2 * ARM Nested Vectored Interrupt Controller
4 * Copyright (c) 2006-2007 CodeSourcery.
5 * Written by Paul Brook
7 * This code is licensed under the GPL.
9 * The ARMv7M System controller is fairly tightly tied in with the
10 * NVIC. Much of that is also implemented here.
13 #include "qemu/osdep.h"
14 #include "qapi/error.h"
16 #include "hw/sysbus.h"
17 #include "migration/vmstate.h"
18 #include "qemu/timer.h"
19 #include "hw/intc/armv7m_nvic.h"
21 #include "hw/qdev-properties.h"
22 #include "sysemu/runstate.h"
23 #include "target/arm/cpu.h"
24 #include "exec/exec-all.h"
25 #include "exec/memop.h"
27 #include "qemu/module.h"
30 /* IRQ number counting:
32 * the num-irq property counts the number of external IRQ lines
34 * NVICState::num_irq counts the total number of exceptions
35 * (external IRQs, the 15 internal exceptions including reset,
36 * and one for the unused exception number 0).
38 * NVIC_MAX_IRQ is the highest permitted number of external IRQ lines.
40 * NVIC_MAX_VECTORS is the highest permitted number of exceptions.
42 * Iterating through all exceptions should typically be done with
43 * for (i = 1; i < s->num_irq; i++) to avoid the unused slot 0.
45 * The external qemu_irq lines are the NVIC's external IRQ lines,
46 * so line 0 is exception 16.
48 * In the terminology of the architecture manual, "interrupts" are
49 * a subcategory of exception referring to the external interrupts
50 * (which are exception numbers NVIC_FIRST_IRQ and upward).
51 * For historical reasons QEMU tends to use "interrupt" and
52 * "exception" more or less interchangeably.
54 #define NVIC_FIRST_IRQ NVIC_INTERNAL_VECTORS
55 #define NVIC_MAX_IRQ (NVIC_MAX_VECTORS - NVIC_FIRST_IRQ)
57 /* Effective running priority of the CPU when no exception is active
58 * (higher than the highest possible priority value)
60 #define NVIC_NOEXC_PRIO 0x100
61 /* Maximum priority of non-secure exceptions when AIRCR.PRIS is set */
62 #define NVIC_NS_PRIO_LIMIT 0x80
64 static const uint8_t nvic_id
[] = {
65 0x00, 0xb0, 0x1b, 0x00, 0x0d, 0xe0, 0x05, 0xb1
68 static void signal_sysresetreq(NVICState
*s
)
70 if (qemu_irq_is_connected(s
->sysresetreq
)) {
71 qemu_irq_pulse(s
->sysresetreq
);
74 * Default behaviour if the SoC doesn't need to wire up
75 * SYSRESETREQ (eg to a system reset controller of some kind):
76 * perform a system reset via the usual QEMU API.
78 qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET
);
82 static int nvic_pending_prio(NVICState
*s
)
84 /* return the group priority of the current pending interrupt,
85 * or NVIC_NOEXC_PRIO if no interrupt is pending
87 return s
->vectpending_prio
;
90 /* Return the value of the ISCR RETTOBASE bit:
91 * 1 if there is exactly one active exception
92 * 0 if there is more than one active exception
93 * UNKNOWN if there are no active exceptions (we choose 1,
94 * which matches the choice Cortex-M3 is documented as making).
96 * NB: some versions of the documentation talk about this
97 * counting "active exceptions other than the one shown by IPSR";
98 * this is only different in the obscure corner case where guest
99 * code has manually deactivated an exception and is about
100 * to fail an exception-return integrity check. The definition
101 * above is the one from the v8M ARM ARM and is also in line
102 * with the behaviour documented for the Cortex-M3.
104 static bool nvic_rettobase(NVICState
*s
)
107 bool check_sec
= arm_feature(&s
->cpu
->env
, ARM_FEATURE_M_SECURITY
);
109 for (irq
= ARMV7M_EXCP_RESET
; irq
< s
->num_irq
; irq
++) {
110 if (s
->vectors
[irq
].active
||
111 (check_sec
&& irq
< NVIC_INTERNAL_VECTORS
&&
112 s
->sec_vectors
[irq
].active
)) {
123 /* Return the value of the ISCR ISRPENDING bit:
124 * 1 if an external interrupt is pending
125 * 0 if no external interrupt is pending
127 static bool nvic_isrpending(NVICState
*s
)
131 /* We can shortcut if the highest priority pending interrupt
132 * happens to be external or if there is nothing pending.
134 if (s
->vectpending
> NVIC_FIRST_IRQ
) {
137 if (s
->vectpending
== 0) {
141 for (irq
= NVIC_FIRST_IRQ
; irq
< s
->num_irq
; irq
++) {
142 if (s
->vectors
[irq
].pending
) {
149 static bool exc_is_banked(int exc
)
151 /* Return true if this is one of the limited set of exceptions which
152 * are banked (and thus have state in sec_vectors[])
154 return exc
== ARMV7M_EXCP_HARD
||
155 exc
== ARMV7M_EXCP_MEM
||
156 exc
== ARMV7M_EXCP_USAGE
||
157 exc
== ARMV7M_EXCP_SVC
||
158 exc
== ARMV7M_EXCP_PENDSV
||
159 exc
== ARMV7M_EXCP_SYSTICK
;
162 /* Return a mask word which clears the subpriority bits from
163 * a priority value for an M-profile exception, leaving only
164 * the group priority.
166 static inline uint32_t nvic_gprio_mask(NVICState
*s
, bool secure
)
168 return ~0U << (s
->prigroup
[secure
] + 1);
171 static bool exc_targets_secure(NVICState
*s
, int exc
)
173 /* Return true if this non-banked exception targets Secure state. */
174 if (!arm_feature(&s
->cpu
->env
, ARM_FEATURE_M_SECURITY
)) {
178 if (exc
>= NVIC_FIRST_IRQ
) {
179 return !s
->itns
[exc
];
182 /* Function shouldn't be called for banked exceptions. */
183 assert(!exc_is_banked(exc
));
186 case ARMV7M_EXCP_NMI
:
187 case ARMV7M_EXCP_BUS
:
188 return !(s
->cpu
->env
.v7m
.aircr
& R_V7M_AIRCR_BFHFNMINS_MASK
);
189 case ARMV7M_EXCP_SECURE
:
191 case ARMV7M_EXCP_DEBUG
:
192 /* TODO: controlled by DEMCR.SDME, which we don't yet implement */
195 /* reset, and reserved (unused) low exception numbers.
196 * We'll get called by code that loops through all the exception
197 * numbers, but it doesn't matter what we return here as these
198 * non-existent exceptions will never be pended or active.
204 static int exc_group_prio(NVICState
*s
, int rawprio
, bool targets_secure
)
206 /* Return the group priority for this exception, given its raw
207 * (group-and-subgroup) priority value and whether it is targeting
208 * secure state or not.
213 rawprio
&= nvic_gprio_mask(s
, targets_secure
);
214 /* AIRCR.PRIS causes us to squash all NS priorities into the
215 * lower half of the total range
217 if (!targets_secure
&&
218 (s
->cpu
->env
.v7m
.aircr
& R_V7M_AIRCR_PRIS_MASK
)) {
219 rawprio
= (rawprio
>> 1) + NVIC_NS_PRIO_LIMIT
;
224 /* Recompute vectpending and exception_prio for a CPU which implements
225 * the Security extension
227 static void nvic_recompute_state_secure(NVICState
*s
)
230 int pend_prio
= NVIC_NOEXC_PRIO
;
231 int active_prio
= NVIC_NOEXC_PRIO
;
233 bool pending_is_s_banked
= false;
234 int pend_subprio
= 0;
236 /* R_CQRV: precedence is by:
237 * - lowest group priority; if both the same then
238 * - lowest subpriority; if both the same then
239 * - lowest exception number; if both the same (ie banked) then
240 * - secure exception takes precedence
241 * Compare pseudocode RawExecutionPriority.
242 * Annoyingly, now we have two prigroup values (for S and NS)
243 * we can't do the loop comparison on raw priority values.
245 for (i
= 1; i
< s
->num_irq
; i
++) {
246 for (bank
= M_REG_S
; bank
>= M_REG_NS
; bank
--) {
251 if (bank
== M_REG_S
) {
252 if (!exc_is_banked(i
)) {
255 vec
= &s
->sec_vectors
[i
];
256 targets_secure
= true;
258 vec
= &s
->vectors
[i
];
259 targets_secure
= !exc_is_banked(i
) && exc_targets_secure(s
, i
);
262 prio
= exc_group_prio(s
, vec
->prio
, targets_secure
);
263 subprio
= vec
->prio
& ~nvic_gprio_mask(s
, targets_secure
);
264 if (vec
->enabled
&& vec
->pending
&&
265 ((prio
< pend_prio
) ||
266 (prio
== pend_prio
&& prio
>= 0 && subprio
< pend_subprio
))) {
268 pend_subprio
= subprio
;
270 pending_is_s_banked
= (bank
== M_REG_S
);
272 if (vec
->active
&& prio
< active_prio
) {
278 s
->vectpending_is_s_banked
= pending_is_s_banked
;
279 s
->vectpending
= pend_irq
;
280 s
->vectpending_prio
= pend_prio
;
281 s
->exception_prio
= active_prio
;
283 trace_nvic_recompute_state_secure(s
->vectpending
,
284 s
->vectpending_is_s_banked
,
289 /* Recompute vectpending and exception_prio */
290 static void nvic_recompute_state(NVICState
*s
)
293 int pend_prio
= NVIC_NOEXC_PRIO
;
294 int active_prio
= NVIC_NOEXC_PRIO
;
297 /* In theory we could write one function that handled both
298 * the "security extension present" and "not present"; however
299 * the security related changes significantly complicate the
300 * recomputation just by themselves and mixing both cases together
301 * would be even worse, so we retain a separate non-secure-only
302 * version for CPUs which don't implement the security extension.
304 if (arm_feature(&s
->cpu
->env
, ARM_FEATURE_M_SECURITY
)) {
305 nvic_recompute_state_secure(s
);
309 for (i
= 1; i
< s
->num_irq
; i
++) {
310 VecInfo
*vec
= &s
->vectors
[i
];
312 if (vec
->enabled
&& vec
->pending
&& vec
->prio
< pend_prio
) {
313 pend_prio
= vec
->prio
;
316 if (vec
->active
&& vec
->prio
< active_prio
) {
317 active_prio
= vec
->prio
;
321 if (active_prio
> 0) {
322 active_prio
&= nvic_gprio_mask(s
, false);
326 pend_prio
&= nvic_gprio_mask(s
, false);
329 s
->vectpending
= pend_irq
;
330 s
->vectpending_prio
= pend_prio
;
331 s
->exception_prio
= active_prio
;
333 trace_nvic_recompute_state(s
->vectpending
,
338 /* Return the current execution priority of the CPU
339 * (equivalent to the pseudocode ExecutionPriority function).
340 * This is a value between -2 (NMI priority) and NVIC_NOEXC_PRIO.
342 static inline int nvic_exec_prio(NVICState
*s
)
344 CPUARMState
*env
= &s
->cpu
->env
;
345 int running
= NVIC_NOEXC_PRIO
;
347 if (env
->v7m
.basepri
[M_REG_NS
] > 0) {
348 running
= exc_group_prio(s
, env
->v7m
.basepri
[M_REG_NS
], M_REG_NS
);
351 if (env
->v7m
.basepri
[M_REG_S
] > 0) {
352 int basepri
= exc_group_prio(s
, env
->v7m
.basepri
[M_REG_S
], M_REG_S
);
353 if (running
> basepri
) {
358 if (env
->v7m
.primask
[M_REG_NS
]) {
359 if (env
->v7m
.aircr
& R_V7M_AIRCR_PRIS_MASK
) {
360 if (running
> NVIC_NS_PRIO_LIMIT
) {
361 running
= NVIC_NS_PRIO_LIMIT
;
368 if (env
->v7m
.primask
[M_REG_S
]) {
372 if (env
->v7m
.faultmask
[M_REG_NS
]) {
373 if (env
->v7m
.aircr
& R_V7M_AIRCR_BFHFNMINS_MASK
) {
376 if (env
->v7m
.aircr
& R_V7M_AIRCR_PRIS_MASK
) {
377 if (running
> NVIC_NS_PRIO_LIMIT
) {
378 running
= NVIC_NS_PRIO_LIMIT
;
386 if (env
->v7m
.faultmask
[M_REG_S
]) {
387 running
= (env
->v7m
.aircr
& R_V7M_AIRCR_BFHFNMINS_MASK
) ? -3 : -1;
390 /* consider priority of active handler */
391 return MIN(running
, s
->exception_prio
);
394 bool armv7m_nvic_neg_prio_requested(void *opaque
, bool secure
)
396 /* Return true if the requested execution priority is negative
397 * for the specified security state, ie that security state
398 * has an active NMI or HardFault or has set its FAULTMASK.
399 * Note that this is not the same as whether the execution
400 * priority is actually negative (for instance AIRCR.PRIS may
401 * mean we don't allow FAULTMASK_NS to actually make the execution
402 * priority negative). Compare pseudocode IsReqExcPriNeg().
404 NVICState
*s
= opaque
;
406 if (s
->cpu
->env
.v7m
.faultmask
[secure
]) {
410 if (secure
? s
->sec_vectors
[ARMV7M_EXCP_HARD
].active
:
411 s
->vectors
[ARMV7M_EXCP_HARD
].active
) {
415 if (s
->vectors
[ARMV7M_EXCP_NMI
].active
&&
416 exc_targets_secure(s
, ARMV7M_EXCP_NMI
) == secure
) {
423 bool armv7m_nvic_can_take_pending_exception(void *opaque
)
425 NVICState
*s
= opaque
;
427 return nvic_exec_prio(s
) > nvic_pending_prio(s
);
430 int armv7m_nvic_raw_execution_priority(void *opaque
)
432 NVICState
*s
= opaque
;
434 return s
->exception_prio
;
437 /* caller must call nvic_irq_update() after this.
