2 * ARM Nested Vectored Interrupt Controller
4 * Copyright (c) 2006-2007 CodeSourcery.
5 * Written by Paul Brook
7 * This code is licensed under the GPL.
9 * The ARMv7M System controller is fairly tightly tied in with the
10 * NVIC. Much of that is also implemented here.
13 #include "qemu/osdep.h"
14 #include "qapi/error.h"
15 #include "qemu-common.h"
17 #include "hw/sysbus.h"
18 #include "qemu/timer.h"
19 #include "hw/arm/arm.h"
20 #include "hw/intc/armv7m_nvic.h"
21 #include "target/arm/cpu.h"
22 #include "exec/exec-all.h"
26 /* IRQ number counting:
28 * the num-irq property counts the number of external IRQ lines
30 * NVICState::num_irq counts the total number of exceptions
31 * (external IRQs, the 15 internal exceptions including reset,
32 * and one for the unused exception number 0).
34 * NVIC_MAX_IRQ is the highest permitted number of external IRQ lines.
36 * NVIC_MAX_VECTORS is the highest permitted number of exceptions.
38 * Iterating through all exceptions should typically be done with
39 * for (i = 1; i < s->num_irq; i++) to avoid the unused slot 0.
41 * The external qemu_irq lines are the NVIC's external IRQ lines,
42 * so line 0 is exception 16.
44 * In the terminology of the architecture manual, "interrupts" are
45 * a subcategory of exception referring to the external interrupts
46 * (which are exception numbers NVIC_FIRST_IRQ and upward).
47 * For historical reasons QEMU tends to use "interrupt" and
48 * "exception" more or less interchangeably.
50 #define NVIC_FIRST_IRQ NVIC_INTERNAL_VECTORS
51 #define NVIC_MAX_IRQ (NVIC_MAX_VECTORS - NVIC_FIRST_IRQ)
53 /* Effective running priority of the CPU when no exception is active
54 * (higher than the highest possible priority value)
56 #define NVIC_NOEXC_PRIO 0x100
57 /* Maximum priority of non-secure exceptions when AIRCR.PRIS is set */
58 #define NVIC_NS_PRIO_LIMIT 0x80
60 static const uint8_t nvic_id
[] = {
61 0x00, 0xb0, 0x1b, 0x00, 0x0d, 0xe0, 0x05, 0xb1
64 static int nvic_pending_prio(NVICState
*s
)
66 /* return the group priority of the current pending interrupt,
67 * or NVIC_NOEXC_PRIO if no interrupt is pending
69 return s
->vectpending_prio
;
72 /* Return the value of the ISCR RETTOBASE bit:
73 * 1 if there is exactly one active exception
74 * 0 if there is more than one active exception
75 * UNKNOWN if there are no active exceptions (we choose 1,
76 * which matches the choice Cortex-M3 is documented as making).
78 * NB: some versions of the documentation talk about this
79 * counting "active exceptions other than the one shown by IPSR";
80 * this is only different in the obscure corner case where guest
81 * code has manually deactivated an exception and is about
82 * to fail an exception-return integrity check. The definition
83 * above is the one from the v8M ARM ARM and is also in line
84 * with the behaviour documented for the Cortex-M3.
86 static bool nvic_rettobase(NVICState
*s
)
89 bool check_sec
= arm_feature(&s
->cpu
->env
, ARM_FEATURE_M_SECURITY
);
91 for (irq
= ARMV7M_EXCP_RESET
; irq
< s
->num_irq
; irq
++) {
92 if (s
->vectors
[irq
].active
||
93 (check_sec
&& irq
< NVIC_INTERNAL_VECTORS
&&
94 s
->sec_vectors
[irq
].active
)) {
105 /* Return the value of the ISCR ISRPENDING bit:
106 * 1 if an external interrupt is pending
107 * 0 if no external interrupt is pending
109 static bool nvic_isrpending(NVICState
*s
)
113 /* We can shortcut if the highest priority pending interrupt
114 * happens to be external or if there is nothing pending.
116 if (s
->vectpending
> NVIC_FIRST_IRQ
) {
119 if (s
->vectpending
== 0) {
123 for (irq
= NVIC_FIRST_IRQ
; irq
< s
->num_irq
; irq
++) {
124 if (s
->vectors
[irq
].pending
) {
131 static bool exc_is_banked(int exc
)
133 /* Return true if this is one of the limited set of exceptions which
134 * are banked (and thus have state in sec_vectors[])
136 return exc
== ARMV7M_EXCP_HARD
||
137 exc
== ARMV7M_EXCP_MEM
||
138 exc
== ARMV7M_EXCP_USAGE
||
139 exc
== ARMV7M_EXCP_SVC
||
140 exc
== ARMV7M_EXCP_PENDSV
||
141 exc
== ARMV7M_EXCP_SYSTICK
;
144 /* Return a mask word which clears the subpriority bits from
145 * a priority value for an M-profile exception, leaving only
146 * the group priority.
148 static inline uint32_t nvic_gprio_mask(NVICState
*s
, bool secure
)
150 return ~0U << (s
->prigroup
[secure
] + 1);
153 static bool exc_targets_secure(NVICState
*s
, int exc
)
155 /* Return true if this non-banked exception targets Secure state. */
156 if (!arm_feature(&s
->cpu
->env
, ARM_FEATURE_M_SECURITY
)) {
160 if (exc
>= NVIC_FIRST_IRQ
) {
161 return !s
->itns
[exc
];
164 /* Function shouldn't be called for banked exceptions. */
165 assert(!exc_is_banked(exc
));
168 case ARMV7M_EXCP_NMI
:
169 case ARMV7M_EXCP_BUS
:
170 return !(s
->cpu
->env
.v7m
.aircr
& R_V7M_AIRCR_BFHFNMINS_MASK
);
171 case ARMV7M_EXCP_SECURE
:
173 case ARMV7M_EXCP_DEBUG
:
174 /* TODO: controlled by DEMCR.SDME, which we don't yet implement */
177 /* reset, and reserved (unused) low exception numbers.
178 * We'll get called by code that loops through all the exception
179 * numbers, but it doesn't matter what we return here as these
180 * non-existent exceptions will never be pended or active.
186 static int exc_group_prio(NVICState
*s
, int rawprio
, bool targets_secure
)
188 /* Return the group priority for this exception, given its raw
189 * (group-and-subgroup) priority value and whether it is targeting
190 * secure state or not.
195 rawprio
&= nvic_gprio_mask(s
, targets_secure
);
196 /* AIRCR.PRIS causes us to squash all NS priorities into the
197 * lower half of the total range
199 if (!targets_secure
&&
200 (s
->cpu
->env
.v7m
.aircr
& R_V7M_AIRCR_PRIS_MASK
)) {
201 rawprio
= (rawprio
>> 1) + NVIC_NS_PRIO_LIMIT
;
206 /* Recompute vectpending and exception_prio for a CPU which implements
207 * the Security extension
209 static void nvic_recompute_state_secure(NVICState
*s
)
212 int pend_prio
= NVIC_NOEXC_PRIO
;
213 int active_prio
= NVIC_NOEXC_PRIO
;
215 bool pending_is_s_banked
= false;
217 /* R_CQRV: precedence is by:
218 * - lowest group priority; if both the same then
219 * - lowest subpriority; if both the same then
220 * - lowest exception number; if both the same (ie banked) then
221 * - secure exception takes precedence
222 * Compare pseudocode RawExecutionPriority.
223 * Annoyingly, now we have two prigroup values (for S and NS)
224 * we can't do the loop comparison on raw priority values.
226 for (i
= 1; i
< s
->num_irq
; i
++) {
227 for (bank
= M_REG_S
; bank
>= M_REG_NS
; bank
--) {
232 if (bank
== M_REG_S
) {
233 if (!exc_is_banked(i
)) {
236 vec
= &s
->sec_vectors
[i
];
237 targets_secure
= true;
239 vec
= &s
->vectors
[i
];
240 targets_secure
= !exc_is_banked(i
) && exc_targets_secure(s
, i
);
243 prio
= exc_group_prio(s
, vec
->prio
, targets_secure
);
244 if (vec
->enabled
&& vec
->pending
&& prio
< pend_prio
) {
247 pending_is_s_banked
= (bank
== M_REG_S
);
249 if (vec
->active
&& prio
< active_prio
) {
255 s
->vectpending_is_s_banked
= pending_is_s_banked
;
256 s
->vectpending
= pend_irq
;
257 s
->vectpending_prio
= pend_prio
;
258 s
->exception_prio
= active_prio
;
260 trace_nvic_recompute_state_secure(s
->vectpending
,
261 s
->vectpending_is_s_banked
,
266 /* Recompute vectpending and exception_prio */
267 static void nvic_recompute_state(NVICState
*s
)
270 int pend_prio
= NVIC_NOEXC_PRIO
;
271 int active_prio
= NVIC_NOEXC_PRIO
;
274 /* In theory we could write one function that handled both
275 * the "security extension present" and "not present"; however
276 * the security related changes significantly complicate the
277 * recomputation just by themselves and mixing both cases together
278 * would be even worse, so we retain a separate non-secure-only
279 * version for CPUs which don't implement the security extension.
281 if (arm_feature(&s
->cpu
->env
, ARM_FEATURE_M_SECURITY
)) {
282 nvic_recompute_state_secure(s
);
286 for (i
= 1; i
< s
->num_irq
; i
++) {
287 VecInfo
*vec
= &s
->vectors
[i
];
289 if (vec
->enabled
&& vec
->pending
&& vec
->prio
< pend_prio
) {
290 pend_prio
= vec
->prio
;
293 if (vec
->active
&& vec
->prio
< active_prio
) {
294 active_prio
= vec
->prio
;
298 if (active_prio
> 0) {
299 active_prio
&= nvic_gprio_mask(s
, false);
303 pend_prio
&= nvic_gprio_mask(s
, false);
306 s
->vectpending
= pend_irq
;
307 s
->vectpending_prio
= pend_prio
;
308 s
->exception_prio
= active_prio
;
310 trace_nvic_recompute_state(s
->vectpending
,
315 /* Return the current execution priority of the CPU
316 * (equivalent to the pseudocode ExecutionPriority function).
317 * This is a value between -2 (NMI priority) and NVIC_NOEXC_PRIO.
319 static inline int nvic_exec_prio(NVICState
*s
)
321 CPUARMState
*env
= &s
->cpu
->env
;
322 int running
= NVIC_NOEXC_PRIO
;
324 if (env
->v7m
.basepri
[M_REG_NS
] > 0) {
325 running
= exc_group_prio(s
, env
->v7m
.basepri
[M_REG_NS
], M_REG_NS
);
328 if (env
->v7m
.basepri
[M_REG_S
] > 0) {
329 int basepri
= exc_group_prio(s
, env
->v7m
.basepri
[M_REG_S
], M_REG_S
);
330 if (running
> basepri
) {
335 if (env
->v7m
.primask
[M_REG_NS
]) {
336 if (env
->v7m
.aircr
& R_V7M_AIRCR_PRIS_MASK
) {
337 if (running
> NVIC_NS_PRIO_LIMIT
) {
338 running
= NVIC_NS_PRIO_LIMIT
;
345 if (env
->v7m
.primask
[M_REG_S
]) {
349 if (env
->v7m
.faultmask
[M_REG_NS
]) {
350 if (env
->v7m
.aircr
& R_V7M_AIRCR_BFHFNMINS_MASK
) {
353 if (env
->v7m
.aircr
& R_V7M_AIRCR_PRIS_MASK
) {
354 if (running
> NVIC_NS_PRIO_LIMIT
) {
355 running
= NVIC_NS_PRIO_LIMIT
;
363 if (env
->v7m
.faultmask
[M_REG_S
]) {
364 running
= (env
->v7m
.aircr
& R_V7M_AIRCR_BFHFNMINS_MASK
) ? -3 : -1;
367 /* consider priority of active handler */
368 return MIN(running
, s
->exception_prio
);
371 bool armv7m_nvic_neg_prio_requested(void *opaque
, bool secure
)
373 /* Return true if the requested execution priority is negative
374 * for the specified security state, ie that security state
375 * has an active NMI or HardFault or has set its FAULTMASK.
