xref: /openbmc/qemu/hw/intc/armv7m_nvic.c (revision db725815985654007ade0fd53590d613fd657208)
1 /*
2  * ARM Nested Vectored Interrupt Controller
3  *
4  * Copyright (c) 2006-2007 CodeSourcery.
5  * Written by Paul Brook
6  *
7  * This code is licensed under the GPL.
8  *
9  * The ARMv7M System controller is fairly tightly tied in with the
10  * NVIC.  Much of that is also implemented here.
11  */
12 
13 #include "qemu/osdep.h"
14 #include "qapi/error.h"
15 #include "cpu.h"
16 #include "hw/sysbus.h"
17 #include "migration/vmstate.h"
18 #include "qemu/timer.h"
19 #include "hw/intc/armv7m_nvic.h"
20 #include "hw/irq.h"
21 #include "target/arm/cpu.h"
22 #include "exec/exec-all.h"
23 #include "qemu/log.h"
24 #include "qemu/module.h"
25 #include "trace.h"
26 
27 /* IRQ number counting:
28  *
29  * the num-irq property counts the number of external IRQ lines
30  *
31  * NVICState::num_irq counts the total number of exceptions
32  * (external IRQs, the 15 internal exceptions including reset,
33  * and one for the unused exception number 0).
34  *
35  * NVIC_MAX_IRQ is the highest permitted number of external IRQ lines.
36  *
37  * NVIC_MAX_VECTORS is the highest permitted number of exceptions.
38  *
39  * Iterating through all exceptions should typically be done with
40  * for (i = 1; i < s->num_irq; i++) to avoid the unused slot 0.
41  *
42  * The external qemu_irq lines are the NVIC's external IRQ lines,
43  * so line 0 is exception 16.
44  *
45  * In the terminology of the architecture manual, "interrupts" are
46  * a subcategory of exception referring to the external interrupts
47  * (which are exception numbers NVIC_FIRST_IRQ and upward).
48  * For historical reasons QEMU tends to use "interrupt" and
49  * "exception" more or less interchangeably.
50  */
51 #define NVIC_FIRST_IRQ NVIC_INTERNAL_VECTORS
52 #define NVIC_MAX_IRQ (NVIC_MAX_VECTORS - NVIC_FIRST_IRQ)
53 
54 /* Effective running priority of the CPU when no exception is active
55  * (higher than the highest possible priority value)
56  */
57 #define NVIC_NOEXC_PRIO 0x100
58 /* Maximum priority of non-secure exceptions when AIRCR.PRIS is set */
59 #define NVIC_NS_PRIO_LIMIT 0x80
60 
61 static const uint8_t nvic_id[] = {
62     0x00, 0xb0, 0x1b, 0x00, 0x0d, 0xe0, 0x05, 0xb1
63 };
64 
65 static int nvic_pending_prio(NVICState *s)
66 {
67     /* return the group priority of the current pending interrupt,
68      * or NVIC_NOEXC_PRIO if no interrupt is pending
69      */
70     return s->vectpending_prio;
71 }
72 
73 /* Return the value of the ISCR RETTOBASE bit:
74  * 1 if there is exactly one active exception
75  * 0 if there is more than one active exception
76  * UNKNOWN if there are no active exceptions (we choose 1,
77  * which matches the choice Cortex-M3 is documented as making).
78  *
79  * NB: some versions of the documentation talk about this
80  * counting "active exceptions other than the one shown by IPSR";
81  * this is only different in the obscure corner case where guest
82  * code has manually deactivated an exception and is about
83  * to fail an exception-return integrity check. The definition
84  * above is the one from the v8M ARM ARM and is also in line
85  * with the behaviour documented for the Cortex-M3.
86  */
87 static bool nvic_rettobase(NVICState *s)
88 {
89     int irq, nhand = 0;
90     bool check_sec = arm_feature(&s->cpu->env, ARM_FEATURE_M_SECURITY);
91 
92     for (irq = ARMV7M_EXCP_RESET; irq < s->num_irq; irq++) {
93         if (s->vectors[irq].active ||
94             (check_sec && irq < NVIC_INTERNAL_VECTORS &&
95              s->sec_vectors[irq].active)) {
96             nhand++;
97             if (nhand == 2) {
98                 return 0;
99             }
100         }
101     }
102 
103     return 1;
104 }
105 
106 /* Return the value of the ISCR ISRPENDING bit:
107  * 1 if an external interrupt is pending
108  * 0 if no external interrupt is pending
109  */
110 static bool nvic_isrpending(NVICState *s)
111 {
112     int irq;
113 
114     /* We can shortcut if the highest priority pending interrupt
115      * happens to be external or if there is nothing pending.
116      */
117     if (s->vectpending > NVIC_FIRST_IRQ) {
118         return true;
119     }
120     if (s->vectpending == 0) {
121         return false;
122     }
123 
124     for (irq = NVIC_FIRST_IRQ; irq < s->num_irq; irq++) {
125         if (s->vectors[irq].pending) {
126             return true;
127         }
128     }
129     return false;
130 }
131 
132 static bool exc_is_banked(int exc)
133 {
134     /* Return true if this is one of the limited set of exceptions which
135      * are banked (and thus have state in sec_vectors[])
136      */
137     return exc == ARMV7M_EXCP_HARD ||
138         exc == ARMV7M_EXCP_MEM ||
139         exc == ARMV7M_EXCP_USAGE ||
140         exc == ARMV7M_EXCP_SVC ||
141         exc == ARMV7M_EXCP_PENDSV ||
142         exc == ARMV7M_EXCP_SYSTICK;
143 }
144 
145 /* Return a mask word which clears the subpriority bits from
146  * a priority value for an M-profile exception, leaving only
147  * the group priority.
148  */
149 static inline uint32_t nvic_gprio_mask(NVICState *s, bool secure)
150 {
151     return ~0U << (s->prigroup[secure] + 1);
152 }
153 
154 static bool exc_targets_secure(NVICState *s, int exc)
155 {
156     /* Return true if this non-banked exception targets Secure state. */
157     if (!arm_feature(&s->cpu->env, ARM_FEATURE_M_SECURITY)) {
158         return false;
159     }
160 
161     if (exc >= NVIC_FIRST_IRQ) {
162         return !s->itns[exc];
163     }
164 
165     /* Function shouldn't be called for banked exceptions. */
166     assert(!exc_is_banked(exc));
167 
168     switch (exc) {
169     case ARMV7M_EXCP_NMI:
170     case ARMV7M_EXCP_BUS:
171         return !(s->cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK);
172     case ARMV7M_EXCP_SECURE:
173         return true;
174     case ARMV7M_EXCP_DEBUG:
175         /* TODO: controlled by DEMCR.SDME, which we don't yet implement */
176         return false;
177     default:
178         /* reset, and reserved (unused) low exception numbers.
179          * We'll get called by code that loops through all the exception
180          * numbers, but it doesn't matter what we return here as these
181          * non-existent exceptions will never be pended or active.
182          */
183         return true;
184     }
185 }
186 
187 static int exc_group_prio(NVICState *s, int rawprio, bool targets_secure)
188 {
189     /* Return the group priority for this exception, given its raw
190      * (group-and-subgroup) priority value and whether it is targeting
191      * secure state or not.
192      */
193     if (rawprio < 0) {
194         return rawprio;
195     }
196     rawprio &= nvic_gprio_mask(s, targets_secure);
197     /* AIRCR.PRIS causes us to squash all NS priorities into the
198      * lower half of the total range
199      */
200     if (!targets_secure &&
201         (s->cpu->env.v7m.aircr & R_V7M_AIRCR_PRIS_MASK)) {
202         rawprio = (rawprio >> 1) + NVIC_NS_PRIO_LIMIT;
203     }
204     return rawprio;
205 }
206 
207 /* Recompute vectpending and exception_prio for a CPU which implements
208  * the Security extension
209  */
210 static void nvic_recompute_state_secure(NVICState *s)
211 {
212     int i, bank;
213     int pend_prio = NVIC_NOEXC_PRIO;
214     int active_prio = NVIC_NOEXC_PRIO;
215     int pend_irq = 0;
216     bool pending_is_s_banked = false;
217     int pend_subprio = 0;
218 
219     /* R_CQRV: precedence is by:
220      *  - lowest group priority; if both the same then
221      *  - lowest subpriority; if both the same then
222      *  - lowest exception number; if both the same (ie banked) then
223      *  - secure exception takes precedence
224      * Compare pseudocode RawExecutionPriority.
225      * Annoyingly, now we have two prigroup values (for S and NS)
226      * we can't do the loop comparison on raw priority values.
227      */
228     for (i = 1; i < s->num_irq; i++) {
229         for (bank = M_REG_S; bank >= M_REG_NS; bank--) {
230             VecInfo *vec;
231             int prio, subprio;
232             bool targets_secure;
233 
234             if (bank == M_REG_S) {
235                 if (!exc_is_banked(i)) {
236                     continue;
237                 }
238                 vec = &s->sec_vectors[i];
239                 targets_secure = true;
240             } else {
241                 vec = &s->vectors[i];
242                 targets_secure = !exc_is_banked(i) && exc_targets_secure(s, i);
243             }
244 
245             prio = exc_group_prio(s, vec->prio, targets_secure);
246             subprio = vec->prio & ~nvic_gprio_mask(s, targets_secure);
247             if (vec->enabled && vec->pending &&
248                 ((prio < pend_prio) ||
249                  (prio == pend_prio && prio >= 0 && subprio < pend_subprio))) {
250                 pend_prio = prio;
251                 pend_subprio = subprio;
252                 pend_irq = i;
253                 pending_is_s_banked = (bank == M_REG_S);
254             }
255             if (vec->active && prio < active_prio) {
256                 active_prio = prio;
257             }
258         }
259     }
260 
261     s->vectpending_is_s_banked = pending_is_s_banked;
262     s->vectpending = pend_irq;
263     s->vectpending_prio = pend_prio;
264     s->exception_prio = active_prio;
265 
266     trace_nvic_recompute_state_secure(s->vectpending,
267                                       s->vectpending_is_s_banked,
268                                       s->vectpending_prio,
269                                       s->exception_prio);
270 }
271 
272 /* Recompute vectpending and exception_prio */
273 static void nvic_recompute_state(NVICState *s)
274 {
275     int i;
276     int pend_prio = NVIC_NOEXC_PRIO;
277     int active_prio = NVIC_NOEXC_PRIO;
278     int pend_irq = 0;
279 
280     /* In theory we could write one function that handled both
281      * the "security extension present" and "not present"; however
282      * the security related changes significantly complicate the
283      * recomputation just by themselves and mixing both cases together
284      * would be even worse, so we retain a separate non-secure-only
285      * version for CPUs which don't implement the security extension.
286      */
287     if (arm_feature(&s->cpu->env, ARM_FEATURE_M_SECURITY)) {
288         nvic_recompute_state_secure(s);
289         return;
290     }
291 
292     for (i = 1; i < s->num_irq; i++) {
293         VecInfo *vec = &s->vectors[i];
294 
295         if (vec->enabled && vec->pending && vec->prio < pend_prio) {
296             pend_prio = vec->prio;
297             pend_irq = i;
298         }
299         if (vec->active && vec->prio < active_prio) {
300             active_prio = vec->prio;
301         }
302     }
303 
304     if (active_prio > 0) {
305         active_prio &= nvic_gprio_mask(s, false);
306     }
307 
308     if (pend_prio > 0) {
309         pend_prio &= nvic_gprio_mask(s, false);
310     }
311 
312     s->vectpending = pend_irq;
313     s->vectpending_prio = pend_prio;
314     s->exception_prio = active_prio;
315 
316     trace_nvic_recompute_state(s->vectpending,
317                                s->vectpending_prio,
318                                s->exception_prio);
319 }
320 
321 /* Return the current execution priority of the CPU
322  * (equivalent to the pseudocode ExecutionPriority function).
323  * This is a value between -2 (NMI priority) and NVIC_NOEXC_PRIO.
324  */
325 static inline int nvic_exec_prio(NVICState *s)
326 {
327     CPUARMState *env = &s->cpu->env;
328     int running = NVIC_NOEXC_PRIO;
329 
330     if (env->v7m.basepri[M_REG_NS] > 0) {
331         running = exc_group_prio(s, env->v7m.basepri[M_REG_NS], M_REG_NS);
332     }
333 
334     if (env->v7m.basepri[M_REG_S] > 0) {
335         int basepri = exc_group_prio(s, env->v7m.basepri[M_REG_S], M_REG_S);
336         if (running > basepri) {
337             running = basepri;
338         }
339     }
340 
341     if (env->v7m.primask[M_REG_NS]) {
342         if (env->v7m.aircr & R_V7M_AIRCR_PRIS_MASK) {
343             if (running > NVIC_NS_PRIO_LIMIT) {
344                 running = NVIC_NS_PRIO_LIMIT;
345             }
346         } else {
347             running = 0;
348         }
349     }
350 
351     if (env->v7m.primask[M_REG_S]) {
352         running = 0;
353     }
354 
355     if (env->v7m.faultmask[M_REG_NS]) {
356         if (env->v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK) {
357             running = -1;
358         } else {
359             if (env->v7m.aircr & R_V7M_AIRCR_PRIS_MASK) {
360                 if (running > NVIC_NS_PRIO_LIMIT) {
361                     running = NVIC_NS_PRIO_LIMIT;
362                 }
363             } else {
364                 running = 0;
365             }
366         }
367     }
368 
369     if (env->v7m.faultmask[M_REG_S]) {
370         running = (env->v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK) ? -3 : -1;
371     }
372 
373     /* consider priority of active handler */
374     return MIN(running, s->exception_prio);
375 }
376 
377 bool armv7m_nvic_neg_prio_requested(void *opaque, bool secure)
378 {
379     /* Return true if the requested execution priority is negative
380      * for the specified security state, ie that security state
381      * has an active NMI or HardFault or has set its FAULTMASK.
382      * Note that this is not the same as whether the execution
383      * priority is actually negative (for instance AIRCR.PRIS may
384      * mean we don't allow FAULTMASK_NS to actually make the execution
385      * priority negative). Compare pseudocode IsReqExcPriNeg().
