hw/intc/armv7m_nvic: Provide default "reset the system" behaviour for SYSRESETREQ
[qemu.git] / hw / intc / armv7m_nvic.c
1 /*
2 * ARM Nested Vectored Interrupt Controller
3 *
4 * Copyright (c) 2006-2007 CodeSourcery.
5 * Written by Paul Brook
6 *
7 * This code is licensed under the GPL.
8 *
9 * The ARMv7M System controller is fairly tightly tied in with the
10 * NVIC. Much of that is also implemented here.
11 */
12
13 #include "qemu/osdep.h"
14 #include "qapi/error.h"
15 #include "cpu.h"
16 #include "hw/sysbus.h"
17 #include "migration/vmstate.h"
18 #include "qemu/timer.h"
19 #include "hw/intc/armv7m_nvic.h"
20 #include "hw/irq.h"
21 #include "hw/qdev-properties.h"
22 #include "sysemu/runstate.h"
23 #include "target/arm/cpu.h"
24 #include "exec/exec-all.h"
25 #include "exec/memop.h"
26 #include "qemu/log.h"
27 #include "qemu/module.h"
28 #include "trace.h"
29
30 /* IRQ number counting:
31 *
32 * the num-irq property counts the number of external IRQ lines
33 *
34 * NVICState::num_irq counts the total number of exceptions
35 * (external IRQs, the 15 internal exceptions including reset,
36 * and one for the unused exception number 0).
37 *
38 * NVIC_MAX_IRQ is the highest permitted number of external IRQ lines.
39 *
40 * NVIC_MAX_VECTORS is the highest permitted number of exceptions.
41 *
42 * Iterating through all exceptions should typically be done with
43 * for (i = 1; i < s->num_irq; i++) to avoid the unused slot 0.
44 *
45 * The external qemu_irq lines are the NVIC's external IRQ lines,
46 * so line 0 is exception 16.
47 *
48 * In the terminology of the architecture manual, "interrupts" are
49 * a subcategory of exception referring to the external interrupts
50 * (which are exception numbers NVIC_FIRST_IRQ and upward).
51 * For historical reasons QEMU tends to use "interrupt" and
52 * "exception" more or less interchangeably.
53 */
54 #define NVIC_FIRST_IRQ NVIC_INTERNAL_VECTORS
55 #define NVIC_MAX_IRQ (NVIC_MAX_VECTORS - NVIC_FIRST_IRQ)
56
57 /* Effective running priority of the CPU when no exception is active
58 * (higher than the highest possible priority value)
59 */
60 #define NVIC_NOEXC_PRIO 0x100
61 /* Maximum priority of non-secure exceptions when AIRCR.PRIS is set */
62 #define NVIC_NS_PRIO_LIMIT 0x80
63
64 static const uint8_t nvic_id[] = {
65 0x00, 0xb0, 0x1b, 0x00, 0x0d, 0xe0, 0x05, 0xb1
66 };
67
68 static void signal_sysresetreq(NVICState *s)
69 {
70 if (qemu_irq_is_connected(s->sysresetreq)) {
71 qemu_irq_pulse(s->sysresetreq);
72 } else {
73 /*
74 * Default behaviour if the SoC doesn't need to wire up
75 * SYSRESETREQ (eg to a system reset controller of some kind):
76 * perform a system reset via the usual QEMU API.
77 */
78 qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
79 }
80 }
81
82 static int nvic_pending_prio(NVICState *s)
83 {
84 /* return the group priority of the current pending interrupt,
85 * or NVIC_NOEXC_PRIO if no interrupt is pending
86 */
87 return s->vectpending_prio;
88 }
89
90 /* Return the value of the ISCR RETTOBASE bit:
91 * 1 if there is exactly one active exception
92 * 0 if there is more than one active exception
93 * UNKNOWN if there are no active exceptions (we choose 1,
94 * which matches the choice Cortex-M3 is documented as making).
95 *
96 * NB: some versions of the documentation talk about this
97 * counting "active exceptions other than the one shown by IPSR";
98 * this is only different in the obscure corner case where guest
99 * code has manually deactivated an exception and is about
100 * to fail an exception-return integrity check. The definition
101 * above is the one from the v8M ARM ARM and is also in line
102 * with the behaviour documented for the Cortex-M3.
103 */
104 static bool nvic_rettobase(NVICState *s)
105 {
106 int irq, nhand = 0;
107 bool check_sec = arm_feature(&s->cpu->env, ARM_FEATURE_M_SECURITY);
108
109 for (irq = ARMV7M_EXCP_RESET; irq < s->num_irq; irq++) {
110 if (s->vectors[irq].active ||
111 (check_sec && irq < NVIC_INTERNAL_VECTORS &&
112 s->sec_vectors[irq].active)) {
113 nhand++;
114 if (nhand == 2) {
115 return 0;
116 }
117 }
118 }
119
120 return 1;
121 }
122
123 /* Return the value of the ISCR ISRPENDING bit:
124 * 1 if an external interrupt is pending
125 * 0 if no external interrupt is pending
126 */
127 static bool nvic_isrpending(NVICState *s)
128 {
129 int irq;
130
131 /* We can shortcut if the highest priority pending interrupt
132 * happens to be external or if there is nothing pending.
133 */
134 if (s->vectpending > NVIC_FIRST_IRQ) {
135 return true;
136 }
137 if (s->vectpending == 0) {
138 return false;
139 }
140
141 for (irq = NVIC_FIRST_IRQ; irq < s->num_irq; irq++) {
142 if (s->vectors[irq].pending) {
143 return true;
144 }
145 }
146 return false;
147 }
148
149 static bool exc_is_banked(int exc)
150 {
151 /* Return true if this is one of the limited set of exceptions which
152 * are banked (and thus have state in sec_vectors[])
153 */
154 return exc == ARMV7M_EXCP_HARD ||
155 exc == ARMV7M_EXCP_MEM ||
156 exc == ARMV7M_EXCP_USAGE ||
157 exc == ARMV7M_EXCP_SVC ||
158 exc == ARMV7M_EXCP_PENDSV ||
159 exc == ARMV7M_EXCP_SYSTICK;
160 }
161
162 /* Return a mask word which clears the subpriority bits from
163 * a priority value for an M-profile exception, leaving only
164 * the group priority.
165 */
166 static inline uint32_t nvic_gprio_mask(NVICState *s, bool secure)
167 {
168 return ~0U << (s->prigroup[secure] + 1);
169 }
170
171 static bool exc_targets_secure(NVICState *s, int exc)
172 {
173 /* Return true if this non-banked exception targets Secure state. */
174 if (!arm_feature(&s->cpu->env, ARM_FEATURE_M_SECURITY)) {
175 return false;
176 }
177
178 if (exc >= NVIC_FIRST_IRQ) {
179 return !s->itns[exc];
180 }
181
182 /* Function shouldn't be called for banked exceptions. */
183 assert(!exc_is_banked(exc));
184
185 switch (exc) {
186 case ARMV7M_EXCP_NMI:
187 case ARMV7M_EXCP_BUS:
188 return !(s->cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK);
189 case ARMV7M_EXCP_SECURE:
190 return true;
191 case ARMV7M_EXCP_DEBUG:
192 /* TODO: controlled by DEMCR.SDME, which we don't yet implement */
193 return false;
194 default:
195 /* reset, and reserved (unused) low exception numbers.
196 * We'll get called by code that loops through all the exception
197 * numbers, but it doesn't matter what we return here as these
198 * non-existent exceptions will never be pended or active.
199 */
200 return true;
201 }
202 }
203
204 static int exc_group_prio(NVICState *s, int rawprio, bool targets_secure)
205 {
206 /* Return the group priority for this exception, given its raw
207 * (group-and-subgroup) priority value and whether it is targeting
208 * secure state or not.
209 */
210 if (rawprio < 0) {
211 return rawprio;
212 }
213 rawprio &= nvic_gprio_mask(s, targets_secure);
214 /* AIRCR.PRIS causes us to squash all NS priorities into the
215 * lower half of the total range
216 */
217 if (!targets_secure &&
218 (s->cpu->env.v7m.aircr & R_V7M_AIRCR_PRIS_MASK)) {
219 rawprio = (rawprio >> 1) + NVIC_NS_PRIO_LIMIT;
220 }
221 return rawprio;
222 }
223
224 /* Recompute vectpending and exception_prio for a CPU which implements
225 * the Security extension
226 */
227 static void nvic_recompute_state_secure(NVICState *s)
228 {
229 int i, bank;
230 int pend_prio = NVIC_NOEXC_PRIO;
231 int active_prio = NVIC_NOEXC_PRIO;
232 int pend_irq = 0;
233 bool pending_is_s_banked = false;
234 int pend_subprio = 0;
235
236 /* R_CQRV: precedence is by:
237 * - lowest group priority; if both the same then
238 * - lowest subpriority; if both the same then
239 * - lowest exception number; if both the same (ie banked) then
240 * - secure exception takes precedence
241 * Compare pseudocode RawExecutionPriority.
242 * Annoyingly, now we have two prigroup values (for S and NS)
243 * we can't do the loop comparison on raw priority values.
244 */
245 for (i = 1; i < s->num_irq; i++) {
246 for (bank = M_REG_S; bank >= M_REG_NS; bank--) {
247 VecInfo *vec;
248 int prio, subprio;
249 bool targets_secure;
250
251 if (bank == M_REG_S) {
252 if (!exc_is_banked(i)) {
253 continue;
254 }
255 vec = &s->sec_vectors[i];
256 targets_secure = true;
257 } else {
258 vec = &s->vectors[i];
259 targets_secure = !exc_is_banked(i) && exc_targets_secure(s, i);
260 }
261
262 prio = exc_group_prio(s, vec->prio, targets_secure);
263 subprio = vec->prio & ~nvic_gprio_mask(s, targets_secure);
264 if (vec->enabled && vec->pending &&
265 ((prio < pend_prio) ||
266 (prio == pend_prio && prio >= 0 && subprio < pend_subprio))) {
267 pend_prio = prio;
268 pend_subprio = subprio;
269 pend_irq = i;
270 pending_is_s_banked = (bank == M_REG_S);
271 }
272 if (vec->active && prio < active_prio) {
273 active_prio = prio;
274 }
275 }
276 }
277
278 s->vectpending_is_s_banked = pending_is_s_banked;
279 s->vectpending = pend_irq;
280 s->vectpending_prio = pend_prio;
281 s->exception_prio = active_prio;
282
283 trace_nvic_recompute_state_secure(s->vectpending,
284 s->vectpending_is_s_banked,
285 s->vectpending_prio,
286 s->exception_prio);
287 }
288
289 /* Recompute vectpending and exception_prio */
290 static void nvic_recompute_state(NVICState *s)
291 {
292 int i;
293 int pend_prio = NVIC_NOEXC_PRIO;
294 int active_prio = NVIC_NOEXC_PRIO;
295 int pend_irq = 0;
296
297 /* In theory we could write one function that handled both
298 * the "security extension present" and "not present"; however
299 * the security related changes significantly complicate the
300 * recomputation just by themselves and mixing both cases together
301 * would be even worse, so we retain a separate non-secure-only
302 * version for CPUs which don't implement the security extension.
303 */
304 if (arm_feature(&s->cpu->env, ARM_FEATURE_M_SECURITY)) {
305 nvic_recompute_state_secure(s);
306 return;
307 }
308
309 for (i = 1; i < s->num_irq; i++) {
310 VecInfo *vec = &s->vectors[i];
311
312 if (vec->enabled && vec->pending && vec->prio < pend_prio) {
313 pend_prio = vec->prio;
314 pend_irq = i;
315 }
316 if (vec->active && vec->prio < active_prio) {
317 active_prio = vec->prio;
318 }
319 }
320
321 if (active_prio > 0) {
322 active_prio &= nvic_gprio_mask(s, false);
323 }
324
325 if (pend_prio > 0) {
326 pend_prio &= nvic_gprio_mask(s, false);
327 }
328
329 s->vectpending = pend_irq;
330 s->vectpending_prio = pend_prio;
331 s->exception_prio = active_prio;
332
333 trace_nvic_recompute_state(s->vectpending,
334 s->vectpending_prio,
335 s->exception_prio);
336 }
337
338 /* Return the current execution priority of the CPU
339 * (equivalent to the pseudocode ExecutionPriority function).
340 * This is a value between -2 (NMI priority) and NVIC_NOEXC_PRIO.
341 */
342 static inline int nvic_exec_prio(NVICState *s)
343 {
344 CPUARMState *env = &s->cpu->env;
345 int running = NVIC_NOEXC_PRIO;
346
347 if (env->v7m.basepri[M_REG_NS] > 0) {
348 running = exc_group_prio(s, env->v7m.basepri[M_REG_NS], M_REG_NS);
349 }
350
351 if (env->v7m.basepri[M_REG_S] > 0) {
352 int basepri = exc_group_prio(s, env->v7m.basepri[M_REG_S], M_REG_S);
353 if (running > basepri) {
354 running = basepri;
355 }
356 }
357
358 if (env->v7m.primask[M_REG_NS]) {
359 if (env->v7m.aircr & R_V7M_AIRCR_PRIS_MASK) {
360 if (running > NVIC_NS_PRIO_LIMIT) {
361 running = NVIC_NS_PRIO_LIMIT;
362 }
363 } else {
364 running = 0;
365 }
366 }
367
368 if (env->v7m.primask[M_REG_S]) {
369 running = 0;
370 }
371
372 if (env->v7m.faultmask[M_REG_NS]) {
373 if (env->v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK) {
374 running = -1;
375 } else {
376 if (env->v7m.aircr & R_V7M_AIRCR_PRIS_MASK) {
377 if (running > NVIC_NS_PRIO_LIMIT) {
378 running = NVIC_NS_PRIO_LIMIT;
379 }
380 } else {
381 running = 0;
382 }
383 }
384 }
385
386 if (env->v7m.faultmask[M_REG_S]) {
387 running = (env->v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK) ? -3 : -1;
388 }
389
390 /* consider priority of active handler */
391 return MIN(running, s->exception_prio);
392 }
393
394 bool armv7m_nvic_neg_prio_requested(void *opaque, bool secure)
395 {
396 /* Return true if the requested execution priority is negative
397 * for the specified security state, ie that security state
398 * has an active NMI or HardFault or has set its FAULTMASK.
