In order to support derived exceptions (exceptions generated in

the course of trying to take an exception), we need to be able

to handle prioritizing whether to take the original exception

or the derived exception.

We do this by introducing a new function

armv7m_nvic_set_pending_derived() which the exception-taking code in

helper.c will call when a derived exception occurs. Derived

exceptions are dealt with mostly like normal pending exceptions, so

we share the implementation with the armv7m_nvic_set_pending()

function.

Note that the way we structure this is significantly different

from the v8M Arm ARM pseudocode: that does all the prioritization

logic in the DerivedLateArrival() function, whereas we choose to

let the existing "identify highest priority exception" logic

do the prioritization for us. The effect is the same, though.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 1517324542-6607-2-git-send-email-peter.maydell@linaro.org

---

target/arm/cpu.h | 13 ++++++++++

hw/intc/armv7m_nvic.c | 68 +++++++++++++++++++++++++++++++++++++++++++++++++--

hw/intc/trace-events | 2 +-

3 files changed, 80 insertions(+), 3 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/cpu.h

+++ b/target/arm/cpu.h

@@ -XXX,XX +XXX,XX @@ static inline bool armv7m_nvic_can_take_pending_exception(void *opaque)

* of architecturally banked exceptions.

*/

void armv7m_nvic_set_pending(void *opaque, int irq, bool secure);

+/**

+ * armv7m_nvic_set_pending_derived: mark this derived exception as pending

+ * @opaque: the NVIC

+ * @irq: the exception number to mark pending

+ * @secure: false for non-banked exceptions or for the nonsecure

+ * version of a banked exception, true for the secure version of a banked

+ * exception.

+ *

+ * Similar to armv7m_nvic_set_pending(), but specifically for derived

+ * exceptions (exceptions generated in the course of trying to take

+ * a different exception).

+ */

+void armv7m_nvic_set_pending_derived(void *opaque, int irq, bool secure);

/**

* armv7m_nvic_acknowledge_irq: make highest priority pending exception active

* @opaque: the NVIC

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/intc/armv7m_nvic.c

+++ b/hw/intc/armv7m_nvic.c

@@ -XXX,XX +XXX,XX @@ static void armv7m_nvic_clear_pending(void *opaque, int irq, bool secure)

}

}

-void armv7m_nvic_set_pending(void *opaque, int irq, bool secure)

+static void do_armv7m_nvic_set_pending(void *opaque, int irq, bool secure,

+ bool derived)

{

+ /* Pend an exception, including possibly escalating it to HardFault.

+ *

+ * This function handles both "normal" pending of interrupts and

+ * exceptions, and also derived exceptions (ones which occur as

+ * a result of trying to take some other exception).

+ *

+ * If derived == true, the caller guarantees that we are part way through

+ * trying to take an exception (but have not yet called

+ * armv7m_nvic_acknowledge_irq() to make it active), and so:

+ * - s->vectpending is the "original exception" we were trying to take

+ * - irq is the "derived exception"

+ * - nvic_exec_prio(s) gives the priority before exception entry

+ * Here we handle the prioritization logic which the pseudocode puts

+ * in the DerivedLateArrival() function.

+ */

+

NVICState *s = (NVICState *)opaque;

bool banked = exc_is_banked(irq);

VecInfo *vec;

@@ -XXX,XX +XXX,XX @@ void armv7m_nvic_set_pending(void *opaque, int irq, bool secure)

vec = (banked && secure) ? &s->sec_vectors[irq] : &s->vectors[irq];

- trace_nvic_set_pending(irq, secure, vec->enabled, vec->prio);

+ trace_nvic_set_pending(irq, secure, derived, vec->enabled, vec->prio);

+

+ if (derived) {

+ /* Derived exceptions are always synchronous. */

+ assert(irq >= ARMV7M_EXCP_HARD && irq < ARMV7M_EXCP_PENDSV);

+

+ if (irq == ARMV7M_EXCP_DEBUG &&

+ exc_group_prio(s, vec->prio, secure) >= nvic_exec_prio(s)) {

+ /* DebugMonitorFault, but its priority is lower than the

+ * preempted exception priority: just ignore it.

