xref: /openbmc/qemu/hw/intc/armv7m_nvic.c (revision 3f1e0eb7c38c19bd2a4bfa8398921d29a1080249)
1 /*
2  * ARM Nested Vectored Interrupt Controller
3  *
4  * Copyright (c) 2006-2007 CodeSourcery.
5  * Written by Paul Brook
6  *
7  * This code is licensed under the GPL.
8  *
9  * The ARMv7M System controller is fairly tightly tied in with the
10  * NVIC.  Much of that is also implemented here.
11  */
12 
13 #include "qemu/osdep.h"
14 #include "qapi/error.h"
15 #include "qemu-common.h"
16 #include "cpu.h"
17 #include "hw/sysbus.h"
18 #include "qemu/timer.h"
19 #include "hw/arm/arm.h"
20 #include "hw/intc/armv7m_nvic.h"
21 #include "target/arm/cpu.h"
22 #include "exec/exec-all.h"
23 #include "qemu/log.h"
24 #include "trace.h"
25 
26 /* IRQ number counting:
27  *
28  * the num-irq property counts the number of external IRQ lines
29  *
30  * NVICState::num_irq counts the total number of exceptions
31  * (external IRQs, the 15 internal exceptions including reset,
32  * and one for the unused exception number 0).
33  *
34  * NVIC_MAX_IRQ is the highest permitted number of external IRQ lines.
35  *
36  * NVIC_MAX_VECTORS is the highest permitted number of exceptions.
37  *
38  * Iterating through all exceptions should typically be done with
39  * for (i = 1; i < s->num_irq; i++) to avoid the unused slot 0.
40  *
41  * The external qemu_irq lines are the NVIC's external IRQ lines,
42  * so line 0 is exception 16.
43  *
44  * In the terminology of the architecture manual, "interrupts" are
45  * a subcategory of exception referring to the external interrupts
46  * (which are exception numbers NVIC_FIRST_IRQ and upward).
47  * For historical reasons QEMU tends to use "interrupt" and
48  * "exception" more or less interchangeably.
49  */
50 #define NVIC_FIRST_IRQ NVIC_INTERNAL_VECTORS
51 #define NVIC_MAX_IRQ (NVIC_MAX_VECTORS - NVIC_FIRST_IRQ)
52 
53 /* Effective running priority of the CPU when no exception is active
54  * (higher than the highest possible priority value)
55  */
56 #define NVIC_NOEXC_PRIO 0x100
57 /* Maximum priority of non-secure exceptions when AIRCR.PRIS is set */
58 #define NVIC_NS_PRIO_LIMIT 0x80
59 
60 static const uint8_t nvic_id[] = {
61     0x00, 0xb0, 0x1b, 0x00, 0x0d, 0xe0, 0x05, 0xb1
62 };
63 
64 static int nvic_pending_prio(NVICState *s)
65 {
66     /* return the group priority of the current pending interrupt,
67      * or NVIC_NOEXC_PRIO if no interrupt is pending
68      */
69     return s->vectpending_prio;
70 }
71 
72 /* Return the value of the ISCR RETTOBASE bit:
73  * 1 if there is exactly one active exception
74  * 0 if there is more than one active exception
75  * UNKNOWN if there are no active exceptions (we choose 1,
76  * which matches the choice Cortex-M3 is documented as making).
77  *
78  * NB: some versions of the documentation talk about this
79  * counting "active exceptions other than the one shown by IPSR";
80  * this is only different in the obscure corner case where guest
81  * code has manually deactivated an exception and is about
82  * to fail an exception-return integrity check. The definition
83  * above is the one from the v8M ARM ARM and is also in line
84  * with the behaviour documented for the Cortex-M3.
85  */
86 static bool nvic_rettobase(NVICState *s)
87 {
88     int irq, nhand = 0;
89     bool check_sec = arm_feature(&s->cpu->env, ARM_FEATURE_M_SECURITY);
90 
91     for (irq = ARMV7M_EXCP_RESET; irq < s->num_irq; irq++) {
92         if (s->vectors[irq].active ||
93             (check_sec && irq < NVIC_INTERNAL_VECTORS &&
94              s->sec_vectors[irq].active)) {
95             nhand++;
96             if (nhand == 2) {
97                 return 0;
98             }
99         }
100     }
101 
102     return 1;
103 }
104 
105 /* Return the value of the ISCR ISRPENDING bit:
106  * 1 if an external interrupt is pending
107  * 0 if no external interrupt is pending
108  */
109 static bool nvic_isrpending(NVICState *s)
110 {
111     int irq;
112 
113     /* We can shortcut if the highest priority pending interrupt
114      * happens to be external or if there is nothing pending.
115      */
116     if (s->vectpending > NVIC_FIRST_IRQ) {
117         return true;
118     }
119     if (s->vectpending == 0) {
120         return false;
121     }
122 
123     for (irq = NVIC_FIRST_IRQ; irq < s->num_irq; irq++) {
124         if (s->vectors[irq].pending) {
125             return true;
126         }
127     }
128     return false;
129 }
130 
131 static bool exc_is_banked(int exc)
132 {
133     /* Return true if this is one of the limited set of exceptions which
134      * are banked (and thus have state in sec_vectors[])
135      */
136     return exc == ARMV7M_EXCP_HARD ||
137         exc == ARMV7M_EXCP_MEM ||
138         exc == ARMV7M_EXCP_USAGE ||
139         exc == ARMV7M_EXCP_SVC ||
140         exc == ARMV7M_EXCP_PENDSV ||
141         exc == ARMV7M_EXCP_SYSTICK;
142 }
143 
144 /* Return a mask word which clears the subpriority bits from
145  * a priority value for an M-profile exception, leaving only
146  * the group priority.
147  */
148 static inline uint32_t nvic_gprio_mask(NVICState *s, bool secure)
149 {
150     return ~0U << (s->prigroup[secure] + 1);
151 }
152 
153 static bool exc_targets_secure(NVICState *s, int exc)
154 {
155     /* Return true if this non-banked exception targets Secure state. */
156     if (!arm_feature(&s->cpu->env, ARM_FEATURE_M_SECURITY)) {
157         return false;
158     }
159 
160     if (exc >= NVIC_FIRST_IRQ) {
161         return !s->itns[exc];
162     }
163 
164     /* Function shouldn't be called for banked exceptions. */
165     assert(!exc_is_banked(exc));
166 
167     switch (exc) {
168     case ARMV7M_EXCP_NMI:
169     case ARMV7M_EXCP_BUS:
170         return !(s->cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK);
171     case ARMV7M_EXCP_SECURE:
172         return true;
173     case ARMV7M_EXCP_DEBUG:
174         /* TODO: controlled by DEMCR.SDME, which we don't yet implement */
175         return false;
176     default:
177         /* reset, and reserved (unused) low exception numbers.
178          * We'll get called by code that loops through all the exception
179          * numbers, but it doesn't matter what we return here as these
180          * non-existent exceptions will never be pended or active.
181          */
182         return true;
183     }
184 }
185 
186 static int exc_group_prio(NVICState *s, int rawprio, bool targets_secure)
187 {
188     /* Return the group priority for this exception, given its raw
189      * (group-and-subgroup) priority value and whether it is targeting
190      * secure state or not.
191      */
192     if (rawprio < 0) {
193         return rawprio;
194     }
195     rawprio &= nvic_gprio_mask(s, targets_secure);
196     /* AIRCR.PRIS causes us to squash all NS priorities into the
197      * lower half of the total range
198      */
199     if (!targets_secure &&
200         (s->cpu->env.v7m.aircr & R_V7M_AIRCR_PRIS_MASK)) {
201         rawprio = (rawprio >> 1) + NVIC_NS_PRIO_LIMIT;
202     }
203     return rawprio;
204 }
205 
206 /* Recompute vectpending and exception_prio for a CPU which implements
207  * the Security extension
208  */
209 static void nvic_recompute_state_secure(NVICState *s)
210 {
211     int i, bank;
212     int pend_prio = NVIC_NOEXC_PRIO;
213     int active_prio = NVIC_NOEXC_PRIO;
214     int pend_irq = 0;
215     bool pending_is_s_banked = false;
216 
217     /* R_CQRV: precedence is by:
218      *  - lowest group priority; if both the same then
219      *  - lowest subpriority; if both the same then
220      *  - lowest exception number; if both the same (ie banked) then
221      *  - secure exception takes precedence
222      * Compare pseudocode RawExecutionPriority.
223      * Annoyingly, now we have two prigroup values (for S and NS)
224      * we can't do the loop comparison on raw priority values.
225      */
226     for (i = 1; i < s->num_irq; i++) {
227         for (bank = M_REG_S; bank >= M_REG_NS; bank--) {
228             VecInfo *vec;
229             int prio;
230             bool targets_secure;
231 
232             if (bank == M_REG_S) {
233                 if (!exc_is_banked(i)) {
234                     continue;
235                 }
236                 vec = &s->sec_vectors[i];
237                 targets_secure = true;
238             } else {
239                 vec = &s->vectors[i];
240                 targets_secure = !exc_is_banked(i) && exc_targets_secure(s, i);
241             }
242 
243             prio = exc_group_prio(s, vec->prio, targets_secure);
244             if (vec->enabled && vec->pending && prio < pend_prio) {
245                 pend_prio = prio;
246                 pend_irq = i;
247                 pending_is_s_banked = (bank == M_REG_S);
248             }
249             if (vec->active && prio < active_prio) {
250                 active_prio = prio;
251             }
252         }
253     }
254 
255     s->vectpending_is_s_banked = pending_is_s_banked;
256     s->vectpending = pend_irq;
257     s->vectpending_prio = pend_prio;
258     s->exception_prio = active_prio;
259 
260     trace_nvic_recompute_state_secure(s->vectpending,
261                                       s->vectpending_is_s_banked,
262                                       s->vectpending_prio,
263                                       s->exception_prio);
264 }
265 
266 /* Recompute vectpending and exception_prio */
267 static void nvic_recompute_state(NVICState *s)
268 {
269     int i;
270     int pend_prio = NVIC_NOEXC_PRIO;
271     int active_prio = NVIC_NOEXC_PRIO;
272     int pend_irq = 0;
273 
274     /* In theory we could write one function that handled both
275      * the "security extension present" and "not present"; however
276      * the security related changes significantly complicate the
277      * recomputation just by themselves and mixing both cases together
278      * would be even worse, so we retain a separate non-secure-only
279      * version for CPUs which don't implement the security extension.