399 * Note that this is not the same as whether the execution
400 * priority is actually negative (for instance AIRCR.PRIS may
401 * mean we don't allow FAULTMASK_NS to actually make the execution
402 * priority negative). Compare pseudocode IsReqExcPriNeg().
403 */
404 NVICState *s = opaque;
405
406 if (s->cpu->env.v7m.faultmask[secure]) {
407 return true;
408 }
409
410 if (secure ? s->sec_vectors[ARMV7M_EXCP_HARD].active :
411 s->vectors[ARMV7M_EXCP_HARD].active) {
412 return true;
413 }
414
415 if (s->vectors[ARMV7M_EXCP_NMI].active &&
416 exc_targets_secure(s, ARMV7M_EXCP_NMI) == secure) {
417 return true;
418 }
419
420 return false;
421 }
422
423 bool armv7m_nvic_can_take_pending_exception(void *opaque)
424 {
425 NVICState *s = opaque;
426
427 return nvic_exec_prio(s) > nvic_pending_prio(s);
428 }
429
430 int armv7m_nvic_raw_execution_priority(void *opaque)
431 {
432 NVICState *s = opaque;
433
434 return s->exception_prio;
435 }
436
437 /* caller must call nvic_irq_update() after this.
438 * secure indicates the bank to use for banked exceptions (we assert if
439 * we are passed secure=true for a non-banked exception).
440 */
441 static void set_prio(NVICState *s, unsigned irq, bool secure, uint8_t prio)
442 {
443 assert(irq > ARMV7M_EXCP_NMI); /* only use for configurable prios */
444 assert(irq < s->num_irq);
445
446 prio &= MAKE_64BIT_MASK(8 - s->num_prio_bits, s->num_prio_bits);
447
448 if (secure) {
449 assert(exc_is_banked(irq));
450 s->sec_vectors[irq].prio = prio;
451 } else {
452 s->vectors[irq].prio = prio;
453 }
454
455 trace_nvic_set_prio(irq, secure, prio);
456 }
457
458 /* Return the current raw priority register value.
459 * secure indicates the bank to use for banked exceptions (we assert if
460 * we are passed secure=true for a non-banked exception).
461 */
462 static int get_prio(NVICState *s, unsigned irq, bool secure)
463 {
464 assert(irq > ARMV7M_EXCP_NMI); /* only use for configurable prios */
465 assert(irq < s->num_irq);
466
467 if (secure) {
468 assert(exc_is_banked(irq));
469 return s->sec_vectors[irq].prio;
470 } else {
471 return s->vectors[irq].prio;
472 }
473 }
474
475 /* Recompute state and assert irq line accordingly.
476 * Must be called after changes to:
477 * vec->active, vec->enabled, vec->pending or vec->prio for any vector
478 * prigroup
479 */
480 static void nvic_irq_update(NVICState *s)
481 {
482 int lvl;
483 int pend_prio;
484
485 nvic_recompute_state(s);
486 pend_prio = nvic_pending_prio(s);
487
488 /* Raise NVIC output if this IRQ would be taken, except that we
489 * ignore the effects of the BASEPRI, FAULTMASK and PRIMASK (which
490 * will be checked for in arm_v7m_cpu_exec_interrupt()); changes
491 * to those CPU registers don't cause us to recalculate the NVIC
492 * pending info.
493 */
494 lvl = (pend_prio < s->exception_prio);
495 trace_nvic_irq_update(s->vectpending, pend_prio, s->exception_prio, lvl);
496 qemu_set_irq(s->excpout, lvl);
497 }
498
499 /**
500 * armv7m_nvic_clear_pending: mark the specified exception as not pending
501 * @opaque: the NVIC
502 * @irq: the exception number to mark as not pending
503 * @secure: false for non-banked exceptions or for the nonsecure
504 * version of a banked exception, true for the secure version of a banked
505 * exception.
506 *
507 * Marks the specified exception as not pending. Note that we will assert()
508 * if @secure is true and @irq does not specify one of the fixed set
509 * of architecturally banked exceptions.
510 */
511 static void armv7m_nvic_clear_pending(void *opaque, int irq, bool secure)
512 {
513 NVICState *s = (NVICState *)opaque;
514 VecInfo *vec;
515
516 assert(irq > ARMV7M_EXCP_RESET && irq < s->num_irq);
517
518 if (secure) {
519 assert(exc_is_banked(irq));
520 vec = &s->sec_vectors[irq];
521 } else {
522 vec = &s->vectors[irq];
523 }
524 trace_nvic_clear_pending(irq, secure, vec->enabled, vec->prio);
525 if (vec->pending) {
526 vec->pending = 0;
527 nvic_irq_update(s);
528 }
529 }
530
531 static void do_armv7m_nvic_set_pending(void *opaque, int irq, bool secure,
532 bool derived)
533 {
534 /* Pend an exception, including possibly escalating it to HardFault.
535 *
536 * This function handles both "normal" pending of interrupts and
537 * exceptions, and also derived exceptions (ones which occur as
538 * a result of trying to take some other exception).
539 *
540 * If derived == true, the caller guarantees that we are part way through
541 * trying to take an exception (but have not yet called
542 * armv7m_nvic_acknowledge_irq() to make it active), and so:
543 * - s->vectpending is the "original exception" we were trying to take
544 * - irq is the "derived exception"
545 * - nvic_exec_prio(s) gives the priority before exception entry
546 * Here we handle the prioritization logic which the pseudocode puts
547 * in the DerivedLateArrival() function.
548 */
549
550 NVICState *s = (NVICState *)opaque;
551 bool banked = exc_is_banked(irq);
552 VecInfo *vec;
553 bool targets_secure;
554
555 assert(irq > ARMV7M_EXCP_RESET && irq < s->num_irq);
556 assert(!secure || banked);
557
558 vec = (banked && secure) ? &s->sec_vectors[irq] : &s->vectors[irq];
559
560 targets_secure = banked ? secure : exc_targets_secure(s, irq);
561
562 trace_nvic_set_pending(irq, secure, targets_secure,
563 derived, vec->enabled, vec->prio);
564
565 if (derived) {
566 /* Derived exceptions are always synchronous. */
567 assert(irq >= ARMV7M_EXCP_HARD && irq < ARMV7M_EXCP_PENDSV);
568
569 if (irq == ARMV7M_EXCP_DEBUG &&
570 exc_group_prio(s, vec->prio, secure) >= nvic_exec_prio(s)) {
571 /* DebugMonitorFault, but its priority is lower than the
572 * preempted exception priority: just ignore it.
573 */
574 return;
575 }
576
577 if (irq == ARMV7M_EXCP_HARD && vec->prio >= s->vectpending_prio) {
578 /* If this is a terminal exception (one which means we cannot
579 * take the original exception, like a failure to read its
580 * vector table entry), then we must take the derived exception.
581 * If the derived exception can't take priority over the
582 * original exception, then we go into Lockup.
583 *
584 * For QEMU, we rely on the fact that a derived exception is
585 * terminal if and only if it's reported to us as HardFault,
586 * which saves having to have an extra argument is_terminal
587 * that we'd only use in one place.
588 */
589 cpu_abort(&s->cpu->parent_obj,
590 "Lockup: can't take terminal derived exception "
591 "(original exception priority %d)\n",
592 s->vectpending_prio);
593 }
594 /* We now continue with the same code as for a normal pending
595 * exception, which will cause us to pend the derived exception.
596 * We'll then take either the original or the derived exception
597 * based on which is higher priority by the usual mechanism
598 * for selecting the highest priority pending interrupt.
599 */
600 }
601
602 if (irq >= ARMV7M_EXCP_HARD && irq < ARMV7M_EXCP_PENDSV) {
603 /* If a synchronous exception is pending then it may be
604 * escalated to HardFault if:
605 * * it is equal or lower priority to current execution
606 * * it is disabled
607 * (ie we need to take it immediately but we can't do so).
608 * Asynchronous exceptions (and interrupts) simply remain pending.
609 *
610 * For QEMU, we don't have any imprecise (asynchronous) faults,
611 * so we can assume that PREFETCH_ABORT and DATA_ABORT are always
612 * synchronous.
613 * Debug exceptions are awkward because only Debug exceptions
614 * resulting from the BKPT instruction should be escalated,
615 * but we don't currently implement any Debug exceptions other
616 * than those that result from BKPT, so we treat all debug exceptions
617 * as needing escalation.
618 *
619 * This all means we can identify whether to escalate based only on
620 * the exception number and don't (yet) need the caller to explicitly
621 * tell us whether this exception is synchronous or not.
622 */
623 int running = nvic_exec_prio(s);
624 bool escalate = false;
625
626 if (exc_group_prio(s, vec->prio, secure) >= running) {
627 trace_nvic_escalate_prio(irq, vec->prio, running);
628 escalate = true;
629 } else if (!vec->enabled) {
630 trace_nvic_escalate_disabled(irq);
631 escalate = true;
632 }
633
634 if (escalate) {
635
636 /* We need to escalate this exception to a synchronous HardFault.
637 * If BFHFNMINS is set then we escalate to the banked HF for
638 * the target security state of the original exception; otherwise
639 * we take a Secure HardFault.
640 */
641 irq = ARMV7M_EXCP_HARD;
642 if (arm_feature(&s->cpu->env, ARM_FEATURE_M_SECURITY) &&
643 (targets_secure ||
644 !(s->cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK))) {
645 vec = &s->sec_vectors[irq];
646 } else {
647 vec = &s->vectors[irq];
648 }
649 if (running <= vec->prio) {
650 /* We want to escalate to HardFault but we can't take the
651 * synchronous HardFault at this point either. This is a
652 * Lockup condition due to a guest bug. We don't model
653 * Lockup, so report via cpu_abort() instead.
654 */
655 cpu_abort(&s->cpu->parent_obj,
656 "Lockup: can't escalate %d to HardFault "
657 "(current priority %d)\n", irq, running);
658 }
659
660 /* HF may be banked but there is only one shared HFSR */
661 s->cpu->env.v7m.hfsr |= R_V7M_HFSR_FORCED_MASK;
662 }
663 }
664
665 if (!vec->pending) {
666 vec->pending = 1;
667 nvic_irq_update(s);
668 }
669 }
670
671 void armv7m_nvic_set_pending(void *opaque, int irq, bool secure)
672 {
673 do_armv7m_nvic_set_pending(opaque, irq, secure, false);
674 }
675
676 void armv7m_nvic_set_pending_derived(void *opaque, int irq, bool secure)
677 {
678 do_armv7m_nvic_set_pending(opaque, irq, secure, true);
679 }
680
681 void armv7m_nvic_set_pending_lazyfp(void *opaque, int irq, bool secure)
682 {
683 /*
684 * Pend an exception during lazy FP stacking. This differs
685 * from the usual exception pending because the logic for
686 * whether we should escalate depends on the saved context
687 * in the FPCCR register, not on the current state of the CPU/NVIC.
688 */
689 NVICState *s = (NVICState *)opaque;
690 bool banked = exc_is_banked(irq);
691 VecInfo *vec;
692 bool targets_secure;
693 bool escalate = false;
694 /*
695 * We will only look at bits in fpccr if this is a banked exception
696 * (in which case 'secure' tells us whether it is the S or NS version).
697 * All the bits for the non-banked exceptions are in fpccr_s.
698 */
699 uint32_t fpccr_s = s->cpu->env.v7m.fpccr[M_REG_S];
700 uint32_t fpccr = s->cpu->env.v7m.fpccr[secure];
701
702 assert(irq > ARMV7M_EXCP_RESET && irq < s->num_irq);
703 assert(!secure || banked);
704
705 vec = (banked && secure) ? &s->sec_vectors[irq] : &s->vectors[irq];
706
707 targets_secure = banked ? secure : exc_targets_secure(s, irq);
708
709 switch (irq) {
710 case ARMV7M_EXCP_DEBUG:
711 if (!(fpccr_s & R_V7M_FPCCR_MONRDY_MASK)) {
712 /* Ignore DebugMonitor exception */
713 return;
714 }
715 break;
716 case ARMV7M_EXCP_MEM:
717 escalate = !(fpccr & R_V7M_FPCCR_MMRDY_MASK);
718 break;
719 case ARMV7M_EXCP_USAGE:
720 escalate = !(fpccr & R_V7M_FPCCR_UFRDY_MASK);
721 break;
722 case ARMV7M_EXCP_BUS:
723 escalate = !(fpccr_s & R_V7M_FPCCR_BFRDY_MASK);
724 break;
725 case ARMV7M_EXCP_SECURE:
726 escalate = !(fpccr_s & R_V7M_FPCCR_SFRDY_MASK);
727 break;
728 default:
729 g_assert_not_reached();
730 }
731
732 if (escalate) {
733 /*
734 * Escalate to HardFault: faults that initially targeted Secure
735 * continue to do so, even if HF normally targets NonSecure.
736 */
737 irq = ARMV7M_EXCP_HARD;
738 if (arm_feature(&s->cpu->env, ARM_FEATURE_M_SECURITY) &&
739 (targets_secure ||
740 !(s->cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK))) {
741 vec = &s->sec_vectors[irq];
742 } else {
743 vec = &s->vectors[irq];
744 }
745 }
746
747 if (!vec->enabled ||
748 nvic_exec_prio(s) <= exc_group_prio(s, vec->prio, secure)) {
749 if (!(fpccr_s & R_V7M_FPCCR_HFRDY_MASK)) {
750 /*
751 * We want to escalate to HardFault but the context the
752 * FP state belongs to prevents the exception pre-empting.
753 */
754 cpu_abort(&s->cpu->parent_obj,
755 "Lockup: can't escalate to HardFault during "
756 "lazy FP register stacking\n");
757 }
758 }
759
760 if (escalate) {
761 s->cpu->env.v7m.hfsr |= R_V7M_HFSR_FORCED_MASK;
762 }
763 if (!vec->pending) {
764 vec->pending = 1;
765 /*
766 * We do not call nvic_irq_update(), because we know our caller
767 * is going to handle causing us to take the exception by
768 * raising EXCP_LAZYFP, so raising the IRQ line would be
769 * pointless extra work. We just need to recompute the
770 * priorities so that armv7m_nvic_can_take_pending_exception()
771 * returns the right answer.