+ */

+ return;

+ }

+

+ if (irq == ARMV7M_EXCP_HARD && vec->prio >= s->vectpending_prio) {

+ /* If this is a terminal exception (one which means we cannot

+ * take the original exception, like a failure to read its

+ * vector table entry), then we must take the derived exception.

+ * If the derived exception can't take priority over the

+ * original exception, then we go into Lockup.

+ *

+ * For QEMU, we rely on the fact that a derived exception is

+ * terminal if and only if it's reported to us as HardFault,

+ * which saves having to have an extra argument is_terminal

+ * that we'd only use in one place.

+ */

+ cpu_abort(&s->cpu->parent_obj,

+ "Lockup: can't take terminal derived exception "

+ "(original exception priority %d)\n",

+ s->vectpending_prio);

+ }

+ /* We now continue with the same code as for a normal pending

+ * exception, which will cause us to pend the derived exception.

+ * We'll then take either the original or the derived exception

+ * based on which is higher priority by the usual mechanism

+ * for selecting the highest priority pending interrupt.

+ */

+ }

if (irq >= ARMV7M_EXCP_HARD && irq < ARMV7M_EXCP_PENDSV) {

/* If a synchronous exception is pending then it may be

@@ -XXX,XX +XXX,XX @@ void armv7m_nvic_set_pending(void *opaque, int irq, bool secure)

}

}

+void armv7m_nvic_set_pending(void *opaque, int irq, bool secure)

+{

+ do_armv7m_nvic_set_pending(opaque, irq, secure, false);

+}

+

+void armv7m_nvic_set_pending_derived(void *opaque, int irq, bool secure)

+{

+ do_armv7m_nvic_set_pending(opaque, irq, secure, true);

+}

+

/* Make pending IRQ active. */

bool armv7m_nvic_acknowledge_irq(void *opaque)

{

diff --git a/hw/intc/trace-events b/hw/intc/trace-events

index XXXXXXX..XXXXXXX 100644

--- a/hw/intc/trace-events

+++ b/hw/intc/trace-events

@@ -XXX,XX +XXX,XX @@ nvic_set_prio(int irq, bool secure, uint8_t prio) "NVIC set irq %d secure-bank %

nvic_irq_update(int vectpending, int pendprio, int exception_prio, int level) "NVIC vectpending %d pending prio %d exception_prio %d: setting irq line to %d"

nvic_escalate_prio(int irq, int irqprio, int runprio) "NVIC escalating irq %d to HardFault: insufficient priority %d >= %d"

nvic_escalate_disabled(int irq) "NVIC escalating irq %d to HardFault: disabled"

-nvic_set_pending(int irq, bool secure, int en, int prio) "NVIC set pending irq %d secure-bank %d (enabled: %d priority %d)"

+nvic_set_pending(int irq, bool secure, bool derived, int en, int prio) "NVIC set pending irq %d secure-bank %d derived %d (enabled: %d priority %d)"

nvic_clear_pending(int irq, bool secure, int en, int prio) "NVIC clear pending irq %d secure-bank %d (enabled: %d priority %d)"

nvic_set_pending_level(int irq) "NVIC set pending: irq %d higher prio than vectpending: setting irq line to 1"

nvic_acknowledge_irq(int irq, int prio, bool targets_secure) "NVIC acknowledge IRQ: %d now active (prio %d targets_secure %d)"

--

2.16.1

Currently armv7m_nvic_acknowledge_irq() does three things:

* make the current highest priority pending interrupt active

* return a bool indicating whether that interrupt is targeting

Secure or NonSecure state

* implicitly tell the caller which is the highest priority

pending interrupt by setting env->v7m.exception

We need to split these jobs, because v7m_exception_taken()

needs to know whether the pending interrupt targets Secure so

it can choose to stack callee-saves registers or not, but it

must not make the interrupt active until after it has done

that stacking, in case the stacking causes a derived exception.

Similarly, it needs to know the number of the pending interrupt

so it can read the correct vector table entry before the

interrupt is made active, because vector table reads might

also cause a derived exception.