280      */
281     if (arm_feature(&s->cpu->env, ARM_FEATURE_M_SECURITY)) {
282         nvic_recompute_state_secure(s);
283         return;
284     }
285 
286     for (i = 1; i < s->num_irq; i++) {
287         VecInfo *vec = &s->vectors[i];
288 
289         if (vec->enabled && vec->pending && vec->prio < pend_prio) {
290             pend_prio = vec->prio;
291             pend_irq = i;
292         }
293         if (vec->active && vec->prio < active_prio) {
294             active_prio = vec->prio;
295         }
296     }
297 
298     if (active_prio > 0) {
299         active_prio &= nvic_gprio_mask(s, false);
300     }
301 
302     if (pend_prio > 0) {
303         pend_prio &= nvic_gprio_mask(s, false);
304     }
305 
306     s->vectpending = pend_irq;
307     s->vectpending_prio = pend_prio;
308     s->exception_prio = active_prio;
309 
310     trace_nvic_recompute_state(s->vectpending,
311                                s->vectpending_prio,
312                                s->exception_prio);
313 }
314 
315 /* Return the current execution priority of the CPU
316  * (equivalent to the pseudocode ExecutionPriority function).
317  * This is a value between -2 (NMI priority) and NVIC_NOEXC_PRIO.
318  */
319 static inline int nvic_exec_prio(NVICState *s)
320 {
321     CPUARMState *env = &s->cpu->env;
322     int running = NVIC_NOEXC_PRIO;
323 
324     if (env->v7m.basepri[M_REG_NS] > 0) {
325         running = exc_group_prio(s, env->v7m.basepri[M_REG_NS], M_REG_NS);
326     }
327 
328     if (env->v7m.basepri[M_REG_S] > 0) {
329         int basepri = exc_group_prio(s, env->v7m.basepri[M_REG_S], M_REG_S);
330         if (running > basepri) {
331             running = basepri;
332         }
333     }
334 
335     if (env->v7m.primask[M_REG_NS]) {
336         if (env->v7m.aircr & R_V7M_AIRCR_PRIS_MASK) {
337             if (running > NVIC_NS_PRIO_LIMIT) {
338                 running = NVIC_NS_PRIO_LIMIT;
339             }
340         } else {
341             running = 0;
342         }
343     }
344 
345     if (env->v7m.primask[M_REG_S]) {
346         running = 0;
347     }
348 
349     if (env->v7m.faultmask[M_REG_NS]) {
350         if (env->v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK) {
351             running = -1;
352         } else {
353             if (env->v7m.aircr & R_V7M_AIRCR_PRIS_MASK) {
354                 if (running > NVIC_NS_PRIO_LIMIT) {
355                     running = NVIC_NS_PRIO_LIMIT;
356                 }
357             } else {
358                 running = 0;
359             }
360         }
361     }
362 
363     if (env->v7m.faultmask[M_REG_S]) {
364         running = (env->v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK) ? -3 : -1;
365     }
366 
367     /* consider priority of active handler */
368     return MIN(running, s->exception_prio);
369 }
370 
371 bool armv7m_nvic_neg_prio_requested(void *opaque, bool secure)
372 {
373     /* Return true if the requested execution priority is negative
374      * for the specified security state, ie that security state
375      * has an active NMI or HardFault or has set its FAULTMASK.
376      * Note that this is not the same as whether the execution
377      * priority is actually negative (for instance AIRCR.PRIS may
378      * mean we don't allow FAULTMASK_NS to actually make the execution
379      * priority negative). Compare pseudocode IsReqExcPriNeg().
380      */
381     NVICState *s = opaque;
382 
383     if (s->cpu->env.v7m.faultmask[secure]) {
384         return true;
385     }
386 
387     if (secure ? s->sec_vectors[ARMV7M_EXCP_HARD].active :
388         s->vectors[ARMV7M_EXCP_HARD].active) {
389         return true;
390     }
391 
392     if (s->vectors[ARMV7M_EXCP_NMI].active &&
393         exc_targets_secure(s, ARMV7M_EXCP_NMI) == secure) {
394         return true;
395     }
396 
397     return false;
398 }
399 
400 bool armv7m_nvic_can_take_pending_exception(void *opaque)
401 {
402     NVICState *s = opaque;
403 
404     return nvic_exec_prio(s) > nvic_pending_prio(s);
405 }
406 
407 int armv7m_nvic_raw_execution_priority(void *opaque)
408 {
409     NVICState *s = opaque;
410 
411     return s->exception_prio;
412 }
413 
414 /* caller must call nvic_irq_update() after this.
415  * secure indicates the bank to use for banked exceptions (we assert if
416  * we are passed secure=true for a non-banked exception).
417  */
418 static void set_prio(NVICState *s, unsigned irq, bool secure, uint8_t prio)
419 {
420     assert(irq > ARMV7M_EXCP_NMI); /* only use for configurable prios */
421     assert(irq < s->num_irq);
422 
423     if (secure) {
424         assert(exc_is_banked(irq));
425         s->sec_vectors[irq].prio = prio;
426     } else {
427         s->vectors[irq].prio = prio;
428     }
429 
430     trace_nvic_set_prio(irq, secure, prio);
431 }
432 
433 /* Return the current raw priority register value.
434  * secure indicates the bank to use for banked exceptions (we assert if
435  * we are passed secure=true for a non-banked exception).
436  */
437 static int get_prio(NVICState *s, unsigned irq, bool secure)
438 {
439     assert(irq > ARMV7M_EXCP_NMI); /* only use for configurable prios */
440     assert(irq < s->num_irq);
441 
442     if (secure) {
443         assert(exc_is_banked(irq));
444         return s->sec_vectors[irq].prio;
445     } else {
446         return s->vectors[irq].prio;
447     }
448 }
449 
450 /* Recompute state and assert irq line accordingly.
451  * Must be called after changes to:
452  *  vec->active, vec->enabled, vec->pending or vec->prio for any vector
453  *  prigroup
454  */
455 static void nvic_irq_update(NVICState *s)
456 {
457     int lvl;
458     int pend_prio;
459 
460     nvic_recompute_state(s);
461     pend_prio = nvic_pending_prio(s);
462 
463     /* Raise NVIC output if this IRQ would be taken, except that we
464      * ignore the effects of the BASEPRI, FAULTMASK and PRIMASK (which
465      * will be checked for in arm_v7m_cpu_exec_interrupt()); changes
466      * to those CPU registers don't cause us to recalculate the NVIC
467      * pending info.
468      */
469     lvl = (pend_prio < s->exception_prio);
470     trace_nvic_irq_update(s->vectpending, pend_prio, s->exception_prio, lvl);
471     qemu_set_irq(s->excpout, lvl);
472 }
473 
474 /**
475  * armv7m_nvic_clear_pending: mark the specified exception as not pending
476  * @opaque: the NVIC
477  * @irq: the exception number to mark as not pending
478  * @secure: false for non-banked exceptions or for the nonsecure
479  * version of a banked exception, true for the secure version of a banked
480  * exception.
481  *
482  * Marks the specified exception as not pending. Note that we will assert()
483  * if @secure is true and @irq does not specify one of the fixed set
484  * of architecturally banked exceptions.
485  */
486 static void armv7m_nvic_clear_pending(void *opaque, int irq, bool secure)
487 {
488     NVICState *s = (NVICState *)opaque;
489     VecInfo *vec;
490 
491     assert(irq > ARMV7M_EXCP_RESET && irq < s->num_irq);
492 
493     if (secure) {
494         assert(exc_is_banked(irq));
495         vec = &s->sec_vectors[irq];
496     } else {
497         vec = &s->vectors[irq];
498     }
499     trace_nvic_clear_pending(irq, secure, vec->enabled, vec->prio);
500     if (vec->pending) {
501         vec->pending = 0;
502         nvic_irq_update(s);
503     }
504 }
505 
506 void armv7m_nvic_set_pending(void *opaque, int irq, bool secure)
507 {
508     NVICState *s = (NVICState *)opaque;
509     bool banked = exc_is_banked(irq);
510     VecInfo *vec;
511 
512     assert(irq > ARMV7M_EXCP_RESET && irq < s->num_irq);
513     assert(!secure || banked);
514 
515     vec = (banked && secure) ? &s->sec_vectors[irq] : &s->vectors[irq];
516 
517     trace_nvic_set_pending(irq, secure, vec->enabled, vec->prio);
518 
519     if (irq >= ARMV7M_EXCP_HARD && irq < ARMV7M_EXCP_PENDSV) {
520         /* If a synchronous exception is pending then it may be
521          * escalated to HardFault if:
522          *  * it is equal or lower priority to current execution
523          *  * it is disabled
524          * (ie we need to take it immediately but we can't do so).
