In v8M the MSR and MRS instructions have extra register value

encodings to allow secure code to access the non-secure banked

version of various special registers.

(We don't implement the MSPLIM_NS or PSPLIM_NS aliases, because

we don't currently implement the stack limit registers at all.)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 1505240046-11454-2-git-send-email-peter.maydell@linaro.org

---

target/arm/helper.c | 110 ++++++++++++++++++++++++++++++++++++++++++++++++++++

1 file changed, 110 insertions(+)

diff --git a/target/arm/helper.c b/target/arm/helper.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/helper.c

+++ b/target/arm/helper.c

@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(v7m_mrs)(CPUARMState *env, uint32_t reg)

break;

case 20: /* CONTROL */

return env->v7m.control[env->v7m.secure];

+ case 0x94: /* CONTROL_NS */

+ /* We have to handle this here because unprivileged Secure code

+ * can read the NS CONTROL register.

+ */

+ if (!env->v7m.secure) {

+ return 0;

+ }

+ return env->v7m.control[M_REG_NS];

}

if (el == 0) {

return 0; /* unprivileged reads others as zero */

}

+ if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {

+ switch (reg) {

+ case 0x88: /* MSP_NS */

+ if (!env->v7m.secure) {

+ return 0;

+ }

+ return env->v7m.other_ss_msp;

+ case 0x89: /* PSP_NS */

+ if (!env->v7m.secure) {

+ return 0;

+ }

+ return env->v7m.other_ss_psp;

+ case 0x90: /* PRIMASK_NS */

+ if (!env->v7m.secure) {

+ return 0;

+ }

+ return env->v7m.primask[M_REG_NS];

+ case 0x91: /* BASEPRI_NS */

+ if (!env->v7m.secure) {

+ return 0;

+ }

+ return env->v7m.basepri[M_REG_NS];

+ case 0x93: /* FAULTMASK_NS */

+ if (!env->v7m.secure) {

+ return 0;

+ }

+ return env->v7m.faultmask[M_REG_NS];

+ case 0x98: /* SP_NS */

+ {

+ /* This gives the non-secure SP selected based on whether we're

+ * currently in handler mode or not, using the NS CONTROL.SPSEL.

+ */

+ bool spsel = env->v7m.control[M_REG_NS] & R_V7M_CONTROL_SPSEL_MASK;

+

+ if (!env->v7m.secure) {

+ return 0;

+ }

+ if (!arm_v7m_is_handler_mode(env) && spsel) {

+ return env->v7m.other_ss_psp;

+ } else {

+ return env->v7m.other_ss_msp;

+ }

+ }

+ default:

+ break;

+ }

+ }

+

switch (reg) {

case 8: /* MSP */

return (env->v7m.control[env->v7m.secure] & R_V7M_CONTROL_SPSEL_MASK) ?

@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val)

return;

}

+ if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {

+ switch (reg) {

+ case 0x88: /* MSP_NS */

+ if (!env->v7m.secure) {

+ return;

+ }

+ env->v7m.other_ss_msp = val;

+ return;

+ case 0x89: /* PSP_NS */

+ if (!env->v7m.secure) {

+ return;

+ }

+ env->v7m.other_ss_psp = val;

+ return;

+ case 0x90: /* PRIMASK_NS */

+ if (!env->v7m.secure) {

+ return;

+ }

+ env->v7m.primask[M_REG_NS] = val & 1;

+ return;

+ case 0x91: /* BASEPRI_NS */

+ if (!env->v7m.secure) {

+ return;

+ }

+ env->v7m.basepri[M_REG_NS] = val & 0xff;

+ return;

+ case 0x93: /* FAULTMASK_NS */

+ if (!env->v7m.secure) {

+ return;

+ }

+ env->v7m.faultmask[M_REG_NS] = val & 1;

+ return;

+ case 0x98: /* SP_NS */

+ {

+ /* This gives the non-secure SP selected based on whether we're

+ * currently in handler mode or not, using the NS CONTROL.SPSEL.

+ */

+ bool spsel = env->v7m.control[M_REG_NS] & R_V7M_CONTROL_SPSEL_MASK;

+

+ if (!env->v7m.secure) {

+ return;

+ }

+ if (!arm_v7m_is_handler_mode(env) && spsel) {

+ env->v7m.other_ss_psp = val;

+ } else {

+ env->v7m.other_ss_msp = val;

+ }

+ return;

+ }

+ default:

+ break;

+ }

+ }

+

switch (reg) {

case 0 ... 7: /* xPSR sub-fields */

/* only APSR is actually writable */

--

2.7.4

For the v8M security extension, some exceptions must be banked

between security states. Add the new vecinfo array which holds

the state for the banked exceptions and migrate it if the

CPU the NVIC is attached to implements the security extension.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

---

include/hw/intc/armv7m_nvic.h | 14 ++++++++++++

hw/intc/armv7m_nvic.c | 53 ++++++++++++++++++++++++++++++++++++++++++-

2 files changed, 66 insertions(+), 1 deletion(-)

diff --git a/include/hw/intc/armv7m_nvic.h b/include/hw/intc/armv7m_nvic.h

index XXXXXXX..XXXXXXX 100644

--- a/include/hw/intc/armv7m_nvic.h

+++ b/include/hw/intc/armv7m_nvic.h

@@ -XXX,XX +XXX,XX @@

/* Highest permitted number of exceptions (architectural limit) */

#define NVIC_MAX_VECTORS 512

+/* Number of internal exceptions */

+#define NVIC_INTERNAL_VECTORS 16

typedef struct VecInfo {

/* Exception priorities can range from -3 to 255; only the unmodifiable

@@ -XXX,XX +XXX,XX @@ typedef struct NVICState {

ARMCPU *cpu;

VecInfo vectors[NVIC_MAX_VECTORS];

+ /* If the v8M security extension is implemented, some of the internal

+ * exceptions are banked between security states (ie there exists both

+ * a Secure and a NonSecure version of the exception and its state):

+ * HardFault, MemManage, UsageFault, SVCall, PendSV, SysTick (R_PJHV)

+ * The rest (including all the external exceptions) are not banked, though

+ * they may be configurable to target either Secure or NonSecure state.