386      */
387     NVICState *s = opaque;
388 
389     if (s->cpu->env.v7m.faultmask[secure]) {
390         return true;
391     }
392 
393     if (secure ? s->sec_vectors[ARMV7M_EXCP_HARD].active :
394         s->vectors[ARMV7M_EXCP_HARD].active) {
395         return true;
396     }
397 
398     if (s->vectors[ARMV7M_EXCP_NMI].active &&
399         exc_targets_secure(s, ARMV7M_EXCP_NMI) == secure) {
400         return true;
401     }
402 
403     return false;
404 }
405 
406 bool armv7m_nvic_can_take_pending_exception(void *opaque)
407 {
408     NVICState *s = opaque;
409 
410     return nvic_exec_prio(s) > nvic_pending_prio(s);
411 }
412 
413 int armv7m_nvic_raw_execution_priority(void *opaque)
414 {
415     NVICState *s = opaque;
416 
417     return s->exception_prio;
418 }
419 
420 /* caller must call nvic_irq_update() after this.
421  * secure indicates the bank to use for banked exceptions (we assert if
422  * we are passed secure=true for a non-banked exception).
423  */
424 static void set_prio(NVICState *s, unsigned irq, bool secure, uint8_t prio)
425 {
426     assert(irq > ARMV7M_EXCP_NMI); /* only use for configurable prios */
427     assert(irq < s->num_irq);
428 
429     prio &= MAKE_64BIT_MASK(8 - s->num_prio_bits, s->num_prio_bits);
430 
431     if (secure) {
432         assert(exc_is_banked(irq));
433         s->sec_vectors[irq].prio = prio;
434     } else {
435         s->vectors[irq].prio = prio;
436     }
437 
438     trace_nvic_set_prio(irq, secure, prio);
439 }
440 
441 /* Return the current raw priority register value.
442  * secure indicates the bank to use for banked exceptions (we assert if
443  * we are passed secure=true for a non-banked exception).
444  */
445 static int get_prio(NVICState *s, unsigned irq, bool secure)
446 {
447     assert(irq > ARMV7M_EXCP_NMI); /* only use for configurable prios */
448     assert(irq < s->num_irq);
449 
450     if (secure) {
451         assert(exc_is_banked(irq));
452         return s->sec_vectors[irq].prio;
453     } else {
454         return s->vectors[irq].prio;
455     }
456 }
457 
458 /* Recompute state and assert irq line accordingly.
459  * Must be called after changes to:
460  *  vec->active, vec->enabled, vec->pending or vec->prio for any vector
461  *  prigroup
462  */
463 static void nvic_irq_update(NVICState *s)
464 {
465     int lvl;
466     int pend_prio;
467 
468     nvic_recompute_state(s);
469     pend_prio = nvic_pending_prio(s);
470 
471     /* Raise NVIC output if this IRQ would be taken, except that we
472      * ignore the effects of the BASEPRI, FAULTMASK and PRIMASK (which
473      * will be checked for in arm_v7m_cpu_exec_interrupt()); changes
474      * to those CPU registers don't cause us to recalculate the NVIC
475      * pending info.
476      */
477     lvl = (pend_prio < s->exception_prio);
478     trace_nvic_irq_update(s->vectpending, pend_prio, s->exception_prio, lvl);
479     qemu_set_irq(s->excpout, lvl);
480 }
481 
482 /**
483  * armv7m_nvic_clear_pending: mark the specified exception as not pending
484  * @opaque: the NVIC
485  * @irq: the exception number to mark as not pending
486  * @secure: false for non-banked exceptions or for the nonsecure
487  * version of a banked exception, true for the secure version of a banked
488  * exception.
489  *
490  * Marks the specified exception as not pending. Note that we will assert()
491  * if @secure is true and @irq does not specify one of the fixed set
492  * of architecturally banked exceptions.
493  */
494 static void armv7m_nvic_clear_pending(void *opaque, int irq, bool secure)
495 {
496     NVICState *s = (NVICState *)opaque;
497     VecInfo *vec;
498 
499     assert(irq > ARMV7M_EXCP_RESET && irq < s->num_irq);
500 
501     if (secure) {
502         assert(exc_is_banked(irq));
503         vec = &s->sec_vectors[irq];
504     } else {
505         vec = &s->vectors[irq];
506     }
507     trace_nvic_clear_pending(irq, secure, vec->enabled, vec->prio);
508     if (vec->pending) {
509         vec->pending = 0;
510         nvic_irq_update(s);
511     }
512 }
513 
514 static void do_armv7m_nvic_set_pending(void *opaque, int irq, bool secure,
515                                        bool derived)
516 {
517     /* Pend an exception, including possibly escalating it to HardFault.
518      *
519      * This function handles both "normal" pending of interrupts and
520      * exceptions, and also derived exceptions (ones which occur as
521      * a result of trying to take some other exception).
522      *
523      * If derived == true, the caller guarantees that we are part way through
524      * trying to take an exception (but have not yet called
525      * armv7m_nvic_acknowledge_irq() to make it active), and so:
526      *  - s->vectpending is the "original exception" we were trying to take
527      *  - irq is the "derived exception"
528      *  - nvic_exec_prio(s) gives the priority before exception entry
529      * Here we handle the prioritization logic which the pseudocode puts
530      * in the DerivedLateArrival() function.
531      */
532 
533     NVICState *s = (NVICState *)opaque;
534     bool banked = exc_is_banked(irq);
535     VecInfo *vec;
536     bool targets_secure;
537 
538     assert(irq > ARMV7M_EXCP_RESET && irq < s->num_irq);
539     assert(!secure || banked);
540 
541     vec = (banked && secure) ? &s->sec_vectors[irq] : &s->vectors[irq];
542 
543     targets_secure = banked ? secure : exc_targets_secure(s, irq);
544 
545     trace_nvic_set_pending(irq, secure, targets_secure,
546                            derived, vec->enabled, vec->prio);
547 
548     if (derived) {
549         /* Derived exceptions are always synchronous. */
550         assert(irq >= ARMV7M_EXCP_HARD && irq < ARMV7M_EXCP_PENDSV);
551 
552         if (irq == ARMV7M_EXCP_DEBUG &&
553             exc_group_prio(s, vec->prio, secure) >= nvic_exec_prio(s)) {
554             /* DebugMonitorFault, but its priority is lower than the
555              * preempted exception priority: just ignore it.
556              */
557             return;
558         }
559 
560         if (irq == ARMV7M_EXCP_HARD && vec->prio >= s->vectpending_prio) {
561             /* If this is a terminal exception (one which means we cannot
562              * take the original exception, like a failure to read its
563              * vector table entry), then we must take the derived exception.
564              * If the derived exception can't take priority over the
565              * original exception, then we go into Lockup.
566              *
567              * For QEMU, we rely on the fact that a derived exception is
568              * terminal if and only if it's reported to us as HardFault,
569              * which saves having to have an extra argument is_terminal
570              * that we'd only use in one place.
571              */
572             cpu_abort(&s->cpu->parent_obj,
573                       "Lockup: can't take terminal derived exception "
574                       "(original exception priority %d)\n",
575                       s->vectpending_prio);
576         }
577         /* We now continue with the same code as for a normal pending
578          * exception, which will cause us to pend the derived exception.
579          * We'll then take either the original or the derived exception
580          * based on which is higher priority by the usual mechanism
581          * for selecting the highest priority pending interrupt.
582          */
583     }
584 
585     if (irq >= ARMV7M_EXCP_HARD && irq < ARMV7M_EXCP_PENDSV) {
586         /* If a synchronous exception is pending then it may be
587          * escalated to HardFault if:
588          *  * it is equal or lower priority to current execution
589          *  * it is disabled
590          * (ie we need to take it immediately but we can't do so).
591          * Asynchronous exceptions (and interrupts) simply remain pending.
592          *
593          * For QEMU, we don't have any imprecise (asynchronous) faults,
594          * so we can assume that PREFETCH_ABORT and DATA_ABORT are always
595          * synchronous.
596          * Debug exceptions are awkward because only Debug exceptions
597          * resulting from the BKPT instruction should be escalated,
598          * but we don't currently implement any Debug exceptions other
599          * than those that result from BKPT, so we treat all debug exceptions
600          * as needing escalation.
601          *
602          * This all means we can identify whether to escalate based only on
603          * the exception number and don't (yet) need the caller to explicitly
604          * tell us whether this exception is synchronous or not.
605          */
606         int running = nvic_exec_prio(s);
607         bool escalate = false;
608 
609         if (exc_group_prio(s, vec->prio, secure) >= running) {
610             trace_nvic_escalate_prio(irq, vec->prio, running);
611             escalate = true;
612         } else if (!vec->enabled) {
613             trace_nvic_escalate_disabled(irq);
614             escalate = true;
615         }
616 
617         if (escalate) {
618 
619             /* We need to escalate this exception to a synchronous HardFault.
620              * If BFHFNMINS is set then we escalate to the banked HF for
621              * the target security state of the original exception; otherwise
622              * we take a Secure HardFault.
623              */
624             irq = ARMV7M_EXCP_HARD;
625             if (arm_feature(&s->cpu->env, ARM_FEATURE_M_SECURITY) &&
626                 (targets_secure ||
627                  !(s->cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK))) {
628                 vec = &s->sec_vectors[irq];
629             } else {
630                 vec = &s->vectors[irq];
631             }
632             if (running <= vec->prio) {
633                 /* We want to escalate to HardFault but we can't take the
634                  * synchronous HardFault at this point either. This is a
635                  * Lockup condition due to a guest bug. We don't model
636                  * Lockup, so report via cpu_abort() instead.
637                  */
638                 cpu_abort(&s->cpu->parent_obj,
639                           "Lockup: can't escalate %d to HardFault "
640                           "(current priority %d)\n", irq, running);
641             }
642 
643             /* HF may be banked but there is only one shared HFSR */
644             s->cpu->env.v7m.hfsr |= R_V7M_HFSR_FORCED_MASK;
645         }
646     }
647 
648     if (!vec->pending) {
649         vec->pending = 1;
650         nvic_irq_update(s);
651     }
652 }
653 
654 void armv7m_nvic_set_pending(void *opaque, int irq, bool secure)
655 {
656     do_armv7m_nvic_set_pending(opaque, irq, secure, false);
657 }
658 
659 void armv7m_nvic_set_pending_derived(void *opaque, int irq, bool secure)
660 {
661     do_armv7m_nvic_set_pending(opaque, irq, secure, true);
662 }
663 
664 void armv7m_nvic_set_pending_lazyfp(void *opaque, int irq, bool secure)
665 {
666     /*
667      * Pend an exception during lazy FP stacking. This differs
668      * from the usual exception pending because the logic for
669      * whether we should escalate depends on the saved context
670      * in the FPCCR register, not on the current state of the CPU/NVIC.
671      */
672     NVICState *s = (NVICState *)opaque;
673     bool banked = exc_is_banked(irq);
674     VecInfo *vec;
675     bool targets_secure;
676     bool escalate = false;
677     /*
678      * We will only look at bits in fpccr if this is a banked exception
679      * (in which case 'secure' tells us whether it is the S or NS version).
680      * All the bits for the non-banked exceptions are in fpccr_s.
681      */
682     uint32_t fpccr_s = s->cpu->env.v7m.fpccr[M_REG_S];
683     uint32_t fpccr = s->cpu->env.v7m.fpccr[secure];
684 
685     assert(irq > ARMV7M_EXCP_RESET && irq < s->num_irq);
686     assert(!secure || banked);
687 
688     vec = (banked && secure) ? &s->sec_vectors[irq] : &s->vectors[irq];
689 
690     targets_secure = banked ? secure : exc_targets_secure(s, irq);
691 
692     switch (irq) {
693     case ARMV7M_EXCP_DEBUG:
694         if (!(fpccr_s & R_V7M_FPCCR_MONRDY_MASK)) {
695             /* Ignore DebugMonitor exception */
696             return;
697         }
698         break;
699     case ARMV7M_EXCP_MEM:
700         escalate = !(fpccr & R_V7M_FPCCR_MMRDY_MASK);
701         break;
702     case ARMV7M_EXCP_USAGE:
703         escalate = !(fpccr & R_V7M_FPCCR_UFRDY_MASK);
704         break;
705     case ARMV7M_EXCP_BUS:
706         escalate = !(fpccr_s & R_V7M_FPCCR_BFRDY_MASK);
707         break;
708     case ARMV7M_EXCP_SECURE:
709         escalate = !(fpccr_s & R_V7M_FPCCR_SFRDY_MASK);
710         break;
711     default:
712         g_assert_not_reached();
713     }
714 
715     if (escalate) {
716         /*
717          * Escalate to HardFault: faults that initially targeted Secure
718          * continue to do so, even if HF normally targets NonSecure.
719          */
720         irq = ARMV7M_EXCP_HARD;
721         if (arm_feature(&s->cpu->env, ARM_FEATURE_M_SECURITY) &&
722             (targets_secure ||
723              !(s->cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK))) {
724             vec = &s->sec_vectors[irq];
725         } else {
726             vec = &s->vectors[irq];
727         }
728     }
729 
730     if (!vec->enabled ||
731         nvic_exec_prio(s) <= exc_group_prio(s, vec->prio, secure)) {
732         if (!(fpccr_s & R_V7M_FPCCR_HFRDY_MASK)) {
733             /*
734              * We want to escalate to HardFault but the context the
735              * FP state belongs to prevents the exception pre-empting.
736              */
737             cpu_abort(&s->cpu->parent_obj,
738                       "Lockup: can't escalate to HardFault during "
739                       "lazy FP register stacking\n");
740         }
741     }
742 
743     if (escalate) {
744         s->cpu->env.v7m.hfsr |= R_V7M_HFSR_FORCED_MASK;
745     }
746     if (!vec->pending) {
747         vec->pending = 1;
748         /*
749          * We do not call nvic_irq_update(), because we know our caller
750          * is going to handle causing us to take the exception by
751          * raising EXCP_LAZYFP, so raising the IRQ line would be
752          * pointless extra work. We just need to recompute the
753          * priorities so that armv7m_nvic_can_take_pending_exception()
754          * returns the right answer.
