1 /* 2 * ARM Nested Vectored Interrupt Controller 3 * 4 * Copyright (c) 2006-2007 CodeSourcery. 5 * Written by Paul Brook 6 * 7 * This code is licensed under the GPL. 8 * 9 * The ARMv7M System controller is fairly tightly tied in with the 10 * NVIC. Much of that is also implemented here. 11 */ 12 13 #include "qemu/osdep.h" 14 #include "qapi/error.h" 15 #include "hw/sysbus.h" 16 #include "qemu/timer.h" 17 #include "hw/arm/arm.h" 18 #include "exec/address-spaces.h" 19 #include "gic_internal.h" 20 21 typedef struct { 22 GICState gic; 23 struct { 24 uint32_t control; 25 uint32_t reload; 26 int64_t tick; 27 QEMUTimer *timer; 28 } systick; 29 MemoryRegion sysregmem; 30 MemoryRegion gic_iomem_alias; 31 MemoryRegion container; 32 uint32_t num_irq; 33 qemu_irq sysresetreq; 34 } nvic_state; 35 36 #define TYPE_NVIC "armv7m_nvic" 37 /** 38 * NVICClass: 39 * @parent_reset: the parent class' reset handler. 40 * 41 * A model of the v7M NVIC and System Controller 42 */ 43 typedef struct NVICClass { 44 /*< private >*/ 45 ARMGICClass parent_class; 46 /*< public >*/ 47 DeviceRealize parent_realize; 48 void (*parent_reset)(DeviceState *dev); 49 } NVICClass; 50 51 #define NVIC_CLASS(klass) \ 52 OBJECT_CLASS_CHECK(NVICClass, (klass), TYPE_NVIC) 53 #define NVIC_GET_CLASS(obj) \ 54 OBJECT_GET_CLASS(NVICClass, (obj), TYPE_NVIC) 55 #define NVIC(obj) \ 56 OBJECT_CHECK(nvic_state, (obj), TYPE_NVIC) 57 58 static const uint8_t nvic_id[] = { 59 0x00, 0xb0, 0x1b, 0x00, 0x0d, 0xe0, 0x05, 0xb1 60 }; 61 62 /* qemu timers run at 1GHz. We want something closer to 1MHz. */ 63 #define SYSTICK_SCALE 1000ULL 64 65 #define SYSTICK_ENABLE (1 << 0) 66 #define SYSTICK_TICKINT (1 << 1) 67 #define SYSTICK_CLKSOURCE (1 << 2) 68 #define SYSTICK_COUNTFLAG (1 << 16) 69 70 int system_clock_scale; 71 72 /* Conversion factor from qemu timer to SysTick frequencies. */ 73 static inline int64_t systick_scale(nvic_state *s) 74 { 75 if (s->systick.control & SYSTICK_CLKSOURCE) 76 return system_clock_scale; 77 else 78 return 1000; 79 } 80 81 static void systick_reload(nvic_state *s, int reset) 82 { 83 /* The Cortex-M3 Devices Generic User Guide says that "When the 84 * ENABLE bit is set to 1, the counter loads the RELOAD value from the 85 * SYST RVR register and then counts down". So, we need to check the 86 * ENABLE bit before reloading the value. 87 */ 88 if ((s->systick.control & SYSTICK_ENABLE) == 0) { 89 return; 90 } 91 92 if (reset) 93 s->systick.tick = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL); 94 s->systick.tick += (s->systick.reload + 1) * systick_scale(s); 95 timer_mod(s->systick.timer, s->systick.tick); 96 } 97 98 static void systick_timer_tick(void * opaque) 99 { 100 nvic_state *s = (nvic_state *)opaque; 101 s->systick.control |= SYSTICK_COUNTFLAG; 102 if (s->systick.control & SYSTICK_TICKINT) { 103 /* Trigger the interrupt. */ 104 armv7m_nvic_set_pending(s, ARMV7M_EXCP_SYSTICK); 105 } 106 if (s->systick.reload == 0) { 107 s->systick.control &= ~SYSTICK_ENABLE; 108 } else { 109 systick_reload(s, 0); 110 } 111 } 112 113 static void