438 * secure indicates the bank to use for banked exceptions (we assert if
439 * we are passed secure=true for a non-banked exception).
441 static void set_prio(NVICState
*s
, unsigned irq
, bool secure
, uint8_t prio
)
443 assert(irq
> ARMV7M_EXCP_NMI
); /* only use for configurable prios */
444 assert(irq
< s
->num_irq
);
446 prio
&= MAKE_64BIT_MASK(8 - s
->num_prio_bits
, s
->num_prio_bits
);
449 assert(exc_is_banked(irq
));
450 s
->sec_vectors
[irq
].prio
= prio
;
452 s
->vectors
[irq
].prio
= prio
;
455 trace_nvic_set_prio(irq
, secure
, prio
);
458 /* Return the current raw priority register value.
459 * secure indicates the bank to use for banked exceptions (we assert if
460 * we are passed secure=true for a non-banked exception).
462 static int get_prio(NVICState
*s
, unsigned irq
, bool secure
)
464 assert(irq
> ARMV7M_EXCP_NMI
); /* only use for configurable prios */
465 assert(irq
< s
->num_irq
);
468 assert(exc_is_banked(irq
));
469 return s
->sec_vectors
[irq
].prio
;
471 return s
->vectors
[irq
].prio
;
475 /* Recompute state and assert irq line accordingly.
476 * Must be called after changes to:
477 * vec->active, vec->enabled, vec->pending or vec->prio for any vector
480 static void nvic_irq_update(NVICState
*s
)
485 nvic_recompute_state(s
);
486 pend_prio
= nvic_pending_prio(s
);
488 /* Raise NVIC output if this IRQ would be taken, except that we
489 * ignore the effects of the BASEPRI, FAULTMASK and PRIMASK (which
490 * will be checked for in arm_v7m_cpu_exec_interrupt()); changes
491 * to those CPU registers don't cause us to recalculate the NVIC
494 lvl
= (pend_prio
< s
->exception_prio
);
495 trace_nvic_irq_update(s
->vectpending
, pend_prio
, s
->exception_prio
, lvl
);
496 qemu_set_irq(s
->excpout
, lvl
);
500 * armv7m_nvic_clear_pending: mark the specified exception as not pending
502 * @irq: the exception number to mark as not pending
503 * @secure: false for non-banked exceptions or for the nonsecure
504 * version of a banked exception, true for the secure version of a banked
507 * Marks the specified exception as not pending. Note that we will assert()
508 * if @secure is true and @irq does not specify one of the fixed set
509 * of architecturally banked exceptions.
511 static void armv7m_nvic_clear_pending(void *opaque
, int irq
, bool secure
)
513 NVICState
*s
= (NVICState
*)opaque
;
516 assert(irq
> ARMV7M_EXCP_RESET
&& irq
< s
->num_irq
);
519 assert(exc_is_banked(irq
));
520 vec
= &s
->sec_vectors
[irq
];
522 vec
= &s
->vectors
[irq
];
524 trace_nvic_clear_pending(irq
, secure
, vec
->enabled
, vec
->prio
);
531 static void do_armv7m_nvic_set_pending(void *opaque
, int irq
, bool secure
,
534 /* Pend an exception, including possibly escalating it to HardFault.
536 * This function handles both "normal" pending of interrupts and
537 * exceptions, and also derived exceptions (ones which occur as
538 * a result of trying to take some other exception).
540 * If derived == true, the caller guarantees that we are part way through
541 * trying to take an exception (but have not yet called
542 * armv7m_nvic_acknowledge_irq() to make it active), and so:
543 * - s->vectpending is the "original exception" we were trying to take
544 * - irq is the "derived exception"
545 * - nvic_exec_prio(s) gives the priority before exception entry
546 * Here we handle the prioritization logic which the pseudocode puts
547 * in the DerivedLateArrival() function.
550 NVICState
*s
= (NVICState
*)opaque
;
551 bool banked
= exc_is_banked(irq
);
555 assert(irq
> ARMV7M_EXCP_RESET
&& irq
< s
->num_irq
);
556 assert(!secure
|| banked
);
558 vec
= (banked
&& secure
) ? &s
->sec_vectors
[irq
] : &s
->vectors
[irq
];
560 targets_secure
= banked
? secure
: exc_targets_secure(s
, irq
);
562 trace_nvic_set_pending(irq
, secure
, targets_secure
,
563 derived
, vec
->enabled
, vec
->prio
);
566 /* Derived exceptions are always synchronous. */
567 assert(irq
>= ARMV7M_EXCP_HARD
&& irq
< ARMV7M_EXCP_PENDSV
);
569 if (irq
== ARMV7M_EXCP_DEBUG
&&
570 exc_group_prio(s
, vec
->prio
, secure
) >= nvic_exec_prio(s
)) {
571 /* DebugMonitorFault, but its priority is lower than the
572 * preempted exception priority: just ignore it.
577 if (irq
== ARMV7M_EXCP_HARD
&& vec
->prio
>= s
->vectpending_prio
) {
578 /* If this is a terminal exception (one which means we cannot
579 * take the original exception, like a failure to read its
580 * vector table entry), then we must take the derived exception.
581 * If the derived exception can't take priority over the
582 * original exception, then we go into Lockup.
584 * For QEMU, we rely on the fact that a derived exception is
585 * terminal if and only if it's reported to us as HardFault,
586 * which saves having to have an extra argument is_terminal
587 * that we'd only use in one place.
589 cpu_abort(&s
->cpu
->parent_obj
,
590 "Lockup: can't take terminal derived exception "
591 "(original exception priority %d)\n",
592 s
->vectpending_prio
);
594 /* We now continue with the same code as for a normal pending
595 * exception, which will cause us to pend the derived exception.
596 * We'll then take either the original or the derived exception
597 * based on which is higher priority by the usual mechanism
598 * for selecting the highest priority pending interrupt.
602 if (irq
>= ARMV7M_EXCP_HARD
&& irq
< ARMV7M_EXCP_PENDSV
) {
603 /* If a synchronous exception is pending then it may be
604 * escalated to HardFault if:
605 * * it is equal or lower priority to current execution
607 * (ie we need to take it immediately but we can't do so).
608 * Asynchronous exceptions (and interrupts) simply remain pending.
610 * For QEMU, we don't have any imprecise (asynchronous) faults,
611 * so we can assume that PREFETCH_ABORT and DATA_ABORT are always
613 * Debug exceptions are awkward because only Debug exceptions
614 * resulting from the BKPT instruction should be escalated,
615 * but we don't currently implement any Debug exceptions other
616 * than those that result from BKPT, so we treat all debug exceptions
617 * as needing escalation.
619 * This all means we can identify whether to escalate based only on
620 * the exception number and don't (yet) need the caller to explicitly
621 * tell us whether this exception is synchronous or not.
623 int running
= nvic_exec_prio(s
);
624 bool escalate
= false;
626 if (exc_group_prio(s
, vec
->prio
, secure
) >= running
) {
627 trace_nvic_escalate_prio(irq
, vec
->prio
, running
);
629 } else if (!vec
->enabled
) {
630 trace_nvic_escalate_disabled(irq
);
636 /* We need to escalate this exception to a synchronous HardFault.
637 * If BFHFNMINS is set then we escalate to the banked HF for
638 * the target security state of the original exception; otherwise
639 * we take a Secure HardFault.
641 irq
= ARMV7M_EXCP_HARD
;
642 if (arm_feature(&s
->cpu
->env
, ARM_FEATURE_M_SECURITY
) &&
644 !(s
->cpu
->env
.v7m
.aircr
& R_V7M_AIRCR_BFHFNMINS_MASK
))) {
645 vec
= &s
->sec_vectors
[irq
];
647 vec
= &s
->vectors
[irq
];
649 if (running
<= vec
->prio
) {
650 /* We want to escalate to HardFault but we can't take the
651 * synchronous HardFault at this point either. This is a
652 * Lockup condition due to a guest bug. We don't model
653 * Lockup, so report via cpu_abort() instead.
655 cpu_abort(&s
->cpu
->parent_obj
,
656 "Lockup: can't escalate %d to HardFault "
657 "(current priority %d)\n", irq
, running
);
660 /* HF may be banked but there is only one shared HFSR */
661 s
->cpu
->env
.v7m
.hfsr
|= R_V7M_HFSR_FORCED_MASK
;
671 void armv7m_nvic_set_pending(void *opaque
, int irq
, bool secure
)
673 do_armv7m_nvic_set_pending(opaque
, irq
, secure
, false);
676 void armv7m_nvic_set_pending_derived(void *opaque
, int irq
, bool secure
)
678 do_armv7m_nvic_set_pending(opaque
, irq
, secure
, true);
681 void armv7m_nvic_set_pending_lazyfp(void *opaque
, int irq
, bool secure
)
684 * Pend an exception during lazy FP stacking. This differs
685 * from the usual exception pending because the logic for
686 * whether we should escalate depends on the saved context
687 * in the FPCCR register, not on the current state of the CPU/NVIC.
689 NVICState
*s
= (NVICState
*)opaque
;
690 bool banked
= exc_is_banked(irq
);
693 bool escalate
= false;
695 * We will only look at bits in fpccr if this is a banked exception
696 * (in which case 'secure' tells us whether it is the S or NS version).
697 * All the bits for the non-banked exceptions are in fpccr_s.
699 uint32_t fpccr_s
= s
->cpu
->env
.v7m
.fpccr
[M_REG_S
];
700 uint32_t fpccr
= s
->cpu
->env
.v7m
.fpccr
[secure
];
702 assert(irq
> ARMV7M_EXCP_RESET
&& irq
< s
->num_irq
);
703 assert(!secure
|| banked
);
705 vec
= (banked
&& secure
) ? &s
->sec_vectors
[irq
] : &s
->vectors
[irq
];
707 targets_secure
= banked
? secure
: exc_targets_secure(s
, irq
);
710 case ARMV7M_EXCP_DEBUG
:
711 if (!(fpccr_s
& R_V7M_FPCCR_MONRDY_MASK
)) {
712 /* Ignore DebugMonitor exception */
716 case ARMV7M_EXCP_MEM
:
717 escalate
= !(fpccr
& R_V7M_FPCCR_MMRDY_MASK
);
719 case ARMV7M_EXCP_USAGE
:
720 escalate
= !(fpccr
& R_V7M_FPCCR_UFRDY_MASK
);
722 case ARMV7M_EXCP_BUS
:
723 escalate
= !(fpccr_s
& R_V7M_FPCCR_BFRDY_MASK
);
725 case ARMV7M_EXCP_SECURE
:
726 escalate
= !(fpccr_s
& R_V7M_FPCCR_SFRDY_MASK
);
729 g_assert_not_reached();
734 * Escalate to HardFault: faults that initially targeted Secure
735 * continue to do so, even if HF normally targets NonSecure.
737 irq
= ARMV7M_EXCP_HARD
;
738 if (arm_feature(&s
->cpu
->env
, ARM_FEATURE_M_SECURITY
) &&
740 !(s
->cpu
->env
.v7m
.aircr
& R_V7M_AIRCR_BFHFNMINS_MASK
))) {
741 vec
= &s
->sec_vectors
[irq
];
743 vec
= &s
->vectors
[irq
];
748 nvic_exec_prio(s
) <= exc_group_prio(s
, vec
->prio
, secure
)) {
749 if (!(fpccr_s
& R_V7M_FPCCR_HFRDY_MASK
)) {
751 * We want to escalate to HardFault but the context the
752 * FP state belongs to prevents the exception pre-empting.
754 cpu_abort(&s
->cpu
->parent_obj
,
755 "Lockup: can't escalate to HardFault during "
756 "lazy FP register stacking\n");
761 s
->cpu
->env
.v7m
.hfsr
|= R_V7M_HFSR_FORCED_MASK
;
766 * We do not call nvic_irq_update(), because we know our caller
767 * is going to handle causing us to take the exception by
768 * raising EXCP_LAZYFP, so raising the IRQ line would be
769 * pointless extra work. We just need to recompute the
770 * priorities so that armv7m_nvic_can_take_pending_exception()
771 * returns the right answer.
773 nvic_recompute_state(s
);
777 /* Make pending IRQ active. */
778 void armv7m_nvic_acknowledge_irq(void *opaque
)
780 NVICState
*s
= (NVICState
*)opaque
;
781 CPUARMState
*env
= &s
->cpu
->env
;
782 const int pending
= s
->vectpending
;
783 const int running
= nvic_exec_prio(s
);
786 assert(pending
> ARMV7M_EXCP_RESET
&& pending
< s
->num_irq
);
788 if (s
->vectpending_is_s_banked
) {
789 vec
= &s
->sec_vectors
[pending
];
791 vec
= &s
->vectors
[pending
];
794 assert(vec
->enabled
);
795 assert(vec
->pending
);
797 assert(s
->vectpending_prio
< running
);
799 trace_nvic_acknowledge_irq(pending
, s
->vectpending_prio
);
804 write_v7m_exception(env
, s
->vectpending
);
809 void armv7m_nvic_get_pending_irq_info(void *opaque
,
810 int *pirq
, bool *ptargets_secure
)
812 NVICState
*s
= (NVICState
*)opaque
;
813 const int pending
= s
->vectpending
;
816 assert(pending
> ARMV7M_EXCP_RESET
&& pending
< s
->num_irq
);
818 if (s
->vectpending_is_s_banked
) {
819 targets_secure
= true;
821 targets_secure
= !exc_is_banked(pending
) &&
822 exc_targets_secure(s
, pending
);
825 trace_nvic_get_pending_irq_info(pending
, targets_secure
);
827 *ptargets_secure
= targets_secure
;
831 int armv7m_nvic_complete_irq(void *opaque
, int irq
, bool secure
)
833 NVICState
*s
= (NVICState
*)opaque
;
837 assert(irq
> ARMV7M_EXCP_RESET
&& irq
< s
->num_irq
);
839 trace_nvic_complete_irq(irq
, secure
);
841 if (secure
&& exc_is_banked(irq
)) {
842 vec
= &s
->sec_vectors
[irq
];
844 vec
= &s
->vectors
[irq
];
848 * Identify illegal exception return cases. We can't immediately
849 * return at this point because we still need to deactivate
850 * (either this exception or NMI/HardFault) first.