376 * Note that this is not the same as whether the execution
377 * priority is actually negative (for instance AIRCR.PRIS may
378 * mean we don't allow FAULTMASK_NS to actually make the execution
379 * priority negative). Compare pseudocode IsReqExcPriNeg().
381 NVICState
*s
= opaque
;
383 if (s
->cpu
->env
.v7m
.faultmask
[secure
]) {
387 if (secure
? s
->sec_vectors
[ARMV7M_EXCP_HARD
].active
:
388 s
->vectors
[ARMV7M_EXCP_HARD
].active
) {
392 if (s
->vectors
[ARMV7M_EXCP_NMI
].active
&&
393 exc_targets_secure(s
, ARMV7M_EXCP_NMI
) == secure
) {
400 bool armv7m_nvic_can_take_pending_exception(void *opaque
)
402 NVICState
*s
= opaque
;
404 return nvic_exec_prio(s
) > nvic_pending_prio(s
);
407 int armv7m_nvic_raw_execution_priority(void *opaque
)
409 NVICState
*s
= opaque
;
411 return s
->exception_prio
;
414 /* caller must call nvic_irq_update() after this.
415 * secure indicates the bank to use for banked exceptions (we assert if
416 * we are passed secure=true for a non-banked exception).
418 static void set_prio(NVICState
*s
, unsigned irq
, bool secure
, uint8_t prio
)
420 assert(irq
> ARMV7M_EXCP_NMI
); /* only use for configurable prios */
421 assert(irq
< s
->num_irq
);
424 assert(exc_is_banked(irq
));
425 s
->sec_vectors
[irq
].prio
= prio
;
427 s
->vectors
[irq
].prio
= prio
;
430 trace_nvic_set_prio(irq
, secure
, prio
);
433 /* Return the current raw priority register value.
434 * secure indicates the bank to use for banked exceptions (we assert if
435 * we are passed secure=true for a non-banked exception).
437 static int get_prio(NVICState
*s
, unsigned irq
, bool secure
)
439 assert(irq
> ARMV7M_EXCP_NMI
); /* only use for configurable prios */
440 assert(irq
< s
->num_irq
);
443 assert(exc_is_banked(irq
));
444 return s
->sec_vectors
[irq
].prio
;
446 return s
->vectors
[irq
].prio
;
450 /* Recompute state and assert irq line accordingly.
451 * Must be called after changes to:
452 * vec->active, vec->enabled, vec->pending or vec->prio for any vector
455 static void nvic_irq_update(NVICState
*s
)
460 nvic_recompute_state(s
);
461 pend_prio
= nvic_pending_prio(s
);
463 /* Raise NVIC output if this IRQ would be taken, except that we
464 * ignore the effects of the BASEPRI, FAULTMASK and PRIMASK (which
465 * will be checked for in arm_v7m_cpu_exec_interrupt()); changes
466 * to those CPU registers don't cause us to recalculate the NVIC
469 lvl
= (pend_prio
< s
->exception_prio
);
470 trace_nvic_irq_update(s
->vectpending
, pend_prio
, s
->exception_prio
, lvl
);
471 qemu_set_irq(s
->excpout
, lvl
);
475 * armv7m_nvic_clear_pending: mark the specified exception as not pending
477 * @irq: the exception number to mark as not pending
478 * @secure: false for non-banked exceptions or for the nonsecure
479 * version of a banked exception, true for the secure version of a banked
482 * Marks the specified exception as not pending. Note that we will assert()
483 * if @secure is true and @irq does not specify one of the fixed set
484 * of architecturally banked exceptions.
486 static void armv7m_nvic_clear_pending(void *opaque
, int irq
, bool secure
)
488 NVICState
*s
= (NVICState
*)opaque
;
491 assert(irq
> ARMV7M_EXCP_RESET
&& irq
< s
->num_irq
);
494 assert(exc_is_banked(irq
));
495 vec
= &s
->sec_vectors
[irq
];
497 vec
= &s
->vectors
[irq
];
499 trace_nvic_clear_pending(irq
, secure
, vec
->enabled
, vec
->prio
);
506 static void do_armv7m_nvic_set_pending(void *opaque
, int irq
, bool secure
,
509 /* Pend an exception, including possibly escalating it to HardFault.
511 * This function handles both "normal" pending of interrupts and
512 * exceptions, and also derived exceptions (ones which occur as
513 * a result of trying to take some other exception).
515 * If derived == true, the caller guarantees that we are part way through
516 * trying to take an exception (but have not yet called
517 * armv7m_nvic_acknowledge_irq() to make it active), and so:
518 * - s->vectpending is the "original exception" we were trying to take
519 * - irq is the "derived exception"
520 * - nvic_exec_prio(s) gives the priority before exception entry
521 * Here we handle the prioritization logic which the pseudocode puts
522 * in the DerivedLateArrival() function.
525 NVICState
*s
= (NVICState
*)opaque
;
526 bool banked
= exc_is_banked(irq
);
530 assert(irq
> ARMV7M_EXCP_RESET
&& irq
< s
->num_irq
);
531 assert(!secure
|| banked
);
533 vec
= (banked
&& secure
) ? &s
->sec_vectors
[irq
] : &s
->vectors
[irq
];
535 targets_secure
= banked
? secure
: exc_targets_secure(s
, irq
);
537 trace_nvic_set_pending(irq
, secure
, targets_secure
,
538 derived
, vec
->enabled
, vec
->prio
);
541 /* Derived exceptions are always synchronous. */
542 assert(irq
>= ARMV7M_EXCP_HARD
&& irq
< ARMV7M_EXCP_PENDSV
);
544 if (irq
== ARMV7M_EXCP_DEBUG
&&
545 exc_group_prio(s
, vec
->prio
, secure
) >= nvic_exec_prio(s
)) {
546 /* DebugMonitorFault, but its priority is lower than the
547 * preempted exception priority: just ignore it.
552 if (irq
== ARMV7M_EXCP_HARD
&& vec
->prio
>= s
->vectpending_prio
) {
553 /* If this is a terminal exception (one which means we cannot
554 * take the original exception, like a failure to read its
555 * vector table entry), then we must take the derived exception.
556 * If the derived exception can't take priority over the
557 * original exception, then we go into Lockup.
559 * For QEMU, we rely on the fact that a derived exception is
560 * terminal if and only if it's reported to us as HardFault,
561 * which saves having to have an extra argument is_terminal
562 * that we'd only use in one place.
564 cpu_abort(&s
->cpu
->parent_obj
,
565 "Lockup: can't take terminal derived exception "
566 "(original exception priority %d)\n",
567 s
->vectpending_prio
);
569 /* We now continue with the same code as for a normal pending
570 * exception, which will cause us to pend the derived exception.
571 * We'll then take either the original or the derived exception
572 * based on which is higher priority by the usual mechanism
573 * for selecting the highest priority pending interrupt.
577 if (irq
>= ARMV7M_EXCP_HARD
&& irq
< ARMV7M_EXCP_PENDSV
) {
578 /* If a synchronous exception is pending then it may be
579 * escalated to HardFault if:
580 * * it is equal or lower priority to current execution
582 * (ie we need to take it immediately but we can't do so).
583 * Asynchronous exceptions (and interrupts) simply remain pending.
585 * For QEMU, we don't have any imprecise (asynchronous) faults,
586 * so we can assume that PREFETCH_ABORT and DATA_ABORT are always
588 * Debug exceptions are awkward because only Debug exceptions
589 * resulting from the BKPT instruction should be escalated,
590 * but we don't currently implement any Debug exceptions other
591 * than those that result from BKPT, so we treat all debug exceptions
592 * as needing escalation.
594 * This all means we can identify whether to escalate based only on
595 * the exception number and don't (yet) need the caller to explicitly
596 * tell us whether this exception is synchronous or not.
598 int running
= nvic_exec_prio(s
);
599 bool escalate
= false;
601 if (exc_group_prio(s
, vec
->prio
, secure
) >= running
) {
602 trace_nvic_escalate_prio(irq
, vec
->prio
, running
);
604 } else if (!vec
->enabled
) {
605 trace_nvic_escalate_disabled(irq
);
611 /* We need to escalate this exception to a synchronous HardFault.
612 * If BFHFNMINS is set then we escalate to the banked HF for
613 * the target security state of the original exception; otherwise
614 * we take a Secure HardFault.
616 irq
= ARMV7M_EXCP_HARD
;
617 if (arm_feature(&s
->cpu
->env
, ARM_FEATURE_M_SECURITY
) &&
619 !(s
->cpu
->env
.v7m
.aircr
& R_V7M_AIRCR_BFHFNMINS_MASK
))) {
620 vec
= &s
->sec_vectors
[irq
];
622 vec
= &s
->vectors
[irq
];
624 if (running
<= vec
->prio
) {
625 /* We want to escalate to HardFault but we can't take the
626 * synchronous HardFault at this point either. This is a
627 * Lockup condition due to a guest bug. We don't model
628 * Lockup, so report via cpu_abort() instead.
