1 /* 2 * ARM Nested Vectored Interrupt Controller 3 * 4 * Copyright (c) 2006-2007 CodeSourcery. 5 * Written by Paul Brook 6 * 7 * This code is licensed under the GPL. 8 * 9 * The ARMv7M System controller is fairly tightly tied in with the 10 * NVIC. Much of that is also implemented here. 11 */ 12 13 #include "qemu/osdep.h" 14 #include "qapi/error.h" 15 #include "qemu-common.h" 16 #include "cpu.h" 17 #include "hw/sysbus.h" 18 #include "qemu/timer.h" 19 #include "hw/arm/arm.h" 20 #include "hw/intc/armv7m_nvic.h" 21 #include "target/arm/cpu.h" 22 #include "exec/exec-all.h" 23 #include "qemu/log.h" 24 #include "trace.h" 25 26 /* IRQ number counting: 27 * 28 * the num-irq property counts the number of external IRQ lines 29 * 30 * NVICState::num_irq counts the total number of exceptions 31 * (external IRQs, the 15 internal exceptions including reset, 32 * and one for the unused exception number 0). 33 * 34 * NVIC_MAX_IRQ is the highest permitted number of external IRQ lines. 35 * 36 * NVIC_MAX_VECTORS is the highest permitted number of exceptions. 37 * 38 * Iterating through all exceptions should typically be done with 39 * for (i = 1; i < s->num_irq; i++) to avoid the unused slot 0. 40 * 41 * The external qemu_irq lines are the NVIC's external IRQ lines, 42 * so line 0 is exception 16. 43 * 44 * In the terminology of the architecture manual, "interrupts" are 45 * a subcategory of exception referring to the external interrupts 46 * (which are exception numbers NVIC_FIRST_IRQ and upward). 47 * For historical reasons QEMU tends to use "interrupt" and 48 * "exception" more or less interchangeably. 49 */ 50 #define NVIC_FIRST_IRQ 16 51 #define NVIC_MAX_IRQ (NVIC_MAX_VECTORS - NVIC_FIRST_IRQ) 52 53 /* Effective running priority of the CPU when no exception is active 54 * (higher than the highest possible priority value) 55 */ 56 #define NVIC_NOEXC_PRIO 0x100 57 58 static const uint8_t nvic_id[] = { 59 0x00, 0xb0, 0x1b, 0x00, 0x0d, 0xe0, 0x05, 0xb1 60 }; 61 62 static int nvic_pending_prio(NVICState *s) 63 { 64 /* return the priority of the current pending interrupt, 65 * or NVIC_NOEXC_PRIO if no interrupt is pending 66 */ 67 return s->vectpending ? s->vectors[s->vectpending].prio : NVIC_NOEXC_PRIO; 68 } 69 70 /* Return the value of the ISCR RETTOBASE bit: 71 * 1 if there is exactly one active exception 72 * 0 if there is more than one active exception 73 * UNKNOWN if there are no active exceptions (we choose 1, 74 * which matches the choice Cortex-M3 is documented as making). 75 * 76 * NB: some versions of the documentation talk about this 77 * counting "active exceptions other than the one shown by IPSR"; 78 * this is only different in the obscure corner case where guest 79 * code has manually deactivated an exception and is about 80 * to fail an exception-return integrity check. The definition 81 * above is the one from the v8M ARM ARM and is also in line 82 * with the behaviour documented for the Cortex-M3. 83 */ 84 static bool nvic_rettobase(NVICState *s) 85 { 86 int irq, nhand = 0; 87 88 for (irq = ARMV7M_EXCP_RESET; irq < s->num_irq; irq++) { 89 if (s->vectors[irq].active) { 90 nhand++; 91 if (nhand == 2) { 92 return 0; 93 } 94 } 95 } 96 97 return 1; 98 } 99 100 /* Return the value of the ISCR ISRPENDING bit: 101 * 1 if an external interrupt is pending 102 * 0 if no external interrupt is pending 103 */ 104 static bool nvic_isrpending(NVICState *s) 105 { 106 int irq; 107 108 /* We can shortcut if the highest priority pending interrupt 109 * happens to be external or if there is nothing pending. 110 */ 111 if (s->vectpending > NVIC_FIRST_IRQ) { 112 return true; 113 } 114 if (s->vectpending == 0) { 115 return false; 116 } 117 118 for (irq = NVIC_FIRST_IRQ; irq < s->num_irq; irq++) { 119 if (s->vectors[irq].pending) { 120 return true; 121 } 122 } 123 return false; 124 } 125 126 /* Return a mask word which clears the subpriority bits from 127 * a priority value for an M-profile exception, leaving only 128 * the group priority. 129 */ 130 static inline uint32_t nvic_gprio_mask(NVICState *s) 131 { 132 return ~0U << (s->prigroup + 1); 133 } 134 135 /* Recompute vectpending and exception_prio */ 136 static void nvic_recompute_state(NVICState *s) 137 { 138 int i; 139 int pend_prio = NVIC_NOEXC_PRIO; 140 int active_prio = NVIC_NOEXC_PRIO; 141 int pend_irq = 0; 142 143 for (i = 1; i < s->num_irq; i++) { 144 VecInfo *vec = &s->vectors[i]; 145 146 if (vec->enabled && vec->pending && vec->prio < pend_prio) { 147 pend_prio = vec->prio; 148 pend_irq = i; 149 } 150 if (vec->active && vec->prio < active_prio) { 151 active_prio = vec->prio; 152 } 153 } 154 155 s->vectpending = pend_irq; 156 s->exception_prio = active_prio & nvic_gprio_mask(s); 157 158 trace_nvic_recompute_state(s->vectpending, s->exception_prio); 159 } 160 161 /* Return the current execution priority of the CPU 162 * (equivalent to the pseudocode ExecutionPriority function). 