->armv7m[cpunum]); 1075 1076 qdev_connect_gpio_out(devs, cpunum, 1077 qdev_get_gpio_in(cpudev, i)); 1078 } 1079 } 1080 } 1081 } 1082 1083 /* Set up the big aliases first */ 1084 make_alias(s, &s->alias1, &s->container, "alias 1", 1085 0x10000000, 0x10000000, 0x00000000); 1086 make_alias(s, &s->alias2, &s->container, 1087 "alias 2", 0x30000000, 0x10000000, 0x20000000); 1088 /* The 0x50000000..0x5fffffff region is not a pure alias: it has 1089 * a few extra devices that only appear there (generally the 1090 * control interfaces for the protection controllers). 1091 * We implement this by mapping those devices over the top of this 1092 * alias MR at a higher priority. Some of the devices in this range 1093 * are per-CPU, so we must put this alias in the per-cpu containers. 1094 */ 1095 for (i = 0; i < info->num_cpus; i++) { 1096 make_alias(s, &s->alias3[i], &s->cpu_container[i], 1097 "alias 3", 0x50000000, 0x10000000, 0x40000000); 1098 } 1099 1100 /* Security controller */ 1101 object_property_set_int(OBJECT(&s->secctl), "sse-version", 1102 info->sse_version, &error_abort); 1103 if (!sysbus_realize(SYS_BUS_DEVICE(&s->secctl), errp)) { 1104 return; 1105 } 1106 sbd_secctl = SYS_BUS_DEVICE(&s->secctl); 1107 dev_secctl = DEVICE(&s->secctl); 1108 sysbus_mmio_map(sbd_secctl, 0, 0x50080000); 1109 sysbus_mmio_map(sbd_secctl, 1, 0x40080000); 1110 1111 s->nsc_cfg_in = qemu_allocate_irq(nsccfg_handler, s, 1); 1112 qdev_connect_gpio_out_named(dev_secctl, "nsc_cfg", 0, s->nsc_cfg_in); 1113 1114 /* The sec_resp_cfg output from the security controller must be split into 1115 * multiple lines, one for each of the PPCs within the ARMSSE and one 1116 * that will be an output from the ARMSSE to the system. 1117 */ 1118 if (!object_property_set_int(OBJECT(&s->sec_resp_splitter), 1119 "num-lines", 3, errp)) { 1120 return; 1121 } 1122 if (!qdev_realize(DEVICE(&s->sec_resp_splitter), NULL, errp)) { 1123 return; 1124 } 1125 dev_splitter = DEVICE(&s->sec_resp_splitter); 1126 qdev_connect_gpio_out_named(dev_secctl, "sec_resp_cfg", 0, 1127 qdev_get_gpio_in(dev_splitter, 0)); 1128 1129 /* Each SRAM bank lives behind its own Memory Protection Controller */ 1130 for (i = 0; i < info->sram_banks; i++) { 1131 char *ramname = g_strdup_printf("armsse.sram%d", i); 1132 SysBusDevice *sbd_mpc; 1133 uint32_t sram_bank_size = 1 << s->sram_addr_width; 1134 1135 memory_region_init_ram(&s->sram[i], NULL, ramname, 1136 sram_bank_size, &err); 1137 g_free(ramname); 1138 if (err) { 1139 error_propagate(errp, err); 1140 return; 1141 } 1142 object_property_set_link(OBJECT(&s->mpc[i]), "downstream", 1143 OBJECT(&s->sram[i]), &error_abort); 1144 if (!sysbus_realize(SYS_BUS_DEVICE(&s->mpc[i]), errp)) { 1145 return; 1146 } 