xref: /openbmc/qemu/hw/intc/armv7m_nvic.c (revision 5d4791991d4de12e83d44738417c9e964167b6e8)
1 /*
2  * ARM Nested Vectored Interrupt Controller
3  *
4  * Copyright (c) 2006-2007 CodeSourcery.
5  * Written by Paul Brook
6  *
7  * This code is licensed under the GPL.
8  *
9  * The ARMv7M System controller is fairly tightly tied in with the
10  * NVIC.  Much of that is also implemented here.
11  */
12 
13 #include "qemu/osdep.h"
14 #include "qapi/error.h"
15 #include "qemu-common.h"
16 #include "cpu.h"
17 #include "hw/sysbus.h"
18 #include "qemu/timer.h"
19 #include "hw/arm/arm.h"
20 #include "hw/intc/armv7m_nvic.h"
21 #include "target/arm/cpu.h"
22 #include "exec/exec-all.h"
23 #include "qemu/log.h"
24 #include "trace.h"
25 
26 /* IRQ number counting:
27  *
28  * the num-irq property counts the number of external IRQ lines
29  *
30  * NVICState::num_irq counts the total number of exceptions
31  * (external IRQs, the 15 internal exceptions including reset,
32  * and one for the unused exception number 0).
33  *
34  * NVIC_MAX_IRQ is the highest permitted number of external IRQ lines.
35  *
36  * NVIC_MAX_VECTORS is the highest permitted number of exceptions.
37  *
38  * Iterating through all exceptions should typically be done with
39  * for (i = 1; i < s->num_irq; i++) to avoid the unused slot 0.
40  *
41  * The external qemu_irq lines are the NVIC's external IRQ lines,
42  * so line 0 is exception 16.
43  *
44  * In the terminology of the architecture manual, "interrupts" are
45  * a subcategory of exception referring to the external interrupts
46  * (which are exception numbers NVIC_FIRST_IRQ and upward).
47  * For historical reasons QEMU tends to use "interrupt" and
48  * "exception" more or less interchangeably.
49  */
50 #define NVIC_FIRST_IRQ NVIC_INTERNAL_VECTORS
51 #define NVIC_MAX_IRQ (NVIC_MAX_VECTORS - NVIC_FIRST_IRQ)
52 
53 /* Effective running priority of the CPU when no exception is active
54  * (higher than the highest possible priority value)
55  */
56 #define NVIC_NOEXC_PRIO 0x100
57 /* Maximum priority of non-secure exceptions when AIRCR.PRIS is set */
58 #define NVIC_NS_PRIO_LIMIT 0x80
59 
60 static const uint8_t nvic_id[] = {
61     0x00, 0xb0, 0x1b, 0x00, 0x0d, 0xe0, 0x05, 0xb1
62 };
63 
64 static int nvic_pending_prio(NVICState *s)
65 {
66     /* return the group priority of the current pending interrupt,
67      * or NVIC_NOEXC_PRIO if no interrupt is pending
68      */
69     return s->vectpending_prio;
70 }
71 
72 /* Return the value of the ISCR RETTOBASE bit:
73  * 1 if there is exactly one active exception
74  * 0 if there is more than one active exception
75  * UNKNOWN if there are no active exceptions (we choose 1,
76  * which matches the choice Cortex-M3 is documented as making).
77  *
78  * NB: some versions of the documentation talk about this
79  * counting "active exceptions other than the one shown by IPSR";
80  * this is only different in the obscure corner case where guest
81  * code has manually deactivated an exception and is about
82  * to fail an exception-return integrity check. The definition
83  * above is the one from the v8M ARM ARM and is also in line
84  * with the behaviour documented for the Cortex-M3.
85  */
86 static bool nvic_rettobase(NVICState *s)
87 {
88     int irq, nhand = 0;
89     bool check_sec = arm_feature(&s->cpu->env, ARM_FEATURE_M_SECURITY);
90 
91     for (irq = ARMV7M_EXCP_RESET; irq < s->num_irq; irq++) {
92         if (s->vectors[irq].active ||
93             (check_sec && irq < NVIC_INTERNAL_VECTORS &&
94              s->sec_vectors[irq].active)) {
95             nhand++;
96             if (nhand == 2) {
97                 return 0;
98             }
99         }
100     }
101 
102     return 1;
103 }
104 
105 /* Return the value of the ISCR ISRPENDING bit:
106  * 1 if an external interrupt is pending
107  * 0 if no external interrupt is pending
108  */
109 static bool nvic_isrpending(NVICState *s)
110 {
111     int irq;
112 
113     /* We can shortcut if the highest priority pending interrupt
114      * happens to be external or if there is nothing pending.
115      */
116     if (s->vectpending > NVIC_FIRST_IRQ) {
117         return true;
118     }
119     if (s->vectpending == 0) {
120         return false;
121     }
122 
123     for (irq = NVIC_FIRST_IRQ; irq < s->num_irq; irq++) {
124         if (s->vectors[irq].pending) {
125             return true;
126         }
127     }
128     return false;
129 }
130 
131 static bool exc_is_banked(int exc)
132 {
133     /* Return true if this is one of the limited set of exceptions which
134      * are banked (and thus have state in sec_vectors[])
135      */
136     return exc == ARMV7M_EXCP_HARD ||
137         exc == ARMV7M_EXCP_MEM ||
138         exc == ARMV7M_EXCP_USAGE ||
139         exc == ARMV7M_EXCP_SVC ||
140         exc == ARMV7M_EXCP_PENDSV ||
141         exc == ARMV7M_EXCP_SYSTICK;
142 }
143 
144 /* Return a mask word which clears the subpriority bits from
145  * a priority value for an M-profile exception, leaving only
146  * the group priority.
147  */
148 static inline uint32_t nvic_gprio_mask(NVICState *s, bool secure)
149 {
150     return ~0U << (s->prigroup[secure] + 1);
151 }
152 
153 static bool exc_targets_secure(NVICState *s, int exc)
154 {
155     /* Return true if this non-banked exception targets Secure state. */
156     if (!arm_feature(&s->cpu->env, ARM_FEATURE_M_SECURITY)) {
157         return false;
158     }
159 
160     if (exc >= NVIC_FIRST_IRQ) {
161         return !s->itns[exc];
162     }
163 
164     /* Function shouldn't be called for banked exceptions. */
165     assert(!exc_is_banked(exc));
166 
167     switch (exc) {
168     case ARMV7M_EXCP_NMI:
169     case ARMV7M_EXCP_BUS:
170         return !(s->cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK);
171     case ARMV7M_EXCP_SECURE:
172         return true;
173     case ARMV7M_EXCP_DEBUG:
174         /* TODO: controlled by DEMCR.SDME, which we don't yet implement */
175         return false;
176     default:
177         /* reset, and reserved (unused) low exception numbers.
178          * We'll get called by code that loops through all the exception
179          * numbers, but it doesn't matter what we return here as these
180          * non-existent exceptions will never be pended or active.
181          */
182         return true;
183     }
184 }
185 
186 static int exc_group_prio(NVICState *s, int rawprio, bool targets_secure)
187 {
188     /* Return the group priority for this exception, given its raw
189      * (group-and-subgroup) priority value and whether it is targeting
190      * secure state or not.
191      */
192     if (rawprio < 0) {
193         return rawprio;
194     }
195     rawprio &= nvic_gprio_mask(s, targets_secure);
196     /* AIRCR.PRIS causes us to squash all NS priorities into the
197      * lower half of the total range
198      */
199     if (!targets_secure &&
200         (s->cpu->env.v7m.aircr & R_V7M_AIRCR_PRIS_MASK)) {
201         rawprio = (rawprio >> 1) + NVIC_NS_PRIO_LIMIT;
202     }
203     return rawprio;
204 }
205 
206 /* Recompute vectpending and exception_prio for a CPU which implements
207  * the Security extension
208  */
209 static void nvic_recompute_state_secure(NVICState *s)
210 {
211     int i, bank;
212     int pend_prio = NVIC_NOEXC_PRIO;
213     int active_prio = NVIC_NOEXC_PRIO;
214     int pend_irq = 0;
215     bool pending_is_s_banked = false;
216 
217     /* R_CQRV: precedence is by:
218      *  - lowest group priority; if both the same then
219      *  - lowest subpriority; if both the same then
220      *  - lowest exception number; if both the same (ie banked) then
221      *  - secure exception takes precedence
222      * Compare pseudocode RawExecutionPriority.
223      * Annoyingly, now we have two prigroup values (for S and NS)
224      * we can't do the loop comparison on raw priority values.