163 * This is a value between -2 (NMI priority) and NVIC_NOEXC_PRIO. 164 */ 165 static inline int nvic_exec_prio(NVICState *s) 166 { 167 CPUARMState *env = &s->cpu->env; 168 int running; 169 170 if (env->v7m.faultmask[env->v7m.secure]) { 171 running = -1; 172 } else if (env->v7m.primask[env->v7m.secure]) { 173 running = 0; 174 } else if (env->v7m.basepri[env->v7m.secure] > 0) { 175 running = env->v7m.basepri[env->v7m.secure] & nvic_gprio_mask(s); 176 } else { 177 running = NVIC_NOEXC_PRIO; /* lower than any possible priority */ 178 } 179 /* consider priority of active handler */ 180 return MIN(running, s->exception_prio); 181 } 182 183 bool armv7m_nvic_can_take_pending_exception(void *opaque) 184 { 185 NVICState *s = opaque; 186 187 return nvic_exec_prio(s) > nvic_pending_prio(s); 188 } 189 190 int armv7m_nvic_raw_execution_priority(void *opaque) 191 { 192 NVICState *s = opaque; 193 194 return s->exception_prio; 195 } 196 197 /* caller must call nvic_irq_update() after this */ 198 static void set_prio(NVICState *s, unsigned irq, uint8_t prio) 199 { 200 assert(irq > ARMV7M_EXCP_NMI); /* only use for configurable prios */ 201 assert(irq < s->num_irq); 202 203 s->vectors[irq].prio = prio; 204 205 trace_nvic_set_prio(irq, prio); 206 } 207 208 /* Recompute state and assert irq line accordingly. 209 * Must be called after changes to: 210 * vec->active, vec->enabled, vec->pending or vec->prio for any vector 211 * prigroup 212 */ 213 static void nvic_irq_update(NVICState *s) 214 { 215 int lvl; 216 int pend_prio; 217 218 nvic_recompute_state(s); 219 pend_prio = nvic_pending_prio(s); 220 221 /* Raise NVIC output if this IRQ would be taken, except that we 222 * ignore the effects of the BASEPRI, FAULTMASK and PRIMASK (which 223 * will be checked for in arm_v7m_cpu_exec_interrupt()); changes 224 * to those CPU registers don't cause us to recalculate the NVIC 225 * pending info. 226 */ 227 lvl = (pend_prio < s->exception_prio); 228 trace_nvic_irq_update(s->vectpending, pend_prio, s->exception_prio, lvl); 229 qemu_set_irq(s->excpout, lvl); 230 } 231 232 static void armv7m_nvic_clear_pending(void *opaque, int irq) 233 { 234 NVICState *s = (NVICState *)opaque; 235 VecInfo *vec; 236 237 assert(irq > ARMV7M_EXCP_RESET && irq < s->num_irq); 238 239 vec = &s->vectors[irq]; 240 trace_nvic_clear_pending(irq, vec->enabled, vec->prio); 241 if (vec->pending) { 242 vec->pending = 0; 243 nvic_irq_update(s); 244 } 245 } 246 247 void armv7m_nvic_set_pending(void *opaque, int irq) 248 { 249 NVICState *s = (NVICState *)opaque; 250 VecInfo *vec; 251 252 assert(irq > ARMV7M_EXCP_RESET && irq < s->num_irq); 253 254 vec = &s->vectors[irq]; 255 trace_nvic_set_pending(irq, vec->enabled, vec->prio); 256 257 258 if (irq >= ARMV7M_EXCP_HARD && irq < ARMV7M_EXCP_PENDSV) { 259 /* If a synchronous exception is pending then it may be 260 * escalated to HardFault if: 261 * * it is equal or lower priority to current execution 262 * * it is disabled 263 * (ie we need to take it immediately but we can't do so). 264 * Asynchronous exceptions (and interrupts) simply remain pending. 265 * 266 * For QEMU, we don't have any imprecise (asynchronous) faults, 267 * so we can assume that PREFETCH_ABORT and DATA_ABORT are always 268 * synchronous. 269 * Debug exceptions are awkward because only Debug exceptions 270 * resulting from the BKPT instruction should be escalated, 271 * but we don't currently implement any Debug exceptions other 272 * than those that result from BKPT, so we treat all debug exceptions 273 * as needing escalation. 274 * 275 * This all means we can identify whether to escalate based only on 276 * the exception number and don't (yet) need the caller to explicitly 277 * tell us whether this exception is synchronous or not. 278 */ 279 int running = nvic_exec_prio(s); 280 bool escalate = false; 281 282 if (vec->prio >= running) { 283 trace_nvic_escalate_prio(irq, vec->prio, running); 284 escalate = true; 285 } else if (!vec->enabled) { 286 trace_nvic_escalate_disabled(irq); 287 escalate = true; 288 } 289 290 if (escalate) { 291 if (running < 0) { 292 /* We want to escalate to HardFault but we can't take a 293 * synchronous HardFault at this point either. This is a 294 * Lockup condition due to a guest bug. We don't model 295 * Lockup, so report via cpu_abort() instead. 296 */ 297 cpu_abort(&s->cpu->parent_obj, 298 "Lockup: can't escalate %d to HardFault " 299 "(current priority %d)\n", irq, running); 300 } 301 302 /* We can do the escalation, so we take HardFault instead */ 303 irq = ARMV7M_EXCP_HARD; 304 vec = &s->vectors[irq]; 305 s->cpu->env.v7m.hfsr |= R_V7M_HFSR_FORCED_MASK; 306 } 307 } 308 309 if (!vec->pending) { 310 vec->pending = 1; 311 nvic_irq_update(s); 312 } 313 } 314 315 /* Make pending IRQ active. */ 316 void armv7m_nvic_acknowledge_irq(void *opaque) 317 { 318 NVICState *s = (NVICState *)opaque; 319 CPUARMState *env = &s->cpu->env; 320 const int pending = s->vectpending; 321 const int running = nvic_exec_prio(s); 322 int pendgroupprio; 323 VecInfo *vec; 324 325 assert(pending > ARMV7M_EXCP_RESET && pending < s->num_irq); 326 327 vec = &s->vectors[pending]; 328 329 assert(vec->enabled); 330 assert(vec->pending); 331 332 pendgroupprio = vec->prio & nvic_gprio_mask(s); 333 assert(pendgroupprio < running); 334 335 trace_nvic_acknowledge_irq(pending, vec->prio); 