2 * ARM Nested Vectored Interrupt Controller
4 * Copyright (c) 2006-2007 CodeSourcery.
5 * Written by Paul Brook
7 * This code is licensed under the GPL.
9 * The ARMv7M System controller is fairly tightly tied in with the
10 * NVIC. Much of that is also implemented here.
13 #include "qemu/osdep.h"
14 #include "qapi/error.h"
15 #include "qemu-common.h"
17 #include "hw/sysbus.h"
18 #include "qemu/timer.h"
19 #include "hw/arm/arm.h"
20 #include "target/arm/cpu.h"
21 #include "exec/address-spaces.h"
25 /* IRQ number counting:
27 * the num-irq property counts the number of external IRQ lines
29 * NVICState::num_irq counts the total number of exceptions
30 * (external IRQs, the 15 internal exceptions including reset,
31 * and one for the unused exception number 0).
33 * NVIC_MAX_IRQ is the highest permitted number of external IRQ lines.
35 * NVIC_MAX_VECTORS is the highest permitted number of exceptions.
37 * Iterating through all exceptions should typically be done with
38 * for (i = 1; i < s->num_irq; i++) to avoid the unused slot 0.
40 * The external qemu_irq lines are the NVIC's external IRQ lines,
41 * so line 0 is exception 16.
43 * In the terminology of the architecture manual, "interrupts" are
44 * a subcategory of exception referring to the external interrupts
45 * (which are exception numbers NVIC_FIRST_IRQ and upward).
46 * For historical reasons QEMU tends to use "interrupt" and
47 * "exception" more or less interchangeably.
49 #define NVIC_FIRST_IRQ 16
50 #define NVIC_MAX_VECTORS 512
51 #define NVIC_MAX_IRQ (NVIC_MAX_VECTORS - NVIC_FIRST_IRQ)
53 /* Effective running priority of the CPU when no exception is active
54 * (higher than the highest possible priority value)
56 #define NVIC_NOEXC_PRIO 0x100
58 typedef struct VecInfo
{
59 /* Exception priorities can range from -3 to 255; only the unmodifiable
60 * priority values for RESET, NMI and HardFault can be negative.
66 uint8_t level
; /* exceptions <=15 never set level */
69 typedef struct NVICState
{
71 SysBusDevice parent_obj
;
76 VecInfo vectors
[NVIC_MAX_VECTORS
];
79 /* vectpending and exception_prio are both cached state that can
80 * be recalculated from the vectors[] array and the prigroup field.
82 unsigned int vectpending
; /* highest prio pending enabled exception */
83 int exception_prio
; /* group prio of the highest prio active exception */
92 MemoryRegion sysregmem
;
93 MemoryRegion container
;
100 #define TYPE_NVIC "armv7m_nvic"
103 OBJECT_CHECK(NVICState, (obj), TYPE_NVIC)
105 static const uint8_t nvic_id
[] = {
106 0x00, 0xb0, 0x1b, 0x00, 0x0d, 0xe0, 0x05, 0xb1
109 /* qemu timers run at 1GHz. We want something closer to 1MHz. */
110 #define SYSTICK_SCALE 1000ULL
112 #define SYSTICK_ENABLE (1 << 0)
113 #define SYSTICK_TICKINT (1 << 1)
114 #define SYSTICK_CLKSOURCE (1 << 2)
115 #define SYSTICK_COUNTFLAG (1 << 16)
117 int system_clock_scale
;
119 /* Conversion factor from qemu timer to SysTick frequencies. */
120 static inline int64_t systick_scale(NVICState
*s
)
122 if (s
->systick
.control
& SYSTICK_CLKSOURCE
)
123 return system_clock_scale
;
128 static void systick_reload(NVICState
*s
, int reset
)
130 /* The Cortex-M3 Devices Generic User Guide says that "When the
131 * ENABLE bit is set to 1, the counter loads the RELOAD value from the
132 * SYST RVR register and then counts down". So, we need to check the
133 * ENABLE bit before reloading the value.
135 if ((s
->systick
.control
& SYSTICK_ENABLE
) == 0) {
140 s
->systick
.tick
= qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL
);
141 s
->systick
.tick
+= (s
->systick
.reload
+ 1) * systick_scale(s
);
142 timer_mod(s
->systick
.timer
, s
->systick
.tick
);
145 static void systick_timer_tick(void * opaque
)
147 NVICState
*s
= (NVICState
*)opaque
;
148 s
->systick
.control
|= SYSTICK_COUNTFLAG
;
149 if (s
->systick
.control
& SYSTICK_TICKINT
) {
150 /* Trigger the interrupt. */
151 armv7m_nvic_set_pending(s
, ARMV7M_EXCP_SYSTICK
);
153 if (s
->systick
.reload
== 0) {
154 s
->systick
.control
&= ~SYSTICK_ENABLE
;
156 systick_reload(s
, 0);
160 static void systick_reset(NVICState
*s
)
162 s
->systick
.control
= 0;
163 s
->systick
.reload
= 0;
165 timer_del(s
->systick
.timer
);
168 static int nvic_pending_prio(NVICState
*s
)
170 /* return the priority of the current pending interrupt,
171 * or NVIC_NOEXC_PRIO if no interrupt is pending
173 return s
->vectpending
? s
->vectors
[s
->vectpending
].prio
: NVIC_NOEXC_PRIO
;
176 /* Return the value of the ISCR RETTOBASE bit:
177 * 1 if there is exactly one active exception
178 * 0 if there is more than one active exception
179 * UNKNOWN if there are no active exceptions (we choose 1,
180 * which matches the choice Cortex-M3 is documented as making).
