2 * ARMV7M System emulation.
4 * Copyright (c) 2006-2007 CodeSourcery.
5 * Written by Paul Brook
7 * This code is licensed under the GPL.
10 #include "qemu/osdep.h"
11 #include "hw/arm/armv7m.h"
12 #include "qapi/error.h"
13 #include "hw/sysbus.h"
14 #include "hw/arm/boot.h"
15 #include "hw/loader.h"
16 #include "hw/qdev-properties.h"
17 #include "hw/qdev-clock.h"
19 #include "sysemu/reset.h"
20 #include "qemu/error-report.h"
21 #include "qemu/module.h"
23 #include "target/arm/idau.h"
24 #include "migration/vmstate.h"
26 /* Bitbanded IO. Each word corresponds to a single bit. */
28 /* Get the byte address of the real memory for a bitband access. */
29 static inline hwaddr
bitband_addr(BitBandState
*s
, hwaddr offset
)
31 return s
->base
| (offset
& 0x1ffffff) >> 5;
34 static MemTxResult
bitband_read(void *opaque
, hwaddr offset
,
35 uint64_t *data
, unsigned size
, MemTxAttrs attrs
)
37 BitBandState
*s
= opaque
;
45 /* Find address in underlying memory and round down to multiple of size */
46 addr
= bitband_addr(s
, offset
) & (-size
);
47 res
= address_space_read(&s
->source_as
, addr
, attrs
, buf
, size
);
51 /* Bit position in the N bytes read... */
52 bitpos
= (offset
>> 2) & ((size
* 8) - 1);
53 /* ...converted to byte in buffer and bit in byte */
54 bit
= (buf
[bitpos
>> 3] >> (bitpos
& 7)) & 1;
59 static MemTxResult
bitband_write(void *opaque
, hwaddr offset
, uint64_t value
,
60 unsigned size
, MemTxAttrs attrs
)
62 BitBandState
*s
= opaque
;
70 /* Find address in underlying memory and round down to multiple of size */
71 addr
= bitband_addr(s
, offset
) & (-size
);
72 res
= address_space_read(&s
->source_as
, addr
, attrs
, buf
, size
);
76 /* Bit position in the N bytes read... */
77 bitpos
= (offset
>> 2) & ((size
* 8) - 1);
78 /* ...converted to byte in buffer and bit in byte */
79 bit
= 1 << (bitpos
& 7);
81 buf
[bitpos
>> 3] |= bit
;
83 buf
[bitpos
>> 3] &= ~bit
;
85 return address_space_write(&s
->source_as
, addr
, attrs
, buf
, size
);
88 static const MemoryRegionOps bitband_ops
= {
89 .read_with_attrs
= bitband_read
,
90 .write_with_attrs
= bitband_write
,
91 .endianness
= DEVICE_NATIVE_ENDIAN
,
92 .impl
.min_access_size
= 1,
93 .impl
.max_access_size
= 4,
94 .valid
.min_access_size
= 1,
95 .valid
.max_access_size
= 4,
98 static void bitband_init(Object
*obj
)
100 BitBandState
*s
= BITBAND(obj
);
101 SysBusDevice
*dev
= SYS_BUS_DEVICE(obj
);
103 memory_region_init_io(&s
->iomem
, obj
, &bitband_ops
, s
,
104 "bitband", 0x02000000);
105 sysbus_init_mmio(dev
, &s
->iomem
);
108 static void bitband_realize(DeviceState
*dev
, Error
**errp
)
110 BitBandState
*s
= BITBAND(dev
);
112 if (!s
->source_memory
) {
113 error_setg(errp
, "source-memory property not set");
117 address_space_init(&s
->source_as
, s
->source_memory
, "bitband-source");
122 static const hwaddr bitband_input_addr
[ARMV7M_NUM_BITBANDS
] = {
123 0x20000000, 0x40000000
126 static const hwaddr bitband_output_addr
[ARMV7M_NUM_BITBANDS
] = {
127 0x22000000, 0x42000000
130 static MemTxResult
v7m_sysreg_ns_write(void *opaque
, hwaddr addr
,
131 uint64_t value
, unsigned size
,
134 MemoryRegion
*mr
= opaque
;
137 /* S accesses to the alias act like NS accesses to the real region */
139 return memory_region_dispatch_write(mr
, addr
, value
,
140 size_memop(size
) | MO_TE
, attrs
);
142 /* NS attrs are RAZ/WI for privileged, and BusFault for user */
150 static MemTxResult
v7m_sysreg_ns_read(void *opaque
, hwaddr addr
,
151 uint64_t *data
, unsigned size
,
154 MemoryRegion
*mr
= opaque
;