1147 /* Map the upstream end of the MPC into the right place... */ 1148 sbd_mpc = SYS_BUS_DEVICE(&s->mpc[i]); 1149 memory_region_add_subregion(&s->container, 1150 0x20000000 + i * sram_bank_size, 1151 sysbus_mmio_get_region(sbd_mpc, 1)); 1152 /* ...and its register interface */ 1153 memory_region_add_subregion(&s->container, 0x50083000 + i * 0x1000, 1154 sysbus_mmio_get_region(sbd_mpc, 0)); 1155 } 1156 1157 /* We must OR together lines from the MPC splitters to go to the NVIC */ 1158 if (!object_property_set_int(OBJECT(&s->mpc_irq_orgate), "num-lines", 1159 IOTS_NUM_EXP_MPC + info->sram_banks, 1160 errp)) { 1161 return; 1162 } 1163 if (!qdev_realize(DEVICE(&s->mpc_irq_orgate), NULL, errp)) { 1164 return; 1165 } 1166 qdev_connect_gpio_out(DEVICE(&s->mpc_irq_orgate), 0, 1167 armsse_get_common_irq_in(s, 9)); 1168 1169 /* This OR gate wires together outputs from the secure watchdogs to NMI */ 1170 if (!object_property_set_int(OBJECT(&s->nmi_orgate), "num-lines", 2, 1171 errp)) { 1172 return; 1173 } 1174 if (!qdev_realize(DEVICE(&s->nmi_orgate), NULL, errp)) { 1175 return; 1176 } 1177 qdev_connect_gpio_out(DEVICE(&s->nmi_orgate), 0, 1178 qdev_get_gpio_in_named(DEVICE(&s->armv7m), "NMI", 0)); 1179 1180 /* The SSE-300 has a System Counter / System Timestamp Generator */ 1181 if (info->has_sse_counter) { 1182 SysBusDevice *sbd = SYS_BUS_DEVICE(&s->sse_counter); 1183 1184 qdev_connect_clock_in(DEVICE(sbd), "CLK", s->mainclk); 1185 if (!sysbus_realize(sbd, errp)) { 1186 return; 1187 } 1188 /* 1189 * The control frame is only in the Secure region; 1190 * the status frame is in the NS region (and visible in the 1191 * S region via the alias mapping). 1192 */ 1193 memory_region_add_subregion(&s->container, 0x58100000, 1194 sysbus_mmio_get_region(sbd, 0)); 1195 memory_region_add_subregion(&s->container, 0x48101000, 1196 sysbus_mmio_get_region(sbd, 1)); 1197 } 1198 1199 /* Devices behind APB PPC0: 1200 * 0x40000000: timer0 1201 * 0x40001000: timer1 1202 * 0x40002000: dual timer 1203 * 0x40003000: MHU0 (SSE-200 only) 1204 * 0x40004000: MHU1 (SSE-200 only) 1205 * We must configure and realize each downstream device and connect 1206 * it to the appropriate PPC port; then we can realize the PPC and 1207 * map its upstream ends to the right place in the container. 1208 */ 1209 for (devinfo = info->devinfo; devinfo->name; devinfo++) { 1210 SysBusDevice *sbd; 1211 qemu_irq irq; 1212 1213 if (!strcmp(devinfo->type, TYPE_CMSDK_APB_TIMER)) { 1214 sbd = SYS_BUS_DEVICE(&s->timer[devinfo->index]); 1215 1216 qdev_connect_clock_in(DEVICE(sbd), "pclk", 1217 devinfo->slowclk ? s->s32kclk : s->mainclk); 1218 if (!sysbus_realize(sbd, errp)) { 1219 return; 1220 } 1221 mr = sysbus_mmio_get_region(sbd, 