xref: /openbmc/qemu/hw/intc/armv7m_nvic.c (revision 1d470673)
1 /*
2  * ARM Nested Vectored Interrupt Controller
3  *
4  * Copyright (c) 2006-2007 CodeSourcery.
5  * Written by Paul Brook
6  *
7  * This code is licensed under the GPL.
8  *
9  * The ARMv7M System controller is fairly tightly tied in with the
10  * NVIC.  Much of that is also implemented here.
11  */
12 
13 #include "qemu/osdep.h"
14 #include "qapi/error.h"
15 #include "cpu.h"
16 #include "hw/sysbus.h"
17 #include "migration/vmstate.h"
18 #include "qemu/timer.h"
19 #include "hw/intc/armv7m_nvic.h"
20 #include "hw/irq.h"
21 #include "hw/qdev-properties.h"
22 #include "sysemu/runstate.h"
23 #include "target/arm/cpu.h"
24 #include "exec/exec-all.h"
25 #include "exec/memop.h"
26 #include "qemu/log.h"
27 #include "qemu/module.h"
28 #include "trace.h"
29 
30 /* IRQ number counting:
31  *
32  * the num-irq property counts the number of external IRQ lines
33  *
34  * NVICState::num_irq counts the total number of exceptions
35  * (external IRQs, the 15 internal exceptions including reset,
36  * and one for the unused exception number 0).
37  *
38  * NVIC_MAX_IRQ is the highest permitted number of external IRQ lines.
39  *
40  * NVIC_MAX_VECTORS is the highest permitted number of exceptions.
41  *
42  * Iterating through all exceptions should typically be done with
43  * for (i = 1; i < s->num_irq; i++) to avoid the unused slot 0.
44  *
45  * The external qemu_irq lines are the NVIC's external IRQ lines,
46  * so line 0 is exception 16.
47  *
48  * In the terminology of the architecture manual, "interrupts" are
49  * a subcategory of exception referring to the external interrupts
50  * (which are exception numbers NVIC_FIRST_IRQ and upward).
51  * For historical reasons QEMU tends to use "interrupt" and
52  * "exception" more or less interchangeably.
53  */
54 #define NVIC_FIRST_IRQ NVIC_INTERNAL_VECTORS
55 #define NVIC_MAX_IRQ (NVIC_MAX_VECTORS - NVIC_FIRST_IRQ)
56 
57 /* Effective running priority of the CPU when no exception is active
58  * (higher than the highest possible priority value)
59  */
60 #define NVIC_NOEXC_PRIO 0x100
61 /* Maximum priority of non-secure exceptions when AIRCR.PRIS is set */
62 #define NVIC_NS_PRIO_LIMIT 0x80
63 
64 static const uint8_t nvic_id[] = {
65     0x00, 0xb0, 0x1b, 0x00, 0x0d, 0xe0, 0x05, 0xb1
66 };
67 
68 static void signal_sysresetreq(NVICState *s)
69 {
70     if (qemu_irq_is_connected(s->sysresetreq)) {
71         qemu_irq_pulse(s->sysresetreq);
72     } else {
73         /*
74          * Default behaviour if the SoC doesn't need to wire up
75          * SYSRESETREQ (eg to a system reset controller of some kind):
76          * perform a system reset via the usual QEMU API.
77          */
78         qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
79     }
80 }
81 
82 static int nvic_pending_prio(NVICState *s)
83 {
84     /* return the group priority of the current pending interrupt,
85      * or NVIC_NOEXC_PRIO if no interrupt is pending
86      */
87     return s->vectpending_prio;
88 }
89 
90 /* Return the value of the ISCR RETTOBASE bit:
91  * 1 if there is exactly one active exception
92  * 0 if there is more than one active exception
93  * UNKNOWN if there are no active exceptions (we choose 1,
94  * which matches the choice Cortex-M3 is documented as making).
95  *
96  * NB: some versions of the documentation talk about this
97  * counting "active exceptions other than the one shown by IPSR";
98  * this is only different in the obscure corner case where guest
99  * code has manually deactivated an exception and is about
100  * to fail an exception-return integrity check. The definition
101  * above is the one from the v8M ARM ARM and is also in line
102  * with the behaviour documented for the Cortex-M3.
103  */
104 static bool nvic_rettobase(NVICState *s)
105 {
106     int irq, nhand = 0;
107     bool check_sec = arm_feature(&s->cpu->env, ARM_FEATURE_M_SECURITY);
108 
109     for (irq = ARMV7M_EXCP_RESET; irq < s->num_irq; irq++) {
110         if (s->vectors[irq].active ||
111             (check_sec && irq < NVIC_INTERNAL_VECTORS &&
112              s->sec_vectors[irq].active)) {
113             nhand++;
114             if (nhand == 2) {
115                 return 0;
116             }
117         }
118     }
119 
120     return 1;
121 }
122 
123 /* Return the value of the ISCR ISRPENDING bit:
124  * 1 if an external interrupt is pending
125  * 0 if no external interrupt is pending
126  */
127 static bool nvic_isrpending(NVICState *s)
128 {
129     int irq;
130 
131     /* We can shortcut if the highest priority pending interrupt
132      * happens to be external or if there is nothing pending.
133      */
134     if (s->vectpending > NVIC_FIRST_IRQ) {
135         return true;
136     }
137     if (s->vectpending == 0) {
138         return false;
139     }
140 
141     for (irq = NVIC_FIRST_IRQ; irq < s->num_irq; irq++) {
142         if (s->vectors[irq].pending) {
143             return true;
144         }
145     }
146     return false;
147 }
148 
149 static bool exc_is_banked(int exc)
150 {
151     /* Return true if this is one of the limited set of exceptions which
152      * are banked (and thus have state in sec_vectors[])
153      */
154     return exc == ARMV7M_EXCP_HARD ||
155         exc == ARMV7M_EXCP_MEM ||
156         exc == ARMV7M_EXCP_USAGE ||
157         exc == ARMV7M_EXCP_SVC ||
158         exc == ARMV7M_EXCP_PENDSV ||
159         exc == ARMV7M_EXCP_SYSTICK;
160 }
161 
162 /* Return a mask word which clears the subpriority bits from
163  * a priority value for an M-profile exception, leaving only
164  * the group priority.
165  */
166 static inline uint32_t nvic_gprio_mask(NVICState *s, bool secure)
167 {
168     return ~0U << (s->prigroup[secure] + 1);
169 }
170 
171 static bool exc_targets_secure(NVICState *s, int exc)
172 {
173     /* Return true if this non-banked exception targets Secure state. */
174     if (!arm_feature(&s->cpu->env, ARM_FEATURE_M_SECURITY)) {
175         return false;
176     }
177 
178     if (exc >= NVIC_FIRST_IRQ) {
179         return !s->itns[exc];
180     }
181 
182     /* Function shouldn't be called for banked exceptions. */
183     assert(!exc_is_banked(exc));
184 
185     switch (exc) {
186     case ARMV7M_EXCP_NMI:
187     case ARMV7M_EXCP_BUS:
188         return !(s->cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK);
189     case ARMV7M_EXCP_SECURE:
190         return true;
191     case ARMV7M_EXCP_DEBUG:
192         /* TODO: controlled by DEMCR.SDME, which we don't yet implement */
193         return false;
194     default:
195         /* reset, and reserved (unused) low exception numbers.
196          * We'll get called by code that loops through all the exception
197          * numbers, but it doesn't matter what we return here as these
198          * non-existent exceptions will never be pended or active.
199          */
200         return true;
201     }
202 }
203 
204 static int exc_group_prio(NVICState *s, int rawprio, bool targets_secure)
205 {
206     /* Return the group priority for this exception, given its raw
207      * (group-and-subgroup) priority value and whether it is targeting
208      * secure state or not.
209      */
210     if (rawprio < 0) {
211         return rawprio;
212     }
213     rawprio &= nvic_gprio_mask(s, targets_secure);
214     /* AIRCR.PRIS causes us to squash all NS priorities into the
215      * lower half of the total range
216      */
217     if (!targets_secure &&
218         (s->cpu->env.v7m.aircr & R_V7M_AIRCR_PRIS_MASK)) {
219         rawprio = (rawprio >> 1) + NVIC_NS_PRIO_LIMIT;
220     }
221     return rawprio;
222 }
223 
224 /* Recompute vectpending and exception_prio for a CPU which implements
225  * the Security extension
226  */
227 static void nvic_recompute_state_secure(NVICState *s)
228 {
229     int i, bank;
230     int pend_prio = NVIC_NOEXC_PRIO;
231     int active_prio = NVIC_NOEXC_PRIO;
232     int pend_irq = 0;
233     bool pending_is_s_banked = false;
234     int pend_subprio = 0;
235 
236     /* R_CQRV: precedence is by:
237      *  - lowest group priority; if both the same then
238      *  - lowest subpriority; if both the same then
239      *  - lowest exception number; if both the same (ie banked) then
240      *  - secure exception takes precedence
241      * Compare pseudocode RawExecutionPriority.
242      * Annoyingly, now we have two prigroup values (for S and NS)
243      * we can't do the loop comparison on raw priority values.
244      */
245     for (i = 1; i < s->num_irq; i++) {
246         for (bank = M_REG_S; bank >= M_REG_NS; bank--) {
247             VecInfo *vec;
248             int prio, subprio;
249             bool targets_secure;
250 
251             if (bank == M_REG_S) {
252                 if (!exc_is_banked(i)) {
253                     continue;
254                 }
255                 vec = &s->sec_vectors[i];
256                 targets_secure = true;
257             } else {
258                 vec = &s->vectors[i];
259                 targets_secure = !exc_is_banked(i) && exc_targets_secure(s, i);
260             }
261 
262             prio = exc_group_prio(s, vec->prio, targets_secure);
263             subprio = vec->prio & ~nvic_gprio_mask(s, targets_secure);
264             if (vec->enabled && vec->pending &&
265                 ((prio < pend_prio) ||
266                  (prio == pend_prio && prio >= 0 && subprio < pend_subprio))) {
267                 pend_prio = prio;
268                 pend_subprio = subprio;
269                 pend_irq = i;
270                 pending_is_s_banked = (bank == M_REG_S);
271             }
272             if (vec->active && prio < active_prio) {
273                 active_prio = prio;
274             }
275         }
276     }
277 
278     s->vectpending_is_s_banked = pending_is_s_banked;
279     s->vectpending = pend_irq;
280     s->vectpending_prio = pend_prio;
281     s->exception_prio = active_prio;
282 
283     trace_nvic_recompute_state_secure(s->vectpending,
284                                       s->vectpending_is_s_banked,
285                                       s->vectpending_prio,
286                                       s->exception_prio);
287 }
288 
289 /* Recompute vectpending and exception_prio */
290 static void nvic_recompute_state(NVICState *s)
291 {
292     int i;
293     int pend_prio = NVIC_NOEXC_PRIO;
294     int active_prio = NVIC_NOEXC_PRIO;
295     int pend_irq = 0;
296 
297     /* In theory we could write one function that handled both
298      * the "security extension present" and "not present"; however
299      * the security related changes significantly complicate the
300      * recomputation just by themselves and mixing both cases together
301      * would be even worse, so we retain a separate non-secure-only
302      * version for CPUs which don't implement the security extension.
303      */
304     if (arm_feature(&s->cpu->env, ARM_FEATURE_M_SECURITY)) {
305         nvic_recompute_state_secure(s);
306         return;
307     }
308 
309     for (i = 1; i < s->num_irq; i++) {
310         VecInfo *vec = &s->vectors[i];
311 
312         if (vec->enabled && vec->pending && vec->prio < pend_prio) {
313             pend_prio = vec->prio;
314             pend_irq = i;
315         }
316         if (vec->active && vec->prio < active_prio) {
317             active_prio = vec->prio;
318         }
319     }
320 
321     if (active_prio > 0) {
322         active_prio &= nvic_gprio_mask(s, false);
323     }
324 
325     if (pend_prio > 0) {
326         pend_prio &= nvic_gprio_mask(s, false);
327     }
328 
329     s->vectpending = pend_irq;
330     s->vectpending_prio = pend_prio;
331     s->exception_prio = active_prio;
332 
333     trace_nvic_recompute_state(s->vectpending,
334                                s->vectpending_prio,
335                                s->exception_prio);
336 }
337 
338 /* Return the current execution priority of the CPU
339  * (equivalent to the pseudocode ExecutionPriority function).
340  * This is a value between -2 (NMI priority) and NVIC_NOEXC_PRIO.
341  */
342 static inline int nvic_exec_prio(NVICState *s)
343 {
344     CPUARMState *env = &s->cpu->env;
345     int running = NVIC_NOEXC_PRIO;
346 
347     if (env->v7m.basepri[M_REG_NS] > 0) {
348         running = exc_group_prio(s, env->v7m.basepri[M_REG_NS], M_REG_NS);
349     }
350 
351     if (env->v7m.basepri[M_REG_S] > 0) {
352         int basepri = exc_group_prio(s, env->v7m.basepri[M_REG_S], M_REG_S);
353         if (running > basepri) {
354             running = basepri;
355         }
356     }
357 
358     if (env->v7m.primask[M_REG_NS]) {
359         if (env->v7m.aircr & R_V7M_AIRCR_PRIS_MASK) {
360             if (running > NVIC_NS_PRIO_LIMIT) {
361                 running = NVIC_NS_PRIO_LIMIT;
362             }
363         } else {
364             running = 0;
365         }
366     }
367 
368     if (env->v7m.primask[M_REG_S]) {
369         running = 0;
370     }
371 
372     if (env->v7m.faultmask[M_REG_NS]) {
373         if (env->v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK) {
374             running = -1;
375         } else {
376             if (env->v7m.aircr & R_V7M_AIRCR_PRIS_MASK) {
377                 if (running > NVIC_NS_PRIO_LIMIT) {
378                     running = NVIC_NS_PRIO_LIMIT;
379                 }
380             } else {
381                 running = 0;
382             }
383         }
384     }
385 
386     if (env->v7m.faultmask[M_REG_S]) {
387         running = (env->v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK) ? -3 : -1;
388     }
389 
390     /* consider priority of active handler */
391     return MIN(running, s->exception_prio);
392 }
393 
394 bool armv7m_nvic_neg_prio_requested(void *opaque, bool secure)
395 {
396     /* Return true if the requested execution priority is negative
397      * for the specified security state, ie that security state
398      * has an active NMI or HardFault or has set its FAULTMASK.
399      * Note that this is not the same as whether the execution
400      * priority is actually negative (for instance AIRCR.PRIS may
401      * mean we don't allow FAULTMASK_NS to actually make the execution
402      * priority negative). Compare pseudocode IsReqExcPriNeg().
403      */
404     NVICState *s = opaque;
405 
406     if (s->cpu->env.v7m.faultmask[secure]) {
407         return true;
408     }
409 
410     if (secure ? s->sec_vectors[ARMV7M_EXCP_HARD].active :
411         s->vectors[ARMV7M_EXCP_HARD].active) {
412         return true;
413     }
414 
415     if (s->vectors[ARMV7M_EXCP_NMI].active &&
416         exc_targets_secure(s, ARMV7M_EXCP_NMI) == secure) {
417         return true;
418     }
419 
420     return false;
421 }
422 
423 bool armv7m_nvic_can_take_pending_exception(void *opaque)
424 {
425     NVICState *s = opaque;
426 
427     return nvic_exec_prio(s) > nvic_pending_prio(s);
428 }
429 
430 int armv7m_nvic_raw_execution_priority(void *opaque)
431 {
432     NVICState *s = opaque;
433 
434     return s->exception_prio;
435 }
436 
437 /* caller must call nvic_irq_update() after this.