157 /* S accesses to the alias act like NS accesses to the real region */
159 return memory_region_dispatch_read(mr
, addr
, data
,
160 size_memop(size
) | MO_TE
, attrs
);
162 /* NS attrs are RAZ/WI for privileged, and BusFault for user */
171 static const MemoryRegionOps v7m_sysreg_ns_ops
= {
172 .read_with_attrs
= v7m_sysreg_ns_read
,
173 .write_with_attrs
= v7m_sysreg_ns_write
,
174 .endianness
= DEVICE_NATIVE_ENDIAN
,
177 static MemTxResult
v7m_systick_write(void *opaque
, hwaddr addr
,
178 uint64_t value
, unsigned size
,
181 ARMv7MState
*s
= opaque
;
184 /* Direct the access to the correct systick */
185 mr
= sysbus_mmio_get_region(SYS_BUS_DEVICE(&s
->systick
[attrs
.secure
]), 0);
186 return memory_region_dispatch_write(mr
, addr
, value
,
187 size_memop(size
) | MO_TE
, attrs
);
190 static MemTxResult
v7m_systick_read(void *opaque
, hwaddr addr
,
191 uint64_t *data
, unsigned size
,
194 ARMv7MState
*s
= opaque
;
197 /* Direct the access to the correct systick */
198 mr
= sysbus_mmio_get_region(SYS_BUS_DEVICE(&s
->systick
[attrs
.secure
]), 0);
199 return memory_region_dispatch_read(mr
, addr
, data
, size_memop(size
) | MO_TE
,
203 static const MemoryRegionOps v7m_systick_ops
= {
204 .read_with_attrs
= v7m_systick_read
,
205 .write_with_attrs
= v7m_systick_write
,
206 .endianness
= DEVICE_NATIVE_ENDIAN
,
210 * Unassigned portions of the PPB space are RAZ/WI for privileged
211 * accesses, and fault for non-privileged accesses.
213 static MemTxResult
ppb_default_read(void *opaque
, hwaddr addr
,
214 uint64_t *data
, unsigned size
,
217 qemu_log_mask(LOG_UNIMP
, "Read of unassigned area of PPB: offset 0x%x\n",
226 static MemTxResult
ppb_default_write(void *opaque
, hwaddr addr
,
227 uint64_t value
, unsigned size
,
230 qemu_log_mask(LOG_UNIMP
, "Write of unassigned area of PPB: offset 0x%x\n",
238 static const MemoryRegionOps ppb_default_ops
= {
239 .read_with_attrs
= ppb_default_read
,
240 .write_with_attrs
= ppb_default_write
,
241 .endianness
= DEVICE_NATIVE_ENDIAN
,
242 .valid
.min_access_size
= 1,
243 .valid
.max_access_size
= 8,
246 static void armv7m_instance_init(Object
*obj
)
248 ARMv7MState
*s
= ARMV7M(obj
);
251 /* Can't init the cpu here, we don't yet know which model to use */
253 memory_region_init(&s
->container
, obj
, "armv7m-container", UINT64_MAX
);
255 object_initialize_child(obj
, "nvic", &s
->nvic
, TYPE_NVIC
);
256 object_property_add_alias(obj
, "num-irq",
257 OBJECT(&s
->nvic
), "num-irq");
259 object_initialize_child(obj
, "systick-reg-ns", &s
->systick
[M_REG_NS
],
262 * We can't initialize the secure systick here, as we don't know
266 for (i
= 0; i
< ARRAY_SIZE(s
->bitband
); i
++) {
267 object_initialize_child(obj
, "bitband[*]", &s
->bitband
[i
],
271 s
->refclk
= qdev_init_clock_in(DEVICE(obj
), "refclk", NULL
, NULL
, 0);
272 s
->cpuclk
= qdev_init_clock_in(DEVICE(obj
), "cpuclk", NULL
, NULL
, 0);
275 static void armv7m_realize(DeviceState
*dev
, Error
**errp
)
277 ARMv7MState
*s
= ARMV7M(dev
);
282 if (!s
->board_memory
) {
283 error_setg(errp
, "memory property was not set");
287 memory_region_add_subregion_overlap(&s
->container
, 0, s
->board_memory
, -1);
289 s
->cpu
= ARM_CPU(object_new_with_props(s
->cpu_type
, OBJECT(s
), "cpu",
292 error_propagate(errp
, err
);
296 object_property_set_link(OBJECT(s
->cpu
), "memory", OBJECT(&s
->container
),
298 if (object_property_find(OBJECT(s
->cpu
), "idau")) {
299 object_property_set_link(OBJECT(s
->cpu
), "idau", s
->idau
,
302 if (object_property_find(OBJECT(s
->cpu
), "init-svtor")) {
