2 * ARM Nested Vectored Interrupt Controller
4 * Copyright (c) 2006-2007 CodeSourcery.
5 * Written by Paul Brook
7 * This code is licensed under the GPL.
9 * The ARMv7M System controller is fairly tightly tied in with the
10 * NVIC. Much of that is also implemented here.
13 #include "qemu/osdep.h"
14 #include "qapi/error.h"
15 #include "qemu-common.h"
17 #include "hw/sysbus.h"
18 #include "qemu/timer.h"
19 #include "hw/arm/arm.h"
20 #include "hw/intc/armv7m_nvic.h"
21 #include "target/arm/cpu.h"
22 #include "exec/exec-all.h"
26 /* IRQ number counting:
28 * the num-irq property counts the number of external IRQ lines
30 * NVICState::num_irq counts the total number of exceptions
31 * (external IRQs, the 15 internal exceptions including reset,
32 * and one for the unused exception number 0).
34 * NVIC_MAX_IRQ is the highest permitted number of external IRQ lines.
36 * NVIC_MAX_VECTORS is the highest permitted number of exceptions.
38 * Iterating through all exceptions should typically be done with
39 * for (i = 1; i < s->num_irq; i++) to avoid the unused slot 0.
41 * The external qemu_irq lines are the NVIC's external IRQ lines,
42 * so line 0 is exception 16.
44 * In the terminology of the architecture manual, "interrupts" are
45 * a subcategory of exception referring to the external interrupts
46 * (which are exception numbers NVIC_FIRST_IRQ and upward).
47 * For historical reasons QEMU tends to use "interrupt" and
48 * "exception" more or less interchangeably.
50 #define NVIC_FIRST_IRQ NVIC_INTERNAL_VECTORS
51 #define NVIC_MAX_IRQ (NVIC_MAX_VECTORS - NVIC_FIRST_IRQ)
53 /* Effective running priority of the CPU when no exception is active
54 * (higher than the highest possible priority value)
56 #define NVIC_NOEXC_PRIO 0x100
57 /* Maximum priority of non-secure exceptions when AIRCR.PRIS is set */
58 #define NVIC_NS_PRIO_LIMIT 0x80
60 static const uint8_t nvic_id
[] = {
61 0x00, 0xb0, 0x1b, 0x00, 0x0d, 0xe0, 0x05, 0xb1
64 static int nvic_pending_prio(NVICState
*s
)
66 /* return the group priority of the current pending interrupt,
67 * or NVIC_NOEXC_PRIO if no interrupt is pending
69 return s
->vectpending_prio
;
72 /* Return the value of the ISCR RETTOBASE bit:
73 * 1 if there is exactly one active exception
74 * 0 if there is more than one active exception
75 * UNKNOWN if there are no active exceptions (we choose 1,
76 * which matches the choice Cortex-M3 is documented as making).
78 * NB: some versions of the documentation talk about this
79 * counting "active exceptions other than the one shown by IPSR";
80 * this is only different in the obscure corner case where guest
81 * code has manually deactivated an exception and is about
82 * to fail an exception-return integrity check. The definition
83 * above is the one from the v8M ARM ARM and is also in line
84 * with the behaviour documented for the Cortex-M3.
86 static bool nvic_rettobase(NVICState
*s
)
89 bool check_sec
= arm_feature(&s
->cpu
->env
, ARM_FEATURE_M_SECURITY
);
91 for (irq
= ARMV7M_EXCP_RESET
; irq
< s
->num_irq
; irq
++) {
92 if (s
->vectors
[irq
].active
||
93 (check_sec
&& irq
< NVIC_INTERNAL_VECTORS
&&
94 s
->sec_vectors
[irq
].active
)) {
105 /* Return the value of the ISCR ISRPENDING bit:
106 * 1 if an external interrupt is pending
107 * 0 if no external interrupt is pending
109 static bool nvic_isrpending(NVICState
*s
)
113 /* We can shortcut if the highest priority pending interrupt
114 * happens to be external or if there is nothing pending.
116 if (s
->vectpending
> NVIC_FIRST_IRQ
) {
119 if (s
->vectpending
== 0) {
123 for (irq
= NVIC_FIRST_IRQ
; irq
< s
->num_irq
; irq
++) {
124 if (s
->vectors
[irq
].pending
) {
131 static bool exc_is_banked(int exc
)
133 /* Return true if this is one of the limited set of exceptions which
134 * are banked (and thus have state in sec_vectors[])
136 return exc
== ARMV7M_EXCP_HARD
||
137 exc
== ARMV7M_EXCP_MEM
||
138 exc
== ARMV7M_EXCP_USAGE
||
139 exc
== ARMV7M_EXCP_SVC
||
140 exc
== ARMV7M_EXCP_PENDSV
||
141 exc
== ARMV7M_EXCP_SYSTICK
;
144 /* Return a mask word which clears the subpriority bits from
145 * a priority value for an M-profile exception, leaving only
146 * the group priority.
148 static inline uint32_t nvic_gprio_mask(NVICState
*s
, bool secure
)
150 return ~0U << (s
->prigroup
[secure
] + 1);
153 static bool exc_targets_secure(NVICState
*s
, int exc
)
155 /* Return true if this non-banked exception targets Secure state. */
156 if (!arm_feature(&s
->cpu
->env
, ARM_FEATURE_M_SECURITY
)) {
160 if (exc
>= NVIC_FIRST_IRQ
) {
161 return !s
->itns
[exc
];
164 /* Function shouldn't be called for banked exceptions. */
165 assert(!exc_is_banked(exc
));
168 case ARMV7M_EXCP_NMI
:
169 case ARMV7M_EXCP_BUS
:
170 return !(s
->cpu
->env
.v7m
.aircr
& R_V7M_AIRCR_BFHFNMINS_MASK
);
171 case ARMV7M_EXCP_SECURE
:
173 case ARMV7M_EXCP_DEBUG
:
174 /* TODO: controlled by DEMCR.SDME, which we don't yet implement */
177 /* reset, and reserved (unused) low exception numbers.
178 * We'll get called by code that loops through all the exception
179 * numbers, but it doesn't matter what we return here as these
180 * non-existent exceptions will never be pended or active.
186 static int exc_group_prio(NVICState
*s
, int rawprio
, bool targets_secure
)
188 /* Return the group priority for this exception, given its raw
189 * (group-and-subgroup) priority value and whether it is targeting
190 * secure state or not.
195 rawprio
&= nvic_gprio_mask(s
, targets_secure
);
196 /* AIRCR.PRIS causes us to squash all NS priorities into the
197 * lower half of the total range
199 if (!targets_secure
&&
200 (s
->cpu
->env
.v7m
.aircr
& R_V7M_AIRCR_PRIS_MASK
)) {
201 rawprio
= (rawprio
>> 1) + NVIC_NS_PRIO_LIMIT
;
206 /* Recompute vectpending and exception_prio for a CPU which implements
207 * the Security extension
209 static void nvic_recompute_state_secure(NVICState
*s
)
212 int pend_prio
= NVIC_NOEXC_PRIO
;
213 int active_prio
= NVIC_NOEXC_PRIO
;
215 bool pending_is_s_banked
= false;
217 /* R_CQRV: precedence is by:
218 * - lowest group priority; if both the same then
219 * - lowest subpriority; if both the same then
220 * - lowest exception number; if both the same (ie banked) then
221 * - secure exception takes precedence
222 * Compare pseudocode RawExecutionPriority.
223 * Annoyingly, now we have two prigroup values (for S and NS)
224 * we can't do the loop comparison on raw priority values.