systick_reset(nvic_state *s) 114 { 115 s->systick.control = 0; 116 s->systick.reload = 0; 117 s->systick.tick = 0; 118 timer_del(s->systick.timer); 119 } 120 121 /* The external routines use the hardware vector numbering, ie. the first 122 IRQ is #16. The internal GIC routines use #32 as the first IRQ. */ 123 void armv7m_nvic_set_pending(void *opaque, int irq) 124 { 125 nvic_state *s = (nvic_state *)opaque; 126 if (irq >= 16) 127 irq += 16; 128 gic_set_pending_private(&s->gic, 0, irq); 129 } 130 131 /* Make pending IRQ active. */ 132 int armv7m_nvic_acknowledge_irq(void *opaque) 133 { 134 nvic_state *s = (nvic_state *)opaque; 135 uint32_t irq; 136 137 irq = gic_acknowledge_irq(&s->gic, 0, MEMTXATTRS_UNSPECIFIED); 138 if (irq == 1023) 139 hw_error("Interrupt but no vector\n"); 140 if (irq >= 32) 141 irq -= 16; 142 return irq; 143 } 144 145 void armv7m_nvic_complete_irq(void *opaque, int irq) 146 { 147 nvic_state *s = (nvic_state *)opaque; 148 if (irq >= 16) 149 irq += 16; 150 gic_complete_irq(&s->gic, 0, irq, MEMTXATTRS_UNSPECIFIED); 151 } 152 153 static uint32_t nvic_readl(nvic_state *s, uint32_t offset) 154 { 155 ARMCPU *cpu; 156 uint32_t val; 157 int irq; 158 159 switch (offset) { 160 case 4: /* Interrupt Control Type. */ 161 return (s->num_irq / 32) - 1; 162 case 0x10: /* SysTick Control and Status. */ 163 val = s->systick.control; 164 s->systick.control &= ~SYSTICK_COUNTFLAG; 165 return val; 166 case 0x14: /* SysTick Reload Value. */ 167 return s->systick.reload; 168 case 0x18: /* SysTick Current Value. */ 169 { 170 int64_t t; 171 if ((s->systick.control & SYSTICK_ENABLE) == 0) 172 return 0; 173 t = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL); 174 if (t >= s->systick.tick) 175 return 0; 176 val = ((s->systick.tick - (t + 1)) / systick_scale(s)) + 1; 177 /* The interrupt in triggered when the timer reaches zero. 178 However the counter is not reloaded until the next clock 179 tick. This is a hack to return zero during the first tick. */ 180 if (val > s->systick.reload) 181 val = 0; 182 return val; 183 } 184 case 0x1c: /* SysTick Calibration Value. */ 185 return 10000; 186 case 0xd00: /* CPUID Base. */ 187 cpu = ARM_CPU(current_cpu); 188 return cpu->midr; 189 case 0xd04: /* Interrupt Control State. */ 190 /* VECTACTIVE */ 191 cpu = ARM_CPU(current_cpu); 192 val = cpu->env.v7m.exception; 193 if (val == 1023) { 194 val = 0; 195 } else if (val >= 32) { 196 val -= 16; 197 } 198 /* VECTPENDING */ 199 if (s->gic.current_pending[0] != 1023) 200 val |= (s->gic.current_pending[0] << 12); 201 /* ISRPENDING and RETTOBASE */ 202 for (irq = 32; irq < s->num_irq; irq++) { 203 if (s->gic.irq_state[irq].pending) { 204 val |= (1 << 22); 205 break; 206 } 207 if (irq != cpu->env.v7m.exception && s->gic.irq_state[irq].active) { 208 val |= (1 << 11); 209 } 210 } 211 /* PENDSTSET */ 212 if (s->gic.irq_state[ARMV7M_EXCP_SYSTICK].pending) 213 val |= (1 << 26); 214 /* PENDSVSET */ 215 if (s->gic.irq_state[ARMV7M_EXCP_PENDSV].pending) 216 val |= (1 << 28); 217 /* NMIPENDSET */ 218 if (s->gic.irq_state[ARMV7M_EXCP_NMI].pending) 