0); 1222 } else if (!strcmp(devinfo->type, TYPE_CMSDK_APB_DUALTIMER)) { 1223 sbd = SYS_BUS_DEVICE(&s->dualtimer); 1224 1225 qdev_connect_clock_in(DEVICE(sbd), "TIMCLK", s->mainclk); 1226 if (!sysbus_realize(sbd, errp)) { 1227 return; 1228 } 1229 mr = sysbus_mmio_get_region(sbd, 0); 1230 } else if (!strcmp(devinfo->type, TYPE_SSE_TIMER)) { 1231 sbd = SYS_BUS_DEVICE(&s->sse_timer[devinfo->index]); 1232 1233 assert(info->has_sse_counter); 1234 object_property_set_link(OBJECT(sbd), "counter", 1235 OBJECT(&s->sse_counter), &error_abort); 1236 if (!sysbus_realize(sbd, errp)) { 1237 return; 1238 } 1239 mr = sysbus_mmio_get_region(sbd, 0); 1240 } else if (!strcmp(devinfo->type, TYPE_CMSDK_APB_WATCHDOG)) { 1241 sbd = SYS_BUS_DEVICE(&s->cmsdk_watchdog[devinfo->index]); 1242 1243 qdev_connect_clock_in(DEVICE(sbd), "WDOGCLK", 1244 devinfo->slowclk ? s->s32kclk : s->mainclk); 1245 if (!sysbus_realize(sbd, errp)) { 1246 return; 1247 } 1248 mr = sysbus_mmio_get_region(sbd, 0); 1249 } else if (!strcmp(devinfo->type, TYPE_IOTKIT_SYSINFO)) { 1250 sbd = SYS_BUS_DEVICE(&s->sysinfo); 1251 1252 object_property_set_int(OBJECT(&s->sysinfo), "SYS_VERSION", 1253 info->sys_version, &error_abort); 1254 object_property_set_int(OBJECT(&s->sysinfo), "SYS_CONFIG", 1255 armsse_sys_config_value(s, info), 1256 &error_abort); 1257 object_property_set_int(OBJECT(&s->sysinfo), "sse-version", 1258 info->sse_version, &error_abort); 1259 object_property_set_int(OBJECT(&s->sysinfo), "IIDR", 1260 info->iidr, &error_abort); 1261 if (!sysbus_realize(sbd, errp)) { 1262 return; 1263 } 1264 mr = sysbus_mmio_get_region(sbd, 0); 1265 } else if (!strcmp(devinfo->type, TYPE_IOTKIT_SYSCTL)) { 1266 /* System control registers */ 1267 sbd = SYS_BUS_DEVICE(&s->sysctl); 1268 1269 object_property_set_int(OBJECT(&s->sysctl), "sse-version", 1270 info->sse_version, &error_abort); 1271 object_property_set_int(OBJECT(&s->sysctl), "CPUWAIT_RST", 1272 info->cpuwait_rst, &error_abort); 1273 object_property_set_int(OBJECT(&s->sysctl), "INITSVTOR0_RST", 1274 s->init_svtor, &error_abort); 1275 object_property_set_int(OBJECT(&s->sysctl), "INITSVTOR1_RST", 1276 s->init_svtor, &error_abort); 1277 if (!sysbus_realize(sbd, errp)) { 1278 return; 1279 } 1280 mr = sysbus_mmio_get_region(sbd, 0); 1281 } else if (!strcmp(devinfo->type, TYPE_UNIMPLEMENTED_DEVICE)) { 1282 sbd = SYS_BUS_DEVICE(&s->unimp[devinfo->index]); 1283 1284 qdev_prop_set_string(DEVICE(sbd), "name", devinfo->name); 1285 qdev_prop_set_uint64(DEVICE(sbd), "size", devinfo->size); 1286 if (!sysbus_realize(sbd, errp)) { 1287 return; 1288 } 1289 mr = sysbus_mmio_get_region(sbd, 0); 1290 } else { 1291 g_assert_not_reached(); 1292 } 1293 1294 switch (devinfo->irq) { 1295 case NO_IRQ: 