1 /* 2 * ARM Nested Vectored Interrupt Controller 3 * 4 * Copyright (c) 2006-2007 CodeSourcery. 5 * Written by Paul Brook 6 * 7 * This code is licensed under the GPL. 8 * 9 * The ARMv7M System controller is fairly tightly tied in with the 10 * NVIC. Much of that is also implemented here. 11 */ 12 13 #include "qemu/osdep.h" 14 #include "qapi/error.h" 15 #include "qemu-common.h" 16 #include "cpu.h" 17 #include "hw/sysbus.h" 18 #include "qemu/timer.h" 19 #include "hw/arm/arm.h" 20 #include "exec/address-spaces.h" 21 #include "gic_internal.h" 22 #include "qemu/log.h" 23 24 typedef struct { 25 GICState gic; 26 struct { 27 uint32_t control; 28 uint32_t reload; 29 int64_t tick; 30 QEMUTimer *timer; 31 } systick; 32 MemoryRegion sysregmem; 33 MemoryRegion gic_iomem_alias; 34 MemoryRegion container; 35 uint32_t num_irq; 36 qemu_irq sysresetreq; 37 } nvic_state; 38 39 #define TYPE_NVIC "armv7m_nvic" 40 /** 41 * NVICClass: 42 * @parent_reset: the parent class' reset handler. 43 * 44 * A model of the v7M NVIC and System Controller 45 */ 46 typedef struct NVICClass { 47 /*< private >*/ 48 ARMGICClass parent_class; 49 /*< public >*/ 50 DeviceRealize parent_realize; 51 void (*parent_reset)(DeviceState *dev); 52 } NVICClass; 53 54 #define NVIC_CLASS(klass) \ 55 OBJECT_CLASS_CHECK(NVICClass, (klass), TYPE_NVIC) 56 #define NVIC_GET_CLASS(obj) \ 57 OBJECT_GET_CLASS(NVICClass, (obj), TYPE_NVIC) 58 #define NVIC(obj) \ 59 OBJECT_CHECK(nvic_state, (obj), TYPE_NVIC) 60 61 static const uint8_t nvic_id[] = { 62 0x00, 0xb0, 0x1b, 0x00, 0x0d, 0xe0, 0x05, 0xb1 63 }; 64 65 /* qemu timers run at 1GHz. We want something closer to 1MHz. */ 66 #define SYSTICK_SCALE 1000ULL 67 68 #define SYSTICK_ENABLE (1 << 0) 69 #define SYSTICK_TICKINT (1 << 1) 70 #define SYSTICK_CLKSOURCE (1 << 2) 71 #define SYSTICK_COUNTFLAG (1 << 16) 72 73 int system_clock_scale; 74 75 /* Conversion factor from qemu timer to SysTick frequencies. */ 76 static inline int64_t systick_scale(nvic_state *s) 77 { 78 if (s->systick.control & SYSTICK_CLKSOURCE) 79 return system_clock_scale; 80 else 81 return 1000; 82 } 83 84 static void systick_reload(nvic_state *s, int reset) 85 { 86 /* The Cortex-M3 Devices Generic User Guide says that "When the 87 * ENABLE bit is set to 1, the counter loads the RELOAD value from the 88 * SYST RVR register and then counts down". So, we need to check the 89 * ENABLE bit before reloading the value. 90 */ 91 if ((s->systick.control & SYSTICK_ENABLE) == 0) { 92 return; 93 } 94 95 if (reset) 96 s->systick.tick = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL); 97 s->systick.tick += (s->systick.reload + 1) * systick_scale(s); 98 timer_mod(s->systick.timer, s->systick.tick); 99 } 100 101 static void systick_timer_tick(void * opaque) 102 { 103 nvic_state *s = (nvic_state *)opaque; 104 s->systick.control |= SYSTICK_COUNTFLAG; 105 if (s->systick.control & SYSTICK_TICKINT) { 106 /* Trigger the interrupt. */ 107 armv7m_nvic_set_pending(s, ARMV7M_EXCP_SYSTICK); 108 } 109 if (s->systick.reload == 0) { 110 s->systick.control &= ~SYSTICK_ENABLE; 111 } else { 112 