226 for (i
= 1; i
< s
->num_irq
; i
++) {
227 for (bank
= M_REG_S
; bank
>= M_REG_NS
; bank
--) {
232 if (bank
== M_REG_S
) {
233 if (!exc_is_banked(i
)) {
236 vec
= &s
->sec_vectors
[i
];
237 targets_secure
= true;
239 vec
= &s
->vectors
[i
];
240 targets_secure
= !exc_is_banked(i
) && exc_targets_secure(s
, i
);
243 prio
= exc_group_prio(s
, vec
->prio
, targets_secure
);
244 if (vec
->enabled
&& vec
->pending
&& prio
< pend_prio
) {
247 pending_is_s_banked
= (bank
== M_REG_S
);
249 if (vec
->active
&& prio
< active_prio
) {
255 s
->vectpending_is_s_banked
= pending_is_s_banked
;
256 s
->vectpending
= pend_irq
;
257 s
->vectpending_prio
= pend_prio
;
258 s
->exception_prio
= active_prio
;
260 trace_nvic_recompute_state_secure(s
->vectpending
,
261 s
->vectpending_is_s_banked
,
266 /* Recompute vectpending and exception_prio */
267 static void nvic_recompute_state(NVICState
*s
)
270 int pend_prio
= NVIC_NOEXC_PRIO
;
271 int active_prio
= NVIC_NOEXC_PRIO
;
274 /* In theory we could write one function that handled both
275 * the "security extension present" and "not present"; however
276 * the security related changes significantly complicate the
277 * recomputation just by themselves and mixing both cases together
278 * would be even worse, so we retain a separate non-secure-only
279 * version for CPUs which don't implement the security extension.
281 if (arm_feature(&s
->cpu
->env
, ARM_FEATURE_M_SECURITY
)) {
282 nvic_recompute_state_secure(s
);
286 for (i
= 1; i
< s
->num_irq
; i
++) {
287 VecInfo
*vec
= &s
->vectors
[i
];
289 if (vec
->enabled
&& vec
->pending
&& vec
->prio
< pend_prio
) {
290 pend_prio
= vec
->prio
;
293 if (vec
->active
&& vec
->prio
< active_prio
) {
294 active_prio
= vec
->prio
;
298 if (active_prio
> 0) {
299 active_prio
&= nvic_gprio_mask(s
, false);
303 pend_prio
&= nvic_gprio_mask(s
, false);
306 s
->vectpending
= pend_irq
;
307 s
->vectpending_prio
= pend_prio
;
308 s
->exception_prio
= active_prio
;
310 trace_nvic_recompute_state(s
->vectpending
,
315 /* Return the current execution priority of the CPU
316 * (equivalent to the pseudocode ExecutionPriority function).
317 * This is a value between -2 (NMI priority) and NVIC_NOEXC_PRIO.
319 static inline int nvic_exec_prio(NVICState
*s
)
321 CPUARMState
*env
= &s
->cpu
->env
;
324 if (env
->v7m
.faultmask
[env
->v7m
.secure
]) {
326 } else if (env
->v7m
.primask
[env
->v7m
.secure
]) {
328 } else if (env
->v7m
.basepri
[env
->v7m
.secure
] > 0) {
329 running
= env
->v7m
.basepri
[env
->v7m
.secure
] &
330 nvic_gprio_mask(s
, env
->v7m
.secure
);
332 running
= NVIC_NOEXC_PRIO
; /* lower than any possible priority */
334 /* consider priority of active handler */
335 return MIN(running
, s
->exception_prio
);
338 bool armv7m_nvic_can_take_pending_exception(void *opaque
)
340 NVICState
*s
= opaque
;
342 return nvic_exec_prio(s
) > nvic_pending_prio(s
);
345 int armv7m_nvic_raw_execution_priority(void *opaque
)
347 NVICState
*s
= opaque
;
349 return s
->exception_prio
;
352 /* caller must call nvic_irq_update() after this.
353 * secure indicates the bank to use for banked exceptions (we assert if
354 * we are passed secure=true for a non-banked exception).
356 static void set_prio(NVICState
*s
, unsigned irq
, bool secure
, uint8_t prio
)
358 assert(irq
> ARMV7M_EXCP_NMI
); /* only use for configurable prios */
359 assert(irq
< s
->num_irq
);
362 assert(exc_is_banked(irq
));
363 s
->sec_vectors
[irq
].prio
= prio
;
365 s
->vectors
[irq
].prio
= prio
;
368 trace_nvic_set_prio(irq
, secure
, prio
);
371 /* Return the current raw priority register value.
372 * secure indicates the bank to use for banked exceptions (we assert if
373 * we are passed secure=true for a non-banked exception).
375 static int get_prio(NVICState
*s
, unsigned irq
, bool secure
)
377 assert(irq
> ARMV7M_EXCP_NMI
); /* only use for configurable prios */
378 assert(irq
< s
->num_irq
);
381 assert(exc_is_banked(irq
));
382 return s
->sec_vectors
[irq
].prio
;
384 return s
->vectors
[irq
].prio
;
388 /* Recompute state and assert irq line accordingly.
389 * Must be called after changes to:
390 * vec->active, vec->enabled, vec->pending or vec->prio for any vector
393 static void nvic_irq_update(NVICState
*s
)
398 nvic_recompute_state(s
);
399 pend_prio
= nvic_pending_prio(s
);
401 /* Raise NVIC output if this IRQ would be taken, except that we
402 * ignore the effects of the BASEPRI, FAULTMASK and PRIMASK (which
403 * will be checked for in arm_v7m_cpu_exec_interrupt()); changes
404 * to those CPU registers don't cause us to recalculate the NVIC
407 lvl
= (pend_prio
< s
->exception_prio
);
408 trace_nvic_irq_update(s
->vectpending
, pend_prio
, s
->exception_prio
, lvl
);
409 qemu_set_irq(s
->excpout
, lvl
);
413 * armv7m_nvic_clear_pending: mark the specified exception as not pending
415 * @irq: the exception number to mark as not pending
416 * @secure: false for non-banked exceptions or for the nonsecure
417 * version of a banked exception, true for the secure version of a banked
420 * Marks the specified exception as not pending. Note that we will assert()
421 * if @secure is true and @irq does not specify one of the fixed set
422 * of architecturally banked exceptions.
424 static void armv7m_nvic_clear_pending(void *opaque
, int irq
, bool secure
)
426 NVICState
*s
= (NVICState
*)opaque
;
429 assert(irq
> ARMV7M_EXCP_RESET
&& irq
< s
->num_irq
);
432 assert(exc_is_banked(irq
));
433 vec
= &s
->sec_vectors
[irq
];
435 vec
= &s
->vectors
[irq
];
437 trace_nvic_clear_pending(irq
, secure
, vec
->enabled
, vec
->prio
);
444 void armv7m_nvic_set_pending(void *opaque
, int irq
, bool secure
)
446 NVICState
*s
= (NVICState
*)opaque
;
447 bool banked
= exc_is_banked(irq
);
450 assert(irq
> ARMV7M_EXCP_RESET
&& irq
< s
->num_irq
);
451 assert(!secure
|| banked
);
453 vec
= (banked
&& secure
) ? &s
->sec_vectors
[irq
] : &s
->vectors
[irq
];
455 trace_nvic_set_pending(irq
, secure
, vec
->enabled
, vec
->prio
);
457 if (irq
>= ARMV7M_EXCP_HARD
&& irq
< ARMV7M_EXCP_PENDSV
) {
458 /* If a synchronous exception is pending then it may be
459 * escalated to HardFault if:
460 * * it is equal or lower priority to current execution
462 * (ie we need to take it immediately but we can't do so).
463 * Asynchronous exceptions (and interrupts) simply remain pending.
465 * For QEMU, we don't have any imprecise (asynchronous) faults,
466 * so we can assume that PREFETCH_ABORT and DATA_ABORT are always
468 * Debug exceptions are awkward because only Debug exceptions
469 * resulting from the BKPT instruction should be escalated,
470 * but we don't currently implement any Debug exceptions other
471 * than those that result from BKPT, so we treat all debug exceptions
472 * as needing escalation.
474 * This all means we can identify whether to escalate based only on
475 * the exception number and don't (yet) need the caller to explicitly
476 * tell us whether this exception is synchronous or not.
478 int running
= nvic_exec_prio(s
);
479 bool escalate
= false;
481 if (exc_group_prio(s
, vec
->prio
, secure
) >= running
) {
482 trace_nvic_escalate_prio(irq
, vec
->prio
, running
);
484 } else if (!vec
->enabled
) {
485 trace_nvic_escalate_disabled(irq
);
491 /* We need to escalate this exception to a synchronous HardFault.
