1 /* 2 * ARM Nested Vectored Interrupt Controller 3 * 4 * Copyright (c) 2006-2007 CodeSourcery. 5 * Written by Paul Brook 6 * 7 * This code is licensed under the GPL. 8 * 9 * The ARMv7M System controller is fairly tightly tied in with the 10 * NVIC. Much of that is also implemented here. 11 */ 12 13 #include "hw/sysbus.h" 14 #include "qemu/timer.h" 15 #include "hw/arm/arm.h" 16 #include "exec/address-spaces.h" 17 #include "gic_internal.h" 18 19 typedef struct { 20 GICState gic; 21 struct { 22 uint32_t control; 23 uint32_t reload; 24 int64_t tick; 25 QEMUTimer *timer; 26 } systick; 27 MemoryRegion sysregmem; 28 MemoryRegion gic_iomem_alias; 29 MemoryRegion container; 30 uint32_t num_irq; 31 qemu_irq sysresetreq; 32 } nvic_state; 33 34 #define TYPE_NVIC "armv7m_nvic" 35 /** 36 * NVICClass: 37 * @parent_reset: the parent class' reset handler. 38 * 39 * A model of the v7M NVIC and System Controller 40 */ 41 typedef struct NVICClass { 42 /*< private >*/ 43 ARMGICClass parent_class; 44 /*< public >*/ 45 DeviceRealize parent_realize; 46 void (*parent_reset)(DeviceState *dev); 47 } NVICClass; 48 49 #define NVIC_CLASS(klass) \ 50 OBJECT_CLASS_CHECK(NVICClass, (klass), TYPE_NVIC) 51 #define NVIC_GET_CLASS(obj) \ 52 OBJECT_GET_CLASS(NVICClass, (obj), TYPE_NVIC) 53 #define NVIC(obj) \ 54 OBJECT_CHECK(nvic_state, (obj), TYPE_NVIC) 55 56 static const uint8_t nvic_id[] = { 57 0x00, 0xb0, 0x1b, 0x00, 0x0d, 0xe0, 0x05, 0xb1 58 }; 59 60 /* qemu timers run at 1GHz. We want something closer to 1MHz. */ 61 #define SYSTICK_SCALE 1000ULL 62 63 #define SYSTICK_ENABLE (1 << 0) 64 #define SYSTICK_TICKINT (1 << 1) 65 #define SYSTICK_CLKSOURCE (1 << 2) 66 #define SYSTICK_COUNTFLAG (1 << 16) 67 68 int system_clock_scale; 69 70 /* Conversion factor from qemu timer to SysTick frequencies. */ 71 static inline int64_t systick_scale(nvic_state *s) 72 { 73 if (s->systick.control & SYSTICK_CLKSOURCE) 74 return system_clock_scale; 75 else 76 return 1000; 77 } 78 79 static void systick_reload(nvic_state *s, int reset) 80 { 81 /* The Cortex-M3 Devices Generic User Guide says that "When the 82 * ENABLE bit is set to 1, the counter loads the RELOAD value from the 83 * SYST RVR register and then counts down". So, we need to check the 84 * ENABLE bit before reloading the value. 85 */ 86 if ((s->systick.control & SYSTICK_ENABLE) == 0) { 87 return; 88 } 89 90 if (reset) 91 s->systick.tick = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL); 92 s->systick.tick += (s->systick.reload + 1) * systick_scale(s); 93 timer_mod(s->systick.timer, s->systick.tick); 94 } 95 96 static void systick_timer_tick(void * opaque) 97 { 98 nvic_state *s = (nvic_state *)opaque; 99 s->systick.control |= SYSTICK_COUNTFLAG; 100 if (s->systick.control & SYSTICK_TICKINT) { 101 /* Trigger the interrupt. */ 102 armv7m_nvic_set_pending(s, ARMV7M_EXCP_SYSTICK); 103 } 104 if (s->systick.reload == 0) { 105 s->systick.control &= ~SYSTICK_ENABLE; 106 } else { 107 systick_reload(s, 0); 108 } 109 } 110 111 static void systick_reset(nvic_state *s) 112 { 113 s->systick.control = 0; 114 s->systick.reload = 0; 115 s->systick.tick = 0; 116 timer_del(s->systick.timer); 117 } 118 119 /* The external routines use the hardware vector numbering, ie. the first 120 IRQ is #16. The internal GIC routines use #32 as the first IRQ. */ 121 void armv7m_nvic_set_pending(void *opaque, int irq) 122 { 123 nvic_state *s = (nvic_state *)opaque; 124 if (irq >= 16) 125 irq += 16; 126 gic_set_pending_private(&s->gic, 0, irq); 127 } 128 129 /* Make pending IRQ active. */ 130 int armv7m_nvic_acknowledge_irq(void *opaque) 131 { 132 nvic_state *s = (nvic_state *)opaque; 133 uint32_t irq; 134 135 irq = gic_acknowledge_irq(&s->gic, 0, MEMTXATTRS_UNSPECIFIED); 136 if (irq == 1023) 137 hw_error("Interrupt but no vector\n"); 138 if (irq >= 32) 139 irq -= 16; 140 return irq; 141 } 142 143 void armv7m_nvic_complete_irq(void *opaque, int irq) 144 { 145 nvic_state *s = (nvic_state *)opaque; 146 if (irq >= 16) 147 irq += 16; 148 gic_complete_irq(&s->gic, 0, irq, MEMTXATTRS_UNSPECIFIED); 149 } 150 151 static uint32_t nvic_readl(nvic_state *s, uint32_t offset) 152 { 153 ARMCPU *cpu; 154 uint32_t val; 155 int irq; 156 157 switch (offset) { 158 case 4: /* Interrupt Control Type. */ 159 return (s->num_irq / 32) - 1; 160 case 0x10: /* SysTick Control and Status. */ 161 val = s->systick.control; 162 s->systick.control &= ~SYSTICK_COUNTFLAG; 163 return val; 164 case 0x14: /* SysTick Reload Value. */ 165 return s->systick.reload; 166 case 0x18: /* SysTick Current Value. */ 167 { 168 int64_t t; 169 if ((s->systick.control & SYSTICK_ENABLE) == 0) 170 return 0; 171 t = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL); 172 if (t >= s->systick.tick) 173 return 0; 174 val = ((s->systick.tick - (t + 1)) / systick_scale(s)) + 1; 175 /* The interrupt in triggered when the timer reaches zero. 176 However the counter is not reloaded until the next clock 177 tick. This is a hack to return zero during the first tick. */ 178 if (val > s->systick.reload) 179 val = 0; 180 return val; 181 } 182 case 0x1c: /* SysTick Calibration Value. */ 183 return 10000; 184 case 0xd00: /* CPUID Base. */ 185 cpu = ARM_CPU(current_cpu); 186 return cpu->midr; 187 case 0xd04: /* Interrupt Control State. */ 188 /* VECTACTIVE */ 189 cpu = ARM_CPU(current_cpu); 190 val = cpu->env.v7m.exception; 191 if (val == 1023) { 192 val = 0; 193 } else if (val >= 32) { 194 val -= 16; 195 } 196 /* VECTPENDING */ 197 if (s->gic.current_pending[0] != 1023) 198 val |= (s->gic.current_pending[0] << 12); 199 /* ISRPENDING and RETTOBASE */ 200 for (irq = 32; irq < s->num_irq; irq++) { 201 if (s->gic.irq_state[irq].pending) { 202 val |= (1 << 22); 203 break; 204 } 205 if (irq != cpu->env.v7m.exception && s->gic.irq_state[irq].active) { 206 val |= (1 << 11); 207 } 208 } 209 /* PENDSTSET */ 210 if (s->gic.irq_state[ARMV7M_EXCP_SYSTICK].pending) 211 val |= (1 << 26); 212 /* PENDSVSET */ 213 if (s->gic.irq_state[ARMV7M_EXCP_PENDSV].pending) 214 val |= (1 << 28); 215 /* NMIPENDSET */ 216 if (s->gic.irq_state[ARMV7M_EXCP_NMI].pending) 217 val |= (1 << 31); 218 return