438  * secure indicates the bank to use for banked exceptions (we assert if
439  * we are passed secure=true for a non-banked exception).
440  */
441 static void set_prio(NVICState *s, unsigned irq, bool secure, uint8_t prio)
442 {
443     assert(irq > ARMV7M_EXCP_NMI); /* only use for configurable prios */
444     assert(irq < s->num_irq);
445 
446     prio &= MAKE_64BIT_MASK(8 - s->num_prio_bits, s->num_prio_bits);
447 
448     if (secure) {
449         assert(exc_is_banked(irq));
450         s->sec_vectors[irq].prio = prio;
451     } else {
452         s->vectors[irq].prio = prio;
453     }
454 
455     trace_nvic_set_prio(irq, secure, prio);
456 }
457 
458 /* Return the current raw priority register value.
459  * secure indicates the bank to use for banked exceptions (we assert if
460  * we are passed secure=true for a non-banked exception).
461  */
462 static int get_prio(NVICState *s, unsigned irq, bool secure)
463 {
464     assert(irq > ARMV7M_EXCP_NMI); /* only use for configurable prios */
465     assert(irq < s->num_irq);
466 
467     if (secure) {
468         assert(exc_is_banked(irq));
469         return s->sec_vectors[irq].prio;
470     } else {
471         return s->vectors[irq].prio;
472     }
473 }
474 
475 /* Recompute state and assert irq line accordingly.
476  * Must be called after changes to:
477  *  vec->active, vec->enabled, vec->pending or vec->prio for any vector
478  *  prigroup
479  */
480 static void nvic_irq_update(NVICState *s)
481 {
482     int lvl;
483     int pend_prio;
484 
485     nvic_recompute_state(s);
486     pend_prio = nvic_pending_prio(s);
487 
488     /* Raise NVIC output if this IRQ would be taken, except that we
489      * ignore the effects of the BASEPRI, FAULTMASK and PRIMASK (which
490      * will be checked for in arm_v7m_cpu_exec_interrupt()); changes
491      * to those CPU registers don't cause us to recalculate the NVIC
492      * pending info.
493      */
494     lvl = (pend_prio < s->exception_prio);
495     trace_nvic_irq_update(s->vectpending, pend_prio, s->exception_prio, lvl);
496     qemu_set_irq(s->excpout, lvl);
497 }
498 
499 /**
500  * armv7m_nvic_clear_pending: mark the specified exception as not pending
501  * @opaque: the NVIC
502  * @irq: the exception number to mark as not pending
503  * @secure: false for non-banked exceptions or for the nonsecure
504  * version of a banked exception, true for the secure version of a banked
505  * exception.
506  *
507  * Marks the specified exception as not pending. Note that we will assert()
508  * if @secure is true and @irq does not specify one of the fixed set
509  * of architecturally banked exceptions.
510  */
511 static void armv7m_nvic_clear_pending(void *opaque, int irq, bool secure)
512 {
513     NVICState *s = (NVICState *)opaque;
514     VecInfo *vec;
515 
516     assert(irq > ARMV7M_EXCP_RESET && irq < s->num_irq);
517 
518     if (secure) {
519         assert(exc_is_banked(irq));
520         vec = &s->sec_vectors[irq];
521     } else {
522         vec = &s->vectors[irq];
523     }
524     trace_nvic_clear_pending(irq, secure, vec->enabled, vec->prio);
525     if (vec->pending) {
526         vec->pending = 0;
527         nvic_irq_update(s);
528     }
529 }
530 
531 static void do_armv7m_nvic_set_pending(void *opaque, int irq, bool secure,
532                                        bool derived)
533 {
534     /* Pend an exception, including possibly escalating it to HardFault.
535      *
536      * This function handles both "normal" pending of interrupts and
537      * exceptions, and also derived exceptions (ones which occur as
538      * a result of trying to take some other exception).
539      *
540      * If derived == true, the caller guarantees that we are part way through
541      * trying to take an exception (but have not yet called
542      * armv7m_nvic_acknowledge_irq() to make it active), and so:
543      *  - s->vectpending is the "original exception" we were trying to take
544      *  - irq is the "derived exception"
545      *  - nvic_exec_prio(s) gives the priority before exception entry
546      * Here we handle the prioritization logic which the pseudocode puts
547      * in the DerivedLateArrival() function.
548      */
549 
550     NVICState *s = (NVICState *)opaque;
551     bool banked = exc_is_banked(irq);
552     VecInfo *vec;
553     bool targets_secure;
554 
555     assert(irq > ARMV7M_EXCP_RESET && irq < s->num_irq);
556     assert(!secure || banked);
557 
558     vec = (banked && secure) ? &s->sec_vectors[irq] : &s->vectors[irq];
559 
560     targets_secure = banked ? secure : exc_targets_secure(s, irq);
561 
562     trace_nvic_set_pending(irq, secure, targets_secure,
563                            derived, vec->enabled, vec->prio);
564 
565     if (derived) {
566         /* Derived exceptions are always synchronous. */
567         assert(irq >= ARMV7M_EXCP_HARD && irq < ARMV7M_EXCP_PENDSV);
568 
569         if (irq == ARMV7M_EXCP_DEBUG &&
570             exc_group_prio(s, vec->prio, secure) >= nvic_exec_prio(s)) {
571             /* DebugMonitorFault, but its priority is lower than the
572              * preempted exception priority: just ignore it.
573              */
574             return;
575         }
576 
577         if (irq == ARMV7M_EXCP_HARD && vec->prio >= s->vectpending_prio) {
578             /* If this is a terminal exception (one which means we cannot
579              * take the original exception, like a failure to read its
580              * vector table entry), then we must take the derived exception.
581              * If the derived exception can't take priority over the
582              * original exception, then we go into Lockup.
583              *
584              * For QEMU, we rely on the fact that a derived exception is
585              * terminal if and only if it's reported to us as HardFault,
586              * which saves having to have an extra argument is_terminal
587              * that we'd only use in one place.
588              */
589             cpu_abort(&s->cpu->parent_obj,
590                       "Lockup: can't take terminal derived exception "
591                       "(original exception priority %d)\n",
592                       s->vectpending_prio);
593         }
594         /* We now continue with the same code as for a normal pending
595          * exception, which will cause us to pend the derived exception.
596          * We'll then take either the original or the derived exception
597          * based on which is higher priority by the usual mechanism
598          * for selecting the highest priority pending interrupt.
599          */
600     }
601 
602     if (irq >= ARMV7M_EXCP_HARD && irq < ARMV7M_EXCP_PENDSV) {
603         /* If a synchronous exception is pending then it may be
604          * escalated to HardFault if:
605          *  * it is equal or lower priority to current execution
606          *  * it is disabled
607          * (ie we need to take it immediately but we can't do so).
608          * Asynchronous exceptions (and interrupts) simply remain pending.
609          *
610          * For QEMU, we don't have any imprecise (asynchronous) faults,
611          * so we can assume that PREFETCH_ABORT and DATA_ABORT are always
612          * synchronous.
613          * Debug exceptions are awkward because only Debug exceptions
614          * resulting from the BKPT instruction should be escalated,
615          * but we don't currently implement any Debug exceptions other
616          * than those that result from BKPT, so we treat all debug exceptions
617          * as needing escalation.
618          *
619          * This all means we can identify whether to escalate based only on
620          * the exception number and don't (yet) need the caller to explicitly
621          * tell us whether this exception is synchronous or not.
622          */
623         int running = nvic_exec_prio(s);
624         bool escalate = false;
625 
626         if (exc_group_prio(s, vec->prio, secure) >= running) {
627             trace_nvic_escalate_prio(irq, vec->prio, running);
628             escalate = true;
629         } else if (!vec->enabled) {
630             trace_nvic_escalate_disabled(irq);
631             escalate = true;
632         }
633 
634         if (escalate) {
635 
636             /* We need to escalate this exception to a synchronous HardFault.
637              * If BFHFNMINS is set then we escalate to the banked HF for
638              * the target security state of the original exception; otherwise
639              * we take a Secure HardFault.
640              */
641             irq = ARMV7M_EXCP_HARD;
642             if (arm_feature(&s->cpu->env, ARM_FEATURE_M_SECURITY) &&
643                 (targets_secure ||
644                  !(s->cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK))) {
645                 vec = &s->sec_vectors[irq];
646             } else {
647                 vec = &s->vectors[irq];
648             }
649             if (running <= vec->prio) {
650                 /* We want to escalate to HardFault but we can't take the
651                  * synchronous HardFault at this point either. This is a
652                  * Lockup condition due to a guest bug. We don't model
653                  * Lockup, so report via cpu_abort() instead.
654                  */
655                 cpu_abort(&s->cpu->parent_obj,
656                           "Lockup: can't escalate %d to HardFault "
657                           "(current priority %d)\n", irq, running);
658             }
659 
660             /* HF may be banked but there is only one shared HFSR */
661             s->cpu->env.v7m.hfsr |= R_V7M_HFSR_FORCED_MASK;
662         }
663     }
664 
665     if (!vec->pending) {
666         vec->pending = 1;
667         nvic_irq_update(s);
668     }
669 }
670 
671 void armv7m_nvic_set_pending(void *opaque, int irq, bool secure)
672 {
673     do_armv7m_nvic_set_pending(opaque, irq, secure, false);
674 }
675 
676 void armv7m_nvic_set_pending_derived(void *opaque, int irq, bool secure)
677 {
678     do_armv7m_nvic_set_pending(opaque, irq, secure, true);
679 }
680 
681 void armv7m_nvic_set_pending_lazyfp(void *opaque, int irq, bool secure)
682 {
683     /*
684      * Pend an exception during lazy FP stacking. This differs
685      * from the usual exception pending because the logic for
686      * whether we should escalate depends on the saved context
687      * in the FPCCR register, not on the current state of the CPU/NVIC.
688      */
689     NVICState *s = (NVICState *)opaque;
690     bool banked = exc_is_banked(irq);
691     VecInfo *vec;
692     bool targets_secure;
693     bool escalate = false;
694     /*
695      * We will only look at bits in fpccr if this is a banked exception
696      * (in which case 'secure' tells us whether it is the S or NS version).
697      * All the bits for the non-banked exceptions are in fpccr_s.
698      */
699     uint32_t fpccr_s = s->cpu->env.v7m.fpccr[M_REG_S];
700     uint32_t fpccr = s->cpu->env.v7m.fpccr[secure];
701 
702     assert(irq > ARMV7M_EXCP_RESET && irq < s->num_irq);
703     assert(!secure || banked);
704 
705     vec = (banked && secure) ? &s->sec_vectors[irq] : &s->vectors[irq];
706 
707     targets_secure = banked ? secure : exc_targets_secure(s, irq);
708 
709     switch (irq) {
710     case ARMV7M_EXCP_DEBUG:
711         if (!(fpccr_s & R_V7M_FPCCR_MONRDY_MASK)) {
712             /* Ignore DebugMonitor exception */
713             return;
714         }
715         break;
716     case ARMV7M_EXCP_MEM:
717         escalate = !(fpccr & R_V7M_FPCCR_MMRDY_MASK);
718         break;
719     case ARMV7M_EXCP_USAGE:
720         escalate = !(fpccr & R_V7M_FPCCR_UFRDY_MASK);
721         break;
722     case ARMV7M_EXCP_BUS:
723         escalate = !(fpccr_s & R_V7M_FPCCR_BFRDY_MASK);
724         break;
725     case ARMV7M_EXCP_SECURE:
726         escalate = !(fpccr_s & R_V7M_FPCCR_SFRDY_MASK);
727         break;
728     default:
729         g_assert_not_reached();
730     }
731 
732     if (escalate) {
733         /*
734          * Escalate to HardFault: faults that initially targeted Secure
735          * continue to do so, even if HF normally targets NonSecure.
736          */
737         irq = ARMV7M_EXCP_HARD;
738         if (arm_feature(&s->cpu->env, ARM_FEATURE_M_SECURITY) &&
739             (targets_secure ||
740              !(s->cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK))) {
741             vec = &s->sec_vectors[irq];
742         } else {
743             vec = &s->vectors[irq];
744         }
745     }
746 
747     if (!vec->enabled ||
748         nvic_exec_prio(s) <= exc_group_prio(s, vec->prio, secure)) {
749         if (!(fpccr_s & R_V7M_FPCCR_HFRDY_MASK)) {
750             /*
751              * We want to escalate to HardFault but the context the
752              * FP state belongs to prevents the exception pre-empting.
753              */
754             cpu_abort(&s->cpu->parent_obj,
755                       "Lockup: can't escalate to HardFault during "
756                       "lazy FP register stacking\n");
757         }
758     }
759 
760     if (escalate) {
761         s->cpu->env.v7m.hfsr |= R_V7M_HFSR_FORCED_MASK;
762     }
763     if (!vec->pending) {
764         vec->pending = 1;
765         /*
766          * We do not call nvic_irq_update(), because we know our caller
767          * is going to handle causing us to take the exception by
768          * raising EXCP_LAZYFP, so raising the IRQ line would be
769          * pointless extra work. We just need to recompute the
770          * priorities so that armv7m_nvic_can_take_pending_exception()
771          * returns the right answer.
772          */
773         nvic_recompute_state(s);
774     }
775 }
776 
777 /* Make pending IRQ active.  */
778 void armv7m_nvic_acknowledge_irq(void *opaque)
779 {
780     NVICState *s = (NVICState *)opaque;
781     CPUARMState *env = &s->cpu->env;
782     const int pending = s->vectpending;
783     const int running = nvic_exec_prio(s);
784     VecInfo *vec;
785 
786     assert(pending > ARMV7M_EXCP_RESET && pending < s->num_irq);
787 
788     if (s->vectpending_is_s_banked) {
789         vec = &s->sec_vectors[pending];
790     } else {
791         vec = &s->vectors[pending];
792     }
793 
794     assert(vec->enabled);
795     assert(vec->pending);
796 
797     assert(s->vectpending_prio < running);
798 
799     trace_nvic_acknowledge_irq(pending, s->vectpending_prio);
800 
801     vec->active = 1;
802     vec->pending = 0;
803 
804     write_v7m_exception(env, s->vectpending);
805 
806     nvic_irq_update(s);
807 }
808 
809 void armv7m_nvic_get_pending_irq_info(void *opaque,
810                                       int *pirq, bool *ptargets_secure)
811 {
812     NVICState *s = (NVICState *)opaque;
813     const int pending = s->vectpending;
814     bool targets_secure;
815 
816     assert(pending > ARMV7M_EXCP_RESET && pending < s->num_irq);
817 
818     if (s->vectpending_is_s_banked) {
819         targets_secure = true;
820     } else {
821         targets_secure = !exc_is_banked(pending) &&
822             exc_targets_secure(s, pending);
823     }
824 
825     trace_nvic_get_pending_irq_info(pending, targets_secure);
826 
827     *ptargets_secure = targets_secure;
828     *pirq = pending;
829 }
830 
831 int armv7m_nvic_complete_irq(void *opaque, int irq, bool secure)
832 {
833     NVICState *s = (NVICState *)opaque;
834     VecInfo *vec = NULL;
835     int ret = 0;
836 
837     assert(irq > ARMV7M_EXCP_RESET && irq < s->num_irq);
838 
839     trace_nvic_complete_irq(irq, secure);
840 
841     if (secure && exc_is_banked(irq)) {
842         vec = &s->sec_vectors[irq];
843     } else {
844         vec = &s->vectors[irq];
845     }
846 
847     /*
848      * Identify illegal exception return cases. We can't immediately
849      * return at this point because we still need to deactivate
850      * (either this exception or NMI/HardFault) first.