755          */
756         nvic_recompute_state(s);
757     }
758 }
759 
760 /* Make pending IRQ active.  */
761 void armv7m_nvic_acknowledge_irq(void *opaque)
762 {
763     NVICState *s = (NVICState *)opaque;
764     CPUARMState *env = &s->cpu->env;
765     const int pending = s->vectpending;
766     const int running = nvic_exec_prio(s);
767     VecInfo *vec;
768 
769     assert(pending > ARMV7M_EXCP_RESET && pending < s->num_irq);
770 
771     if (s->vectpending_is_s_banked) {
772         vec = &s->sec_vectors[pending];
773     } else {
774         vec = &s->vectors[pending];
775     }
776 
777     assert(vec->enabled);
778     assert(vec->pending);
779 
780     assert(s->vectpending_prio < running);
781 
782     trace_nvic_acknowledge_irq(pending, s->vectpending_prio);
783 
784     vec->active = 1;
785     vec->pending = 0;
786 
787     write_v7m_exception(env, s->vectpending);
788 
789     nvic_irq_update(s);
790 }
791 
792 void armv7m_nvic_get_pending_irq_info(void *opaque,
793                                       int *pirq, bool *ptargets_secure)
794 {
795     NVICState *s = (NVICState *)opaque;
796     const int pending = s->vectpending;
797     bool targets_secure;
798 
799     assert(pending > ARMV7M_EXCP_RESET && pending < s->num_irq);
800 
801     if (s->vectpending_is_s_banked) {
802         targets_secure = true;
803     } else {
804         targets_secure = !exc_is_banked(pending) &&
805             exc_targets_secure(s, pending);
806     }
807 
808     trace_nvic_get_pending_irq_info(pending, targets_secure);
809 
810     *ptargets_secure = targets_secure;
811     *pirq = pending;
812 }
813 
814 int armv7m_nvic_complete_irq(void *opaque, int irq, bool secure)
815 {
816     NVICState *s = (NVICState *)opaque;
817     VecInfo *vec = NULL;
818     int ret;
819 
820     assert(irq > ARMV7M_EXCP_RESET && irq < s->num_irq);
821 
822     /*
823      * For negative priorities, v8M will forcibly deactivate the appropriate
824      * NMI or HardFault regardless of what interrupt we're being asked to
825      * deactivate (compare the DeActivate() pseudocode). This is a guard
826      * against software returning from NMI or HardFault with a corrupted
827      * IPSR and leaving the CPU in a negative-priority state.
828      * v7M does not do this, but simply deactivates the requested interrupt.
829      */
830     if (arm_feature(&s->cpu->env, ARM_FEATURE_V8)) {
831         switch (armv7m_nvic_raw_execution_priority(s)) {
832         case -1:
833             if (s->cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK) {
834                 vec = &s->vectors[ARMV7M_EXCP_HARD];
835             } else {
836                 vec = &s->sec_vectors[ARMV7M_EXCP_HARD];
837             }
838             break;
839         case -2:
840             vec = &s->vectors[ARMV7M_EXCP_NMI];
841             break;
842         case -3:
843             vec = &s->sec_vectors[ARMV7M_EXCP_HARD];
844             break;
845         default:
846             break;
847         }
848     }
849 
850     if (!vec) {
851         if (secure && exc_is_banked(irq)) {
852             vec = &s->sec_vectors[irq];
853         } else {
854             vec = &s->vectors[irq];
855         }
856     }
857 
858     trace_nvic_complete_irq(irq, secure);
859 
860     if (!vec->active) {
861         /* Tell the caller this was an illegal exception return */
862         return -1;
863     }
864 
865     /*
866      * If this is a configurable exception and it is currently
867      * targeting the opposite security state from the one we're trying
868      * to complete it for, this counts as an illegal exception return.
869      * We still need to deactivate whatever vector the logic above has
870      * selected, though, as it might not be the same as the one for the
871      * requested exception number.
872      */
873     if (!exc_is_banked(irq) && exc_targets_secure(s, irq) != secure) {
874         ret = -1;
875     } else {
876         ret = nvic_rettobase(s);
877     }
878 
879     vec->active = 0;
880     if (vec->level) {
881         /* Re-pend the exception if it's still held high; only
882          * happens for extenal IRQs
883          */
884         assert(irq >= NVIC_FIRST_IRQ);
885         vec->pending = 1;
886     }
887 
888     nvic_irq_update(s);
889 
890     return ret;
891 }
892 
893 bool armv7m_nvic_get_ready_status(void *opaque, int irq, bool secure)
894 {
895     /*
896      * Return whether an exception is "ready", i.e. it is enabled and is
897      * configured at a priority which would allow it to interrupt the
898      * current execution priority.
899      *
900      * irq and secure have the same semantics as for armv7m_nvic_set_pending():
901      * for non-banked exceptions secure is always false; for banked exceptions
902      * it indicates which of the exceptions is required.
903      */
904     NVICState *s = (NVICState *)opaque;
905     bool banked = exc_is_banked(irq);
906     VecInfo *vec;
907     int running = nvic_exec_prio(s);
908 
909     assert(irq > ARMV7M_EXCP_RESET && irq < s->num_irq);
910     assert(!secure || banked);
911 
912     /*
913      * HardFault is an odd special case: we always check against -1,
914      * even if we're secure and HardFault has priority -3; we never
915      * need to check for enabled state.
916      */
917     if (irq == ARMV7M_EXCP_HARD) {
918         return running > -1;
919     }
920 
921     vec = (banked && secure) ? &s->sec_vectors[irq] : &s->vectors[irq];
922 
923     return vec->enabled &&
924         exc_group_prio(s, vec->prio, secure) < running;
925 }
926 
927 /* callback when external interrupt line is changed */
928 static void set_irq_level(void *opaque, int n, int level)
929 {
930     NVICState *s = opaque;
931     VecInfo *vec;
932 
933     n += NVIC_FIRST_IRQ;
934 
935     assert(n >= NVIC_FIRST_IRQ && n < s->num_irq);
936 
937     trace_nvic_set_irq_level(n, level);
938 
939     /* The pending status of an external interrupt is
940      * latched on rising edge and exception handler return.
941      *
942      * Pulsing the IRQ will always run the handler
943      * once, and the handler will re-run until the
944      * level is low when the handler completes.
945      */
946     vec = &s->vectors[n];
947     if (level != vec->level) {
948         vec->level = level;
949         if (level) {
950             armv7m_nvic_set_pending(s, n, false);
951         }
952     }
953 }
954 
955 /* callback when external NMI line is changed */
956 static void nvic_nmi_trigger(void *opaque, int n, int level)
957 {
958     NVICState *s = opaque;
959 
960     trace_nvic_set_nmi_level(level);
961 
962     /*
963      * The architecture doesn't specify whether NMI should share
964      * the normal-interrupt behaviour of being resampled on
965      * exception handler return. We choose not to, so just
966      * set NMI pending here and don't track the current level.
967      */
968     if (level) {
969         armv7m_nvic_set_pending(s, ARMV7M_EXCP_NMI, false);
970     }
971 }
972 
973 static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
974 {
975     ARMCPU *cpu = s->cpu;
976     uint32_t val;
977 
978     switch (offset) {
979     case 4: /* Interrupt Control Type.  */
980         if (!arm_feature(&cpu->env, ARM_FEATURE_V7)) {
981             goto bad_offset;
982         }
983         return ((s->num_irq - NVIC_FIRST_IRQ) / 32) - 1;
984     case 0xc: /* CPPWR */
985         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
986             goto bad_offset;
987         }
988         /* We make the IMPDEF choice that nothing can ever go into a
989          * non-retentive power state, which allows us to RAZ/WI this.
990          */
991         return 0;
992     case 0x380 ... 0x3bf: /* NVIC_ITNS<n> */
993     {
994         int startvec = 8 * (offset - 0x380) + NVIC_FIRST_IRQ;
995         int i;
996 
997         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
998             goto bad_offset;
999         }
1000         if (!attrs.secure) {
1001             return 0;
1002         }
1003         val = 0;
1004         for (i = 0; i < 32 && startvec + i < s->num_irq; i++) {
1005             if (s->itns[startvec + i]) {
1006                 val |= (1 << i);
1007             }
1008         }
1009         return val;
1010     }
1011     case 0xd00: /* CPUID Base.  */
1012         return cpu->midr;
1013     case 0xd04: /* Interrupt Control State (ICSR) */
1014         /* VECTACTIVE */
1015         val = cpu->env.v7m.exception;
1016         /* VECTPENDING */
1017         val |= (s->vectpending & 0xff) << 12;
1018         /* ISRPENDING - set if any external IRQ is pending */
1019         if (nvic_isrpending(s)) {
1020             val |= (1 << 22);
1021         }
1022         /* RETTOBASE - set if only one handler is active */
1023         if (nvic_rettobase(s)) {
1024             val |= (1 << 11);
1025         }
1026         if (attrs.secure) {
1027             /* PENDSTSET */
1028             if (s->sec_vectors[ARMV7M_EXCP_SYSTICK].pending) {
1029                 val |= (1 << 26);
1030             }
1031             /* PENDSVSET */
1032             if (s->sec_vectors[ARMV7M_EXCP_PENDSV].pending) {
1033                 val |= (1 << 28);
1034             }
1035         } else {
1036             /* PENDSTSET */
1037             if (s->vectors[ARMV7M_EXCP_SYSTICK].pending) {
1038                 val |= (1 << 26);
1039             }
1040             /* PENDSVSET */
1041             if (s->vectors[ARMV7M_EXCP_PENDSV].pending) {
1042                 val |= (1 << 28);
1043             }
1044         }
1045         /* NMIPENDSET */
1046         if ((attrs.secure || (cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK))
1047             && s->vectors[ARMV7M_EXCP_NMI].pending) {
1048             val |= (1 << 31);
1049         }
1050         /* ISRPREEMPT: RES0 when halting debug not implemented */
1051         /* STTNS: RES0 for the Main Extension */
1052         return val;
1053     case 0xd08: /* Vector Table Offset.  */
1054         return cpu->env.v7m.vecbase[attrs.secure];
1055     case 0xd0c: /* Application Interrupt/Reset Control (AIRCR) */
1056         val = 0xfa050000 | (s->prigroup[attrs.secure] << 8);
1057         if (attrs.secure) {
1058             /* s->aircr stores PRIS, BFHFNMINS, SYSRESETREQS */
1059             val |= cpu->env.v7m.aircr;
1060         } else {
1061             if (arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1062                 /* BFHFNMINS is R/O from NS; other bits are RAZ/WI. If
1063                  * security isn't supported then BFHFNMINS is RAO (and
1064                  * the bit in env.v7m.aircr is always set).
1065                  */
1066                 val |= cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK;
1067             }
1068         }
1069         return val;
1070     case 0xd10: /* System Control.  */
1071         if (!arm_feature(&cpu->env, ARM_FEATURE_V7)) {
1072             goto bad_offset;
1073         }
1074         return cpu->env.v7m.scr[attrs.secure];
1075     case 0xd14: /* Configuration Control.  */
1076         /* The BFHFNMIGN bit is the only non-banked bit; we
1077          * keep it in the non-secure copy of the register.