525          * Asynchronous exceptions (and interrupts) simply remain pending.
526          *
527          * For QEMU, we don't have any imprecise (asynchronous) faults,
528          * so we can assume that PREFETCH_ABORT and DATA_ABORT are always
529          * synchronous.
530          * Debug exceptions are awkward because only Debug exceptions
531          * resulting from the BKPT instruction should be escalated,
532          * but we don't currently implement any Debug exceptions other
533          * than those that result from BKPT, so we treat all debug exceptions
534          * as needing escalation.
535          *
536          * This all means we can identify whether to escalate based only on
537          * the exception number and don't (yet) need the caller to explicitly
538          * tell us whether this exception is synchronous or not.
539          */
540         int running = nvic_exec_prio(s);
541         bool escalate = false;
542 
543         if (exc_group_prio(s, vec->prio, secure) >= running) {
544             trace_nvic_escalate_prio(irq, vec->prio, running);
545             escalate = true;
546         } else if (!vec->enabled) {
547             trace_nvic_escalate_disabled(irq);
548             escalate = true;
549         }
550 
551         if (escalate) {
552 
553             /* We need to escalate this exception to a synchronous HardFault.
554              * If BFHFNMINS is set then we escalate to the banked HF for
555              * the target security state of the original exception; otherwise
556              * we take a Secure HardFault.
557              */
558             irq = ARMV7M_EXCP_HARD;
559             if (arm_feature(&s->cpu->env, ARM_FEATURE_M_SECURITY) &&
560                 (secure ||
561                  !(s->cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK))) {
562                 vec = &s->sec_vectors[irq];
563             } else {
564                 vec = &s->vectors[irq];
565             }
566             if (running <= vec->prio) {
567                 /* We want to escalate to HardFault but we can't take the
568                  * synchronous HardFault at this point either. This is a
569                  * Lockup condition due to a guest bug. We don't model
570                  * Lockup, so report via cpu_abort() instead.
571                  */
572                 cpu_abort(&s->cpu->parent_obj,
573                           "Lockup: can't escalate %d to HardFault "
574                           "(current priority %d)\n", irq, running);
575             }
576 
577             /* HF may be banked but there is only one shared HFSR */
578             s->cpu->env.v7m.hfsr |= R_V7M_HFSR_FORCED_MASK;
579         }
580     }
581 
582     if (!vec->pending) {
583         vec->pending = 1;
584         nvic_irq_update(s);
585     }
586 }
587 
588 /* Make pending IRQ active.  */
589 void armv7m_nvic_acknowledge_irq(void *opaque)
590 {
591     NVICState *s = (NVICState *)opaque;
592     CPUARMState *env = &s->cpu->env;
593     const int pending = s->vectpending;
594     const int running = nvic_exec_prio(s);
595     VecInfo *vec;
596 
597     assert(pending > ARMV7M_EXCP_RESET && pending < s->num_irq);
598 
599     vec = &s->vectors[pending];
600 
601     assert(vec->enabled);
602     assert(vec->pending);
603 
604     assert(s->vectpending_prio < running);
605 
606     trace_nvic_acknowledge_irq(pending, s->vectpending_prio);
607 
608     vec->active = 1;
609     vec->pending = 0;
610 
611     env->v7m.exception = s->vectpending;
612 
613     nvic_irq_update(s);
614 }
615 
616 int armv7m_nvic_complete_irq(void *opaque, int irq)
617 {
618     NVICState *s = (NVICState *)opaque;
619     VecInfo *vec;
620     int ret;
621 
622     assert(irq > ARMV7M_EXCP_RESET && irq < s->num_irq);
623 
624     vec = &s->vectors[irq];
625 
626     trace_nvic_complete_irq(irq);
627 
628     if (!vec->active) {
629         /* Tell the caller this was an illegal exception return */
630         return -1;
631     }
632 
633     ret = nvic_rettobase(s);
634 
635     vec->active = 0;
636     if (vec->level) {
637         /* Re-pend the exception if it's still held high; only
638          * happens for extenal IRQs
639          */
640         assert(irq >= NVIC_FIRST_IRQ);
641         vec->pending = 1;
642     }
643 
644     nvic_irq_update(s);
645 
646     return ret;
647 }
648 
649 /* callback when external interrupt line is changed */
650 static void set_irq_level(void *opaque, int n, int level)
651 {
652     NVICState *s = opaque;
653     VecInfo *vec;
654 
655     n += NVIC_FIRST_IRQ;
656 
657     assert(n >= NVIC_FIRST_IRQ && n < s->num_irq);
658 
659     trace_nvic_set_irq_level(n, level);
660 
661     /* The pending status of an external interrupt is
662      * latched on rising edge and exception handler return.
663      *
664      * Pulsing the IRQ will always run the handler
665      * once, and the handler will re-run until the
666      * level is low when the handler completes.
667      */
668     vec = &s->vectors[n];
669     if (level != vec->level) {
670         vec->level = level;
671         if (level) {
672             armv7m_nvic_set_pending(s, n, false);
673         }
674     }
675 }
676 
677 static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
678 {
679     ARMCPU *cpu = s->cpu;
680     uint32_t val;
681 
682     switch (offset) {
683     case 4: /* Interrupt Control Type.  */
684         return ((s->num_irq - NVIC_FIRST_IRQ) / 32) - 1;
685     case 0x380 ... 0x3bf: /* NVIC_ITNS<n> */
686     {
687         int startvec = 32 * (offset - 0x380) + NVIC_FIRST_IRQ;
688         int i;
689 
690         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
691             goto bad_offset;
692         }
693         if (!attrs.secure) {
694             return 0;
695         }
696         val = 0;
697         for (i = 0; i < 32 && startvec + i < s->num_irq; i++) {
698             if (s->itns[startvec + i]) {
699                 val |= (1 << i);
700             }
701         }
702         return val;
703     }
704     case 0xd00: /* CPUID Base.  */
705         return cpu->midr;
706     case 0xd04: /* Interrupt Control State (ICSR) */
707         /* VECTACTIVE */
708         val = cpu->env.v7m.exception;
709         /* VECTPENDING */
710         val |= (s->vectpending & 0xff) << 12;
711         /* ISRPENDING - set if any external IRQ is pending */
712         if (nvic_isrpending(s)) {
713             val |= (1 << 22);
714         }
715         /* RETTOBASE - set if only one handler is active */
716         if (nvic_rettobase(s)) {
717             val |= (1 << 11);
718         }
719         if (attrs.secure) {
720             /* PENDSTSET */
721             if (s->sec_vectors[ARMV7M_EXCP_SYSTICK].pending) {
722                 val |= (1 << 26);
723             }
724             /* PENDSVSET */
725             if (s->sec_vectors[ARMV7M_EXCP_PENDSV].pending) {
726                 val |= (1 << 28);
727             }
728         } else {
729             /* PENDSTSET */
730             if (s->vectors[ARMV7M_EXCP_SYSTICK].pending) {
731                 val |= (1 << 26);
732             }
733             /* PENDSVSET */
734             if (s->vectors[ARMV7M_EXCP_PENDSV].pending) {
735                 val |= (1 << 28);
736             }
737         }
738         /* NMIPENDSET */
739         if ((cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK) &&
740             s->vectors[ARMV7M_EXCP_NMI].pending) {
741             val |= (1 << 31);
742         }
743         /* ISRPREEMPT: RES0 when halting debug not implemented */
744         /* STTNS: RES0 for the Main Extension */
745         return val;
746     case 0xd08: /* Vector Table Offset.  */
747         return cpu->env.v7m.vecbase[attrs.secure];
748     case 0xd0c: /* Application Interrupt/Reset Control (AIRCR) */
749         val = 0xfa050000 | (s->prigroup[attrs.secure] << 8);
750         if (attrs.secure) {
751             /* s->aircr stores PRIS, BFHFNMINS, SYSRESETREQS */
752             val |= cpu->env.v7m.aircr;
753         } else {
754             if (arm_feature(&cpu->env, ARM_FEATURE_V8)) {
755                 /* BFHFNMINS is R/O from NS; other bits are RAZ/WI. If
756                  * security isn't supported then BFHFNMINS is RAO (and
757                  * the bit in env.v7m.aircr is always set).
758                  */
759                 val |= cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK;
760             }
761         }
762         return val;
763     case 0xd10: /* System Control.  */
764         /* TODO: Implement SLEEPONEXIT.  */
765         return 0;
766     case 0xd14: /* Configuration Control.  */
767         /* The BFHFNMIGN bit is the only non-banked bit; we
768          * keep it in the non-secure copy of the register.