1296 irq = NULL; 1297 break; 1298 case 0 ... NUM_SSE_IRQS - 1: 1299 irq = armsse_get_common_irq_in(s, devinfo->irq); 1300 break; 1301 case NMI_0: 1302 case NMI_1: 1303 irq = qdev_get_gpio_in(DEVICE(&s->nmi_orgate), 1304 devinfo->irq - NMI_0); 1305 break; 1306 default: 1307 g_assert_not_reached(); 1308 } 1309 1310 if (irq) { 1311 sysbus_connect_irq(sbd, 0, irq); 1312 } 1313 1314 /* 1315 * Devices connected to a PPC are connected to the port here; 1316 * we will map the upstream end of that port to the right address 1317 * in the container later after the PPC has been realized. 1318 * Devices not connected to a PPC can be mapped immediately. 1319 */ 1320 if (devinfo->ppc != NO_PPC) { 1321 TZPPC *ppc = &s->apb_ppc[devinfo->ppc]; 1322 g_autofree char *portname = g_strdup_printf("port[%d]", 1323 devinfo->ppc_port); 1324 object_property_set_link(OBJECT(ppc), portname, OBJECT(mr), 1325 &error_abort); 1326 } else { 1327 memory_region_add_subregion(&s->container, devinfo->addr, mr); 1328 } 1329 } 1330 1331 if (info->has_mhus) { 1332 /* 1333 * An SSE-200 with only one CPU should have only one MHU created, 1334 * with the region where the second MHU usually is being RAZ/WI. 1335 * We don't implement that SSE-200 config; if we want to support 1336 * it then this code needs to be enhanced to handle creating the 1337 * RAZ/WI region instead of the second MHU. 1338 */ 1339 assert(info->num_cpus == ARRAY_SIZE(s->mhu)); 1340 1341 for (i = 0; i < ARRAY_SIZE(s->mhu); i++) { 1342 char *port; 1343 int cpunum; 1344 SysBusDevice *mhu_sbd = SYS_BUS_DEVICE(&s->mhu[i]); 1345 1346 if (!sysbus_realize(SYS_BUS_DEVICE(&s->mhu[i]), errp)) { 1347 return; 1348 } 1349 port = g_strdup_printf("port[%d]", i + 3); 1350 mr = sysbus_mmio_get_region(mhu_sbd, 0); 1351 object_property_set_link(OBJECT(&s->apb_ppc[0]), port, OBJECT(mr), 1352 &error_abort); 1353 g_free(port); 1354 1355 /* 1356 * Each MHU has an irq line for each CPU: 1357 * MHU 0 irq line 0 -> CPU 0 IRQ 6 1358 * MHU 0 irq line 1 -> CPU 1 IRQ 6 1359 * MHU 1 irq line 0 -> CPU 0 IRQ 7 1360 * MHU 1 irq line 1 -> CPU 1 IRQ 7 1361 */ 1362 for (cpunum = 0; cpunum < info->num_cpus; cpunum++) { 1363 DeviceState *cpudev = DEVICE(&s->armv7m[cpunum]); 1364 1365 sysbus_connect_irq(mhu_sbd, cpunum, 1366 qdev_get_gpio_in(cpudev, 6 + i)); 1367 } 1368 } 1369 } 1370 1371 if (!sysbus_realize(SYS_BUS_DEVICE(&s->apb_ppc[0]), errp)) { 1372 return; 1373 } 1374 1375 sbd_apb_ppc0 = SYS_BUS_DEVICE(&s->apb_ppc[0]); 1376 dev_apb_ppc0 = DEVICE(&s->apb_ppc[0]); 1377 1378 if (info->has_mhus) { 1379 mr = sysbus_mmio_get_region(sbd_apb_ppc0, 3); 1380 memory_region_add_subregion(&s->container, 0x40003000, mr); 1381 mr = sysbus_mmio_get_region(sbd_apb_ppc0, 4); 1382 