1 /* 2 * ARM Nested Vectored Interrupt Controller 3 * 4 * Copyright (c) 2006-2007 CodeSourcery. 5 * Written by Paul Brook 6 * 7 * This code is licensed under the GPL. 8 * 9 * The ARMv7M System controller is fairly tightly tied in with the 10 * NVIC. Much of that is also implemented here. 11 */ 12 13 #include "qemu/osdep.h" 14 #include "qapi/error.h" 15 #include "qemu-common.h" 16 #include "cpu.h" 17 #include "hw/sysbus.h" 18 #include "qemu/timer.h" 19 #include "hw/arm/arm.h" 20 #include "hw/intc/armv7m_nvic.h" 21 #include "target/arm/cpu.h" 22 #include "exec/exec-all.h" 23 #include "qemu/log.h" 24 #include "trace.h" 25 26 /* IRQ number counting: 27 * 28 * the num-irq property counts the number of external IRQ lines 29 * 30 * NVICState::num_irq counts the total number of exceptions 31 * (external IRQs, the 15 internal exceptions including reset, 32 * and one for the unused exception number 0). 33 * 34 * NVIC_MAX_IRQ is the highest permitted number of external IRQ lines. 35 * 36 * NVIC_MAX_VECTORS is the highest permitted number of exceptions. 37 * 38 * Iterating through all exceptions should typically be done with 39 * for (i = 1; i < s->num_irq; i++) to avoid the unused slot 0. 40 * 41 * The external qemu_irq lines are the NVIC's external IRQ lines, 42 * so line 0 is exception 16. 43 * 44 * In the terminology of the architecture manual, "interrupts" are 45 * a subcategory of exception referring to the external interrupts 46 * (which are exception numbers NVIC_FIRST_IRQ and upward). 47 * For historical reasons QEMU tends to use "interrupt" and 48 * "exception" more or less interchangeably. 49 */ 50 #define NVIC_FIRST_IRQ NVIC_INTERNAL_VECTORS 51 #define NVIC_MAX_IRQ (NVIC_MAX_VECTORS - NVIC_FIRST_IRQ) 52 53 /* Effective running priority of the CPU when no exception is active 54 * (higher than the highest possible priority value) 55 */ 56 #define NVIC_NOEXC_PRIO 0x100 57 /* Maximum priority of non-secure exceptions when AIRCR.PRIS is set */ 58 #define NVIC_NS_PRIO_LIMIT 0x80 59 60 static const uint8_t nvic_id[] = { 61 0x00, 0xb0, 0x1b, 0x00, 0x0d, 0xe0, 0x05, 0xb1 62 }; 63 64 static int nvic_pending_prio(NVICState *s) 65 { 66 /* return the group priority of the current pending interrupt, 67 * or NVIC_NOEXC_PRIO if no interrupt is pending 68 */ 69 return s->vectpending_prio; 70 } 71 72 /* Return the value of the ISCR RETTOBASE bit: 73 * 1 if there is exactly one active exception 74 * 0 if there is more than one active exception 75 * UNKNOWN if there are no active exceptions (we choose 1, 76 * which matches the choice Cortex-M3 is documented as making). 77 * 78 * NB: some versions of the documentation talk about this 79 * counting "active exceptions other than the one shown by IPSR"; 80 * this is only different in the obscure corner case where guest 81 * code has manually deactivated an exception and is about 82 * to fail an exception-return integrity check. The definition 83 * above is the one from the v8M ARM ARM and is also in line 84 * with the behaviour documented for the Cortex-M3. 85 */ 86 static bool nvic_rettobase(NVICState *s) 87 { 88 int irq, nhand = 0; 89 bool check_sec = arm_feature(&s->cpu->env, ARM_FEATURE_M_SECURITY); 90 91 for (irq = ARMV7M_EXCP_RESET; irq < s->num_irq; irq++) { 92 if (s->vectors[irq].active || 93 (check_sec && irq < NVIC_INTERNAL_VECTORS && 94 s->sec_vectors[irq].active)) { 95 nhand++; 96 if (nhand == 2) { 97 return 0; 98 } 99 } 100 } 101 102 return 1; 103 } 104 105 /* Return the value of the ISCR ISRPENDING bit: 106 * 1 if an external interrupt is pending 107 * 0 if no external interrupt is pending 108 */ 109 static bool nvic_isrpending(NVICState *s) 110 { 111 int irq; 112 113 /* We can shortcut if the highest priority pending interrupt 114 * happens to be external or if there is nothing pending. 115 */ 116 if (s->vectpending > NVIC_FIRST_IRQ) { 117 return true; 118 } 119 if (s->vectpending == 0) { 120 return false; 121 } 122 123 for (irq = NVIC_FIRST_IRQ; irq < s->num_irq; irq++) { 124 if (s->vectors[irq].pending) { 125 return true; 126 } 127 } 128 return false; 129 } 130 131 static bool exc_is_banked(int exc) 132 { 133 /* Return true if this is one of the limited set of exceptions which 134 * are banked (and thus have state in sec_vectors[]) 135 */ 136 return exc == ARMV7M_EXCP_HARD || 137 exc == ARMV7M_EXCP_MEM || 138 exc == ARMV7M_EXCP_USAGE || 139 exc == ARMV7M_EXCP_SVC || 140 exc == ARMV7M_EXCP_PENDSV || 141 exc == ARMV7M_EXCP_SYSTICK; 142 } 143 144 /* Return a mask word which clears the subpriority bits from 145 * a priority value for an M-profile exception, leaving only 146 * the group priority. 147 */ 148 static inline uint32_t nvic_gprio_mask(NVICState *s, bool secure) 149 { 150 return ~0U << (s->prigroup[secure] + 1); 151 } 152 153 static bool exc_targets_secure(NVICState *s, int exc) 154 { 155 /* Return true if this non-banked exception targets Secure state. */ 156 if (!arm_feature(&s->cpu->env, ARM_FEATURE_M_SECURITY)) { 157 return false; 158 } 159 160 if (exc >= NVIC_FIRST_IRQ) { 161 return !s->itns[exc]; 162 } 163 164 /* Function shouldn't be called for banked exceptions. */ 165 assert(!exc_is_banked(exc)); 166 167 switch (exc) { 168 case ARMV7M_EXCP_NMI: 169 case ARMV7M_EXCP_BUS: 170 return !(s->cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK); 171 case ARMV7M_EXCP_SECURE: 172 return true; 173 case ARMV7M_EXCP_DEBUG: 174 /* TODO: controlled by DEMCR.SDME, which we don't yet implement */ 175 return false; 176 default: 177 /* reset, and reserved (unused) low exception numbers. 178 * We'll get called by code that loops through all the exception 179 * numbers, but it doesn't matter what we return here as these 180 * non-existent exceptions will never be pended or active. 181 */ 182 return true; 183 } 184 } 185 186 static int exc_group_prio(NVICState *s, int rawprio, bool targets_secure) 187 { 188 /* Return the group priority for this exception, given its raw 189 * (group-and-subgroup) priority value and whether it is targeting 190 * secure state or not. 191 */ 192 if (rawprio < 0) { 193 return rawprio; 194 } 195 rawprio &= nvic_gprio_mask(s, targets_secure); 196 /* AIRCR.PRIS causes us to squash all NS priorities into the 197 * lower half of the total range 198 */ 199 if (!targets_secure && 200 (s->cpu->env.v7m.aircr & R_V7M_AIRCR_PRIS_MASK)) { 201 rawprio = (rawprio >> 1) + NVIC_NS_PRIO_LIMIT; 202 } 203 return rawprio; 204 } 205 206 /* Recompute vectpending and exception_prio for a CPU which implements 207 * the Security extension 208 */ 209 static void nvic_recompute_state_secure(NVICState *s) 210 { 211 int i, bank; 212 int pend_prio = NVIC_NOEXC_PRIO; 213 int active_prio = NVIC_NOEXC_PRIO; 214 int pend_irq = 0; 215 bool pending_is_s_banked = false; 216 217 /* R_CQRV: precedence is by: 218 * - lowest group priority; if both the same then 219 * - lowest subpriority; if both the same then 220 * - lowest exception number; if both the same (ie banked) then 221 * - secure exception takes precedence 222 * Compare pseudocode RawExecutionPriority. 223 * Annoyingly, now we have two prigroup values (for S and NS) 224 * we can't do the loop comparison on raw priority values. 225 */ 226 for (i = 1; i < s->num_irq; i++) { 227 for (bank = M_REG_S; bank >= M_REG_NS; bank--) { 228 VecInfo *vec; 229 int prio; 230 bool targets_secure; 231 232 if (bank == M_REG_S) { 233 if (!exc_is_banked(i)) { 234 continue; 235 } 236 vec = &s->sec_vectors[i]; 237 targets_secure = true; 238 } else { 239 vec = &s->vectors[i]; 240 targets_secure = !exc_is_banked(i) && exc_targets_secure(s, i); 241 } 242 243 prio = exc_group_prio(s, vec->prio, targets_secure); 244 if (vec->enabled && vec->pending && prio < pend_prio) { 245 pend_prio = prio; 246 pend_irq = i; 247 pending_is_s_banked = (bank == M_REG_S); 248 } 249 if (vec->active && prio < active_prio) { 250 active_prio = prio; 251 } 252 } 253 } 254 255 s->vectpending_is_s_banked = pending_is_s_banked; 256 s->vectpending = pend_irq; 257 s->vectpending_prio = pend_prio; 258 s->exception_prio = active_prio; 259 260 trace_nvic_recompute_state_secure(s->vectpending, 261 s->vectpending_is_s_banked, 262 s->vectpending_prio, 263 s->exception_prio); 264 } 265 266 /* Recompute vectpending and exception_prio */ 267 static void nvic_recompute_state(NVICState *s) 268 { 269 int i; 270 int pend_prio = NVIC_NOEXC_PRIO; 271 int active_prio = NVIC_NOEXC_PRIO; 272 int pend_irq = 0; 273 274 /* In theory we could write one function that handled both 275 * the "security extension present" and "not present"; however 276 * the security related changes significantly complicate the 277 * recomputation just by themselves and mixing both cases together 278 * would be even worse, so we retain a separate non-secure-only 279 * version for CPUs which don't implement the security extension. 280 */ 281 if (arm_feature(&s->cpu->env, ARM_FEATURE_M_SECURITY)) { 282 nvic_recompute_state_secure(s); 283 return; 284 } 285 286 for (i = 1; i < s->num_irq; i++) { 287 VecInfo *vec = &s->vectors[i]; 288 289 if (vec->enabled && vec->pending && vec->prio < pend_prio) { 290 pend_prio = vec->prio; 291 pend_irq = i; 292 } 293 if (vec->active && vec->prio < active_prio) { 294 active_prio = vec->prio; 295 } 296 } 297 298 if (active_prio > 0) { 299 active_prio &= nvic_gprio_mask(s, false); 300 } 301 302 if (pend_prio > 0) { 303 pend_prio &= nvic_gprio_mask(s, false); 304 } 305 306 s->vectpending = pend_irq; 307 s->vectpending_prio = pend_prio; 308 s->exception_prio = active_prio; 309 310 trace_nvic_recompute_state(s->vectpending, 311 s->vectpending_prio, 312 s->exception_prio); 313 } 314 315 /* Return the current execution priority of the CPU 316 * (equivalent to the pseudocode ExecutionPriority function). 