1078          */
1079         val = cpu->env.v7m.ccr[attrs.secure];
1080         val |= cpu->env.v7m.ccr[M_REG_NS] & R_V7M_CCR_BFHFNMIGN_MASK;
1081         return val;
1082     case 0xd24: /* System Handler Control and State (SHCSR) */
1083         if (!arm_feature(&cpu->env, ARM_FEATURE_V7)) {
1084             goto bad_offset;
1085         }
1086         val = 0;
1087         if (attrs.secure) {
1088             if (s->sec_vectors[ARMV7M_EXCP_MEM].active) {
1089                 val |= (1 << 0);
1090             }
1091             if (s->sec_vectors[ARMV7M_EXCP_HARD].active) {
1092                 val |= (1 << 2);
1093             }
1094             if (s->sec_vectors[ARMV7M_EXCP_USAGE].active) {
1095                 val |= (1 << 3);
1096             }
1097             if (s->sec_vectors[ARMV7M_EXCP_SVC].active) {
1098                 val |= (1 << 7);
1099             }
1100             if (s->sec_vectors[ARMV7M_EXCP_PENDSV].active) {
1101                 val |= (1 << 10);
1102             }
1103             if (s->sec_vectors[ARMV7M_EXCP_SYSTICK].active) {
1104                 val |= (1 << 11);
1105             }
1106             if (s->sec_vectors[ARMV7M_EXCP_USAGE].pending) {
1107                 val |= (1 << 12);
1108             }
1109             if (s->sec_vectors[ARMV7M_EXCP_MEM].pending) {
1110                 val |= (1 << 13);
1111             }
1112             if (s->sec_vectors[ARMV7M_EXCP_SVC].pending) {
1113                 val |= (1 << 15);
1114             }
1115             if (s->sec_vectors[ARMV7M_EXCP_MEM].enabled) {
1116                 val |= (1 << 16);
1117             }
1118             if (s->sec_vectors[ARMV7M_EXCP_USAGE].enabled) {
1119                 val |= (1 << 18);
1120             }
1121             if (s->sec_vectors[ARMV7M_EXCP_HARD].pending) {
1122                 val |= (1 << 21);
1123             }
1124             /* SecureFault is not banked but is always RAZ/WI to NS */
1125             if (s->vectors[ARMV7M_EXCP_SECURE].active) {
1126                 val |= (1 << 4);
1127             }
1128             if (s->vectors[ARMV7M_EXCP_SECURE].enabled) {
1129                 val |= (1 << 19);
1130             }
1131             if (s->vectors[ARMV7M_EXCP_SECURE].pending) {
1132                 val |= (1 << 20);
1133             }
1134         } else {
1135             if (s->vectors[ARMV7M_EXCP_MEM].active) {
1136                 val |= (1 << 0);
1137             }
1138             if (arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1139                 /* HARDFAULTACT, HARDFAULTPENDED not present in v7M */
1140                 if (s->vectors[ARMV7M_EXCP_HARD].active) {
1141                     val |= (1 << 2);
1142                 }
1143                 if (s->vectors[ARMV7M_EXCP_HARD].pending) {
1144                     val |= (1 << 21);
1145                 }
1146             }
1147             if (s->vectors[ARMV7M_EXCP_USAGE].active) {
1148                 val |= (1 << 3);
1149             }
1150             if (s->vectors[ARMV7M_EXCP_SVC].active) {
1151                 val |= (1 << 7);
1152             }
1153             if (s->vectors[ARMV7M_EXCP_PENDSV].active) {
1154                 val |= (1 << 10);
1155             }
1156             if (s->vectors[ARMV7M_EXCP_SYSTICK].active) {
1157                 val |= (1 << 11);
1158             }
1159             if (s->vectors[ARMV7M_EXCP_USAGE].pending) {
1160                 val |= (1 << 12);
1161             }
1162             if (s->vectors[ARMV7M_EXCP_MEM].pending) {
1163                 val |= (1 << 13);
1164             }
1165             if (s->vectors[ARMV7M_EXCP_SVC].pending) {
1166                 val |= (1 << 15);
1167             }
1168             if (s->vectors[ARMV7M_EXCP_MEM].enabled) {
1169                 val |= (1 << 16);
1170             }
1171             if (s->vectors[ARMV7M_EXCP_USAGE].enabled) {
1172                 val |= (1 << 18);
1173             }
1174         }
1175         if (attrs.secure || (cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK)) {
1176             if (s->vectors[ARMV7M_EXCP_BUS].active) {
1177                 val |= (1 << 1);
1178             }
1179             if (s->vectors[ARMV7M_EXCP_BUS].pending) {
1180                 val |= (1 << 14);
1181             }
1182             if (s->vectors[ARMV7M_EXCP_BUS].enabled) {
1183                 val |= (1 << 17);
1184             }
1185             if (arm_feature(&cpu->env, ARM_FEATURE_V8) &&
1186                 s->vectors[ARMV7M_EXCP_NMI].active) {
1187                 /* NMIACT is not present in v7M */
1188                 val |= (1 << 5);
1189             }
1190         }
1191 
1192         /* TODO: this is RAZ/WI from NS if DEMCR.SDME is set */
1193         if (s->vectors[ARMV7M_EXCP_DEBUG].active) {
1194             val |= (1 << 8);
1195         }
1196         return val;
1197     case 0xd2c: /* Hard Fault Status.  */
1198         if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
1199             goto bad_offset;
1200         }
1201         return cpu->env.v7m.hfsr;
1202     case 0xd30: /* Debug Fault Status.  */
1203         return cpu->env.v7m.dfsr;
1204     case 0xd34: /* MMFAR MemManage Fault Address */
1205         if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
1206             goto bad_offset;
1207         }
1208         return cpu->env.v7m.mmfar[attrs.secure];
1209     case 0xd38: /* Bus Fault Address.  */
1210         if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
1211             goto bad_offset;
1212         }
1213         if (!attrs.secure &&
1214             !(s->cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK)) {
1215             return 0;
1216         }
1217         return cpu->env.v7m.bfar;
1218     case 0xd3c: /* Aux Fault Status.  */
1219         /* TODO: Implement fault status registers.  */
1220         qemu_log_mask(LOG_UNIMP,
1221                       "Aux Fault status registers unimplemented\n");
1222         return 0;
1223     case 0xd40: /* PFR0.  */
1224         return cpu->id_pfr0;
1225     case 0xd44: /* PFR1.  */
1226         return cpu->id_pfr1;
1227     case 0xd48: /* DFR0.  */
1228         return cpu->id_dfr0;
1229     case 0xd4c: /* AFR0.  */
1230         return cpu->id_afr0;
1231     case 0xd50: /* MMFR0.  */
1232         return cpu->id_mmfr0;
1233     case 0xd54: /* MMFR1.  */
1234         return cpu->id_mmfr1;
1235     case 0xd58: /* MMFR2.  */
1236         return cpu->id_mmfr2;
1237     case 0xd5c: /* MMFR3.  */
1238         return cpu->id_mmfr3;
1239     case 0xd60: /* ISAR0.  */
1240         return cpu->isar.id_isar0;
1241     case 0xd64: /* ISAR1.  */
1242         return cpu->isar.id_isar1;
1243     case 0xd68: /* ISAR2.  */
1244         return cpu->isar.id_isar2;
1245     case 0xd6c: /* ISAR3.  */
1246         return cpu->isar.id_isar3;
1247     case 0xd70: /* ISAR4.  */
1248         return cpu->isar.id_isar4;
1249     case 0xd74: /* ISAR5.  */
1250         return cpu->isar.id_isar5;
1251     case 0xd78: /* CLIDR */
1252         return cpu->clidr;
1253     case 0xd7c: /* CTR */
1254         return cpu->ctr;
1255     case 0xd80: /* CSSIDR */
1256     {
1257         int idx = cpu->env.v7m.csselr[attrs.secure] & R_V7M_CSSELR_INDEX_MASK;
1258         return cpu->ccsidr[idx];
1259     }
1260     case 0xd84: /* CSSELR */
1261         return cpu->env.v7m.csselr[attrs.secure];
1262     case 0xd88: /* CPACR */
1263         if (!arm_feature(&cpu->env, ARM_FEATURE_VFP)) {
1264             return 0;
1265         }
1266         return cpu->env.v7m.cpacr[attrs.secure];
1267     case 0xd8c: /* NSACR */
1268         if (!attrs.secure || !arm_feature(&cpu->env, ARM_FEATURE_VFP)) {
1269             return 0;
1270         }
1271         return cpu->env.v7m.nsacr;
1272     /* TODO: Implement debug registers.  */
1273     case 0xd90: /* MPU_TYPE */
1274         /* Unified MPU; if the MPU is not present this value is zero */
1275         return cpu->pmsav7_dregion << 8;
1276         break;
1277     case 0xd94: /* MPU_CTRL */
1278         return cpu->env.v7m.mpu_ctrl[attrs.secure];
1279     case 0xd98: /* MPU_RNR */
1280         return cpu->env.pmsav7.rnr[attrs.secure];
1281     case 0xd9c: /* MPU_RBAR */
1282     case 0xda4: /* MPU_RBAR_A1 */
1283     case 0xdac: /* MPU_RBAR_A2 */
1284     case 0xdb4: /* MPU_RBAR_A3 */
1285     {
1286         int region = cpu->env.pmsav7.rnr[attrs.secure];
1287 
1288         if (arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1289             /* PMSAv8M handling of the aliases is different from v7M:
1290              * aliases A1, A2, A3 override the low two bits of the region
1291              * number in MPU_RNR, and there is no 'region' field in the
1292              * RBAR register.
1293              */
1294             int aliasno = (offset - 0xd9c) / 8; /* 0..3 */
1295             if (aliasno) {
1296                 region = deposit32(region, 0, 2, aliasno);
1297             }
1298             if (region >= cpu->pmsav7_dregion) {
1299                 return 0;
1300             }
1301             return cpu->env.pmsav8.rbar[attrs.secure][region];
1302         }
1303 
1304         if (region >= cpu->pmsav7_dregion) {
1305             return 0;
1306         }
1307         return (cpu->env.pmsav7.drbar[region] & ~0x1f) | (region & 0xf);
1308     }
1309     case 0xda0: /* MPU_RASR (v7M), MPU_RLAR (v8M) */
1310     case 0xda8: /* MPU_RASR_A1 (v7M), MPU_RLAR_A1 (v8M) */
1311     case 0xdb0: /* MPU_RASR_A2 (v7M), MPU_RLAR_A2 (v8M) */
1312     case 0xdb8: /* MPU_RASR_A3 (v7M), MPU_RLAR_A3 (v8M) */
1313     {
1314         int region = cpu->env.pmsav7.rnr[attrs.secure];
1315 
1316         if (arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1317             /* PMSAv8M handling of the aliases is different from v7M:
1318              * aliases A1, A2, A3 override the low two bits of the region
1319              * number in MPU_RNR.
1320              */
1321             int aliasno = (offset - 0xda0) / 8; /* 0..3 */
1322             if (aliasno) {
1323                 region = deposit32(region, 0, 2, aliasno);
1324             }
1325             if (region >= cpu->pmsav7_dregion) {
1326                 return 0;
1327             }
1328             return cpu->env.pmsav8.rlar[attrs.secure][region];
1329         }
1330 
1331         if (region >= cpu->pmsav7_dregion) {
1332             return 0;
1333         }
1334         return ((cpu->env.pmsav7.dracr[region] & 0xffff) << 16) |
1335             (cpu->env.pmsav7.drsr[region] & 0xffff);
1336     }
1337     case 0xdc0: /* MPU_MAIR0 */
1338         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1339             goto bad_offset;
1340         }
1341         return cpu->env.pmsav8.mair0[attrs.secure];
1342     case 0xdc4: /* MPU_MAIR1 */
1343         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1344             goto bad_offset;
1345         }
1346         return cpu->env.pmsav8.mair1[attrs.secure];
1347     case 0xdd0: /* SAU_CTRL */
1348         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1349             goto bad_offset;
1350         }
1351         if (!attrs.secure) {
1352             return 0;
1353         }
1354         return cpu->env.sau.ctrl;
1355     case 0xdd4: /* SAU_TYPE */
1356         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1357             goto bad_offset;
1358         }
1359         if (!attrs.secure) {
1360             return 0;
1361         }
1362         return cpu->sau_sregion;
1363     case 0xdd8: /* SAU_RNR */
1364         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1365             goto bad_offset;
1366         }
1367         if (!attrs.secure) {
1368             return 0;
1369         }
1370         return cpu->env.sau.rnr;
1371     case 0xddc: /* SAU_RBAR */
1372     {
1373         int region = cpu->env.sau.rnr;
1374 
1375         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1376             goto bad_offset;
1377         }
1378         if (!attrs.secure) {
1379             return 0;
1380         }
1381         if (region >= cpu->sau_sregion) {
1382             return 0;
1383         }
1384         return cpu->env.sau.rbar[region];
1385     }
1386     case 0xde0: /* SAU_RLAR */
1387     {
1388         int region = cpu->env.sau.rnr;
1389 
1390         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1391             goto bad_offset;
1392         }
1393         if (!attrs.secure) {
1394             return 0;
1395         }
1396         if (region >= cpu->sau_sregion) {
1397             return 0;
1398         }
1399         return cpu->env.sau.rlar[region];
1400     }
1401     case 0xde4: /* SFSR */
1402         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1403             goto bad_offset;
1404         }
1405         if (!attrs.secure) {
1406             return 0;
1407         }
1408         return cpu->env.v7m.sfsr;
1409     case 0xde8: /* SFAR */
1410         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1411             goto bad_offset;
1412         }
1413         if (!attrs.secure) {
1414             return 0;
1415         }
1416         return cpu->env.v7m.sfar;
1417     case 0xf34: /* FPCCR */
1418         if (!arm_feature(&cpu->env, ARM_FEATURE_VFP)) {
1419             return 0;
1420         }
1421         if (attrs.secure) {
1422             return cpu->env.v7m.fpccr[M_REG_S];
1423         } else {
1424             /*
1425              * NS can read LSPEN, CLRONRET and MONRDY. It can read
1426              * BFRDY and HFRDY if AIRCR.BFHFNMINS != 0;
1427              * other non-banked bits RAZ.
1428              * TODO: MONRDY should RAZ/WI if DEMCR.SDME is set.
1429              */
1430             uint32_t value = cpu->env.v7m.fpccr[M_REG_S];
1431             uint32_t mask = R_V7M_FPCCR_LSPEN_MASK |
1432                 R_V7M_FPCCR_CLRONRET_MASK |
1433                 R_V7M_FPCCR_MONRDY_MASK;
1434 
1435             if (s->cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK) {
1436                 mask |= R_V7M_FPCCR_BFRDY_MASK | R_V7M_FPCCR_HFRDY_MASK;
1437             }
1438 
1439             value &= mask;
1440 
1441             value |= cpu->env.v7m.fpccr[M_REG_NS];
1442             return value;
1443         }
1444     case 0xf38: /* FPCAR */
1445         if (!arm_feature(&cpu->env, ARM_FEATURE_VFP)) {
1446             return 0;
1447         }
1448         return cpu->env.v7m.fpcar[attrs.secure];
1449     case 0xf3c: /* FPDSCR */
1450         if (!arm_feature(&cpu->env, ARM_FEATURE_VFP)) {
1451             return 0;
1452         }
1453         return cpu->env.v7m.fpdscr[attrs.secure];
1454     case 0xf40: /* MVFR0 */
1455         return cpu->isar.mvfr0;
1456     case 0xf44: /* MVFR1 */
1457         return cpu->isar.mvfr1;
1458     case 0xf48: /* MVFR2 */
1459         return cpu->isar.mvfr2;
1460     default:
1461     bad_offset:
1462         qemu_log_mask(LOG_GUEST_ERROR, "NVIC: Bad read offset 0x%x\n", offset);
1463         return 0;
1464     }
1465 }
1466 
1467 static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value,
1468                         MemTxAttrs attrs)
1469 {
1470     ARMCPU *cpu = s->cpu;
1471 
1472     switch (offset) {
1473     case 0xc: /* CPPWR */
1474         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1475             goto bad_offset;
1476         }
1477         /* Make the IMPDEF choice to RAZ/WI this. */
1478         break;
1479     case 0x380 ... 0x3bf: /* NVIC_ITNS<n> */
1480     {
1481         int startvec = 8 * (offset - 0x380) + NVIC_FIRST_IRQ;
1482         int i;
1483 
1484         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1485             goto bad_offset;
1486         }
1487         if (!attrs.secure) {
1488             break;
1489         }
1490         for (i = 0; i < 32 && startvec + i < s->num_irq; i++) {
1491             s->itns[startvec + i] = (value >> i) & 1;
1492         }
1493         nvic_irq_update(s);
1494         break;
1495     }
1496     case 0xd04: /* Interrupt Control State (ICSR) */
1497         if (attrs.secure || cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK) {
1498             if (value & (1 << 31)) {
1499                 armv7m_nvic_set_pending(s, ARMV7M_EXCP_NMI, false);
1500             } else if (value & (1 << 30) &&
1501                        arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1502                 /* PENDNMICLR didn't exist in v7M */
1503                 armv7m_nvic_clear_pending(s, ARMV7M_EXCP_NMI, false);
1504             }
1505         }
1506         if (value & (1 << 28)) {
1507             armv7m_nvic_set_pending(s, ARMV7M_EXCP_PENDSV, attrs.secure);
1508         } else if (value & (1 << 27)) {
1509             armv7m_nvic_clear_pending(s, ARMV7M_EXCP_PENDSV, attrs.secure);
1510         }
1511         if (value & (1 << 26)) {
1512             armv7m_nvic_set_pending(s, ARMV7M_EXCP_SYSTICK, attrs.secure);
1513         } else if (value & (1 << 25)) {
1514             armv7m_nvic_clear_pending(s, ARMV7M_EXCP_SYSTICK, attrs.secure);
1515         }
1516         break;
1517     case 0xd08: /* Vector Table Offset.  */
1518         cpu->env.v7m.vecbase[attrs.secure] = value & 0xffffff80;
1519         break;
1520     case 0xd0c: /* Application Interrupt/Reset Control (AIRCR) */
1521         if ((value >> R_V7M_AIRCR_VECTKEY_SHIFT) == 0x05fa) {
1522             if (value & R_V7M_AIRCR_SYSRESETREQ_MASK) {
1523                 if (attrs.secure ||
1524                     !(cpu->env.v7m.aircr & R_V7M_AIRCR_SYSRESETREQS_MASK)) {
1525                     qemu_irq_pulse(s->sysresetreq);
1526                 }
1527             }
1528             if (value & R_V7M_AIRCR_VECTCLRACTIVE_MASK) {
1529                 qemu_log_mask(LOG_GUEST_ERROR,
1530                               "Setting VECTCLRACTIVE when not in DEBUG mode "
1531                               "is UNPREDICTABLE\n");
1532             }
1533             if (value & R_V7M_AIRCR_VECTRESET_MASK) {
1534                 /* NB: this bit is RES0 in v8M */
1535                 qemu_log_mask(LOG_GUEST_ERROR,
1536                               "Setting VECTRESET when not in DEBUG mode "
1537                               "is UNPREDICTABLE\n");
1538             }
1539             if (arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
1540                 s->prigroup[attrs.secure] =
1541                     extract32(value,
1542                               R_V7M_AIRCR_PRIGROUP_SHIFT,
1543                               R_V7M_AIRCR_PRIGROUP_LENGTH);
1544             }
1545             if (attrs.secure) {
1546                 /* These bits are only writable by secure */
1547                 cpu->env.v7m.aircr = value &
1548                     (R_V7M_AIRCR_SYSRESETREQS_MASK |
1549                      R_V7M_AIRCR_BFHFNMINS_MASK |
1550                      R_V7M_AIRCR_PRIS_MASK);
1551                 /* BFHFNMINS changes the priority of Secure HardFault, and
1552                  * allows a pending Non-secure HardFault to preempt (which
1553                  * we implement by marking it enabled).