val; 219 case 0xd08: /* Vector Table Offset. */ 220 cpu = ARM_CPU(current_cpu); 221 return cpu->env.v7m.vecbase; 222 case 0xd0c: /* Application Interrupt/Reset Control. */ 223 return 0xfa050000; 224 case 0xd10: /* System Control. */ 225 /* TODO: Implement SLEEPONEXIT. */ 226 return 0; 227 case 0xd14: /* Configuration Control. */ 228 /* TODO: Implement Configuration Control bits. */ 229 return 0; 230 case 0xd24: /* System Handler Status. */ 231 val = 0; 232 if (s->gic.irq_state[ARMV7M_EXCP_MEM].active) val |= (1 << 0); 233 if (s->gic.irq_state[ARMV7M_EXCP_BUS].active) val |= (1 << 1); 234 if (s->gic.irq_state[ARMV7M_EXCP_USAGE].active) val |= (1 << 3); 235 if (s->gic.irq_state[ARMV7M_EXCP_SVC].active) val |= (1 << 7); 236 if (s->gic.irq_state[ARMV7M_EXCP_DEBUG].active) val |= (1 << 8); 237 if (s->gic.irq_state[ARMV7M_EXCP_PENDSV].active) val |= (1 << 10); 238 if (s->gic.irq_state[ARMV7M_EXCP_SYSTICK].active) val |= (1 << 11); 239 if (s->gic.irq_state[ARMV7M_EXCP_USAGE].pending) val |= (1 << 12); 240 if (s->gic.irq_state[ARMV7M_EXCP_MEM].pending) val |= (1 << 13); 241 if (s->gic.irq_state[ARMV7M_EXCP_BUS].pending) val |= (1 << 14); 242 if (s->gic.irq_state[ARMV7M_EXCP_SVC].pending) val |= (1 << 15); 243 if (s->gic.irq_state[ARMV7M_EXCP_MEM].enabled) val |= (1 << 16); 244 if (s->gic.irq_state[ARMV7M_EXCP_BUS].enabled) val |= (1 << 17); 245 if (s->gic.irq_state[ARMV7M_EXCP_USAGE].enabled) val |= (1 << 18); 246 return val; 247 case 0xd28: /* Configurable Fault Status. */ 248 /* TODO: Implement Fault Status. */ 249 qemu_log_mask(LOG_UNIMP, "Configurable Fault Status unimplemented\n"); 250 return 0; 251 case 0xd2c: /* Hard Fault Status. */ 252 case 0xd30: /* Debug Fault Status. */ 253 case 0xd34: /* Mem Manage Address. */ 254 case 0xd38: /* Bus Fault Address. */ 255 case 0xd3c: /* Aux Fault Status. */ 256 /* TODO: Implement fault status registers. */ 257 qemu_log_mask(LOG_UNIMP, "Fault status registers unimplemented\n"); 258 return 0; 259 case 0xd40: /* PFR0. */ 260 return 0x00000030; 261 case 0xd44: /* PRF1. */ 262 return 0x00000200; 263 case 0xd48: /* DFR0. */ 264 return 0x00100000; 265 case 0xd4c: /* AFR0. */ 266 return 0x00000000; 267 case 0xd50: /* MMFR0. */ 268 return 0x00000030; 269 case 0xd54: /* MMFR1. */ 270 return 0x00000000; 271 case 0xd58: /* MMFR2. */ 272 return 0x00000000; 273 case 0xd5c: /* MMFR3. */ 274 return 0x00000000; 275 case 0xd60: /* ISAR0. */ 276 return 0x01141110; 277 case 0xd64: /* ISAR1. */ 278 return 0x02111000; 279 case 0xd68: /* ISAR2. */ 280 return 0x21112231; 281 case 0xd6c: /* ISAR3. */ 282 return 0x01111110; 283 case 0xd70: /* ISAR4. */ 284 return 0x01310102; 285 /* TODO: Implement debug registers. */ 286 default: 287 qemu_log_mask(LOG_GUEST_ERROR, "NVIC: Bad read offset 0x%x\n", offset); 288 return 0; 289 } 290 } 291 292 static void nvic_writel(nvic_state *s, uint32_t offset, uint32_t value) 293 { 294 ARMCPU *cpu; 295 uint32_t oldval; 296 switch (offset) { 297 case 0x10: /* SysTick Control and Status. */ 298 oldval = s->systick.control; 299 s->systick.control &= 