851      */
852     if (!exc_is_banked(irq) && exc_targets_secure(s, irq) != secure) {
853         /*
854          * Return from a configurable exception targeting the opposite
855          * security state from the one we're trying to complete it for.
856          * Clear vec because it's not really the VecInfo for this
857          * (irq, secstate) so we mustn't deactivate it.
858          */
859         ret = -1;
860         vec = NULL;
861     } else if (!vec->active) {
862         /* Return from an inactive interrupt */
863         ret = -1;
864     } else {
865         /* Legal return, we will return the RETTOBASE bit value to the caller */
866         ret = nvic_rettobase(s);
867     }
868 
869     /*
870      * For negative priorities, v8M will forcibly deactivate the appropriate
871      * NMI or HardFault regardless of what interrupt we're being asked to
872      * deactivate (compare the DeActivate() pseudocode). This is a guard
873      * against software returning from NMI or HardFault with a corrupted
874      * IPSR and leaving the CPU in a negative-priority state.
875      * v7M does not do this, but simply deactivates the requested interrupt.
876      */
877     if (arm_feature(&s->cpu->env, ARM_FEATURE_V8)) {
878         switch (armv7m_nvic_raw_execution_priority(s)) {
879         case -1:
880             if (s->cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK) {
881                 vec = &s->vectors[ARMV7M_EXCP_HARD];
882             } else {
883                 vec = &s->sec_vectors[ARMV7M_EXCP_HARD];
884             }
885             break;
886         case -2:
887             vec = &s->vectors[ARMV7M_EXCP_NMI];
888             break;
889         case -3:
890             vec = &s->sec_vectors[ARMV7M_EXCP_HARD];
891             break;
892         default:
893             break;
894         }
895     }
896 
897     if (!vec) {
898         return ret;
899     }
900 
901     vec->active = 0;
902     if (vec->level) {
903         /* Re-pend the exception if it's still held high; only
904          * happens for extenal IRQs
905          */
906         assert(irq >= NVIC_FIRST_IRQ);
907         vec->pending = 1;
908     }
909 
910     nvic_irq_update(s);
911 
912     return ret;
913 }
914 
915 bool armv7m_nvic_get_ready_status(void *opaque, int irq, bool secure)
916 {
917     /*
918      * Return whether an exception is "ready", i.e. it is enabled and is
919      * configured at a priority which would allow it to interrupt the
920      * current execution priority.
921      *
922      * irq and secure have the same semantics as for armv7m_nvic_set_pending():
923      * for non-banked exceptions secure is always false; for banked exceptions
924      * it indicates which of the exceptions is required.
925      */
926     NVICState *s = (NVICState *)opaque;
927     bool banked = exc_is_banked(irq);
928     VecInfo *vec;
929     int running = nvic_exec_prio(s);
930 
931     assert(irq > ARMV7M_EXCP_RESET && irq < s->num_irq);
932     assert(!secure || banked);
933 
934     /*
935      * HardFault is an odd special case: we always check against -1,
936      * even if we're secure and HardFault has priority -3; we never
937      * need to check for enabled state.
938      */
939     if (irq == ARMV7M_EXCP_HARD) {
940         return running > -1;
941     }
942 
943     vec = (banked && secure) ? &s->sec_vectors[irq] : &s->vectors[irq];
944 
945     return vec->enabled &&
946         exc_group_prio(s, vec->prio, secure) < running;
947 }
948 
949 /* callback when external interrupt line is changed */
950 static void set_irq_level(void *opaque, int n, int level)
951 {
952     NVICState *s = opaque;
953     VecInfo *vec;
954 
955     n += NVIC_FIRST_IRQ;
956 
957     assert(n >= NVIC_FIRST_IRQ && n < s->num_irq);
958 
959     trace_nvic_set_irq_level(n, level);
960 
961     /* The pending status of an external interrupt is
962      * latched on rising edge and exception handler return.
963      *
964      * Pulsing the IRQ will always run the handler
965      * once, and the handler will re-run until the
966      * level is low when the handler completes.
967      */
968     vec = &s->vectors[n];
969     if (level != vec->level) {
970         vec->level = level;
971         if (level) {
972             armv7m_nvic_set_pending(s, n, false);
973         }
974     }
975 }
976 
977 /* callback when external NMI line is changed */
978 static void nvic_nmi_trigger(void *opaque, int n, int level)
979 {
980     NVICState *s = opaque;
981 
982     trace_nvic_set_nmi_level(level);
983 
984     /*
985      * The architecture doesn't specify whether NMI should share
986      * the normal-interrupt behaviour of being resampled on
987      * exception handler return. We choose not to, so just
988      * set NMI pending here and don't track the current level.
989      */
990     if (level) {
991         armv7m_nvic_set_pending(s, ARMV7M_EXCP_NMI, false);
992     }
993 }
994 
995 static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
996 {
997     ARMCPU *cpu = s->cpu;
998     uint32_t val;
999 
1000     switch (offset) {
1001     case 4: /* Interrupt Control Type.  */
1002         if (!arm_feature(&cpu->env, ARM_FEATURE_V7)) {
1003             goto bad_offset;
1004         }
1005         return ((s->num_irq - NVIC_FIRST_IRQ) / 32) - 1;
1006     case 0xc: /* CPPWR */
1007         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1008             goto bad_offset;
1009         }
1010         /* We make the IMPDEF choice that nothing can ever go into a
1011          * non-retentive power state, which allows us to RAZ/WI this.
1012          */
1013         return 0;
1014     case 0x380 ... 0x3bf: /* NVIC_ITNS<n> */
1015     {
1016         int startvec = 8 * (offset - 0x380) + NVIC_FIRST_IRQ;
1017         int i;
1018 
1019         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1020             goto bad_offset;
1021         }
1022         if (!attrs.secure) {
1023             return 0;
1024         }
1025         val = 0;
1026         for (i = 0; i < 32 && startvec + i < s->num_irq; i++) {
1027             if (s->itns[startvec + i]) {
1028                 val |= (1 << i);
1029             }
1030         }
1031         return val;
1032     }
1033     case 0xcfc:
1034         if (!arm_feature(&cpu->env, ARM_FEATURE_V8_1M)) {
1035             goto bad_offset;
1036         }
1037         return cpu->revidr;
1038     case 0xd00: /* CPUID Base.  */
1039         return cpu->midr;
1040     case 0xd04: /* Interrupt Control State (ICSR) */
1041         /* VECTACTIVE */
1042         val = cpu->env.v7m.exception;
1043         /* VECTPENDING */
1044         val |= (s->vectpending & 0xff) << 12;
1045         /* ISRPENDING - set if any external IRQ is pending */
1046         if (nvic_isrpending(s)) {
1047             val |= (1 << 22);
1048         }
1049         /* RETTOBASE - set if only one handler is active */
1050         if (nvic_rettobase(s)) {
1051             val |= (1 << 11);
1052         }
1053         if (attrs.secure) {
1054             /* PENDSTSET */
1055             if (s->sec_vectors[ARMV7M_EXCP_SYSTICK].pending) {
1056                 val |= (1 << 26);
1057             }
1058             /* PENDSVSET */
1059             if (s->sec_vectors[ARMV7M_EXCP_PENDSV].pending) {
1060                 val |= (1 << 28);
1061             }
1062         } else {
1063             /* PENDSTSET */
1064             if (s->vectors[ARMV7M_EXCP_SYSTICK].pending) {
1065                 val |= (1 << 26);
1066             }
1067             /* PENDSVSET */
1068             if (s->vectors[ARMV7M_EXCP_PENDSV].pending) {
1069                 val |= (1 << 28);
1070             }
1071         }
1072         /* NMIPENDSET */
1073         if ((attrs.secure || (cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK))
1074             && s->vectors[ARMV7M_EXCP_NMI].pending) {
1075             val |= (1 << 31);
1076         }
1077         /* ISRPREEMPT: RES0 when halting debug not implemented */
1078         /* STTNS: RES0 for the Main Extension */
1079         return val;
1080     case 0xd08: /* Vector Table Offset.  */
1081         return cpu->env.v7m.vecbase[attrs.secure];
1082     case 0xd0c: /* Application Interrupt/Reset Control (AIRCR) */
1083         val = 0xfa050000 | (s->prigroup[attrs.secure] << 8);
1084         if (attrs.secure) {
1085             /* s->aircr stores PRIS, BFHFNMINS, SYSRESETREQS */
1086             val |= cpu->env.v7m.aircr;
1087         } else {
1088             if (arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1089                 /* BFHFNMINS is R/O from NS; other bits are RAZ/WI. If
1090                  * security isn't supported then BFHFNMINS is RAO (and
1091                  * the bit in env.v7m.aircr is always set).
1092                  */
1093                 val |= cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK;
1094             }
1095         }
1096         return val;
1097     case 0xd10: /* System Control.  */
1098         if (!arm_feature(&cpu->env, ARM_FEATURE_V7)) {
1099             goto bad_offset;
1100         }
1101         return cpu->env.v7m.scr[attrs.secure];
1102     case 0xd14: /* Configuration Control.  */
1103         /*
1104          * Non-banked bits: BFHFNMIGN (stored in the NS copy of the register)
1105          * and TRD (stored in the S copy of the register)
1106          */
1107         val = cpu->env.v7m.ccr[attrs.secure];
1108         val |= cpu->env.v7m.ccr[M_REG_NS] & R_V7M_CCR_BFHFNMIGN_MASK;
1109         return val;
1110     case 0xd24: /* System Handler Control and State (SHCSR) */
1111         if (!arm_feature(&cpu->env, ARM_FEATURE_V7)) {
1112             goto bad_offset;
1113         }
1114         val = 0;
1115         if (attrs.secure) {
1116             if (s->sec_vectors[ARMV7M_EXCP_MEM].active) {
1117                 val |= (1 << 0);
1118             }
1119             if (s->sec_vectors[ARMV7M_EXCP_HARD].active) {
1120                 val |= (1 << 2);
1121             }
1122             if (s->sec_vectors[ARMV7M_EXCP_USAGE].active) {
1123                 val |= (1 << 3);
1124             }
1125             if (s->sec_vectors[ARMV7M_EXCP_SVC].active) {
1126                 val |= (1 << 7);
1127             }
1128             if (s->sec_vectors[ARMV7M_EXCP_PENDSV].active) {
1129                 val |= (1 << 10);
1130             }
1131             if (s->sec_vectors[ARMV7M_EXCP_SYSTICK].active) {
1132                 val |= (1 << 11);
1133             }
1134             if (s->sec_vectors[ARMV7M_EXCP_USAGE].pending) {
1135                 val |= (1 << 12);
1136             }
1137             if (s->sec_vectors[ARMV7M_EXCP_MEM].pending) {
1138                 val |= (1 << 13);
1139             }
1140             if (s->sec_vectors[ARMV7M_EXCP_SVC].pending) {
1141                 val |= (1 << 15);
1142             }
1143             if (s->sec_vectors[ARMV7M_EXCP_MEM].enabled) {
1144                 val |= (1 << 16);
1145             }
1146             if (s->sec_vectors[ARMV7M_EXCP_USAGE].enabled) {
1147                 val |= (1 << 18);
1148             }
1149             if (s->sec_vectors[ARMV7M_EXCP_HARD].pending) {
1150                 val |= (1 << 21);
1151             }
1152             /* SecureFault is not banked but is always RAZ/WI to NS */
1153             if (s->vectors[ARMV7M_EXCP_SECURE].active) {
1154                 val |= (1 << 4);
1155             }
1156             if (s->vectors[ARMV7M_EXCP_SECURE].enabled) {
1157                 val |= (1 << 19);
1158             }
1159             if (s->vectors[ARMV7M_EXCP_SECURE].pending) {
1160                 val |= (1 << 20);
1161             }
1162         } else {
1163             if (s->vectors[ARMV7M_EXCP_MEM].active) {
1164                 val |= (1 << 0);
1165             }
1166             if (arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1167                 /* HARDFAULTACT, HARDFAULTPENDED not present in v7M */
1168                 if (s->vectors[ARMV7M_EXCP_HARD].active) {
1169                     val |= (1 << 2);
1170                 }
1171                 if (s->vectors[ARMV7M_EXCP_HARD].pending) {
1172                     val |= (1 << 21);
1173                 }
1174             }
1175             if (s->vectors[ARMV7M_EXCP_USAGE].active) {
1176                 val |= (1 << 3);
1177             }
1178             if (s->vectors[ARMV7M_EXCP_SVC].active) {
1179                 val |= (1 << 7);
1180             }
1181             if (s->vectors[ARMV7M_EXCP_PENDSV].active) {
1182                 val |= (1 << 10);
1183             }
1184             if (s->vectors[ARMV7M_EXCP_SYSTICK].active) {
1185                 val |= (1 << 11);
1186             }
1187             if (s->vectors[ARMV7M_EXCP_USAGE].pending) {
1188                 val |= (1 << 12);
1189             }
1190             if (s->vectors[ARMV7M_EXCP_MEM].pending) {
1191                 val |= (1 << 13);
1192             }
1193             if (s->vectors[ARMV7M_EXCP_SVC].pending) {
1194                 val |= (1 << 15);
1195             }
1196             if (s->vectors[ARMV7M_EXCP_MEM].enabled) {
1197                 val |= (1 << 16);
1198             }
1199             if (s->vectors[ARMV7M_EXCP_USAGE].enabled) {
1200                 val |= (1 << 18);
1201             }
1202         }
1203         if (attrs.secure || (cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK)) {
1204             if (s->vectors[ARMV7M_EXCP_BUS].active) {
1205                 val |= (1 << 1);
1206             }
1207             if (s->vectors[ARMV7M_EXCP_BUS].pending) {
1208                 val |= (1 << 14);
1209             }
1210             if (s->vectors[ARMV7M_EXCP_BUS].enabled) {
1211                 val |= (1 << 17);
1212             }
1213             if (arm_feature(&cpu->env, ARM_FEATURE_V8) &&
1214                 s->vectors[ARMV7M_EXCP_NMI].active) {
1215                 /* NMIACT is not present in v7M */
1216                 val |= (1 << 5);
1217             }
1218         }
1219 
1220         /* TODO: this is RAZ/WI from NS if DEMCR.SDME is set */
1221         if (s->vectors[ARMV7M_EXCP_DEBUG].active) {
1222             val |= (1 << 8);
1223         }
1224         return val;
1225     case 0xd2c: /* Hard Fault Status.  */
1226         if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
1227             goto bad_offset;
1228         }
1229         return cpu->env.v7m.hfsr;
1230     case 0xd30: /* Debug Fault Status.  */
1231         return cpu->env.v7m.dfsr;
1232     case 0xd34: /* MMFAR MemManage Fault Address */
1233         if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
1234             goto bad_offset;
1235         }
1236         return cpu->env.v7m.mmfar[attrs.secure];
1237     case 0xd38: /* Bus Fault Address.  */
1238         if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
1239             goto bad_offset;
1240         }
1241         if (!attrs.secure &&
1242             !(s->cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK)) {
1243             return 0;
1244         }
1245         return cpu->env.v7m.bfar;
1246     case 0xd3c: /* Aux Fault Status.  */