systick_reload(s, 0); 113 } 114 } 115 116 static void systick_reset(nvic_state *s) 117 { 118 s->systick.control = 0; 119 s->systick.reload = 0; 120 s->systick.tick = 0; 121 timer_del(s->systick.timer); 122 } 123 124 /* The external routines use the hardware vector numbering, ie. the first 125 IRQ is #16. The internal GIC routines use #32 as the first IRQ. */ 126 void armv7m_nvic_set_pending(void *opaque, int irq) 127 { 128 nvic_state *s = (nvic_state *)opaque; 129 if (irq >= 16) 130 irq += 16; 131 gic_set_pending_private(&s->gic, 0, irq); 132 } 133 134 /* Make pending IRQ active. */ 135 int armv7m_nvic_acknowledge_irq(void *opaque) 136 { 137 nvic_state *s = (nvic_state *)opaque; 138 uint32_t irq; 139 140 irq = gic_acknowledge_irq(&s->gic, 0, MEMTXATTRS_UNSPECIFIED); 141 if (irq == 1023) 142 hw_error("Interrupt but no vector\n"); 143 if (irq >= 32) 144 irq -= 16; 145 return irq; 146 } 147 148 void armv7m_nvic_complete_irq(void *opaque, int irq) 149 { 150 nvic_state *s = (nvic_state *)opaque; 151 if (irq >= 16) 152 irq += 16; 153 gic_complete_irq(&s->gic, 0, irq, MEMTXATTRS_UNSPECIFIED); 154 } 155 156 static uint32_t nvic_readl(nvic_state *s, uint32_t offset) 157 { 158 ARMCPU *cpu; 159 uint32_t val; 160 int irq; 161 162 switch (offset) { 163 case 4: /* Interrupt Control Type. */ 164 return (s->num_irq / 32) - 1; 165 case 0x10: /* SysTick Control and Status. */ 166 val = s->systick.control; 167 s->systick.control &= ~SYSTICK_COUNTFLAG; 168 return val; 169 case 0x14: /* SysTick Reload Value. */ 170 return s->systick.reload; 171 case 0x18: /* SysTick Current Value. */ 172 { 173 int64_t t; 174 if ((s->systick.control & SYSTICK_ENABLE) == 0) 175 return 0; 176 t = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL); 177 if (t >= s->systick.tick) 178 return 0; 179 val = ((s->systick.tick - (t + 1)) / systick_scale(s)) + 1; 180 /* The interrupt in triggered when the timer reaches zero. 181 However the counter is not reloaded until the next clock 182 tick. This is a hack to return zero during the first tick. */ 183 if (val > s->systick.reload) 184 val = 0; 185 return val; 186 } 187 case 0x1c: /* SysTick Calibration Value. */ 188 return 10000; 189 case 0xd00: /* CPUID Base. */ 190 cpu = ARM_CPU(qemu_get_cpu(0)); 191 return cpu->midr; 192 case 0xd04: /* Interrupt Control State. */ 193 /* VECTACTIVE */ 194 cpu = ARM_CPU(qemu_get_cpu(0)); 195 val = cpu->env.v7m.exception; 196 if (val == 1023) { 197 val = 0; 198 } else if (val >= 32) { 199 val -= 16; 200 } 201 /* VECTPENDING */ 202 if (s->gic.current_pending[0] != 1023) 203 val |= (s->gic.current_pending[0] << 12); 204 /* ISRPENDING and RETTOBASE */ 205 for (irq = 32; irq < s->num_irq; irq++) { 206 if (s->gic.irq_state[irq].pending) { 207 val |= (1 << 22); 208 break; 209 } 210 if (irq != cpu->env.v7m.exception && s->gic.irq_state[irq].active) { 211 val |= (1 << 11); 212 } 213 } 214 /* PENDSTSET */ 215 if (s->gic.irq_state[ARMV7M_EXCP_SYSTICK].pending) 216 val |= (1 << 26); 217 /* PENDSVSET */ 218 if (s->gic.irq_state[ARMV7M_EXCP_PENDSV].pending) 219 val |= (1 << 28); 220 /* NMIPENDSET */ 221 if (s->gic.irq_state[ARMV7M_EXCP_NMI].pending) 222 val |= (1 << 31); 223 return val; 224 case 0xd08: /* Vector Table Offset. */ 225 cpu = ARM_CPU(qemu_get_cpu(0)); 226 return cpu->env.v7m.vecbase; 227 case 0xd0c: /* Application Interrupt/Reset Control. */ 228 return 0xfa050000; 229 case 0xd10: /* System Control. */ 230 /* TODO: Implement SLEEPONEXIT. */ 231 return 0; 232 case 0xd14: /* Configuration Control. */ 233 /* TODO: Implement Configuration Control bits. */ 234 return 0; 235 case 0xd24: /* System Handler Status. */ 236 val = 0; 237 if (s->gic.irq_state[ARMV7M_EXCP_MEM].active) val |= (1 << 0); 238 if (s->gic.irq_state[ARMV7M_EXCP_BUS].active) val |= (1 << 1); 239 if (s->gic.irq_state[ARMV7M_EXCP_USAGE].active) val |= (1 << 3); 240 if (s->gic.irq_state[ARMV7M_EXCP_SVC].active) val |= (1 << 7); 241 if (s->gic.irq_state[ARMV7M_EXCP_DEBUG].active) val |= (1 << 8); 242 if (s->gic.irq_state[ARMV7M_EXCP_PENDSV].active) val |= (1 << 10); 243 if (s->gic.irq_state[ARMV7M_EXCP_SYSTICK].active) val |= (1 << 11); 244 if (s->gic.irq_state[ARMV7M_EXCP_USAGE].pending) val |= (1 << 12); 245 if (s->gic.irq_state[ARMV7M_EXCP_MEM].pending) val |= (1 << 13); 246 if (s->gic.irq_state[ARMV7M_EXCP_BUS].pending) val |= (1 << 14); 247 if (s->gic.irq_state[ARMV7M_EXCP_SVC].pending) val |= (1 << 15); 248 if (s->gic.irq_state[ARMV7M_EXCP_MEM].enabled) val |= (1 << 16); 249 if (s->gic.irq_state[ARMV7M_EXCP_BUS].enabled) val |= (1 << 17); 250 if (s->gic.irq_state[ARMV7M_EXCP_USAGE].enabled) val |= (1 << 18); 251 return val; 252 case 0xd28: /* Configurable Fault Status. */ 253 /* TODO: Implement Fault Status. */ 254 qemu_log_mask(LOG_UNIMP, "Configurable Fault Status unimplemented\n"); 255 return 0; 256 case 0xd2c: /* Hard Fault Status. */ 257 case 0xd30: /* Debug Fault Status. */ 258 case 0xd34: /* Mem Manage Address. */ 259 case 0xd38: /* Bus Fault Address. */ 260 case 0xd3c: /* Aux Fault Status. */ 261 /* TODO: Implement fault status registers. */ 262 qemu_log_mask(LOG_UNIMP, "Fault status registers unimplemented\n"); 263 return 0; 264 case 0xd40: /* PFR0. */ 265 return 0x00000030; 266 case 0xd44: /* PRF1. */ 267 return 0x00000200; 268 case 0xd48: /* DFR0. */ 269 return 0x00100000; 270 case 0xd4c: /* AFR0. */ 271 return 0x00000000; 272 case 0xd50: /* MMFR0. */ 273 return 0x00000030; 274 case 0xd54: /* MMFR1. */ 275 return 0x00000000; 276 case 0xd58: /* MMFR2. */ 277 return 0x00000000; 278 case 0xd5c: /* MMFR3. */ 279 return 0x00000000; 280 case 0xd60: /* ISAR0. */ 281 return 0x01141110; 282 case 0xd64: /* ISAR1. */ 283 return 0x02111000; 284 case 0xd68: /* ISAR2. */ 285 return 0x21112231; 286 case 0xd6c: /* ISAR3. */ 287 return 0x01111110; 288 case 0xd70: /* ISAR4. */ 289 return 0x01310102; 290 /* TODO: Implement debug registers. */ 291 default: 292 qemu_log_mask(LOG_GUEST_ERROR, "NVIC: Bad read offset 0x%x\n", offset); 293 return 0; 294 } 295 } 296 297 static void nvic_writel(nvic_state *s, uint32_t offset, uint32_t value) 298 { 299 ARMCPU *cpu; 300 uint32_t oldval; 301 switch (offset) { 302 case 0x10: /* SysTick Control and