xref: /openbmc/qemu/hw/intc/armv7m_nvic.c (revision 84d2e3e2ae76fdb0c8f3063fa8c46c8ce14ab201)
1 /*
2  * ARM Nested Vectored Interrupt Controller
3  *
4  * Copyright (c) 2006-2007 CodeSourcery.
5  * Written by Paul Brook
6  *
7  * This code is licensed under the GPL.
8  *
9  * The ARMv7M System controller is fairly tightly tied in with the
10  * NVIC.  Much of that is also implemented here.
11  */
12 
13 #include "qemu/osdep.h"
14 #include "qapi/error.h"
15 #include "qemu-common.h"
16 #include "cpu.h"
17 #include "hw/sysbus.h"
18 #include "qemu/timer.h"
19 #include "hw/arm/arm.h"
20 #include "hw/intc/armv7m_nvic.h"
21 #include "target/arm/cpu.h"
22 #include "exec/exec-all.h"
23 #include "qemu/log.h"
24 #include "trace.h"
25 
26 /* IRQ number counting:
27  *
28  * the num-irq property counts the number of external IRQ lines
29  *
30  * NVICState::num_irq counts the total number of exceptions
31  * (external IRQs, the 15 internal exceptions including reset,
32  * and one for the unused exception number 0).
33  *
34  * NVIC_MAX_IRQ is the highest permitted number of external IRQ lines.
35  *
36  * NVIC_MAX_VECTORS is the highest permitted number of exceptions.
37  *
38  * Iterating through all exceptions should typically be done with
39  * for (i = 1; i < s->num_irq; i++) to avoid the unused slot 0.
40  *
41  * The external qemu_irq lines are the NVIC's external IRQ lines,
42  * so line 0 is exception 16.
43  *
44  * In the terminology of the architecture manual, "interrupts" are
45  * a subcategory of exception referring to the external interrupts
46  * (which are exception numbers NVIC_FIRST_IRQ and upward).
47  * For historical reasons QEMU tends to use "interrupt" and
48  * "exception" more or less interchangeably.
49  */
50 #define NVIC_FIRST_IRQ NVIC_INTERNAL_VECTORS
51 #define NVIC_MAX_IRQ (NVIC_MAX_VECTORS - NVIC_FIRST_IRQ)
52 
53 /* Effective running priority of the CPU when no exception is active
54  * (higher than the highest possible priority value)
55  */
56 #define NVIC_NOEXC_PRIO 0x100
57 /* Maximum priority of non-secure exceptions when AIRCR.PRIS is set */
58 #define NVIC_NS_PRIO_LIMIT 0x80
59 
60 static const uint8_t nvic_id[] = {
61     0x00, 0xb0, 0x1b, 0x00, 0x0d, 0xe0, 0x05, 0xb1
62 };
63 
64 static int nvic_pending_prio(NVICState *s)
65 {
66     /* return the group priority of the current pending interrupt,
67      * or NVIC_NOEXC_PRIO if no interrupt is pending
68      */
69     return s->vectpending_prio;
70 }
71 
72 /* Return the value of the ISCR RETTOBASE bit:
73  * 1 if there is exactly one active exception
74  * 0 if there is more than one active exception
75  * UNKNOWN if there are no active exceptions (we choose 1,
76  * which matches the choice Cortex-M3 is documented as making).
77  *
78  * NB: some versions of the documentation talk about this
79  * counting "active exceptions other than the one shown by IPSR";
80  * this is only different in the obscure corner case where guest
81  * code has manually deactivated an exception and is about
82  * to fail an exception-return integrity check. The definition
83  * above is the one from the v8M ARM ARM and is also in line
84  * with the behaviour documented for the Cortex-M3.
85  */
86 static bool nvic_rettobase(NVICState *s)
87 {
88     int irq, nhand = 0;
89     bool check_sec = arm_feature(&s->cpu->env, ARM_FEATURE_M_SECURITY);
90 
91     for (irq = ARMV7M_EXCP_RESET; irq < s->num_irq; irq++) {
92         if (s->vectors[irq].active ||
93             (check_sec && irq < NVIC_INTERNAL_VECTORS &&
94              s->sec_vectors[irq].active)) {
95             nhand++;
96             if (nhand == 2) {
97                 return 0;
98             }
99         }
100     }
101 
102     return 1;
103 }
104 
105 /* Return the value of the ISCR ISRPENDING bit:
106  * 1 if an external interrupt is pending
107  * 0 if no external interrupt is pending
108  */
109 static bool nvic_isrpending(NVICState *s)
110 {
111     int irq;
112 
113     /* We can shortcut if the highest priority pending interrupt
114      * happens to be external or if there is nothing pending.
115      */
116     if (s->vectpending > NVIC_FIRST_IRQ) {
117         return true;
118     }
119     if (s->vectpending == 0) {
120         return false;
121     }
122 
123     for (irq = NVIC_FIRST_IRQ; irq < s->num_irq; irq++) {
124         if (s->vectors[irq].pending) {
125             return true;
126         }
127     }
128     return false;
129 }
130 
131 static bool exc_is_banked(int exc)
132 {
133     /* Return true if this is one of the limited set of exceptions which
134      * are banked (and thus have state in sec_vectors[])
135      */
136     return exc == ARMV7M_EXCP_HARD ||
137         exc == ARMV7M_EXCP_MEM ||
138         exc == ARMV7M_EXCP_USAGE ||
139         exc == ARMV7M_EXCP_SVC ||
140         exc == ARMV7M_EXCP_PENDSV ||
141         exc == ARMV7M_EXCP_SYSTICK;
142 }
143 
144 /* Return a mask word which clears the subpriority bits from
145  * a priority value for an M-profile exception, leaving only
146  * the group priority.
147  */
148 static inline uint32_t nvic_gprio_mask(NVICState *s, bool secure)
149 {
150     return ~0U << (s->prigroup[secure] + 1);
151 }
152 
153 static bool exc_targets_secure(NVICState *s, int exc)
154 {
155     /* Return true if this non-banked exception targets Secure state. */
156     if (!arm_feature(&s->cpu->env, ARM_FEATURE_M_SECURITY)) {
157         return false;
158     }
159 
160     if (exc >= NVIC_FIRST_IRQ) {
161         return !s->itns[exc];
162     }
163 
164     /* Function shouldn't be called for banked exceptions. */
165     assert(!exc_is_banked(exc));
166 
167     switch (exc) {
168     case ARMV7M_EXCP_NMI:
169     case ARMV7M_EXCP_BUS:
170         return !(s->cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK);
171     case ARMV7M_EXCP_SECURE:
172         return true;
173     case ARMV7M_EXCP_DEBUG:
174         /* TODO: controlled by DEMCR.SDME, which we don't yet implement */
175         return false;
176     default:
177         /* reset, and reserved (unused) low exception numbers.
178          * We'll get called by code that loops through all the exception
179          * numbers, but it doesn't matter what we return here as these
180          * non-existent exceptions will never be pended or active.
181          */
182         return true;
183     }
184 }
185 
186 static int exc_group_prio(NVICState *s, int rawprio, bool targets_secure)
187 {
188     /* Return the group priority for this exception, given its raw
189      * (group-and-subgroup) priority value and whether it is targeting
190      * secure state or not.
191      */
192     if (rawprio < 0) {
193         return rawprio;
194     }
195     rawprio &= nvic_gprio_mask(s, targets_secure);
196     /* AIRCR.PRIS causes us to squash all NS priorities into the
197      * lower half of the total range
198      */
199     if (!targets_secure &&
200         (s->cpu->env.v7m.aircr & R_V7M_AIRCR_PRIS_MASK)) {
201         rawprio = (rawprio >> 1) + NVIC_NS_PRIO_LIMIT;
202     }
203     return rawprio;
204 }
205 
206 /* Recompute vectpending and exception_prio for a CPU which implements
207  * the Security extension
208  */
209 static void nvic_recompute_state_secure(NVICState *s)
210 {
211     int i, bank;
212     int pend_prio = NVIC_NOEXC_PRIO;
213     int active_prio = NVIC_NOEXC_PRIO;
214     int pend_irq = 0;
215     bool pending_is_s_banked = false;
216 
217     /* R_CQRV: precedence is by:
218      *  - lowest group priority; if both the same then
219      *  - lowest subpriority; if both the same then
220      *  - lowest exception number; if both the same (ie banked) then
221      *  - secure exception takes precedence
222      * Compare pseudocode RawExecutionPriority.
223      * Annoyingly, now we have two prigroup values (for S and NS)
224      * we can't do the loop comparison on raw priority values.
225      */
226     for (i = 1; i < s->num_irq; i++) {
227         for (bank = M_REG_S; bank >= M_REG_NS; bank--) {
228             VecInfo *vec;
229             int prio;
230             bool targets_secure;
231 
232             if (bank == M_REG_S) {
233                 if (!exc_is_banked(i)) {
234                     continue;
235                 }
236                 vec = &s->sec_vectors[i];
237                 targets_secure = true;
238             } else {
239                 vec = &s->vectors[i];
240                 targets_secure = !exc_is_banked(i) && exc_targets_secure(s, i);
241             }
242 
243             prio = exc_group_prio(s, vec->prio, targets_secure);
244             if (vec->enabled && vec->pending && prio < pend_prio) {
245                 pend_prio = prio;
246                 pend_irq = i;
247                 pending_is_s_banked = (bank == M_REG_S);
248             }
249             if (vec->active && prio < active_prio) {
250                 active_prio = prio;
251             }
252         }
253     }
254 
255     s->vectpending_is_s_banked = pending_is_s_banked;
256     s->vectpending = pend_irq;
257     s->vectpending_prio = pend_prio;
258     s->exception_prio = active_prio;
259 
260     trace_nvic_recompute_state_secure(s->vectpending,
261                                       s->vectpending_is_s_banked,
262                                       s->vectpending_prio,
263                                       s->exception_prio);
264 }
265 
266 /* Recompute vectpending and exception_prio */
267 static void nvic_recompute_state(NVICState *s)
268 {
269     int i;
270     int pend_prio = NVIC_NOEXC_PRIO;
271     int active_prio = NVIC_NOEXC_PRIO;
272     int pend_irq = 0;
273 
274     /* In theory we could write one function that handled both
275      * the "security extension present" and "not present"; however
276      * the security related changes significantly complicate the
277      * recomputation just by themselves and mixing both cases together
278      * would be even worse, so we retain a separate non-secure-only
279      * version for CPUs which don't implement the security extension.
280      */
281     if (arm_feature(&s->cpu->env, ARM_FEATURE_M_SECURITY)) {
282         nvic_recompute_state_secure(s);
283         return;
284     }
285 
286     for (i = 1; i < s->num_irq; i++) {
287         VecInfo *vec = &s->vectors[i];
288 
289         if (vec->enabled && vec->pending && vec->prio < pend_prio) {
290             pend_prio = vec->prio;
291             pend_irq = i;
292         }
293         if (vec->active && vec->prio < active_prio) {
294             active_prio = vec->prio;
295         }
296     }
297 
298     if (active_prio > 0) {
299         active_prio &= nvic_gprio_mask(s, false);
300     }
301 
302     if (pend_prio > 0) {
303         pend_prio &= nvic_gprio_mask(s, false);
304     }
305 
306     s->vectpending = pend_irq;
307     s->vectpending_prio = pend_prio;
308     s->exception_prio = active_prio;
309 
310     trace_nvic_recompute_state(s->vectpending,
311                                s->vectpending_prio,
312                                s->exception_prio);
313 }
314 
315 /* Return the current execution priority of the CPU
316  * (equivalent to the pseudocode ExecutionPriority function).
317  * This is a value between -2 (NMI priority) and NVIC_NOEXC_PRIO.