630 cpu_abort(&s
->cpu
->parent_obj
,
631 "Lockup: can't escalate %d to HardFault "
632 "(current priority %d)\n", irq
, running
);
635 /* HF may be banked but there is only one shared HFSR */
636 s
->cpu
->env
.v7m
.hfsr
|= R_V7M_HFSR_FORCED_MASK
;
646 void armv7m_nvic_set_pending(void *opaque
, int irq
, bool secure
)
648 do_armv7m_nvic_set_pending(opaque
, irq
, secure
, false);
651 void armv7m_nvic_set_pending_derived(void *opaque
, int irq
, bool secure
)
653 do_armv7m_nvic_set_pending(opaque
, irq
, secure
, true);
656 /* Make pending IRQ active. */
657 void armv7m_nvic_acknowledge_irq(void *opaque
)
659 NVICState
*s
= (NVICState
*)opaque
;
660 CPUARMState
*env
= &s
->cpu
->env
;
661 const int pending
= s
->vectpending
;
662 const int running
= nvic_exec_prio(s
);
665 assert(pending
> ARMV7M_EXCP_RESET
&& pending
< s
->num_irq
);
667 if (s
->vectpending_is_s_banked
) {
668 vec
= &s
->sec_vectors
[pending
];
670 vec
= &s
->vectors
[pending
];
673 assert(vec
->enabled
);
674 assert(vec
->pending
);
676 assert(s
->vectpending_prio
< running
);
678 trace_nvic_acknowledge_irq(pending
, s
->vectpending_prio
);
683 write_v7m_exception(env
, s
->vectpending
);
688 void armv7m_nvic_get_pending_irq_info(void *opaque
,
689 int *pirq
, bool *ptargets_secure
)
691 NVICState
*s
= (NVICState
*)opaque
;
692 const int pending
= s
->vectpending
;
695 assert(pending
> ARMV7M_EXCP_RESET
&& pending
< s
->num_irq
);
697 if (s
->vectpending_is_s_banked
) {
698 targets_secure
= true;
700 targets_secure
= !exc_is_banked(pending
) &&
701 exc_targets_secure(s
, pending
);
704 trace_nvic_get_pending_irq_info(pending
, targets_secure
);
706 *ptargets_secure
= targets_secure
;
710 int armv7m_nvic_complete_irq(void *opaque
, int irq
, bool secure
)
712 NVICState
*s
= (NVICState
*)opaque
;
716 assert(irq
> ARMV7M_EXCP_RESET
&& irq
< s
->num_irq
);
718 if (secure
&& exc_is_banked(irq
)) {
719 vec
= &s
->sec_vectors
[irq
];
721 vec
= &s
->vectors
[irq
];
724 trace_nvic_complete_irq(irq
, secure
);
727 /* Tell the caller this was an illegal exception return */
731 ret
= nvic_rettobase(s
);
735 /* Re-pend the exception if it's still held high; only
736 * happens for extenal IRQs
738 assert(irq
>= NVIC_FIRST_IRQ
);
747 /* callback when external interrupt line is changed */
748 static void set_irq_level(void *opaque
, int n
, int level
)
750 NVICState
*s
= opaque
;
755 assert(n
>= NVIC_FIRST_IRQ
&& n
< s
->num_irq
);
757 trace_nvic_set_irq_level(n
, level
);
759 /* The pending status of an external interrupt is
760 * latched on rising edge and exception handler return.
762 * Pulsing the IRQ will always run the handler
763 * once, and the handler will re-run until the
764 * level is low when the handler completes.
766 vec
= &s
->vectors
[n
];
767 if (level
!= vec
->level
) {
770 armv7m_nvic_set_pending(s
, n
, false);
775 static uint32_t nvic_readl(NVICState
*s
, uint32_t offset
, MemTxAttrs attrs
)
777 ARMCPU
*cpu
= s
->cpu
;
781 case 4: /* Interrupt Control Type. */
782 return ((s
->num_irq
- NVIC_FIRST_IRQ
) / 32) - 1;
783 case 0xc: /* CPPWR */
784 if (!arm_feature(&cpu
->env
, ARM_FEATURE_V8
)) {
787 /* We make the IMPDEF choice that nothing can ever go into a
788 * non-retentive power state, which allows us to RAZ/WI this.
791 case 0x380 ... 0x3bf: /* NVIC_ITNS<n> */
793 int startvec
= 8 * (offset
- 0x380) + NVIC_FIRST_IRQ
;
796 if (!arm_feature(&cpu
->env
, ARM_FEATURE_V8
)) {
803 for (i
= 0; i
< 32 && startvec
+ i
< s
->num_irq
; i
++) {
804 if (s
->itns
[startvec
+ i
]) {
810 case 0xd00: /* CPUID Base. */
812 case 0xd04: /* Interrupt Control State (ICSR) */
814 val
= cpu
->env
.v7m
.exception
;
816 val
|= (s
->vectpending
& 0xff) << 12;
817 /* ISRPENDING - set if any external IRQ is pending */
818 if (nvic_isrpending(s
)) {
821 /* RETTOBASE - set if only one handler is active */
822 if (nvic_rettobase(s
)) {
827 if (s
->sec_vectors
[ARMV7M_EXCP_SYSTICK
].pending
) {
831 if (s
->sec_vectors
[ARMV7M_EXCP_PENDSV
].pending
) {
836 if (s
->vectors
[ARMV7M_EXCP_SYSTICK
].pending
) {
840 if (s
->vectors
[ARMV7M_EXCP_PENDSV
].pending
) {
845 if ((attrs
.secure
|| (cpu
->env
.v7m
.aircr
& R_V7M_AIRCR_BFHFNMINS_MASK
))
846 && s
->vectors
[ARMV7M_EXCP_NMI
].pending
) {
849 /* ISRPREEMPT: RES0 when halting debug not implemented */
850 /* STTNS: RES0 for the Main Extension */
852 case 0xd08: /* Vector Table Offset. */
853 return cpu
->env
.v7m
.vecbase
[attrs
.secure
];
854 case 0xd0c: /* Application Interrupt/Reset Control (AIRCR) */
855 val
= 0xfa050000 | (s
->prigroup
[attrs
.secure
] << 8);
857 /* s->aircr stores PRIS, BFHFNMINS, SYSRESETREQS */
858 val
|= cpu
->env
.v7m
.aircr
;
860 if (arm_feature(&cpu
->env
, ARM_FEATURE_V8
)) {
861 /* BFHFNMINS is R/O from NS; other bits are RAZ/WI. If
862 * security isn't supported then BFHFNMINS is RAO (and
863 * the bit in env.v7m.aircr is always set).
865 val
|= cpu
->env
.v7m
.aircr
& R_V7M_AIRCR_BFHFNMINS_MASK
;
869 case 0xd10: /* System Control. */
870 if (!arm_feature(&cpu
->env
, ARM_FEATURE_V7
)) {
873 return cpu
->env
.v7m
.scr
[attrs
.secure
];
874 case 0xd14: /* Configuration Control. */
875 /* The BFHFNMIGN bit is the only non-banked bit; we
876 * keep it in the non-secure copy of the register.
878 val
= cpu
->env
.v7m
.ccr
[attrs
.secure
];
879 val
|= cpu
->env
.v7m
.ccr
[M_REG_NS
] & R_V7M_CCR_BFHFNMIGN_MASK
;
881 case 0xd24: /* System Handler Control and State (SHCSR) */
882 if (!arm_feature(&cpu
->env
, ARM_FEATURE_V7
)) {
887 if (s
->sec_vectors
[ARMV7M_EXCP_MEM
].active
) {
890 if (s
->sec_vectors
[ARMV7M_EXCP_HARD
].active
) {
893 if (s
->sec_vectors
[ARMV7M_EXCP_USAGE
].active
) {
896 if (s
->sec_vectors
[ARMV7M_EXCP_SVC
].active
) {
899 if (s
->sec_vectors
[ARMV7M_EXCP_PENDSV
].active
) {
902 if (s
->sec_vectors
[ARMV7M_EXCP_SYSTICK
].active
) {
905 if (s
->sec_vectors
[ARMV7M_EXCP_USAGE
].pending
) {
908 if (s
->sec_vectors
[ARMV7M_EXCP_MEM
].pending
) {
911 if (s
->sec_vectors
[ARMV7M_EXCP_SVC
].pending
) {
914 if (s
->sec_vectors
[ARMV7M_EXCP_MEM
].enabled
) {
917 if (s
->sec_vectors
[ARMV7M_EXCP_USAGE
].enabled
) {
920 if (s
->sec_vectors
[ARMV7M_EXCP_HARD
].pending
) {
923 /* SecureFault is not banked but is always RAZ/WI to NS */
924 if (s
->vectors
[ARMV7M_EXCP_SECURE
].active
) {
927 if (s
->vectors
[ARMV7M_EXCP_SECURE
].enabled
) {
930 if (s
->vectors
[ARMV7M_EXCP_SECURE
].pending
) {
934 if (s
->vectors
[ARMV7M_EXCP_MEM
].active
) {
937 if (arm_feature(&cpu
->env
, ARM_FEATURE_V8
)) {
938 /* HARDFAULTACT, HARDFAULTPENDED not present in v7M */
939 if (s
->vectors
[ARMV7M_EXCP_HARD
].active
) {
942 if (s
->vectors
[ARMV7M_EXCP_HARD
].pending
) {
946 if (s
->vectors
[ARMV7M_EXCP_USAGE
].active
) {
949 if (s
->vectors
[ARMV7M_EXCP_SVC
].active
) {
952 if (s
->vectors
[ARMV7M_EXCP_PENDSV
].active
) {
955 if (s
->vectors
[ARMV7M_EXCP_SYSTICK
].active
) {
958 if (s
->vectors
[ARMV7M_EXCP_USAGE
].pending
) {
961 if (s
->vectors
[ARMV7M_EXCP_MEM
].pending
) {
964 if (s
->vectors
[ARMV7M_EXCP_SVC
].pending
) {
967 if (s
->vectors
[ARMV7M_EXCP_MEM
].enabled
) {
970 if (s
->vectors
[ARMV7M_EXCP_USAGE
].enabled
) {
974 if (attrs
.secure
|| (cpu
->env
.v7m
.aircr
& R_V7M_AIRCR_BFHFNMINS_MASK
)) {
975 if (s
->vectors
[ARMV7M_EXCP_BUS
].active
) {
978 if (s
->vectors
[ARMV7M_EXCP_BUS
].pending
) {
981 if (s
->vectors
[ARMV7M_EXCP_BUS
].enabled
) {
984 if (arm_feature(&cpu
->env
, ARM_FEATURE_V8
) &&
985 s
->vectors
[ARMV7M_EXCP_NMI
].active
) {
986 /* NMIACT is not present in v7M */
991 /* TODO: this is RAZ/WI from NS if DEMCR.SDME is set */
992 if (s
->vectors
[ARMV7M_EXCP_DEBUG
].active
) {
996 case 0xd2c: /* Hard Fault Status. */
997 if (!arm_feature(&cpu
->env
, ARM_FEATURE_M_MAIN
)) {
1000 return cpu
->env
.v7m
.hfsr
;
1001 case 0xd30: /* Debug Fault Status. */
1002 return cpu
->env
.v7m
.dfsr
;
1003 case 0xd34: /* MMFAR MemManage Fault Address */
1004 if (!arm_feature(&cpu
->env
, ARM_FEATURE_M_MAIN
)) {
1007 return cpu
->env
.v7m
.mmfar
[attrs
.secure
];
1008 case 0xd38: /* Bus Fault Address. */
1009 if (!arm_feature(&cpu
->env
, ARM_FEATURE_M_MAIN
)) {
1012 return cpu
->env
.v7m
.bfar
;
1013 case 0xd3c: /* Aux Fault Status. */
1014 /* TODO: Implement fault status registers. */
1015 qemu_log_mask(LOG_UNIMP
,
1016 "Aux Fault status registers unimplemented\n");
1018 case 0xd40: /* PFR0. */
1019 return cpu
->id_pfr0
;
1020 case 0xd44: /* PFR1. */
1021 return cpu
->id_pfr1
;
1022 case 0xd48: /* DFR0. */
1023 return cpu
->id_dfr0
;
1024 case 0xd4c: /* AFR0. */
1025 return cpu
->id_afr0
;
1026 case 0xd50: /* MMFR0. */
1027 return cpu
->id_mmfr0
;
1028 case 0xd54: /* MMFR1. */
1029 return cpu
->id_mmfr1
;
1030 case 0xd58: /* MMFR2. */
1031 return cpu
->id_mmfr2
;
1032 case 0xd5c: /* MMFR3. */
1033 return cpu
->id_mmfr3
;
1034 case 0xd60: /* ISAR0. */
1035 return cpu
->id_isar0
;
1036 case 0xd64: /* ISAR1. */
1037 return cpu
->id_isar1
;
1038 case 0xd68: /* ISAR2. */
1039 return cpu
->id_isar2
;
1040 case 0xd6c: /* ISAR3. */
1041 return cpu
->id_isar3
;
1042 case 0xd70: /* ISAR4. */
1043 return cpu
->id_isar4
;
1044 case 0xd74: /* ISAR5. */
1045 return cpu
->id_isar5
;
1046 case 0xd78: /* CLIDR */
1048 case 0xd7c: /* CTR */
1050 case 0xd80: /* CSSIDR */
1052 int idx
= cpu
->env
.v7m
.csselr
[attrs
.secure
] & R_V7M_CSSELR_INDEX_MASK
;
1053 return cpu
->ccsidr
[idx
];
1055 case 0xd84: /* CSSELR */
1056 return cpu
->env
.v7m
.csselr
[attrs
.secure
];
1057 /* TODO: Implement debug registers. */
1058 case 0xd90: /* MPU_TYPE */
1059 /* Unified MPU; if the MPU is not present this value is zero */
1060 return cpu
->pmsav7_dregion
<< 8;
1062 case 0xd94: /* MPU_CTRL */
1063 return cpu
->env
.v7m
.mpu_ctrl
[attrs
.secure
];
1064 case 0xd98: /* MPU_RNR */
1065 return cpu
->env
.pmsav7
.rnr
[attrs
.secure
];
1066 case 0xd9c: /* MPU_RBAR */
1067 case 0xda4: /* MPU_RBAR_A1 */
1068 case 0xdac: /* MPU_RBAR_A2 */
1069 case 0xdb4: /* MPU_RBAR_A3 */
1071 int region
= cpu
->env
.pmsav7
.rnr
[attrs
.secure
];
1073 if (arm_feature(&cpu
->env
, ARM_FEATURE_V8
)) {
1074 /* PMSAv8M handling of the aliases is different from v7M:
1075 * aliases A1, A2, A3 override the low two bits of the region
1076 * number in MPU_RNR, and there is no 'region' field in the
1079 int aliasno
= (offset
- 0xd9c) / 8; /* 0..3 */
1081 region
= deposit32(region
, 0, 2, aliasno
);
1083 if (region
>= cpu
->pmsav7_dregion
) {
1086 return cpu
->env
.pmsav8
.rbar
[attrs
.secure
][region
];
1089 if (region
>= cpu
->pmsav7_dregion
) {
1092 return (cpu
->env
.pmsav7
.drbar
[region
] & ~0x1f) | (region
& 0xf);
1094 case 0xda0: /* MPU_RASR (v7M), MPU_RLAR (v8M) */
1095 case 0xda8: /* MPU_RASR_A1 (v7M), MPU_RLAR_A1 (v8M) */
1096 case 0xdb0: /* MPU_RASR_A2 (v7M), MPU_RLAR_A2 (v8M) */
1097 case 0xdb8: /* MPU_RASR_A3 (v7M), MPU_RLAR_A3 (v8M) */
1099 int region
= cpu
->env
.pmsav7
.rnr
[attrs
.secure
];
1101 if (arm_feature(&cpu
->env
, ARM_FEATURE_V8
)) {
1102 /* PMSAv8M handling of the aliases is different from v7M:
1103 * aliases A1, A2, A3 override the low two bits of the region
1104 * number in MPU_RNR.