1554                  */
1555                 if (cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK) {
1556                     s->sec_vectors[ARMV7M_EXCP_HARD].prio = -3;
1557                     s->vectors[ARMV7M_EXCP_HARD].enabled = 1;
1558                 } else {
1559                     s->sec_vectors[ARMV7M_EXCP_HARD].prio = -1;
1560                     s->vectors[ARMV7M_EXCP_HARD].enabled = 0;
1561                 }
1562             }
1563             nvic_irq_update(s);
1564         }
1565         break;
1566     case 0xd10: /* System Control.  */
1567         if (!arm_feature(&cpu->env, ARM_FEATURE_V7)) {
1568             goto bad_offset;
1569         }
1570         /* We don't implement deep-sleep so these bits are RAZ/WI.
1571          * The other bits in the register are banked.
1572          * QEMU's implementation ignores SEVONPEND and SLEEPONEXIT, which
1573          * is architecturally permitted.
1574          */
1575         value &= ~(R_V7M_SCR_SLEEPDEEP_MASK | R_V7M_SCR_SLEEPDEEPS_MASK);
1576         cpu->env.v7m.scr[attrs.secure] = value;
1577         break;
1578     case 0xd14: /* Configuration Control.  */
1579         if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
1580             goto bad_offset;
1581         }
1582 
1583         /* Enforce RAZ/WI on reserved and must-RAZ/WI bits */
1584         value &= (R_V7M_CCR_STKALIGN_MASK |
1585                   R_V7M_CCR_BFHFNMIGN_MASK |
1586                   R_V7M_CCR_DIV_0_TRP_MASK |
1587                   R_V7M_CCR_UNALIGN_TRP_MASK |
1588                   R_V7M_CCR_USERSETMPEND_MASK |
1589                   R_V7M_CCR_NONBASETHRDENA_MASK);
1590 
1591         if (arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1592             /* v8M makes NONBASETHRDENA and STKALIGN be RES1 */
1593             value |= R_V7M_CCR_NONBASETHRDENA_MASK
1594                 | R_V7M_CCR_STKALIGN_MASK;
1595         }
1596         if (attrs.secure) {
1597             /* the BFHFNMIGN bit is not banked; keep that in the NS copy */
1598             cpu->env.v7m.ccr[M_REG_NS] =
1599                 (cpu->env.v7m.ccr[M_REG_NS] & ~R_V7M_CCR_BFHFNMIGN_MASK)
1600                 | (value & R_V7M_CCR_BFHFNMIGN_MASK);
1601             value &= ~R_V7M_CCR_BFHFNMIGN_MASK;
1602         }
1603 
1604         cpu->env.v7m.ccr[attrs.secure] = value;
1605         break;
1606     case 0xd24: /* System Handler Control and State (SHCSR) */
1607         if (!arm_feature(&cpu->env, ARM_FEATURE_V7)) {
1608             goto bad_offset;
1609         }
1610         if (attrs.secure) {
1611             s->sec_vectors[ARMV7M_EXCP_MEM].active = (value & (1 << 0)) != 0;
1612             /* Secure HardFault active bit cannot be written */
1613             s->sec_vectors[ARMV7M_EXCP_USAGE].active = (value & (1 << 3)) != 0;
1614             s->sec_vectors[ARMV7M_EXCP_SVC].active = (value & (1 << 7)) != 0;
1615             s->sec_vectors[ARMV7M_EXCP_PENDSV].active =
1616                 (value & (1 << 10)) != 0;
1617             s->sec_vectors[ARMV7M_EXCP_SYSTICK].active =
1618                 (value & (1 << 11)) != 0;
1619             s->sec_vectors[ARMV7M_EXCP_USAGE].pending =
1620                 (value & (1 << 12)) != 0;
1621             s->sec_vectors[ARMV7M_EXCP_MEM].pending = (value & (1 << 13)) != 0;
1622             s->sec_vectors[ARMV7M_EXCP_SVC].pending = (value & (1 << 15)) != 0;
1623             s->sec_vectors[ARMV7M_EXCP_MEM].enabled = (value & (1 << 16)) != 0;
1624             s->sec_vectors[ARMV7M_EXCP_BUS].enabled = (value & (1 << 17)) != 0;
1625             s->sec_vectors[ARMV7M_EXCP_USAGE].enabled =
1626                 (value & (1 << 18)) != 0;
1627             s->sec_vectors[ARMV7M_EXCP_HARD].pending = (value & (1 << 21)) != 0;
1628             /* SecureFault not banked, but RAZ/WI to NS */
1629             s->vectors[ARMV7M_EXCP_SECURE].active = (value & (1 << 4)) != 0;
1630             s->vectors[ARMV7M_EXCP_SECURE].enabled = (value & (1 << 19)) != 0;
1631             s->vectors[ARMV7M_EXCP_SECURE].pending = (value & (1 << 20)) != 0;
1632         } else {
1633             s->vectors[ARMV7M_EXCP_MEM].active = (value & (1 << 0)) != 0;
1634             if (arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1635                 /* HARDFAULTPENDED is not present in v7M */
1636                 s->vectors[ARMV7M_EXCP_HARD].pending = (value & (1 << 21)) != 0;
1637             }
1638             s->vectors[ARMV7M_EXCP_USAGE].active = (value & (1 << 3)) != 0;
1639             s->vectors[ARMV7M_EXCP_SVC].active = (value & (1 << 7)) != 0;
1640             s->vectors[ARMV7M_EXCP_PENDSV].active = (value & (1 << 10)) != 0;
1641             s->vectors[ARMV7M_EXCP_SYSTICK].active = (value & (1 << 11)) != 0;
1642             s->vectors[ARMV7M_EXCP_USAGE].pending = (value & (1 << 12)) != 0;
1643             s->vectors[ARMV7M_EXCP_MEM].pending = (value & (1 << 13)) != 0;
1644             s->vectors[ARMV7M_EXCP_SVC].pending = (value & (1 << 15)) != 0;
1645             s->vectors[ARMV7M_EXCP_MEM].enabled = (value & (1 << 16)) != 0;
1646             s->vectors[ARMV7M_EXCP_USAGE].enabled = (value & (1 << 18)) != 0;
1647         }
1648         if (attrs.secure || (cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK)) {
1649             s->vectors[ARMV7M_EXCP_BUS].active = (value & (1 << 1)) != 0;
1650             s->vectors[ARMV7M_EXCP_BUS].pending = (value & (1 << 14)) != 0;
1651             s->vectors[ARMV7M_EXCP_BUS].enabled = (value & (1 << 17)) != 0;
1652         }
1653         /* NMIACT can only be written if the write is of a zero, with
1654          * BFHFNMINS 1, and by the CPU in secure state via the NS alias.
1655          */
1656         if (!attrs.secure && cpu->env.v7m.secure &&
1657             (cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK) &&
1658             (value & (1 << 5)) == 0) {
1659             s->vectors[ARMV7M_EXCP_NMI].active = 0;
1660         }
1661         /* HARDFAULTACT can only be written if the write is of a zero
1662          * to the non-secure HardFault state by the CPU in secure state.
1663          * The only case where we can be targeting the non-secure HF state
1664          * when in secure state is if this is a write via the NS alias
1665          * and BFHFNMINS is 1.
1666          */
1667         if (!attrs.secure && cpu->env.v7m.secure &&
1668             (cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK) &&
1669             (value & (1 << 2)) == 0) {
1670             s->vectors[ARMV7M_EXCP_HARD].active = 0;
1671         }
1672 
1673         /* TODO: this is RAZ/WI from NS if DEMCR.SDME is set */
1674         s->vectors[ARMV7M_EXCP_DEBUG].active = (value & (1 << 8)) != 0;
1675         nvic_irq_update(s);
1676         break;
1677     case 0xd2c: /* Hard Fault Status.  */
1678         if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
1679             goto bad_offset;
1680         }
1681         cpu->env.v7m.hfsr &= ~value; /* W1C */
1682         break;
1683     case 0xd30: /* Debug Fault Status.  */
1684         cpu->env.v7m.dfsr &= ~value; /* W1C */
1685         break;
1686     case 0xd34: /* Mem Manage Address.  */
1687         if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
1688             goto bad_offset;
1689         }
1690         cpu->env.v7m.mmfar[attrs.secure] = value;
1691         return;
1692     case 0xd38: /* Bus Fault Address.  */
1693         if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
1694             goto bad_offset;
1695         }
1696         if (!attrs.secure &&
1697             !(s->cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK)) {
1698             return;
1699         }
1700         cpu->env.v7m.bfar = value;
1701         return;
1702     case 0xd3c: /* Aux Fault Status.  */
1703         qemu_log_mask(LOG_UNIMP,
1704                       "NVIC: Aux fault status registers unimplemented\n");
1705         break;
1706     case 0xd84: /* CSSELR */
1707         if (!arm_v7m_csselr_razwi(cpu)) {
1708             cpu->env.v7m.csselr[attrs.secure] = value & R_V7M_CSSELR_INDEX_MASK;
1709         }
1710         break;
1711     case 0xd88: /* CPACR */
1712         if (arm_feature(&cpu->env, ARM_FEATURE_VFP)) {
1713             /* We implement only the Floating Point extension's CP10/CP11 */
1714             cpu->env.v7m.cpacr[attrs.secure] = value & (0xf << 20);
1715         }
1716         break;
1717     case 0xd8c: /* NSACR */
1718         if (attrs.secure && arm_feature(&cpu->env, ARM_FEATURE_VFP)) {
1719             /* We implement only the Floating Point extension's CP10/CP11 */
1720             cpu->env.v7m.nsacr = value & (3 << 10);
1721         }
1722         break;
1723     case 0xd90: /* MPU_TYPE */
1724         return; /* RO */
1725     case 0xd94: /* MPU_CTRL */
1726         if ((value &
1727              (R_V7M_MPU_CTRL_HFNMIENA_MASK | R_V7M_MPU_CTRL_ENABLE_MASK))
1728             == R_V7M_MPU_CTRL_HFNMIENA_MASK) {
1729             qemu_log_mask(LOG_GUEST_ERROR, "MPU_CTRL: HFNMIENA and !ENABLE is "
1730                           "UNPREDICTABLE\n");
1731         }
1732         cpu->env.v7m.mpu_ctrl[attrs.secure]
1733             = value & (R_V7M_MPU_CTRL_ENABLE_MASK |
1734                        R_V7M_MPU_CTRL_HFNMIENA_MASK |
1735                        R_V7M_MPU_CTRL_PRIVDEFENA_MASK);
1736         tlb_flush(CPU(cpu));
1737         break;
1738     case 0xd98: /* MPU_RNR */
1739         if (value >= cpu->pmsav7_dregion) {
1740             qemu_log_mask(LOG_GUEST_ERROR, "MPU region out of range %"
1741                           PRIu32 "/%" PRIu32 "\n",
1742                           value, cpu->pmsav7_dregion);
1743         } else {
1744             cpu->env.pmsav7.rnr[attrs.secure] = value;
1745         }
1746         break;
1747     case 0xd9c: /* MPU_RBAR */
1748     case 0xda4: /* MPU_RBAR_A1 */
1749     case 0xdac: /* MPU_RBAR_A2 */
1750     case 0xdb4: /* MPU_RBAR_A3 */
1751     {
1752         int region;
1753 
1754         if (arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1755             /* PMSAv8M handling of the aliases is different from v7M:
1756              * aliases A1, A2, A3 override the low two bits of the region
1757              * number in MPU_RNR, and there is no 'region' field in the
1758              * RBAR register.
1759              */
1760             int aliasno = (offset - 0xd9c) / 8; /* 0..3 */
1761 
1762             region = cpu->env.pmsav7.rnr[attrs.secure];
1763             if (aliasno) {
1764                 region = deposit32(region, 0, 2, aliasno);
1765             }
1766             if (region >= cpu->pmsav7_dregion) {
1767                 return;
1768             }
1769             cpu->env.pmsav8.rbar[attrs.secure][region] = value;
1770             tlb_flush(CPU(cpu));
1771             return;
1772         }
1773 
1774         if (value & (1 << 4)) {
1775             /* VALID bit means use the region number specified in this
1776              * value and also update MPU_RNR.REGION with that value.
