2 * Arm IoT Kit security controller
4 * Copyright (c) 2018 Linaro Limited
5 * Written by Peter Maydell
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License version 2 or
9 * (at your option) any later version.
12 #include "qemu/osdep.h"
14 #include "qemu/module.h"
15 #include "qapi/error.h"
17 #include "hw/sysbus.h"
18 #include "hw/registerfields.h"
20 #include "hw/misc/iotkit-secctl.h"
22 /* Registers in the secure privilege control block */
23 REG32(SECRESPCFG, 0x10)
25 REG32(SECMPCINTSTATUS, 0x1c)
26 REG32(SECPPCINTSTAT, 0x20)
27 REG32(SECPPCINTCLR, 0x24)
28 REG32(SECPPCINTEN, 0x28)
29 REG32(SECMSCINTSTAT, 0x30)
30 REG32(SECMSCINTCLR, 0x34)
31 REG32(SECMSCINTEN, 0x38)
32 REG32(BRGINTSTAT, 0x40)
33 REG32(BRGINTCLR, 0x44)
35 REG32(AHBNSPPC0, 0x50)
36 REG32(AHBNSPPCEXP0, 0x60)
37 REG32(AHBNSPPCEXP1, 0x64)
38 REG32(AHBNSPPCEXP2, 0x68)
39 REG32(AHBNSPPCEXP3, 0x6c)
40 REG32(APBNSPPC0, 0x70)
41 REG32(APBNSPPC1, 0x74)
42 REG32(APBNSPPCEXP0, 0x80)
43 REG32(APBNSPPCEXP1, 0x84)
44 REG32(APBNSPPCEXP2, 0x88)
45 REG32(APBNSPPCEXP3, 0x8c)
46 REG32(AHBSPPPC0, 0x90)
47 REG32(AHBSPPPCEXP0, 0xa0)
48 REG32(AHBSPPPCEXP1, 0xa4)
49 REG32(AHBSPPPCEXP2, 0xa8)
50 REG32(AHBSPPPCEXP3, 0xac)
51 REG32(APBSPPPC0, 0xb0)
52 REG32(APBSPPPC1, 0xb4)
53 REG32(APBSPPPCEXP0, 0xc0)
54 REG32(APBSPPPCEXP1, 0xc4)
55 REG32(APBSPPPCEXP2, 0xc8)
56 REG32(APBSPPPCEXP3, 0xcc)
71 /* Registers in the non-secure privilege control block */
72 REG32(AHBNSPPPC0, 0x90)
73 REG32(AHBNSPPPCEXP0, 0xa0)
74 REG32(AHBNSPPPCEXP1, 0xa4)
75 REG32(AHBNSPPPCEXP2, 0xa8)
76 REG32(AHBNSPPPCEXP3, 0xac)
77 REG32(APBNSPPPC0, 0xb0)
78 REG32(APBNSPPPC1, 0xb4)
79 REG32(APBNSPPPCEXP0, 0xc0)
80 REG32(APBNSPPPCEXP1, 0xc4)
81 REG32(APBNSPPPCEXP2, 0xc8)
82 REG32(APBNSPPPCEXP3, 0xcc)
83 /* PID and CID registers are also present in the NS block */
85 static const uint8_t iotkit_secctl_s_idregs[] = {
86 0x04, 0x00, 0x00, 0x00,
87 0x52, 0xb8, 0x0b, 0x00,
88 0x0d, 0xf0, 0x05, 0xb1,
91 static const uint8_t iotkit_secctl_ns_idregs[] = {
92 0x04, 0x00, 0x00, 0x00,
93 0x53, 0xb8, 0x0b, 0x00,
94 0x0d, 0xf0, 0x05, 0xb1,
97 /* The register sets for the various PPCs (AHB internal, APB internal,
98 * AHB expansion, APB expansion) are all set up so that they are
99 * in 16-aligned blocks so offsets 0xN0, 0xN4, 0xN8, 0xNC are PPCs
100 * 0, 1, 2, 3 of that type, so we can convert a register address offset
101 * into an an index into a PPC array easily.
