1 /* 2 * ARM Nested Vectored Interrupt Controller 3 * 4 * Copyright (c) 2006-2007 CodeSourcery. 5 * Written by Paul Brook 6 * 7 * This code is licensed under the GPL. 8 * 9 * The ARMv7M System controller is fairly tightly tied in with the 10 * NVIC. Much of that is also implemented here. 11 */ 12 13 #include "hw/sysbus.h" 14 #include "qemu/timer.h" 15 #include "hw/arm/arm.h" 16 #include "exec/address-spaces.h" 17 #include "gic_internal.h" 18 19 typedef struct { 20 GICState gic; 21 struct { 22 uint32_t control; 23 uint32_t reload; 24 int64_t tick; 25 QEMUTimer *timer; 26 } systick; 27 MemoryRegion sysregmem; 28 MemoryRegion gic_iomem_alias; 29 MemoryRegion container; 30 uint32_t num_irq; 31 } nvic_state; 32 33 #define TYPE_NVIC "armv7m_nvic" 34 /** 35 * NVICClass: 36 * @parent_reset: the parent class' reset handler. 37 * 38 * A model of the v7M NVIC and System Controller 39 */ 40 typedef struct NVICClass { 41 /*< private >*/ 42 ARMGICClass parent_class; 43 /*< public >*/ 44 DeviceRealize parent_realize; 45 void (*parent_reset)(DeviceState *dev); 46 } NVICClass; 47 48 #define NVIC_CLASS(klass) \ 49 OBJECT_CLASS_CHECK(NVICClass, (klass), TYPE_NVIC) 50 #define NVIC_GET_CLASS(obj) \ 51 OBJECT_GET_CLASS(NVICClass, (obj), TYPE_NVIC) 52 #define NVIC(obj) \ 53 OBJECT_CHECK(nvic_state, (obj), TYPE_NVIC) 54 55 static const uint8_t nvic_id[] = { 56 0x00, 0xb0, 0x1b, 0x00, 0x0d, 0xe0, 0x05, 0xb1 57 }; 58 59 /* qemu timers run at 1GHz. We want something closer to 1MHz. */ 60 #define SYSTICK_SCALE 1000ULL 61 62 #define SYSTICK_ENABLE (1 << 0) 63 #define SYSTICK_TICKINT (1 << 1) 64 #define SYSTICK_CLKSOURCE (1 << 2) 65 #define SYSTICK_COUNTFLAG (1 << 16) 66 67 int system_clock_scale; 68 69 /* Conversion factor from qemu timer to SysTick frequencies. */ 70 static inline int64_t systick_scale(nvic_state *s) 71 { 72 if (s->systick.control & SYSTICK_CLKSOURCE) 73 return system_clock_scale; 74 else 75 return 1000; 76 } 77 78 static void systick_reload(nvic_state *s, int reset) 79 { 80 /* The Cortex-M3 Devices Generic User Guide says that "When the 81 * ENABLE bit is set to 1, the counter loads the RELOAD value from the 82 * SYST RVR register and then counts down". So, we need to check the 83 * ENABLE bit before reloading the value. 84 */ 85 if ((s->systick.control & SYSTICK_ENABLE) == 0) { 86 return; 87 } 88 89 if (reset) 90 s->systick.tick = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL); 91 s->systick.tick += (s->systick.reload + 1) * systick_scale(s); 92 timer_mod(s->systick.timer, s->systick.tick); 93 } 94 95 static void systick_timer_tick(void * opaque) 96 { 97 nvic_state *s = (nvic_state *)opaque; 98 s->systick.control |= SYSTICK_COUNTFLAG; 99 if (s->systick.control & SYSTICK_TICKINT) { 100 /* Trigger the interrupt. */ 101 armv7m_nvic_set_pending(s, ARMV7M_EXCP_SYSTICK); 102 } 103 if (s->systick.reload == 0) { 104 s->systick.control &= ~SYSTICK_ENABLE; 105 } else { 106 systick_reload(s, 0); 107 } 108 } 109 110 static void systick_reset(nvic_state *s) 111 { 112 