772 */
773 nvic_recompute_state(s);
774 }
775 }
776
777 /* Make pending IRQ active. */
778 void armv7m_nvic_acknowledge_irq(void *opaque)
779 {
780 NVICState *s = (NVICState *)opaque;
781 CPUARMState *env = &s->cpu->env;
782 const int pending = s->vectpending;
783 const int running = nvic_exec_prio(s);
784 VecInfo *vec;
785
786 assert(pending > ARMV7M_EXCP_RESET && pending < s->num_irq);
787
788 if (s->vectpending_is_s_banked) {
789 vec = &s->sec_vectors[pending];
790 } else {
791 vec = &s->vectors[pending];
792 }
793
794 assert(vec->enabled);
795 assert(vec->pending);
796
797 assert(s->vectpending_prio < running);
798
799 trace_nvic_acknowledge_irq(pending, s->vectpending_prio);
800
801 vec->active = 1;
802 vec->pending = 0;
803
804 write_v7m_exception(env, s->vectpending);
805
806 nvic_irq_update(s);
807 }
808
809 void armv7m_nvic_get_pending_irq_info(void *opaque,
810 int *pirq, bool *ptargets_secure)
811 {
812 NVICState *s = (NVICState *)opaque;
813 const int pending = s->vectpending;
814 bool targets_secure;
815
816 assert(pending > ARMV7M_EXCP_RESET && pending < s->num_irq);
817
818 if (s->vectpending_is_s_banked) {
819 targets_secure = true;
820 } else {
821 targets_secure = !exc_is_banked(pending) &&
822 exc_targets_secure(s, pending);
823 }
824
825 trace_nvic_get_pending_irq_info(pending, targets_secure);
826
827 *ptargets_secure = targets_secure;
828 *pirq = pending;
829 }
830
831 int armv7m_nvic_complete_irq(void *opaque, int irq, bool secure)
832 {
833 NVICState *s = (NVICState *)opaque;
834 VecInfo *vec = NULL;
835 int ret;
836
837 assert(irq > ARMV7M_EXCP_RESET && irq < s->num_irq);
838
839 /*
840 * For negative priorities, v8M will forcibly deactivate the appropriate
841 * NMI or HardFault regardless of what interrupt we're being asked to
842 * deactivate (compare the DeActivate() pseudocode). This is a guard
843 * against software returning from NMI or HardFault with a corrupted
844 * IPSR and leaving the CPU in a negative-priority state.
845 * v7M does not do this, but simply deactivates the requested interrupt.
846 */
847 if (arm_feature(&s->cpu->env, ARM_FEATURE_V8)) {
848 switch (armv7m_nvic_raw_execution_priority(s)) {
849 case -1:
850 if (s->cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK) {
851 vec = &s->vectors[ARMV7M_EXCP_HARD];
852 } else {
853 vec = &s->sec_vectors[ARMV7M_EXCP_HARD];
854 }
855 break;
856 case -2:
857 vec = &s->vectors[ARMV7M_EXCP_NMI];
858 break;
859 case -3:
860 vec = &s->sec_vectors[ARMV7M_EXCP_HARD];
861 break;
862 default:
863 break;
864 }
865 }
866
867 if (!vec) {
868 if (secure && exc_is_banked(irq)) {
869 vec = &s->sec_vectors[irq];
870 } else {
871 vec = &s->vectors[irq];
872 }
873 }
874
875 trace_nvic_complete_irq(irq, secure);
876
877 if (!vec->active) {
878 /* Tell the caller this was an illegal exception return */
879 return -1;
880 }
881
882 /*
883 * If this is a configurable exception and it is currently
884 * targeting the opposite security state from the one we're trying
885 * to complete it for, this counts as an illegal exception return.
886 * We still need to deactivate whatever vector the logic above has
887 * selected, though, as it might not be the same as the one for the
888 * requested exception number.
889 */
890 if (!exc_is_banked(irq) && exc_targets_secure(s, irq) != secure) {
891 ret = -1;
892 } else {
893 ret = nvic_rettobase(s);
894 }
895
896 vec->active = 0;
897 if (vec->level) {
898 /* Re-pend the exception if it's still held high; only
899 * happens for extenal IRQs
900 */
901 assert(irq >= NVIC_FIRST_IRQ);
902 vec->pending = 1;
903 }
904
905 nvic_irq_update(s);
906
907 return ret;
908 }
909
910 bool armv7m_nvic_get_ready_status(void *opaque, int irq, bool secure)
911 {
912 /*
913 * Return whether an exception is "ready", i.e. it is enabled and is
914 * configured at a priority which would allow it to interrupt the
915 * current execution priority.
916 *
917 * irq and secure have the same semantics as for armv7m_nvic_set_pending():
918 * for non-banked exceptions secure is always false; for banked exceptions
919 * it indicates which of the exceptions is required.
920 */
921 NVICState *s = (NVICState *)opaque;
922 bool banked = exc_is_banked(irq);
923 VecInfo *vec;
924 int running = nvic_exec_prio(s);
925
926 assert(irq > ARMV7M_EXCP_RESET && irq < s->num_irq);
927 assert(!secure || banked);
928
929 /*
930 * HardFault is an odd special case: we always check against -1,
931 * even if we're secure and HardFault has priority -3; we never
932 * need to check for enabled state.
933 */
934 if (irq == ARMV7M_EXCP_HARD) {
935 return running > -1;
936 }
937
938 vec = (banked && secure) ? &s->sec_vectors[irq] : &s->vectors[irq];
939
940 return vec->enabled &&
941 exc_group_prio(s, vec->prio, secure) < running;
942 }
943
944 /* callback when external interrupt line is changed */
945 static void set_irq_level(void *opaque, int n, int level)
946 {
947 NVICState *s = opaque;
948 VecInfo *vec;
949
950 n += NVIC_FIRST_IRQ;
951
952 assert(n >= NVIC_FIRST_IRQ && n < s->num_irq);
953
954 trace_nvic_set_irq_level(n, level);
955
956 /* The pending status of an external interrupt is
957 * latched on rising edge and exception handler return.
958 *
959 * Pulsing the IRQ will always run the handler
960 * once, and the handler will re-run until the
961 * level is low when the handler completes.
962 */
963 vec = &s->vectors[n];
964 if (level != vec->level) {
965 vec->level = level;
966 if (level) {
967 armv7m_nvic_set_pending(s, n, false);
968 }
969 }
970 }
971
972 /* callback when external NMI line is changed */
973 static void nvic_nmi_trigger(void *opaque, int n, int level)
974 {
975 NVICState *s = opaque;
976
977 trace_nvic_set_nmi_level(level);
978
979 /*
980 * The architecture doesn't specify whether NMI should share
981 * the normal-interrupt behaviour of being resampled on
982 * exception handler return. We choose not to, so just
983 * set NMI pending here and don't track the current level.
984 */
985 if (level) {
986 armv7m_nvic_set_pending(s, ARMV7M_EXCP_NMI, false);
987 }
988 }
989
990 static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
991 {
992 ARMCPU *cpu = s->cpu;
993 uint32_t val;
994
995 switch (offset) {
996 case 4: /* Interrupt Control Type. */
997 if (!arm_feature(&cpu->env, ARM_FEATURE_V7)) {
998 goto bad_offset;
999 }
1000 return ((s->num_irq - NVIC_FIRST_IRQ) / 32) - 1;
1001 case 0xc: /* CPPWR */
1002 if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1003 goto bad_offset;
1004 }
1005 /* We make the IMPDEF choice that nothing can ever go into a
1006 * non-retentive power state, which allows us to RAZ/WI this.
1007 */
1008 return 0;
1009 case 0x380 ... 0x3bf: /* NVIC_ITNS<n> */
1010 {
1011 int startvec = 8 * (offset - 0x380) + NVIC_FIRST_IRQ;
1012 int i;
1013
1014 if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1015 goto bad_offset;
1016 }
1017 if (!attrs.secure) {
1018 return 0;
1019 }
1020 val = 0;
1021 for (i = 0; i < 32 && startvec + i < s->num_irq; i++) {
1022 if (s->itns[startvec + i]) {
1023 val |= (1 << i);
1024 }
1025 }
1026 return val;
1027 }
1028 case 0xd00: /* CPUID Base. */
1029 return cpu->midr;
1030 case 0xd04: /* Interrupt Control State (ICSR) */
1031 /* VECTACTIVE */
1032 val = cpu->env.v7m.exception;
1033 /* VECTPENDING */
1034 val |= (s->vectpending & 0xff) << 12;
1035 /* ISRPENDING - set if any external IRQ is pending */
1036 if (nvic_isrpending(s)) {
1037 val |= (1 << 22);
1038 }
1039 /* RETTOBASE - set if only one handler is active */
1040 if (nvic_rettobase(s)) {
1041 val |= (1 << 11);
1042 }
1043 if (attrs.secure) {
1044 /* PENDSTSET */
1045 if (s->sec_vectors[ARMV7M_EXCP_SYSTICK].pending) {
1046 val |= (1 << 26);
1047 }
1048 /* PENDSVSET */
1049 if (s->sec_vectors[ARMV7M_EXCP_PENDSV].pending) {
1050 val |= (1 << 28);
1051 }
1052 } else {
1053 /* PENDSTSET */
1054 if (s->vectors[ARMV7M_EXCP_SYSTICK].pending) {
1055 val |= (1 << 26);
1056 }
1057 /* PENDSVSET */
1058 if (s->vectors[ARMV7M_EXCP_PENDSV].pending) {
1059 val |= (1 << 28);
1060 }
1061 }
1062 /* NMIPENDSET */
1063 if ((attrs.secure || (cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK))
1064 && s->vectors[ARMV7M_EXCP_NMI].pending) {
1065 val |= (1 << 31);
1066 }
1067 /* ISRPREEMPT: RES0 when halting debug not implemented */
1068 /* STTNS: RES0 for the Main Extension */
1069 return val;
1070 case 0xd08: /* Vector Table Offset. */
1071 return cpu->env.v7m.vecbase[attrs.secure];
1072 case 0xd0c: /* Application Interrupt/Reset Control (AIRCR) */
1073 val = 0xfa050000 | (s->prigroup[attrs.secure] << 8);
1074 if (attrs.secure) {
1075 /* s->aircr stores PRIS, BFHFNMINS, SYSRESETREQS */
1076 val |= cpu->env.v7m.aircr;
1077 } else {
1078 if (arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1079 /* BFHFNMINS is R/O from NS; other bits are RAZ/WI. If
1080 * security isn't supported then BFHFNMINS is RAO (and
1081 * the bit in env.v7m.aircr is always set).
1082 */
1083 val |= cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK;
1084 }
1085 }
1086 return val;
1087 case 0xd10: /* System Control. */
1088 if (!arm_feature(&cpu->env, ARM_FEATURE_V7)) {
1089 goto bad_offset;
1090 }
1091 return cpu->env.v7m.scr[attrs.secure];
1092 case 0xd14: /* Configuration Control. */
1093 /* The BFHFNMIGN bit is the only non-banked bit; we
1094 * keep it in the non-secure copy of the register.