103 static inline int offset_to_ppc_idx(uint32_t offset)
105 return extract32(offset, 2, 2);
108 typedef void PerPPCFunction(IoTKitSecCtlPPC *ppc);
110 static void foreach_ppc(IoTKitSecCtl *s, PerPPCFunction *fn)
114 for (i = 0; i < IOTS_NUM_APB_PPC; i++) {
117 for (i = 0; i < IOTS_NUM_APB_EXP_PPC; i++) {
120 for (i = 0; i < IOTS_NUM_AHB_EXP_PPC; i++) {
125 static MemTxResult iotkit_secctl_s_read(void *opaque, hwaddr addr,
127 unsigned size, MemTxAttrs attrs)
130 uint32_t offset = addr & ~0x3;
131 IoTKitSecCtl *s = IOTKIT_SECCTL(opaque);
144 case A_SECMPCINTSTATUS:
147 case A_SECPPCINTSTAT:
148 r = s->secppcintstat;
154 /* QEMU's bus fabric can never report errors as it doesn't buffer
155 * writes, so we never report bridge interrupts.
166 r = s->ahbexp[offset_to_ppc_idx(offset)].ns;
170 r = s->apb[offset_to_ppc_idx(offset)].ns;
176 r = s->apbexp[offset_to_ppc_idx(offset)].ns;
182 r = s->apbexp[offset_to_ppc_idx(offset)].sp;
186 r = s->apb[offset_to_ppc_idx(offset)].sp;
192 r = s->apbexp[offset_to_ppc_idx(offset)].sp;
194 case A_SECMSCINTSTAT:
195 r = s->secmscintstat;
215 r = iotkit_secctl_s_idregs[(offset - A_PID4) / 4];
220 qemu_log_mask(LOG_GUEST_ERROR,
221 "IotKit SecCtl S block read: write-only offset 0x%x\n",
226 qemu_log_mask(LOG_GUEST_ERROR,
227 "IotKit SecCtl S block read: bad offset 0x%x\n", offset);
233 /* None of our registers are access-sensitive, so just pull the right
234 * byte out of the word read result.
236 r = extract32(r, (addr & 3) * 8, size * 8);
239 trace_iotkit_secctl_s_read(offset, r, size);
244 static void iotkit_secctl_update_ppc_ap(IoTKitSecCtlPPC *ppc)
248 for (i = 0; i < ppc->numports; i++) {
251 if (extract32(ppc->ns, i, 1)) {
252 v = extract32(ppc->nsp, i, 1);
254 v = extract32(ppc->sp, i, 1);
256 qemu_set_irq(ppc->ap[i], v);
260 static void iotkit_secctl_ppc_ns_write(IoTKitSecCtlPPC *ppc, uint32_t value)
264 ppc->ns = value & MAKE_64BIT_MASK(0, ppc->numports);
265 for (i = 0; i < ppc->numports; i++) {
266 qemu_set_irq(ppc->nonsec[i], extract32(ppc->ns, i, 1));
268 iotkit_secctl_update_ppc_ap(ppc);
271 static void iotkit_secctl_ppc_sp_write(IoTKitSecCtlPPC *ppc, uint32_t value)
273 ppc->sp = value & MAKE_64BIT_MASK(0, ppc->numports);
274 iotkit_secctl_update_ppc_ap(ppc);
277 static void iotkit_secctl_ppc_nsp_write(IoTKitSecCtlPPC *ppc, uint32_t value)
279 ppc->nsp = value & MAKE_64BIT_MASK(0, ppc->numports);
280 iotkit_secctl_update_ppc_ap(ppc);
283 static void iotkit_secctl_ppc_update_irq_clear(IoTKitSecCtlPPC *ppc)
285 uint32_t value = ppc->parent->secppcintstat;
287 qemu_set_irq(ppc->irq_clear, extract32(value, ppc->irq_bit_offset, 1));
290 static void iotkit_secctl_ppc_update_irq_enable(IoTKitSecCtlPPC *ppc)
292 uint32_t value = ppc->parent->secppcinten;
294 qemu_set_irq(ppc->irq_enable, extract32(value, ppc->irq_bit_offset, 1));
297 static void iotkit_secctl_update_mscexp_irqs(qemu_irq *msc_irqs, uint32_t value)