1247         /* TODO: Implement fault status registers.  */
1248         qemu_log_mask(LOG_UNIMP,
1249                       "Aux Fault status registers unimplemented\n");
1250         return 0;
1251     case 0xd40: /* PFR0.  */
1252         if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
1253             goto bad_offset;
1254         }
1255         return cpu->isar.id_pfr0;
1256     case 0xd44: /* PFR1.  */
1257         if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
1258             goto bad_offset;
1259         }
1260         return cpu->isar.id_pfr1;
1261     case 0xd48: /* DFR0.  */
1262         if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
1263             goto bad_offset;
1264         }
1265         return cpu->isar.id_dfr0;
1266     case 0xd4c: /* AFR0.  */
1267         if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
1268             goto bad_offset;
1269         }
1270         return cpu->id_afr0;
1271     case 0xd50: /* MMFR0.  */
1272         if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
1273             goto bad_offset;
1274         }
1275         return cpu->isar.id_mmfr0;
1276     case 0xd54: /* MMFR1.  */
1277         if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
1278             goto bad_offset;
1279         }
1280         return cpu->isar.id_mmfr1;
1281     case 0xd58: /* MMFR2.  */
1282         if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
1283             goto bad_offset;
1284         }
1285         return cpu->isar.id_mmfr2;
1286     case 0xd5c: /* MMFR3.  */
1287         if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
1288             goto bad_offset;
1289         }
1290         return cpu->isar.id_mmfr3;
1291     case 0xd60: /* ISAR0.  */
1292         if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
1293             goto bad_offset;
1294         }
1295         return cpu->isar.id_isar0;
1296     case 0xd64: /* ISAR1.  */
1297         if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
1298             goto bad_offset;
1299         }
1300         return cpu->isar.id_isar1;
1301     case 0xd68: /* ISAR2.  */
1302         if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
1303             goto bad_offset;
1304         }
1305         return cpu->isar.id_isar2;
1306     case 0xd6c: /* ISAR3.  */
1307         if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
1308             goto bad_offset;
1309         }
1310         return cpu->isar.id_isar3;
1311     case 0xd70: /* ISAR4.  */
1312         if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
1313             goto bad_offset;
1314         }
1315         return cpu->isar.id_isar4;
1316     case 0xd74: /* ISAR5.  */
1317         if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
1318             goto bad_offset;
1319         }
1320         return cpu->isar.id_isar5;
1321     case 0xd78: /* CLIDR */
1322         return cpu->clidr;
1323     case 0xd7c: /* CTR */
1324         return cpu->ctr;
1325     case 0xd80: /* CSSIDR */
1326     {
1327         int idx = cpu->env.v7m.csselr[attrs.secure] & R_V7M_CSSELR_INDEX_MASK;
1328         return cpu->ccsidr[idx];
1329     }
1330     case 0xd84: /* CSSELR */
1331         return cpu->env.v7m.csselr[attrs.secure];
1332     case 0xd88: /* CPACR */
1333         if (!cpu_isar_feature(aa32_vfp_simd, cpu)) {
1334             return 0;
1335         }
1336         return cpu->env.v7m.cpacr[attrs.secure];
1337     case 0xd8c: /* NSACR */
1338         if (!attrs.secure || !cpu_isar_feature(aa32_vfp_simd, cpu)) {
1339             return 0;
1340         }
1341         return cpu->env.v7m.nsacr;
1342     /* TODO: Implement debug registers.  */
1343     case 0xd90: /* MPU_TYPE */
1344         /* Unified MPU; if the MPU is not present this value is zero */
1345         return cpu->pmsav7_dregion << 8;
1346     case 0xd94: /* MPU_CTRL */
1347         return cpu->env.v7m.mpu_ctrl[attrs.secure];
1348     case 0xd98: /* MPU_RNR */
1349         return cpu->env.pmsav7.rnr[attrs.secure];
1350     case 0xd9c: /* MPU_RBAR */
1351     case 0xda4: /* MPU_RBAR_A1 */
1352     case 0xdac: /* MPU_RBAR_A2 */
1353     case 0xdb4: /* MPU_RBAR_A3 */
1354     {
1355         int region = cpu->env.pmsav7.rnr[attrs.secure];
1356 
1357         if (arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1358             /* PMSAv8M handling of the aliases is different from v7M:
1359              * aliases A1, A2, A3 override the low two bits of the region
1360              * number in MPU_RNR, and there is no 'region' field in the
1361              * RBAR register.
1362              */
1363             int aliasno = (offset - 0xd9c) / 8; /* 0..3 */
1364             if (aliasno) {
1365                 region = deposit32(region, 0, 2, aliasno);
1366             }
1367             if (region >= cpu->pmsav7_dregion) {
1368                 return 0;
1369             }
1370             return cpu->env.pmsav8.rbar[attrs.secure][region];
1371         }
1372 
1373         if (region >= cpu->pmsav7_dregion) {
1374             return 0;
1375         }
1376         return (cpu->env.pmsav7.drbar[region] & ~0x1f) | (region & 0xf);
1377     }
1378     case 0xda0: /* MPU_RASR (v7M), MPU_RLAR (v8M) */
1379     case 0xda8: /* MPU_RASR_A1 (v7M), MPU_RLAR_A1 (v8M) */
1380     case 0xdb0: /* MPU_RASR_A2 (v7M), MPU_RLAR_A2 (v8M) */
1381     case 0xdb8: /* MPU_RASR_A3 (v7M), MPU_RLAR_A3 (v8M) */
1382     {
1383         int region = cpu->env.pmsav7.rnr[attrs.secure];
1384 
1385         if (arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1386             /* PMSAv8M handling of the aliases is different from v7M:
1387              * aliases A1, A2, A3 override the low two bits of the region
1388              * number in MPU_RNR.
1389              */
1390             int aliasno = (offset - 0xda0) / 8; /* 0..3 */
1391             if (aliasno) {
1392                 region = deposit32(region, 0, 2, aliasno);
1393             }
1394             if (region >= cpu->pmsav7_dregion) {
1395                 return 0;
1396             }
1397             return cpu->env.pmsav8.rlar[attrs.secure][region];
1398         }
1399 
1400         if (region >= cpu->pmsav7_dregion) {
1401             return 0;
1402         }
1403         return ((cpu->env.pmsav7.dracr[region] & 0xffff) << 16) |
1404             (cpu->env.pmsav7.drsr[region] & 0xffff);
1405     }
1406     case 0xdc0: /* MPU_MAIR0 */
1407         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1408             goto bad_offset;
1409         }
1410         return cpu->env.pmsav8.mair0[attrs.secure];
1411     case 0xdc4: /* MPU_MAIR1 */
1412         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1413             goto bad_offset;
1414         }
1415         return cpu->env.pmsav8.mair1[attrs.secure];
1416     case 0xdd0: /* SAU_CTRL */
1417         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1418             goto bad_offset;
1419         }
1420         if (!attrs.secure) {
1421             return 0;
1422         }
1423         return cpu->env.sau.ctrl;
1424     case 0xdd4: /* SAU_TYPE */
1425         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1426             goto bad_offset;
1427         }
1428         if (!attrs.secure) {
1429             return 0;
1430         }
1431         return cpu->sau_sregion;
1432     case 0xdd8: /* SAU_RNR */
1433         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1434             goto bad_offset;
1435         }
1436         if (!attrs.secure) {
1437             return 0;
1438         }
1439         return cpu->env.sau.rnr;
1440     case 0xddc: /* SAU_RBAR */
1441     {
1442         int region = cpu->env.sau.rnr;
1443 
1444         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1445             goto bad_offset;
1446         }
1447         if (!attrs.secure) {
1448             return 0;
1449         }
1450         if (region >= cpu->sau_sregion) {
1451             return 0;
1452         }
1453         return cpu->env.sau.rbar[region];
1454     }
1455     case 0xde0: /* SAU_RLAR */
1456     {
1457         int region = cpu->env.sau.rnr;
1458 
1459         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1460             goto bad_offset;
1461         }
1462         if (!attrs.secure) {
1463             return 0;
1464         }
1465         if (region >= cpu->sau_sregion) {
1466             return 0;
1467         }
1468         return cpu->env.sau.rlar[region];
1469     }
1470     case 0xde4: /* SFSR */
1471         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1472             goto bad_offset;
1473         }
1474         if (!attrs.secure) {
1475             return 0;
1476         }
1477         return cpu->env.v7m.sfsr;
1478     case 0xde8: /* SFAR */
1479         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1480             goto bad_offset;
1481         }
1482         if (!attrs.secure) {
1483             return 0;
1484         }
1485         return cpu->env.v7m.sfar;
1486     case 0xf04: /* RFSR */
1487         if (!cpu_isar_feature(aa32_ras, cpu)) {
1488             goto bad_offset;
1489         }
1490         /* We provide minimal-RAS only: RFSR is RAZ/WI */
1491         return 0;
1492     case 0xf34: /* FPCCR */
1493         if (!cpu_isar_feature(aa32_vfp_simd, cpu)) {
1494             return 0;
1495         }
1496         if (attrs.secure) {
1497             return cpu->env.v7m.fpccr[M_REG_S];
1498         } else {
1499             /*
1500              * NS can read LSPEN, CLRONRET and MONRDY. It can read
1501              * BFRDY and HFRDY if AIRCR.BFHFNMINS != 0;
1502              * other non-banked bits RAZ.
1503              * TODO: MONRDY should RAZ/WI if DEMCR.SDME is set.
1504              */
1505             uint32_t value = cpu->env.v7m.fpccr[M_REG_S];
1506             uint32_t mask = R_V7M_FPCCR_LSPEN_MASK |
1507                 R_V7M_FPCCR_CLRONRET_MASK |
1508                 R_V7M_FPCCR_MONRDY_MASK;
1509 
1510             if (s->cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK) {
1511                 mask |= R_V7M_FPCCR_BFRDY_MASK | R_V7M_FPCCR_HFRDY_MASK;
1512             }
1513 
1514             value &= mask;
1515 
1516             value |= cpu->env.v7m.fpccr[M_REG_NS];
1517             return value;
1518         }
1519     case 0xf38: /* FPCAR */
1520         if (!cpu_isar_feature(aa32_vfp_simd, cpu)) {
1521             return 0;
1522         }
1523         return cpu->env.v7m.fpcar[attrs.secure];
1524     case 0xf3c: /* FPDSCR */
1525         if (!cpu_isar_feature(aa32_vfp_simd, cpu)) {
1526             return 0;
1527         }
1528         return cpu->env.v7m.fpdscr[attrs.secure];
1529     case 0xf40: /* MVFR0 */
1530         return cpu->isar.mvfr0;
1531     case 0xf44: /* MVFR1 */
1532         return cpu->isar.mvfr1;
1533     case 0xf48: /* MVFR2 */
1534         return cpu->isar.mvfr2;
1535     default:
1536     bad_offset:
1537         qemu_log_mask(LOG_GUEST_ERROR, "NVIC: Bad read offset 0x%x\n", offset);
1538         return 0;
1539     }
1540 }
1541 
1542 static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value,
1543                         MemTxAttrs attrs)
1544 {
1545     ARMCPU *cpu = s->cpu;
1546 
1547     switch (offset) {
1548     case 0xc: /* CPPWR */
1549         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1550             goto bad_offset;
1551         }
1552         /* Make the IMPDEF choice to RAZ/WI this. */
1553         break;
1554     case 0x380 ... 0x3bf: /* NVIC_ITNS<n> */
1555     {
1556         int startvec = 8 * (offset - 0x380) + NVIC_FIRST_IRQ;
1557         int i;
1558 
1559         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1560             goto bad_offset;
1561         }
1562         if (!attrs.secure) {
1563             break;
1564         }
1565         for (i = 0; i < 32 && startvec + i < s->num_irq; i++) {
1566             s->itns[startvec + i] = (value >> i) & 1;
1567         }
1568         nvic_irq_update(s);
1569         break;
1570     }
1571     case 0xd04: /* Interrupt Control State (ICSR) */
1572         if (attrs.secure || cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK) {
1573             if (value & (1 << 31)) {
1574                 armv7m_nvic_set_pending(s, ARMV7M_EXCP_NMI, false);
1575             } else if (value & (1 << 30) &&
1576                        arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1577                 /* PENDNMICLR didn't exist in v7M */
1578                 armv7m_nvic_clear_pending(s, ARMV7M_EXCP_NMI, false);
1579             }
1580         }
1581         if (value & (1 << 28)) {
1582             armv7m_nvic_set_pending(s, ARMV7M_EXCP_PENDSV, attrs.secure);
1583         } else if (value & (1 << 27)) {
1584             armv7m_nvic_clear_pending(s, ARMV7M_EXCP_PENDSV, attrs.secure);
1585         }
1586         if (value & (1 << 26)) {
1587             armv7m_nvic_set_pending(s, ARMV7M_EXCP_SYSTICK, attrs.secure);
1588         } else if (value & (1 << 25)) {
1589             armv7m_nvic_clear_pending(s, ARMV7M_EXCP_SYSTICK, attrs.secure);
1590         }
1591         break;
1592     case 0xd08: /* Vector Table Offset.  */
1593         cpu->env.v7m.vecbase[attrs.secure] = value & 0xffffff80;
1594         break;
1595     case 0xd0c: /* Application Interrupt/Reset Control (AIRCR) */
1596         if ((value >> R_V7M_AIRCR_VECTKEY_SHIFT) == 0x05fa) {
1597             if (value & R_V7M_AIRCR_SYSRESETREQ_MASK) {
1598                 if (attrs.secure ||
1599                     !(cpu->env.v7m.aircr & R_V7M_AIRCR_SYSRESETREQS_MASK)) {
1600                     signal_sysresetreq(s);
1601                 }
1602             }
1603             if (value & R_V7M_AIRCR_VECTCLRACTIVE_MASK) {
1604                 qemu_log_mask(LOG_GUEST_ERROR,
1605                               "Setting VECTCLRACTIVE when not in DEBUG mode "
1606                               "is UNPREDICTABLE\n");
1607             }
1608             if (value & R_V7M_AIRCR_VECTRESET_MASK) {
1609                 /* NB: this bit is RES0 in v8M */
1610                 qemu_log_mask(LOG_GUEST_ERROR,
1611                               "Setting VECTRESET when not in DEBUG mode "
1612                               "is UNPREDICTABLE\n");
1613             }
1614             if (arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
1615                 s->prigroup[attrs.secure] =
1616                     extract32(value,
1617                               R_V7M_AIRCR_PRIGROUP_SHIFT,
1618                               R_V7M_AIRCR_PRIGROUP_LENGTH);
1619             }
1620             /* AIRCR.IESB is RAZ/WI because we implement only minimal RAS */
1621             if (attrs.secure) {
1622                 /* These bits are only writable by secure */
1623                 cpu->env.v7m.aircr = value &
1624                     (R_V7M_AIRCR_SYSRESETREQS_MASK |
1625                      R_V7M_AIRCR_BFHFNMINS_MASK |
1626                      R_V7M_AIRCR_PRIS_MASK);
1627                 /* BFHFNMINS changes the priority of Secure HardFault, and
1628                  * allows a pending Non-secure HardFault to preempt (which
1629                  * we implement by marking it enabled).