336 337 vec->active = 1; 338 vec->pending = 0; 339 340 env->v7m.exception = s->vectpending; 341 342 nvic_irq_update(s); 343 } 344 345 int armv7m_nvic_complete_irq(void *opaque, int irq) 346 { 347 NVICState *s = (NVICState *)opaque; 348 VecInfo *vec; 349 int ret; 350 351 assert(irq > ARMV7M_EXCP_RESET && irq < s->num_irq); 352 353 vec = &s->vectors[irq]; 354 355 trace_nvic_complete_irq(irq); 356 357 if (!vec->active) { 358 /* Tell the caller this was an illegal exception return */ 359 return -1; 360 } 361 362 ret = nvic_rettobase(s); 363 364 vec->active = 0; 365 if (vec->level) { 366 /* Re-pend the exception if it's still held high; only 367 * happens for extenal IRQs 368 */ 369 assert(irq >= NVIC_FIRST_IRQ); 370 vec->pending = 1; 371 } 372 373 nvic_irq_update(s); 374 375 return ret; 376 } 377 378 /* callback when external interrupt line is changed */ 379 static void set_irq_level(void *opaque, int n, int level) 380 { 381 NVICState *s = opaque; 382 VecInfo *vec; 383 384 n += NVIC_FIRST_IRQ; 385 386 assert(n >= NVIC_FIRST_IRQ && n < s->num_irq); 387 388 trace_nvic_set_irq_level(n, level); 389 390 /* The pending status of an external interrupt is 391 * latched on rising edge and exception handler return. 392 * 393 * Pulsing the IRQ will always run the handler 394 * once, and the handler will re-run until the 395 * level is low when the handler completes. 396 */ 397 vec = &s->vectors[n]; 398 if (level != vec->level) { 399 vec->level = level; 400 if (level) { 401 armv7m_nvic_set_pending(s, n); 402 } 403 } 404 } 405 406 static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs) 407 { 408 ARMCPU *cpu = s->cpu; 409 uint32_t val; 410 411 switch (offset) { 412 case 4: /* Interrupt Control Type. */ 413 return ((s->num_irq - NVIC_FIRST_IRQ) / 32) - 1; 414 case 0xd00: /* CPUID Base. */ 415 return cpu->midr; 416 case 0xd04: /* Interrupt Control State. */ 417 /* VECTACTIVE */ 418 val = cpu->env.v7m.exception; 419 /* VECTPENDING */ 420 val |= (s->vectpending & 0xff) << 12; 421 /* ISRPENDING - set if any external IRQ is pending */ 422 if (nvic_isrpending(s)) { 423 val |= (1 << 22); 424 } 425 /* RETTOBASE - set if only one handler is active */ 426 if (nvic_rettobase(s)) { 427 val |= (1 << 11); 428 } 429 /* PENDSTSET */ 430 if (s->vectors[ARMV7M_EXCP_SYSTICK].pending) { 431 val |= (1 << 26); 432 } 433 /* PENDSVSET */ 434 if (s->vectors[ARMV7M_EXCP_PENDSV].pending) { 435 val |= (1 << 28); 436 } 437 /* NMIPENDSET */ 438 if (s->vectors[ARMV7M_EXCP_NMI].pending) { 439 val |= (1 << 31); 440 } 441 /* ISRPREEMPT not implemented */ 442 return val; 443 case 0xd08: /* Vector Table Offset. */ 444 return cpu->env.v7m.vecbase[attrs.secure]; 445 case 0xd0c: /* Application Interrupt/Reset Control. */ 446 return 0xfa050000 | (s->prigroup << 8); 447 case 0xd10: /* System Control. */ 448 /* TODO: Implement SLEEPONEXIT. */ 449 return 0; 450 case 0xd14: /* Configuration Control. */ 451 /* The BFHFNMIGN bit is the only non-banked bit; we 452 * keep it in the non-secure copy of the register. 453 */ 454 val = cpu->env.v7m.ccr[attrs.secure]; 455 val |= cpu->env.v7m.ccr[M_REG_NS] & R_V7M_CCR_BFHFNMIGN_MASK; 456 return val; 457 case 0xd24: /* System Handler Status. */ 458 val = 0; 459 if (s->vectors[ARMV7M_EXCP_MEM].active) { 460 val |= (1 << 0); 461 } 462 if (s->vectors[ARMV7M_EXCP_BUS].active) { 463 val |= (1 << 1); 464 } 465 if (s->vectors[ARMV7M_EXCP_USAGE].active) { 466 val |= (1 << 3); 467 } 468 if (s->vectors[ARMV7M_EXCP_SVC].active) { 469 val |= (1 << 7); 470 } 471 if (s->vectors[ARMV7M_EXCP_DEBUG].active) { 472 val |= (1 << 8); 473 } 474 if (s->vectors[ARMV7M_EXCP_PENDSV].active) { 475 val |= (1 << 10); 476 } 477 if (s->vectors[ARMV7M_EXCP_SYSTICK].active) { 478 val |= (1 << 11); 479 } 480 if (s->vectors[ARMV7M_EXCP_USAGE].pending) { 481 val |= (1 << 12); 482 } 483 if (s->vectors[ARMV7M_EXCP_MEM].pending) { 484 val |= (1 << 13); 485 } 486 if (s->vectors[ARMV7M_EXCP_BUS].pending) { 487 val |= (1 << 14); 488 } 489 if (s->vectors[ARMV7M_EXCP_SVC].pending) { 490 val |= (1 << 15); 491 } 492 if (s->vectors[ARMV7M_EXCP_MEM].enabled) { 493 val |= (1 << 16); 494 } 495 if (s->vectors[ARMV7M_EXCP_BUS].enabled) { 496 val |= (1 << 17); 497 } 498 if (s->vectors[ARMV7M_EXCP_USAGE].enabled) { 499 val |= (1 << 18); 500 } 501 return val; 502 case 0xd28: /* Configurable Fault Status. */ 503 return cpu->env.v7m.cfsr; 504 case 0xd2c: /* Hard Fault Status. */ 505 return cpu->env.v7m.hfsr; 506 case 0xd30: /* Debug Fault Status. */ 507 return cpu->env.v7m.dfsr; 508 case 0xd34: /* MMFAR MemManage Fault Address */ 509 return cpu->env.v7m.mmfar[attrs.secure]; 510 case 0xd38: /* Bus Fault Address. */ 511 return cpu->env.v7m.bfar; 512 case 0xd3c: /* Aux Fault Status. */ 513 /* TODO: Implement fault status registers. */ 514 qemu_log_mask(LOG_UNIMP, 515 "Aux Fault status registers unimplemented\n"); 516 return 0; 517 case 0xd40: /* PFR0. */ 518 return 0x00000030; 519 case 0xd44: /* PRF1. */ 520 return 0x00000200; 521 case 0xd48: /* DFR0. */ 522 return 0x00100000; 523 case 0xd4c: /* AFR0. */ 524 return 0x00000000; 525 case 0xd50: /* MMFR0. */ 526 return 