852 if (!exc_is_banked(irq
) && exc_targets_secure(s
, irq
) != secure
) {
854 * Return from a configurable exception targeting the opposite
855 * security state from the one we're trying to complete it for.
856 * Clear vec because it's not really the VecInfo for this
857 * (irq, secstate) so we mustn't deactivate it.
861 } else if (!vec
->active
) {
862 /* Return from an inactive interrupt */
865 /* Legal return, we will return the RETTOBASE bit value to the caller */
866 ret
= nvic_rettobase(s
);
870 * For negative priorities, v8M will forcibly deactivate the appropriate
871 * NMI or HardFault regardless of what interrupt we're being asked to
872 * deactivate (compare the DeActivate() pseudocode). This is a guard
873 * against software returning from NMI or HardFault with a corrupted
874 * IPSR and leaving the CPU in a negative-priority state.
875 * v7M does not do this, but simply deactivates the requested interrupt.
877 if (arm_feature(&s
->cpu
->env
, ARM_FEATURE_V8
)) {
878 switch (armv7m_nvic_raw_execution_priority(s
)) {
880 if (s
->cpu
->env
.v7m
.aircr
& R_V7M_AIRCR_BFHFNMINS_MASK
) {
881 vec
= &s
->vectors
[ARMV7M_EXCP_HARD
];
883 vec
= &s
->sec_vectors
[ARMV7M_EXCP_HARD
];
887 vec
= &s
->vectors
[ARMV7M_EXCP_NMI
];
890 vec
= &s
->sec_vectors
[ARMV7M_EXCP_HARD
];
903 /* Re-pend the exception if it's still held high; only
904 * happens for extenal IRQs
906 assert(irq
>= NVIC_FIRST_IRQ
);
915 bool armv7m_nvic_get_ready_status(void *opaque
, int irq
, bool secure
)
918 * Return whether an exception is "ready", i.e. it is enabled and is
919 * configured at a priority which would allow it to interrupt the
920 * current execution priority.
922 * irq and secure have the same semantics as for armv7m_nvic_set_pending():
923 * for non-banked exceptions secure is always false; for banked exceptions
924 * it indicates which of the exceptions is required.
926 NVICState
*s
= (NVICState
*)opaque
;
927 bool banked
= exc_is_banked(irq
);
929 int running
= nvic_exec_prio(s
);
931 assert(irq
> ARMV7M_EXCP_RESET
&& irq
< s
->num_irq
);
932 assert(!secure
|| banked
);
935 * HardFault is an odd special case: we always check against -1,
936 * even if we're secure and HardFault has priority -3; we never
937 * need to check for enabled state.
939 if (irq
== ARMV7M_EXCP_HARD
) {
943 vec
= (banked
&& secure
) ? &s
->sec_vectors
[irq
] : &s
->vectors
[irq
];
945 return vec
->enabled
&&
946 exc_group_prio(s
, vec
->prio
, secure
) < running
;
949 /* callback when external interrupt line is changed */
950 static void set_irq_level(void *opaque
, int n
, int level
)
952 NVICState
*s
= opaque
;
957 assert(n
>= NVIC_FIRST_IRQ
&& n
< s
->num_irq
);
959 trace_nvic_set_irq_level(n
, level
);
961 /* The pending status of an external interrupt is
962 * latched on rising edge and exception handler return.
964 * Pulsing the IRQ will always run the handler
965 * once, and the handler will re-run until the
966 * level is low when the handler completes.
968 vec
= &s
->vectors
[n
];
969 if (level
!= vec
->level
) {
972 armv7m_nvic_set_pending(s
, n
, false);
977 /* callback when external NMI line is changed */
978 static void nvic_nmi_trigger(void *opaque
, int n
, int level
)
980 NVICState
*s
= opaque
;
982 trace_nvic_set_nmi_level(level
);
985 * The architecture doesn't specify whether NMI should share
986 * the normal-interrupt behaviour of being resampled on
987 * exception handler return. We choose not to, so just
988 * set NMI pending here and don't track the current level.
991 armv7m_nvic_set_pending(s
, ARMV7M_EXCP_NMI
, false);
995 static uint32_t nvic_readl(NVICState
*s
, uint32_t offset
, MemTxAttrs attrs
)
997 ARMCPU
*cpu
= s
->cpu
;
1001 case 4: /* Interrupt Control Type. */
1002 if (!arm_feature(&cpu
->env
, ARM_FEATURE_V7
)) {
1005 return ((s
->num_irq
- NVIC_FIRST_IRQ
) / 32) - 1;
1006 case 0xc: /* CPPWR */
1007 if (!arm_feature(&cpu
->env
, ARM_FEATURE_V8
)) {
1010 /* We make the IMPDEF choice that nothing can ever go into a
1011 * non-retentive power state, which allows us to RAZ/WI this.
1014 case 0x380 ... 0x3bf: /* NVIC_ITNS<n> */
1016 int startvec
= 8 * (offset
- 0x380) + NVIC_FIRST_IRQ
;
1019 if (!arm_feature(&cpu
->env
, ARM_FEATURE_V8
)) {
1022 if (!attrs
.secure
) {
1026 for (i
= 0; i
< 32 && startvec
+ i
< s
->num_irq
; i
++) {
1027 if (s
->itns
[startvec
+ i
]) {
1034 if (!arm_feature(&cpu
->env
, ARM_FEATURE_V8_1M
)) {
1038 case 0xd00: /* CPUID Base. */
1040 case 0xd04: /* Interrupt Control State (ICSR) */
1042 val
= cpu
->env
.v7m
.exception
;
1044 val
|= (s
->vectpending
& 0xff) << 12;
1045 /* ISRPENDING - set if any external IRQ is pending */
1046 if (nvic_isrpending(s
)) {
1049 /* RETTOBASE - set if only one handler is active */
1050 if (nvic_rettobase(s
)) {
1055 if (s
->sec_vectors
[ARMV7M_EXCP_SYSTICK
].pending
) {
1059 if (s
->sec_vectors
[ARMV7M_EXCP_PENDSV
].pending
) {
1064 if (s
->vectors
[ARMV7M_EXCP_SYSTICK
].pending
) {
1068 if (s
->vectors
[ARMV7M_EXCP_PENDSV
].pending
) {
1073 if ((attrs
.secure
|| (cpu
->env
.v7m
.aircr
& R_V7M_AIRCR_BFHFNMINS_MASK
))
1074 && s
->vectors
[ARMV7M_EXCP_NMI
].pending
) {
1077 /* ISRPREEMPT: RES0 when halting debug not implemented */
1078 /* STTNS: RES0 for the Main Extension */
1080 case 0xd08: /* Vector Table Offset. */
1081 return cpu
->env
.v7m
.vecbase
[attrs
.secure
];
1082 case 0xd0c: /* Application Interrupt/Reset Control (AIRCR) */
1083 val
= 0xfa050000 | (s
->prigroup
[attrs
.secure
] << 8);
1085 /* s->aircr stores PRIS, BFHFNMINS, SYSRESETREQS */
1086 val
|= cpu
->env
.v7m
.aircr
;
1088 if (arm_feature(&cpu
->env
, ARM_FEATURE_V8
)) {
1089 /* BFHFNMINS is R/O from NS; other bits are RAZ/WI. If
1090 * security isn't supported then BFHFNMINS is RAO (and
1091 * the bit in env.v7m.aircr is always set).
1093 val
|= cpu
->env
.v7m
.aircr
& R_V7M_AIRCR_BFHFNMINS_MASK
;
1097 case 0xd10: /* System Control. */
1098 if (!arm_feature(&cpu
->env
, ARM_FEATURE_V7
)) {
1101 return cpu
->env
.v7m
.scr
[attrs
.secure
];
1102 case 0xd14: /* Configuration Control. */
1104 * Non-banked bits: BFHFNMIGN (stored in the NS copy of the register)
1105 * and TRD (stored in the S copy of the register)
1107 val
= cpu
->env
.v7m
.ccr
[attrs
.secure
];
1108 val
|= cpu
->env
.v7m
.ccr
[M_REG_NS
] & R_V7M_CCR_BFHFNMIGN_MASK
;
1110 case 0xd24: /* System Handler Control and State (SHCSR) */
1111 if (!arm_feature(&cpu
->env
, ARM_FEATURE_V7
)) {
1116 if (s
->sec_vectors
[ARMV7M_EXCP_MEM
].active
) {
1119 if (s
->sec_vectors
[ARMV7M_EXCP_HARD
].active
) {
1122 if (s
->sec_vectors
[ARMV7M_EXCP_USAGE
].active
) {
1125 if (s
->sec_vectors
[ARMV7M_EXCP_SVC
].active
) {
1128 if (s
->sec_vectors
[ARMV7M_EXCP_PENDSV
].active
) {
1131 if (s
->sec_vectors
[ARMV7M_EXCP_SYSTICK
].active
) {
1134 if (s
->sec_vectors
[ARMV7M_EXCP_USAGE
].pending
) {
1137 if (s
->sec_vectors
[ARMV7M_EXCP_MEM
].pending
) {
1140 if (s
->sec_vectors
[ARMV7M_EXCP_SVC
].pending
) {
1143 if (s
->sec_vectors
[ARMV7M_EXCP_MEM
].enabled
) {
1146 if (s
->sec_vectors
[ARMV7M_EXCP_USAGE
].enabled
) {
1149 if (s
->sec_vectors
[ARMV7M_EXCP_HARD
].pending
) {
1152 /* SecureFault is not banked but is always RAZ/WI to NS */
1153 if (s
->vectors
[ARMV7M_EXCP_SECURE
].active
) {
1156 if (s
->vectors
[ARMV7M_EXCP_SECURE
].enabled
) {
1159 if (s
->vectors
[ARMV7M_EXCP_SECURE
].pending
) {
1163 if (s
->vectors
[ARMV7M_EXCP_MEM
].active
) {
1166 if (arm_feature(&cpu
->env
, ARM_FEATURE_V8
)) {
1167 /* HARDFAULTACT, HARDFAULTPENDED not present in v7M */
1168 if (s
->vectors
[ARMV7M_EXCP_HARD
].active
) {
1171 if (s
->vectors
[ARMV7M_EXCP_HARD
].pending
) {
1175 if (s
->vectors
[ARMV7M_EXCP_USAGE
].active
) {
1178 if (s
->vectors
[ARMV7M_EXCP_SVC
].active
) {
1181 if (s
->vectors
[ARMV7M_EXCP_PENDSV
].active
) {
1184 if (s
->vectors
[ARMV7M_EXCP_SYSTICK
].active
) {
1187 if (s
->vectors
[ARMV7M_EXCP_USAGE
].pending
) {
1190 if (s
->vectors
[ARMV7M_EXCP_MEM
].pending
) {
1193 if (s
->vectors
[ARMV7M_EXCP_SVC
].pending
) {
1196 if (s
->vectors
[ARMV7M_EXCP_MEM
].enabled
) {
1199 if (s
->vectors
[ARMV7M_EXCP_USAGE
].enabled
) {
1203 if (attrs
.secure
|| (cpu
->env
.v7m
.aircr
& R_V7M_AIRCR_BFHFNMINS_MASK
)) {
1204 if (s
->vectors
[ARMV7M_EXCP_BUS
].active
) {
1207 if (s
->vectors
[ARMV7M_EXCP_BUS
].pending
) {
1210 if (s
->vectors
[ARMV7M_EXCP_BUS
].enabled
) {
1213 if (arm_feature(&cpu
->env
, ARM_FEATURE_V8
) &&
1214 s
->vectors
[ARMV7M_EXCP_NMI
].active
) {
1215 /* NMIACT is not present in v7M */
1220 /* TODO: this is RAZ/WI from NS if DEMCR.SDME is set */
1221 if (s
->vectors
[ARMV7M_EXCP_DEBUG
].active
) {
1225 case 0xd2c: /* Hard Fault Status. */
1226 if (!arm_feature(&cpu
->env
, ARM_FEATURE_M_MAIN
)) {
1229 return cpu
->env
.v7m
.hfsr
;
1230 case 0xd30: /* Debug Fault Status. */
1231 return cpu
->env
.v7m
.dfsr
;
1232 case 0xd34: /* MMFAR MemManage Fault Address */
1233 if (!arm_feature(&cpu
->env
, ARM_FEATURE_M_MAIN
)) {
1236 return cpu
->env
.v7m
.mmfar
[attrs
.secure
];
1237 case 0xd38: /* Bus Fault Address. */
1238 if (!arm_feature(&cpu
->env
, ARM_FEATURE_M_MAIN
)) {
1241 if (!attrs
.secure
&&
1242 !(s
->cpu
->env
.v7m
.aircr
& R_V7M_AIRCR_BFHFNMINS_MASK
)) {
1245 return cpu
->env
.v7m
.bfar
;
1246 case 0xd3c: /* Aux Fault Status. */
1247 /* TODO: Implement fault status registers. */
1248 qemu_log_mask(LOG_UNIMP
,
1249 "Aux Fault status registers unimplemented\n");
1251 case 0xd40: /* PFR0. */
1252 if (!arm_feature(&cpu
->env
, ARM_FEATURE_M_MAIN
)) {
1255 return cpu
->isar
.id_pfr0
;
1256 case 0xd44: /* PFR1. */
1257 if (!arm_feature(&cpu
->env
, ARM_FEATURE_M_MAIN
)) {
1260 return cpu
->isar
.id_pfr1
;
1261 case 0xd48: /* DFR0. */
