1 /* 2 * ARM Nested Vectored Interrupt Controller 3 * 4 * Copyright (c) 2006-2007 CodeSourcery. 5 * Written by Paul Brook 6 * 7 * This code is licensed under the GPL. 8 * 9 * The ARMv7M System controller is fairly tightly tied in with the 10 * NVIC. Much of that is also implemented here. 11 */ 12 13 #include "qemu/osdep.h" 14 #include "qapi/error.h" 15 #include "qemu-common.h" 16 #include "hw/sysbus.h" 17 #include "qemu/timer.h" 18 #include "hw/arm/arm.h" 19 #include "exec/address-spaces.h" 20 #include "gic_internal.h" 21 22 typedef struct { 23 GICState gic; 24 struct { 25 uint32_t control; 26 uint32_t reload; 27 int64_t tick; 28 QEMUTimer *timer; 29 } systick; 30 MemoryRegion sysregmem; 31 MemoryRegion gic_iomem_alias; 32 MemoryRegion container; 33 uint32_t num_irq; 34 qemu_irq sysresetreq; 35 } nvic_state; 36 37 #define TYPE_NVIC "armv7m_nvic" 38 /** 39 * NVICClass: 40 * @parent_reset: the parent class' reset handler. 41 * 42 * A model of the v7M NVIC and System Controller 43 */ 44 typedef struct NVICClass { 45 /*< private >*/ 46 ARMGICClass parent_class; 47 /*< public >*/ 48 DeviceRealize parent_realize; 49 void (*parent_reset)(DeviceState *dev); 50 } NVICClass; 51 52 #define NVIC_CLASS(klass) \ 53 OBJECT_CLASS_CHECK(NVICClass, (klass), TYPE_NVIC) 54 #define NVIC_GET_CLASS(obj) \ 55 OBJECT_GET_CLASS(NVICClass, (obj), TYPE_NVIC) 56 #define NVIC(obj) \ 57 OBJECT_CHECK(nvic_state, (obj), TYPE_NVIC) 58 59 static const uint8_t nvic_id[] = { 60 0x00, 0xb0, 0x1b, 0x00, 0x0d, 0xe0, 0x05, 0xb1 61 }; 62 63 /* qemu timers run at 1GHz. We want something closer to 1MHz. */ 64 #define SYSTICK_SCALE 1000ULL 65 66 #define SYSTICK_ENABLE (1 << 0) 67 #define SYSTICK_TICKINT (1 << 1) 68 #define SYSTICK_CLKSOURCE (1 << 2) 69 #define SYSTICK_COUNTFLAG (1 << 16) 70 71 int system_clock_scale; 72 73 /* Conversion factor from qemu timer to SysTick frequencies. */ 74 static inline int64_t systick_scale(nvic_state *s) 75 { 76 if (s->systick.control & SYSTICK_CLKSOURCE) 77 return system_clock_scale; 78 else 79 return 1000; 80 } 81 82 static void systick_reload(nvic_state *s, int reset) 83 { 84 /* The Cortex-M3 Devices Generic User Guide says that "When the 85 * ENABLE bit is set to 1, the counter loads the RELOAD value from the 86 * SYST RVR register and then counts down". So, we need to check the 87 * ENABLE bit before reloading the value. 88 */ 89 if ((s->systick.control & SYSTICK_ENABLE) == 0) { 90 return; 91 } 92 93 if (reset) 94 s->systick.tick = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL); 95 s->systick.tick += (s->systick.reload + 1) * systick_scale(s); 96 timer_mod(s->systick.timer, s->systick.tick); 97 } 98 99 static void systick_timer_tick(void * opaque) 100 { 101 nvic_state *s = (nvic_state *)opaque; 102 s->systick.control |= SYSTICK_COUNTFLAG; 103 if (s->systick.control & SYSTICK_TICKINT) { 104 /* Trigger the interrupt. */ 105 armv7m_nvic_set_pending(s, ARMV7M_EXCP_SYSTICK); 106 } 107 if (s->systick.reload == 0) { 108 s->systick.control &= ~SYSTICK_ENABLE; 109 } else { 110 systick_reload(s, 0); 111 } 112 } 113 