1 /*
2 * ARM Generic Interrupt Controller v3 (emulation)
3 *
4 * Copyright (c) 2016 Linaro Limited
5 * Written by Peter Maydell
6 *
7 * This code is licensed under the GPL, version 2 or (at your option)
8 * any later version.
9 */
10
11 /* This file contains the code for the system register interface
12 * portions of the GICv3.
13 */
14
15 #include "qemu/osdep.h"
16 #include "qemu/bitops.h"
17 #include "qemu/log.h"
18 #include "qemu/main-loop.h"
19 #include "trace.h"
20 #include "gicv3_internal.h"
21 #include "hw/irq.h"
22 #include "cpu.h"
23 #include "target/arm/cpregs.h"
24 #include "sysemu/tcg.h"
25 #include "sysemu/qtest.h"
26
27 /*
28 * Special case return value from hppvi_index(); must be larger than
29 * the architecturally maximum possible list register index (which is 15)
30 */
31 #define HPPVI_INDEX_VLPI 16
32
icc_cs_from_env(CPUARMState * env)33 static GICv3CPUState *icc_cs_from_env(CPUARMState *env)
34 {
35 return env->gicv3state;
36 }
37
gicv3_use_ns_bank(CPUARMState * env)38 static bool gicv3_use_ns_bank(CPUARMState *env)
39 {
40 /* Return true if we should use the NonSecure bank for a banked GIC
41 * CPU interface register. Note that this differs from the
42 * access_secure_reg() function because GICv3 banked registers are
43 * banked even for AArch64, unlike the other CPU system registers.
44 */
45 return !arm_is_secure_below_el3(env);
46 }
47
48 /* The minimum BPR for the virtual interface is a configurable property */
icv_min_vbpr(GICv3CPUState * cs)49 static inline int icv_min_vbpr(GICv3CPUState *cs)
50 {
51 return 7 - cs->vprebits;
52 }
53
ich_num_aprs(GICv3CPUState * cs)54 static inline int ich_num_aprs(GICv3CPUState *cs)
55 {
56 /* Return the number of virtual APR registers (1, 2, or 4) */
57 int aprmax = 1 << (cs->vprebits - 5);
58 assert(aprmax <= ARRAY_SIZE(cs->ich_apr[0]));
59 return aprmax;
60 }
61
62 /* Simple accessor functions for LR fields */
ich_lr_vintid(uint64_t lr)63 static uint32_t ich_lr_vintid(uint64_t lr)
64 {
65 return extract64(lr, ICH_LR_EL2_VINTID_SHIFT, ICH_LR_EL2_VINTID_LENGTH);
66 }
67
ich_lr_pintid(uint64_t lr)68 static uint32_t ich_lr_pintid(uint64_t lr)
69 {
70 return extract64(lr, ICH_LR_EL2_PINTID_SHIFT, ICH_LR_EL2_PINTID_LENGTH);
71 }
72
ich_lr_prio(uint64_t lr)73 static uint32_t ich_lr_prio(uint64_t lr)
74 {
75 return extract64(lr, ICH_LR_EL2_PRIORITY_SHIFT, ICH_LR_EL2_PRIORITY_LENGTH);
76 }
77
ich_lr_state(uint64_t lr)78 static int ich_lr_state(uint64_t lr)
79 {
80 return extract64(lr, ICH_LR_EL2_STATE_SHIFT, ICH_LR_EL2_STATE_LENGTH);
81 }
82
icv_access(CPUARMState * env,int hcr_flags)83 static bool icv_access(CPUARMState *env, int hcr_flags)
84 {
85 /* Return true if this ICC_ register access should really be
86 * directed to an ICV_ access. hcr_flags is a mask of
87 * HCR_EL2 bits to check: we treat this as an ICV_ access
88 * if we are in NS EL1 and at least one of the specified
89 * HCR_EL2 bits is set.
90 *
91 * ICV registers fall into four categories:
92 * * access if NS EL1 and HCR_EL2.FMO == 1:
93 * all ICV regs with '0' in their name
94 * * access if NS EL1 and HCR_EL2.IMO == 1:
95 * all ICV regs with '1' in their name
96 * * access if NS EL1 and either IMO or FMO == 1:
97 * CTLR, DIR, PMR, RPR
98 */
99 uint64_t hcr_el2 = arm_hcr_el2_eff(env);
100 bool flagmatch = hcr_el2 & hcr_flags & (HCR_IMO | HCR_FMO);
101
102 return flagmatch && arm_current_el(env) == 1
103 && !arm_is_secure_below_el3(env);
104 }
105
read_vbpr(GICv3CPUState * cs,int grp)106 static int read_vbpr(GICv3CPUState *cs, int grp)
107 {
108 /* Read VBPR value out of the VMCR field (caller must handle
109 * VCBPR effects if required)
110 */
111 if (grp == GICV3_G0) {
112 return extract64(cs->ich_vmcr_el2, ICH_VMCR_EL2_VBPR0_SHIFT,
113 ICH_VMCR_EL2_VBPR0_LENGTH);
114 } else {
115 return extract64(cs->ich_vmcr_el2, ICH_VMCR_EL2_VBPR1_SHIFT,
116 ICH_VMCR_EL2_VBPR1_LENGTH);
117 }
118 }
119
write_vbpr(GICv3CPUState * cs,int grp,int value)120 static void write_vbpr(GICv3CPUState *cs, int grp, int value)
121 {
122 /* Write new VBPR1 value, handling the "writing a value less than
123 * the minimum sets it to the minimum" semantics.
124 */
125 int min = icv_min_vbpr(cs);
126
127 if (grp != GICV3_G0) {
128 min++;
129 }
130
131 value = MAX(value, min);
132
133 if (grp == GICV3_G0) {
134 cs->ich_vmcr_el2 = deposit64(cs->ich_vmcr_el2, ICH_VMCR_EL2_VBPR0_SHIFT,
135 ICH_VMCR_EL2_VBPR0_LENGTH, value);
136 } else {
137 cs->ich_vmcr_el2 = deposit64(cs->ich_vmcr_el2, ICH_VMCR_EL2_VBPR1_SHIFT,
138 ICH_VMCR_EL2_VBPR1_LENGTH, value);
139 }
140 }
141
icv_fullprio_mask(GICv3CPUState * cs)142 static uint32_t icv_fullprio_mask(GICv3CPUState *cs)
143 {
144 /* Return a mask word which clears the unimplemented priority bits
145 * from a priority value for a virtual interrupt. (Not to be confused
146 * with the group priority, whose mask depends on the value of VBPR
147 * for the interrupt group.)
148 */
149 return (~0U << (8 - cs->vpribits)) & 0xff;
150 }
151
ich_highest_active_virt_prio(GICv3CPUState * cs)152 static int ich_highest_active_virt_prio(GICv3CPUState *cs)
153 {
154 /* Calculate the current running priority based on the set bits
155 * in the ICH Active Priority Registers.
156 */
157 int i;
158 int aprmax = ich_num_aprs(cs);
159
160 for (i = 0; i < aprmax; i++) {
161 uint32_t apr = cs->ich_apr[GICV3_G0][i] |
162 cs->ich_apr[GICV3_G1NS][i];
163
164 if (!apr) {
165 continue;
166 }
167 return (i * 32 + ctz32(apr)) << (icv_min_vbpr(cs) + 1);
168 }
169 /* No current active interrupts: return idle priority */
170 return 0xff;
171 }
172
hppvi_index(GICv3CPUState * cs)173 static int hppvi_index(GICv3CPUState *cs)
174 {
175 /*
176 * Return the list register index of the highest priority pending
177 * virtual interrupt, as per the HighestPriorityVirtualInterrupt
178 * pseudocode. If no pending virtual interrupts, return -1.