219 val |= (1 << 31); 220 return val; 221 case 0xd08: /* Vector Table Offset. */ 222 cpu = ARM_CPU(current_cpu); 223 return cpu->env.v7m.vecbase; 224 case 0xd0c: /* Application Interrupt/Reset Control. */ 225 return 0xfa050000; 226 case 0xd10: /* System Control. */ 227 /* TODO: Implement SLEEPONEXIT. */ 228 return 0; 229 case 0xd14: /* Configuration Control. */ 230 /* TODO: Implement Configuration Control bits. */ 231 return 0; 232 case 0xd24: /* System Handler Status. */ 233 val = 0; 234 if (s->gic.irq_state[ARMV7M_EXCP_MEM].active) val |= (1 << 0); 235 if (s->gic.irq_state[ARMV7M_EXCP_BUS].active) val |= (1 << 1); 236 if (s->gic.irq_state[ARMV7M_EXCP_USAGE].active) val |= (1 << 3); 237 if (s->gic.irq_state[ARMV7M_EXCP_SVC].active) val |= (1 << 7); 238 if (s->gic.irq_state[ARMV7M_EXCP_DEBUG].active) val |= (1 << 8); 239 if (s->gic.irq_state[ARMV7M_EXCP_PENDSV].active) val |= (1 << 10); 240 if (s->gic.irq_state[ARMV7M_EXCP_SYSTICK].active) val |= (1 << 11); 241 if (s->gic.irq_state[ARMV7M_EXCP_USAGE].pending) val |= (1 << 12); 242 if (s->gic.irq_state[ARMV7M_EXCP_MEM].pending) val |= (1 << 13); 243 if (s->gic.irq_state[ARMV7M_EXCP_BUS].pending) val |= (1 << 14); 244 if (s->gic.irq_state[ARMV7M_EXCP_SVC].pending) val |= (1 << 15); 245 if (s->gic.irq_state[ARMV7M_EXCP_MEM].enabled) val |= (1 << 16); 246 if (s->gic.irq_state[ARMV7M_EXCP_BUS].enabled) val |= (1 << 17); 247 if (s->gic.irq_state[ARMV7M_EXCP_USAGE].enabled) val |= (1 << 18); 248 return val; 249 case 0xd28: /* Configurable Fault Status. */ 250 /* TODO: Implement Fault Status. */ 251 qemu_log_mask(LOG_UNIMP, "Configurable Fault Status unimplemented\n"); 252 return 0; 253 case 0xd2c: /* Hard Fault Status. */ 254 case 0xd30: /* Debug Fault Status. */ 255 case 0xd34: /* Mem Manage Address. */ 256 case 0xd38: /* Bus Fault Address. */ 257 case 0xd3c: /* Aux Fault Status. */ 258 /* TODO: Implement fault status registers. */ 259 qemu_log_mask(LOG_UNIMP, "Fault status registers unimplemented\n"); 260 return 0; 261 case 0xd40: /* PFR0. */ 262 return 0x00000030; 263 case 0xd44: /* PRF1. */ 264 return 0x00000200; 265 case 0xd48: /* DFR0. */ 266 return 0x00100000; 267 case 0xd4c: /* AFR0. */ 268 return 0x00000000; 269 case 0xd50: /* MMFR0. */ 270 return 0x00000030; 271 case 0xd54: /* MMFR1. */ 272 return 0x00000000; 273 case 0xd58: /* MMFR2. */ 274 return 0x00000000; 275 case 0xd5c: /* MMFR3. */ 276 return 0x00000000; 277 case 0xd60: /* ISAR0. */ 278 return 0x01141110; 279 case 0xd64: /* ISAR1. */ 280 return 0x02111000; 281 case 0xd68: /* ISAR2. */ 282 return 0x21112231; 283 case 0xd6c: /* ISAR3. */ 284 return 0x01111110; 285 case 0xd70: /* ISAR4. */ 286 return 0x01310102; 287 /* TODO: Implement debug registers. */ 288 default: 289 qemu_log_mask(LOG_GUEST_ERROR, "NVIC: Bad read offset 0x%x\n", offset); 290 return 0; 291 } 292 } 293 294 static void nvic_writel(nvic_state *s, uint32_t offset, uint32_t value) 295 { 296 ARMCPU *cpu; 297 uint32_t oldval; 298 switch (offset) { 299 case 0x10: /* SysTick Control and Status. */ 300 oldval = s->systick.control; 