492 * If BFHFNMINS is set then we escalate to the banked HF for
493 * the target security state of the original exception; otherwise
494 * we take a Secure HardFault.
496 irq
= ARMV7M_EXCP_HARD
;
497 if (arm_feature(&s
->cpu
->env
, ARM_FEATURE_M_SECURITY
) &&
499 !(s
->cpu
->env
.v7m
.aircr
& R_V7M_AIRCR_BFHFNMINS_MASK
))) {
500 vec
= &s
->sec_vectors
[irq
];
502 vec
= &s
->vectors
[irq
];
504 if (running
<= vec
->prio
) {
505 /* We want to escalate to HardFault but we can't take the
506 * synchronous HardFault at this point either. This is a
507 * Lockup condition due to a guest bug. We don't model
508 * Lockup, so report via cpu_abort() instead.
510 cpu_abort(&s
->cpu
->parent_obj
,
511 "Lockup: can't escalate %d to HardFault "
512 "(current priority %d)\n", irq
, running
);
515 /* HF may be banked but there is only one shared HFSR */
516 s
->cpu
->env
.v7m
.hfsr
|= R_V7M_HFSR_FORCED_MASK
;
526 /* Make pending IRQ active. */
527 void armv7m_nvic_acknowledge_irq(void *opaque
)
529 NVICState
*s
= (NVICState
*)opaque
;
530 CPUARMState
*env
= &s
->cpu
->env
;
531 const int pending
= s
->vectpending
;
532 const int running
= nvic_exec_prio(s
);
535 assert(pending
> ARMV7M_EXCP_RESET
&& pending
< s
->num_irq
);
537 vec
= &s
->vectors
[pending
];
539 assert(vec
->enabled
);
540 assert(vec
->pending
);
542 assert(s
->vectpending_prio
< running
);
544 trace_nvic_acknowledge_irq(pending
, s
->vectpending_prio
);
549 env
->v7m
.exception
= s
->vectpending
;
554 int armv7m_nvic_complete_irq(void *opaque
, int irq
)
556 NVICState
*s
= (NVICState
*)opaque
;
560 assert(irq
> ARMV7M_EXCP_RESET
&& irq
< s
->num_irq
);
562 vec
= &s
->vectors
[irq
];
564 trace_nvic_complete_irq(irq
);
567 /* Tell the caller this was an illegal exception return */
571 ret
= nvic_rettobase(s
);
575 /* Re-pend the exception if it's still held high; only
576 * happens for extenal IRQs
578 assert(irq
>= NVIC_FIRST_IRQ
);
587 /* callback when external interrupt line is changed */
588 static void set_irq_level(void *opaque
, int n
, int level
)
590 NVICState
*s
= opaque
;
595 assert(n
>= NVIC_FIRST_IRQ
&& n
< s
->num_irq
);
597 trace_nvic_set_irq_level(n
, level
);
599 /* The pending status of an external interrupt is
600 * latched on rising edge and exception handler return.
602 * Pulsing the IRQ will always run the handler
603 * once, and the handler will re-run until the
604 * level is low when the handler completes.
606 vec
= &s
->vectors
[n
];
607 if (level
!= vec
->level
) {
610 armv7m_nvic_set_pending(s
, n
, false);
615 static uint32_t nvic_readl(NVICState
*s
, uint32_t offset
, MemTxAttrs attrs
)
617 ARMCPU
*cpu
= s
->cpu
;
621 case 4: /* Interrupt Control Type. */
622 return ((s
->num_irq
- NVIC_FIRST_IRQ
) / 32) - 1;
623 case 0x380 ... 0x3bf: /* NVIC_ITNS<n> */
625 int startvec
= 32 * (offset
- 0x380) + NVIC_FIRST_IRQ
;
628 if (!arm_feature(&cpu
->env
, ARM_FEATURE_V8
)) {
635 for (i
= 0; i
< 32 && startvec
+ i
< s
->num_irq
; i
++) {
636 if (s
->itns
[startvec
+ i
]) {
642 case 0xd00: /* CPUID Base. */
644 case 0xd04: /* Interrupt Control State. */
646 val
= cpu
->env
.v7m
.exception
;
648 val
|= (s
->vectpending
& 0xff) << 12;
649 /* ISRPENDING - set if any external IRQ is pending */
650 if (nvic_isrpending(s
)) {
653 /* RETTOBASE - set if only one handler is active */
654 if (nvic_rettobase(s
)) {
658 if (s
->vectors
[ARMV7M_EXCP_SYSTICK
].pending
) {
662 if (s
->vectors
[ARMV7M_EXCP_PENDSV
].pending
) {
666 if (s
->vectors
[ARMV7M_EXCP_NMI
].pending
) {
669 /* ISRPREEMPT not implemented */
671 case 0xd08: /* Vector Table Offset. */
672 return cpu
->env
.v7m
.vecbase
[attrs
.secure
];
673 case 0xd0c: /* Application Interrupt/Reset Control (AIRCR) */
674 val
= 0xfa050000 | (s
->prigroup
[attrs
.secure
] << 8);
676 /* s->aircr stores PRIS, BFHFNMINS, SYSRESETREQS */
677 val
|= cpu
->env
.v7m
.aircr
;
679 if (arm_feature(&cpu
->env
, ARM_FEATURE_V8
)) {
680 /* BFHFNMINS is R/O from NS; other bits are RAZ/WI. If
681 * security isn't supported then BFHFNMINS is RAO (and
682 * the bit in env.v7m.aircr is always set).
684 val
|= cpu
->env
.v7m
.aircr
& R_V7M_AIRCR_BFHFNMINS_MASK
;
688 case 0xd10: /* System Control. */
689 /* TODO: Implement SLEEPONEXIT. */
691 case 0xd14: /* Configuration Control. */
692 /* The BFHFNMIGN bit is the only non-banked bit; we
693 * keep it in the non-secure copy of the register.