179 * If the highest priority pending virtual interrupt is a vLPI,
180 * return HPPVI_INDEX_VLPI.
181 * (The pseudocode handles checking whether the vLPI is higher
182 * priority than the highest priority list register at every
183 * callsite of HighestPriorityVirtualInterrupt; we check it here.)
184 */
185 ARMCPU *cpu = ARM_CPU(cs->cpu);
186 CPUARMState *env = &cpu->env;
187 int idx = -1;
188 int i;
189 /* Note that a list register entry with a priority of 0xff will
190 * never be reported by this function; this is the architecturally
191 * correct behaviour.
192 */
193 int prio = 0xff;
194
195 if (!(cs->ich_vmcr_el2 & (ICH_VMCR_EL2_VENG0 | ICH_VMCR_EL2_VENG1))) {
196 /* Both groups disabled, definitely nothing to do */
197 return idx;
198 }
199
200 for (i = 0; i < cs->num_list_regs; i++) {
201 uint64_t lr = cs->ich_lr_el2[i];
202 int thisprio;
203
204 if (ich_lr_state(lr) != ICH_LR_EL2_STATE_PENDING) {
205 /* Not Pending */
206 continue;
207 }
208
209 /* Ignore interrupts if relevant group enable not set */
210 if (lr & ICH_LR_EL2_GROUP) {
211 if (!(cs->ich_vmcr_el2 & ICH_VMCR_EL2_VENG1)) {
212 continue;
213 }
214 } else {
215 if (!(cs->ich_vmcr_el2 & ICH_VMCR_EL2_VENG0)) {
216 continue;
217 }
218 }
219
220 thisprio = ich_lr_prio(lr);
221
222 if (thisprio < prio) {
223 prio = thisprio;
224 idx = i;
225 }
226 }
227
228 /*
229 * "no pending vLPI" is indicated with prio = 0xff, which always
230 * fails the priority check here. vLPIs are only considered
231 * when we are in Non-Secure state.
232 */
233 if (cs->hppvlpi.prio < prio && !arm_is_secure(env)) {
234 if (cs->hppvlpi.grp == GICV3_G0) {
235 if (cs->ich_vmcr_el2 & ICH_VMCR_EL2_VENG0) {
236 return HPPVI_INDEX_VLPI;
237 }
238 } else {
239 if (cs->ich_vmcr_el2 & ICH_VMCR_EL2_VENG1) {
240 return HPPVI_INDEX_VLPI;
241 }
242 }
243 }
244
245 return idx;
246 }
247
icv_gprio_mask(GICv3CPUState * cs,int group)248 static uint32_t icv_gprio_mask(GICv3CPUState *cs, int group)
249 {
250 /* Return a mask word which clears the subpriority bits from
251 * a priority value for a virtual interrupt in the specified group.
252 * This depends on the VBPR value.
253 * If using VBPR0 then:
254 * a BPR of 0 means the group priority bits are [7:1];
255 * a BPR of 1 means they are [7:2], and so on down to
256 * a BPR of 7 meaning no group priority bits at all.
257 * If using VBPR1 then:
258 * a BPR of 0 is impossible (the minimum value is 1)
259 * a BPR of 1 means the group priority bits are [7:1];
260 * a BPR of 2 means they are [7:2], and so on down to
261 * a BPR of 7 meaning the group priority is [7].
262 *
263 * Which BPR to use depends on the group of the interrupt and
264 * the current ICH_VMCR_EL2.VCBPR settings.
265 *
266 * This corresponds to the VGroupBits() pseudocode.
267 */
268 int bpr;
269
270 if (group == GICV3_G1NS && cs->ich_vmcr_el2 & ICH_VMCR_EL2_VCBPR) {
271 group = GICV3_G0;
272 }
273
274 bpr = read_vbpr(cs, group);
275 if (group == GICV3_G1NS) {
276 assert(bpr > 0);
277 bpr--;
278 }
279
280 return ~0U << (bpr + 1);
281 }
282
icv_hppi_can_preempt(GICv3CPUState * cs,uint64_t lr)283 static bool icv_hppi_can_preempt(GICv3CPUState *cs, uint64_t lr)
284 {
285 /* Return true if we can signal this virtual interrupt defined by
286 * the given list register value; see the pseudocode functions
287 * CanSignalVirtualInterrupt and CanSignalVirtualInt.
288 * Compare also icc_hppi_can_preempt() which is the non-virtual
289 * equivalent of these checks.
290 */
291 int grp;
292 uint32_t mask, prio, rprio, vpmr;
293
294 if (!(cs->ich_hcr_el2 & ICH_HCR_EL2_EN)) {
295 /* Virtual interface disabled */
296 return false;
297 }
298
299 /* We don't need to check that this LR is in Pending state because
300 * that has already been done in hppvi_index().
301 */
302
303 prio = ich_lr_prio(lr);
304 vpmr = extract64(cs->ich_vmcr_el2, ICH_VMCR_EL2_VPMR_SHIFT,
305 ICH_VMCR_EL2_VPMR_LENGTH);
306
307 if (prio >= vpmr) {
308 /* Priority mask masks this interrupt */
309 return false;
310 }
311
312 rprio = ich_highest_active_virt_prio(cs);
313 if (rprio == 0xff) {
314 /* No running interrupt so we can preempt */
315 return true;
316 }
317
318 grp = (lr & ICH_LR_EL2_GROUP) ? GICV3_G1NS : GICV3_G0;
319
320 mask = icv_gprio_mask(cs, grp);
321
322 /* We only preempt a running interrupt if the pending interrupt's
323 * group priority is sufficient (the subpriorities are not considered).
324 */
325 if ((prio & mask) < (rprio & mask)) {
326 return true;
327 }
328
329 return false;
330 }
331
icv_hppvlpi_can_preempt(GICv3CPUState * cs)332 static bool icv_hppvlpi_can_preempt(GICv3CPUState *cs)
333 {
334 /*
335 * Return true if we can signal the highest priority pending vLPI.
336 * We can assume we're Non-secure because hppvi_index() already
337 * tested for that.
338 */
339 uint32_t mask, rprio, vpmr;
340
341 if (!(cs->ich_hcr_el2 & ICH_HCR_EL2_EN)) {
342 /* Virtual interface disabled */
343 return false;
344 }
345
346 vpmr = extract64(cs->ich_vmcr_el2, ICH_VMCR_EL2_VPMR_SHIFT,
347 ICH_VMCR_EL2_VPMR_LENGTH);
348
349 if (cs->hppvlpi.prio >= vpmr) {
350 /* Priority mask masks this interrupt */
351 return false;
352 }
353
354 rprio = ich_highest_active_virt_prio(cs);
355 if (rprio == 0xff) {
356 /* No running interrupt so we can preempt */
357 return true;
358 }
359
360 mask = icv_gprio_mask(cs, cs->hppvlpi.grp);
361
362 /*
363 * We only preempt a running interrupt if the pending interrupt's
364 * group priority is sufficient (the subpriorities are not considered).
365 */
366 if ((cs->hppvlpi.prio & mask) < (rprio & mask)) {
367 return true;
368 }
369
370 return false;
371 }
372
eoi_maintenance_interrupt_state(GICv3CPUState * cs,uint32_t * misr)373 static uint32_t eoi_maintenance_interrupt_state(GICv3CPUState *cs,
374 uint32_t *misr)
375 {
376 /* Return a set of bits indicating the EOI maintenance interrupt status
377 * for each list register. The EOI maintenance interrupt status is
378 * 1 if LR.State == 0 && LR.HW == 0 && LR.EOI == 1
379 * (see the GICv3 spec for the ICH_EISR_EL2 register).
380 * If misr is not NULL then we should also collect the information
381 * about the MISR.EOI, MISR.NP and MISR.U bits.