318  */
319 static inline int nvic_exec_prio(NVICState *s)
320 {
321     CPUARMState *env = &s->cpu->env;
322     int running = NVIC_NOEXC_PRIO;
323 
324     if (env->v7m.basepri[M_REG_NS] > 0) {
325         running = exc_group_prio(s, env->v7m.basepri[M_REG_NS], M_REG_NS);
326     }
327 
328     if (env->v7m.basepri[M_REG_S] > 0) {
329         int basepri = exc_group_prio(s, env->v7m.basepri[M_REG_S], M_REG_S);
330         if (running > basepri) {
331             running = basepri;
332         }
333     }
334 
335     if (env->v7m.primask[M_REG_NS]) {
336         if (env->v7m.aircr & R_V7M_AIRCR_PRIS_MASK) {
337             if (running > NVIC_NS_PRIO_LIMIT) {
338                 running = NVIC_NS_PRIO_LIMIT;
339             }
340         } else {
341             running = 0;
342         }
343     }
344 
345     if (env->v7m.primask[M_REG_S]) {
346         running = 0;
347     }
348 
349     if (env->v7m.faultmask[M_REG_NS]) {
350         if (env->v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK) {
351             running = -1;
352         } else {
353             if (env->v7m.aircr & R_V7M_AIRCR_PRIS_MASK) {
354                 if (running > NVIC_NS_PRIO_LIMIT) {
355                     running = NVIC_NS_PRIO_LIMIT;
356                 }
357             } else {
358                 running = 0;
359             }
360         }
361     }
362 
363     if (env->v7m.faultmask[M_REG_S]) {
364         running = (env->v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK) ? -3 : -1;
365     }
366 
367     /* consider priority of active handler */
368     return MIN(running, s->exception_prio);
369 }
370 
371 bool armv7m_nvic_neg_prio_requested(void *opaque, bool secure)
372 {
373     /* Return true if the requested execution priority is negative
374      * for the specified security state, ie that security state
375      * has an active NMI or HardFault or has set its FAULTMASK.
376      * Note that this is not the same as whether the execution
377      * priority is actually negative (for instance AIRCR.PRIS may
378      * mean we don't allow FAULTMASK_NS to actually make the execution
379      * priority negative). Compare pseudocode IsReqExcPriNeg().
380      */
381     NVICState *s = opaque;
382 
383     if (s->cpu->env.v7m.faultmask[secure]) {
384         return true;
385     }
386 
387     if (secure ? s->sec_vectors[ARMV7M_EXCP_HARD].active :
388         s->vectors[ARMV7M_EXCP_HARD].active) {
389         return true;
390     }
391 
392     if (s->vectors[ARMV7M_EXCP_NMI].active &&
393         exc_targets_secure(s, ARMV7M_EXCP_NMI) == secure) {
394         return true;
395     }
396 
397     return false;
398 }
399 
400 bool armv7m_nvic_can_take_pending_exception(void *opaque)
401 {
402     NVICState *s = opaque;
403 
404     return nvic_exec_prio(s) > nvic_pending_prio(s);
405 }
406 
407 int armv7m_nvic_raw_execution_priority(void *opaque)
408 {
409     NVICState *s = opaque;
410 
411     return s->exception_prio;
412 }
413 
414 /* caller must call nvic_irq_update() after this.
415  * secure indicates the bank to use for banked exceptions (we assert if
416  * we are passed secure=true for a non-banked exception).
417  */
418 static void set_prio(NVICState *s, unsigned irq, bool secure, uint8_t prio)
419 {
420     assert(irq > ARMV7M_EXCP_NMI); /* only use for configurable prios */
421     assert(irq < s->num_irq);
422 
423     prio &= MAKE_64BIT_MASK(8 - s->num_prio_bits, s->num_prio_bits);
424 
425     if (secure) {
426         assert(exc_is_banked(irq));
427         s->sec_vectors[irq].prio = prio;
428     } else {
429         s->vectors[irq].prio = prio;
430     }
431 
432     trace_nvic_set_prio(irq, secure, prio);
433 }
434 
435 /* Return the current raw priority register value.
436  * secure indicates the bank to use for banked exceptions (we assert if
437  * we are passed secure=true for a non-banked exception).
438  */
439 static int get_prio(NVICState *s, unsigned irq, bool secure)
440 {
441     assert(irq > ARMV7M_EXCP_NMI); /* only use for configurable prios */
442     assert(irq < s->num_irq);
443 
444     if (secure) {
445         assert(exc_is_banked(irq));
446         return s->sec_vectors[irq].prio;
447     } else {
448         return s->vectors[irq].prio;
449     }
450 }
451 
452 /* Recompute state and assert irq line accordingly.
453  * Must be called after changes to:
454  *  vec->active, vec->enabled, vec->pending or vec->prio for any vector
455  *  prigroup
456  */
457 static void nvic_irq_update(NVICState *s)
458 {
459     int lvl;
460     int pend_prio;
461 
462     nvic_recompute_state(s);
463     pend_prio = nvic_pending_prio(s);
464 
465     /* Raise NVIC output if this IRQ would be taken, except that we
466      * ignore the effects of the BASEPRI, FAULTMASK and PRIMASK (which
467      * will be checked for in arm_v7m_cpu_exec_interrupt()); changes
468      * to those CPU registers don't cause us to recalculate the NVIC
469      * pending info.
470      */
471     lvl = (pend_prio < s->exception_prio);
472     trace_nvic_irq_update(s->vectpending, pend_prio, s->exception_prio, lvl);
473     qemu_set_irq(s->excpout, lvl);
474 }
475 
476 /**
477  * armv7m_nvic_clear_pending: mark the specified exception as not pending
478  * @opaque: the NVIC
479  * @irq: the exception number to mark as not pending
480  * @secure: false for non-banked exceptions or for the nonsecure
481  * version of a banked exception, true for the secure version of a banked
482  * exception.
483  *
484  * Marks the specified exception as not pending. Note that we will assert()
485  * if @secure is true and @irq does not specify one of the fixed set
486  * of architecturally banked exceptions.
487  */
488 static void armv7m_nvic_clear_pending(void *opaque, int irq, bool secure)
489 {
490     NVICState *s = (NVICState *)opaque;
491     VecInfo *vec;
492 
493     assert(irq > ARMV7M_EXCP_RESET && irq < s->num_irq);
494 
495     if (secure) {
496         assert(exc_is_banked(irq));
497         vec = &s->sec_vectors[irq];
498     } else {
499         vec = &s->vectors[irq];
500     }
501     trace_nvic_clear_pending(irq, secure, vec->enabled, vec->prio);
502     if (vec->pending) {
503         vec->pending = 0;
504         nvic_irq_update(s);
505     }
506 }
507 
508 static void do_armv7m_nvic_set_pending(void *opaque, int irq, bool secure,
509                                        bool derived)
510 {
511     /* Pend an exception, including possibly escalating it to HardFault.
512      *
513      * This function handles both "normal" pending of interrupts and
514      * exceptions, and also derived exceptions (ones which occur as
515      * a result of trying to take some other exception).
516      *
517      * If derived == true, the caller guarantees that we are part way through
518      * trying to take an exception (but have not yet called
519      * armv7m_nvic_acknowledge_irq() to make it active), and so:
520      *  - s->vectpending is the "original exception" we were trying to take
521      *  - irq is the "derived exception"
522      *  - nvic_exec_prio(s) gives the priority before exception entry
523      * Here we handle the prioritization logic which the pseudocode puts
524      * in the DerivedLateArrival() function.
525      */
526 
527     NVICState *s = (NVICState *)opaque;
528     bool banked = exc_is_banked(irq);
529     VecInfo *vec;
530     bool targets_secure;
531 
532     assert(irq > ARMV7M_EXCP_RESET && irq < s->num_irq);
533     assert(!secure || banked);
534 
535     vec = (banked && secure) ? &s->sec_vectors[irq] : &s->vectors[irq];
536 
537     targets_secure = banked ? secure : exc_targets_secure(s, irq);
538 
539     trace_nvic_set_pending(irq, secure, targets_secure,
540                            derived, vec->enabled, vec->prio);
541 
542     if (derived) {
543         /* Derived exceptions are always synchronous. */
544         assert(irq >= ARMV7M_EXCP_HARD && irq < ARMV7M_EXCP_PENDSV);
545 
546         if (irq == ARMV7M_EXCP_DEBUG &&
547             exc_group_prio(s, vec->prio, secure) >= nvic_exec_prio(s)) {
548             /* DebugMonitorFault, but its priority is lower than the
549              * preempted exception priority: just ignore it.
550              */
551             return;
552         }
553 
554         if (irq == ARMV7M_EXCP_HARD && vec->prio >= s->vectpending_prio) {
555             /* If this is a terminal exception (one which means we cannot
556              * take the original exception, like a failure to read its
557              * vector table entry), then we must take the derived exception.
558              * If the derived exception can't take priority over the
559              * original exception, then we go into Lockup.
560              *
561              * For QEMU, we rely on the fact that a derived exception is
562              * terminal if and only if it's reported to us as HardFault,
563              * which saves having to have an extra argument is_terminal
564              * that we'd only use in one place.
565              */
566             cpu_abort(&s->cpu->parent_obj,
567                       "Lockup: can't take terminal derived exception "
568                       "(original exception priority %d)\n",
569                       s->vectpending_prio);
570         }
571         /* We now continue with the same code as for a normal pending
572          * exception, which will cause us to pend the derived exception.
573          * We'll then take either the original or the derived exception
574          * based on which is higher priority by the usual mechanism
575          * for selecting the highest priority pending interrupt.
576          */
577     }
578 
579     if (irq >= ARMV7M_EXCP_HARD && irq < ARMV7M_EXCP_PENDSV) {
580         /* If a synchronous exception is pending then it may be
581          * escalated to HardFault if:
582          *  * it is equal or lower priority to current execution
583          *  * it is disabled
584          * (ie we need to take it immediately but we can't do so).
585          * Asynchronous exceptions (and interrupts) simply remain pending.
586          *
587          * For QEMU, we don't have any imprecise (asynchronous) faults,
588          * so we can assume that PREFETCH_ABORT and DATA_ABORT are always
589          * synchronous.
590          * Debug exceptions are awkward because only Debug exceptions
591          * resulting from the BKPT instruction should be escalated,
592          * but we don't currently implement any Debug exceptions other
593          * than those that result from BKPT, so we treat all debug exceptions
594          * as needing escalation.
595          *
596          * This all means we can identify whether to escalate based only on
597          * the exception number and don't (yet) need the caller to explicitly
598          * tell us whether this exception is synchronous or not.
599          */
600         int running = nvic_exec_prio(s);
601         bool escalate = false;
602 
603         if (exc_group_prio(s, vec->prio, secure) >= running) {
604             trace_nvic_escalate_prio(irq, vec->prio, running);
605             escalate = true;
606         } else if (!vec->enabled) {
607             trace_nvic_escalate_disabled(irq);
608             escalate = true;
609         }
610 
611         if (escalate) {
612 
613             /* We need to escalate this exception to a synchronous HardFault.
614              * If BFHFNMINS is set then we escalate to the banked HF for
615              * the target security state of the original exception; otherwise
616              * we take a Secure HardFault.
617              */
618             irq = ARMV7M_EXCP_HARD;
619             if (arm_feature(&s->cpu->env, ARM_FEATURE_M_SECURITY) &&
620                 (targets_secure ||
621                  !(s->cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK))) {
622                 vec = &s->sec_vectors[irq];
623             } else {
624                 vec = &s->vectors[irq];
625             }
626             if (running <= vec->prio) {
627                 /* We want to escalate to HardFault but we can't take the
628                  * synchronous HardFault at this point either. This is a
629                  * Lockup condition due to a guest bug. We don't model
630                  * Lockup, so report via cpu_abort() instead.