1106 int aliasno
= (offset
- 0xda0) / 8; /* 0..3 */
1108 region
= deposit32(region
, 0, 2, aliasno
);
1110 if (region
>= cpu
->pmsav7_dregion
) {
1113 return cpu
->env
.pmsav8
.rlar
[attrs
.secure
][region
];
1116 if (region
>= cpu
->pmsav7_dregion
) {
1119 return ((cpu
->env
.pmsav7
.dracr
[region
] & 0xffff) << 16) |
1120 (cpu
->env
.pmsav7
.drsr
[region
] & 0xffff);
1122 case 0xdc0: /* MPU_MAIR0 */
1123 if (!arm_feature(&cpu
->env
, ARM_FEATURE_V8
)) {
1126 return cpu
->env
.pmsav8
.mair0
[attrs
.secure
];
1127 case 0xdc4: /* MPU_MAIR1 */
1128 if (!arm_feature(&cpu
->env
, ARM_FEATURE_V8
)) {
1131 return cpu
->env
.pmsav8
.mair1
[attrs
.secure
];
1132 case 0xdd0: /* SAU_CTRL */
1133 if (!arm_feature(&cpu
->env
, ARM_FEATURE_V8
)) {
1136 if (!attrs
.secure
) {
1139 return cpu
->env
.sau
.ctrl
;
1140 case 0xdd4: /* SAU_TYPE */
1141 if (!arm_feature(&cpu
->env
, ARM_FEATURE_V8
)) {
1144 if (!attrs
.secure
) {
1147 return cpu
->sau_sregion
;
1148 case 0xdd8: /* SAU_RNR */
1149 if (!arm_feature(&cpu
->env
, ARM_FEATURE_V8
)) {
1152 if (!attrs
.secure
) {
1155 return cpu
->env
.sau
.rnr
;
1156 case 0xddc: /* SAU_RBAR */
1158 int region
= cpu
->env
.sau
.rnr
;
1160 if (!arm_feature(&cpu
->env
, ARM_FEATURE_V8
)) {
1163 if (!attrs
.secure
) {
1166 if (region
>= cpu
->sau_sregion
) {
1169 return cpu
->env
.sau
.rbar
[region
];
1171 case 0xde0: /* SAU_RLAR */
1173 int region
= cpu
->env
.sau
.rnr
;
1175 if (!arm_feature(&cpu
->env
, ARM_FEATURE_V8
)) {
1178 if (!attrs
.secure
) {
1181 if (region
>= cpu
->sau_sregion
) {
1184 return cpu
->env
.sau
.rlar
[region
];
1186 case 0xde4: /* SFSR */
1187 if (!arm_feature(&cpu
->env
, ARM_FEATURE_V8
)) {
1190 if (!attrs
.secure
) {
1193 return cpu
->env
.v7m
.sfsr
;
1194 case 0xde8: /* SFAR */
1195 if (!arm_feature(&cpu
->env
, ARM_FEATURE_V8
)) {
1198 if (!attrs
.secure
) {
1201 return cpu
->env
.v7m
.sfar
;
1204 qemu_log_mask(LOG_GUEST_ERROR
, "NVIC: Bad read offset 0x%x\n", offset
);
1209 static void nvic_writel(NVICState
*s
, uint32_t offset
, uint32_t value
,
1212 ARMCPU
*cpu
= s
->cpu
;
1215 case 0xc: /* CPPWR */
1216 if (!arm_feature(&cpu
->env
, ARM_FEATURE_V8
)) {
1219 /* Make the IMPDEF choice to RAZ/WI this. */
1221 case 0x380 ... 0x3bf: /* NVIC_ITNS<n> */
1223 int startvec
= 8 * (offset
- 0x380) + NVIC_FIRST_IRQ
;
1226 if (!arm_feature(&cpu
->env
, ARM_FEATURE_V8
)) {
1229 if (!attrs
.secure
) {
1232 for (i
= 0; i
< 32 && startvec
+ i
< s
->num_irq
; i
++) {
1233 s
->itns
[startvec
+ i
] = (value
>> i
) & 1;
1238 case 0xd04: /* Interrupt Control State (ICSR) */
1239 if (attrs
.secure
|| cpu
->env
.v7m
.aircr
& R_V7M_AIRCR_BFHFNMINS_MASK
) {
1240 if (value
& (1 << 31)) {
1241 armv7m_nvic_set_pending(s
, ARMV7M_EXCP_NMI
, false);
1242 } else if (value
& (1 << 30) &&
1243 arm_feature(&cpu
->env
, ARM_FEATURE_V8
)) {
1244 /* PENDNMICLR didn't exist in v7M */
1245 armv7m_nvic_clear_pending(s
, ARMV7M_EXCP_NMI
, false);
1248 if (value
& (1 << 28)) {
1249 armv7m_nvic_set_pending(s
, ARMV7M_EXCP_PENDSV
, attrs
.secure
);
1250 } else if (value
& (1 << 27)) {
1251 armv7m_nvic_clear_pending(s
, ARMV7M_EXCP_PENDSV
, attrs
.secure
);
1253 if (value
& (1 << 26)) {
1254 armv7m_nvic_set_pending(s
, ARMV7M_EXCP_SYSTICK
, attrs
.secure
);
1255 } else if (value
& (1 << 25)) {
1256 armv7m_nvic_clear_pending(s
, ARMV7M_EXCP_SYSTICK
, attrs
.secure
);
1259 case 0xd08: /* Vector Table Offset. */
1260 cpu
->env
.v7m
.vecbase
[attrs
.secure
] = value
& 0xffffff80;
1262 case 0xd0c: /* Application Interrupt/Reset Control (AIRCR) */
1263 if ((value
>> R_V7M_AIRCR_VECTKEY_SHIFT
) == 0x05fa) {
1264 if (value
& R_V7M_AIRCR_SYSRESETREQ_MASK
) {
1266 !(cpu
->env
.v7m
.aircr
& R_V7M_AIRCR_SYSRESETREQS_MASK
)) {
1267 qemu_irq_pulse(s
->sysresetreq
);
1270 if (value
& R_V7M_AIRCR_VECTCLRACTIVE_MASK
) {
1271 qemu_log_mask(LOG_GUEST_ERROR
,
1272 "Setting VECTCLRACTIVE when not in DEBUG mode "
1273 "is UNPREDICTABLE\n");
1275 if (value
& R_V7M_AIRCR_VECTRESET_MASK
) {
1276 /* NB: this bit is RES0 in v8M */
1277 qemu_log_mask(LOG_GUEST_ERROR
,
1278 "Setting VECTRESET when not in DEBUG mode "
1279 "is UNPREDICTABLE\n");
1281 s
->prigroup
[attrs
.secure
] = extract32(value
,
1282 R_V7M_AIRCR_PRIGROUP_SHIFT
,
1283 R_V7M_AIRCR_PRIGROUP_LENGTH
);
1285 /* These bits are only writable by secure */
1286 cpu
->env
.v7m
.aircr
= value
&
1287 (R_V7M_AIRCR_SYSRESETREQS_MASK
|
1288 R_V7M_AIRCR_BFHFNMINS_MASK
|
1289 R_V7M_AIRCR_PRIS_MASK
);
1290 /* BFHFNMINS changes the priority of Secure HardFault, and
1291 * allows a pending Non-secure HardFault to preempt (which
1292 * we implement by marking it enabled).
1294 if (cpu
->env
.v7m
.aircr
& R_V7M_AIRCR_BFHFNMINS_MASK
) {
1295 s
->sec_vectors
[ARMV7M_EXCP_HARD
].prio
= -3;
1296 s
->vectors
[ARMV7M_EXCP_HARD
].enabled
= 1;
1298 s
->sec_vectors
[ARMV7M_EXCP_HARD
].prio
= -1;
1299 s
->vectors
[ARMV7M_EXCP_HARD
].enabled
= 0;
1305 case 0xd10: /* System Control. */
1306 if (!arm_feature(&cpu
->env
, ARM_FEATURE_V7
)) {
1309 /* We don't implement deep-sleep so these bits are RAZ/WI.
1310 * The other bits in the register are banked.