+ * We store the secure exception state in sec_vectors[] for the banked

+ * exceptions, and otherwise use only vectors[] (including for exceptions

+ * like SecureFault that unconditionally target Secure state).

+ * Entries in sec_vectors[] for non-banked exception numbers are unused.

+ */

+ VecInfo sec_vectors[NVIC_INTERNAL_VECTORS];

uint32_t prigroup;

/* vectpending and exception_prio are both cached state that can

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/intc/armv7m_nvic.c

+++ b/hw/intc/armv7m_nvic.c

@@ -XXX,XX +XXX,XX @@

* For historical reasons QEMU tends to use "interrupt" and

* "exception" more or less interchangeably.

*/

-#define NVIC_FIRST_IRQ 16

+#define NVIC_FIRST_IRQ NVIC_INTERNAL_VECTORS

#define NVIC_MAX_IRQ (NVIC_MAX_VECTORS - NVIC_FIRST_IRQ)

/* Effective running priority of the CPU when no exception is active

@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_VecInfo = {

}

};

+static bool nvic_security_needed(void *opaque)

+{

+ NVICState *s = opaque;

+

+ return arm_feature(&s->cpu->env, ARM_FEATURE_M_SECURITY);

+}

+

+static int nvic_security_post_load(void *opaque, int version_id)

+{

+ NVICState *s = opaque;

+ int i;

+

+ /* Check for out of range priority settings */

+ if (s->sec_vectors[ARMV7M_EXCP_HARD].prio != -1) {

+ return 1;

+ }

+ for (i = ARMV7M_EXCP_MEM; i < ARRAY_SIZE(s->sec_vectors); i++) {

+ if (s->sec_vectors[i].prio & ~0xff) {

+ return 1;

+ }

+ }

+ return 0;

+}

+

+static const VMStateDescription vmstate_nvic_security = {

+ .name = "nvic/m-security",

+ .version_id = 1,

+ .minimum_version_id = 1,

+ .needed = nvic_security_needed,

+ .post_load = &nvic_security_post_load,

+ .fields = (VMStateField[]) {

+ VMSTATE_STRUCT_ARRAY(sec_vectors, NVICState, NVIC_INTERNAL_VECTORS, 1,

+ vmstate_VecInfo, VecInfo),

+ VMSTATE_END_OF_LIST()

+ }

+};

+

static const VMStateDescription vmstate_nvic = {

.name = "armv7m_nvic",

.version_id = 4,

@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_nvic = {

vmstate_VecInfo, VecInfo),

VMSTATE_UINT32(prigroup, NVICState),

VMSTATE_END_OF_LIST()

+ },

+ .subsections = (const VMStateDescription*[]) {

+ &vmstate_nvic_security,

+ NULL

}

};

@@ -XXX,XX +XXX,XX @@ static void armv7m_nvic_reset(DeviceState *dev)

s->vectors[ARMV7M_EXCP_NMI].prio = -2;

s->vectors[ARMV7M_EXCP_HARD].prio = -1;

+ if (arm_feature(&s->cpu->env, ARM_FEATURE_M_SECURITY)) {

+ s->sec_vectors[ARMV7M_EXCP_HARD].enabled = 1;

+ s->sec_vectors[ARMV7M_EXCP_SVC].enabled = 1;

+ s->sec_vectors[ARMV7M_EXCP_PENDSV].enabled = 1;

+ s->sec_vectors[ARMV7M_EXCP_SYSTICK].enabled = 1;

+

+ /* AIRCR.BFHFNMINS resets to 0 so Secure HF is priority -1 (R_CMTC) */

+ s->sec_vectors[ARMV7M_EXCP_HARD].prio = -1;

+ }

+

/* Strictly speaking the reset handler should be enabled.

* However, we don't simulate soft resets through the NVIC,

* and the reset vector should never be pended.

--

2.7.4

With banked exceptions, just the exception number in

s->vectpending is no longer sufficient to uniquely identify

the pending exception. Add a vectpending_is_s_banked bool

which is true if the exception is using the sec_vectors[]

array.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Message-id: 1505240046-11454-4-git-send-email-peter.maydell@linaro.org

---

include/hw/intc/armv7m_nvic.h | 11 +++++++++--

hw/intc/armv7m_nvic.c | 1 +

2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/include/hw/intc/armv7m_nvic.h b/include/hw/intc/armv7m_nvic.h

index XXXXXXX..XXXXXXX 100644

--- a/include/hw/intc/armv7m_nvic.h

+++ b/include/hw/intc/armv7m_nvic.h

@@ -XXX,XX +XXX,XX @@ typedef struct NVICState {

VecInfo sec_vectors[NVIC_INTERNAL_VECTORS];

uint32_t prigroup;

- /* vectpending and exception_prio are both cached state that can

- * be recalculated from the vectors[] array and the prigroup field.