0x00000030; 527 case 0xd54: /* MMFR1. */ 528 return 0x00000000; 529 case 0xd58: /* MMFR2. */ 530 return 0x00000000; 531 case 0xd5c: /* MMFR3. */ 532 return 0x00000000; 533 case 0xd60: /* ISAR0. */ 534 return 0x01141110; 535 case 0xd64: /* ISAR1. */ 536 return 0x02111000; 537 case 0xd68: /* ISAR2. */ 538 return 0x21112231; 539 case 0xd6c: /* ISAR3. */ 540 return 0x01111110; 541 case 0xd70: /* ISAR4. */ 542 return 0x01310102; 543 /* TODO: Implement debug registers. */ 544 case 0xd90: /* MPU_TYPE */ 545 /* Unified MPU; if the MPU is not present this value is zero */ 546 return cpu->pmsav7_dregion << 8; 547 break; 548 case 0xd94: /* MPU_CTRL */ 549 return cpu->env.v7m.mpu_ctrl[attrs.secure]; 550 case 0xd98: /* MPU_RNR */ 551 return cpu->env.pmsav7.rnr[attrs.secure]; 552 case 0xd9c: /* MPU_RBAR */ 553 case 0xda4: /* MPU_RBAR_A1 */ 554 case 0xdac: /* MPU_RBAR_A2 */ 555 case 0xdb4: /* MPU_RBAR_A3 */ 556 { 557 int region = cpu->env.pmsav7.rnr[attrs.secure]; 558 559 if (arm_feature(&cpu->env, ARM_FEATURE_V8)) { 560 /* PMSAv8M handling of the aliases is different from v7M: 561 * aliases A1, A2, A3 override the low two bits of the region 562 * number in MPU_RNR, and there is no 'region' field in the 563 * RBAR register. 564 */ 565 int aliasno = (offset - 0xd9c) / 8; /* 0..3 */ 566 if (aliasno) { 567 region = deposit32(region, 0, 2, aliasno); 568 } 569 if (region >= cpu->pmsav7_dregion) { 570 return 0; 571 } 572 return cpu->env.pmsav8.rbar[attrs.secure][region]; 573 } 574 575 if (region >= cpu->pmsav7_dregion) { 576 return 0; 577 } 578 return (cpu->env.pmsav7.drbar[region] & 0x1f) | (region & 0xf); 579 } 580 case 0xda0: /* MPU_RASR (v7M), MPU_RLAR (v8M) */ 581 case 0xda8: /* MPU_RASR_A1 (v7M), MPU_RLAR_A1 (v8M) */ 582 case 0xdb0: /* MPU_RASR_A2 (v7M), MPU_RLAR_A2 (v8M) */ 583 case 0xdb8: /* MPU_RASR_A3 (v7M), MPU_RLAR_A3 (v8M) */ 584 { 585 int region = cpu->env.pmsav7.rnr[attrs.secure]; 586 587 if (arm_feature(&cpu->env, ARM_FEATURE_V8)) { 588 /* PMSAv8M handling of the aliases is different from v7M: 589 * aliases A1, A2, A3 override the low two bits of the region 590 * number in MPU_RNR. 591 */ 592 int aliasno = (offset - 0xda0) / 8; /* 0..3 */ 593 if (aliasno) { 594 region = deposit32(region, 0, 2, aliasno); 595 } 596 if (region >= cpu->pmsav7_dregion) { 597 return 0; 598 } 599 return cpu->env.pmsav8.rlar[attrs.secure][region]; 600 } 601 602 if (region >= cpu->pmsav7_dregion) { 603 return 0; 604 } 605 return ((cpu->env.pmsav7.dracr[region] & 0xffff) << 16) | 606 (cpu->env.pmsav7.drsr[region] & 0xffff); 607 } 608 case 0xdc0: /* MPU_MAIR0 */ 609 if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) { 610 goto bad_offset; 611 } 612 return cpu->env.pmsav8.mair0[attrs.secure]; 613 case 0xdc4: /* MPU_MAIR1 */ 614 if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) { 615 goto bad_offset; 616 } 617 return cpu->env.pmsav8.mair1[attrs.secure]; 618 default: 619 bad_offset: 620 qemu_log_mask(LOG_GUEST_ERROR, "NVIC: Bad read offset 0x%x\n", offset); 621 return 0; 622 } 623 } 624 625 static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value, 626 MemTxAttrs attrs) 627 { 628 ARMCPU *cpu = s->cpu; 629 630 switch (offset) { 631 case 0xd04: /* Interrupt Control State. */ 632 if (value & (1 << 31)) { 633 armv7m_nvic_set_pending(s, ARMV7M_EXCP_NMI); 634 } 635 if (value & (1 << 28)) { 636 armv7m_nvic_set_pending(s, ARMV7M_EXCP_PENDSV); 637 } else if (value & (1 << 27)) { 638 armv7m_nvic_clear_pending(s, ARMV7M_EXCP_PENDSV); 639 } 640 if (value & (1 << 26)) { 641 armv7m_nvic_set_pending(s, ARMV7M_EXCP_SYSTICK); 642 } else if (value & (1 << 25)) { 643 armv7m_nvic_clear_pending(s, ARMV7M_EXCP_SYSTICK); 644 } 645 break; 646 case 0xd08: /* Vector Table Offset. */ 647 cpu->env.v7m.vecbase[attrs.secure] = value & 0xffffff80; 648 break; 649 case 0xd0c: /* Application Interrupt/Reset Control. */ 650 if ((value >> 16) == 0x05fa) { 651 if (value & 4) { 652 qemu_irq_pulse(s->sysresetreq); 653 } 654 if (value & 2) { 655 qemu_log_mask(LOG_GUEST_ERROR, 656 "Setting VECTCLRACTIVE when not in DEBUG mode " 657 "is UNPREDICTABLE\n"); 658 } 659 if (value & 1) { 660 qemu_log_mask(LOG_GUEST_ERROR, 661 "Setting VECTRESET when not in DEBUG mode " 662 "is UNPREDICTABLE\n"); 663 } 664 s->prigroup = extract32(value, 8, 3); 665 nvic_irq_update(s); 666 } 667 break; 668 case 0xd10: /* System Control. */ 669 /* TODO: Implement control registers. */ 670 qemu_log_mask(LOG_UNIMP, "NVIC: SCR unimplemented\n"); 671 break; 672 case 0xd14: /* Configuration Control. */ 673 /* Enforce RAZ/WI on reserved and must-RAZ/WI bits */ 674 value &= (R_V7M_CCR_STKALIGN_MASK | 675 R_V7M_CCR_BFHFNMIGN_MASK | 676 R_V7M_CCR_DIV_0_TRP_MASK | 677 R_V7M_CCR_UNALIGN_TRP_MASK | 678 R_V7M_CCR_USERSETMPEND_MASK | 679 R_V7M_CCR_NONBASETHRDENA_MASK); 680 681 if (arm_feature(&cpu->env, ARM_FEATURE_V8)) { 682 /* v8M makes NONBASETHRDENA and STKALIGN be RES1 */ 683 value |= R_V7M_CCR_NONBASETHRDENA_MASK 684 | R_V7M_CCR_STKALIGN_MASK; 685 } 686 if (attrs.secure) { 687 /* the BFHFNMIGN bit is not banked; keep that in the NS copy */ 688 cpu->env.v7m.ccr[M_REG_NS] = 689 (cpu->env.v7m.ccr[M_REG_NS] & ~R_V7M_CCR_BFHFNMIGN_MASK) 