Status. */ 303 oldval = s->systick.control; 304 s->systick.control &= 0xfffffff8; 305 s->systick.control |= value & 7; 306 if ((oldval ^ value) & SYSTICK_ENABLE) { 307 int64_t now = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL); 308 if (value & SYSTICK_ENABLE) { 309 if (s->systick.tick) { 310 s->systick.tick += now; 311 timer_mod(s->systick.timer, s->systick.tick); 312 } else { 313 systick_reload(s, 1); 314 } 315 } else { 316 timer_del(s->systick.timer); 317 s->systick.tick -= now; 318 if (s->systick.tick < 0) 319 s->systick.tick = 0; 320 } 321 } else if ((oldval ^ value) & SYSTICK_CLKSOURCE) { 322 /* This is a hack. Force the timer to be reloaded 323 when the reference clock is changed. */ 324 systick_reload(s, 1); 325 } 326 break; 327 case 0x14: /* SysTick Reload Value. */ 328 s->systick.reload = value; 329 break; 330 case 0x18: /* SysTick Current Value. Writes reload the timer. */ 331 systick_reload(s, 1); 332 s->systick.control &= ~SYSTICK_COUNTFLAG; 333 break; 334 case 0xd04: /* Interrupt Control State. */ 335 if (value & (1 << 31)) { 336 armv7m_nvic_set_pending(s, ARMV7M_EXCP_NMI); 337 } 338 if (value & (1 << 28)) { 339 armv7m_nvic_set_pending(s, ARMV7M_EXCP_PENDSV); 340 } else if (value & (1 << 27)) { 341 s->gic.irq_state[ARMV7M_EXCP_PENDSV].pending = 0; 342 gic_update(&s->gic); 343 } 344 if (value & (1 << 26)) { 345 armv7m_nvic_set_pending(s, ARMV7M_EXCP_SYSTICK); 346 } else if (value & (1 << 25)) { 347 s->gic.irq_state[ARMV7M_EXCP_SYSTICK].pending = 0; 348 gic_update(&s->gic); 349 } 350 break; 351 case 0xd08: /* Vector Table Offset. */ 352 cpu = ARM_CPU(qemu_get_cpu(0)); 353 cpu->env.v7m.vecbase = value & 0xffffff80; 354 break; 355 case 0xd0c: /* Application Interrupt/Reset Control. */ 356 if ((value >> 16) == 0x05fa) { 357 if (value & 4) { 358 qemu_irq_pulse(s->sysresetreq); 359 } 360 if (value & 2) { 361 qemu_log_mask(LOG_UNIMP, "VECTCLRACTIVE unimplemented\n"); 362 } 363 if (value & 1) { 364 qemu_log_mask(LOG_UNIMP, "AIRCR system reset unimplemented\n"); 365 } 366 if (value & 0x700) { 367 qemu_log_mask(LOG_UNIMP, "PRIGROUP unimplemented\n"); 368 } 369 } 370 break; 371 case 0xd10: /* System Control. */ 372 case 0xd14: /* Configuration Control. */ 373 /* TODO: Implement control registers. */ 374 qemu_log_mask(LOG_UNIMP, "NVIC: SCR and CCR unimplemented\n"); 375 break; 376 case 0xd24: /* System Handler Control. */ 377 /* TODO: Real hardware allows you to set/clear the active bits 378 under some circumstances. We don't implement this. */ 379 s->gic.irq_state[ARMV7M_EXCP_MEM].enabled = (value & (1 << 16)) != 0; 380 s->gic.irq_state[ARMV7M_EXCP_BUS].enabled = (value & (1 << 17)) != 0; 381 s->gic.irq_state[ARMV7M_EXCP_USAGE].enabled = (value & (1 << 18)) != 0; 382 break; 383 case 0xd28: /* Configurable Fault Status. */ 384 case 0xd2c: /* Hard Fault Status. */ 385 case 0xd30: /* Debug Fault Status. */ 386 case 0xd34: /* Mem Manage Address. */ 387 case 0xd38: /* Bus Fault Address. */ 388 case 0xd3c: /* Aux Fault Status. */ 389 qemu_log_mask(LOG_UNIMP, 390 "NVIC: fault status registers unimplemented\n"); 391 