225      */
226     for (i = 1; i < s->num_irq; i++) {
227         for (bank = M_REG_S; bank >= M_REG_NS; bank--) {
228             VecInfo *vec;
229             int prio;
230             bool targets_secure;
231 
232             if (bank == M_REG_S) {
233                 if (!exc_is_banked(i)) {
234                     continue;
235                 }
236                 vec = &s->sec_vectors[i];
237                 targets_secure = true;
238             } else {
239                 vec = &s->vectors[i];
240                 targets_secure = !exc_is_banked(i) && exc_targets_secure(s, i);
241             }
242 
243             prio = exc_group_prio(s, vec->prio, targets_secure);
244             if (vec->enabled && vec->pending && prio < pend_prio) {
245                 pend_prio = prio;
246                 pend_irq = i;
247                 pending_is_s_banked = (bank == M_REG_S);
248             }
249             if (vec->active && prio < active_prio) {
250                 active_prio = prio;
251             }
252         }
253     }
254 
255     s->vectpending_is_s_banked = pending_is_s_banked;
256     s->vectpending = pend_irq;
257     s->vectpending_prio = pend_prio;
258     s->exception_prio = active_prio;
259 
260     trace_nvic_recompute_state_secure(s->vectpending,
261                                       s->vectpending_is_s_banked,
262                                       s->vectpending_prio,
263                                       s->exception_prio);
264 }
265 
266 /* Recompute vectpending and exception_prio */
267 static void nvic_recompute_state(NVICState *s)
268 {
269     int i;
270     int pend_prio = NVIC_NOEXC_PRIO;
271     int active_prio = NVIC_NOEXC_PRIO;
272     int pend_irq = 0;
273 
274     /* In theory we could write one function that handled both
275      * the "security extension present" and "not present"; however
276      * the security related changes significantly complicate the
277      * recomputation just by themselves and mixing both cases together
278      * would be even worse, so we retain a separate non-secure-only
279      * version for CPUs which don't implement the security extension.
280      */
281     if (arm_feature(&s->cpu->env, ARM_FEATURE_M_SECURITY)) {
282         nvic_recompute_state_secure(s);
283         return;
284     }
285 
286     for (i = 1; i < s->num_irq; i++) {
287         VecInfo *vec = &s->vectors[i];
288 
289         if (vec->enabled && vec->pending && vec->prio < pend_prio) {
290             pend_prio = vec->prio;
291             pend_irq = i;
292         }
293         if (vec->active && vec->prio < active_prio) {
294             active_prio = vec->prio;
295         }
296     }
297 
298     if (active_prio > 0) {
299         active_prio &= nvic_gprio_mask(s, false);
300     }
301 
302     if (pend_prio > 0) {
303         pend_prio &= nvic_gprio_mask(s, false);
304     }
305 
306     s->vectpending = pend_irq;
307     s->vectpending_prio = pend_prio;
308     s->exception_prio = active_prio;
309 
310     trace_nvic_recompute_state(s->vectpending,
311                                s->vectpending_prio,
312                                s->exception_prio);
313 }
314 
315 /* Return the current execution priority of the CPU
316  * (equivalent to the pseudocode ExecutionPriority function).
317  * This is a value between -2 (NMI priority) and NVIC_NOEXC_PRIO.
318  */
319 static inline int nvic_exec_prio(NVICState *s)
320 {
321     CPUARMState *env = &s->cpu->env;
322     int running = NVIC_NOEXC_PRIO;
323 
324     if (env->v7m.basepri[M_REG_NS] > 0) {
325         running = exc_group_prio(s, env->v7m.basepri[M_REG_NS], M_REG_NS);
326     }
327 
328     if (env->v7m.basepri[M_REG_S] > 0) {
329         int basepri = exc_group_prio(s, env->v7m.basepri[M_REG_S], M_REG_S);
330         if (running > basepri) {
331             running = basepri;
332         }
333     }
334 
335     if (env->v7m.primask[M_REG_NS]) {
336         if (env->v7m.aircr & R_V7M_AIRCR_PRIS_MASK) {
337             if (running > NVIC_NS_PRIO_LIMIT) {
338                 running = NVIC_NS_PRIO_LIMIT;
339             }
340         } else {
341             running = 0;
342         }
343     }
344 
345     if (env->v7m.primask[M_REG_S]) {
346         running = 0;
347     }
348 
349     if (env->v7m.faultmask[M_REG_NS]) {
350         if (env->v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK) {
351             running = -1;
352         } else {
353             if (env->v7m.aircr & R_V7M_AIRCR_PRIS_MASK) {
354                 if (running > NVIC_NS_PRIO_LIMIT) {
355                     running = NVIC_NS_PRIO_LIMIT;
356                 }
357             } else {
358                 running = 0;
359             }
360         }
361     }
362 
363     if (env->v7m.faultmask[M_REG_S]) {
364         running = (env->v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK) ? -3 : -1;
365     }
366 
367     /* consider priority of active handler */
368     return MIN(running, s->exception_prio);
369 }
370 
371 bool armv7m_nvic_neg_prio_requested(void *opaque, bool secure)
372 {
373     /* Return true if the requested execution priority is negative
374      * for the specified security state, ie that security state
375      * has an active NMI or HardFault or has set its FAULTMASK.
376      * Note that this is not the same as whether the execution
377      * priority is actually negative (for instance AIRCR.PRIS may
378      * mean we don't allow FAULTMASK_NS to actually make the execution
379      * priority negative). Compare pseudocode IsReqExcPriNeg().
380      */
381     NVICState *s = opaque;
382 
383     if (s->cpu->env.v7m.faultmask[secure]) {
384         return true;
385     }
386 
387     if (secure ? s->sec_vectors[ARMV7M_EXCP_HARD].active :
388         s->vectors[ARMV7M_EXCP_HARD].active) {
389         return true;
390     }
391 
392     if (s->vectors[ARMV7M_EXCP_NMI].active &&
393         exc_targets_secure(s, ARMV7M_EXCP_NMI) == secure) {
394         return true;
395     }
396 
397     return false;
398 }
399 
400 bool armv7m_nvic_can_take_pending_exception(void *opaque)
401 {
402     NVICState *s = opaque;
403 
404     return nvic_exec_prio(s) > nvic_pending_prio(s);
405 }
406 
407 int armv7m_nvic_raw_execution_priority(void *opaque)
408 {
409     NVICState *s = opaque;
410 
411     return s->exception_prio;
412 }
413 
414 /* caller must call nvic_irq_update() after this.
415  * secure indicates the bank to use for banked exceptions (we assert if
416  * we are passed secure=true for a non-banked exception).
417  */
418 static void set_prio(NVICState *s, unsigned irq, bool secure, uint8_t prio)
419 {
420     assert(irq > ARMV7M_EXCP_NMI); /* only use for configurable prios */
421     assert(irq < s->num_irq);
422 
423     if (secure) {
424         assert(exc_is_banked(irq));
425         s->sec_vectors[irq].prio = prio;
426     } else {
427         s->vectors[irq].prio = prio;
428     }
429 
430     trace_nvic_set_prio(irq, secure, prio);
431 }
432 
433 /* Return the current raw priority register value.
434  * secure indicates the bank to use for banked exceptions (we assert if
435  * we are passed secure=true for a non-banked exception).
436  */
437 static int get_prio(NVICState *s, unsigned irq, bool secure)
438 {
439     assert(irq > ARMV7M_EXCP_NMI); /* only use for configurable prios */
440     assert(irq < s->num_irq);
441 
442     if (secure) {
443         assert(exc_is_banked(irq));
444         return s->sec_vectors[irq].prio;
445     } else {
446         return s->vectors[irq].prio;
447     }
448 }
449 
450 /* Recompute state and assert irq line accordingly.
451  * Must be called after changes to:
452  *  vec->active, vec->enabled, vec->pending or vec->prio for any vector
453  *  prigroup
454  */
455 static void nvic_irq_update(NVICState *s)
456 {
457     int lvl;
458     int pend_prio;
459 
460     nvic_recompute_state(s);
461     pend_prio = nvic_pending_prio(s);
462 
463     /* Raise NVIC output if this IRQ would be taken, except that we
464      * ignore the effects of the BASEPRI, FAULTMASK and PRIMASK (which
465      * will be checked for in arm_v7m_cpu_exec_interrupt()); changes
466      * to those CPU registers don't cause us to recalculate the NVIC
467      * pending info.
468      */
469     lvl = (pend_prio < s->exception_prio);
470     trace_nvic_irq_update(s->vectpending, pend_prio, s->exception_prio, lvl);
471     qemu_set_irq(s->excpout, lvl);
472 }
473 
474 /**
475  * armv7m_nvic_clear_pending: mark the specified exception as not pending
476  * @opaque: the NVIC
477  * @irq: the exception number to mark as not pending
478  * @secure: false for non-banked exceptions or for the nonsecure
479  * version of a banked exception, true for the secure version of a banked
480  * exception.
481  *
482  * Marks the specified exception as not pending. Note that we will assert()
483  * if @secure is true and @irq does not specify one of the fixed set
484  * of architecturally banked exceptions.
485  */
486 static void armv7m_nvic_clear_pending(void *opaque, int irq, bool secure)
487 {
488     NVICState *s = (NVICState *)opaque;
489     VecInfo *vec;
490 
491     assert(irq > ARMV7M_EXCP_RESET && irq < s->num_irq);
492 
493     if (secure) {
494         assert(exc_is_banked(irq));
495         vec = &s->sec_vectors[irq];
496     } else {
497         vec = &s->vectors[irq];
498     }
499     trace_nvic_clear_pending(irq, secure, vec->enabled, vec->prio);
500     if (vec->pending) {
501         vec->pending = 0;
502         nvic_irq_update(s);
503     }
504 }
505 
506 void armv7m_nvic_set_pending(void *opaque, int irq, bool secure)
507 {
508     NVICState *s = (NVICState *)opaque;
509     bool banked = exc_is_banked(irq);
510     VecInfo *vec;
511 
512     assert(irq > ARMV7M_EXCP_RESET && irq < s->num_irq);
513     assert(!secure || banked);
514 
515     vec = (banked && secure) ? &s->sec_vectors[irq] : &s->vectors[irq];
516 
517     trace_nvic_set_pending(irq, secure, vec->enabled, vec->prio);
518 
519     if (irq >= ARMV7M_EXCP_HARD && irq < ARMV7M_EXCP_PENDSV) {
520         /* If a synchronous exception is pending then it may be
521          * escalated to HardFault if:
522          *  * it is equal or lower priority to current execution
523          *  * it is disabled
524          * (ie we need to take it immediately but we can't do so).