s->systick.control = 0; 113 s->systick.reload = 0; 114 s->systick.tick = 0; 115 timer_del(s->systick.timer); 116 } 117 118 /* The external routines use the hardware vector numbering, ie. the first 119 IRQ is #16. The internal GIC routines use #32 as the first IRQ. */ 120 void armv7m_nvic_set_pending(void *opaque, int irq) 121 { 122 nvic_state *s = (nvic_state *)opaque; 123 if (irq >= 16) 124 irq += 16; 125 gic_set_pending_private(&s->gic, 0, irq); 126 } 127 128 /* Make pending IRQ active. */ 129 int armv7m_nvic_acknowledge_irq(void *opaque) 130 { 131 nvic_state *s = (nvic_state *)opaque; 132 uint32_t irq; 133 134 irq = gic_acknowledge_irq(&s->gic, 0, MEMTXATTRS_UNSPECIFIED); 135 if (irq == 1023) 136 hw_error("Interrupt but no vector\n"); 137 if (irq >= 32) 138 irq -= 16; 139 return irq; 140 } 141 142 void armv7m_nvic_complete_irq(void *opaque, int irq) 143 { 144 nvic_state *s = (nvic_state *)opaque; 145 if (irq >= 16) 146 irq += 16; 147 gic_complete_irq(&s->gic, 0, irq, MEMTXATTRS_UNSPECIFIED); 148 } 149 150 static uint32_t nvic_readl(nvic_state *s, uint32_t offset) 151 { 152 ARMCPU *cpu; 153 uint32_t val; 154 int irq; 155 156 switch (offset) { 157 case 4: /* Interrupt Control Type. */ 158 return (s->num_irq / 32) - 1; 159 case 0x10: /* SysTick Control and Status. */ 160 val = s->systick.control; 161 s->systick.control &= ~SYSTICK_COUNTFLAG; 162 return val; 163 case 0x14: /* SysTick Reload Value. */ 164 return s->systick.reload; 165 case 0x18: /* SysTick Current Value. */ 166 { 167 int64_t t; 168 if ((s->systick.control & SYSTICK_ENABLE) == 0) 169 return 0; 170 t = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL); 171 if (t >= s->systick.tick) 172 return 0; 173 val = ((s->systick.tick - (t + 1)) / systick_scale(s)) + 1; 174 /* The interrupt in triggered when the timer reaches zero. 175 However the counter is not reloaded until the next clock 176 tick. This is a hack to return zero during the first tick. */ 177 if (val > s->systick.reload) 178 val = 0; 179 return val; 180 } 181 case 0x1c: /* SysTick Calibration Value. */ 182 return 10000; 183 case 0xd00: /* CPUID Base. */ 184 cpu = ARM_CPU(current_cpu); 185 return cpu->midr; 186 case 0xd04: /* Interrupt Control State. */ 187 /* VECTACTIVE */ 188 cpu = ARM_CPU(current_cpu); 189 val = cpu->env.v7m.exception; 190 if (val == 1023) { 191 val = 0; 192 } else if (val >= 32) { 193 val -= 16; 194 } 195 /* VECTPENDING */ 196 if (s->gic.current_pending[0] != 1023) 197 val |= (s->gic.current_pending[0] << 12); 198 /* ISRPENDING and RETTOBASE */ 199 for (irq = 32; irq < s->num_irq; irq++) { 200 if (s->gic.irq_state[irq].pending) { 201 val |= (1 << 22); 202 break; 203 } 204 if (irq != cpu->env.v7m.exception && s->gic.irq_state[irq].active) { 205 val |= (1 << 11); 206 } 207 } 208 /* PENDSTSET */ 209 if (s->gic.irq_state[ARMV7M_EXCP_SYSTICK].pending) 210 val |= (1 << 26); 211 /* PENDSVSET */ 212 if (s->gic.irq_state[ARMV7M_EXCP_PENDSV].pending) 213 val |= (1 << 28); 214 /* NMIPENDSET */ 215 if (s->gic.irq_state[ARMV7M_EXCP_NMI].pending) 