301 for (i = 0; i < IOTS_NUM_EXP_MSC; i++) {
302 qemu_set_irq(msc_irqs[i], extract32(value, i + 16, 1));
306 static void iotkit_secctl_update_msc_irq(IoTKitSecCtl *s)
308 /* Update the combined MSC IRQ, based on S_MSCEXP_STATUS and S_MSCEXP_EN */
309 bool level = s->secmscintstat & s->secmscinten;
311 qemu_set_irq(s->msc_irq, level);
314 static MemTxResult iotkit_secctl_s_write(void *opaque, hwaddr addr,
316 unsigned size, MemTxAttrs attrs)
318 IoTKitSecCtl *s = IOTKIT_SECCTL(opaque);
319 uint32_t offset = addr;
320 IoTKitSecCtlPPC *ppc;
322 trace_iotkit_secctl_s_write(offset, value, size);
325 /* Byte and halfword writes are ignored */
326 qemu_log_mask(LOG_GUEST_ERROR,
327 "IotKit SecCtl S block write: bad size, ignored\n");
333 s->nsccfg = value & 3;
334 qemu_set_irq(s->nsc_cfg_irq, s->nsccfg);
338 s->secrespcfg = value;
339 qemu_set_irq(s->sec_resp_cfg, s->secrespcfg);
343 foreach_ppc(s, iotkit_secctl_ppc_update_irq_clear);
346 s->secppcinten = value & 0x00f000f3;
347 foreach_ppc(s, iotkit_secctl_ppc_update_irq_enable);
352 s->brginten = value & 0xffff0000;
358 ppc = &s->ahbexp[offset_to_ppc_idx(offset)];
359 iotkit_secctl_ppc_ns_write(ppc, value);
363 ppc = &s->apb[offset_to_ppc_idx(offset)];
364 iotkit_secctl_ppc_ns_write(ppc, value);
370 ppc = &s->apbexp[offset_to_ppc_idx(offset)];
371 iotkit_secctl_ppc_ns_write(ppc, value);
377 ppc = &s->ahbexp[offset_to_ppc_idx(offset)];
378 iotkit_secctl_ppc_sp_write(ppc, value);
382 ppc = &s->apb[offset_to_ppc_idx(offset)];
383 iotkit_secctl_ppc_sp_write(ppc, value);
389 ppc = &s->apbexp[offset_to_ppc_idx(offset)];
390 iotkit_secctl_ppc_sp_write(ppc, value);
393 iotkit_secctl_update_mscexp_irqs(s->mscexp_clear, value);
396 s->secmscinten = value;
397 iotkit_secctl_update_msc_irq(s);
401 iotkit_secctl_update_mscexp_irqs(s->mscexp_ns, value);
403 case A_SECMPCINTSTATUS:
404 case A_SECPPCINTSTAT:
405 case A_SECMSCINTSTAT:
421 qemu_log_mask(LOG_GUEST_ERROR,
422 "IoTKit SecCtl S block write: "
423 "read-only offset 0x%x\n", offset);
426 qemu_log_mask(LOG_GUEST_ERROR,
427 "IotKit SecCtl S block write: bad offset 0x%x\n",
435 static MemTxResult iotkit_secctl_ns_read(void *opaque, hwaddr addr,
437 unsigned size, MemTxAttrs attrs)
439 IoTKitSecCtl *s = IOTKIT_SECCTL(opaque);
441 uint32_t offset = addr & ~0x3;
447 case A_AHBNSPPPCEXP0:
448 case A_AHBNSPPPCEXP1:
449 case A_AHBNSPPPCEXP2:
450 case A_AHBNSPPPCEXP3:
451 r = s->ahbexp[offset_to_ppc_idx(offset)].nsp;
455 r = s->apb[offset_to_ppc_idx(offset)].nsp;
457 case A_APBNSPPPCEXP0:
458 case A_APBNSPPPCEXP1:
459 case A_APBNSPPPCEXP2:
460 case A_APBNSPPPCEXP3:
461 r = s->apbexp[offset_to_ppc_idx(offset)].nsp;
475 r = iotkit_secctl_ns_idregs[(offset - A_PID4) / 4];
478 qemu_log_mask(LOG_GUEST_ERROR,
479 "IotKit SecCtl NS block write: bad offset 0x%x\n",
486 /* None of our registers are access-sensitive, so just pull the right
487 * byte out of the word read result.