317 * This is a value between -2 (NMI priority) and NVIC_NOEXC_PRIO. 318 */ 319 static inline int nvic_exec_prio(NVICState *s) 320 { 321 CPUARMState *env = &s->cpu->env; 322 int running = NVIC_NOEXC_PRIO; 323 324 if (env->v7m.basepri[M_REG_NS] > 0) { 325 running = exc_group_prio(s, env->v7m.basepri[M_REG_NS], M_REG_NS); 326 } 327 328 if (env->v7m.basepri[M_REG_S] > 0) { 329 int basepri = exc_group_prio(s, env->v7m.basepri[M_REG_S], M_REG_S); 330 if (running > basepri) { 331 running = basepri; 332 } 333 } 334 335 if (env->v7m.primask[M_REG_NS]) { 336 if (env->v7m.aircr & R_V7M_AIRCR_PRIS_MASK) { 337 if (running > NVIC_NS_PRIO_LIMIT) { 338 running = NVIC_NS_PRIO_LIMIT; 339 } 340 } else { 341 running = 0; 342 } 343 } 344 345 if (env->v7m.primask[M_REG_S]) { 346 running = 0; 347 } 348 349 if (env->v7m.faultmask[M_REG_NS]) { 350 if (env->v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK) { 351 running = -1; 352 } else { 353 if (env->v7m.aircr & R_V7M_AIRCR_PRIS_MASK) { 354 if (running > NVIC_NS_PRIO_LIMIT) { 355 running = NVIC_NS_PRIO_LIMIT; 356 } 357 } else { 358 running = 0; 359 } 360 } 361 } 362 363 if (env->v7m.faultmask[M_REG_S]) { 364 running = (env->v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK) ? -3 : -1; 365 } 366 367 /* consider priority of active handler */ 368 return MIN(running, s->exception_prio); 369 } 370 371 bool armv7m_nvic_neg_prio_requested(void *opaque, bool secure) 372 { 373 /* Return true if the requested execution priority is negative 374 * for the specified security state, ie that security state 375 * has an active NMI or HardFault or has set its FAULTMASK. 376 * Note that this is not the same as whether the execution 377 * priority is actually negative (for instance AIRCR.PRIS may 378 * mean we don't allow FAULTMASK_NS to actually make the execution 379 * priority negative). Compare pseudocode IsReqExcPriNeg(). 380 */ 381 NVICState *s = opaque; 382 383 if (s->cpu->env.v7m.faultmask[secure]) { 384 return true; 385 } 386 387 if (secure ? s->sec_vectors[ARMV7M_EXCP_HARD].active : 388 s->vectors[ARMV7M_EXCP_HARD].active) { 389 return true; 390 } 391 392 if (s->vectors[ARMV7M_EXCP_NMI].active && 393 exc_targets_secure(s, ARMV7M_EXCP_NMI) == secure) { 394 return true; 395 } 396 397 return false; 398 } 399 400 bool armv7m_nvic_can_take_pending_exception(void *opaque) 401 { 402 NVICState *s = opaque; 403 404 return nvic_exec_prio(s) > nvic_pending_prio(s); 405 } 406 407 int armv7m_nvic_raw_execution_priority(void *opaque) 408 { 409 NVICState *s = opaque; 410 411 return s->exception_prio; 412 } 413 414 /* caller must call nvic_irq_update() after this. 415 * secure indicates the bank to use for banked exceptions (we assert if 416 * we are passed secure=true for a non-banked exception). 417 */ 418 static void set_prio(NVICState *s, unsigned irq, bool secure, uint8_t prio) 419 { 420 assert(irq > ARMV7M_EXCP_NMI); /* only use for configurable prios */ 421 assert(irq < s->num_irq); 422 423 prio &= MAKE_64BIT_MASK(8 - s->num_prio_bits, s->num_prio_bits); 424 425 if (secure) { 426 assert(exc_is_banked(irq)); 427 s->sec_vectors[irq].prio = prio; 428 } else { 429 s->vectors[irq].prio = prio; 430 } 431 432 trace_nvic_set_prio(irq, secure, prio); 433 } 434 435 /* Return the current raw priority register value. 436 * secure indicates the bank to use for banked exceptions (we assert if 437 * we are passed secure=true for a non-banked exception). 438 */ 439 static int get_prio(NVICState *s, unsigned irq, bool secure) 440 { 441 assert(irq > ARMV7M_EXCP_NMI); /* only use for configurable prios */ 442 assert(irq < s->num_irq); 443 444 if (secure) { 445 assert(exc_is_banked(irq)); 446 return s->sec_vectors[irq].prio; 447 } else { 448 return s->vectors[irq].prio; 449 } 450 } 451 452 /* Recompute state and assert irq line accordingly. 453 * Must be called after changes to: 454 * vec->active, vec->enabled, vec->pending or vec->prio for any vector 455 * prigroup 456 */ 457 static void nvic_irq_update(NVICState *s) 458 { 459 int lvl; 460 int pend_prio; 461 462 nvic_recompute_state(s); 463 pend_prio = nvic_pending_prio(s); 464 465 /* Raise NVIC output if this IRQ would be taken, except that we 466 * ignore the effects of the BASEPRI, FAULTMASK and PRIMASK (which 467 * will be checked for in arm_v7m_cpu_exec_interrupt()); changes 468 * to those CPU registers don't cause us to recalculate the NVIC 469 * pending info. 470 */ 471 lvl = (pend_prio < s->exception_prio); 472 trace_nvic_irq_update(s->vectpending, pend_prio, s->exception_prio, lvl); 473 qemu_set_irq(s->excpout, lvl); 474 } 475 476 /** 477 * armv7m_nvic_clear_pending: mark the specified exception as not pending 478 * @opaque: the NVIC 479 * @irq: the exception number to mark as not pending 480 * @secure: false for non-banked exceptions or for the nonsecure 481 * version of a banked exception, true for the secure version of a banked 482 * exception. 483 * 484 * Marks the specified exception as not pending. Note that we will assert() 485 * if @secure is true and @irq does not specify one of the fixed set 486 * of architecturally banked exceptions. 487 */ 488 static void armv7m_nvic_clear_pending(void *opaque, int irq, bool secure) 489 { 490 NVICState *s = (NVICState *)opaque; 491 VecInfo *vec; 492 493 assert(irq > ARMV7M_EXCP_RESET && irq < s->num_irq); 494 495 if (secure) { 496 assert(exc_is_banked(irq)); 497 vec = &s->sec_vectors[irq]; 498 } else { 499 vec = &s->vectors[irq]; 500 } 501 trace_nvic_clear_pending(irq, secure, vec->enabled, vec->prio); 502 if (vec->pending) { 503 vec->pending = 0; 504 nvic_irq_update(s); 505 } 506 } 507 508 static void do_armv7m_nvic_set_pending(void *opaque, int irq, bool secure, 509 bool derived) 510 { 511 /* Pend an exception, including possibly escalating it to HardFault. 512 * 513 * This function handles both "normal" pending of interrupts and 514 * exceptions, and also derived exceptions (ones which occur as 515 * a result of trying to take some other exception). 516 * 517 * If derived == true, the caller guarantees that we are part way through 518 * trying to take an exception (but have not yet called 519 * armv7m_nvic_acknowledge_irq() to make it active), and so: 520 * - s->vectpending is the "original exception" we were trying to take 521 * - irq is the "derived exception" 522 * - nvic_exec_prio(s) gives the priority before exception entry 523 * Here we handle the prioritization logic which the pseudocode puts 524 * in the DerivedLateArrival() function. 525 */ 526 527 NVICState *s = (NVICState *)opaque; 528 bool banked = exc_is_banked(irq); 529 VecInfo *vec; 530 bool targets_secure; 531 532 assert(irq > ARMV7M_EXCP_RESET && irq < s->num_irq); 533 assert(!secure || banked); 534 535 vec = (banked && secure) ? &s->sec_vectors[irq] : &s->vectors[irq]; 536 537 targets_secure = banked ? secure : exc_targets_secure(s, irq); 538 539 trace_nvic_set_pending(irq, secure, targets_secure, 540 derived, vec->enabled, vec->prio); 541 542 if (derived) { 543 /* Derived exceptions are always synchronous. */ 544 assert(irq >= ARMV7M_EXCP_HARD && irq < ARMV7M_EXCP_PENDSV); 545 546 if (irq == ARMV7M_EXCP_DEBUG && 547 exc_group_prio(s, vec->prio, secure) >= nvic_exec_prio(s)) { 548 /* DebugMonitorFault, but its priority is lower than the 549 * preempted exception priority: just ignore it. 550 */ 551 return; 552 } 553 554 if (irq == ARMV7M_EXCP_HARD && vec->prio >= s->vectpending_prio) { 555 /* If this is a terminal exception (one which means we cannot 556 * take the original exception, like a failure to read its 557 * vector table entry), then we must take the derived exception. 558 * If the derived exception can't take priority over the 559 * original exception, then we go into Lockup. 560 * 561 * For QEMU, we rely on the fact that a derived exception is 562 * terminal if and only if it's reported to us as HardFault, 563 * which saves having to have an extra argument is_terminal 564 * that we'd only use in one place. 565 */ 566 cpu_abort(&s->cpu->parent_obj, 567 "Lockup: can't take terminal derived exception " 568 "(original exception priority %d)\n", 569 s->vectpending_prio); 570 } 571 /* We now continue with the same code as for a normal pending 572 * exception, which will cause us to pend the derived exception. 573 * We'll then take either the original or the derived exception 574 * based on which is higher priority by the usual mechanism 575 * for selecting the highest priority pending interrupt. 576 */ 577 } 578 579 if (irq >= ARMV7M_EXCP_HARD && irq < ARMV7M_EXCP_PENDSV) { 580 /* If a synchronous exception is pending then it may be 581 * escalated to HardFault if: 582 * * it is equal or lower priority to current execution 583 * * it is disabled 584 * (ie we need to take it immediately but we can't do so). 585 * Asynchronous exceptions (and interrupts) simply remain pending. 586 * 587 * For QEMU, we don't have any imprecise (asynchronous) faults, 588 * so we can assume that PREFETCH_ABORT and DATA_ABORT are always 589 * synchronous. 590 * Debug exceptions are awkward because only Debug exceptions 591 * resulting from the BKPT instruction should be escalated, 592 * but we don't currently implement any Debug exceptions other 593 * than those that result from BKPT, so we treat all debug exceptions 594 * as needing escalation. 