382 */
383 uint32_t value = 0;
384 int validcount = 0;
385 bool seenpending = false;
386 int i;
387
388 for (i = 0; i < cs->num_list_regs; i++) {
389 uint64_t lr = cs->ich_lr_el2[i];
390
391 if ((lr & (ICH_LR_EL2_STATE_MASK | ICH_LR_EL2_HW | ICH_LR_EL2_EOI))
392 == ICH_LR_EL2_EOI) {
393 value |= (1 << i);
394 }
395 if ((lr & ICH_LR_EL2_STATE_MASK)) {
396 validcount++;
397 }
398 if (ich_lr_state(lr) == ICH_LR_EL2_STATE_PENDING) {
399 seenpending = true;
400 }
401 }
402
403 if (misr) {
404 if (validcount < 2 && (cs->ich_hcr_el2 & ICH_HCR_EL2_UIE)) {
405 *misr |= ICH_MISR_EL2_U;
406 }
407 if (!seenpending && (cs->ich_hcr_el2 & ICH_HCR_EL2_NPIE)) {
408 *misr |= ICH_MISR_EL2_NP;
409 }
410 if (value) {
411 *misr |= ICH_MISR_EL2_EOI;
412 }
413 }
414 return value;
415 }
416
maintenance_interrupt_state(GICv3CPUState * cs)417 static uint32_t maintenance_interrupt_state(GICv3CPUState *cs)
418 {
419 /* Return a set of bits indicating the maintenance interrupt status
420 * (as seen in the ICH_MISR_EL2 register).
421 */
422 uint32_t value = 0;
423
424 /* Scan list registers and fill in the U, NP and EOI bits */
425 eoi_maintenance_interrupt_state(cs, &value);
426
427 if ((cs->ich_hcr_el2 & ICH_HCR_EL2_LRENPIE) &&
428 (cs->ich_hcr_el2 & ICH_HCR_EL2_EOICOUNT_MASK)) {
429 value |= ICH_MISR_EL2_LRENP;
430 }
431
432 if ((cs->ich_hcr_el2 & ICH_HCR_EL2_VGRP0EIE) &&
433 (cs->ich_vmcr_el2 & ICH_VMCR_EL2_VENG0)) {
434 value |= ICH_MISR_EL2_VGRP0E;
435 }
436
437 if ((cs->ich_hcr_el2 & ICH_HCR_EL2_VGRP0DIE) &&
438 !(cs->ich_vmcr_el2 & ICH_VMCR_EL2_VENG1)) {
439 value |= ICH_MISR_EL2_VGRP0D;
440 }
441 if ((cs->ich_hcr_el2 & ICH_HCR_EL2_VGRP1EIE) &&
442 (cs->ich_vmcr_el2 & ICH_VMCR_EL2_VENG1)) {
443 value |= ICH_MISR_EL2_VGRP1E;
444 }
445
446 if ((cs->ich_hcr_el2 & ICH_HCR_EL2_VGRP1DIE) &&
447 !(cs->ich_vmcr_el2 & ICH_VMCR_EL2_VENG1)) {
448 value |= ICH_MISR_EL2_VGRP1D;
449 }
450
451 return value;
452 }
453
gicv3_cpuif_virt_irq_fiq_update(GICv3CPUState * cs)454 void gicv3_cpuif_virt_irq_fiq_update(GICv3CPUState *cs)
455 {
456 /*
457 * Tell the CPU about any pending virtual interrupts.
458 * This should only be called for changes that affect the
459 * vIRQ and vFIQ status and do not change the maintenance
460 * interrupt status. This means that unlike gicv3_cpuif_virt_update()
461 * this function won't recursively call back into the GIC code.
462 * The main use of this is when the redistributor has changed the
463 * highest priority pending virtual LPI.
464 */
465 int idx;
466 int irqlevel = 0;
467 int fiqlevel = 0;
468
469 idx = hppvi_index(cs);
470 trace_gicv3_cpuif_virt_update(gicv3_redist_affid(cs), idx,
471 cs->hppvlpi.irq, cs->hppvlpi.grp,
472 cs->hppvlpi.prio);
473 if (idx == HPPVI_INDEX_VLPI) {
474 if (icv_hppvlpi_can_preempt(cs)) {
475 if (cs->hppvlpi.grp == GICV3_G0) {
476 fiqlevel = 1;
477 } else {
478 irqlevel = 1;
479 }
480 }
481 } else if (idx >= 0) {
482 uint64_t lr = cs->ich_lr_el2[idx];
483
484 if (icv_hppi_can_preempt(cs, lr)) {
485 /* Virtual interrupts are simple: G0 are always FIQ, and G1 IRQ */
486 if (lr & ICH_LR_EL2_GROUP) {
487 irqlevel = 1;
488 } else {
489 fiqlevel = 1;
490 }
491 }
492 }
493
494 trace_gicv3_cpuif_virt_set_irqs(gicv3_redist_affid(cs), fiqlevel, irqlevel);
495 qemu_set_irq(cs->parent_vfiq, fiqlevel);
496 qemu_set_irq(cs->parent_virq, irqlevel);
497 }
498
gicv3_cpuif_virt_update(GICv3CPUState * cs)499 static void gicv3_cpuif_virt_update(GICv3CPUState *cs)
500 {
501 /*
502 * Tell the CPU about any pending virtual interrupts or
503 * maintenance interrupts, following a change to the state
504 * of the CPU interface relevant to virtual interrupts.
505 *
506 * CAUTION: this function will call qemu_set_irq() on the
507 * CPU maintenance IRQ line, which is typically wired up
508 * to the GIC as a per-CPU interrupt. This means that it
509 * will recursively call back into the GIC code via
510 * gicv3_redist_set_irq() and thus into the CPU interface code's
511 * gicv3_cpuif_update(). It is therefore important that this
512 * function is only called as the final action of a CPU interface
513 * register write implementation, after all the GIC state
514 * fields have been updated. gicv3_cpuif_update() also must
515 * not cause this function to be called, but that happens
516 * naturally as a result of there being no architectural
517 * linkage between the physical and virtual GIC logic.