769          */
770         val = cpu->env.v7m.ccr[attrs.secure];
771         val |= cpu->env.v7m.ccr[M_REG_NS] & R_V7M_CCR_BFHFNMIGN_MASK;
772         return val;
773     case 0xd24: /* System Handler Status.  */
774         val = 0;
775         if (s->vectors[ARMV7M_EXCP_MEM].active) {
776             val |= (1 << 0);
777         }
778         if (s->vectors[ARMV7M_EXCP_BUS].active) {
779             val |= (1 << 1);
780         }
781         if (s->vectors[ARMV7M_EXCP_USAGE].active) {
782             val |= (1 << 3);
783         }
784         if (s->vectors[ARMV7M_EXCP_SVC].active) {
785             val |= (1 << 7);
786         }
787         if (s->vectors[ARMV7M_EXCP_DEBUG].active) {
788             val |= (1 << 8);
789         }
790         if (s->vectors[ARMV7M_EXCP_PENDSV].active) {
791             val |= (1 << 10);
792         }
793         if (s->vectors[ARMV7M_EXCP_SYSTICK].active) {
794             val |= (1 << 11);
795         }
796         if (s->vectors[ARMV7M_EXCP_USAGE].pending) {
797             val |= (1 << 12);
798         }
799         if (s->vectors[ARMV7M_EXCP_MEM].pending) {
800             val |= (1 << 13);
801         }
802         if (s->vectors[ARMV7M_EXCP_BUS].pending) {
803             val |= (1 << 14);
804         }
805         if (s->vectors[ARMV7M_EXCP_SVC].pending) {
806             val |= (1 << 15);
807         }
808         if (s->vectors[ARMV7M_EXCP_MEM].enabled) {
809             val |= (1 << 16);
810         }
811         if (s->vectors[ARMV7M_EXCP_BUS].enabled) {
812             val |= (1 << 17);
813         }
814         if (s->vectors[ARMV7M_EXCP_USAGE].enabled) {
815             val |= (1 << 18);
816         }
817         return val;
818     case 0xd28: /* Configurable Fault Status.  */
819         /* The BFSR bits [15:8] are shared between security states
820          * and we store them in the NS copy
821          */
822         val = cpu->env.v7m.cfsr[attrs.secure];
823         val |= cpu->env.v7m.cfsr[M_REG_NS] & R_V7M_CFSR_BFSR_MASK;
824         return val;
825     case 0xd2c: /* Hard Fault Status.  */
826         return cpu->env.v7m.hfsr;
827     case 0xd30: /* Debug Fault Status.  */
828         return cpu->env.v7m.dfsr;
829     case 0xd34: /* MMFAR MemManage Fault Address */
830         return cpu->env.v7m.mmfar[attrs.secure];
831     case 0xd38: /* Bus Fault Address.  */
832         return cpu->env.v7m.bfar;
833     case 0xd3c: /* Aux Fault Status.  */
834         /* TODO: Implement fault status registers.  */
835         qemu_log_mask(LOG_UNIMP,
836                       "Aux Fault status registers unimplemented\n");
837         return 0;
838     case 0xd40: /* PFR0.  */
839         return 0x00000030;
840     case 0xd44: /* PRF1.  */
841         return 0x00000200;
842     case 0xd48: /* DFR0.  */
843         return 0x00100000;
844     case 0xd4c: /* AFR0.  */
845         return 0x00000000;
846     case 0xd50: /* MMFR0.  */
847         return 0x00000030;
848     case 0xd54: /* MMFR1.  */
849         return 0x00000000;
850     case 0xd58: /* MMFR2.  */
851         return 0x00000000;
852     case 0xd5c: /* MMFR3.  */
853         return 0x00000000;
854     case 0xd60: /* ISAR0.  */
855         return 0x01141110;
856     case 0xd64: /* ISAR1.  */
857         return 0x02111000;
858     case 0xd68: /* ISAR2.  */
859         return 0x21112231;
860     case 0xd6c: /* ISAR3.  */
861         return 0x01111110;
862     case 0xd70: /* ISAR4.  */
863         return 0x01310102;
864     /* TODO: Implement debug registers.  */
865     case 0xd90: /* MPU_TYPE */
866         /* Unified MPU; if the MPU is not present this value is zero */
867         return cpu->pmsav7_dregion << 8;
868         break;
869     case 0xd94: /* MPU_CTRL */
870         return cpu->env.v7m.mpu_ctrl[attrs.secure];
871     case 0xd98: /* MPU_RNR */
872         return cpu->env.pmsav7.rnr[attrs.secure];
873     case 0xd9c: /* MPU_RBAR */
874     case 0xda4: /* MPU_RBAR_A1 */
875     case 0xdac: /* MPU_RBAR_A2 */
876     case 0xdb4: /* MPU_RBAR_A3 */
877     {
878         int region = cpu->env.pmsav7.rnr[attrs.secure];
879 
880         if (arm_feature(&cpu->env, ARM_FEATURE_V8)) {
881             /* PMSAv8M handling of the aliases is different from v7M:
882              * aliases A1, A2, A3 override the low two bits of the region
883              * number in MPU_RNR, and there is no 'region' field in the
884              * RBAR register.
885              */
886             int aliasno = (offset - 0xd9c) / 8; /* 0..3 */
887             if (aliasno) {
888                 region = deposit32(region, 0, 2, aliasno);
889             }
890             if (region >= cpu->pmsav7_dregion) {
891                 return 0;
892             }
893             return cpu->env.pmsav8.rbar[attrs.secure][region];
894         }
895 
896         if (region >= cpu->pmsav7_dregion) {
897             return 0;
898         }
899         return (cpu->env.pmsav7.drbar[region] & 0x1f) | (region & 0xf);
900     }
901     case 0xda0: /* MPU_RASR (v7M), MPU_RLAR (v8M) */
902     case 0xda8: /* MPU_RASR_A1 (v7M), MPU_RLAR_A1 (v8M) */
903     case 0xdb0: /* MPU_RASR_A2 (v7M), MPU_RLAR_A2 (v8M) */
904     case 0xdb8: /* MPU_RASR_A3 (v7M), MPU_RLAR_A3 (v8M) */
905     {
906         int region = cpu->env.pmsav7.rnr[attrs.secure];
907 
908         if (arm_feature(&cpu->env, ARM_FEATURE_V8)) {
909             /* PMSAv8M handling of the aliases is different from v7M:
910              * aliases A1, A2, A3 override the low two bits of the region
911              * number in MPU_RNR.
912              */
913             int aliasno = (offset - 0xda0) / 8; /* 0..3 */
914             if (aliasno) {
915                 region = deposit32(region, 0, 2, aliasno);
916             }
917             if (region >= cpu->pmsav7_dregion) {
918                 return 0;
919             }
920             return cpu->env.pmsav8.rlar[attrs.secure][region];
921         }
922 
923         if (region >= cpu->pmsav7_dregion) {
924             return 0;
925         }
926         return ((cpu->env.pmsav7.dracr[region] & 0xffff) << 16) |
927             (cpu->env.pmsav7.drsr[region] & 0xffff);
928     }
929     case 0xdc0: /* MPU_MAIR0 */
930         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
931             goto bad_offset;
932         }
933         return cpu->env.pmsav8.mair0[attrs.secure];
934     case 0xdc4: /* MPU_MAIR1 */
935         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
936             goto bad_offset;
937         }
938         return cpu->env.pmsav8.mair1[attrs.secure];
939     default:
940     bad_offset:
941         qemu_log_mask(LOG_GUEST_ERROR, "NVIC: Bad read offset 0x%x\n", offset);
942         return 0;
943     }
944 }
945 
946 static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value,
947                         MemTxAttrs attrs)
948 {
949     ARMCPU *cpu = s->cpu;
950 
951     switch (offset) {
952     case 0x380 ... 0x3bf: /* NVIC_ITNS<n> */
953     {
954         int startvec = 32 * (offset - 0x380) + NVIC_FIRST_IRQ;
955         int i;
956 
957         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
958             goto bad_offset;
959         }
960         if (!attrs.secure) {
961             break;
962         }
963         for (i = 0; i < 32 && startvec + i < s->num_irq; i++) {
964             s->itns[startvec + i] = (value >> i) & 1;
965         }
966         nvic_irq_update(s);
967         break;
968     }
969     case 0xd04: /* Interrupt Control State (ICSR) */
970         if (cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK) {
971             if (value & (1 << 31)) {
972                 armv7m_nvic_set_pending(s, ARMV7M_EXCP_NMI, false);
973             } else if (value & (1 << 30) &&
974                        arm_feature(&cpu->env, ARM_FEATURE_V8)) {
975                 /* PENDNMICLR didn't exist in v7M */
976                 armv7m_nvic_clear_pending(s, ARMV7M_EXCP_NMI, false);
977             }
978         }
979         if (value & (1 << 28)) {
980             armv7m_nvic_set_pending(s, ARMV7M_EXCP_PENDSV, attrs.secure);
981         } else if (value & (1 << 27)) {
982             armv7m_nvic_clear_pending(s, ARMV7M_EXCP_PENDSV, attrs.secure);
983         }
984         if (value & (1 << 26)) {
985             armv7m_nvic_set_pending(s, ARMV7M_EXCP_SYSTICK, attrs.secure);
986         } else if (value & (1 << 25)) {
987             armv7m_nvic_clear_pending(s, ARMV7M_EXCP_SYSTICK, attrs.secure);
988         }
989         break;
990     case 0xd08: /* Vector Table Offset.  */
991         cpu->env.v7m.vecbase[attrs.secure] = value & 0xffffff80;
992         break;
993     case 0xd0c: /* Application Interrupt/Reset Control (AIRCR) */
994         if ((value >> R_V7M_AIRCR_VECTKEY_SHIFT) == 0x05fa) {
995             if (value & R_V7M_AIRCR_SYSRESETREQ_MASK) {
996                 if (attrs.secure ||
997                     !(cpu->env.v7m.aircr & R_V7M_AIRCR_SYSRESETREQS_MASK)) {
998                     qemu_irq_pulse(s->sysresetreq);
999                 }
1000             }
1001             if (value & R_V7M_AIRCR_VECTCLRACTIVE_MASK) {
1002                 qemu_log_mask(LOG_GUEST_ERROR,
1003                               "Setting VECTCLRACTIVE when not in DEBUG mode "
1004                               "is UNPREDICTABLE\n");
1005             }
1006             if (value & R_V7M_AIRCR_VECTRESET_MASK) {
1007                 /* NB: this bit is RES0 in v8M */
1008                 qemu_log_mask(LOG_GUEST_ERROR,
1009                               "Setting VECTRESET when not in DEBUG mode "
1010                               "is UNPREDICTABLE\n");
1011             }
1012             s->prigroup[attrs.secure] = extract32(value,
1013                                                   R_V7M_AIRCR_PRIGROUP_SHIFT,
1014                                                   R_V7M_AIRCR_PRIGROUP_LENGTH);
1015             if (attrs.secure) {
1016                 /* These bits are only writable by secure */
1017                 cpu->env.v7m.aircr = value &
1018                     (R_V7M_AIRCR_SYSRESETREQS_MASK |
1019                      R_V7M_AIRCR_BFHFNMINS_MASK |
1020                      R_V7M_AIRCR_PRIS_MASK);
1021                 /* BFHFNMINS changes the priority of Secure HardFault, and
1022                  * allows a pending Non-secure HardFault to preempt (which
1023                  * we implement by marking it enabled).