695 val
= cpu
->env
.v7m
.ccr
[attrs
.secure
];
696 val
|= cpu
->env
.v7m
.ccr
[M_REG_NS
] & R_V7M_CCR_BFHFNMIGN_MASK
;
698 case 0xd24: /* System Handler Status. */
700 if (s
->vectors
[ARMV7M_EXCP_MEM
].active
) {
703 if (s
->vectors
[ARMV7M_EXCP_BUS
].active
) {
706 if (s
->vectors
[ARMV7M_EXCP_USAGE
].active
) {
709 if (s
->vectors
[ARMV7M_EXCP_SVC
].active
) {
712 if (s
->vectors
[ARMV7M_EXCP_DEBUG
].active
) {
715 if (s
->vectors
[ARMV7M_EXCP_PENDSV
].active
) {
718 if (s
->vectors
[ARMV7M_EXCP_SYSTICK
].active
) {
721 if (s
->vectors
[ARMV7M_EXCP_USAGE
].pending
) {
724 if (s
->vectors
[ARMV7M_EXCP_MEM
].pending
) {
727 if (s
->vectors
[ARMV7M_EXCP_BUS
].pending
) {
730 if (s
->vectors
[ARMV7M_EXCP_SVC
].pending
) {
733 if (s
->vectors
[ARMV7M_EXCP_MEM
].enabled
) {
736 if (s
->vectors
[ARMV7M_EXCP_BUS
].enabled
) {
739 if (s
->vectors
[ARMV7M_EXCP_USAGE
].enabled
) {
743 case 0xd28: /* Configurable Fault Status. */
744 /* The BFSR bits [15:8] are shared between security states
745 * and we store them in the NS copy
747 val
= cpu
->env
.v7m
.cfsr
[attrs
.secure
];
748 val
|= cpu
->env
.v7m
.cfsr
[M_REG_NS
] & R_V7M_CFSR_BFSR_MASK
;
750 case 0xd2c: /* Hard Fault Status. */
751 return cpu
->env
.v7m
.hfsr
;
752 case 0xd30: /* Debug Fault Status. */
753 return cpu
->env
.v7m
.dfsr
;
754 case 0xd34: /* MMFAR MemManage Fault Address */
755 return cpu
->env
.v7m
.mmfar
[attrs
.secure
];
756 case 0xd38: /* Bus Fault Address. */
757 return cpu
->env
.v7m
.bfar
;
758 case 0xd3c: /* Aux Fault Status. */
759 /* TODO: Implement fault status registers. */
760 qemu_log_mask(LOG_UNIMP
,
761 "Aux Fault status registers unimplemented\n");
763 case 0xd40: /* PFR0. */
765 case 0xd44: /* PRF1. */
767 case 0xd48: /* DFR0. */
769 case 0xd4c: /* AFR0. */
771 case 0xd50: /* MMFR0. */
773 case 0xd54: /* MMFR1. */
775 case 0xd58: /* MMFR2. */
777 case 0xd5c: /* MMFR3. */
779 case 0xd60: /* ISAR0. */
781 case 0xd64: /* ISAR1. */
783 case 0xd68: /* ISAR2. */
785 case 0xd6c: /* ISAR3. */
787 case 0xd70: /* ISAR4. */
789 /* TODO: Implement debug registers. */
790 case 0xd90: /* MPU_TYPE */
791 /* Unified MPU; if the MPU is not present this value is zero */
792 return cpu
->pmsav7_dregion
<< 8;
794 case 0xd94: /* MPU_CTRL */
795 return cpu
->env
.v7m
.mpu_ctrl
[attrs
.secure
];
796 case 0xd98: /* MPU_RNR */
797 return cpu
->env
.pmsav7
.rnr
[attrs
.secure
];
798 case 0xd9c: /* MPU_RBAR */
799 case 0xda4: /* MPU_RBAR_A1 */
800 case 0xdac: /* MPU_RBAR_A2 */
801 case 0xdb4: /* MPU_RBAR_A3 */
803 int region
= cpu
->env
.pmsav7
.rnr
[attrs
.secure
];
805 if (arm_feature(&cpu
->env
, ARM_FEATURE_V8
)) {
806 /* PMSAv8M handling of the aliases is different from v7M:
807 * aliases A1, A2, A3 override the low two bits of the region
808 * number in MPU_RNR, and there is no 'region' field in the
811 int aliasno
= (offset
- 0xd9c) / 8; /* 0..3 */
813 region
= deposit32(region
, 0, 2, aliasno
);
815 if (region
>= cpu
->pmsav7_dregion
) {
818 return cpu
->env
.pmsav8
.rbar
[attrs
.secure
][region
];
821 if (region
>= cpu
->pmsav7_dregion
) {
824 return (cpu
->env
.pmsav7
.drbar
[region
] & 0x1f) | (region
& 0xf);
826 case 0xda0: /* MPU_RASR (v7M), MPU_RLAR (v8M) */
827 case 0xda8: /* MPU_RASR_A1 (v7M), MPU_RLAR_A1 (v8M) */
828 case 0xdb0: /* MPU_RASR_A2 (v7M), MPU_RLAR_A2 (v8M) */
829 case 0xdb8: /* MPU_RASR_A3 (v7M), MPU_RLAR_A3 (v8M) */
831 int region
= cpu
->env
.pmsav7
.rnr
[attrs
.secure
];
833 if (arm_feature(&cpu
->env
, ARM_FEATURE_V8
)) {
834 /* PMSAv8M handling of the aliases is different from v7M:
835 * aliases A1, A2, A3 override the low two bits of the region
838 int aliasno
= (offset
- 0xda0) / 8; /* 0..3 */
840 region
= deposit32(region
, 0, 2, aliasno
);
842 if (region
>= cpu
->pmsav7_dregion
) {
845 return cpu
->env
.pmsav8
.rlar
[attrs
.secure
][region
];
848 if (region
>= cpu
->pmsav7_dregion
) {
851 return ((cpu
->env
.pmsav7
.dracr
[region
] & 0xffff) << 16) |
852 (cpu
->env
.pmsav7
.drsr
[region
] & 0xffff);
854 case 0xdc0: /* MPU_MAIR0 */
855 if (!arm_feature(&cpu
->env
, ARM_FEATURE_V8
)) {
858 return cpu
->env
.pmsav8
.mair0
[attrs
.secure
];
859 case 0xdc4: /* MPU_MAIR1 */
860 if (!arm_feature(&cpu
->env
, ARM_FEATURE_V8
)) {
863 return cpu
->env
.pmsav8
.mair1
[attrs
.secure
];
866 qemu_log_mask(LOG_GUEST_ERROR
, "NVIC: Bad read offset 0x%x\n", offset
);
871 static void nvic_writel(NVICState
*s
, uint32_t offset
, uint32_t value
,
874 ARMCPU
*cpu
= s
->cpu
;
877 case 0x380 ... 0x3bf: /* NVIC_ITNS<n> */
879 int startvec
= 32 * (offset
- 0x380) + NVIC_FIRST_IRQ
;
882 if (!arm_feature(&cpu
->env
, ARM_FEATURE_V8
)) {
888 for (i
= 0; i
< 32 && startvec
+ i
< s
->num_irq
; i
++) {
889 s
->itns
[startvec
+ i
] = (value
>> i
) & 1;
894 case 0xd04: /* Interrupt Control State. */
895 if (value
& (1 << 31)) {
896 armv7m_nvic_set_pending(s
, ARMV7M_EXCP_NMI
, false);
898 if (value
& (1 << 28)) {
899 armv7m_nvic_set_pending(s
, ARMV7M_EXCP_PENDSV
, attrs
.secure
);
900 } else if (value
& (1 << 27)) {
901 armv7m_nvic_clear_pending(s
, ARMV7M_EXCP_PENDSV
, attrs
.secure
);
903 if (value
& (1 << 26)) {
904 armv7m_nvic_set_pending(s
, ARMV7M_EXCP_SYSTICK
, attrs
.secure
);
905 } else if (value
& (1 << 25)) {
906 armv7m_nvic_clear_pending(s
, ARMV7M_EXCP_SYSTICK
, attrs
.secure
);
909 case 0xd08: /* Vector Table Offset. */
910 cpu
->env
.v7m
.vecbase
[attrs
.secure
] = value
& 0xffffff80;
912 case 0xd0c: /* Application Interrupt/Reset Control (AIRCR) */
913 if ((value
>> R_V7M_AIRCR_VECTKEY_SHIFT
) == 0x05fa) {
914 if (value
& R_V7M_AIRCR_SYSRESETREQ_MASK
) {
916 !(cpu
->env
.v7m
.aircr
& R_V7M_AIRCR_SYSRESETREQS_MASK
)) {
917 qemu_irq_pulse(s
->sysresetreq
);
920 if (value
& R_V7M_AIRCR_VECTCLRACTIVE_MASK
) {
921 qemu_log_mask(LOG_GUEST_ERROR
,
922 "Setting VECTCLRACTIVE when not in DEBUG mode "