1777              */
1778             region = extract32(value, 0, 4);
1779             if (region >= cpu->pmsav7_dregion) {
1780                 qemu_log_mask(LOG_GUEST_ERROR,
1781                               "MPU region out of range %u/%" PRIu32 "\n",
1782                               region, cpu->pmsav7_dregion);
1783                 return;
1784             }
1785             cpu->env.pmsav7.rnr[attrs.secure] = region;
1786         } else {
1787             region = cpu->env.pmsav7.rnr[attrs.secure];
1788         }
1789 
1790         if (region >= cpu->pmsav7_dregion) {
1791             return;
1792         }
1793 
1794         cpu->env.pmsav7.drbar[region] = value & ~0x1f;
1795         tlb_flush(CPU(cpu));
1796         break;
1797     }
1798     case 0xda0: /* MPU_RASR (v7M), MPU_RLAR (v8M) */
1799     case 0xda8: /* MPU_RASR_A1 (v7M), MPU_RLAR_A1 (v8M) */
1800     case 0xdb0: /* MPU_RASR_A2 (v7M), MPU_RLAR_A2 (v8M) */
1801     case 0xdb8: /* MPU_RASR_A3 (v7M), MPU_RLAR_A3 (v8M) */
1802     {
1803         int region = cpu->env.pmsav7.rnr[attrs.secure];
1804 
1805         if (arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1806             /* PMSAv8M handling of the aliases is different from v7M:
1807              * aliases A1, A2, A3 override the low two bits of the region
1808              * number in MPU_RNR.
1809              */
1810             int aliasno = (offset - 0xd9c) / 8; /* 0..3 */
1811 
1812             region = cpu->env.pmsav7.rnr[attrs.secure];
1813             if (aliasno) {
1814                 region = deposit32(region, 0, 2, aliasno);
1815             }
1816             if (region >= cpu->pmsav7_dregion) {
1817                 return;
1818             }
1819             cpu->env.pmsav8.rlar[attrs.secure][region] = value;
1820             tlb_flush(CPU(cpu));
1821             return;
1822         }
1823 
1824         if (region >= cpu->pmsav7_dregion) {
1825             return;
1826         }
1827 
1828         cpu->env.pmsav7.drsr[region] = value & 0xff3f;
1829         cpu->env.pmsav7.dracr[region] = (value >> 16) & 0x173f;
1830         tlb_flush(CPU(cpu));
1831         break;
1832     }
1833     case 0xdc0: /* MPU_MAIR0 */
1834         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1835             goto bad_offset;
1836         }
1837         if (cpu->pmsav7_dregion) {
1838             /* Register is RES0 if no MPU regions are implemented */
1839             cpu->env.pmsav8.mair0[attrs.secure] = value;
1840         }
1841         /* We don't need to do anything else because memory attributes
1842          * only affect cacheability, and we don't implement caching.
1843          */
1844         break;
1845     case 0xdc4: /* MPU_MAIR1 */
1846         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1847             goto bad_offset;
1848         }
1849         if (cpu->pmsav7_dregion) {
1850             /* Register is RES0 if no MPU regions are implemented */
1851             cpu->env.pmsav8.mair1[attrs.secure] = value;
1852         }
1853         /* We don't need to do anything else because memory attributes
1854          * only affect cacheability, and we don't implement caching.
1855          */
1856         break;
1857     case 0xdd0: /* SAU_CTRL */
1858         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1859             goto bad_offset;
1860         }
1861         if (!attrs.secure) {
1862             return;
1863         }
1864         cpu->env.sau.ctrl = value & 3;
1865         break;
1866     case 0xdd4: /* SAU_TYPE */
1867         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1868             goto bad_offset;
1869         }
1870         break;
1871     case 0xdd8: /* SAU_RNR */
1872         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1873             goto bad_offset;
1874         }
1875         if (!attrs.secure) {
1876             return;
1877         }
1878         if (value >= cpu->sau_sregion) {
1879             qemu_log_mask(LOG_GUEST_ERROR, "SAU region out of range %"
1880                           PRIu32 "/%" PRIu32 "\n",
1881                           value, cpu->sau_sregion);
1882         } else {
1883             cpu->env.sau.rnr = value;
1884         }
1885         break;
1886     case 0xddc: /* SAU_RBAR */
1887     {
1888         int region = cpu->env.sau.rnr;
1889 
1890         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1891             goto bad_offset;
1892         }
1893         if (!attrs.secure) {
1894             return;
1895         }
1896         if (region >= cpu->sau_sregion) {
1897             return;
1898         }
1899         cpu->env.sau.rbar[region] = value & ~0x1f;
1900         tlb_flush(CPU(cpu));
1901         break;
1902     }
1903     case 0xde0: /* SAU_RLAR */
1904     {
1905         int region = cpu->env.sau.rnr;
1906 
1907         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1908             goto bad_offset;
1909         }
1910         if (!attrs.secure) {
1911             return;
1912         }
1913         if (region >= cpu->sau_sregion) {
1914             return;
1915         }
1916         cpu->env.sau.rlar[region] = value & ~0x1c;
1917         tlb_flush(CPU(cpu));
1918         break;
1919     }
1920     case 0xde4: /* SFSR */
1921         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1922             goto bad_offset;
1923         }
1924         if (!attrs.secure) {
1925             return;
1926         }
1927         cpu->env.v7m.sfsr &= ~value; /* W1C */
1928         break;
1929     case 0xde8: /* SFAR */
1930         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1931             goto bad_offset;
1932         }
1933         if (!attrs.secure) {
1934             return;
1935         }
1936         cpu->env.v7m.sfsr = value;
1937         break;
1938     case 0xf00: /* Software Triggered Interrupt Register */
1939     {
1940         int excnum = (value & 0x1ff) + NVIC_FIRST_IRQ;
1941 
1942         if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
1943             goto bad_offset;
1944         }
1945 
1946         if (excnum < s->num_irq) {
1947             armv7m_nvic_set_pending(s, excnum, false);
1948         }
1949         break;
1950     }
1951     case 0xf34: /* FPCCR */
1952         if (arm_feature(&cpu->env, ARM_FEATURE_VFP)) {
1953             /* Not all bits here are banked. */
1954             uint32_t fpccr_s;
1955 
1956             if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1957                 /* Don't allow setting of bits not present in v7M */
1958                 value &= (R_V7M_FPCCR_LSPACT_MASK |
1959                           R_V7M_FPCCR_USER_MASK |
1960                           R_V7M_FPCCR_THREAD_MASK |
1961                           R_V7M_FPCCR_HFRDY_MASK |
1962                           R_V7M_FPCCR_MMRDY_MASK |
1963                           R_V7M_FPCCR_BFRDY_MASK |
1964                           R_V7M_FPCCR_MONRDY_MASK |
1965                           R_V7M_FPCCR_LSPEN_MASK |
1966                           R_V7M_FPCCR_ASPEN_MASK);
1967             }
1968             value &= ~R_V7M_FPCCR_RES0_MASK;
1969 
1970             if (!attrs.secure) {
1971                 /* Some non-banked bits are configurably writable by NS */
1972                 fpccr_s = cpu->env.v7m.fpccr[M_REG_S];
1973                 if (!(fpccr_s & R_V7M_FPCCR_LSPENS_MASK)) {
1974                     uint32_t lspen = FIELD_EX32(value, V7M_FPCCR, LSPEN);
1975                     fpccr_s = FIELD_DP32(fpccr_s, V7M_FPCCR, LSPEN, lspen);
1976                 }
1977                 if (!(fpccr_s & R_V7M_FPCCR_CLRONRETS_MASK)) {
1978                     uint32_t cor = FIELD_EX32(value, V7M_FPCCR, CLRONRET);
1979                     fpccr_s = FIELD_DP32(fpccr_s, V7M_FPCCR, CLRONRET, cor);
1980                 }
1981                 if ((s->cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK)) {
1982                     uint32_t hfrdy = FIELD_EX32(value, V7M_FPCCR, HFRDY);
1983                     uint32_t bfrdy = FIELD_EX32(value, V7M_FPCCR, BFRDY);
1984                     fpccr_s = FIELD_DP32(fpccr_s, V7M_FPCCR, HFRDY, hfrdy);
1985                     fpccr_s = FIELD_DP32(fpccr_s, V7M_FPCCR, BFRDY, bfrdy);
1986                 }
1987                 /* TODO MONRDY should RAZ/WI if DEMCR.SDME is set */
1988                 {
1989                     uint32_t monrdy = FIELD_EX32(value, V7M_FPCCR, MONRDY);
1990                     fpccr_s = FIELD_DP32(fpccr_s, V7M_FPCCR, MONRDY, monrdy);
1991                 }
1992 
1993                 /*
1994                  * All other non-banked bits are RAZ/WI from NS; write
1995                  * just the banked bits to fpccr[M_REG_NS].
1996                  */
1997                 value &= R_V7M_FPCCR_BANKED_MASK;
1998                 cpu->env.v7m.fpccr[M_REG_NS] = value;
1999             } else {
2000                 fpccr_s = value;
2001             }
2002             cpu->env.v7m.fpccr[M_REG_S] = fpccr_s;
2003         }
2004         break;
2005     case 0xf38: /* FPCAR */
2006         if (arm_feature(&cpu->env, ARM_FEATURE_VFP)) {
2007             value &= ~7;
2008             cpu->env.v7m.fpcar[attrs.secure] = value;
2009         }
2010         break;
2011     case 0xf3c: /* FPDSCR */
2012         if (arm_feature(&cpu->env, ARM_FEATURE_VFP)) {
2013             value &= 0x07c00000;
2014             cpu->env.v7m.fpdscr[attrs.secure] = value;
2015         }
2016         break;
2017     case 0xf50: /* ICIALLU */
2018     case 0xf58: /* ICIMVAU */
2019     case 0xf5c: /* DCIMVAC */
2020     case 0xf60: /* DCISW */
2021     case 0xf64: /* DCCMVAU */
2022     case 0xf68: /* DCCMVAC */
2023     case 0xf6c: /* DCCSW */
2024     case 0xf70: /* DCCIMVAC */
2025     case 0xf74: /* DCCISW */
2026     case 0xf78: /* BPIALL */
2027         /* Cache and branch predictor maintenance: for QEMU these always NOP */
2028         break;
2029     default:
2030     bad_offset:
2031         qemu_log_mask(LOG_GUEST_ERROR,
2032                       "NVIC: Bad write offset 0x%x\n", offset);
2033     }
2034 }
2035 
2036 static bool nvic_user_access_ok(NVICState *s, hwaddr offset, MemTxAttrs attrs)
2037 {
2038     /* Return true if unprivileged access to this register is permitted. */
2039     switch (offset) {
2040     case 0xf00: /* STIR: accessible only if CCR.USERSETMPEND permits */
2041         /* For access via STIR_NS it is the NS CCR.USERSETMPEND that
2042          * controls access even though the CPU is in Secure state (I_QDKX).
2043          */
2044         return s->cpu->env.v7m.ccr[attrs.secure] & R_V7M_CCR_USERSETMPEND_MASK;
2045     default:
2046         /* All other user accesses cause a BusFault unconditionally */
2047         return false;
2048     }
2049 }
2050 
2051 static int shpr_bank(NVICState *s, int exc, MemTxAttrs attrs)
2052 {
2053     /* Behaviour for the SHPR register field for this exception:
2054      * return M_REG_NS to use the nonsecure vector (including for
2055      * non-banked exceptions), M_REG_S for the secure version of
2056      * a banked exception, and -1 if this field should RAZ/WI.