303 if (!object_property_set_uint(OBJECT(s
->cpu
), "init-svtor",
304 s
->init_svtor
, errp
)) {
308 if (object_property_find(OBJECT(s
->cpu
), "init-nsvtor")) {
309 if (!object_property_set_uint(OBJECT(s
->cpu
), "init-nsvtor",
310 s
->init_nsvtor
, errp
)) {
314 if (object_property_find(OBJECT(s
->cpu
), "start-powered-off")) {
315 if (!object_property_set_bool(OBJECT(s
->cpu
), "start-powered-off",
316 s
->start_powered_off
, errp
)) {
320 if (object_property_find(OBJECT(s
->cpu
), "vfp")) {
321 if (!object_property_set_bool(OBJECT(s
->cpu
), "vfp", s
->vfp
, errp
)) {
325 if (object_property_find(OBJECT(s
->cpu
), "dsp")) {
326 if (!object_property_set_bool(OBJECT(s
->cpu
), "dsp", s
->dsp
, errp
)) {
332 * Tell the CPU where the NVIC is; it will fail realize if it doesn't
333 * have one. Similarly, tell the NVIC where its CPU is.
335 s
->cpu
->env
.nvic
= &s
->nvic
;
336 s
->nvic
.cpu
= s
->cpu
;
338 if (!qdev_realize(DEVICE(s
->cpu
), NULL
, errp
)) {
342 /* Note that we must realize the NVIC after the CPU */
343 if (!sysbus_realize(SYS_BUS_DEVICE(&s
->nvic
), errp
)) {
347 /* Alias the NVIC's input and output GPIOs as our own so the board
348 * code can wire them up. (We do this in realize because the
349 * NVIC doesn't create the input GPIO array until realize.)
351 qdev_pass_gpios(DEVICE(&s
->nvic
), dev
, NULL
);
352 qdev_pass_gpios(DEVICE(&s
->nvic
), dev
, "SYSRESETREQ");
353 qdev_pass_gpios(DEVICE(&s
->nvic
), dev
, "NMI");
356 * We map various devices into the container MR at their architected
357 * addresses. In particular, we map everything corresponding to the
358 * "System PPB" space. This is the range from 0xe0000000 to 0xe00fffff
359 * and includes the NVIC, the System Control Space (system registers),
360 * the systick timer, and for CPUs with the Security extension an NS
361 * banked version of all of these.
363 * The default behaviour for unimplemented registers/ranges
364 * (for instance the Data Watchpoint and Trace unit at 0xe0001000)
365 * is to RAZ/WI for privileged access and BusFault for non-privileged
368 * The NVIC and System Control Space (SCS) starts at 0xe000e000
369 * and looks like this:
371 * 0x010 - 0xff - systick
372 * 0x100..0x7ec - NVIC
373 * 0x7f0..0xcff - Reserved
374 * 0xd00..0xd3c - SCS registers
375 * 0xd40..0xeff - Reserved or Not implemented
378 * Some registers within this space are banked between security states.
379 * In v8M there is a second range 0xe002e000..0xe002efff which is the
380 * NonSecure alias SCS; secure accesses to this behave like NS accesses
381 * to the main SCS range, and non-secure accesses (including when
382 * the security extension is not implemented) are RAZ/WI.
383 * Note that both the main SCS range and the alias range are defined
384 * to be exempt from memory attribution (R_BLJT) and so the memory
385 * transaction attribute always matches the current CPU security
386 * state (attrs.secure == env->v7m.secure). In the v7m_sysreg_ns_ops
387 * wrappers we change attrs.secure to indicate the NS access; so
388 * generally code determining which banked register to use should
389 * use attrs.secure; code determining actual behaviour of the system
390 * should use env->v7m.secure.
392 * Within the PPB space, some MRs overlap, and the priority
393 * of overlapping regions is:
394 * - default region (for RAZ/WI and BusFault) : -1
395 * - system register regions (provided by the NVIC) : 0
397 * This is because the systick device is a small block of registers
398 * in the middle of the other system control registers.