1262 if (!arm_feature(&cpu
->env
, ARM_FEATURE_M_MAIN
)) {
1265 return cpu
->isar
.id_dfr0
;
1266 case 0xd4c: /* AFR0. */
1267 if (!arm_feature(&cpu
->env
, ARM_FEATURE_M_MAIN
)) {
1270 return cpu
->id_afr0
;
1271 case 0xd50: /* MMFR0. */
1272 if (!arm_feature(&cpu
->env
, ARM_FEATURE_M_MAIN
)) {
1275 return cpu
->isar
.id_mmfr0
;
1276 case 0xd54: /* MMFR1. */
1277 if (!arm_feature(&cpu
->env
, ARM_FEATURE_M_MAIN
)) {
1280 return cpu
->isar
.id_mmfr1
;
1281 case 0xd58: /* MMFR2. */
1282 if (!arm_feature(&cpu
->env
, ARM_FEATURE_M_MAIN
)) {
1285 return cpu
->isar
.id_mmfr2
;
1286 case 0xd5c: /* MMFR3. */
1287 if (!arm_feature(&cpu
->env
, ARM_FEATURE_M_MAIN
)) {
1290 return cpu
->isar
.id_mmfr3
;
1291 case 0xd60: /* ISAR0. */
1292 if (!arm_feature(&cpu
->env
, ARM_FEATURE_M_MAIN
)) {
1295 return cpu
->isar
.id_isar0
;
1296 case 0xd64: /* ISAR1. */
1297 if (!arm_feature(&cpu
->env
, ARM_FEATURE_M_MAIN
)) {
1300 return cpu
->isar
.id_isar1
;
1301 case 0xd68: /* ISAR2. */
1302 if (!arm_feature(&cpu
->env
, ARM_FEATURE_M_MAIN
)) {
1305 return cpu
->isar
.id_isar2
;
1306 case 0xd6c: /* ISAR3. */
1307 if (!arm_feature(&cpu
->env
, ARM_FEATURE_M_MAIN
)) {
1310 return cpu
->isar
.id_isar3
;
1311 case 0xd70: /* ISAR4. */
1312 if (!arm_feature(&cpu
->env
, ARM_FEATURE_M_MAIN
)) {
1315 return cpu
->isar
.id_isar4
;
1316 case 0xd74: /* ISAR5. */
1317 if (!arm_feature(&cpu
->env
, ARM_FEATURE_M_MAIN
)) {
1320 return cpu
->isar
.id_isar5
;
1321 case 0xd78: /* CLIDR */
1323 case 0xd7c: /* CTR */
1325 case 0xd80: /* CSSIDR */
1327 int idx
= cpu
->env
.v7m
.csselr
[attrs
.secure
] & R_V7M_CSSELR_INDEX_MASK
;
1328 return cpu
->ccsidr
[idx
];
1330 case 0xd84: /* CSSELR */
1331 return cpu
->env
.v7m
.csselr
[attrs
.secure
];
1332 case 0xd88: /* CPACR */
1333 if (!cpu_isar_feature(aa32_vfp_simd
, cpu
)) {
1336 return cpu
->env
.v7m
.cpacr
[attrs
.secure
];
1337 case 0xd8c: /* NSACR */
1338 if (!attrs
.secure
|| !cpu_isar_feature(aa32_vfp_simd
, cpu
)) {
1341 return cpu
->env
.v7m
.nsacr
;
1342 /* TODO: Implement debug registers. */
1343 case 0xd90: /* MPU_TYPE */
1344 /* Unified MPU; if the MPU is not present this value is zero */
1345 return cpu
->pmsav7_dregion
<< 8;
1346 case 0xd94: /* MPU_CTRL */
1347 return cpu
->env
.v7m
.mpu_ctrl
[attrs
.secure
];
1348 case 0xd98: /* MPU_RNR */
1349 return cpu
->env
.pmsav7
.rnr
[attrs
.secure
];
1350 case 0xd9c: /* MPU_RBAR */
1351 case 0xda4: /* MPU_RBAR_A1 */
1352 case 0xdac: /* MPU_RBAR_A2 */
1353 case 0xdb4: /* MPU_RBAR_A3 */
1355 int region
= cpu
->env
.pmsav7
.rnr
[attrs
.secure
];
1357 if (arm_feature(&cpu
->env
, ARM_FEATURE_V8
)) {
1358 /* PMSAv8M handling of the aliases is different from v7M:
1359 * aliases A1, A2, A3 override the low two bits of the region
1360 * number in MPU_RNR, and there is no 'region' field in the
1363 int aliasno
= (offset
- 0xd9c) / 8; /* 0..3 */
1365 region
= deposit32(region
, 0, 2, aliasno
);
1367 if (region
>= cpu
->pmsav7_dregion
) {
1370 return cpu
->env
.pmsav8
.rbar
[attrs
.secure
][region
];
1373 if (region
>= cpu
->pmsav7_dregion
) {
1376 return (cpu
->env
.pmsav7
.drbar
[region
] & ~0x1f) | (region
& 0xf);
1378 case 0xda0: /* MPU_RASR (v7M), MPU_RLAR (v8M) */
1379 case 0xda8: /* MPU_RASR_A1 (v7M), MPU_RLAR_A1 (v8M) */
1380 case 0xdb0: /* MPU_RASR_A2 (v7M), MPU_RLAR_A2 (v8M) */
1381 case 0xdb8: /* MPU_RASR_A3 (v7M), MPU_RLAR_A3 (v8M) */
1383 int region
= cpu
->env
.pmsav7
.rnr
[attrs
.secure
];
1385 if (arm_feature(&cpu
->env
, ARM_FEATURE_V8
)) {
1386 /* PMSAv8M handling of the aliases is different from v7M:
1387 * aliases A1, A2, A3 override the low two bits of the region
1388 * number in MPU_RNR.
1390 int aliasno
= (offset
- 0xda0) / 8; /* 0..3 */
1392 region
= deposit32(region
, 0, 2, aliasno
);
1394 if (region
>= cpu
->pmsav7_dregion
) {
1397 return cpu
->env
.pmsav8
.rlar
[attrs
.secure
][region
];
1400 if (region
>= cpu
->pmsav7_dregion
) {
1403 return ((cpu
->env
.pmsav7
.dracr
[region
] & 0xffff) << 16) |
1404 (cpu
->env
.pmsav7
.drsr
[region
] & 0xffff);
1406 case 0xdc0: /* MPU_MAIR0 */
1407 if (!arm_feature(&cpu
->env
, ARM_FEATURE_V8
)) {
1410 return cpu
->env
.pmsav8
.mair0
[attrs
.secure
];
1411 case 0xdc4: /* MPU_MAIR1 */
1412 if (!arm_feature(&cpu
->env
, ARM_FEATURE_V8
)) {
1415 return cpu
->env
.pmsav8
.mair1
[attrs
.secure
];
1416 case 0xdd0: /* SAU_CTRL */
1417 if (!arm_feature(&cpu
->env
, ARM_FEATURE_V8
)) {
1420 if (!attrs
.secure
) {
1423 return cpu
->env
.sau
.ctrl
;
1424 case 0xdd4: /* SAU_TYPE */
1425 if (!arm_feature(&cpu
->env
, ARM_FEATURE_V8
)) {
1428 if (!attrs
.secure
) {
1431 return cpu
->sau_sregion
;
1432 case 0xdd8: /* SAU_RNR */
1433 if (!arm_feature(&cpu
->env
, ARM_FEATURE_V8
)) {
1436 if (!attrs
.secure
) {
1439 return cpu
->env
.sau
.rnr
;
1440 case 0xddc: /* SAU_RBAR */
1442 int region
= cpu
->env
.sau
.rnr
;
1444 if (!arm_feature(&cpu
->env
, ARM_FEATURE_V8
)) {
1447 if (!attrs
.secure
) {
1450 if (region
>= cpu
->sau_sregion
) {
1453 return cpu
->env
.sau
.rbar
[region
];
1455 case 0xde0: /* SAU_RLAR */
1457 int region
= cpu
->env
.sau
.rnr
;
1459 if (!arm_feature(&cpu
->env
, ARM_FEATURE_V8
)) {
1462 if (!attrs
.secure
) {
1465 if (region
>= cpu
->sau_sregion
) {
1468 return cpu
->env
.sau
.rlar
[region
];
1470 case 0xde4: /* SFSR */
1471 if (!arm_feature(&cpu
->env
, ARM_FEATURE_V8
)) {
1474 if (!attrs
.secure
) {
1477 return cpu
->env
.v7m
.sfsr
;
1478 case 0xde8: /* SFAR */
1479 if (!arm_feature(&cpu
->env
, ARM_FEATURE_V8
)) {
1482 if (!attrs
.secure
) {
1485 return cpu
->env
.v7m
.sfar
;
1486 case 0xf04: /* RFSR */
1487 if (!cpu_isar_feature(aa32_ras
, cpu
)) {
1490 /* We provide minimal-RAS only: RFSR is RAZ/WI */
1492 case 0xf34: /* FPCCR */
1493 if (!cpu_isar_feature(aa32_vfp_simd
, cpu
)) {
1497 return cpu
->env
.v7m
.fpccr
[M_REG_S
];
1500 * NS can read LSPEN, CLRONRET and MONRDY. It can read
1501 * BFRDY and HFRDY if AIRCR.BFHFNMINS != 0;
1502 * other non-banked bits RAZ.
1503 * TODO: MONRDY should RAZ/WI if DEMCR.SDME is set.
1505 uint32_t value
= cpu
->env
.v7m
.fpccr
[M_REG_S
];
1506 uint32_t mask
= R_V7M_FPCCR_LSPEN_MASK
|
1507 R_V7M_FPCCR_CLRONRET_MASK
|
1508 R_V7M_FPCCR_MONRDY_MASK
;
1510 if (s
->cpu
->env
.v7m
.aircr
& R_V7M_AIRCR_BFHFNMINS_MASK
) {
1511 mask
|= R_V7M_FPCCR_BFRDY_MASK
| R_V7M_FPCCR_HFRDY_MASK
;
1516 value
|= cpu
->env
.v7m
.fpccr
[M_REG_NS
];
1519 case 0xf38: /* FPCAR */
1520 if (!cpu_isar_feature(aa32_vfp_simd
, cpu
)) {
1523 return cpu
->env
.v7m
.fpcar
[attrs
.secure
];
1524 case 0xf3c: /* FPDSCR */
1525 if (!cpu_isar_feature(aa32_vfp_simd
, cpu
)) {
1528 return cpu
->env
.v7m
.fpdscr
[attrs
.secure
];
1529 case 0xf40: /* MVFR0 */
1530 return cpu
->isar
.mvfr0
;
1531 case 0xf44: /* MVFR1 */
1532 return cpu
->isar
.mvfr1
;
1533 case 0xf48: /* MVFR2 */
1534 return cpu
->isar
.mvfr2
;
1537 qemu_log_mask(LOG_GUEST_ERROR
, "NVIC: Bad read offset 0x%x\n", offset
);
1542 static void nvic_writel(NVICState
*s
, uint32_t offset
, uint32_t value
,
1545 ARMCPU
*cpu
= s
->cpu
;
1548 case 0xc: /* CPPWR */
1549 if (!arm_feature(&cpu
->env
, ARM_FEATURE_V8
)) {
1552 /* Make the IMPDEF choice to RAZ/WI this. */
1554 case 0x380 ... 0x3bf: /* NVIC_ITNS<n> */
1556 int startvec
= 8 * (offset
- 0x380) + NVIC_FIRST_IRQ
;
1559 if (!arm_feature(&cpu
->env
, ARM_FEATURE_V8
)) {
1562 if (!attrs
.secure
) {
1565 for (i
= 0; i
< 32 && startvec
+ i
< s
->num_irq
; i
++) {
1566 s
->itns
[startvec
+ i
] = (value
>> i
) & 1;
1571 case 0xd04: /* Interrupt Control State (ICSR) */
1572 if (attrs
.secure
|| cpu
->env
.v7m
.aircr
& R_V7M_AIRCR_BFHFNMINS_MASK
) {
1573 if (value
& (1 << 31)) {
1574 armv7m_nvic_set_pending(s
, ARMV7M_EXCP_NMI
, false);
1575 } else if (value
& (1 << 30) &&
1576 arm_feature(&cpu
->env
, ARM_FEATURE_V8
)) {
1577 /* PENDNMICLR didn't exist in v7M */
1578 armv7m_nvic_clear_pending(s
, ARMV7M_EXCP_NMI
, false);
1581 if (value
& (1 << 28)) {
1582 armv7m_nvic_set_pending(s
, ARMV7M_EXCP_PENDSV
, attrs
.secure
);
1583 } else if (value
& (1 << 27)) {
1584 armv7m_nvic_clear_pending(s
, ARMV7M_EXCP_PENDSV
, attrs
.secure
);
1586 if (value
& (1 << 26)) {
1587 armv7m_nvic_set_pending(s
, ARMV7M_EXCP_SYSTICK
, attrs
.secure
);
1588 } else if (value
& (1 << 25)) {
1589 armv7m_nvic_clear_pending(s
, ARMV7M_EXCP_SYSTICK
, attrs
.secure
);
1592 case 0xd08: /* Vector Table Offset. */
1593 cpu
->env
.v7m
.vecbase
[attrs
.secure
] = value
& 0xffffff80;
1595 case 0xd0c: /* Application Interrupt/Reset Control (AIRCR) */
1596 if ((value
>> R_V7M_AIRCR_VECTKEY_SHIFT
) == 0x05fa) {
1597 if (value
& R_V7M_AIRCR_SYSRESETREQ_MASK
) {
1599 !(cpu
->env
.v7m
.aircr
& R_V7M_AIRCR_SYSRESETREQS_MASK
)) {
1600 signal_sysresetreq(s
);
1603 if (value
& R_V7M_AIRCR_VECTCLRACTIVE_MASK
) {
1604 qemu_log_mask(LOG_GUEST_ERROR
,
1605 "Setting VECTCLRACTIVE when not in DEBUG mode "
1606 "is UNPREDICTABLE\n");
1608 if (value
& R_V7M_AIRCR_VECTRESET_MASK
) {
1609 /* NB: this bit is RES0 in v8M */
1610 qemu_log_mask(LOG_GUEST_ERROR
,
1611 "Setting VECTRESET when not in DEBUG mode "
1612 "is UNPREDICTABLE\n");
1614 if (arm_feature(&cpu
->env
, ARM_FEATURE_M_MAIN
)) {
1615 s
->prigroup
[attrs
.secure
] =
1617 R_V7M_AIRCR_PRIGROUP_SHIFT
,
1618 R_V7M_AIRCR_PRIGROUP_LENGTH
);
1620 /* AIRCR.IESB is RAZ/WI because we implement only minimal RAS */
1622 /* These bits are only writable by secure */
1623 cpu
->env
.v7m
.aircr
= value
&
1624 (R_V7M_AIRCR_SYSRESETREQS_MASK
|
1625 R_V7M_AIRCR_BFHFNMINS_MASK
|
1626 R_V7M_AIRCR_PRIS_MASK
);
1627 /* BFHFNMINS changes the priority of Secure HardFault, and
1628 * allows a pending Non-secure HardFault to preempt (which
1629 * we implement by marking it enabled).