114 static void systick_reset(nvic_state *s) 115 { 116 s->systick.control = 0; 117 s->systick.reload = 0; 118 s->systick.tick = 0; 119 timer_del(s->systick.timer); 120 } 121 122 /* The external routines use the hardware vector numbering, ie. the first 123 IRQ is #16. The internal GIC routines use #32 as the first IRQ. */ 124 void armv7m_nvic_set_pending(void *opaque, int irq) 125 { 126 nvic_state *s = (nvic_state *)opaque; 127 if (irq >= 16) 128 irq += 16; 129 gic_set_pending_private(&s->gic, 0, irq); 130 } 131 132 /* Make pending IRQ active. */ 133 int armv7m_nvic_acknowledge_irq(void *opaque) 134 { 135 nvic_state *s = (nvic_state *)opaque; 136 uint32_t irq; 137 138 irq = gic_acknowledge_irq(&s->gic, 0, MEMTXATTRS_UNSPECIFIED); 139 if (irq == 1023) 140 hw_error("Interrupt but no vector\n"); 141 if (irq >= 32) 142 irq -= 16; 143 return irq; 144 } 145 146 void armv7m_nvic_complete_irq(void *opaque, int irq) 147 { 148 nvic_state *s = (nvic_state *)opaque; 149 if (irq >= 16) 150 irq += 16; 151 gic_complete_irq(&s->gic, 0, irq, MEMTXATTRS_UNSPECIFIED); 152 } 153 154 static uint32_t nvic_readl(nvic_state *s, uint32_t offset) 155 { 156 ARMCPU *cpu; 157 uint32_t val; 158 int irq; 159 160 switch (offset) { 161 case 4: /* Interrupt Control Type. */ 162 return (s->num_irq / 32) - 1; 163 case 0x10: /* SysTick Control and Status. */ 164 val = s->systick.control; 165 s->systick.control &= ~SYSTICK_COUNTFLAG; 166 return val; 167 case 0x14: /* SysTick Reload Value. */ 168 return s->systick.reload; 169 case 0x18: /* SysTick Current Value. */ 170 { 171 int64_t t; 172 if ((s->systick.control & SYSTICK_ENABLE) == 0) 173 return 0; 174 t = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL); 175 if (t >= s->systick.tick) 176 return 0; 177 val = ((s->systick.tick - (t + 1)) / systick_scale(s)) + 1; 178 /* The interrupt in triggered when the timer reaches zero. 179 However the counter is not reloaded until the next clock 180 tick. This is a hack to return zero during the first tick. */ 181 if (val > s->systick.reload) 182 val = 0; 183 return val; 184 } 185 case 0x1c: /* SysTick Calibration Value. */ 186 return 10000; 187 case 0xd00: /* CPUID Base. */ 188 cpu = ARM_CPU(current_cpu); 189 return cpu->midr; 190 case 0xd04: /* Interrupt Control State. */ 191 /* VECTACTIVE */ 192 cpu = ARM_CPU(current_cpu); 193 val = cpu->env.v7m.exception; 194 if (val == 1023) { 195 val = 0; 196 } else if (val >= 32) { 197 val -= 16; 198 } 199 /* VECTPENDING */ 200 if (s->gic.current_pending[0] != 1023) 201 val |= (s->gic.current_pending[0] << 12); 202 /* ISRPENDING and RETTOBASE */ 203 for (irq = 32; irq < s->num_irq; irq++) { 204 if (s->gic.irq_state[irq].pending) { 205 val |= (1 << 22); 206 break; 207 } 208 if (irq != cpu->env.v7m.exception && s->gic.irq_state[irq].active) { 209 val |= (1 << 11); 210 } 211 } 212 /* PENDSTSET */ 213 if (s->gic.irq_state[ARMV7M_EXCP_SYSTICK].pending) 214 val |= (1 << 26); 215 /* PENDSVSET */ 216 if (s->gic.irq_state[ARMV7M_EXCP_PENDSV].pending) 217 val |= (1 << 28); 218 /* NMIPENDSET */ 219 if (s->gic.irq_state[ARMV7M_EXCP_NMI].pending) 220 val |= (1 << 31); 221 return val; 222 case 0xd08: /* Vector Table Offset. */ 223 cpu = ARM_CPU(current_cpu); 224 return cpu->env.v7m.vecbase; 225 case 0xd0c: /* Application Interrupt/Reset Control. */ 226 return 0xfa050000; 227 case 0xd10: /* System Control. */ 228 /* TODO: Implement SLEEPONEXIT. */ 229 return 0; 230 case 0xd14: /* Configuration Control. */ 231 /* TODO: Implement Configuration Control bits. */ 232 return 0; 233 case 0xd24: /* System Handler Status. */ 234 val = 0; 235 if (s->gic.irq_state[ARMV7M_EXCP_MEM].active) val |= (1 << 0); 236 if (s->gic.irq_state[ARMV7M_EXCP_BUS].active) val |= (1 << 1); 237 if (s->gic.irq_state[ARMV7M_EXCP_USAGE].active) val |= (1 << 3); 238 if (s->gic.irq_state[ARMV7M_EXCP_SVC].active) val |= (1 << 7); 239 if (s->gic.irq_state[ARMV7M_EXCP_DEBUG].active) val |= (1 << 8); 240 if (s->gic.irq_state[ARMV7M_EXCP_PENDSV].active) val |= (1 << 10); 241 if (s->gic.irq_state[ARMV7M_EXCP_SYSTICK].active) val |= (1 << 11); 242 if (s->gic.irq_state[ARMV7M_EXCP_USAGE].pending) val |= (1 << 12); 243 if (s->gic.irq_state[ARMV7M_EXCP_MEM].pending) val |= (1 << 13); 244 if (s->gic.irq_state[ARMV7M_EXCP_BUS].pending) val |= (1 << 14); 245 if (s->gic.irq_state[ARMV7M_EXCP_SVC].pending) val |= (1 << 15); 246 if (s->gic.irq_state[ARMV7M_EXCP_MEM].enabled) val |= (1 << 16); 247 if (s->gic.irq_state[ARMV7M_EXCP_BUS].enabled) val |= (1 << 17); 248 if (s->gic.irq_state[ARMV7M_EXCP_USAGE].enabled) val |= (1 << 18); 249 return val; 250 case 0xd28: /* Configurable Fault Status. */ 251 /* TODO: Implement Fault Status. */ 252 qemu_log_mask(LOG_UNIMP, "Configurable Fault Status unimplemented\n"); 253 return 0; 254 case 0xd2c: /* Hard Fault Status. */ 255 case 0xd30: /* Debug Fault Status. */ 256 case 0xd34: /* Mem Manage Address. */ 257 case 0xd38: /* Bus Fault Address. */ 258 case 0xd3c: /* Aux Fault Status. */ 259 /* TODO: Implement fault status registers. */ 260 qemu_log_mask(LOG_UNIMP, "Fault status registers unimplemented\n"); 261 return 0; 262 case 0xd40: /* PFR0. */ 263 return 0x00000030; 264 case 0xd44: /* PRF1. */ 265 return 0x00000200; 266 case 0xd48: /* DFR0. */ 267 return 0x00100000; 268 case 0xd4c: /* AFR0. */ 269 return 0x00000000; 270 case 0xd50: /* MMFR0. */ 271 return 0x00000030; 272 case 0xd54: /* MMFR1. */ 273 return 0x00000000; 274 case 0xd58: /* MMFR2. */ 275 return 0x00000000; 276 case 0xd5c: /* MMFR3. */ 277 return 0x00000000; 278 case 0xd60: /* ISAR0. */ 279 return 0x01141110; 280 case 0xd64: /* ISAR1. */ 281 return 0x02111000; 282 case 0xd68: /* ISAR2. */ 283 return 0x21112231; 284 case 0xd6c: /* ISAR3. */ 285 return 0x01111110; 286 case 0xd70: /* ISAR4. */ 287 return 0x01310102; 288 /* TODO: Implement debug registers. */ 289 default: 290 qemu_log_mask(LOG_GUEST_ERROR, "NVIC: Bad read offset 0x%x\n", offset); 291 return 0; 292 } 293 } 294 295 static void nvic_writel(nvic_state *s, uint32_t offset, uint32_t value) 296 { 297 ARMCPU *cpu; 298 uint32_t oldval; 299 switch (offset) { 300 case 0x10: /* SysTick Control and Status. */ 301 oldval = s->systick.control; 302 s->systick.control &= 0xfffffff8; 303 s->systick.control |= value & 7; 304 if ((oldval ^ value) & SYSTICK_ENABLE) { 305 int64_t now = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL); 306 if (value & SYSTICK_ENABLE) { 307 if (s->systick.tick) { 308 s->systick.tick += now; 309 timer_mod(s->systick.timer, s->systick.tick); 310 } else { 311 systick_reload(s, 1); 312 } 313 } else { 314 timer_del(s->systick.timer); 315 s->systick.tick -= now; 316 if (s->systick.tick < 0) 317 s->systick.tick = 0; 318 } 319 } else if ((oldval ^ value) & SYSTICK_CLKSOURCE) { 320 /* This is a hack. Force the timer to be reloaded 321 when the reference clock is changed. */ 322 systick_reload(s, 1); 323 } 324 break; 325 case 0x14: /* SysTick Reload Value. */ 326 s->systick.reload = value; 327 break; 328 case 0x18: /* SysTick Current Value. Writes reload the timer. */ 329 systick_reload(s, 1); 330 s->systick.control &= ~SYSTICK_COUNTFLAG; 331 break; 332 case 0xd04: /* Interrupt Control State. */ 333 if (value & (1 << 31)) { 334 armv7m_nvic_set_pending(s, ARMV7M_EXCP_NMI); 335 } 336 if (value & (1 << 28)) { 337 armv7m_nvic_set_pending(s, ARMV7M_EXCP_PENDSV); 338 } else if (value & (1 << 27)) { 339 s->gic.irq_state[ARMV7M_EXCP_PENDSV].pending = 0; 340 gic_update(&s->gic); 341 } 342 if (value & (1 << 26)) { 343 armv7m_nvic_set_pending(s, ARMV7M_EXCP_SYSTICK); 344 } else if (value & (1 << 25)) { 345 s->gic.irq_state[ARMV7M_EXCP_SYSTICK].pending = 0; 346 gic_update(&s->gic); 347 } 348 break; 349 case 0xd08: /* Vector Table Offset. */ 350 cpu = ARM_CPU(current_cpu); 351 cpu->env.v7m.vecbase = value & 0xffffff80; 352 break; 353 case 0xd0c: /* Application Interrupt/Reset Control. */ 354 if ((value >> 16) == 0x05fa) { 355 if (value & 4) { 356 qemu_irq_pulse(s->sysresetreq); 357 } 358 if (value & 2) { 359 qemu_log_mask(LOG_UNIMP, "VECTCLRACTIVE unimplemented\n"); 360 } 361 if (value & 1) { 362 qemu_log_mask(LOG_UNIMP, "AIRCR system reset unimplemented\n"); 363 } 364 if (value & 0x700) { 365 qemu_log_mask(LOG_UNIMP, "PRIGROUP unimplemented\n"); 366 } 367 } 368 break; 369 case 0xd10: /* System Control. */ 370 case 0xd14: /* Configuration Control. */ 371 /* TODO: Implement control registers. */ 372 qemu_log_mask(LOG_UNIMP, "NVIC: SCR and CCR unimplemented\n"); 373 break; 374 case 0xd24: /* System Handler Control. */ 375 /* TODO: Real hardware allows you to set/clear the active bits 376 under some circumstances. We don't implement this. */ 377 s->gic.irq_state[ARMV7M_EXCP_MEM].enabled = (value & (1 << 16)) != 0; 378 s->gic.irq_state[ARMV7M_EXCP_BUS].enabled = (value & (1 << 17)) != 0; 379 s->gic.irq_state[ARMV7M_EXCP_USAGE].enabled = (value & (1 << 18)) != 0; 380 break; 381 case 0xd28: /* Configurable Fault Status. */ 382 case 0xd2c: /* Hard Fault Status. */ 383 case 0xd30: /* Debug Fault Status. */ 384 case 0xd34: /* Mem Manage Address. */ 385 case 0xd38: /* Bus Fault Address. */ 386 case 0xd3c: /* Aux Fault Status. */ 387 qemu_log_mask(LOG_UNIMP, 388 "NVIC: fault status registers unimplemented\n"); 389 break; 390 case 