memory_region_add_subregion(&s->container, 0x40004000, mr); 1383 } 1384 for (i = 0; i < IOTS_APB_PPC0_NUM_PORTS; i++) { 1385 qdev_connect_gpio_out_named(dev_secctl, "apb_ppc0_nonsec", i, 1386 qdev_get_gpio_in_named(dev_apb_ppc0, 1387 "cfg_nonsec", i)); 1388 qdev_connect_gpio_out_named(dev_secctl, "apb_ppc0_ap", i, 1389 qdev_get_gpio_in_named(dev_apb_ppc0, 1390 "cfg_ap", i)); 1391 } 1392 qdev_connect_gpio_out_named(dev_secctl, "apb_ppc0_irq_enable", 0, 1393 qdev_get_gpio_in_named(dev_apb_ppc0, 1394 "irq_enable", 0)); 1395 qdev_connect_gpio_out_named(dev_secctl, "apb_ppc0_irq_clear", 0, 1396 qdev_get_gpio_in_named(dev_apb_ppc0, 1397 "irq_clear", 0)); 1398 qdev_connect_gpio_out(dev_splitter, 0, 1399 qdev_get_gpio_in_named(dev_apb_ppc0, 1400 "cfg_sec_resp", 0)); 1401 1402 /* All the PPC irq lines (from the 2 internal PPCs and the 8 external 1403 * ones) are sent individually to the security controller, and also 1404 * ORed together to give a single combined PPC interrupt to the NVIC. 1405 */ 1406 if (!object_property_set_int(OBJECT(&s->ppc_irq_orgate), 1407 "num-lines", NUM_PPCS, errp)) { 1408 return; 1409 } 1410 if (!qdev_realize(DEVICE(&s->ppc_irq_orgate), NULL, errp)) { 1411 return; 1412 } 1413 qdev_connect_gpio_out(DEVICE(&s->ppc_irq_orgate), 0, 1414 armsse_get_common_irq_in(s, 10)); 1415 1416 /* 1417 * 0x40010000 .. 0x4001ffff (and the 0x5001000... secure-only alias): 1418 * private per-CPU region (all these devices are SSE-200 only): 1419 * 0x50010000: L1 icache control registers 1420 * 0x50011000: CPUSECCTRL (CPU local security control registers) 1421 * 0x4001f000 and 0x5001f000: CPU_IDENTITY register block 1422 * The SSE-300 has an extra: 1423 * 0x40012000 and 0x50012000: CPU_PWRCTRL register block 1424 */ 1425 if (info->has_cachectrl) { 1426 for (i = 0; i < info->num_cpus; i++) { 1427 char *name = g_strdup_printf("cachectrl%d", i); 1428 MemoryRegion *mr; 1429 1430 qdev_prop_set_string(DEVICE(&s->cachectrl[i]), "name", name); 1431 g_free(name); 1432 qdev_prop_set_uint64(DEVICE(&s->cachectrl[i]), "size", 0x1000); 1433 if (!sysbus_realize(SYS_BUS_DEVICE(&s->cachectrl[i]), errp)) { 1434 return; 1435 } 1436 1437 mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->cachectrl[i]), 0); 1438 memory_region_add_subregion(&s->cpu_container[i], 0x50010000, mr); 1439 } 1440 } 1441 if (info->has_cpusecctrl) { 1442 for (i = 0; i < info->num_cpus; i++) { 1443 char *name = g_strdup_printf("CPUSECCTRL%d", i); 1444 MemoryRegion *mr; 1445 1446 qdev_prop_set_string(DEVICE(&s->cpusecctrl[i]), "name", name); 1447 g_free(name); 1448 qdev_prop_set_uint64(DEVICE(&s->cpusecctrl[i]), "size", 0x1000); 1449 if (!sysbus_realize(SYS_BUS_DEVICE(&s->cpusecctrl[i]), errp)) { 1450 return; 1451 } 1452 1453 mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->cpusecctrl[i]), 0); 1454 memory_region_add_subregion(&s->cpu_container[i], 0x50011000, mr); 1455 } 1456 } 1457 if (info->has_cpuid) { 1458 for (i = 0; i < info->num_cpus; i++) { 1459 MemoryRegion *mr; 1460 1461 qdev_prop_set_uint32(DEVICE(&s->cpuid[i]), "CPUID", i); 1462 if (!sysbus_realize(SYS_BUS_DEVICE(&s->cpuid[i]), errp)) { 1463 return; 1464 } 1465 1466 mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->cpuid[i]), 0); 1467 memory_region_add_subregion(&s->cpu_container[i], 0x4001F000, mr); 1468 } 1469 } 1470 if (info->has_cpu_pwrctrl) { 1471 for (i = 0; i < info->num_cpus; i++) { 1472 MemoryRegion *mr; 1473 1474 if (!sysbus_realize(SYS_BUS_DEVICE(&s->cpu_pwrctrl[i]), errp)) { 1475 return; 1476 } 1477 1478 mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->cpu_pwrctrl[i]), 0); 1479 memory_region_add_subregion(&s->cpu_container[i], 0x40012000, mr); 1480 } 1481 } 1482 1483 if (!sysbus_realize(SYS_BUS_DEVICE(&s->apb_ppc[1]), errp)) { 1484 return; 1485 } 1486 1487 dev_apb_ppc1 = DEVICE(&s->apb_ppc[1]); 1488 qdev_connect_gpio_out_named(dev_secctl, "apb_ppc1_nonsec", 0, 1489 qdev_get_gpio_in_named(dev_apb_ppc1, 1490 "cfg_nonsec", 0)); 1491 qdev_connect_gpio_out_named(dev_secctl, "apb_ppc1_ap", 0, 1492 qdev_get_gpio_in_named(dev_apb_ppc1, 1493 "cfg_ap", 0)); 1494 qdev_connect_gpio_out_named(dev_secctl, "apb_ppc1_irq_enable", 0, 1495 qdev_get_gpio_in_named(dev_apb_ppc1, 1496 "irq_enable", 0)); 1497 qdev_connect_gpio_out_named(dev_secctl, "apb_ppc1_irq_clear", 0, 1498 qdev_get_gpio_in_named(dev_apb_ppc1, 1499 "irq_clear", 0)); 1500 qdev_connect_gpio_out(dev_splitter, 1, 1501 qdev_get_gpio_in_named(dev_apb_ppc1, 1502 "cfg_sec_resp", 0)); 1503 1504 /* 1505 * Now both PPCs are realized we can map the upstream ends of 1506 * ports which correspond to entries in the devinfo array. 1507 * The ports which are connected to non-devinfo devices have 1508 * already been mapped. 1509 */ 1510 for (devinfo = info->devinfo; devinfo->name; devinfo++) { 1511 SysBusDevice *ppc_sbd; 1512 1513 if (devinfo->ppc == NO_PPC) { 1514 continue; 1515 } 1516 ppc_sbd = SYS_BUS_DEVICE(&s->apb_ppc[devinfo->ppc]); 1517 mr = sysbus_mmio_get_region(ppc_sbd, devinfo->ppc_port); 1518 memory_region_add_subregion(&s->container, devinfo->addr, mr); 1519 } 1520 1521 for (i = 0; i < ARRAY_SIZE(s->ppc_irq_splitter); i++) { 1522 Object *splitter = OBJECT(&s->ppc_irq_splitter[i]); 1523 1524 if (!object_property_set_int(splitter, "num-lines", 2, errp)) { 1525 return; 1526 } 1527 if (!qdev_realize(DEVICE(splitter), NULL, errp)) { 1528 return; 1529 } 1530 } 1531 1532 for (i = 0; i < IOTS_NUM_AHB_EXP_PPC; i++) { 1533 char *ppcname = g_strdup_printf("ahb_ppcexp%d", i); 