489 r = extract32(r, (addr & 3) * 8, size * 8);
492 trace_iotkit_secctl_ns_read(offset, r, size);
497 static MemTxResult iotkit_secctl_ns_write(void *opaque, hwaddr addr,
499 unsigned size, MemTxAttrs attrs)
501 IoTKitSecCtl *s = IOTKIT_SECCTL(opaque);
502 uint32_t offset = addr;
503 IoTKitSecCtlPPC *ppc;
505 trace_iotkit_secctl_ns_write(offset, value, size);
508 /* Byte and halfword writes are ignored */
509 qemu_log_mask(LOG_GUEST_ERROR,
510 "IotKit SecCtl NS block write: bad size, ignored\n");
515 case A_AHBNSPPPCEXP0:
516 case A_AHBNSPPPCEXP1:
517 case A_AHBNSPPPCEXP2:
518 case A_AHBNSPPPCEXP3:
519 ppc = &s->ahbexp[offset_to_ppc_idx(offset)];
520 iotkit_secctl_ppc_nsp_write(ppc, value);
524 ppc = &s->apb[offset_to_ppc_idx(offset)];
525 iotkit_secctl_ppc_nsp_write(ppc, value);
527 case A_APBNSPPPCEXP0:
528 case A_APBNSPPPCEXP1:
529 case A_APBNSPPPCEXP2:
530 case A_APBNSPPPCEXP3:
531 ppc = &s->apbexp[offset_to_ppc_idx(offset)];
532 iotkit_secctl_ppc_nsp_write(ppc, value);
547 qemu_log_mask(LOG_GUEST_ERROR,
548 "IoTKit SecCtl NS block write: "
549 "read-only offset 0x%x\n", offset);
552 qemu_log_mask(LOG_GUEST_ERROR,
553 "IotKit SecCtl NS block write: bad offset 0x%x\n",
561 static const MemoryRegionOps iotkit_secctl_s_ops = {
562 .read_with_attrs = iotkit_secctl_s_read,
563 .write_with_attrs = iotkit_secctl_s_write,
564 .endianness = DEVICE_LITTLE_ENDIAN,
565 .valid.min_access_size = 1,
566 .valid.max_access_size = 4,
567 .impl.min_access_size = 1,
568 .impl.max_access_size = 4,
571 static const MemoryRegionOps iotkit_secctl_ns_ops = {
572 .read_with_attrs = iotkit_secctl_ns_read,
573 .write_with_attrs = iotkit_secctl_ns_write,
574 .endianness = DEVICE_LITTLE_ENDIAN,
575 .valid.min_access_size = 1,
576 .valid.max_access_size = 4,
577 .impl.min_access_size = 1,
578 .impl.max_access_size = 4,
581 static void iotkit_secctl_reset_ppc(IoTKitSecCtlPPC *ppc)
588 static void iotkit_secctl_reset(DeviceState *dev)
590 IoTKitSecCtl *s = IOTKIT_SECCTL(dev);
592 s->secppcintstat = 0;
598 foreach_ppc(s, iotkit_secctl_reset_ppc);
601 static void iotkit_secctl_mpc_status(void *opaque, int n, int level)
603 IoTKitSecCtl *s = IOTKIT_SECCTL(opaque);
605 s->mpcintstatus = deposit32(s->mpcintstatus, n, 1, !!level);
608 static void iotkit_secctl_mpcexp_status(void *opaque, int n, int level)
610 IoTKitSecCtl *s = IOTKIT_SECCTL(opaque);
612 s->mpcintstatus = deposit32(s->mpcintstatus, n + 16, 1, !!level);
615 static void iotkit_secctl_mscexp_status(void *opaque, int n, int level)
617 IoTKitSecCtl *s = IOTKIT_SECCTL(opaque);
619 s->secmscintstat = deposit32(s->secmscintstat, n + 16, 1, !!level);
