xref: /openbmc/qemu/hw/intc/armv7m_nvic.c (revision c51a5cfc9fae82099028eb12cb1d064ee07f348e)
1 /*
2  * ARM Nested Vectored Interrupt Controller
3  *
4  * Copyright (c) 2006-2007 CodeSourcery.
5  * Written by Paul Brook
6  *
7  * This code is licensed under the GPL.
8  *
9  * The ARMv7M System controller is fairly tightly tied in with the
10  * NVIC.  Much of that is also implemented here.
11  */
12 
13 #include "qemu/osdep.h"
14 #include "qapi/error.h"
15 #include "qemu-common.h"
16 #include "cpu.h"
17 #include "hw/sysbus.h"
18 #include "qemu/timer.h"
19 #include "hw/arm/arm.h"
20 #include "hw/intc/armv7m_nvic.h"
21 #include "target/arm/cpu.h"
22 #include "exec/exec-all.h"
23 #include "qemu/log.h"
24 #include "trace.h"
25 
26 /* IRQ number counting:
27  *
28  * the num-irq property counts the number of external IRQ lines
29  *
30  * NVICState::num_irq counts the total number of exceptions
31  * (external IRQs, the 15 internal exceptions including reset,
32  * and one for the unused exception number 0).
33  *
34  * NVIC_MAX_IRQ is the highest permitted number of external IRQ lines.
35  *
36  * NVIC_MAX_VECTORS is the highest permitted number of exceptions.
37  *
38  * Iterating through all exceptions should typically be done with
39  * for (i = 1; i < s->num_irq; i++) to avoid the unused slot 0.
40  *
41  * The external qemu_irq lines are the NVIC's external IRQ lines,
42  * so line 0 is exception 16.
43  *
44  * In the terminology of the architecture manual, "interrupts" are
45  * a subcategory of exception referring to the external interrupts
46  * (which are exception numbers NVIC_FIRST_IRQ and upward).
47  * For historical reasons QEMU tends to use "interrupt" and
48  * "exception" more or less interchangeably.
49  */
50 #define NVIC_FIRST_IRQ 16
51 #define NVIC_MAX_IRQ (NVIC_MAX_VECTORS - NVIC_FIRST_IRQ)
52 
53 /* Effective running priority of the CPU when no exception is active
54  * (higher than the highest possible priority value)
55  */
56 #define NVIC_NOEXC_PRIO 0x100
57 
58 static const uint8_t nvic_id[] = {
59     0x00, 0xb0, 0x1b, 0x00, 0x0d, 0xe0, 0x05, 0xb1
60 };
61 
62 static int nvic_pending_prio(NVICState *s)
63 {
64     /* return the priority of the current pending interrupt,
65      * or NVIC_NOEXC_PRIO if no interrupt is pending
66      */
67     return s->vectpending ? s->vectors[s->vectpending].prio : NVIC_NOEXC_PRIO;
68 }
69 
70 /* Return the value of the ISCR RETTOBASE bit:
71  * 1 if there is exactly one active exception
72  * 0 if there is more than one active exception
73  * UNKNOWN if there are no active exceptions (we choose 1,
74  * which matches the choice Cortex-M3 is documented as making).
75  *
76  * NB: some versions of the documentation talk about this
77  * counting "active exceptions other than the one shown by IPSR";
78  * this is only different in the obscure corner case where guest
79  * code has manually deactivated an exception and is about
80  * to fail an exception-return integrity check. The definition
81  * above is the one from the v8M ARM ARM and is also in line
82  * with the behaviour documented for the Cortex-M3.
83  */
84 static bool nvic_rettobase(NVICState *s)
85 {
86     int irq, nhand = 0;
87 
88     for (irq = ARMV7M_EXCP_RESET; irq < s->num_irq; irq++) {
89         if (s->vectors[irq].active) {
90             nhand++;
91             if (nhand == 2) {
92                 return 0;
93             }
94         }
95     }
96 
97     return 1;
98 }
99 
100 /* Return the value of the ISCR ISRPENDING bit:
101  * 1 if an external interrupt is pending
102  * 0 if no external interrupt is pending
103  */
104 static bool nvic_isrpending(NVICState *s)
105 {
106     int irq;
107 
108     /* We can shortcut if the highest priority pending interrupt
109      * happens to be external or if there is nothing pending.
110      */
111     if (s->vectpending > NVIC_FIRST_IRQ) {
112         return true;
113     }
114     if (s->vectpending == 0) {
115         return false;
116     }
117 
118     for (irq = NVIC_FIRST_IRQ; irq < s->num_irq; irq++) {
119         if (s->vectors[irq].pending) {
120             return true;
121         }
122     }
123     return false;
124 }
125 
126 /* Return a mask word which clears the subpriority bits from
127  * a priority value for an M-profile exception, leaving only
128  * the group priority.
129  */
130 static inline uint32_t nvic_gprio_mask(NVICState *s)
131 {
132     return ~0U << (s->prigroup + 1);
133 }
134 
135 /* Recompute vectpending and exception_prio */
136 static void nvic_recompute_state(NVICState *s)
137 {
138     int i;
139     int pend_prio = NVIC_NOEXC_PRIO;
140     int active_prio = NVIC_NOEXC_PRIO;
141     int pend_irq = 0;
142 
143     for (i = 1; i < s->num_irq; i++) {
144         VecInfo *vec = &s->vectors[i];
145 
146         if (vec->enabled && vec->pending && vec->prio < pend_prio) {
147             pend_prio = vec->prio;
148             pend_irq = i;
149         }
150         if (vec->active && vec->prio < active_prio) {
151             active_prio = vec->prio;
152         }
153     }
154 
155     s->vectpending = pend_irq;
156     s->exception_prio = active_prio & nvic_gprio_mask(s);
157 
158     trace_nvic_recompute_state(s->vectpending, s->exception_prio);
159 }
160 
161 /* Return the current execution priority of the CPU
162  * (equivalent to the pseudocode ExecutionPriority function).
163  * This is a value between -2 (NMI priority) and NVIC_NOEXC_PRIO.
164  */
165 static inline int nvic_exec_prio(NVICState *s)
166 {
167     CPUARMState *env = &s->cpu->env;
168     int running;
169 
170     if (env->v7m.faultmask[env->v7m.secure]) {
171         running = -1;
172     } else if (env->v7m.primask[env->v7m.secure]) {
173         running = 0;
174     } else if (env->v7m.basepri[env->v7m.secure] > 0) {
175         running = env->v7m.basepri[env->v7m.secure] & nvic_gprio_mask(s);
176     } else {
177         running = NVIC_NOEXC_PRIO; /* lower than any possible priority */
178     }
179     /* consider priority of active handler */
180     return MIN(running, s->exception_prio);
181 }
182 
183 bool armv7m_nvic_can_take_pending_exception(void *opaque)
184 {
185     NVICState *s = opaque;
186 
187     return nvic_exec_prio(s) > nvic_pending_prio(s);
188 }
189 
190 int armv7m_nvic_raw_execution_priority(void *opaque)
191 {
192     NVICState *s = opaque;
193 
194     return s->exception_prio;
195 }
196 
197 /* caller must call nvic_irq_update() after this */
198 static void set_prio(NVICState *s, unsigned irq, uint8_t prio)
199 {
200     assert(irq > ARMV7M_EXCP_NMI); /* only use for configurable prios */
201     assert(irq < s->num_irq);
202 
203     s->vectors[irq].prio = prio;
204 
205     trace_nvic_set_prio(irq, prio);
206 }
207 
208 /* Recompute state and assert irq line accordingly.