595 * 596 * This all means we can identify whether to escalate based only on 597 * the exception number and don't (yet) need the caller to explicitly 598 * tell us whether this exception is synchronous or not. 599 */ 600 int running = nvic_exec_prio(s); 601 bool escalate = false; 602 603 if (exc_group_prio(s, vec->prio, secure) >= running) { 604 trace_nvic_escalate_prio(irq, vec->prio, running); 605 escalate = true; 606 } else if (!vec->enabled) { 607 trace_nvic_escalate_disabled(irq); 608 escalate = true; 609 } 610 611 if (escalate) { 612 613 /* We need to escalate this exception to a synchronous HardFault. 614 * If BFHFNMINS is set then we escalate to the banked HF for 615 * the target security state of the original exception; otherwise 616 * we take a Secure HardFault. 617 */ 618 irq = ARMV7M_EXCP_HARD; 619 if (arm_feature(&s->cpu->env, ARM_FEATURE_M_SECURITY) && 620 (targets_secure || 621 !(s->cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK))) { 622 vec = &s->sec_vectors[irq]; 623 } else { 624 vec = &s->vectors[irq]; 625 } 626 if (running <= vec->prio) { 627 /* We want to escalate to HardFault but we can't take the 628 * synchronous HardFault at this point either. This is a 629 * Lockup condition due to a guest bug. We don't model 630 * Lockup, so report via cpu_abort() instead. 631 */ 632 cpu_abort(&s->cpu->parent_obj, 633 "Lockup: can't escalate %d to HardFault " 634 "(current priority %d)\n", irq, running); 635 } 636 637 /* HF may be banked but there is only one shared HFSR */ 638 s->cpu->env.v7m.hfsr |= R_V7M_HFSR_FORCED_MASK; 639 } 640 } 641 642 if (!vec->pending) { 643 vec->pending = 1; 644 nvic_irq_update(s); 645 } 646 } 647 648 void armv7m_nvic_set_pending(void *opaque, int irq, bool secure) 649 { 650 do_armv7m_nvic_set_pending(opaque, irq, secure, false); 651 } 652 653 void armv7m_nvic_set_pending_derived(void *opaque, int irq, bool secure) 654 { 655 do_armv7m_nvic_set_pending(opaque, irq, secure, true); 656 } 657 658 /* Make pending IRQ active. */ 659 void armv7m_nvic_acknowledge_irq(void *opaque) 660 { 661 NVICState *s = (NVICState *)opaque; 662 CPUARMState *env = &s->cpu->env; 663 const int pending = s->vectpending; 664 const int running = nvic_exec_prio(s); 665 VecInfo *vec; 666 667 assert(pending > ARMV7M_EXCP_RESET && pending < s->num_irq); 668 669 if (s->vectpending_is_s_banked) { 670 vec = &s->sec_vectors[pending]; 671 } else { 672 vec = &s->vectors[pending]; 673 } 674 675 assert(vec->enabled); 676 assert(vec->pending); 677 678 assert(s->vectpending_prio < running); 679 680 trace_nvic_acknowledge_irq(pending, s->vectpending_prio); 681 682 vec->active = 1; 683 vec->pending = 0; 684 685 write_v7m_exception(env, s->vectpending); 686 687 nvic_irq_update(s); 688 } 689 690 void armv7m_nvic_get_pending_irq_info(void *opaque, 691 int *pirq, bool *ptargets_secure) 692 { 693 NVICState *s = (NVICState *)opaque; 694 const int pending = s->vectpending; 695 bool targets_secure; 696 697 assert(pending > ARMV7M_EXCP_RESET && pending < s->num_irq); 698 699 if (s->vectpending_is_s_banked) { 700 targets_secure = true; 701 } else { 702 targets_secure = !exc_is_banked(pending) && 703 exc_targets_secure(s, pending); 704 } 705 706 trace_nvic_get_pending_irq_info(pending, targets_secure); 707 708 *ptargets_secure = targets_secure; 709 *pirq = pending; 710 } 711 712 int armv7m_nvic_complete_irq(void *opaque, int irq, bool secure) 713 { 714 NVICState *s = (NVICState *)opaque; 715 VecInfo *vec; 716 int ret; 717 718 assert(irq > ARMV7M_EXCP_RESET && irq < s->num_irq); 719 720 if (secure && exc_is_banked(irq)) { 721 vec = &s->sec_vectors[irq]; 722 } else { 723 vec = &s->vectors[irq]; 724 } 725 726 trace_nvic_complete_irq(irq, secure); 727 728 if (!vec->active) { 729 /* Tell the caller this was an illegal exception return */ 730 return -1; 731 } 732 733 ret = nvic_rettobase(s); 734 735 vec->active = 0; 736 if (vec->level) { 737 /* Re-pend the exception if it's still held high; only 738 * happens for extenal IRQs 739 */ 740 assert(irq >= NVIC_FIRST_IRQ); 741 vec->pending = 1; 742 } 743 744 nvic_irq_update(s); 745 746 return ret; 747 } 748 749 /* callback when external interrupt line is changed */ 750 static void set_irq_level(void *opaque, int n, int level) 751 { 752 NVICState *s = opaque; 753 VecInfo *vec; 754 755 n += NVIC_FIRST_IRQ; 756 757 assert(n >= NVIC_FIRST_IRQ && n < s->num_irq); 758 759 trace_nvic_set_irq_level(n, level); 760 761 /* The pending status of an external interrupt is 762 * latched on rising edge and exception handler return. 763 * 764 * Pulsing the IRQ will always run the handler 765 * once, and the handler will re-run until the 766 * level is low when the handler completes. 767 */ 768 vec = &s->vectors[n]; 769 if (level != vec->level) { 770 vec->level = level; 771 if (level) { 772 armv7m_nvic_set_pending(s, n, false); 773 } 774 } 775 } 776 777 /* callback when external NMI line is changed */ 778 static void nvic_nmi_trigger(void *opaque, int n, int level) 779 { 780 NVICState *s = opaque; 781 782 trace_nvic_set_nmi_level(level); 783 784 /* 785 * The architecture doesn't specify whether NMI should share 786 * the normal-interrupt behaviour of being resampled on 787 * exception handler return. We choose not to, so just 788 * set NMI pending here and don't track the current level. 789 */ 790 if (level) { 791 armv7m_nvic_set_pending(s, ARMV7M_EXCP_NMI, false); 792 } 793 } 794 795 static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs) 796 { 797 ARMCPU *cpu = s->cpu; 798 uint32_t val; 799 800 switch (offset) { 801 case 4: /* Interrupt Control Type. */ 802 if (!arm_feature(&cpu->env, ARM_FEATURE_V7)) { 803 goto bad_offset; 804 } 805 return ((s->num_irq - NVIC_FIRST_IRQ) / 32) - 1; 806 case 0xc: /* CPPWR */ 807 if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) { 808 goto bad_offset; 809 } 810 /* We make the IMPDEF choice that nothing can ever go into a 811 * non-retentive power state, which allows us to RAZ/WI this. 812 */ 813 return 0; 814 case 0x380 ... 0x3bf: /* NVIC_ITNS<n> */ 815 { 816 int startvec = 8 * (offset - 0x380) + NVIC_FIRST_IRQ; 817 int i; 818 819 if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) { 820 goto bad_offset; 821 } 822 if (!attrs.secure) { 823 return 0; 824 } 825 val = 0; 826 for (i = 0; i < 32 && startvec + i < s->num_irq; i++) { 827 if (s->itns[startvec + i]) { 828 val |= (1 << i); 829 } 830 } 831 return val; 832 } 833 case 0xd00: /* CPUID Base. */ 834 return cpu->midr; 835 case 0xd04: /* Interrupt Control State (ICSR) */ 836 /* VECTACTIVE */ 837 val = cpu->env.v7m.exception; 838 /* VECTPENDING */ 839 val |= (s->vectpending & 0xff) << 12; 840 /* ISRPENDING - set if any external IRQ is pending */ 841 if (nvic_isrpending(s)) { 842 val |= (1 << 22); 843 } 844 /* RETTOBASE - set if only one handler is active */ 845 if (nvic_rettobase(s)) { 846 val |= (1 << 11); 847 } 848 if (attrs.secure) { 849 /* PENDSTSET */ 850 if (s->sec_vectors[ARMV7M_EXCP_SYSTICK].pending) { 851 val |= (1 << 26); 852 } 853 /* PENDSVSET */ 854 if (s->sec_vectors[ARMV7M_EXCP_PENDSV].pending) { 855 val |= (1 << 28); 856 } 857 } else { 858 /* PENDSTSET */ 859 if (s->vectors[ARMV7M_EXCP_SYSTICK].pending) { 860 val |= (1 << 26); 861 } 862 /* PENDSVSET */ 863 if (s->vectors[ARMV7M_EXCP_PENDSV].pending) { 864 val |= (1 << 28); 865 } 866 } 867 /* NMIPENDSET */ 868 if ((attrs.secure || (cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK)) 869 && s->vectors[ARMV7M_EXCP_NMI].pending) { 870 val |= (1 << 31); 871 } 872 /* ISRPREEMPT: RES0 when halting debug not implemented */ 873 /* STTNS: RES0 for the Main Extension */ 874 return val; 875 case 0xd08: /* Vector Table Offset. */ 876 return cpu->env.v7m.vecbase[attrs.secure]; 877 case 0xd0c: /* Application Interrupt/Reset Control (AIRCR) */ 878 val = 0xfa050000 | (s->prigroup[attrs.secure] << 8); 879 if (attrs.secure) { 880 /* s->aircr stores PRIS, BFHFNMINS, SYSRESETREQS */ 881 val |= cpu->env.v7m.aircr; 882 } else { 883 if (arm_feature(&cpu->env, ARM_FEATURE_V8)) { 884 /* BFHFNMINS is R/O from NS; other bits are RAZ/WI. If 885 * security isn't supported then BFHFNMINS is RAO (and 886 * the bit in env.v7m.aircr is always set). 887 */ 888 val |= cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK; 889 } 890 } 891 return val; 892 case 0xd10: /* System Control. */ 893 if (!arm_feature(&cpu->env, ARM_FEATURE_V7)) { 894 goto bad_offset; 895 } 896 return cpu->env.v7m.scr[attrs.secure]; 897 case 0xd14: /* Configuration Control. */ 898 /* The BFHFNMIGN bit is the only non-banked bit; we 899 * keep it in the non-secure copy of the register. 