401 memory_region_init_io(&s
->defaultmem
, OBJECT(s
), &ppb_default_ops
, s
,
402 "nvic-default", 0x100000);
403 memory_region_add_subregion_overlap(&s
->container
, 0xe0000000,
406 /* Wire the NVIC up to the CPU */
407 sbd
= SYS_BUS_DEVICE(&s
->nvic
);
408 sysbus_connect_irq(sbd
, 0,
409 qdev_get_gpio_in(DEVICE(s
->cpu
), ARM_CPU_IRQ
));
411 memory_region_add_subregion(&s
->container
, 0xe000e000,
412 sysbus_mmio_get_region(sbd
, 0));
413 if (arm_feature(&s
->cpu
->env
, ARM_FEATURE_V8
)) {
414 /* Create the NS alias region for the NVIC sysregs */
415 memory_region_init_io(&s
->sysreg_ns_mem
, OBJECT(s
),
417 sysbus_mmio_get_region(sbd
, 0),
418 "nvic_sysregs_ns", 0x1000);
419 memory_region_add_subregion(&s
->container
, 0xe002e000,
423 /* Create and map the systick devices */
424 qdev_connect_clock_in(DEVICE(&s
->systick
[M_REG_NS
]), "refclk", s
->refclk
);
425 qdev_connect_clock_in(DEVICE(&s
->systick
[M_REG_NS
]), "cpuclk", s
->cpuclk
);
426 if (!sysbus_realize(SYS_BUS_DEVICE(&s
->systick
[M_REG_NS
]), errp
)) {
429 sysbus_connect_irq(SYS_BUS_DEVICE(&s
->systick
[M_REG_NS
]), 0,
430 qdev_get_gpio_in_named(DEVICE(&s
->nvic
),
431 "systick-trigger", M_REG_NS
));
433 if (arm_feature(&s
->cpu
->env
, ARM_FEATURE_M_SECURITY
)) {
435 * We couldn't init the secure systick device in instance_init
436 * as we didn't know then if the CPU had the security extensions;
437 * so we have to do it here.
439 object_initialize_child(OBJECT(dev
), "systick-reg-s",
440 &s
->systick
[M_REG_S
], TYPE_SYSTICK
);
441 qdev_connect_clock_in(DEVICE(&s
->systick
[M_REG_S
]), "refclk",
443 qdev_connect_clock_in(DEVICE(&s
->systick
[M_REG_S
]), "cpuclk",
446 if (!sysbus_realize(SYS_BUS_DEVICE(&s
->systick
[M_REG_S
]), errp
)) {
449 sysbus_connect_irq(SYS_BUS_DEVICE(&s
->systick
[M_REG_S
]), 0,
450 qdev_get_gpio_in_named(DEVICE(&s
->nvic
),
451 "systick-trigger", M_REG_S
));
454 memory_region_init_io(&s
->systickmem
, OBJECT(s
),
456 "v7m_systick", 0xe0);
458 memory_region_add_subregion_overlap(&s
->container
, 0xe000e010,
460 if (arm_feature(&s
->cpu
->env
, ARM_FEATURE_V8
)) {
461 memory_region_init_io(&s
->systick_ns_mem
, OBJECT(s
),
462 &v7m_sysreg_ns_ops
, &s
->systickmem
,
463 "v7m_systick_ns", 0xe0);
464 memory_region_add_subregion_overlap(&s
->container
, 0xe002e010,
465 &s
->systick_ns_mem
, 1);
468 /* If the CPU has RAS support, create the RAS register block */
469 if (cpu_isar_feature(aa32_ras
, s
->cpu
)) {
470 object_initialize_child(OBJECT(dev
), "armv7m-ras",
471 &s
->ras
, TYPE_ARMV7M_RAS
);
472 sbd
= SYS_BUS_DEVICE(&s
->ras
);
473 if (!sysbus_realize(sbd
, errp
)) {
476 memory_region_add_subregion_overlap(&s
->container
, 0xe0005000,
477 sysbus_mmio_get_region(sbd
, 0), 1);
480 for (i
= 0; i
< ARRAY_SIZE(s
->bitband
); i
++) {
481 if (s
->enable_bitband
) {
482 Object
*obj
= OBJECT(&s
->bitband
[i
]);
483 SysBusDevice
*sbd
= SYS_BUS_DEVICE(&s
->bitband
[i
]);
485 if (!object_property_set_int(obj
, "base",
486 bitband_input_addr
[i
], errp
)) {
489 object_property_set_link(obj
, "source-memory",
490 OBJECT(s
->board_memory
), &error_abort
);
491 if (!sysbus_realize(SYS_BUS_DEVICE(obj
), errp
)) {
495 memory_region_add_subregion(&s
->container
, bitband_output_addr
[i
],
496 sysbus_mmio_get_region(sbd
, 0));
498 object_unparent(OBJECT(&s
->bitband
[i
]));