1630                  */
1631                 if (cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK) {
1632                     s->sec_vectors[ARMV7M_EXCP_HARD].prio = -3;
1633                     s->vectors[ARMV7M_EXCP_HARD].enabled = 1;
1634                 } else {
1635                     s->sec_vectors[ARMV7M_EXCP_HARD].prio = -1;
1636                     s->vectors[ARMV7M_EXCP_HARD].enabled = 0;
1637                 }
1638             }
1639             nvic_irq_update(s);
1640         }
1641         break;
1642     case 0xd10: /* System Control.  */
1643         if (!arm_feature(&cpu->env, ARM_FEATURE_V7)) {
1644             goto bad_offset;
1645         }
1646         /* We don't implement deep-sleep so these bits are RAZ/WI.
1647          * The other bits in the register are banked.
1648          * QEMU's implementation ignores SEVONPEND and SLEEPONEXIT, which
1649          * is architecturally permitted.
1650          */
1651         value &= ~(R_V7M_SCR_SLEEPDEEP_MASK | R_V7M_SCR_SLEEPDEEPS_MASK);
1652         cpu->env.v7m.scr[attrs.secure] = value;
1653         break;
1654     case 0xd14: /* Configuration Control.  */
1655     {
1656         uint32_t mask;
1657 
1658         if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
1659             goto bad_offset;
1660         }
1661 
1662         /* Enforce RAZ/WI on reserved and must-RAZ/WI bits */
1663         mask = R_V7M_CCR_STKALIGN_MASK |
1664             R_V7M_CCR_BFHFNMIGN_MASK |
1665             R_V7M_CCR_DIV_0_TRP_MASK |
1666             R_V7M_CCR_UNALIGN_TRP_MASK |
1667             R_V7M_CCR_USERSETMPEND_MASK |
1668             R_V7M_CCR_NONBASETHRDENA_MASK;
1669         if (arm_feature(&cpu->env, ARM_FEATURE_V8_1M) && attrs.secure) {
1670             /* TRD is always RAZ/WI from NS */
1671             mask |= R_V7M_CCR_TRD_MASK;
1672         }
1673         value &= mask;
1674 
1675         if (arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1676             /* v8M makes NONBASETHRDENA and STKALIGN be RES1 */
1677             value |= R_V7M_CCR_NONBASETHRDENA_MASK
1678                 | R_V7M_CCR_STKALIGN_MASK;
1679         }
1680         if (attrs.secure) {
1681             /* the BFHFNMIGN bit is not banked; keep that in the NS copy */
1682             cpu->env.v7m.ccr[M_REG_NS] =
1683                 (cpu->env.v7m.ccr[M_REG_NS] & ~R_V7M_CCR_BFHFNMIGN_MASK)
1684                 | (value & R_V7M_CCR_BFHFNMIGN_MASK);
1685             value &= ~R_V7M_CCR_BFHFNMIGN_MASK;
1686         }
1687 
1688         cpu->env.v7m.ccr[attrs.secure] = value;
1689         break;
1690     }
1691     case 0xd24: /* System Handler Control and State (SHCSR) */
1692         if (!arm_feature(&cpu->env, ARM_FEATURE_V7)) {
1693             goto bad_offset;
1694         }
1695         if (attrs.secure) {
1696             s->sec_vectors[ARMV7M_EXCP_MEM].active = (value & (1 << 0)) != 0;
1697             /* Secure HardFault active bit cannot be written */
1698             s->sec_vectors[ARMV7M_EXCP_USAGE].active = (value & (1 << 3)) != 0;
1699             s->sec_vectors[ARMV7M_EXCP_SVC].active = (value & (1 << 7)) != 0;
1700             s->sec_vectors[ARMV7M_EXCP_PENDSV].active =
1701                 (value & (1 << 10)) != 0;
1702             s->sec_vectors[ARMV7M_EXCP_SYSTICK].active =
1703                 (value & (1 << 11)) != 0;
1704             s->sec_vectors[ARMV7M_EXCP_USAGE].pending =
1705                 (value & (1 << 12)) != 0;
1706             s->sec_vectors[ARMV7M_EXCP_MEM].pending = (value & (1 << 13)) != 0;
1707             s->sec_vectors[ARMV7M_EXCP_SVC].pending = (value & (1 << 15)) != 0;
1708             s->sec_vectors[ARMV7M_EXCP_MEM].enabled = (value & (1 << 16)) != 0;
1709             s->sec_vectors[ARMV7M_EXCP_BUS].enabled = (value & (1 << 17)) != 0;
1710             s->sec_vectors[ARMV7M_EXCP_USAGE].enabled =
1711                 (value & (1 << 18)) != 0;
1712             s->sec_vectors[ARMV7M_EXCP_HARD].pending = (value & (1 << 21)) != 0;
1713             /* SecureFault not banked, but RAZ/WI to NS */
1714             s->vectors[ARMV7M_EXCP_SECURE].active = (value & (1 << 4)) != 0;
1715             s->vectors[ARMV7M_EXCP_SECURE].enabled = (value & (1 << 19)) != 0;
1716             s->vectors[ARMV7M_EXCP_SECURE].pending = (value & (1 << 20)) != 0;
1717         } else {
1718             s->vectors[ARMV7M_EXCP_MEM].active = (value & (1 << 0)) != 0;
1719             if (arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1720                 /* HARDFAULTPENDED is not present in v7M */
1721                 s->vectors[ARMV7M_EXCP_HARD].pending = (value & (1 << 21)) != 0;
1722             }
1723             s->vectors[ARMV7M_EXCP_USAGE].active = (value & (1 << 3)) != 0;
1724             s->vectors[ARMV7M_EXCP_SVC].active = (value & (1 << 7)) != 0;
1725             s->vectors[ARMV7M_EXCP_PENDSV].active = (value & (1 << 10)) != 0;
1726             s->vectors[ARMV7M_EXCP_SYSTICK].active = (value & (1 << 11)) != 0;
1727             s->vectors[ARMV7M_EXCP_USAGE].pending = (value & (1 << 12)) != 0;
1728             s->vectors[ARMV7M_EXCP_MEM].pending = (value & (1 << 13)) != 0;
1729             s->vectors[ARMV7M_EXCP_SVC].pending = (value & (1 << 15)) != 0;
1730             s->vectors[ARMV7M_EXCP_MEM].enabled = (value & (1 << 16)) != 0;
1731             s->vectors[ARMV7M_EXCP_USAGE].enabled = (value & (1 << 18)) != 0;
1732         }
1733         if (attrs.secure || (cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK)) {
1734             s->vectors[ARMV7M_EXCP_BUS].active = (value & (1 << 1)) != 0;
1735             s->vectors[ARMV7M_EXCP_BUS].pending = (value & (1 << 14)) != 0;
1736             s->vectors[ARMV7M_EXCP_BUS].enabled = (value & (1 << 17)) != 0;
1737         }
1738         /* NMIACT can only be written if the write is of a zero, with
1739          * BFHFNMINS 1, and by the CPU in secure state via the NS alias.
1740          */
1741         if (!attrs.secure && cpu->env.v7m.secure &&
1742             (cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK) &&
1743             (value & (1 << 5)) == 0) {
1744             s->vectors[ARMV7M_EXCP_NMI].active = 0;
1745         }
1746         /* HARDFAULTACT can only be written if the write is of a zero
1747          * to the non-secure HardFault state by the CPU in secure state.
1748          * The only case where we can be targeting the non-secure HF state
1749          * when in secure state is if this is a write via the NS alias
1750          * and BFHFNMINS is 1.
1751          */
1752         if (!attrs.secure && cpu->env.v7m.secure &&
1753             (cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK) &&
1754             (value & (1 << 2)) == 0) {
1755             s->vectors[ARMV7M_EXCP_HARD].active = 0;
1756         }
1757 
1758         /* TODO: this is RAZ/WI from NS if DEMCR.SDME is set */
1759         s->vectors[ARMV7M_EXCP_DEBUG].active = (value & (1 << 8)) != 0;
1760         nvic_irq_update(s);
1761         break;
1762     case 0xd2c: /* Hard Fault Status.  */
1763         if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
1764             goto bad_offset;
1765         }
1766         cpu->env.v7m.hfsr &= ~value; /* W1C */
1767         break;
1768     case 0xd30: /* Debug Fault Status.  */
1769         cpu->env.v7m.dfsr &= ~value; /* W1C */
1770         break;
1771     case 0xd34: /* Mem Manage Address.  */
1772         if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
1773             goto bad_offset;
1774         }
1775         cpu->env.v7m.mmfar[attrs.secure] = value;
1776         return;
1777     case 0xd38: /* Bus Fault Address.  */
1778         if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
1779             goto bad_offset;
1780         }
1781         if (!attrs.secure &&
1782             !(s->cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK)) {
1783             return;
1784         }
1785         cpu->env.v7m.bfar = value;
1786         return;
1787     case 0xd3c: /* Aux Fault Status.  */
1788         qemu_log_mask(LOG_UNIMP,
1789                       "NVIC: Aux fault status registers unimplemented\n");
1790         break;
1791     case 0xd84: /* CSSELR */
1792         if (!arm_v7m_csselr_razwi(cpu)) {
1793             cpu->env.v7m.csselr[attrs.secure] = value & R_V7M_CSSELR_INDEX_MASK;
1794         }
1795         break;
1796     case 0xd88: /* CPACR */
1797         if (cpu_isar_feature(aa32_vfp_simd, cpu)) {
1798             /* We implement only the Floating Point extension's CP10/CP11 */
1799             cpu->env.v7m.cpacr[attrs.secure] = value & (0xf << 20);
1800         }
1801         break;
1802     case 0xd8c: /* NSACR */
1803         if (attrs.secure && cpu_isar_feature(aa32_vfp_simd, cpu)) {
1804             /* We implement only the Floating Point extension's CP10/CP11 */
1805             cpu->env.v7m.nsacr = value & (3 << 10);
1806         }
1807         break;
1808     case 0xd90: /* MPU_TYPE */
1809         return; /* RO */
1810     case 0xd94: /* MPU_CTRL */
1811         if ((value &
1812              (R_V7M_MPU_CTRL_HFNMIENA_MASK | R_V7M_MPU_CTRL_ENABLE_MASK))
1813             == R_V7M_MPU_CTRL_HFNMIENA_MASK) {
1814             qemu_log_mask(LOG_GUEST_ERROR, "MPU_CTRL: HFNMIENA and !ENABLE is "
1815                           "UNPREDICTABLE\n");
1816         }
1817         cpu->env.v7m.mpu_ctrl[attrs.secure]
1818             = value & (R_V7M_MPU_CTRL_ENABLE_MASK |
1819                        R_V7M_MPU_CTRL_HFNMIENA_MASK |
1820                        R_V7M_MPU_CTRL_PRIVDEFENA_MASK);
1821         tlb_flush(CPU(cpu));
1822         break;
1823     case 0xd98: /* MPU_RNR */
1824         if (value >= cpu->pmsav7_dregion) {
1825             qemu_log_mask(LOG_GUEST_ERROR, "MPU region out of range %"
1826                           PRIu32 "/%" PRIu32 "\n",
1827                           value, cpu->pmsav7_dregion);
1828         } else {
1829             cpu->env.pmsav7.rnr[attrs.secure] = value;
1830         }
1831         break;
1832     case 0xd9c: /* MPU_RBAR */
1833     case 0xda4: /* MPU_RBAR_A1 */
1834     case 0xdac: /* MPU_RBAR_A2 */
1835     case 0xdb4: /* MPU_RBAR_A3 */
1836     {
1837         int region;
1838 
1839         if (arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1840             /* PMSAv8M handling of the aliases is different from v7M:
1841              * aliases A1, A2, A3 override the low two bits of the region
1842              * number in MPU_RNR, and there is no 'region' field in the
1843              * RBAR register.
1844              */
1845             int aliasno = (offset - 0xd9c) / 8; /* 0..3 */
1846 
1847             region = cpu->env.pmsav7.rnr[attrs.secure];
1848             if (aliasno) {
1849                 region = deposit32(region, 0, 2, aliasno);
1850             }
1851             if (region >= cpu->pmsav7_dregion) {
1852                 return;
1853             }
1854             cpu->env.pmsav8.rbar[attrs.secure][region] = value;
1855             tlb_flush(CPU(cpu));
1856             return;
1857         }
1858 
1859         if (value & (1 << 4)) {
1860             /* VALID bit means use the region number specified in this
1861              * value and also update MPU_RNR.REGION with that value.
1862              */
1863             region = extract32(value, 0, 4);
1864             if (region >= cpu->pmsav7_dregion) {
1865                 qemu_log_mask(LOG_GUEST_ERROR,
1866                               "MPU region out of range %u/%" PRIu32 "\n",
1867                               region, cpu->pmsav7_dregion);
1868                 return;
1869             }
1870             cpu->env.pmsav7.rnr[attrs.secure] = region;
1871         } else {
1872             region = cpu->env.pmsav7.rnr[attrs.secure];
1873         }
1874 
1875         if (region >= cpu->pmsav7_dregion) {
1876             return;
1877         }
1878 
1879         cpu->env.pmsav7.drbar[region] = value & ~0x1f;
1880         tlb_flush(CPU(cpu));
1881         break;
1882     }
1883     case 0xda0: /* MPU_RASR (v7M), MPU_RLAR (v8M) */
1884     case 0xda8: /* MPU_RASR_A1 (v7M), MPU_RLAR_A1 (v8M) */
1885     case 0xdb0: /* MPU_RASR_A2 (v7M), MPU_RLAR_A2 (v8M) */
1886     case 0xdb8: /* MPU_RASR_A3 (v7M), MPU_RLAR_A3 (v8M) */
1887     {
1888         int region = cpu->env.pmsav7.rnr[attrs.secure];
1889 
1890         if (arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1891             /* PMSAv8M handling of the aliases is different from v7M:
1892              * aliases A1, A2, A3 override the low two bits of the region
1893              * number in MPU_RNR.