1311 * QEMU's implementation ignores SEVONPEND and SLEEPONEXIT, which
1312 * is architecturally permitted.
1314 value
&= ~(R_V7M_SCR_SLEEPDEEP_MASK
| R_V7M_SCR_SLEEPDEEPS_MASK
);
1315 cpu
->env
.v7m
.scr
[attrs
.secure
] = value
;
1317 case 0xd14: /* Configuration Control. */
1318 if (!arm_feature(&cpu
->env
, ARM_FEATURE_M_MAIN
)) {
1322 /* Enforce RAZ/WI on reserved and must-RAZ/WI bits */
1323 value
&= (R_V7M_CCR_STKALIGN_MASK
|
1324 R_V7M_CCR_BFHFNMIGN_MASK
|
1325 R_V7M_CCR_DIV_0_TRP_MASK
|
1326 R_V7M_CCR_UNALIGN_TRP_MASK
|
1327 R_V7M_CCR_USERSETMPEND_MASK
|
1328 R_V7M_CCR_NONBASETHRDENA_MASK
);
1330 if (arm_feature(&cpu
->env
, ARM_FEATURE_V8
)) {
1331 /* v8M makes NONBASETHRDENA and STKALIGN be RES1 */
1332 value
|= R_V7M_CCR_NONBASETHRDENA_MASK
1333 | R_V7M_CCR_STKALIGN_MASK
;
1336 /* the BFHFNMIGN bit is not banked; keep that in the NS copy */
1337 cpu
->env
.v7m
.ccr
[M_REG_NS
] =
1338 (cpu
->env
.v7m
.ccr
[M_REG_NS
] & ~R_V7M_CCR_BFHFNMIGN_MASK
)
1339 | (value
& R_V7M_CCR_BFHFNMIGN_MASK
);
1340 value
&= ~R_V7M_CCR_BFHFNMIGN_MASK
;
1343 cpu
->env
.v7m
.ccr
[attrs
.secure
] = value
;
1345 case 0xd24: /* System Handler Control and State (SHCSR) */
1346 if (!arm_feature(&cpu
->env
, ARM_FEATURE_V7
)) {
1350 s
->sec_vectors
[ARMV7M_EXCP_MEM
].active
= (value
& (1 << 0)) != 0;
1351 /* Secure HardFault active bit cannot be written */
1352 s
->sec_vectors
[ARMV7M_EXCP_USAGE
].active
= (value
& (1 << 3)) != 0;
1353 s
->sec_vectors
[ARMV7M_EXCP_SVC
].active
= (value
& (1 << 7)) != 0;
1354 s
->sec_vectors
[ARMV7M_EXCP_PENDSV
].active
=
1355 (value
& (1 << 10)) != 0;
1356 s
->sec_vectors
[ARMV7M_EXCP_SYSTICK
].active
=
1357 (value
& (1 << 11)) != 0;
1358 s
->sec_vectors
[ARMV7M_EXCP_USAGE
].pending
=
1359 (value
& (1 << 12)) != 0;
1360 s
->sec_vectors
[ARMV7M_EXCP_MEM
].pending
= (value
& (1 << 13)) != 0;
1361 s
->sec_vectors
[ARMV7M_EXCP_SVC
].pending
= (value
& (1 << 15)) != 0;
1362 s
->sec_vectors
[ARMV7M_EXCP_MEM
].enabled
= (value
& (1 << 16)) != 0;
1363 s
->sec_vectors
[ARMV7M_EXCP_BUS
].enabled
= (value
& (1 << 17)) != 0;
1364 s
->sec_vectors
[ARMV7M_EXCP_USAGE
].enabled
=
1365 (value
& (1 << 18)) != 0;
1366 s
->sec_vectors
[ARMV7M_EXCP_HARD
].pending
= (value
& (1 << 21)) != 0;
1367 /* SecureFault not banked, but RAZ/WI to NS */
1368 s
->vectors
[ARMV7M_EXCP_SECURE
].active
= (value
& (1 << 4)) != 0;
1369 s
->vectors
[ARMV7M_EXCP_SECURE
].enabled
= (value
& (1 << 19)) != 0;
1370 s
->vectors
[ARMV7M_EXCP_SECURE
].pending
= (value
& (1 << 20)) != 0;
1372 s
->vectors
[ARMV7M_EXCP_MEM
].active
= (value
& (1 << 0)) != 0;
1373 if (arm_feature(&cpu
->env
, ARM_FEATURE_V8
)) {
1374 /* HARDFAULTPENDED is not present in v7M */
1375 s
->vectors
[ARMV7M_EXCP_HARD
].pending
= (value
& (1 << 21)) != 0;
1377 s
->vectors
[ARMV7M_EXCP_USAGE
].active
= (value
& (1 << 3)) != 0;
1378 s
->vectors
[ARMV7M_EXCP_SVC
].active
= (value
& (1 << 7)) != 0;
1379 s
->vectors
[ARMV7M_EXCP_PENDSV
].active
= (value
& (1 << 10)) != 0;
1380 s
->vectors
[ARMV7M_EXCP_SYSTICK
].active
= (value
& (1 << 11)) != 0;
1381 s
->vectors
[ARMV7M_EXCP_USAGE
].pending
= (value
& (1 << 12)) != 0;
1382 s
->vectors
[ARMV7M_EXCP_MEM
].pending
= (value
& (1 << 13)) != 0;
1383 s
->vectors
[ARMV7M_EXCP_SVC
].pending
= (value
& (1 << 15)) != 0;
1384 s
->vectors
[ARMV7M_EXCP_MEM
].enabled
= (value
& (1 << 16)) != 0;
1385 s
->vectors
[ARMV7M_EXCP_USAGE
].enabled
= (value
& (1 << 18)) != 0;
1387 if (attrs
.secure
|| (cpu
->env
.v7m
.aircr
& R_V7M_AIRCR_BFHFNMINS_MASK
)) {
1388 s
->vectors
[ARMV7M_EXCP_BUS
].active
= (value
& (1 << 1)) != 0;
1389 s
->vectors
[ARMV7M_EXCP_BUS
].pending
= (value
& (1 << 14)) != 0;
1390 s
->vectors
[ARMV7M_EXCP_BUS
].enabled
= (value
& (1 << 17)) != 0;
1392 /* NMIACT can only be written if the write is of a zero, with
1393 * BFHFNMINS 1, and by the CPU in secure state via the NS alias.
1395 if (!attrs
.secure
&& cpu
->env
.v7m
.secure
&&
1396 (cpu
->env
.v7m
.aircr
& R_V7M_AIRCR_BFHFNMINS_MASK
) &&
1397 (value
& (1 << 5)) == 0) {
1398 s
->vectors
[ARMV7M_EXCP_NMI
].active
= 0;
1400 /* HARDFAULTACT can only be written if the write is of a zero
1401 * to the non-secure HardFault state by the CPU in secure state.
1402 * The only case where we can be targeting the non-secure HF state
1403 * when in secure state is if this is a write via the NS alias
1404 * and BFHFNMINS is 1.
1406 if (!attrs
.secure
&& cpu
->env
.v7m
.secure
&&
1407 (cpu
->env
.v7m
.aircr
& R_V7M_AIRCR_BFHFNMINS_MASK
) &&
1408 (value
& (1 << 2)) == 0) {
1409 s
->vectors
[ARMV7M_EXCP_HARD
].active
= 0;
1412 /* TODO: this is RAZ/WI from NS if DEMCR.SDME is set */
1413 s
->vectors
[ARMV7M_EXCP_DEBUG
].active
= (value
& (1 << 8)) != 0;
1416 case 0xd2c: /* Hard Fault Status. */
1417 if (!arm_feature(&cpu
->env
, ARM_FEATURE_M_MAIN
)) {
1420 cpu
->env
.v7m
.hfsr
&= ~value
; /* W1C */
1422 case 0xd30: /* Debug Fault Status. */
1423 cpu
->env
.v7m
.dfsr
&= ~value
; /* W1C */
1425 case 0xd34: /* Mem Manage Address. */
1426 if (!arm_feature(&cpu
->env
, ARM_FEATURE_M_MAIN
)) {
1429 cpu
->env
.v7m
.mmfar
[attrs
.secure
] = value
;
1431 case 0xd38: /* Bus Fault Address. */
1432 if (!arm_feature(&cpu
->env
, ARM_FEATURE_M_MAIN
)) {
1435 cpu
->env
.v7m
.bfar
= value
;
1437 case 0xd3c: /* Aux Fault Status. */
1438 qemu_log_mask(LOG_UNIMP
,
1439 "NVIC: Aux fault status registers unimplemented\n");
1441 case 0xd84: /* CSSELR */
1442 if (!arm_v7m_csselr_razwi(cpu
)) {
1443 cpu
->env
.v7m
.csselr
[attrs
.secure
] = value
& R_V7M_CSSELR_INDEX_MASK
;
1446 case 0xd90: /* MPU_TYPE */
1448 case 0xd94: /* MPU_CTRL */
1450 (R_V7M_MPU_CTRL_HFNMIENA_MASK
| R_V7M_MPU_CTRL_ENABLE_MASK
))
1451 == R_V7M_MPU_CTRL_HFNMIENA_MASK
) {
1452 qemu_log_mask(LOG_GUEST_ERROR
, "MPU_CTRL: HFNMIENA and !ENABLE is "
1455 cpu
->env
.v7m
.mpu_ctrl
[attrs
.secure
]
1456 = value
& (R_V7M_MPU_CTRL_ENABLE_MASK
|
1457 R_V7M_MPU_CTRL_HFNMIENA_MASK
|
1458 R_V7M_MPU_CTRL_PRIVDEFENA_MASK
);
1459 tlb_flush(CPU(cpu
));
1461 case 0xd98: /* MPU_RNR */
1462 if (value
>= cpu
->pmsav7_dregion
) {
1463 qemu_log_mask(LOG_GUEST_ERROR
, "MPU region out of range %"
1464 PRIu32
"/%" PRIu32
"\n",
1465 value
, cpu
->pmsav7_dregion
);
1467 cpu
->env
.pmsav7
.rnr
[attrs
.secure
] = value
;
1470 case 0xd9c: /* MPU_RBAR */
1471 case 0xda4: /* MPU_RBAR_A1 */
1472 case 0xdac: /* MPU_RBAR_A2 */
1473 case 0xdb4: /* MPU_RBAR_A3 */
1477 if (arm_feature(&cpu
->env
, ARM_FEATURE_V8
)) {
1478 /* PMSAv8M handling of the aliases is different from v7M:
1479 * aliases A1, A2, A3 override the low two bits of the region
1480 * number in MPU_RNR, and there is no 'region' field in the
1483 int aliasno
= (offset
- 0xd9c) / 8; /* 0..3 */
1485 region
= cpu
->env
.pmsav7
.rnr
[attrs
.secure
];
1487 region
= deposit32(region
, 0, 2, aliasno
);
1489 if (region
>= cpu
->pmsav7_dregion
) {
1492 cpu
->env
.pmsav8
.rbar
[attrs
.secure
][region
] = value
;
1493 tlb_flush(CPU(cpu
));
1497 if (value
& (1 << 4)) {
1498 /* VALID bit means use the region number specified in this
1499 * value and also update MPU_RNR.REGION with that value.
