1 /* 2 * ARM Nested Vectored Interrupt Controller 3 * 4 * Copyright (c) 2006-2007 CodeSourcery. 5 * Written by Paul Brook 6 * 7 * This code is licensed under the GPL. 8 * 9 * The ARMv7M System controller is fairly tightly tied in with the 10 * NVIC. Much of that is also implemented here. 11 */ 12 13 #include "qemu/osdep.h" 14 #include "hw/sysbus.h" 15 #include "qemu/timer.h" 16 #include "hw/arm/arm.h" 17 #include "exec/address-spaces.h" 18 #include "gic_internal.h" 19 20 typedef struct { 21 GICState gic; 22 struct { 23 uint32_t control; 24 uint32_t reload; 25 int64_t tick; 26 QEMUTimer *timer; 27 } systick; 28 MemoryRegion sysregmem; 29 MemoryRegion gic_iomem_alias; 30 MemoryRegion container; 31 uint32_t num_irq; 32 qemu_irq sysresetreq; 33 } nvic_state; 34 35 #define TYPE_NVIC "armv7m_nvic" 36 /** 37 * NVICClass: 38 * @parent_reset: the parent class' reset handler. 39 * 40 * A model of the v7M NVIC and System Controller 41 */ 42 typedef struct NVICClass { 43 /*< private >*/ 44 ARMGICClass parent_class; 45 /*< public >*/ 46 DeviceRealize parent_realize; 47 void (*parent_reset)(DeviceState *dev); 48 } NVICClass; 49 50 #define NVIC_CLASS(klass) \ 51 OBJECT_CLASS_CHECK(NVICClass, (klass), TYPE_NVIC) 52 #define NVIC_GET_CLASS(obj) \ 53 OBJECT_GET_CLASS(NVICClass, (obj), TYPE_NVIC) 54 #define NVIC(obj) \ 55 OBJECT_CHECK(nvic_state, (obj), TYPE_NVIC) 56 57 static const uint8_t nvic_id[] = { 58 0x00, 0xb0, 0x1b, 0x00, 0x0d, 0xe0, 0x05, 0xb1 59 }; 60 61 /* qemu timers run at 1GHz. We want something closer to 1MHz. */ 62 #define SYSTICK_SCALE 1000ULL 63 64 #define SYSTICK_ENABLE (1 << 0) 65 #define SYSTICK_TICKINT (1 << 1) 66 #define SYSTICK_CLKSOURCE (1 << 2) 67 #define SYSTICK_COUNTFLAG (1 << 16) 68 69 int system_clock_scale; 70 71 /* Conversion factor from qemu timer to SysTick frequencies. */ 72 static inline int64_t systick_scale(nvic_state *s) 73 { 74 if (s->systick.control & SYSTICK_CLKSOURCE) 75 return system_clock_scale; 76 else 77 return 1000; 78 } 79 80 static void systick_reload(nvic_state *s, int reset) 81 { 82 /* The Cortex-M3 Devices Generic User Guide says that "When the 83 * ENABLE bit is set to 1, the counter loads the RELOAD value from the 84 * SYST RVR register and then counts down". So, we need to check the 85 * ENABLE bit before reloading the value. 86 */ 87 if ((s->systick.control & SYSTICK_ENABLE) == 0) { 88 return; 89 } 90 91 if (reset) 92 s->systick.tick = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL); 93 s->systick.tick += (s->systick.reload + 1) * systick_scale(s); 94 timer_mod(s->systick.timer, s->systick.tick); 95 } 96 97 static void systick_timer_tick(void * opaque) 98 { 99 nvic_state *s = (nvic_state *)opaque; 100 s->systick.control |= SYSTICK_COUNTFLAG; 101 if (s->systick.control & SYSTICK_TICKINT) { 102 /* Trigger the interrupt. */ 103 armv7m_nvic_set_pending(s, ARMV7M_EXCP_SYSTICK); 104 } 105 if (s->systick.reload == 0) { 106 s->systick.control &= ~SYSTICK_ENABLE; 107 } else { 108 systick_reload(s, 0); 109 } 110 } 111 112 static void systick_reset(nvic_state *s) 