1894              */
1895             int aliasno = (offset - 0xd9c) / 8; /* 0..3 */
1896 
1897             region = cpu->env.pmsav7.rnr[attrs.secure];
1898             if (aliasno) {
1899                 region = deposit32(region, 0, 2, aliasno);
1900             }
1901             if (region >= cpu->pmsav7_dregion) {
1902                 return;
1903             }
1904             cpu->env.pmsav8.rlar[attrs.secure][region] = value;
1905             tlb_flush(CPU(cpu));
1906             return;
1907         }
1908 
1909         if (region >= cpu->pmsav7_dregion) {
1910             return;
1911         }
1912 
1913         cpu->env.pmsav7.drsr[region] = value & 0xff3f;
1914         cpu->env.pmsav7.dracr[region] = (value >> 16) & 0x173f;
1915         tlb_flush(CPU(cpu));
1916         break;
1917     }
1918     case 0xdc0: /* MPU_MAIR0 */
1919         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1920             goto bad_offset;
1921         }
1922         if (cpu->pmsav7_dregion) {
1923             /* Register is RES0 if no MPU regions are implemented */
1924             cpu->env.pmsav8.mair0[attrs.secure] = value;
1925         }
1926         /* We don't need to do anything else because memory attributes
1927          * only affect cacheability, and we don't implement caching.
1928          */
1929         break;
1930     case 0xdc4: /* MPU_MAIR1 */
1931         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1932             goto bad_offset;
1933         }
1934         if (cpu->pmsav7_dregion) {
1935             /* Register is RES0 if no MPU regions are implemented */
1936             cpu->env.pmsav8.mair1[attrs.secure] = value;
1937         }
1938         /* We don't need to do anything else because memory attributes
1939          * only affect cacheability, and we don't implement caching.
1940          */
1941         break;
1942     case 0xdd0: /* SAU_CTRL */
1943         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1944             goto bad_offset;
1945         }
1946         if (!attrs.secure) {
1947             return;
1948         }
1949         cpu->env.sau.ctrl = value & 3;
1950         break;
1951     case 0xdd4: /* SAU_TYPE */
1952         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1953             goto bad_offset;
1954         }
1955         break;
1956     case 0xdd8: /* SAU_RNR */
1957         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1958             goto bad_offset;
1959         }
1960         if (!attrs.secure) {
1961             return;
1962         }
1963         if (value >= cpu->sau_sregion) {
1964             qemu_log_mask(LOG_GUEST_ERROR, "SAU region out of range %"
1965                           PRIu32 "/%" PRIu32 "\n",
1966                           value, cpu->sau_sregion);
1967         } else {
1968             cpu->env.sau.rnr = value;
1969         }
1970         break;
1971     case 0xddc: /* SAU_RBAR */
1972     {
1973         int region = cpu->env.sau.rnr;
1974 
1975         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1976             goto bad_offset;
1977         }
1978         if (!attrs.secure) {
1979             return;
1980         }
1981         if (region >= cpu->sau_sregion) {
1982             return;
1983         }
1984         cpu->env.sau.rbar[region] = value & ~0x1f;
1985         tlb_flush(CPU(cpu));
1986         break;
1987     }
1988     case 0xde0: /* SAU_RLAR */
1989     {
1990         int region = cpu->env.sau.rnr;
1991 
1992         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1993             goto bad_offset;
1994         }
1995         if (!attrs.secure) {
1996             return;
1997         }
1998         if (region >= cpu->sau_sregion) {
1999             return;
2000         }
2001         cpu->env.sau.rlar[region] = value & ~0x1c;
2002         tlb_flush(CPU(cpu));
2003         break;
2004     }
2005     case 0xde4: /* SFSR */
2006         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
2007             goto bad_offset;
2008         }
2009         if (!attrs.secure) {
2010             return;
2011         }
2012         cpu->env.v7m.sfsr &= ~value; /* W1C */
2013         break;
2014     case 0xde8: /* SFAR */
2015         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
2016             goto bad_offset;
2017         }
2018         if (!attrs.secure) {
2019             return;
2020         }
2021         cpu->env.v7m.sfsr = value;
2022         break;
2023     case 0xf00: /* Software Triggered Interrupt Register */
2024     {
2025         int excnum = (value & 0x1ff) + NVIC_FIRST_IRQ;
2026 
2027         if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
2028             goto bad_offset;
2029         }
2030 
2031         if (excnum < s->num_irq) {
2032             armv7m_nvic_set_pending(s, excnum, false);
2033         }
2034         break;
2035     }
2036     case 0xf04: /* RFSR */
2037         if (!cpu_isar_feature(aa32_ras, cpu)) {
2038             goto bad_offset;
2039         }
2040         /* We provide minimal-RAS only: RFSR is RAZ/WI */
2041         break;
2042     case 0xf34: /* FPCCR */
2043         if (cpu_isar_feature(aa32_vfp_simd, cpu)) {
2044             /* Not all bits here are banked. */
2045             uint32_t fpccr_s;
2046 
2047             if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
2048                 /* Don't allow setting of bits not present in v7M */
2049                 value &= (R_V7M_FPCCR_LSPACT_MASK |
2050                           R_V7M_FPCCR_USER_MASK |
2051                           R_V7M_FPCCR_THREAD_MASK |
2052                           R_V7M_FPCCR_HFRDY_MASK |
2053                           R_V7M_FPCCR_MMRDY_MASK |
2054                           R_V7M_FPCCR_BFRDY_MASK |
2055                           R_V7M_FPCCR_MONRDY_MASK |
2056                           R_V7M_FPCCR_LSPEN_MASK |
2057                           R_V7M_FPCCR_ASPEN_MASK);
2058             }
2059             value &= ~R_V7M_FPCCR_RES0_MASK;
2060 
2061             if (!attrs.secure) {
2062                 /* Some non-banked bits are configurably writable by NS */
2063                 fpccr_s = cpu->env.v7m.fpccr[M_REG_S];
2064                 if (!(fpccr_s & R_V7M_FPCCR_LSPENS_MASK)) {
2065                     uint32_t lspen = FIELD_EX32(value, V7M_FPCCR, LSPEN);
2066                     fpccr_s = FIELD_DP32(fpccr_s, V7M_FPCCR, LSPEN, lspen);
2067                 }
2068                 if (!(fpccr_s & R_V7M_FPCCR_CLRONRETS_MASK)) {
2069                     uint32_t cor = FIELD_EX32(value, V7M_FPCCR, CLRONRET);
2070                     fpccr_s = FIELD_DP32(fpccr_s, V7M_FPCCR, CLRONRET, cor);
2071                 }
2072                 if ((s->cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK)) {
2073                     uint32_t hfrdy = FIELD_EX32(value, V7M_FPCCR, HFRDY);
2074                     uint32_t bfrdy = FIELD_EX32(value, V7M_FPCCR, BFRDY);
2075                     fpccr_s = FIELD_DP32(fpccr_s, V7M_FPCCR, HFRDY, hfrdy);
2076                     fpccr_s = FIELD_DP32(fpccr_s, V7M_FPCCR, BFRDY, bfrdy);
2077                 }
2078                 /* TODO MONRDY should RAZ/WI if DEMCR.SDME is set */
2079                 {
2080                     uint32_t monrdy = FIELD_EX32(value, V7M_FPCCR, MONRDY);
2081                     fpccr_s = FIELD_DP32(fpccr_s, V7M_FPCCR, MONRDY, monrdy);
2082                 }
2083 
2084                 /*
2085                  * All other non-banked bits are RAZ/WI from NS; write
2086                  * just the banked bits to fpccr[M_REG_NS].
2087                  */
2088                 value &= R_V7M_FPCCR_BANKED_MASK;
2089                 cpu->env.v7m.fpccr[M_REG_NS] = value;
2090             } else {
2091                 fpccr_s = value;
2092             }
2093             cpu->env.v7m.fpccr[M_REG_S] = fpccr_s;
2094         }
2095         break;
2096     case 0xf38: /* FPCAR */
2097         if (cpu_isar_feature(aa32_vfp_simd, cpu)) {
2098             value &= ~7;
2099             cpu->env.v7m.fpcar[attrs.secure] = value;
2100         }
2101         break;
2102     case 0xf3c: /* FPDSCR */
2103         if (cpu_isar_feature(aa32_vfp_simd, cpu)) {
2104             uint32_t mask = FPCR_AHP | FPCR_DN | FPCR_FZ | FPCR_RMODE_MASK;
2105             if (cpu_isar_feature(any_fp16, cpu)) {
2106                 mask |= FPCR_FZ16;
2107             }
2108             value &= mask;
2109             if (cpu_isar_feature(aa32_lob, cpu)) {
2110                 value |= 4 << FPCR_LTPSIZE_SHIFT;
2111             }
2112             cpu->env.v7m.fpdscr[attrs.secure] = value;
2113         }
2114         break;
2115     case 0xf50: /* ICIALLU */
2116     case 0xf58: /* ICIMVAU */
2117     case 0xf5c: /* DCIMVAC */
2118     case 0xf60: /* DCISW */
2119     case 0xf64: /* DCCMVAU */
2120     case 0xf68: /* DCCMVAC */
2121     case 0xf6c: /* DCCSW */
2122     case 0xf70: /* DCCIMVAC */
2123     case 0xf74: /* DCCISW */
2124     case 0xf78: /* BPIALL */
2125         /* Cache and branch predictor maintenance: for QEMU these always NOP */
2126         break;
2127     default:
2128     bad_offset:
2129         qemu_log_mask(LOG_GUEST_ERROR,
2130                       "NVIC: Bad write offset 0x%x\n", offset);
2131     }
2132 }
2133 
2134 static bool nvic_user_access_ok(NVICState *s, hwaddr offset, MemTxAttrs attrs)
2135 {
2136     /* Return true if unprivileged access to this register is permitted. */
2137     switch (offset) {
2138     case 0xf00: /* STIR: accessible only if CCR.USERSETMPEND permits */
2139         /* For access via STIR_NS it is the NS CCR.USERSETMPEND that
2140          * controls access even though the CPU is in Secure state (I_QDKX).
2141          */
2142         return s->cpu->env.v7m.ccr[attrs.secure] & R_V7M_CCR_USERSETMPEND_MASK;
2143     default:
2144         /* All other user accesses cause a BusFault unconditionally */
2145         return false;
2146     }
2147 }
2148 
2149 static int shpr_bank(NVICState *s, int exc, MemTxAttrs attrs)
2150 {
2151     /* Behaviour for the SHPR register field for this exception:
2152      * return M_REG_NS to use the nonsecure vector (including for
2153      * non-banked exceptions), M_REG_S for the secure version of
2154      * a banked exception, and -1 if this field should RAZ/WI.
2155      */
2156     switch (exc) {
2157     case ARMV7M_EXCP_MEM:
2158     case ARMV7M_EXCP_USAGE:
2159     case ARMV7M_EXCP_SVC:
2160     case ARMV7M_EXCP_PENDSV:
2161     case ARMV7M_EXCP_SYSTICK:
2162         /* Banked exceptions */
2163         return attrs.secure;
2164     case ARMV7M_EXCP_BUS:
2165         /* Not banked, RAZ/WI from nonsecure if BFHFNMINS is zero */
2166         if (!attrs.secure &&
2167             !(s->cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK)) {
2168             return -1;
2169         }
2170         return M_REG_NS;
2171     case ARMV7M_EXCP_SECURE:
2172         /* Not banked, RAZ/WI from nonsecure */
2173         if (!attrs.secure) {
2174             return -1;
2175         }
2176         return M_REG_NS;
2177     case ARMV7M_EXCP_DEBUG:
2178         /* Not banked. TODO should RAZ/WI if DEMCR.SDME is set */
2179         return M_REG_NS;
2180     case 8 ... 10:
2181     case 13:
2182         /* RES0 */
2183         return -1;
2184     default:
2185         /* Not reachable due to decode of SHPR register addresses */
2186         g_assert_not_reached();
2187     }
2188 }
2189 
2190 static MemTxResult nvic_sysreg_read(void *opaque, hwaddr addr,
2191                                     uint64_t *data, unsigned size,
2192                                     MemTxAttrs attrs)
2193 {
2194     NVICState *s = (NVICState *)opaque;
2195     uint32_t offset = addr;
2196     unsigned i, startvec, end;
2197     uint32_t val;
2198 
2199     if (attrs.user && !nvic_user_access_ok(s, addr, attrs)) {
2200         /* Generate BusFault for unprivileged accesses */
2201         return MEMTX_ERROR;
2202     }
2203 
2204     switch (offset) {
2205     /* reads of set and clear both return the status */
2206     case 0x100 ... 0x13f: /* NVIC Set enable */
2207         offset += 0x80;
2208         /* fall through */
2209     case 0x180 ... 0x1bf: /* NVIC Clear enable */
2210         val = 0;
2211         startvec = 8 * (offset - 0x180) + NVIC_FIRST_IRQ; /* vector # */
2212 
2213         for (i = 0, end = size * 8; i < end && startvec + i < s->num_irq; i++) {
2214             if (s->vectors[startvec + i].enabled &&
2215                 (attrs.secure || s->itns[startvec + i])) {
2216                 val |= (1 << i);
2217             }
2218         }
2219         break;
2220     case 0x200 ... 0x23f: /* NVIC Set pend */
2221         offset += 0x80;
2222         /* fall through */
2223     case 0x280 ... 0x2bf: /* NVIC Clear pend */
2224         val = 0;
2225         startvec = 8 * (offset - 0x280) + NVIC_FIRST_IRQ; /* vector # */
2226         for (i = 0, end = size * 8; i < end && startvec + i < s->num_irq; i++) {
2227             if (s->vectors[startvec + i].pending &&
2228                 (attrs.secure || s->itns[startvec + i])) {
2229                 val |= (1 << i);
2230             }
2231         }
2232         break;
2233     case 0x300 ... 0x33f: /* NVIC Active */
2234         val = 0;
2235 
2236         if (!arm_feature(&s->cpu->env, ARM_FEATURE_V7)) {
2237             break;
2238         }
2239 
2240         startvec = 8 * (offset - 0x300) + NVIC_FIRST_IRQ; /* vector # */
2241 
2242         for (i = 0, end = size * 8; i < end && startvec + i < s->num_irq; i++) {
2243             if (s->vectors[startvec + i].active &&
2244                 (attrs.secure || s->itns[startvec + i])) {
2245                 val |= (1 << i);
2246             }
2247         }
2248         break;
2249     case 0x400 ... 0x5ef: /* NVIC Priority */
2250         val = 0;
2251         startvec = offset - 0x400 + NVIC_FIRST_IRQ; /* vector # */
2252 
2253         for (i = 0; i < size && startvec + i < s->num_irq; i++) {
2254             if (attrs.secure || s->itns[startvec + i]) {
2255                 val |= s->vectors[startvec + i].prio << (8 * i);
2256             }
2257         }
2258         break;
2259     case 0xd18 ... 0xd1b: /* System Handler Priority (SHPR1) */
2260         if (!arm_feature(&s->cpu->env, ARM_FEATURE_M_MAIN)) {
2261             val = 0;
2262             break;
2263         }
2264         /* fall through */
2265     case 0xd1c ... 0xd23: /* System Handler Priority (SHPR2, SHPR3) */
2266         val = 0;
2267         for (i = 0; i < size; i++) {
2268             unsigned hdlidx = (offset - 0xd14) + i;
2269             int sbank = shpr_bank(s, hdlidx, attrs);
2270 
2271             if (sbank < 0) {
2272                 continue;
2273             }
2274             val = deposit32(val, i * 8, 8, get_prio(s, hdlidx, sbank));
2275         }
2276         break;
2277     case 0xd28 ... 0xd2b: /* Configurable Fault Status (CFSR) */
2278         if (!arm_feature(&s->cpu->env, ARM_FEATURE_M_MAIN)) {
2279             val = 0;
2280             break;
2281         };
2282         /*
2283          * The BFSR bits [15:8] are shared between security states
2284          * and we store them in the NS copy. They are RAZ/WI for
2285          * NS code if AIRCR.BFHFNMINS is 0.