923 "is UNPREDICTABLE\n");
925 if (value
& R_V7M_AIRCR_VECTRESET_MASK
) {
926 /* NB: this bit is RES0 in v8M */
927 qemu_log_mask(LOG_GUEST_ERROR
,
928 "Setting VECTRESET when not in DEBUG mode "
929 "is UNPREDICTABLE\n");
931 s
->prigroup
[attrs
.secure
] = extract32(value
,
932 R_V7M_AIRCR_PRIGROUP_SHIFT
,
933 R_V7M_AIRCR_PRIGROUP_LENGTH
);
935 /* These bits are only writable by secure */
936 cpu
->env
.v7m
.aircr
= value
&
937 (R_V7M_AIRCR_SYSRESETREQS_MASK
|
938 R_V7M_AIRCR_BFHFNMINS_MASK
|
939 R_V7M_AIRCR_PRIS_MASK
);
944 case 0xd10: /* System Control. */
945 /* TODO: Implement control registers. */
946 qemu_log_mask(LOG_UNIMP
, "NVIC: SCR unimplemented\n");
948 case 0xd14: /* Configuration Control. */
949 /* Enforce RAZ/WI on reserved and must-RAZ/WI bits */
950 value
&= (R_V7M_CCR_STKALIGN_MASK
|
951 R_V7M_CCR_BFHFNMIGN_MASK
|
952 R_V7M_CCR_DIV_0_TRP_MASK
|
953 R_V7M_CCR_UNALIGN_TRP_MASK
|
954 R_V7M_CCR_USERSETMPEND_MASK
|
955 R_V7M_CCR_NONBASETHRDENA_MASK
);
957 if (arm_feature(&cpu
->env
, ARM_FEATURE_V8
)) {
958 /* v8M makes NONBASETHRDENA and STKALIGN be RES1 */
959 value
|= R_V7M_CCR_NONBASETHRDENA_MASK
960 | R_V7M_CCR_STKALIGN_MASK
;
963 /* the BFHFNMIGN bit is not banked; keep that in the NS copy */
964 cpu
->env
.v7m
.ccr
[M_REG_NS
] =
965 (cpu
->env
.v7m
.ccr
[M_REG_NS
] & ~R_V7M_CCR_BFHFNMIGN_MASK
)
966 | (value
& R_V7M_CCR_BFHFNMIGN_MASK
);
967 value
&= ~R_V7M_CCR_BFHFNMIGN_MASK
;
970 cpu
->env
.v7m
.ccr
[attrs
.secure
] = value
;
972 case 0xd24: /* System Handler Control. */
973 s
->vectors
[ARMV7M_EXCP_MEM
].active
= (value
& (1 << 0)) != 0;
974 s
->vectors
[ARMV7M_EXCP_BUS
].active
= (value
& (1 << 1)) != 0;
975 s
->vectors
[ARMV7M_EXCP_USAGE
].active
= (value
& (1 << 3)) != 0;
976 s
->vectors
[ARMV7M_EXCP_SVC
].active
= (value
& (1 << 7)) != 0;
977 s
->vectors
[ARMV7M_EXCP_DEBUG
].active
= (value
& (1 << 8)) != 0;
978 s
->vectors
[ARMV7M_EXCP_PENDSV
].active
= (value
& (1 << 10)) != 0;
979 s
->vectors
[ARMV7M_EXCP_SYSTICK
].active
= (value
& (1 << 11)) != 0;
980 s
->vectors
[ARMV7M_EXCP_USAGE
].pending
= (value
& (1 << 12)) != 0;
981 s
->vectors
[ARMV7M_EXCP_MEM
].pending
= (value
& (1 << 13)) != 0;
982 s
->vectors
[ARMV7M_EXCP_BUS
].pending
= (value
& (1 << 14)) != 0;
983 s
->vectors
[ARMV7M_EXCP_SVC
].pending
= (value
& (1 << 15)) != 0;
984 s
->vectors
[ARMV7M_EXCP_MEM
].enabled
= (value
& (1 << 16)) != 0;
985 s
->vectors
[ARMV7M_EXCP_BUS
].enabled
= (value
& (1 << 17)) != 0;
986 s
->vectors
[ARMV7M_EXCP_USAGE
].enabled
= (value
& (1 << 18)) != 0;
989 case 0xd28: /* Configurable Fault Status. */
990 cpu
->env
.v7m
.cfsr
[attrs
.secure
] &= ~value
; /* W1C */
992 /* The BFSR bits [15:8] are shared between security states
993 * and we store them in the NS copy.
995 cpu
->env
.v7m
.cfsr
[M_REG_NS
] &= ~(value
& R_V7M_CFSR_BFSR_MASK
);
998 case 0xd2c: /* Hard Fault Status. */
999 cpu
->env
.v7m
.hfsr
&= ~value
; /* W1C */
1001 case 0xd30: /* Debug Fault Status. */
1002 cpu
->env
.v7m
.dfsr
&= ~value
; /* W1C */
1004 case 0xd34: /* Mem Manage Address. */
1005 cpu
->env
.v7m
.mmfar
[attrs
.secure
] = value
;
1007 case 0xd38: /* Bus Fault Address. */
1008 cpu
->env
.v7m
.bfar
= value
;
1010 case 0xd3c: /* Aux Fault Status. */
1011 qemu_log_mask(LOG_UNIMP
,
1012 "NVIC: Aux fault status registers unimplemented\n");
1014 case 0xd90: /* MPU_TYPE */
1016 case 0xd94: /* MPU_CTRL */
1018 (R_V7M_MPU_CTRL_HFNMIENA_MASK
| R_V7M_MPU_CTRL_ENABLE_MASK
))
1019 == R_V7M_MPU_CTRL_HFNMIENA_MASK
) {
1020 qemu_log_mask(LOG_GUEST_ERROR
, "MPU_CTRL: HFNMIENA and !ENABLE is "
1023 cpu
->env
.v7m
.mpu_ctrl
[attrs
.secure
]
1024 = value
& (R_V7M_MPU_CTRL_ENABLE_MASK
|
1025 R_V7M_MPU_CTRL_HFNMIENA_MASK
|
1026 R_V7M_MPU_CTRL_PRIVDEFENA_MASK
);
1027 tlb_flush(CPU(cpu
));
1029 case 0xd98: /* MPU_RNR */
1030 if (value
>= cpu
->pmsav7_dregion
) {
1031 qemu_log_mask(LOG_GUEST_ERROR
, "MPU region out of range %"
1032 PRIu32
"/%" PRIu32
"\n",
1033 value
, cpu
->pmsav7_dregion
);
1035 cpu
->env
.pmsav7
.rnr
[attrs
.secure
] = value
;
1038 case 0xd9c: /* MPU_RBAR */
1039 case 0xda4: /* MPU_RBAR_A1 */
1040 case 0xdac: /* MPU_RBAR_A2 */
1041 case 0xdb4: /* MPU_RBAR_A3 */
1045 if (arm_feature(&cpu
->env
, ARM_FEATURE_V8
)) {
1046 /* PMSAv8M handling of the aliases is different from v7M:
1047 * aliases A1, A2, A3 override the low two bits of the region
1048 * number in MPU_RNR, and there is no 'region' field in the
1051 int aliasno
= (offset
- 0xd9c) / 8; /* 0..3 */
1053 region
= cpu
->env
.pmsav7
.rnr
[attrs
.secure
];
1055 region
= deposit32(region
, 0, 2, aliasno
);
1057 if (region
>= cpu
->pmsav7_dregion
) {
1060 cpu
->env
.pmsav8
.rbar
[attrs
.secure
][region
] = value
;
1061 tlb_flush(CPU(cpu
));
1065 if (value
& (1 << 4)) {
1066 /* VALID bit means use the region number specified in this
1067 * value and also update MPU_RNR.REGION with that value.
1069 region
= extract32(value
, 0, 4);
1070 if (region
>= cpu
->pmsav7_dregion
) {
1071 qemu_log_mask(LOG_GUEST_ERROR
,
1072 "MPU region out of range %u/%" PRIu32
"\n",
1073 region
, cpu
->pmsav7_dregion
);
1076 cpu
->env
.pmsav7
.rnr
[attrs
.secure
] = region
;
1078 region
= cpu
->env
.pmsav7
.rnr
[attrs
.secure
];
1081 if (region
>= cpu
->pmsav7_dregion
) {
1085 cpu
->env
.pmsav7
.drbar
[region
] = value
& ~0x1f;
1086 tlb_flush(CPU(cpu
));
1089 case 0xda0: /* MPU_RASR (v7M), MPU_RLAR (v8M) */
1090 case 0xda8: /* MPU_RASR_A1 (v7M), MPU_RLAR_A1 (v8M) */
1091 case 0xdb0: /* MPU_RASR_A2 (v7M), MPU_RLAR_A2 (v8M) */
1092 case 0xdb8: /* MPU_RASR_A3 (v7M), MPU_RLAR_A3 (v8M) */
1094 int region
= cpu
->env
.pmsav7
.rnr
[attrs
.secure
];
1096 if (arm_feature(&cpu
->env
, ARM_FEATURE_V8
)) {
1097 /* PMSAv8M handling of the aliases is different from v7M:
1098 * aliases A1, A2, A3 override the low two bits of the region
1099 * number in MPU_RNR.