1095 */
1096 val = cpu->env.v7m.ccr[attrs.secure];
1097 val |= cpu->env.v7m.ccr[M_REG_NS] & R_V7M_CCR_BFHFNMIGN_MASK;
1098 return val;
1099 case 0xd24: /* System Handler Control and State (SHCSR) */
1100 if (!arm_feature(&cpu->env, ARM_FEATURE_V7)) {
1101 goto bad_offset;
1102 }
1103 val = 0;
1104 if (attrs.secure) {
1105 if (s->sec_vectors[ARMV7M_EXCP_MEM].active) {
1106 val |= (1 << 0);
1107 }
1108 if (s->sec_vectors[ARMV7M_EXCP_HARD].active) {
1109 val |= (1 << 2);
1110 }
1111 if (s->sec_vectors[ARMV7M_EXCP_USAGE].active) {
1112 val |= (1 << 3);
1113 }
1114 if (s->sec_vectors[ARMV7M_EXCP_SVC].active) {
1115 val |= (1 << 7);
1116 }
1117 if (s->sec_vectors[ARMV7M_EXCP_PENDSV].active) {
1118 val |= (1 << 10);
1119 }
1120 if (s->sec_vectors[ARMV7M_EXCP_SYSTICK].active) {
1121 val |= (1 << 11);
1122 }
1123 if (s->sec_vectors[ARMV7M_EXCP_USAGE].pending) {
1124 val |= (1 << 12);
1125 }
1126 if (s->sec_vectors[ARMV7M_EXCP_MEM].pending) {
1127 val |= (1 << 13);
1128 }
1129 if (s->sec_vectors[ARMV7M_EXCP_SVC].pending) {
1130 val |= (1 << 15);
1131 }
1132 if (s->sec_vectors[ARMV7M_EXCP_MEM].enabled) {
1133 val |= (1 << 16);
1134 }
1135 if (s->sec_vectors[ARMV7M_EXCP_USAGE].enabled) {
1136 val |= (1 << 18);
1137 }
1138 if (s->sec_vectors[ARMV7M_EXCP_HARD].pending) {
1139 val |= (1 << 21);
1140 }
1141 /* SecureFault is not banked but is always RAZ/WI to NS */
1142 if (s->vectors[ARMV7M_EXCP_SECURE].active) {
1143 val |= (1 << 4);
1144 }
1145 if (s->vectors[ARMV7M_EXCP_SECURE].enabled) {
1146 val |= (1 << 19);
1147 }
1148 if (s->vectors[ARMV7M_EXCP_SECURE].pending) {
1149 val |= (1 << 20);
1150 }
1151 } else {
1152 if (s->vectors[ARMV7M_EXCP_MEM].active) {
1153 val |= (1 << 0);
1154 }
1155 if (arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1156 /* HARDFAULTACT, HARDFAULTPENDED not present in v7M */
1157 if (s->vectors[ARMV7M_EXCP_HARD].active) {
1158 val |= (1 << 2);
1159 }
1160 if (s->vectors[ARMV7M_EXCP_HARD].pending) {
1161 val |= (1 << 21);
1162 }
1163 }
1164 if (s->vectors[ARMV7M_EXCP_USAGE].active) {
1165 val |= (1 << 3);
1166 }
1167 if (s->vectors[ARMV7M_EXCP_SVC].active) {
1168 val |= (1 << 7);
1169 }
1170 if (s->vectors[ARMV7M_EXCP_PENDSV].active) {
1171 val |= (1 << 10);
1172 }
1173 if (s->vectors[ARMV7M_EXCP_SYSTICK].active) {
1174 val |= (1 << 11);
1175 }
1176 if (s->vectors[ARMV7M_EXCP_USAGE].pending) {
1177 val |= (1 << 12);
1178 }
1179 if (s->vectors[ARMV7M_EXCP_MEM].pending) {
1180 val |= (1 << 13);
1181 }
1182 if (s->vectors[ARMV7M_EXCP_SVC].pending) {
1183 val |= (1 << 15);
1184 }
1185 if (s->vectors[ARMV7M_EXCP_MEM].enabled) {
1186 val |= (1 << 16);
1187 }
1188 if (s->vectors[ARMV7M_EXCP_USAGE].enabled) {
1189 val |= (1 << 18);
1190 }
1191 }
1192 if (attrs.secure || (cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK)) {
1193 if (s->vectors[ARMV7M_EXCP_BUS].active) {
1194 val |= (1 << 1);
1195 }
1196 if (s->vectors[ARMV7M_EXCP_BUS].pending) {
1197 val |= (1 << 14);
1198 }
1199 if (s->vectors[ARMV7M_EXCP_BUS].enabled) {
1200 val |= (1 << 17);
1201 }
1202 if (arm_feature(&cpu->env, ARM_FEATURE_V8) &&
1203 s->vectors[ARMV7M_EXCP_NMI].active) {
1204 /* NMIACT is not present in v7M */
1205 val |= (1 << 5);
1206 }
1207 }
1208
1209 /* TODO: this is RAZ/WI from NS if DEMCR.SDME is set */
1210 if (s->vectors[ARMV7M_EXCP_DEBUG].active) {
1211 val |= (1 << 8);
1212 }
1213 return val;
1214 case 0xd2c: /* Hard Fault Status. */
1215 if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
1216 goto bad_offset;
1217 }
1218 return cpu->env.v7m.hfsr;
1219 case 0xd30: /* Debug Fault Status. */
1220 return cpu->env.v7m.dfsr;
1221 case 0xd34: /* MMFAR MemManage Fault Address */
1222 if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
1223 goto bad_offset;
1224 }
1225 return cpu->env.v7m.mmfar[attrs.secure];
1226 case 0xd38: /* Bus Fault Address. */
1227 if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
1228 goto bad_offset;
1229 }
1230 if (!attrs.secure &&
1231 !(s->cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK)) {
1232 return 0;
1233 }
1234 return cpu->env.v7m.bfar;
1235 case 0xd3c: /* Aux Fault Status. */
1236 /* TODO: Implement fault status registers. */
1237 qemu_log_mask(LOG_UNIMP,
1238 "Aux Fault status registers unimplemented\n");
1239 return 0;
1240 case 0xd40: /* PFR0. */
1241 return cpu->id_pfr0;
1242 case 0xd44: /* PFR1. */
1243 return cpu->id_pfr1;
1244 case 0xd48: /* DFR0. */
1245 return cpu->isar.id_dfr0;
1246 case 0xd4c: /* AFR0. */
1247 return cpu->id_afr0;
1248 case 0xd50: /* MMFR0. */
1249 return cpu->isar.id_mmfr0;
1250 case 0xd54: /* MMFR1. */
1251 return cpu->isar.id_mmfr1;
1252 case 0xd58: /* MMFR2. */
1253 return cpu->isar.id_mmfr2;
1254 case 0xd5c: /* MMFR3. */
1255 return cpu->isar.id_mmfr3;
1256 case 0xd60: /* ISAR0. */
1257 return cpu->isar.id_isar0;
1258 case 0xd64: /* ISAR1. */
1259 return cpu->isar.id_isar1;
1260 case 0xd68: /* ISAR2. */
1261 return cpu->isar.id_isar2;
1262 case 0xd6c: /* ISAR3. */
1263 return cpu->isar.id_isar3;
1264 case 0xd70: /* ISAR4. */
1265 return cpu->isar.id_isar4;
1266 case 0xd74: /* ISAR5. */
1267 return cpu->isar.id_isar5;
1268 case 0xd78: /* CLIDR */
1269 return cpu->clidr;
1270 case 0xd7c: /* CTR */
1271 return cpu->ctr;
1272 case 0xd80: /* CSSIDR */
1273 {
1274 int idx = cpu->env.v7m.csselr[attrs.secure] & R_V7M_CSSELR_INDEX_MASK;
1275 return cpu->ccsidr[idx];
1276 }
1277 case 0xd84: /* CSSELR */
1278 return cpu->env.v7m.csselr[attrs.secure];
1279 case 0xd88: /* CPACR */
1280 if (!cpu_isar_feature(aa32_vfp_simd, cpu)) {
1281 return 0;
1282 }
1283 return cpu->env.v7m.cpacr[attrs.secure];
1284 case 0xd8c: /* NSACR */
1285 if (!attrs.secure || !cpu_isar_feature(aa32_vfp_simd, cpu)) {
1286 return 0;
1287 }
1288 return cpu->env.v7m.nsacr;
1289 /* TODO: Implement debug registers. */
1290 case 0xd90: /* MPU_TYPE */
1291 /* Unified MPU; if the MPU is not present this value is zero */
1292 return cpu->pmsav7_dregion << 8;
1293 break;
1294 case 0xd94: /* MPU_CTRL */
1295 return cpu->env.v7m.mpu_ctrl[attrs.secure];
1296 case 0xd98: /* MPU_RNR */
1297 return cpu->env.pmsav7.rnr[attrs.secure];
1298 case 0xd9c: /* MPU_RBAR */
1299 case 0xda4: /* MPU_RBAR_A1 */
1300 case 0xdac: /* MPU_RBAR_A2 */
1301 case 0xdb4: /* MPU_RBAR_A3 */
1302 {
1303 int region = cpu->env.pmsav7.rnr[attrs.secure];
1304
1305 if (arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1306 /* PMSAv8M handling of the aliases is different from v7M:
1307 * aliases A1, A2, A3 override the low two bits of the region
1308 * number in MPU_RNR, and there is no 'region' field in the
1309 * RBAR register.
1310 */
1311 int aliasno = (offset - 0xd9c) / 8; /* 0..3 */
1312 if (aliasno) {
1313 region = deposit32(region, 0, 2, aliasno);
1314 }
1315 if (region >= cpu->pmsav7_dregion) {
1316 return 0;
1317 }
1318 return cpu->env.pmsav8.rbar[attrs.secure][region];
1319 }
1320
1321 if (region >= cpu->pmsav7_dregion) {
1322 return 0;
1323 }
1324 return (cpu->env.pmsav7.drbar[region] & ~0x1f) | (region & 0xf);
1325 }
1326 case 0xda0: /* MPU_RASR (v7M), MPU_RLAR (v8M) */
1327 case 0xda8: /* MPU_RASR_A1 (v7M), MPU_RLAR_A1 (v8M) */
1328 case 0xdb0: /* MPU_RASR_A2 (v7M), MPU_RLAR_A2 (v8M) */
1329 case 0xdb8: /* MPU_RASR_A3 (v7M), MPU_RLAR_A3 (v8M) */
1330 {
1331 int region = cpu->env.pmsav7.rnr[attrs.secure];
1332
1333 if (arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1334 /* PMSAv8M handling of the aliases is different from v7M:
1335 * aliases A1, A2, A3 override the low two bits of the region
1336 * number in MPU_RNR.
1337 */
1338 int aliasno = (offset - 0xda0) / 8; /* 0..3 */
1339 if (aliasno) {
1340 region = deposit32(region, 0, 2, aliasno);
1341 }
1342 if (region >= cpu->pmsav7_dregion) {
1343 return 0;
1344 }
1345 return cpu->env.pmsav8.rlar[attrs.secure][region];
1346 }
1347
1348 if (region >= cpu->pmsav7_dregion) {
1349 return 0;
1350 }
1351 return ((cpu->env.pmsav7.dracr[region] & 0xffff) << 16) |
1352 (cpu->env.pmsav7.drsr[region] & 0xffff);
1353 }
1354 case 0xdc0: /* MPU_MAIR0 */
1355 if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1356 goto bad_offset;
1357 }
1358 return cpu->env.pmsav8.mair0[attrs.secure];
1359 case 0xdc4: /* MPU_MAIR1 */
1360 if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1361 goto bad_offset;
1362 }
1363 return cpu->env.pmsav8.mair1[attrs.secure];
1364 case 0xdd0: /* SAU_CTRL */
1365 if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1366 goto bad_offset;
1367 }
1368 if (!attrs.secure) {
1369 return 0;
1370 }
1371 return cpu->env.sau.ctrl;
1372 case 0xdd4: /* SAU_TYPE */
1373 if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1374 goto bad_offset;
1375 }
1376 if (!attrs.secure) {
1377 return 0;
1378 }
1379 return cpu->sau_sregion;
1380 case 0xdd8: /* SAU_RNR */
1381 if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1382 goto bad_offset;
1383 }
1384 if (!attrs.secure) {
1385 return 0;
1386 }
1387 return cpu->env.sau.rnr;
1388 case 0xddc: /* SAU_RBAR */
1389 {
1390 int region = cpu->env.sau.rnr;
1391
1392 if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1393 goto bad_offset;
1394 }
1395 if (!attrs.secure) {
1396 return 0;
1397 }
1398 if (region >= cpu->sau_sregion) {
1399 return 0;
1400 }
1401 return cpu->env.sau.rbar[region];
1402 }
1403 case 0xde0: /* SAU_RLAR */
1404 {
1405 int region = cpu->env.sau.rnr;
1406
1407 if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1408 goto bad_offset;
1409 }
1410 if (!attrs.secure) {
1411 return 0;
1412 }
1413 if (region >= cpu->sau_sregion) {
1414 return 0;
1415 }
1416 return cpu->env.sau.rlar[region];
1417 }
1418 case 0xde4: /* SFSR */
1419 if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1420 goto bad_offset;
1421 }
1422 if (!attrs.secure) {
1423 return 0;
1424 }
1425 return cpu->env.v7m.sfsr;
1426 case 0xde8: /* SFAR */
1427 if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1428 goto bad_offset;
1429 }
1430 if (!attrs.secure) {
1431 return 0;
1432 }
1433 return cpu->env.v7m.sfar;
1434 case 0xf34: /* FPCCR */
1435 if (!cpu_isar_feature(aa32_vfp_simd, cpu)) {
1436 return 0;
1437 }
1438 if (attrs.secure) {
1439 return cpu->env.v7m.fpccr[M_REG_S];
1440 } else {
1441 /*
1442 * NS can read LSPEN, CLRONRET and MONRDY. It can read
1443 * BFRDY and HFRDY if AIRCR.BFHFNMINS != 0;
1444 * other non-banked bits RAZ.
1445 * TODO: MONRDY should RAZ/WI if DEMCR.SDME is set.
1446 */
1447 uint32_t value = cpu->env.v7m.fpccr[M_REG_S];
1448 uint32_t mask = R_V7M_FPCCR_LSPEN_MASK |
1449 R_V7M_FPCCR_CLRONRET_MASK |
1450 R_V7M_FPCCR_MONRDY_MASK;
1451
1452 if (s->cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK) {
1453 mask |= R_V7M_FPCCR_BFRDY_MASK | R_V7M_FPCCR_HFRDY_MASK;
1454 }
1455
1456 value &= mask;
1457
1458 value |= cpu->env.v7m.fpccr[M_REG_NS];
1459 return value;
1460 }
1461 case 0xf38: /* FPCAR */
1462 if (!cpu_isar_feature(aa32_vfp_simd, cpu)) {
1463 return 0;
1464 }
1465 return cpu->env.v7m.fpcar[attrs.secure];
1466 case 0xf3c: /* FPDSCR */
1467 if (!cpu_isar_feature(aa32_vfp_simd, cpu)) {
1468 return 0;
1469 }
1470 return cpu->env.v7m.fpdscr[attrs.secure];
1471 case 0xf40: /* MVFR0 */
1472 return cpu->isar.mvfr0;
1473 case 0xf44: /* MVFR1 */
1474 return cpu->isar.mvfr1;
1475 case 0xf48: /* MVFR2 */
1476 return cpu->isar.mvfr2;
1477 default:
1478 bad_offset:
1479 qemu_log_mask(LOG_GUEST_ERROR, "NVIC: Bad read offset 0x%x\n", offset);
1480 return 0;
1481 }
1482 }
1483
1484 static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value,
1485 MemTxAttrs attrs)
1486 {
1487 ARMCPU *cpu = s->cpu;
1488
1489 switch (offset) {
1490 case 0xc: /* CPPWR */
1491 if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1492 goto bad_offset;
1493 }
1494 /* Make the IMPDEF choice to RAZ/WI this. */
1495 break;
1496 case 0x380 ... 0x3bf: /* NVIC_ITNS<n> */
1497 {
1498 int startvec = 8 * (offset - 0x380) + NVIC_FIRST_IRQ;
1499 int i;
1500
1501 if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1502 goto bad_offset;
1503 }
1504 if (!attrs.secure) {
1505 break;
1506 }
1507 for (i = 0; i < 32 && startvec + i < s->num_irq; i++) {
1508 s->itns[startvec + i] = (value >> i) & 1;
1509 }
1510 nvic_irq_update(s);
1511 break;
1512 }
1513 case 0xd04: /* Interrupt Control State (ICSR) */
1514 if (attrs.secure || cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK) {
1515 if (value & (1 << 31)) {
1516 armv7m_nvic_set_pending(s, ARMV7M_EXCP_NMI, false);
1517 } else if (value & (1 << 30) &&
1518 arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1519 /* PENDNMICLR didn't exist in v7M */
1520 armv7m_nvic_clear_pending(s, ARMV7M_EXCP_NMI, false);
1521 }
1522 }
1523 if (value & (1 << 28)) {
1524 armv7m_nvic_set_pending(s, ARMV7M_EXCP_PENDSV, attrs.secure);
1525 } else if (value & (1 << 27)) {
1526 armv7m_nvic_clear_pending(s, ARMV7M_EXCP_PENDSV, attrs.secure);
1527 }
1528 if (value & (1 << 26)) {
1529 armv7m_nvic_set_pending(s, ARMV7M_EXCP_SYSTICK, attrs.secure);
1530 } else if (value & (1 << 25)) {
1531 armv7m_nvic_clear_pending(s, ARMV7M_EXCP_SYSTICK, attrs.secure);
1532 }
1533 break;
1534 case 0xd08: /* Vector Table Offset. */
1535 cpu->env.v7m.vecbase[attrs.secure] = value & 0xffffff80;
1536 break;
1537 case 0xd0c: /* Application Interrupt/Reset Control (AIRCR) */
1538 if ((value >> R_V7M_AIRCR_VECTKEY_SHIFT) == 0x05fa) {
1539 if (value & R_V7M_AIRCR_SYSRESETREQ_MASK) {
1540 if (attrs.secure ||
1541 !(cpu->env.v7m.aircr & R_V7M_AIRCR_SYSRESETREQS_MASK)) {
1542 signal_sysresetreq(s);
1543 }
1544 }
1545 if (value & R_V7M_AIRCR_VECTCLRACTIVE_MASK) {
1546 qemu_log_mask(LOG_GUEST_ERROR,
1547 "Setting VECTCLRACTIVE when not in DEBUG mode "
1548 "is UNPREDICTABLE\n");
1549 }
1550 if (value & R_V7M_AIRCR_VECTRESET_MASK) {
1551 /* NB: this bit is RES0 in v8M */
1552 qemu_log_mask(LOG_GUEST_ERROR,
1553 "Setting VECTRESET when not in DEBUG mode "
1554 "is UNPREDICTABLE\n");
1555 }
1556 if (arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
1557 s->prigroup[attrs.secure] =
1558 extract32(value,
1559 R_V7M_AIRCR_PRIGROUP_SHIFT,
1560 R_V7M_AIRCR_PRIGROUP_LENGTH);
1561 }
1562 if (attrs.secure) {
1563 /* These bits are only writable by secure */
1564 cpu->env.v7m.aircr = value &
1565 (R_V7M_AIRCR_SYSRESETREQS_MASK |
1566 R_V7M_AIRCR_BFHFNMINS_MASK |
1567 R_V7M_AIRCR_PRIS_MASK);
1568 /* BFHFNMINS changes the priority of Secure HardFault, and
1569 * allows a pending Non-secure HardFault to preempt (which
1570 * we implement by marking it enabled).