2286          */
2287         val = s->cpu->env.v7m.cfsr[attrs.secure];
2288         if (!attrs.secure &&
2289             !(s->cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK)) {
2290             val &= ~R_V7M_CFSR_BFSR_MASK;
2291         } else {
2292             val |= s->cpu->env.v7m.cfsr[M_REG_NS] & R_V7M_CFSR_BFSR_MASK;
2293         }
2294         val = extract32(val, (offset - 0xd28) * 8, size * 8);
2295         break;
2296     case 0xfe0 ... 0xfff: /* ID.  */
2297         if (offset & 3) {
2298             val = 0;
2299         } else {
2300             val = nvic_id[(offset - 0xfe0) >> 2];
2301         }
2302         break;
2303     default:
2304         if (size == 4) {
2305             val = nvic_readl(s, offset, attrs);
2306         } else {
2307             qemu_log_mask(LOG_GUEST_ERROR,
2308                           "NVIC: Bad read of size %d at offset 0x%x\n",
2309                           size, offset);
2310             val = 0;
2311         }
2312     }
2313 
2314     trace_nvic_sysreg_read(addr, val, size);
2315     *data = val;
2316     return MEMTX_OK;
2317 }
2318 
2319 static MemTxResult nvic_sysreg_write(void *opaque, hwaddr addr,
2320                                      uint64_t value, unsigned size,
2321                                      MemTxAttrs attrs)
2322 {
2323     NVICState *s = (NVICState *)opaque;
2324     uint32_t offset = addr;
2325     unsigned i, startvec, end;
2326     unsigned setval = 0;
2327 
2328     trace_nvic_sysreg_write(addr, value, size);
2329 
2330     if (attrs.user && !nvic_user_access_ok(s, addr, attrs)) {
2331         /* Generate BusFault for unprivileged accesses */
2332         return MEMTX_ERROR;
2333     }
2334 
2335     switch (offset) {
2336     case 0x100 ... 0x13f: /* NVIC Set enable */
2337         offset += 0x80;
2338         setval = 1;
2339         /* fall through */
2340     case 0x180 ... 0x1bf: /* NVIC Clear enable */
2341         startvec = 8 * (offset - 0x180) + NVIC_FIRST_IRQ;
2342 
2343         for (i = 0, end = size * 8; i < end && startvec + i < s->num_irq; i++) {
2344             if (value & (1 << i) &&
2345                 (attrs.secure || s->itns[startvec + i])) {
2346                 s->vectors[startvec + i].enabled = setval;
2347             }
2348         }
2349         nvic_irq_update(s);
2350         goto exit_ok;
2351     case 0x200 ... 0x23f: /* NVIC Set pend */
2352         /* the special logic in armv7m_nvic_set_pending()
2353          * is not needed since IRQs are never escalated
2354          */
2355         offset += 0x80;
2356         setval = 1;
2357         /* fall through */
2358     case 0x280 ... 0x2bf: /* NVIC Clear pend */
2359         startvec = 8 * (offset - 0x280) + NVIC_FIRST_IRQ; /* vector # */
2360 
2361         for (i = 0, end = size * 8; i < end && startvec + i < s->num_irq; i++) {
2362             if (value & (1 << i) &&
2363                 (attrs.secure || s->itns[startvec + i])) {
2364                 s->vectors[startvec + i].pending = setval;
2365             }
2366         }
2367         nvic_irq_update(s);
2368         goto exit_ok;
2369     case 0x300 ... 0x33f: /* NVIC Active */
2370         goto exit_ok; /* R/O */
2371     case 0x400 ... 0x5ef: /* NVIC Priority */
2372         startvec = (offset - 0x400) + NVIC_FIRST_IRQ; /* vector # */
2373 
2374         for (i = 0; i < size && startvec + i < s->num_irq; i++) {
2375             if (attrs.secure || s->itns[startvec + i]) {
2376                 set_prio(s, startvec + i, false, (value >> (i * 8)) & 0xff);
2377             }
2378         }
2379         nvic_irq_update(s);
2380         goto exit_ok;
2381     case 0xd18 ... 0xd1b: /* System Handler Priority (SHPR1) */
2382         if (!arm_feature(&s->cpu->env, ARM_FEATURE_M_MAIN)) {
2383             goto exit_ok;
2384         }
2385         /* fall through */
2386     case 0xd1c ... 0xd23: /* System Handler Priority (SHPR2, SHPR3) */
2387         for (i = 0; i < size; i++) {
2388             unsigned hdlidx = (offset - 0xd14) + i;
2389             int newprio = extract32(value, i * 8, 8);
2390             int sbank = shpr_bank(s, hdlidx, attrs);
2391 
2392             if (sbank < 0) {
2393                 continue;
2394             }
2395             set_prio(s, hdlidx, sbank, newprio);
2396         }
2397         nvic_irq_update(s);
2398         goto exit_ok;
2399     case 0xd28 ... 0xd2b: /* Configurable Fault Status (CFSR) */
2400         if (!arm_feature(&s->cpu->env, ARM_FEATURE_M_MAIN)) {
2401             goto exit_ok;
2402         }
2403         /* All bits are W1C, so construct 32 bit value with 0s in
2404          * the parts not written by the access size
2405          */
2406         value <<= ((offset - 0xd28) * 8);
2407 
2408         if (!attrs.secure &&
2409             !(s->cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK)) {
2410             /* BFSR bits are RAZ/WI for NS if BFHFNMINS is set */
2411             value &= ~R_V7M_CFSR_BFSR_MASK;
2412         }
2413 
2414         s->cpu->env.v7m.cfsr[attrs.secure] &= ~value;
2415         if (attrs.secure) {
2416             /* The BFSR bits [15:8] are shared between security states
2417              * and we store them in the NS copy.
2418              */
2419             s->cpu->env.v7m.cfsr[M_REG_NS] &= ~(value & R_V7M_CFSR_BFSR_MASK);
2420         }
2421         goto exit_ok;
2422     }
2423     if (size == 4) {
2424         nvic_writel(s, offset, value, attrs);
2425         goto exit_ok;
2426     }
2427     qemu_log_mask(LOG_GUEST_ERROR,
2428                   "NVIC: Bad write of size %d at offset 0x%x\n", size, offset);
2429     /* This is UNPREDICTABLE; treat as RAZ/WI */
2430 
2431  exit_ok:
2432     /* Ensure any changes made are reflected in the cached hflags.  */
2433     arm_rebuild_hflags(&s->cpu->env);
2434     return MEMTX_OK;
2435 }
2436 
2437 static const MemoryRegionOps nvic_sysreg_ops = {
2438     .read_with_attrs = nvic_sysreg_read,
2439     .write_with_attrs = nvic_sysreg_write,
2440     .endianness = DEVICE_NATIVE_ENDIAN,
2441 };
2442 
2443 static MemTxResult nvic_sysreg_ns_write(void *opaque, hwaddr addr,
2444                                         uint64_t value, unsigned size,
2445                                         MemTxAttrs attrs)
2446 {
2447     MemoryRegion *mr = opaque;
2448 
2449     if (attrs.secure) {
2450         /* S accesses to the alias act like NS accesses to the real region */
2451         attrs.secure = 0;
2452         return memory_region_dispatch_write(mr, addr, value,
2453                                             size_memop(size) | MO_TE, attrs);
2454     } else {
2455         /* NS attrs are RAZ/WI for privileged, and BusFault for user */
2456         if (attrs.user) {
2457             return MEMTX_ERROR;
2458         }
2459         return MEMTX_OK;
2460     }
2461 }
2462 
2463 static MemTxResult nvic_sysreg_ns_read(void *opaque, hwaddr addr,
2464                                        uint64_t *data, unsigned size,
2465                                        MemTxAttrs attrs)
2466 {
2467     MemoryRegion *mr = opaque;
2468 
2469     if (attrs.secure) {
2470         /* S accesses to the alias act like NS accesses to the real region */
2471         attrs.secure = 0;
2472         return memory_region_dispatch_read(mr, addr, data,
2473                                            size_memop(size) | MO_TE, attrs);
2474     } else {
2475         /* NS attrs are RAZ/WI for privileged, and BusFault for user */
2476         if (attrs.user) {
2477             return MEMTX_ERROR;
2478         }
2479         *data = 0;
2480         return MEMTX_OK;
2481     }
2482 }
2483 
2484 static const MemoryRegionOps nvic_sysreg_ns_ops = {
2485     .read_with_attrs = nvic_sysreg_ns_read,
2486     .write_with_attrs = nvic_sysreg_ns_write,
2487     .endianness = DEVICE_NATIVE_ENDIAN,
2488 };
2489 
2490 static MemTxResult nvic_systick_write(void *opaque, hwaddr addr,
2491                                       uint64_t value, unsigned size,
2492                                       MemTxAttrs attrs)
2493 {
2494     NVICState *s = opaque;
2495     MemoryRegion *mr;
2496 
2497     /* Direct the access to the correct systick */
2498     mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->systick[attrs.secure]), 0);
2499     return memory_region_dispatch_write(mr, addr, value,
2500                                         size_memop(size) | MO_TE, attrs);
2501 }
2502 
2503 static MemTxResult nvic_systick_read(void *opaque, hwaddr addr,
2504                                      uint64_t *data, unsigned size,
2505                                      MemTxAttrs attrs)
2506 {
2507     NVICState *s = opaque;
2508     MemoryRegion *mr;
2509 
2510     /* Direct the access to the correct systick */
2511     mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->systick[attrs.secure]), 0);
2512     return memory_region_dispatch_read(mr, addr, data, size_memop(size) | MO_TE,
2513                                        attrs);
2514 }
2515 
2516 static const MemoryRegionOps nvic_systick_ops = {
2517     .read_with_attrs = nvic_systick_read,
2518     .write_with_attrs = nvic_systick_write,
2519     .endianness = DEVICE_NATIVE_ENDIAN,
2520 };
2521 
2522 
2523 static MemTxResult ras_read(void *opaque, hwaddr addr,
2524                             uint64_t *data, unsigned size,
2525                             MemTxAttrs attrs)
2526 {
2527     if (attrs.user) {
2528         return MEMTX_ERROR;
2529     }
2530 
2531     switch (addr) {
2532     case 0xe10: /* ERRIIDR */
2533         /* architect field = Arm; product/variant/revision 0 */
2534         *data = 0x43b;
2535         break;
2536     case 0xfc8: /* ERRDEVID */
2537         /* Minimal RAS: we implement 0 error record indexes */
2538         *data = 0;
2539         break;
2540     default:
2541         qemu_log_mask(LOG_UNIMP, "Read RAS register offset 0x%x\n",
2542                       (uint32_t)addr);
2543         *data = 0;
2544         break;
2545     }
2546     return MEMTX_OK;
2547 }
2548 
2549 static MemTxResult ras_write(void *opaque, hwaddr addr,
2550                              uint64_t value, unsigned size,
2551                              MemTxAttrs attrs)
2552 {
2553     if (attrs.user) {
2554         return MEMTX_ERROR;
2555     }
2556 
2557     switch (addr) {
2558     default:
2559         qemu_log_mask(LOG_UNIMP, "Write to RAS register offset 0x%x\n",
2560                       (uint32_t)addr);
2561         break;
2562     }
2563     return MEMTX_OK;
2564 }
2565 
2566 static const MemoryRegionOps ras_ops = {
2567     .read_with_attrs = ras_read,
2568     .write_with_attrs = ras_write,
2569     .endianness = DEVICE_NATIVE_ENDIAN,
2570 };
2571 
2572 /*
2573  * Unassigned portions of the PPB space are RAZ/WI for privileged
2574  * accesses, and fault for non-privileged accesses.
2575  */
2576 static MemTxResult ppb_default_read(void *opaque, hwaddr addr,
2577                                     uint64_t *data, unsigned size,
2578                                     MemTxAttrs attrs)
2579 {
2580     qemu_log_mask(LOG_UNIMP, "Read of unassigned area of PPB: offset 0x%x\n",
2581                   (uint32_t)addr);
2582     if (attrs.user) {
2583         return MEMTX_ERROR;
2584     }
2585     *data = 0;
2586     return MEMTX_OK;
2587 }
2588 
2589 static MemTxResult ppb_default_write(void *opaque, hwaddr addr,
2590                                      uint64_t value, unsigned size,
2591                                      MemTxAttrs attrs)
2592 {
2593     qemu_log_mask(LOG_UNIMP, "Write of unassigned area of PPB: offset 0x%x\n",
2594                   (uint32_t)addr);
2595     if (attrs.user) {
2596         return MEMTX_ERROR;
2597     }
2598     return MEMTX_OK;
2599 }
2600 
2601 static const MemoryRegionOps ppb_default_ops = {
2602     .read_with_attrs = ppb_default_read,
2603     .write_with_attrs = ppb_default_write,
2604     .endianness = DEVICE_NATIVE_ENDIAN,
2605     .valid.min_access_size = 1,
2606     .valid.max_access_size = 8,
2607 };
2608 
2609 static int nvic_post_load(void *opaque, int version_id)
2610 {
2611     NVICState *s = opaque;
2612     unsigned i;
2613     int resetprio;
2614 
2615     /* Check for out of range priority settings */
2616     resetprio = arm_feature(&s->cpu->env, ARM_FEATURE_V8) ? -4 : -3;
2617 
2618     if (s->vectors[ARMV7M_EXCP_RESET].prio != resetprio ||
2619         s->vectors[ARMV7M_EXCP_NMI].prio != -2 ||
2620         s->vectors[ARMV7M_EXCP_HARD].prio != -1) {
2621         return 1;
2622     }
2623     for (i = ARMV7M_EXCP_MEM; i < s->num_irq; i++) {
2624         if (s->vectors[i].prio & ~0xff) {
2625             return 1;
2626         }
2627     }
2628 
2629     nvic_recompute_state(s);
2630 
2631     return 0;
2632 }
2633 
2634 static const VMStateDescription vmstate_VecInfo = {
2635     .name = "armv7m_nvic_info",
2636     .version_id = 1,
2637     .minimum_version_id = 1,
2638     .fields = (VMStateField[]) {
2639         VMSTATE_INT16(prio, VecInfo),
2640         VMSTATE_UINT8(enabled, VecInfo),
2641         VMSTATE_UINT8(pending, VecInfo),
2642         VMSTATE_UINT8(active, VecInfo),
2643         VMSTATE_UINT8(level, VecInfo),
2644         VMSTATE_END_OF_LIST()
2645     }
2646 };
2647 
2648 static bool nvic_security_needed(void *opaque)
2649 {
2650     NVICState *s = opaque;
2651 
2652     return arm_feature(&s->cpu->env, ARM_FEATURE_M_SECURITY);
2653 }
2654 
2655 static int nvic_security_post_load(void *opaque, int version_id)
2656 {
2657     NVICState *s = opaque;
2658     int i;
2659 
2660     /* Check for out of range priority settings */
2661     if (s->sec_vectors[ARMV7M_EXCP_HARD].prio != -1
2662         && s->sec_vectors[ARMV7M_EXCP_HARD].prio != -3) {
2663         /* We can't cross-check against AIRCR.BFHFNMINS as we don't know
2664          * if the CPU state has been migrated yet; a mismatch won't
2665          * cause the emulation to blow up, though.