0xf00: /* Software Triggered Interrupt Register */ 391 if ((value & 0x1ff) < s->num_irq) { 392 gic_set_pending_private(&s->gic, 0, value & 0x1ff); 393 } 394 break; 395 default: 396 qemu_log_mask(LOG_GUEST_ERROR, 397 "NVIC: Bad write offset 0x%x\n", offset); 398 } 399 } 400 401 static uint64_t nvic_sysreg_read(void *opaque, hwaddr addr, 402 unsigned size) 403 { 404 nvic_state *s = (nvic_state *)opaque; 405 uint32_t offset = addr; 406 int i; 407 uint32_t val; 408 409 switch (offset) { 410 case 0xd18 ... 0xd23: /* System Handler Priority. */ 411 val = 0; 412 for (i = 0; i < size; i++) { 413 val |= s->gic.priority1[(offset - 0xd14) + i][0] << (i * 8); 414 } 415 return val; 416 case 0xfe0 ... 0xfff: /* ID. */ 417 if (offset & 3) { 418 return 0; 419 } 420 return nvic_id[(offset - 0xfe0) >> 2]; 421 } 422 if (size == 4) { 423 return nvic_readl(s, offset); 424 } 425 qemu_log_mask(LOG_GUEST_ERROR, 426 "NVIC: Bad read of size %d at offset 0x%x\n", size, offset); 427 return 0; 428 } 429 430 static void nvic_sysreg_write(void *opaque, hwaddr addr, 431 uint64_t value, unsigned size) 432 { 433 nvic_state *s = (nvic_state *)opaque; 434 uint32_t offset = addr; 435 int i; 436 437 switch (offset) { 438 case 0xd18 ... 0xd23: /* System Handler Priority. */ 439 for (i = 0; i < size; i++) { 440 s->gic.priority1[(offset - 0xd14) + i][0] = 441 (value >> (i * 8)) & 0xff; 442 } 443 gic_update(&s->gic); 444 return; 445 } 446 if (size == 4) { 447 nvic_writel(s, offset, value); 448 return; 449 } 450 qemu_log_mask(LOG_GUEST_ERROR, 451 "NVIC: Bad write of size %d at offset 0x%x\n", size, offset); 452 } 453 454 static const MemoryRegionOps nvic_sysreg_ops = { 455 .read = nvic_sysreg_read, 456 .write = nvic_sysreg_write, 457 .endianness = DEVICE_NATIVE_ENDIAN, 458 }; 459 460 static const VMStateDescription vmstate_nvic = { 461 .name = "armv7m_nvic", 462 .version_id = 1, 463 .minimum_version_id = 1, 464 .fields = (VMStateField[]) { 465 VMSTATE_UINT32(systick.control, nvic_state), 466 VMSTATE_UINT32(systick.reload, nvic_state), 467 VMSTATE_INT64(systick.tick, nvic_state), 468 VMSTATE_TIMER_PTR(systick.timer, nvic_state), 469 VMSTATE_END_OF_LIST() 470 } 471 }; 472 473 static void armv7m_nvic_reset(DeviceState *dev) 474 { 475 nvic_state *s = NVIC(dev); 476 NVICClass *nc = NVIC_GET_CLASS(s); 477 nc->parent_reset(dev); 478 /* Common GIC reset resets to disabled; the NVIC doesn't have 479 * per-CPU interfaces so mark our non-existent CPU interface 480 * as enabled by default, and with a priority mask which allows 481 * all interrupts through. 482 */ 483 s->gic.cpu_ctlr[0] = GICC_CTLR_EN_GRP0; 484 s->gic.priority_mask[0] = 0x100; 485 /* The NVIC as a whole is always enabled. */ 486 s->gic.ctlr = 1; 487 systick_reset(s); 488 } 489 490 static void armv7m_nvic_realize(DeviceState *dev, Error **errp) 491 { 492 nvic_state *s = NVIC(dev); 493 NVICClass *nc = NVIC_GET_CLASS(s); 494 Error *local_err = NULL; 495 496 /* The NVIC always has only one CPU */ 497 s->gic.num_cpu = 1; 498 /* Tell the common code we're an NVIC */ 499 s->gic.revision = 0xffffffff; 500 