518 */
519 ARMCPU *cpu = ARM_CPU(cs->cpu);
520 int maintlevel = 0;
521
522 gicv3_cpuif_virt_irq_fiq_update(cs);
523
524 if ((cs->ich_hcr_el2 & ICH_HCR_EL2_EN) &&
525 maintenance_interrupt_state(cs) != 0) {
526 maintlevel = 1;
527 }
528
529 trace_gicv3_cpuif_virt_set_maint_irq(gicv3_redist_affid(cs), maintlevel);
530 qemu_set_irq(cpu->gicv3_maintenance_interrupt, maintlevel);
531 }
532
icv_ap_read(CPUARMState * env,const ARMCPRegInfo * ri)533 static uint64_t icv_ap_read(CPUARMState *env, const ARMCPRegInfo *ri)
534 {
535 GICv3CPUState *cs = icc_cs_from_env(env);
536 int regno = ri->opc2 & 3;
537 int grp = (ri->crm & 1) ? GICV3_G1NS : GICV3_G0;
538 uint64_t value = cs->ich_apr[grp][regno];
539
540 trace_gicv3_icv_ap_read(ri->crm & 1, regno, gicv3_redist_affid(cs), value);
541 return value;
542 }
543
icv_ap_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)544 static void icv_ap_write(CPUARMState *env, const ARMCPRegInfo *ri,
545 uint64_t value)
546 {
547 GICv3CPUState *cs = icc_cs_from_env(env);
548 int regno = ri->opc2 & 3;
549 int grp = (ri->crm & 1) ? GICV3_G1NS : GICV3_G0;
550
551 trace_gicv3_icv_ap_write(ri->crm & 1, regno, gicv3_redist_affid(cs), value);
552
553 cs->ich_apr[grp][regno] = value & 0xFFFFFFFFU;
554
555 gicv3_cpuif_virt_irq_fiq_update(cs);
556 return;
557 }
558
icv_bpr_read(CPUARMState * env,const ARMCPRegInfo * ri)559 static uint64_t icv_bpr_read(CPUARMState *env, const ARMCPRegInfo *ri)
560 {
561 GICv3CPUState *cs = icc_cs_from_env(env);
562 int grp = (ri->crm == 8) ? GICV3_G0 : GICV3_G1NS;
563 uint64_t bpr;
564 bool satinc = false;
565
566 if (grp == GICV3_G1NS && (cs->ich_vmcr_el2 & ICH_VMCR_EL2_VCBPR)) {
567 /* reads return bpr0 + 1 saturated to 7, writes ignored */
568 grp = GICV3_G0;
569 satinc = true;
570 }
571
572 bpr = read_vbpr(cs, grp);
573
574 if (satinc) {
575 bpr++;
576 bpr = MIN(bpr, 7);
577 }
578
579 trace_gicv3_icv_bpr_read(ri->crm == 8 ? 0 : 1, gicv3_redist_affid(cs), bpr);
580
581 return bpr;
582 }
583
icv_bpr_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)584 static void icv_bpr_write(CPUARMState *env, const ARMCPRegInfo *ri,
585 uint64_t value)
586 {
587 GICv3CPUState *cs = icc_cs_from_env(env);
588 int grp = (ri->crm == 8) ? GICV3_G0 : GICV3_G1NS;
589
590 trace_gicv3_icv_bpr_write(ri->crm == 8 ? 0 : 1,
591 gicv3_redist_affid(cs), value);
592
593 if (grp == GICV3_G1NS && (cs->ich_vmcr_el2 & ICH_VMCR_EL2_VCBPR)) {
594 /* reads return bpr0 + 1 saturated to 7, writes ignored */
595 return;
596 }
597
598 write_vbpr(cs, grp, value);
599
600 gicv3_cpuif_virt_irq_fiq_update(cs);
601 }
602
icv_pmr_read(CPUARMState * env,const ARMCPRegInfo * ri)603 static uint64_t icv_pmr_read(CPUARMState *env, const ARMCPRegInfo *ri)
604 {
605 GICv3CPUState *cs = icc_cs_from_env(env);
606 uint64_t value;
607
608 value = extract64(cs->ich_vmcr_el2, ICH_VMCR_EL2_VPMR_SHIFT,
609 ICH_VMCR_EL2_VPMR_LENGTH);
610
611 trace_gicv3_icv_pmr_read(gicv3_redist_affid(cs), value);
612 return value;
613 }
614
icv_pmr_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)615 static void icv_pmr_write(CPUARMState *env, const ARMCPRegInfo *ri,
616 uint64_t value)
617 {
618 GICv3CPUState *cs = icc_cs_from_env(env);
619
620 trace_gicv3_icv_pmr_write(gicv3_redist_affid(cs), value);
621
622 value &= icv_fullprio_mask(cs);
623
624 cs->ich_vmcr_el2 = deposit64(cs->ich_vmcr_el2, ICH_VMCR_EL2_VPMR_SHIFT,
625 ICH_VMCR_EL2_VPMR_LENGTH, value);
626
627 gicv3_cpuif_virt_irq_fiq_update(cs);
628 }
629
icv_igrpen_read(CPUARMState * env,const ARMCPRegInfo * ri)630 static uint64_t icv_igrpen_read(CPUARMState *env, const ARMCPRegInfo *ri)
631 {
632 GICv3CPUState *cs = icc_cs_from_env(env);
633 int enbit;
634 uint64_t value;
635
636 enbit = ri->opc2 & 1 ? ICH_VMCR_EL2_VENG1_SHIFT : ICH_VMCR_EL2_VENG0_SHIFT;
637 value = extract64(cs->ich_vmcr_el2, enbit, 1);
638
639 trace_gicv3_icv_igrpen_read(ri->opc2 & 1 ? 1 : 0,
640 gicv3_redist_affid(cs), value);
641 return value;
642 }
643
icv_igrpen_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)644 static void icv_igrpen_write(CPUARMState *env, const ARMCPRegInfo *ri,
645 uint64_t value)
646 {
647 GICv3CPUState *cs = icc_cs_from_env(env);
648 int enbit;
649
650 trace_gicv3_icv_igrpen_write(ri->opc2 & 1 ? 1 : 0,
651 gicv3_redist_affid(cs), value);
652
653 enbit = ri->opc2 & 1 ? ICH_VMCR_EL2_VENG1_SHIFT : ICH_VMCR_EL2_VENG0_SHIFT;
654
655 cs->ich_vmcr_el2 = deposit64(cs->ich_vmcr_el2, enbit, 1, value);
656 gicv3_cpuif_virt_update(cs);
657 }
658
icv_ctlr_read(CPUARMState * env,const ARMCPRegInfo * ri)659 static uint64_t icv_ctlr_read(CPUARMState *env, const ARMCPRegInfo *ri)
660 {
661 GICv3CPUState *cs = icc_cs_from_env(env);
662 uint64_t value;
663
664 /* Note that the fixed fields here (A3V, SEIS, IDbits, PRIbits)
665 * should match the ones reported in ich_vtr_read().
666 */
667 value = ICC_CTLR_EL1_A3V | (1 << ICC_CTLR_EL1_IDBITS_SHIFT) |
668 ((cs->vpribits - 1) << ICC_CTLR_EL1_PRIBITS_SHIFT);
669
670 if (cs->ich_vmcr_el2 & ICH_VMCR_EL2_VEOIM) {
671 value |= ICC_CTLR_EL1_EOIMODE;
672 }
673
674 if (cs->ich_vmcr_el2 & ICH_VMCR_EL2_VCBPR) {
675 value |= ICC_CTLR_EL1_CBPR;
676 }
677
678 trace_gicv3_icv_ctlr_read(gicv3_redist_affid(cs), value);
679 return value;
680 }
681
icv_ctlr_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)682 static void icv_ctlr_write(CPUARMState *env, const ARMCPRegInfo *ri,
683 uint64_t value)
684 {
685 GICv3CPUState *cs = icc_cs_from_env(env);
686
687 trace_gicv3_icv_ctlr_write(gicv3_redist_affid(cs), value);
688
689 cs->ich_vmcr_el2 = deposit64(cs->ich_vmcr_el2, ICH_VMCR_EL2_VCBPR_SHIFT,
690 1, value & ICC_CTLR_EL1_CBPR ? 1 : 0);
691 cs->ich_vmcr_el2 = deposit64(cs->ich_vmcr_el2, ICH_VMCR_EL2_VEOIM_SHIFT,
692 1, value & ICC_CTLR_EL1_EOIMODE ? 1 : 0);
693
694 gicv3_cpuif_virt_irq_fiq_update(cs);
695 }
696
icv_rpr_read(CPUARMState * env,const ARMCPRegInfo * ri)697 static uint64_t icv_rpr_read(CPUARMState *env, const ARMCPRegInfo *ri)
698 {
699 GICv3CPUState *cs = icc_cs_from_env(env);
700 int prio = ich_highest_active_virt_prio(cs);
701
702 trace_gicv3_icv_rpr_read(gicv3_redist_affid(cs), prio);
703 return prio;
704 }
705
icv_hppir_read(CPUARMState * env,const ARMCPRegInfo * ri)706 static uint64_t icv_hppir_read(CPUARMState *env, const ARMCPRegInfo *ri)
707 {
708 GICv3CPUState *cs = icc_cs_from_env(env);
709 int grp = ri->crm == 8 ? GICV3_G0 : GICV3_G1NS;
710 int idx = hppvi_index(cs);
711 uint64_t value = INTID_SPURIOUS;
712
713 if (idx == HPPVI_INDEX_VLPI) {
714 if (cs->hppvlpi.grp == grp) {
715 value = cs->hppvlpi.irq;
716 }
717 } else if (idx >= 0) {
718 uint64_t lr = cs->ich_lr_el2[idx];
719 int thisgrp = (lr & ICH_LR_EL2_GROUP) ? GICV3_G1NS : GICV3_G0;
720
721 if (grp == thisgrp) {
722 value = ich_lr_vintid(lr);
723 }
724 }
725
726 trace_gicv3_icv_hppir_read(ri->crm == 8 ? 0 : 1,
727 gicv3_redist_affid(cs), value);
728 return value;
729 }
730
icv_activate_irq(GICv3CPUState * cs,int idx,int grp)731 static void icv_activate_irq(GICv3CPUState *cs, int idx, int grp)
732 {
733 /* Activate the interrupt in the specified list register
734 * by moving it from Pending to Active state, and update the
735 * Active Priority Registers.