113 { 114 s->systick.control = 0; 115 s->systick.reload = 0; 116 s->systick.tick = 0; 117 timer_del(s->systick.timer); 118 } 119 120 /* The external routines use the hardware vector numbering, ie. the first 121 IRQ is #16. The internal GIC routines use #32 as the first IRQ. */ 122 void armv7m_nvic_set_pending(void *opaque, int irq) 123 { 124 nvic_state *s = (nvic_state *)opaque; 125 if (irq >= 16) 126 irq += 16; 127 gic_set_pending_private(&s->gic, 0, irq); 128 } 129 130 /* Make pending IRQ active. */ 131 int armv7m_nvic_acknowledge_irq(void *opaque) 132 { 133 nvic_state *s = (nvic_state *)opaque; 134 uint32_t irq; 135 136 irq = gic_acknowledge_irq(&s->gic, 0, MEMTXATTRS_UNSPECIFIED); 137 if (irq == 1023) 138 hw_error("Interrupt but no vector\n"); 139 if (irq >= 32) 140 irq -= 16; 141 return irq; 142 } 143 144 void armv7m_nvic_complete_irq(void *opaque, int irq) 145 { 146 nvic_state *s = (nvic_state *)opaque; 147 if (irq >= 16) 148 irq += 16; 149 gic_complete_irq(&s->gic, 0, irq, MEMTXATTRS_UNSPECIFIED); 150 } 151 152 static uint32_t nvic_readl(nvic_state *s, uint32_t offset) 153 { 154 ARMCPU *cpu; 155 uint32_t val; 156 int irq; 157 158 switch (offset) { 159 case 4: /* Interrupt Control Type. */ 160 return (s->num_irq / 32) - 1; 161 case 0x10: /* SysTick Control and Status. */ 162 val = s->systick.control; 163 s->systick.control &= ~SYSTICK_COUNTFLAG; 164 return val; 165 case 0x14: /* SysTick Reload Value. */ 166 return s->systick.reload; 167 case 0x18: /* SysTick Current Value. */ 168 { 169 int64_t t; 170 if ((s->systick.control & SYSTICK_ENABLE) == 0) 171 return 0; 172 t = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL); 173 if (t >= s->systick.tick) 174 return 0; 175 val = ((s->systick.tick - (t + 1)) / systick_scale(s)) + 1; 176 /* The interrupt in triggered when the timer reaches zero. 177 However the counter is not reloaded until the next clock 178 tick. This is a hack to return zero during the first tick. */ 179 if (val > s->systick.reload) 180 val = 0; 181 return val; 182 } 183 case 0x1c: /* SysTick Calibration Value. */ 184 return 10000; 185 case 0xd00: /* CPUID Base. */ 186 cpu = ARM_CPU(current_cpu); 187 return cpu->midr; 188 case 0xd04: /* Interrupt Control State. */ 189 /* VECTACTIVE */ 190 cpu = ARM_CPU(current_cpu); 191 val = cpu->env.v7m.exception; 192 if (val == 1023) { 193 val = 0; 194 } else if (val >= 32) { 195 val -= 16; 196 } 197 /* VECTPENDING */ 198 if (s->gic.current_pending[0] != 1023) 199 val |= (s->gic.current_pending[0] << 12); 200 /* ISRPENDING and RETTOBASE */ 201 for (irq = 32; irq < s->num_irq; irq++) { 202 if (s->gic.irq_state[irq].pending) { 203 val |= (1 << 22); 204 break; 205 } 206 if (irq != cpu->env.v7m.exception && s->gic.irq_state[irq].active) { 207 val |= (1 << 11); 208 } 209 } 210 /* PENDSTSET */ 211 if (s->gic.irq_state[ARMV7M_EXCP_SYSTICK].pending) 212 val |= (1 << 26); 213 /* PENDSVSET */ 214 if (s->gic.irq_state[ARMV7M_EXCP_PENDSV].pending) 215 val |= (1 << 28); 216 /* NMIPENDSET */ 217 if (s->gic.irq_state[ARMV7M_EXCP_NMI].pending) 218 val |= (1 << 31); 219 return val; 220 case 0xd08: /* Vector Table Offset. */ 221 cpu = ARM_CPU(current_cpu); 222 return cpu->env.v7m.vecbase; 223 case 0xd0c: /* Application Interrupt/Reset Control. */ 224 return 0xfa050000; 225 case 0xd10: /* System Control. */ 226 /* TODO: Implement SLEEPONEXIT. */ 227 return 0; 228 case 0xd14: /* Configuration Control. */ 229 /* TODO: Implement Configuration Control bits. */ 230 return 0; 231 case 0xd24: /* System Handler Status. */ 232 val = 0; 233 if (s->gic.irq_state[ARMV7M_EXCP_MEM].active) val |= (1 << 0); 234 if (s->gic.irq_state[ARMV7M_EXCP_BUS].active) val |= (1 << 1); 235 if (s->gic.irq_state[ARMV7M_EXCP_USAGE].active) val |= (1 << 3); 236 if (s->gic.irq_state[ARMV7M_EXCP_SVC].active) val |= (1 << 7); 237 if (s->gic.irq_state[ARMV7M_EXCP_DEBUG].active) val |= (1 << 8); 238 if (s->gic.irq_state[ARMV7M_EXCP_PENDSV].active) val |= (1 << 10); 239 if (s->gic.irq_state[ARMV7M_EXCP_SYSTICK].active) val |= (1 << 11); 240 if (s->gic.irq_state[ARMV7M_EXCP_USAGE].pending) val |= (1 << 12); 241 if (s->gic.irq_state[ARMV7M_EXCP_MEM].pending) val |= (1 << 13); 242 if (s->gic.irq_state[ARMV7M_EXCP_BUS].pending) val |= (1 << 14); 243 if (s->gic.irq_state[ARMV7M_EXCP_SVC].pending) val |= (1 << 15); 244 if (s->gic.irq_state[ARMV7M_EXCP_MEM].enabled) val |= (1 << 16); 245 if (s->gic.irq_state[ARMV7M_EXCP_BUS].enabled) val |= (1 << 17); 246 if (s->gic.irq_state[ARMV7M_EXCP_USAGE].enabled) val |= (1 << 18); 247 return val; 248 case 0xd28: /* Configurable Fault Status. */ 249 /* TODO: Implement Fault Status. */ 250 qemu_log_mask(LOG_UNIMP, "Configurable Fault Status unimplemented\n"); 251 return 0; 252 case 0xd2c: /* Hard Fault Status. */ 253 case 0xd30: /* Debug Fault Status. */ 254 case 0xd34: /* Mem Manage Address. */ 255 case 0xd38: /* Bus Fault Address. */ 256 case 0xd3c: /* Aux Fault Status. */ 257 /* TODO: Implement fault status registers. */ 258 qemu_log_mask(LOG_UNIMP, "Fault status registers unimplemented\n"); 259 return 0; 260 case 0xd40: /* PFR0. */ 261 return 0x00000030; 262 case 0xd44: /* PRF1. */ 263 return 0x00000200; 264 case 0xd48: /* DFR0. */ 265 return 0x00100000; 266 case 0xd4c: /* AFR0. */ 267 return 0x00000000; 268 case 0xd50: /* MMFR0. */ 269 return 0x00000030; 270 case 0xd54: /* MMFR1. */ 271 return 0x00000000; 272 case 0xd58: /* MMFR2. */ 273 return 0x00000000; 274 case 0xd5c: /* MMFR3. */ 275 return 0x00000000; 276 case 0xd60: /* ISAR0. */ 277 return 0x01141110; 278 case 0xd64: /* ISAR1. */ 279 return 0x02111000; 280 case 0xd68: /* ISAR2. */ 281 return 0x21112231; 282 case 0xd6c: /* ISAR3. */ 283 return 0x01111110; 284 case 0xd70: /* ISAR4. */ 285 return 0x01310102; 286 /* TODO: Implement debug registers. */ 287 default: 288 qemu_log_mask(LOG_GUEST_ERROR, "NVIC: Bad read offset 0x%x\n", offset); 289 return 0; 290 } 291 } 292 293 static void nvic_writel(nvic_state *s, uint32_t offset, uint32_t value) 294 { 295 ARMCPU *cpu; 296 uint32_t oldval; 297 switch (offset) { 298 case 0x10: /* SysTick Control and Status. */ 299 oldval = s->systick.control; 300 