182 * NB: some versions of the documentation talk about this
183 * counting "active exceptions other than the one shown by IPSR";
184 * this is only different in the obscure corner case where guest
185 * code has manually deactivated an exception and is about
186 * to fail an exception-return integrity check. The definition
187 * above is the one from the v8M ARM ARM and is also in line
188 * with the behaviour documented for the Cortex-M3.
190 static bool nvic_rettobase(NVICState
*s
)
194 for (irq
= ARMV7M_EXCP_RESET
; irq
< s
->num_irq
; irq
++) {
195 if (s
->vectors
[irq
].active
) {
206 /* Return the value of the ISCR ISRPENDING bit:
207 * 1 if an external interrupt is pending
208 * 0 if no external interrupt is pending
210 static bool nvic_isrpending(NVICState
*s
)
214 /* We can shortcut if the highest priority pending interrupt
215 * happens to be external or if there is nothing pending.
217 if (s
->vectpending
> NVIC_FIRST_IRQ
) {
220 if (s
->vectpending
== 0) {
224 for (irq
= NVIC_FIRST_IRQ
; irq
< s
->num_irq
; irq
++) {
225 if (s
->vectors
[irq
].pending
) {
232 /* Return a mask word which clears the subpriority bits from
233 * a priority value for an M-profile exception, leaving only
234 * the group priority.
236 static inline uint32_t nvic_gprio_mask(NVICState
*s
)
238 return ~0U << (s
->prigroup
+ 1);
241 /* Recompute vectpending and exception_prio */
242 static void nvic_recompute_state(NVICState
*s
)
245 int pend_prio
= NVIC_NOEXC_PRIO
;
246 int active_prio
= NVIC_NOEXC_PRIO
;
249 for (i
= 1; i
< s
->num_irq
; i
++) {
250 VecInfo
*vec
= &s
->vectors
[i
];
252 if (vec
->enabled
&& vec
->pending
&& vec
->prio
< pend_prio
) {
253 pend_prio
= vec
->prio
;
256 if (vec
->active
&& vec
->prio
< active_prio
) {
257 active_prio
= vec
->prio
;
261 s
->vectpending
= pend_irq
;
262 s
->exception_prio
= active_prio
& nvic_gprio_mask(s
);
264 trace_nvic_recompute_state(s
->vectpending
, s
->exception_prio
);
267 /* Return the current execution priority of the CPU
268 * (equivalent to the pseudocode ExecutionPriority function).
269 * This is a value between -2 (NMI priority) and NVIC_NOEXC_PRIO.
271 static inline int nvic_exec_prio(NVICState
*s
)
273 CPUARMState
*env
= &s
->cpu
->env
;
276 if (env
->daif
& PSTATE_F
) { /* FAULTMASK */
278 } else if (env
->daif
& PSTATE_I
) { /* PRIMASK */
280 } else if (env
->v7m
.basepri
> 0) {
281 running
= env
->v7m
.basepri
& nvic_gprio_mask(s
);
283 running
= NVIC_NOEXC_PRIO
; /* lower than any possible priority */
285 /* consider priority of active handler */
286 return MIN(running
, s
->exception_prio
);
289 bool armv7m_nvic_can_take_pending_exception(void *opaque
)
291 NVICState
*s
= opaque
;
293 return nvic_exec_prio(s
) > nvic_pending_prio(s
);
296 /* caller must call nvic_irq_update() after this */
297 static void set_prio(NVICState
*s
, unsigned irq
, uint8_t prio
)
299 assert(irq
> ARMV7M_EXCP_NMI
); /* only use for configurable prios */
300 assert(irq
< s
->num_irq
);
302 s
->vectors
[irq
].prio
= prio
;
304 trace_nvic_set_prio(irq
, prio
);
307 /* Recompute state and assert irq line accordingly.