2057      */
2058     switch (exc) {
2059     case ARMV7M_EXCP_MEM:
2060     case ARMV7M_EXCP_USAGE:
2061     case ARMV7M_EXCP_SVC:
2062     case ARMV7M_EXCP_PENDSV:
2063     case ARMV7M_EXCP_SYSTICK:
2064         /* Banked exceptions */
2065         return attrs.secure;
2066     case ARMV7M_EXCP_BUS:
2067         /* Not banked, RAZ/WI from nonsecure if BFHFNMINS is zero */
2068         if (!attrs.secure &&
2069             !(s->cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK)) {
2070             return -1;
2071         }
2072         return M_REG_NS;
2073     case ARMV7M_EXCP_SECURE:
2074         /* Not banked, RAZ/WI from nonsecure */
2075         if (!attrs.secure) {
2076             return -1;
2077         }
2078         return M_REG_NS;
2079     case ARMV7M_EXCP_DEBUG:
2080         /* Not banked. TODO should RAZ/WI if DEMCR.SDME is set */
2081         return M_REG_NS;
2082     case 8 ... 10:
2083     case 13:
2084         /* RES0 */
2085         return -1;
2086     default:
2087         /* Not reachable due to decode of SHPR register addresses */
2088         g_assert_not_reached();
2089     }
2090 }
2091 
2092 static MemTxResult nvic_sysreg_read(void *opaque, hwaddr addr,
2093                                     uint64_t *data, unsigned size,
2094                                     MemTxAttrs attrs)
2095 {
2096     NVICState *s = (NVICState *)opaque;
2097     uint32_t offset = addr;
2098     unsigned i, startvec, end;
2099     uint32_t val;
2100 
2101     if (attrs.user && !nvic_user_access_ok(s, addr, attrs)) {
2102         /* Generate BusFault for unprivileged accesses */
2103         return MEMTX_ERROR;
2104     }
2105 
2106     switch (offset) {
2107     /* reads of set and clear both return the status */
2108     case 0x100 ... 0x13f: /* NVIC Set enable */
2109         offset += 0x80;
2110         /* fall through */
2111     case 0x180 ... 0x1bf: /* NVIC Clear enable */
2112         val = 0;
2113         startvec = 8 * (offset - 0x180) + NVIC_FIRST_IRQ; /* vector # */
2114 
2115         for (i = 0, end = size * 8; i < end && startvec + i < s->num_irq; i++) {
2116             if (s->vectors[startvec + i].enabled &&
2117                 (attrs.secure || s->itns[startvec + i])) {
2118                 val |= (1 << i);
2119             }
2120         }
2121         break;
2122     case 0x200 ... 0x23f: /* NVIC Set pend */
2123         offset += 0x80;
2124         /* fall through */
2125     case 0x280 ... 0x2bf: /* NVIC Clear pend */
2126         val = 0;
2127         startvec = 8 * (offset - 0x280) + NVIC_FIRST_IRQ; /* vector # */
2128         for (i = 0, end = size * 8; i < end && startvec + i < s->num_irq; i++) {
2129             if (s->vectors[startvec + i].pending &&
2130                 (attrs.secure || s->itns[startvec + i])) {
2131                 val |= (1 << i);
2132             }
2133         }
2134         break;
2135     case 0x300 ... 0x33f: /* NVIC Active */
2136         val = 0;
2137 
2138         if (!arm_feature(&s->cpu->env, ARM_FEATURE_V7)) {
2139             break;
2140         }
2141 
2142         startvec = 8 * (offset - 0x300) + NVIC_FIRST_IRQ; /* vector # */
2143 
2144         for (i = 0, end = size * 8; i < end && startvec + i < s->num_irq; i++) {
2145             if (s->vectors[startvec + i].active &&
2146                 (attrs.secure || s->itns[startvec + i])) {
2147                 val |= (1 << i);
2148             }
2149         }
2150         break;
2151     case 0x400 ... 0x5ef: /* NVIC Priority */
2152         val = 0;
2153         startvec = offset - 0x400 + NVIC_FIRST_IRQ; /* vector # */
2154 
2155         for (i = 0; i < size && startvec + i < s->num_irq; i++) {
2156             if (attrs.secure || s->itns[startvec + i]) {
2157                 val |= s->vectors[startvec + i].prio << (8 * i);
2158             }
2159         }
2160         break;
2161     case 0xd18 ... 0xd1b: /* System Handler Priority (SHPR1) */
2162         if (!arm_feature(&s->cpu->env, ARM_FEATURE_M_MAIN)) {
2163             val = 0;
2164             break;
2165         }
2166         /* fall through */
2167     case 0xd1c ... 0xd23: /* System Handler Priority (SHPR2, SHPR3) */
2168         val = 0;
2169         for (i = 0; i < size; i++) {
2170             unsigned hdlidx = (offset - 0xd14) + i;
2171             int sbank = shpr_bank(s, hdlidx, attrs);
2172 
2173             if (sbank < 0) {
2174                 continue;
2175             }
2176             val = deposit32(val, i * 8, 8, get_prio(s, hdlidx, sbank));
2177         }
2178         break;
2179     case 0xd28 ... 0xd2b: /* Configurable Fault Status (CFSR) */
2180         if (!arm_feature(&s->cpu->env, ARM_FEATURE_M_MAIN)) {
2181             val = 0;
2182             break;
2183         };
2184         /*
2185          * The BFSR bits [15:8] are shared between security states
2186          * and we store them in the NS copy. They are RAZ/WI for
2187          * NS code if AIRCR.BFHFNMINS is 0.
2188          */
2189         val = s->cpu->env.v7m.cfsr[attrs.secure];
2190         if (!attrs.secure &&
2191             !(s->cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK)) {
2192             val &= ~R_V7M_CFSR_BFSR_MASK;
2193         } else {
2194             val |= s->cpu->env.v7m.cfsr[M_REG_NS] & R_V7M_CFSR_BFSR_MASK;
2195         }
2196         val = extract32(val, (offset - 0xd28) * 8, size * 8);
2197         break;
2198     case 0xfe0 ... 0xfff: /* ID.  */
2199         if (offset & 3) {
2200             val = 0;
2201         } else {
2202             val = nvic_id[(offset - 0xfe0) >> 2];
2203         }
2204         break;
2205     default:
2206         if (size == 4) {
2207             val = nvic_readl(s, offset, attrs);
2208         } else {
2209             qemu_log_mask(LOG_GUEST_ERROR,
2210                           "NVIC: Bad read of size %d at offset 0x%x\n",
2211                           size, offset);
2212             val = 0;
2213         }
2214     }
2215 
2216     trace_nvic_sysreg_read(addr, val, size);
2217     *data = val;
2218     return MEMTX_OK;
2219 }
2220 
2221 static MemTxResult nvic_sysreg_write(void *opaque, hwaddr addr,
2222                                      uint64_t value, unsigned size,
2223                                      MemTxAttrs attrs)
2224 {
2225     NVICState *s = (NVICState *)opaque;
2226     uint32_t offset = addr;
2227     unsigned i, startvec, end;
2228     unsigned setval = 0;
2229 
2230     trace_nvic_sysreg_write(addr, value, size);
2231 
2232     if (attrs.user && !nvic_user_access_ok(s, addr, attrs)) {
2233         /* Generate BusFault for unprivileged accesses */
2234         return MEMTX_ERROR;
2235     }
2236 
2237     switch (offset) {
2238     case 0x100 ... 0x13f: /* NVIC Set enable */
2239         offset += 0x80;
2240         setval = 1;
2241         /* fall through */
2242     case 0x180 ... 0x1bf: /* NVIC Clear enable */
2243         startvec = 8 * (offset - 0x180) + NVIC_FIRST_IRQ;
2244 
2245         for (i = 0, end = size * 8; i < end && startvec + i < s->num_irq; i++) {
2246             if (value & (1 << i) &&
2247                 (attrs.secure || s->itns[startvec + i])) {
2248                 s->vectors[startvec + i].enabled = setval;
2249             }
2250         }
2251         nvic_irq_update(s);
2252         return MEMTX_OK;
2253     case 0x200 ... 0x23f: /* NVIC Set pend */
2254         /* the special logic in armv7m_nvic_set_pending()
2255          * is not needed since IRQs are never escalated
2256          */
2257         offset += 0x80;
2258         setval = 1;
2259         /* fall through */
2260     case 0x280 ... 0x2bf: /* NVIC Clear pend */
2261         startvec = 8 * (offset - 0x280) + NVIC_FIRST_IRQ; /* vector # */
2262 
2263         for (i = 0, end = size * 8; i < end && startvec + i < s->num_irq; i++) {
2264             if (value & (1 << i) &&
2265                 (attrs.secure || s->itns[startvec + i])) {
2266                 s->vectors[startvec + i].pending = setval;
2267             }
2268         }
2269         nvic_irq_update(s);
2270         return MEMTX_OK;
2271     case 0x300 ... 0x33f: /* NVIC Active */
2272         return MEMTX_OK; /* R/O */
2273     case 0x400 ... 0x5ef: /* NVIC Priority */
2274         startvec = (offset - 0x400) + NVIC_FIRST_IRQ; /* vector # */
2275 
2276         for (i = 0; i < size && startvec + i < s->num_irq; i++) {
2277             if (attrs.secure || s->itns[startvec + i]) {
2278                 set_prio(s, startvec + i, false, (value >> (i * 8)) & 0xff);
2279             }
2280         }
2281         nvic_irq_update(s);
2282         return MEMTX_OK;
2283     case 0xd18 ... 0xd1b: /* System Handler Priority (SHPR1) */
2284         if (!arm_feature(&s->cpu->env, ARM_FEATURE_M_MAIN)) {
2285             return MEMTX_OK;
2286         }
2287         /* fall through */
2288     case 0xd1c ... 0xd23: /* System Handler Priority (SHPR2, SHPR3) */
2289         for (i = 0; i < size; i++) {
2290             unsigned hdlidx = (offset - 0xd14) + i;
2291             int newprio = extract32(value, i * 8, 8);
2292             int sbank = shpr_bank(s, hdlidx, attrs);
2293 
2294             if (sbank < 0) {
2295                 continue;
2296             }
2297             set_prio(s, hdlidx, sbank, newprio);
2298         }
2299         nvic_irq_update(s);
2300         return MEMTX_OK;
2301     case 0xd28 ... 0xd2b: /* Configurable Fault Status (CFSR) */
2302         if (!arm_feature(&s->cpu->env, ARM_FEATURE_M_MAIN)) {
2303             return MEMTX_OK;
2304         }
2305         /* All bits are W1C, so construct 32 bit value with 0s in
2306          * the parts not written by the access size
2307          */
2308         value <<= ((offset - 0xd28) * 8);
2309 
2310         if (!attrs.secure &&
2311             !(s->cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK)) {
2312             /* BFSR bits are RAZ/WI for NS if BFHFNMINS is set */
2313             value &= ~R_V7M_CFSR_BFSR_MASK;
2314         }
2315 
2316         s->cpu->env.v7m.cfsr[attrs.secure] &= ~value;
2317         if (attrs.secure) {
2318             /* The BFSR bits [15:8] are shared between security states
2319              * and we store them in the NS copy.
2320              */
2321             s->cpu->env.v7m.cfsr[M_REG_NS] &= ~(value & R_V7M_CFSR_BFSR_MASK);
2322         }
2323         return MEMTX_OK;
2324     }
2325     if (size == 4) {
2326         nvic_writel(s, offset, value, attrs);
2327         return MEMTX_OK;
2328     }
2329     qemu_log_mask(LOG_GUEST_ERROR,
2330                   "NVIC: Bad write of size %d at offset 0x%x\n", size, offset);
2331     /* This is UNPREDICTABLE; treat as RAZ/WI */
2332     return MEMTX_OK;
2333 }
2334 
2335 static const MemoryRegionOps nvic_sysreg_ops = {
2336     .read_with_attrs = nvic_sysreg_read,
2337     .write_with_attrs = nvic_sysreg_write,
2338     .endianness = DEVICE_NATIVE_ENDIAN,
2339 };
2340 
2341 static MemTxResult nvic_sysreg_ns_write(void *opaque, hwaddr addr,
2342                                         uint64_t value, unsigned size,
2343                                         MemTxAttrs attrs)
2344 {
2345     MemoryRegion *mr = opaque;
2346 
2347     if (attrs.secure) {
2348         /* S accesses to the alias act like NS accesses to the real region */
2349         attrs.secure = 0;
2350         return memory_region_dispatch_write(mr, addr, value, size, attrs);
2351     } else {
2352         /* NS attrs are RAZ/WI for privileged, and BusFault for user */
2353         if (attrs.user) {
2354             return MEMTX_ERROR;
2355         }
2356         return MEMTX_OK;
2357     }
2358 }
2359 
2360 static MemTxResult nvic_sysreg_ns_read(void *opaque, hwaddr addr,
2361                                        uint64_t *data, unsigned size,
2362                                        MemTxAttrs attrs)
2363 {
2364     MemoryRegion *mr = opaque;
2365 
2366     if (attrs.secure) {
2367         /* S accesses to the alias act like NS accesses to the real region */
2368         attrs.secure = 0;
2369         return memory_region_dispatch_read(mr, addr, data, size, attrs);
2370     } else {
2371         /* NS attrs are RAZ/WI for privileged, and BusFault for user */
2372         if (attrs.user) {
2373             return MEMTX_ERROR;
2374         }
2375         *data = 0;
2376         return MEMTX_OK;
2377     }
2378 }
2379 
2380 static const MemoryRegionOps nvic_sysreg_ns_ops = {
2381     .read_with_attrs = nvic_sysreg_ns_read,
2382     .write_with_attrs = nvic_sysreg_ns_write,
2383     .endianness = DEVICE_NATIVE_ENDIAN,
2384 };
2385 
2386 static MemTxResult nvic_systick_write(void *opaque, hwaddr addr,
2387                                       uint64_t value, unsigned size,
2388                                       MemTxAttrs attrs)
2389 {
2390     NVICState *s = opaque;
2391     MemoryRegion *mr;
2392 
2393     /* Direct the access to the correct systick */
2394     mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->systick[attrs.secure]), 0);
2395     return memory_region_dispatch_write(mr, addr, value, size, attrs);
2396 }
2397 
2398 static MemTxResult nvic_systick_read(void *opaque, hwaddr addr,
2399                                      uint64_t *data, unsigned size,
2400                                      MemTxAttrs attrs)
2401 {
2402     NVICState *s = opaque;
2403     MemoryRegion *mr;
2404 
2405     /* Direct the access to the correct systick */
2406     mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->systick[attrs.secure]), 0);
2407     return memory_region_dispatch_read(mr, addr, data, size, attrs);
2408 }
2409 
2410 static const MemoryRegionOps nvic_systick_ops = {
2411     .read_with_attrs = nvic_systick_read,
2412     .write_with_attrs = nvic_systick_write,
2413     .endianness = DEVICE_NATIVE_ENDIAN,
2414 };
2415 
2416 static int nvic_post_load(void *opaque, int version_id)
2417 {
2418     NVICState *s = opaque;
2419     unsigned i;
2420     int resetprio;
2421 
2422     /* Check for out of range priority settings */
2423     resetprio = arm_feature(&s->cpu->env, ARM_FEATURE_V8) ? -4 : -3;
2424 
2425     if (s->vectors[ARMV7M_EXCP_RESET].prio != resetprio ||
2426         s->vectors[ARMV7M_EXCP_NMI].prio != -2 ||
2427         s->vectors[ARMV7M_EXCP_HARD].prio != -1) {
2428         return 1;
2429     }
2430     for (i = ARMV7M_EXCP_MEM; i < s->num_irq; i++) {
2431         if (s->vectors[i].prio & ~0xff) {
2432             return 1;
2433         }
2434     }
2435 
2436     nvic_recompute_state(s);
2437 
2438     return 0;
2439 }
2440 
2441 static const VMStateDescription vmstate_VecInfo = {
2442     .name = "armv7m_nvic_info",
2443     .version_id = 1,
2444     .minimum_version_id = 1,
2445     .fields = (VMStateField[]) {
2446         VMSTATE_INT16(prio, VecInfo),
2447         VMSTATE_UINT8(enabled, VecInfo),
2448         VMSTATE_UINT8(pending, VecInfo),
2449         VMSTATE_UINT8(active, VecInfo),
2450         VMSTATE_UINT8(level, VecInfo),
2451         VMSTATE_END_OF_LIST()
2452     }
2453 };
2454 
2455 static bool nvic_security_needed(void *opaque)
2456 {
2457     NVICState *s = opaque;
2458 
2459     return arm_feature(&s->cpu->env, ARM_FEATURE_M_SECURITY);
2460 }
2461 
2462 static int nvic_security_post_load(void *opaque, int version_id)
2463 {
2464     NVICState *s = opaque;
2465     int i;
2466 
2467     /* Check for out of range priority settings */
2468     if (s->sec_vectors[ARMV7M_EXCP_HARD].prio != -1
2469         && s->sec_vectors[ARMV7M_EXCP_HARD].prio != -3) {
2470         /* We can't cross-check against AIRCR.BFHFNMINS as we don't know
2471          * if the CPU state has been migrated yet; a mismatch won't
2472          * cause the emulation to blow up, though.