s->systick.control &= 0xfffffff8; 301 s->systick.control |= value & 7; 302 if ((oldval ^ value) & SYSTICK_ENABLE) { 303 int64_t now = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL); 304 if (value & SYSTICK_ENABLE) { 305 if (s->systick.tick) { 306 s->systick.tick += now; 307 timer_mod(s->systick.timer, s->systick.tick); 308 } else { 309 systick_reload(s, 1); 310 } 311 } else { 312 timer_del(s->systick.timer); 313 s->systick.tick -= now; 314 if (s->systick.tick < 0) 315 s->systick.tick = 0; 316 } 317 } else if ((oldval ^ value) & SYSTICK_CLKSOURCE) { 318 /* This is a hack. Force the timer to be reloaded 319 when the reference clock is changed. */ 320 systick_reload(s, 1); 321 } 322 break; 323 case 0x14: /* SysTick Reload Value. */ 324 s->systick.reload = value; 325 break; 326 case 0x18: /* SysTick Current Value. Writes reload the timer. */ 327 systick_reload(s, 1); 328 s->systick.control &= ~SYSTICK_COUNTFLAG; 329 break; 330 case 0xd04: /* Interrupt Control State. */ 331 if (value & (1 << 31)) { 332 armv7m_nvic_set_pending(s, ARMV7M_EXCP_NMI); 333 } 334 if (value & (1 << 28)) { 335 armv7m_nvic_set_pending(s, ARMV7M_EXCP_PENDSV); 336 } else if (value & (1 << 27)) { 337 s->gic.irq_state[ARMV7M_EXCP_PENDSV].pending = 0; 338 gic_update(&s->gic); 339 } 340 if (value & (1 << 26)) { 341 armv7m_nvic_set_pending(s, ARMV7M_EXCP_SYSTICK); 342 } else if (value & (1 << 25)) { 343 s->gic.irq_state[ARMV7M_EXCP_SYSTICK].pending = 0; 344 gic_update(&s->gic); 345 } 346 break; 347 case 0xd08: /* Vector Table Offset. */ 348 cpu = ARM_CPU(current_cpu); 349 cpu->env.v7m.vecbase = value & 0xffffff80; 350 break; 351 case 0xd0c: /* Application Interrupt/Reset Control. */ 352 if ((value >> 16) == 0x05fa) { 353 if (value & 4) { 354 qemu_irq_pulse(s->sysresetreq); 355 } 356 if (value & 2) { 357 qemu_log_mask(LOG_UNIMP, "VECTCLRACTIVE unimplemented\n"); 358 } 359 if (value & 1) { 360 qemu_log_mask(LOG_UNIMP, "AIRCR system reset unimplemented\n"); 361 } 362 if (value & 0x700) { 363 qemu_log_mask(LOG_UNIMP, "PRIGROUP unimplemented\n"); 364 } 365 } 366 break; 367 case 0xd10: /* System Control. */ 368 case 0xd14: /* Configuration Control. */ 369 /* TODO: Implement control registers. */ 370 qemu_log_mask(LOG_UNIMP, "NVIC: SCR and CCR unimplemented\n"); 371 break; 372 case 0xd24: /* System Handler Control. */ 373 /* TODO: Real hardware allows you to set/clear the active bits 374 under some circumstances. We don't implement this. */ 375 s->gic.irq_state[ARMV7M_EXCP_MEM].enabled = (value & (1 << 16)) != 0; 376 s->gic.irq_state[ARMV7M_EXCP_BUS].enabled = (value & (1 << 17)) != 0; 377 s->gic.irq_state[ARMV7M_EXCP_USAGE].enabled = (value & (1 << 18)) != 0; 378 break; 379 case 0xd28: /* Configurable Fault Status. */ 380 case 0xd2c: /* Hard Fault Status. */ 381 case 0xd30: /* Debug Fault Status. */ 382 case 0xd34: /* Mem Manage Address. */ 383 case 0xd38: /* Bus Fault Address. */ 384 case 0xd3c: /* Aux Fault Status. */ 385 qemu_log_mask(LOG_UNIMP, 386 "NVIC: fault status registers unimplemented\n"); 387 break; 388 case 0xf00: /* Software