308 * Must be called after changes to:
309 * vec->active, vec->enabled, vec->pending or vec->prio for any vector
312 static void nvic_irq_update(NVICState
*s
)
317 nvic_recompute_state(s
);
318 pend_prio
= nvic_pending_prio(s
);
320 /* Raise NVIC output if this IRQ would be taken, except that we
321 * ignore the effects of the BASEPRI, FAULTMASK and PRIMASK (which
322 * will be checked for in arm_v7m_cpu_exec_interrupt()); changes
323 * to those CPU registers don't cause us to recalculate the NVIC
326 lvl
= (pend_prio
< s
->exception_prio
);
327 trace_nvic_irq_update(s
->vectpending
, pend_prio
, s
->exception_prio
, lvl
);
328 qemu_set_irq(s
->excpout
, lvl
);
331 static void armv7m_nvic_clear_pending(void *opaque
, int irq
)
333 NVICState
*s
= (NVICState
*)opaque
;
336 assert(irq
> ARMV7M_EXCP_RESET
&& irq
< s
->num_irq
);
338 vec
= &s
->vectors
[irq
];
339 trace_nvic_clear_pending(irq
, vec
->enabled
, vec
->prio
);
346 void armv7m_nvic_set_pending(void *opaque
, int irq
)
348 NVICState
*s
= (NVICState
*)opaque
;
351 assert(irq
> ARMV7M_EXCP_RESET
&& irq
< s
->num_irq
);
353 vec
= &s
->vectors
[irq
];
354 trace_nvic_set_pending(irq
, vec
->enabled
, vec
->prio
);
357 if (irq
>= ARMV7M_EXCP_HARD
&& irq
< ARMV7M_EXCP_PENDSV
) {
358 /* If a synchronous exception is pending then it may be
359 * escalated to HardFault if:
360 * * it is equal or lower priority to current execution
362 * (ie we need to take it immediately but we can't do so).
363 * Asynchronous exceptions (and interrupts) simply remain pending.
365 * For QEMU, we don't have any imprecise (asynchronous) faults,
366 * so we can assume that PREFETCH_ABORT and DATA_ABORT are always
368 * Debug exceptions are awkward because only Debug exceptions
369 * resulting from the BKPT instruction should be escalated,
370 * but we don't currently implement any Debug exceptions other
371 * than those that result from BKPT, so we treat all debug exceptions
372 * as needing escalation.
374 * This all means we can identify whether to escalate based only on
375 * the exception number and don't (yet) need the caller to explicitly
376 * tell us whether this exception is synchronous or not.
378 int running
= nvic_exec_prio(s
);
379 bool escalate
= false;
381 if (vec
->prio
>= running
) {
382 trace_nvic_escalate_prio(irq
, vec
->prio
, running
);
384 } else if (!vec
->enabled
) {
385 trace_nvic_escalate_disabled(irq
);
391 /* We want to escalate to HardFault but we can't take a
392 * synchronous HardFault at this point either. This is a
393 * Lockup condition due to a guest bug. We don't model
394 * Lockup, so report via cpu_abort() instead.
396 cpu_abort(&s
->cpu
->parent_obj
,
397 "Lockup: can't escalate %d to HardFault "
398 "(current priority %d)\n", irq
, running
);
401 /* We can do the escalation, so we take HardFault instead */
402 irq
= ARMV7M_EXCP_HARD
;
403 vec
= &s
->vectors
[irq
];
404 s
->cpu
->env
.v7m
.hfsr
|= R_V7M_HFSR_FORCED_MASK
;
414 /* Make pending IRQ active. */
415 void armv7m_nvic_acknowledge_irq(void *opaque
)
417 NVICState
*s
= (NVICState
*)opaque
;
418 CPUARMState
*env
= &s
->cpu
->env
;
419 const int pending
= s
->vectpending
;
420 const int running
= nvic_exec_prio(s
);
424 assert(pending
> ARMV7M_EXCP_RESET
&& pending
< s
->num_irq
);
426 vec
= &s
->vectors
[pending
];
428 assert(vec
->enabled
);
429 assert(vec
->pending
);
431 pendgroupprio
= vec
->prio
& nvic_gprio_mask(s
);
432 assert(pendgroupprio
< running
);
434 trace_nvic_acknowledge_irq(pending
, vec
->prio
);
439 env
->v7m
.exception
= s
->vectpending
;
444 int armv7m_nvic_complete_irq(void *opaque
, int irq
)
446 NVICState
*s
= (NVICState
*)opaque
;
450 assert(irq
> ARMV7M_EXCP_RESET
&& irq
< s
->num_irq
);
452 vec
= &s
->vectors
[irq
];
454 trace_nvic_complete_irq(irq
);
457 /* Tell the caller this was an illegal exception return */
461 ret
= nvic_rettobase(s
);
465 /* Re-pend the exception if it's still held high; only
466 * happens for extenal IRQs
468 assert(irq
>= NVIC_FIRST_IRQ
);
477 /* callback when external interrupt line is changed */
478 static void set_irq_level(void *opaque
, int n
, int level
)
480 NVICState
*s
= opaque
;
485 assert(n
>= NVIC_FIRST_IRQ
&& n
< s
->num_irq
);
487 trace_nvic_set_irq_level(n
, level
);
489 /* The pending status of an external interrupt is
490 * latched on rising edge and exception handler return.