900 */ 901 val = cpu->env.v7m.ccr[attrs.secure]; 902 val |= cpu->env.v7m.ccr[M_REG_NS] & R_V7M_CCR_BFHFNMIGN_MASK; 903 return val; 904 case 0xd24: /* System Handler Control and State (SHCSR) */ 905 if (!arm_feature(&cpu->env, ARM_FEATURE_V7)) { 906 goto bad_offset; 907 } 908 val = 0; 909 if (attrs.secure) { 910 if (s->sec_vectors[ARMV7M_EXCP_MEM].active) { 911 val |= (1 << 0); 912 } 913 if (s->sec_vectors[ARMV7M_EXCP_HARD].active) { 914 val |= (1 << 2); 915 } 916 if (s->sec_vectors[ARMV7M_EXCP_USAGE].active) { 917 val |= (1 << 3); 918 } 919 if (s->sec_vectors[ARMV7M_EXCP_SVC].active) { 920 val |= (1 << 7); 921 } 922 if (s->sec_vectors[ARMV7M_EXCP_PENDSV].active) { 923 val |= (1 << 10); 924 } 925 if (s->sec_vectors[ARMV7M_EXCP_SYSTICK].active) { 926 val |= (1 << 11); 927 } 928 if (s->sec_vectors[ARMV7M_EXCP_USAGE].pending) { 929 val |= (1 << 12); 930 } 931 if (s->sec_vectors[ARMV7M_EXCP_MEM].pending) { 932 val |= (1 << 13); 933 } 934 if (s->sec_vectors[ARMV7M_EXCP_SVC].pending) { 935 val |= (1 << 15); 936 } 937 if (s->sec_vectors[ARMV7M_EXCP_MEM].enabled) { 938 val |= (1 << 16); 939 } 940 if (s->sec_vectors[ARMV7M_EXCP_USAGE].enabled) { 941 val |= (1 << 18); 942 } 943 if (s->sec_vectors[ARMV7M_EXCP_HARD].pending) { 944 val |= (1 << 21); 945 } 946 /* SecureFault is not banked but is always RAZ/WI to NS */ 947 if (s->vectors[ARMV7M_EXCP_SECURE].active) { 948 val |= (1 << 4); 949 } 950 if (s->vectors[ARMV7M_EXCP_SECURE].enabled) { 951 val |= (1 << 19); 952 } 953 if (s->vectors[ARMV7M_EXCP_SECURE].pending) { 954 val |= (1 << 20); 955 } 956 } else { 957 if (s->vectors[ARMV7M_EXCP_MEM].active) { 958 val |= (1 << 0); 959 } 960 if (arm_feature(&cpu->env, ARM_FEATURE_V8)) { 961 /* HARDFAULTACT, HARDFAULTPENDED not present in v7M */ 962 if (s->vectors[ARMV7M_EXCP_HARD].active) { 963 val |= (1 << 2); 964 } 965 if (s->vectors[ARMV7M_EXCP_HARD].pending) { 966 val |= (1 << 21); 967 } 968 } 969 if (s->vectors[ARMV7M_EXCP_USAGE].active) { 970 val |= (1 << 3); 971 } 972 if (s->vectors[ARMV7M_EXCP_SVC].active) { 973 val |= (1 << 7); 974 } 975 if (s->vectors[ARMV7M_EXCP_PENDSV].active) { 976 val |= (1 << 10); 977 } 978 if (s->vectors[ARMV7M_EXCP_SYSTICK].active) { 979 val |= (1 << 11); 980 } 981 if (s->vectors[ARMV7M_EXCP_USAGE].pending) { 982 val |= (1 << 12); 983 } 984 if (s->vectors[ARMV7M_EXCP_MEM].pending) { 985 val |= (1 << 13); 986 } 987 if (s->vectors[ARMV7M_EXCP_SVC].pending) { 988 val |= (1 << 15); 989 } 990 if (s->vectors[ARMV7M_EXCP_MEM].enabled) { 991 val |= (1 << 16); 992 } 993 if (s->vectors[ARMV7M_EXCP_USAGE].enabled) { 994 val |= (1 << 18); 995 } 996 } 997 if (attrs.secure || (cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK)) { 998 if (s->vectors[ARMV7M_EXCP_BUS].active) { 999 val |= (1 << 1); 1000 } 1001 if (s->vectors[ARMV7M_EXCP_BUS].pending) { 1002 val |= (1 << 14); 1003 } 1004 if (s->vectors[ARMV7M_EXCP_BUS].enabled) { 1005 val |= (1 << 17); 1006 } 1007 if (arm_feature(&cpu->env, ARM_FEATURE_V8) && 1008 s->vectors[ARMV7M_EXCP_NMI].active) { 1009 /* NMIACT is not present in v7M */ 1010 val |= (1 << 5); 1011 } 1012 } 1013 1014 /* TODO: this is RAZ/WI from NS if DEMCR.SDME is set */ 1015 if (s->vectors[ARMV7M_EXCP_DEBUG].active) { 1016 val |= (1 << 8); 1017 } 1018 return val; 1019 case 0xd2c: /* Hard Fault Status. */ 1020 if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) { 1021 goto bad_offset; 1022 } 1023 return cpu->env.v7m.hfsr; 1024 case 0xd30: /* Debug Fault Status. */ 1025 return cpu->env.v7m.dfsr; 1026 case 0xd34: /* MMFAR MemManage Fault Address */ 1027 if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) { 1028 goto bad_offset; 1029 } 1030 return cpu->env.v7m.mmfar[attrs.secure]; 1031 case 0xd38: /* Bus Fault Address. */ 1032 if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) { 1033 goto bad_offset; 1034 } 1035 return cpu->env.v7m.bfar; 1036 case 0xd3c: /* Aux Fault Status. */ 1037 /* TODO: Implement fault status registers. */ 1038 qemu_log_mask(LOG_UNIMP, 1039 "Aux Fault status registers unimplemented\n"); 1040 return 0; 1041 case 0xd40: /* PFR0. */ 1042 return cpu->id_pfr0; 1043 case 0xd44: /* PFR1. */ 1044 return cpu->id_pfr1; 1045 case 0xd48: /* DFR0. */ 1046 return cpu->id_dfr0; 1047 case 0xd4c: /* AFR0. */ 1048 return cpu->id_afr0; 1049 case 0xd50: /* MMFR0. */ 1050 return cpu->id_mmfr0; 1051 case 0xd54: /* MMFR1. */ 1052 return cpu->id_mmfr1; 1053 case 0xd58: /* MMFR2. */ 1054 return cpu->id_mmfr2; 1055 case 0xd5c: /* MMFR3. */ 1056 return cpu->id_mmfr3; 1057 case 0xd60: /* ISAR0. */ 1058 return cpu->isar.id_isar0; 1059 case 0xd64: /* ISAR1. */ 1060 return cpu->isar.id_isar1; 1061 case 0xd68: /* ISAR2. */ 1062 return cpu->isar.id_isar2; 1063 case 0xd6c: /* ISAR3. */ 1064 return cpu->isar.id_isar3; 1065 case 0xd70: /* ISAR4. */ 1066 return cpu->isar.id_isar4; 1067 case 0xd74: /* ISAR5. */ 1068 return cpu->isar.id_isar5; 1069 case 0xd78: /* CLIDR */ 1070 return cpu->clidr; 1071 case 0xd7c: /* CTR */ 1072 return cpu->ctr; 1073 case 0xd80: /* CSSIDR */ 1074 { 1075 int idx = cpu->env.v7m.csselr[attrs.secure] & R_V7M_CSSELR_INDEX_MASK; 1076 return cpu->ccsidr[idx]; 1077 } 1078 case 0xd84: /* CSSELR */ 1079 return cpu->env.v7m.csselr[attrs.secure]; 1080 /* TODO: Implement debug registers. */ 1081 case 0xd90: /* MPU_TYPE */ 1082 /* Unified MPU; if the MPU is not present this value is zero */ 1083 return cpu->pmsav7_dregion << 8; 1084 break; 1085 case 0xd94: /* MPU_CTRL */ 1086 return cpu->env.v7m.mpu_ctrl[attrs.secure]; 1087 case 0xd98: /* MPU_RNR */ 1088 return cpu->env.pmsav7.rnr[attrs.secure]; 1089 case 0xd9c: /* MPU_RBAR */ 1090 case 0xda4: /* MPU_RBAR_A1 */ 1091 case 0xdac: /* MPU_RBAR_A2 */ 1092 case 0xdb4: /* MPU_RBAR_A3 */ 1093 { 1094 int region = cpu->env.pmsav7.rnr[attrs.secure]; 1095 1096 if (arm_feature(&cpu->env, ARM_FEATURE_V8)) { 1097 /* PMSAv8M handling of the aliases is different from v7M: 1098 * aliases A1, A2, A3 override the low two bits of the region 1099 * number in MPU_RNR, and there is no 'region' field in the 1100 * RBAR register. 1101 */ 1102 int aliasno = (offset - 0xd9c) / 8; /* 0..3 */ 1103 if (aliasno) { 1104 region = deposit32(region, 0, 2, aliasno); 1105 } 1106 if (region >= cpu->pmsav7_dregion) { 1107 return 0; 1108 } 1109 return cpu->env.pmsav8.rbar[attrs.secure][region]; 1110 } 1111 1112 if (region >= cpu->pmsav7_dregion) { 1113 return 0; 1114 } 1115 return (cpu->env.pmsav7.drbar[region] & ~0x1f) | (region & 0xf); 1116 } 1117 case 0xda0: /* MPU_RASR (v7M), MPU_RLAR (v8M) */ 1118 case 0xda8: /* MPU_RASR_A1 (v7M), MPU_RLAR_A1 (v8M) */ 1119 case 0xdb0: /* MPU_RASR_A2 (v7M), MPU_RLAR_A2 (v8M) */ 1120 case 0xdb8: /* MPU_RASR_A3 (v7M), MPU_RLAR_A3 (v8M) */ 1121 { 1122 int region = cpu->env.pmsav7.rnr[attrs.secure]; 1123 1124 if (arm_feature(&cpu->env, ARM_FEATURE_V8)) { 1125 /* PMSAv8M handling of the aliases is different from v7M: 1126 * aliases A1, A2, A3 override the low two bits of the region 1127 * number in MPU_RNR. 1128 */ 1129 int aliasno = (offset - 0xda0) / 8; /* 0..3 */ 1130 if (aliasno) { 1131 region = deposit32(region, 0, 2, aliasno); 1132 } 1133 if (region >= cpu->pmsav7_dregion) { 1134 return 0; 1135 } 1136 return cpu->env.pmsav8.rlar[attrs.secure][region]; 1137 } 1138 1139 if (region >= cpu->pmsav7_dregion) { 1140 return 0; 1141 } 1142 return ((cpu->env.pmsav7.dracr[region] & 0xffff) << 16) | 1143 (cpu->env.pmsav7.drsr[region] & 0xffff); 1144 } 1145 case 0xdc0: /* MPU_MAIR0 */ 1146 if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) { 1147 goto bad_offset; 1148 } 1149 return cpu->env.pmsav8.mair0[attrs.secure]; 1150 case 0xdc4: /* MPU_MAIR1 */ 1151 if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) { 1152 goto bad_offset; 1153 } 1154 return cpu->env.pmsav8.mair1[attrs.secure]; 1155 case 0xdd0: /* SAU_CTRL */ 1156 if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) { 1157 goto bad_offset; 1158 } 1159 if (!attrs.secure) { 1160 return 0; 1161 } 1162 return cpu->env.sau.ctrl; 1163 case 0xdd4: /* SAU_TYPE */ 1164 if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) { 1165 goto bad_offset; 1166 } 1167 if (!attrs.secure) { 1168 return 0; 1169 } 1170 return cpu->sau_sregion; 1171 case 0xdd8: /* SAU_RNR */ 1172 if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) { 1173 goto bad_offset; 1174 } 1175 if (!attrs.secure) { 1176 return 0; 1177 } 1178 return cpu->env.sau.rnr; 1179 case 0xddc: /* SAU_RBAR */ 1180 { 1181 int region = cpu->env.sau.rnr; 1182 1183 if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) { 1184 goto bad_offset; 1185 } 1186 if (!attrs.secure) { 1187 return 0; 1188 } 1189 if (region >= cpu->sau_sregion) { 1190 return 0; 1191 } 1192 return cpu->env.sau.rbar[region]; 1193 } 1194 case 0xde0: /* SAU_RLAR */ 1195 { 1196 int region = cpu->env.sau.rnr; 1197 1198 if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) { 1199 goto bad_offset; 1200 } 1201 if (!attrs.secure) { 1202 return 0; 1203 } 1204 if (region >= cpu->sau_sregion) { 1205 return 0; 1206 } 1207 return cpu->env.sau.rlar[region]; 1208 } 1209 case 0xde4: /* SFSR */ 1210 if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) { 1211 goto bad_offset; 1212 } 1213 if (!attrs.secure) { 1214 return 0; 1215 } 1216 return cpu->env.v7m.sfsr; 1217 case 0xde8: /* SFAR */ 1218 if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) { 1219 goto bad_offset; 1220 } 1221 if (!attrs.secure) { 1222 return 0; 1223 } 1224 return cpu->env.v7m.sfar; 1225 case 0xf40: /* MVFR0 */ 1226 return cpu->isar.mvfr0; 1227 case 0xf44: /* MVFR1 */ 1228 return cpu->isar.mvfr1; 1229 case 0xf48: /* MVFR2 */ 1230 return cpu->isar.mvfr2; 1231 default: 1232 bad_offset: 1233 qemu_log_mask(LOG_GUEST_ERROR, "NVIC: Bad read offset 0x%x\n", offset); 1234 return 0; 1235 } 1236 } 1237 1238 static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value, 1239 MemTxAttrs attrs) 1240 { 1241 ARMCPU *cpu = s->cpu; 1242 1243 switch (offset) { 1244 case 0xc: /* CPPWR */ 1245 if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) { 1246 goto bad_offset; 1247 } 1248 /* Make the IMPDEF choice to RAZ/WI this. */ 1249 break; 1250 case 0x380 ... 0x3bf: /* NVIC_ITNS<n> */ 1251 { 1252 int startvec = 8 * (offset - 0x380) + NVIC_FIRST_IRQ; 1253 int i; 1254 1255 if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) { 1256 goto bad_offset; 1257 } 1258 if (!attrs.secure) { 1259 break; 1260 } 1261 for (i = 0; i < 32 && startvec + i < s->num_irq; i++) { 1262 s->itns[startvec + i] = (value >> i) & 1; 1263 } 1264 nvic_irq_update(s); 1265 break; 1266 } 1267 case 0xd04: /* Interrupt Control State (ICSR) */ 1268 if (attrs.secure || cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK) { 1269 if (value & (1 << 31)) { 1270 armv7m_nvic_set_pending(s, ARMV7M_EXCP_NMI, false); 1271 } else if (value & (1 << 30) && 1272 arm_feature(&cpu->env, ARM_FEATURE_V8)) { 1273 /* PENDNMICLR didn't exist in v7M */ 1274 armv7m_nvic_clear_pending(s, ARMV7M_EXCP_NMI, false); 1275 } 1276 } 1277 if (value & (1 << 28)) { 1278 armv7m_nvic_set_pending(s, ARMV7M_EXCP_PENDSV, attrs.secure); 1279 } else if (value & (1 << 27)) { 1280 armv7m_nvic_clear_pending(s, ARMV7M_EXCP_PENDSV, attrs.secure); 1281 } 1282 if (value & (1 << 26)) { 1283 armv7m_nvic_set_pending(s, ARMV7M_EXCP_SYSTICK, attrs.secure); 1284 } else if (value & (1 << 25)) { 1285 armv7m_nvic_clear_pending(s, ARMV7M_EXCP_SYSTICK, attrs.secure); 1286 } 1287 break; 1288 case 0xd08: /* Vector Table Offset. */ 1289 cpu->env.v7m.vecbase[attrs.secure] = value & 0xffffff80; 1290 break; 1291 case 0xd0c: /* Application Interrupt/Reset Control (AIRCR) */ 1292 if ((value >> R_V7M_AIRCR_VECTKEY_SHIFT) == 0x05fa) { 1293 if (value & R_V7M_AIRCR_SYSRESETREQ_MASK) { 1294 if (attrs.secure || 1295 !