631                  */
632                 cpu_abort(&s->cpu->parent_obj,
633                           "Lockup: can't escalate %d to HardFault "
634                           "(current priority %d)\n", irq, running);
635             }
636 
637             /* HF may be banked but there is only one shared HFSR */
638             s->cpu->env.v7m.hfsr |= R_V7M_HFSR_FORCED_MASK;
639         }
640     }
641 
642     if (!vec->pending) {
643         vec->pending = 1;
644         nvic_irq_update(s);
645     }
646 }
647 
648 void armv7m_nvic_set_pending(void *opaque, int irq, bool secure)
649 {
650     do_armv7m_nvic_set_pending(opaque, irq, secure, false);
651 }
652 
653 void armv7m_nvic_set_pending_derived(void *opaque, int irq, bool secure)
654 {
655     do_armv7m_nvic_set_pending(opaque, irq, secure, true);
656 }
657 
658 /* Make pending IRQ active.  */
659 void armv7m_nvic_acknowledge_irq(void *opaque)
660 {
661     NVICState *s = (NVICState *)opaque;
662     CPUARMState *env = &s->cpu->env;
663     const int pending = s->vectpending;
664     const int running = nvic_exec_prio(s);
665     VecInfo *vec;
666 
667     assert(pending > ARMV7M_EXCP_RESET && pending < s->num_irq);
668 
669     if (s->vectpending_is_s_banked) {
670         vec = &s->sec_vectors[pending];
671     } else {
672         vec = &s->vectors[pending];
673     }
674 
675     assert(vec->enabled);
676     assert(vec->pending);
677 
678     assert(s->vectpending_prio < running);
679 
680     trace_nvic_acknowledge_irq(pending, s->vectpending_prio);
681 
682     vec->active = 1;
683     vec->pending = 0;
684 
685     write_v7m_exception(env, s->vectpending);
686 
687     nvic_irq_update(s);
688 }
689 
690 void armv7m_nvic_get_pending_irq_info(void *opaque,
691                                       int *pirq, bool *ptargets_secure)
692 {
693     NVICState *s = (NVICState *)opaque;
694     const int pending = s->vectpending;
695     bool targets_secure;
696 
697     assert(pending > ARMV7M_EXCP_RESET && pending < s->num_irq);
698 
699     if (s->vectpending_is_s_banked) {
700         targets_secure = true;
701     } else {
702         targets_secure = !exc_is_banked(pending) &&
703             exc_targets_secure(s, pending);
704     }
705 
706     trace_nvic_get_pending_irq_info(pending, targets_secure);
707 
708     *ptargets_secure = targets_secure;
709     *pirq = pending;
710 }
711 
712 int armv7m_nvic_complete_irq(void *opaque, int irq, bool secure)
713 {
714     NVICState *s = (NVICState *)opaque;
715     VecInfo *vec;
716     int ret;
717 
718     assert(irq > ARMV7M_EXCP_RESET && irq < s->num_irq);
719 
720     if (secure && exc_is_banked(irq)) {
721         vec = &s->sec_vectors[irq];
722     } else {
723         vec = &s->vectors[irq];
724     }
725 
726     trace_nvic_complete_irq(irq, secure);
727 
728     if (!vec->active) {
729         /* Tell the caller this was an illegal exception return */
730         return -1;
731     }
732 
733     ret = nvic_rettobase(s);
734 
735     vec->active = 0;
736     if (vec->level) {
737         /* Re-pend the exception if it's still held high; only
738          * happens for extenal IRQs
739          */
740         assert(irq >= NVIC_FIRST_IRQ);
741         vec->pending = 1;
742     }
743 
744     nvic_irq_update(s);
745 
746     return ret;
747 }
748 
749 /* callback when external interrupt line is changed */
750 static void set_irq_level(void *opaque, int n, int level)
751 {
752     NVICState *s = opaque;
753     VecInfo *vec;
754 
755     n += NVIC_FIRST_IRQ;
756 
757     assert(n >= NVIC_FIRST_IRQ && n < s->num_irq);
758 
759     trace_nvic_set_irq_level(n, level);
760 
761     /* The pending status of an external interrupt is
762      * latched on rising edge and exception handler return.
763      *
764      * Pulsing the IRQ will always run the handler
765      * once, and the handler will re-run until the
766      * level is low when the handler completes.
767      */
768     vec = &s->vectors[n];
769     if (level != vec->level) {
770         vec->level = level;
771         if (level) {
772             armv7m_nvic_set_pending(s, n, false);
773         }
774     }
775 }
776 
777 /* callback when external NMI line is changed */
778 static void nvic_nmi_trigger(void *opaque, int n, int level)
779 {
780     NVICState *s = opaque;
781 
782     trace_nvic_set_nmi_level(level);
783 
784     /*
785      * The architecture doesn't specify whether NMI should share
786      * the normal-interrupt behaviour of being resampled on
787      * exception handler return. We choose not to, so just
788      * set NMI pending here and don't track the current level.
789      */
790     if (level) {
791         armv7m_nvic_set_pending(s, ARMV7M_EXCP_NMI, false);
792     }
793 }
794 
795 static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
796 {
797     ARMCPU *cpu = s->cpu;
798     uint32_t val;
799 
800     switch (offset) {
801     case 4: /* Interrupt Control Type.  */
802         if (!arm_feature(&cpu->env, ARM_FEATURE_V7)) {
803             goto bad_offset;
804         }
805         return ((s->num_irq - NVIC_FIRST_IRQ) / 32) - 1;
806     case 0xc: /* CPPWR */
807         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
808             goto bad_offset;
809         }
810         /* We make the IMPDEF choice that nothing can ever go into a
811          * non-retentive power state, which allows us to RAZ/WI this.
812          */
813         return 0;
814     case 0x380 ... 0x3bf: /* NVIC_ITNS<n> */
815     {
816         int startvec = 8 * (offset - 0x380) + NVIC_FIRST_IRQ;
817         int i;
818 
819         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
820             goto bad_offset;
821         }
822         if (!attrs.secure) {
823             return 0;
824         }
825         val = 0;
826         for (i = 0; i < 32 && startvec + i < s->num_irq; i++) {
827             if (s->itns[startvec + i]) {
828                 val |= (1 << i);
829             }
830         }
831         return val;
832     }
833     case 0xd00: /* CPUID Base.  */
834         return cpu->midr;
835     case 0xd04: /* Interrupt Control State (ICSR) */
836         /* VECTACTIVE */
837         val = cpu->env.v7m.exception;
838         /* VECTPENDING */
839         val |= (s->vectpending & 0xff) << 12;
840         /* ISRPENDING - set if any external IRQ is pending */
841         if (nvic_isrpending(s)) {
842             val |= (1 << 22);
843         }
844         /* RETTOBASE - set if only one handler is active */
845         if (nvic_rettobase(s)) {
846             val |= (1 << 11);
847         }
848         if (attrs.secure) {
849             /* PENDSTSET */
850             if (s->sec_vectors[ARMV7M_EXCP_SYSTICK].pending) {
851                 val |= (1 << 26);
852             }
853             /* PENDSVSET */
854             if (s->sec_vectors[ARMV7M_EXCP_PENDSV].pending) {
855                 val |= (1 << 28);
856             }
857         } else {
858             /* PENDSTSET */
859             if (s->vectors[ARMV7M_EXCP_SYSTICK].pending) {
860                 val |= (1 << 26);
861             }
862             /* PENDSVSET */
863             if (s->vectors[ARMV7M_EXCP_PENDSV].pending) {
864                 val |= (1 << 28);
865             }
866         }
867         /* NMIPENDSET */
868         if ((attrs.secure || (cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK))
869             && s->vectors[ARMV7M_EXCP_NMI].pending) {
870             val |= (1 << 31);
871         }
872         /* ISRPREEMPT: RES0 when halting debug not implemented */
873         /* STTNS: RES0 for the Main Extension */
874         return val;
875     case 0xd08: /* Vector Table Offset.  */
876         return cpu->env.v7m.vecbase[attrs.secure];
877     case 0xd0c: /* Application Interrupt/Reset Control (AIRCR) */
878         val = 0xfa050000 | (s->prigroup[attrs.secure] << 8);
879         if (attrs.secure) {
880             /* s->aircr stores PRIS, BFHFNMINS, SYSRESETREQS */
881             val |= cpu->env.v7m.aircr;
882         } else {
883             if (arm_feature(&cpu->env, ARM_FEATURE_V8)) {
884                 /* BFHFNMINS is R/O from NS; other bits are RAZ/WI. If
885                  * security isn't supported then BFHFNMINS is RAO (and
886                  * the bit in env.v7m.aircr is always set).
887                  */
888                 val |= cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK;
889             }
890         }
891         return val;
892     case 0xd10: /* System Control.  */
893         if (!arm_feature(&cpu->env, ARM_FEATURE_V7)) {
894             goto bad_offset;
895         }
896         return cpu->env.v7m.scr[attrs.secure];
897     case 0xd14: /* Configuration Control.  */
898         /* The BFHFNMIGN bit is the only non-banked bit; we
899          * keep it in the non-secure copy of the register.
900          */
901         val = cpu->env.v7m.ccr[attrs.secure];
902         val |= cpu->env.v7m.ccr[M_REG_NS] & R_V7M_CCR_BFHFNMIGN_MASK;
903         return val;
904     case 0xd24: /* System Handler Control and State (SHCSR) */
905         if (!arm_feature(&cpu->env, ARM_FEATURE_V7)) {
906             goto bad_offset;
907         }
908         val = 0;
909         if (attrs.secure) {
910             if (s->sec_vectors[ARMV7M_EXCP_MEM].active) {
911                 val |= (1 << 0);
912             }
913             if (s->sec_vectors[ARMV7M_EXCP_HARD].active) {
914                 val |= (1 << 2);
915             }
916             if (s->sec_vectors[ARMV7M_EXCP_USAGE].active) {
917                 val |= (1 << 3);
918             }
919             if (s->sec_vectors[ARMV7M_EXCP_SVC].active) {
920                 val |= (1 << 7);
921             }
922             if (s->sec_vectors[ARMV7M_EXCP_PENDSV].active) {
923                 val |= (1 << 10);
924             }
925             if (s->sec_vectors[ARMV7M_EXCP_SYSTICK].active) {
926                 val |= (1 << 11);
927             }
928             if (s->sec_vectors[ARMV7M_EXCP_USAGE].pending) {
929                 val |= (1 << 12);
930             }
931             if (s->sec_vectors[ARMV7M_EXCP_MEM].pending) {
932                 val |= (1 << 13);
933             }
934             if (s->sec_vectors[ARMV7M_EXCP_SVC].pending) {
935                 val |= (1 << 15);
936             }
937             if (s->sec_vectors[ARMV7M_EXCP_MEM].enabled) {
938                 val |= (1 << 16);
939             }
940             if (s->sec_vectors[ARMV7M_EXCP_USAGE].enabled) {
941                 val |= (1 << 18);
942             }
943             if (s->sec_vectors[ARMV7M_EXCP_HARD].pending) {
944                 val |= (1 << 21);
945             }
946             /* SecureFault is not banked but is always RAZ/WI to NS */
947             if (s->vectors[ARMV7M_EXCP_SECURE].active) {
948                 val |= (1 << 4);
949             }
950             if (s->vectors[ARMV7M_EXCP_SECURE].enabled) {
951                 val |= (1 << 19);
952             }
953             if (s->vectors[ARMV7M_EXCP_SECURE].pending) {
954                 val |= (1 << 20);
955             }
956         } else {
957             if (s->vectors[ARMV7M_EXCP_MEM].active) {
958                 val |= (1 << 0);
959             }
960             if (arm_feature(&cpu->env, ARM_FEATURE_V8)) {
961                 /* HARDFAULTACT, HARDFAULTPENDED not present in v7M */
962                 if (s->vectors[ARMV7M_EXCP_HARD].active) {
963                     val |= (1 << 2);
964                 }
965                 if (s->vectors[ARMV7M_EXCP_HARD].pending) {
966                     val |= (1 << 21);
967                 }
968             }
969             if (s->vectors[ARMV7M_EXCP_USAGE].active) {
970                 val |= (1 << 3);
971             }
972             if (s->vectors[ARMV7M_EXCP_SVC].active) {
973                 val |= (1 << 7);
974             }
975             if (s->vectors[ARMV7M_EXCP_PENDSV].active) {
976                 val |= (1 << 10);
977             }
978             if (s->vectors[ARMV7M_EXCP_SYSTICK].active) {
979                 val |= (1 << 11);
980             }
981             if (s->vectors[ARMV7M_EXCP_USAGE].pending) {
982                 val |= (1 << 12);
983             }
984             if (s->vectors[ARMV7M_EXCP_MEM].pending) {
985                 val |= (1 << 13);
986             }
987             if (s->vectors[ARMV7M_EXCP_SVC].pending) {
988                 val |= (1 << 15);
989             }
990             if (s->vectors[ARMV7M_EXCP_MEM].enabled) {
991                 val |= (1 << 16);
992             }
993             if (s->vectors[ARMV7M_EXCP_USAGE].enabled) {
994                 val |= (1 << 18);
995             }
996         }
997         if (attrs.secure || (cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK)) {
998             if (s->vectors[ARMV7M_EXCP_BUS].active) {
999                 val |= (1 << 1);