503 static Property armv7m_properties
[] = {
504 DEFINE_PROP_STRING("cpu-type", ARMv7MState
, cpu_type
),
505 DEFINE_PROP_LINK("memory", ARMv7MState
, board_memory
, TYPE_MEMORY_REGION
,
507 DEFINE_PROP_LINK("idau", ARMv7MState
, idau
, TYPE_IDAU_INTERFACE
, Object
*),
508 DEFINE_PROP_UINT32("init-svtor", ARMv7MState
, init_svtor
, 0),
509 DEFINE_PROP_UINT32("init-nsvtor", ARMv7MState
, init_nsvtor
, 0),
510 DEFINE_PROP_BOOL("enable-bitband", ARMv7MState
, enable_bitband
, false),
511 DEFINE_PROP_BOOL("start-powered-off", ARMv7MState
, start_powered_off
,
513 DEFINE_PROP_BOOL("vfp", ARMv7MState
, vfp
, true),
514 DEFINE_PROP_BOOL("dsp", ARMv7MState
, dsp
, true),
515 DEFINE_PROP_END_OF_LIST(),
518 static const VMStateDescription vmstate_armv7m
= {
521 .minimum_version_id
= 1,
522 .fields
= (VMStateField
[]) {
523 VMSTATE_CLOCK(refclk
, SysTickState
),
524 VMSTATE_CLOCK(cpuclk
, SysTickState
),
525 VMSTATE_END_OF_LIST()
529 static void armv7m_class_init(ObjectClass
*klass
, void *data
)
531 DeviceClass
*dc
= DEVICE_CLASS(klass
);
533 dc
->realize
= armv7m_realize
;
534 dc
->vmsd
= &vmstate_armv7m
;
535 device_class_set_props(dc
, armv7m_properties
);
538 static const TypeInfo armv7m_info
= {
540 .parent
= TYPE_SYS_BUS_DEVICE
,
541 .instance_size
= sizeof(ARMv7MState
),
542 .instance_init
= armv7m_instance_init
,
543 .class_init
= armv7m_class_init
,
546 static void armv7m_reset(void *opaque
)
548 ARMCPU
*cpu
= opaque
;
553 void armv7m_load_kernel(ARMCPU
*cpu
, const char *kernel_filename
, int mem_size
)
560 CPUState
*cs
= CPU(cpu
);
562 #ifdef TARGET_WORDS_BIGENDIAN
568 if (arm_feature(&cpu
->env
, ARM_FEATURE_EL3
)) {
573 as
= cpu_get_address_space(cs
, asidx
);
575 if (kernel_filename
) {
576 image_size
= load_elf_as(kernel_filename
, NULL
, NULL
, NULL
,
578 NULL
, big_endian
, EM_ARM
, 1, 0, as
);
579 if (image_size
< 0) {
580 image_size
= load_image_targphys_as(kernel_filename
, 0,
583 if (image_size
< 0) {
584 error_report("Could not load kernel '%s'", kernel_filename
);
589 /* CPU objects (unlike devices) are not automatically reset on system
590 * reset, so we must always register a handler to do so. Unlike
591 * A-profile CPUs, we don't need to do anything special in the
592 * handler to arrange that it starts correctly.
593 * This is arguably the wrong place to do this, but it matches the
594 * way A-profile does it. Note that this means that every M profile
595 * board must call this function!
597 qemu_register_reset(armv7m_reset
, cpu
);
600 static Property bitband_properties
[] = {
601 DEFINE_PROP_UINT32("base", BitBandState
, base
, 0),
602 DEFINE_PROP_LINK("source-memory", BitBandState
, source_memory
,
603 TYPE_MEMORY_REGION
, MemoryRegion
*),
604 DEFINE_PROP_END_OF_LIST(),
607 static void bitband_class_init(ObjectClass
*klass
, void *data
)
609 DeviceClass
*dc
= DEVICE_CLASS(klass
);
611 dc
->realize
= bitband_realize
;
612 device_class_set_props(dc
, bitband_properties
);
615 static const TypeInfo bitband_info
= {
616 .name
= TYPE_BITBAND
,
617 .parent
= TYPE_SYS_BUS_DEVICE
,
618 .instance_size
= sizeof(BitBandState
),
619 .instance_init
= bitband_init
,
620 .class_init
= bitband_class_init
,
623 static void armv7m_register_types(void)
625 type_register_static(&bitband_info
);
626 type_register_static(&armv7m_info
);
629 type_init(armv7m_register_types
)