492 * Pulsing the IRQ will always run the handler
493 * once, and the handler will re-run until the
494 * level is low when the handler completes.
496 vec
= &s
->vectors
[n
];
497 if (level
!= vec
->level
) {
500 armv7m_nvic_set_pending(s
, n
);
505 static uint32_t nvic_readl(NVICState
*s
, uint32_t offset
)
507 ARMCPU
*cpu
= s
->cpu
;
511 case 4: /* Interrupt Control Type. */
512 return ((s
->num_irq
- NVIC_FIRST_IRQ
) / 32) - 1;
513 case 0x10: /* SysTick Control and Status. */
514 val
= s
->systick
.control
;
515 s
->systick
.control
&= ~SYSTICK_COUNTFLAG
;
517 case 0x14: /* SysTick Reload Value. */
518 return s
->systick
.reload
;
519 case 0x18: /* SysTick Current Value. */
522 if ((s
->systick
.control
& SYSTICK_ENABLE
) == 0)
524 t
= qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL
);
525 if (t
>= s
->systick
.tick
)
527 val
= ((s
->systick
.tick
- (t
+ 1)) / systick_scale(s
)) + 1;
528 /* The interrupt in triggered when the timer reaches zero.
529 However the counter is not reloaded until the next clock
530 tick. This is a hack to return zero during the first tick. */
531 if (val
> s
->systick
.reload
)
535 case 0x1c: /* SysTick Calibration Value. */
537 case 0xd00: /* CPUID Base. */
539 case 0xd04: /* Interrupt Control State. */
541 val
= cpu
->env
.v7m
.exception
;
543 val
|= (s
->vectpending
& 0xff) << 12;
544 /* ISRPENDING - set if any external IRQ is pending */
545 if (nvic_isrpending(s
)) {
548 /* RETTOBASE - set if only one handler is active */
549 if (nvic_rettobase(s
)) {
553 if (s
->vectors
[ARMV7M_EXCP_SYSTICK
].pending
) {
557 if (s
->vectors
[ARMV7M_EXCP_PENDSV
].pending
) {
561 if (s
->vectors
[ARMV7M_EXCP_NMI
].pending
) {
564 /* ISRPREEMPT not implemented */
566 case 0xd08: /* Vector Table Offset. */
567 return cpu
->env
.v7m
.vecbase
;
568 case 0xd0c: /* Application Interrupt/Reset Control. */
569 return 0xfa050000 | (s
->prigroup
<< 8);
570 case 0xd10: /* System Control. */
571 /* TODO: Implement SLEEPONEXIT. */
573 case 0xd14: /* Configuration Control. */
574 return cpu
->env
.v7m
.ccr
;
575 case 0xd24: /* System Handler Status. */
577 if (s
->vectors
[ARMV7M_EXCP_MEM
].active
) {
580 if (s
->vectors
[ARMV7M_EXCP_BUS
].active
) {
583 if (s
->vectors
[ARMV7M_EXCP_USAGE
].active
) {
586 if (s
->vectors
[ARMV7M_EXCP_SVC
].active
) {
589 if (s
->vectors
[ARMV7M_EXCP_DEBUG
].active
) {
592 if (s
->vectors
[ARMV7M_EXCP_PENDSV
].active
) {
595 if (s
->vectors
[ARMV7M_EXCP_SYSTICK
].active
) {
598 if (s
->vectors
[ARMV7M_EXCP_USAGE
].pending
) {
601 if (s
->vectors
[ARMV7M_EXCP_MEM
].pending
) {
604 if (s
->vectors
[ARMV7M_EXCP_BUS
].pending
) {
607 if (s
->vectors
[ARMV7M_EXCP_SVC
].pending
) {
610 if (s
->vectors
[ARMV7M_EXCP_MEM
].enabled
) {
613 if (s
->vectors
[ARMV7M_EXCP_BUS
].enabled
) {
616 if (s
->vectors
[ARMV7M_EXCP_USAGE
].enabled
) {
620 case 0xd28: /* Configurable Fault Status. */
621 return cpu
->env
.v7m
.cfsr
;
622 case 0xd2c: /* Hard Fault Status. */
623 return cpu
->env
.v7m
.hfsr
;
624 case 0xd30: /* Debug Fault Status. */
625 return cpu
->env
.v7m
.dfsr
;
626 case 0xd34: /* MMFAR MemManage Fault Address */
627 return cpu
->env
.v7m
.mmfar
;
628 case 0xd38: /* Bus Fault Address. */
629 return cpu
->env
.v7m
.bfar
;
630 case 0xd3c: /* Aux Fault Status. */
631 /* TODO: Implement fault status registers. */
632 qemu_log_mask(LOG_UNIMP
,
633 "Aux Fault status registers unimplemented\n");