301 s->systick.control &= 0xfffffff8; 302 s->systick.control |= value & 7; 303 if ((oldval ^ value) & SYSTICK_ENABLE) { 304 int64_t now = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL); 305 if (value & SYSTICK_ENABLE) { 306 if (s->systick.tick) { 307 s->systick.tick += now; 308 timer_mod(s->systick.timer, s->systick.tick); 309 } else { 310 systick_reload(s, 1); 311 } 312 } else { 313 timer_del(s->systick.timer); 314 s->systick.tick -= now; 315 if (s->systick.tick < 0) 316 s->systick.tick = 0; 317 } 318 } else if ((oldval ^ value) & SYSTICK_CLKSOURCE) { 319 /* This is a hack. Force the timer to be reloaded 320 when the reference clock is changed. */ 321 systick_reload(s, 1); 322 } 323 break; 324 case 0x14: /* SysTick Reload Value. */ 325 s->systick.reload = value; 326 break; 327 case 0x18: /* SysTick Current Value. Writes reload the timer. */ 328 systick_reload(s, 1); 329 s->systick.control &= ~SYSTICK_COUNTFLAG; 330 break; 331 case 0xd04: /* Interrupt Control State. */ 332 if (value & (1 << 31)) { 333 armv7m_nvic_set_pending(s, ARMV7M_EXCP_NMI); 334 } 335 if (value & (1 << 28)) { 336 armv7m_nvic_set_pending(s, ARMV7M_EXCP_PENDSV); 337 } else if (value & (1 << 27)) { 338 s->gic.irq_state[ARMV7M_EXCP_PENDSV].pending = 0; 339 gic_update(&s->gic); 340 } 341 if (value & (1 << 26)) { 342 armv7m_nvic_set_pending(s, ARMV7M_EXCP_SYSTICK); 343 } else if (value & (1 << 25)) { 344 s->gic.irq_state[ARMV7M_EXCP_SYSTICK].pending = 0; 345 gic_update(&s->gic); 346 } 347 break; 348 case 0xd08: /* Vector Table Offset. */ 349 cpu = ARM_CPU(current_cpu); 350 cpu->env.v7m.vecbase = value & 0xffffff80; 351 break; 352 case 0xd0c: /* Application Interrupt/Reset Control. */ 353 if ((value >> 16) == 0x05fa) { 354 if (value & 4) { 355 qemu_irq_pulse(s->sysresetreq); 356 } 357 if (value & 2) { 358 qemu_log_mask(LOG_UNIMP, "VECTCLRACTIVE unimplemented\n"); 359 } 360 if (value & 1) { 361 qemu_log_mask(LOG_UNIMP, "AIRCR system reset unimplemented\n"); 362 } 363 if (value & 0x700) { 364 qemu_log_mask(LOG_UNIMP, "PRIGROUP unimplemented\n"); 365 } 366 } 367 break; 368 case 0xd10: /* System Control. */ 369 case 0xd14: /* Configuration Control. */ 370 /* TODO: Implement control registers. */ 371 qemu_log_mask(LOG_UNIMP, "NVIC: SCR and CCR unimplemented\n"); 372 break; 373 case 0xd24: /* System Handler Control. */ 374 /* TODO: Real hardware allows you to set/clear the active bits 375 under some circumstances. We don't implement this. */ 376 s->gic.irq_state[ARMV7M_EXCP_MEM].enabled = (value & (1 << 16)) != 0; 377 s->gic.irq_state[ARMV7M_EXCP_BUS].enabled = (value & (1 << 17)) != 0; 378 s->gic.irq_state[ARMV7M_EXCP_USAGE].enabled = (value & (1 << 18)) != 0; 379 break; 380 case 0xd28: /* Configurable Fault Status. */ 381 case 0xd2c: /* Hard Fault Status. */ 382 case 0xd30: /* Debug Fault Status. */ 383 case 0xd34: /* Mem Manage Address. */ 384 case 0xd38: /* Bus Fault Address. */ 385 case 0xd3c: /* Aux Fault Status. */ 386 qemu_log_mask(LOG_UNIMP, 387 "NVIC: fault status registers unimplemented\n"); 388 break; 389 case 0xf00: /* Software Triggered Interrupt Register */ 390 if ((value & 0x1ff) < s->num_irq) { 391 gic_set_pending_private(&s->gic, 0, value & 0x1ff); 392 } 393 break; 394 default: 395 qemu_log_mask(LOG_GUEST_ERROR, 396 "NVIC: Bad write offset 0x%x\n", offset); 397 } 398 } 399 400 static uint64_t nvic_sysreg_read(void *opaque, hwaddr addr, 401 unsigned size) 402 { 403 nvic_state *s = (nvic_state *)opaque; 404 uint32_t offset = addr; 405 int i; 406 uint32_t val; 407 408 switch (offset) { 409 case 0xd18 ... 0xd23: /* System Handler Priority. */ 410 val = 0; 411 for (i = 0; i < size; i++) { 412 val |= s->gic.priority1[(offset - 0xd14) + i][0] << (i * 8); 413 } 414 return val; 415 case 0xfe0 ... 0xfff: /* ID. */ 416 if (offset & 3) { 417 return 0; 418 } 419 return nvic_id[(offset - 0xfe0) >> 2]; 420 } 421 if (size == 4) { 422 return nvic_readl(s, offset); 423 } 424 qemu_log_mask(LOG_GUEST_ERROR, 425 "NVIC: Bad read of size %d at offset 0x%x\n", size, offset); 426 return 0; 427 } 428 429 static void nvic_sysreg_write(void *opaque, hwaddr addr, 430 uint64_t value, unsigned size) 431 { 432 nvic_state *s = (nvic_state *)opaque; 433 uint32_t offset = addr; 434 int i; 435 436 switch (offset) { 437 case 0xd18 ... 0xd23: /* System Handler Priority. */ 438 for (i = 0; i < size; i++) { 439 s->gic.priority1[(offset - 0xd14) + i][0] = 440 (value >> (i * 8)) & 0xff; 441 } 442 gic_update(&s->gic); 443 return; 444 } 445 if (size == 4) { 446 nvic_writel(s, offset, value); 447 return; 448 } 449 qemu_log_mask(LOG_GUEST_ERROR, 450 "NVIC: Bad write of size %d at offset 0x%x\n", size, offset); 451 } 452 453 static const MemoryRegionOps nvic_sysreg_ops = { 454 .read = nvic_sysreg_read, 455 .write = nvic_sysreg_write, 456 .endianness = DEVICE_NATIVE_ENDIAN, 457 }; 458 459 static const VMStateDescription vmstate_nvic = { 460 .name = "armv7m_nvic", 461 .version_id = 1, 462 .minimum_version_id = 1, 463 .fields = (VMStateField[]) { 464 VMSTATE_UINT32(systick.control, nvic_state), 465 VMSTATE_UINT32(systick.reload, nvic_state), 466 VMSTATE_INT64(systick.tick, nvic_state), 467 VMSTATE_TIMER_PTR(systick.timer, nvic_state), 468 VMSTATE_END_OF_LIST() 469 } 470 }; 471 472 static void armv7m_nvic_reset(DeviceState *dev) 473 { 474 nvic_state *s = NVIC(dev); 475 NVICClass *nc = NVIC_GET_CLASS(s); 476 nc->parent_reset(dev); 477 /* Common GIC reset resets to disabled; the NVIC doesn't have 478 * per-CPU interfaces so mark our non-existent CPU interface 479 * as enabled by default, and with a priority mask which allows 480 * all interrupts through. 481 */ 482 s->gic.cpu_ctlr[0] = GICC_CTLR_EN_GRP0; 483 s->gic.priority_mask[0] = 0x100; 484 /* The NVIC as a whole is always enabled. */ 485 s->gic.ctlr = 1; 486 systick_reset(s); 487 } 488 489 static void armv7m_nvic_realize(DeviceState *dev, Error **errp) 490 { 491 nvic_state *s = NVIC(dev); 492 NVICClass *nc = NVIC_GET_CLASS(s); 493 Error *local_err = NULL; 494 495 /* The NVIC always has only one CPU */ 496 s->gic.num_cpu = 1; 497 /* Tell the common code we're an NVIC */ 498 s->gic.revision = 0xffffffff; 499 