1501 region
= extract32(value
, 0, 4);
1502 if (region
>= cpu
->pmsav7_dregion
) {
1503 qemu_log_mask(LOG_GUEST_ERROR
,
1504 "MPU region out of range %u/%" PRIu32
"\n",
1505 region
, cpu
->pmsav7_dregion
);
1508 cpu
->env
.pmsav7
.rnr
[attrs
.secure
] = region
;
1510 region
= cpu
->env
.pmsav7
.rnr
[attrs
.secure
];
1513 if (region
>= cpu
->pmsav7_dregion
) {
1517 cpu
->env
.pmsav7
.drbar
[region
] = value
& ~0x1f;
1518 tlb_flush(CPU(cpu
));
1521 case 0xda0: /* MPU_RASR (v7M), MPU_RLAR (v8M) */
1522 case 0xda8: /* MPU_RASR_A1 (v7M), MPU_RLAR_A1 (v8M) */
1523 case 0xdb0: /* MPU_RASR_A2 (v7M), MPU_RLAR_A2 (v8M) */
1524 case 0xdb8: /* MPU_RASR_A3 (v7M), MPU_RLAR_A3 (v8M) */
1526 int region
= cpu
->env
.pmsav7
.rnr
[attrs
.secure
];
1528 if (arm_feature(&cpu
->env
, ARM_FEATURE_V8
)) {
1529 /* PMSAv8M handling of the aliases is different from v7M:
1530 * aliases A1, A2, A3 override the low two bits of the region
1531 * number in MPU_RNR.
1533 int aliasno
= (offset
- 0xd9c) / 8; /* 0..3 */
1535 region
= cpu
->env
.pmsav7
.rnr
[attrs
.secure
];
1537 region
= deposit32(region
, 0, 2, aliasno
);
1539 if (region
>= cpu
->pmsav7_dregion
) {
1542 cpu
->env
.pmsav8
.rlar
[attrs
.secure
][region
] = value
;
1543 tlb_flush(CPU(cpu
));
1547 if (region
>= cpu
->pmsav7_dregion
) {
1551 cpu
->env
.pmsav7
.drsr
[region
] = value
& 0xff3f;
1552 cpu
->env
.pmsav7
.dracr
[region
] = (value
>> 16) & 0x173f;
1553 tlb_flush(CPU(cpu
));
1556 case 0xdc0: /* MPU_MAIR0 */
1557 if (!arm_feature(&cpu
->env
, ARM_FEATURE_V8
)) {
1560 if (cpu
->pmsav7_dregion
) {
1561 /* Register is RES0 if no MPU regions are implemented */
1562 cpu
->env
.pmsav8
.mair0
[attrs
.secure
] = value
;
1564 /* We don't need to do anything else because memory attributes
1565 * only affect cacheability, and we don't implement caching.
1568 case 0xdc4: /* MPU_MAIR1 */
1569 if (!arm_feature(&cpu
->env
, ARM_FEATURE_V8
)) {
1572 if (cpu
->pmsav7_dregion
) {
1573 /* Register is RES0 if no MPU regions are implemented */
1574 cpu
->env
.pmsav8
.mair1
[attrs
.secure
] = value
;
1576 /* We don't need to do anything else because memory attributes
1577 * only affect cacheability, and we don't implement caching.
1580 case 0xdd0: /* SAU_CTRL */
1581 if (!arm_feature(&cpu
->env
, ARM_FEATURE_V8
)) {
1584 if (!attrs
.secure
) {
1587 cpu
->env
.sau
.ctrl
= value
& 3;
1589 case 0xdd4: /* SAU_TYPE */
1590 if (!arm_feature(&cpu
->env
, ARM_FEATURE_V8
)) {
1594 case 0xdd8: /* SAU_RNR */
1595 if (!arm_feature(&cpu
->env
, ARM_FEATURE_V8
)) {
1598 if (!attrs
.secure
) {
1601 if (value
>= cpu
->sau_sregion
) {
1602 qemu_log_mask(LOG_GUEST_ERROR
, "SAU region out of range %"
1603 PRIu32
"/%" PRIu32
"\n",
1604 value
, cpu
->sau_sregion
);
1606 cpu
->env
.sau
.rnr
= value
;
1609 case 0xddc: /* SAU_RBAR */
1611 int region
= cpu
->env
.sau
.rnr
;
1613 if (!arm_feature(&cpu
->env
, ARM_FEATURE_V8
)) {
1616 if (!attrs
.secure
) {
1619 if (region
>= cpu
->sau_sregion
) {
1622 cpu
->env
.sau
.rbar
[region
] = value
& ~0x1f;
1623 tlb_flush(CPU(cpu
));
1626 case 0xde0: /* SAU_RLAR */
1628 int region
= cpu
->env
.sau
.rnr
;
1630 if (!arm_feature(&cpu
->env
, ARM_FEATURE_V8
)) {
1633 if (!attrs
.secure
) {
1636 if (region
>= cpu
->sau_sregion
) {
1639 cpu
->env
.sau
.rlar
[region
] = value
& ~0x1c;
1640 tlb_flush(CPU(cpu
));
1643 case 0xde4: /* SFSR */
1644 if (!arm_feature(&cpu
->env
, ARM_FEATURE_V8
)) {
1647 if (!attrs
.secure
) {
1650 cpu
->env
.v7m
.sfsr
&= ~value
; /* W1C */
1652 case 0xde8: /* SFAR */
1653 if (!arm_feature(&cpu
->env
, ARM_FEATURE_V8
)) {
1656 if (!attrs
.secure
) {
1659 cpu
->env
.v7m
.sfsr
= value
;
1661 case 0xf00: /* Software Triggered Interrupt Register */
1663 int excnum
= (value
& 0x1ff) + NVIC_FIRST_IRQ
;
1665 if (!arm_feature(&cpu
->env
, ARM_FEATURE_M_MAIN
)) {
1669 if (excnum
< s
->num_irq
) {
1670 armv7m_nvic_set_pending(s
, excnum
, false);
1674 case 0xf50: /* ICIALLU */
1675 case 0xf58: /* ICIMVAU */
1676 case 0xf5c: /* DCIMVAC */
1677 case 0xf60: /* DCISW */
1678 case 0xf64: /* DCCMVAU */
1679 case 0xf68: /* DCCMVAC */
1680 case 0xf6c: /* DCCSW */
1681 case 0xf70: /* DCCIMVAC */
1682 case 0xf74: /* DCCISW */
1683 case 0xf78: /* BPIALL */
1684 /* Cache and branch predictor maintenance: for QEMU these always NOP */
1688 qemu_log_mask(LOG_GUEST_ERROR
,
1689 "NVIC: Bad write offset 0x%x\n", offset
);
1693 static bool nvic_user_access_ok(NVICState
*s
, hwaddr offset
, MemTxAttrs attrs
)
1695 /* Return true if unprivileged access to this register is permitted. */
1697 case 0xf00: /* STIR: accessible only if CCR.USERSETMPEND permits */
1698 /* For access via STIR_NS it is the NS CCR.USERSETMPEND that
1699 * controls access even though the CPU is in Secure state (I_QDKX).
1701 return s
->cpu
->env
.v7m
.ccr
[attrs
.secure
] & R_V7M_CCR_USERSETMPEND_MASK
;
1703 /* All other user accesses cause a BusFault unconditionally */
1708 static int shpr_bank(NVICState
*s
, int exc
, MemTxAttrs attrs
)
1710 /* Behaviour for the SHPR register field for this exception:
1711 * return M_REG_NS to use the nonsecure vector (including for
1712 * non-banked exceptions), M_REG_S for the secure version of
1713 * a banked exception, and -1 if this field should RAZ/WI.
1716 case ARMV7M_EXCP_MEM
:
1717 case ARMV7M_EXCP_USAGE
:
1718 case ARMV7M_EXCP_SVC
:
1719 case ARMV7M_EXCP_PENDSV
:
1720 case ARMV7M_EXCP_SYSTICK
:
1721 /* Banked exceptions */
1722 return attrs
.secure
;
1723 case ARMV7M_EXCP_BUS
:
1724 /* Not banked, RAZ/WI from nonsecure if BFHFNMINS is zero */
1725 if (!attrs
.secure
&&
1726 !(s
->cpu
->env
.v7m
.aircr
& R_V7M_AIRCR_BFHFNMINS_MASK
)) {
1730 case ARMV7M_EXCP_SECURE
:
1731 /* Not banked, RAZ/WI from nonsecure */
1732 if (!attrs
.secure
) {
1736 case ARMV7M_EXCP_DEBUG
:
1737 /* Not banked. TODO should RAZ/WI if DEMCR.SDME is set */
1744 /* Not reachable due to decode of SHPR register addresses */
1745 g_assert_not_reached();
1749 static MemTxResult
nvic_sysreg_read(void *opaque
, hwaddr addr
,
1750 uint64_t *data
, unsigned size
,
1753 NVICState
*s
= (NVICState
*)opaque
;
1754 uint32_t offset
= addr
;
1755 unsigned i
, startvec
, end
;
1758 if (attrs
.user
&& !nvic_user_access_ok(s
, addr
, attrs
)) {
1759 /* Generate BusFault for unprivileged accesses */
1764 /* reads of set and clear both return the status */
1765 case 0x100 ... 0x13f: /* NVIC Set enable */
1768 case 0x180 ... 0x1bf: /* NVIC Clear enable */
1770 startvec
= 8 * (offset
- 0x180) + NVIC_FIRST_IRQ
; /* vector # */
1772 for (i
= 0, end
= size
* 8; i
< end
&& startvec
+ i
< s
->num_irq
; i
++) {
1773 if (s
->vectors
[startvec
+ i
].enabled
&&
1774 (attrs
.secure
|| s
->itns
[startvec
+ i
])) {
1779 case 0x200 ... 0x23f: /* NVIC Set pend */
1782 case 0x280 ... 0x2bf: /* NVIC Clear pend */
1784 startvec
= 8 * (offset
- 0x280) + NVIC_FIRST_IRQ
; /* vector # */
1785 for (i
= 0, end
= size
* 8; i
< end
&& startvec
+ i
< s
->num_irq
; i
++) {
1786 if (s
->vectors
[startvec
+ i
].pending
&&
1787 (attrs
.secure
|| s
->itns
[startvec
+ i
])) {
1792 case 0x300 ... 0x33f: /* NVIC Active */
1794 startvec
= 8 * (offset
- 0x300) + NVIC_FIRST_IRQ
; /* vector # */
1796 for (i
= 0, end
= size
* 8; i
< end
&& startvec
+ i
< s
->num_irq
; i
++) {
1797 if (s
->vectors
[startvec
+ i
].active
&&
1798 (attrs
.secure
|| s
->itns
[startvec
+ i
])) {
1803 case 0x400 ... 0x5ef: /* NVIC Priority */
1805 startvec
= offset
- 0x400 + NVIC_FIRST_IRQ
; /* vector # */
1807 for (i
= 0; i
< size
&& startvec
+ i
< s
->num_irq
; i
++) {
1808 if (attrs