620 iotkit_secctl_update_msc_irq(s);
623 static void iotkit_secctl_ppc_irqstatus(void *opaque, int n, int level)
625 IoTKitSecCtlPPC *ppc = opaque;
626 IoTKitSecCtl *s = IOTKIT_SECCTL(ppc->parent);
627 int irqbit = ppc->irq_bit_offset + n;
629 s->secppcintstat = deposit32(s->secppcintstat, irqbit, 1, level);
632 static void iotkit_secctl_init_ppc(IoTKitSecCtl *s,
633 IoTKitSecCtlPPC *ppc,
639 DeviceState *dev = DEVICE(s);
641 ppc->numports = numports;
642 ppc->irq_bit_offset = irq_bit_offset;
645 gpioname = g_strdup_printf("%s_nonsec", name);
646 qdev_init_gpio_out_named(dev, ppc->nonsec, gpioname, numports);
648 gpioname = g_strdup_printf("%s_ap", name);
649 qdev_init_gpio_out_named(dev, ppc->ap, gpioname, numports);
651 gpioname = g_strdup_printf("%s_irq_enable", name);
652 qdev_init_gpio_out_named(dev, &ppc->irq_enable, gpioname, 1);
654 gpioname = g_strdup_printf("%s_irq_clear", name);
655 qdev_init_gpio_out_named(dev, &ppc->irq_clear, gpioname, 1);
657 gpioname = g_strdup_printf("%s_irq_status", name);
658 qdev_init_gpio_in_named_with_opaque(dev, iotkit_secctl_ppc_irqstatus,
663 static void iotkit_secctl_init(Object *obj)
665 IoTKitSecCtl *s = IOTKIT_SECCTL(obj);
666 SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
667 DeviceState *dev = DEVICE(obj);
670 iotkit_secctl_init_ppc(s, &s->apb[0], "apb_ppc0",
671 IOTS_APB_PPC0_NUM_PORTS, 0);
672 iotkit_secctl_init_ppc(s, &s->apb[1], "apb_ppc1",
673 IOTS_APB_PPC1_NUM_PORTS, 1);
675 for (i = 0; i < IOTS_NUM_APB_EXP_PPC; i++) {
676 IoTKitSecCtlPPC *ppc = &s->apbexp[i];
677 char *ppcname = g_strdup_printf("apb_ppcexp%d", i);
678 iotkit_secctl_init_ppc(s, ppc, ppcname, IOTS_PPC_NUM_PORTS, 4 + i);
681 for (i = 0; i < IOTS_NUM_AHB_EXP_PPC; i++) {
682 IoTKitSecCtlPPC *ppc = &s->ahbexp[i];
683 char *ppcname = g_strdup_printf("ahb_ppcexp%d", i);
684 iotkit_secctl_init_ppc(s, ppc, ppcname, IOTS_PPC_NUM_PORTS, 20 + i);
688 qdev_init_gpio_out_named(dev, &s->sec_resp_cfg, "sec_resp_cfg", 1);
689 qdev_init_gpio_out_named(dev, &s->nsc_cfg_irq, "nsc_cfg", 1);
691 qdev_init_gpio_in_named(dev, iotkit_secctl_mpc_status, "mpc_status",
693 qdev_init_gpio_in_named(dev, iotkit_secctl_mpcexp_status,
694 "mpcexp_status", IOTS_NUM_EXP_MPC);
696 qdev_init_gpio_in_named(dev, iotkit_secctl_mscexp_status,
697 "mscexp_status", IOTS_NUM_EXP_MSC);
698 qdev_init_gpio_out_named(dev, s->mscexp_clear, "mscexp_clear",
700 qdev_init_gpio_out_named(dev, s->mscexp_ns, "mscexp_ns",
702 qdev_init_gpio_out_named(dev, &s->msc_irq, "msc_irq", 1);
704 memory_region_init_io(&s->s_regs, obj, &iotkit_secctl_s_ops,
705 s, "iotkit-secctl-s-regs", 0x1000);