+ /* The following fields are all cached state that can be recalculated

+ * from the vectors[] and sec_vectors[] arrays and the prigroup field:

+ * - vectpending

+ * - vectpending_is_secure

+ * - exception_prio

*/

unsigned int vectpending; /* highest prio pending enabled exception */

+ /* true if vectpending is a banked secure exception, ie it is in

+ * sec_vectors[] rather than vectors[]

+ */

+ bool vectpending_is_s_banked;

int exception_prio; /* group prio of the highest prio active exception */

MemoryRegion sysregmem;

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/intc/armv7m_nvic.c

+++ b/hw/intc/armv7m_nvic.c

@@ -XXX,XX +XXX,XX @@ static void armv7m_nvic_reset(DeviceState *dev)

s->exception_prio = NVIC_NOEXC_PRIO;

s->vectpending = 0;

+ s->vectpending_is_s_banked = false;

}

static void nvic_systick_trigger(void *opaque, int n, int level)

--

2.7.4

Instead of looking up the pending priority

in nvic_pending_prio(), cache it in a new state struct

field. The calculation of the pending priority given

the interrupt number is more complicated in v8M with

the security extension, so the caching will be worthwhile.

This changes nvic_pending_prio() from returning a full

(group + subpriority) priority value to returning a group

priority. This doesn't require changes to its callsites

because we use it only in comparisons of the form

execution_prio > nvic_pending_prio()

and execution priority is always a group priority, so

a test (exec prio > full prio) is true if and only if

(execprio > group_prio).

(Architecturally the expected comparison is with the

group priority for this sort of "would we preempt" test;

we were only doing a test with a full priority as an

optimisation to avoid the mask, which is possible

precisely because the two comparisons always give the

same answer.)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 1505240046-11454-5-git-send-email-peter.maydell@linaro.org

---

include/hw/intc/armv7m_nvic.h | 2 ++

hw/intc/armv7m_nvic.c | 23 +++++++++++++----------

hw/intc/trace-events | 2 +-

3 files changed, 16 insertions(+), 11 deletions(-)

diff --git a/include/hw/intc/armv7m_nvic.h b/include/hw/intc/armv7m_nvic.h

index XXXXXXX..XXXXXXX 100644

--- a/include/hw/intc/armv7m_nvic.h

+++ b/include/hw/intc/armv7m_nvic.h

@@ -XXX,XX +XXX,XX @@ typedef struct NVICState {

* - vectpending

* - vectpending_is_secure

* - exception_prio

+ * - vectpending_prio

*/

unsigned int vectpending; /* highest prio pending enabled exception */

/* true if vectpending is a banked secure exception, ie it is in

@@ -XXX,XX +XXX,XX @@ typedef struct NVICState {

*/

bool vectpending_is_s_banked;

int exception_prio; /* group prio of the highest prio active exception */

+ int vectpending_prio; /* group prio of the exeception in vectpending */

MemoryRegion sysregmem;

MemoryRegion sysreg_ns_mem;

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/intc/armv7m_nvic.c

+++ b/hw/intc/armv7m_nvic.c

@@ -XXX,XX +XXX,XX @@ static const uint8_t nvic_id[] = {

static int nvic_pending_prio(NVICState *s)

{

- /* return the priority of the current pending interrupt,

+ /* return the group priority of the current pending interrupt,

* or NVIC_NOEXC_PRIO if no interrupt is pending

*/

- return s->vectpending ? s->vectors[s->vectpending].prio : NVIC_NOEXC_PRIO;

+ return s->vectpending_prio;

}

/* Return the value of the ISCR RETTOBASE bit:

@@ -XXX,XX +XXX,XX @@ static void nvic_recompute_state(NVICState *s)

active_prio &= nvic_gprio_mask(s);

}

+ if (pend_prio > 0) {

+ pend_prio &= nvic_gprio_mask(s);

+ }

+

s->vectpending = pend_irq;

+ s->vectpending_prio = pend_prio;

s->exception_prio = active_prio;

- trace_nvic_recompute_state(s->vectpending, s->exception_prio);

+ trace_nvic_recompute_state(s->vectpending,

+ s->vectpending_prio,

+ s->exception_prio);

}

/* Return the current execution priority of the CPU

@@ -XXX,XX +XXX,XX @@ void armv7m_nvic_acknowledge_irq(void *opaque)

CPUARMState *env = &s->cpu->env;

const int pending = s->vectpending;

const int running = nvic_exec_prio(s);

- int pendgroupprio;

VecInfo *vec;

assert(pending > ARMV7M_EXCP_RESET && pending < s->num_irq);

@@ -XXX,XX +XXX,XX @@ void armv7m_nvic_acknowledge_irq(void *opaque)

assert(vec->enabled);

assert(vec->pending);

- pendgroupprio = vec->prio;

- if (pendgroupprio > 0) {

- pendgroupprio &= nvic_gprio_mask(s);

- }

- assert(pendgroupprio < running);

+ assert(s->vectpending_prio < running);

- trace_nvic_acknowledge_irq(pending, vec->prio);

+ trace_nvic_acknowledge_irq(pending, s->vectpending_prio);

vec->active = 1;

vec->pending = 0;

@@ -XXX,XX +XXX,XX @@ static void armv7m_nvic_reset(DeviceState *dev)

s->exception_prio = NVIC_NOEXC_PRIO;

s->vectpending = 0;

s->vectpending_is_s_banked = false;

+ s->vectpending_prio = NVIC_NOEXC_PRIO;

}

static void nvic_systick_trigger(void *opaque, int n, int level)

diff --git a/hw/intc/trace-events b/hw/intc/trace-events

index XXXXXXX..XXXXXXX 100644

--- a/hw/intc/trace-events

+++ b/hw/intc/trace-events

@@ -XXX,XX +XXX,XX @@ gicv3_redist_set_irq(uint32_t cpu, int irq, int level) "GICv3 redistributor 0x%x

gicv3_redist_send_sgi(uint32_t cpu, int irq) "GICv3 redistributor 0x%x pending SGI %d"