(cpu->env.v7m.aircr & R_V7M_AIRCR_SYSRESETREQS_MASK)) { 1296 qemu_irq_pulse(s->sysresetreq); 1297 } 1298 } 1299 if (value & R_V7M_AIRCR_VECTCLRACTIVE_MASK) { 1300 qemu_log_mask(LOG_GUEST_ERROR, 1301 "Setting VECTCLRACTIVE when not in DEBUG mode " 1302 "is UNPREDICTABLE\n"); 1303 } 1304 if (value & R_V7M_AIRCR_VECTRESET_MASK) { 1305 /* NB: this bit is RES0 in v8M */ 1306 qemu_log_mask(LOG_GUEST_ERROR, 1307 "Setting VECTRESET when not in DEBUG mode " 1308 "is UNPREDICTABLE\n"); 1309 } 1310 if (arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) { 1311 s->prigroup[attrs.secure] = 1312 extract32(value, 1313 R_V7M_AIRCR_PRIGROUP_SHIFT, 1314 R_V7M_AIRCR_PRIGROUP_LENGTH); 1315 } 1316 if (attrs.secure) { 1317 /* These bits are only writable by secure */ 1318 cpu->env.v7m.aircr = value & 1319 (R_V7M_AIRCR_SYSRESETREQS_MASK | 1320 R_V7M_AIRCR_BFHFNMINS_MASK | 1321 R_V7M_AIRCR_PRIS_MASK); 1322 /* BFHFNMINS changes the priority of Secure HardFault, and 1323 * allows a pending Non-secure HardFault to preempt (which 1324 * we implement by marking it enabled). 1325 */ 1326 if (cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK) { 1327 s->sec_vectors[ARMV7M_EXCP_HARD].prio = -3; 1328 s->vectors[ARMV7M_EXCP_HARD].enabled = 1; 1329 } else { 1330 s->sec_vectors[ARMV7M_EXCP_HARD].prio = -1; 1331 s->vectors[ARMV7M_EXCP_HARD].enabled = 0; 1332 } 1333 } 1334 nvic_irq_update(s); 1335 } 1336 break; 1337 case 0xd10: /* System Control. */ 1338 if (!arm_feature(&cpu->env, ARM_FEATURE_V7)) { 1339 goto bad_offset; 1340 } 1341 /* We don't implement deep-sleep so these bits are RAZ/WI. 1342 * The other bits in the register are banked. 1343 * QEMU's implementation ignores SEVONPEND and SLEEPONEXIT, which 1344 * is architecturally permitted. 1345 */ 1346 value &= ~(R_V7M_SCR_SLEEPDEEP_MASK | R_V7M_SCR_SLEEPDEEPS_MASK); 1347 cpu->env.v7m.scr[attrs.secure] = value; 1348 break; 1349 case 0xd14: /* Configuration Control. */ 1350 if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) { 1351 goto bad_offset; 1352 } 1353 1354 /* Enforce RAZ/WI on reserved and must-RAZ/WI bits */ 1355 value &= (R_V7M_CCR_STKALIGN_MASK | 1356 R_V7M_CCR_BFHFNMIGN_MASK | 1357 R_V7M_CCR_DIV_0_TRP_MASK | 1358 R_V7M_CCR_UNALIGN_TRP_MASK | 1359 R_V7M_CCR_USERSETMPEND_MASK | 1360 R_V7M_CCR_NONBASETHRDENA_MASK); 1361 1362 if (arm_feature(&cpu->env, ARM_FEATURE_V8)) { 1363 /* v8M makes NONBASETHRDENA and STKALIGN be RES1 */ 1364 value |= R_V7M_CCR_NONBASETHRDENA_MASK 1365 | R_V7M_CCR_STKALIGN_MASK; 1366 } 1367 if (attrs.secure) { 1368 /* the BFHFNMIGN bit is not banked; keep that in the NS copy */ 1369 cpu->env.v7m.ccr[M_REG_NS] = 1370 (cpu->env.v7m.ccr[M_REG_NS] & ~R_V7M_CCR_BFHFNMIGN_MASK) 1371 | (value & R_V7M_CCR_BFHFNMIGN_MASK); 1372 value &= ~R_V7M_CCR_BFHFNMIGN_MASK; 1373 } 1374 1375 cpu->env.v7m.ccr[attrs.secure] = value; 1376 break; 1377 case 0xd24: /* System Handler Control and State (SHCSR) */ 1378 if (!arm_feature(&cpu->env, ARM_FEATURE_V7)) { 1379 goto bad_offset; 1380 } 1381 if (attrs.secure) { 1382 s->sec_vectors[ARMV7M_EXCP_MEM].active = (value & (1 << 0)) != 0; 1383 /* Secure HardFault active bit cannot be written */ 1384 s->sec_vectors[ARMV7M_EXCP_USAGE].active = (value & (1 << 3)) != 0; 1385 s->sec_vectors[ARMV7M_EXCP_SVC].active = (value & (1 << 7)) != 0; 1386 s->sec_vectors[ARMV7M_EXCP_PENDSV].active = 1387 (value & (1 << 10)) != 0; 1388 s->sec_vectors[ARMV7M_EXCP_SYSTICK].active = 1389 (value & (1 << 11)) != 0; 1390 s->sec_vectors[ARMV7M_EXCP_USAGE].pending = 1391 (value & (1 << 12)) != 0; 1392 s->sec_vectors[ARMV7M_EXCP_MEM].pending = (value & (1 << 13)) != 0; 1393 s->sec_vectors[ARMV7M_EXCP_SVC].pending = (value & (1 << 15)) != 0; 1394 s->sec_vectors[ARMV7M_EXCP_MEM].enabled = (value & (1 << 16)) != 0; 1395 s->sec_vectors[ARMV7M_EXCP_BUS].enabled = (value & (1 << 17)) != 0; 1396 s->sec_vectors[ARMV7M_EXCP_USAGE].enabled = 1397 (value & (1 << 18)) != 0; 1398 s->sec_vectors[ARMV7M_EXCP_HARD].pending = (value & (1 << 21)) != 0; 1399 /* SecureFault not banked, but RAZ/WI to NS */ 1400 s->vectors[ARMV7M_EXCP_SECURE].active = (value & (1 << 4)) != 0; 1401 s->vectors[ARMV7M_EXCP_SECURE].enabled = (value & (1 << 19)) != 0; 1402 s->vectors[ARMV7M_EXCP_SECURE].pending = (value & (1 << 20)) != 0; 1403 } else { 1404 s->vectors[ARMV7M_EXCP_MEM].active = (value & (1 << 0)) != 0; 1405 if (arm_feature(&cpu->env, ARM_FEATURE_V8)) { 1406 /* HARDFAULTPENDED is not present in v7M */ 1407 s->vectors[ARMV7M_EXCP_HARD].pending = (value & (1 << 21)) != 0; 1408 } 1409 s->vectors[ARMV7M_EXCP_USAGE].active = (value & (1 << 3)) != 0; 1410 s->vectors[ARMV7M_EXCP_SVC].active = (value & (1 << 7)) != 0; 1411 s->vectors[ARMV7M_EXCP_PENDSV].active = (value & (1 << 10)) != 0; 1412 s->vectors[ARMV7M_EXCP_SYSTICK].active = (value & (1 << 11)) != 0; 1413 s->vectors[ARMV7M_EXCP_USAGE].pending = (value & (1 << 12)) != 0; 1414 s->vectors[ARMV7M_EXCP_MEM].pending = (value & (1 << 13)) != 0; 1415 s->vectors[ARMV7M_EXCP_SVC].pending = (value & (1 << 15)) != 0; 1416 s->vectors[ARMV7M_EXCP_MEM].enabled = (value & (1 << 16)) != 0; 1417 s->vectors[ARMV7M_EXCP_USAGE].enabled = (value & (1 << 18)) != 0; 1418 } 1419 if (attrs.secure || (cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK)) { 1420 s->vectors[ARMV7M_EXCP_BUS].active = (value & (1 << 1)) != 0; 1421 s->vectors[ARMV7M_EXCP_BUS].pending = (value & (1 << 14)) != 0; 1422 s->vectors[ARMV7M_EXCP_BUS].enabled = (value & (1 << 17)) != 0; 1423 } 1424 /* NMIACT can only be written if the write is of a zero, with 1425 * BFHFNMINS 1, and by the CPU in secure state via the NS alias. 1426 */ 1427 if (!attrs.secure && cpu->env.v7m.secure && 1428 (cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK) && 1429 (value & (1 << 5)) == 0) { 1430 s->vectors[ARMV7M_EXCP_NMI].active = 0; 1431 } 1432 /* HARDFAULTACT can only be written if the write is of a zero 1433 * to the non-secure HardFault state by the CPU in secure state. 1434 * The only case where we can be targeting the non-secure HF state 1435 * when in secure state is if this is a write via the NS alias 1436 * and BFHFNMINS is 1. 1437 */ 1438 if (!attrs.secure && cpu->env.v7m.secure && 1439 (cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK) && 1440 (value & (1 << 2)) == 0) { 1441 s->vectors[ARMV7M_EXCP_HARD].active = 0; 1442 } 1443 1444 /* TODO: this is RAZ/WI from NS if DEMCR.SDME is set */ 1445 s->vectors[ARMV7M_EXCP_DEBUG].active = (value & (1 << 8)) != 0; 1446 nvic_irq_update(s); 1447 break; 1448 case 0xd2c: /* Hard Fault Status. */ 1449 if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) { 1450 goto bad_offset; 1451 } 1452 cpu->env.v7m.hfsr &= ~value; /* W1C */ 1453 break; 1454 case 0xd30: /* Debug Fault Status. */ 1455 cpu->env.v7m.dfsr &= ~value; /* W1C */ 1456 break; 1457 case 0xd34: /* Mem Manage Address. */ 1458 if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) { 1459 goto bad_offset; 1460 } 1461 cpu->env.v7m.mmfar[attrs.secure] = value; 1462 return; 1463 case 0xd38: /* Bus Fault Address. */ 1464 if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) { 1465 goto bad_offset; 1466 } 1467 cpu->env.v7m.bfar = value; 1468 return; 1469 case 0xd3c: /* Aux Fault Status. */ 1470 qemu_log_mask(LOG_UNIMP, 1471 "NVIC: Aux fault status registers unimplemented\n"); 1472 break; 1473 case 0xd84: /* CSSELR */ 1474 if (!arm_v7m_csselr_razwi(cpu)) { 1475 cpu->env.v7m.csselr[attrs.secure] = value & R_V7M_CSSELR_INDEX_MASK; 1476 } 1477 break; 1478 case 0xd90: /* MPU_TYPE */ 1479 return; /* RO */ 1480 case 0xd94: /* MPU_CTRL */ 1481 if ((value & 1482 (R_V7M_MPU_CTRL_HFNMIENA_MASK | R_V7M_MPU_CTRL_ENABLE_MASK)) 1483 == R_V7M_MPU_CTRL_HFNMIENA_MASK) { 1484 qemu_log_mask(LOG_GUEST_ERROR, "MPU_CTRL: HFNMIENA and !ENABLE is " 1485 "UNPREDICTABLE\n"); 1486 } 1487 cpu->env.v7m.mpu_ctrl[attrs.secure] 1488 = value & (R_V7M_MPU_CTRL_ENABLE_MASK | 1489 R_V7M_MPU_CTRL_HFNMIENA_MASK | 1490 R_V7M_MPU_CTRL_PRIVDEFENA_MASK); 1491 tlb_flush(CPU(cpu)); 1492 break; 1493 case 0xd98: /* MPU_RNR */ 1494 if (value >= cpu->pmsav7_dregion) { 1495 qemu_log_mask(LOG_GUEST_ERROR, "MPU region out of range %" 1496 PRIu32 "/%" PRIu32 "\n", 1497 value, cpu->pmsav7_dregion); 1498 } else { 1499 cpu->env.pmsav7.rnr[attrs.secure] = value; 1500 } 1501 break; 1502 case 0xd9c: /* MPU_RBAR */ 1503 case 0xda4: /* MPU_RBAR_A1 */ 1504 case 0xdac: /* MPU_RBAR_A2 */ 1505 case 0xdb4: /* MPU_RBAR_A3 */ 1506 { 1507 int region; 1508 1509 if (arm_feature(&cpu->env, ARM_FEATURE_V8)) { 1510 /* PMSAv8M handling of the aliases is different from v7M: 1511 * aliases A1, A2, A3 override the low two bits of the region 1512 * number in MPU_RNR, and there is no 'region' field in the 1513 * RBAR register. 