525          * Asynchronous exceptions (and interrupts) simply remain pending.
526          *
527          * For QEMU, we don't have any imprecise (asynchronous) faults,
528          * so we can assume that PREFETCH_ABORT and DATA_ABORT are always
529          * synchronous.
530          * Debug exceptions are awkward because only Debug exceptions
531          * resulting from the BKPT instruction should be escalated,
532          * but we don't currently implement any Debug exceptions other
533          * than those that result from BKPT, so we treat all debug exceptions
534          * as needing escalation.
535          *
536          * This all means we can identify whether to escalate based only on
537          * the exception number and don't (yet) need the caller to explicitly
538          * tell us whether this exception is synchronous or not.
539          */
540         int running = nvic_exec_prio(s);
541         bool escalate = false;
542 
543         if (exc_group_prio(s, vec->prio, secure) >= running) {
544             trace_nvic_escalate_prio(irq, vec->prio, running);
545             escalate = true;
546         } else if (!vec->enabled) {
547             trace_nvic_escalate_disabled(irq);
548             escalate = true;
549         }
550 
551         if (escalate) {
552 
553             /* We need to escalate this exception to a synchronous HardFault.
554              * If BFHFNMINS is set then we escalate to the banked HF for
555              * the target security state of the original exception; otherwise
556              * we take a Secure HardFault.
557              */
558             irq = ARMV7M_EXCP_HARD;
559             if (arm_feature(&s->cpu->env, ARM_FEATURE_M_SECURITY) &&
560                 (secure ||
561                  !(s->cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK))) {
562                 vec = &s->sec_vectors[irq];
563             } else {
564                 vec = &s->vectors[irq];
565             }
566             if (running <= vec->prio) {
567                 /* We want to escalate to HardFault but we can't take the
568                  * synchronous HardFault at this point either. This is a
569                  * Lockup condition due to a guest bug. We don't model
570                  * Lockup, so report via cpu_abort() instead.
571                  */
572                 cpu_abort(&s->cpu->parent_obj,
573                           "Lockup: can't escalate %d to HardFault "
574                           "(current priority %d)\n", irq, running);
575             }
576 
577             /* HF may be banked but there is only one shared HFSR */
578             s->cpu->env.v7m.hfsr |= R_V7M_HFSR_FORCED_MASK;
579         }
580     }
581 
582     if (!vec->pending) {
583         vec->pending = 1;
584         nvic_irq_update(s);
585     }
586 }
587 
588 /* Make pending IRQ active.  */
589 void armv7m_nvic_acknowledge_irq(void *opaque)
590 {
591     NVICState *s = (NVICState *)opaque;
592     CPUARMState *env = &s->cpu->env;
593     const int pending = s->vectpending;
594     const int running = nvic_exec_prio(s);
595     VecInfo *vec;
596 
597     assert(pending > ARMV7M_EXCP_RESET && pending < s->num_irq);
598 
599     vec = &s->vectors[pending];
600 
601     assert(vec->enabled);
602     assert(vec->pending);
603 
604     assert(s->vectpending_prio < running);
605 
606     trace_nvic_acknowledge_irq(pending, s->vectpending_prio);
607 
608     vec->active = 1;
609     vec->pending = 0;
610 
611     env->v7m.exception = s->vectpending;
612 
613     nvic_irq_update(s);
614 }
615 
616 int armv7m_nvic_complete_irq(void *opaque, int irq)
617 {
618     NVICState *s = (NVICState *)opaque;
619     VecInfo *vec;
620     int ret;
621 
622     assert(irq > ARMV7M_EXCP_RESET && irq < s->num_irq);
623 
624     vec = &s->vectors[irq];
625 
626     trace_nvic_complete_irq(irq);
627 
628     if (!vec->active) {
629         /* Tell the caller this was an illegal exception return */
630         return -1;
631     }
632 
633     ret = nvic_rettobase(s);
634 
635     vec->active = 0;
636     if (vec->level) {
637         /* Re-pend the exception if it's still held high; only
638          * happens for extenal IRQs
639          */
640         assert(irq >= NVIC_FIRST_IRQ);
641         vec->pending = 1;
642     }
643 
644     nvic_irq_update(s);
645 
646     return ret;
647 }
648 
649 /* callback when external interrupt line is changed */
650 static void set_irq_level(void *opaque, int n, int level)
651 {
652     NVICState *s = opaque;
653     VecInfo *vec;
654 
655     n += NVIC_FIRST_IRQ;
656 
657     assert(n >= NVIC_FIRST_IRQ && n < s->num_irq);
658 
659     trace_nvic_set_irq_level(n, level);
660 
661     /* The pending status of an external interrupt is
662      * latched on rising edge and exception handler return.
663      *
664      * Pulsing the IRQ will always run the handler
665      * once, and the handler will re-run until the
666      * level is low when the handler completes.
667      */
668     vec = &s->vectors[n];
669     if (level != vec->level) {
670         vec->level = level;
671         if (level) {
672             armv7m_nvic_set_pending(s, n, false);
673         }
674     }
675 }
676 
677 static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
678 {
679     ARMCPU *cpu = s->cpu;
680     uint32_t val;
681 
682     switch (offset) {
683     case 4: /* Interrupt Control Type.  */
684         return ((s->num_irq - NVIC_FIRST_IRQ) / 32) - 1;
685     case 0x380 ... 0x3bf: /* NVIC_ITNS<n> */
686     {
687         int startvec = 32 * (offset - 0x380) + NVIC_FIRST_IRQ;
688         int i;
689 
690         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
691             goto bad_offset;
692         }
693         if (!attrs.secure) {
694             return 0;
695         }
696         val = 0;
697         for (i = 0; i < 32 && startvec + i < s->num_irq; i++) {
698             if (s->itns[startvec + i]) {
699                 val |= (1 << i);
700             }
701         }
702         return val;
703     }
704     case 0xd00: /* CPUID Base.  */
705         return cpu->midr;
706     case 0xd04: /* Interrupt Control State.  */
707         /* VECTACTIVE */
708         val = cpu->env.v7m.exception;
709         /* VECTPENDING */
710         val |= (s->vectpending & 0xff) << 12;
711         /* ISRPENDING - set if any external IRQ is pending */
712         if (nvic_isrpending(s)) {
713             val |= (1 << 22);
714         }
715         /* RETTOBASE - set if only one handler is active */
716         if (nvic_rettobase(s)) {
717             val |= (1 << 11);
718         }
719         /* PENDSTSET */
720         if (s->vectors[ARMV7M_EXCP_SYSTICK].pending) {
721             val |= (1 << 26);
722         }
723         /* PENDSVSET */
724         if (s->vectors[ARMV7M_EXCP_PENDSV].pending) {
725             val |= (1 << 28);
726         }
727         /* NMIPENDSET */
728         if (s->vectors[ARMV7M_EXCP_NMI].pending) {
729             val |= (1 << 31);
730         }
731         /* ISRPREEMPT not implemented */
732         return val;
733     case 0xd08: /* Vector Table Offset.  */
734         return cpu->env.v7m.vecbase[attrs.secure];
735     case 0xd0c: /* Application Interrupt/Reset Control (AIRCR) */
736         val = 0xfa050000 | (s->prigroup[attrs.secure] << 8);
737         if (attrs.secure) {
738             /* s->aircr stores PRIS, BFHFNMINS, SYSRESETREQS */
739             val |= cpu->env.v7m.aircr;
740         } else {
741             if (arm_feature(&cpu->env, ARM_FEATURE_V8)) {
742                 /* BFHFNMINS is R/O from NS; other bits are RAZ/WI. If
743                  * security isn't supported then BFHFNMINS is RAO (and
744                  * the bit in env.v7m.aircr is always set).
745                  */
746                 val |= cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK;
747             }
748         }
749         return val;
750     case 0xd10: /* System Control.  */
751         /* TODO: Implement SLEEPONEXIT.  */
752         return 0;
753     case 0xd14: /* Configuration Control.  */
754         /* The BFHFNMIGN bit is the only non-banked bit; we
755          * keep it in the non-secure copy of the register.