# hw/intc/armv7m_nvic.c

-nvic_recompute_state(int vectpending, int exception_prio) "NVIC state recomputed: vectpending %d exception_prio %d"

+nvic_recompute_state(int vectpending, int vectpending_prio, int exception_prio) "NVIC state recomputed: vectpending %d vectpending_prio %d exception_prio %d"

nvic_set_prio(int irq, uint8_t prio) "NVIC set irq %d priority %d"

nvic_irq_update(int vectpending, int pendprio, int exception_prio, int level) "NVIC vectpending %d pending prio %d exception_prio %d: setting irq line to %d"

nvic_escalate_prio(int irq, int irqprio, int runprio) "NVIC escalating irq %d to HardFault: insufficient priority %d >= %d"

--

2.7.4

The Application Interrupt and Reset Control Register has some changes

for v8M:

* new bits SYSRESETREQS, BFHFNMINS and PRIS: these all have

real state if the security extension is implemented and otherwise

are constant

* the PRIGROUP field is banked between security states

* non-secure code can be blocked from using the SYSRESET bit

to reset the system if SYSRESETREQS is set

Implement the new state and the changes to register read and write.

For the moment we ignore the effects of the secure PRIGROUP.

We will implement the effects of PRIS and BFHFNMIS later.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 1505240046-11454-6-git-send-email-peter.maydell@linaro.org

---

include/hw/intc/armv7m_nvic.h | 3 ++-

target/arm/cpu.h | 12 +++++++++++

hw/intc/armv7m_nvic.c | 49 +++++++++++++++++++++++++++++++++----------

target/arm/cpu.c | 7 +++++++

4 files changed, 59 insertions(+), 12 deletions(-)

diff --git a/include/hw/intc/armv7m_nvic.h b/include/hw/intc/armv7m_nvic.h

index XXXXXXX..XXXXXXX 100644

--- a/include/hw/intc/armv7m_nvic.h

+++ b/include/hw/intc/armv7m_nvic.h

@@ -XXX,XX +XXX,XX @@ typedef struct NVICState {

* Entries in sec_vectors[] for non-banked exception numbers are unused.

*/

VecInfo sec_vectors[NVIC_INTERNAL_VECTORS];

- uint32_t prigroup;

+ /* The PRIGROUP field in AIRCR is banked */

+ uint32_t prigroup[M_REG_NUM_BANKS];

/* The following fields are all cached state that can be recalculated

* from the vectors[] and sec_vectors[] arrays and the prigroup field:

diff --git a/target/arm/cpu.h b/target/arm/cpu.h

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/cpu.h

+++ b/target/arm/cpu.h

@@ -XXX,XX +XXX,XX @@ typedef struct CPUARMState {

int exception;

uint32_t primask[M_REG_NUM_BANKS];

uint32_t faultmask[M_REG_NUM_BANKS];

+ uint32_t aircr; /* only holds r/w state if security extn implemented */

uint32_t secure; /* Is CPU in Secure state? (not guest visible) */

} v7m;

@@ -XXX,XX +XXX,XX @@ FIELD(V7M_CCR, STKALIGN, 9, 1)

FIELD(V7M_CCR, DC, 16, 1)

FIELD(V7M_CCR, IC, 17, 1)

+/* V7M AIRCR bits */

+FIELD(V7M_AIRCR, VECTRESET, 0, 1)

+FIELD(V7M_AIRCR, VECTCLRACTIVE, 1, 1)

+FIELD(V7M_AIRCR, SYSRESETREQ, 2, 1)

+FIELD(V7M_AIRCR, SYSRESETREQS, 3, 1)

+FIELD(V7M_AIRCR, PRIGROUP, 8, 3)

+FIELD(V7M_AIRCR, BFHFNMINS, 13, 1)

+FIELD(V7M_AIRCR, PRIS, 14, 1)

+FIELD(V7M_AIRCR, ENDIANNESS, 15, 1)

+FIELD(V7M_AIRCR, VECTKEY, 16, 16)

+

/* V7M CFSR bits for MMFSR */

FIELD(V7M_CFSR, IACCVIOL, 0, 1)

FIELD(V7M_CFSR, DACCVIOL, 1, 1)

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/intc/armv7m_nvic.c

+++ b/hw/intc/armv7m_nvic.c

@@ -XXX,XX +XXX,XX @@ static bool nvic_isrpending(NVICState *s)

*/

static inline uint32_t nvic_gprio_mask(NVICState *s)

{

- return ~0U << (s->prigroup + 1);

+ return ~0U << (s->prigroup[M_REG_NS] + 1);

}

/* Recompute vectpending and exception_prio */

@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)

return val;

case 0xd08: /* Vector Table Offset. */

return cpu->env.v7m.vecbase[attrs.secure];

- case 0xd0c: /* Application Interrupt/Reset Control. */

- return 0xfa050000 | (s->prigroup << 8);

+ case 0xd0c: /* Application Interrupt/Reset Control (AIRCR) */

+ val = 0xfa050000 | (s->prigroup[attrs.secure] << 8);

+ if (attrs.secure) {

+ /* s->aircr stores PRIS, BFHFNMINS, SYSRESETREQS */

+ val |= cpu->env.v7m.aircr;

+ } else {

+ if (arm_feature(&cpu->env, ARM_FEATURE_V8)) {

+ /* BFHFNMINS is R/O from NS; other bits are RAZ/WI. If

+ * security isn't supported then BFHFNMINS is RAO (and

+ * the bit in env.v7m.aircr is always set).