1631 if (cpu
->env
.v7m
.aircr
& R_V7M_AIRCR_BFHFNMINS_MASK
) {
1632 s
->sec_vectors
[ARMV7M_EXCP_HARD
].prio
= -3;
1633 s
->vectors
[ARMV7M_EXCP_HARD
].enabled
= 1;
1635 s
->sec_vectors
[ARMV7M_EXCP_HARD
].prio
= -1;
1636 s
->vectors
[ARMV7M_EXCP_HARD
].enabled
= 0;
1642 case 0xd10: /* System Control. */
1643 if (!arm_feature(&cpu
->env
, ARM_FEATURE_V7
)) {
1646 /* We don't implement deep-sleep so these bits are RAZ/WI.
1647 * The other bits in the register are banked.
1648 * QEMU's implementation ignores SEVONPEND and SLEEPONEXIT, which
1649 * is architecturally permitted.
1651 value
&= ~(R_V7M_SCR_SLEEPDEEP_MASK
| R_V7M_SCR_SLEEPDEEPS_MASK
);
1652 cpu
->env
.v7m
.scr
[attrs
.secure
] = value
;
1654 case 0xd14: /* Configuration Control. */
1658 if (!arm_feature(&cpu
->env
, ARM_FEATURE_M_MAIN
)) {
1662 /* Enforce RAZ/WI on reserved and must-RAZ/WI bits */
1663 mask
= R_V7M_CCR_STKALIGN_MASK
|
1664 R_V7M_CCR_BFHFNMIGN_MASK
|
1665 R_V7M_CCR_DIV_0_TRP_MASK
|
1666 R_V7M_CCR_UNALIGN_TRP_MASK
|
1667 R_V7M_CCR_USERSETMPEND_MASK
|
1668 R_V7M_CCR_NONBASETHRDENA_MASK
;
1669 if (arm_feature(&cpu
->env
, ARM_FEATURE_V8_1M
) && attrs
.secure
) {
1670 /* TRD is always RAZ/WI from NS */
1671 mask
|= R_V7M_CCR_TRD_MASK
;
1675 if (arm_feature(&cpu
->env
, ARM_FEATURE_V8
)) {
1676 /* v8M makes NONBASETHRDENA and STKALIGN be RES1 */
1677 value
|= R_V7M_CCR_NONBASETHRDENA_MASK
1678 | R_V7M_CCR_STKALIGN_MASK
;
1681 /* the BFHFNMIGN bit is not banked; keep that in the NS copy */
1682 cpu
->env
.v7m
.ccr
[M_REG_NS
] =
1683 (cpu
->env
.v7m
.ccr
[M_REG_NS
] & ~R_V7M_CCR_BFHFNMIGN_MASK
)
1684 | (value
& R_V7M_CCR_BFHFNMIGN_MASK
);
1685 value
&= ~R_V7M_CCR_BFHFNMIGN_MASK
;
1688 cpu
->env
.v7m
.ccr
[attrs
.secure
] = value
;
1691 case 0xd24: /* System Handler Control and State (SHCSR) */
1692 if (!arm_feature(&cpu
->env
, ARM_FEATURE_V7
)) {
1696 s
->sec_vectors
[ARMV7M_EXCP_MEM
].active
= (value
& (1 << 0)) != 0;
1697 /* Secure HardFault active bit cannot be written */
1698 s
->sec_vectors
[ARMV7M_EXCP_USAGE
].active
= (value
& (1 << 3)) != 0;
1699 s
->sec_vectors
[ARMV7M_EXCP_SVC
].active
= (value
& (1 << 7)) != 0;
1700 s
->sec_vectors
[ARMV7M_EXCP_PENDSV
].active
=
1701 (value
& (1 << 10)) != 0;
1702 s
->sec_vectors
[ARMV7M_EXCP_SYSTICK
].active
=
1703 (value
& (1 << 11)) != 0;
1704 s
->sec_vectors
[ARMV7M_EXCP_USAGE
].pending
=
1705 (value
& (1 << 12)) != 0;
1706 s
->sec_vectors
[ARMV7M_EXCP_MEM
].pending
= (value
& (1 << 13)) != 0;
1707 s
->sec_vectors
[ARMV7M_EXCP_SVC
].pending
= (value
& (1 << 15)) != 0;
1708 s
->sec_vectors
[ARMV7M_EXCP_MEM
].enabled
= (value
& (1 << 16)) != 0;
1709 s
->sec_vectors
[ARMV7M_EXCP_BUS
].enabled
= (value
& (1 << 17)) != 0;
1710 s
->sec_vectors
[ARMV7M_EXCP_USAGE
].enabled
=
1711 (value
& (1 << 18)) != 0;
1712 s
->sec_vectors
[ARMV7M_EXCP_HARD
].pending
= (value
& (1 << 21)) != 0;
1713 /* SecureFault not banked, but RAZ/WI to NS */
1714 s
->vectors
[ARMV7M_EXCP_SECURE
].active
= (value
& (1 << 4)) != 0;
1715 s
->vectors
[ARMV7M_EXCP_SECURE
].enabled
= (value
& (1 << 19)) != 0;
1716 s
->vectors
[ARMV7M_EXCP_SECURE
].pending
= (value
& (1 << 20)) != 0;
1718 s
->vectors
[ARMV7M_EXCP_MEM
].active
= (value
& (1 << 0)) != 0;
1719 if (arm_feature(&cpu
->env
, ARM_FEATURE_V8
)) {
1720 /* HARDFAULTPENDED is not present in v7M */
1721 s
->vectors
[ARMV7M_EXCP_HARD
].pending
= (value
& (1 << 21)) != 0;
1723 s
->vectors
[ARMV7M_EXCP_USAGE
].active
= (value
& (1 << 3)) != 0;
1724 s
->vectors
[ARMV7M_EXCP_SVC
].active
= (value
& (1 << 7)) != 0;
1725 s
->vectors
[ARMV7M_EXCP_PENDSV
].active
= (value
& (1 << 10)) != 0;
1726 s
->vectors
[ARMV7M_EXCP_SYSTICK
].active
= (value
& (1 << 11)) != 0;
1727 s
->vectors
[ARMV7M_EXCP_USAGE
].pending
= (value
& (1 << 12)) != 0;
1728 s
->vectors
[ARMV7M_EXCP_MEM
].pending
= (value
& (1 << 13)) != 0;
1729 s
->vectors
[ARMV7M_EXCP_SVC
].pending
= (value
& (1 << 15)) != 0;
1730 s
->vectors
[ARMV7M_EXCP_MEM
].enabled
= (value
& (1 << 16)) != 0;
1731 s
->vectors
[ARMV7M_EXCP_USAGE
].enabled
= (value
& (1 << 18)) != 0;
1733 if (attrs
.secure
|| (cpu
->env
.v7m
.aircr
& R_V7M_AIRCR_BFHFNMINS_MASK
)) {
1734 s
->vectors
[ARMV7M_EXCP_BUS
].active
= (value
& (1 << 1)) != 0;
1735 s
->vectors
[ARMV7M_EXCP_BUS
].pending
= (value
& (1 << 14)) != 0;
1736 s
->vectors
[ARMV7M_EXCP_BUS
].enabled
= (value
& (1 << 17)) != 0;
1738 /* NMIACT can only be written if the write is of a zero, with
1739 * BFHFNMINS 1, and by the CPU in secure state via the NS alias.
1741 if (!attrs
.secure
&& cpu
->env
.v7m
.secure
&&
1742 (cpu
->env
.v7m
.aircr
& R_V7M_AIRCR_BFHFNMINS_MASK
) &&
1743 (value
& (1 << 5)) == 0) {
1744 s
->vectors
[ARMV7M_EXCP_NMI
].active
= 0;
1746 /* HARDFAULTACT can only be written if the write is of a zero
1747 * to the non-secure HardFault state by the CPU in secure state.
1748 * The only case where we can be targeting the non-secure HF state
1749 * when in secure state is if this is a write via the NS alias
1750 * and BFHFNMINS is 1.
1752 if (!attrs
.secure
&& cpu
->env
.v7m
.secure
&&
1753 (cpu
->env
.v7m
.aircr
& R_V7M_AIRCR_BFHFNMINS_MASK
) &&
1754 (value
& (1 << 2)) == 0) {
1755 s
->vectors
[ARMV7M_EXCP_HARD
].active
= 0;
1758 /* TODO: this is RAZ/WI from NS if DEMCR.SDME is set */
1759 s
->vectors
[ARMV7M_EXCP_DEBUG
].active
= (value
& (1 << 8)) != 0;
1762 case 0xd2c: /* Hard Fault Status. */
1763 if (!arm_feature(&cpu
->env
, ARM_FEATURE_M_MAIN
)) {
1766 cpu
->env
.v7m
.hfsr
&= ~value
; /* W1C */
1768 case 0xd30: /* Debug Fault Status. */
1769 cpu
->env
.v7m
.dfsr
&= ~value
; /* W1C */
1771 case 0xd34: /* Mem Manage Address. */
1772 if (!arm_feature(&cpu
->env
, ARM_FEATURE_M_MAIN
)) {
1775 cpu
->env
.v7m
.mmfar
[attrs
.secure
] = value
;
1777 case 0xd38: /* Bus Fault Address. */
1778 if (!arm_feature(&cpu
->env
, ARM_FEATURE_M_MAIN
)) {
1781 if (!attrs
.secure
&&
1782 !(s
->cpu
->env
.v7m
.aircr
& R_V7M_AIRCR_BFHFNMINS_MASK
)) {
1785 cpu
->env
.v7m
.bfar
= value
;
1787 case 0xd3c: /* Aux Fault Status. */
1788 qemu_log_mask(LOG_UNIMP
,
1789 "NVIC: Aux fault status registers unimplemented\n");
1791 case 0xd84: /* CSSELR */
1792 if (!arm_v7m_csselr_razwi(cpu
)) {
1793 cpu
->env
.v7m
.csselr
[attrs
.secure
] = value
& R_V7M_CSSELR_INDEX_MASK
;
1796 case 0xd88: /* CPACR */
1797 if (cpu_isar_feature(aa32_vfp_simd
, cpu
)) {
1798 /* We implement only the Floating Point extension's CP10/CP11 */
1799 cpu
->env
.v7m
.cpacr
[attrs
.secure
] = value
& (0xf << 20);
1802 case 0xd8c: /* NSACR */
1803 if (attrs
.secure
&& cpu_isar_feature(aa32_vfp_simd
, cpu
)) {
1804 /* We implement only the Floating Point extension's CP10/CP11 */
1805 cpu
->env
.v7m
.nsacr
= value
& (3 << 10);
1808 case 0xd90: /* MPU_TYPE */
1810 case 0xd94: /* MPU_CTRL */
1812 (R_V7M_MPU_CTRL_HFNMIENA_MASK
| R_V7M_MPU_CTRL_ENABLE_MASK
))
1813 == R_V7M_MPU_CTRL_HFNMIENA_MASK
) {
1814 qemu_log_mask(LOG_GUEST_ERROR
, "MPU_CTRL: HFNMIENA and !ENABLE is "
1817 cpu
->env
.v7m
.mpu_ctrl
[attrs
.secure
]
1818 = value
& (R_V7M_MPU_CTRL_ENABLE_MASK
|
1819 R_V7M_MPU_CTRL_HFNMIENA_MASK
|
1820 R_V7M_MPU_CTRL_PRIVDEFENA_MASK
);
1821 tlb_flush(CPU(cpu
));
1823 case 0xd98: /* MPU_RNR */
1824 if (value
>= cpu
->pmsav7_dregion
) {
1825 qemu_log_mask(LOG_GUEST_ERROR
, "MPU region out of range %"
1826 PRIu32
"/%" PRIu32
"\n",
1827 value
, cpu
->pmsav7_dregion
);
1829 cpu
->env
.pmsav7
.rnr
[attrs
.secure
] = value
;
1832 case 0xd9c: /* MPU_RBAR */
1833 case 0xda4: /* MPU_RBAR_A1 */
1834 case 0xdac: /* MPU_RBAR_A2 */
1835 case 0xdb4: /* MPU_RBAR_A3 */
1839 if (arm_feature(&cpu
->env
, ARM_FEATURE_V8
)) {
1840 /* PMSAv8M handling of the aliases is different from v7M:
1841 * aliases A1, A2, A3 override the low two bits of the region
1842 * number in MPU_RNR, and there is no 'region' field in the
1845 int aliasno
= (offset
- 0xd9c) / 8; /* 0..3 */
1847 region
= cpu
->env
.pmsav7
.rnr
[attrs
.secure
];
1849 region
= deposit32(region
, 0, 2, aliasno
);
1851 if (region
>= cpu
->pmsav7_dregion
) {
1854 cpu
->env
.pmsav8
.rbar
[attrs
.secure
][region
] = value
;
1855 tlb_flush(CPU(cpu
));
1859 if (value
& (1 << 4)) {
1860 /* VALID bit means use the region number specified in this
1861 * value and also update MPU_RNR.REGION with that value.