635 case 0xd40: /* PFR0. */
637 case 0xd44: /* PRF1. */
639 case 0xd48: /* DFR0. */
641 case 0xd4c: /* AFR0. */
643 case 0xd50: /* MMFR0. */
645 case 0xd54: /* MMFR1. */
647 case 0xd58: /* MMFR2. */
649 case 0xd5c: /* MMFR3. */
651 case 0xd60: /* ISAR0. */
653 case 0xd64: /* ISAR1. */
655 case 0xd68: /* ISAR2. */
657 case 0xd6c: /* ISAR3. */
659 case 0xd70: /* ISAR4. */
661 /* TODO: Implement debug registers. */
663 qemu_log_mask(LOG_GUEST_ERROR
, "NVIC: Bad read offset 0x%x\n", offset
);
668 static void nvic_writel(NVICState
*s
, uint32_t offset
, uint32_t value
)
670 ARMCPU
*cpu
= s
->cpu
;
673 case 0x10: /* SysTick Control and Status. */
674 oldval
= s
->systick
.control
;
675 s
->systick
.control
&= 0xfffffff8;
676 s
->systick
.control
|= value
& 7;
677 if ((oldval
^ value
) & SYSTICK_ENABLE
) {
678 int64_t now
= qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL
);
679 if (value
& SYSTICK_ENABLE
) {
680 if (s
->systick
.tick
) {
681 s
->systick
.tick
+= now
;
682 timer_mod(s
->systick
.timer
, s
->systick
.tick
);
684 systick_reload(s
, 1);
687 timer_del(s
->systick
.timer
);
688 s
->systick
.tick
-= now
;
689 if (s
->systick
.tick
< 0)
692 } else if ((oldval
^ value
) & SYSTICK_CLKSOURCE
) {
693 /* This is a hack. Force the timer to be reloaded
694 when the reference clock is changed. */
695 systick_reload(s
, 1);
698 case 0x14: /* SysTick Reload Value. */
699 s
->systick
.reload
= value
;
701 case 0x18: /* SysTick Current Value. Writes reload the timer. */
702 systick_reload(s
, 1);
703 s
->systick
.control
&= ~SYSTICK_COUNTFLAG
;
705 case 0xd04: /* Interrupt Control State. */
706 if (value
& (1 << 31)) {
707 armv7m_nvic_set_pending(s
, ARMV7M_EXCP_NMI
);
709 if (value
& (1 << 28)) {
710 armv7m_nvic_set_pending(s
, ARMV7M_EXCP_PENDSV
);
711 } else if (value
& (1 << 27)) {
712 armv7m_nvic_clear_pending(s
, ARMV7M_EXCP_PENDSV
);
714 if (value
& (1 << 26)) {
715 armv7m_nvic_set_pending(s
, ARMV7M_EXCP_SYSTICK
);
716 } else if (value
& (1 << 25)) {
717 armv7m_nvic_clear_pending(s
, ARMV7M_EXCP_SYSTICK
);
720 case 0xd08: /* Vector Table Offset. */
721 cpu
->env
.v7m
.vecbase
= value
& 0xffffff80;
723 case 0xd0c: /* Application Interrupt/Reset Control. */
724 if ((value
>> 16) == 0x05fa) {
726 qemu_irq_pulse(s
->sysresetreq
);
729 qemu_log_mask(LOG_GUEST_ERROR
,
730 "Setting VECTCLRACTIVE when not in DEBUG mode "
731 "is UNPREDICTABLE\n");
734 qemu_log_mask(LOG_GUEST_ERROR
,
735 "Setting VECTRESET when not in DEBUG mode "
736 "is UNPREDICTABLE\n");
738 s
->prigroup
= extract32(value
, 8, 3);
742 case 0xd10: /* System Control. */
743 /* TODO: Implement control registers. */
744 qemu_log_mask(LOG_UNIMP
, "NVIC: SCR unimplemented\n");
746 case 0xd14: /* Configuration Control. */
747 /* Enforce RAZ/WI on reserved and must-RAZ/WI bits */
748 value
&= (R_V7M_CCR_STKALIGN_MASK
|
749 R_V7M_CCR_BFHFNMIGN_MASK
|
750 R_V7M_CCR_DIV_0_TRP_MASK
|
751 R_V7M_CCR_UNALIGN_TRP_MASK
|
752 R_V7M_CCR_USERSETMPEND_MASK
|
753 R_V7M_CCR_NONBASETHRDENA_MASK
);
755 cpu
->env
.v7m
.ccr
= value
;
757 case 0xd24: /* System Handler Control. */
758 /* TODO: Real hardware allows you to set/clear the active bits
759 under some circumstances. We don't implement this. */
760 s
->vectors
[ARMV7M_EXCP_MEM
].enabled
= (value
& (1 << 16)) != 0;
761 s
->vectors
[ARMV7M_EXCP_BUS
].enabled
= (value
& (1 << 17)) != 0;
762 s
->vectors