+ */

+ val |= cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK;

+ }

+ }

+ return val;

case 0xd10: /* System Control. */

/* TODO: Implement SLEEPONEXIT. */

return 0;

@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value,

case 0xd08: /* Vector Table Offset. */

cpu->env.v7m.vecbase[attrs.secure] = value & 0xffffff80;

break;

- case 0xd0c: /* Application Interrupt/Reset Control. */

- if ((value >> 16) == 0x05fa) {

- if (value & 4) {

- qemu_irq_pulse(s->sysresetreq);

+ case 0xd0c: /* Application Interrupt/Reset Control (AIRCR) */

+ if ((value >> R_V7M_AIRCR_VECTKEY_SHIFT) == 0x05fa) {

+ if (value & R_V7M_AIRCR_SYSRESETREQ_MASK) {

+ if (attrs.secure ||

+ !(cpu->env.v7m.aircr & R_V7M_AIRCR_SYSRESETREQS_MASK)) {

+ qemu_irq_pulse(s->sysresetreq);

+ }

}

- if (value & 2) {

+ if (value & R_V7M_AIRCR_VECTCLRACTIVE_MASK) {

qemu_log_mask(LOG_GUEST_ERROR,

"Setting VECTCLRACTIVE when not in DEBUG mode "

"is UNPREDICTABLE\n");

}

- if (value & 1) {

+ if (value & R_V7M_AIRCR_VECTRESET_MASK) {

+ /* NB: this bit is RES0 in v8M */

qemu_log_mask(LOG_GUEST_ERROR,

"Setting VECTRESET when not in DEBUG mode "

"is UNPREDICTABLE\n");

}

- s->prigroup = extract32(value, 8, 3);

+ s->prigroup[attrs.secure] = extract32(value,

+ R_V7M_AIRCR_PRIGROUP_SHIFT,

+ R_V7M_AIRCR_PRIGROUP_LENGTH);

+ if (attrs.secure) {

+ /* These bits are only writable by secure */

+ cpu->env.v7m.aircr = value &

+ (R_V7M_AIRCR_SYSRESETREQS_MASK |

+ R_V7M_AIRCR_BFHFNMINS_MASK |

+ R_V7M_AIRCR_PRIS_MASK);

+ }

nvic_irq_update(s);

}

break;

@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_nvic_security = {

.fields = (VMStateField[]) {

VMSTATE_STRUCT_ARRAY(sec_vectors, NVICState, NVIC_INTERNAL_VECTORS, 1,

vmstate_VecInfo, VecInfo),

+ VMSTATE_UINT32(prigroup[M_REG_S], NVICState),

VMSTATE_END_OF_LIST()

}

};

@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_nvic = {

.fields = (VMStateField[]) {

VMSTATE_STRUCT_ARRAY(vectors, NVICState, NVIC_MAX_VECTORS, 1,

vmstate_VecInfo, VecInfo),

- VMSTATE_UINT32(prigroup, NVICState),

+ VMSTATE_UINT32(prigroup[M_REG_NS], NVICState),

VMSTATE_END_OF_LIST()

},

.subsections = (const VMStateDescription*[]) {

diff --git a/target/arm/cpu.c b/target/arm/cpu.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/cpu.c

+++ b/target/arm/cpu.c

@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(CPUState *s)

if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {

env->v7m.secure = true;

+ } else {

+ /* This bit resets to 0 if security is supported, but 1 if

+ * it is not. The bit is not present in v7M, but we set it

+ * here so we can avoid having to make checks on it conditional

+ * on ARM_FEATURE_V8 (we don't let the guest see the bit).

+ */

+ env->v7m.aircr = R_V7M_AIRCR_BFHFNMINS_MASK;

}

/* In v7M the reset value of this bit is IMPDEF, but ARM recommends

--

2.7.4

Update the code in nvic_rettobase() so that it checks the

sec_vectors[] array as well as the vectors[] array if needed.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 1505240046-11454-7-git-send-email-peter.maydell@linaro.org

---

hw/intc/armv7m_nvic.c | 5 ++++-

1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/intc/armv7m_nvic.c

+++ b/hw/intc/armv7m_nvic.c

@@ -XXX,XX +XXX,XX @@ static int nvic_pending_prio(NVICState *s)

static bool nvic_rettobase(NVICState *s)

{

int irq, nhand = 0;

+ bool check_sec = arm_feature(&s->cpu->env, ARM_FEATURE_M_SECURITY);

for (irq = ARMV7M_EXCP_RESET; irq < s->num_irq; irq++) {

- if (s->vectors[irq].active) {

+ if (s->vectors[irq].active ||

+ (check_sec && irq < NVIC_INTERNAL_VECTORS &&

+ s->sec_vectors[irq].active)) {

nhand++;

if (nhand == 2) {

return 0;

--

2.7.4

For v8M, the NVIC has a new set of registers per interrupt,

NVIC_ITNS<n>. These determine whether the interrupt targets Secure

or Non-secure state. Implement the register read/write code for

these, and make them cause NVIC_IABR, NVIC_ICER, NVIC_ISER,

NVIC_ICPR, NVIC_IPR and NVIC_ISPR to RAZ/WI for non-secure

accesses to fields corresponding to interrupts which are

configured to target secure state.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 1505240046-11454-8-git-send-email-peter.maydell@linaro.org

---

include/hw/intc/armv7m_nvic.h | 3 ++

hw/intc/armv7m_nvic.c | 74 +++++++++++++++++++++++++++++++++++++++----

2 files changed, 70 insertions(+), 7 deletions(-)

diff --git a/include/hw/intc/armv7m_nvic.h b/include/hw/intc/armv7m_nvic.h

index XXXXXXX..XXXXXXX 100644

--- a/include/hw/intc/armv7m_nvic.h

+++ b/include/hw/intc/armv7m_nvic.h

@@ -XXX,XX +XXX,XX @@ typedef struct NVICState {

/* The PRIGROUP field in AIRCR is banked */

uint32_t prigroup[M_REG_NUM_BANKS];