756          */
757         val = cpu->env.v7m.ccr[attrs.secure];
758         val |= cpu->env.v7m.ccr[M_REG_NS] & R_V7M_CCR_BFHFNMIGN_MASK;
759         return val;
760     case 0xd24: /* System Handler Status.  */
761         val = 0;
762         if (s->vectors[ARMV7M_EXCP_MEM].active) {
763             val |= (1 << 0);
764         }
765         if (s->vectors[ARMV7M_EXCP_BUS].active) {
766             val |= (1 << 1);
767         }
768         if (s->vectors[ARMV7M_EXCP_USAGE].active) {
769             val |= (1 << 3);
770         }
771         if (s->vectors[ARMV7M_EXCP_SVC].active) {
772             val |= (1 << 7);
773         }
774         if (s->vectors[ARMV7M_EXCP_DEBUG].active) {
775             val |= (1 << 8);
776         }
777         if (s->vectors[ARMV7M_EXCP_PENDSV].active) {
778             val |= (1 << 10);
779         }
780         if (s->vectors[ARMV7M_EXCP_SYSTICK].active) {
781             val |= (1 << 11);
782         }
783         if (s->vectors[ARMV7M_EXCP_USAGE].pending) {
784             val |= (1 << 12);
785         }
786         if (s->vectors[ARMV7M_EXCP_MEM].pending) {
787             val |= (1 << 13);
788         }
789         if (s->vectors[ARMV7M_EXCP_BUS].pending) {
790             val |= (1 << 14);
791         }
792         if (s->vectors[ARMV7M_EXCP_SVC].pending) {
793             val |= (1 << 15);
794         }
795         if (s->vectors[ARMV7M_EXCP_MEM].enabled) {
796             val |= (1 << 16);
797         }
798         if (s->vectors[ARMV7M_EXCP_BUS].enabled) {
799             val |= (1 << 17);
800         }
801         if (s->vectors[ARMV7M_EXCP_USAGE].enabled) {
802             val |= (1 << 18);
803         }
804         return val;
805     case 0xd28: /* Configurable Fault Status.  */
806         /* The BFSR bits [15:8] are shared between security states
807          * and we store them in the NS copy
808          */
809         val = cpu->env.v7m.cfsr[attrs.secure];
810         val |= cpu->env.v7m.cfsr[M_REG_NS] & R_V7M_CFSR_BFSR_MASK;
811         return val;
812     case 0xd2c: /* Hard Fault Status.  */
813         return cpu->env.v7m.hfsr;
814     case 0xd30: /* Debug Fault Status.  */
815         return cpu->env.v7m.dfsr;
816     case 0xd34: /* MMFAR MemManage Fault Address */
817         return cpu->env.v7m.mmfar[attrs.secure];
818     case 0xd38: /* Bus Fault Address.  */
819         return cpu->env.v7m.bfar;
820     case 0xd3c: /* Aux Fault Status.  */
821         /* TODO: Implement fault status registers.  */
822         qemu_log_mask(LOG_UNIMP,
823                       "Aux Fault status registers unimplemented\n");
824         return 0;
825     case 0xd40: /* PFR0.  */
826         return 0x00000030;
827     case 0xd44: /* PRF1.  */
828         return 0x00000200;
829     case 0xd48: /* DFR0.  */
830         return 0x00100000;
831     case 0xd4c: /* AFR0.  */
832         return 0x00000000;
833     case 0xd50: /* MMFR0.  */
834         return 0x00000030;
835     case 0xd54: /* MMFR1.  */
836         return 0x00000000;
837     case 0xd58: /* MMFR2.  */
838         return 0x00000000;
839     case 0xd5c: /* MMFR3.  */
840         return 0x00000000;
841     case 0xd60: /* ISAR0.  */
842         return 0x01141110;
843     case 0xd64: /* ISAR1.  */
844         return 0x02111000;
845     case 0xd68: /* ISAR2.  */
846         return 0x21112231;
847     case 0xd6c: /* ISAR3.  */
848         return 0x01111110;
849     case 0xd70: /* ISAR4.  */
850         return 0x01310102;
851     /* TODO: Implement debug registers.  */
852     case 0xd90: /* MPU_TYPE */
853         /* Unified MPU; if the MPU is not present this value is zero */
854         return cpu->pmsav7_dregion << 8;
855         break;
856     case 0xd94: /* MPU_CTRL */
857         return cpu->env.v7m.mpu_ctrl[attrs.secure];
858     case 0xd98: /* MPU_RNR */
859         return cpu->env.pmsav7.rnr[attrs.secure];
860     case 0xd9c: /* MPU_RBAR */
861     case 0xda4: /* MPU_RBAR_A1 */
862     case 0xdac: /* MPU_RBAR_A2 */
863     case 0xdb4: /* MPU_RBAR_A3 */
864     {
865         int region = cpu->env.pmsav7.rnr[attrs.secure];
866 
867         if (arm_feature(&cpu->env, ARM_FEATURE_V8)) {
868             /* PMSAv8M handling of the aliases is different from v7M:
869              * aliases A1, A2, A3 override the low two bits of the region
870              * number in MPU_RNR, and there is no 'region' field in the
871              * RBAR register.
872              */
873             int aliasno = (offset - 0xd9c) / 8; /* 0..3 */
874             if (aliasno) {
875                 region = deposit32(region, 0, 2, aliasno);
876             }
877             if (region >= cpu->pmsav7_dregion) {
878                 return 0;
879             }
880             return cpu->env.pmsav8.rbar[attrs.secure][region];
881         }
882 
883         if (region >= cpu->pmsav7_dregion) {
884             return 0;
885         }
886         return (cpu->env.pmsav7.drbar[region] & 0x1f) | (region & 0xf);
887     }
888     case 0xda0: /* MPU_RASR (v7M), MPU_RLAR (v8M) */
889     case 0xda8: /* MPU_RASR_A1 (v7M), MPU_RLAR_A1 (v8M) */
890     case 0xdb0: /* MPU_RASR_A2 (v7M), MPU_RLAR_A2 (v8M) */
891     case 0xdb8: /* MPU_RASR_A3 (v7M), MPU_RLAR_A3 (v8M) */
892     {
893         int region = cpu->env.pmsav7.rnr[attrs.secure];
894 
895         if (arm_feature(&cpu->env, ARM_FEATURE_V8)) {
896             /* PMSAv8M handling of the aliases is different from v7M:
897              * aliases A1, A2, A3 override the low two bits of the region
898              * number in MPU_RNR.
899              */
900             int aliasno = (offset - 0xda0) / 8; /* 0..3 */
901             if (aliasno) {
902                 region = deposit32(region, 0, 2, aliasno);
903             }
904             if (region >= cpu->pmsav7_dregion) {
905                 return 0;
906             }
907             return cpu->env.pmsav8.rlar[attrs.secure][region];
908         }
909 
910         if (region >= cpu->pmsav7_dregion) {
911             return 0;
912         }
913         return ((cpu->env.pmsav7.dracr[region] & 0xffff) << 16) |
914             (cpu->env.pmsav7.drsr[region] & 0xffff);
915     }
916     case 0xdc0: /* MPU_MAIR0 */
917         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
918             goto bad_offset;
919         }
920         return cpu->env.pmsav8.mair0[attrs.secure];
921     case 0xdc4: /* MPU_MAIR1 */
922         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
923             goto bad_offset;
924         }
925         return cpu->env.pmsav8.mair1[attrs.secure];
926     default:
927     bad_offset:
928         qemu_log_mask(LOG_GUEST_ERROR, "NVIC: Bad read offset 0x%x\n", offset);
929         return 0;
930     }
931 }
932 
933 static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value,
934                         MemTxAttrs attrs)
935 {
936     ARMCPU *cpu = s->cpu;
937 
938     switch (offset) {
939     case 0x380 ... 0x3bf: /* NVIC_ITNS<n> */
940     {
941         int startvec = 32 * (offset - 0x380) + NVIC_FIRST_IRQ;
942         int i;
943 
944         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
945             goto bad_offset;
946         }
947         if (!attrs.secure) {
948             break;
949         }
950         for (i = 0; i < 32 && startvec + i < s->num_irq; i++) {
951             s->itns[startvec + i] = (value >> i) & 1;
952         }
953         nvic_irq_update(s);
954         break;
955     }
956     case 0xd04: /* Interrupt Control State.  */
957         if (value & (1 << 31)) {
958             armv7m_nvic_set_pending(s, ARMV7M_EXCP_NMI, false);
959         }
960         if (value & (1 << 28)) {
961             armv7m_nvic_set_pending(s, ARMV7M_EXCP_PENDSV, attrs.secure);
962         } else if (value & (1 << 27)) {
963             armv7m_nvic_clear_pending(s, ARMV7M_EXCP_PENDSV, attrs.secure);
964         }
965         if (value & (1 << 26)) {
966             armv7m_nvic_set_pending(s, ARMV7M_EXCP_SYSTICK, attrs.secure);
967         } else if (value & (1 << 25)) {
968             armv7m_nvic_clear_pending(s, ARMV7M_EXCP_SYSTICK, attrs.secure);
969         }
970         break;
971     case 0xd08: /* Vector Table Offset.  */
972         cpu->env.v7m.vecbase[attrs.secure] = value & 0xffffff80;
973         break;
974     case 0xd0c: /* Application Interrupt/Reset Control (AIRCR) */
975         if ((value >> R_V7M_AIRCR_VECTKEY_SHIFT) == 0x05fa) {
976             if (value & R_V7M_AIRCR_SYSRESETREQ_MASK) {
977                 if (attrs.secure ||
978                     !(cpu->env.v7m.aircr & R_V7M_AIRCR_SYSRESETREQS_MASK)) {
979                     qemu_irq_pulse(s->sysresetreq);
980                 }
981             }
982             if (value & R_V7M_AIRCR_VECTCLRACTIVE_MASK) {
983                 qemu_log_mask(LOG_GUEST_ERROR,
984                               "Setting VECTCLRACTIVE when not in DEBUG mode "
985                               "is UNPREDICTABLE\n");
986             }
987             if (value & R_V7M_AIRCR_VECTRESET_MASK) {
988                 /* NB: this bit is RES0 in v8M */
989                 qemu_log_mask(LOG_GUEST_ERROR,
990                               "Setting VECTRESET when not in DEBUG mode "
991                               "is UNPREDICTABLE\n");
992             }
993             s->prigroup[attrs.secure] = extract32(value,
994                                                   R_V7M_AIRCR_PRIGROUP_SHIFT,
995                                                   R_V7M_AIRCR_PRIGROUP_LENGTH);
996             if (attrs.secure) {
997                 /* These bits are only writable by secure */
998                 cpu->env.v7m.aircr = value &
999                     (R_V7M_AIRCR_SYSRESETREQS_MASK |
1000                      R_V7M_AIRCR_BFHFNMINS_MASK |
1001                      R_V7M_AIRCR_PRIS_MASK);
1002                 /* BFHFNMINS changes the priority of Secure HardFault, and
1003                  * allows a pending Non-secure HardFault to preempt (which
1004                  * we implement by marking it enabled).