1514 */ 1515 int aliasno = (offset - 0xd9c) / 8; /* 0..3 */ 1516 1517 region = cpu->env.pmsav7.rnr[attrs.secure]; 1518 if (aliasno) { 1519 region = deposit32(region, 0, 2, aliasno); 1520 } 1521 if (region >= cpu->pmsav7_dregion) { 1522 return; 1523 } 1524 cpu->env.pmsav8.rbar[attrs.secure][region] = value; 1525 tlb_flush(CPU(cpu)); 1526 return; 1527 } 1528 1529 if (value & (1 << 4)) { 1530 /* VALID bit means use the region number specified in this 1531 * value and also update MPU_RNR.REGION with that value. 1532 */ 1533 region = extract32(value, 0, 4); 1534 if (region >= cpu->pmsav7_dregion) { 1535 qemu_log_mask(LOG_GUEST_ERROR, 1536 "MPU region out of range %u/%" PRIu32 "\n", 1537 region, cpu->pmsav7_dregion); 1538 return; 1539 } 1540 cpu->env.pmsav7.rnr[attrs.secure] = region; 1541 } else { 1542 region = cpu->env.pmsav7.rnr[attrs.secure]; 1543 } 1544 1545 if (region >= cpu->pmsav7_dregion) { 1546 return; 1547 } 1548 1549 cpu->env.pmsav7.drbar[region] = value & ~0x1f; 1550 tlb_flush(CPU(cpu)); 1551 break; 1552 } 1553 case 0xda0: /* MPU_RASR (v7M), MPU_RLAR (v8M) */ 1554 case 0xda8: /* MPU_RASR_A1 (v7M), MPU_RLAR_A1 (v8M) */ 1555 case 0xdb0: /* MPU_RASR_A2 (v7M), MPU_RLAR_A2 (v8M) */ 1556 case 0xdb8: /* MPU_RASR_A3 (v7M), MPU_RLAR_A3 (v8M) */ 1557 { 1558 int region = cpu->env.pmsav7.rnr[attrs.secure]; 1559 1560 if (arm_feature(&cpu->env, ARM_FEATURE_V8)) { 1561 /* PMSAv8M handling of the aliases is different from v7M: 1562 * aliases A1, A2, A3 override the low two bits of the region 1563 * number in MPU_RNR. 1564 */ 1565 int aliasno = (offset - 0xd9c) / 8; /* 0..3 */ 1566 1567 region = cpu->env.pmsav7.rnr[attrs.secure]; 1568 if (aliasno) { 1569 region = deposit32(region, 0, 2, aliasno); 1570 } 1571 if (region >= cpu->pmsav7_dregion) { 1572 return; 1573 } 1574 cpu->env.pmsav8.rlar[attrs.secure][region] = value; 1575 tlb_flush(CPU(cpu)); 1576 return; 1577 } 1578 1579 if (region >= cpu->pmsav7_dregion) { 1580 return; 1581 } 1582 1583 cpu->env.pmsav7.drsr[region] = value & 0xff3f; 1584 cpu->env.pmsav7.dracr[region] = (value >> 16) & 0x173f; 1585 tlb_flush(CPU(cpu)); 1586 break; 1587 } 1588 case 0xdc0: /* MPU_MAIR0 */ 1589 if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) { 1590 goto bad_offset; 1591 } 1592 if (cpu->pmsav7_dregion) { 1593 /* Register is RES0 if no MPU regions are implemented */ 1594 cpu->env.pmsav8.mair0[attrs.secure] = value; 1595 } 1596 /* We don't need to do anything else because memory attributes 1597 * only affect cacheability, and we don't implement caching. 1598 */ 1599 break; 1600 case 0xdc4: /* MPU_MAIR1 */ 1601 if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) { 1602 goto bad_offset; 1603 } 1604 if (cpu->pmsav7_dregion) { 1605 /* Register is RES0 if no MPU regions are implemented */ 1606 cpu->env.pmsav8.mair1[attrs.secure] = value; 1607 } 1608 /* We don't need to do anything else because memory attributes 1609 * only affect cacheability, and we don't implement caching. 1610 */ 1611 break; 1612 case 0xdd0: /* SAU_CTRL */ 1613 if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) { 1614 goto bad_offset; 1615 } 1616 if (!attrs.secure) { 1617 return; 1618 } 1619 cpu->env.sau.ctrl = value & 3; 1620 break; 1621 case 0xdd4: /* SAU_TYPE */ 1622 if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) { 1623 goto bad_offset; 1624 } 1625 break; 1626 case 0xdd8: /* SAU_RNR */ 1627 if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) { 1628 goto bad_offset; 1629 } 1630 if (!attrs.secure) { 1631 return; 1632 } 1633 if (value >= cpu->sau_sregion) { 1634 qemu_log_mask(LOG_GUEST_ERROR, "SAU region out of range %" 1635 PRIu32 "/%" PRIu32 "\n", 1636 value, cpu->sau_sregion); 1637 } else { 1638 cpu->env.sau.rnr = value; 1639 } 1640 break; 1641 case 0xddc: /* SAU_RBAR */ 1642 { 1643 int region = cpu->env.sau.rnr; 1644 1645 if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) { 1646 goto bad_offset; 1647 } 1648 if (!attrs.secure) { 1649 return; 1650 } 1651 if (region >= cpu->sau_sregion) { 1652 return; 1653 } 1654 cpu->env.sau.rbar[region] = value & ~0x1f; 1655 tlb_flush(CPU(cpu)); 1656 break; 1657 } 1658 case 0xde0: /* SAU_RLAR */ 1659 { 1660 int region = cpu->env.sau.rnr; 1661 1662 if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) { 1663 goto bad_offset; 1664 } 1665 if (!attrs.secure) { 1666 return; 1667 } 1668 if (region >= cpu->sau_sregion) { 1669 return; 1670 } 1671 cpu->env.sau.rlar[region] = value & ~0x1c; 1672 tlb_flush(CPU(cpu)); 1673 break; 1674 } 1675 case 0xde4: /* SFSR */ 1676 if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) { 1677 goto bad_offset; 1678 } 1679 if (!attrs.secure) { 1680 return; 1681 } 1682 cpu->env.v7m.sfsr &= ~value; /* W1C */ 1683 break; 1684 case 0xde8: /* SFAR */ 1685 if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) { 1686 goto bad_offset; 1687 } 1688 if (!attrs.secure) { 1689 return; 1690 } 1691 cpu->env.v7m.sfsr = value; 1692 break; 1693 case 0xf00: /* Software Triggered Interrupt Register */ 1694 { 1695 int excnum = (value & 0x1ff) + NVIC_FIRST_IRQ; 1696 1697 if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) { 1698 goto bad_offset; 1699 } 1700 1701 if (excnum < s->num_irq) { 1702 armv7m_nvic_set_pending(s, excnum, false); 1703 } 1704 break; 1705 } 1706 case 0xf50: /* ICIALLU */ 1707 case 0xf58: /* ICIMVAU */ 1708 case 0xf5c: /* DCIMVAC */ 1709 case 0xf60: /* DCISW */ 1710 case 0xf64: /* DCCMVAU */ 1711 case 0xf68: /* DCCMVAC */ 1712 case 0xf6c: /* DCCSW */ 1713 case 0xf70: /* DCCIMVAC */ 1714 case 0xf74: /* DCCISW */ 1715 case 0xf78: /* BPIALL */ 1716 /* Cache and branch predictor maintenance: for QEMU these always NOP */ 1717 break; 1718 default: 1719 bad_offset: 1720 qemu_log_mask(LOG_GUEST_ERROR, 1721 "NVIC: Bad write offset 0x%x\n", offset); 1722 } 1723 } 1724 1725 static bool nvic_user_access_ok(NVICState *s, hwaddr offset, MemTxAttrs attrs) 1726 { 1727 /* Return true if unprivileged access to this register is permitted. */ 1728 switch (offset) { 1729 case 0xf00: /* STIR: accessible only if CCR.USERSETMPEND permits */ 1730 /* For access via STIR_NS it is the NS CCR.USERSETMPEND that 1731 * controls access even though the CPU is in Secure state (I_QDKX). 1732 */ 1733 return s->cpu->env.v7m.ccr[attrs.secure] & R_V7M_CCR_USERSETMPEND_MASK; 1734 default: 1735 /* All other user accesses cause a BusFault unconditionally */ 1736 return false; 1737 } 1738 } 1739 1740 static int shpr_bank(NVICState *s, int exc, MemTxAttrs attrs) 1741 { 1742 /* Behaviour for the SHPR register field for this exception: 1743 * return M_REG_NS to use the nonsecure vector (including for 1744 * non-banked exceptions), M_REG_S for the secure version of 1745 * a banked exception, and -1 if this field should RAZ/WI. 1746 */ 1747 switch (exc) { 1748 case ARMV7M_EXCP_MEM: 1749 case ARMV7M_EXCP_USAGE: 1750 case ARMV7M_EXCP_SVC: 1751 case ARMV7M_EXCP_PENDSV: 1752 case ARMV7M_EXCP_SYSTICK: 1753 /* Banked exceptions */ 1754 return attrs.secure; 1755 case ARMV7M_EXCP_BUS: 1756 /* Not banked, RAZ/WI from nonsecure if BFHFNMINS is zero */ 1757 if (!attrs.secure && 1758 !(s->cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK)) { 1759 return -1; 1760 } 1761 return M_REG_NS; 1762 case ARMV7M_EXCP_SECURE: 1763 /* Not banked, RAZ/WI from nonsecure */ 1764 if (!attrs.secure) { 1765 return -1; 1766 } 1767 return M_REG_NS; 1768 case ARMV7M_EXCP_DEBUG: 1769 /* Not banked. TODO should RAZ/WI if DEMCR.SDME is set */ 1770 return M_REG_NS; 1771 case 8 ... 10: 1772 case 13: 1773 /* RES0 */ 1774 return -1; 1775 default: 1776 /* Not reachable due to decode of SHPR register addresses */ 1777 g_assert_not_reached(); 1778 } 1779 } 1780 1781 static MemTxResult nvic_sysreg_read(void *opaque, hwaddr addr, 1782 uint64_t *data, unsigned size, 1783 MemTxAttrs attrs) 1784 { 1785 NVICState *s = (NVICState *)opaque; 1786 uint32_t offset = addr; 1787 unsigned i, startvec, end; 1788 uint32_t val; 1789 1790 if (attrs.user && !nvic_user_access_ok(s, addr, attrs)) { 1791 /* Generate BusFault for unprivileged accesses */ 1792 return MEMTX_ERROR; 1793 } 1794 1795 switch (offset) { 1796 /* reads of set and clear both return the status */ 1797 case 0x100 ... 0x13f: /* NVIC Set enable */ 1798 offset += 0x80; 1799 /* fall through */ 1800 case 0x180 ... 0x1bf: /* NVIC Clear enable */ 1801 val = 0; 1802 startvec = 8 * (offset - 0x180) + NVIC_FIRST_IRQ; /* vector # */ 1803 1804 for (i = 0, end = size * 8; i < end && startvec + i < s->num_irq; i++) { 1805 if (s->vectors[startvec + i].enabled && 1806 (attrs.secure || s->itns[startvec + i])) { 1807 val |= (1 << i); 1808 } 1809 } 1810 break; 1811 case 0x200 ... 0x23f: /* NVIC Set pend */ 1812 offset += 0x80; 1813 /* fall through */ 1814 case 0x280 ... 0x2bf: /* NVIC Clear pend */ 1815 val = 0; 1816 startvec = 8 * (offset - 0x280) + NVIC_FIRST_IRQ; /* vector # */ 1817 for (i = 0, end = size * 8; i < end && startvec + i < s->num_irq; i++) { 1818 if (s->vectors[startvec + i].pending && 1819 (attrs.secure || s->itns[startvec + i])) { 1820 val |= (1 << i); 1821 } 1822 } 1823 break; 1824 case 0x300 ... 0x33f: /* NVIC Active */ 1825 val = 0; 1826 1827 if (!arm_feature(&s->cpu->env, ARM_FEATURE_V7)) { 1828 break; 1829 } 1830 1831 startvec = 8 * (offset - 0x300) + NVIC_FIRST_IRQ; /* vector # */ 1832 1833 for (i = 0, end = size * 8; i < end && startvec + i < s->num_irq; i++) { 1834 if (s->vectors[startvec + i].active && 1835 (attrs.secure || s->itns[startvec + i])) { 1836 val |= (1 << i); 1837 } 1838 } 1839 break; 1840 case 0x400 ... 0x5ef: /* NVIC Priority */ 1841 val = 0; 1842 startvec = offset - 0x400 + NVIC_FIRST_IRQ; /* vector # */ 1843 1844 for (i = 0; i < size && startvec + i < s->num_irq; i++) { 1845 if (attrs.secure || s->itns[startvec + i]) { 1846 val |= s->vectors[startvec + i].prio << (8 * i); 1847 } 1848 } 1849 break; 1850 case 0xd18 ... 