+ /* v8M NVIC_ITNS state (stored as a bool per bit) */

+ bool itns[NVIC_MAX_VECTORS];

+

/* The following fields are all cached state that can be recalculated

* from the vectors[] and sec_vectors[] arrays and the prigroup field:

* - vectpending

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/intc/armv7m_nvic.c

+++ b/hw/intc/armv7m_nvic.c

@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)

switch (offset) {

case 4: /* Interrupt Control Type. */

return ((s->num_irq - NVIC_FIRST_IRQ) / 32) - 1;

+ case 0x380 ... 0x3bf: /* NVIC_ITNS<n> */

+ {

+ int startvec = 32 * (offset - 0x380) + NVIC_FIRST_IRQ;

+ int i;

+

+ if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {

+ goto bad_offset;

+ }

+ if (!attrs.secure) {

+ return 0;

+ }

+ val = 0;

+ for (i = 0; i < 32 && startvec + i < s->num_irq; i++) {

+ if (s->itns[startvec + i]) {

+ val |= (1 << i);

+ }

+ }

+ return val;

+ }

case 0xd00: /* CPUID Base. */

return cpu->midr;

case 0xd04: /* Interrupt Control State. */

@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value,

ARMCPU *cpu = s->cpu;

switch (offset) {

+ case 0x380 ... 0x3bf: /* NVIC_ITNS<n> */

+ {

+ int startvec = 32 * (offset - 0x380) + NVIC_FIRST_IRQ;

+ int i;

+

+ if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {

+ goto bad_offset;

+ }

+ if (!attrs.secure) {

+ break;

+ }

+ for (i = 0; i < 32 && startvec + i < s->num_irq; i++) {

+ s->itns[startvec + i] = (value >> i) & 1;

+ }

+ nvic_irq_update(s);

+ break;

+ }

case 0xd04: /* Interrupt Control State. */

if (value & (1 << 31)) {

armv7m_nvic_set_pending(s, ARMV7M_EXCP_NMI);

@@ -XXX,XX +XXX,XX @@ static MemTxResult nvic_sysreg_read(void *opaque, hwaddr addr,

startvec = offset - 0x180 + NVIC_FIRST_IRQ; /* vector # */

for (i = 0, end = size * 8; i < end && startvec + i < s->num_irq; i++) {

- if (s->vectors[startvec + i].enabled) {

+ if (s->vectors[startvec + i].enabled &&

+ (attrs.secure || s->itns[startvec + i])) {

val |= (1 << i);

}

}

@@ -XXX,XX +XXX,XX @@ static MemTxResult nvic_sysreg_read(void *opaque, hwaddr addr,

val = 0;

startvec = offset - 0x280 + NVIC_FIRST_IRQ; /* vector # */

for (i = 0, end = size * 8; i < end && startvec + i < s->num_irq; i++) {

- if (s->vectors[startvec + i].pending) {

+ if (s->vectors[startvec + i].pending &&

+ (attrs.secure || s->itns[startvec + i])) {

val |= (1 << i);

}

}

@@ -XXX,XX +XXX,XX @@ static MemTxResult nvic_sysreg_read(void *opaque, hwaddr addr,

startvec = offset - 0x300 + NVIC_FIRST_IRQ; /* vector # */

for (i = 0, end = size * 8; i < end && startvec + i < s->num_irq; i++) {

- if (s->vectors[startvec + i].active) {

+ if (s->vectors[startvec + i].active &&

+ (attrs.secure || s->itns[startvec + i])) {

val |= (1 << i);

}

}

@@ -XXX,XX +XXX,XX @@ static MemTxResult nvic_sysreg_read(void *opaque, hwaddr addr,

startvec = offset - 0x400 + NVIC_FIRST_IRQ; /* vector # */

for (i = 0; i < size && startvec + i < s->num_irq; i++) {

- val |= s->vectors[startvec + i].prio << (8 * i);

+ if (attrs.secure || s->itns[startvec + i]) {

+ val |= s->vectors[startvec + i].prio << (8 * i);

+ }

}

break;

case 0xd18 ... 0xd23: /* System Handler Priority. */

@@ -XXX,XX +XXX,XX @@ static MemTxResult nvic_sysreg_write(void *opaque, hwaddr addr,

startvec = 8 * (offset - 0x180) + NVIC_FIRST_IRQ;

for (i = 0, end = size * 8; i < end && startvec + i < s->num_irq; i++) {

- if (value & (1 << i)) {

+ if (value & (1 << i) &&

+ (attrs.secure || s->itns[startvec + i])) {

s->vectors[startvec + i].enabled = setval;

}

}

@@ -XXX,XX +XXX,XX @@ static MemTxResult nvic_sysreg_write(void *opaque, hwaddr addr,

startvec = 8 * (offset - 0x280) + NVIC_FIRST_IRQ; /* vector # */

for (i = 0, end = size * 8; i < end && startvec + i < s->num_irq; i++) {

- if (value & (1 << i)) {

+ if (value & (1 << i) &&

+ (attrs.secure || s->itns[startvec + i])) {

s->vectors[startvec + i].pending = setval;

}

}

@@ -XXX,XX +XXX,XX @@ static MemTxResult nvic_sysreg_write(void *opaque, hwaddr addr,

startvec = 8 * (offset - 0x400) + NVIC_FIRST_IRQ; /* vector # */

for (i = 0; i < size && startvec + i < s->num_irq; i++) {

- set_prio(s, startvec + i, (value >> (i * 8)) & 0xff);

+ if (attrs.secure || s->itns[startvec + i]) {

+ set_prio(s, startvec + i, (value >> (i * 8)) & 0xff);