736 */
737 uint32_t mask = icv_gprio_mask(cs, grp);
738 int prio = ich_lr_prio(cs->ich_lr_el2[idx]) & mask;
739 int aprbit = prio >> (8 - cs->vprebits);
740 int regno = aprbit / 32;
741 int regbit = aprbit % 32;
742
743 cs->ich_lr_el2[idx] &= ~ICH_LR_EL2_STATE_PENDING_BIT;
744 cs->ich_lr_el2[idx] |= ICH_LR_EL2_STATE_ACTIVE_BIT;
745 cs->ich_apr[grp][regno] |= (1 << regbit);
746 }
747
icv_activate_vlpi(GICv3CPUState * cs)748 static void icv_activate_vlpi(GICv3CPUState *cs)
749 {
750 uint32_t mask = icv_gprio_mask(cs, cs->hppvlpi.grp);
751 int prio = cs->hppvlpi.prio & mask;
752 int aprbit = prio >> (8 - cs->vprebits);
753 int regno = aprbit / 32;
754 int regbit = aprbit % 32;
755
756 cs->ich_apr[cs->hppvlpi.grp][regno] |= (1 << regbit);
757 gicv3_redist_vlpi_pending(cs, cs->hppvlpi.irq, 0);
758 }
759
icv_iar_read(CPUARMState * env,const ARMCPRegInfo * ri)760 static uint64_t icv_iar_read(CPUARMState *env, const ARMCPRegInfo *ri)
761 {
762 GICv3CPUState *cs = icc_cs_from_env(env);
763 int grp = ri->crm == 8 ? GICV3_G0 : GICV3_G1NS;
764 int idx = hppvi_index(cs);
765 uint64_t intid = INTID_SPURIOUS;
766
767 if (idx == HPPVI_INDEX_VLPI) {
768 if (cs->hppvlpi.grp == grp && icv_hppvlpi_can_preempt(cs)) {
769 intid = cs->hppvlpi.irq;
770 icv_activate_vlpi(cs);
771 }
772 } else if (idx >= 0) {
773 uint64_t lr = cs->ich_lr_el2[idx];
774 int thisgrp = (lr & ICH_LR_EL2_GROUP) ? GICV3_G1NS : GICV3_G0;
775
776 if (thisgrp == grp && icv_hppi_can_preempt(cs, lr)) {
777 intid = ich_lr_vintid(lr);
778 if (!gicv3_intid_is_special(intid)) {
779 icv_activate_irq(cs, idx, grp);
780 } else {
781 /* Interrupt goes from Pending to Invalid */
782 cs->ich_lr_el2[idx] &= ~ICH_LR_EL2_STATE_PENDING_BIT;
783 /* We will now return the (bogus) ID from the list register,
784 * as per the pseudocode.
785 */
786 }
787 }
788 }
789
790 trace_gicv3_icv_iar_read(ri->crm == 8 ? 0 : 1,
791 gicv3_redist_affid(cs), intid);
792
793 gicv3_cpuif_virt_update(cs);
794
795 return intid;
796 }
797
icc_fullprio_mask(GICv3CPUState * cs)798 static uint32_t icc_fullprio_mask(GICv3CPUState *cs)
799 {
800 /*
801 * Return a mask word which clears the unimplemented priority bits
802 * from a priority value for a physical interrupt. (Not to be confused
803 * with the group priority, whose mask depends on the value of BPR
804 * for the interrupt group.)
805 */
806 return (~0U << (8 - cs->pribits)) & 0xff;
807 }
808
icc_min_bpr(GICv3CPUState * cs)809 static inline int icc_min_bpr(GICv3CPUState *cs)
810 {
811 /* The minimum BPR for the physical interface. */
812 return 7 - cs->prebits;
813 }
814
icc_min_bpr_ns(GICv3CPUState * cs)815 static inline int icc_min_bpr_ns(GICv3CPUState *cs)
816 {
817 return icc_min_bpr(cs) + 1;
818 }
819
icc_num_aprs(GICv3CPUState * cs)820 static inline int icc_num_aprs(GICv3CPUState *cs)
821 {
822 /* Return the number of APR registers (1, 2, or 4) */
823 int aprmax = 1 << MAX(cs->prebits - 5, 0);
824 assert(aprmax <= ARRAY_SIZE(cs->icc_apr[0]));
825 return aprmax;
826 }
827
icc_highest_active_prio(GICv3CPUState * cs)828 static int icc_highest_active_prio(GICv3CPUState *cs)
829 {
830 /* Calculate the current running priority based on the set bits
831 * in the Active Priority Registers.
832 */
833 int i;
834
835 for (i = 0; i < icc_num_aprs(cs); i++) {
836 uint32_t apr = cs->icc_apr[GICV3_G0][i] |
837 cs->icc_apr[GICV3_G1][i] | cs->icc_apr[GICV3_G1NS][i];
838
839 if (!apr) {
840 continue;
841 }
842 return (i * 32 + ctz32(apr)) << (icc_min_bpr(cs) + 1);
843 }
844 /* No current active interrupts: return idle priority */
845 return 0xff;
846 }
847
icc_gprio_mask(GICv3CPUState * cs,int group)848 static uint32_t icc_gprio_mask(GICv3CPUState *cs, int group)
849 {
850 /* Return a mask word which clears the subpriority bits from
851 * a priority value for an interrupt in the specified group.
852 * This depends on the BPR value. For CBPR0 (S or NS):
853 * a BPR of 0 means the group priority bits are [7:1];
854 * a BPR of 1 means they are [7:2], and so on down to
855 * a BPR of 7 meaning no group priority bits at all.
856 * For CBPR1 NS:
857 * a BPR of 0 is impossible (the minimum value is 1)
858 * a BPR of 1 means the group priority bits are [7:1];
859 * a BPR of 2 means they are [7:2], and so on down to
860 * a BPR of 7 meaning the group priority is [7].
861 *
862 * Which BPR to use depends on the group of the interrupt and
863 * the current ICC_CTLR.CBPR settings.
864 *
865 * This corresponds to the GroupBits() pseudocode.
866 */
867 int bpr;
868
869 if ((group == GICV3_G1 && cs->icc_ctlr_el1[GICV3_S] & ICC_CTLR_EL1_CBPR) ||
870 (group == GICV3_G1NS &&
871 cs->icc_ctlr_el1[GICV3_NS] & ICC_CTLR_EL1_CBPR)) {
872 group = GICV3_G0;
873 }
874
875 bpr = cs->icc_bpr[group] & 7;
876
877 if (group == GICV3_G1NS) {
878 assert(bpr > 0);
879 bpr--;
880 }
881
882 return ~0U << (bpr + 1);
883 }
884
icc_no_enabled_hppi(GICv3CPUState * cs)885 static bool icc_no_enabled_hppi(GICv3CPUState *cs)
886 {
887 /* Return true if there is no pending interrupt, or the
888 * highest priority pending interrupt is in a group which has been
889 * disabled at the CPU interface by the ICC_IGRPEN* register enable bits.