[ARMV7M_EXCP_USAGE
].enabled
= (value
& (1 << 18)) != 0;
765 case 0xd28: /* Configurable Fault Status. */
766 cpu
->env
.v7m
.cfsr
&= ~value
; /* W1C */
768 case 0xd2c: /* Hard Fault Status. */
769 cpu
->env
.v7m
.hfsr
&= ~value
; /* W1C */
771 case 0xd30: /* Debug Fault Status. */
772 cpu
->env
.v7m
.dfsr
&= ~value
; /* W1C */
774 case 0xd34: /* Mem Manage Address. */
775 cpu
->env
.v7m
.mmfar
= value
;
777 case 0xd38: /* Bus Fault Address. */
778 cpu
->env
.v7m
.bfar
= value
;
780 case 0xd3c: /* Aux Fault Status. */
781 qemu_log_mask(LOG_UNIMP
,
782 "NVIC: Aux fault status registers unimplemented\n");
784 case 0xf00: /* Software Triggered Interrupt Register */
786 /* user mode can only write to STIR if CCR.USERSETMPEND permits it */
787 int excnum
= (value
& 0x1ff) + NVIC_FIRST_IRQ
;
788 if (excnum
< s
->num_irq
&&
789 (arm_current_el(&cpu
->env
) ||
790 (cpu
->env
.v7m
.ccr
& R_V7M_CCR_USERSETMPEND_MASK
))) {
791 armv7m_nvic_set_pending(s
, excnum
);
796 qemu_log_mask(LOG_GUEST_ERROR
,
797 "NVIC: Bad write offset 0x%x\n", offset
);
801 static uint64_t nvic_sysreg_read(void *opaque
, hwaddr addr
,
804 NVICState
*s
= (NVICState
*)opaque
;
805 uint32_t offset
= addr
;
806 unsigned i
, startvec
, end
;
810 /* reads of set and clear both return the status */
811 case 0x100 ... 0x13f: /* NVIC Set enable */
814 case 0x180 ... 0x1bf: /* NVIC Clear enable */
816 startvec
= offset
- 0x180 + NVIC_FIRST_IRQ
; /* vector # */
818 for (i
= 0, end
= size
* 8; i
< end
&& startvec
+ i
< s
->num_irq
; i
++) {
819 if (s
->vectors
[startvec
+ i
].enabled
) {
824 case 0x200 ... 0x23f: /* NVIC Set pend */
827 case 0x280 ... 0x2bf: /* NVIC Clear pend */
829 startvec
= offset
- 0x280 + NVIC_FIRST_IRQ
; /* vector # */
830 for (i
= 0, end
= size
* 8; i
< end
&& startvec
+ i
< s
->num_irq
; i
++) {
831 if (s
->vectors
[startvec
+ i
].pending
) {
836 case 0x300 ... 0x33f: /* NVIC Active */
838 startvec
= offset
- 0x300 + NVIC_FIRST_IRQ
; /* vector # */
840 for (i
= 0, end
= size
* 8; i
< end
&& startvec
+ i
< s
->num_irq
; i
++) {
841 if (s
->vectors
[startvec
+ i
].active
) {
846 case 0x400 ... 0x5ef: /* NVIC Priority */
848 startvec
= offset
- 0x400 + NVIC_FIRST_IRQ
; /* vector # */
850 for (i
= 0; i
< size
&& startvec
+ i
< s
->num_irq
; i
++) {
851 val
|= s
->vectors
[startvec
+ i
].prio
<< (8 * i
);
854 case 0xd18 ... 0xd23: /* System Handler Priority. */
856 for (i
= 0; i
< size
; i
++) {
857 val
|= s
->vectors
[(offset
- 0xd14) + i
].prio
<< (i
* 8);
860 case 0xfe0 ... 0xfff: /* ID. */
864 val
= nvic_id
[(offset
- 0xfe0) >> 2];
869 val
= nvic_readl(s
, offset
);
871 qemu_log_mask(LOG_GUEST_ERROR
,
872 "NVIC: Bad read of size %d at offset 0x%x\n",
878 trace_nvic_sysreg_read(addr
, val
, size
);
882 static void nvic_sysreg_write(void *opaque
, hwaddr addr
,
883 uint64_t value
, unsigned size
)
885 NVICState
*s
= (NVICState
*)opaque
;
886 uint32_t offset
= addr
;
887 unsigned i
, startvec
, end
;
890 trace_nvic_sysreg_write(addr
, value
, size
);
893 case 0x100 ... 0x13f: /* NVIC Set enable */
897 case 0x180 ... 0x1bf: /* NVIC Clear enable */
898 startvec
= 8 * (offset
- 0x180) + NVIC_FIRST_IRQ
;
900 for (i
= 0, end
= size
* 8; i
< end
&& startvec
+ i
< s
->num_irq
; i
++) {
901 if (value
& (1 << i
)) {
902 s
->vectors
[startvec
+ i
].enabled
= setval
;
907 case 0x200 ... 0x23f: /* NVIC Set pend */
908 /* the special logic in armv7m_nvic_set_pending()