1005                  */
1006                 if (cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK) {
1007                     s->sec_vectors[ARMV7M_EXCP_HARD].prio = -3;
1008                     s->vectors[ARMV7M_EXCP_HARD].enabled = 1;
1009                 } else {
1010                     s->sec_vectors[ARMV7M_EXCP_HARD].prio = -1;
1011                     s->vectors[ARMV7M_EXCP_HARD].enabled = 0;
1012                 }
1013             }
1014             nvic_irq_update(s);
1015         }
1016         break;
1017     case 0xd10: /* System Control.  */
1018         /* TODO: Implement control registers.  */
1019         qemu_log_mask(LOG_UNIMP, "NVIC: SCR unimplemented\n");
1020         break;
1021     case 0xd14: /* Configuration Control.  */
1022         /* Enforce RAZ/WI on reserved and must-RAZ/WI bits */
1023         value &= (R_V7M_CCR_STKALIGN_MASK |
1024                   R_V7M_CCR_BFHFNMIGN_MASK |
1025                   R_V7M_CCR_DIV_0_TRP_MASK |
1026                   R_V7M_CCR_UNALIGN_TRP_MASK |
1027                   R_V7M_CCR_USERSETMPEND_MASK |
1028                   R_V7M_CCR_NONBASETHRDENA_MASK);
1029 
1030         if (arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1031             /* v8M makes NONBASETHRDENA and STKALIGN be RES1 */
1032             value |= R_V7M_CCR_NONBASETHRDENA_MASK
1033                 | R_V7M_CCR_STKALIGN_MASK;
1034         }
1035         if (attrs.secure) {
1036             /* the BFHFNMIGN bit is not banked; keep that in the NS copy */
1037             cpu->env.v7m.ccr[M_REG_NS] =
1038                 (cpu->env.v7m.ccr[M_REG_NS] & ~R_V7M_CCR_BFHFNMIGN_MASK)
1039                 | (value & R_V7M_CCR_BFHFNMIGN_MASK);
1040             value &= ~R_V7M_CCR_BFHFNMIGN_MASK;
1041         }
1042 
1043         cpu->env.v7m.ccr[attrs.secure] = value;
1044         break;
1045     case 0xd24: /* System Handler Control.  */
1046         s->vectors[ARMV7M_EXCP_MEM].active = (value & (1 << 0)) != 0;
1047         s->vectors[ARMV7M_EXCP_BUS].active = (value & (1 << 1)) != 0;
1048         s->vectors[ARMV7M_EXCP_USAGE].active = (value & (1 << 3)) != 0;
1049         s->vectors[ARMV7M_EXCP_SVC].active = (value & (1 << 7)) != 0;
1050         s->vectors[ARMV7M_EXCP_DEBUG].active = (value & (1 << 8)) != 0;
1051         s->vectors[ARMV7M_EXCP_PENDSV].active = (value & (1 << 10)) != 0;
1052         s->vectors[ARMV7M_EXCP_SYSTICK].active = (value & (1 << 11)) != 0;
1053         s->vectors[ARMV7M_EXCP_USAGE].pending = (value & (1 << 12)) != 0;
1054         s->vectors[ARMV7M_EXCP_MEM].pending = (value & (1 << 13)) != 0;
1055         s->vectors[ARMV7M_EXCP_BUS].pending = (value & (1 << 14)) != 0;
1056         s->vectors[ARMV7M_EXCP_SVC].pending = (value & (1 << 15)) != 0;
1057         s->vectors[ARMV7M_EXCP_MEM].enabled = (value & (1 << 16)) != 0;
1058         s->vectors[ARMV7M_EXCP_BUS].enabled = (value & (1 << 17)) != 0;
1059         s->vectors[ARMV7M_EXCP_USAGE].enabled = (value & (1 << 18)) != 0;
1060         nvic_irq_update(s);
1061         break;
1062     case 0xd28: /* Configurable Fault Status.  */
1063         cpu->env.v7m.cfsr[attrs.secure] &= ~value; /* W1C */
1064         if (attrs.secure) {
1065             /* The BFSR bits [15:8] are shared between security states
1066              * and we store them in the NS copy.
1067              */
1068             cpu->env.v7m.cfsr[M_REG_NS] &= ~(value & R_V7M_CFSR_BFSR_MASK);
1069         }
1070         break;
1071     case 0xd2c: /* Hard Fault Status.  */
1072         cpu->env.v7m.hfsr &= ~value; /* W1C */
1073         break;
1074     case 0xd30: /* Debug Fault Status.  */
1075         cpu->env.v7m.dfsr &= ~value; /* W1C */
1076         break;
1077     case 0xd34: /* Mem Manage Address.  */
1078         cpu->env.v7m.mmfar[attrs.secure] = value;
1079         return;
1080     case 0xd38: /* Bus Fault Address.  */
1081         cpu->env.v7m.bfar = value;
1082         return;
1083     case 0xd3c: /* Aux Fault Status.  */
1084         qemu_log_mask(LOG_UNIMP,
1085                       "NVIC: Aux fault status registers unimplemented\n");
1086         break;
1087     case 0xd90: /* MPU_TYPE */
1088         return; /* RO */
1089     case 0xd94: /* MPU_CTRL */
1090         if ((value &
1091              (R_V7M_MPU_CTRL_HFNMIENA_MASK | R_V7M_MPU_CTRL_ENABLE_MASK))
1092             == R_V7M_MPU_CTRL_HFNMIENA_MASK) {
1093             qemu_log_mask(LOG_GUEST_ERROR, "MPU_CTRL: HFNMIENA and !ENABLE is "
1094                           "UNPREDICTABLE\n");
1095         }
1096         cpu->env.v7m.mpu_ctrl[attrs.secure]
1097             = value & (R_V7M_MPU_CTRL_ENABLE_MASK |
1098                        R_V7M_MPU_CTRL_HFNMIENA_MASK |
1099                        R_V7M_MPU_CTRL_PRIVDEFENA_MASK);
1100         tlb_flush(CPU(cpu));
1101         break;
1102     case 0xd98: /* MPU_RNR */
1103         if (value >= cpu->pmsav7_dregion) {
1104             qemu_log_mask(LOG_GUEST_ERROR, "MPU region out of range %"
1105                           PRIu32 "/%" PRIu32 "\n",
1106                           value, cpu->pmsav7_dregion);
1107         } else {
1108             cpu->env.pmsav7.rnr[attrs.secure] = value;
1109         }
1110         break;
1111     case 0xd9c: /* MPU_RBAR */
1112     case 0xda4: /* MPU_RBAR_A1 */
1113     case 0xdac: /* MPU_RBAR_A2 */
1114     case 0xdb4: /* MPU_RBAR_A3 */
1115     {
1116         int region;
1117 
1118         if (arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1119             /* PMSAv8M handling of the aliases is different from v7M:
1120              * aliases A1, A2, A3 override the low two bits of the region
1121              * number in MPU_RNR, and there is no 'region' field in the
1122              * RBAR register.
1123              */
1124             int aliasno = (offset - 0xd9c) / 8; /* 0..3 */
1125 
1126             region = cpu->env.pmsav7.rnr[attrs.secure];
1127             if (aliasno) {
1128                 region = deposit32(region, 0, 2, aliasno);
1129             }
1130             if (region >= cpu->pmsav7_dregion) {
1131                 return;
1132             }
1133             cpu->env.pmsav8.rbar[attrs.secure][region] = value;
1134             tlb_flush(CPU(cpu));
1135             return;
1136         }
1137 
1138         if (value & (1 << 4)) {
1139             /* VALID bit means use the region number specified in this
1140              * value and also update MPU_RNR.REGION with that value.
1141              */
1142             region = extract32(value, 0, 4);
1143             if (region >= cpu->pmsav7_dregion) {
1144                 qemu_log_mask(LOG_GUEST_ERROR,
1145                               "MPU region out of range %u/%" PRIu32 "\n",
1146                               region, cpu->pmsav7_dregion);
1147                 return;
1148             }
1149             cpu->env.pmsav7.rnr[attrs.secure] = region;
1150         } else {
1151             region = cpu->env.pmsav7.rnr[attrs.secure];
1152         }
1153 
1154         if (region >= cpu->pmsav7_dregion) {
1155             return;
1156         }
1157 
1158         cpu->env.pmsav7.drbar[region] = value & ~0x1f;
1159         tlb_flush(CPU(cpu));
1160         break;
1161     }
1162     case 0xda0: /* MPU_RASR (v7M), MPU_RLAR (v8M) */
1163     case 0xda8: /* MPU_RASR_A1 (v7M), MPU_RLAR_A1 (v8M) */
1164     case 0xdb0: /* MPU_RASR_A2 (v7M), MPU_RLAR_A2 (v8M) */
1165     case 0xdb8: /* MPU_RASR_A3 (v7M), MPU_RLAR_A3 (v8M) */
1166     {
1167         int region = cpu->env.pmsav7.rnr[attrs.secure];
1168 
1169         if (arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1170             /* PMSAv8M handling of the aliases is different from v7M:
1171              * aliases A1, A2, A3 override the low two bits of the region
1172              * number in MPU_RNR.