216 val |= (1 << 31); 217 return val; 218 case 0xd08: /* Vector Table Offset. */ 219 cpu = ARM_CPU(current_cpu); 220 return cpu->env.v7m.vecbase; 221 case 0xd0c: /* Application Interrupt/Reset Control. */ 222 return 0xfa050000; 223 case 0xd10: /* System Control. */ 224 /* TODO: Implement SLEEPONEXIT. */ 225 return 0; 226 case 0xd14: /* Configuration Control. */ 227 /* TODO: Implement Configuration Control bits. */ 228 return 0; 229 case 0xd24: /* System Handler Status. */ 230 val = 0; 231 if (s->gic.irq_state[ARMV7M_EXCP_MEM].active) val |= (1 << 0); 232 if (s->gic.irq_state[ARMV7M_EXCP_BUS].active) val |= (1 << 1); 233 if (s->gic.irq_state[ARMV7M_EXCP_USAGE].active) val |= (1 << 3); 234 if (s->gic.irq_state[ARMV7M_EXCP_SVC].active) val |= (1 << 7); 235 if (s->gic.irq_state[ARMV7M_EXCP_DEBUG].active) val |= (1 << 8); 236 if (s->gic.irq_state[ARMV7M_EXCP_PENDSV].active) val |= (1 << 10); 237 if (s->gic.irq_state[ARMV7M_EXCP_SYSTICK].active) val |= (1 << 11); 238 if (s->gic.irq_state[ARMV7M_EXCP_USAGE].pending) val |= (1 << 12); 239 if (s->gic.irq_state[ARMV7M_EXCP_MEM].pending) val |= (1 << 13); 240 if (s->gic.irq_state[ARMV7M_EXCP_BUS].pending) val |= (1 << 14); 241 if (s->gic.irq_state[ARMV7M_EXCP_SVC].pending) val |= (1 << 15); 242 if (s->gic.irq_state[ARMV7M_EXCP_MEM].enabled) val |= (1 << 16); 243 if (s->gic.irq_state[ARMV7M_EXCP_BUS].enabled) val |= (1 << 17); 244 if (s->gic.irq_state[ARMV7M_EXCP_USAGE].enabled) val |= (1 << 18); 245 return val; 246 case 0xd28: /* Configurable Fault Status. */ 247 /* TODO: Implement Fault Status. */ 248 qemu_log_mask(LOG_UNIMP, "Configurable Fault Status unimplemented\n"); 249 return 0; 250 case 0xd2c: /* Hard Fault Status. */ 251 case 0xd30: /* Debug Fault Status. */ 252 case 0xd34: /* Mem Manage Address. */ 253 case 0xd38: /* Bus Fault Address. */ 254 case 0xd3c: /* Aux Fault Status. */ 255 /* TODO: Implement fault status registers. */ 256 qemu_log_mask(LOG_UNIMP, "Fault status registers unimplemented\n"); 257 return 0; 258 case 0xd40: /* PFR0. */ 259 return 0x00000030; 260 case 0xd44: /* PRF1. */ 261 return 0x00000200; 262 case 0xd48: /* DFR0. */ 263 return 0x00100000; 264 case 0xd4c: /* AFR0. */ 265 return 0x00000000; 266 case 0xd50: /* MMFR0. */ 267 return 0x00000030; 268 case 0xd54: /* MMFR1. */ 269 return 0x00000000; 270 case 0xd58: /* MMFR2. */ 271 return 0x00000000; 272 case 0xd5c: /* MMFR3. */ 273 return 0x00000000; 274 case 0xd60: /* ISAR0. */ 275 return 0x01141110; 276 case 0xd64: /* ISAR1. */ 277 return 0x02111000; 278 case 0xd68: /* ISAR2. */ 279 return 0x21112231; 280 case 0xd6c: /* ISAR3. */ 281 return 0x01111110; 282 case 0xd70: /* ISAR4. */ 283 return 0x01310102; 284 /* TODO: Implement debug registers. */ 285 default: 286 qemu_log_mask(LOG_GUEST_ERROR, "NVIC: Bad read offset 0x%x\n", offset); 287 return 0; 288 } 289 } 290 291 static void nvic_writel(nvic_state *s, uint32_t offset, uint32_t value) 292 { 293 ARMCPU *cpu; 294 uint32_t oldval; 295 switch (offset) { 296 case 0x10: /* SysTick Control and Status. */ 297 oldval = s->systick.control; 298 s->systick.control &= 0xfffffff8; 299 s->systick.control |= value & 7; 300 if ((oldval ^ value) & SYSTICK_ENABLE) { 301 int64_t now = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL); 302 if (value & SYSTICK_ENABLE) { 303 if (s->systick.tick) { 304 s->systick.tick += now; 305 timer_mod(s->systick.timer, s->systick.tick); 306 } else { 307 systick_reload(s, 1); 308 } 309 } else { 310 timer_del(s->systick.timer); 311 s->systick.tick -= now; 312 if (s->systick.tick < 0) 313 s->systick.tick = 0; 314 } 315 } else if ((oldval ^ value) & SYSTICK_CLKSOURCE) { 316 /* This is a hack. Force the timer to be reloaded 317 when the reference clock is changed. */ 318 systick_reload(s, 1); 319 } 320 break; 321 case 0x14: /* SysTick Reload Value. */ 322 s->systick.reload = value; 323 break; 324 case 0x18: /* SysTick Current Value. Writes reload the timer. */ 325 systick_reload(s, 1); 326 s->systick.control &= ~SYSTICK_COUNTFLAG; 327 break; 328 case 0xd04: /* Interrupt Control State. */ 329 if (value & (1 << 31)) { 330 armv7m_nvic_set_pending(s, ARMV7M_EXCP_NMI); 331 } 332 if (value & (1 << 28)) { 333 armv7m_nvic_set_pending(s, ARMV7M_EXCP_PENDSV); 334 } else if (value & (1 << 27)) { 335 s->gic.irq_state[ARMV7M_EXCP_PENDSV].pending = 0; 336 gic_update(&s->gic); 337 } 338 if (value & (1 << 26)) { 339 armv7m_nvic_set_pending(s, ARMV7M_EXCP_SYSTICK); 340 } else if (value & (1 << 25)) { 341 s->gic.irq_state[ARMV7M_EXCP_SYSTICK].pending = 0; 342 gic_update(&s->gic); 343 } 344 break; 345 case 0xd08: /* Vector Table Offset. */ 346 cpu = ARM_CPU(current_cpu); 347 cpu->env.v7m.vecbase = value & 0xffffff80; 348 break; 349 case 0xd0c: /* Application Interrupt/Reset Control. */ 350 if ((value >> 16) == 0x05fa) { 351 if (value & 2) { 352 qemu_log_mask(LOG_UNIMP, "VECTCLRACTIVE unimplemented\n"); 353 } 354 if (value & 5) { 355 qemu_log_mask(LOG_UNIMP, "AIRCR system reset unimplemented\n"); 356 } 357 if (value & 0x700) { 358 qemu_log_mask(LOG_UNIMP, "PRIGROUP unimplemented\n"); 359 } 360 } 361 break; 362 case 0xd10: /* System Control. */ 363 case 0xd14: /* Configuration Control. */ 364 /* TODO: Implement control registers. */ 365 qemu_log_mask(LOG_UNIMP, "NVIC: SCR and CCR unimplemented\n"); 366 break; 367 case 0xd24: /* System Handler Control. */ 368 /* TODO: Real hardware allows you to set/clear the active bits 369 under some circumstances. We don't implement this. */ 370 s->gic.irq_state[ARMV7M_EXCP_MEM].enabled = (value & (1 << 16)) != 0; 371 s->gic.irq_state[ARMV7M_EXCP_BUS].enabled = (value & (1 << 17)) != 0; 372 s->gic.irq_state[ARMV7M_EXCP_USAGE].enabled = (value & (1 << 18)) != 0; 373 break; 374 case 0xd28: /* Configurable Fault Status. */ 375 case 0xd2c: /* Hard Fault Status. */ 376 case 0xd30: /* Debug Fault Status. */ 377 case 0xd34: /* Mem Manage Address. */ 378 case 0xd38: /* Bus Fault Address. */ 379 case 0xd3c: /* Aux Fault Status. */ 380 qemu_log_mask(LOG_UNIMP, 381 "NVIC: fault status registers