1024                  */
1025                 if (cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK) {
1026                     s->sec_vectors[ARMV7M_EXCP_HARD].prio = -3;
1027                     s->vectors[ARMV7M_EXCP_HARD].enabled = 1;
1028                 } else {
1029                     s->sec_vectors[ARMV7M_EXCP_HARD].prio = -1;
1030                     s->vectors[ARMV7M_EXCP_HARD].enabled = 0;
1031                 }
1032             }
1033             nvic_irq_update(s);
1034         }
1035         break;
1036     case 0xd10: /* System Control.  */
1037         /* TODO: Implement control registers.  */
1038         qemu_log_mask(LOG_UNIMP, "NVIC: SCR unimplemented\n");
1039         break;
1040     case 0xd14: /* Configuration Control.  */
1041         /* Enforce RAZ/WI on reserved and must-RAZ/WI bits */
1042         value &= (R_V7M_CCR_STKALIGN_MASK |
1043                   R_V7M_CCR_BFHFNMIGN_MASK |
1044                   R_V7M_CCR_DIV_0_TRP_MASK |
1045                   R_V7M_CCR_UNALIGN_TRP_MASK |
1046                   R_V7M_CCR_USERSETMPEND_MASK |
1047                   R_V7M_CCR_NONBASETHRDENA_MASK);
1048 
1049         if (arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1050             /* v8M makes NONBASETHRDENA and STKALIGN be RES1 */
1051             value |= R_V7M_CCR_NONBASETHRDENA_MASK
1052                 | R_V7M_CCR_STKALIGN_MASK;
1053         }
1054         if (attrs.secure) {
1055             /* the BFHFNMIGN bit is not banked; keep that in the NS copy */
1056             cpu->env.v7m.ccr[M_REG_NS] =
1057                 (cpu->env.v7m.ccr[M_REG_NS] & ~R_V7M_CCR_BFHFNMIGN_MASK)
1058                 | (value & R_V7M_CCR_BFHFNMIGN_MASK);
1059             value &= ~R_V7M_CCR_BFHFNMIGN_MASK;
1060         }
1061 
1062         cpu->env.v7m.ccr[attrs.secure] = value;
1063         break;
1064     case 0xd24: /* System Handler Control.  */
1065         s->vectors[ARMV7M_EXCP_MEM].active = (value & (1 << 0)) != 0;
1066         s->vectors[ARMV7M_EXCP_BUS].active = (value & (1 << 1)) != 0;
1067         s->vectors[ARMV7M_EXCP_USAGE].active = (value & (1 << 3)) != 0;
1068         s->vectors[ARMV7M_EXCP_SVC].active = (value & (1 << 7)) != 0;
1069         s->vectors[ARMV7M_EXCP_DEBUG].active = (value & (1 << 8)) != 0;
1070         s->vectors[ARMV7M_EXCP_PENDSV].active = (value & (1 << 10)) != 0;
1071         s->vectors[ARMV7M_EXCP_SYSTICK].active = (value & (1 << 11)) != 0;
1072         s->vectors[ARMV7M_EXCP_USAGE].pending = (value & (1 << 12)) != 0;
1073         s->vectors[ARMV7M_EXCP_MEM].pending = (value & (1 << 13)) != 0;
1074         s->vectors[ARMV7M_EXCP_BUS].pending = (value & (1 << 14)) != 0;
1075         s->vectors[ARMV7M_EXCP_SVC].pending = (value & (1 << 15)) != 0;
1076         s->vectors[ARMV7M_EXCP_MEM].enabled = (value & (1 << 16)) != 0;
1077         s->vectors[ARMV7M_EXCP_BUS].enabled = (value & (1 << 17)) != 0;
1078         s->vectors[ARMV7M_EXCP_USAGE].enabled = (value & (1 << 18)) != 0;
1079         nvic_irq_update(s);
1080         break;
1081     case 0xd28: /* Configurable Fault Status.  */
1082         cpu->env.v7m.cfsr[attrs.secure] &= ~value; /* W1C */
1083         if (attrs.secure) {
1084             /* The BFSR bits [15:8] are shared between security states
1085              * and we store them in the NS copy.
1086              */
1087             cpu->env.v7m.cfsr[M_REG_NS] &= ~(value & R_V7M_CFSR_BFSR_MASK);
1088         }
1089         break;
1090     case 0xd2c: /* Hard Fault Status.  */
1091         cpu->env.v7m.hfsr &= ~value; /* W1C */
1092         break;
1093     case 0xd30: /* Debug Fault Status.  */
1094         cpu->env.v7m.dfsr &= ~value; /* W1C */
1095         break;
1096     case 0xd34: /* Mem Manage Address.  */
1097         cpu->env.v7m.mmfar[attrs.secure] = value;
1098         return;
1099     case 0xd38: /* Bus Fault Address.  */
1100         cpu->env.v7m.bfar = value;
1101         return;
1102     case 0xd3c: /* Aux Fault Status.  */
1103         qemu_log_mask(LOG_UNIMP,
1104                       "NVIC: Aux fault status registers unimplemented\n");
1105         break;
1106     case 0xd90: /* MPU_TYPE */
1107         return; /* RO */
1108     case 0xd94: /* MPU_CTRL */
1109         if ((value &
1110              (R_V7M_MPU_CTRL_HFNMIENA_MASK | R_V7M_MPU_CTRL_ENABLE_MASK))
1111             == R_V7M_MPU_CTRL_HFNMIENA_MASK) {
1112             qemu_log_mask(LOG_GUEST_ERROR, "MPU_CTRL: HFNMIENA and !ENABLE is "
1113                           "UNPREDICTABLE\n");
1114         }
1115         cpu->env.v7m.mpu_ctrl[attrs.secure]
1116             = value & (R_V7M_MPU_CTRL_ENABLE_MASK |
1117                        R_V7M_MPU_CTRL_HFNMIENA_MASK |
1118                        R_V7M_MPU_CTRL_PRIVDEFENA_MASK);
1119         tlb_flush(CPU(cpu));
1120         break;
1121     case 0xd98: /* MPU_RNR */
1122         if (value >= cpu->pmsav7_dregion) {
1123             qemu_log_mask(LOG_GUEST_ERROR, "MPU region out of range %"
1124                           PRIu32 "/%" PRIu32 "\n",
1125                           value, cpu->pmsav7_dregion);
1126         } else {
1127             cpu->env.pmsav7.rnr[attrs.secure] = value;
1128         }
1129         break;
1130     case 0xd9c: /* MPU_RBAR */
1131     case 0xda4: /* MPU_RBAR_A1 */
1132     case 0xdac: /* MPU_RBAR_A2 */
1133     case 0xdb4: /* MPU_RBAR_A3 */
1134     {
1135         int region;
1136 
1137         if (arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1138             /* PMSAv8M handling of the aliases is different from v7M:
1139              * aliases A1, A2, A3 override the low two bits of the region
1140              * number in MPU_RNR, and there is no 'region' field in the
1141              * RBAR register.
1142              */
1143             int aliasno = (offset - 0xd9c) / 8; /* 0..3 */
1144 
1145             region = cpu->env.pmsav7.rnr[attrs.secure];
1146             if (aliasno) {
1147                 region = deposit32(region, 0, 2, aliasno);
1148             }
1149             if (region >= cpu->pmsav7_dregion) {
1150                 return;
1151             }
1152             cpu->env.pmsav8.rbar[attrs.secure][region] = value;
1153             tlb_flush(CPU(cpu));
1154             return;
1155         }
1156 
1157         if (value & (1 << 4)) {
1158             /* VALID bit means use the region number specified in this
1159              * value and also update MPU_RNR.REGION with that value.
1160              */
1161             region = extract32(value, 0, 4);
1162             if (region >= cpu->pmsav7_dregion) {
1163                 qemu_log_mask(LOG_GUEST_ERROR,
1164                               "MPU region out of range %u/%" PRIu32 "\n",
1165                               region, cpu->pmsav7_dregion);
1166                 return;
1167             }
1168             cpu->env.pmsav7.rnr[attrs.secure] = region;
1169         } else {
1170             region = cpu->env.pmsav7.rnr[attrs.secure];
1171         }
1172 
1173         if (region >= cpu->pmsav7_dregion) {
1174             return;
1175         }
1176 
1177         cpu->env.pmsav7.drbar[region] = value & ~0x1f;
1178         tlb_flush(CPU(cpu));
1179         break;
1180     }
1181     case 0xda0: /* MPU_RASR (v7M), MPU_RLAR (v8M) */
1182     case 0xda8: /* MPU_RASR_A1 (v7M), MPU_RLAR_A1 (v8M) */
1183     case 0xdb0: /* MPU_RASR_A2 (v7M), MPU_RLAR_A2 (v8M) */
1184     case 0xdb8: /* MPU_RASR_A3 (v7M), MPU_RLAR_A3 (v8M) */
1185     {
1186         int region = cpu->env.pmsav7.rnr[attrs.secure];
1187 
1188         if (arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1189             /* PMSAv8M handling of the aliases is different from v7M:
1190              * aliases A1, A2, A3 override the low two bits of the region
1191              * number in MPU_RNR.