+ }

}

nvic_irq_update(s);

return MEMTX_OK;

@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_nvic_security = {

VMSTATE_STRUCT_ARRAY(sec_vectors, NVICState, NVIC_INTERNAL_VECTORS, 1,

vmstate_VecInfo, VecInfo),

VMSTATE_UINT32(prigroup[M_REG_S], NVICState),

+ VMSTATE_BOOL_ARRAY(itns, NVICState, NVIC_MAX_VECTORS),

VMSTATE_END_OF_LIST()

}

};

@@ -XXX,XX +XXX,XX @@ static void armv7m_nvic_reset(DeviceState *dev)

s->vectpending = 0;

s->vectpending_is_s_banked = false;

s->vectpending_prio = NVIC_NOEXC_PRIO;

+

+ if (arm_feature(&s->cpu->env, ARM_FEATURE_M_SECURITY)) {

+ memset(s->itns, 0, sizeof(s->itns));

+ } else {

+ /* This state is constant and not guest accessible in a non-security

+ * NVIC; we set the bits to true to avoid having to do a feature

+ * bit check in the NVIC enable/pend/etc register accessors.

+ */

+ int i;

+

+ for (i = NVIC_FIRST_IRQ; i < ARRAY_SIZE(s->itns); i++) {

+ s->itns[i] = true;

+ }

+ }

}

static void nvic_systick_trigger(void *opaque, int n, int level)

--

2.7.4

Update the nvic_recompute_state() code to handle the security

extension and its associated banked registers.

Code that uses the resulting cached state (ie the irq

acknowledge and complete code) will be updated in a later

commit.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 1505240046-11454-9-git-send-email-peter.maydell@linaro.org

---

hw/intc/armv7m_nvic.c | 151 ++++++++++++++++++++++++++++++++++++++++++++++++--

hw/intc/trace-events | 1 +

2 files changed, 147 insertions(+), 5 deletions(-)

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/intc/armv7m_nvic.c

+++ b/hw/intc/armv7m_nvic.c

@@ -XXX,XX +XXX,XX @@

* (higher than the highest possible priority value)

*/

#define NVIC_NOEXC_PRIO 0x100

+/* Maximum priority of non-secure exceptions when AIRCR.PRIS is set */

+#define NVIC_NS_PRIO_LIMIT 0x80

static const uint8_t nvic_id[] = {

0x00, 0xb0, 0x1b, 0x00, 0x0d, 0xe0, 0x05, 0xb1

@@ -XXX,XX +XXX,XX @@ static bool nvic_isrpending(NVICState *s)

return false;

}

+static bool exc_is_banked(int exc)

+{

+ /* Return true if this is one of the limited set of exceptions which

+ * are banked (and thus have state in sec_vectors[])

+ */

+ return exc == ARMV7M_EXCP_HARD ||

+ exc == ARMV7M_EXCP_MEM ||

+ exc == ARMV7M_EXCP_USAGE ||

+ exc == ARMV7M_EXCP_SVC ||

+ exc == ARMV7M_EXCP_PENDSV ||

+ exc == ARMV7M_EXCP_SYSTICK;

+}

+

/* Return a mask word which clears the subpriority bits from

* a priority value for an M-profile exception, leaving only

* the group priority.

*/

-static inline uint32_t nvic_gprio_mask(NVICState *s)

+static inline uint32_t nvic_gprio_mask(NVICState *s, bool secure)

+{

+ return ~0U << (s->prigroup[secure] + 1);

+}

+

+static bool exc_targets_secure(NVICState *s, int exc)

+{

+ /* Return true if this non-banked exception targets Secure state. */

+ if (!arm_feature(&s->cpu->env, ARM_FEATURE_M_SECURITY)) {

+ return false;

+ }

+

+ if (exc >= NVIC_FIRST_IRQ) {

+ return !s->itns[exc];

+ }

+

+ /* Function shouldn't be called for banked exceptions. */

+ assert(!exc_is_banked(exc));

+

+ switch (exc) {

+ case ARMV7M_EXCP_NMI:

+ case ARMV7M_EXCP_BUS:

+ return !(s->cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK);

+ case ARMV7M_EXCP_SECURE:

+ return true;

+ case ARMV7M_EXCP_DEBUG:

+ /* TODO: controlled by DEMCR.SDME, which we don't yet implement */

+ return false;

+ default:

+ /* reset, and reserved (unused) low exception numbers.

+ * We'll get called by code that loops through all the exception

+ * numbers, but it doesn't matter what we return here as these

+ * non-existent exceptions will never be pended or active.

+ */

+ return true;

+ }

+}

+

+static int exc_group_prio(NVICState *s, int rawprio, bool targets_secure)

+{

+ /* Return the group priority for this exception, given its raw

+ * (group-and-subgroup) priority value and whether it is targeting

+ * secure state or not.

+ */

+ if (rawprio < 0) {

+ return rawprio;

+ }

+ rawprio &= nvic_gprio_mask(s, targets_secure);

+ /* AIRCR.PRIS causes us to squash all NS priorities into the

+ * lower half of the total range

+ */

+ if (!targets_secure &&

+ (s->cpu->env.v7m.aircr & R_V7M_AIRCR_PRIS_MASK)) {

+ rawprio = (rawprio >> 1) + NVIC_NS_PRIO_LIMIT;

+ }

+ return rawprio;

+}

+

+/* Recompute vectpending and exception_prio for a CPU which implements

+ * the Security extension

+ */

+static void nvic_recompute_state_secure(NVICState *s)

{

- return ~0U << (s->prigroup[M_REG_NS] + 1);

+ int i, bank;

+ int pend_prio = NVIC_NOEXC_PRIO;

+ int active_prio = NVIC_NOEXC_PRIO;

+ int pend_irq = 0;

+ bool pending_is_s_banked = false;

+

+ /* R_CQRV: precedence is by:

+ * - lowest group priority; if both the same then

+ * - lowest subpriority; if both the same then

+ * - lowest exception number; if both the same (ie banked) then

+ * - secure exception takes precedence

+ * Compare pseudocode RawExecutionPriority.