209  * Must be called after changes to:
210  *  vec->active, vec->enabled, vec->pending or vec->prio for any vector
211  *  prigroup
212  */
213 static void nvic_irq_update(NVICState *s)
214 {
215     int lvl;
216     int pend_prio;
217 
218     nvic_recompute_state(s);
219     pend_prio = nvic_pending_prio(s);
220 
221     /* Raise NVIC output if this IRQ would be taken, except that we
222      * ignore the effects of the BASEPRI, FAULTMASK and PRIMASK (which
223      * will be checked for in arm_v7m_cpu_exec_interrupt()); changes
224      * to those CPU registers don't cause us to recalculate the NVIC
225      * pending info.
226      */
227     lvl = (pend_prio < s->exception_prio);
228     trace_nvic_irq_update(s->vectpending, pend_prio, s->exception_prio, lvl);
229     qemu_set_irq(s->excpout, lvl);
230 }
231 
232 static void armv7m_nvic_clear_pending(void *opaque, int irq)
233 {
234     NVICState *s = (NVICState *)opaque;
235     VecInfo *vec;
236 
237     assert(irq > ARMV7M_EXCP_RESET && irq < s->num_irq);
238 
239     vec = &s->vectors[irq];
240     trace_nvic_clear_pending(irq, vec->enabled, vec->prio);
241     if (vec->pending) {
242         vec->pending = 0;
243         nvic_irq_update(s);
244     }
245 }
246 
247 void armv7m_nvic_set_pending(void *opaque, int irq)
248 {
249     NVICState *s = (NVICState *)opaque;
250     VecInfo *vec;
251 
252     assert(irq > ARMV7M_EXCP_RESET && irq < s->num_irq);
253 
254     vec = &s->vectors[irq];
255     trace_nvic_set_pending(irq, vec->enabled, vec->prio);
256 
257 
258     if (irq >= ARMV7M_EXCP_HARD && irq < ARMV7M_EXCP_PENDSV) {
259         /* If a synchronous exception is pending then it may be
260          * escalated to HardFault if:
261          *  * it is equal or lower priority to current execution
262          *  * it is disabled
263          * (ie we need to take it immediately but we can't do so).
264          * Asynchronous exceptions (and interrupts) simply remain pending.
265          *
266          * For QEMU, we don't have any imprecise (asynchronous) faults,
267          * so we can assume that PREFETCH_ABORT and DATA_ABORT are always
268          * synchronous.
269          * Debug exceptions are awkward because only Debug exceptions
270          * resulting from the BKPT instruction should be escalated,
271          * but we don't currently implement any Debug exceptions other
272          * than those that result from BKPT, so we treat all debug exceptions
273          * as needing escalation.
274          *
275          * This all means we can identify whether to escalate based only on
276          * the exception number and don't (yet) need the caller to explicitly
277          * tell us whether this exception is synchronous or not.
278          */
279         int running = nvic_exec_prio(s);
280         bool escalate = false;
281 
282         if (vec->prio >= running) {
283             trace_nvic_escalate_prio(irq, vec->prio, running);
284             escalate = true;
285         } else if (!vec->enabled) {
286             trace_nvic_escalate_disabled(irq);
287             escalate = true;
288         }
289 
290         if (escalate) {
291             if (running < 0) {
292                 /* We want to escalate to HardFault but we can't take a
293                  * synchronous HardFault at this point either. This is a
294                  * Lockup condition due to a guest bug. We don't model
295                  * Lockup, so report via cpu_abort() instead.
296                  */
297                 cpu_abort(&s->cpu->parent_obj,
298                           "Lockup: can't escalate %d to HardFault "
299                           "(current priority %d)\n", irq, running);
300             }
301 
302             /* We can do the escalation, so we take HardFault instead */
303             irq = ARMV7M_EXCP_HARD;
304             vec = &s->vectors[irq];
305             s->cpu->env.v7m.hfsr |= R_V7M_HFSR_FORCED_MASK;
306         }
307     }
308 
309     if (!vec->pending) {
310         vec->pending = 1;
311         nvic_irq_update(s);
312     }
313 }
314 
315 /* Make pending IRQ active.  */
316 void armv7m_nvic_acknowledge_irq(void *opaque)
317 {
318     NVICState *s = (NVICState *)opaque;
319     CPUARMState *env = &s->cpu->env;
320     const int pending = s->vectpending;
321     const int running = nvic_exec_prio(s);
322     int pendgroupprio;
323     VecInfo *vec;
324 
325     assert(pending > ARMV7M_EXCP_RESET && pending < s->num_irq);
326 
327     vec = &s->vectors[pending];
328 
329     assert(vec->enabled);
330     assert(vec->pending);
331 
332     pendgroupprio = vec->prio & nvic_gprio_mask(s);
333     assert(pendgroupprio < running);
334 
335     trace_nvic_acknowledge_irq(pending, vec->prio);
336 
337     vec->active = 1;
338     vec->pending = 0;
339 
340     env->v7m.exception = s->vectpending;
341 
342     nvic_irq_update(s);
343 }
344 
345 int armv7m_nvic_complete_irq(void *opaque, int irq)
346 {
347     NVICState *s = (NVICState *)opaque;
348     VecInfo *vec;
349     int ret;
350 
351     assert(irq > ARMV7M_EXCP_RESET && irq < s->num_irq);
352 
353     vec = &s->vectors[irq];
354 
355     trace_nvic_complete_irq(irq);
356 
357     if (!vec->active) {
358         /* Tell the caller this was an illegal exception return */
359         return -1;
360     }
361 
362     ret = nvic_rettobase(s);
363 
364     vec->active = 0;
365     if (vec->level) {
366         /* Re-pend the exception if it's still held high; only
367          * happens for extenal IRQs
368          */
369         assert(irq >= NVIC_FIRST_IRQ);
370         vec->pending = 1;
371     }
372 
373     nvic_irq_update(s);
374 
375     return ret;
376 }
377 
378 /* callback when external interrupt line is changed */
379 static void set_irq_level(void *opaque, int n, int level)
380 {
381     NVICState *s = opaque;
382     VecInfo *vec;
383 
384     n += NVIC_FIRST_IRQ;
385 
386     assert(n >= NVIC_FIRST_IRQ && n < s->num_irq);
387 
388     trace_nvic_set_irq_level(n, level);
389 
390     /* The pending status of an external interrupt is
391      * latched on rising edge and exception handler return.