1192              */
1193             int aliasno = (offset - 0xd9c) / 8; /* 0..3 */
1194 
1195             region = cpu->env.pmsav7.rnr[attrs.secure];
1196             if (aliasno) {
1197                 region = deposit32(region, 0, 2, aliasno);
1198             }
1199             if (region >= cpu->pmsav7_dregion) {
1200                 return;
1201             }
1202             cpu->env.pmsav8.rlar[attrs.secure][region] = value;
1203             tlb_flush(CPU(cpu));
1204             return;
1205         }
1206 
1207         if (region >= cpu->pmsav7_dregion) {
1208             return;
1209         }
1210 
1211         cpu->env.pmsav7.drsr[region] = value & 0xff3f;
1212         cpu->env.pmsav7.dracr[region] = (value >> 16) & 0x173f;
1213         tlb_flush(CPU(cpu));
1214         break;
1215     }
1216     case 0xdc0: /* MPU_MAIR0 */
1217         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1218             goto bad_offset;
1219         }
1220         if (cpu->pmsav7_dregion) {
1221             /* Register is RES0 if no MPU regions are implemented */
1222             cpu->env.pmsav8.mair0[attrs.secure] = value;
1223         }
1224         /* We don't need to do anything else because memory attributes
1225          * only affect cacheability, and we don't implement caching.
1226          */
1227         break;
1228     case 0xdc4: /* MPU_MAIR1 */
1229         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1230             goto bad_offset;
1231         }
1232         if (cpu->pmsav7_dregion) {
1233             /* Register is RES0 if no MPU regions are implemented */
1234             cpu->env.pmsav8.mair1[attrs.secure] = value;
1235         }
1236         /* We don't need to do anything else because memory attributes
1237          * only affect cacheability, and we don't implement caching.
1238          */
1239         break;
1240     case 0xf00: /* Software Triggered Interrupt Register */
1241     {
1242         int excnum = (value & 0x1ff) + NVIC_FIRST_IRQ;
1243         if (excnum < s->num_irq) {
1244             armv7m_nvic_set_pending(s, excnum, false);
1245         }
1246         break;
1247     }
1248     default:
1249     bad_offset:
1250         qemu_log_mask(LOG_GUEST_ERROR,
1251                       "NVIC: Bad write offset 0x%x\n", offset);
1252     }
1253 }
1254 
1255 static bool nvic_user_access_ok(NVICState *s, hwaddr offset, MemTxAttrs attrs)
1256 {
1257     /* Return true if unprivileged access to this register is permitted. */
1258     switch (offset) {
1259     case 0xf00: /* STIR: accessible only if CCR.USERSETMPEND permits */
1260         /* For access via STIR_NS it is the NS CCR.USERSETMPEND that
1261          * controls access even though the CPU is in Secure state (I_QDKX).
1262          */
1263         return s->cpu->env.v7m.ccr[attrs.secure] & R_V7M_CCR_USERSETMPEND_MASK;
1264     default:
1265         /* All other user accesses cause a BusFault unconditionally */
1266         return false;
1267     }
1268 }
1269 
1270 static int shpr_bank(NVICState *s, int exc, MemTxAttrs attrs)
1271 {
1272     /* Behaviour for the SHPR register field for this exception:
1273      * return M_REG_NS to use the nonsecure vector (including for
1274      * non-banked exceptions), M_REG_S for the secure version of
1275      * a banked exception, and -1 if this field should RAZ/WI.
1276      */
1277     switch (exc) {
1278     case ARMV7M_EXCP_MEM:
1279     case ARMV7M_EXCP_USAGE:
1280     case ARMV7M_EXCP_SVC:
1281     case ARMV7M_EXCP_PENDSV:
1282     case ARMV7M_EXCP_SYSTICK:
1283         /* Banked exceptions */
1284         return attrs.secure;
1285     case ARMV7M_EXCP_BUS:
1286         /* Not banked, RAZ/WI from nonsecure if BFHFNMINS is zero */
1287         if (!attrs.secure &&
1288             !(s->cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK)) {
1289             return -1;
1290         }
1291         return M_REG_NS;
1292     case ARMV7M_EXCP_SECURE:
1293         /* Not banked, RAZ/WI from nonsecure */
1294         if (!attrs.secure) {
1295             return -1;
1296         }
1297         return M_REG_NS;
1298     case ARMV7M_EXCP_DEBUG:
1299         /* Not banked. TODO should RAZ/WI if DEMCR.SDME is set */
1300         return M_REG_NS;
1301     case 8 ... 10:
1302     case 13:
1303         /* RES0 */
1304         return -1;
1305     default:
1306         /* Not reachable due to decode of SHPR register addresses */
1307         g_assert_not_reached();
1308     }
1309 }
1310 
1311 static MemTxResult nvic_sysreg_read(void *opaque, hwaddr addr,
1312                                     uint64_t *data, unsigned size,
1313                                     MemTxAttrs attrs)
1314 {
1315     NVICState *s = (NVICState *)opaque;
1316     uint32_t offset = addr;
1317     unsigned i, startvec, end;
1318     uint32_t val;
1319 
1320     if (attrs.user && !nvic_user_access_ok(s, addr, attrs)) {
1321         /* Generate BusFault for unprivileged accesses */
1322         return MEMTX_ERROR;
1323     }
1324 
1325     switch (offset) {
1326     /* reads of set and clear both return the status */
1327     case 0x100 ... 0x13f: /* NVIC Set enable */
1328         offset += 0x80;
1329         /* fall through */
1330     case 0x180 ... 0x1bf: /* NVIC Clear enable */
1331         val = 0;
1332         startvec = offset - 0x180 + NVIC_FIRST_IRQ; /* vector # */
1333 
1334         for (i = 0, end = size * 8; i < end && startvec + i < s->num_irq; i++) {
1335             if (s->vectors[startvec + i].enabled &&
1336                 (attrs.secure || s->itns[startvec + i])) {
1337                 val |= (1 << i);
1338             }
1339         }
1340         break;
1341     case 0x200 ... 0x23f: /* NVIC Set pend */
1342         offset += 0x80;
1343         /* fall through */
1344     case 0x280 ... 0x2bf: /* NVIC Clear pend */
1345         val = 0;
1346         startvec = offset - 0x280 + NVIC_FIRST_IRQ; /* vector # */
1347         for (i = 0, end = size * 8; i < end && startvec + i < s->num_irq; i++) {
1348             if (s->vectors[startvec + i].pending &&
1349                 (attrs.secure || s->itns[startvec + i])) {
1350                 val |= (1 << i);
1351             }
1352         }
1353         break;
1354     case 0x300 ... 0x33f: /* NVIC Active */
1355         val = 0;
1356         startvec = offset - 0x300 + NVIC_FIRST_IRQ; /* vector # */
1357 
1358         for (i = 0, end = size * 8; i < end && startvec + i < s->num_irq; i++) {
1359             if (s->vectors[startvec + i].active &&
1360                 (attrs.secure || s->itns[startvec + i])) {
1361                 val |= (1 << i);
1362             }
1363         }
1364         break;
1365     case 0x400 ... 0x5ef: /* NVIC Priority */
1366         val = 0;
1367         startvec = offset - 0x400 + NVIC_FIRST_IRQ; /* vector # */
1368 
1369         for (i = 0; i < size && startvec + i < s->num_irq; i++) {
1370             if (attrs.secure || s->itns[startvec + i]) {
1371                 val |= s->vectors[startvec + i].prio << (8 * i);
1372             }
1373         }
1374         break;
1375     case 0xd18 ... 0xd23: /* System Handler Priority (SHPR1, SHPR2, SHPR3) */
1376         val = 0;
1377         for (i = 0; i < size; i++) {
1378             unsigned hdlidx = (offset - 0xd14) + i;
1379             int sbank = shpr_bank(s, hdlidx, attrs);
1380 
1381             if (sbank < 0) {
1382                 continue;
1383             }
1384             val = deposit32(val, i * 8, 8, get_prio(s, hdlidx, sbank));
1385         }
1386         break;
1387     case 0xfe0 ... 0xfff: /* ID.  */
1388         if (offset & 3) {
1389             val = 0;