690 | (value & R_V7M_CCR_BFHFNMIGN_MASK); 691 value &= ~R_V7M_CCR_BFHFNMIGN_MASK; 692 } 693 694 cpu->env.v7m.ccr[attrs.secure] = value; 695 break; 696 case 0xd24: /* System Handler Control. */ 697 s->vectors[ARMV7M_EXCP_MEM].active = (value & (1 << 0)) != 0; 698 s->vectors[ARMV7M_EXCP_BUS].active = (value & (1 << 1)) != 0; 699 s->vectors[ARMV7M_EXCP_USAGE].active = (value & (1 << 3)) != 0; 700 s->vectors[ARMV7M_EXCP_SVC].active = (value & (1 << 7)) != 0; 701 s->vectors[ARMV7M_EXCP_DEBUG].active = (value & (1 << 8)) != 0; 702 s->vectors[ARMV7M_EXCP_PENDSV].active = (value & (1 << 10)) != 0; 703 s->vectors[ARMV7M_EXCP_SYSTICK].active = (value & (1 << 11)) != 0; 704 s->vectors[ARMV7M_EXCP_USAGE].pending = (value & (1 << 12)) != 0; 705 s->vectors[ARMV7M_EXCP_MEM].pending = (value & (1 << 13)) != 0; 706 s->vectors[ARMV7M_EXCP_BUS].pending = (value & (1 << 14)) != 0; 707 s->vectors[ARMV7M_EXCP_SVC].pending = (value & (1 << 15)) != 0; 708 s->vectors[ARMV7M_EXCP_MEM].enabled = (value & (1 << 16)) != 0; 709 s->vectors[ARMV7M_EXCP_BUS].enabled = (value & (1 << 17)) != 0; 710 s->vectors[ARMV7M_EXCP_USAGE].enabled = (value & (1 << 18)) != 0; 711 nvic_irq_update(s); 712 break; 713 case 0xd28: /* Configurable Fault Status. */ 714 cpu->env.v7m.cfsr &= ~value; /* W1C */ 715 break; 716 case 0xd2c: /* Hard Fault Status. */ 717 cpu->env.v7m.hfsr &= ~value; /* W1C */ 718 break; 719 case 0xd30: /* Debug Fault Status. */ 720 cpu->env.v7m.dfsr &= ~value; /* W1C */ 721 break; 722 case 0xd34: /* Mem Manage Address. */ 723 cpu->env.v7m.mmfar[attrs.secure] = value; 724 return; 725 case 0xd38: /* Bus Fault Address. */ 726 cpu->env.v7m.bfar = value; 727 return; 728 case 0xd3c: /* Aux Fault Status. */ 729 qemu_log_mask(LOG_UNIMP, 730 "NVIC: Aux fault status registers unimplemented\n"); 731 break; 732 case 0xd90: /* MPU_TYPE */ 733 return; /* RO */ 734 case 0xd94: /* MPU_CTRL */ 735 if ((value & 736 (R_V7M_MPU_CTRL_HFNMIENA_MASK | R_V7M_MPU_CTRL_ENABLE_MASK)) 737 == R_V7M_MPU_CTRL_HFNMIENA_MASK) { 738 qemu_log_mask(LOG_GUEST_ERROR, "MPU_CTRL: HFNMIENA and !ENABLE is " 739 "UNPREDICTABLE\n"); 740 } 741 cpu->env.v7m.mpu_ctrl[attrs.secure] 742 = value & (R_V7M_MPU_CTRL_ENABLE_MASK | 743 R_V7M_MPU_CTRL_HFNMIENA_MASK | 744 R_V7M_MPU_CTRL_PRIVDEFENA_MASK); 745 tlb_flush(CPU(cpu)); 746 break; 747 case 0xd98: /* MPU_RNR */ 748 if (value >= cpu->pmsav7_dregion) { 749 qemu_log_mask(LOG_GUEST_ERROR, "MPU region out of range %" 750 PRIu32 "/%" PRIu32 "\n", 751 value, cpu->pmsav7_dregion); 752 } else { 753 cpu->env.pmsav7.rnr[attrs.secure] = value; 754 } 755 break; 756 case 0xd9c: /* MPU_RBAR */ 757 case 0xda4: /* MPU_RBAR_A1 */ 758 case 0xdac: /* MPU_RBAR_A2 */ 759 case 0xdb4: /* MPU_RBAR_A3 */ 760 { 761 int region; 762 763 if (arm_feature(&cpu->env, ARM_FEATURE_V8)) { 764 /* PMSAv8M handling of the aliases is different from v7M: 765 * aliases A1, A2, A3 override the low two bits of the region 766 * number in MPU_RNR, and there is no 'region' field in the 767 * RBAR register. 768 */ 769 int aliasno = (offset - 0xd9c) / 8; /* 0..3 */ 770 771 region = cpu->env.pmsav7.rnr[attrs.secure]; 772 if (aliasno) { 773 region = deposit32(region, 0, 2, aliasno); 774 } 775 if (region >= cpu->pmsav7_dregion) { 776 return; 777 } 778 cpu->env.pmsav8.rbar[attrs.secure][region] = value; 779 tlb_flush(CPU(cpu)); 780 return; 781 } 782 783 if (value & (1 << 4)) { 784 /* VALID bit means use the region number specified in this 785 * value and also update MPU_RNR.REGION with that value. 786 */ 787 region = extract32(value, 0, 4); 788 if (region >= cpu->pmsav7_dregion) { 789 qemu_log_mask(LOG_GUEST_ERROR, 790 "MPU region out of range %u/%" PRIu32 "\n", 791 region, cpu->pmsav7_dregion); 792 return; 793 } 794 cpu->env.pmsav7.rnr[attrs.secure] = region; 795 } else { 796 region = cpu->env.pmsav7.rnr[attrs.secure]; 797 } 798 799 if (region >= cpu->pmsav7_dregion) { 800 return; 801 } 802 803 cpu->env.pmsav7.drbar[region] = value & ~0x1f; 804 tlb_flush(CPU(cpu)); 805 break; 806 } 807 case 0xda0: /* MPU_RASR (v7M), MPU_RLAR (v8M) */ 808 case 0xda8: /* MPU_RASR_A1 (v7M), MPU_RLAR_A1 (v8M) */ 809 case 0xdb0: /* MPU_RASR_A2 (v7M), MPU_RLAR_A2 (v8M) */ 810 case 0xdb8: /* MPU_RASR_A3 (v7M), MPU_RLAR_A3 (v8M) */ 811 { 812 int region = cpu->env.pmsav7.rnr[attrs.secure]; 813 814 if (arm_feature(&cpu->env, ARM_FEATURE_V8)) { 815 /* PMSAv8M handling of the aliases is different from v7M: 816 * aliases A1, A2, A3 override the low two bits of the region 817 * number in MPU_RNR. 818 */ 819 int aliasno = (offset - 0xd9c) / 8; /* 0..3 */ 820 821 region = cpu->env.pmsav7.rnr[attrs.secure]; 822 if (aliasno) { 823 region = deposit32(region, 0, 2, aliasno); 824 } 825 if (region >= cpu->pmsav7_dregion) { 826 return; 827 } 828 cpu->env.pmsav8.rlar[attrs.secure][region] = value; 829 tlb_flush(CPU(cpu)); 830 return; 831 } 832 833 if (region >= cpu->pmsav7_dregion) { 834 return; 835 } 836 837 cpu->env.pmsav7.drsr[region] = value & 0xff3f; 838 cpu->env.pmsav7.dracr[region] = (value >> 16) & 0x173f; 839 tlb_flush(CPU(cpu)); 840 break; 841 } 842 case 0xdc0: /* MPU_MAIR0 */ 843 if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) { 844 goto bad_offset; 845 } 846 if (cpu->pmsav7_dregion) { 847 /* Register is RES0 if no MPU regions are implemented */ 848 cpu->env.pmsav8.mair0[attrs.secure] = value; 849 } 850 /* We don't need to do anything else because memory attributes 851 * only affect cacheability, and we don't implement caching. 