392      *
393      * Pulsing the IRQ will always run the handler
394      * once, and the handler will re-run until the
395      * level is low when the handler completes.
396      */
397     vec = &s->vectors[n];
398     if (level != vec->level) {
399         vec->level = level;
400         if (level) {
401             armv7m_nvic_set_pending(s, n);
402         }
403     }
404 }
405 
406 static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
407 {
408     ARMCPU *cpu = s->cpu;
409     uint32_t val;
410 
411     switch (offset) {
412     case 4: /* Interrupt Control Type.  */
413         return ((s->num_irq - NVIC_FIRST_IRQ) / 32) - 1;
414     case 0xd00: /* CPUID Base.  */
415         return cpu->midr;
416     case 0xd04: /* Interrupt Control State.  */
417         /* VECTACTIVE */
418         val = cpu->env.v7m.exception;
419         /* VECTPENDING */
420         val |= (s->vectpending & 0xff) << 12;
421         /* ISRPENDING - set if any external IRQ is pending */
422         if (nvic_isrpending(s)) {
423             val |= (1 << 22);
424         }
425         /* RETTOBASE - set if only one handler is active */
426         if (nvic_rettobase(s)) {
427             val |= (1 << 11);
428         }
429         /* PENDSTSET */
430         if (s->vectors[ARMV7M_EXCP_SYSTICK].pending) {
431             val |= (1 << 26);
432         }
433         /* PENDSVSET */
434         if (s->vectors[ARMV7M_EXCP_PENDSV].pending) {
435             val |= (1 << 28);
436         }
437         /* NMIPENDSET */
438         if (s->vectors[ARMV7M_EXCP_NMI].pending) {
439             val |= (1 << 31);
440         }
441         /* ISRPREEMPT not implemented */
442         return val;
443     case 0xd08: /* Vector Table Offset.  */
444         return cpu->env.v7m.vecbase[attrs.secure];
445     case 0xd0c: /* Application Interrupt/Reset Control.  */
446         return 0xfa050000 | (s->prigroup << 8);
447     case 0xd10: /* System Control.  */
448         /* TODO: Implement SLEEPONEXIT.  */
449         return 0;
450     case 0xd14: /* Configuration Control.  */
451         /* The BFHFNMIGN bit is the only non-banked bit; we
452          * keep it in the non-secure copy of the register.
453          */
454         val = cpu->env.v7m.ccr[attrs.secure];
455         val |= cpu->env.v7m.ccr[M_REG_NS] & R_V7M_CCR_BFHFNMIGN_MASK;
456         return val;
457     case 0xd24: /* System Handler Status.  */
458         val = 0;
459         if (s->vectors[ARMV7M_EXCP_MEM].active) {
460             val |= (1 << 0);
461         }
462         if (s->vectors[ARMV7M_EXCP_BUS].active) {
463             val |= (1 << 1);
464         }
465         if (s->vectors[ARMV7M_EXCP_USAGE].active) {
466             val |= (1 << 3);
467         }
468         if (s->vectors[ARMV7M_EXCP_SVC].active) {
469             val |= (1 << 7);
470         }
471         if (s->vectors[ARMV7M_EXCP_DEBUG].active) {
472             val |= (1 << 8);
473         }
474         if (s->vectors[ARMV7M_EXCP_PENDSV].active) {
475             val |= (1 << 10);
476         }
477         if (s->vectors[ARMV7M_EXCP_SYSTICK].active) {
478             val |= (1 << 11);
479         }
480         if (s->vectors[ARMV7M_EXCP_USAGE].pending) {
481             val |= (1 << 12);
482         }
483         if (s->vectors[ARMV7M_EXCP_MEM].pending) {
484             val |= (1 << 13);
485         }
486         if (s->vectors[ARMV7M_EXCP_BUS].pending) {
487             val |= (1 << 14);
488         }
489         if (s->vectors[ARMV7M_EXCP_SVC].pending) {
490             val |= (1 << 15);
491         }
492         if (s->vectors[ARMV7M_EXCP_MEM].enabled) {
493             val |= (1 << 16);
494         }
495         if (s->vectors[ARMV7M_EXCP_BUS].enabled) {
496             val |= (1 << 17);
497         }
498         if (s->vectors[ARMV7M_EXCP_USAGE].enabled) {
499             val |= (1 << 18);
500         }
501         return val;
502     case 0xd28: /* Configurable Fault Status.  */
503         return cpu->env.v7m.cfsr;
504     case 0xd2c: /* Hard Fault Status.  */
505         return cpu->env.v7m.hfsr;
506     case 0xd30: /* Debug Fault Status.  */
507         return cpu->env.v7m.dfsr;
508     case 0xd34: /* MMFAR MemManage Fault Address */
509         return cpu->env.v7m.mmfar[attrs.secure];
510     case 0xd38: /* Bus Fault Address.  */
511         return cpu->env.v7m.bfar;
512     case 0xd3c: /* Aux Fault Status.  */
513         /* TODO: Implement fault status registers.  */
514         qemu_log_mask(LOG_UNIMP,
515                       "Aux Fault status registers unimplemented\n");
516         return 0;
517     case 0xd40: /* PFR0.  */
518         return 0x00000030;
519     case 0xd44: /* PRF1.  */
520         return 0x00000200;
521     case 0xd48: /* DFR0.  */
522         return 0x00100000;
523     case 0xd4c: /* AFR0.  */
524         return 0x00000000;
525     case 0xd50: /* MMFR0.  */
526         return 0x00000030;
527     case 0xd54: /* MMFR1.  */
528         return 0x00000000;
529     case 0xd58: /* MMFR2.  */
530         return 0x00000000;
531     case 0xd5c: /* MMFR3.  */
532         return 0x00000000;
533     case 0xd60: /* ISAR0.  */
534         return 0x01141110;
535     case 0xd64: /* ISAR1.  */
536         return 0x02111000;
537     case 0xd68: /* ISAR2.  */
538         return 0x21112231;
539     case 0xd6c: /* ISAR3.  */
540         return 0x01111110;
541     case 0xd70: /* ISAR4.  */
542         return 0x01310102;
543     /* TODO: Implement debug registers.  */
544     case 0xd90: /* MPU_TYPE */
545         /* Unified MPU; if the MPU is not present this value is zero */
546         return cpu->pmsav7_dregion << 8;
547         break;
548     case 0xd94: /* MPU_CTRL */
549         return cpu->env.v7m.mpu_ctrl[attrs.secure];
550     case 0xd98: /* MPU_RNR */
551         return cpu->env.pmsav7.rnr[attrs.secure];
552     case 0xd9c: /* MPU_RBAR */
553     case 0xda4: /* MPU_RBAR_A1 */
554     case 0xdac: /* MPU_RBAR_A2 */
555     case 0xdb4: /* MPU_RBAR_A3 */
556     {
557         int region = cpu->env.pmsav7.rnr[attrs.secure];
558 
559         if (arm_feature(&cpu->env, ARM_FEATURE_V8)) {
560             /* PMSAv8M handling of the aliases is different from v7M:
561              * aliases A1, A2, A3 override the low two bits of the region
562              * number in MPU_RNR, and there is no 'region' field in the
563              * RBAR register.