1101 int aliasno
= (offset
- 0xd9c) / 8; /* 0..3 */
1103 region
= cpu
->env
.pmsav7
.rnr
[attrs
.secure
];
1105 region
= deposit32(region
, 0, 2, aliasno
);
1107 if (region
>= cpu
->pmsav7_dregion
) {
1110 cpu
->env
.pmsav8
.rlar
[attrs
.secure
][region
] = value
;
1111 tlb_flush(CPU(cpu
));
1115 if (region
>= cpu
->pmsav7_dregion
) {
1119 cpu
->env
.pmsav7
.drsr
[region
] = value
& 0xff3f;
1120 cpu
->env
.pmsav7
.dracr
[region
] = (value
>> 16) & 0x173f;
1121 tlb_flush(CPU(cpu
));
1124 case 0xdc0: /* MPU_MAIR0 */
1125 if (!arm_feature(&cpu
->env
, ARM_FEATURE_V8
)) {
1128 if (cpu
->pmsav7_dregion
) {
1129 /* Register is RES0 if no MPU regions are implemented */
1130 cpu
->env
.pmsav8
.mair0
[attrs
.secure
] = value
;
1132 /* We don't need to do anything else because memory attributes
1133 * only affect cacheability, and we don't implement caching.
1136 case 0xdc4: /* MPU_MAIR1 */
1137 if (!arm_feature(&cpu
->env
, ARM_FEATURE_V8
)) {
1140 if (cpu
->pmsav7_dregion
) {
1141 /* Register is RES0 if no MPU regions are implemented */
1142 cpu
->env
.pmsav8
.mair1
[attrs
.secure
] = value
;
1144 /* We don't need to do anything else because memory attributes
1145 * only affect cacheability, and we don't implement caching.
1148 case 0xf00: /* Software Triggered Interrupt Register */
1150 int excnum
= (value
& 0x1ff) + NVIC_FIRST_IRQ
;
1151 if (excnum
< s
->num_irq
) {
1152 armv7m_nvic_set_pending(s
, excnum
, false);
1158 qemu_log_mask(LOG_GUEST_ERROR
,
1159 "NVIC: Bad write offset 0x%x\n", offset
);
1163 static bool nvic_user_access_ok(NVICState
*s
, hwaddr offset
, MemTxAttrs attrs
)
1165 /* Return true if unprivileged access to this register is permitted. */
1167 case 0xf00: /* STIR: accessible only if CCR.USERSETMPEND permits */
1168 /* For access via STIR_NS it is the NS CCR.USERSETMPEND that
1169 * controls access even though the CPU is in Secure state (I_QDKX).
1171 return s
->cpu
->env
.v7m
.ccr
[attrs
.secure
] & R_V7M_CCR_USERSETMPEND_MASK
;
1173 /* All other user accesses cause a BusFault unconditionally */
1178 static int shpr_bank(NVICState
*s
, int exc
, MemTxAttrs attrs
)
1180 /* Behaviour for the SHPR register field for this exception:
1181 * return M_REG_NS to use the nonsecure vector (including for
1182 * non-banked exceptions), M_REG_S for the secure version of
1183 * a banked exception, and -1 if this field should RAZ/WI.
1186 case ARMV7M_EXCP_MEM
:
1187 case ARMV7M_EXCP_USAGE
:
1188 case ARMV7M_EXCP_SVC
:
1189 case ARMV7M_EXCP_PENDSV
:
1190 case ARMV7M_EXCP_SYSTICK
:
1191 /* Banked exceptions */
1192 return attrs
.secure
;
1193 case ARMV7M_EXCP_BUS
:
1194 /* Not banked, RAZ/WI from nonsecure if BFHFNMINS is zero */
1195 if (!attrs
.secure
&&
1196 !(s
->cpu
->env
.v7m
.aircr
& R_V7M_AIRCR_BFHFNMINS_MASK
)) {
1200 case ARMV7M_EXCP_SECURE
:
1201 /* Not banked, RAZ/WI from nonsecure */
1202 if (!attrs
.secure
) {
1206 case ARMV7M_EXCP_DEBUG
:
1207 /* Not banked. TODO should RAZ/WI if DEMCR.SDME is set */
1214 /* Not reachable due to decode of SHPR register addresses */
1215 g_assert_not_reached();
1219 static MemTxResult
nvic_sysreg_read(void *opaque
, hwaddr addr
,
1220 uint64_t *data
, unsigned size
,
1223 NVICState
*s
= (NVICState
*)opaque
;
1224 uint32_t offset
= addr
;
1225 unsigned i
, startvec
, end
;
1228 if (attrs
.user
&& !nvic_user_access_ok(s
, addr
, attrs
)) {
1229 /* Generate BusFault for unprivileged accesses */
1234 /* reads of set and clear both return the status */
1235 case 0x100 ... 0x13f: /* NVIC Set enable */
1238 case 0x180 ... 0x1bf: /* NVIC Clear enable */
1240 startvec
= offset
- 0x180 + NVIC_FIRST_IRQ
; /* vector # */
1242 for (i
= 0, end
= size
* 8; i
< end
&& startvec
+ i
< s
->num_irq
; i
++) {
1243 if (s
->vectors
[startvec
+ i
].enabled
&&
1244 (attrs
.secure
|| s
->itns
[startvec
+ i
])) {
1249 case 0x200 ... 0x23f: /* NVIC Set pend */
1252 case 0x280 ... 0x2bf: /* NVIC Clear pend */
1254 startvec
= offset
- 0x280 + NVIC_FIRST_IRQ
; /* vector # */
1255 for (i
= 0, end
= size
* 8; i
< end
&& startvec
+ i
< s
->num_irq
; i
++) {
1256 if (s
->vectors
[startvec
+ i
].pending
&&
1257 (attrs
.secure
|| s
->itns
[startvec
+ i
])) {
1262 case 0x300 ... 0x33f: /* NVIC Active */
1264 startvec
= offset
- 0x300 + NVIC_FIRST_IRQ
; /* vector # */
1266 for (i
= 0, end
= size
* 8; i
< end
&& startvec
+ i
< s
->num_irq
; i
++) {
1267 if (s
->vectors
[startvec
+ i
].active
&&
1268 (attrs
.secure
|| s
->itns
[startvec
+ i
])) {
1273 case 0x400 ... 0x5ef: /* NVIC Priority */
1275 startvec
= offset
- 0x400 + NVIC_FIRST_IRQ
; /* vector # */
1277 for (i
= 0; i
< size
&& startvec
+ i
< s
->num_irq
; i
++) {
1278 if (attrs
.secure
|| s
->itns
[startvec
+ i
]) {
1279 val
|= s
->vectors
[startvec
+ i
].prio
<< (8 * i
);
1283 case 0xd18 ... 0xd23: /* System Handler Priority (SHPR1, SHPR2, SHPR3) */
1285 for (i
= 0; i
< size
; i
++) {
1286 unsigned hdlidx
= (offset
- 0xd14) + i
;
1287 int sbank
= shpr_bank(s
, hdlidx
, attrs
);
1292 val
= deposit32(val
, i
* 8, 8, get_prio(s
, hdlidx
, sbank
));
1295 case 0xfe0 ... 0xfff: /* ID. */
1299 val
= nvic_id
[(offset
- 0xfe0) >> 2];
1304 val
= nvic_readl(s
, offset
, attrs
);
1306 qemu_log_mask(LOG_GUEST_ERROR
,
1307 "NVIC: Bad read of size %d at offset 0x%x\n",
1313 trace_nvic_sysreg_read(addr
, val
, size
);
1318 static MemTxResult
nvic_sysreg_write(void *opaque
, hwaddr addr
,
1319 uint64_t value
, unsigned size
,
1322 NVICState
*s
= (NVICState
*)opaque
;
1323 uint32_t offset
= addr
;
1324 unsigned i
, startvec
, end
;
1325 unsigned setval
= 0;
1327 trace_nvic_sysreg_write(addr
, value
, size
);
1329 if (attrs
.user
&& !nvic_user_access_ok(s
, addr
, attrs
)) {
1330 /* Generate BusFault for unprivileged accesses */
1335 case 0x100 ... 0x13f: /* NVIC Set enable */
1339 case 0x180 ... 0x1bf: /* NVIC Clear enable */
1340 startvec
= 8 * (offset
- 0x180) + NVIC_FIRST_IRQ
;
1342 for (i
= 0, end
= size
* 8; i
< end
&& startvec
+ i
< s
->num_irq
; i
++) {
1343 if (value
& (1 << i
) &&
1344 (attrs
.secure
|| s
->itns
[startvec
+ i
])) {
1345 s