852 */ 853 break; 854 case 0xdc4: /* MPU_MAIR1 */ 855 if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) { 856 goto bad_offset; 857 } 858 if (cpu->pmsav7_dregion) { 859 /* Register is RES0 if no MPU regions are implemented */ 860 cpu->env.pmsav8.mair1[attrs.secure] = value; 861 } 862 /* We don't need to do anything else because memory attributes 863 * only affect cacheability, and we don't implement caching. 864 */ 865 break; 866 case 0xf00: /* Software Triggered Interrupt Register */ 867 { 868 int excnum = (value & 0x1ff) + NVIC_FIRST_IRQ; 869 if (excnum < s->num_irq) { 870 armv7m_nvic_set_pending(s, excnum); 871 } 872 break; 873 } 874 default: 875 bad_offset: 876 qemu_log_mask(LOG_GUEST_ERROR, 877 "NVIC: Bad write offset 0x%x\n", offset); 878 } 879 } 880 881 static bool nvic_user_access_ok(NVICState *s, hwaddr offset, MemTxAttrs attrs) 882 { 883 /* Return true if unprivileged access to this register is permitted. */ 884 switch (offset) { 885 case 0xf00: /* STIR: accessible only if CCR.USERSETMPEND permits */ 886 /* For access via STIR_NS it is the NS CCR.USERSETMPEND that 887 * controls access even though the CPU is in Secure state (I_QDKX). 888 */ 889 return s->cpu->env.v7m.ccr[attrs.secure] & R_V7M_CCR_USERSETMPEND_MASK; 890 default: 891 /* All other user accesses cause a BusFault unconditionally */ 892 return false; 893 } 894 } 895 896 static MemTxResult nvic_sysreg_read(void *opaque, hwaddr addr, 897 uint64_t *data, unsigned size, 898 MemTxAttrs attrs) 899 { 900 NVICState *s = (NVICState *)opaque; 901 uint32_t offset = addr; 902 unsigned i, startvec, end; 903 uint32_t val; 904 905 if (attrs.user && !nvic_user_access_ok(s, addr, attrs)) { 906 /* Generate BusFault for unprivileged accesses */ 907 return MEMTX_ERROR; 908 } 909 910 switch (offset) { 911 /* reads of set and clear both return the status */ 912 case 0x100 ... 0x13f: /* NVIC Set enable */ 913 offset += 0x80; 914 /* fall through */ 915 case 0x180 ... 0x1bf: /* NVIC Clear enable */ 916 val = 0; 917 startvec = offset - 0x180 + NVIC_FIRST_IRQ; /* vector # */ 918 919 for (i = 0, end = size * 8; i < end && startvec + i < s->num_irq; i++) { 920 if (s->vectors[startvec + i].enabled) { 921 val |= (1 << i); 922 } 923 } 924 break; 925 case 0x200 ... 0x23f: /* NVIC Set pend */ 926 offset += 0x80; 927 /* fall through */ 928 case 0x280 ... 0x2bf: /* NVIC Clear pend */ 929 val = 0; 930 startvec = offset - 0x280 + NVIC_FIRST_IRQ; /* vector # */ 931 for (i = 0, end = size * 8; i < end && startvec + i < s->num_irq; i++) { 932 if (s->vectors[startvec + i].pending) { 933 val |= (1 << i); 934 } 935 } 936 break; 937 case 0x300 ... 0x33f: /* NVIC Active */ 938 val = 0; 939 startvec = offset - 0x300 + NVIC_FIRST_IRQ; /* vector # */ 940 941 for (i = 0, end = size * 8; i < end && startvec + i < s->num_irq; i++) { 942 if (s->vectors[startvec + i].active) { 943 val |= (1 << i); 944 } 945 } 946 break; 947 case 0x400 ... 0x5ef: /* NVIC Priority */ 948 val = 0; 949 startvec = offset - 0x400 + NVIC_FIRST_IRQ; /* vector # */ 950 951 for (i = 0; i < size && startvec + i < s->num_irq; i++) { 952 val |= s->vectors[startvec + i].prio << (8 * i); 953 } 954 break; 955 case 0xd18 ... 0xd23: /* System Handler Priority. */ 956 val = 0; 957 for (i = 0; i < size; i++) { 958 val |= s->vectors[(offset - 0xd14) + i].prio << (i * 8); 959 } 960 break; 961 case 0xfe0 ... 0xfff: /* ID. */ 962 if (offset & 3) { 963 val = 0; 964 } else { 965 val = nvic_id[(offset - 0xfe0) >> 2]; 966 } 967 break; 968 default: 969 if (size == 4) { 970 val = nvic_readl(s, offset, attrs); 971 } else { 972 qemu_log_mask(LOG_GUEST_ERROR, 973 "NVIC: Bad read of size %d at offset 0x%x\n", 974 size, offset); 975 val = 0; 976 } 977 } 978 979 trace_nvic_sysreg_read(addr, val, size); 980 *data = val; 981 return MEMTX_OK; 982 } 983 984 static MemTxResult nvic_sysreg_write(void *opaque, hwaddr addr, 985 uint64_t value, unsigned size, 986 MemTxAttrs attrs) 987 { 988 NVICState *s = (NVICState *)opaque; 989 uint32_t offset = addr; 990 unsigned i, startvec, end; 991 unsigned setval = 0; 992 993 trace_nvic_sysreg_write(addr, value, size); 994 995 if (attrs.user && !nvic_user_access_ok(s, addr, attrs)) { 996 /* Generate BusFault for unprivileged accesses */ 997 return MEMTX_ERROR; 998 } 999 1000 switch (offset) { 1001 case 0x100 ... 0x13f: /* NVIC Set enable */ 1002 offset += 0x80; 1003 setval = 1; 1004 /* fall through */ 1005 case 0x180 ... 0x1bf: /* NVIC Clear enable */ 1006 startvec = 8 * (offset - 0x180) + NVIC_FIRST_IRQ; 1007 1008 for (i = 0, end = size * 8; i < end && startvec + i < s->num_irq; i++) { 1009 if (value & (1 << i)) { 1010 s->vectors[startvec + i].enabled = setval; 1011 } 1012 } 1013 nvic_irq_update(s); 1014 return MEMTX_OK; 1015 case 0x200 ... 