0xd1b: /* System Handler Priority (SHPR1) */ 1851 if (!arm_feature(&s->cpu->env, ARM_FEATURE_M_MAIN)) { 1852 val = 0; 1853 break; 1854 } 1855 /* fall through */ 1856 case 0xd1c ... 0xd23: /* System Handler Priority (SHPR2, SHPR3) */ 1857 val = 0; 1858 for (i = 0; i < size; i++) { 1859 unsigned hdlidx = (offset - 0xd14) + i; 1860 int sbank = shpr_bank(s, hdlidx, attrs); 1861 1862 if (sbank < 0) { 1863 continue; 1864 } 1865 val = deposit32(val, i * 8, 8, get_prio(s, hdlidx, sbank)); 1866 } 1867 break; 1868 case 0xd28 ... 0xd2b: /* Configurable Fault Status (CFSR) */ 1869 if (!arm_feature(&s->cpu->env, ARM_FEATURE_M_MAIN)) { 1870 val = 0; 1871 break; 1872 }; 1873 /* The BFSR bits [15:8] are shared between security states 1874 * and we store them in the NS copy 1875 */ 1876 val = s->cpu->env.v7m.cfsr[attrs.secure]; 1877 val |= s->cpu->env.v7m.cfsr[M_REG_NS] & R_V7M_CFSR_BFSR_MASK; 1878 val = extract32(val, (offset - 0xd28) * 8, size * 8); 1879 break; 1880 case 0xfe0 ... 0xfff: /* ID. */ 1881 if (offset & 3) { 1882 val = 0; 1883 } else { 1884 val = nvic_id[(offset - 0xfe0) >> 2]; 1885 } 1886 break; 1887 default: 1888 if (size == 4) { 1889 val = nvic_readl(s, offset, attrs); 1890 } else { 1891 qemu_log_mask(LOG_GUEST_ERROR, 1892 "NVIC: Bad read of size %d at offset 0x%x\n", 1893 size, offset); 1894 val = 0; 1895 } 1896 } 1897 1898 trace_nvic_sysreg_read(addr, val, size); 1899 *data = val; 1900 return MEMTX_OK; 1901 } 1902 1903 static MemTxResult nvic_sysreg_write(void *opaque, hwaddr addr, 1904 uint64_t value, unsigned size, 1905 MemTxAttrs attrs) 1906 { 1907 NVICState *s = (NVICState *)opaque; 1908 uint32_t offset = addr; 1909 unsigned i, startvec, end; 1910 unsigned setval = 0; 1911 1912 trace_nvic_sysreg_write(addr, value, size); 1913 1914 if (attrs.user && !nvic_user_access_ok(s, addr, attrs)) { 1915 /* Generate BusFault for unprivileged accesses */ 1916 return MEMTX_ERROR; 1917 } 1918 1919 switch (offset) { 1920 case 0x100 ... 0x13f: /* NVIC Set enable */ 1921 offset += 0x80; 1922 setval = 1; 1923 /* fall through */ 1924 case 0x180 ... 0x1bf: /* NVIC Clear enable */ 1925 startvec = 8 * (offset - 0x180) + NVIC_FIRST_IRQ; 1926 1927 for (i = 0, end = size * 8; i < end && startvec + i < s->num_irq; i++) { 1928 if (value & (1 << i) && 1929 (attrs.secure || s->itns[startvec + i])) { 1930 s->vectors[startvec + i].enabled = setval; 1931 } 1932 } 1933 nvic_irq_update(s); 1934 return MEMTX_OK; 1935 case 0x200 ... 0x23f: /* NVIC Set pend */ 1936 /* the special logic in armv7m_nvic_set_pending() 1937 * is not needed since IRQs are never escalated 1938 */ 1939 offset += 0x80; 1940 setval = 1; 1941 /* fall through */ 1942 case 0x280 ... 0x2bf: /* NVIC Clear pend */ 1943 startvec = 8 * (offset - 0x280) + NVIC_FIRST_IRQ; /* vector # */ 1944 1945 for (i = 0, end = size * 8; i < end && startvec + i < s->num_irq; i++) { 1946 if (value & (1 << i) && 1947 (attrs.secure || s->itns[startvec + i])) { 1948 s->vectors[startvec + i].pending = setval; 1949 } 1950 } 1951 nvic_irq_update(s); 1952 return MEMTX_OK; 1953 case 0x300 ... 0x33f: /* NVIC Active */ 1954 return MEMTX_OK; /* R/O */ 1955 case 0x400 ... 0x5ef: /* NVIC Priority */ 1956 startvec = (offset - 0x400) + NVIC_FIRST_IRQ; /* vector # */ 1957 1958 for (i = 0; i < size && startvec + i < s->num_irq; i++) { 1959 if (attrs.secure || s->itns[startvec + i]) { 1960 set_prio(s, startvec + i, false, (value >> (i * 8)) & 0xff); 1961 } 1962 } 1963 nvic_irq_update(s); 1964 return MEMTX_OK; 1965 case 0xd18 ... 0xd1b: /* System Handler Priority (SHPR1) */ 1966 if (!arm_feature(&s->cpu->env, ARM_FEATURE_M_MAIN)) { 1967 return MEMTX_OK; 1968 } 1969 /* fall through */ 1970 case 0xd1c ... 0xd23: /* System Handler Priority (SHPR2, SHPR3) */ 1971 for (i = 0; i < size; i++) { 1972 unsigned hdlidx = (offset - 0xd14) + i; 1973 int newprio = extract32(value, i * 8, 8); 1974 int sbank = shpr_bank(s, hdlidx, attrs); 1975 1976 if (sbank < 0) { 1977 continue; 1978 } 1979 set_prio(s, hdlidx, sbank, newprio); 1980 } 1981 nvic_irq_update(s); 1982 return MEMTX_OK; 1983 case 0xd28 ... 0xd2b: /* Configurable Fault Status (CFSR) */ 1984 if (!arm_feature(&s->cpu->env, ARM_FEATURE_M_MAIN)) { 1985 return MEMTX_OK; 1986 } 1987 /* All bits are W1C, so construct 32 bit value with 0s in 1988 * the parts not written by the access size 1989 */ 1990 value <<= ((offset - 0xd28) * 8); 1991 1992 s->cpu->env.v7m.cfsr[attrs.secure] &= ~value; 1993 if (attrs.secure) { 1994 /* The BFSR bits [15:8] are shared between security states 1995 * and we store them in the NS copy. 1996 */ 1997 s->cpu->env.v7m.cfsr[M_REG_NS] &= ~(value & R_V7M_CFSR_BFSR_MASK); 1998 } 1999 return MEMTX_OK; 2000 } 2001 if (size == 4) { 2002 nvic_writel(s, offset, value, attrs); 2003 return MEMTX_OK; 2004 } 2005 qemu_log_mask(LOG_GUEST_ERROR, 2006 "NVIC: Bad write of size %d at offset 0x%x\n", size, offset); 2007 /* This is UNPREDICTABLE; treat as RAZ/WI */ 2008 return MEMTX_OK; 2009 } 2010 2011 static const MemoryRegionOps nvic_sysreg_ops = { 2012 .read_with_attrs = nvic_sysreg_read, 2013 .write_with_attrs = nvic_sysreg_write, 2014 .endianness = DEVICE_NATIVE_ENDIAN, 2015 }; 2016 2017 static MemTxResult nvic_sysreg_ns_write(void *opaque, hwaddr addr, 2018 uint64_t value, unsigned size, 2019 MemTxAttrs attrs) 2020 { 2021 MemoryRegion *mr = opaque; 2022 2023 if (attrs.secure) { 2024 /* S accesses to the alias act like NS accesses to the real region */ 2025 attrs.secure = 0; 2026 return memory_region_dispatch_write(mr, addr, value, size, attrs); 2027 } else { 2028 /* NS attrs are RAZ/WI for privileged, and BusFault for user */ 2029 if (attrs.user) { 2030 return MEMTX_ERROR; 2031 } 2032 return MEMTX_OK; 2033 } 2034 } 2035 2036 static MemTxResult nvic_sysreg_ns_read(void *opaque, hwaddr addr, 2037 uint64_t *data, unsigned size, 2038 MemTxAttrs attrs) 2039 { 2040 MemoryRegion *mr = opaque; 2041 2042 if (attrs.secure) { 2043 /* S accesses to the alias act like NS accesses to the real region */ 2044 attrs.secure = 0; 2045 return memory_region_dispatch_read(mr, addr, data, size, attrs); 2046 } else { 2047 /* NS attrs are RAZ/WI for privileged, and BusFault for user */ 2048 if (attrs.user) { 2049 return MEMTX_ERROR; 2050 } 2051 *data = 0; 2052 return MEMTX_OK; 2053 } 2054 } 2055 2056 static const MemoryRegionOps nvic_sysreg_ns_ops = { 2057 .read_with_attrs = nvic_sysreg_ns_read, 2058 .write_with_attrs = nvic_sysreg_ns_write, 2059 .endianness = DEVICE_NATIVE_ENDIAN, 2060 }; 2061 2062 static MemTxResult nvic_systick_write(void *opaque, hwaddr addr, 2063 uint64_t value, unsigned size, 2064 MemTxAttrs attrs) 2065 { 2066 NVICState *s = opaque; 2067 MemoryRegion *mr; 2068 2069 /* Direct the access to the correct systick */ 2070 mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->systick[attrs.secure]), 0); 2071 return memory_region_dispatch_write(mr, addr, value, size, attrs); 2072 } 2073 2074 static MemTxResult nvic_systick_read(void *opaque, hwaddr addr, 2075 uint64_t *data, unsigned size, 2076 MemTxAttrs attrs) 2077 { 2078 NVICState *s = opaque; 2079 MemoryRegion *mr; 2080 2081 /* Direct the access to the correct systick */ 2082 mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->systick[attrs.secure]), 0); 2083 return memory_region_dispatch_read(mr, addr, data, size, attrs); 2084 } 2085 2086 static const MemoryRegionOps nvic_systick_ops = { 2087 .read_with_attrs = nvic_systick_read, 2088 .write_with_attrs = nvic_systick_write, 2089 .endianness = DEVICE_NATIVE_ENDIAN, 2090 }; 2091 2092 static int nvic_post_load(void *opaque, int version_id) 2093 { 2094 NVICState *s = opaque; 2095 unsigned i; 2096 int resetprio; 2097 2098 /* Check for out of range priority settings */ 2099 resetprio = arm_feature(&s->cpu->env, ARM_FEATURE_V8) ? -4 : -3; 2100 2101 if (s->vectors[ARMV7M_EXCP_RESET].prio != resetprio || 2102 s->vectors[ARMV7M_EXCP_NMI].prio != -2 || 2103 s->vectors[ARMV7M_EXCP_HARD].prio != -1) { 2104 return 1; 2105 } 2106 for (i = ARMV7M_EXCP_MEM; i < s->num_irq; i++) { 2107 if (s->vectors[i].prio & ~0xff) { 2108 return 1; 2109 } 2110 } 2111 2112 nvic_recompute_state(s); 2113 2114 return 0; 2115 } 2116 2117 static const VMStateDescription vmstate_VecInfo = { 2118 .name = "armv7m_nvic_info", 2119 .version_id = 1, 2120 .minimum_version_id = 1, 2121 .fields = (VMStateField[]) { 2122 VMSTATE_INT16(prio, VecInfo), 2123 VMSTATE_UINT8(enabled, VecInfo), 2124 VMSTATE_UINT8(pending, VecInfo), 2125 VMSTATE_UINT8(active, VecInfo), 2126 VMSTATE_UINT8(level, VecInfo), 2127 VMSTATE_END_OF_LIST() 2128 } 2129 }; 2130 2131 static bool nvic_security_needed(void *opaque) 2132 { 2133 NVICState *s = opaque; 2134 2135 return arm_feature(&s->cpu->env, ARM_FEATURE_M_SECURITY); 2136 } 2137 2138 static int nvic_security_post_load(void *opaque, int version_id) 2139 { 2140 NVICState *s = opaque; 2141 int i; 2142 2143 /* Check for out of range priority settings */ 2144 if (s->sec_vectors[ARMV7M_EXCP_HARD].prio != -1 2145 && s->sec_vectors[ARMV7M_EXCP_HARD].prio != -3) { 2146 /* We can't cross-check against AIRCR.BFHFNMINS as we don't know 2147 * if the CPU state has been migrated yet; a mismatch won't 2148 * cause the emulation to blow up, though. 