1863 region
= extract32(value
, 0, 4);
1864 if (region
>= cpu
->pmsav7_dregion
) {
1865 qemu_log_mask(LOG_GUEST_ERROR
,
1866 "MPU region out of range %u/%" PRIu32
"\n",
1867 region
, cpu
->pmsav7_dregion
);
1870 cpu
->env
.pmsav7
.rnr
[attrs
.secure
] = region
;
1872 region
= cpu
->env
.pmsav7
.rnr
[attrs
.secure
];
1875 if (region
>= cpu
->pmsav7_dregion
) {
1879 cpu
->env
.pmsav7
.drbar
[region
] = value
& ~0x1f;
1880 tlb_flush(CPU(cpu
));
1883 case 0xda0: /* MPU_RASR (v7M), MPU_RLAR (v8M) */
1884 case 0xda8: /* MPU_RASR_A1 (v7M), MPU_RLAR_A1 (v8M) */
1885 case 0xdb0: /* MPU_RASR_A2 (v7M), MPU_RLAR_A2 (v8M) */
1886 case 0xdb8: /* MPU_RASR_A3 (v7M), MPU_RLAR_A3 (v8M) */
1888 int region
= cpu
->env
.pmsav7
.rnr
[attrs
.secure
];
1890 if (arm_feature(&cpu
->env
, ARM_FEATURE_V8
)) {
1891 /* PMSAv8M handling of the aliases is different from v7M:
1892 * aliases A1, A2, A3 override the low two bits of the region
1893 * number in MPU_RNR.
1895 int aliasno
= (offset
- 0xd9c) / 8; /* 0..3 */
1897 region
= cpu
->env
.pmsav7
.rnr
[attrs
.secure
];
1899 region
= deposit32(region
, 0, 2, aliasno
);
1901 if (region
>= cpu
->pmsav7_dregion
) {
1904 cpu
->env
.pmsav8
.rlar
[attrs
.secure
][region
] = value
;
1905 tlb_flush(CPU(cpu
));
1909 if (region
>= cpu
->pmsav7_dregion
) {
1913 cpu
->env
.pmsav7
.drsr
[region
] = value
& 0xff3f;
1914 cpu
->env
.pmsav7
.dracr
[region
] = (value
>> 16) & 0x173f;
1915 tlb_flush(CPU(cpu
));
1918 case 0xdc0: /* MPU_MAIR0 */
1919 if (!arm_feature(&cpu
->env
, ARM_FEATURE_V8
)) {
1922 if (cpu
->pmsav7_dregion
) {
1923 /* Register is RES0 if no MPU regions are implemented */
1924 cpu
->env
.pmsav8
.mair0
[attrs
.secure
] = value
;
1926 /* We don't need to do anything else because memory attributes
1927 * only affect cacheability, and we don't implement caching.
1930 case 0xdc4: /* MPU_MAIR1 */
1931 if (!arm_feature(&cpu
->env
, ARM_FEATURE_V8
)) {
1934 if (cpu
->pmsav7_dregion
) {
1935 /* Register is RES0 if no MPU regions are implemented */
1936 cpu
->env
.pmsav8
.mair1
[attrs
.secure
] = value
;
1938 /* We don't need to do anything else because memory attributes
1939 * only affect cacheability, and we don't implement caching.
1942 case 0xdd0: /* SAU_CTRL */
1943 if (!arm_feature(&cpu
->env
, ARM_FEATURE_V8
)) {
1946 if (!attrs
.secure
) {
1949 cpu
->env
.sau
.ctrl
= value
& 3;
1951 case 0xdd4: /* SAU_TYPE */
1952 if (!arm_feature(&cpu
->env
, ARM_FEATURE_V8
)) {
1956 case 0xdd8: /* SAU_RNR */
1957 if (!arm_feature(&cpu
->env
, ARM_FEATURE_V8
)) {
1960 if (!attrs
.secure
) {
1963 if (value
>= cpu
->sau_sregion
) {
1964 qemu_log_mask(LOG_GUEST_ERROR
, "SAU region out of range %"
1965 PRIu32
"/%" PRIu32
"\n",
1966 value
, cpu
->sau_sregion
);
1968 cpu
->env
.sau
.rnr
= value
;
1971 case 0xddc: /* SAU_RBAR */
1973 int region
= cpu
->env
.sau
.rnr
;
1975 if (!arm_feature(&cpu
->env
, ARM_FEATURE_V8
)) {
1978 if (!attrs
.secure
) {
1981 if (region
>= cpu
->sau_sregion
) {
1984 cpu
->env
.sau
.rbar
[region
] = value
& ~0x1f;
1985 tlb_flush(CPU(cpu
));
1988 case 0xde0: /* SAU_RLAR */
1990 int region
= cpu
->env
.sau
.rnr
;
1992 if (!arm_feature(&cpu
->env
, ARM_FEATURE_V8
)) {
1995 if (!attrs
.secure
) {
1998 if (region
>= cpu
->sau_sregion
) {
2001 cpu
->env
.sau
.rlar
[region
] = value
& ~0x1c;
2002 tlb_flush(CPU(cpu
));
2005 case 0xde4: /* SFSR */
2006 if (!arm_feature(&cpu
->env
, ARM_FEATURE_V8
)) {
2009 if (!attrs
.secure
) {
2012 cpu
->env
.v7m
.sfsr
&= ~value
; /* W1C */
2014 case 0xde8: /* SFAR */
2015 if (!arm_feature(&cpu
->env
, ARM_FEATURE_V8
)) {
2018 if (!attrs
.secure
) {
2021 cpu
->env
.v7m
.sfsr
= value
;
2023 case 0xf00: /* Software Triggered Interrupt Register */
2025 int excnum
= (value
& 0x1ff) + NVIC_FIRST_IRQ
;
2027 if (!arm_feature(&cpu
->env
, ARM_FEATURE_M_MAIN
)) {
2031 if (excnum
< s
->num_irq
) {
2032 armv7m_nvic_set_pending(s
, excnum
, false);
2036 case 0xf04: /* RFSR */
2037 if (!cpu_isar_feature(aa32_ras
, cpu
)) {
2040 /* We provide minimal-RAS only: RFSR is RAZ/WI */
2042 case 0xf34: /* FPCCR */
2043 if (cpu_isar_feature(aa32_vfp_simd
, cpu
)) {
2044 /* Not all bits here are banked. */
2047 if (!arm_feature(&cpu
->env
, ARM_FEATURE_V8
)) {
2048 /* Don't allow setting of bits not present in v7M */
2049 value
&= (R_V7M_FPCCR_LSPACT_MASK
|
2050 R_V7M_FPCCR_USER_MASK
|
2051 R_V7M_FPCCR_THREAD_MASK
|
2052 R_V7M_FPCCR_HFRDY_MASK
|
2053 R_V7M_FPCCR_MMRDY_MASK
|
2054 R_V7M_FPCCR_BFRDY_MASK
|
2055 R_V7M_FPCCR_MONRDY_MASK
|
2056 R_V7M_FPCCR_LSPEN_MASK
|
2057 R_V7M_FPCCR_ASPEN_MASK
);
2059 value
&= ~R_V7M_FPCCR_RES0_MASK
;
2061 if (!attrs
.secure
) {
2062 /* Some non-banked bits are configurably writable by NS */
2063 fpccr_s
= cpu
->env
.v7m
.fpccr
[M_REG_S
];
2064 if (!(fpccr_s
& R_V7M_FPCCR_LSPENS_MASK
)) {
2065 uint32_t lspen
= FIELD_EX32(value
, V7M_FPCCR
, LSPEN
);
2066 fpccr_s
= FIELD_DP32(fpccr_s
, V7M_FPCCR
, LSPEN
, lspen
);
2068 if (!(fpccr_s
& R_V7M_FPCCR_CLRONRETS_MASK
)) {
2069 uint32_t cor
= FIELD_EX32(value
, V7M_FPCCR
, CLRONRET
);
2070 fpccr_s
= FIELD_DP32(fpccr_s
, V7M_FPCCR
, CLRONRET
, cor
);
2072 if ((s
->cpu
->env
.v7m
.aircr
& R_V7M_AIRCR_BFHFNMINS_MASK
)) {
2073 uint32_t hfrdy
= FIELD_EX32(value
, V7M_FPCCR
, HFRDY
);
2074 uint32_t bfrdy
= FIELD_EX32(value
, V7M_FPCCR
, BFRDY
);
2075 fpccr_s
= FIELD_DP32(fpccr_s
, V7M_FPCCR
, HFRDY
, hfrdy
);
2076 fpccr_s
= FIELD_DP32(fpccr_s
, V7M_FPCCR
, BFRDY
, bfrdy
);
2078 /* TODO MONRDY should RAZ/WI if DEMCR.SDME is set */
2080 uint32_t monrdy
= FIELD_EX32(value
, V7M_FPCCR
, MONRDY
);
2081 fpccr_s
= FIELD_DP32(fpccr_s
, V7M_FPCCR
, MONRDY
, monrdy
);
2085 * All other non-banked bits are RAZ/WI from NS; write
2086 * just the banked bits to fpccr[M_REG_NS].
2088 value
&= R_V7M_FPCCR_BANKED_MASK
;
2089 cpu
->env
.v7m
.fpccr
[M_REG_NS
] = value
;
2093 cpu
->env
.v7m
.fpccr
[M_REG_S
] = fpccr_s
;
2096 case 0xf38: /* FPCAR */
2097 if (cpu_isar_feature(aa32_vfp_simd
, cpu
)) {
2099 cpu
->env
.v7m
.fpcar
[attrs
.secure
] = value
;
2102 case 0xf3c: /* FPDSCR */
2103 if (cpu_isar_feature(aa32_vfp_simd
, cpu
)) {
2104 uint32_t mask
= FPCR_AHP
| FPCR_DN
| FPCR_FZ
| FPCR_RMODE_MASK
;
2105 if (cpu_isar_feature(any_fp16
, cpu
)) {
2109 if (cpu_isar_feature(aa32_lob
, cpu
)) {
2110 value
|= 4 << FPCR_LTPSIZE_SHIFT
;
2112 cpu
->env
.v7m
.fpdscr
[attrs
.secure
] = value
;
2115 case 0xf50: /* ICIALLU */
2116 case 0xf58: /* ICIMVAU */
2117 case 0xf5c: /* DCIMVAC */
2118 case 0xf60: /* DCISW */
2119 case 0xf64: /* DCCMVAU */
2120 case 0xf68: /* DCCMVAC */
2121 case 0xf6c: /* DCCSW */
2122 case 0xf70: /* DCCIMVAC */
2123 case 0xf74: /* DCCISW */
2124 case 0xf78: /* BPIALL */
2125 /* Cache and branch predictor maintenance: for QEMU these always NOP */
2129 qemu_log_mask(LOG_GUEST_ERROR
,
2130 "NVIC: Bad write offset 0x%x\n", offset
);
2134 static bool nvic_user_access_ok(NVICState
*s
, hwaddr offset
, MemTxAttrs attrs
)
2136 /* Return true if unprivileged access to this register is permitted. */
2138 case 0xf00: /* STIR: accessible only if CCR.USERSETMPEND permits */
2139 /* For access via STIR_NS it is the NS CCR.USERSETMPEND that
2140 * controls access even though the CPU is in Secure state (I_QDKX).
2142 return s
->cpu
->env
.v7m
.ccr
[attrs
.secure
] & R_V7M_CCR_USERSETMPEND_MASK
;
2144 /* All other user accesses cause a BusFault unconditionally */
2149 static int shpr_bank(NVICState
*s
, int exc
, MemTxAttrs attrs
)
2151 /* Behaviour for the SHPR register field for this exception:
2152 * return M_REG_NS to use the nonsecure vector (including for
2153 * non-banked exceptions), M_REG_S for the secure version of
2154 * a banked exception, and -1 if this field should RAZ/WI.
2157 case ARMV7M_EXCP_MEM
:
2158 case ARMV7M_EXCP_USAGE
:
2159 case ARMV7M_EXCP_SVC
:
2160 case ARMV7M_EXCP_PENDSV
:
2161 case ARMV7M_EXCP_SYSTICK
:
2162 /* Banked exceptions */
2163 return attrs
.secure
;
2164 case ARMV7M_EXCP_BUS
:
2165 /* Not banked, RAZ/WI from nonsecure if BFHFNMINS is zero */
2166 if (!attrs
.secure
&&
2167 !(s
->cpu
->env
.v7m
.aircr
& R_V7M_AIRCR_BFHFNMINS_MASK
)) {
2171 case ARMV7M_EXCP_SECURE
:
2172 /* Not banked, RAZ/WI from nonsecure */
2173 if (!attrs
.secure
) {
2177 case ARMV7M_EXCP_DEBUG
:
2178 /* Not banked. TODO should RAZ/WI if DEMCR.SDME is set */
2185 /* Not reachable due to decode of SHPR register addresses */
2186 g_assert_not_reached();
2190 static MemTxResult
nvic_sysreg_read(void *opaque
, hwaddr addr
,
2191 uint64_t *data
, unsigned size
,
2194 NVICState
*s
= (NVICState
*)opaque
;
2195 uint32_t offset
= addr
;
2196 unsigned i
, startvec
, end
;
2199 if (attrs
.user
&& !nvic_user_access_ok(s
, addr
, attrs
)) {
2200 /* Generate BusFault for unprivileged accesses */
2205 /* reads of set and clear both return the status */
2206 case 0x100 ... 0x13f: /* NVIC Set enable */
2209 case 0x180 ... 0x1bf: /* NVIC Clear enable */
2211 startvec
= 8 * (offset
- 0x180) + NVIC_FIRST_IRQ
; /* vector # */
2213 for (i
= 0, end
= size
* 8; i
< end
&& startvec
+ i
< s
->num_irq
; i
++) {
2214 if (s
->vectors
[startvec
+ i
].enabled
&&
2215 (attrs
.secure
|| s
->itns
[startvec
+ i
])) {
2220 case 0x200 ... 0x23f: /* NVIC Set pend */
2223 case 0x280 ... 0x2bf: /* NVIC Clear pend */
2225 startvec
= 8 * (offset
- 0x280) + NVIC_FIRST_IRQ
; /* vector # */
2226 for (i
= 0, end
= size
* 8; i
< end
&& startvec
+ i
< s
->num_irq
; i
++) {
2227 if (s
->vectors
[startvec
+ i
].pending
&&
2228 (attrs
.secure
|| s
->itns
[startvec
+ i
])) {
2233 case 0x300 ... 0x33f: /* NVIC Active */
2236 if (!arm_feature(&s
->cpu
->env
, ARM_FEATURE_V7
)) {
2240 startvec
= 8 * (offset
- 0x300) + NVIC_FIRST_IRQ
; /* vector # */
2242 for (i
= 0, end
= size
* 8; i
< end
&& startvec
+ i
< s
->num_irq
; i
++) {
2243 if (s
->vectors
[startvec
+ i
].active
&&
2244 (attrs
.secure
|| s
->itns
[startvec
+ i
])) {
2249 case 0x400 ... 0x5ef: /* NVIC Priority */
2251 startvec
= offset
- 0x400 + NVIC_FIRST_IRQ
; /* vector # */
2253 for (i
= 0; i
< size
&& startvec
+ i
< s
->num_irq
; i
++) {
2254 if (attrs
.secure
|| s
->itns
[startvec
+ i
]) {
2255 val
|= s
->vectors
[startvec
+ i
].prio
<< (8 * i
);
2259 case 0xd18 ... 0xd1b: /* System Handler Priority (SHPR1) */
2260 if (!arm_feature(&s
->cpu
->env
, ARM_FEATURE_M_MAIN
)) {
2265 case 0xd1c ... 0xd23: /* System Handler Priority (SHPR2, SHPR3) */
2267 for (i
= 0; i
< size
; i
++) {
2268 unsigned hdlidx
= (offset
- 0xd14) + i
;
2269 int sbank
= shpr_bank(s
, hdlidx
, attrs
);
2274 val
= deposit32(val
, i
* 8, 8, get_prio(s
, hdlidx
, sbank
));
2277 case 0xd28 ... 0xd2b: /* Configurable Fault Status (CFSR) */
2278 if (!arm_feature(&s
->cpu
->env
, ARM_FEATURE_M_MAIN
)) {
2283 * The BFSR bits [15:8] are shared between security states
2284 * and we store them in the NS copy. They are RAZ/WI for
2285 * NS code if AIRCR.BFHFNMINS is 0.