564              */
565             int aliasno = (offset - 0xd9c) / 8; /* 0..3 */
566             if (aliasno) {
567                 region = deposit32(region, 0, 2, aliasno);
568             }
569             if (region >= cpu->pmsav7_dregion) {
570                 return 0;
571             }
572             return cpu->env.pmsav8.rbar[attrs.secure][region];
573         }
574 
575         if (region >= cpu->pmsav7_dregion) {
576             return 0;
577         }
578         return (cpu->env.pmsav7.drbar[region] & 0x1f) | (region & 0xf);
579     }
580     case 0xda0: /* MPU_RASR (v7M), MPU_RLAR (v8M) */
581     case 0xda8: /* MPU_RASR_A1 (v7M), MPU_RLAR_A1 (v8M) */
582     case 0xdb0: /* MPU_RASR_A2 (v7M), MPU_RLAR_A2 (v8M) */
583     case 0xdb8: /* MPU_RASR_A3 (v7M), MPU_RLAR_A3 (v8M) */
584     {
585         int region = cpu->env.pmsav7.rnr[attrs.secure];
586 
587         if (arm_feature(&cpu->env, ARM_FEATURE_V8)) {
588             /* PMSAv8M handling of the aliases is different from v7M:
589              * aliases A1, A2, A3 override the low two bits of the region
590              * number in MPU_RNR.
591              */
592             int aliasno = (offset - 0xda0) / 8; /* 0..3 */
593             if (aliasno) {
594                 region = deposit32(region, 0, 2, aliasno);
595             }
596             if (region >= cpu->pmsav7_dregion) {
597                 return 0;
598             }
599             return cpu->env.pmsav8.rlar[attrs.secure][region];
600         }
601 
602         if (region >= cpu->pmsav7_dregion) {
603             return 0;
604         }
605         return ((cpu->env.pmsav7.dracr[region] & 0xffff) << 16) |
606             (cpu->env.pmsav7.drsr[region] & 0xffff);
607     }
608     case 0xdc0: /* MPU_MAIR0 */
609         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
610             goto bad_offset;
611         }
612         return cpu->env.pmsav8.mair0[attrs.secure];
613     case 0xdc4: /* MPU_MAIR1 */
614         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
615             goto bad_offset;
616         }
617         return cpu->env.pmsav8.mair1[attrs.secure];
618     default:
619     bad_offset:
620         qemu_log_mask(LOG_GUEST_ERROR, "NVIC: Bad read offset 0x%x\n", offset);
621         return 0;
622     }
623 }
624 
625 static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value,
626                         MemTxAttrs attrs)
627 {
628     ARMCPU *cpu = s->cpu;
629 
630     switch (offset) {
631     case 0xd04: /* Interrupt Control State.  */
632         if (value & (1 << 31)) {
633             armv7m_nvic_set_pending(s, ARMV7M_EXCP_NMI);
634         }
635         if (value & (1 << 28)) {
636             armv7m_nvic_set_pending(s, ARMV7M_EXCP_PENDSV);
637         } else if (value & (1 << 27)) {
638             armv7m_nvic_clear_pending(s, ARMV7M_EXCP_PENDSV);
639         }
640         if (value & (1 << 26)) {
641             armv7m_nvic_set_pending(s, ARMV7M_EXCP_SYSTICK);
642         } else if (value & (1 << 25)) {
643             armv7m_nvic_clear_pending(s, ARMV7M_EXCP_SYSTICK);
644         }
645         break;
646     case 0xd08: /* Vector Table Offset.  */
647         cpu->env.v7m.vecbase[attrs.secure] = value & 0xffffff80;
648         break;
649     case 0xd0c: /* Application Interrupt/Reset Control.  */
650         if ((value >> 16) == 0x05fa) {
651             if (value & 4) {
652                 qemu_irq_pulse(s->sysresetreq);
653             }
654             if (value & 2) {
655                 qemu_log_mask(LOG_GUEST_ERROR,
656                               "Setting VECTCLRACTIVE when not in DEBUG mode "
657                               "is UNPREDICTABLE\n");
658             }
659             if (value & 1) {
660                 qemu_log_mask(LOG_GUEST_ERROR,
661                               "Setting VECTRESET when not in DEBUG mode "
662                               "is UNPREDICTABLE\n");
663             }
664             s->prigroup = extract32(value, 8, 3);
665             nvic_irq_update(s);
666         }
667         break;
668     case 0xd10: /* System Control.  */
669         /* TODO: Implement control registers.  */
670         qemu_log_mask(LOG_UNIMP, "NVIC: SCR unimplemented\n");
671         break;
672     case 0xd14: /* Configuration Control.  */
673         /* Enforce RAZ/WI on reserved and must-RAZ/WI bits */
674         value &= (R_V7M_CCR_STKALIGN_MASK |
675                   R_V7M_CCR_BFHFNMIGN_MASK |
676                   R_V7M_CCR_DIV_0_TRP_MASK |
677                   R_V7M_CCR_UNALIGN_TRP_MASK |
678                   R_V7M_CCR_USERSETMPEND_MASK |
679                   R_V7M_CCR_NONBASETHRDENA_MASK);
680 
681         if (arm_feature(&cpu->env, ARM_FEATURE_V8)) {
682             /* v8M makes NONBASETHRDENA and STKALIGN be RES1 */
683             value |= R_V7M_CCR_NONBASETHRDENA_MASK
684                 | R_V7M_CCR_STKALIGN_MASK;
685         }
686         if (attrs.secure) {
687             /* the BFHFNMIGN bit is not banked; keep that in the NS copy */
688             cpu->env.v7m.ccr[M_REG_NS] =
689                 (cpu->env.v7m.ccr[M_REG_NS] & ~R_V7M_CCR_BFHFNMIGN_MASK)
690                 | (value & R_V7M_CCR_BFHFNMIGN_MASK);
691             value &= ~R_V7M_CCR_BFHFNMIGN_MASK;
692         }
693 
694         cpu->env.v7m.ccr[attrs.secure] = value;
695         break;
696     case 0xd24: /* System Handler Control.  */
697         s->vectors[ARMV7M_EXCP_MEM].active = (value & (1 << 0)) != 0;
698         s->vectors[ARMV7M_EXCP_BUS].active = (value & (1 << 1)) != 0;
699         s->vectors[ARMV7M_EXCP_USAGE].active = (value & (1 << 3)) != 0;
700         s->vectors[ARMV7M_EXCP_SVC].active = (value & (1 << 7)) != 0;
701         s->vectors[ARMV7M_EXCP_DEBUG].active = (value & (1 << 8)) != 0;
702         s->vectors[ARMV7M_EXCP_PENDSV].active = (value & (1 << 10)) != 0;
703         s->vectors[ARMV7M_EXCP_SYSTICK].active = (value & (1 << 11)) != 0;
704         s->vectors[ARMV7M_EXCP_USAGE].pending = (value & (1 << 12)) != 0;
705         s->vectors[ARMV7M_EXCP_MEM].pending = (value & (1 << 13)) != 0;