Create a new armv7m_nvic_get_pending_irq_info() function which simply

returns information about the highest priority pending interrupt, and

use it to rearrange the v7m_exception_taken() code so we don't

acknowledge the exception until we've done all the things which could

possibly cause a derived exception.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Message-id: 1517324542-6607-3-git-send-email-peter.maydell@linaro.org

---

target/arm/cpu.h | 19 ++++++++++++++++---

hw/intc/armv7m_nvic.c | 30 +++++++++++++++++++++++-------

target/arm/helper.c | 16 ++++++++++++----

hw/intc/trace-events | 3 ++-

4 files changed, 53 insertions(+), 15 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/cpu.h

+++ b/target/arm/cpu.h

@@ -XXX,XX +XXX,XX @@ void armv7m_nvic_set_pending(void *opaque, int irq, bool secure);

* a different exception).

*/

void armv7m_nvic_set_pending_derived(void *opaque, int irq, bool secure);

+/**

+ * armv7m_nvic_get_pending_irq_info: return highest priority pending

+ * exception, and whether it targets Secure state

+ * @opaque: the NVIC

+ * @pirq: set to pending exception number

+ * @ptargets_secure: set to whether pending exception targets Secure

+ *

+ * This function writes the number of the highest priority pending

+ * exception (the one which would be made active by

+ * armv7m_nvic_acknowledge_irq()) to @pirq, and sets @ptargets_secure

+ * to true if the current highest priority pending exception should

+ * be taken to Secure state, false for NS.

+ */

+void armv7m_nvic_get_pending_irq_info(void *opaque, int *pirq,

+ bool *ptargets_secure);

/**

* armv7m_nvic_acknowledge_irq: make highest priority pending exception active

* @opaque: the NVIC

@@ -XXX,XX +XXX,XX @@ void armv7m_nvic_set_pending_derived(void *opaque, int irq, bool secure);

* Move the current highest priority pending exception from the pending

* state to the active state, and update v7m.exception to indicate that

* it is the exception currently being handled.

- *

- * Returns: true if exception should be taken to Secure state, false for NS

*/

-bool armv7m_nvic_acknowledge_irq(void *opaque);

+void armv7m_nvic_acknowledge_irq(void *opaque);

/**

* armv7m_nvic_complete_irq: complete specified interrupt or exception

* @opaque: the NVIC

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/intc/armv7m_nvic.c

+++ b/hw/intc/armv7m_nvic.c

@@ -XXX,XX +XXX,XX @@ void armv7m_nvic_set_pending_derived(void *opaque, int irq, bool secure)

}

/* Make pending IRQ active. */

-bool armv7m_nvic_acknowledge_irq(void *opaque)

+void armv7m_nvic_acknowledge_irq(void *opaque)

{

NVICState *s = (NVICState *)opaque;

CPUARMState *env = &s->cpu->env;

const int pending = s->vectpending;

const int running = nvic_exec_prio(s);

VecInfo *vec;

- bool targets_secure;

assert(pending > ARMV7M_EXCP_RESET && pending < s->num_irq);

if (s->vectpending_is_s_banked) {

vec = &s->sec_vectors[pending];

- targets_secure = true;

} else {

vec = &s->vectors[pending];

- targets_secure = !exc_is_banked(s->vectpending) &&

- exc_targets_secure(s, s->vectpending);

}

assert(vec->enabled);

@@ -XXX,XX +XXX,XX @@ bool armv7m_nvic_acknowledge_irq(void *opaque)

assert(s->vectpending_prio < running);

- trace_nvic_acknowledge_irq(pending, s->vectpending_prio, targets_secure);

+ trace_nvic_acknowledge_irq(pending, s->vectpending_prio);

vec->active = 1;

vec->pending = 0;

@@ -XXX,XX +XXX,XX @@ bool armv7m_nvic_acknowledge_irq(void *opaque)

write_v7m_exception(env, s->vectpending);

nvic_irq_update(s);

+}

+

+void armv7m_nvic_get_pending_irq_info(void *opaque,

+ int *pirq, bool *ptargets_secure)

+{

+ NVICState *s = (NVICState *)opaque;

+ const int pending = s->vectpending;

+ bool targets_secure;

+

+ assert(pending > ARMV7M_EXCP_RESET && pending < s->num_irq);

+

+ if (s->vectpending_is_s_banked) {

+ targets_secure = true;

+ } else {

+ targets_secure = !exc_is_banked(pending) &&

+ exc_targets_secure(s, pending);

+ }

+

+ trace_nvic_get_pending_irq_info(pending, targets_secure);