1571 */
1572 if (cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK) {
1573 s->sec_vectors[ARMV7M_EXCP_HARD].prio = -3;
1574 s->vectors[ARMV7M_EXCP_HARD].enabled = 1;
1575 } else {
1576 s->sec_vectors[ARMV7M_EXCP_HARD].prio = -1;
1577 s->vectors[ARMV7M_EXCP_HARD].enabled = 0;
1578 }
1579 }
1580 nvic_irq_update(s);
1581 }
1582 break;
1583 case 0xd10: /* System Control. */
1584 if (!arm_feature(&cpu->env, ARM_FEATURE_V7)) {
1585 goto bad_offset;
1586 }
1587 /* We don't implement deep-sleep so these bits are RAZ/WI.
1588 * The other bits in the register are banked.
1589 * QEMU's implementation ignores SEVONPEND and SLEEPONEXIT, which
1590 * is architecturally permitted.
1591 */
1592 value &= ~(R_V7M_SCR_SLEEPDEEP_MASK | R_V7M_SCR_SLEEPDEEPS_MASK);
1593 cpu->env.v7m.scr[attrs.secure] = value;
1594 break;
1595 case 0xd14: /* Configuration Control. */
1596 if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
1597 goto bad_offset;
1598 }
1599
1600 /* Enforce RAZ/WI on reserved and must-RAZ/WI bits */
1601 value &= (R_V7M_CCR_STKALIGN_MASK |
1602 R_V7M_CCR_BFHFNMIGN_MASK |
1603 R_V7M_CCR_DIV_0_TRP_MASK |
1604 R_V7M_CCR_UNALIGN_TRP_MASK |
1605 R_V7M_CCR_USERSETMPEND_MASK |
1606 R_V7M_CCR_NONBASETHRDENA_MASK);
1607
1608 if (arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1609 /* v8M makes NONBASETHRDENA and STKALIGN be RES1 */
1610 value |= R_V7M_CCR_NONBASETHRDENA_MASK
1611 | R_V7M_CCR_STKALIGN_MASK;
1612 }
1613 if (attrs.secure) {
1614 /* the BFHFNMIGN bit is not banked; keep that in the NS copy */
1615 cpu->env.v7m.ccr[M_REG_NS] =
1616 (cpu->env.v7m.ccr[M_REG_NS] & ~R_V7M_CCR_BFHFNMIGN_MASK)
1617 | (value & R_V7M_CCR_BFHFNMIGN_MASK);
1618 value &= ~R_V7M_CCR_BFHFNMIGN_MASK;
1619 }
1620
1621 cpu->env.v7m.ccr[attrs.secure] = value;
1622 break;
1623 case 0xd24: /* System Handler Control and State (SHCSR) */
1624 if (!arm_feature(&cpu->env, ARM_FEATURE_V7)) {
1625 goto bad_offset;
1626 }
1627 if (attrs.secure) {
1628 s->sec_vectors[ARMV7M_EXCP_MEM].active = (value & (1 << 0)) != 0;
1629 /* Secure HardFault active bit cannot be written */
1630 s->sec_vectors[ARMV7M_EXCP_USAGE].active = (value & (1 << 3)) != 0;
1631 s->sec_vectors[ARMV7M_EXCP_SVC].active = (value & (1 << 7)) != 0;
1632 s->sec_vectors[ARMV7M_EXCP_PENDSV].active =
1633 (value & (1 << 10)) != 0;
1634 s->sec_vectors[ARMV7M_EXCP_SYSTICK].active =
1635 (value & (1 << 11)) != 0;
1636 s->sec_vectors[ARMV7M_EXCP_USAGE].pending =
1637 (value & (1 << 12)) != 0;
1638 s->sec_vectors[ARMV7M_EXCP_MEM].pending = (value & (1 << 13)) != 0;
1639 s->sec_vectors[ARMV7M_EXCP_SVC].pending = (value & (1 << 15)) != 0;
1640 s->sec_vectors[ARMV7M_EXCP_MEM].enabled = (value & (1 << 16)) != 0;
1641 s->sec_vectors[ARMV7M_EXCP_BUS].enabled = (value & (1 << 17)) != 0;
1642 s->sec_vectors[ARMV7M_EXCP_USAGE].enabled =
1643 (value & (1 << 18)) != 0;
1644 s->sec_vectors[ARMV7M_EXCP_HARD].pending = (value & (1 << 21)) != 0;
1645 /* SecureFault not banked, but RAZ/WI to NS */
1646 s->vectors[ARMV7M_EXCP_SECURE].active = (value & (1 << 4)) != 0;
1647 s->vectors[ARMV7M_EXCP_SECURE].enabled = (value & (1 << 19)) != 0;
1648 s->vectors[ARMV7M_EXCP_SECURE].pending = (value & (1 << 20)) != 0;
1649 } else {
1650 s->vectors[ARMV7M_EXCP_MEM].active = (value & (1 << 0)) != 0;
1651 if (arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1652 /* HARDFAULTPENDED is not present in v7M */
1653 s->vectors[ARMV7M_EXCP_HARD].pending = (value & (1 << 21)) != 0;
1654 }
1655 s->vectors[ARMV7M_EXCP_USAGE].active = (value & (1 << 3)) != 0;
1656 s->vectors[ARMV7M_EXCP_SVC].active = (value & (1 << 7)) != 0;
1657 s->vectors[ARMV7M_EXCP_PENDSV].active = (value & (1 << 10)) != 0;
1658 s->vectors[ARMV7M_EXCP_SYSTICK].active = (value & (1 << 11)) != 0;
1659 s->vectors[ARMV7M_EXCP_USAGE].pending = (value & (1 << 12)) != 0;
1660 s->vectors[ARMV7M_EXCP_MEM].pending = (value & (1 << 13)) != 0;
1661 s->vectors[ARMV7M_EXCP_SVC].pending = (value & (1 << 15)) != 0;
1662 s->vectors[ARMV7M_EXCP_MEM].enabled = (value & (1 << 16)) != 0;
1663 s->vectors[ARMV7M_EXCP_USAGE].enabled = (value & (1 << 18)) != 0;
1664 }
1665 if (attrs.secure || (cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK)) {
1666 s->vectors[ARMV7M_EXCP_BUS].active = (value & (1 << 1)) != 0;
1667 s->vectors[ARMV7M_EXCP_BUS].pending = (value & (1 << 14)) != 0;
1668 s->vectors[ARMV7M_EXCP_BUS].enabled = (value & (1 << 17)) != 0;
1669 }
1670 /* NMIACT can only be written if the write is of a zero, with
1671 * BFHFNMINS 1, and by the CPU in secure state via the NS alias.
1672 */
1673 if (!attrs.secure && cpu->env.v7m.secure &&
1674 (cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK) &&
1675 (value & (1 << 5)) == 0) {
1676 s->vectors[ARMV7M_EXCP_NMI].active = 0;
1677 }
1678 /* HARDFAULTACT can only be written if the write is of a zero
1679 * to the non-secure HardFault state by the CPU in secure state.
1680 * The only case where we can be targeting the non-secure HF state
1681 * when in secure state is if this is a write via the NS alias
1682 * and BFHFNMINS is 1.
1683 */
1684 if (!attrs.secure && cpu->env.v7m.secure &&
1685 (cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK) &&
1686 (value & (1 << 2)) == 0) {
1687 s->vectors[ARMV7M_EXCP_HARD].active = 0;
1688 }
1689
1690 /* TODO: this is RAZ/WI from NS if DEMCR.SDME is set */
1691 s->vectors[ARMV7M_EXCP_DEBUG].active = (value & (1 << 8)) != 0;
1692 nvic_irq_update(s);
1693 break;
1694 case 0xd2c: /* Hard Fault Status. */
1695 if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
1696 goto bad_offset;
1697 }
1698 cpu->env.v7m.hfsr &= ~value; /* W1C */
1699 break;
1700 case 0xd30: /* Debug Fault Status. */
1701 cpu->env.v7m.dfsr &= ~value; /* W1C */
1702 break;
1703 case 0xd34: /* Mem Manage Address. */
1704 if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
1705 goto bad_offset;
1706 }
1707 cpu->env.v7m.mmfar[attrs.secure] = value;
1708 return;
1709 case 0xd38: /* Bus Fault Address. */
1710 if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
1711 goto bad_offset;
1712 }
1713 if (!attrs.secure &&
1714 !(s->cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK)) {
1715 return;
1716 }
1717 cpu->env.v7m.bfar = value;
1718 return;
1719 case 0xd3c: /* Aux Fault Status. */
1720 qemu_log_mask(LOG_UNIMP,
1721 "NVIC: Aux fault status registers unimplemented\n");
1722 break;
1723 case 0xd84: /* CSSELR */
1724 if (!arm_v7m_csselr_razwi(cpu)) {
1725 cpu->env.v7m.csselr[attrs.secure] = value & R_V7M_CSSELR_INDEX_MASK;
1726 }
1727 break;
1728 case 0xd88: /* CPACR */
1729 if (cpu_isar_feature(aa32_vfp_simd, cpu)) {
1730 /* We implement only the Floating Point extension's CP10/CP11 */
1731 cpu->env.v7m.cpacr[attrs.secure] = value & (0xf << 20);
1732 }
1733 break;
1734 case 0xd8c: /* NSACR */
1735 if (attrs.secure && cpu_isar_feature(aa32_vfp_simd, cpu)) {
1736 /* We implement only the Floating Point extension's CP10/CP11 */
1737 cpu->env.v7m.nsacr = value & (3 << 10);
1738 }
1739 break;
1740 case 0xd90: /* MPU_TYPE */
1741 return; /* RO */
1742 case 0xd94: /* MPU_CTRL */
1743 if ((value &
1744 (R_V7M_MPU_CTRL_HFNMIENA_MASK | R_V7M_MPU_CTRL_ENABLE_MASK))
1745 == R_V7M_MPU_CTRL_HFNMIENA_MASK) {
1746 qemu_log_mask(LOG_GUEST_ERROR, "MPU_CTRL: HFNMIENA and !ENABLE is "
1747 "UNPREDICTABLE\n");
1748 }
1749 cpu->env.v7m.mpu_ctrl[attrs.secure]
1750 = value & (R_V7M_MPU_CTRL_ENABLE_MASK |
1751 R_V7M_MPU_CTRL_HFNMIENA_MASK |
1752 R_V7M_MPU_CTRL_PRIVDEFENA_MASK);
1753 tlb_flush(CPU(cpu));
1754 break;
1755 case 0xd98: /* MPU_RNR */
1756 if (value >= cpu->pmsav7_dregion) {
1757 qemu_log_mask(LOG_GUEST_ERROR, "MPU region out of range %"
1758 PRIu32 "/%" PRIu32 "\n",
1759 value, cpu->pmsav7_dregion);
1760 } else {
1761 cpu->env.pmsav7.rnr[attrs.secure] = value;
1762 }
1763 break;
1764 case 0xd9c: /* MPU_RBAR */
1765 case 0xda4: /* MPU_RBAR_A1 */
1766 case 0xdac: /* MPU_RBAR_A2 */
1767 case 0xdb4: /* MPU_RBAR_A3 */
1768 {
1769 int region;
1770
1771 if (arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1772 /* PMSAv8M handling of the aliases is different from v7M:
1773 * aliases A1, A2, A3 override the low two bits of the region
1774 * number in MPU_RNR, and there is no 'region' field in the
1775 * RBAR register.