909 * is not needed since IRQs are never escalated
914 case 0x280 ... 0x2bf: /* NVIC Clear pend */
915 startvec
= 8 * (offset
- 0x280) + NVIC_FIRST_IRQ
; /* vector # */
917 for (i
= 0, end
= size
* 8; i
< end
&& startvec
+ i
< s
->num_irq
; i
++) {
918 if (value
& (1 << i
)) {
919 s
->vectors
[startvec
+ i
].pending
= setval
;
924 case 0x300 ... 0x33f: /* NVIC Active */
926 case 0x400 ... 0x5ef: /* NVIC Priority */
927 startvec
= 8 * (offset
- 0x400) + NVIC_FIRST_IRQ
; /* vector # */
929 for (i
= 0; i
< size
&& startvec
+ i
< s
->num_irq
; i
++) {
930 set_prio(s
, startvec
+ i
, (value
>> (i
* 8)) & 0xff);
934 case 0xd18 ... 0xd23: /* System Handler Priority. */
935 for (i
= 0; i
< size
; i
++) {
936 unsigned hdlidx
= (offset
- 0xd14) + i
;
937 set_prio(s
, hdlidx
, (value
>> (i
* 8)) & 0xff);
943 nvic_writel(s
, offset
, value
);
946 qemu_log_mask(LOG_GUEST_ERROR
,
947 "NVIC: Bad write of size %d at offset 0x%x\n", size
, offset
);
950 static const MemoryRegionOps nvic_sysreg_ops
= {
951 .read
= nvic_sysreg_read
,
952 .write
= nvic_sysreg_write
,
953 .endianness
= DEVICE_NATIVE_ENDIAN
,
956 static int nvic_post_load(void *opaque
, int version_id
)
958 NVICState
*s
= opaque
;
961 /* Check for out of range priority settings */
962 if (s
->vectors
[ARMV7M_EXCP_RESET
].prio
!= -3 ||
963 s
->vectors
[ARMV7M_EXCP_NMI
].prio
!= -2 ||
964 s
->vectors
[ARMV7M_EXCP_HARD
].prio
!= -1) {
967 for (i
= ARMV7M_EXCP_MEM
; i
< s
->num_irq
; i
++) {
968 if (s
->vectors
[i
].prio
& ~0xff) {
973 nvic_recompute_state(s
);
978 static const VMStateDescription vmstate_VecInfo
= {
979 .name
= "armv7m_nvic_info",
981 .minimum_version_id
= 1,
982 .fields
= (VMStateField
[]) {
983 VMSTATE_INT16(prio
, VecInfo
),
984 VMSTATE_UINT8(enabled
, VecInfo
),
985 VMSTATE_UINT8(pending
, VecInfo
),
986 VMSTATE_UINT8(active
, VecInfo
),
987 VMSTATE_UINT8(level
, VecInfo
),
988 VMSTATE_END_OF_LIST()
992 static const VMStateDescription vmstate_nvic
= {
993 .name
= "armv7m_nvic",
995 .minimum_version_id
= 3,
996 .post_load
= &nvic_post_load
,
997 .fields
= (VMStateField
[]) {
998 VMSTATE_STRUCT_ARRAY(vectors
, NVICState
, NVIC_MAX_VECTORS
, 1,
999 vmstate_VecInfo
, VecInfo
),
1000 VMSTATE_UINT32(systick
.control
, NVICState
),
1001 VMSTATE_UINT32(systick
.reload
, NVICState
),
1002 VMSTATE_INT64(systick
.tick
, NVICState
),
1003 VMSTATE_TIMER_PTR(systick
.timer
, NVICState
),
1004 VMSTATE_UINT32(prigroup
, NVICState
),
1005 VMSTATE_END_OF_LIST()
1009 static Property props_nvic
[] = {
1010 /* Number of external IRQ lines (so excluding the 16 internal exceptions) */
1011 DEFINE_PROP_UINT32("num-irq", NVICState
, num_irq
, 64),
1012 DEFINE_PROP_END_OF_LIST()
1015 static void armv7m_nvic_reset(DeviceState
*dev
)
1017 NVICState
*s
= NVIC(dev
);
1019 s
->vectors
[ARMV7M_EXCP_NMI
].enabled
= 1;
1020 s
->vectors
[ARMV7M_EXCP_HARD
].enabled
= 1;
1021 /* MEM, BUS, and USAGE are enabled through
1022 * the System Handler Control register
1024 s
->vectors
[ARMV7M_EXCP_SVC
].enabled
= 1;
1025 s
->vectors
[ARMV7M_EXCP_DEBUG
].enabled
= 1;
1026 s
->vectors
[ARMV7M_EXCP_PENDSV
].enabled
= 1;
1027 s
->vectors
[ARMV7M_EXCP_SYSTICK
].enabled
= 1;
1029 s
->vectors
[ARMV7M_EXCP_RESET
].prio
= -3;
1030 s
->vectors
[ARMV7M_EXCP_NMI
].prio
= -2;
1031 s
->vectors
[ARMV7M_EXCP_HARD
].prio
= -1;
1033 /* Strictly speaking the reset handler should be enabled.