2473          */
2474         return 1;
2475     }
2476     for (i = ARMV7M_EXCP_MEM; i < ARRAY_SIZE(s->sec_vectors); i++) {
2477         if (s->sec_vectors[i].prio & ~0xff) {
2478             return 1;
2479         }
2480     }
2481     return 0;
2482 }
2483 
2484 static const VMStateDescription vmstate_nvic_security = {
2485     .name = "armv7m_nvic/m-security",
2486     .version_id = 1,
2487     .minimum_version_id = 1,
2488     .needed = nvic_security_needed,
2489     .post_load = &nvic_security_post_load,
2490     .fields = (VMStateField[]) {
2491         VMSTATE_STRUCT_ARRAY(sec_vectors, NVICState, NVIC_INTERNAL_VECTORS, 1,
2492                              vmstate_VecInfo, VecInfo),
2493         VMSTATE_UINT32(prigroup[M_REG_S], NVICState),
2494         VMSTATE_BOOL_ARRAY(itns, NVICState, NVIC_MAX_VECTORS),
2495         VMSTATE_END_OF_LIST()
2496     }
2497 };
2498 
2499 static const VMStateDescription vmstate_nvic = {
2500     .name = "armv7m_nvic",
2501     .version_id = 4,
2502     .minimum_version_id = 4,
2503     .post_load = &nvic_post_load,
2504     .fields = (VMStateField[]) {
2505         VMSTATE_STRUCT_ARRAY(vectors, NVICState, NVIC_MAX_VECTORS, 1,
2506                              vmstate_VecInfo, VecInfo),
2507         VMSTATE_UINT32(prigroup[M_REG_NS], NVICState),
2508         VMSTATE_END_OF_LIST()
2509     },
2510     .subsections = (const VMStateDescription*[]) {
2511         &vmstate_nvic_security,
2512         NULL
2513     }
2514 };
2515 
2516 static Property props_nvic[] = {
2517     /* Number of external IRQ lines (so excluding the 16 internal exceptions) */
2518     DEFINE_PROP_UINT32("num-irq", NVICState, num_irq, 64),
2519     DEFINE_PROP_END_OF_LIST()
2520 };
2521 
2522 static void armv7m_nvic_reset(DeviceState *dev)
2523 {
2524     int resetprio;
2525     NVICState *s = NVIC(dev);
2526 
2527     memset(s->vectors, 0, sizeof(s->vectors));
2528     memset(s->sec_vectors, 0, sizeof(s->sec_vectors));
2529     s->prigroup[M_REG_NS] = 0;
2530     s->prigroup[M_REG_S] = 0;
2531 
2532     s->vectors[ARMV7M_EXCP_NMI].enabled = 1;
2533     /* MEM, BUS, and USAGE are enabled through
2534      * the System Handler Control register
2535      */
2536     s->vectors[ARMV7M_EXCP_SVC].enabled = 1;
2537     s->vectors[ARMV7M_EXCP_PENDSV].enabled = 1;
2538     s->vectors[ARMV7M_EXCP_SYSTICK].enabled = 1;
2539 
2540     /* DebugMonitor is enabled via DEMCR.MON_EN */
2541     s->vectors[ARMV7M_EXCP_DEBUG].enabled = 0;
2542 
2543     resetprio = arm_feature(&s->cpu->env, ARM_FEATURE_V8) ? -4 : -3;
2544     s->vectors[ARMV7M_EXCP_RESET].prio = resetprio;
2545     s->vectors[ARMV7M_EXCP_NMI].prio = -2;
2546     s->vectors[ARMV7M_EXCP_HARD].prio = -1;
2547 
2548     if (arm_feature(&s->cpu->env, ARM_FEATURE_M_SECURITY)) {
2549         s->sec_vectors[ARMV7M_EXCP_HARD].enabled = 1;
2550         s->sec_vectors[ARMV7M_EXCP_SVC].enabled = 1;
2551         s->sec_vectors[ARMV7M_EXCP_PENDSV].enabled = 1;
2552         s->sec_vectors[ARMV7M_EXCP_SYSTICK].enabled = 1;
2553 
2554         /* AIRCR.BFHFNMINS resets to 0 so Secure HF is priority -1 (R_CMTC) */
2555         s->sec_vectors[ARMV7M_EXCP_HARD].prio = -1;
2556         /* If AIRCR.BFHFNMINS is 0 then NS HF is (effectively) disabled */
2557         s->vectors[ARMV7M_EXCP_HARD].enabled = 0;
2558     } else {
2559         s->vectors[ARMV7M_EXCP_HARD].enabled = 1;
2560     }
2561 
2562     /* Strictly speaking the reset handler should be enabled.
2563      * However, we don't simulate soft resets through the NVIC,
2564      * and the reset vector should never be pended.
2565      * So we leave it disabled to catch logic errors.
2566      */
2567 
2568     s->exception_prio = NVIC_NOEXC_PRIO;
2569     s->vectpending = 0;
2570     s->vectpending_is_s_banked = false;
2571     s->vectpending_prio = NVIC_NOEXC_PRIO;
2572 
2573     if (arm_feature(&s->cpu->env, ARM_FEATURE_M_SECURITY)) {
2574         memset(s->itns, 0, sizeof(s->itns));
2575     } else {
2576         /* This state is constant and not guest accessible in a non-security
2577          * NVIC; we set the bits to true to avoid having to do a feature
2578          * bit check in the NVIC enable/pend/etc register accessors.
2579          */
2580         int i;
2581 
2582         for (i = NVIC_FIRST_IRQ; i < ARRAY_SIZE(s->itns); i++) {
2583             s->itns[i] = true;
2584         }
2585     }
2586 }
2587 
2588 static void nvic_systick_trigger(void *opaque, int n, int level)
2589 {
2590     NVICState *s = opaque;
2591 
2592     if (level) {
2593         /* SysTick just asked us to pend its exception.
2594          * (This is different from an external interrupt line's
2595          * behaviour.)
2596          * n == 0 : NonSecure systick
2597          * n == 1 : Secure systick
2598          */
2599         armv7m_nvic_set_pending(s, ARMV7M_EXCP_SYSTICK, n);
2600     }
2601 }
2602 
2603 static void armv7m_nvic_realize(DeviceState *dev, Error **errp)
2604 {
2605     NVICState *s = NVIC(dev);
2606     Error *err = NULL;
2607     int regionlen;
2608 
2609     /* The armv7m container object will have set our CPU pointer */
2610     if (!s->cpu || !arm_feature(&s->cpu->env, ARM_FEATURE_M)) {
2611         error_setg(errp, "The NVIC can only be used with a Cortex-M CPU");
2612         return;
2613     }
2614 
2615     if (s->num_irq > NVIC_MAX_IRQ) {
2616         error_setg(errp, "num-irq %d exceeds NVIC maximum", s->num_irq);
2617         return;
2618     }
2619 
2620     qdev_init_gpio_in(dev, set_irq_level, s->num_irq);
2621 
2622     /* include space for internal exception vectors */
2623     s->num_irq += NVIC_FIRST_IRQ;
2624 
2625     s->num_prio_bits = arm_feature(&s->cpu->env, ARM_FEATURE_V7) ? 8 : 2;
2626 
2627     object_property_set_bool(OBJECT(&s->systick[M_REG_NS]), true,
2628                              "realized", &err);
2629     if (err != NULL) {
2630         error_propagate(errp, err);
2631         return;
2632     }
2633     sysbus_connect_irq(SYS_BUS_DEVICE(&s->systick[M_REG_NS]), 0,
2634                        qdev_get_gpio_in_named(dev, "systick-trigger",
2635                                               M_REG_NS));
2636 
2637     if (arm_feature(&s->cpu->env, ARM_FEATURE_M_SECURITY)) {
2638         /* We couldn't init the secure systick device in instance_init
2639          * as we didn't know then if the CPU had the security extensions;
2640          * so we have to do it here.
2641          */
2642         sysbus_init_child_obj(OBJECT(dev), "systick-reg-s",
2643                               &s->systick[M_REG_S],
2644                               sizeof(s->systick[M_REG_S]), TYPE_SYSTICK);
2645 
2646         object_property_set_bool(OBJECT(&s->systick[M_REG_S]), true,
2647                                  "realized", &err);
2648         if (err != NULL) {
2649             error_propagate(errp, err);
2650             return;
2651         }
2652         sysbus_connect_irq(SYS_BUS_DEVICE(&s->systick[M_REG_S]), 0,
2653                            qdev_get_gpio_in_named(dev, "systick-trigger",
2654                                                   M_REG_S));
2655     }
2656 
2657     /* The NVIC and System Control Space (SCS) starts at 0xe000e000
2658      * and looks like this:
2659      *  0x004 - ICTR
2660      *  0x010 - 0xff - systick
2661      *  0x100..0x7ec - NVIC
2662      *  0x7f0..0xcff - Reserved
2663      *  0xd00..0xd3c - SCS registers
2664      *  0xd40..0xeff - Reserved or Not implemented
2665      *  0xf00 - STIR
2666      *
2667      * Some registers within this space are banked between security states.
2668      * In v8M there is a second range 0xe002e000..0xe002efff which is the
2669      * NonSecure alias SCS; secure accesses to this behave like NS accesses
2670      * to the main SCS range, and non-secure accesses (including when
2671      * the security extension is not implemented) are RAZ/WI.
2672      * Note that both the main SCS range and the alias range are defined
2673      * to be exempt from memory attribution (R_BLJT) and so the memory
2674      * transaction attribute always matches the current CPU security
2675      * state (attrs.secure == env->v7m.secure). In the nvic_sysreg_ns_ops
2676      * wrappers we change attrs.secure to indicate the NS access; so
2677      * generally code determining which banked register to use should
2678      * use attrs.secure; code determining actual behaviour of the system
2679      * should use env->v7m.secure.
2680      */
2681     regionlen = arm_feature(&s->cpu->env, ARM_FEATURE_V8) ? 0x21000 : 0x1000;
2682     memory_region_init(&s->container, OBJECT(s), "nvic", regionlen);
2683     /* The system register region goes at the bottom of the priority
2684      * stack as it covers the whole page.
2685      */
2686     memory_region_init_io(&s->sysregmem, OBJECT(s), &nvic_sysreg_ops, s,
2687                           "nvic_sysregs", 0x1000);
2688     memory_region_add_subregion(&s->container, 0, &s->sysregmem);
2689 
2690     memory_region_init_io(&s->systickmem, OBJECT(s),
2691                           &nvic_systick_ops, s,
2692                           "nvic_systick", 0xe0);
2693 
2694     memory_region_add_subregion_overlap(&s->container, 0x10,
2695                                         &s->systickmem, 1);
2696 
2697     if (arm_feature(&s->cpu->env, ARM_FEATURE_V8)) {
2698         memory_region_init_io(&s->sysreg_ns_mem, OBJECT(s),
2699                               &nvic_sysreg_ns_ops, &s->sysregmem,
2700                               "nvic_sysregs_ns", 0x1000);
2701         memory_region_add_subregion(&s->container, 0x20000, &s->sysreg_ns_mem);
2702         memory_region_init_io(&s->systick_ns_mem, OBJECT(s),
2703                               &nvic_sysreg_ns_ops, &s->systickmem,
2704                               "nvic_systick_ns", 0xe0);
2705         memory_region_add_subregion_overlap(&s->container, 0x20010,
2706                                             &s->systick_ns_mem, 1);
2707     }
2708 
2709     sysbus_init_mmio(SYS_BUS_DEVICE(dev), &s->container);
2710 }
2711 
2712 static void armv7m_nvic_instance_init(Object *obj)
2713 {
2714     /* We have a different default value for the num-irq property
2715      * than our superclass. This function runs after qdev init
2716      * has set the defaults from the Property array and before
2717      * any user-specified property setting, so just modify the
2718      * value in the GICState struct.
2719      */
2720     DeviceState *dev = DEVICE(obj);
2721     NVICState *nvic = NVIC(obj);
2722     SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
2723 
2724     sysbus_init_child_obj(obj, "systick-reg-ns", &nvic->systick[M_REG_NS],
2725                           sizeof(nvic->systick[M_REG_NS]), TYPE_SYSTICK);
2726     /* We can't initialize the secure systick here, as we don't know
2727      * yet if we need it.
2728      */
2729 
2730     sysbus_init_irq(sbd, &nvic->excpout);
2731     qdev_init_gpio_out_named(dev, &nvic->sysresetreq, "SYSRESETREQ", 1);
2732     qdev_init_gpio_in_named(dev, nvic_systick_trigger, "systick-trigger",
2733                             M_REG_NUM_BANKS);
2734     qdev_init_gpio_in_named(dev, nvic_nmi_trigger, "NMI", 1);
2735 }
2736 
2737 static void armv7m_nvic_class_init(ObjectClass *klass, void *data)
2738 {
2739     DeviceClass *dc = DEVICE_CLASS(klass);
2740 
2741     dc->vmsd  = &vmstate_nvic;
2742     dc->props = props_nvic;
2743     dc->reset = armv7m_nvic_reset;
2744     dc->realize = armv7m_nvic_realize;
2745 }
2746 
2747 static const TypeInfo armv7m_nvic_info = {
2748     .name          = TYPE_NVIC,
2749     .parent        = TYPE_SYS_BUS_DEVICE,
2750     .instance_init = armv7m_nvic_instance_init,
2751     .instance_size = sizeof(NVICState),
2752     .class_init    = armv7m_nvic_class_init,
2753     .class_size    = sizeof(SysBusDeviceClass),
2754 };
2755 
2756 static void armv7m_nvic_register_types(void)
2757 {
2758     type_register_static(&armv7m_nvic_info);
2759 }
2760 
2761 type_init(armv7m_nvic_register_types)
2762