.secure
|| s
->itns
[startvec
+ i
]) {
1809 val
|= s
->vectors
[startvec
+ i
].prio
<< (8 * i
);
1813 case 0xd18: /* System Handler Priority (SHPR1) */
1814 if (!arm_feature(&s
->cpu
->env
, ARM_FEATURE_M_MAIN
)) {
1819 case 0xd1c ... 0xd23: /* System Handler Priority (SHPR2, SHPR3) */
1821 for (i
= 0; i
< size
; i
++) {
1822 unsigned hdlidx
= (offset
- 0xd14) + i
;
1823 int sbank
= shpr_bank(s
, hdlidx
, attrs
);
1828 val
= deposit32(val
, i
* 8, 8, get_prio(s
, hdlidx
, sbank
));
1831 case 0xd28 ... 0xd2b: /* Configurable Fault Status (CFSR) */
1832 if (!arm_feature(&s
->cpu
->env
, ARM_FEATURE_M_MAIN
)) {
1836 /* The BFSR bits [15:8] are shared between security states
1837 * and we store them in the NS copy
1839 val
= s
->cpu
->env
.v7m
.cfsr
[attrs
.secure
];
1840 val
|= s
->cpu
->env
.v7m
.cfsr
[M_REG_NS
] & R_V7M_CFSR_BFSR_MASK
;
1841 val
= extract32(val
, (offset
- 0xd28) * 8, size
* 8);
1843 case 0xfe0 ... 0xfff: /* ID. */
1847 val
= nvic_id
[(offset
- 0xfe0) >> 2];
1852 val
= nvic_readl(s
, offset
, attrs
);
1854 qemu_log_mask(LOG_GUEST_ERROR
,
1855 "NVIC: Bad read of size %d at offset 0x%x\n",
1861 trace_nvic_sysreg_read(addr
, val
, size
);
1866 static MemTxResult
nvic_sysreg_write(void *opaque
, hwaddr addr
,
1867 uint64_t value
, unsigned size
,
1870 NVICState
*s
= (NVICState
*)opaque
;
1871 uint32_t offset
= addr
;
1872 unsigned i
, startvec
, end
;
1873 unsigned setval
= 0;
1875 trace_nvic_sysreg_write(addr
, value
, size
);
1877 if (attrs
.user
&& !nvic_user_access_ok(s
, addr
, attrs
)) {
1878 /* Generate BusFault for unprivileged accesses */
1883 case 0x100 ... 0x13f: /* NVIC Set enable */
1887 case 0x180 ... 0x1bf: /* NVIC Clear enable */
1888 startvec
= 8 * (offset
- 0x180) + NVIC_FIRST_IRQ
;
1890 for (i
= 0, end
= size
* 8; i
< end
&& startvec
+ i
< s
->num_irq
; i
++) {
1891 if (value
& (1 << i
) &&
1892 (attrs
.secure
|| s
->itns
[startvec
+ i
])) {
1893 s
->vectors
[startvec
+ i
].enabled
= setval
;
1898 case 0x200 ... 0x23f: /* NVIC Set pend */
1899 /* the special logic in armv7m_nvic_set_pending()
1900 * is not needed since IRQs are never escalated
1905 case 0x280 ... 0x2bf: /* NVIC Clear pend */
1906 startvec
= 8 * (offset
- 0x280) + NVIC_FIRST_IRQ
; /* vector # */
1908 for (i
= 0, end
= size
* 8; i
< end
&& startvec
+ i
< s
->num_irq
; i
++) {
1909 if (value
& (1 << i
) &&
1910 (attrs
.secure
|| s
->itns
[startvec
+ i
])) {
1911 s
->vectors
[startvec
+ i
].pending
= setval
;
1916 case 0x300 ... 0x33f: /* NVIC Active */
1917 return MEMTX_OK
; /* R/O */
1918 case 0x400 ... 0x5ef: /* NVIC Priority */
1919 startvec
= (offset
- 0x400) + NVIC_FIRST_IRQ
; /* vector # */
1921 for (i
= 0; i
< size
&& startvec
+ i
< s
->num_irq
; i
++) {
1922 if (attrs
.secure
|| s
->itns
[startvec
+ i
]) {
1923 set_prio(s
, startvec
+ i
, false, (value
>> (i
* 8)) & 0xff);
1928 case 0xd18: /* System Handler Priority (SHPR1) */
1929 if (!arm_feature(&s
->cpu
->env
, ARM_FEATURE_M_MAIN
)) {
1933 case 0xd1c ... 0xd23: /* System Handler Priority (SHPR2, SHPR3) */
1934 for (i
= 0; i
< size
; i
++) {
1935 unsigned hdlidx
= (offset
- 0xd14) + i
;
1936 int newprio
= extract32(value
, i
* 8, 8);
1937 int sbank
= shpr_bank(s
, hdlidx
, attrs
);
1942 set_prio(s
, hdlidx
, sbank
, newprio
);
1946 case 0xd28 ... 0xd2b: /* Configurable Fault Status (CFSR) */
1947 if (!arm_feature(&s
->cpu
->env
, ARM_FEATURE_M_MAIN
)) {
1950 /* All bits are W1C, so construct 32 bit value with 0s in
1951 * the parts not written by the access size
1953 value
<<= ((offset
- 0xd28) * 8);
1955 s
->cpu
->env
.v7m
.cfsr
[attrs
.secure
] &= ~value
;
1957 /* The BFSR bits [15:8] are shared between security states
1958 * and we store them in the NS copy.
1960 s
->cpu
->env
.v7m
.cfsr
[M_REG_NS
] &= ~(value
& R_V7M_CFSR_BFSR_MASK
);
1965 nvic_writel(s
, offset
, value
, attrs
);
1968 qemu_log_mask(LOG_GUEST_ERROR
,
1969 "NVIC: Bad write of size %d at offset 0x%x\n", size
, offset
);
1970 /* This is UNPREDICTABLE; treat as RAZ/WI */
1974 static const MemoryRegionOps nvic_sysreg_ops
= {
1975 .read_with_attrs
= nvic_sysreg_read
,
1976 .write_with_attrs
= nvic_sysreg_write
,
1977 .endianness
= DEVICE_NATIVE_ENDIAN
,
1980 static MemTxResult
nvic_sysreg_ns_write(void *opaque
, hwaddr addr
,
1981 uint64_t value
, unsigned size
,
1984 MemoryRegion
*mr
= opaque
;
1987 /* S accesses to the alias act like NS accesses to the real region */
1989 return memory_region_dispatch_write(mr
, addr
, value
, size
, attrs
);
1991 /* NS attrs are RAZ/WI for privileged, and BusFault for user */
1999 static MemTxResult
nvic_sysreg_ns_read(void *opaque
, hwaddr addr
,
2000 uint64_t *data
, unsigned size
,
2003 MemoryRegion
*mr
= opaque
;
2006 /* S accesses to the alias act like NS accesses to the real region */
2008 return memory_region_dispatch_read(mr
, addr
, data
, size
, attrs
);
2010 /* NS attrs are RAZ/WI for privileged, and BusFault for user */
2019 static const MemoryRegionOps nvic_sysreg_ns_ops
= {
2020 .read_with_attrs
= nvic_sysreg_ns_read
,
2021 .write_with_attrs
= nvic_sysreg_ns_write
,
2022 .endianness
= DEVICE_NATIVE_ENDIAN
,
2025 static MemTxResult
nvic_systick_write(void *opaque
, hwaddr addr
,
2026 uint64_t value
, unsigned size
,
2029 NVICState
*s
= opaque
;
2032 /* Direct the access to the correct systick */
2033 mr
= sysbus_mmio_get_region(SYS_BUS_DEVICE(&s
->systick
[attrs
.secure
]), 0);
2034 return memory_region_dispatch_write(mr
, addr
, value
, size
, attrs
);
2037 static MemTxResult
nvic_systick_read(void *opaque
, hwaddr addr
,
2038 uint64_t *data
, unsigned size
,
2041 NVICState
*s
= opaque
;
2044 /* Direct the access to the correct systick */
2045 mr
= sysbus_mmio_get_region(SYS_BUS_DEVICE(&s
->systick
[attrs
.secure
]), 0);
2046 return memory_region_dispatch_read(mr
, addr
, data
, size
, attrs
);
2049 static const MemoryRegionOps nvic_systick_ops
= {
2050 .read_with_attrs
= nvic_systick_read
,
2051 .write_with_attrs
= nvic_systick_write
,
2052 .endianness
= DEVICE_NATIVE_ENDIAN
,
2055 static int nvic_post_load(void *opaque
, int version_id
)
2057 NVICState
*s
= opaque
;
2061 /* Check for out of range priority settings */
2062 resetprio
= arm_feature(&s
->cpu
->env
, ARM_FEATURE_V8
) ? -4 : -3;
2064 if (s
->vectors
[ARMV7M_EXCP_RESET
].prio
!= resetprio
||
2065 s
->vectors
[ARMV7M_EXCP_NMI
].prio
!= -2 ||
2066 s
->vectors
[ARMV7M_EXCP_HARD
].prio
!= -1) {
2069 for (i
= ARMV7M_EXCP_MEM
; i
< s
->num_irq
; i
++) {
2070 if (s
->vectors
[i
].prio
& ~0xff) {
2075 nvic_recompute_state(s
);
2080 static const VMStateDescription vmstate_VecInfo
= {
2081 .name
= "armv7m_nvic_info",
2083 .minimum_version_id
= 1,
2084 .fields
= (VMStateField
[]) {
2085 VMSTATE_INT16(prio
, VecInfo
),
2086 VMSTATE_UINT8(enabled
, VecInfo
),
2087 VMSTATE_UINT8(pending
, VecInfo
),
2088 VMSTATE_UINT8(active
, VecInfo
),
2089 VMSTATE_UINT8(level
, VecInfo
),
2090 VMSTATE_END_OF_LIST()
2094 static bool nvic_security_needed(void *opaque
)
2096 NVICState
*s
= opaque
;
2098 return arm_feature(&s
->cpu
->env
, ARM_FEATURE_M_SECURITY
);
2101 static int nvic_security_post_load(void *opaque
, int version_id
)
2103 NVICState
*s
= opaque
;
2106 /* Check for out of range priority settings */
2107 if (s
->sec_vectors
[ARMV7M_EXCP_HARD
].prio
!= -1
2108 && s
->sec_vectors
[ARMV7M_EXCP_HARD
].prio
!= -3) {
2109 /* We can't cross-check against AIRCR.BFHFNMINS as we don't know
2110 * if the CPU state has been migrated yet; a mismatch won't
2111 * cause the emulation to blow up, though.