706         s->vectors[ARMV7M_EXCP_BUS].pending = (value & (1 << 14)) != 0;
707         s->vectors[ARMV7M_EXCP_SVC].pending = (value & (1 << 15)) != 0;
708         s->vectors[ARMV7M_EXCP_MEM].enabled = (value & (1 << 16)) != 0;
709         s->vectors[ARMV7M_EXCP_BUS].enabled = (value & (1 << 17)) != 0;
710         s->vectors[ARMV7M_EXCP_USAGE].enabled = (value & (1 << 18)) != 0;
711         nvic_irq_update(s);
712         break;
713     case 0xd28: /* Configurable Fault Status.  */
714         cpu->env.v7m.cfsr &= ~value; /* W1C */
715         break;
716     case 0xd2c: /* Hard Fault Status.  */
717         cpu->env.v7m.hfsr &= ~value; /* W1C */
718         break;
719     case 0xd30: /* Debug Fault Status.  */
720         cpu->env.v7m.dfsr &= ~value; /* W1C */
721         break;
722     case 0xd34: /* Mem Manage Address.  */
723         cpu->env.v7m.mmfar[attrs.secure] = value;
724         return;
725     case 0xd38: /* Bus Fault Address.  */
726         cpu->env.v7m.bfar = value;
727         return;
728     case 0xd3c: /* Aux Fault Status.  */
729         qemu_log_mask(LOG_UNIMP,
730                       "NVIC: Aux fault status registers unimplemented\n");
731         break;
732     case 0xd90: /* MPU_TYPE */
733         return; /* RO */
734     case 0xd94: /* MPU_CTRL */
735         if ((value &
736              (R_V7M_MPU_CTRL_HFNMIENA_MASK | R_V7M_MPU_CTRL_ENABLE_MASK))
737             == R_V7M_MPU_CTRL_HFNMIENA_MASK) {
738             qemu_log_mask(LOG_GUEST_ERROR, "MPU_CTRL: HFNMIENA and !ENABLE is "
739                           "UNPREDICTABLE\n");
740         }
741         cpu->env.v7m.mpu_ctrl[attrs.secure]
742             = value & (R_V7M_MPU_CTRL_ENABLE_MASK |
743                        R_V7M_MPU_CTRL_HFNMIENA_MASK |
744                        R_V7M_MPU_CTRL_PRIVDEFENA_MASK);
745         tlb_flush(CPU(cpu));
746         break;
747     case 0xd98: /* MPU_RNR */
748         if (value >= cpu->pmsav7_dregion) {
749             qemu_log_mask(LOG_GUEST_ERROR, "MPU region out of range %"
750                           PRIu32 "/%" PRIu32 "\n",
751                           value, cpu->pmsav7_dregion);
752         } else {
753             cpu->env.pmsav7.rnr[attrs.secure] = value;
754         }
755         break;
756     case 0xd9c: /* MPU_RBAR */
757     case 0xda4: /* MPU_RBAR_A1 */
758     case 0xdac: /* MPU_RBAR_A2 */
759     case 0xdb4: /* MPU_RBAR_A3 */
760     {
761         int region;
762 
763         if (arm_feature(&cpu->env, ARM_FEATURE_V8)) {
764             /* PMSAv8M handling of the aliases is different from v7M:
765              * aliases A1, A2, A3 override the low two bits of the region
766              * number in MPU_RNR, and there is no 'region' field in the
767              * RBAR register.
768              */
769             int aliasno = (offset - 0xd9c) / 8; /* 0..3 */
770 
771             region = cpu->env.pmsav7.rnr[attrs.secure];
772             if (aliasno) {
773                 region = deposit32(region, 0, 2, aliasno);
774             }
775             if (region >= cpu->pmsav7_dregion) {
776                 return;
777             }
778             cpu->env.pmsav8.rbar[attrs.secure][region] = value;
779             tlb_flush(CPU(cpu));
780             return;
781         }
782 
783         if (value & (1 << 4)) {
784             /* VALID bit means use the region number specified in this
785              * value and also update MPU_RNR.REGION with that value.
786              */
787             region = extract32(value, 0, 4);
788             if (region >= cpu->pmsav7_dregion) {
789                 qemu_log_mask(LOG_GUEST_ERROR,
790                               "MPU region out of range %u/%" PRIu32 "\n",
791                               region, cpu->pmsav7_dregion);
792                 return;
793             }
794             cpu->env.pmsav7.rnr[attrs.secure] = region;
795         } else {
796             region = cpu->env.pmsav7.rnr[attrs.secure];
797         }
798 
799         if (region >= cpu->pmsav7_dregion) {
800             return;
801         }
802 
803         cpu->env.pmsav7.drbar[region] = value & ~0x1f;
804         tlb_flush(CPU(cpu));
805         break;
806     }
807     case 0xda0: /* MPU_RASR (v7M), MPU_RLAR (v8M) */
808     case 0xda8: /* MPU_RASR_A1 (v7M), MPU_RLAR_A1 (v8M) */
809     case 0xdb0: /* MPU_RASR_A2 (v7M), MPU_RLAR_A2 (v8M) */
810     case 0xdb8: /* MPU_RASR_A3 (v7M), MPU_RLAR_A3 (v8M) */
811     {
812         int region = cpu->env.pmsav7.rnr[attrs.secure];
813 
814         if (arm_feature(&cpu->env, ARM_FEATURE_V8)) {
815             /* PMSAv8M handling of the aliases is different from v7M:
816              * aliases A1, A2, A3 override the low two bits of the region
817              * number in MPU_RNR.
818              */
819             int aliasno = (offset - 0xd9c) / 8; /* 0..3 */
820 
821             region = cpu->env.pmsav7.rnr[attrs.secure];
822             if (aliasno) {
823                 region = deposit32(region, 0, 2, aliasno);
824             }
825             if (region >= cpu->pmsav7_dregion) {
826                 return;
827             }
828             cpu->env.pmsav8.rlar[attrs.secure][region] = value;
829             tlb_flush(CPU(cpu));
830             return;
831         }
832 
833         if (region >= cpu->pmsav7_dregion) {
834             return;
835         }
836 
837         cpu->env.pmsav7.drsr[region] = value & 0xff3f;
838         cpu->env.pmsav7.dracr[region] = (value >> 16) & 0x173f;
839         tlb_flush(CPU(cpu));
840         break;
841     }
842     case 0xdc0: /* MPU_MAIR0 */
843         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
844             goto bad_offset;
845         }
846         if (cpu->pmsav7_dregion) {
847             /* Register is RES0 if no MPU regions are implemented */
848             cpu->env.pmsav8.mair0[attrs.secure] = value;
849         }
850         /* We don't need to do anything else because memory attributes
851          * only affect cacheability, and we don't implement caching.