890 */
891 return cs->hppi.prio == 0xff || (cs->icc_igrpen[cs->hppi.grp] == 0);
892 }
893
icc_hppi_can_preempt(GICv3CPUState * cs)894 static bool icc_hppi_can_preempt(GICv3CPUState *cs)
895 {
896 /* Return true if we have a pending interrupt of sufficient
897 * priority to preempt.
898 */
899 int rprio;
900 uint32_t mask;
901
902 if (icc_no_enabled_hppi(cs)) {
903 return false;
904 }
905
906 if (cs->hppi.prio >= cs->icc_pmr_el1) {
907 /* Priority mask masks this interrupt */
908 return false;
909 }
910
911 rprio = icc_highest_active_prio(cs);
912 if (rprio == 0xff) {
913 /* No currently running interrupt so we can preempt */
914 return true;
915 }
916
917 mask = icc_gprio_mask(cs, cs->hppi.grp);
918
919 /* We only preempt a running interrupt if the pending interrupt's
920 * group priority is sufficient (the subpriorities are not considered).
921 */
922 if ((cs->hppi.prio & mask) < (rprio & mask)) {
923 return true;
924 }
925
926 return false;
927 }
928
gicv3_cpuif_update(GICv3CPUState * cs)929 void gicv3_cpuif_update(GICv3CPUState *cs)
930 {
931 /* Tell the CPU about its highest priority pending interrupt */
932 int irqlevel = 0;
933 int fiqlevel = 0;
934 ARMCPU *cpu = ARM_CPU(cs->cpu);
935 CPUARMState *env = &cpu->env;
936
937 g_assert(qemu_mutex_iothread_locked());
938
939 trace_gicv3_cpuif_update(gicv3_redist_affid(cs), cs->hppi.irq,
940 cs->hppi.grp, cs->hppi.prio);
941
942 if (cs->hppi.grp == GICV3_G1 && !arm_feature(env, ARM_FEATURE_EL3)) {
943 /* If a Security-enabled GIC sends a G1S interrupt to a
944 * Security-disabled CPU, we must treat it as if it were G0.
945 */
946 cs->hppi.grp = GICV3_G0;
947 }
948
949 if (icc_hppi_can_preempt(cs)) {
950 /* We have an interrupt: should we signal it as IRQ or FIQ?
951 * This is described in the GICv3 spec section 4.6.2.
952 */
953 bool isfiq;
954
955 switch (cs->hppi.grp) {
956 case GICV3_G0:
957 isfiq = true;
958 break;
959 case GICV3_G1:
960 isfiq = (!arm_is_secure(env) ||
961 (arm_current_el(env) == 3 && arm_el_is_aa64(env, 3)));
962 break;
963 case GICV3_G1NS:
964 isfiq = arm_is_secure(env);
965 break;
966 default:
967 g_assert_not_reached();
968 }
969
970 if (isfiq) {
971 fiqlevel = 1;
972 } else {
973 irqlevel = 1;
974 }
975 }
976
977 trace_gicv3_cpuif_set_irqs(gicv3_redist_affid(cs), fiqlevel, irqlevel);
978
979 qemu_set_irq(cs->parent_fiq, fiqlevel);
980 qemu_set_irq(cs->parent_irq, irqlevel);
981 }
982
icc_pmr_read(CPUARMState * env,const ARMCPRegInfo * ri)983 static uint64_t icc_pmr_read(CPUARMState *env, const ARMCPRegInfo *ri)
984 {
985 GICv3CPUState *cs = icc_cs_from_env(env);
986 uint32_t value = cs->icc_pmr_el1;
987
988 if (icv_access(env, HCR_FMO | HCR_IMO)) {
989 return icv_pmr_read(env, ri);
990 }
991
992 if (arm_feature(env, ARM_FEATURE_EL3) && !arm_is_secure(env) &&
993 (env->cp15.scr_el3 & SCR_FIQ)) {
994 /* NS access and Group 0 is inaccessible to NS: return the
995 * NS view of the current priority
996 */
997 if ((value & 0x80) == 0) {
998 /* Secure priorities not visible to NS */
999 value = 0;
1000 } else if (value != 0xff) {
1001 value = (value << 1) & 0xff;
1002 }
1003 }
1004
1005 trace_gicv3_icc_pmr_read(gicv3_redist_affid(cs), value);
1006
1007 return value;
1008 }
1009
icc_pmr_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)1010 static void icc_pmr_write(CPUARMState *env, const ARMCPRegInfo *ri,
1011 uint64_t value)
1012 {
1013 GICv3CPUState *cs = icc_cs_from_env(env);
1014
1015 if (icv_access(env, HCR_FMO | HCR_IMO)) {
1016 return icv_pmr_write(env, ri, value);
1017 }
1018
1019 trace_gicv3_icc_pmr_write(gicv3_redist_affid(cs), value);
1020
1021 if (arm_feature(env, ARM_FEATURE_EL3) && !arm_is_secure(env) &&
1022 (env->cp15.scr_el3 & SCR_FIQ)) {
1023 /* NS access and Group 0 is inaccessible to NS: return the
1024 * NS view of the current priority
1025 */
1026 if (!(cs->icc_pmr_el1 & 0x80)) {
1027 /* Current PMR in the secure range, don't allow NS to change it */
1028 return;
1029 }
1030 value = (value >> 1) | 0x80;
1031 }
1032 value &= icc_fullprio_mask(cs);
1033 cs->icc_pmr_el1 = value;
1034 gicv3_cpuif_update(cs);
1035 }
1036
icc_activate_irq(GICv3CPUState * cs,int irq)1037 static void icc_activate_irq(GICv3CPUState *cs, int irq)
1038 {
1039 /* Move the interrupt from the Pending state to Active, and update
1040 * the Active Priority Registers
1041 */
1042 uint32_t mask = icc_gprio_mask(cs, cs->hppi.grp);
1043 int prio = cs->hppi.prio & mask;
1044 int aprbit = prio >> (8 - cs->prebits);
1045 int regno = aprbit / 32;
1046 int regbit = aprbit % 32;
1047
1048 cs->icc_apr[cs->hppi.grp][regno] |= (1 << regbit);
1049
1050 if (irq < GIC_INTERNAL) {
1051 cs->gicr_iactiver0 = deposit32(cs->gicr_iactiver0, irq, 1, 1);
1052 cs->gicr_ipendr0 = deposit32(cs->gicr_ipendr0, irq, 1, 0);
1053 gicv3_redist_update(cs);
1054 } else if (irq < GICV3_LPI_INTID_START) {
1055 gicv3_gicd_active_set(cs->gic, irq);
1056 gicv3_gicd_pending_clear(cs->gic, irq);
1057 gicv3_update(cs->gic, irq, 1);
1058 } else {
1059 gicv3_redist_lpi_pending(cs, irq, 0);
1060 }
1061 }
1062
icc_hppir0_value(GICv3CPUState * cs,CPUARMState * env)1063 static uint64_t icc_hppir0_value(GICv3CPUState *cs, CPUARMState *env)
1064 {
1065 /* Return the highest priority pending interrupt register value
1066 * for group 0.
1067 */
1068 bool irq_is_secure;
1069
1070 if (cs->hppi.prio == 0xff) {
1071 return INTID_SPURIOUS;
1072 }
1073
1074 /* Check whether we can return the interrupt or if we should return
1075 * a special identifier, as per the CheckGroup0ForSpecialIdentifiers
1076 * pseudocode. (We can simplify a little because for us ICC_SRE_EL1.RM
1077 * is always zero.)