1173              */
1174             int aliasno = (offset - 0xd9c) / 8; /* 0..3 */
1175 
1176             region = cpu->env.pmsav7.rnr[attrs.secure];
1177             if (aliasno) {
1178                 region = deposit32(region, 0, 2, aliasno);
1179             }
1180             if (region >= cpu->pmsav7_dregion) {
1181                 return;
1182             }
1183             cpu->env.pmsav8.rlar[attrs.secure][region] = value;
1184             tlb_flush(CPU(cpu));
1185             return;
1186         }
1187 
1188         if (region >= cpu->pmsav7_dregion) {
1189             return;
1190         }
1191 
1192         cpu->env.pmsav7.drsr[region] = value & 0xff3f;
1193         cpu->env.pmsav7.dracr[region] = (value >> 16) & 0x173f;
1194         tlb_flush(CPU(cpu));
1195         break;
1196     }
1197     case 0xdc0: /* MPU_MAIR0 */
1198         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1199             goto bad_offset;
1200         }
1201         if (cpu->pmsav7_dregion) {
1202             /* Register is RES0 if no MPU regions are implemented */
1203             cpu->env.pmsav8.mair0[attrs.secure] = value;
1204         }
1205         /* We don't need to do anything else because memory attributes
1206          * only affect cacheability, and we don't implement caching.
1207          */
1208         break;
1209     case 0xdc4: /* MPU_MAIR1 */
1210         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1211             goto bad_offset;
1212         }
1213         if (cpu->pmsav7_dregion) {
1214             /* Register is RES0 if no MPU regions are implemented */
1215             cpu->env.pmsav8.mair1[attrs.secure] = value;
1216         }
1217         /* We don't need to do anything else because memory attributes
1218          * only affect cacheability, and we don't implement caching.
1219          */
1220         break;
1221     case 0xf00: /* Software Triggered Interrupt Register */
1222     {
1223         int excnum = (value & 0x1ff) + NVIC_FIRST_IRQ;
1224         if (excnum < s->num_irq) {
1225             armv7m_nvic_set_pending(s, excnum, false);
1226         }
1227         break;
1228     }
1229     default:
1230     bad_offset:
1231         qemu_log_mask(LOG_GUEST_ERROR,
1232                       "NVIC: Bad write offset 0x%x\n", offset);
1233     }
1234 }
1235 
1236 static bool nvic_user_access_ok(NVICState *s, hwaddr offset, MemTxAttrs attrs)
1237 {
1238     /* Return true if unprivileged access to this register is permitted. */
1239     switch (offset) {
1240     case 0xf00: /* STIR: accessible only if CCR.USERSETMPEND permits */
1241         /* For access via STIR_NS it is the NS CCR.USERSETMPEND that
1242          * controls access even though the CPU is in Secure state (I_QDKX).
1243          */
1244         return s->cpu->env.v7m.ccr[attrs.secure] & R_V7M_CCR_USERSETMPEND_MASK;
1245     default:
1246         /* All other user accesses cause a BusFault unconditionally */
1247         return false;
1248     }
1249 }
1250 
1251 static int shpr_bank(NVICState *s, int exc, MemTxAttrs attrs)
1252 {
1253     /* Behaviour for the SHPR register field for this exception:
1254      * return M_REG_NS to use the nonsecure vector (including for
1255      * non-banked exceptions), M_REG_S for the secure version of
1256      * a banked exception, and -1 if this field should RAZ/WI.
1257      */
1258     switch (exc) {
1259     case ARMV7M_EXCP_MEM:
1260     case ARMV7M_EXCP_USAGE:
1261     case ARMV7M_EXCP_SVC:
1262     case ARMV7M_EXCP_PENDSV:
1263     case ARMV7M_EXCP_SYSTICK:
1264         /* Banked exceptions */
1265         return attrs.secure;
1266     case ARMV7M_EXCP_BUS:
1267         /* Not banked, RAZ/WI from nonsecure if BFHFNMINS is zero */
1268         if (!attrs.secure &&
1269             !(s->cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK)) {
1270             return -1;
1271         }
1272         return M_REG_NS;
1273     case ARMV7M_EXCP_SECURE:
1274         /* Not banked, RAZ/WI from nonsecure */
1275         if (!attrs.secure) {
1276             return -1;
1277         }
1278         return M_REG_NS;
1279     case ARMV7M_EXCP_DEBUG:
1280         /* Not banked. TODO should RAZ/WI if DEMCR.SDME is set */
1281         return M_REG_NS;
1282     case 8 ... 10:
1283     case 13:
1284         /* RES0 */
1285         return -1;
1286     default:
1287         /* Not reachable due to decode of SHPR register addresses */
1288         g_assert_not_reached();
1289     }
1290 }
1291 
1292 static MemTxResult nvic_sysreg_read(void *opaque, hwaddr addr,
1293                                     uint64_t *data, unsigned size,
1294                                     MemTxAttrs attrs)
1295 {
1296     NVICState *s = (NVICState *)opaque;
1297     uint32_t offset = addr;
1298     unsigned i, startvec, end;
1299     uint32_t val;
1300 
1301     if (attrs.user && !nvic_user_access_ok(s, addr, attrs)) {
1302         /* Generate BusFault for unprivileged accesses */
1303         return MEMTX_ERROR;
1304     }
1305 
1306     switch (offset) {
1307     /* reads of set and clear both return the status */
1308     case 0x100 ... 0x13f: /* NVIC Set enable */
1309         offset += 0x80;
1310         /* fall through */
1311     case 0x180 ... 0x1bf: /* NVIC Clear enable */
1312         val = 0;
1313         startvec = offset - 0x180 + NVIC_FIRST_IRQ; /* vector # */
1314 
1315         for (i = 0, end = size * 8; i < end && startvec + i < s->num_irq; i++) {
1316             if (s->vectors[startvec + i].enabled &&
1317                 (attrs.secure || s->itns[startvec + i])) {
1318                 val |= (1 << i);
1319             }
1320         }
1321         break;
1322     case 0x200 ... 0x23f: /* NVIC Set pend */
1323         offset += 0x80;
1324         /* fall through */
1325     case 0x280 ... 0x2bf: /* NVIC Clear pend */
1326         val = 0;
1327         startvec = offset - 0x280 + NVIC_FIRST_IRQ; /* vector # */
1328         for (i = 0, end = size * 8; i < end && startvec + i < s->num_irq; i++) {
1329             if (s->vectors[startvec + i].pending &&
1330                 (attrs.secure || s->itns[startvec + i])) {
1331                 val |= (1 << i);
1332             }
1333         }
1334         break;
1335     case 0x300 ... 0x33f: /* NVIC Active */
1336         val = 0;
1337         startvec = offset - 0x300 + NVIC_FIRST_IRQ; /* vector # */
1338 
1339         for (i = 0, end = size * 8; i < end && startvec + i < s->num_irq; i++) {
1340             if (s->vectors[startvec + i].active &&
1341                 (attrs.secure || s->itns[startvec + i])) {
1342                 val |= (1 << i);
1343             }
1344         }
1345         break;
1346     case 0x400 ... 0x5ef: /* NVIC Priority */
1347         val = 0;
1348         startvec = offset - 0x400 + NVIC_FIRST_IRQ; /* vector # */
1349 
1350         for (i = 0; i < size && startvec + i < s->num_irq; i++) {
1351             if (attrs.secure || s->itns[startvec + i]) {
1352                 val |= s->vectors[startvec + i].prio << (8 * i);
1353             }
1354         }
1355         break;
1356     case 0xd18 ... 0xd23: /* System Handler Priority (SHPR1, SHPR2, SHPR3) */
1357         val = 0;
1358         for (i = 0; i < size; i++) {
1359             unsigned hdlidx = (offset - 0xd14) + i;
1360             int sbank = shpr_bank(s, hdlidx, attrs);
1361 
1362             if (sbank < 0) {
1363                 continue;
1364             }
1365             val = deposit32(val, i * 8, 8, get_prio(s, hdlidx, sbank));
1366         }
1367         break;
1368     case 0xfe0 ... 0xfff: /* ID.  */
1369         if (offset & 3) {
1370             val = 0;