1390         } else {
1391             val = nvic_id[(offset - 0xfe0) >> 2];
1392         }
1393         break;
1394     default:
1395         if (size == 4) {
1396             val = nvic_readl(s, offset, attrs);
1397         } else {
1398             qemu_log_mask(LOG_GUEST_ERROR,
1399                           "NVIC: Bad read of size %d at offset 0x%x\n",
1400                           size, offset);
1401             val = 0;
1402         }
1403     }
1404 
1405     trace_nvic_sysreg_read(addr, val, size);
1406     *data = val;
1407     return MEMTX_OK;
1408 }
1409 
1410 static MemTxResult nvic_sysreg_write(void *opaque, hwaddr addr,
1411                                      uint64_t value, unsigned size,
1412                                      MemTxAttrs attrs)
1413 {
1414     NVICState *s = (NVICState *)opaque;
1415     uint32_t offset = addr;
1416     unsigned i, startvec, end;
1417     unsigned setval = 0;
1418 
1419     trace_nvic_sysreg_write(addr, value, size);
1420 
1421     if (attrs.user && !nvic_user_access_ok(s, addr, attrs)) {
1422         /* Generate BusFault for unprivileged accesses */
1423         return MEMTX_ERROR;
1424     }
1425 
1426     switch (offset) {
1427     case 0x100 ... 0x13f: /* NVIC Set enable */
1428         offset += 0x80;
1429         setval = 1;
1430         /* fall through */
1431     case 0x180 ... 0x1bf: /* NVIC Clear enable */
1432         startvec = 8 * (offset - 0x180) + NVIC_FIRST_IRQ;
1433 
1434         for (i = 0, end = size * 8; i < end && startvec + i < s->num_irq; i++) {
1435             if (value & (1 << i) &&
1436                 (attrs.secure || s->itns[startvec + i])) {
1437                 s->vectors[startvec + i].enabled = setval;
1438             }
1439         }
1440         nvic_irq_update(s);
1441         return MEMTX_OK;
1442     case 0x200 ... 0x23f: /* NVIC Set pend */
1443         /* the special logic in armv7m_nvic_set_pending()
1444          * is not needed since IRQs are never escalated
1445          */
1446         offset += 0x80;
1447         setval = 1;
1448         /* fall through */
1449     case 0x280 ... 0x2bf: /* NVIC Clear pend */
1450         startvec = 8 * (offset - 0x280) + NVIC_FIRST_IRQ; /* vector # */
1451 
1452         for (i = 0, end = size * 8; i < end && startvec + i < s->num_irq; i++) {
1453             if (value & (1 << i) &&
1454                 (attrs.secure || s->itns[startvec + i])) {
1455                 s->vectors[startvec + i].pending = setval;
1456             }
1457         }
1458         nvic_irq_update(s);
1459         return MEMTX_OK;
1460     case 0x300 ... 0x33f: /* NVIC Active */
1461         return MEMTX_OK; /* R/O */
1462     case 0x400 ... 0x5ef: /* NVIC Priority */
1463         startvec = 8 * (offset - 0x400) + NVIC_FIRST_IRQ; /* vector # */
1464 
1465         for (i = 0; i < size && startvec + i < s->num_irq; i++) {
1466             if (attrs.secure || s->itns[startvec + i]) {
1467                 set_prio(s, startvec + i, false, (value >> (i * 8)) & 0xff);
1468             }
1469         }
1470         nvic_irq_update(s);
1471         return MEMTX_OK;
1472     case 0xd18 ... 0xd23: /* System Handler Priority (SHPR1, SHPR2, SHPR3) */
1473         for (i = 0; i < size; i++) {
1474             unsigned hdlidx = (offset - 0xd14) + i;
1475             int newprio = extract32(value, i * 8, 8);
1476             int sbank = shpr_bank(s, hdlidx, attrs);
1477 
1478             if (sbank < 0) {
1479                 continue;
1480             }
1481             set_prio(s, hdlidx, sbank, newprio);
1482         }
1483         nvic_irq_update(s);
1484         return MEMTX_OK;
1485     }
1486     if (size == 4) {
1487         nvic_writel(s, offset, value, attrs);
1488         return MEMTX_OK;
1489     }
1490     qemu_log_mask(LOG_GUEST_ERROR,
1491                   "NVIC: Bad write of size %d at offset 0x%x\n", size, offset);
1492     /* This is UNPREDICTABLE; treat as RAZ/WI */
1493     return MEMTX_OK;
1494 }
1495 
1496 static const MemoryRegionOps nvic_sysreg_ops = {
1497     .read_with_attrs = nvic_sysreg_read,
1498     .write_with_attrs = nvic_sysreg_write,
1499     .endianness = DEVICE_NATIVE_ENDIAN,
1500 };
1501 
1502 static MemTxResult nvic_sysreg_ns_write(void *opaque, hwaddr addr,
1503                                         uint64_t value, unsigned size,
1504                                         MemTxAttrs attrs)
1505 {
1506     if (attrs.secure) {
1507         /* S accesses to the alias act like NS accesses to the real region */
1508         attrs.secure = 0;
1509         return nvic_sysreg_write(opaque, addr, value, size, attrs);
1510     } else {
1511         /* NS attrs are RAZ/WI for privileged, and BusFault for user */
1512         if (attrs.user) {
1513             return MEMTX_ERROR;
1514         }
1515         return MEMTX_OK;
1516     }
1517 }
1518 
1519 static MemTxResult nvic_sysreg_ns_read(void *opaque, hwaddr addr,
1520                                        uint64_t *data, unsigned size,
1521                                        MemTxAttrs attrs)
1522 {
1523     if (attrs.secure) {
1524         /* S accesses to the alias act like NS accesses to the real region */
1525         attrs.secure = 0;
1526         return nvic_sysreg_read(opaque, addr, data, size, attrs);
1527     } else {
1528         /* NS attrs are RAZ/WI for privileged, and BusFault for user */
1529         if (attrs.user) {
1530             return MEMTX_ERROR;
1531         }
1532         *data = 0;
1533         return MEMTX_OK;
1534     }
1535 }
1536 
1537 static const MemoryRegionOps nvic_sysreg_ns_ops = {
1538     .read_with_attrs = nvic_sysreg_ns_read,
1539     .write_with_attrs = nvic_sysreg_ns_write,
1540     .endianness = DEVICE_NATIVE_ENDIAN,
1541 };
1542 
1543 static int nvic_post_load(void *opaque, int version_id)
1544 {
1545     NVICState *s = opaque;
1546     unsigned i;
1547     int resetprio;
1548 
1549     /* Check for out of range priority settings */
1550     resetprio = arm_feature(&s->cpu->env, ARM_FEATURE_V8) ? -4 : -3;
1551 
1552     if (s->vectors[ARMV7M_EXCP_RESET].prio != resetprio ||
1553         s->vectors[ARMV7M_EXCP_NMI].prio != -2 ||
1554         s->vectors[ARMV7M_EXCP_HARD].prio != -1) {
1555         return 1;
1556     }
1557     for (i = ARMV7M_EXCP_MEM; i < s->num_irq; i++) {
1558         if (s->vectors[i].prio & ~0xff) {
1559             return 1;
1560         }
1561     }
1562 
1563     nvic_recompute_state(s);
1564 
1565     return 0;
1566 }
1567 
1568 static const VMStateDescription vmstate_VecInfo = {
1569     .name = "armv7m_nvic_info",
1570     .version_id = 1,
1571     .minimum_version_id = 1,
1572     .fields = (VMStateField[]) {
1573         VMSTATE_INT16(prio, VecInfo),
1574         VMSTATE_UINT8(enabled, VecInfo),
1575         VMSTATE_UINT8(pending, VecInfo),
1576         VMSTATE_UINT8(active, VecInfo),
1577         VMSTATE_UINT8(level, VecInfo),
1578         VMSTATE_END_OF_LIST()
1579     }
1580 };
1581 
1582 static bool nvic_security_needed(void *opaque)
1583 {
1584     NVICState *s = opaque;
1585 
1586     return arm_feature(&s->cpu->env, ARM_FEATURE_M_SECURITY);
1587 }
1588 
1589 static int nvic_security_post_load(void *opaque, int version_id)
1590 {
1591     NVICState *s = opaque;
1592     int i;
1593 
1594     /* Check for out of range priority settings */
1595     if (s->sec_vectors[ARMV7M_EXCP_HARD].prio != -1
1596         && s->sec_vectors[ARMV7M_EXCP_HARD].prio != -3) {
1597         /* We can't cross-check against AIRCR.BFHFNMINS as we don't know
1598          * if the CPU state has been migrated yet; a mismatch won't
1599          * cause the emulation to blow up, though.