1078 */
1079 irq_is_secure = (!(cs->gic->gicd_ctlr & GICD_CTLR_DS) &&
1080 (cs->hppi.grp != GICV3_G1NS));
1081
1082 if (cs->hppi.grp != GICV3_G0 && !arm_is_el3_or_mon(env)) {
1083 return INTID_SPURIOUS;
1084 }
1085 if (irq_is_secure && !arm_is_secure(env)) {
1086 /* Secure interrupts not visible to Nonsecure */
1087 return INTID_SPURIOUS;
1088 }
1089
1090 if (cs->hppi.grp != GICV3_G0) {
1091 /* Indicate to EL3 that there's a Group 1 interrupt for the other
1092 * state pending.
1093 */
1094 return irq_is_secure ? INTID_SECURE : INTID_NONSECURE;
1095 }
1096
1097 return cs->hppi.irq;
1098 }
1099
icc_hppir1_value(GICv3CPUState * cs,CPUARMState * env)1100 static uint64_t icc_hppir1_value(GICv3CPUState *cs, CPUARMState *env)
1101 {
1102 /* Return the highest priority pending interrupt register value
1103 * for group 1.
1104 */
1105 bool irq_is_secure;
1106
1107 if (cs->hppi.prio == 0xff) {
1108 return INTID_SPURIOUS;
1109 }
1110
1111 /* Check whether we can return the interrupt or if we should return
1112 * a special identifier, as per the CheckGroup1ForSpecialIdentifiers
1113 * pseudocode. (We can simplify a little because for us ICC_SRE_EL1.RM
1114 * is always zero.)
1115 */
1116 irq_is_secure = (!(cs->gic->gicd_ctlr & GICD_CTLR_DS) &&
1117 (cs->hppi.grp != GICV3_G1NS));
1118
1119 if (cs->hppi.grp == GICV3_G0) {
1120 /* Group 0 interrupts not visible via HPPIR1 */
1121 return INTID_SPURIOUS;
1122 }
1123 if (irq_is_secure) {
1124 if (!arm_is_secure(env)) {
1125 /* Secure interrupts not visible in Non-secure */
1126 return INTID_SPURIOUS;
1127 }
1128 } else if (!arm_is_el3_or_mon(env) && arm_is_secure(env)) {
1129 /* Group 1 non-secure interrupts not visible in Secure EL1 */
1130 return INTID_SPURIOUS;
1131 }
1132
1133 return cs->hppi.irq;
1134 }
1135
icc_iar0_read(CPUARMState * env,const ARMCPRegInfo * ri)1136 static uint64_t icc_iar0_read(CPUARMState *env, const ARMCPRegInfo *ri)
1137 {
1138 GICv3CPUState *cs = icc_cs_from_env(env);
1139 uint64_t intid;
1140
1141 if (icv_access(env, HCR_FMO)) {
1142 return icv_iar_read(env, ri);
1143 }
1144
1145 if (!icc_hppi_can_preempt(cs)) {
1146 intid = INTID_SPURIOUS;
1147 } else {
1148 intid = icc_hppir0_value(cs, env);
1149 }
1150
1151 if (!gicv3_intid_is_special(intid)) {
1152 icc_activate_irq(cs, intid);
1153 }
1154
1155 trace_gicv3_icc_iar0_read(gicv3_redist_affid(cs), intid);
1156 return intid;
1157 }
1158
icc_iar1_read(CPUARMState * env,const ARMCPRegInfo * ri)1159 static uint64_t icc_iar1_read(CPUARMState *env, const ARMCPRegInfo *ri)
1160 {
1161 GICv3CPUState *cs = icc_cs_from_env(env);
1162 uint64_t intid;
1163
1164 if (icv_access(env, HCR_IMO)) {
1165 return icv_iar_read(env, ri);
1166 }
1167
1168 if (!icc_hppi_can_preempt(cs)) {
1169 intid = INTID_SPURIOUS;
1170 } else {
1171 intid = icc_hppir1_value(cs, env);
1172 }
1173
1174 if (!gicv3_intid_is_special(intid)) {
1175 icc_activate_irq(cs, intid);
1176 }
1177
1178 trace_gicv3_icc_iar1_read(gicv3_redist_affid(cs), intid);
1179 return intid;
1180 }
1181
icc_drop_prio(GICv3CPUState * cs,int grp)1182 static void icc_drop_prio(GICv3CPUState *cs, int grp)
1183 {
1184 /* Drop the priority of the currently active interrupt in
1185 * the specified group.
1186 *
1187 * Note that we can guarantee (because of the requirement to nest
1188 * ICC_IAR reads [which activate an interrupt and raise priority]
1189 * with ICC_EOIR writes [which drop the priority for the interrupt])
1190 * that the interrupt we're being called for is the highest priority
1191 * active interrupt, meaning that it has the lowest set bit in the
1192 * APR registers.
1193 *
1194 * If the guest does not honour the ordering constraints then the
1195 * behaviour of the GIC is UNPREDICTABLE, which for us means that
1196 * the values of the APR registers might become incorrect and the
1197 * running priority will be wrong, so interrupts that should preempt
1198 * might not do so, and interrupts that should not preempt might do so.
1199 */
1200 int i;
1201
1202 for (i = 0; i < icc_num_aprs(cs); i++) {
1203 uint64_t *papr = &cs->icc_apr[grp][i];
1204
1205 if (!*papr) {
1206 continue;
1207 }
1208 /* Clear the lowest set bit */
1209 *papr &= *papr - 1;
1210 break;
1211 }
1212
1213 /* running priority change means we need an update for this cpu i/f */
1214 gicv3_cpuif_update(cs);
1215 }
1216
icc_eoi_split(CPUARMState * env,GICv3CPUState * cs)1217 static bool icc_eoi_split(CPUARMState *env, GICv3CPUState *cs)
1218 {
1219 /* Return true if we should split priority drop and interrupt
1220 * deactivation, ie whether the relevant EOIMode bit is set.
1221 */
1222 if (arm_is_el3_or_mon(env)) {
1223 return cs->icc_ctlr_el3 & ICC_CTLR_EL3_EOIMODE_EL3;
1224 }
1225 if (arm_is_secure_below_el3(env)) {
1226 return cs->icc_ctlr_el1[GICV3_S] & ICC_CTLR_EL1_EOIMODE;
1227 } else {
1228 return cs->icc_ctlr_el1[GICV3_NS] & ICC_CTLR_EL1_EOIMODE;
1229 }
1230 }
1231
icc_highest_active_group(GICv3CPUState * cs)1232 static int icc_highest_active_group(GICv3CPUState *cs)
1233 {
1234 /* Return the group with the highest priority active interrupt.
1235 * We can do this by just comparing the APRs to see which one
1236 * has the lowest set bit.
1237 * (If more than one group is active at the same priority then
1238 * we're in UNPREDICTABLE territory.)
1239 */
1240 int i;
1241
1242 for (i = 0; i < ARRAY_SIZE(cs->icc_apr[0]); i++) {
1243 int g0ctz = ctz32(cs->icc_apr[GICV3_G0][i]);
1244 int g1ctz = ctz32(cs->icc_apr[GICV3_G1][i]);
1245 int g1nsctz = ctz32(cs->icc_apr[GICV3_G1NS][i]);
1246
1247 if (g1nsctz < g0ctz && g1nsctz < g1ctz) {
1248 return GICV3_G1NS;
1249 }
1250 if (g1ctz < g0ctz) {
1251 return GICV3_G1;
1252 }
1253 if (g0ctz < 32) {
1254 return GICV3_G0;
1255 }
1256 }
1257 /* No set active bits? UNPREDICTABLE; return -1 so the caller
1258 * ignores the spurious EOI attempt.