unimplemented\n"); 382 break; 383 case 0xf00: /* Software Triggered Interrupt Register */ 384 if ((value & 0x1ff) < s->num_irq) { 385 gic_set_pending_private(&s->gic, 0, value & 0x1ff); 386 } 387 break; 388 default: 389 qemu_log_mask(LOG_GUEST_ERROR, 390 "NVIC: Bad write offset 0x%x\n", offset); 391 } 392 } 393 394 static uint64_t nvic_sysreg_read(void *opaque, hwaddr addr, 395 unsigned size) 396 { 397 nvic_state *s = (nvic_state *)opaque; 398 uint32_t offset = addr; 399 int i; 400 uint32_t val; 401 402 switch (offset) { 403 case 0xd18 ... 0xd23: /* System Handler Priority. */ 404 val = 0; 405 for (i = 0; i < size; i++) { 406 val |= s->gic.priority1[(offset - 0xd14) + i][0] << (i * 8); 407 } 408 return val; 409 case 0xfe0 ... 0xfff: /* ID. */ 410 if (offset & 3) { 411 return 0; 412 } 413 return nvic_id[(offset - 0xfe0) >> 2]; 414 } 415 if (size == 4) { 416 return nvic_readl(s, offset); 417 } 418 qemu_log_mask(LOG_GUEST_ERROR, 419 "NVIC: Bad read of size %d at offset 0x%x\n", size, offset); 420 return 0; 421 } 422 423 static void nvic_sysreg_write(void *opaque, hwaddr addr, 424 uint64_t value, unsigned size) 425 { 426 nvic_state *s = (nvic_state *)opaque; 427 uint32_t offset = addr; 428 int i; 429 430 switch (offset) { 431 case 0xd18 ... 0xd23: /* System Handler Priority. */ 432 for (i = 0; i < size; i++) { 433 s->gic.priority1[(offset - 0xd14) + i][0] = 434 (value >> (i * 8)) & 0xff; 435 } 436 gic_update(&s->gic); 437 return; 438 } 439 if (size == 4) { 440 nvic_writel(s, offset, value); 441 return; 442 } 443 qemu_log_mask(LOG_GUEST_ERROR, 444 "NVIC: Bad write of size %d at offset 0x%x\n", size, offset); 445 } 446 447 static const MemoryRegionOps nvic_sysreg_ops = { 448 .read = nvic_sysreg_read, 449 .write = nvic_sysreg_write, 450 .endianness = DEVICE_NATIVE_ENDIAN, 451 }; 452 453 static const VMStateDescription vmstate_nvic = { 454 .name = "armv7m_nvic", 455 .version_id = 1, 456 .minimum_version_id = 1, 457 .fields = (VMStateField[]) { 458 VMSTATE_UINT32(systick.control, nvic_state), 459 VMSTATE_UINT32(systick.reload, nvic_state), 460 VMSTATE_INT64(systick.tick, nvic_state), 461 VMSTATE_TIMER_PTR(systick.timer, nvic_state), 462 VMSTATE_END_OF_LIST() 463 } 464 }; 465 466 static void armv7m_nvic_reset(DeviceState *dev) 467 { 468 nvic_state *s = NVIC(dev); 469 NVICClass *nc = NVIC_GET_CLASS(s); 470 nc->parent_reset(dev); 471 /* Common GIC reset resets to disabled; the NVIC doesn't have 472 * per-CPU interfaces so mark our non-existent CPU interface 473 * as enabled by default, and with a priority mask which allows 474 * all interrupts through. 