0x23f: /* NVIC Set pend */ 1016 /* the special logic in armv7m_nvic_set_pending() 1017 * is not needed since IRQs are never escalated 1018 */ 1019 offset += 0x80; 1020 setval = 1; 1021 /* fall through */ 1022 case 0x280 ... 0x2bf: /* NVIC Clear pend */ 1023 startvec = 8 * (offset - 0x280) + NVIC_FIRST_IRQ; /* vector # */ 1024 1025 for (i = 0, end = size * 8; i < end && startvec + i < s->num_irq; i++) { 1026 if (value & (1 << i)) { 1027 s->vectors[startvec + i].pending = setval; 1028 } 1029 } 1030 nvic_irq_update(s); 1031 return MEMTX_OK; 1032 case 0x300 ... 0x33f: /* NVIC Active */ 1033 return MEMTX_OK; /* R/O */ 1034 case 0x400 ... 0x5ef: /* NVIC Priority */ 1035 startvec = 8 * (offset - 0x400) + NVIC_FIRST_IRQ; /* vector # */ 1036 1037 for (i = 0; i < size && startvec + i < s->num_irq; i++) { 1038 set_prio(s, startvec + i, (value >> (i * 8)) & 0xff); 1039 } 1040 nvic_irq_update(s); 1041 return MEMTX_OK; 1042 case 0xd18 ... 0xd23: /* System Handler Priority. */ 1043 for (i = 0; i < size; i++) { 1044 unsigned hdlidx = (offset - 0xd14) + i; 1045 set_prio(s, hdlidx, (value >> (i * 8)) & 0xff); 1046 } 1047 nvic_irq_update(s); 1048 return MEMTX_OK; 1049 } 1050 if (size == 4) { 1051 nvic_writel(s, offset, value, attrs); 1052 return MEMTX_OK; 1053 } 1054 qemu_log_mask(LOG_GUEST_ERROR, 1055 "NVIC: Bad write of size %d at offset 0x%x\n", size, offset); 1056 /* This is UNPREDICTABLE; treat as RAZ/WI */ 1057 return MEMTX_OK; 1058 } 1059 1060 static const MemoryRegionOps nvic_sysreg_ops = { 1061 .read_with_attrs = nvic_sysreg_read, 1062 .write_with_attrs = nvic_sysreg_write, 1063 .endianness = DEVICE_NATIVE_ENDIAN, 1064 }; 1065 1066 static MemTxResult nvic_sysreg_ns_write(void *opaque, hwaddr addr, 1067 uint64_t value, unsigned size, 1068 MemTxAttrs attrs) 1069 { 1070 if (attrs.secure) { 1071 /* S accesses to the alias act like NS accesses to the real region */ 1072 attrs.secure = 0; 1073 return nvic_sysreg_write(opaque, addr, value, size, attrs); 1074 } else { 1075 /* NS attrs are RAZ/WI for privileged, and BusFault for user */ 1076 if (attrs.user) { 1077 return MEMTX_ERROR; 1078 } 1079 return MEMTX_OK; 1080 } 1081 } 1082 1083 static MemTxResult nvic_sysreg_ns_read(void *opaque, hwaddr addr, 1084 uint64_t *data, unsigned size, 1085 MemTxAttrs attrs) 1086 { 1087 if (attrs.secure) { 1088 /* S accesses to the alias act like NS accesses to the real region */ 1089 attrs.secure = 0; 1090 return nvic_sysreg_read(opaque, addr, data, size, attrs); 1091 } else { 1092 /* NS attrs are RAZ/WI for privileged, and BusFault for user */ 1093 if (attrs.user) { 1094 return MEMTX_ERROR; 1095 } 1096 *data = 0; 1097 return MEMTX_OK; 1098 } 1099 } 1100 1101 static const MemoryRegionOps nvic_sysreg_ns_ops = { 1102 .read_with_attrs = nvic_sysreg_ns_read, 1103 .write_with_attrs = nvic_sysreg_ns_write, 1104 .endianness = DEVICE_NATIVE_ENDIAN, 1105 }; 1106 1107 static int nvic_post_load(void *opaque, int version_id) 1108 { 1109 NVICState *s = opaque; 1110 unsigned i; 1111 1112 /* Check for out of range priority settings */ 1113 if (s->vectors[ARMV7M_EXCP_RESET].prio != -3 || 1114 s->vectors[ARMV7M_EXCP_NMI].prio != -2 || 1115 s->vectors[ARMV7M_EXCP_HARD].prio != -1) { 1116 return 1; 1117 } 1118 for (i = ARMV7M_EXCP_MEM; i < s->num_irq; i++) { 1119 if (s->vectors[i].prio & ~0xff) { 1120 return 1; 1121 } 1122 } 1123 1124 nvic_recompute_state(s); 1125 1126 return 0; 1127 } 1128 1129 static const VMStateDescription vmstate_VecInfo = { 1130 .name = "armv7m_nvic_info", 1131 .version_id = 1, 1132 .minimum_version_id = 1, 1133 .fields = (VMStateField[]) { 1134 VMSTATE_INT16(prio, VecInfo), 1135 VMSTATE_UINT8(enabled, VecInfo), 1136 VMSTATE_UINT8(pending, VecInfo), 1137 VMSTATE_UINT8(active, VecInfo), 1138 VMSTATE_UINT8(level, VecInfo), 1139 VMSTATE_END_OF_LIST() 1140 } 1141 }; 1142 1143 static const VMStateDescription vmstate_nvic = { 1144 .name = "armv7m_nvic", 1145 .version_id = 4, 1146 .minimum_version_id = 4, 1147 .post_load = &nvic_post_load, 1148 .fields = (VMStateField[]) { 1149 VMSTATE_STRUCT_ARRAY(vectors, NVICState, NVIC_MAX_VECTORS, 1, 1150 vmstate_VecInfo, VecInfo), 1151 VMSTATE_UINT32(prigroup, NVICState), 1152 VMSTATE_END_OF_LIST() 1153 } 1154 }; 1155 1156 static Property props_nvic[] = { 1157 /* Number of external IRQ lines (so excluding the 16 internal exceptions) */ 1158 DEFINE_PROP_UINT32("num-irq", NVICState, num_irq, 64), 1159 DEFINE_PROP_END_OF_LIST() 1160 }; 1161 1162 static void armv7m_nvic_reset(DeviceState *dev) 1163 { 1164 NVICState *s = NVIC(dev); 1165 1166 s->vectors[ARMV7M_EXCP_NMI].enabled = 1; 1167 s->vectors[ARMV7M_EXCP_HARD].enabled = 1; 1168 /* MEM, BUS, and USAGE are enabled through 1169 * the System Handler Control register 1170 */ 1171 s->vectors[ARMV7M_EXCP_SVC].enabled = 1; 1172 s->vectors[ARMV7M_EXCP_DEBUG].enabled = 1; 1173 s->vectors[ARMV7M_EXCP_PENDSV].enabled = 1; 1174 s->vectors[ARMV7M_EXCP_SYSTICK].enabled = 1; 1175 1176 s->vectors[ARMV7M_EXCP_RESET].prio = -3; 1177 s->vectors[ARMV7M_EXCP_NMI].prio = -2; 1178 s->vectors[ARMV7M_EXCP_HARD].prio = -1; 1179 1180 /* Strictly speaking the reset handler should be enabled. 