2666          */
2667         return 1;
2668     }
2669     for (i = ARMV7M_EXCP_MEM; i < ARRAY_SIZE(s->sec_vectors); i++) {
2670         if (s->sec_vectors[i].prio & ~0xff) {
2671             return 1;
2672         }
2673     }
2674     return 0;
2675 }
2676 
2677 static const VMStateDescription vmstate_nvic_security = {
2678     .name = "armv7m_nvic/m-security",
2679     .version_id = 1,
2680     .minimum_version_id = 1,
2681     .needed = nvic_security_needed,
2682     .post_load = &nvic_security_post_load,
2683     .fields = (VMStateField[]) {
2684         VMSTATE_STRUCT_ARRAY(sec_vectors, NVICState, NVIC_INTERNAL_VECTORS, 1,
2685                              vmstate_VecInfo, VecInfo),
2686         VMSTATE_UINT32(prigroup[M_REG_S], NVICState),
2687         VMSTATE_BOOL_ARRAY(itns, NVICState, NVIC_MAX_VECTORS),
2688         VMSTATE_END_OF_LIST()
2689     }
2690 };
2691 
2692 static const VMStateDescription vmstate_nvic = {
2693     .name = "armv7m_nvic",
2694     .version_id = 4,
2695     .minimum_version_id = 4,
2696     .post_load = &nvic_post_load,
2697     .fields = (VMStateField[]) {
2698         VMSTATE_STRUCT_ARRAY(vectors, NVICState, NVIC_MAX_VECTORS, 1,
2699                              vmstate_VecInfo, VecInfo),
2700         VMSTATE_UINT32(prigroup[M_REG_NS], NVICState),
2701         VMSTATE_END_OF_LIST()
2702     },
2703     .subsections = (const VMStateDescription*[]) {
2704         &vmstate_nvic_security,
2705         NULL
2706     }
2707 };
2708 
2709 static Property props_nvic[] = {
2710     /* Number of external IRQ lines (so excluding the 16 internal exceptions) */
2711     DEFINE_PROP_UINT32("num-irq", NVICState, num_irq, 64),
2712     DEFINE_PROP_END_OF_LIST()
2713 };
2714 
2715 static void armv7m_nvic_reset(DeviceState *dev)
2716 {
2717     int resetprio;
2718     NVICState *s = NVIC(dev);
2719 
2720     memset(s->vectors, 0, sizeof(s->vectors));
2721     memset(s->sec_vectors, 0, sizeof(s->sec_vectors));
2722     s->prigroup[M_REG_NS] = 0;
2723     s->prigroup[M_REG_S] = 0;
2724 
2725     s->vectors[ARMV7M_EXCP_NMI].enabled = 1;
2726     /* MEM, BUS, and USAGE are enabled through
2727      * the System Handler Control register
2728      */
2729     s->vectors[ARMV7M_EXCP_SVC].enabled = 1;
2730     s->vectors[ARMV7M_EXCP_PENDSV].enabled = 1;
2731     s->vectors[ARMV7M_EXCP_SYSTICK].enabled = 1;
2732 
2733     /* DebugMonitor is enabled via DEMCR.MON_EN */
2734     s->vectors[ARMV7M_EXCP_DEBUG].enabled = 0;
2735 
2736     resetprio = arm_feature(&s->cpu->env, ARM_FEATURE_V8) ? -4 : -3;
2737     s->vectors[ARMV7M_EXCP_RESET].prio = resetprio;
2738     s->vectors[ARMV7M_EXCP_NMI].prio = -2;
2739     s->vectors[ARMV7M_EXCP_HARD].prio = -1;
2740 
2741     if (arm_feature(&s->cpu->env, ARM_FEATURE_M_SECURITY)) {
2742         s->sec_vectors[ARMV7M_EXCP_HARD].enabled = 1;
2743         s->sec_vectors[ARMV7M_EXCP_SVC].enabled = 1;
2744         s->sec_vectors[ARMV7M_EXCP_PENDSV].enabled = 1;
2745         s->sec_vectors[ARMV7M_EXCP_SYSTICK].enabled = 1;
2746 
2747         /* AIRCR.BFHFNMINS resets to 0 so Secure HF is priority -1 (R_CMTC) */
2748         s->sec_vectors[ARMV7M_EXCP_HARD].prio = -1;
2749         /* If AIRCR.BFHFNMINS is 0 then NS HF is (effectively) disabled */
2750         s->vectors[ARMV7M_EXCP_HARD].enabled = 0;
2751     } else {
2752         s->vectors[ARMV7M_EXCP_HARD].enabled = 1;
2753     }
2754 
2755     /* Strictly speaking the reset handler should be enabled.
2756      * However, we don't simulate soft resets through the NVIC,
2757      * and the reset vector should never be pended.
2758      * So we leave it disabled to catch logic errors.
2759      */
2760 
2761     s->exception_prio = NVIC_NOEXC_PRIO;
2762     s->vectpending = 0;
2763     s->vectpending_is_s_banked = false;
2764     s->vectpending_prio = NVIC_NOEXC_PRIO;
2765 
2766     if (arm_feature(&s->cpu->env, ARM_FEATURE_M_SECURITY)) {
2767         memset(s->itns, 0, sizeof(s->itns));
2768     } else {
2769         /* This state is constant and not guest accessible in a non-security
2770          * NVIC; we set the bits to true to avoid having to do a feature
2771          * bit check in the NVIC enable/pend/etc register accessors.
2772          */
2773         int i;
2774 
2775         for (i = NVIC_FIRST_IRQ; i < ARRAY_SIZE(s->itns); i++) {
2776             s->itns[i] = true;
2777         }
2778     }
2779 
2780     /*
2781      * We updated state that affects the CPU's MMUidx and thus its hflags;
2782      * and we can't guarantee that we run before the CPU reset function.
2783      */
2784     arm_rebuild_hflags(&s->cpu->env);
2785 }
2786 
2787 static void nvic_systick_trigger(void *opaque, int n, int level)
2788 {
2789     NVICState *s = opaque;
2790 
2791     if (level) {
2792         /* SysTick just asked us to pend its exception.
2793          * (This is different from an external interrupt line's
2794          * behaviour.)
2795          * n == 0 : NonSecure systick
2796          * n == 1 : Secure systick
2797          */
2798         armv7m_nvic_set_pending(s, ARMV7M_EXCP_SYSTICK, n);
2799     }
2800 }
2801 
2802 static void armv7m_nvic_realize(DeviceState *dev, Error **errp)
2803 {
2804     NVICState *s = NVIC(dev);
2805 
2806     /* The armv7m container object will have set our CPU pointer */
2807     if (!s->cpu || !arm_feature(&s->cpu->env, ARM_FEATURE_M)) {
2808         error_setg(errp, "The NVIC can only be used with a Cortex-M CPU");
2809         return;
2810     }
2811 
2812     if (s->num_irq > NVIC_MAX_IRQ) {
2813         error_setg(errp, "num-irq %d exceeds NVIC maximum", s->num_irq);
2814         return;
2815     }
2816 
2817     qdev_init_gpio_in(dev, set_irq_level, s->num_irq);
2818 
2819     /* include space for internal exception vectors */
2820     s->num_irq += NVIC_FIRST_IRQ;
2821 
2822     s->num_prio_bits = arm_feature(&s->cpu->env, ARM_FEATURE_V7) ? 8 : 2;
2823 
2824     if (!sysbus_realize(SYS_BUS_DEVICE(&s->systick[M_REG_NS]), errp)) {
2825         return;
2826     }
2827     sysbus_connect_irq(SYS_BUS_DEVICE(&s->systick[M_REG_NS]), 0,
2828                        qdev_get_gpio_in_named(dev, "systick-trigger",
2829                                               M_REG_NS));
2830 
2831     if (arm_feature(&s->cpu->env, ARM_FEATURE_M_SECURITY)) {
2832         /* We couldn't init the secure systick device in instance_init
2833          * as we didn't know then if the CPU had the security extensions;
2834          * so we have to do it here.
2835          */
2836         object_initialize_child(OBJECT(dev), "systick-reg-s",
2837                                 &s->systick[M_REG_S], TYPE_SYSTICK);
2838 
2839         if (!sysbus_realize(SYS_BUS_DEVICE(&s->systick[M_REG_S]), errp)) {
2840             return;
2841         }
2842         sysbus_connect_irq(SYS_BUS_DEVICE(&s->systick[M_REG_S]), 0,
2843                            qdev_get_gpio_in_named(dev, "systick-trigger",
2844                                                   M_REG_S));
2845     }
2846 
2847     /*
2848      * This device provides a single sysbus memory region which
2849      * represents the whole of the "System PPB" space. This is the
2850      * range from 0xe0000000 to 0xe00fffff and includes the NVIC,
2851      * the System Control Space (system registers), the systick timer,
2852      * and for CPUs with the Security extension an NS banked version
2853      * of all of these.
2854      *
2855      * The default behaviour for unimplemented registers/ranges
2856      * (for instance the Data Watchpoint and Trace unit at 0xe0001000)
2857      * is to RAZ/WI for privileged access and BusFault for non-privileged
2858      * access.
2859      *
2860      * The NVIC and System Control Space (SCS) starts at 0xe000e000
2861      * and looks like this:
2862      *  0x004 - ICTR
2863      *  0x010 - 0xff - systick
2864      *  0x100..0x7ec - NVIC
2865      *  0x7f0..0xcff - Reserved
2866      *  0xd00..0xd3c - SCS registers
2867      *  0xd40..0xeff - Reserved or Not implemented
2868      *  0xf00 - STIR
2869      *
2870      * Some registers within this space are banked between security states.
2871      * In v8M there is a second range 0xe002e000..0xe002efff which is the
2872      * NonSecure alias SCS; secure accesses to this behave like NS accesses
2873      * to the main SCS range, and non-secure accesses (including when
2874      * the security extension is not implemented) are RAZ/WI.
2875      * Note that both the main SCS range and the alias range are defined
2876      * to be exempt from memory attribution (R_BLJT) and so the memory
2877      * transaction attribute always matches the current CPU security
2878      * state (attrs.secure == env->v7m.secure). In the nvic_sysreg_ns_ops
2879      * wrappers we change attrs.secure to indicate the NS access; so
2880      * generally code determining which banked register to use should
2881      * use attrs.secure; code determining actual behaviour of the system
2882      * should use env->v7m.secure.
2883      *
2884      * The container covers the whole PPB space. Within it the priority
2885      * of overlapping regions is:
2886      *  - default region (for RAZ/WI and BusFault) : -1
2887      *  - system register regions : 0
2888      *  - systick : 1
2889      * This is because the systick device is a small block of registers
2890      * in the middle of the other system control registers.
2891      */
2892     memory_region_init(&s->container, OBJECT(s), "nvic", 0x100000);
2893     memory_region_init_io(&s->defaultmem, OBJECT(s), &ppb_default_ops, s,
2894                           "nvic-default", 0x100000);
2895     memory_region_add_subregion_overlap(&s->container, 0, &s->defaultmem, -1);
2896     memory_region_init_io(&s->sysregmem, OBJECT(s), &nvic_sysreg_ops, s,
2897                           "nvic_sysregs", 0x1000);
2898     memory_region_add_subregion(&s->container, 0xe000, &s->sysregmem);
2899 
2900     memory_region_init_io(&s->systickmem, OBJECT(s),
2901                           &nvic_systick_ops, s,
2902                           "nvic_systick", 0xe0);
2903 
2904     memory_region_add_subregion_overlap(&s->container, 0xe010,
2905                                         &s->systickmem, 1);
2906 
2907     if (arm_feature(&s->cpu->env, ARM_FEATURE_V8)) {
2908         memory_region_init_io(&s->sysreg_ns_mem, OBJECT(s),
2909                               &nvic_sysreg_ns_ops, &s->sysregmem,
2910                               "nvic_sysregs_ns", 0x1000);
2911         memory_region_add_subregion(&s->container, 0x2e000, &s->sysreg_ns_mem);
2912         memory_region_init_io(&s->systick_ns_mem, OBJECT(s),
2913                               &nvic_sysreg_ns_ops, &s->systickmem,
2914                               "nvic_systick_ns", 0xe0);
2915         memory_region_add_subregion_overlap(&s->container, 0x2e010,
2916                                             &s->systick_ns_mem, 1);
2917     }
2918 
2919     if (cpu_isar_feature(aa32_ras, s->cpu)) {
2920         memory_region_init_io(&s->ras_mem, OBJECT(s),
2921                               &ras_ops, s, "nvic_ras", 0x1000);
2922         memory_region_add_subregion(&s->container, 0x5000, &s->ras_mem);
2923     }
2924 
2925     sysbus_init_mmio(SYS_BUS_DEVICE(dev), &s->container);
2926 }
2927 
2928 static void armv7m_nvic_instance_init(Object *obj)
2929 {
2930     /* We have a different default value for the num-irq property
2931      * than our superclass. This function runs after qdev init
2932      * has set the defaults from the Property array and before
2933      * any user-specified property setting, so just modify the
2934      * value in the GICState struct.
2935      */
2936     DeviceState *dev = DEVICE(obj);
2937     NVICState *nvic = NVIC(obj);
2938     SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
2939 
2940     object_initialize_child(obj, "systick-reg-ns", &nvic->systick[M_REG_NS],
2941                             TYPE_SYSTICK);
2942     /* We can't initialize the secure systick here, as we don't know
2943      * yet if we need it.
2944      */
2945 
2946     sysbus_init_irq(sbd, &nvic->excpout);
2947     qdev_init_gpio_out_named(dev, &nvic->sysresetreq, "SYSRESETREQ", 1);
2948     qdev_init_gpio_in_named(dev, nvic_systick_trigger, "systick-trigger",
2949                             M_REG_NUM_BANKS);
2950     qdev_init_gpio_in_named(dev, nvic_nmi_trigger, "NMI", 1);
2951 }
2952 
2953 static void armv7m_nvic_class_init(ObjectClass *klass, void *data)
2954 {
2955     DeviceClass *dc = DEVICE_CLASS(klass);
2956 
2957     dc->vmsd  = &vmstate_nvic;
2958     device_class_set_props(dc, props_nvic);
2959     dc->reset = armv7m_nvic_reset;
2960     dc->realize = armv7m_nvic_realize;
2961 }
2962 
2963 static const TypeInfo armv7m_nvic_info = {
2964     .name          = TYPE_NVIC,
2965     .parent        = TYPE_SYS_BUS_DEVICE,
2966     .instance_init = armv7m_nvic_instance_init,
2967     .instance_size = sizeof(NVICState),
2968     .class_init    = armv7m_nvic_class_init,
2969     .class_size    = sizeof(SysBusDeviceClass),
2970 };
2971 
2972 static void armv7m_nvic_register_types(void)
2973 {
2974     type_register_static(&armv7m_nvic_info);
2975 }
2976 
2977 type_init(armv7m_nvic_register_types)
2978