1371         } else {
1372             val = nvic_id[(offset - 0xfe0) >> 2];
1373         }
1374         break;
1375     default:
1376         if (size == 4) {
1377             val = nvic_readl(s, offset, attrs);
1378         } else {
1379             qemu_log_mask(LOG_GUEST_ERROR,
1380                           "NVIC: Bad read of size %d at offset 0x%x\n",
1381                           size, offset);
1382             val = 0;
1383         }
1384     }
1385 
1386     trace_nvic_sysreg_read(addr, val, size);
1387     *data = val;
1388     return MEMTX_OK;
1389 }
1390 
1391 static MemTxResult nvic_sysreg_write(void *opaque, hwaddr addr,
1392                                      uint64_t value, unsigned size,
1393                                      MemTxAttrs attrs)
1394 {
1395     NVICState *s = (NVICState *)opaque;
1396     uint32_t offset = addr;
1397     unsigned i, startvec, end;
1398     unsigned setval = 0;
1399 
1400     trace_nvic_sysreg_write(addr, value, size);
1401 
1402     if (attrs.user && !nvic_user_access_ok(s, addr, attrs)) {
1403         /* Generate BusFault for unprivileged accesses */
1404         return MEMTX_ERROR;
1405     }
1406 
1407     switch (offset) {
1408     case 0x100 ... 0x13f: /* NVIC Set enable */
1409         offset += 0x80;
1410         setval = 1;
1411         /* fall through */
1412     case 0x180 ... 0x1bf: /* NVIC Clear enable */
1413         startvec = 8 * (offset - 0x180) + NVIC_FIRST_IRQ;
1414 
1415         for (i = 0, end = size * 8; i < end && startvec + i < s->num_irq; i++) {
1416             if (value & (1 << i) &&
1417                 (attrs.secure || s->itns[startvec + i])) {
1418                 s->vectors[startvec + i].enabled = setval;
1419             }
1420         }
1421         nvic_irq_update(s);
1422         return MEMTX_OK;
1423     case 0x200 ... 0x23f: /* NVIC Set pend */
1424         /* the special logic in armv7m_nvic_set_pending()
1425          * is not needed since IRQs are never escalated
1426          */
1427         offset += 0x80;
1428         setval = 1;
1429         /* fall through */
1430     case 0x280 ... 0x2bf: /* NVIC Clear pend */
1431         startvec = 8 * (offset - 0x280) + NVIC_FIRST_IRQ; /* vector # */
1432 
1433         for (i = 0, end = size * 8; i < end && startvec + i < s->num_irq; i++) {
1434             if (value & (1 << i) &&
1435                 (attrs.secure || s->itns[startvec + i])) {
1436                 s->vectors[startvec + i].pending = setval;
1437             }
1438         }
1439         nvic_irq_update(s);
1440         return MEMTX_OK;
1441     case 0x300 ... 0x33f: /* NVIC Active */
1442         return MEMTX_OK; /* R/O */
1443     case 0x400 ... 0x5ef: /* NVIC Priority */
1444         startvec = 8 * (offset - 0x400) + NVIC_FIRST_IRQ; /* vector # */
1445 
1446         for (i = 0; i < size && startvec + i < s->num_irq; i++) {
1447             if (attrs.secure || s->itns[startvec + i]) {
1448                 set_prio(s, startvec + i, false, (value >> (i * 8)) & 0xff);
1449             }
1450         }
1451         nvic_irq_update(s);
1452         return MEMTX_OK;
1453     case 0xd18 ... 0xd23: /* System Handler Priority (SHPR1, SHPR2, SHPR3) */
1454         for (i = 0; i < size; i++) {
1455             unsigned hdlidx = (offset - 0xd14) + i;
1456             int newprio = extract32(value, i * 8, 8);
1457             int sbank = shpr_bank(s, hdlidx, attrs);
1458 
1459             if (sbank < 0) {
1460                 continue;
1461             }
1462             set_prio(s, hdlidx, sbank, newprio);
1463         }
1464         nvic_irq_update(s);
1465         return MEMTX_OK;
1466     }
1467     if (size == 4) {
1468         nvic_writel(s, offset, value, attrs);
1469         return MEMTX_OK;
1470     }
1471     qemu_log_mask(LOG_GUEST_ERROR,
1472                   "NVIC: Bad write of size %d at offset 0x%x\n", size, offset);
1473     /* This is UNPREDICTABLE; treat as RAZ/WI */
1474     return MEMTX_OK;
1475 }
1476 
1477 static const MemoryRegionOps nvic_sysreg_ops = {
1478     .read_with_attrs = nvic_sysreg_read,
1479     .write_with_attrs = nvic_sysreg_write,
1480     .endianness = DEVICE_NATIVE_ENDIAN,
1481 };
1482 
1483 static MemTxResult nvic_sysreg_ns_write(void *opaque, hwaddr addr,
1484                                         uint64_t value, unsigned size,
1485                                         MemTxAttrs attrs)
1486 {
1487     if (attrs.secure) {
1488         /* S accesses to the alias act like NS accesses to the real region */
1489         attrs.secure = 0;
1490         return nvic_sysreg_write(opaque, addr, value, size, attrs);
1491     } else {
1492         /* NS attrs are RAZ/WI for privileged, and BusFault for user */
1493         if (attrs.user) {
1494             return MEMTX_ERROR;
1495         }
1496         return MEMTX_OK;
1497     }
1498 }
1499 
1500 static MemTxResult nvic_sysreg_ns_read(void *opaque, hwaddr addr,
1501                                        uint64_t *data, unsigned size,
1502                                        MemTxAttrs attrs)
1503 {
1504     if (attrs.secure) {
1505         /* S accesses to the alias act like NS accesses to the real region */
1506         attrs.secure = 0;
1507         return nvic_sysreg_read(opaque, addr, data, size, attrs);
1508     } else {
1509         /* NS attrs are RAZ/WI for privileged, and BusFault for user */
1510         if (attrs.user) {
1511             return MEMTX_ERROR;
1512         }
1513         *data = 0;
1514         return MEMTX_OK;
1515     }
1516 }
1517 
1518 static const MemoryRegionOps nvic_sysreg_ns_ops = {
1519     .read_with_attrs = nvic_sysreg_ns_read,
1520     .write_with_attrs = nvic_sysreg_ns_write,
1521     .endianness = DEVICE_NATIVE_ENDIAN,
1522 };
1523 
1524 static int nvic_post_load(void *opaque, int version_id)
1525 {
1526     NVICState *s = opaque;
1527     unsigned i;
1528     int resetprio;
1529 
1530     /* Check for out of range priority settings */
1531     resetprio = arm_feature(&s->cpu->env, ARM_FEATURE_V8) ? -4 : -3;
1532 
1533     if (s->vectors[ARMV7M_EXCP_RESET].prio != resetprio ||
1534         s->vectors[ARMV7M_EXCP_NMI].prio != -2 ||
1535         s->vectors[ARMV7M_EXCP_HARD].prio != -1) {
1536         return 1;
1537     }
1538     for (i = ARMV7M_EXCP_MEM; i < s->num_irq; i++) {
1539         if (s->vectors[i].prio & ~0xff) {
1540             return 1;
1541         }
1542     }
1543 
1544     nvic_recompute_state(s);
1545 
1546     return 0;
1547 }
1548 
1549 static const VMStateDescription vmstate_VecInfo = {
1550     .name = "armv7m_nvic_info",
1551     .version_id = 1,
1552     .minimum_version_id = 1,
1553     .fields = (VMStateField[]) {
1554         VMSTATE_INT16(prio, VecInfo),
1555         VMSTATE_UINT8(enabled, VecInfo),
1556         VMSTATE_UINT8(pending, VecInfo),
1557         VMSTATE_UINT8(active, VecInfo),
1558         VMSTATE_UINT8(level, VecInfo),
1559         VMSTATE_END_OF_LIST()
1560     }
1561 };
1562 
1563 static bool nvic_security_needed(void *opaque)
1564 {
1565     NVICState *s = opaque;
1566 
1567     return arm_feature(&s->cpu->env, ARM_FEATURE_M_SECURITY);
1568 }
1569 
1570 static int nvic_security_post_load(void *opaque, int version_id)
1571 {
1572     NVICState *s = opaque;
1573     int i;
1574 
1575     /* Check for out of range priority settings */
1576     if (s->sec_vectors[ARMV7M_EXCP_HARD].prio != -1
1577         && s->sec_vectors[ARMV7M_EXCP_HARD].prio != -3) {
1578         /* We can't cross-check against AIRCR.BFHFNMINS as we don't know
1579          * if the CPU state has been migrated yet; a mismatch won't
1580          * cause the emulation to blow up, though.