2115 for (i
= ARMV7M_EXCP_MEM
; i
< ARRAY_SIZE(s
->sec_vectors
); i
++) {
2116 if (s
->sec_vectors
[i
].prio
& ~0xff) {
2123 static const VMStateDescription vmstate_nvic_security
= {
2124 .name
= "armv7m_nvic/m-security",
2126 .minimum_version_id
= 1,
2127 .needed
= nvic_security_needed
,
2128 .post_load
= &nvic_security_post_load
,
2129 .fields
= (VMStateField
[]) {
2130 VMSTATE_STRUCT_ARRAY(sec_vectors
, NVICState
, NVIC_INTERNAL_VECTORS
, 1,
2131 vmstate_VecInfo
, VecInfo
),
2132 VMSTATE_UINT32(prigroup
[M_REG_S
], NVICState
),
2133 VMSTATE_BOOL_ARRAY(itns
, NVICState
, NVIC_MAX_VECTORS
),
2134 VMSTATE_END_OF_LIST()
2138 static const VMStateDescription vmstate_nvic
= {
2139 .name
= "armv7m_nvic",
2141 .minimum_version_id
= 4,
2142 .post_load
= &nvic_post_load
,
2143 .fields
= (VMStateField
[]) {
2144 VMSTATE_STRUCT_ARRAY(vectors
, NVICState
, NVIC_MAX_VECTORS
, 1,
2145 vmstate_VecInfo
, VecInfo
),
2146 VMSTATE_UINT32(prigroup
[M_REG_NS
], NVICState
),
2147 VMSTATE_END_OF_LIST()
2149 .subsections
= (const VMStateDescription
*[]) {
2150 &vmstate_nvic_security
,
2155 static Property props_nvic
[] = {
2156 /* Number of external IRQ lines (so excluding the 16 internal exceptions) */
2157 DEFINE_PROP_UINT32("num-irq", NVICState
, num_irq
, 64),
2158 DEFINE_PROP_END_OF_LIST()
2161 static void armv7m_nvic_reset(DeviceState
*dev
)
2164 NVICState
*s
= NVIC(dev
);
2166 memset(s
->vectors
, 0, sizeof(s
->vectors
));
2167 memset(s
->sec_vectors
, 0, sizeof(s
->sec_vectors
));
2168 s
->prigroup
[M_REG_NS
] = 0;
2169 s
->prigroup
[M_REG_S
] = 0;
2171 s
->vectors
[ARMV7M_EXCP_NMI
].enabled
= 1;
2172 /* MEM, BUS, and USAGE are enabled through
2173 * the System Handler Control register
2175 s
->vectors
[ARMV7M_EXCP_SVC
].enabled
= 1;
2176 s
->vectors
[ARMV7M_EXCP_DEBUG
].enabled
= 1;
2177 s
->vectors
[ARMV7M_EXCP_PENDSV
].enabled
= 1;
2178 s
->vectors
[ARMV7M_EXCP_SYSTICK
].enabled
= 1;
2180 resetprio
= arm_feature(&s
->cpu
->env
, ARM_FEATURE_V8
) ? -4 : -3;
2181 s
->vectors
[ARMV7M_EXCP_RESET
].prio
= resetprio
;
2182 s
->vectors
[ARMV7M_EXCP_NMI
].prio
= -2;
2183 s
->vectors
[ARMV7M_EXCP_HARD
].prio
= -1;
2185 if (arm_feature(&s
->cpu
->env
, ARM_FEATURE_M_SECURITY
)) {
2186 s
->sec_vectors
[ARMV7M_EXCP_HARD
].enabled
= 1;
2187 s
->sec_vectors
[ARMV7M_EXCP_SVC
].enabled
= 1;
2188 s
->sec_vectors
[ARMV7M_EXCP_PENDSV
].enabled
= 1;
2189 s
->sec_vectors
[ARMV7M_EXCP_SYSTICK
].enabled
= 1;
2191 /* AIRCR.BFHFNMINS resets to 0 so Secure HF is priority -1 (R_CMTC) */
2192 s
->sec_vectors
[ARMV7M_EXCP_HARD
].prio
= -1;
2193 /* If AIRCR.BFHFNMINS is 0 then NS HF is (effectively) disabled */
2194 s
->vectors
[ARMV7M_EXCP_HARD
].enabled
= 0;
2196 s
->vectors
[ARMV7M_EXCP_HARD
].enabled
= 1;
2199 /* Strictly speaking the reset handler should be enabled.
2200 * However, we don't simulate soft resets through the NVIC,
2201 * and the reset vector should never be pended.
2202 * So we leave it disabled to catch logic errors.
2205 s
->exception_prio
= NVIC_NOEXC_PRIO
;
2207 s
->vectpending_is_s_banked
= false;
2208 s
->vectpending_prio
= NVIC_NOEXC_PRIO
;
2210 if (arm_feature(&s
->cpu
->env
, ARM_FEATURE_M_SECURITY
)) {
2211 memset(s
->itns
, 0, sizeof(s
->itns
));
2213 /* This state is constant and not guest accessible in a non-security
2214 * NVIC; we set the bits to true to avoid having to do a feature
2215 * bit check in the NVIC enable/pend/etc register accessors.
2219 for (i
= NVIC_FIRST_IRQ
; i
< ARRAY_SIZE(s
->itns
); i
++) {
2225 static void nvic_systick_trigger(void *opaque
, int n
, int level
)
2227 NVICState
*s
= opaque
;
2230 /* SysTick just asked us to pend its exception.
2231 * (This is different from an external interrupt line's
2233 * n == 0 : NonSecure systick
2234 * n == 1 : Secure systick
2236 armv7m_nvic_set_pending(s
, ARMV7M_EXCP_SYSTICK
, n
);
2240 static void armv7m_nvic_realize(DeviceState
*dev
, Error
**errp
)
2242 NVICState
*s
= NVIC(dev
);
2246 s
->cpu
= ARM_CPU(qemu_get_cpu(0));
2248 if (!s
->cpu
|| !arm_feature(&s
->cpu
->env
, ARM_FEATURE_M
)) {
2249 error_setg(errp
, "The NVIC can only be used with a Cortex-M CPU");
2253 if (s
->num_irq
> NVIC_MAX_IRQ
) {
2254 error_setg(errp
, "num-irq %d exceeds NVIC maximum", s
->num_irq
);
2258 qdev_init_gpio_in(dev
, set_irq_level
, s
->num_irq
);
2260 /* include space for internal exception vectors */
2261 s
->num_irq
+= NVIC_FIRST_IRQ
;
2263 object_property_set_bool(OBJECT(&s
->systick
[M_REG_NS
]), true,
2266 error_propagate(errp
, err
);
2269 sysbus_connect_irq(SYS_BUS_DEVICE(&s
->systick
[M_REG_NS
]), 0,
2270 qdev_get_gpio_in_named(dev
, "systick-trigger",
2273 if (arm_feature(&s
->cpu
->env
, ARM_FEATURE_M_SECURITY
)) {
2274 /* We couldn't init the secure systick device in instance_init
2275 * as we didn't know then if the CPU had the security extensions;
2276 * so we have to do it here.
2278 object_initialize(&s
->systick
[M_REG_S
], sizeof(s
->systick
[M_REG_S
]),
2280 qdev_set_parent_bus(DEVICE(&s
->systick
[M_REG_S
]), sysbus_get_default());
2282 object_property_set_bool(OBJECT(&s
->systick
[M_REG_S
]), true,
2285 error_propagate(errp
, err
);
2288 sysbus_connect_irq(SYS_BUS_DEVICE(&s
->systick
[M_REG_S
]), 0,
2289 qdev_get_gpio_in_named(dev
, "systick-trigger",
2293 /* The NVIC and System Control Space (SCS) starts at 0xe000e000
2294 * and looks like this:
2296 * 0x010 - 0xff - systick
2297 * 0x100..0x7ec - NVIC
2298 * 0x7f0..0xcff - Reserved
2299 * 0xd00..0xd3c - SCS registers
2300 * 0xd40..0xeff - Reserved or Not implemented
2303 * Some registers within this space are banked between security states.
2304 * In v8M there is a second range 0xe002e000..0xe002efff which is the
2305 * NonSecure alias SCS; secure accesses to this behave like NS accesses
2306 * to the main SCS range, and non-secure accesses (including when
2307 * the security extension is not implemented) are RAZ/WI.
2308 * Note that both the main SCS range and the alias range are defined
2309 * to be exempt from memory attribution (R_BLJT) and so the memory
2310 * transaction attribute always matches the current CPU security
2311 * state (attrs.secure == env->v7m.secure). In the nvic_sysreg_ns_ops
2312 * wrappers we change attrs.secure to indicate the NS access; so
2313 * generally code determining which banked register to use should
2314 * use attrs.secure; code determining actual behaviour of the system
2315 * should use env->v7m.secure.
2317 regionlen
= arm_feature(&s
->cpu
->env
, ARM_FEATURE_V8
) ? 0x21000 : 0x1000;
2318 memory_region_init(&s
->container
, OBJECT(s
), "nvic", regionlen
);
2319 /* The system register region goes at the bottom of the priority
2320 * stack as it covers the whole page.
2322 memory_region_init_io(&s
->sysregmem
, OBJECT(s
), &nvic_sysreg_ops
, s
,
2323 "nvic_sysregs", 0x1000);
2324 memory_region_add_subregion(&s
->container
, 0, &s
->sysregmem
);
2326 memory_region_init_io(&s
->systickmem
, OBJECT(s
),
2327 &nvic_systick_ops
, s
,
2328 "nvic_systick", 0xe0);
2330 memory_region_add_subregion_overlap(&s
->container
, 0x10,
2333 if (arm_feature(&s
->cpu
->env
, ARM_FEATURE_V8
)) {
2334 memory_region_init_io(&s
->sysreg_ns_mem
, OBJECT(s
),
2335 &nvic_sysreg_ns_ops
, &s
->sysregmem
,
2336 "nvic_sysregs_ns", 0x1000);
2337 memory_region_add_subregion(&s
->container
, 0x20000, &s
->sysreg_ns_mem
);
2338 memory_region_init_io(&s
->systick_ns_mem
, OBJECT(s
),
2339 &nvic_sysreg_ns_ops
, &s
->systickmem
,
2340 "nvic_systick_ns", 0xe0);
2341 memory_region_add_subregion_overlap(&s
->container
, 0x20010,
2342 &s
->systick_ns_mem
, 1);
2345 sysbus_init_mmio(SYS_BUS_DEVICE(dev
), &s
->container
);
2348 static void armv7m_nvic_instance_init(Object
*obj
)
2350 /* We have a different default value for the num-irq property
2351 * than our superclass. This function runs after qdev init
2352 * has set the defaults from the Property array and before
2353 * any user-specified property setting, so just modify the
2354 * value in the GICState struct.
2356 DeviceState
*dev
= DEVICE(obj
);
2357 NVICState
*nvic
= NVIC(obj
);
2358 SysBusDevice
*sbd
= SYS_BUS_DEVICE(obj
);
2360 sysbus_init_child_obj(obj
, "systick-reg-ns", &nvic
->systick
[M_REG_NS
],
2361 sizeof(nvic
->systick
[M_REG_NS
]), TYPE_SYSTICK
);
2362 /* We can't initialize the secure systick here, as we don't know
2363 * yet if we need it.
2366 sysbus_init_irq(sbd
, &nvic
->excpout
);
2367 qdev_init_gpio_out_named(dev
, &nvic
->sysresetreq
, "SYSRESETREQ", 1);
2368 qdev_init_gpio_in_named(dev
, nvic_systick_trigger
, "systick-trigger",
2372 static void armv7m_nvic_class_init(ObjectClass
*klass
, void *data
)
2374 DeviceClass
*dc
= DEVICE_CLASS(klass
);
2376 dc
->vmsd
= &vmstate_nvic
;
2377 dc
->props
= props_nvic
;
2378 dc
->reset
= armv7m_nvic_reset
;
2379 dc
->realize
= armv7m_nvic_realize
;
2382 static const TypeInfo armv7m_nvic_info
= {
2384 .parent
= TYPE_SYS_BUS_DEVICE
,
2385 .instance_init
= armv7m_nvic_instance_init
,
2386 .instance_size
= sizeof(NVICState
),
2387 .class_init
= armv7m_nvic_class_init
,
2388 .class_size
= sizeof(SysBusDeviceClass
),
2391 static void armv7m_nvic_register_types(void)
2393 type_register_static(&armv7m_nvic_info
);
2396 type_init(armv7m_nvic_register_types
)