852          */
853         break;
854     case 0xdc4: /* MPU_MAIR1 */
855         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
856             goto bad_offset;
857         }
858         if (cpu->pmsav7_dregion) {
859             /* Register is RES0 if no MPU regions are implemented */
860             cpu->env.pmsav8.mair1[attrs.secure] = value;
861         }
862         /* We don't need to do anything else because memory attributes
863          * only affect cacheability, and we don't implement caching.
864          */
865         break;
866     case 0xf00: /* Software Triggered Interrupt Register */
867     {
868         int excnum = (value & 0x1ff) + NVIC_FIRST_IRQ;
869         if (excnum < s->num_irq) {
870             armv7m_nvic_set_pending(s, excnum);
871         }
872         break;
873     }
874     default:
875     bad_offset:
876         qemu_log_mask(LOG_GUEST_ERROR,
877                       "NVIC: Bad write offset 0x%x\n", offset);
878     }
879 }
880 
881 static bool nvic_user_access_ok(NVICState *s, hwaddr offset, MemTxAttrs attrs)
882 {
883     /* Return true if unprivileged access to this register is permitted. */
884     switch (offset) {
885     case 0xf00: /* STIR: accessible only if CCR.USERSETMPEND permits */
886         /* For access via STIR_NS it is the NS CCR.USERSETMPEND that
887          * controls access even though the CPU is in Secure state (I_QDKX).
888          */
889         return s->cpu->env.v7m.ccr[attrs.secure] & R_V7M_CCR_USERSETMPEND_MASK;
890     default:
891         /* All other user accesses cause a BusFault unconditionally */
892         return false;
893     }
894 }
895 
896 static MemTxResult nvic_sysreg_read(void *opaque, hwaddr addr,
897                                     uint64_t *data, unsigned size,
898                                     MemTxAttrs attrs)
899 {
900     NVICState *s = (NVICState *)opaque;
901     uint32_t offset = addr;
902     unsigned i, startvec, end;
903     uint32_t val;
904 
905     if (attrs.user && !nvic_user_access_ok(s, addr, attrs)) {
906         /* Generate BusFault for unprivileged accesses */
907         return MEMTX_ERROR;
908     }
909 
910     switch (offset) {
911     /* reads of set and clear both return the status */
912     case 0x100 ... 0x13f: /* NVIC Set enable */
913         offset += 0x80;
914         /* fall through */
915     case 0x180 ... 0x1bf: /* NVIC Clear enable */
916         val = 0;
917         startvec = offset - 0x180 + NVIC_FIRST_IRQ; /* vector # */
918 
919         for (i = 0, end = size * 8; i < end && startvec + i < s->num_irq; i++) {
920             if (s->vectors[startvec + i].enabled) {
921                 val |= (1 << i);
922             }
923         }
924         break;
925     case 0x200 ... 0x23f: /* NVIC Set pend */
926         offset += 0x80;
927         /* fall through */
928     case 0x280 ... 0x2bf: /* NVIC Clear pend */
929         val = 0;
930         startvec = offset - 0x280 + NVIC_FIRST_IRQ; /* vector # */
931         for (i = 0, end = size * 8; i < end && startvec + i < s->num_irq; i++) {
932             if (s->vectors[startvec + i].pending) {
933                 val |= (1 << i);
934             }
935         }
936         break;
937     case 0x300 ... 0x33f: /* NVIC Active */
938         val = 0;
939         startvec = offset - 0x300 + NVIC_FIRST_IRQ; /* vector # */
940 
941         for (i = 0, end = size * 8; i < end && startvec + i < s->num_irq; i++) {
942             if (s->vectors[startvec + i].active) {
943                 val |= (1 << i);
944             }
945         }
946         break;
947     case 0x400 ... 0x5ef: /* NVIC Priority */
948         val = 0;
949         startvec = offset - 0x400 + NVIC_FIRST_IRQ; /* vector # */
950 
951         for (i = 0; i < size && startvec + i < s->num_irq; i++) {
952             val |= s->vectors[startvec + i].prio << (8 * i);
953         }
954         break;
955     case 0xd18 ... 0xd23: /* System Handler Priority.  */
956         val = 0;
957         for (i = 0; i < size; i++) {
958             val |= s->vectors[(offset - 0xd14) + i].prio << (i * 8);
959         }
960         break;
961     case 0xfe0 ... 0xfff: /* ID.  */
962         if (offset & 3) {
963             val = 0;
964         } else {
965             val = nvic_id[(offset - 0xfe0) >> 2];
966         }
967         break;
968     default:
969         if (size == 4) {
970             val = nvic_readl(s, offset, attrs);
971         } else {
972             qemu_log_mask(LOG_GUEST_ERROR,
973                           "NVIC: Bad read of size %d at offset 0x%x\n",
974                           size, offset);
975             val = 0;
976         }
977     }
978 
979     trace_nvic_sysreg_read(addr, val, size);
980     *data = val;
981     return MEMTX_OK;
982 }
983 
984 static MemTxResult nvic_sysreg_write(void *opaque, hwaddr addr,
985                                      uint64_t value, unsigned size,
986                                      MemTxAttrs attrs)
987 {
988     NVICState *s = (NVICState *)opaque;
989     uint32_t offset = addr;
990     unsigned i, startvec, end;
991     unsigned setval = 0;
992 
993     trace_nvic_sysreg_write(addr, value, size);
994 
995     if (attrs.user && !nvic_user_access_ok(s, addr, attrs)) {
996         /* Generate BusFault for unprivileged accesses */
997         return MEMTX_ERROR;
998     }
999 
1000     switch (offset) {
1001     case 0x100 ... 0x13f: /* NVIC Set enable */
1002         offset += 0x80;
1003         setval = 1;
1004         /* fall through */
1005     case 0x180 ... 0x1bf: /* NVIC Clear enable */
1006         startvec = 8 * (offset - 0x180) + NVIC_FIRST_IRQ;
1007 
1008         for (i = 0, end = size * 8; i < end && startvec + i < s->num_irq; i++) {
1009             if (value & (1 << i)) {
1010                 s->vectors[startvec + i].enabled = setval;
1011             }
1012         }
1013         nvic_irq_update(s);
1014         return MEMTX_OK;
1015     case 0x200 ... 0x23f: /* NVIC Set pend */
1016         /* the special logic in armv7m_nvic_set_pending()