2287 val
= s
->cpu
->env
.v7m
.cfsr
[attrs
.secure
];
2288 if (!attrs
.secure
&&
2289 !(s
->cpu
->env
.v7m
.aircr
& R_V7M_AIRCR_BFHFNMINS_MASK
)) {
2290 val
&= ~R_V7M_CFSR_BFSR_MASK
;
2292 val
|= s
->cpu
->env
.v7m
.cfsr
[M_REG_NS
] & R_V7M_CFSR_BFSR_MASK
;
2294 val
= extract32(val
, (offset
- 0xd28) * 8, size
* 8);
2296 case 0xfe0 ... 0xfff: /* ID. */
2300 val
= nvic_id
[(offset
- 0xfe0) >> 2];
2305 val
= nvic_readl(s
, offset
, attrs
);
2307 qemu_log_mask(LOG_GUEST_ERROR
,
2308 "NVIC: Bad read of size %d at offset 0x%x\n",
2314 trace_nvic_sysreg_read(addr
, val
, size
);
2319 static MemTxResult
nvic_sysreg_write(void *opaque
, hwaddr addr
,
2320 uint64_t value
, unsigned size
,
2323 NVICState
*s
= (NVICState
*)opaque
;
2324 uint32_t offset
= addr
;
2325 unsigned i
, startvec
, end
;
2326 unsigned setval
= 0;
2328 trace_nvic_sysreg_write(addr
, value
, size
);
2330 if (attrs
.user
&& !nvic_user_access_ok(s
, addr
, attrs
)) {
2331 /* Generate BusFault for unprivileged accesses */
2336 case 0x100 ... 0x13f: /* NVIC Set enable */
2340 case 0x180 ... 0x1bf: /* NVIC Clear enable */
2341 startvec
= 8 * (offset
- 0x180) + NVIC_FIRST_IRQ
;
2343 for (i
= 0, end
= size
* 8; i
< end
&& startvec
+ i
< s
->num_irq
; i
++) {
2344 if (value
& (1 << i
) &&
2345 (attrs
.secure
|| s
->itns
[startvec
+ i
])) {
2346 s
->vectors
[startvec
+ i
].enabled
= setval
;
2351 case 0x200 ... 0x23f: /* NVIC Set pend */
2352 /* the special logic in armv7m_nvic_set_pending()
2353 * is not needed since IRQs are never escalated
2358 case 0x280 ... 0x2bf: /* NVIC Clear pend */
2359 startvec
= 8 * (offset
- 0x280) + NVIC_FIRST_IRQ
; /* vector # */
2361 for (i
= 0, end
= size
* 8; i
< end
&& startvec
+ i
< s
->num_irq
; i
++) {
2362 if (value
& (1 << i
) &&
2363 (attrs
.secure
|| s
->itns
[startvec
+ i
])) {
2364 s
->vectors
[startvec
+ i
].pending
= setval
;
2369 case 0x300 ... 0x33f: /* NVIC Active */
2370 goto exit_ok
; /* R/O */
2371 case 0x400 ... 0x5ef: /* NVIC Priority */
2372 startvec
= (offset
- 0x400) + NVIC_FIRST_IRQ
; /* vector # */
2374 for (i
= 0; i
< size
&& startvec
+ i
< s
->num_irq
; i
++) {
2375 if (attrs
.secure
|| s
->itns
[startvec
+ i
]) {
2376 set_prio(s
, startvec
+ i
, false, (value
>> (i
* 8)) & 0xff);
2381 case 0xd18 ... 0xd1b: /* System Handler Priority (SHPR1) */
2382 if (!arm_feature(&s
->cpu
->env
, ARM_FEATURE_M_MAIN
)) {
2386 case 0xd1c ... 0xd23: /* System Handler Priority (SHPR2, SHPR3) */
2387 for (i
= 0; i
< size
; i
++) {
2388 unsigned hdlidx
= (offset
- 0xd14) + i
;
2389 int newprio
= extract32(value
, i
* 8, 8);
2390 int sbank
= shpr_bank(s
, hdlidx
, attrs
);
2395 set_prio(s
, hdlidx
, sbank
, newprio
);
2399 case 0xd28 ... 0xd2b: /* Configurable Fault Status (CFSR) */
2400 if (!arm_feature(&s
->cpu
->env
, ARM_FEATURE_M_MAIN
)) {
2403 /* All bits are W1C, so construct 32 bit value with 0s in
2404 * the parts not written by the access size
2406 value
<<= ((offset
- 0xd28) * 8);
2408 if (!attrs
.secure
&&
2409 !(s
->cpu
->env
.v7m
.aircr
& R_V7M_AIRCR_BFHFNMINS_MASK
)) {
2410 /* BFSR bits are RAZ/WI for NS if BFHFNMINS is set */
2411 value
&= ~R_V7M_CFSR_BFSR_MASK
;
2414 s
->cpu
->env
.v7m
.cfsr
[attrs
.secure
] &= ~value
;
2416 /* The BFSR bits [15:8] are shared between security states
2417 * and we store them in the NS copy.
2419 s
->cpu
->env
.v7m
.cfsr
[M_REG_NS
] &= ~(value
& R_V7M_CFSR_BFSR_MASK
);
2424 nvic_writel(s
, offset
, value
, attrs
);
2427 qemu_log_mask(LOG_GUEST_ERROR
,
2428 "NVIC: Bad write of size %d at offset 0x%x\n", size
, offset
);
2429 /* This is UNPREDICTABLE; treat as RAZ/WI */
2432 /* Ensure any changes made are reflected in the cached hflags. */
2433 arm_rebuild_hflags(&s
->cpu
->env
);
2437 static const MemoryRegionOps nvic_sysreg_ops
= {
2438 .read_with_attrs
= nvic_sysreg_read
,
2439 .write_with_attrs
= nvic_sysreg_write
,
2440 .endianness
= DEVICE_NATIVE_ENDIAN
,
2443 static MemTxResult
nvic_sysreg_ns_write(void *opaque
, hwaddr addr
,
2444 uint64_t value
, unsigned size
,
2447 MemoryRegion
*mr
= opaque
;
2450 /* S accesses to the alias act like NS accesses to the real region */
2452 return memory_region_dispatch_write(mr
, addr
, value
,
2453 size_memop(size
) | MO_TE
, attrs
);
2455 /* NS attrs are RAZ/WI for privileged, and BusFault for user */
2463 static MemTxResult
nvic_sysreg_ns_read(void *opaque
, hwaddr addr
,
2464 uint64_t *data
, unsigned size
,
2467 MemoryRegion
*mr
= opaque
;
2470 /* S accesses to the alias act like NS accesses to the real region */
2472 return memory_region_dispatch_read(mr
, addr
, data
,
2473 size_memop(size
) | MO_TE
, attrs
);
2475 /* NS attrs are RAZ/WI for privileged, and BusFault for user */
2484 static const MemoryRegionOps nvic_sysreg_ns_ops
= {
2485 .read_with_attrs
= nvic_sysreg_ns_read
,
2486 .write_with_attrs
= nvic_sysreg_ns_write
,
2487 .endianness
= DEVICE_NATIVE_ENDIAN
,
2490 static MemTxResult
nvic_systick_write(void *opaque
, hwaddr addr
,
2491 uint64_t value
, unsigned size
,
2494 NVICState
*s
= opaque
;
2497 /* Direct the access to the correct systick */
2498 mr
= sysbus_mmio_get_region(SYS_BUS_DEVICE(&s
->systick
[attrs
.secure
]), 0);
2499 return memory_region_dispatch_write(mr
, addr
, value
,
2500 size_memop(size
) | MO_TE
, attrs
);
2503 static MemTxResult
nvic_systick_read(void *opaque
, hwaddr addr
,
2504 uint64_t *data
, unsigned size
,
2507 NVICState
*s
= opaque
;
2510 /* Direct the access to the correct systick */
2511 mr
= sysbus_mmio_get_region(SYS_BUS_DEVICE(&s
->systick
[attrs
.secure
]), 0);
2512 return memory_region_dispatch_read(mr
, addr
, data
, size_memop(size
) | MO_TE
,
2516 static const MemoryRegionOps nvic_systick_ops
= {
2517 .read_with_attrs
= nvic_systick_read
,
2518 .write_with_attrs
= nvic_systick_write
,
2519 .endianness
= DEVICE_NATIVE_ENDIAN
,
2523 static MemTxResult
ras_read(void *opaque
, hwaddr addr
,
2524 uint64_t *data
, unsigned size
,
2532 case 0xe10: /* ERRIIDR */
2533 /* architect field = Arm; product/variant/revision 0 */
2536 case 0xfc8: /* ERRDEVID */
2537 /* Minimal RAS: we implement 0 error record indexes */
2541 qemu_log_mask(LOG_UNIMP
, "Read RAS register offset 0x%x\n",
2549 static MemTxResult
ras_write(void *opaque
, hwaddr addr
,
2550 uint64_t value
, unsigned size
,
2559 qemu_log_mask(LOG_UNIMP
, "Write to RAS register offset 0x%x\n",
2566 static const MemoryRegionOps ras_ops
= {
2567 .read_with_attrs
= ras_read
,
2568 .write_with_attrs
= ras_write
,
2569 .endianness
= DEVICE_NATIVE_ENDIAN
,
2573 * Unassigned portions of the PPB space are RAZ/WI for privileged
2574 * accesses, and fault for non-privileged accesses.
2576 static MemTxResult
ppb_default_read(void *opaque
, hwaddr addr
,
2577 uint64_t *data
, unsigned size
,
2580 qemu_log_mask(LOG_UNIMP
, "Read of unassigned area of PPB: offset 0x%x\n",
2589 static MemTxResult
ppb_default_write(void *opaque
, hwaddr addr
,
2590 uint64_t value
, unsigned size
,
2593 qemu_log_mask(LOG_UNIMP
, "Write of unassigned area of PPB: offset 0x%x\n",
2601 static const MemoryRegionOps ppb_default_ops
= {
2602 .read_with_attrs
= ppb_default_read
,
2603 .write_with_attrs
= ppb_default_write
,
2604 .endianness
= DEVICE_NATIVE_ENDIAN
,
2605 .valid
.min_access_size
= 1,
2606 .valid
.max_access_size
= 8,
2609 static int nvic_post_load(void *opaque
, int version_id
)
2611 NVICState
*s
= opaque
;
2615 /* Check for out of range priority settings */
2616 resetprio
= arm_feature(&s
->cpu
->env
, ARM_FEATURE_V8
) ? -4 : -3;
2618 if (s
->vectors
[ARMV7M_EXCP_RESET
].prio
!= resetprio
||
2619 s
->vectors
[ARMV7M_EXCP_NMI
].prio
!= -2 ||
2620 s
->vectors
[ARMV7M_EXCP_HARD
].prio
!= -1) {
2623 for (i
= ARMV7M_EXCP_MEM
; i
< s
->num_irq
; i
++) {
2624 if (s
->vectors
[i
].prio
& ~0xff) {
2629 nvic_recompute_state(s
);
2634 static const VMStateDescription vmstate_VecInfo
= {
2635 .name
= "armv7m_nvic_info",
2637 .minimum_version_id
= 1,
2638 .fields
= (VMStateField
[]) {
2639 VMSTATE_INT16(prio
, VecInfo
),
2640 VMSTATE_UINT8(enabled
, VecInfo
),
2641 VMSTATE_UINT8(pending
, VecInfo
),
2642 VMSTATE_UINT8(active
, VecInfo
),
2643 VMSTATE_UINT8(level
, VecInfo
),
2644 VMSTATE_END_OF_LIST()
2648 static bool nvic_security_needed(void *opaque
)
2650 NVICState
*s
= opaque
;
2652 return arm_feature(&s
->cpu
->env
, ARM_FEATURE_M_SECURITY
);
2655 static int nvic_security_post_load(void *opaque
, int version_id
)
2657 NVICState
*s
= opaque
;
2660 /* Check for out of range priority settings */
2661 if (s
->sec_vectors
[ARMV7M_EXCP_HARD
].prio
!= -1
2662 && s
->sec_vectors
[ARMV7M_EXCP_HARD
].prio
!= -3) {
2663 /* We can't cross-check against AIRCR.BFHFNMINS as we don't know
2664 * if the CPU state has been migrated yet; a mismatch won't
2665 * cause the emulation to blow up, though.