1776 */
1777 int aliasno = (offset - 0xd9c) / 8; /* 0..3 */
1778
1779 region = cpu->env.pmsav7.rnr[attrs.secure];
1780 if (aliasno) {
1781 region = deposit32(region, 0, 2, aliasno);
1782 }
1783 if (region >= cpu->pmsav7_dregion) {
1784 return;
1785 }
1786 cpu->env.pmsav8.rbar[attrs.secure][region] = value;
1787 tlb_flush(CPU(cpu));
1788 return;
1789 }
1790
1791 if (value & (1 << 4)) {
1792 /* VALID bit means use the region number specified in this
1793 * value and also update MPU_RNR.REGION with that value.
1794 */
1795 region = extract32(value, 0, 4);
1796 if (region >= cpu->pmsav7_dregion) {
1797 qemu_log_mask(LOG_GUEST_ERROR,
1798 "MPU region out of range %u/%" PRIu32 "\n",
1799 region, cpu->pmsav7_dregion);
1800 return;
1801 }
1802 cpu->env.pmsav7.rnr[attrs.secure] = region;
1803 } else {
1804 region = cpu->env.pmsav7.rnr[attrs.secure];
1805 }
1806
1807 if (region >= cpu->pmsav7_dregion) {
1808 return;
1809 }
1810
1811 cpu->env.pmsav7.drbar[region] = value & ~0x1f;
1812 tlb_flush(CPU(cpu));
1813 break;
1814 }
1815 case 0xda0: /* MPU_RASR (v7M), MPU_RLAR (v8M) */
1816 case 0xda8: /* MPU_RASR_A1 (v7M), MPU_RLAR_A1 (v8M) */
1817 case 0xdb0: /* MPU_RASR_A2 (v7M), MPU_RLAR_A2 (v8M) */
1818 case 0xdb8: /* MPU_RASR_A3 (v7M), MPU_RLAR_A3 (v8M) */
1819 {
1820 int region = cpu->env.pmsav7.rnr[attrs.secure];
1821
1822 if (arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1823 /* PMSAv8M handling of the aliases is different from v7M:
1824 * aliases A1, A2, A3 override the low two bits of the region
1825 * number in MPU_RNR.
1826 */
1827 int aliasno = (offset - 0xd9c) / 8; /* 0..3 */
1828
1829 region = cpu->env.pmsav7.rnr[attrs.secure];
1830 if (aliasno) {
1831 region = deposit32(region, 0, 2, aliasno);
1832 }
1833 if (region >= cpu->pmsav7_dregion) {
1834 return;
1835 }
1836 cpu->env.pmsav8.rlar[attrs.secure][region] = value;
1837 tlb_flush(CPU(cpu));
1838 return;
1839 }
1840
1841 if (region >= cpu->pmsav7_dregion) {
1842 return;
1843 }
1844
1845 cpu->env.pmsav7.drsr[region] = value & 0xff3f;
1846 cpu->env.pmsav7.dracr[region] = (value >> 16) & 0x173f;
1847 tlb_flush(CPU(cpu));
1848 break;
1849 }
1850 case 0xdc0: /* MPU_MAIR0 */
1851 if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1852 goto bad_offset;
1853 }
1854 if (cpu->pmsav7_dregion) {
1855 /* Register is RES0 if no MPU regions are implemented */
1856 cpu->env.pmsav8.mair0[attrs.secure] = value;
1857 }
1858 /* We don't need to do anything else because memory attributes
1859 * only affect cacheability, and we don't implement caching.
1860 */
1861 break;
1862 case 0xdc4: /* MPU_MAIR1 */
1863 if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1864 goto bad_offset;
1865 }
1866 if (cpu->pmsav7_dregion) {
1867 /* Register is RES0 if no MPU regions are implemented */
1868 cpu->env.pmsav8.mair1[attrs.secure] = value;
1869 }
1870 /* We don't need to do anything else because memory attributes
1871 * only affect cacheability, and we don't implement caching.
1872 */
1873 break;
1874 case 0xdd0: /* SAU_CTRL */
1875 if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1876 goto bad_offset;
1877 }
1878 if (!attrs.secure) {
1879 return;
1880 }
1881 cpu->env.sau.ctrl = value & 3;
1882 break;
1883 case 0xdd4: /* SAU_TYPE */
1884 if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1885 goto bad_offset;
1886 }
1887 break;
1888 case 0xdd8: /* SAU_RNR */
1889 if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1890 goto bad_offset;
1891 }
1892 if (!attrs.secure) {
1893 return;
1894 }
1895 if (value >= cpu->sau_sregion) {
1896 qemu_log_mask(LOG_GUEST_ERROR, "SAU region out of range %"
1897 PRIu32 "/%" PRIu32 "\n",
1898 value, cpu->sau_sregion);
1899 } else {
1900 cpu->env.sau.rnr = value;
1901 }
1902 break;
1903 case 0xddc: /* SAU_RBAR */
1904 {
1905 int region = cpu->env.sau.rnr;
1906
1907 if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1908 goto bad_offset;
1909 }
1910 if (!attrs.secure) {
1911 return;
1912 }
1913 if (region >= cpu->sau_sregion) {
1914 return;
1915 }
1916 cpu->env.sau.rbar[region] = value & ~0x1f;
1917 tlb_flush(CPU(cpu));
1918 break;
1919 }
1920 case 0xde0: /* SAU_RLAR */
1921 {
1922 int region = cpu->env.sau.rnr;
1923
1924 if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1925 goto bad_offset;
1926 }
1927 if (!attrs.secure) {
1928 return;
1929 }
1930 if (region >= cpu->sau_sregion) {
1931 return;
1932 }
1933 cpu->env.sau.rlar[region] = value & ~0x1c;
1934 tlb_flush(CPU(cpu));
1935 break;
1936 }
1937 case 0xde4: /* SFSR */
1938 if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1939 goto bad_offset;
1940 }
1941 if (!attrs.secure) {
1942 return;
1943 }
1944 cpu->env.v7m.sfsr &= ~value; /* W1C */
1945 break;
1946 case 0xde8: /* SFAR */
1947 if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1948 goto bad_offset;
1949 }
1950 if (!attrs.secure) {
1951 return;
1952 }
1953 cpu->env.v7m.sfsr = value;
1954 break;
1955 case 0xf00: /* Software Triggered Interrupt Register */
1956 {
1957 int excnum = (value & 0x1ff) + NVIC_FIRST_IRQ;
1958
1959 if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
1960 goto bad_offset;
1961 }
1962
1963 if (excnum < s->num_irq) {
1964 armv7m_nvic_set_pending(s, excnum, false);
1965 }
1966 break;
1967 }
1968 case 0xf34: /* FPCCR */
1969 if (cpu_isar_feature(aa32_vfp_simd, cpu)) {
1970 /* Not all bits here are banked. */
1971 uint32_t fpccr_s;
1972
1973 if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1974 /* Don't allow setting of bits not present in v7M */
1975 value &= (R_V7M_FPCCR_LSPACT_MASK |
1976 R_V7M_FPCCR_USER_MASK |
1977 R_V7M_FPCCR_THREAD_MASK |
1978 R_V7M_FPCCR_HFRDY_MASK |
1979 R_V7M_FPCCR_MMRDY_MASK |
1980 R_V7M_FPCCR_BFRDY_MASK |
1981 R_V7M_FPCCR_MONRDY_MASK |
1982 R_V7M_FPCCR_LSPEN_MASK |
1983 R_V7M_FPCCR_ASPEN_MASK);
1984 }
1985 value &= ~R_V7M_FPCCR_RES0_MASK;
1986
1987 if (!attrs.secure) {
1988 /* Some non-banked bits are configurably writable by NS */
1989 fpccr_s = cpu->env.v7m.fpccr[M_REG_S];
1990 if (!(fpccr_s & R_V7M_FPCCR_LSPENS_MASK)) {
1991 uint32_t lspen = FIELD_EX32(value, V7M_FPCCR, LSPEN);
1992 fpccr_s = FIELD_DP32(fpccr_s, V7M_FPCCR, LSPEN, lspen);
1993 }
1994 if (!(fpccr_s & R_V7M_FPCCR_CLRONRETS_MASK)) {
1995 uint32_t cor = FIELD_EX32(value, V7M_FPCCR, CLRONRET);
1996 fpccr_s = FIELD_DP32(fpccr_s, V7M_FPCCR, CLRONRET, cor);
1997 }
1998 if ((s->cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK)) {
1999 uint32_t hfrdy = FIELD_EX32(value, V7M_FPCCR, HFRDY);
2000 uint32_t bfrdy = FIELD_EX32(value, V7M_FPCCR, BFRDY);
2001 fpccr_s = FIELD_DP32(fpccr_s, V7M_FPCCR, HFRDY, hfrdy);
2002 fpccr_s = FIELD_DP32(fpccr_s, V7M_FPCCR, BFRDY, bfrdy);
2003 }
2004 /* TODO MONRDY should RAZ/WI if DEMCR.SDME is set */
2005 {
2006 uint32_t monrdy = FIELD_EX32(value, V7M_FPCCR, MONRDY);
2007 fpccr_s = FIELD_DP32(fpccr_s, V7M_FPCCR, MONRDY, monrdy);
2008 }
2009
2010 /*
2011 * All other non-banked bits are RAZ/WI from NS; write
2012 * just the banked bits to fpccr[M_REG_NS].
2013 */
2014 value &= R_V7M_FPCCR_BANKED_MASK;
2015 cpu->env.v7m.fpccr[M_REG_NS] = value;
2016 } else {
2017 fpccr_s = value;
2018 }
2019 cpu->env.v7m.fpccr[M_REG_S] = fpccr_s;
2020 }
2021 break;
2022 case 0xf38: /* FPCAR */
2023 if (cpu_isar_feature(aa32_vfp_simd, cpu)) {
2024 value &= ~7;
2025 cpu->env.v7m.fpcar[attrs.secure] = value;
2026 }
2027 break;
2028 case 0xf3c: /* FPDSCR */
2029 if (cpu_isar_feature(aa32_vfp_simd, cpu)) {
2030 value &= 0x07c00000;
2031 cpu->env.v7m.fpdscr[attrs.secure] = value;
2032 }
2033 break;
2034 case 0xf50: /* ICIALLU */
2035 case 0xf58: /* ICIMVAU */
2036 case 0xf5c: /* DCIMVAC */
2037 case 0xf60: /* DCISW */
2038 case 0xf64: /* DCCMVAU */
2039 case 0xf68: /* DCCMVAC */
2040 case 0xf6c: /* DCCSW */
2041 case 0xf70: /* DCCIMVAC */
2042 case 0xf74: /* DCCISW */
2043 case 0xf78: /* BPIALL */
2044 /* Cache and branch predictor maintenance: for QEMU these always NOP */
2045 break;
2046 default:
2047 bad_offset:
2048 qemu_log_mask(LOG_GUEST_ERROR,
2049 "NVIC: Bad write offset 0x%x\n", offset);
2050 }
2051 }
2052
2053 static bool nvic_user_access_ok(NVICState *s, hwaddr offset, MemTxAttrs attrs)
2054 {
2055 /* Return true if unprivileged access to this register is permitted. */
2056 switch (offset) {
2057 case 0xf00: /* STIR: accessible only if CCR.USERSETMPEND permits */
2058 /* For access via STIR_NS it is the NS CCR.USERSETMPEND that
2059 * controls access even though the CPU is in Secure state (I_QDKX).
2060 */
2061 return s->cpu->env.v7m.ccr[attrs.secure] & R_V7M_CCR_USERSETMPEND_MASK;
2062 default:
2063 /* All other user accesses cause a BusFault unconditionally */
2064 return false;
2065 }
2066 }
2067
2068 static int shpr_bank(NVICState *s, int exc, MemTxAttrs attrs)
2069 {
2070 /* Behaviour for the SHPR register field for this exception:
2071 * return M_REG_NS to use the nonsecure vector (including for
2072 * non-banked exceptions), M_REG_S for the secure version of
2073 * a banked exception, and -1 if this field should RAZ/WI.