+ * Annoyingly, now we have two prigroup values (for S and NS)

+ * we can't do the loop comparison on raw priority values.

+ */

+ for (i = 1; i < s->num_irq; i++) {

+ for (bank = M_REG_S; bank >= M_REG_NS; bank--) {

+ VecInfo *vec;

+ int prio;

+ bool targets_secure;

+

+ if (bank == M_REG_S) {

+ if (!exc_is_banked(i)) {

+ continue;

+ }

+ vec = &s->sec_vectors[i];

+ targets_secure = true;

+ } else {

+ vec = &s->vectors[i];

+ targets_secure = !exc_is_banked(i) && exc_targets_secure(s, i);

+ }

+

+ prio = exc_group_prio(s, vec->prio, targets_secure);

+ if (vec->enabled && vec->pending && prio < pend_prio) {

+ pend_prio = prio;

+ pend_irq = i;

+ pending_is_s_banked = (bank == M_REG_S);

+ }

+ if (vec->active && prio < active_prio) {

+ active_prio = prio;

+ }

+ }

+ }

+

+ s->vectpending_is_s_banked = pending_is_s_banked;

+ s->vectpending = pend_irq;

+ s->vectpending_prio = pend_prio;

+ s->exception_prio = active_prio;

+

+ trace_nvic_recompute_state_secure(s->vectpending,

+ s->vectpending_is_s_banked,

+ s->vectpending_prio,

+ s->exception_prio);

}

/* Recompute vectpending and exception_prio */

@@ -XXX,XX +XXX,XX @@ static void nvic_recompute_state(NVICState *s)

int active_prio = NVIC_NOEXC_PRIO;

int pend_irq = 0;

+ /* In theory we could write one function that handled both

+ * the "security extension present" and "not present"; however

+ * the security related changes significantly complicate the

+ * recomputation just by themselves and mixing both cases together

+ * would be even worse, so we retain a separate non-secure-only

+ * version for CPUs which don't implement the security extension.

+ */

+ if (arm_feature(&s->cpu->env, ARM_FEATURE_M_SECURITY)) {

+ nvic_recompute_state_secure(s);

+ return;

+ }

+

for (i = 1; i < s->num_irq; i++) {

VecInfo *vec = &s->vectors[i];

@@ -XXX,XX +XXX,XX @@ static void nvic_recompute_state(NVICState *s)

}

if (active_prio > 0) {

- active_prio &= nvic_gprio_mask(s);

+ active_prio &= nvic_gprio_mask(s, false);

}

if (pend_prio > 0) {

- pend_prio &= nvic_gprio_mask(s);

+ pend_prio &= nvic_gprio_mask(s, false);

}

s->vectpending = pend_irq;

@@ -XXX,XX +XXX,XX @@ static inline int nvic_exec_prio(NVICState *s)

} else if (env->v7m.primask[env->v7m.secure]) {

running = 0;

} else if (env->v7m.basepri[env->v7m.secure] > 0) {

- running = env->v7m.basepri[env->v7m.secure] & nvic_gprio_mask(s);

+ running = env->v7m.basepri[env->v7m.secure] &

+ nvic_gprio_mask(s, env->v7m.secure);

} else {

running = NVIC_NOEXC_PRIO; /* lower than any possible priority */

}

diff --git a/hw/intc/trace-events b/hw/intc/trace-events

index XXXXXXX..XXXXXXX 100644

--- a/hw/intc/trace-events

+++ b/hw/intc/trace-events

@@ -XXX,XX +XXX,XX @@ gicv3_redist_send_sgi(uint32_t cpu, int irq) "GICv3 redistributor 0x%x pending S

# hw/intc/armv7m_nvic.c

nvic_recompute_state(int vectpending, int vectpending_prio, int exception_prio) "NVIC state recomputed: vectpending %d vectpending_prio %d exception_prio %d"

+nvic_recompute_state_secure(int vectpending, bool vectpending_is_s_banked, int vectpending_prio, int exception_prio) "NVIC state recomputed: vectpending %d is_s_banked %d vectpending_prio %d exception_prio %d"

nvic_set_prio(int irq, uint8_t prio) "NVIC set irq %d priority %d"

nvic_irq_update(int vectpending, int pendprio, int exception_prio, int level) "NVIC vectpending %d pending prio %d exception_prio %d: setting irq line to %d"

nvic_escalate_prio(int irq, int irqprio, int runprio) "NVIC escalating irq %d to HardFault: insufficient priority %d >= %d"

--

2.7.4

Make the armv7m_nvic_set_pending() and armv7m_nvic_clear_pending()

functions take a bool indicating whether to pend the secure

or non-secure version of a banked interrupt, and update the

callsites accordingly.

In most callsites we can simply pass the correct security

state in; in a couple of cases we use TODO comments to indicate

that we will return the code in a subsequent commit.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 1505240046-11454-10-git-send-email-peter.maydell@linaro.org

---

target/arm/cpu.h | 14 ++++++++++-

hw/intc/armv7m_nvic.c | 64 ++++++++++++++++++++++++++++++++++++++-------------

target/arm/helper.c | 24 +++++++++++--------

hw/intc/trace-events | 4 ++--

4 files changed, 77 insertions(+), 29 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h

index XXXXXXX..XXXXXXX 100644