break; 392 case 0xf00: /* Software Triggered Interrupt Register */ 393 if ((value & 0x1ff) < s->num_irq) { 394 gic_set_pending_private(&s->gic, 0, value & 0x1ff); 395 } 396 break; 397 default: 398 qemu_log_mask(LOG_GUEST_ERROR, 399 "NVIC: Bad write offset 0x%x\n", offset); 400 } 401 } 402 403 static uint64_t nvic_sysreg_read(void *opaque, hwaddr addr, 404 unsigned size) 405 { 406 nvic_state *s = (nvic_state *)opaque; 407 uint32_t offset = addr; 408 int i; 409 uint32_t val; 410 411 switch (offset) { 412 case 0xd18 ... 0xd23: /* System Handler Priority. */ 413 val = 0; 414 for (i = 0; i < size; i++) { 415 val |= s->gic.priority1[(offset - 0xd14) + i][0] << (i * 8); 416 } 417 return val; 418 case 0xfe0 ... 0xfff: /* ID. */ 419 if (offset & 3) { 420 return 0; 421 } 422 return nvic_id[(offset - 0xfe0) >> 2]; 423 } 424 if (size == 4) { 425 return nvic_readl(s, offset); 426 } 427 qemu_log_mask(LOG_GUEST_ERROR, 428 "NVIC: Bad read of size %d at offset 0x%x\n", size, offset); 429 return 0; 430 } 431 432 static void nvic_sysreg_write(void *opaque, hwaddr addr, 433 uint64_t value, unsigned size) 434 { 435 nvic_state *s = (nvic_state *)opaque; 436 uint32_t offset = addr; 437 int i; 438 439 switch (offset) { 440 case 0xd18 ... 0xd23: /* System Handler Priority. */ 441 for (i = 0; i < size; i++) { 442 s->gic.priority1[(offset - 0xd14) + i][0] = 443 (value >> (i * 8)) & 0xff; 444 } 445 gic_update(&s->gic); 446 return; 447 } 448 if (size == 4) { 449 nvic_writel(s, offset, value); 450 return; 451 } 452 qemu_log_mask(LOG_GUEST_ERROR, 453 "NVIC: Bad write of size %d at offset 0x%x\n", size, offset); 454 } 455 456 static const MemoryRegionOps nvic_sysreg_ops = { 457 .read = nvic_sysreg_read, 458 .write = nvic_sysreg_write, 459 .endianness = DEVICE_NATIVE_ENDIAN, 460 }; 461 462 static const VMStateDescription vmstate_nvic = { 463 .name = "armv7m_nvic", 464 .version_id = 1, 465 .minimum_version_id = 1, 466 .fields = (VMStateField[]) { 467 VMSTATE_UINT32(systick.control, nvic_state), 468 VMSTATE_UINT32(systick.reload, nvic_state), 469 VMSTATE_INT64(systick.tick, nvic_state), 470 VMSTATE_TIMER_PTR(systick.timer, nvic_state), 471 VMSTATE_END_OF_LIST() 472 } 473 }; 474 475 static void armv7m_nvic_reset(DeviceState *dev) 476 { 477 nvic_state *s = NVIC(dev); 478 NVICClass *nc = NVIC_GET_CLASS(s); 479 nc->parent_reset(dev); 480 /* Common GIC reset resets to disabled; the NVIC doesn't have 481 * per-CPU interfaces so mark our non-existent CPU interface 482 * as enabled by default, and with a priority mask which allows 483 * all interrupts through. 484 */ 485 s->gic.cpu_ctlr[0] = GICC_CTLR_EN_GRP0; 486 s->gic.priority_mask[0] = 0x100; 487 /* The NVIC as a whole is always enabled. */ 488 s->gic.ctlr = 1; 489 systick_reset(s); 490 } 491 492 static void armv7m_nvic_realize(DeviceState *dev, Error **errp) 493 { 494 nvic_state *s = NVIC(dev); 495 NVICClass *nc = NVIC_GET_CLASS(s); 496 Error *local_err = NULL; 497 498 /* The NVIC always has only one CPU */ 499 s->gic.num_cpu = 1; 500 /* Tell the common code we're an NVIC */ 501 s->gic.revision = 0xffffffff; 