2074 */
2075 switch (exc) {
2076 case ARMV7M_EXCP_MEM:
2077 case ARMV7M_EXCP_USAGE:
2078 case ARMV7M_EXCP_SVC:
2079 case ARMV7M_EXCP_PENDSV:
2080 case ARMV7M_EXCP_SYSTICK:
2081 /* Banked exceptions */
2082 return attrs.secure;
2083 case ARMV7M_EXCP_BUS:
2084 /* Not banked, RAZ/WI from nonsecure if BFHFNMINS is zero */
2085 if (!attrs.secure &&
2086 !(s->cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK)) {
2087 return -1;
2088 }
2089 return M_REG_NS;
2090 case ARMV7M_EXCP_SECURE:
2091 /* Not banked, RAZ/WI from nonsecure */
2092 if (!attrs.secure) {
2093 return -1;
2094 }
2095 return M_REG_NS;
2096 case ARMV7M_EXCP_DEBUG:
2097 /* Not banked. TODO should RAZ/WI if DEMCR.SDME is set */
2098 return M_REG_NS;
2099 case 8 ... 10:
2100 case 13:
2101 /* RES0 */
2102 return -1;
2103 default:
2104 /* Not reachable due to decode of SHPR register addresses */
2105 g_assert_not_reached();
2106 }
2107 }
2108
2109 static MemTxResult nvic_sysreg_read(void *opaque, hwaddr addr,
2110 uint64_t *data, unsigned size,
2111 MemTxAttrs attrs)
2112 {
2113 NVICState *s = (NVICState *)opaque;
2114 uint32_t offset = addr;
2115 unsigned i, startvec, end;
2116 uint32_t val;
2117
2118 if (attrs.user && !nvic_user_access_ok(s, addr, attrs)) {
2119 /* Generate BusFault for unprivileged accesses */
2120 return MEMTX_ERROR;
2121 }
2122
2123 switch (offset) {
2124 /* reads of set and clear both return the status */
2125 case 0x100 ... 0x13f: /* NVIC Set enable */
2126 offset += 0x80;
2127 /* fall through */
2128 case 0x180 ... 0x1bf: /* NVIC Clear enable */
2129 val = 0;
2130 startvec = 8 * (offset - 0x180) + NVIC_FIRST_IRQ; /* vector # */
2131
2132 for (i = 0, end = size * 8; i < end && startvec + i < s->num_irq; i++) {
2133 if (s->vectors[startvec + i].enabled &&
2134 (attrs.secure || s->itns[startvec + i])) {
2135 val |= (1 << i);
2136 }
2137 }
2138 break;
2139 case 0x200 ... 0x23f: /* NVIC Set pend */
2140 offset += 0x80;
2141 /* fall through */
2142 case 0x280 ... 0x2bf: /* NVIC Clear pend */
2143 val = 0;
2144 startvec = 8 * (offset - 0x280) + NVIC_FIRST_IRQ; /* vector # */
2145 for (i = 0, end = size * 8; i < end && startvec + i < s->num_irq; i++) {
2146 if (s->vectors[startvec + i].pending &&
2147 (attrs.secure || s->itns[startvec + i])) {
2148 val |= (1 << i);
2149 }
2150 }
2151 break;
2152 case 0x300 ... 0x33f: /* NVIC Active */
2153 val = 0;
2154
2155 if (!arm_feature(&s->cpu->env, ARM_FEATURE_V7)) {
2156 break;
2157 }
2158
2159 startvec = 8 * (offset - 0x300) + NVIC_FIRST_IRQ; /* vector # */
2160
2161 for (i = 0, end = size * 8; i < end && startvec + i < s->num_irq; i++) {
2162 if (s->vectors[startvec + i].active &&
2163 (attrs.secure || s->itns[startvec + i])) {
2164 val |= (1 << i);
2165 }
2166 }
2167 break;
2168 case 0x400 ... 0x5ef: /* NVIC Priority */
2169 val = 0;
2170 startvec = offset - 0x400 + NVIC_FIRST_IRQ; /* vector # */
2171
2172 for (i = 0; i < size && startvec + i < s->num_irq; i++) {
2173 if (attrs.secure || s->itns[startvec + i]) {
2174 val |= s->vectors[startvec + i].prio << (8 * i);
2175 }
2176 }
2177 break;
2178 case 0xd18 ... 0xd1b: /* System Handler Priority (SHPR1) */
2179 if (!arm_feature(&s->cpu->env, ARM_FEATURE_M_MAIN)) {
2180 val = 0;
2181 break;
2182 }
2183 /* fall through */
2184 case 0xd1c ... 0xd23: /* System Handler Priority (SHPR2, SHPR3) */
2185 val = 0;
2186 for (i = 0; i < size; i++) {
2187 unsigned hdlidx = (offset - 0xd14) + i;
2188 int sbank = shpr_bank(s, hdlidx, attrs);
2189
2190 if (sbank < 0) {
2191 continue;
2192 }
2193 val = deposit32(val, i * 8, 8, get_prio(s, hdlidx, sbank));
2194 }
2195 break;
2196 case 0xd28 ... 0xd2b: /* Configurable Fault Status (CFSR) */
2197 if (!arm_feature(&s->cpu->env, ARM_FEATURE_M_MAIN)) {
2198 val = 0;
2199 break;
2200 };
2201 /*
2202 * The BFSR bits [15:8] are shared between security states
2203 * and we store them in the NS copy. They are RAZ/WI for
2204 * NS code if AIRCR.BFHFNMINS is 0.
2205 */
2206 val = s->cpu->env.v7m.cfsr[attrs.secure];
2207 if (!attrs.secure &&
2208 !(s->cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK)) {
2209 val &= ~R_V7M_CFSR_BFSR_MASK;
2210 } else {
2211 val |= s->cpu->env.v7m.cfsr[M_REG_NS] & R_V7M_CFSR_BFSR_MASK;
2212 }
2213 val = extract32(val, (offset - 0xd28) * 8, size * 8);
2214 break;
2215 case 0xfe0 ... 0xfff: /* ID. */
2216 if (offset & 3) {
2217 val = 0;
2218 } else {
2219 val = nvic_id[(offset - 0xfe0) >> 2];
2220 }
2221 break;
2222 default:
2223 if (size == 4) {
2224 val = nvic_readl(s, offset, attrs);
2225 } else {
2226 qemu_log_mask(LOG_GUEST_ERROR,
2227 "NVIC: Bad read of size %d at offset 0x%x\n",
2228 size, offset);
2229 val = 0;
2230 }
2231 }
2232
2233 trace_nvic_sysreg_read(addr, val, size);
2234 *data = val;
2235 return MEMTX_OK;
2236 }
2237
2238 static MemTxResult nvic_sysreg_write(void *opaque, hwaddr addr,
2239 uint64_t value, unsigned size,
2240 MemTxAttrs attrs)
2241 {
2242 NVICState *s = (NVICState *)opaque;
2243 uint32_t offset = addr;
2244 unsigned i, startvec, end;
2245 unsigned setval = 0;
2246
2247 trace_nvic_sysreg_write(addr, value, size);
2248
2249 if (attrs.user && !nvic_user_access_ok(s, addr, attrs)) {
2250 /* Generate BusFault for unprivileged accesses */
2251 return MEMTX_ERROR;
2252 }
2253
2254 switch (offset) {
2255 case 0x100 ... 0x13f: /* NVIC Set enable */
2256 offset += 0x80;
2257 setval = 1;
2258 /* fall through */
2259 case 0x180 ... 0x1bf: /* NVIC Clear enable */
2260 startvec = 8 * (offset - 0x180) + NVIC_FIRST_IRQ;
2261
2262 for (i = 0, end = size * 8; i < end && startvec + i < s->num_irq; i++) {
2263 if (value & (1 << i) &&
2264 (attrs.secure || s->itns[startvec + i])) {
2265 s->vectors[startvec + i].enabled = setval;
2266 }
2267 }
2268 nvic_irq_update(s);
2269 goto exit_ok;
2270 case 0x200 ... 0x23f: /* NVIC Set pend */
2271 /* the special logic in armv7m_nvic_set_pending()
2272 * is not needed since IRQs are never escalated
2273 */
2274 offset += 0x80;
2275 setval = 1;
2276 /* fall through */
2277 case 0x280 ... 0x2bf: /* NVIC Clear pend */
2278 startvec = 8 * (offset - 0x280) + NVIC_FIRST_IRQ; /* vector # */
2279
2280 for (i = 0, end = size * 8; i < end && startvec + i < s->num_irq; i++) {
2281 if (value & (1 << i) &&
2282 (attrs.secure || s->itns[startvec + i])) {
2283 s->vectors[startvec + i].pending = setval;
2284 }
2285 }
2286 nvic_irq_update(s);
2287 goto exit_ok;
2288 case 0x300 ... 0x33f: /* NVIC Active */
2289 goto exit_ok; /* R/O */
2290 case 0x400 ... 0x5ef: /* NVIC Priority */
2291 startvec = (offset - 0x400) + NVIC_FIRST_IRQ; /* vector # */
2292
2293 for (i = 0; i < size && startvec + i < s->num_irq; i++) {
2294 if (attrs.secure || s->itns[startvec + i]) {
2295 set_prio(s, startvec + i, false, (value >> (i * 8)) & 0xff);
2296 }
2297 }
2298 nvic_irq_update(s);
2299 goto exit_ok;
2300 case 0xd18 ... 0xd1b: /* System Handler Priority (SHPR1) */
2301 if (!arm_feature(&s->cpu->env, ARM_FEATURE_M_MAIN)) {
2302 goto exit_ok;
2303 }
2304 /* fall through */
2305 case 0xd1c ... 0xd23: /* System Handler Priority (SHPR2, SHPR3) */
2306 for (i = 0; i < size; i++) {
2307 unsigned hdlidx = (offset - 0xd14) + i;
2308 int newprio = extract32(value, i * 8, 8);
2309 int sbank = shpr_bank(s, hdlidx, attrs);
2310
2311 if (sbank < 0) {
2312 continue;
2313 }
2314 set_prio(s, hdlidx, sbank, newprio);
2315 }
2316 nvic_irq_update(s);
2317 goto exit_ok;
2318 case 0xd28 ... 0xd2b: /* Configurable Fault Status (CFSR) */
2319 if (!arm_feature(&s->cpu->env, ARM_FEATURE_M_MAIN)) {
2320 goto exit_ok;
2321 }
2322 /* All bits are W1C, so construct 32 bit value with 0s in
2323 * the parts not written by the access size
2324 */
2325 value <<= ((offset - 0xd28) * 8);
2326
2327 if (!attrs.secure &&
2328 !(s->cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK)) {
2329 /* BFSR bits are RAZ/WI for NS if BFHFNMINS is set */
2330 value &= ~R_V7M_CFSR_BFSR_MASK;
2331 }
2332
2333 s->cpu->env.v7m.cfsr[attrs.secure] &= ~value;
2334 if (attrs.secure) {
2335 /* The BFSR bits [15:8] are shared between security states
2336 * and we store them in the NS copy.
2337 */
2338 s->cpu->env.v7m.cfsr[M_REG_NS] &= ~(value & R_V7M_CFSR_BFSR_MASK);
2339 }
2340 goto exit_ok;
2341 }
2342 if (size == 4) {
2343 nvic_writel(s, offset, value, attrs);
2344 goto exit_ok;
2345 }
2346 qemu_log_mask(LOG_GUEST_ERROR,
2347 "NVIC: Bad write of size %d at offset 0x%x\n", size, offset);
2348 /* This is UNPREDICTABLE; treat as RAZ/WI */
2349
2350 exit_ok:
2351 /* Ensure any changes made are reflected in the cached hflags. */
2352 arm_rebuild_hflags(&s->cpu->env);
2353 return MEMTX_OK;
2354 }
2355
2356 static const MemoryRegionOps nvic_sysreg_ops = {
2357 .read_with_attrs = nvic_sysreg_read,
2358 .write_with_attrs = nvic_sysreg_write,
2359 .endianness = DEVICE_NATIVE_ENDIAN,
2360 };
2361
2362 static MemTxResult nvic_sysreg_ns_write(void *opaque, hwaddr addr,
2363 uint64_t value, unsigned size,
2364 MemTxAttrs attrs)
2365 {
2366 MemoryRegion *mr = opaque;
2367
2368 if (attrs.secure) {
2369 /* S accesses to the alias act like NS accesses to the real region */
2370 attrs.secure = 0;
2371 return memory_region_dispatch_write(mr, addr, value,
2372 size_memop(size) | MO_TE, attrs);
2373 } else {
2374 /* NS attrs are RAZ/WI for privileged, and BusFault for user */
2375 if (attrs.user) {
2376 return MEMTX_ERROR;
2377 }
2378 return MEMTX_OK;
2379 }
2380 }
2381
2382 static MemTxResult nvic_sysreg_ns_read(void *opaque, hwaddr addr,
2383 uint64_t *data, unsigned size,
2384 MemTxAttrs attrs)
2385 {
2386 MemoryRegion *mr = opaque;
2387
2388 if (attrs.secure) {
2389 /* S accesses to the alias act like NS accesses to the real region */
2390 attrs.secure = 0;
2391 return memory_region_dispatch_read(mr, addr, data,
2392 size_memop(size) | MO_TE, attrs);
2393 } else {
2394 /* NS attrs are RAZ/WI for privileged, and BusFault for user */
2395 if (attrs.user) {
2396 return MEMTX_ERROR;
2397 }
2398 *data = 0;
2399 return MEMTX_OK;
2400 }
2401 }
2402
2403 static const MemoryRegionOps nvic_sysreg_ns_ops = {
2404 .read_with_attrs = nvic_sysreg_ns_read,
2405 .write_with_attrs = nvic_sysreg_ns_write,
2406 .endianness = DEVICE_NATIVE_ENDIAN,
2407 };
2408
2409 static MemTxResult nvic_systick_write(void *opaque, hwaddr addr,
2410 uint64_t value, unsigned size,
2411 MemTxAttrs attrs)
2412 {
2413 NVICState *s = opaque;
2414 MemoryRegion *mr;
2415
2416 /* Direct the access to the correct systick */
2417 mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->systick[attrs.secure]), 0);
2418 return memory_region_dispatch_write(mr, addr, value,
2419 size_memop(size) | MO_TE, attrs);
2420 }
2421
2422 static MemTxResult nvic_systick_read(void *opaque, hwaddr addr,
2423 uint64_t *data, unsigned size,
2424 MemTxAttrs attrs)
2425 {
2426 NVICState *s = opaque;
2427 MemoryRegion *mr;
2428
2429 /* Direct the access to the correct systick */
2430 mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->systick[attrs.secure]), 0);
2431 return memory_region_dispatch_read(mr, addr, data, size_memop(size) | MO_TE,
2432 attrs);
2433 }
2434
2435 static const MemoryRegionOps nvic_systick_ops = {
2436 .read_with_attrs = nvic_systick_read,
2437 .write_with_attrs = nvic_systick_write,
2438 .endianness = DEVICE_NATIVE_ENDIAN,
2439 };
2440
2441 static int nvic_post_load(void *opaque, int version_id)
2442 {
2443 NVICState *s = opaque;
2444 unsigned i;
2445 int resetprio;
2446
2447 /* Check for out of range priority settings */
2448 resetprio = arm_feature(&s->cpu->env, ARM_FEATURE_V8) ? -4 : -3;
2449
2450 if (s->vectors[ARMV7M_EXCP_RESET].prio != resetprio ||
2451 s->vectors[ARMV7M_EXCP_NMI].prio != -2 ||
2452 s->vectors[ARMV7M_EXCP_HARD].prio != -1) {
2453 return 1;
2454 }
2455 for (i = ARMV7M_EXCP_MEM; i < s->num_irq; i++) {
2456 if (s->vectors[i].prio & ~0xff) {
2457 return 1;
2458 }
2459 }
2460
2461 nvic_recompute_state(s);
2462
2463 return 0;
2464 }
2465
2466 static const VMStateDescription vmstate_VecInfo = {
2467 .name = "armv7m_nvic_info",
2468 .version_id = 1,
2469 .minimum_version_id = 1,
2470 .fields = (VMStateField[]) {
2471 VMSTATE_INT16(prio, VecInfo),
2472 VMSTATE_UINT8(enabled, VecInfo),
2473 VMSTATE_UINT8(pending, VecInfo),
2474 VMSTATE_UINT8(active, VecInfo),
2475 VMSTATE_UINT8(level, VecInfo),
2476 VMSTATE_END_OF_LIST()
2477 }
2478 };
2479
2480 static bool nvic_security_needed(void *opaque)
2481 {
2482 NVICState *s = opaque;
2483
2484 return arm_feature(&s->cpu->env, ARM_FEATURE_M_SECURITY);
2485 }
2486
2487 static int nvic_security_post_load(void *opaque, int version_id)
2488 {
2489 NVICState *s = opaque;
2490 int i;
2491
2492 /* Check for out of range priority settings */
2493 if (s->sec_vectors[ARMV7M_EXCP_HARD].prio != -1
2494 && s->sec_vectors[ARMV7M_EXCP_HARD].prio != -3) {
2495 /* We can't cross-check against AIRCR.BFHFNMINS as we don't know
2496 * if the CPU state has been migrated yet; a mismatch won't
2497 * cause the emulation to blow up, though.