706 memory_region_init_io(&s->ns_regs, obj, &iotkit_secctl_ns_ops,
707 s, "iotkit-secctl-ns-regs", 0x1000);
708 sysbus_init_mmio(sbd, &s->s_regs);
709 sysbus_init_mmio(sbd, &s->ns_regs);
712 static const VMStateDescription iotkit_secctl_ppc_vmstate = {
713 .name = "iotkit-secctl-ppc",
715 .minimum_version_id = 1,
716 .fields = (VMStateField[]) {
717 VMSTATE_UINT32(ns, IoTKitSecCtlPPC),
718 VMSTATE_UINT32(sp, IoTKitSecCtlPPC),
719 VMSTATE_UINT32(nsp, IoTKitSecCtlPPC),
720 VMSTATE_END_OF_LIST()
724 static const VMStateDescription iotkit_secctl_mpcintstatus_vmstate = {
725 .name = "iotkit-secctl-mpcintstatus",
727 .minimum_version_id = 1,
728 .fields = (VMStateField[]) {
729 VMSTATE_UINT32(mpcintstatus, IoTKitSecCtl),
730 VMSTATE_END_OF_LIST()
734 static bool needed_always(void *opaque)
739 static const VMStateDescription iotkit_secctl_msc_vmstate = {
740 .name = "iotkit-secctl/msc",
742 .minimum_version_id = 1,
743 .needed = needed_always,
744 .fields = (VMStateField[]) {
745 VMSTATE_UINT32(secmscintstat, IoTKitSecCtl),
746 VMSTATE_UINT32(secmscinten, IoTKitSecCtl),
747 VMSTATE_UINT32(nsmscexp, IoTKitSecCtl),
748 VMSTATE_END_OF_LIST()
752 static const VMStateDescription iotkit_secctl_vmstate = {
753 .name = "iotkit-secctl",
755 .minimum_version_id = 1,
756 .fields = (VMStateField[]) {
757 VMSTATE_UINT32(secppcintstat, IoTKitSecCtl),
758 VMSTATE_UINT32(secppcinten, IoTKitSecCtl),
759 VMSTATE_UINT32(secrespcfg, IoTKitSecCtl),
760 VMSTATE_UINT32(nsccfg, IoTKitSecCtl),
761 VMSTATE_UINT32(brginten, IoTKitSecCtl),
762 VMSTATE_STRUCT_ARRAY(apb, IoTKitSecCtl, IOTS_NUM_APB_PPC, 1,
763 iotkit_secctl_ppc_vmstate, IoTKitSecCtlPPC),
764 VMSTATE_STRUCT_ARRAY(apbexp, IoTKitSecCtl, IOTS_NUM_APB_EXP_PPC, 1,
765 iotkit_secctl_ppc_vmstate, IoTKitSecCtlPPC),
766 VMSTATE_STRUCT_ARRAY(ahbexp, IoTKitSecCtl, IOTS_NUM_AHB_EXP_PPC, 1,
767 iotkit_secctl_ppc_vmstate, IoTKitSecCtlPPC),
768 VMSTATE_END_OF_LIST()
770 .subsections = (const VMStateDescription*[]) {
771 &iotkit_secctl_mpcintstatus_vmstate,
772 &iotkit_secctl_msc_vmstate,
777 static void iotkit_secctl_class_init(ObjectClass *klass, void *data)
779 DeviceClass *dc = DEVICE_CLASS(klass);
781 dc->vmsd = &iotkit_secctl_vmstate;
782 dc->reset = iotkit_secctl_reset;
785 static const TypeInfo iotkit_secctl_info = {
786 .name = TYPE_IOTKIT_SECCTL,
787 .parent = TYPE_SYS_BUS_DEVICE,
788 .instance_size = sizeof(IoTKitSecCtl),
789 .instance_init = iotkit_secctl_init,
790 .class_init = iotkit_secctl_class_init,
793 static void iotkit_secctl_register_types(void)
795 type_register_static(&iotkit_secctl_info);
798 type_init(iotkit_secctl_register_types);