1000             }
1001             if (s->vectors[ARMV7M_EXCP_BUS].pending) {
1002                 val |= (1 << 14);
1003             }
1004             if (s->vectors[ARMV7M_EXCP_BUS].enabled) {
1005                 val |= (1 << 17);
1006             }
1007             if (arm_feature(&cpu->env, ARM_FEATURE_V8) &&
1008                 s->vectors[ARMV7M_EXCP_NMI].active) {
1009                 /* NMIACT is not present in v7M */
1010                 val |= (1 << 5);
1011             }
1012         }
1013 
1014         /* TODO: this is RAZ/WI from NS if DEMCR.SDME is set */
1015         if (s->vectors[ARMV7M_EXCP_DEBUG].active) {
1016             val |= (1 << 8);
1017         }
1018         return val;
1019     case 0xd2c: /* Hard Fault Status.  */
1020         if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
1021             goto bad_offset;
1022         }
1023         return cpu->env.v7m.hfsr;
1024     case 0xd30: /* Debug Fault Status.  */
1025         return cpu->env.v7m.dfsr;
1026     case 0xd34: /* MMFAR MemManage Fault Address */
1027         if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
1028             goto bad_offset;
1029         }
1030         return cpu->env.v7m.mmfar[attrs.secure];
1031     case 0xd38: /* Bus Fault Address.  */
1032         if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
1033             goto bad_offset;
1034         }
1035         return cpu->env.v7m.bfar;
1036     case 0xd3c: /* Aux Fault Status.  */
1037         /* TODO: Implement fault status registers.  */
1038         qemu_log_mask(LOG_UNIMP,
1039                       "Aux Fault status registers unimplemented\n");
1040         return 0;
1041     case 0xd40: /* PFR0.  */
1042         return cpu->id_pfr0;
1043     case 0xd44: /* PFR1.  */
1044         return cpu->id_pfr1;
1045     case 0xd48: /* DFR0.  */
1046         return cpu->id_dfr0;
1047     case 0xd4c: /* AFR0.  */
1048         return cpu->id_afr0;
1049     case 0xd50: /* MMFR0.  */
1050         return cpu->id_mmfr0;
1051     case 0xd54: /* MMFR1.  */
1052         return cpu->id_mmfr1;
1053     case 0xd58: /* MMFR2.  */
1054         return cpu->id_mmfr2;
1055     case 0xd5c: /* MMFR3.  */
1056         return cpu->id_mmfr3;
1057     case 0xd60: /* ISAR0.  */
1058         return cpu->isar.id_isar0;
1059     case 0xd64: /* ISAR1.  */
1060         return cpu->isar.id_isar1;
1061     case 0xd68: /* ISAR2.  */
1062         return cpu->isar.id_isar2;
1063     case 0xd6c: /* ISAR3.  */
1064         return cpu->isar.id_isar3;
1065     case 0xd70: /* ISAR4.  */
1066         return cpu->isar.id_isar4;
1067     case 0xd74: /* ISAR5.  */
1068         return cpu->isar.id_isar5;
1069     case 0xd78: /* CLIDR */
1070         return cpu->clidr;
1071     case 0xd7c: /* CTR */
1072         return cpu->ctr;
1073     case 0xd80: /* CSSIDR */
1074     {
1075         int idx = cpu->env.v7m.csselr[attrs.secure] & R_V7M_CSSELR_INDEX_MASK;
1076         return cpu->ccsidr[idx];
1077     }
1078     case 0xd84: /* CSSELR */
1079         return cpu->env.v7m.csselr[attrs.secure];
1080     /* TODO: Implement debug registers.  */
1081     case 0xd90: /* MPU_TYPE */
1082         /* Unified MPU; if the MPU is not present this value is zero */
1083         return cpu->pmsav7_dregion << 8;
1084         break;
1085     case 0xd94: /* MPU_CTRL */
1086         return cpu->env.v7m.mpu_ctrl[attrs.secure];
1087     case 0xd98: /* MPU_RNR */
1088         return cpu->env.pmsav7.rnr[attrs.secure];
1089     case 0xd9c: /* MPU_RBAR */
1090     case 0xda4: /* MPU_RBAR_A1 */
1091     case 0xdac: /* MPU_RBAR_A2 */
1092     case 0xdb4: /* MPU_RBAR_A3 */
1093     {
1094         int region = cpu->env.pmsav7.rnr[attrs.secure];
1095 
1096         if (arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1097             /* PMSAv8M handling of the aliases is different from v7M:
1098              * aliases A1, A2, A3 override the low two bits of the region
1099              * number in MPU_RNR, and there is no 'region' field in the
1100              * RBAR register.
1101              */
1102             int aliasno = (offset - 0xd9c) / 8; /* 0..3 */
1103             if (aliasno) {
1104                 region = deposit32(region, 0, 2, aliasno);
1105             }
1106             if (region >= cpu->pmsav7_dregion) {
1107                 return 0;
1108             }
1109             return cpu->env.pmsav8.rbar[attrs.secure][region];
1110         }
1111 
1112         if (region >= cpu->pmsav7_dregion) {
1113             return 0;
1114         }
1115         return (cpu->env.pmsav7.drbar[region] & ~0x1f) | (region & 0xf);
1116     }
1117     case 0xda0: /* MPU_RASR (v7M), MPU_RLAR (v8M) */
1118     case 0xda8: /* MPU_RASR_A1 (v7M), MPU_RLAR_A1 (v8M) */
1119     case 0xdb0: /* MPU_RASR_A2 (v7M), MPU_RLAR_A2 (v8M) */
1120     case 0xdb8: /* MPU_RASR_A3 (v7M), MPU_RLAR_A3 (v8M) */
1121     {
1122         int region = cpu->env.pmsav7.rnr[attrs.secure];
1123 
1124         if (arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1125             /* PMSAv8M handling of the aliases is different from v7M:
1126              * aliases A1, A2, A3 override the low two bits of the region
1127              * number in MPU_RNR.
1128              */
1129             int aliasno = (offset - 0xda0) / 8; /* 0..3 */
1130             if (aliasno) {
1131                 region = deposit32(region, 0, 2, aliasno);
1132             }
1133             if (region >= cpu->pmsav7_dregion) {
1134                 return 0;
1135             }
1136             return cpu->env.pmsav8.rlar[attrs.secure][region];
1137         }
1138 
1139         if (region >= cpu->pmsav7_dregion) {
1140             return 0;
1141         }
1142         return ((cpu->env.pmsav7.dracr[region] & 0xffff) << 16) |
1143             (cpu->env.pmsav7.drsr[region] & 0xffff);
1144     }
1145     case 0xdc0: /* MPU_MAIR0 */
1146         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1147             goto bad_offset;
1148         }
1149         return cpu->env.pmsav8.mair0[attrs.secure];
1150     case 0xdc4: /* MPU_MAIR1 */
1151         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1152             goto bad_offset;
1153         }
1154         return cpu->env.pmsav8.mair1[attrs.secure];
1155     case 0xdd0: /* SAU_CTRL */
1156         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1157             goto bad_offset;
1158         }
1159         if (!attrs.secure) {
1160             return 0;
1161         }
1162         return cpu->env.sau.ctrl;
1163     case 0xdd4: /* SAU_TYPE */
1164         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1165             goto bad_offset;
1166         }
1167         if (!attrs.secure) {
1168             return 0;
1169         }
1170         return cpu->sau_sregion;
1171     case 0xdd8: /* SAU_RNR */
1172         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1173             goto bad_offset;
1174         }
1175         if (!attrs.secure) {
1176             return 0;
1177         }
1178         return cpu->env.sau.rnr;
1179     case 0xddc: /* SAU_RBAR */
1180     {
1181         int region = cpu->env.sau.rnr;
1182 
1183         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1184             goto bad_offset;
1185         }
1186         if (!attrs.secure) {
1187             return 0;
1188         }
1189         if (region >= cpu->sau_sregion) {
1190             return 0;
1191         }
1192         return cpu->env.sau.rbar[region];
1193     }
1194     case 0xde0: /* SAU_RLAR */
1195     {
1196         int region = cpu->env.sau.rnr;
1197 
1198         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1199             goto bad_offset;
1200         }
1201         if (!attrs.secure) {
1202             return 0;
1203         }
1204         if (region >= cpu->sau_sregion) {
1205             return 0;
1206         }
1207         return cpu->env.sau.rlar[region];
1208     }
1209     case 0xde4: /* SFSR */
1210         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1211             goto bad_offset;
1212         }
1213         if (!attrs.secure) {
1214             return 0;
1215         }
1216         return cpu->env.v7m.sfsr;
1217     case 0xde8: /* SFAR */
1218         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1219             goto bad_offset;
1220         }
1221         if (!attrs.secure) {
1222             return 0;
1223         }
1224         return cpu->env.v7m.sfar;
1225     case 0xf40: /* MVFR0 */
1226         return cpu->isar.mvfr0;
1227     case 0xf44: /* MVFR1 */
1228         return cpu->isar.mvfr1;
1229     case 0xf48: /* MVFR2 */
1230         return cpu->isar.mvfr2;
1231     default:
1232     bad_offset:
1233         qemu_log_mask(LOG_GUEST_ERROR, "NVIC: Bad read offset 0x%x\n", offset);
1234         return 0;
1235     }
1236 }
1237 
1238 static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value,
1239                         MemTxAttrs attrs)
1240 {
1241     ARMCPU *cpu = s->cpu;
1242 
1243     switch (offset) {
1244     case 0xc: /* CPPWR */
1245         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1246             goto bad_offset;
1247         }
1248         /* Make the IMPDEF choice to RAZ/WI this. */
1249         break;
1250     case 0x380 ... 0x3bf: /* NVIC_ITNS<n> */
1251     {
1252         int startvec = 8 * (offset - 0x380) + NVIC_FIRST_IRQ;
1253         int i;
1254 
1255         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1256             goto bad_offset;
1257         }
1258         if (!attrs.secure) {
1259             break;
1260         }
1261         for (i = 0; i < 32 && startvec + i < s->num_irq; i++) {
1262             s->itns[startvec + i] = (value >> i) & 1;
1263         }
1264         nvic_irq_update(s);
1265         break;
1266     }
1267     case 0xd04: /* Interrupt Control State (ICSR) */
1268         if (attrs.secure || cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK) {
1269             if (value & (1 << 31)) {
1270                 armv7m_nvic_set_pending(s, ARMV7M_EXCP_NMI, false);
1271             } else if (value & (1 << 30) &&
1272                        arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1273                 /* PENDNMICLR didn't exist in v7M */
1274                 armv7m_nvic_clear_pending(s, ARMV7M_EXCP_NMI, false);
1275             }
1276         }
1277         if (value & (1 << 28)) {
1278             armv7m_nvic_set_pending(s, ARMV7M_EXCP_PENDSV, attrs.secure);
1279         } else if (value & (1 << 27)) {
1280             armv7m_nvic_clear_pending(s, ARMV7M_EXCP_PENDSV, attrs.secure);
1281         }
1282         if (value & (1 << 26)) {
1283             armv7m_nvic_set_pending(s, ARMV7M_EXCP_SYSTICK, attrs.secure);
1284         } else if (value & (1 << 25)) {
1285             armv7m_nvic_clear_pending(s, ARMV7M_EXCP_SYSTICK, attrs.secure);
1286         }
1287         break;
1288     case 0xd08: /* Vector Table Offset.  */
1289         cpu->env.v7m.vecbase[attrs.secure] = value & 0xffffff80;
1290         break;
1291     case 0xd0c: /* Application Interrupt/Reset Control (AIRCR) */
1292         if ((value >> R_V7M_AIRCR_VECTKEY_SHIFT) == 0x05fa) {
1293             if (value & R_V7M_AIRCR_SYSRESETREQ_MASK) {
1294                 if (attrs.secure ||
1295                     !(cpu->env.v7m.aircr & R_V7M_AIRCR_SYSRESETREQS_MASK)) {
1296                     qemu_irq_pulse(s->sysresetreq);
1297                 }
1298             }
1299             if (value & R_V7M_AIRCR_VECTCLRACTIVE_MASK) {
1300                 qemu_log_mask(LOG_GUEST_ERROR,
1301                               "Setting VECTCLRACTIVE when not in DEBUG mode "
1302                               "is UNPREDICTABLE\n");
1303             }
1304             if (value & R_V7M_AIRCR_VECTRESET_MASK) {
1305                 /* NB: this bit is RES0 in v8M */
1306                 qemu_log_mask(LOG_GUEST_ERROR,
1307                               "Setting VECTRESET when not in DEBUG mode "
1308                               "is UNPREDICTABLE\n");
1309             }
1310             if (arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
1311                 s->prigroup[attrs.secure] =
1312                     extract32(value,
1313                               R_V7M_AIRCR_PRIGROUP_SHIFT,
1314                               R_V7M_AIRCR_PRIGROUP_LENGTH);
1315             }
1316             if (attrs.secure) {
1317                 /* These bits are only writable by secure */
1318                 cpu->env.v7m.aircr = value &
1319                     (R_V7M_AIRCR_SYSRESETREQS_MASK |
1320                      R_V7M_AIRCR_BFHFNMINS_MASK |
1321                      R_V7M_AIRCR_PRIS_MASK);
1322                 /* BFHFNMINS changes the priority of Secure HardFault, and
1323                  * allows a pending Non-secure HardFault to preempt (which
1324                  * we implement by marking it enabled).