0xfffffff8; 300 s->systick.control |= value & 7; 301 if ((oldval ^ value) & SYSTICK_ENABLE) { 302 int64_t now = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL); 303 if (value & SYSTICK_ENABLE) { 304 if (s->systick.tick) { 305 s->systick.tick += now; 306 timer_mod(s->systick.timer, s->systick.tick); 307 } else { 308 systick_reload(s, 1); 309 } 310 } else { 311 timer_del(s->systick.timer); 312 s->systick.tick -= now; 313 if (s->systick.tick < 0) 314 s->systick.tick = 0; 315 } 316 } else if ((oldval ^ value) & SYSTICK_CLKSOURCE) { 317 /* This is a hack. Force the timer to be reloaded 318 when the reference clock is changed. */ 319 systick_reload(s, 1); 320 } 321 break; 322 case 0x14: /* SysTick Reload Value. */ 323 s->systick.reload = value; 324 break; 325 case 0x18: /* SysTick Current Value. Writes reload the timer. */ 326 systick_reload(s, 1); 327 s->systick.control &= ~SYSTICK_COUNTFLAG; 328 break; 329 case 0xd04: /* Interrupt Control State. */ 330 if (value & (1 << 31)) { 331 armv7m_nvic_set_pending(s, ARMV7M_EXCP_NMI); 332 } 333 if (value & (1 << 28)) { 334 armv7m_nvic_set_pending(s, ARMV7M_EXCP_PENDSV); 335 } else if (value & (1 << 27)) { 336 s->gic.irq_state[ARMV7M_EXCP_PENDSV].pending = 0; 337 gic_update(&s->gic); 338 } 339 if (value & (1 << 26)) { 340 armv7m_nvic_set_pending(s, ARMV7M_EXCP_SYSTICK); 341 } else if (value & (1 << 25)) { 342 s->gic.irq_state[ARMV7M_EXCP_SYSTICK].pending = 0; 343 gic_update(&s->gic); 344 } 345 break; 346 case 0xd08: /* Vector Table Offset. */ 347 cpu = ARM_CPU(current_cpu); 348 cpu->env.v7m.vecbase = value & 0xffffff80; 349 break; 350 case 0xd0c: /* Application Interrupt/Reset Control. */ 351 if ((value >> 16) == 0x05fa) { 352 if (value & 4) { 353 qemu_irq_pulse(s->sysresetreq); 354 } 355 if (value & 2) { 356 qemu_log_mask(LOG_UNIMP, "VECTCLRACTIVE unimplemented\n"); 357 } 358 if (value & 1) { 359 qemu_log_mask(LOG_UNIMP, "AIRCR system reset unimplemented\n"); 360 } 361 if (value & 0x700) { 362 qemu_log_mask(LOG_UNIMP, "PRIGROUP unimplemented\n"); 363 } 364 } 365 break; 366 case 0xd10: /* System Control. */ 367 case 0xd14: /* Configuration Control. */ 368 /* TODO: Implement control registers. */ 369 qemu_log_mask(LOG_UNIMP, "NVIC: SCR and CCR unimplemented\n"); 370 break; 371 case 0xd24: /* System Handler Control. */ 372 /* TODO: Real hardware allows you to set/clear the active bits 373 under some circumstances. We don't implement this. */ 374 s->gic.irq_state[ARMV7M_EXCP_MEM].enabled = (value & (1 << 16)) != 0; 375 s->gic.irq_state[ARMV7M_EXCP_BUS].enabled = (value & (1 << 17)) != 0; 376 s->gic.irq_state[ARMV7M_EXCP_USAGE].enabled = (value & (1 << 18)) != 0; 377 break; 378 case 0xd28: /* Configurable Fault Status. */ 379 case 0xd2c: /* Hard Fault Status. */ 380 case 0xd30: /* Debug Fault Status. */ 381 case 0xd34: /* Mem Manage Address. */ 382 case 0xd38: /* Bus Fault Address. */ 383 case 0xd3c: /* Aux Fault Status. */ 384 qemu_log_mask(LOG_UNIMP, 385 "NVIC: fault status registers unimplemented\n"); 386 break; 387 case 0xf00: /* Software Triggered