2149 */ 2150 return 1; 2151 } 2152 for (i = ARMV7M_EXCP_MEM; i < ARRAY_SIZE(s->sec_vectors); i++) { 2153 if (s->sec_vectors[i].prio & ~0xff) { 2154 return 1; 2155 } 2156 } 2157 return 0; 2158 } 2159 2160 static const VMStateDescription vmstate_nvic_security = { 2161 .name = "armv7m_nvic/m-security", 2162 .version_id = 1, 2163 .minimum_version_id = 1, 2164 .needed = nvic_security_needed, 2165 .post_load = &nvic_security_post_load, 2166 .fields = (VMStateField[]) { 2167 VMSTATE_STRUCT_ARRAY(sec_vectors, NVICState, NVIC_INTERNAL_VECTORS, 1, 2168 vmstate_VecInfo, VecInfo), 2169 VMSTATE_UINT32(prigroup[M_REG_S], NVICState), 2170 VMSTATE_BOOL_ARRAY(itns, NVICState, NVIC_MAX_VECTORS), 2171 VMSTATE_END_OF_LIST() 2172 } 2173 }; 2174 2175 static const VMStateDescription vmstate_nvic = { 2176 .name = "armv7m_nvic", 2177 .version_id = 4, 2178 .minimum_version_id = 4, 2179 .post_load = &nvic_post_load, 2180 .fields = (VMStateField[]) { 2181 VMSTATE_STRUCT_ARRAY(vectors, NVICState, NVIC_MAX_VECTORS, 1, 2182 vmstate_VecInfo, VecInfo), 2183 VMSTATE_UINT32(prigroup[M_REG_NS], NVICState), 2184 VMSTATE_END_OF_LIST() 2185 }, 2186 .subsections = (const VMStateDescription*[]) { 2187 &vmstate_nvic_security, 2188 NULL 2189 } 2190 }; 2191 2192 static Property props_nvic[] = { 2193 /* Number of external IRQ lines (so excluding the 16 internal exceptions) */ 2194 DEFINE_PROP_UINT32("num-irq", NVICState, num_irq, 64), 2195 DEFINE_PROP_END_OF_LIST() 2196 }; 2197 2198 static void armv7m_nvic_reset(DeviceState *dev) 2199 { 2200 int resetprio; 2201 NVICState *s = NVIC(dev); 2202 2203 memset(s->vectors, 0, sizeof(s->vectors)); 2204 memset(s->sec_vectors, 0, sizeof(s->sec_vectors)); 2205 s->prigroup[M_REG_NS] = 0; 2206 s->prigroup[M_REG_S] = 0; 2207 2208 s->vectors[ARMV7M_EXCP_NMI].enabled = 1; 2209 /* MEM, BUS, and USAGE are enabled through 2210 * the System Handler Control register 2211 */ 2212 s->vectors[ARMV7M_EXCP_SVC].enabled = 1; 2213 s->vectors[ARMV7M_EXCP_DEBUG].enabled = 1; 2214 s->vectors[ARMV7M_EXCP_PENDSV].enabled = 1; 2215 s->vectors[ARMV7M_EXCP_SYSTICK].enabled = 1; 2216 2217 resetprio = arm_feature(&s->cpu->env, ARM_FEATURE_V8) ? -4 : -3; 2218 s->vectors[ARMV7M_EXCP_RESET].prio = resetprio; 2219 s->vectors[ARMV7M_EXCP_NMI].prio = -2; 2220 s->vectors[ARMV7M_EXCP_HARD].prio = -1; 2221 2222 if (arm_feature(&s->cpu->env, ARM_FEATURE_M_SECURITY)) { 2223 s->sec_vectors[ARMV7M_EXCP_HARD].enabled = 1; 2224 s->sec_vectors[ARMV7M_EXCP_SVC].enabled = 1; 2225 s->sec_vectors[ARMV7M_EXCP_PENDSV].enabled = 1; 2226 s->sec_vectors[ARMV7M_EXCP_SYSTICK].enabled = 1; 2227 2228 /* AIRCR.BFHFNMINS resets to 0 so Secure HF is priority -1 (R_CMTC) */ 2229 s->sec_vectors[ARMV7M_EXCP_HARD].prio = -1; 2230 /* If AIRCR.BFHFNMINS is 0 then NS HF is (effectively) disabled */ 2231 s->vectors[ARMV7M_EXCP_HARD].enabled = 0; 2232 } else { 2233 s->vectors[ARMV7M_EXCP_HARD].enabled = 1; 2234 } 2235 2236 /* Strictly speaking the reset handler should be enabled. 2237 * However, we don't simulate soft resets through the NVIC, 2238 * and the reset vector should never be pended. 2239 * So we leave it disabled to catch logic errors. 2240 */ 2241 2242 s->exception_prio = NVIC_NOEXC_PRIO; 2243 s->vectpending = 0; 2244 s->vectpending_is_s_banked = false; 2245 s->vectpending_prio = NVIC_NOEXC_PRIO; 2246 2247 if (arm_feature(&s->cpu->env, ARM_FEATURE_M_SECURITY)) { 2248 memset(s->itns, 0, sizeof(s->itns)); 2249 } else { 2250 /* This state is constant and not guest accessible in a non-security 2251 * NVIC; we set the bits to true to avoid having to do a feature 2252 * bit check in the NVIC enable/pend/etc register accessors. 2253 */ 2254 int i; 2255 2256 for (i = NVIC_FIRST_IRQ; i < ARRAY_SIZE(s->itns); i++) { 2257 s->itns[i] = true; 2258 } 2259 } 2260 } 2261 2262 static void nvic_systick_trigger(void *opaque, int n, int level) 2263 { 2264 NVICState *s = opaque; 2265 2266 if (level) { 2267 /* SysTick just asked us to pend its exception. 2268 * (This is different from an external interrupt line's 2269 * behaviour.) 2270 * n == 0 : NonSecure systick 2271 * n == 1 : Secure systick 2272 */ 2273 armv7m_nvic_set_pending(s, ARMV7M_EXCP_SYSTICK, n); 2274 } 2275 } 2276 2277 static void armv7m_nvic_realize(DeviceState *dev, Error **errp) 2278 { 2279 NVICState *s = NVIC(dev); 2280 Error *err = NULL; 2281 int regionlen; 2282 2283 /* The armv7m container object will have set our CPU pointer */ 2284 if (!s->cpu || !arm_feature(&s->cpu->env, ARM_FEATURE_M)) { 2285 error_setg(errp, "The NVIC can only be used with a Cortex-M CPU"); 2286 return; 2287 } 2288 2289 if (s->num_irq > NVIC_MAX_IRQ) { 2290 error_setg(errp, "num-irq %d exceeds NVIC maximum", s->num_irq); 2291 return; 2292 } 2293 2294 qdev_init_gpio_in(dev, set_irq_level, s->num_irq); 2295 2296 /* include space for internal exception vectors */ 2297 s->num_irq += NVIC_FIRST_IRQ; 2298 2299 s->num_prio_bits = arm_feature(&s->cpu->env, ARM_FEATURE_V7) ? 8 : 2; 2300 2301 object_property_set_bool(OBJECT(&s->systick[M_REG_NS]), true, 2302 "realized", &err); 2303 if (err != NULL) { 2304 error_propagate(errp, err); 2305 return; 2306 } 2307 sysbus_connect_irq(SYS_BUS_DEVICE(&s->systick[M_REG_NS]), 0, 2308 qdev_get_gpio_in_named(dev, "systick-trigger", 2309 M_REG_NS)); 2310 2311 if (arm_feature(&s->cpu->env, ARM_FEATURE_M_SECURITY)) { 2312 /* We couldn't init the secure systick device in instance_init 2313 * as we didn't know then if the CPU had the security extensions; 2314 * so we have to do it here. 2315 */ 2316 object_initialize(&s->systick[M_REG_S], sizeof(s->systick[M_REG_S]), 2317 TYPE_SYSTICK); 2318 qdev_set_parent_bus(DEVICE(&s->systick[M_REG_S]), sysbus_get_default()); 2319 2320 object_property_set_bool(OBJECT(&s->systick[M_REG_S]), true, 2321 "realized", &err); 2322 if (err != NULL) { 2323 error_propagate(errp, err); 2324 return; 2325 } 2326 sysbus_connect_irq(SYS_BUS_DEVICE(&s->systick[M_REG_S]), 0, 2327 qdev_get_gpio_in_named(dev, "systick-trigger", 2328 M_REG_S)); 2329 } 2330 2331 /* The NVIC and System Control Space (SCS) starts at 0xe000e000 2332 * and looks like this: 2333 * 0x004 - ICTR 2334 * 0x010 - 0xff - systick 2335 * 0x100..0x7ec - NVIC 2336 * 0x7f0..0xcff - Reserved 2337 * 0xd00..0xd3c - SCS registers 2338 * 0xd40..0xeff - Reserved or Not implemented 2339 * 0xf00 - STIR 2340 * 2341 * Some registers within this space are banked between security states. 2342 * In v8M there is a second range 0xe002e000..0xe002efff which is the 2343 * NonSecure alias SCS; secure accesses to this behave like NS accesses 2344 * to the main SCS range, and non-secure accesses (including when 2345 * the security extension is not implemented) are RAZ/WI. 2346 * Note that both the main SCS range and the alias range are defined 2347 * to be exempt from memory attribution (R_BLJT) and so the memory 2348 * transaction attribute always matches the current CPU security 2349 * state (attrs.secure == env->v7m.secure). In the nvic_sysreg_ns_ops 2350 * wrappers we change attrs.secure to indicate the NS access; so 2351 * generally code determining which banked register to use should 2352 * use attrs.secure; code determining actual behaviour of the system 2353 * should use env->v7m.secure. 2354 */ 2355 regionlen = arm_feature(&s->cpu->env, ARM_FEATURE_V8) ? 0x21000 : 0x1000; 2356 memory_region_init(&s->container, OBJECT(s), "nvic", regionlen); 2357 /* The system register region goes at the bottom of the priority 2358 * stack as it covers the whole page. 2359 */ 2360 memory_region_init_io(&s->sysregmem, OBJECT(s), &nvic_sysreg_ops, s, 2361 "nvic_sysregs", 0x1000); 2362 memory_region_add_subregion(&s->container, 0, &s->sysregmem); 2363 2364 memory_region_init_io(&s->systickmem, OBJECT(s), 2365 &nvic_systick_ops, s, 2366 "nvic_systick", 0xe0); 2367 2368 memory_region_add_subregion_overlap(&s->container, 0x10, 2369 &s->systickmem, 1); 2370 2371 if (arm_feature(&s->cpu->env, ARM_FEATURE_V8)) { 2372 memory_region_init_io(&s->sysreg_ns_mem, OBJECT(s), 2373 &nvic_sysreg_ns_ops, &s->sysregmem, 2374 "nvic_sysregs_ns", 0x1000); 2375 memory_region_add_subregion(&s->container, 0x20000, &s->sysreg_ns_mem); 2376 memory_region_init_io(&s->systick_ns_mem, OBJECT(s), 2377 &nvic_sysreg_ns_ops, &s->systickmem, 2378 "nvic_systick_ns", 0xe0); 2379 memory_region_add_subregion_overlap(&s->container, 0x20010, 2380 &s->systick_ns_mem, 1); 2381 } 2382 2383 sysbus_init_mmio(SYS_BUS_DEVICE(dev), &s->container); 2384 } 2385 2386 static void armv7m_nvic_instance_init(Object *obj) 2387 { 2388 /* We have a different default value for the num-irq property 2389 * than our superclass. This function runs after qdev init 2390 * has set the defaults from the Property array and before 2391 * any user-specified property setting, so just modify the 2392 * value in the GICState struct. 2393 */ 2394 DeviceState *dev = DEVICE(obj); 2395 NVICState *nvic = NVIC(obj); 2396 SysBusDevice *sbd = SYS_BUS_DEVICE(obj); 2397 2398 sysbus_init_child_obj(obj, "systick-reg-ns", &nvic->systick[M_REG_NS], 2399 sizeof(nvic->systick[M_REG_NS]), TYPE_SYSTICK); 2400 /* We can't initialize the secure systick here, as we don't know 2401 * yet if we need it. 2402 */ 2403 2404 sysbus_init_irq(sbd, &nvic->excpout); 2405 qdev_init_gpio_out_named(dev, &nvic->sysresetreq, "SYSRESETREQ", 1); 2406 qdev_init_gpio_in_named(dev, nvic_systick_trigger, "systick-trigger", 2407 M_REG_NUM_BANKS); 2408 qdev_init_gpio_in_named(dev, nvic_nmi_trigger, "NMI", 1); 2409 } 2410 2411 static void armv7m_nvic_class_init(ObjectClass *klass, void *data) 2412 { 2413 DeviceClass *dc = DEVICE_CLASS(klass); 2414 2415 dc->vmsd = &vmstate_nvic; 2416 dc->props = props_nvic; 2417 dc->reset = armv7m_nvic_reset; 2418 dc->realize = armv7m_nvic_realize; 2419 } 2420 2421 static const TypeInfo armv7m_nvic_info = { 2422 .name = TYPE_NVIC, 2423 .parent = TYPE_SYS_BUS_DEVICE, 2424 .instance_init = armv7m_nvic_instance_init, 2425 .instance_size = sizeof(NVICState), 2426 .class_init = armv7m_nvic_class_init, 2427 .class_size = sizeof(SysBusDeviceClass), 2428 }; 2429 2430 static void armv7m_nvic_register_types(void) 2431 { 2432 type_register_static(&armv7m_nvic_info); 2433 } 2434 2435 type_init(armv7m_nvic_register_types) 2436