->vectors
[startvec
+ i
].enabled
= setval
;
1350 case 0x200 ... 0x23f: /* NVIC Set pend */
1351 /* the special logic in armv7m_nvic_set_pending()
1352 * is not needed since IRQs are never escalated
1357 case 0x280 ... 0x2bf: /* NVIC Clear pend */
1358 startvec
= 8 * (offset
- 0x280) + NVIC_FIRST_IRQ
; /* vector # */
1360 for (i
= 0, end
= size
* 8; i
< end
&& startvec
+ i
< s
->num_irq
; i
++) {
1361 if (value
& (1 << i
) &&
1362 (attrs
.secure
|| s
->itns
[startvec
+ i
])) {
1363 s
->vectors
[startvec
+ i
].pending
= setval
;
1368 case 0x300 ... 0x33f: /* NVIC Active */
1369 return MEMTX_OK
; /* R/O */
1370 case 0x400 ... 0x5ef: /* NVIC Priority */
1371 startvec
= 8 * (offset
- 0x400) + NVIC_FIRST_IRQ
; /* vector # */
1373 for (i
= 0; i
< size
&& startvec
+ i
< s
->num_irq
; i
++) {
1374 if (attrs
.secure
|| s
->itns
[startvec
+ i
]) {
1375 set_prio(s
, startvec
+ i
, false, (value
>> (i
* 8)) & 0xff);
1380 case 0xd18 ... 0xd23: /* System Handler Priority (SHPR1, SHPR2, SHPR3) */
1381 for (i
= 0; i
< size
; i
++) {
1382 unsigned hdlidx
= (offset
- 0xd14) + i
;
1383 int newprio
= extract32(value
, i
* 8, 8);
1384 int sbank
= shpr_bank(s
, hdlidx
, attrs
);
1389 set_prio(s
, hdlidx
, sbank
, newprio
);
1395 nvic_writel(s
, offset
, value
, attrs
);
1398 qemu_log_mask(LOG_GUEST_ERROR
,
1399 "NVIC: Bad write of size %d at offset 0x%x\n", size
, offset
);
1400 /* This is UNPREDICTABLE; treat as RAZ/WI */
1404 static const MemoryRegionOps nvic_sysreg_ops
= {
1405 .read_with_attrs
= nvic_sysreg_read
,
1406 .write_with_attrs
= nvic_sysreg_write
,
1407 .endianness
= DEVICE_NATIVE_ENDIAN
,
1410 static MemTxResult
nvic_sysreg_ns_write(void *opaque
, hwaddr addr
,
1411 uint64_t value
, unsigned size
,
1415 /* S accesses to the alias act like NS accesses to the real region */
1417 return nvic_sysreg_write(opaque
, addr
, value
, size
, attrs
);
1419 /* NS attrs are RAZ/WI for privileged, and BusFault for user */
1427 static MemTxResult
nvic_sysreg_ns_read(void *opaque
, hwaddr addr
,
1428 uint64_t *data
, unsigned size
,
1432 /* S accesses to the alias act like NS accesses to the real region */
1434 return nvic_sysreg_read(opaque
, addr
, data
, size
, attrs
);
1436 /* NS attrs are RAZ/WI for privileged, and BusFault for user */
1445 static const MemoryRegionOps nvic_sysreg_ns_ops
= {
1446 .read_with_attrs
= nvic_sysreg_ns_read
,
1447 .write_with_attrs
= nvic_sysreg_ns_write
,
1448 .endianness
= DEVICE_NATIVE_ENDIAN
,
1451 static int nvic_post_load(void *opaque
, int version_id
)
1453 NVICState
*s
= opaque
;
1456 /* Check for out of range priority settings */
1457 if (s
->vectors
[ARMV7M_EXCP_RESET
].prio
!= -3 ||
1458 s
->vectors
[ARMV7M_EXCP_NMI
].prio
!= -2 ||
1459 s
->vectors
[ARMV7M_EXCP_HARD
].prio
!= -1) {
1462 for (i
= ARMV7M_EXCP_MEM
; i
< s
->num_irq
; i
++) {
1463 if (s
->vectors
[i
].prio
& ~0xff) {
1468 nvic_recompute_state(s
);
1473 static const VMStateDescription vmstate_VecInfo
= {
1474 .name
= "armv7m_nvic_info",
1476 .minimum_version_id
= 1,
1477 .fields
= (VMStateField
[]) {
1478 VMSTATE_INT16(prio
, VecInfo
),
1479 VMSTATE_UINT8(enabled
, VecInfo
),
1480 VMSTATE_UINT8(pending
, VecInfo
),
1481 VMSTATE_UINT8(active
, VecInfo
),
1482 VMSTATE_UINT8(level
, VecInfo
),
1483 VMSTATE_END_OF_LIST()
1487 static bool nvic_security_needed(void *opaque
)
1489 NVICState
*s
= opaque
;
1491 return arm_feature(&s
->cpu
->env
, ARM_FEATURE_M_SECURITY
);
1494 static int nvic_security_post_load(void *opaque
, int version_id
)
1496 NVICState
*s
= opaque
;
1499 /* Check for out of range priority settings */
1500 if (s
->sec_vectors
[ARMV7M_EXCP_HARD
].prio
!= -1) {
1503 for (i
= ARMV7M_EXCP_MEM
; i
< ARRAY_SIZE(s
->sec_vectors
); i
++) {
1504 if (s
->sec_vectors
[i
].prio
& ~0xff) {
1511 static const VMStateDescription vmstate_nvic_security
= {
1512 .name
= "nvic/m-security",
1514 .minimum_version_id
= 1,
1515 .needed
= nvic_security_needed
,
1516 .post_load
= &nvic_security_post_load
,
1517 .fields
= (VMStateField
[]) {
1518 VMSTATE_STRUCT_ARRAY(sec_vectors
, NVICState
, NVIC_INTERNAL_VECTORS
, 1,
1519 vmstate_VecInfo
, VecInfo
),
1520 VMSTATE_UINT32(prigroup
[M_REG_S
], NVICState
),
1521 VMSTATE_BOOL_ARRAY(itns
, NVICState
, NVIC_MAX_VECTORS
),
1522 VMSTATE_END_OF_LIST()
1526 static const VMStateDescription vmstate_nvic
= {
1527 .name
= "armv7m_nvic",
1529 .minimum_version_id
= 4,
1530 .post_load
= &nvic_post_load
,
1531 .fields
= (VMStateField
[]) {
1532 VMSTATE_STRUCT_ARRAY(vectors
, NVICState
, NVIC_MAX_VECTORS
, 1,
1533 vmstate_VecInfo
, VecInfo
),
1534 VMSTATE_UINT32(prigroup
[M_REG_NS
], NVICState
),
1535 VMSTATE_END_OF_LIST()
1537 .subsections
= (const VMStateDescription
*[]) {
1538 &vmstate_nvic_security
,
1543 static Property props_nvic
[] = {
1544 /* Number of external IRQ lines (so excluding the 16 internal exceptions) */
1545 DEFINE_PROP_UINT32("num-irq", NVICState
, num_irq
, 64),
1546 DEFINE_PROP_END_OF_LIST()
1549 static void armv7m_nvic_reset(DeviceState
*dev
)
1551 NVICState
*s
= NVIC(dev
);
1553 s
->vectors
[ARMV7M_EXCP_NMI
].enabled
= 1;
1554 s
->vectors
[ARMV7M_EXCP_HARD
].enabled
= 1;
1555 /* MEM, BUS, and USAGE are enabled through
1556 * the System Handler Control register
1558 s
->vectors
[ARMV7M_EXCP_SVC
].enabled
= 1;
1559 s
->vectors
[ARMV7M_EXCP_DEBUG
].enabled
= 1;
1560 s
->vectors
[ARMV7M_EXCP_PENDSV
].enabled
= 1;
1561 s
->vectors
[ARMV7M_EXCP_SYSTICK
].enabled
= 1;
1563 s
->vectors
[ARMV7M_EXCP_RESET
].prio
= -3;
1564 s
->vectors
[ARMV7M_EXCP_NMI
].prio
= -2;
1565 s
->vectors
[ARMV7M_EXCP_HARD
].prio
= -1;
1567 if (arm_feature(&s
->cpu
->env
, ARM_FEATURE_M_SECURITY
)) {
1568 s
->sec_vectors
[ARMV7M_EXCP_HARD
].enabled
= 1;
1569 s
->sec_vectors
[ARMV7M_EXCP_SVC
].enabled
= 1;
1570 s
->sec_vectors
[ARMV7M_EXCP_PENDSV
].enabled
= 1;
1571 s
->sec_vectors
[ARMV7M_EXCP_SYSTICK
].enabled
= 1;
1573 /* AIRCR.BFHFNMINS resets to 0 so Secure HF is priority -1 (R_CMTC) */
1574 s
->sec_vectors
[ARMV7M_EXCP_HARD
].prio
= -1;
1577 /* Strictly speaking the reset handler should be enabled.