1017          * is not needed since IRQs are never escalated
1018          */
1019         offset += 0x80;
1020         setval = 1;
1021         /* fall through */
1022     case 0x280 ... 0x2bf: /* NVIC Clear pend */
1023         startvec = 8 * (offset - 0x280) + NVIC_FIRST_IRQ; /* vector # */
1024 
1025         for (i = 0, end = size * 8; i < end && startvec + i < s->num_irq; i++) {
1026             if (value & (1 << i)) {
1027                 s->vectors[startvec + i].pending = setval;
1028             }
1029         }
1030         nvic_irq_update(s);
1031         return MEMTX_OK;
1032     case 0x300 ... 0x33f: /* NVIC Active */
1033         return MEMTX_OK; /* R/O */
1034     case 0x400 ... 0x5ef: /* NVIC Priority */
1035         startvec = 8 * (offset - 0x400) + NVIC_FIRST_IRQ; /* vector # */
1036 
1037         for (i = 0; i < size && startvec + i < s->num_irq; i++) {
1038             set_prio(s, startvec + i, (value >> (i * 8)) & 0xff);
1039         }
1040         nvic_irq_update(s);
1041         return MEMTX_OK;
1042     case 0xd18 ... 0xd23: /* System Handler Priority.  */
1043         for (i = 0; i < size; i++) {
1044             unsigned hdlidx = (offset - 0xd14) + i;
1045             set_prio(s, hdlidx, (value >> (i * 8)) & 0xff);
1046         }
1047         nvic_irq_update(s);
1048         return MEMTX_OK;
1049     }
1050     if (size == 4) {
1051         nvic_writel(s, offset, value, attrs);
1052         return MEMTX_OK;
1053     }
1054     qemu_log_mask(LOG_GUEST_ERROR,
1055                   "NVIC: Bad write of size %d at offset 0x%x\n", size, offset);
1056     /* This is UNPREDICTABLE; treat as RAZ/WI */
1057     return MEMTX_OK;
1058 }
1059 
1060 static const MemoryRegionOps nvic_sysreg_ops = {
1061     .read_with_attrs = nvic_sysreg_read,
1062     .write_with_attrs = nvic_sysreg_write,
1063     .endianness = DEVICE_NATIVE_ENDIAN,
1064 };
1065 
1066 static MemTxResult nvic_sysreg_ns_write(void *opaque, hwaddr addr,
1067                                         uint64_t value, unsigned size,
1068                                         MemTxAttrs attrs)
1069 {
1070     if (attrs.secure) {
1071         /* S accesses to the alias act like NS accesses to the real region */
1072         attrs.secure = 0;
1073         return nvic_sysreg_write(opaque, addr, value, size, attrs);
1074     } else {
1075         /* NS attrs are RAZ/WI for privileged, and BusFault for user */
1076         if (attrs.user) {
1077             return MEMTX_ERROR;
1078         }
1079         return MEMTX_OK;
1080     }
1081 }
1082 
1083 static MemTxResult nvic_sysreg_ns_read(void *opaque, hwaddr addr,
1084                                        uint64_t *data, unsigned size,
1085                                        MemTxAttrs attrs)
1086 {
1087     if (attrs.secure) {
1088         /* S accesses to the alias act like NS accesses to the real region */
1089         attrs.secure = 0;
1090         return nvic_sysreg_read(opaque, addr, data, size, attrs);
1091     } else {
1092         /* NS attrs are RAZ/WI for privileged, and BusFault for user */
1093         if (attrs.user) {
1094             return MEMTX_ERROR;
1095         }
1096         *data = 0;
1097         return MEMTX_OK;
1098     }
1099 }
1100 
1101 static const MemoryRegionOps nvic_sysreg_ns_ops = {
1102     .read_with_attrs = nvic_sysreg_ns_read,
1103     .write_with_attrs = nvic_sysreg_ns_write,
1104     .endianness = DEVICE_NATIVE_ENDIAN,
1105 };
1106 
1107 static int nvic_post_load(void *opaque, int version_id)
1108 {
1109     NVICState *s = opaque;
1110     unsigned i;
1111 
1112     /* Check for out of range priority settings */
1113     if (s->vectors[ARMV7M_EXCP_RESET].prio != -3 ||
1114         s->vectors[ARMV7M_EXCP_NMI].prio != -2 ||
1115         s->vectors[ARMV7M_EXCP_HARD].prio != -1) {
1116         return 1;
1117     }
1118     for (i = ARMV7M_EXCP_MEM; i < s->num_irq; i++) {
1119         if (s->vectors[i].prio & ~0xff) {
1120             return 1;
1121         }
1122     }
1123 
1124     nvic_recompute_state(s);
1125 
1126     return 0;
1127 }
1128 
1129 static const VMStateDescription vmstate_VecInfo = {
1130     .name = "armv7m_nvic_info",
1131     .version_id = 1,
1132     .minimum_version_id = 1,
1133     .fields = (VMStateField[]) {
1134         VMSTATE_INT16(prio, VecInfo),
1135         VMSTATE_UINT8(enabled, VecInfo),
1136         VMSTATE_UINT8(pending, VecInfo),
1137         VMSTATE_UINT8(active, VecInfo),
1138         VMSTATE_UINT8(level, VecInfo),
1139         VMSTATE_END_OF_LIST()
1140     }
1141 };
1142 
1143 static const VMStateDescription vmstate_nvic = {
1144     .name = "armv7m_nvic",
1145     .version_id = 4,
1146     .minimum_version_id = 4,
1147     .post_load = &nvic_post_load,
1148     .fields = (VMStateField[]) {
1149         VMSTATE_STRUCT_ARRAY(vectors, NVICState, NVIC_MAX_VECTORS, 1,
1150                              vmstate_VecInfo, VecInfo),
1151         VMSTATE_UINT32(prigroup, NVICState),
1152         VMSTATE_END_OF_LIST()
1153     }
1154 };
1155 
1156 static Property props_nvic[] = {
1157     /* Number of external IRQ lines (so excluding the 16 internal exceptions) */
1158     DEFINE_PROP_UINT32("num-irq", NVICState, num_irq, 64),
1159     DEFINE_PROP_END_OF_LIST()
1160 };
1161 
1162 static void armv7m_nvic_reset(DeviceState *dev)
1163 {
1164     NVICState *s = NVIC(dev);
1165 
1166     s->vectors[ARMV7M_EXCP_NMI].enabled = 1;
1167     s->vectors[ARMV7M_EXCP_HARD].enabled = 1;
1168     /* MEM, BUS, and USAGE are enabled through
1169      * the System Handler Control register
1170      */
1171     s->vectors[ARMV7M_EXCP_SVC].enabled = 1;
1172     s->vectors[ARMV7M_EXCP_DEBUG].enabled = 1;
1173     s->vectors[ARMV7M_EXCP_PENDSV].enabled = 1;
1174     s->vectors[ARMV7M_EXCP_SYSTICK].enabled = 1;
1175 
1176     s->vectors[ARMV7M_EXCP_RESET].prio = -3;
1177     s->vectors[ARMV7M_EXCP_NMI].prio = -2;
1178     s->vectors[ARMV7M_EXCP_HARD].prio = -1;
1179 
1180     /* Strictly speaking the reset handler should be enabled.