475 */ 476 s->gic.cpu_ctlr[0] = GICC_CTLR_EN_GRP0; 477 s->gic.priority_mask[0] = 0x100; 478 /* The NVIC as a whole is always enabled. */ 479 s->gic.ctlr = 1; 480 systick_reset(s); 481 } 482 483 static void armv7m_nvic_realize(DeviceState *dev, Error **errp) 484 { 485 nvic_state *s = NVIC(dev); 486 NVICClass *nc = NVIC_GET_CLASS(s); 487 Error *local_err = NULL; 488 489 /* The NVIC always has only one CPU */ 490 s->gic.num_cpu = 1; 491 /* Tell the common code we're an NVIC */ 492 s->gic.revision = 0xffffffff; 493 s->num_irq = s->gic.num_irq; 494 nc->parent_realize(dev, &local_err); 495 if (local_err) { 496 error_propagate(errp, local_err); 497 return; 498 } 499 gic_init_irqs_and_distributor(&s->gic); 500 /* The NVIC and system controller register area looks like this: 501 * 0..0xff : system control registers, including systick 502 * 0x100..0xcff : GIC-like registers 503 * 0xd00..0xfff : system control registers 504 * We use overlaying to put the GIC like registers 505 * over the top of the system control register region. 506 */ 507 memory_region_init(&s->container, OBJECT(s), "nvic", 0x1000); 508 /* The system register region goes at the bottom of the priority 509 * stack as it covers the whole page. 510 */ 511 memory_region_init_io(&s->sysregmem, OBJECT(s), &nvic_sysreg_ops, s, 512 "nvic_sysregs", 0x1000); 513 memory_region_add_subregion(&s->container, 0, &s->sysregmem); 514 /* Alias the GIC region so we can get only the section of it 515 * we need, and layer it on top of the system register region. 516 */ 517 memory_region_init_alias(&s->gic_iomem_alias, OBJECT(s), 518 "nvic-gic", &s->gic.iomem, 519 0x100, 0xc00); 520 memory_region_add_subregion_overlap(&s->container, 0x100, 521 &s->gic_iomem_alias, 1); 522 /* Map the whole thing into system memory at the location required 523 * by the v7M architecture. 524 */ 525 memory_region_add_subregion(get_system_memory(), 0xe000e000, &s->container); 526 s->systick.timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, systick_timer_tick, s); 527 } 528 529 static void armv7m_nvic_instance_init(Object *obj) 530 { 531 /* We have a different default value for the num-irq property 532 * than our superclass. This function runs after qdev init 533 * has set the defaults from the Property array and before 534 * any user-specified property setting, so just modify the 535 * value in the GICState struct. 536 */ 537 GICState *s = ARM_GIC_COMMON(obj); 538 /* The ARM v7m may have anything from 0 to 496 external interrupt 539 * IRQ lines. We default to 64. Other boards may differ and should 540 * set the num-irq property appropriately. 541 */ 542 s->num_irq = 64; 543 } 544 545 static void armv7m_nvic_class_init(ObjectClass *klass, void *data) 546 { 547 NVICClass *nc = NVIC_CLASS(klass); 548 DeviceClass *dc = DEVICE_CLASS(klass); 549 550 nc->parent_reset = dc->reset; 551 nc->parent_realize = dc->realize; 552 dc->vmsd = &vmstate_nvic; 553 dc->reset = armv7m_nvic_reset; 554 dc->realize = armv7m_nvic_realize; 555 } 556 557 static const TypeInfo armv7m_nvic_info = { 558 .name = TYPE_NVIC, 559 .parent = TYPE_ARM_GIC_COMMON, 560 .instance_init = armv7m_nvic_instance_init, 561 .instance_size = sizeof(nvic_state), 562 .class_init = armv7m_nvic_class_init, 563 .class_size = sizeof(NVICClass), 564 }; 565 566 static void armv7m_nvic_register_types(void) 567 { 568 type_register_static(&armv7m_nvic_info); 569 } 570 571 type_init(armv7m_nvic_register_types) 572