2498 */
2499 return 1;
2500 }
2501 for (i = ARMV7M_EXCP_MEM; i < ARRAY_SIZE(s->sec_vectors); i++) {
2502 if (s->sec_vectors[i].prio & ~0xff) {
2503 return 1;
2504 }
2505 }
2506 return 0;
2507 }
2508
2509 static const VMStateDescription vmstate_nvic_security = {
2510 .name = "armv7m_nvic/m-security",
2511 .version_id = 1,
2512 .minimum_version_id = 1,
2513 .needed = nvic_security_needed,
2514 .post_load = &nvic_security_post_load,
2515 .fields = (VMStateField[]) {
2516 VMSTATE_STRUCT_ARRAY(sec_vectors, NVICState, NVIC_INTERNAL_VECTORS, 1,
2517 vmstate_VecInfo, VecInfo),
2518 VMSTATE_UINT32(prigroup[M_REG_S], NVICState),
2519 VMSTATE_BOOL_ARRAY(itns, NVICState, NVIC_MAX_VECTORS),
2520 VMSTATE_END_OF_LIST()
2521 }
2522 };
2523
2524 static const VMStateDescription vmstate_nvic = {
2525 .name = "armv7m_nvic",
2526 .version_id = 4,
2527 .minimum_version_id = 4,
2528 .post_load = &nvic_post_load,
2529 .fields = (VMStateField[]) {
2530 VMSTATE_STRUCT_ARRAY(vectors, NVICState, NVIC_MAX_VECTORS, 1,
2531 vmstate_VecInfo, VecInfo),
2532 VMSTATE_UINT32(prigroup[M_REG_NS], NVICState),
2533 VMSTATE_END_OF_LIST()
2534 },
2535 .subsections = (const VMStateDescription*[]) {
2536 &vmstate_nvic_security,
2537 NULL
2538 }
2539 };
2540
2541 static Property props_nvic[] = {
2542 /* Number of external IRQ lines (so excluding the 16 internal exceptions) */
2543 DEFINE_PROP_UINT32("num-irq", NVICState, num_irq, 64),
2544 DEFINE_PROP_END_OF_LIST()
2545 };
2546
2547 static void armv7m_nvic_reset(DeviceState *dev)
2548 {
2549 int resetprio;
2550 NVICState *s = NVIC(dev);
2551
2552 memset(s->vectors, 0, sizeof(s->vectors));
2553 memset(s->sec_vectors, 0, sizeof(s->sec_vectors));
2554 s->prigroup[M_REG_NS] = 0;
2555 s->prigroup[M_REG_S] = 0;
2556
2557 s->vectors[ARMV7M_EXCP_NMI].enabled = 1;
2558 /* MEM, BUS, and USAGE are enabled through
2559 * the System Handler Control register
2560 */
2561 s->vectors[ARMV7M_EXCP_SVC].enabled = 1;
2562 s->vectors[ARMV7M_EXCP_PENDSV].enabled = 1;
2563 s->vectors[ARMV7M_EXCP_SYSTICK].enabled = 1;
2564
2565 /* DebugMonitor is enabled via DEMCR.MON_EN */
2566 s->vectors[ARMV7M_EXCP_DEBUG].enabled = 0;
2567
2568 resetprio = arm_feature(&s->cpu->env, ARM_FEATURE_V8) ? -4 : -3;
2569 s->vectors[ARMV7M_EXCP_RESET].prio = resetprio;
2570 s->vectors[ARMV7M_EXCP_NMI].prio = -2;
2571 s->vectors[ARMV7M_EXCP_HARD].prio = -1;
2572
2573 if (arm_feature(&s->cpu->env, ARM_FEATURE_M_SECURITY)) {
2574 s->sec_vectors[ARMV7M_EXCP_HARD].enabled = 1;
2575 s->sec_vectors[ARMV7M_EXCP_SVC].enabled = 1;
2576 s->sec_vectors[ARMV7M_EXCP_PENDSV].enabled = 1;
2577 s->sec_vectors[ARMV7M_EXCP_SYSTICK].enabled = 1;
2578
2579 /* AIRCR.BFHFNMINS resets to 0 so Secure HF is priority -1 (R_CMTC) */
2580 s->sec_vectors[ARMV7M_EXCP_HARD].prio = -1;
2581 /* If AIRCR.BFHFNMINS is 0 then NS HF is (effectively) disabled */
2582 s->vectors[ARMV7M_EXCP_HARD].enabled = 0;
2583 } else {
2584 s->vectors[ARMV7M_EXCP_HARD].enabled = 1;
2585 }
2586
2587 /* Strictly speaking the reset handler should be enabled.
2588 * However, we don't simulate soft resets through the NVIC,
2589 * and the reset vector should never be pended.
2590 * So we leave it disabled to catch logic errors.
2591 */
2592
2593 s->exception_prio = NVIC_NOEXC_PRIO;
2594 s->vectpending = 0;
2595 s->vectpending_is_s_banked = false;
2596 s->vectpending_prio = NVIC_NOEXC_PRIO;
2597
2598 if (arm_feature(&s->cpu->env, ARM_FEATURE_M_SECURITY)) {
2599 memset(s->itns, 0, sizeof(s->itns));
2600 } else {
2601 /* This state is constant and not guest accessible in a non-security
2602 * NVIC; we set the bits to true to avoid having to do a feature
2603 * bit check in the NVIC enable/pend/etc register accessors.
2604 */
2605 int i;
2606
2607 for (i = NVIC_FIRST_IRQ; i < ARRAY_SIZE(s->itns); i++) {
2608 s->itns[i] = true;
2609 }
2610 }
2611
2612 /*
2613 * We updated state that affects the CPU's MMUidx and thus its hflags;
2614 * and we can't guarantee that we run before the CPU reset function.
2615 */
2616 arm_rebuild_hflags(&s->cpu->env);
2617 }
2618
2619 static void nvic_systick_trigger(void *opaque, int n, int level)
2620 {
2621 NVICState *s = opaque;
2622
2623 if (level) {
2624 /* SysTick just asked us to pend its exception.
2625 * (This is different from an external interrupt line's
2626 * behaviour.)
2627 * n == 0 : NonSecure systick
2628 * n == 1 : Secure systick
2629 */
2630 armv7m_nvic_set_pending(s, ARMV7M_EXCP_SYSTICK, n);
2631 }
2632 }
2633
2634 static void armv7m_nvic_realize(DeviceState *dev, Error **errp)
2635 {
2636 NVICState *s = NVIC(dev);
2637 int regionlen;
2638
2639 /* The armv7m container object will have set our CPU pointer */
2640 if (!s->cpu || !arm_feature(&s->cpu->env, ARM_FEATURE_M)) {
2641 error_setg(errp, "The NVIC can only be used with a Cortex-M CPU");
2642 return;
2643 }
2644
2645 if (s->num_irq > NVIC_MAX_IRQ) {
2646 error_setg(errp, "num-irq %d exceeds NVIC maximum", s->num_irq);
2647 return;
2648 }
2649
2650 qdev_init_gpio_in(dev, set_irq_level, s->num_irq);
2651
2652 /* include space for internal exception vectors */
2653 s->num_irq += NVIC_FIRST_IRQ;
2654
2655 s->num_prio_bits = arm_feature(&s->cpu->env, ARM_FEATURE_V7) ? 8 : 2;
2656
2657 if (!sysbus_realize(SYS_BUS_DEVICE(&s->systick[M_REG_NS]), errp)) {
2658 return;
2659 }
2660 sysbus_connect_irq(SYS_BUS_DEVICE(&s->systick[M_REG_NS]), 0,
2661 qdev_get_gpio_in_named(dev, "systick-trigger",
2662 M_REG_NS));
2663
2664 if (arm_feature(&s->cpu->env, ARM_FEATURE_M_SECURITY)) {
2665 /* We couldn't init the secure systick device in instance_init
2666 * as we didn't know then if the CPU had the security extensions;
2667 * so we have to do it here.
2668 */
2669 object_initialize_child(OBJECT(dev), "systick-reg-s",
2670 &s->systick[M_REG_S], TYPE_SYSTICK);
2671
2672 if (!sysbus_realize(SYS_BUS_DEVICE(&s->systick[M_REG_S]), errp)) {
2673 return;
2674 }
2675 sysbus_connect_irq(SYS_BUS_DEVICE(&s->systick[M_REG_S]), 0,
2676 qdev_get_gpio_in_named(dev, "systick-trigger",
2677 M_REG_S));
2678 }
2679
2680 /* The NVIC and System Control Space (SCS) starts at 0xe000e000
2681 * and looks like this:
2682 * 0x004 - ICTR
2683 * 0x010 - 0xff - systick
2684 * 0x100..0x7ec - NVIC
2685 * 0x7f0..0xcff - Reserved
2686 * 0xd00..0xd3c - SCS registers
2687 * 0xd40..0xeff - Reserved or Not implemented
2688 * 0xf00 - STIR
2689 *
2690 * Some registers within this space are banked between security states.
2691 * In v8M there is a second range 0xe002e000..0xe002efff which is the
2692 * NonSecure alias SCS; secure accesses to this behave like NS accesses
2693 * to the main SCS range, and non-secure accesses (including when
2694 * the security extension is not implemented) are RAZ/WI.
2695 * Note that both the main SCS range and the alias range are defined
2696 * to be exempt from memory attribution (R_BLJT) and so the memory
2697 * transaction attribute always matches the current CPU security
2698 * state (attrs.secure == env->v7m.secure). In the nvic_sysreg_ns_ops
2699 * wrappers we change attrs.secure to indicate the NS access; so
2700 * generally code determining which banked register to use should
2701 * use attrs.secure; code determining actual behaviour of the system
2702 * should use env->v7m.secure.
2703 */
2704 regionlen = arm_feature(&s->cpu->env, ARM_FEATURE_V8) ? 0x21000 : 0x1000;
2705 memory_region_init(&s->container, OBJECT(s), "nvic", regionlen);
2706 /* The system register region goes at the bottom of the priority
2707 * stack as it covers the whole page.
2708 */
2709 memory_region_init_io(&s->sysregmem, OBJECT(s), &nvic_sysreg_ops, s,
2710 "nvic_sysregs", 0x1000);
2711 memory_region_add_subregion(&s->container, 0, &s->sysregmem);
2712
2713 memory_region_init_io(&s->systickmem, OBJECT(s),
2714 &nvic_systick_ops, s,
2715 "nvic_systick", 0xe0);
2716
2717 memory_region_add_subregion_overlap(&s->container, 0x10,
2718 &s->systickmem, 1);
2719
2720 if (arm_feature(&s->cpu->env, ARM_FEATURE_V8)) {
2721 memory_region_init_io(&s->sysreg_ns_mem, OBJECT(s),
2722 &nvic_sysreg_ns_ops, &s->sysregmem,
2723 "nvic_sysregs_ns", 0x1000);
2724 memory_region_add_subregion(&s->container, 0x20000, &s->sysreg_ns_mem);
2725 memory_region_init_io(&s->systick_ns_mem, OBJECT(s),
2726 &nvic_sysreg_ns_ops, &s->systickmem,
2727 "nvic_systick_ns", 0xe0);
2728 memory_region_add_subregion_overlap(&s->container, 0x20010,
2729 &s->systick_ns_mem, 1);
2730 }
2731
2732 sysbus_init_mmio(SYS_BUS_DEVICE(dev), &s->container);
2733 }
2734
2735 static void armv7m_nvic_instance_init(Object *obj)
2736 {
2737 /* We have a different default value for the num-irq property
2738 * than our superclass. This function runs after qdev init
2739 * has set the defaults from the Property array and before
2740 * any user-specified property setting, so just modify the
2741 * value in the GICState struct.
2742 */
2743 DeviceState *dev = DEVICE(obj);
2744 NVICState *nvic = NVIC(obj);
2745 SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
2746
2747 object_initialize_child(obj, "systick-reg-ns", &nvic->systick[M_REG_NS],
2748 TYPE_SYSTICK);
2749 /* We can't initialize the secure systick here, as we don't know
2750 * yet if we need it.
2751 */
2752
2753 sysbus_init_irq(sbd, &nvic->excpout);
2754 qdev_init_gpio_out_named(dev, &nvic->sysresetreq, "SYSRESETREQ", 1);
2755 qdev_init_gpio_in_named(dev, nvic_systick_trigger, "systick-trigger",
2756 M_REG_NUM_BANKS);
2757 qdev_init_gpio_in_named(dev, nvic_nmi_trigger, "NMI", 1);
2758 }
2759
2760 static void armv7m_nvic_class_init(ObjectClass *klass, void *data)
2761 {
2762 DeviceClass *dc = DEVICE_CLASS(klass);
2763
2764 dc->vmsd = &vmstate_nvic;
2765 device_class_set_props(dc, props_nvic);
2766 dc->reset = armv7m_nvic_reset;
2767 dc->realize = armv7m_nvic_realize;
2768 }
2769
2770 static const TypeInfo armv7m_nvic_info = {
2771 .name = TYPE_NVIC,
2772 .parent = TYPE_SYS_BUS_DEVICE,
2773 .instance_init = armv7m_nvic_instance_init,
2774 .instance_size = sizeof(NVICState),
2775 .class_init = armv7m_nvic_class_init,
2776 .class_size = sizeof(SysBusDeviceClass),
2777 };
2778
2779 static void armv7m_nvic_register_types(void)
2780 {
2781 type_register_static(&armv7m_nvic_info);
2782 }
2783
2784 type_init(armv7m_nvic_register_types)