1325                  */
1326                 if (cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK) {
1327                     s->sec_vectors[ARMV7M_EXCP_HARD].prio = -3;
1328                     s->vectors[ARMV7M_EXCP_HARD].enabled = 1;
1329                 } else {
1330                     s->sec_vectors[ARMV7M_EXCP_HARD].prio = -1;
1331                     s->vectors[ARMV7M_EXCP_HARD].enabled = 0;
1332                 }
1333             }
1334             nvic_irq_update(s);
1335         }
1336         break;
1337     case 0xd10: /* System Control.  */
1338         if (!arm_feature(&cpu->env, ARM_FEATURE_V7)) {
1339             goto bad_offset;
1340         }
1341         /* We don't implement deep-sleep so these bits are RAZ/WI.
1342          * The other bits in the register are banked.
1343          * QEMU's implementation ignores SEVONPEND and SLEEPONEXIT, which
1344          * is architecturally permitted.
1345          */
1346         value &= ~(R_V7M_SCR_SLEEPDEEP_MASK | R_V7M_SCR_SLEEPDEEPS_MASK);
1347         cpu->env.v7m.scr[attrs.secure] = value;
1348         break;
1349     case 0xd14: /* Configuration Control.  */
1350         if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
1351             goto bad_offset;
1352         }
1353 
1354         /* Enforce RAZ/WI on reserved and must-RAZ/WI bits */
1355         value &= (R_V7M_CCR_STKALIGN_MASK |
1356                   R_V7M_CCR_BFHFNMIGN_MASK |
1357                   R_V7M_CCR_DIV_0_TRP_MASK |
1358                   R_V7M_CCR_UNALIGN_TRP_MASK |
1359                   R_V7M_CCR_USERSETMPEND_MASK |
1360                   R_V7M_CCR_NONBASETHRDENA_MASK);
1361 
1362         if (arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1363             /* v8M makes NONBASETHRDENA and STKALIGN be RES1 */
1364             value |= R_V7M_CCR_NONBASETHRDENA_MASK
1365                 | R_V7M_CCR_STKALIGN_MASK;
1366         }
1367         if (attrs.secure) {
1368             /* the BFHFNMIGN bit is not banked; keep that in the NS copy */
1369             cpu->env.v7m.ccr[M_REG_NS] =
1370                 (cpu->env.v7m.ccr[M_REG_NS] & ~R_V7M_CCR_BFHFNMIGN_MASK)
1371                 | (value & R_V7M_CCR_BFHFNMIGN_MASK);
1372             value &= ~R_V7M_CCR_BFHFNMIGN_MASK;
1373         }
1374 
1375         cpu->env.v7m.ccr[attrs.secure] = value;
1376         break;
1377     case 0xd24: /* System Handler Control and State (SHCSR) */
1378         if (!arm_feature(&cpu->env, ARM_FEATURE_V7)) {
1379             goto bad_offset;
1380         }
1381         if (attrs.secure) {
1382             s->sec_vectors[ARMV7M_EXCP_MEM].active = (value & (1 << 0)) != 0;
1383             /* Secure HardFault active bit cannot be written */
1384             s->sec_vectors[ARMV7M_EXCP_USAGE].active = (value & (1 << 3)) != 0;
1385             s->sec_vectors[ARMV7M_EXCP_SVC].active = (value & (1 << 7)) != 0;
1386             s->sec_vectors[ARMV7M_EXCP_PENDSV].active =
1387                 (value & (1 << 10)) != 0;
1388             s->sec_vectors[ARMV7M_EXCP_SYSTICK].active =
1389                 (value & (1 << 11)) != 0;
1390             s->sec_vectors[ARMV7M_EXCP_USAGE].pending =
1391                 (value & (1 << 12)) != 0;
1392             s->sec_vectors[ARMV7M_EXCP_MEM].pending = (value & (1 << 13)) != 0;
1393             s->sec_vectors[ARMV7M_EXCP_SVC].pending = (value & (1 << 15)) != 0;
1394             s->sec_vectors[ARMV7M_EXCP_MEM].enabled = (value & (1 << 16)) != 0;
1395             s->sec_vectors[ARMV7M_EXCP_BUS].enabled = (value & (1 << 17)) != 0;
1396             s->sec_vectors[ARMV7M_EXCP_USAGE].enabled =
1397                 (value & (1 << 18)) != 0;
1398             s->sec_vectors[ARMV7M_EXCP_HARD].pending = (value & (1 << 21)) != 0;
1399             /* SecureFault not banked, but RAZ/WI to NS */
1400             s->vectors[ARMV7M_EXCP_SECURE].active = (value & (1 << 4)) != 0;
1401             s->vectors[ARMV7M_EXCP_SECURE].enabled = (value & (1 << 19)) != 0;
1402             s->vectors[ARMV7M_EXCP_SECURE].pending = (value & (1 << 20)) != 0;
1403         } else {
1404             s->vectors[ARMV7M_EXCP_MEM].active = (value & (1 << 0)) != 0;
1405             if (arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1406                 /* HARDFAULTPENDED is not present in v7M */
1407                 s->vectors[ARMV7M_EXCP_HARD].pending = (value & (1 << 21)) != 0;
1408             }
1409             s->vectors[ARMV7M_EXCP_USAGE].active = (value & (1 << 3)) != 0;
1410             s->vectors[ARMV7M_EXCP_SVC].active = (value & (1 << 7)) != 0;
1411             s->vectors[ARMV7M_EXCP_PENDSV].active = (value & (1 << 10)) != 0;
1412             s->vectors[ARMV7M_EXCP_SYSTICK].active = (value & (1 << 11)) != 0;
1413             s->vectors[ARMV7M_EXCP_USAGE].pending = (value & (1 << 12)) != 0;
1414             s->vectors[ARMV7M_EXCP_MEM].pending = (value & (1 << 13)) != 0;
1415             s->vectors[ARMV7M_EXCP_SVC].pending = (value & (1 << 15)) != 0;
1416             s->vectors[ARMV7M_EXCP_MEM].enabled = (value & (1 << 16)) != 0;
1417             s->vectors[ARMV7M_EXCP_USAGE].enabled = (value & (1 << 18)) != 0;
1418         }
1419         if (attrs.secure || (cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK)) {
1420             s->vectors[ARMV7M_EXCP_BUS].active = (value & (1 << 1)) != 0;
1421             s->vectors[ARMV7M_EXCP_BUS].pending = (value & (1 << 14)) != 0;
1422             s->vectors[ARMV7M_EXCP_BUS].enabled = (value & (1 << 17)) != 0;
1423         }
1424         /* NMIACT can only be written if the write is of a zero, with
1425          * BFHFNMINS 1, and by the CPU in secure state via the NS alias.
1426          */
1427         if (!attrs.secure && cpu->env.v7m.secure &&
1428             (cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK) &&
1429             (value & (1 << 5)) == 0) {
1430             s->vectors[ARMV7M_EXCP_NMI].active = 0;
1431         }
1432         /* HARDFAULTACT can only be written if the write is of a zero
1433          * to the non-secure HardFault state by the CPU in secure state.
1434          * The only case where we can be targeting the non-secure HF state
1435          * when in secure state is if this is a write via the NS alias
1436          * and BFHFNMINS is 1.
1437          */
1438         if (!attrs.secure && cpu->env.v7m.secure &&
1439             (cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK) &&
1440             (value & (1 << 2)) == 0) {
1441             s->vectors[ARMV7M_EXCP_HARD].active = 0;
1442         }
1443 
1444         /* TODO: this is RAZ/WI from NS if DEMCR.SDME is set */
1445         s->vectors[ARMV7M_EXCP_DEBUG].active = (value & (1 << 8)) != 0;
1446         nvic_irq_update(s);
1447         break;
1448     case 0xd2c: /* Hard Fault Status.  */
1449         if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
1450             goto bad_offset;
1451         }
1452         cpu->env.v7m.hfsr &= ~value; /* W1C */
1453         break;
1454     case 0xd30: /* Debug Fault Status.  */
1455         cpu->env.v7m.dfsr &= ~value; /* W1C */
1456         break;
1457     case 0xd34: /* Mem Manage Address.  */
1458         if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
1459             goto bad_offset;
1460         }
1461         cpu->env.v7m.mmfar[attrs.secure] = value;
1462         return;
1463     case 0xd38: /* Bus Fault Address.  */
1464         if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
1465             goto bad_offset;
1466         }
1467         cpu->env.v7m.bfar = value;
1468         return;
1469     case 0xd3c: /* Aux Fault Status.  */
1470         qemu_log_mask(LOG_UNIMP,
1471                       "NVIC: Aux fault status registers unimplemented\n");
1472         break;
1473     case 0xd84: /* CSSELR */
1474         if (!arm_v7m_csselr_razwi(cpu)) {
1475             cpu->env.v7m.csselr[attrs.secure] = value & R_V7M_CSSELR_INDEX_MASK;
1476         }
1477         break;
1478     case 0xd90: /* MPU_TYPE */
1479         return; /* RO */
1480     case 0xd94: /* MPU_CTRL */
1481         if ((value &
1482              (R_V7M_MPU_CTRL_HFNMIENA_MASK | R_V7M_MPU_CTRL_ENABLE_MASK))
1483             == R_V7M_MPU_CTRL_HFNMIENA_MASK) {
1484             qemu_log_mask(LOG_GUEST_ERROR, "MPU_CTRL: HFNMIENA and !ENABLE is "
1485                           "UNPREDICTABLE\n");
1486         }
1487         cpu->env.v7m.mpu_ctrl[attrs.secure]
1488             = value & (R_V7M_MPU_CTRL_ENABLE_MASK |
1489                        R_V7M_MPU_CTRL_HFNMIENA_MASK |
1490                        R_V7M_MPU_CTRL_PRIVDEFENA_MASK);
1491         tlb_flush(CPU(cpu));
1492         break;
1493     case 0xd98: /* MPU_RNR */
1494         if (value >= cpu->pmsav7_dregion) {
1495             qemu_log_mask(LOG_GUEST_ERROR, "MPU region out of range %"
1496                           PRIu32 "/%" PRIu32 "\n",
1497                           value, cpu->pmsav7_dregion);
1498         } else {
1499             cpu->env.pmsav7.rnr[attrs.secure] = value;
1500         }
1501         break;
1502     case 0xd9c: /* MPU_RBAR */
1503     case 0xda4: /* MPU_RBAR_A1 */
1504     case 0xdac: /* MPU_RBAR_A2 */
1505     case 0xdb4: /* MPU_RBAR_A3 */
1506     {
1507         int region;
1508 
1509         if (arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1510             /* PMSAv8M handling of the aliases is different from v7M:
1511              * aliases A1, A2, A3 override the low two bits of the region
1512              * number in MPU_RNR, and there is no 'region' field in the
1513              * RBAR register.
1514              */
1515             int aliasno = (offset - 0xd9c) / 8; /* 0..3 */
1516 
1517             region = cpu->env.pmsav7.rnr[attrs.secure];
1518             if (aliasno) {
1519                 region = deposit32(region, 0, 2, aliasno);
1520             }
1521             if (region >= cpu->pmsav7_dregion) {
1522                 return;
1523             }
1524             cpu->env.pmsav8.rbar[attrs.secure][region] = value;
1525             tlb_flush(CPU(cpu));
1526             return;
1527         }
1528 
1529         if (value & (1 << 4)) {
1530             /* VALID bit means use the region number specified in this
1531              * value and also update MPU_RNR.REGION with that value.
1532              */
1533             region = extract32(value, 0, 4);
1534             if (region >= cpu->pmsav7_dregion) {
1535                 qemu_log_mask(LOG_GUEST_ERROR,
1536                               "MPU region out of range %u/%" PRIu32 "\n",
1537                               region, cpu->pmsav7_dregion);
1538                 return;
1539             }
1540             cpu->env.pmsav7.rnr[attrs.secure] = region;
1541         } else {
1542             region = cpu->env.pmsav7.rnr[attrs.secure];
1543         }
1544 
1545         if (region >= cpu->pmsav7_dregion) {
1546             return;
1547         }
1548 
1549         cpu->env.pmsav7.drbar[region] = value & ~0x1f;
1550         tlb_flush(CPU(cpu));
1551         break;
1552     }
1553     case 0xda0: /* MPU_RASR (v7M), MPU_RLAR (v8M) */
1554     case 0xda8: /* MPU_RASR_A1 (v7M), MPU_RLAR_A1 (v8M) */
1555     case 0xdb0: /* MPU_RASR_A2 (v7M), MPU_RLAR_A2 (v8M) */
1556     case 0xdb8: /* MPU_RASR_A3 (v7M), MPU_RLAR_A3 (v8M) */
1557     {
1558         int region = cpu->env.pmsav7.rnr[attrs.secure];
1559 
1560         if (arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1561             /* PMSAv8M handling of the aliases is different from v7M:
1562              * aliases A1, A2, A3 override the low two bits of the region
1563              * number in MPU_RNR.