1578 * However, we don't simulate soft resets through the NVIC,
1579 * and the reset vector should never be pended.
1580 * So we leave it disabled to catch logic errors.
1583 s
->exception_prio
= NVIC_NOEXC_PRIO
;
1585 s
->vectpending_is_s_banked
= false;
1586 s
->vectpending_prio
= NVIC_NOEXC_PRIO
;
1588 if (arm_feature(&s
->cpu
->env
, ARM_FEATURE_M_SECURITY
)) {
1589 memset(s
->itns
, 0, sizeof(s
->itns
));
1591 /* This state is constant and not guest accessible in a non-security
1592 * NVIC; we set the bits to true to avoid having to do a feature
1593 * bit check in the NVIC enable/pend/etc register accessors.
1597 for (i
= NVIC_FIRST_IRQ
; i
< ARRAY_SIZE(s
->itns
); i
++) {
1603 static void nvic_systick_trigger(void *opaque
, int n
, int level
)
1605 NVICState
*s
= opaque
;
1608 /* SysTick just asked us to pend its exception.
1609 * (This is different from an external interrupt line's
1611 * TODO: when we implement the banked systicks we must make
1612 * this pend the correct banked exception.
1614 armv7m_nvic_set_pending(s
, ARMV7M_EXCP_SYSTICK
, false);
1618 static void armv7m_nvic_realize(DeviceState
*dev
, Error
**errp
)
1620 NVICState
*s
= NVIC(dev
);
1621 SysBusDevice
*systick_sbd
;
1625 s
->cpu
= ARM_CPU(qemu_get_cpu(0));
1628 if (s
->num_irq
> NVIC_MAX_IRQ
) {
1629 error_setg(errp
, "num-irq %d exceeds NVIC maximum", s
->num_irq
);
1633 qdev_init_gpio_in(dev
, set_irq_level
, s
->num_irq
);
1635 /* include space for internal exception vectors */
1636 s
->num_irq
+= NVIC_FIRST_IRQ
;
1638 object_property_set_bool(OBJECT(&s
->systick
), true, "realized", &err
);
1640 error_propagate(errp
, err
);
1643 systick_sbd
= SYS_BUS_DEVICE(&s
->systick
);
1644 sysbus_connect_irq(systick_sbd
, 0,
1645 qdev_get_gpio_in_named(dev
, "systick-trigger", 0));
1647 /* The NVIC and System Control Space (SCS) starts at 0xe000e000
1648 * and looks like this:
1650 * 0x010 - 0xff - systick
1651 * 0x100..0x7ec - NVIC
1652 * 0x7f0..0xcff - Reserved
1653 * 0xd00..0xd3c - SCS registers
1654 * 0xd40..0xeff - Reserved or Not implemented
1657 * Some registers within this space are banked between security states.
1658 * In v8M there is a second range 0xe002e000..0xe002efff which is the
1659 * NonSecure alias SCS; secure accesses to this behave like NS accesses
1660 * to the main SCS range, and non-secure accesses (including when
1661 * the security extension is not implemented) are RAZ/WI.
1662 * Note that both the main SCS range and the alias range are defined
1663 * to be exempt from memory attribution (R_BLJT) and so the memory
1664 * transaction attribute always matches the current CPU security
1665 * state (attrs.secure == env->v7m.secure). In the nvic_sysreg_ns_ops
1666 * wrappers we change attrs.secure to indicate the NS access; so
1667 * generally code determining which banked register to use should
1668 * use attrs.secure; code determining actual behaviour of the system
1669 * should use env->v7m.secure.
1671 regionlen
= arm_feature(&s
->cpu
->env
, ARM_FEATURE_V8
) ? 0x21000 : 0x1000;
1672 memory_region_init(&s
->container
, OBJECT(s
), "nvic", regionlen
);
1673 /* The system register region goes at the bottom of the priority
1674 * stack as it covers the whole page.
1676 memory_region_init_io(&s
->sysregmem
, OBJECT(s
), &nvic_sysreg_ops
, s
,
1677 "nvic_sysregs", 0x1000);
1678 memory_region_add_subregion(&s
->container
, 0, &s
->sysregmem
);
1679 memory_region_add_subregion_overlap(&s
->container
, 0x10,
1680 sysbus_mmio_get_region(systick_sbd
, 0),
1683 if (arm_feature(&s
->cpu
->env
, ARM_FEATURE_V8
)) {
1684 memory_region_init_io(&s
->sysreg_ns_mem
, OBJECT(s
),
1685 &nvic_sysreg_ns_ops
, s
,
1686 "nvic_sysregs_ns", 0x1000);
1687 memory_region_add_subregion(&s
->container
, 0x20000, &s
->sysreg_ns_mem
);
1690 sysbus_init_mmio(SYS_BUS_DEVICE(dev
), &s
->container
);
1693 static void armv7m_nvic_instance_init(Object
*obj
)
1695 /* We have a different default value for the num-irq property
1696 * than our superclass. This function runs after qdev init
1697 * has set the defaults from the Property array and before
1698 * any user-specified property setting, so just modify the
1699 * value in the GICState struct.
1701 DeviceState
*dev
= DEVICE(obj
);
1702 NVICState
*nvic
= NVIC(obj
);
1703 SysBusDevice
*sbd
= SYS_BUS_DEVICE(obj
);
1705 object_initialize(&nvic
->systick
, sizeof(nvic
->systick
), TYPE_SYSTICK
);
1706 qdev_set_parent_bus(DEVICE(&nvic
->systick
), sysbus_get_default());
1708 sysbus_init_irq(sbd
, &nvic
->excpout
);
1709 qdev_init_gpio_out_named(dev
, &nvic
->sysresetreq
, "SYSRESETREQ", 1);
1710 qdev_init_gpio_in_named(dev
, nvic_systick_trigger
, "systick-trigger", 1);
1713 static void armv7m_nvic_class_init(ObjectClass
*klass
, void *data
)
1715 DeviceClass
*dc
= DEVICE_CLASS(klass
);
1717 dc
->vmsd
= &vmstate_nvic
;
1718 dc
->props
= props_nvic
;
1719 dc
->reset
= armv7m_nvic_reset
;
1720 dc
->realize
= armv7m_nvic_realize
;
1723 static const TypeInfo armv7m_nvic_info
= {
1725 .parent
= TYPE_SYS_BUS_DEVICE
,
1726 .instance_init
= armv7m_nvic_instance_init
,
1727 .instance_size
= sizeof(NVICState
),
1728 .class_init
= armv7m_nvic_class_init
,
1729 .class_size
= sizeof(SysBusDeviceClass
),
1732 static void armv7m_nvic_register_types(void)
1734 type_register_static(&armv7m_nvic_info
);
1737 type_init(armv7m_nvic_register_types
)