1581          */
1582         return 1;
1583     }
1584     for (i = ARMV7M_EXCP_MEM; i < ARRAY_SIZE(s->sec_vectors); i++) {
1585         if (s->sec_vectors[i].prio & ~0xff) {
1586             return 1;
1587         }
1588     }
1589     return 0;
1590 }
1591 
1592 static const VMStateDescription vmstate_nvic_security = {
1593     .name = "nvic/m-security",
1594     .version_id = 1,
1595     .minimum_version_id = 1,
1596     .needed = nvic_security_needed,
1597     .post_load = &nvic_security_post_load,
1598     .fields = (VMStateField[]) {
1599         VMSTATE_STRUCT_ARRAY(sec_vectors, NVICState, NVIC_INTERNAL_VECTORS, 1,
1600                              vmstate_VecInfo, VecInfo),
1601         VMSTATE_UINT32(prigroup[M_REG_S], NVICState),
1602         VMSTATE_BOOL_ARRAY(itns, NVICState, NVIC_MAX_VECTORS),
1603         VMSTATE_END_OF_LIST()
1604     }
1605 };
1606 
1607 static const VMStateDescription vmstate_nvic = {
1608     .name = "armv7m_nvic",
1609     .version_id = 4,
1610     .minimum_version_id = 4,
1611     .post_load = &nvic_post_load,
1612     .fields = (VMStateField[]) {
1613         VMSTATE_STRUCT_ARRAY(vectors, NVICState, NVIC_MAX_VECTORS, 1,
1614                              vmstate_VecInfo, VecInfo),
1615         VMSTATE_UINT32(prigroup[M_REG_NS], NVICState),
1616         VMSTATE_END_OF_LIST()
1617     },
1618     .subsections = (const VMStateDescription*[]) {
1619         &vmstate_nvic_security,
1620         NULL
1621     }
1622 };
1623 
1624 static Property props_nvic[] = {
1625     /* Number of external IRQ lines (so excluding the 16 internal exceptions) */
1626     DEFINE_PROP_UINT32("num-irq", NVICState, num_irq, 64),
1627     DEFINE_PROP_END_OF_LIST()
1628 };
1629 
1630 static void armv7m_nvic_reset(DeviceState *dev)
1631 {
1632     int resetprio;
1633     NVICState *s = NVIC(dev);
1634 
1635     s->vectors[ARMV7M_EXCP_NMI].enabled = 1;
1636     /* MEM, BUS, and USAGE are enabled through
1637      * the System Handler Control register
1638      */
1639     s->vectors[ARMV7M_EXCP_SVC].enabled = 1;
1640     s->vectors[ARMV7M_EXCP_DEBUG].enabled = 1;
1641     s->vectors[ARMV7M_EXCP_PENDSV].enabled = 1;
1642     s->vectors[ARMV7M_EXCP_SYSTICK].enabled = 1;
1643 
1644     resetprio = arm_feature(&s->cpu->env, ARM_FEATURE_V8) ? -4 : -3;
1645     s->vectors[ARMV7M_EXCP_RESET].prio = resetprio;
1646     s->vectors[ARMV7M_EXCP_NMI].prio = -2;
1647     s->vectors[ARMV7M_EXCP_HARD].prio = -1;
1648 
1649     if (arm_feature(&s->cpu->env, ARM_FEATURE_M_SECURITY)) {
1650         s->sec_vectors[ARMV7M_EXCP_HARD].enabled = 1;
1651         s->sec_vectors[ARMV7M_EXCP_SVC].enabled = 1;
1652         s->sec_vectors[ARMV7M_EXCP_PENDSV].enabled = 1;
1653         s->sec_vectors[ARMV7M_EXCP_SYSTICK].enabled = 1;
1654 
1655         /* AIRCR.BFHFNMINS resets to 0 so Secure HF is priority -1 (R_CMTC) */
1656         s->sec_vectors[ARMV7M_EXCP_HARD].prio = -1;
1657         /* If AIRCR.BFHFNMINS is 0 then NS HF is (effectively) disabled */
1658         s->vectors[ARMV7M_EXCP_HARD].enabled = 0;
1659     } else {
1660         s->vectors[ARMV7M_EXCP_HARD].enabled = 1;
1661     }
1662 
1663     /* Strictly speaking the reset handler should be enabled.
1664      * However, we don't simulate soft resets through the NVIC,
1665      * and the reset vector should never be pended.
1666      * So we leave it disabled to catch logic errors.
1667      */
1668 
1669     s->exception_prio = NVIC_NOEXC_PRIO;
1670     s->vectpending = 0;
1671     s->vectpending_is_s_banked = false;
1672     s->vectpending_prio = NVIC_NOEXC_PRIO;
1673 
1674     if (arm_feature(&s->cpu->env, ARM_FEATURE_M_SECURITY)) {
1675         memset(s->itns, 0, sizeof(s->itns));
1676     } else {
1677         /* This state is constant and not guest accessible in a non-security
1678          * NVIC; we set the bits to true to avoid having to do a feature
1679          * bit check in the NVIC enable/pend/etc register accessors.
1680          */
1681         int i;
1682 
1683         for (i = NVIC_FIRST_IRQ; i < ARRAY_SIZE(s->itns); i++) {
1684             s->itns[i] = true;
1685         }
1686     }
1687 }
1688 
1689 static void nvic_systick_trigger(void *opaque, int n, int level)
1690 {
1691     NVICState *s = opaque;
1692 
1693     if (level) {
1694         /* SysTick just asked us to pend its exception.
1695          * (This is different from an external interrupt line's
1696          * behaviour.)
1697          * TODO: when we implement the banked systicks we must make
1698          * this pend the correct banked exception.
1699          */
1700         armv7m_nvic_set_pending(s, ARMV7M_EXCP_SYSTICK, false);
1701     }
1702 }
1703 
1704 static void armv7m_nvic_realize(DeviceState *dev, Error **errp)
1705 {
1706     NVICState *s = NVIC(dev);
1707     SysBusDevice *systick_sbd;
1708     Error *err = NULL;
1709     int regionlen;
1710 
1711     s->cpu = ARM_CPU(qemu_get_cpu(0));
1712     assert(s->cpu);
1713 
1714     if (s->num_irq > NVIC_MAX_IRQ) {
1715         error_setg(errp, "num-irq %d exceeds NVIC maximum", s->num_irq);
1716         return;
1717     }
1718 
1719     qdev_init_gpio_in(dev, set_irq_level, s->num_irq);
1720 
1721     /* include space for internal exception vectors */
1722     s->num_irq += NVIC_FIRST_IRQ;
1723 
1724     object_property_set_bool(OBJECT(&s->systick), true, "realized", &err);
1725     if (err != NULL) {
1726         error_propagate(errp, err);
1727         return;
1728     }
1729     systick_sbd = SYS_BUS_DEVICE(&s->systick);
1730     sysbus_connect_irq(systick_sbd, 0,
1731                        qdev_get_gpio_in_named(dev, "systick-trigger", 0));
1732 
1733     /* The NVIC and System Control Space (SCS) starts at 0xe000e000
1734      * and looks like this:
1735      *  0x004 - ICTR
1736      *  0x010 - 0xff - systick
1737      *  0x100..0x7ec - NVIC
1738      *  0x7f0..0xcff - Reserved
1739      *  0xd00..0xd3c - SCS registers
1740      *  0xd40..0xeff - Reserved or Not implemented
1741      *  0xf00 - STIR
1742      *
1743      * Some registers within this space are banked between security states.
1744      * In v8M there is a second range 0xe002e000..0xe002efff which is the
1745      * NonSecure alias SCS; secure accesses to this behave like NS accesses
1746      * to the main SCS range, and non-secure accesses (including when
1747      * the security extension is not implemented) are RAZ/WI.
1748      * Note that both the main SCS range and the alias range are defined
1749      * to be exempt from memory attribution (R_BLJT) and so the memory
1750      * transaction attribute always matches the current CPU security
1751      * state (attrs.secure == env->v7m.secure). In the nvic_sysreg_ns_ops
1752      * wrappers we change attrs.secure to indicate the NS access; so
1753      * generally code determining which banked register to use should
1754      * use attrs.secure; code determining actual behaviour of the system
1755      * should use env->v7m.secure.
1756      */
1757     regionlen = arm_feature(&s->cpu->env, ARM_FEATURE_V8) ? 0x21000 : 0x1000;
1758     memory_region_init(&s->container, OBJECT(s), "nvic", regionlen);
1759     /* The system register region goes at the bottom of the priority
1760      * stack as it covers the whole page.
1761      */
1762     memory_region_init_io(&s->sysregmem, OBJECT(s), &nvic_sysreg_ops, s,
1763                           "nvic_sysregs", 0x1000);
1764     memory_region_add_subregion(&s->container, 0, &s->sysregmem);
1765     memory_region_add_subregion_overlap(&s->container, 0x10,
1766                                         sysbus_mmio_get_region(systick_sbd, 0),
1767                                         1);
1768 
1769     if (arm_feature(&s->cpu->env, ARM_FEATURE_V8)) {
1770         memory_region_init_io(&s->sysreg_ns_mem, OBJECT(s),
1771                               &nvic_sysreg_ns_ops, s,
1772                               "nvic_sysregs_ns", 0x1000);
1773         memory_region_add_subregion(&s->container, 0x20000, &s->sysreg_ns_mem);
1774     }
1775 
1776     sysbus_init_mmio(SYS_BUS_DEVICE(dev), &s->container);
1777 }
1778 
1779 static void armv7m_nvic_instance_init(Object *obj)
1780 {
1781     /* We have a different default value for the num-irq property
1782      * than our superclass. This function runs after qdev init
1783      * has set the defaults from the Property array and before
1784      * any user-specified property setting, so just modify the
1785      * value in the GICState struct.
1786      */
1787     DeviceState *dev = DEVICE(obj);
1788     NVICState *nvic = NVIC(obj);
1789     SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
1790 
1791     object_initialize(&nvic->systick, sizeof(nvic->systick), TYPE_SYSTICK);
1792     qdev_set_parent_bus(DEVICE(&nvic->systick), sysbus_get_default());
1793 
1794     sysbus_init_irq(sbd, &nvic->excpout);
1795     qdev_init_gpio_out_named(dev, &nvic->sysresetreq, "SYSRESETREQ", 1);
1796     qdev_init_gpio_in_named(dev, nvic_systick_trigger, "systick-trigger", 1);
1797 }
1798 
1799 static void armv7m_nvic_class_init(ObjectClass *klass, void *data)
1800 {
1801     DeviceClass *dc = DEVICE_CLASS(klass);
1802 
1803     dc->vmsd  = &vmstate_nvic;
1804     dc->props = props_nvic;
1805     dc->reset = armv7m_nvic_reset;
1806     dc->realize = armv7m_nvic_realize;
1807 }
1808 
1809 static const TypeInfo armv7m_nvic_info = {
1810     .name          = TYPE_NVIC,
1811     .parent        = TYPE_SYS_BUS_DEVICE,
1812     .instance_init = armv7m_nvic_instance_init,
1813     .instance_size = sizeof(NVICState),
1814     .class_init    = armv7m_nvic_class_init,
1815     .class_size    = sizeof(SysBusDeviceClass),
1816 };
1817 
1818 static void armv7m_nvic_register_types(void)
1819 {
1820     type_register_static(&armv7m_nvic_info);
1821 }
1822 
1823 type_init(armv7m_nvic_register_types)
1824