1534 1535 armsse_forward_ppc(s, ppcname, i); 1536 g_free(ppcname); 1537 } 1538 1539 for (i = 0; i < IOTS_NUM_APB_EXP_PPC; i++) { 1540 char *ppcname = g_strdup_printf("apb_ppcexp%d", i); 1541 1542 armsse_forward_ppc(s, ppcname, i + IOTS_NUM_AHB_EXP_PPC); 1543 g_free(ppcname); 1544 } 1545 1546 for (i = NUM_EXTERNAL_PPCS; i < NUM_PPCS; i++) { 1547 /* Wire up IRQ splitter for internal PPCs */ 1548 DeviceState *devs = DEVICE(&s->ppc_irq_splitter[i]); 1549 char *gpioname = g_strdup_printf("apb_ppc%d_irq_status", 1550 i - NUM_EXTERNAL_PPCS); 1551 TZPPC *ppc = &s->apb_ppc[i - NUM_EXTERNAL_PPCS]; 1552 1553 qdev_connect_gpio_out(devs, 0, 1554 qdev_get_gpio_in_named(dev_secctl, gpioname, 0)); 1555 qdev_connect_gpio_out(devs, 1, 1556 qdev_get_gpio_in(DEVICE(&s->ppc_irq_orgate), i)); 1557 qdev_connect_gpio_out_named(DEVICE(ppc), "irq", 0, 1558 qdev_get_gpio_in(devs, 0)); 1559 g_free(gpioname); 1560 } 1561 1562 /* Wire up the splitters for the MPC IRQs */ 1563 for (i = 0; i < IOTS_NUM_EXP_MPC + info->sram_banks; i++) { 1564 SplitIRQ *splitter = &s->mpc_irq_splitter[i]; 1565 DeviceState *dev_splitter = DEVICE(splitter); 1566 1567 if (!object_property_set_int(OBJECT(splitter), "num-lines", 2, 1568 errp)) { 1569 return; 1570 } 1571 if (!qdev_realize(DEVICE(splitter), NULL, errp)) { 1572 return; 1573 } 1574 1575 if (i < IOTS_NUM_EXP_MPC) { 1576 /* Splitter input is from GPIO input line */ 1577 s->mpcexp_status_in[i] = qdev_get_gpio_in(dev_splitter, 0); 1578 qdev_connect_gpio_out(dev_splitter, 0, 1579 qdev_get_gpio_in_named(dev_secctl, 1580 "mpcexp_status", i)); 1581 } else { 1582 /* Splitter input is from our own MPC */ 1583 qdev_connect_gpio_out_named(DEVICE(&s->mpc[i - IOTS_NUM_EXP_MPC]), 1584 "irq", 0, 1585 qdev_get_gpio_in(dev_splitter, 0)); 1586 qdev_connect_gpio_out(dev_splitter, 0, 1587 qdev_get_gpio_in_named(dev_secctl, 1588 "mpc_status", 1589 i - IOTS_NUM_EXP_MPC)); 1590 } 1591 1592 qdev_connect_gpio_out(dev_splitter, 1, 1593 qdev_get_gpio_in(DEVICE(&s->mpc_irq_orgate), i)); 1594 } 1595 /* Create GPIO inputs which will pass the line state for our 1596 * mpcexp_irq inputs to the correct splitter devices. 1597 */ 1598 qdev_init_gpio_in_named(dev, armsse_mpcexp_status, "mpcexp_status", 1599 IOTS_NUM_EXP_MPC); 1600 1601 armsse_forward_sec_resp_cfg(s); 1602 1603 /* Forward the MSC related signals */ 1604 qdev_pass_gpios(dev_secctl, dev, "mscexp_status"); 1605 qdev_pass_gpios(dev_secctl, dev, "mscexp_clear"); 1606 qdev_pass_gpios(dev_secctl, dev, "mscexp_ns"); 1607 qdev_connect_gpio_out_named(dev_secctl, "msc_irq", 0, 1608 armsse_get_common_irq_in(s, 11)); 1609 1610 /* 1611 * Expose our container region to the board model; this corresponds 1612 * to the AHB Slave Expansion ports which allow bus master devices 1613 * (eg DMA controllers) in the board model to make transactions into 1614 * devices in the ARMSSE. 