Interrupt Register */ 388 if ((value & 0x1ff) < s->num_irq) { 389 gic_set_pending_private(&s->gic, 0, value & 0x1ff); 390 } 391 break; 392 default: 393 qemu_log_mask(LOG_GUEST_ERROR, 394 "NVIC: Bad write offset 0x%x\n", offset); 395 } 396 } 397 398 static uint64_t nvic_sysreg_read(void *opaque, hwaddr addr, 399 unsigned size) 400 { 401 nvic_state *s = (nvic_state *)opaque; 402 uint32_t offset = addr; 403 int i; 404 uint32_t val; 405 406 switch (offset) { 407 case 0xd18 ... 0xd23: /* System Handler Priority. */ 408 val = 0; 409 for (i = 0; i < size; i++) { 410 val |= s->gic.priority1[(offset - 0xd14) + i][0] << (i * 8); 411 } 412 return val; 413 case 0xfe0 ... 0xfff: /* ID. */ 414 if (offset & 3) { 415 return 0; 416 } 417 return nvic_id[(offset - 0xfe0) >> 2]; 418 } 419 if (size == 4) { 420 return nvic_readl(s, offset); 421 } 422 qemu_log_mask(LOG_GUEST_ERROR, 423 "NVIC: Bad read of size %d at offset 0x%x\n", size, offset); 424 return 0; 425 } 426 427 static void nvic_sysreg_write(void *opaque, hwaddr addr, 428 uint64_t value, unsigned size) 429 { 430 nvic_state *s = (nvic_state *)opaque; 431 uint32_t offset = addr; 432 int i; 433 434 switch (offset) { 435 case 0xd18 ... 0xd23: /* System Handler Priority. */ 436 for (i = 0; i < size; i++) { 437 s->gic.priority1[(offset - 0xd14) + i][0] = 438 (value >> (i * 8)) & 0xff; 439 } 440 gic_update(&s->gic); 441 return; 442 } 443 if (size == 4) { 444 nvic_writel(s, offset, value); 445 return; 446 } 447 qemu_log_mask(LOG_GUEST_ERROR, 448 "NVIC: Bad write of size %d at offset 0x%x\n", size, offset); 449 } 450 451 static const MemoryRegionOps nvic_sysreg_ops = { 452 .read = nvic_sysreg_read, 453 .write = nvic_sysreg_write, 454 .endianness = DEVICE_NATIVE_ENDIAN, 455 }; 456 457 static const VMStateDescription vmstate_nvic = { 458 .name = "armv7m_nvic", 459 .version_id = 1, 460 .minimum_version_id = 1, 461 .fields = (VMStateField[]) { 462 VMSTATE_UINT32(systick.control, nvic_state), 463 VMSTATE_UINT32(systick.reload, nvic_state), 464 VMSTATE_INT64(systick.tick, nvic_state), 465 VMSTATE_TIMER_PTR(systick.timer, nvic_state), 466 VMSTATE_END_OF_LIST() 467 } 468 }; 469 470 static void armv7m_nvic_reset(DeviceState *dev) 471 { 472 nvic_state *s = NVIC(dev); 473 NVICClass *nc = NVIC_GET_CLASS(s); 474 nc->parent_reset(dev); 475 /* Common GIC reset resets to disabled; the NVIC doesn't have 476 * per-CPU interfaces so mark our non-existent CPU interface 477 * as enabled by default, and with a priority mask which allows 478 * all interrupts through. 479 */ 480 s->gic.cpu_ctlr[0] = GICC_CTLR_EN_GRP0; 481 s->gic.priority_mask[0] = 0x100; 482 /* The NVIC as a whole is always enabled. */ 483 s->gic.ctlr = 1; 484 systick_reset(s); 485 } 486 487 static void armv7m_nvic_realize(DeviceState *dev, Error **errp) 488 { 489 nvic_state *s = NVIC(dev); 490 NVICClass *nc = NVIC_GET_CLASS(s); 491 Error *local_err = NULL; 492 493 /* The NVIC always has only one CPU */ 494 s->gic.num_cpu = 1; 495 /* Tell the common code we're an NVIC */ 496 s->gic.revision = 0xffffffff; 497 s->num_irq = s->gic.num_irq; 498 nc->parent_realize(dev, &local_err); 499 if (local_err) { 500 error_propagate(errp, local_err); 501 return; 502 } 503 gic_init_irqs_and_distributor(&s->gic); 504 /* The NVIC and system controller register area looks like this: 505 * 0..0xff : system control registers, including systick 506 * 0x100..0xcff : GIC-like registers 507 * 0xd00..0xfff : system control registers 508 * We use overlaying to put the GIC like registers 509 * over the top of the system control register region. 510 */ 511 memory_region_init(&s->container, OBJECT(s), "nvic", 0x1000); 512 /* The system register region goes at the bottom of the priority 513 * stack as it covers the whole page. 514 */ 515 memory_region_init_io(&s->sysregmem, OBJECT(s), &nvic_sysreg_ops, s, 516 "nvic_sysregs", 0x1000); 517 memory_region_add_subregion(&s->container, 0, &s->sysregmem); 518 /* Alias the GIC region so we can get only the section of it 519 * we need, and layer it on top of the system register region. 520 */ 521 memory_region_init_alias(&s->gic_iomem_alias, OBJECT(s), 522 "nvic-gic", &s->gic.iomem, 523 0x100, 0xc00); 524 memory_region_add_subregion_overlap(&s->container, 0x100, 525 &s->gic_iomem_alias, 1); 526 /* Map the whole thing into system memory at the location required 527 * by the v7M architecture. 528 */ 529 memory_region_add_subregion(get_system_memory(), 0xe000e000, &s->container); 530 s->systick.timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, systick_timer_tick, s); 531 } 532 533 static void armv7m_nvic_instance_init(Object *obj) 534 { 535 /* We have a different default value for the num-irq property 536 * than our superclass. This function runs after qdev init 537 * has set the defaults from the Property array and before 538 * any user-specified property setting, so just modify the 539 * value in the GICState struct. 540 */ 541 GICState *s = ARM_GIC_COMMON(obj); 542 DeviceState *dev = DEVICE(obj); 543 nvic_state *nvic = NVIC(obj); 544 /* The ARM v7m may have anything from 0 to 496 external interrupt 545 * IRQ lines. We default to 64. Other boards may differ and should 546 * set the num-irq property appropriately. 547 */ 548 s->num_irq = 64; 549 qdev_init_gpio_out_named(dev, &nvic->sysresetreq, "SYSRESETREQ", 1); 550 } 551 552 static void armv7m_nvic_class_init(ObjectClass *klass, void *data) 553 { 554 NVICClass *nc = NVIC_CLASS(klass); 555 DeviceClass *dc = DEVICE_CLASS(klass); 556 557 nc->parent_reset = dc->reset; 558 nc->parent_realize = dc->realize; 559 dc->vmsd = &vmstate_nvic; 560 dc->reset = armv7m_nvic_reset; 561 dc->realize = armv7m_nvic_realize; 562 } 563 564 static const TypeInfo armv7m_nvic_info = { 565 .name = TYPE_NVIC, 566 .parent = TYPE_ARM_GIC_COMMON, 567 .instance_init = armv7m_nvic_instance_init, 568 .instance_size = sizeof(nvic_state), 569 .class_init = armv7m_nvic_class_init, 570 .class_size = sizeof(NVICClass), 571 }; 572 573 static void armv7m_nvic_register_types(void) 574 { 575 type_register_static(&armv7m_nvic_info); 576 } 577 578 type_init(armv7m_nvic_register_types) 579