1181 * However, we don't simulate soft resets through the NVIC, 1182 * and the reset vector should never be pended. 1183 * So we leave it disabled to catch logic errors. 1184 */ 1185 1186 s->exception_prio = NVIC_NOEXC_PRIO; 1187 s->vectpending = 0; 1188 } 1189 1190 static void nvic_systick_trigger(void *opaque, int n, int level) 1191 { 1192 NVICState *s = opaque; 1193 1194 if (level) { 1195 /* SysTick just asked us to pend its exception. 1196 * (This is different from an external interrupt line's 1197 * behaviour.) 1198 */ 1199 armv7m_nvic_set_pending(s, ARMV7M_EXCP_SYSTICK); 1200 } 1201 } 1202 1203 static void armv7m_nvic_realize(DeviceState *dev, Error **errp) 1204 { 1205 NVICState *s = NVIC(dev); 1206 SysBusDevice *systick_sbd; 1207 Error *err = NULL; 1208 int regionlen; 1209 1210 s->cpu = ARM_CPU(qemu_get_cpu(0)); 1211 assert(s->cpu); 1212 1213 if (s->num_irq > NVIC_MAX_IRQ) { 1214 error_setg(errp, "num-irq %d exceeds NVIC maximum", s->num_irq); 1215 return; 1216 } 1217 1218 qdev_init_gpio_in(dev, set_irq_level, s->num_irq); 1219 1220 /* include space for internal exception vectors */ 1221 s->num_irq += NVIC_FIRST_IRQ; 1222 1223 object_property_set_bool(OBJECT(&s->systick), true, "realized", &err); 1224 if (err != NULL) { 1225 error_propagate(errp, err); 1226 return; 1227 } 1228 systick_sbd = SYS_BUS_DEVICE(&s->systick); 1229 sysbus_connect_irq(systick_sbd, 0, 1230 qdev_get_gpio_in_named(dev, "systick-trigger", 0)); 1231 1232 /* The NVIC and System Control Space (SCS) starts at 0xe000e000 1233 * and looks like this: 1234 * 0x004 - ICTR 1235 * 0x010 - 0xff - systick 1236 * 0x100..0x7ec - NVIC 1237 * 0x7f0..0xcff - Reserved 1238 * 0xd00..0xd3c - SCS registers 1239 * 0xd40..0xeff - Reserved or Not implemented 1240 * 0xf00 - STIR 1241 * 1242 * Some registers within this space are banked between security states. 1243 * In v8M there is a second range 0xe002e000..0xe002efff which is the 1244 * NonSecure alias SCS; secure accesses to this behave like NS accesses 1245 * to the main SCS range, and non-secure accesses (including when 1246 * the security extension is not implemented) are RAZ/WI. 1247 * Note that both the main SCS range and the alias range are defined 1248 * to be exempt from memory attribution (R_BLJT) and so the memory 1249 * transaction attribute always matches the current CPU security 1250 * state (attrs.secure == env->v7m.secure). In the nvic_sysreg_ns_ops 1251 * wrappers we change attrs.secure to indicate the NS access; so 1252 * generally code determining which banked register to use should 1253 * use attrs.secure; code determining actual behaviour of the system 1254 * should use env->v7m.secure. 1255 */ 1256 regionlen = arm_feature(&s->cpu->env, ARM_FEATURE_V8) ? 0x21000 : 0x1000; 1257 memory_region_init(&s->container, OBJECT(s), "nvic", regionlen); 1258 /* The system register region goes at the bottom of the priority 1259 * stack as it covers the whole page. 1260 */ 1261 memory_region_init_io(&s->sysregmem, OBJECT(s), &nvic_sysreg_ops, s, 1262 "nvic_sysregs", 0x1000); 1263 memory_region_add_subregion(&s->container, 0, &s->sysregmem); 1264 memory_region_add_subregion_overlap(&s->container, 0x10, 1265 sysbus_mmio_get_region(systick_sbd, 0), 1266 1); 1267 1268 if (arm_feature(&s->cpu->env, ARM_FEATURE_V8)) { 1269 memory_region_init_io(&s->sysreg_ns_mem, OBJECT(s), 1270 &nvic_sysreg_ns_ops, s, 1271 "nvic_sysregs_ns", 0x1000); 1272 memory_region_add_subregion(&s->container, 0x20000, &s->sysreg_ns_mem); 1273 } 1274 1275 sysbus_init_mmio(SYS_BUS_DEVICE(dev), &s->container); 1276 } 1277 1278 static void armv7m_nvic_instance_init(Object *obj) 1279 { 1280 /* We have a different default value for the num-irq property 1281 * than our superclass. This function runs after qdev init 1282 * has set the defaults from the Property array and before 1283 * any user-specified property setting, so just modify the 1284 * value in the GICState struct. 1285 */ 1286 DeviceState *dev = DEVICE(obj); 1287 NVICState *nvic = NVIC(obj); 1288 SysBusDevice *sbd = SYS_BUS_DEVICE(obj); 1289 1290 object_initialize(&nvic->systick, sizeof(nvic->systick), TYPE_SYSTICK); 1291 qdev_set_parent_bus(DEVICE(&nvic->systick), sysbus_get_default()); 1292 1293 sysbus_init_irq(sbd, &nvic->excpout); 1294 qdev_init_gpio_out_named(dev, &nvic->sysresetreq, "SYSRESETREQ", 1); 1295 qdev_init_gpio_in_named(dev, nvic_systick_trigger, "systick-trigger", 1); 1296 } 1297 1298 static void armv7m_nvic_class_init(ObjectClass *klass, void *data) 1299 { 1300 DeviceClass *dc = DEVICE_CLASS(klass); 1301 1302 dc->vmsd = &vmstate_nvic; 1303 dc->props = props_nvic; 1304 dc->reset = armv7m_nvic_reset; 1305 dc->realize = armv7m_nvic_realize; 1306 } 1307 1308 static const TypeInfo armv7m_nvic_info = { 1309 .name = TYPE_NVIC, 1310 .parent = TYPE_SYS_BUS_DEVICE, 1311 .instance_init = armv7m_nvic_instance_init, 1312 .instance_size = sizeof(NVICState), 1313 .class_init = armv7m_nvic_class_init, 1314 .class_size = sizeof(SysBusDeviceClass), 1315 }; 1316 1317 static void armv7m_nvic_register_types(void) 1318 { 1319 type_register_static(&armv7m_nvic_info); 1320 } 1321 1322 type_init(armv7m_nvic_register_types) 1323