1034 * However, we don't simulate soft resets through the NVIC,
1035 * and the reset vector should never be pended.
1036 * So we leave it disabled to catch logic errors.
1039 s
->exception_prio
= NVIC_NOEXC_PRIO
;
1045 static void armv7m_nvic_realize(DeviceState
*dev
, Error
**errp
)
1047 NVICState
*s
= NVIC(dev
);
1049 s
->cpu
= ARM_CPU(qemu_get_cpu(0));
1052 if (s
->num_irq
> NVIC_MAX_IRQ
) {
1053 error_setg(errp
, "num-irq %d exceeds NVIC maximum", s
->num_irq
);
1057 qdev_init_gpio_in(dev
, set_irq_level
, s
->num_irq
);
1059 /* include space for internal exception vectors */
1060 s
->num_irq
+= NVIC_FIRST_IRQ
;
1062 /* The NVIC and System Control Space (SCS) starts at 0xe000e000
1063 * and looks like this:
1065 * 0x010 - 0x1c - systick
1066 * 0x100..0x7ec - NVIC
1067 * 0x7f0..0xcff - Reserved
1068 * 0xd00..0xd3c - SCS registers
1069 * 0xd40..0xeff - Reserved or Not implemented
1072 * At the moment there is only one thing in the container region,
1073 * but we leave it in place to allow us to pull systick out into
1074 * its own device object later.
1076 memory_region_init(&s
->container
, OBJECT(s
), "nvic", 0x1000);
1077 /* The system register region goes at the bottom of the priority
1078 * stack as it covers the whole page.
1080 memory_region_init_io(&s
->sysregmem
, OBJECT(s
), &nvic_sysreg_ops
, s
,
1081 "nvic_sysregs", 0x1000);
1082 memory_region_add_subregion(&s
->container
, 0, &s
->sysregmem
);
1084 /* Map the whole thing into system memory at the location required
1085 * by the v7M architecture.
1087 memory_region_add_subregion(get_system_memory(), 0xe000e000, &s
->container
);
1088 s
->systick
.timer
= timer_new_ns(QEMU_CLOCK_VIRTUAL
, systick_timer_tick
, s
);
1091 static void armv7m_nvic_instance_init(Object
*obj
)
1093 /* We have a different default value for the num-irq property
1094 * than our superclass. This function runs after qdev init
1095 * has set the defaults from the Property array and before
1096 * any user-specified property setting, so just modify the
1097 * value in the GICState struct.
1099 DeviceState
*dev
= DEVICE(obj
);
1100 NVICState
*nvic
= NVIC(obj
);
1101 SysBusDevice
*sbd
= SYS_BUS_DEVICE(obj
);
1103 sysbus_init_irq(sbd
, &nvic
->excpout
);
1104 qdev_init_gpio_out_named(dev
, &nvic
->sysresetreq
, "SYSRESETREQ", 1);
1107 static void armv7m_nvic_class_init(ObjectClass
*klass
, void *data
)
1109 DeviceClass
*dc
= DEVICE_CLASS(klass
);
1111 dc
->vmsd
= &vmstate_nvic
;
1112 dc
->props
= props_nvic
;
1113 dc
->reset
= armv7m_nvic_reset
;
1114 dc
->realize
= armv7m_nvic_realize
;
1117 static const TypeInfo armv7m_nvic_info
= {
1119 .parent
= TYPE_SYS_BUS_DEVICE
,
1120 .instance_init
= armv7m_nvic_instance_init
,
1121 .instance_size
= sizeof(NVICState
),
1122 .class_init
= armv7m_nvic_class_init
,
1123 .class_size
= sizeof(SysBusDeviceClass
),
1126 static void armv7m_nvic_register_types(void)
1128 type_register_static(&armv7m_nvic_info
);
1131 type_init(armv7m_nvic_register_types
)