502 s->num_irq = s->gic.num_irq; 503 nc->parent_realize(dev, &local_err); 504 if (local_err) { 505 error_propagate(errp, local_err); 506 return; 507 } 508 gic_init_irqs_and_distributor(&s->gic); 509 /* The NVIC and system controller register area looks like this: 510 * 0..0xff : system control registers, including systick 511 * 0x100..0xcff : GIC-like registers 512 * 0xd00..0xfff : system control registers 513 * We use overlaying to put the GIC like registers 514 * over the top of the system control register region. 515 */ 516 memory_region_init(&s->container, OBJECT(s), "nvic", 0x1000); 517 /* The system register region goes at the bottom of the priority 518 * stack as it covers the whole page. 519 */ 520 memory_region_init_io(&s->sysregmem, OBJECT(s), &nvic_sysreg_ops, s, 521 "nvic_sysregs", 0x1000); 522 memory_region_add_subregion(&s->container, 0, &s->sysregmem); 523 /* Alias the GIC region so we can get only the section of it 524 * we need, and layer it on top of the system register region. 525 */ 526 memory_region_init_alias(&s->gic_iomem_alias, OBJECT(s), 527 "nvic-gic", &s->gic.iomem, 528 0x100, 0xc00); 529 memory_region_add_subregion_overlap(&s->container, 0x100, 530 &s->gic_iomem_alias, 1); 531 /* Map the whole thing into system memory at the location required 532 * by the v7M architecture. 533 */ 534 memory_region_add_subregion(get_system_memory(), 0xe000e000, &s->container); 535 s->systick.timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, systick_timer_tick, s); 536 } 537 538 static void armv7m_nvic_instance_init(Object *obj) 539 { 540 /* We have a different default value for the num-irq property 541 * than our superclass. This function runs after qdev init 542 * has set the defaults from the Property array and before 543 * any user-specified property setting, so just modify the 544 * value in the GICState struct. 545 */ 546 GICState *s = ARM_GIC_COMMON(obj); 547 DeviceState *dev = DEVICE(obj); 548 nvic_state *nvic = NVIC(obj); 549 /* The ARM v7m may have anything from 0 to 496 external interrupt 550 * IRQ lines. We default to 64. Other boards may differ and should 551 * set the num-irq property appropriately. 552 */ 553 s->num_irq = 64; 554 qdev_init_gpio_out_named(dev, &nvic->sysresetreq, "SYSRESETREQ", 1); 555 } 556 557 static void armv7m_nvic_class_init(ObjectClass *klass, void *data) 558 { 559 NVICClass *nc = NVIC_CLASS(klass); 560 DeviceClass *dc = DEVICE_CLASS(klass); 561 562 nc->parent_reset = dc->reset; 563 nc->parent_realize = dc->realize; 564 dc->vmsd = &vmstate_nvic; 565 dc->reset = armv7m_nvic_reset; 566 dc->realize = armv7m_nvic_realize; 567 } 568 569 static const TypeInfo armv7m_nvic_info = { 570 .name = TYPE_NVIC, 571 .parent = TYPE_ARM_GIC_COMMON, 572 .instance_init = armv7m_nvic_instance_init, 573 .instance_size = sizeof(nvic_state), 574 .class_init = armv7m_nvic_class_init, 575 .class_size = sizeof(NVICClass), 576 }; 577 578 static void armv7m_nvic_register_types(void) 579 { 580 type_register_static(&armv7m_nvic_info); 581 } 582 583 type_init(armv7m_nvic_register_types) 584