Triggered Interrupt Register */ 389 if ((value & 0x1ff) < s->num_irq) { 390 gic_set_pending_private(&s->gic, 0, value & 0x1ff); 391 } 392 break; 393 default: 394 qemu_log_mask(LOG_GUEST_ERROR, 395 "NVIC: Bad write offset 0x%x\n", offset); 396 } 397 } 398 399 static uint64_t nvic_sysreg_read(void *opaque, hwaddr addr, 400 unsigned size) 401 { 402 nvic_state *s = (nvic_state *)opaque; 403 uint32_t offset = addr; 404 int i; 405 uint32_t val; 406 407 switch (offset) { 408 case 0xd18 ... 0xd23: /* System Handler Priority. */ 409 val = 0; 410 for (i = 0; i < size; i++) { 411 val |= s->gic.priority1[(offset - 0xd14) + i][0] << (i * 8); 412 } 413 return val; 414 case 0xfe0 ... 0xfff: /* ID. */ 415 if (offset & 3) { 416 return 0; 417 } 418 return nvic_id[(offset - 0xfe0) >> 2]; 419 } 420 if (size == 4) { 421 return nvic_readl(s, offset); 422 } 423 qemu_log_mask(LOG_GUEST_ERROR, 424 "NVIC: Bad read of size %d at offset 0x%x\n", size, offset); 425 return 0; 426 } 427 428 static void nvic_sysreg_write(void *opaque, hwaddr addr, 429 uint64_t value, unsigned size) 430 { 431 nvic_state *s = (nvic_state *)opaque; 432 uint32_t offset = addr; 433 int i; 434 435 switch (offset) { 436 case 0xd18 ... 0xd23: /* System Handler Priority. */ 437 for (i = 0; i < size; i++) { 438 s->gic.priority1[(offset - 0xd14) + i][0] = 439 (value >> (i * 8)) & 0xff; 440 } 441 gic_update(&s->gic); 442 return; 443 } 444 if (size == 4) { 445 nvic_writel(s, offset, value); 446 return; 447 } 448 qemu_log_mask(LOG_GUEST_ERROR, 449 "NVIC: Bad write of size %d at offset 0x%x\n", size, offset); 450 } 451 452 static const MemoryRegionOps nvic_sysreg_ops = { 453 .read = nvic_sysreg_read, 454 .write = nvic_sysreg_write, 455 .endianness = DEVICE_NATIVE_ENDIAN, 456 }; 457 458 static const VMStateDescription vmstate_nvic = { 459 .name = "armv7m_nvic", 460 .version_id = 1, 461 .minimum_version_id = 1, 462 .fields = (VMStateField[]) { 463 VMSTATE_UINT32(systick.control, nvic_state), 464 VMSTATE_UINT32(systick.reload, nvic_state), 465 VMSTATE_INT64(systick.tick, nvic_state), 466 VMSTATE_TIMER_PTR(systick.timer, nvic_state), 467 VMSTATE_END_OF_LIST() 468 } 469 }; 470 471 static void armv7m_nvic_reset(DeviceState *dev) 472 { 473 nvic_state *s = NVIC(dev); 474 NVICClass *nc = NVIC_GET_CLASS(s); 475 nc->parent_reset(dev); 476 /* Common GIC reset resets to disabled; the NVIC doesn't have 477 * per-CPU interfaces so mark our non-existent CPU interface 478 * as enabled by default, and with a priority mask which allows 479 * all interrupts through. 480 */ 481 s->gic.cpu_ctlr[0] = GICC_CTLR_EN_GRP0; 482 s->gic.priority_mask[0] = 0x100; 483 /* The NVIC as a whole is always enabled. */ 484 s->gic.ctlr = 1; 485 systick_reset(s); 486 } 487 488 static void armv7m_nvic_realize(DeviceState *dev, Error **errp) 489 { 490 nvic_state *s = NVIC(dev); 491 NVICClass *nc = NVIC_GET_CLASS(s); 492 Error *local_err = NULL; 493 494 /* The NVIC always has only one CPU */ 495 s->gic.num_cpu = 1; 496 /* Tell the common code we're an NVIC */ 497 s->gic.revision = 0xffffffff; 498 s->num_irq = s->gic.num_irq; 499 nc->parent_realize(dev, &local_err); 500 if (local_err) { 501 error_propagate(errp, local_err); 502 return; 503 } 504 gic_init_irqs_and_distributor(&s->gic); 505 /* The NVIC and system controller register area looks like this: 506 * 0..0xff : system control registers, including systick 507 * 0x100..0xcff : GIC-like registers 508 * 0xd00..0xfff : system control registers 509 * We use overlaying to put the GIC like registers 510 * over the top of the system control register region. 511 */ 512 memory_region_init(&s->container, OBJECT(s), "nvic", 0x1000); 513 /* The system register region goes at the bottom of the priority 514 * stack as it covers the whole page. 515 */ 516 memory_region_init_io(&s->sysregmem, OBJECT(s), &nvic_sysreg_ops, s, 517 "nvic_sysregs", 0x1000); 518 memory_region_add_subregion(&s->container, 0, &s->sysregmem); 519 /* Alias the GIC region so we can get only the section of it 520 * we need, and layer it on top of the system register region. 521 */ 522 memory_region_init_alias(&s->gic_iomem_alias, OBJECT(s), 523 "nvic-gic", &s->gic.iomem, 524 0x100, 0xc00); 525 memory_region_add_subregion_overlap(&s->container, 0x100, 526 &s->gic_iomem_alias, 1); 527 /* Map the whole thing into system memory at the location required 528 * by the v7M architecture. 529 */ 530 memory_region_add_subregion(get_system_memory(), 0xe000e000, &s->container); 531 s->systick.timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, systick_timer_tick, s); 532 } 533 534 static void armv7m_nvic_instance_init(Object *obj) 535 { 536 /* We have a different default value for the num-irq property 537 * than our superclass. This function runs after qdev init 538 * has set the defaults from the Property array and before 539 * any user-specified property setting, so just modify the 540 * value in the GICState struct. 541 */ 542 GICState *s = ARM_GIC_COMMON(obj); 543 DeviceState *dev = DEVICE(obj); 544 nvic_state *nvic = NVIC(obj); 545 /* The ARM v7m may have anything from 0 to 496 external interrupt 546 * IRQ lines. We default to 64. Other boards may differ and should 547 * set the num-irq property appropriately. 548 */ 549 s->num_irq = 64; 550 qdev_init_gpio_out_named(dev, &nvic->sysresetreq, "SYSRESETREQ", 1); 551 } 552 553 static void armv7m_nvic_class_init(ObjectClass *klass, void *data) 554 { 555 NVICClass *nc = NVIC_CLASS(klass); 556 DeviceClass *dc = DEVICE_CLASS(klass); 557 558 nc->parent_reset = dc->reset; 559 nc->parent_realize = dc->realize; 560 dc->vmsd = &vmstate_nvic; 561 dc->reset = armv7m_nvic_reset; 562 dc->realize = armv7m_nvic_realize; 563 } 564 565 static const TypeInfo armv7m_nvic_info = { 566 .name = TYPE_NVIC, 567 .parent = TYPE_ARM_GIC_COMMON, 568 .instance_init = armv7m_nvic_instance_init, 569 .instance_size = sizeof(nvic_state), 570 .class_init = armv7m_nvic_class_init, 571 .class_size = sizeof(NVICClass), 572 }; 573 574 static void armv7m_nvic_register_types(void) 575 { 576 type_register_static(&armv7m_nvic_info); 577 } 578 579 type_init(armv7m_nvic_register_types) 580