1615 */ 1616 sysbus_init_mmio(SYS_BUS_DEVICE(s), &s->container); 1617 1618 /* Set initial system_clock_scale from MAINCLK */ 1619 armsse_mainclk_update(s, ClockUpdate); 1620 } 1621 1622 static void armsse_idau_check(IDAUInterface *ii, uint32_t address, 1623 int *iregion, bool *exempt, bool *ns, bool *nsc) 1624 { 1625 /* 1626 * For ARMSSE systems the IDAU responses are simple logical functions 1627 * of the address bits. The NSC attribute is guest-adjustable via the 1628 * NSCCFG register in the security controller. 1629 */ 1630 ARMSSE *s = ARM_SSE(ii); 1631 int region = extract32(address, 28, 4); 1632 1633 *ns = !(region & 1); 1634 *nsc = (region == 1 && (s->nsccfg & 1)) || (region == 3 && (s->nsccfg & 2)); 1635 /* 0xe0000000..0xe00fffff and 0xf0000000..0xf00fffff are exempt */ 1636 *exempt = (address & 0xeff00000) == 0xe0000000; 1637 *iregion = region; 1638 } 1639 1640 static const VMStateDescription armsse_vmstate = { 1641 .name = "iotkit", 1642 .version_id = 2, 1643 .minimum_version_id = 2, 1644 .fields = (VMStateField[]) { 1645 VMSTATE_CLOCK(mainclk, ARMSSE), 1646 VMSTATE_CLOCK(s32kclk, ARMSSE), 1647 VMSTATE_UINT32(nsccfg, ARMSSE), 1648 VMSTATE_END_OF_LIST() 1649 } 1650 }; 1651 1652 static void armsse_reset(DeviceState *dev) 1653 { 1654 ARMSSE *s = ARM_SSE(dev); 1655 1656 s->nsccfg = 0; 1657 } 1658 1659 static void armsse_class_init(ObjectClass *klass, void *data) 1660 { 1661 DeviceClass *dc = DEVICE_CLASS(klass); 1662 IDAUInterfaceClass *iic = IDAU_INTERFACE_CLASS(klass); 1663 ARMSSEClass *asc = ARM_SSE_CLASS(klass); 1664 const ARMSSEInfo *info = data; 1665 1666 dc->realize = armsse_realize; 1667 dc->vmsd = &armsse_vmstate; 1668 device_class_set_props(dc, info->props); 1669 dc->reset = armsse_reset; 1670 iic->check = armsse_idau_check; 1671 asc->info = info; 1672 } 1673 1674 static const TypeInfo armsse_info = { 1675 .name = TYPE_ARM_SSE, 1676 .parent = TYPE_SYS_BUS_DEVICE, 1677 .instance_size = sizeof(ARMSSE), 1678 .class_size = sizeof(ARMSSEClass), 1679 .instance_init = armsse_init, 1680 .abstract = true, 1681 .interfaces = (InterfaceInfo[]) { 1682 { TYPE_IDAU_INTERFACE }, 1683 { } 1684 } 1685 }; 1686 1687 static void armsse_register_types(void) 1688 { 1689 int i; 1690 1691 type_register_static(&armsse_info); 1692 1693 for (i = 0; i < ARRAY_SIZE(armsse_variants); i++) { 1694 TypeInfo ti = { 1695 .name = armsse_variants[i].name, 1696 .parent = TYPE_ARM_SSE, 1697 .class_init = armsse_class_init, 1698 .class_data = (void *)&armsse_variants[i], 1699 }; 1700 type_register(&ti); 1701 } 1702 } 1703 1704 type_init(armsse_register_types); 1705