- return targets_secure;

+ *ptargets_secure = targets_secure;

+ *pirq = pending;

}

int armv7m_nvic_complete_irq(void *opaque, int irq, bool secure)

diff --git a/target/arm/helper.c b/target/arm/helper.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/helper.c

+++ b/target/arm/helper.c

@@ -XXX,XX +XXX,XX @@ static uint32_t *get_v7m_sp_ptr(CPUARMState *env, bool secure, bool threadmode,

}

}

-static uint32_t arm_v7m_load_vector(ARMCPU *cpu, bool targets_secure)

+static uint32_t arm_v7m_load_vector(ARMCPU *cpu, int exc, bool targets_secure)

{

CPUState *cs = CPU(cpu);

CPUARMState *env = &cpu->env;

MemTxResult result;

- hwaddr vec = env->v7m.vecbase[targets_secure] + env->v7m.exception * 4;

+ hwaddr vec = env->v7m.vecbase[targets_secure] + exc * 4;

uint32_t addr;

addr = address_space_ldl(cs->as, vec,

@@ -XXX,XX +XXX,XX @@ static void v7m_exception_taken(ARMCPU *cpu, uint32_t lr, bool dotailchain)

CPUARMState *env = &cpu->env;

uint32_t addr;

bool targets_secure;

+ int exc;

- targets_secure = armv7m_nvic_acknowledge_irq(env->nvic);

+ armv7m_nvic_get_pending_irq_info(env->nvic, &exc, &targets_secure);

if (arm_feature(env, ARM_FEATURE_V8)) {

if (arm_feature(env, ARM_FEATURE_M_SECURITY) &&

@@ -XXX,XX +XXX,XX @@ static void v7m_exception_taken(ARMCPU *cpu, uint32_t lr, bool dotailchain)

}

}

+ addr = arm_v7m_load_vector(cpu, exc, targets_secure);

+

+ /* Now we've done everything that might cause a derived exception

+ * we can go ahead and activate whichever exception we're going to

+ * take (which might now be the derived exception).

+ */

+ armv7m_nvic_acknowledge_irq(env->nvic);

+

/* Switch to target security state -- must do this before writing SPSEL */

switch_v7m_security_state(env, targets_secure);

write_v7m_control_spsel(env, 0);

@@ -XXX,XX +XXX,XX @@ static void v7m_exception_taken(ARMCPU *cpu, uint32_t lr, bool dotailchain)

/* Clear IT bits */

env->condexec_bits = 0;

env->regs[14] = lr;

- addr = arm_v7m_load_vector(cpu, targets_secure);

env->regs[15] = addr & 0xfffffffe;

env->thumb = addr & 1;

}

diff --git a/hw/intc/trace-events b/hw/intc/trace-events

index XXXXXXX..XXXXXXX 100644

--- a/hw/intc/trace-events

+++ b/hw/intc/trace-events

@@ -XXX,XX +XXX,XX @@ nvic_escalate_disabled(int irq) "NVIC escalating irq %d to HardFault: disabled"

nvic_set_pending(int irq, bool secure, bool derived, int en, int prio) "NVIC set pending irq %d secure-bank %d derived %d (enabled: %d priority %d)"

nvic_clear_pending(int irq, bool secure, int en, int prio) "NVIC clear pending irq %d secure-bank %d (enabled: %d priority %d)"

nvic_set_pending_level(int irq) "NVIC set pending: irq %d higher prio than vectpending: setting irq line to 1"

-nvic_acknowledge_irq(int irq, int prio, bool targets_secure) "NVIC acknowledge IRQ: %d now active (prio %d targets_secure %d)"

+nvic_acknowledge_irq(int irq, int prio) "NVIC acknowledge IRQ: %d now active (prio %d)"

+nvic_get_pending_irq_info(int irq, bool secure) "NVIC next IRQ %d: targets_secure: %d"

nvic_complete_irq(int irq, bool secure) "NVIC complete IRQ %d (secure %d)"

nvic_set_irq_level(int irq, int level) "NVIC external irq %d level set to %d"

nvic_sysreg_read(uint64_t addr, uint32_t value, unsigned size) "NVIC sysreg read addr 0x%" PRIx64 " data 0x%" PRIx32 " size %u"

--

2.16.1