s->num_irq = s->gic.num_irq; 500 nc->parent_realize(dev, &local_err); 501 if (local_err) { 502 error_propagate(errp, local_err); 503 return; 504 } 505 gic_init_irqs_and_distributor(&s->gic); 506 /* The NVIC and system controller register area looks like this: 507 * 0..0xff : system control registers, including systick 508 * 0x100..0xcff : GIC-like registers 509 * 0xd00..0xfff : system control registers 510 * We use overlaying to put the GIC like registers 511 * over the top of the system control register region. 512 */ 513 memory_region_init(&s->container, OBJECT(s), "nvic", 0x1000); 514 /* The system register region goes at the bottom of the priority 515 * stack as it covers the whole page. 516 */ 517 memory_region_init_io(&s->sysregmem, OBJECT(s), &nvic_sysreg_ops, s, 518 "nvic_sysregs", 0x1000); 519 memory_region_add_subregion(&s->container, 0, &s->sysregmem); 520 /* Alias the GIC region so we can get only the section of it 521 * we need, and layer it on top of the system register region. 522 */ 523 memory_region_init_alias(&s->gic_iomem_alias, OBJECT(s), 524 "nvic-gic", &s->gic.iomem, 525 0x100, 0xc00); 526 memory_region_add_subregion_overlap(&s->container, 0x100, 527 &s->gic_iomem_alias, 1); 528 /* Map the whole thing into system memory at the location required 529 * by the v7M architecture. 530 */ 531 memory_region_add_subregion(get_system_memory(), 0xe000e000, &s->container); 532 s->systick.timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, systick_timer_tick, s); 533 } 534 535 static void armv7m_nvic_instance_init(Object *obj) 536 { 537 /* We have a different default value for the num-irq property 538 * than our superclass. This function runs after qdev init 539 * has set the defaults from the Property array and before 540 * any user-specified property setting, so just modify the 541 * value in the GICState struct. 542 */ 543 GICState *s = ARM_GIC_COMMON(obj); 544 DeviceState *dev = DEVICE(obj); 545 nvic_state *nvic = NVIC(obj); 546 /* The ARM v7m may have anything from 0 to 496 external interrupt 547 * IRQ lines. We default to 64. Other boards may differ and should 548 * set the num-irq property appropriately. 549 */ 550 s->num_irq = 64; 551 qdev_init_gpio_out_named(dev, &nvic->sysresetreq, "SYSRESETREQ", 1); 552 } 553 554 static void armv7m_nvic_class_init(ObjectClass *klass, void *data) 555 { 556 NVICClass *nc = NVIC_CLASS(klass); 557 DeviceClass *dc = DEVICE_CLASS(klass); 558 559 nc->parent_reset = dc->reset; 560 nc->parent_realize = dc->realize; 561 dc->vmsd = &vmstate_nvic; 562 dc->reset = armv7m_nvic_reset; 563 dc->realize = armv7m_nvic_realize; 564 } 565 566 static const TypeInfo armv7m_nvic_info = { 567 .name = TYPE_NVIC, 568 .parent = TYPE_ARM_GIC_COMMON, 569 .instance_init = armv7m_nvic_instance_init, 570 .instance_size = sizeof(nvic_state), 571 .class_init = armv7m_nvic_class_init, 572 .class_size = sizeof(NVICClass), 573 }; 574 575 static void armv7m_nvic_register_types(void) 576 { 577 type_register_static(&armv7m_nvic_info); 578 } 579 580 type_init(armv7m_nvic_register_types) 581