1564              */
1565             int aliasno = (offset - 0xd9c) / 8; /* 0..3 */
1566 
1567             region = cpu->env.pmsav7.rnr[attrs.secure];
1568             if (aliasno) {
1569                 region = deposit32(region, 0, 2, aliasno);
1570             }
1571             if (region >= cpu->pmsav7_dregion) {
1572                 return;
1573             }
1574             cpu->env.pmsav8.rlar[attrs.secure][region] = value;
1575             tlb_flush(CPU(cpu));
1576             return;
1577         }
1578 
1579         if (region >= cpu->pmsav7_dregion) {
1580             return;
1581         }
1582 
1583         cpu->env.pmsav7.drsr[region] = value & 0xff3f;
1584         cpu->env.pmsav7.dracr[region] = (value >> 16) & 0x173f;
1585         tlb_flush(CPU(cpu));
1586         break;
1587     }
1588     case 0xdc0: /* MPU_MAIR0 */
1589         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1590             goto bad_offset;
1591         }
1592         if (cpu->pmsav7_dregion) {
1593             /* Register is RES0 if no MPU regions are implemented */
1594             cpu->env.pmsav8.mair0[attrs.secure] = value;
1595         }
1596         /* We don't need to do anything else because memory attributes
1597          * only affect cacheability, and we don't implement caching.
1598          */
1599         break;
1600     case 0xdc4: /* MPU_MAIR1 */
1601         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1602             goto bad_offset;
1603         }
1604         if (cpu->pmsav7_dregion) {
1605             /* Register is RES0 if no MPU regions are implemented */
1606             cpu->env.pmsav8.mair1[attrs.secure] = value;
1607         }
1608         /* We don't need to do anything else because memory attributes
1609          * only affect cacheability, and we don't implement caching.
1610          */
1611         break;
1612     case 0xdd0: /* SAU_CTRL */
1613         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1614             goto bad_offset;
1615         }
1616         if (!attrs.secure) {
1617             return;
1618         }
1619         cpu->env.sau.ctrl = value & 3;
1620         break;
1621     case 0xdd4: /* SAU_TYPE */
1622         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1623             goto bad_offset;
1624         }
1625         break;
1626     case 0xdd8: /* SAU_RNR */
1627         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1628             goto bad_offset;
1629         }
1630         if (!attrs.secure) {
1631             return;
1632         }
1633         if (value >= cpu->sau_sregion) {
1634             qemu_log_mask(LOG_GUEST_ERROR, "SAU region out of range %"
1635                           PRIu32 "/%" PRIu32 "\n",
1636                           value, cpu->sau_sregion);
1637         } else {
1638             cpu->env.sau.rnr = value;
1639         }
1640         break;
1641     case 0xddc: /* SAU_RBAR */
1642     {
1643         int region = cpu->env.sau.rnr;
1644 
1645         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1646             goto bad_offset;
1647         }
1648         if (!attrs.secure) {
1649             return;
1650         }
1651         if (region >= cpu->sau_sregion) {
1652             return;
1653         }
1654         cpu->env.sau.rbar[region] = value & ~0x1f;
1655         tlb_flush(CPU(cpu));
1656         break;
1657     }
1658     case 0xde0: /* SAU_RLAR */
1659     {
1660         int region = cpu->env.sau.rnr;
1661 
1662         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1663             goto bad_offset;
1664         }
1665         if (!attrs.secure) {
1666             return;
1667         }
1668         if (region >= cpu->sau_sregion) {
1669             return;
1670         }
1671         cpu->env.sau.rlar[region] = value & ~0x1c;
1672         tlb_flush(CPU(cpu));
1673         break;
1674     }
1675     case 0xde4: /* SFSR */
1676         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1677             goto bad_offset;
1678         }
1679         if (!attrs.secure) {
1680             return;
1681         }
1682         cpu->env.v7m.sfsr &= ~value; /* W1C */
1683         break;
1684     case 0xde8: /* SFAR */
1685         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1686             goto bad_offset;
1687         }
1688         if (!attrs.secure) {
1689             return;
1690         }
1691         cpu->env.v7m.sfsr = value;
1692         break;
1693     case 0xf00: /* Software Triggered Interrupt Register */
1694     {
1695         int excnum = (value & 0x1ff) + NVIC_FIRST_IRQ;
1696 
1697         if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
1698             goto bad_offset;
1699         }
1700 
1701         if (excnum < s->num_irq) {
1702             armv7m_nvic_set_pending(s, excnum, false);
1703         }
1704         break;
1705     }
1706     case 0xf50: /* ICIALLU */
1707     case 0xf58: /* ICIMVAU */
1708     case 0xf5c: /* DCIMVAC */
1709     case 0xf60: /* DCISW */
1710     case 0xf64: /* DCCMVAU */
1711     case 0xf68: /* DCCMVAC */
1712     case 0xf6c: /* DCCSW */
1713     case 0xf70: /* DCCIMVAC */
1714     case 0xf74: /* DCCISW */
1715     case 0xf78: /* BPIALL */
1716         /* Cache and branch predictor maintenance: for QEMU these always NOP */
1717         break;
1718     default:
1719     bad_offset:
1720         qemu_log_mask(LOG_GUEST_ERROR,
1721                       "NVIC: Bad write offset 0x%x\n", offset);
1722     }
1723 }
1724 
1725 static bool nvic_user_access_ok(NVICState *s, hwaddr offset, MemTxAttrs attrs)
1726 {
1727     /* Return true if unprivileged access to this register is permitted. */
1728     switch (offset) {
1729     case 0xf00: /* STIR: accessible only if CCR.USERSETMPEND permits */
1730         /* For access via STIR_NS it is the NS CCR.USERSETMPEND that
1731          * controls access even though the CPU is in Secure state (I_QDKX).
1732          */
1733         return s->cpu->env.v7m.ccr[attrs.secure] & R_V7M_CCR_USERSETMPEND_MASK;
1734     default:
1735         /* All other user accesses cause a BusFault unconditionally */
1736         return false;
1737     }
1738 }
1739 
1740 static int shpr_bank(NVICState *s, int exc, MemTxAttrs attrs)
1741 {
1742     /* Behaviour for the SHPR register field for this exception:
1743      * return M_REG_NS to use the nonsecure vector (including for
1744      * non-banked exceptions), M_REG_S for the secure version of
1745      * a banked exception, and -1 if this field should RAZ/WI.
1746      */
1747     switch (exc) {
1748     case ARMV7M_EXCP_MEM:
1749     case ARMV7M_EXCP_USAGE:
1750     case ARMV7M_EXCP_SVC:
1751     case ARMV7M_EXCP_PENDSV:
1752     case ARMV7M_EXCP_SYSTICK:
1753         /* Banked exceptions */
1754         return attrs.secure;
1755     case ARMV7M_EXCP_BUS:
1756         /* Not banked, RAZ/WI from nonsecure if BFHFNMINS is zero */
1757         if (!attrs.secure &&
1758             !(s->cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK)) {
1759             return -1;
1760         }
1761         return M_REG_NS;
1762     case ARMV7M_EXCP_SECURE:
1763         /* Not banked, RAZ/WI from nonsecure */
1764         if (!attrs.secure) {
1765             return -1;
1766         }
1767         return M_REG_NS;
1768     case ARMV7M_EXCP_DEBUG:
1769         /* Not banked. TODO should RAZ/WI if DEMCR.SDME is set */
1770         return M_REG_NS;
1771     case 8 ... 10:
1772     case 13:
1773         /* RES0 */
1774         return -1;
1775     default:
1776         /* Not reachable due to decode of SHPR register addresses */
1777         g_assert_not_reached();
1778     }
1779 }
1780 
1781 static MemTxResult nvic_sysreg_read(void *opaque, hwaddr addr,
1782                                     uint64_t *data, unsigned size,
1783                                     MemTxAttrs attrs)
1784 {
1785     NVICState *s = (NVICState *)opaque;
1786     uint32_t offset = addr;
1787     unsigned i, startvec, end;
1788     uint32_t val;
1789 
1790     if (attrs.user && !nvic_user_access_ok(s, addr, attrs)) {
1791         /* Generate BusFault for unprivileged accesses */
1792         return MEMTX_ERROR;
1793     }
1794 
1795     switch (offset) {
1796     /* reads of set and clear both return the status */
1797     case 0x100 ... 0x13f: /* NVIC Set enable */
1798         offset += 0x80;
1799         /* fall through */
1800     case 0x180 ... 0x1bf: /* NVIC Clear enable */
1801         val = 0;
1802         startvec = 8 * (offset - 0x180) + NVIC_FIRST_IRQ; /* vector # */
1803 
1804         for (i = 0, end = size * 8; i < end && startvec + i < s->num_irq; i++) {
1805             if (s->vectors[startvec + i].enabled &&
1806                 (attrs.secure || s->itns[startvec + i])) {
1807                 val |= (1 << i);
1808             }
1809         }
1810         break;
1811     case 0x200 ... 0x23f: /* NVIC Set pend */
1812         offset += 0x80;
1813         /* fall through */
1814     case 0x280 ... 0x2bf: /* NVIC Clear pend */
1815         val = 0;
1816         startvec = 8 * (offset - 0x280) + NVIC_FIRST_IRQ; /* vector # */
1817         for (i = 0, end = size * 8; i < end && startvec + i < s->num_irq; i++) {
1818             if (s->vectors[startvec + i].pending &&
1819                 (attrs.secure || s->itns[startvec + i])) {
1820                 val |= (1 << i);
1821             }
1822         }
1823         break;
1824     case 0x300 ... 0x33f: /* NVIC Active */
1825         val = 0;
1826 
1827         if (!arm_feature(&s->cpu->env, ARM_FEATURE_V7)) {
1828             break;
1829         }
1830 
1831         startvec = 8 * (offset - 0x300) + NVIC_FIRST_IRQ; /* vector # */
1832 
1833         for (i = 0, end = size * 8; i < end && startvec + i < s->num_irq; i++) {
1834             if (s->vectors[startvec + i].active &&
1835                 (attrs.secure || s->itns[startvec + i])) {
1836                 val |= (1 << i);
1837             }
1838         }
1839         break;
1840     case 0x400 ... 0x5ef: /* NVIC Priority */
1841         val = 0;
1842         startvec = offset - 0x400 + NVIC_FIRST_IRQ; /* vector # */
1843 
1844         for (i = 0; i < size && startvec + i < s->num_irq; i++) {
1845             if (attrs.secure || s->itns[startvec + i]) {
1846                 val |= s->vectors[startvec + i].prio << (8 * i);
1847             }
1848         }
1849         break;
1850     case 0xd18 ... 0xd1b: /* System Handler Priority (SHPR1) */
1851         if (!arm_feature(&s->cpu->env, ARM_FEATURE_M_MAIN)) {
1852             val = 0;
1853             break;
1854         }
1855         /* fall through */
1856     case 0xd1c ... 0xd23: /* System Handler Priority (SHPR2, SHPR3) */
1857         val = 0;
1858         for (i = 0; i < size; i++) {
1859             unsigned hdlidx = (offset - 0xd14) + i;