2669 for (i
= ARMV7M_EXCP_MEM
; i
< ARRAY_SIZE(s
->sec_vectors
); i
++) {
2670 if (s
->sec_vectors
[i
].prio
& ~0xff) {
2677 static const VMStateDescription vmstate_nvic_security
= {
2678 .name
= "armv7m_nvic/m-security",
2680 .minimum_version_id
= 1,
2681 .needed
= nvic_security_needed
,
2682 .post_load
= &nvic_security_post_load
,
2683 .fields
= (VMStateField
[]) {
2684 VMSTATE_STRUCT_ARRAY(sec_vectors
, NVICState
, NVIC_INTERNAL_VECTORS
, 1,
2685 vmstate_VecInfo
, VecInfo
),
2686 VMSTATE_UINT32(prigroup
[M_REG_S
], NVICState
),
2687 VMSTATE_BOOL_ARRAY(itns
, NVICState
, NVIC_MAX_VECTORS
),
2688 VMSTATE_END_OF_LIST()
2692 static const VMStateDescription vmstate_nvic
= {
2693 .name
= "armv7m_nvic",
2695 .minimum_version_id
= 4,
2696 .post_load
= &nvic_post_load
,
2697 .fields
= (VMStateField
[]) {
2698 VMSTATE_STRUCT_ARRAY(vectors
, NVICState
, NVIC_MAX_VECTORS
, 1,
2699 vmstate_VecInfo
, VecInfo
),
2700 VMSTATE_UINT32(prigroup
[M_REG_NS
], NVICState
),
2701 VMSTATE_END_OF_LIST()
2703 .subsections
= (const VMStateDescription
*[]) {
2704 &vmstate_nvic_security
,
2709 static Property props_nvic
[] = {
2710 /* Number of external IRQ lines (so excluding the 16 internal exceptions) */
2711 DEFINE_PROP_UINT32("num-irq", NVICState
, num_irq
, 64),
2712 DEFINE_PROP_END_OF_LIST()
2715 static void armv7m_nvic_reset(DeviceState
*dev
)
2718 NVICState
*s
= NVIC(dev
);
2720 memset(s
->vectors
, 0, sizeof(s
->vectors
));
2721 memset(s
->sec_vectors
, 0, sizeof(s
->sec_vectors
));
2722 s
->prigroup
[M_REG_NS
] = 0;
2723 s
->prigroup
[M_REG_S
] = 0;
2725 s
->vectors
[ARMV7M_EXCP_NMI
].enabled
= 1;
2726 /* MEM, BUS, and USAGE are enabled through
2727 * the System Handler Control register
2729 s
->vectors
[ARMV7M_EXCP_SVC
].enabled
= 1;
2730 s
->vectors
[ARMV7M_EXCP_PENDSV
].enabled
= 1;
2731 s
->vectors
[ARMV7M_EXCP_SYSTICK
].enabled
= 1;
2733 /* DebugMonitor is enabled via DEMCR.MON_EN */
2734 s
->vectors
[ARMV7M_EXCP_DEBUG
].enabled
= 0;
2736 resetprio
= arm_feature(&s
->cpu
->env
, ARM_FEATURE_V8
) ? -4 : -3;
2737 s
->vectors
[ARMV7M_EXCP_RESET
].prio
= resetprio
;
2738 s
->vectors
[ARMV7M_EXCP_NMI
].prio
= -2;
2739 s
->vectors
[ARMV7M_EXCP_HARD
].prio
= -1;
2741 if (arm_feature(&s
->cpu
->env
, ARM_FEATURE_M_SECURITY
)) {
2742 s
->sec_vectors
[ARMV7M_EXCP_HARD
].enabled
= 1;
2743 s
->sec_vectors
[ARMV7M_EXCP_SVC
].enabled
= 1;
2744 s
->sec_vectors
[ARMV7M_EXCP_PENDSV
].enabled
= 1;
2745 s
->sec_vectors
[ARMV7M_EXCP_SYSTICK
].enabled
= 1;
2747 /* AIRCR.BFHFNMINS resets to 0 so Secure HF is priority -1 (R_CMTC) */
2748 s
->sec_vectors
[ARMV7M_EXCP_HARD
].prio
= -1;
2749 /* If AIRCR.BFHFNMINS is 0 then NS HF is (effectively) disabled */
2750 s
->vectors
[ARMV7M_EXCP_HARD
].enabled
= 0;
2752 s
->vectors
[ARMV7M_EXCP_HARD
].enabled
= 1;
2755 /* Strictly speaking the reset handler should be enabled.
2756 * However, we don't simulate soft resets through the NVIC,
2757 * and the reset vector should never be pended.
2758 * So we leave it disabled to catch logic errors.
2761 s
->exception_prio
= NVIC_NOEXC_PRIO
;
2763 s
->vectpending_is_s_banked
= false;
2764 s
->vectpending_prio
= NVIC_NOEXC_PRIO
;
2766 if (arm_feature(&s
->cpu
->env
, ARM_FEATURE_M_SECURITY
)) {
2767 memset(s
->itns
, 0, sizeof(s
->itns
));
2769 /* This state is constant and not guest accessible in a non-security
2770 * NVIC; we set the bits to true to avoid having to do a feature
2771 * bit check in the NVIC enable/pend/etc register accessors.
2775 for (i
= NVIC_FIRST_IRQ
; i
< ARRAY_SIZE(s
->itns
); i
++) {
2781 * We updated state that affects the CPU's MMUidx and thus its hflags;
2782 * and we can't guarantee that we run before the CPU reset function.
2784 arm_rebuild_hflags(&s
->cpu
->env
);
2787 static void nvic_systick_trigger(void *opaque
, int n
, int level
)
2789 NVICState
*s
= opaque
;
2792 /* SysTick just asked us to pend its exception.
2793 * (This is different from an external interrupt line's
2795 * n == 0 : NonSecure systick
2796 * n == 1 : Secure systick
2798 armv7m_nvic_set_pending(s
, ARMV7M_EXCP_SYSTICK
, n
);
2802 static void armv7m_nvic_realize(DeviceState
*dev
, Error
**errp
)
2804 NVICState
*s
= NVIC(dev
);
2806 /* The armv7m container object will have set our CPU pointer */
2807 if (!s
->cpu
|| !arm_feature(&s
->cpu
->env
, ARM_FEATURE_M
)) {
2808 error_setg(errp
, "The NVIC can only be used with a Cortex-M CPU");
2812 if (s
->num_irq
> NVIC_MAX_IRQ
) {
2813 error_setg(errp
, "num-irq %d exceeds NVIC maximum", s
->num_irq
);
2817 qdev_init_gpio_in(dev
, set_irq_level
, s
->num_irq
);
2819 /* include space for internal exception vectors */
2820 s
->num_irq
+= NVIC_FIRST_IRQ
;
2822 s
->num_prio_bits
= arm_feature(&s
->cpu
->env
, ARM_FEATURE_V7
) ? 8 : 2;
2824 if (!sysbus_realize(SYS_BUS_DEVICE(&s
->systick
[M_REG_NS
]), errp
)) {
2827 sysbus_connect_irq(SYS_BUS_DEVICE(&s
->systick
[M_REG_NS
]), 0,
2828 qdev_get_gpio_in_named(dev
, "systick-trigger",
2831 if (arm_feature(&s
->cpu
->env
, ARM_FEATURE_M_SECURITY
)) {
2832 /* We couldn't init the secure systick device in instance_init
2833 * as we didn't know then if the CPU had the security extensions;
2834 * so we have to do it here.
2836 object_initialize_child(OBJECT(dev
), "systick-reg-s",
2837 &s
->systick
[M_REG_S
], TYPE_SYSTICK
);
2839 if (!sysbus_realize(SYS_BUS_DEVICE(&s
->systick
[M_REG_S
]), errp
)) {
2842 sysbus_connect_irq(SYS_BUS_DEVICE(&s
->systick
[M_REG_S
]), 0,
2843 qdev_get_gpio_in_named(dev
, "systick-trigger",
2848 * This device provides a single sysbus memory region which
2849 * represents the whole of the "System PPB" space. This is the
2850 * range from 0xe0000000 to 0xe00fffff and includes the NVIC,
2851 * the System Control Space (system registers), the systick timer,
2852 * and for CPUs with the Security extension an NS banked version
2855 * The default behaviour for unimplemented registers/ranges
2856 * (for instance the Data Watchpoint and Trace unit at 0xe0001000)
2857 * is to RAZ/WI for privileged access and BusFault for non-privileged
2860 * The NVIC and System Control Space (SCS) starts at 0xe000e000
2861 * and looks like this:
2863 * 0x010 - 0xff - systick
2864 * 0x100..0x7ec - NVIC
2865 * 0x7f0..0xcff - Reserved
2866 * 0xd00..0xd3c - SCS registers
2867 * 0xd40..0xeff - Reserved or Not implemented
2870 * Some registers within this space are banked between security states.
2871 * In v8M there is a second range 0xe002e000..0xe002efff which is the
2872 * NonSecure alias SCS; secure accesses to this behave like NS accesses
2873 * to the main SCS range, and non-secure accesses (including when
2874 * the security extension is not implemented) are RAZ/WI.
2875 * Note that both the main SCS range and the alias range are defined
2876 * to be exempt from memory attribution (R_BLJT) and so the memory
2877 * transaction attribute always matches the current CPU security
2878 * state (attrs.secure == env->v7m.secure). In the nvic_sysreg_ns_ops
2879 * wrappers we change attrs.secure to indicate the NS access; so
2880 * generally code determining which banked register to use should
2881 * use attrs.secure; code determining actual behaviour of the system
2882 * should use env->v7m.secure.
2884 * The container covers the whole PPB space. Within it the priority
2885 * of overlapping regions is:
2886 * - default region (for RAZ/WI and BusFault) : -1
2887 * - system register regions : 0
2889 * This is because the systick device is a small block of registers
2890 * in the middle of the other system control registers.
2892 memory_region_init(&s
->container
, OBJECT(s
), "nvic", 0x100000);
2893 memory_region_init_io(&s
->defaultmem
, OBJECT(s
), &ppb_default_ops
, s
,
2894 "nvic-default", 0x100000);
2895 memory_region_add_subregion_overlap(&s
->container
, 0, &s
->defaultmem
, -1);
2896 memory_region_init_io(&s
->sysregmem
, OBJECT(s
), &nvic_sysreg_ops
, s
,
2897 "nvic_sysregs", 0x1000);
2898 memory_region_add_subregion(&s
->container
, 0xe000, &s
->sysregmem
);
2900 memory_region_init_io(&s
->systickmem
, OBJECT(s
),
2901 &nvic_systick_ops
, s
,
2902 "nvic_systick", 0xe0);
2904 memory_region_add_subregion_overlap(&s
->container
, 0xe010,
2907 if (arm_feature(&s
->cpu
->env
, ARM_FEATURE_V8
)) {
2908 memory_region_init_io(&s
->sysreg_ns_mem
, OBJECT(s
),
2909 &nvic_sysreg_ns_ops
, &s
->sysregmem
,
2910 "nvic_sysregs_ns", 0x1000);
2911 memory_region_add_subregion(&s
->container
, 0x2e000, &s
->sysreg_ns_mem
);
2912 memory_region_init_io(&s
->systick_ns_mem
, OBJECT(s
),
2913 &nvic_sysreg_ns_ops
, &s
->systickmem
,
2914 "nvic_systick_ns", 0xe0);
2915 memory_region_add_subregion_overlap(&s
->container
, 0x2e010,
2916 &s
->systick_ns_mem
, 1);
2919 if (cpu_isar_feature(aa32_ras
, s
->cpu
)) {
2920 memory_region_init_io(&s
->ras_mem
, OBJECT(s
),
2921 &ras_ops
, s
, "nvic_ras", 0x1000);
2922 memory_region_add_subregion(&s
->container
, 0x5000, &s
->ras_mem
);
2925 sysbus_init_mmio(SYS_BUS_DEVICE(dev
), &s
->container
);
2928 static void armv7m_nvic_instance_init(Object
*obj
)
2930 /* We have a different default value for the num-irq property
2931 * than our superclass. This function runs after qdev init
2932 * has set the defaults from the Property array and before
2933 * any user-specified property setting, so just modify the
2934 * value in the GICState struct.
2936 DeviceState
*dev
= DEVICE(obj
);
2937 NVICState
*nvic
= NVIC(obj
);
2938 SysBusDevice
*sbd
= SYS_BUS_DEVICE(obj
);
2940 object_initialize_child(obj
, "systick-reg-ns", &nvic
->systick
[M_REG_NS
],
2942 /* We can't initialize the secure systick here, as we don't know
2943 * yet if we need it.
2946 sysbus_init_irq(sbd
, &nvic
->excpout
);
2947 qdev_init_gpio_out_named(dev
, &nvic
->sysresetreq
, "SYSRESETREQ", 1);
2948 qdev_init_gpio_in_named(dev
, nvic_systick_trigger
, "systick-trigger",
2950 qdev_init_gpio_in_named(dev
, nvic_nmi_trigger
, "NMI", 1);
2953 static void armv7m_nvic_class_init(ObjectClass
*klass
, void *data
)
2955 DeviceClass
*dc
= DEVICE_CLASS(klass
);
2957 dc
->vmsd
= &vmstate_nvic
;
2958 device_class_set_props(dc
, props_nvic
);
2959 dc
->reset
= armv7m_nvic_reset
;
2960 dc
->realize
= armv7m_nvic_realize
;
2963 static const TypeInfo armv7m_nvic_info
= {
2965 .parent
= TYPE_SYS_BUS_DEVICE
,
2966 .instance_init
= armv7m_nvic_instance_init
,
2967 .instance_size
= sizeof(NVICState
),
2968 .class_init
= armv7m_nvic_class_init
,
2969 .class_size
= sizeof(SysBusDeviceClass
),
2972 static void armv7m_nvic_register_types(void)
2974 type_register_static(&armv7m_nvic_info
);
2977 type_init(armv7m_nvic_register_types
)