s->num_irq = s->gic.num_irq; 501 nc->parent_realize(dev, &local_err); 502 if (local_err) { 503 error_propagate(errp, local_err); 504 return; 505 } 506 gic_init_irqs_and_distributor(&s->gic); 507 /* The NVIC and system controller register area looks like this: 508 * 0..0xff : system control registers, including systick 509 * 0x100..0xcff : GIC-like registers 510 * 0xd00..0xfff : system control registers 511 * We use overlaying to put the GIC like registers 512 * over the top of the system control register region. 513 */ 514 memory_region_init(&s->container, OBJECT(s), "nvic", 0x1000); 515 /* The system register region goes at the bottom of the priority 516 * stack as it covers the whole page. 517 */ 518 memory_region_init_io(&s->sysregmem, OBJECT(s), &nvic_sysreg_ops, s, 519 "nvic_sysregs", 0x1000); 520 memory_region_add_subregion(&s->container, 0, &s->sysregmem); 521 /* Alias the GIC region so we can get only the section of it 522 * we need, and layer it on top of the system register region. 523 */ 524 memory_region_init_alias(&s->gic_iomem_alias, OBJECT(s), 525 "nvic-gic", &s->gic.iomem, 526 0x100, 0xc00); 527 memory_region_add_subregion_overlap(&s->container, 0x100, 528 &s->gic_iomem_alias, 1); 529 /* Map the whole thing into system memory at the location required 530 * by the v7M architecture. 531 */ 532 memory_region_add_subregion(get_system_memory(), 0xe000e000, &s->container); 533 s->systick.timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, systick_timer_tick, s); 534 } 535 536 static void armv7m_nvic_instance_init(Object *obj) 537 { 538 /* We have a different default value for the num-irq property 539 * than our superclass. This function runs after qdev init 540 * has set the defaults from the Property array and before 541 * any user-specified property setting, so just modify the 542 * value in the GICState struct. 543 */ 544 GICState *s = ARM_GIC_COMMON(obj); 545 DeviceState *dev = DEVICE(obj); 546 nvic_state *nvic = NVIC(obj); 547 /* The ARM v7m may have anything from 0 to 496 external interrupt 548 * IRQ lines. We default to 64. Other boards may differ and should 549 * set the num-irq property appropriately. 550 */ 551 s->num_irq = 64; 552 qdev_init_gpio_out_named(dev, &nvic->sysresetreq, "SYSRESETREQ", 1); 553 } 554 555 static void armv7m_nvic_class_init(ObjectClass *klass, void *data) 556 { 557 NVICClass *nc = NVIC_CLASS(klass); 558 DeviceClass *dc = DEVICE_CLASS(klass); 559 560 nc->parent_reset = dc->reset; 561 nc->parent_realize = dc->realize; 562 dc->vmsd = &vmstate_nvic; 563 dc->reset = armv7m_nvic_reset; 564 dc->realize = armv7m_nvic_realize; 565 } 566 567 static const TypeInfo armv7m_nvic_info = { 568 .name = TYPE_NVIC, 569 .parent = TYPE_ARM_GIC_COMMON, 570 .instance_init = armv7m_nvic_instance_init, 571 .instance_size = sizeof(nvic_state), 572 .class_init = armv7m_nvic_class_init, 573 .class_size = sizeof(NVICClass), 574 }; 575 576 static void armv7m_nvic_register_types(void) 577 { 578 type_register_static(&armv7m_nvic_info); 579 } 580 581 type_init(armv7m_nvic_register_types) 582