1860             int sbank = shpr_bank(s, hdlidx, attrs);
1861 
1862             if (sbank < 0) {
1863                 continue;
1864             }
1865             val = deposit32(val, i * 8, 8, get_prio(s, hdlidx, sbank));
1866         }
1867         break;
1868     case 0xd28 ... 0xd2b: /* Configurable Fault Status (CFSR) */
1869         if (!arm_feature(&s->cpu->env, ARM_FEATURE_M_MAIN)) {
1870             val = 0;
1871             break;
1872         };
1873         /* The BFSR bits [15:8] are shared between security states
1874          * and we store them in the NS copy
1875          */
1876         val = s->cpu->env.v7m.cfsr[attrs.secure];
1877         val |= s->cpu->env.v7m.cfsr[M_REG_NS] & R_V7M_CFSR_BFSR_MASK;
1878         val = extract32(val, (offset - 0xd28) * 8, size * 8);
1879         break;
1880     case 0xfe0 ... 0xfff: /* ID.  */
1881         if (offset & 3) {
1882             val = 0;
1883         } else {
1884             val = nvic_id[(offset - 0xfe0) >> 2];
1885         }
1886         break;
1887     default:
1888         if (size == 4) {
1889             val = nvic_readl(s, offset, attrs);
1890         } else {
1891             qemu_log_mask(LOG_GUEST_ERROR,
1892                           "NVIC: Bad read of size %d at offset 0x%x\n",
1893                           size, offset);
1894             val = 0;
1895         }
1896     }
1897 
1898     trace_nvic_sysreg_read(addr, val, size);
1899     *data = val;
1900     return MEMTX_OK;
1901 }
1902 
1903 static MemTxResult nvic_sysreg_write(void *opaque, hwaddr addr,
1904                                      uint64_t value, unsigned size,
1905                                      MemTxAttrs attrs)
1906 {
1907     NVICState *s = (NVICState *)opaque;
1908     uint32_t offset = addr;
1909     unsigned i, startvec, end;
1910     unsigned setval = 0;
1911 
1912     trace_nvic_sysreg_write(addr, value, size);
1913 
1914     if (attrs.user && !nvic_user_access_ok(s, addr, attrs)) {
1915         /* Generate BusFault for unprivileged accesses */
1916         return MEMTX_ERROR;
1917     }
1918 
1919     switch (offset) {
1920     case 0x100 ... 0x13f: /* NVIC Set enable */
1921         offset += 0x80;
1922         setval = 1;
1923         /* fall through */
1924     case 0x180 ... 0x1bf: /* NVIC Clear enable */
1925         startvec = 8 * (offset - 0x180) + NVIC_FIRST_IRQ;
1926 
1927         for (i = 0, end = size * 8; i < end && startvec + i < s->num_irq; i++) {
1928             if (value & (1 << i) &&
1929                 (attrs.secure || s->itns[startvec + i])) {
1930                 s->vectors[startvec + i].enabled = setval;
1931             }
1932         }
1933         nvic_irq_update(s);
1934         return MEMTX_OK;
1935     case 0x200 ... 0x23f: /* NVIC Set pend */
1936         /* the special logic in armv7m_nvic_set_pending()
1937          * is not needed since IRQs are never escalated
1938          */
1939         offset += 0x80;
1940         setval = 1;
1941         /* fall through */
1942     case 0x280 ... 0x2bf: /* NVIC Clear pend */
1943         startvec = 8 * (offset - 0x280) + NVIC_FIRST_IRQ; /* vector # */
1944 
1945         for (i = 0, end = size * 8; i < end && startvec + i < s->num_irq; i++) {
1946             if (value & (1 << i) &&
1947                 (attrs.secure || s->itns[startvec + i])) {
1948                 s->vectors[startvec + i].pending = setval;
1949             }
1950         }
1951         nvic_irq_update(s);
1952         return MEMTX_OK;
1953     case 0x300 ... 0x33f: /* NVIC Active */
1954         return MEMTX_OK; /* R/O */
1955     case 0x400 ... 0x5ef: /* NVIC Priority */
1956         startvec = (offset - 0x400) + NVIC_FIRST_IRQ; /* vector # */
1957 
1958         for (i = 0; i < size && startvec + i < s->num_irq; i++) {
1959             if (attrs.secure || s->itns[startvec + i]) {
1960                 set_prio(s, startvec + i, false, (value >> (i * 8)) & 0xff);
1961             }
1962         }
1963         nvic_irq_update(s);
1964         return MEMTX_OK;
1965     case 0xd18 ... 0xd1b: /* System Handler Priority (SHPR1) */
1966         if (!arm_feature(&s->cpu->env, ARM_FEATURE_M_MAIN)) {
1967             return MEMTX_OK;
1968         }
1969         /* fall through */
1970     case 0xd1c ... 0xd23: /* System Handler Priority (SHPR2, SHPR3) */
1971         for (i = 0; i < size; i++) {
1972             unsigned hdlidx = (offset - 0xd14) + i;
1973             int newprio = extract32(value, i * 8, 8);
1974             int sbank = shpr_bank(s, hdlidx, attrs);
1975 
1976             if (sbank < 0) {
1977                 continue;
1978             }
1979             set_prio(s, hdlidx, sbank, newprio);
1980         }
1981         nvic_irq_update(s);
1982         return MEMTX_OK;
1983     case 0xd28 ... 0xd2b: /* Configurable Fault Status (CFSR) */
1984         if (!arm_feature(&s->cpu->env, ARM_FEATURE_M_MAIN)) {
1985             return MEMTX_OK;
1986         }
1987         /* All bits are W1C, so construct 32 bit value with 0s in
1988          * the parts not written by the access size
1989          */
1990         value <<= ((offset - 0xd28) * 8);
1991 
1992         s->cpu->env.v7m.cfsr[attrs.secure] &= ~value;
1993         if (attrs.secure) {
1994             /* The BFSR bits [15:8] are shared between security states
1995              * and we store them in the NS copy.
1996              */
1997             s->cpu->env.v7m.cfsr[M_REG_NS] &= ~(value & R_V7M_CFSR_BFSR_MASK);
1998         }
1999         return MEMTX_OK;
2000     }
2001     if (size == 4) {
2002         nvic_writel(s, offset, value, attrs);
2003         return MEMTX_OK;
2004     }
2005     qemu_log_mask(LOG_GUEST_ERROR,
2006                   "NVIC: Bad write of size %d at offset 0x%x\n", size, offset);
2007     /* This is UNPREDICTABLE; treat as RAZ/WI */
2008     return MEMTX_OK;
2009 }
2010 
2011 static const MemoryRegionOps nvic_sysreg_ops = {
2012     .read_with_attrs = nvic_sysreg_read,
2013     .write_with_attrs = nvic_sysreg_write,
2014     .endianness = DEVICE_NATIVE_ENDIAN,
2015 };
2016 
2017 static MemTxResult nvic_sysreg_ns_write(void *opaque, hwaddr addr,
2018                                         uint64_t value, unsigned size,
2019                                         MemTxAttrs attrs)
2020 {
2021     MemoryRegion *mr = opaque;
2022 
2023     if (attrs.secure) {
2024         /* S accesses to the alias act like NS accesses to the real region */
2025         attrs.secure = 0;
2026         return memory_region_dispatch_write(mr, addr, value, size, attrs);
2027     } else {
2028         /* NS attrs are RAZ/WI for privileged, and BusFault for user */
2029         if (attrs.user) {
2030             return MEMTX_ERROR;
2031         }
2032         return MEMTX_OK;
2033     }
2034 }
2035 
2036 static MemTxResult nvic_sysreg_ns_read(void *opaque, hwaddr addr,
2037                                        uint64_t *data, unsigned size,
2038                                        MemTxAttrs attrs)
2039 {
2040     MemoryRegion *mr = opaque;
2041 
2042     if (attrs.secure) {
2043         /* S accesses to the alias act like NS accesses to the real region */
2044         attrs.secure = 0;
2045         return memory_region_dispatch_read(mr, addr, data, size, attrs);
2046     } else {
2047         /* NS attrs are RAZ/WI for privileged, and BusFault for user */
2048         if (attrs.user) {
2049             return MEMTX_ERROR;
2050         }
2051         *data = 0;
2052         return MEMTX_OK;
2053     }
2054 }
2055 
2056 static const MemoryRegionOps nvic_sysreg_ns_ops = {
2057     .read_with_attrs = nvic_sysreg_ns_read,
2058     .write_with_attrs = nvic_sysreg_ns_write,
2059     .endianness = DEVICE_NATIVE_ENDIAN,
2060 };
2061 
2062 static MemTxResult nvic_systick_write(void *opaque, hwaddr addr,
2063                                       uint64_t value, unsigned size,
2064                                       MemTxAttrs attrs)
2065 {
2066     NVICState *s = opaque;
2067     MemoryRegion *mr;
2068 
2069     /* Direct the access to the correct systick */
2070     mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->systick[attrs.secure]), 0);
2071     return memory_region_dispatch_write(mr, addr, value, size, attrs);
2072 }
2073 
2074 static MemTxResult nvic_systick_read(void *opaque, hwaddr addr,
2075                                      uint64_t *data, unsigned size,
2076                                      MemTxAttrs attrs)
2077 {
2078     NVICState *s = opaque;
2079     MemoryRegion *mr;
2080 
2081     /* Direct the access to the correct systick */
2082     mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->systick[attrs.secure]), 0);
2083     return memory_region_dispatch_read(mr, addr, data, size, attrs);
2084 }
2085 
2086 static const MemoryRegionOps nvic_systick_ops = {
2087     .read_with_attrs = nvic_systick_read,
2088     .write_with_attrs = nvic_systick_write,
2089     .endianness = DEVICE_NATIVE_ENDIAN,
2090 };
2091 
2092 static int nvic_post_load(void *opaque, int version_id)
2093 {
2094     NVICState *s = opaque;
2095     unsigned i;
2096     int resetprio;
2097 
2098     /* Check for out of range priority settings */
2099     resetprio = arm_feature(&s->cpu->env, ARM_FEATURE_V8) ? -4 : -3;
2100 
2101     if (s->vectors[ARMV7M_EXCP_RESET].prio != resetprio ||
2102         s->vectors[ARMV7M_EXCP_NMI].prio != -2 ||
2103         s->vectors[ARMV7M_EXCP_HARD].prio != -1) {
2104         return 1;
2105     }
2106     for (i = ARMV7M_EXCP_MEM; i < s->num_irq; i++) {
2107         if (s->vectors[i].prio & ~0xff) {
2108             return 1;
2109         }
2110     }
2111 
2112     nvic_recompute_state(s);
2113 
2114     return 0;
2115 }
2116 
2117 static const VMStateDescription vmstate_VecInfo = {
2118     .name = "armv7m_nvic_info",
2119     .version_id = 1,
2120     .minimum_version_id = 1,
2121     .fields = (VMStateField[]) {
2122         VMSTATE_INT16(prio, VecInfo),
2123         VMSTATE_UINT8(enabled, VecInfo),
2124         VMSTATE_UINT8(pending, VecInfo),
2125         VMSTATE_UINT8(active, VecInfo),
2126         VMSTATE_UINT8(level, VecInfo),
2127         VMSTATE_END_OF_LIST()
2128     }
2129 };
2130 
2131 static bool nvic_security_needed(void *opaque)
2132 {
2133     NVICState *s = opaque;
2134 
2135     return arm_feature(&s->cpu->env, ARM_FEATURE_M_SECURITY);
2136 }
2137 
2138 static int nvic_security_post_load(void *opaque, int version_id)
2139 {
2140     NVICState *s = opaque;
2141     int i;
2142 
2143     /* Check for out of range priority settings */
2144     if (s->sec_vectors[ARMV7M_EXCP_HARD].prio != -1
2145         && s->sec_vectors[ARMV7M_EXCP_HARD].prio != -3) {
2146         /* We can't cross-check against AIRCR.BFHFNMINS as we don't know
2147          * if the CPU state has been migrated yet; a mismatch won't
2148          * cause the emulation to blow up, though.