1181      * However, we don't simulate soft resets through the NVIC,
1182      * and the reset vector should never be pended.
1183      * So we leave it disabled to catch logic errors.
1184      */
1185 
1186     s->exception_prio = NVIC_NOEXC_PRIO;
1187     s->vectpending = 0;
1188 }
1189 
1190 static void nvic_systick_trigger(void *opaque, int n, int level)
1191 {
1192     NVICState *s = opaque;
1193 
1194     if (level) {
1195         /* SysTick just asked us to pend its exception.
1196          * (This is different from an external interrupt line's
1197          * behaviour.)
1198          */
1199         armv7m_nvic_set_pending(s, ARMV7M_EXCP_SYSTICK);
1200     }
1201 }
1202 
1203 static void armv7m_nvic_realize(DeviceState *dev, Error **errp)
1204 {
1205     NVICState *s = NVIC(dev);
1206     SysBusDevice *systick_sbd;
1207     Error *err = NULL;
1208     int regionlen;
1209 
1210     s->cpu = ARM_CPU(qemu_get_cpu(0));
1211     assert(s->cpu);
1212 
1213     if (s->num_irq > NVIC_MAX_IRQ) {
1214         error_setg(errp, "num-irq %d exceeds NVIC maximum", s->num_irq);
1215         return;
1216     }
1217 
1218     qdev_init_gpio_in(dev, set_irq_level, s->num_irq);
1219 
1220     /* include space for internal exception vectors */
1221     s->num_irq += NVIC_FIRST_IRQ;
1222 
1223     object_property_set_bool(OBJECT(&s->systick), true, "realized", &err);
1224     if (err != NULL) {
1225         error_propagate(errp, err);
1226         return;
1227     }
1228     systick_sbd = SYS_BUS_DEVICE(&s->systick);
1229     sysbus_connect_irq(systick_sbd, 0,
1230                        qdev_get_gpio_in_named(dev, "systick-trigger", 0));
1231 
1232     /* The NVIC and System Control Space (SCS) starts at 0xe000e000
1233      * and looks like this:
1234      *  0x004 - ICTR
1235      *  0x010 - 0xff - systick
1236      *  0x100..0x7ec - NVIC
1237      *  0x7f0..0xcff - Reserved
1238      *  0xd00..0xd3c - SCS registers
1239      *  0xd40..0xeff - Reserved or Not implemented
1240      *  0xf00 - STIR
1241      *
1242      * Some registers within this space are banked between security states.
1243      * In v8M there is a second range 0xe002e000..0xe002efff which is the
1244      * NonSecure alias SCS; secure accesses to this behave like NS accesses
1245      * to the main SCS range, and non-secure accesses (including when
1246      * the security extension is not implemented) are RAZ/WI.
1247      * Note that both the main SCS range and the alias range are defined
1248      * to be exempt from memory attribution (R_BLJT) and so the memory
1249      * transaction attribute always matches the current CPU security
1250      * state (attrs.secure == env->v7m.secure). In the nvic_sysreg_ns_ops
1251      * wrappers we change attrs.secure to indicate the NS access; so
1252      * generally code determining which banked register to use should
1253      * use attrs.secure; code determining actual behaviour of the system
1254      * should use env->v7m.secure.
1255      */
1256     regionlen = arm_feature(&s->cpu->env, ARM_FEATURE_V8) ? 0x21000 : 0x1000;
1257     memory_region_init(&s->container, OBJECT(s), "nvic", regionlen);
1258     /* The system register region goes at the bottom of the priority
1259      * stack as it covers the whole page.
1260      */
1261     memory_region_init_io(&s->sysregmem, OBJECT(s), &nvic_sysreg_ops, s,
1262                           "nvic_sysregs", 0x1000);
1263     memory_region_add_subregion(&s->container, 0, &s->sysregmem);
1264     memory_region_add_subregion_overlap(&s->container, 0x10,
1265                                         sysbus_mmio_get_region(systick_sbd, 0),
1266                                         1);
1267 
1268     if (arm_feature(&s->cpu->env, ARM_FEATURE_V8)) {
1269         memory_region_init_io(&s->sysreg_ns_mem, OBJECT(s),
1270                               &nvic_sysreg_ns_ops, s,
1271                               "nvic_sysregs_ns", 0x1000);
1272         memory_region_add_subregion(&s->container, 0x20000, &s->sysreg_ns_mem);
1273     }
1274 
1275     sysbus_init_mmio(SYS_BUS_DEVICE(dev), &s->container);
1276 }
1277 
1278 static void armv7m_nvic_instance_init(Object *obj)
1279 {
1280     /* We have a different default value for the num-irq property
1281      * than our superclass. This function runs after qdev init
1282      * has set the defaults from the Property array and before
1283      * any user-specified property setting, so just modify the
1284      * value in the GICState struct.
1285      */
1286     DeviceState *dev = DEVICE(obj);
1287     NVICState *nvic = NVIC(obj);
1288     SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
1289 
1290     object_initialize(&nvic->systick, sizeof(nvic->systick), TYPE_SYSTICK);
1291     qdev_set_parent_bus(DEVICE(&nvic->systick), sysbus_get_default());
1292 
1293     sysbus_init_irq(sbd, &nvic->excpout);
1294     qdev_init_gpio_out_named(dev, &nvic->sysresetreq, "SYSRESETREQ", 1);
1295     qdev_init_gpio_in_named(dev, nvic_systick_trigger, "systick-trigger", 1);
1296 }
1297 
1298 static void armv7m_nvic_class_init(ObjectClass *klass, void *data)
1299 {
1300     DeviceClass *dc = DEVICE_CLASS(klass);
1301 
1302     dc->vmsd  = &vmstate_nvic;
1303     dc->props = props_nvic;
1304     dc->reset = armv7m_nvic_reset;
1305     dc->realize = armv7m_nvic_realize;
1306 }
1307 
1308 static const TypeInfo armv7m_nvic_info = {
1309     .name          = TYPE_NVIC,
1310     .parent        = TYPE_SYS_BUS_DEVICE,
1311     .instance_init = armv7m_nvic_instance_init,
1312     .instance_size = sizeof(NVICState),
1313     .class_init    = armv7m_nvic_class_init,
1314     .class_size    = sizeof(SysBusDeviceClass),
1315 };
1316 
1317 static void armv7m_nvic_register_types(void)
1318 {
1319     type_register_static(&armv7m_nvic_info);
1320 }
1321 
1322 type_init(armv7m_nvic_register_types)
1323