1600          */
1601         return 1;
1602     }
1603     for (i = ARMV7M_EXCP_MEM; i < ARRAY_SIZE(s->sec_vectors); i++) {
1604         if (s->sec_vectors[i].prio & ~0xff) {
1605             return 1;
1606         }
1607     }
1608     return 0;
1609 }
1610 
1611 static const VMStateDescription vmstate_nvic_security = {
1612     .name = "nvic/m-security",
1613     .version_id = 1,
1614     .minimum_version_id = 1,
1615     .needed = nvic_security_needed,
1616     .post_load = &nvic_security_post_load,
1617     .fields = (VMStateField[]) {
1618         VMSTATE_STRUCT_ARRAY(sec_vectors, NVICState, NVIC_INTERNAL_VECTORS, 1,
1619                              vmstate_VecInfo, VecInfo),
1620         VMSTATE_UINT32(prigroup[M_REG_S], NVICState),
1621         VMSTATE_BOOL_ARRAY(itns, NVICState, NVIC_MAX_VECTORS),
1622         VMSTATE_END_OF_LIST()
1623     }
1624 };
1625 
1626 static const VMStateDescription vmstate_nvic = {
1627     .name = "armv7m_nvic",
1628     .version_id = 4,
1629     .minimum_version_id = 4,
1630     .post_load = &nvic_post_load,
1631     .fields = (VMStateField[]) {
1632         VMSTATE_STRUCT_ARRAY(vectors, NVICState, NVIC_MAX_VECTORS, 1,
1633                              vmstate_VecInfo, VecInfo),
1634         VMSTATE_UINT32(prigroup[M_REG_NS], NVICState),
1635         VMSTATE_END_OF_LIST()
1636     },
1637     .subsections = (const VMStateDescription*[]) {
1638         &vmstate_nvic_security,
1639         NULL
1640     }
1641 };
1642 
1643 static Property props_nvic[] = {
1644     /* Number of external IRQ lines (so excluding the 16 internal exceptions) */
1645     DEFINE_PROP_UINT32("num-irq", NVICState, num_irq, 64),
1646     DEFINE_PROP_END_OF_LIST()
1647 };
1648 
1649 static void armv7m_nvic_reset(DeviceState *dev)
1650 {
1651     int resetprio;
1652     NVICState *s = NVIC(dev);
1653 
1654     s->vectors[ARMV7M_EXCP_NMI].enabled = 1;
1655     /* MEM, BUS, and USAGE are enabled through
1656      * the System Handler Control register
1657      */
1658     s->vectors[ARMV7M_EXCP_SVC].enabled = 1;
1659     s->vectors[ARMV7M_EXCP_DEBUG].enabled = 1;
1660     s->vectors[ARMV7M_EXCP_PENDSV].enabled = 1;
1661     s->vectors[ARMV7M_EXCP_SYSTICK].enabled = 1;
1662 
1663     resetprio = arm_feature(&s->cpu->env, ARM_FEATURE_V8) ? -4 : -3;
1664     s->vectors[ARMV7M_EXCP_RESET].prio = resetprio;
1665     s->vectors[ARMV7M_EXCP_NMI].prio = -2;
1666     s->vectors[ARMV7M_EXCP_HARD].prio = -1;
1667 
1668     if (arm_feature(&s->cpu->env, ARM_FEATURE_M_SECURITY)) {
1669         s->sec_vectors[ARMV7M_EXCP_HARD].enabled = 1;
1670         s->sec_vectors[ARMV7M_EXCP_SVC].enabled = 1;
1671         s->sec_vectors[ARMV7M_EXCP_PENDSV].enabled = 1;
1672         s->sec_vectors[ARMV7M_EXCP_SYSTICK].enabled = 1;
1673 
1674         /* AIRCR.BFHFNMINS resets to 0 so Secure HF is priority -1 (R_CMTC) */
1675         s->sec_vectors[ARMV7M_EXCP_HARD].prio = -1;
1676         /* If AIRCR.BFHFNMINS is 0 then NS HF is (effectively) disabled */
1677         s->vectors[ARMV7M_EXCP_HARD].enabled = 0;
1678     } else {
1679         s->vectors[ARMV7M_EXCP_HARD].enabled = 1;
1680     }
1681 
1682     /* Strictly speaking the reset handler should be enabled.
1683      * However, we don't simulate soft resets through the NVIC,
1684      * and the reset vector should never be pended.
1685      * So we leave it disabled to catch logic errors.
1686      */
1687 
1688     s->exception_prio = NVIC_NOEXC_PRIO;
1689     s->vectpending = 0;
1690     s->vectpending_is_s_banked = false;
1691     s->vectpending_prio = NVIC_NOEXC_PRIO;
1692 
1693     if (arm_feature(&s->cpu->env, ARM_FEATURE_M_SECURITY)) {
1694         memset(s->itns, 0, sizeof(s->itns));
1695     } else {
1696         /* This state is constant and not guest accessible in a non-security
1697          * NVIC; we set the bits to true to avoid having to do a feature
1698          * bit check in the NVIC enable/pend/etc register accessors.
1699          */
1700         int i;
1701 
1702         for (i = NVIC_FIRST_IRQ; i < ARRAY_SIZE(s->itns); i++) {
1703             s->itns[i] = true;
1704         }
1705     }
1706 }
1707 
1708 static void nvic_systick_trigger(void *opaque, int n, int level)
1709 {
1710     NVICState *s = opaque;
1711 
1712     if (level) {
1713         /* SysTick just asked us to pend its exception.
1714          * (This is different from an external interrupt line's
1715          * behaviour.)
1716          * TODO: when we implement the banked systicks we must make
1717          * this pend the correct banked exception.
1718          */
1719         armv7m_nvic_set_pending(s, ARMV7M_EXCP_SYSTICK, false);
1720     }
1721 }
1722 
1723 static void armv7m_nvic_realize(DeviceState *dev, Error **errp)
1724 {
1725     NVICState *s = NVIC(dev);
1726     SysBusDevice *systick_sbd;
1727     Error *err = NULL;
1728     int regionlen;
1729 
1730     s->cpu = ARM_CPU(qemu_get_cpu(0));
1731     assert(s->cpu);
1732 
1733     if (s->num_irq > NVIC_MAX_IRQ) {
1734         error_setg(errp, "num-irq %d exceeds NVIC maximum", s->num_irq);
1735         return;
1736     }
1737 
1738     qdev_init_gpio_in(dev, set_irq_level, s->num_irq);
1739 
1740     /* include space for internal exception vectors */
1741     s->num_irq += NVIC_FIRST_IRQ;
1742 
1743     object_property_set_bool(OBJECT(&s->systick), true, "realized", &err);
1744     if (err != NULL) {
1745         error_propagate(errp, err);
1746         return;
1747     }
1748     systick_sbd = SYS_BUS_DEVICE(&s->systick);
1749     sysbus_connect_irq(systick_sbd, 0,
1750                        qdev_get_gpio_in_named(dev, "systick-trigger", 0));
1751 
1752     /* The NVIC and System Control Space (SCS) starts at 0xe000e000
1753      * and looks like this:
1754      *  0x004 - ICTR
1755      *  0x010 - 0xff - systick
1756      *  0x100..0x7ec - NVIC
1757      *  0x7f0..0xcff - Reserved
1758      *  0xd00..0xd3c - SCS registers
1759      *  0xd40..0xeff - Reserved or Not implemented
1760      *  0xf00 - STIR
1761      *
1762      * Some registers within this space are banked between security states.
1763      * In v8M there is a second range 0xe002e000..0xe002efff which is the
1764      * NonSecure alias SCS; secure accesses to this behave like NS accesses
1765      * to the main SCS range, and non-secure accesses (including when
1766      * the security extension is not implemented) are RAZ/WI.
1767      * Note that both the main SCS range and the alias range are defined
1768      * to be exempt from memory attribution (R_BLJT) and so the memory
1769      * transaction attribute always matches the current CPU security
1770      * state (attrs.secure == env->v7m.secure). In the nvic_sysreg_ns_ops
1771      * wrappers we change attrs.secure to indicate the NS access; so
1772      * generally code determining which banked register to use should
1773      * use attrs.secure; code determining actual behaviour of the system
1774      * should use env->v7m.secure.
1775      */
1776     regionlen = arm_feature(&s->cpu->env, ARM_FEATURE_V8) ? 0x21000 : 0x1000;
1777     memory_region_init(&s->container, OBJECT(s), "nvic", regionlen);
1778     /* The system register region goes at the bottom of the priority
1779      * stack as it covers the whole page.
1780      */
1781     memory_region_init_io(&s->sysregmem, OBJECT(s), &nvic_sysreg_ops, s,
1782                           "nvic_sysregs", 0x1000);
1783     memory_region_add_subregion(&s->container, 0, &s->sysregmem);
1784     memory_region_add_subregion_overlap(&s->container, 0x10,
1785                                         sysbus_mmio_get_region(systick_sbd, 0),
1786                                         1);
1787 
1788     if (arm_feature(&s->cpu->env, ARM_FEATURE_V8)) {
1789         memory_region_init_io(&s->sysreg_ns_mem, OBJECT(s),
1790                               &nvic_sysreg_ns_ops, s,
1791                               "nvic_sysregs_ns", 0x1000);
1792         memory_region_add_subregion(&s->container, 0x20000, &s->sysreg_ns_mem);
1793     }
1794 
1795     sysbus_init_mmio(SYS_BUS_DEVICE(dev), &s->container);
1796 }
1797 
1798 static void armv7m_nvic_instance_init(Object *obj)
1799 {
1800     /* We have a different default value for the num-irq property
1801      * than our superclass. This function runs after qdev init
1802      * has set the defaults from the Property array and before
1803      * any user-specified property setting, so just modify the
1804      * value in the GICState struct.
1805      */
1806     DeviceState *dev = DEVICE(obj);
1807     NVICState *nvic = NVIC(obj);
1808     SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
1809 
1810     object_initialize(&nvic->systick, sizeof(nvic->systick), TYPE_SYSTICK);
1811     qdev_set_parent_bus(DEVICE(&nvic->systick), sysbus_get_default());
1812 
1813     sysbus_init_irq(sbd, &nvic->excpout);
1814     qdev_init_gpio_out_named(dev, &nvic->sysresetreq, "SYSRESETREQ", 1);
1815     qdev_init_gpio_in_named(dev, nvic_systick_trigger, "systick-trigger", 1);
1816 }
1817 
1818 static void armv7m_nvic_class_init(ObjectClass *klass, void *data)
1819 {
1820     DeviceClass *dc = DEVICE_CLASS(klass);
1821 
1822     dc->vmsd  = &vmstate_nvic;
1823     dc->props = props_nvic;
1824     dc->reset = armv7m_nvic_reset;
1825     dc->realize = armv7m_nvic_realize;
1826 }
1827 
1828 static const TypeInfo armv7m_nvic_info = {
1829     .name          = TYPE_NVIC,
1830     .parent        = TYPE_SYS_BUS_DEVICE,
1831     .instance_init = armv7m_nvic_instance_init,
1832     .instance_size = sizeof(NVICState),
1833     .class_init    = armv7m_nvic_class_init,
1834     .class_size    = sizeof(SysBusDeviceClass),
1835 };
1836 
1837 static void armv7m_nvic_register_types(void)
1838 {
1839     type_register_static(&armv7m_nvic_info);
1840 }
1841 
1842 type_init(armv7m_nvic_register_types)
1843