2149          */
2150         return 1;
2151     }
2152     for (i = ARMV7M_EXCP_MEM; i < ARRAY_SIZE(s->sec_vectors); i++) {
2153         if (s->sec_vectors[i].prio & ~0xff) {
2154             return 1;
2155         }
2156     }
2157     return 0;
2158 }
2159 
2160 static const VMStateDescription vmstate_nvic_security = {
2161     .name = "armv7m_nvic/m-security",
2162     .version_id = 1,
2163     .minimum_version_id = 1,
2164     .needed = nvic_security_needed,
2165     .post_load = &nvic_security_post_load,
2166     .fields = (VMStateField[]) {
2167         VMSTATE_STRUCT_ARRAY(sec_vectors, NVICState, NVIC_INTERNAL_VECTORS, 1,
2168                              vmstate_VecInfo, VecInfo),
2169         VMSTATE_UINT32(prigroup[M_REG_S], NVICState),
2170         VMSTATE_BOOL_ARRAY(itns, NVICState, NVIC_MAX_VECTORS),
2171         VMSTATE_END_OF_LIST()
2172     }
2173 };
2174 
2175 static const VMStateDescription vmstate_nvic = {
2176     .name = "armv7m_nvic",
2177     .version_id = 4,
2178     .minimum_version_id = 4,
2179     .post_load = &nvic_post_load,
2180     .fields = (VMStateField[]) {
2181         VMSTATE_STRUCT_ARRAY(vectors, NVICState, NVIC_MAX_VECTORS, 1,
2182                              vmstate_VecInfo, VecInfo),
2183         VMSTATE_UINT32(prigroup[M_REG_NS], NVICState),
2184         VMSTATE_END_OF_LIST()
2185     },
2186     .subsections = (const VMStateDescription*[]) {
2187         &vmstate_nvic_security,
2188         NULL
2189     }
2190 };
2191 
2192 static Property props_nvic[] = {
2193     /* Number of external IRQ lines (so excluding the 16 internal exceptions) */
2194     DEFINE_PROP_UINT32("num-irq", NVICState, num_irq, 64),
2195     DEFINE_PROP_END_OF_LIST()
2196 };
2197 
2198 static void armv7m_nvic_reset(DeviceState *dev)
2199 {
2200     int resetprio;
2201     NVICState *s = NVIC(dev);
2202 
2203     memset(s->vectors, 0, sizeof(s->vectors));
2204     memset(s->sec_vectors, 0, sizeof(s->sec_vectors));
2205     s->prigroup[M_REG_NS] = 0;
2206     s->prigroup[M_REG_S] = 0;
2207 
2208     s->vectors[ARMV7M_EXCP_NMI].enabled = 1;
2209     /* MEM, BUS, and USAGE are enabled through
2210      * the System Handler Control register
2211      */
2212     s->vectors[ARMV7M_EXCP_SVC].enabled = 1;
2213     s->vectors[ARMV7M_EXCP_DEBUG].enabled = 1;
2214     s->vectors[ARMV7M_EXCP_PENDSV].enabled = 1;
2215     s->vectors[ARMV7M_EXCP_SYSTICK].enabled = 1;
2216 
2217     resetprio = arm_feature(&s->cpu->env, ARM_FEATURE_V8) ? -4 : -3;
2218     s->vectors[ARMV7M_EXCP_RESET].prio = resetprio;
2219     s->vectors[ARMV7M_EXCP_NMI].prio = -2;
2220     s->vectors[ARMV7M_EXCP_HARD].prio = -1;
2221 
2222     if (arm_feature(&s->cpu->env, ARM_FEATURE_M_SECURITY)) {
2223         s->sec_vectors[ARMV7M_EXCP_HARD].enabled = 1;
2224         s->sec_vectors[ARMV7M_EXCP_SVC].enabled = 1;
2225         s->sec_vectors[ARMV7M_EXCP_PENDSV].enabled = 1;
2226         s->sec_vectors[ARMV7M_EXCP_SYSTICK].enabled = 1;
2227 
2228         /* AIRCR.BFHFNMINS resets to 0 so Secure HF is priority -1 (R_CMTC) */
2229         s->sec_vectors[ARMV7M_EXCP_HARD].prio = -1;
2230         /* If AIRCR.BFHFNMINS is 0 then NS HF is (effectively) disabled */
2231         s->vectors[ARMV7M_EXCP_HARD].enabled = 0;
2232     } else {
2233         s->vectors[ARMV7M_EXCP_HARD].enabled = 1;
2234     }
2235 
2236     /* Strictly speaking the reset handler should be enabled.
2237      * However, we don't simulate soft resets through the NVIC,
2238      * and the reset vector should never be pended.
2239      * So we leave it disabled to catch logic errors.
2240      */
2241 
2242     s->exception_prio = NVIC_NOEXC_PRIO;
2243     s->vectpending = 0;
2244     s->vectpending_is_s_banked = false;
2245     s->vectpending_prio = NVIC_NOEXC_PRIO;
2246 
2247     if (arm_feature(&s->cpu->env, ARM_FEATURE_M_SECURITY)) {
2248         memset(s->itns, 0, sizeof(s->itns));
2249     } else {
2250         /* This state is constant and not guest accessible in a non-security
2251          * NVIC; we set the bits to true to avoid having to do a feature
2252          * bit check in the NVIC enable/pend/etc register accessors.
2253          */
2254         int i;
2255 
2256         for (i = NVIC_FIRST_IRQ; i < ARRAY_SIZE(s->itns); i++) {
2257             s->itns[i] = true;
2258         }
2259     }
2260 }
2261 
2262 static void nvic_systick_trigger(void *opaque, int n, int level)
2263 {
2264     NVICState *s = opaque;
2265 
2266     if (level) {
2267         /* SysTick just asked us to pend its exception.
2268          * (This is different from an external interrupt line's
2269          * behaviour.)
2270          * n == 0 : NonSecure systick
2271          * n == 1 : Secure systick
2272          */
2273         armv7m_nvic_set_pending(s, ARMV7M_EXCP_SYSTICK, n);
2274     }
2275 }
2276 
2277 static void armv7m_nvic_realize(DeviceState *dev, Error **errp)
2278 {
2279     NVICState *s = NVIC(dev);
2280     Error *err = NULL;
2281     int regionlen;
2282 
2283     /* The armv7m container object will have set our CPU pointer */
2284     if (!s->cpu || !arm_feature(&s->cpu->env, ARM_FEATURE_M)) {
2285         error_setg(errp, "The NVIC can only be used with a Cortex-M CPU");
2286         return;
2287     }
2288 
2289     if (s->num_irq > NVIC_MAX_IRQ) {
2290         error_setg(errp, "num-irq %d exceeds NVIC maximum", s->num_irq);
2291         return;
2292     }
2293 
2294     qdev_init_gpio_in(dev, set_irq_level, s->num_irq);
2295 
2296     /* include space for internal exception vectors */
2297     s->num_irq += NVIC_FIRST_IRQ;
2298 
2299     s->num_prio_bits = arm_feature(&s->cpu->env, ARM_FEATURE_V7) ? 8 : 2;
2300 
2301     object_property_set_bool(OBJECT(&s->systick[M_REG_NS]), true,
2302                              "realized", &err);
2303     if (err != NULL) {
2304         error_propagate(errp, err);
2305         return;
2306     }
2307     sysbus_connect_irq(SYS_BUS_DEVICE(&s->systick[M_REG_NS]), 0,
2308                        qdev_get_gpio_in_named(dev, "systick-trigger",
2309                                               M_REG_NS));
2310 
2311     if (arm_feature(&s->cpu->env, ARM_FEATURE_M_SECURITY)) {
2312         /* We couldn't init the secure systick device in instance_init
2313          * as we didn't know then if the CPU had the security extensions;
2314          * so we have to do it here.
2315          */
2316         object_initialize(&s->systick[M_REG_S], sizeof(s->systick[M_REG_S]),
2317                           TYPE_SYSTICK);
2318         qdev_set_parent_bus(DEVICE(&s->systick[M_REG_S]), sysbus_get_default());
2319 
2320         object_property_set_bool(OBJECT(&s->systick[M_REG_S]), true,
2321                                  "realized", &err);
2322         if (err != NULL) {
2323             error_propagate(errp, err);
2324             return;
2325         }
2326         sysbus_connect_irq(SYS_BUS_DEVICE(&s->systick[M_REG_S]), 0,
2327                            qdev_get_gpio_in_named(dev, "systick-trigger",
2328                                                   M_REG_S));
2329     }
2330 
2331     /* The NVIC and System Control Space (SCS) starts at 0xe000e000
2332      * and looks like this:
2333      *  0x004 - ICTR
2334      *  0x010 - 0xff - systick
2335      *  0x100..0x7ec - NVIC
2336      *  0x7f0..0xcff - Reserved
2337      *  0xd00..0xd3c - SCS registers
2338      *  0xd40..0xeff - Reserved or Not implemented
2339      *  0xf00 - STIR
2340      *
2341      * Some registers within this space are banked between security states.
2342      * In v8M there is a second range 0xe002e000..0xe002efff which is the
2343      * NonSecure alias SCS; secure accesses to this behave like NS accesses
2344      * to the main SCS range, and non-secure accesses (including when
2345      * the security extension is not implemented) are RAZ/WI.
2346      * Note that both the main SCS range and the alias range are defined
2347      * to be exempt from memory attribution (R_BLJT) and so the memory
2348      * transaction attribute always matches the current CPU security
2349      * state (attrs.secure == env->v7m.secure). In the nvic_sysreg_ns_ops
2350      * wrappers we change attrs.secure to indicate the NS access; so
2351      * generally code determining which banked register to use should
2352      * use attrs.secure; code determining actual behaviour of the system
2353      * should use env->v7m.secure.
2354      */
2355     regionlen = arm_feature(&s->cpu->env, ARM_FEATURE_V8) ? 0x21000 : 0x1000;
2356     memory_region_init(&s->container, OBJECT(s), "nvic", regionlen);
2357     /* The system register region goes at the bottom of the priority
2358      * stack as it covers the whole page.
2359      */
2360     memory_region_init_io(&s->sysregmem, OBJECT(s), &nvic_sysreg_ops, s,
2361                           "nvic_sysregs", 0x1000);
2362     memory_region_add_subregion(&s->container, 0, &s->sysregmem);
2363 
2364     memory_region_init_io(&s->systickmem, OBJECT(s),
2365                           &nvic_systick_ops, s,
2366                           "nvic_systick", 0xe0);
2367 
2368     memory_region_add_subregion_overlap(&s->container, 0x10,
2369                                         &s->systickmem, 1);
2370 
2371     if (arm_feature(&s->cpu->env, ARM_FEATURE_V8)) {
2372         memory_region_init_io(&s->sysreg_ns_mem, OBJECT(s),
2373                               &nvic_sysreg_ns_ops, &s->sysregmem,
2374                               "nvic_sysregs_ns", 0x1000);
2375         memory_region_add_subregion(&s->container, 0x20000, &s->sysreg_ns_mem);
2376         memory_region_init_io(&s->systick_ns_mem, OBJECT(s),
2377                               &nvic_sysreg_ns_ops, &s->systickmem,
2378                               "nvic_systick_ns", 0xe0);
2379         memory_region_add_subregion_overlap(&s->container, 0x20010,
2380                                             &s->systick_ns_mem, 1);
2381     }
2382 
2383     sysbus_init_mmio(SYS_BUS_DEVICE(dev), &s->container);
2384 }
2385 
2386 static void armv7m_nvic_instance_init(Object *obj)
2387 {
2388     /* We have a different default value for the num-irq property
2389      * than our superclass. This function runs after qdev init
2390      * has set the defaults from the Property array and before
2391      * any user-specified property setting, so just modify the
2392      * value in the GICState struct.
2393      */
2394     DeviceState *dev = DEVICE(obj);
2395     NVICState *nvic = NVIC(obj);
2396     SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
2397 
2398     sysbus_init_child_obj(obj, "systick-reg-ns", &nvic->systick[M_REG_NS],
2399                           sizeof(nvic->systick[M_REG_NS]), TYPE_SYSTICK);
2400     /* We can't initialize the secure systick here, as we don't know
2401      * yet if we need it.
2402      */
2403 
2404     sysbus_init_irq(sbd, &nvic->excpout);
2405     qdev_init_gpio_out_named(dev, &nvic->sysresetreq, "SYSRESETREQ", 1);
2406     qdev_init_gpio_in_named(dev, nvic_systick_trigger, "systick-trigger",
2407                             M_REG_NUM_BANKS);
2408     qdev_init_gpio_in_named(dev, nvic_nmi_trigger, "NMI", 1);
2409 }
2410 
2411 static void armv7m_nvic_class_init(ObjectClass *klass, void *data)
2412 {
2413     DeviceClass *dc = DEVICE_CLASS(klass);
2414 
2415     dc->vmsd  = &vmstate_nvic;
2416     dc->props = props_nvic;
2417     dc->reset = armv7m_nvic_reset;
2418     dc->realize = armv7m_nvic_realize;
2419 }
2420 
2421 static const TypeInfo armv7m_nvic_info = {
2422     .name          = TYPE_NVIC,
2423     .parent        = TYPE_SYS_BUS_DEVICE,
2424     .instance_init = armv7m_nvic_instance_init,
2425     .instance_size = sizeof(NVICState),
2426     .class_init    = armv7m_nvic_class_init,
2427     .class_size    = sizeof(SysBusDeviceClass),
2428 };
2429 
2430 static void armv7m_nvic_register_types(void)
2431 {
2432     type_register_static(&armv7m_nvic_info);
2433 }
2434 
2435 type_init(armv7m_nvic_register_types)
2436