1259 */
1260 return -1;
1261 }
1262
icc_deactivate_irq(GICv3CPUState * cs,int irq)1263 static void icc_deactivate_irq(GICv3CPUState *cs, int irq)
1264 {
1265 if (irq < GIC_INTERNAL) {
1266 cs->gicr_iactiver0 = deposit32(cs->gicr_iactiver0, irq, 1, 0);
1267 gicv3_redist_update(cs);
1268 } else {
1269 gicv3_gicd_active_clear(cs->gic, irq);
1270 gicv3_update(cs->gic, irq, 1);
1271 }
1272 }
1273
icv_eoi_split(CPUARMState * env,GICv3CPUState * cs)1274 static bool icv_eoi_split(CPUARMState *env, GICv3CPUState *cs)
1275 {
1276 /* Return true if we should split priority drop and interrupt
1277 * deactivation, ie whether the virtual EOIMode bit is set.
1278 */
1279 return cs->ich_vmcr_el2 & ICH_VMCR_EL2_VEOIM;
1280 }
1281
icv_find_active(GICv3CPUState * cs,int irq)1282 static int icv_find_active(GICv3CPUState *cs, int irq)
1283 {
1284 /* Given an interrupt number for an active interrupt, return the index
1285 * of the corresponding list register, or -1 if there is no match.
1286 * Corresponds to FindActiveVirtualInterrupt pseudocode.
1287 */
1288 int i;
1289
1290 for (i = 0; i < cs->num_list_regs; i++) {
1291 uint64_t lr = cs->ich_lr_el2[i];
1292
1293 if ((lr & ICH_LR_EL2_STATE_ACTIVE_BIT) && ich_lr_vintid(lr) == irq) {
1294 return i;
1295 }
1296 }
1297
1298 return -1;
1299 }
1300
icv_deactivate_irq(GICv3CPUState * cs,int idx)1301 static void icv_deactivate_irq(GICv3CPUState *cs, int idx)
1302 {
1303 /* Deactivate the interrupt in the specified list register index */
1304 uint64_t lr = cs->ich_lr_el2[idx];
1305
1306 if (lr & ICH_LR_EL2_HW) {
1307 /* Deactivate the associated physical interrupt */
1308 int pirq = ich_lr_pintid(lr);
1309
1310 if (pirq < INTID_SECURE) {
1311 icc_deactivate_irq(cs, pirq);
1312 }
1313 }
1314
1315 /* Clear the 'active' part of the state, so ActivePending->Pending
1316 * and Active->Invalid.
1317 */
1318 lr &= ~ICH_LR_EL2_STATE_ACTIVE_BIT;
1319 cs->ich_lr_el2[idx] = lr;
1320 }
1321
icv_increment_eoicount(GICv3CPUState * cs)1322 static void icv_increment_eoicount(GICv3CPUState *cs)
1323 {
1324 /* Increment the EOICOUNT field in ICH_HCR_EL2 */
1325 int eoicount = extract64(cs->ich_hcr_el2, ICH_HCR_EL2_EOICOUNT_SHIFT,
1326 ICH_HCR_EL2_EOICOUNT_LENGTH);
1327
1328 cs->ich_hcr_el2 = deposit64(cs->ich_hcr_el2, ICH_HCR_EL2_EOICOUNT_SHIFT,
1329 ICH_HCR_EL2_EOICOUNT_LENGTH, eoicount + 1);
1330 }
1331
icv_drop_prio(GICv3CPUState * cs)1332 static int icv_drop_prio(GICv3CPUState *cs)
1333 {
1334 /* Drop the priority of the currently active virtual interrupt
1335 * (favouring group 0 if there is a set active bit at
1336 * the same priority for both group 0 and group 1).
1337 * Return the priority value for the bit we just cleared,
1338 * or 0xff if no bits were set in the AP registers at all.
1339 * Note that though the ich_apr[] are uint64_t only the low
1340 * 32 bits are actually relevant.
1341 */
1342 int i;
1343 int aprmax = ich_num_aprs(cs);
1344
1345 for (i = 0; i < aprmax; i++) {
1346 uint64_t *papr0 = &cs->ich_apr[GICV3_G0][i];
1347 uint64_t *papr1 = &cs->ich_apr[GICV3_G1NS][i];
1348 int apr0count, apr1count;
1349
1350 if (!*papr0 && !*papr1) {
1351 continue;
1352 }
1353
1354 /* We can't just use the bit-twiddling hack icc_drop_prio() does
1355 * because we need to return the bit number we cleared so
1356 * it can be compared against the list register's priority field.
1357 */
1358 apr0count = ctz32(*papr0);
1359 apr1count = ctz32(*papr1);
1360
1361 if (apr0count <= apr1count) {
1362 *papr0 &= *papr0 - 1;
1363 return (apr0count + i * 32) << (icv_min_vbpr(cs) + 1);
1364 } else {
1365 *papr1 &= *papr1 - 1;
1366 return (apr1count + i * 32) << (icv_min_vbpr(cs) + 1);
1367 }
1368 }
1369 return 0xff;
1370 }
1371
icv_dir_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)1372 static void icv_dir_write(CPUARMState *env, const ARMCPRegInfo *ri,
1373 uint64_t value)
1374 {
1375 /* Deactivate interrupt */
1376 GICv3CPUState *cs = icc_cs_from_env(env);
1377 int idx;
1378 int irq = value & 0xffffff;
1379
1380 trace_gicv3_icv_dir_write(gicv3_redist_affid(cs), value);
1381
1382 if (irq >= GICV3_MAXIRQ) {
1383 /* Also catches special interrupt numbers and LPIs */
1384 return;
1385 }
1386
1387 if (!icv_eoi_split(env, cs)) {
1388 return;
1389 }
1390
1391 idx = icv_find_active(cs, irq);
1392
1393 if (idx < 0) {
1394 /* No list register matching this, so increment the EOI count
1395 * (might trigger a maintenance interrupt)
1396 */
1397 icv_increment_eoicount(cs);
1398 } else {
1399 icv_deactivate_irq(cs, idx);
1400 }
1401
1402 gicv3_cpuif_virt_update(cs);
1403 }
1404
icv_eoir_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)1405 static void icv_eoir_write(CPUARMState *env, const ARMCPRegInfo *ri,
1406 uint64_t value)
1407 {
1408 /* End of Interrupt */
1409 GICv3CPUState *cs = icc_cs_from_env(env);
1410 int irq = value & 0xffffff;
1411 int grp = ri->crm == 8 ? GICV3_G0 : GICV3_G1NS;
1412 int idx, dropprio;
1413
1414 trace_gicv3_icv_eoir_write(ri->crm == 8 ? 0 : 1,
1415 gicv3_redist_affid(cs), value);
1416
1417 if (gicv3_intid_is_special(irq)) {
1418 return;
1419 }
1420
1421 /* We implement the IMPDEF choice of "drop priority before doing
1422 * error checks" (because that lets us avoid scanning the AP
1423 * registers twice).
1424 */
1425 dropprio = icv_drop_prio(cs);
1426 if (dropprio == 0xff) {
1427 /* No active interrupt. It is CONSTRAINED UNPREDICTABLE
1428 * whether the list registers are checked in this
1429 * situation; we choose not to.
1430 */
1431 return;
1432 }
1433
1434 idx = icv_find_active(cs, irq);
1435
1436 if (idx < 0) {
1437 /*
1438 * No valid list register corresponding to EOI ID; if this is a vLPI
1439 * not in the list regs then do nothing; otherwise increment EOI count
1440 */
1441 if (irq < GICV3_LPI_INTID_START) {
1442 icv_increment_eoicount(cs);
1443 }
1444 } else {
1445 uint64_t lr = cs->ich_lr_el2[idx];
1446 int thisgrp = (lr & ICH_LR_EL2_GROUP) ? GICV3_G1NS : GICV3_G0;
1447 int lr_gprio = ich_lr_prio(lr) & icv_gprio_mask(cs, grp);
1448
1449 if (thisgrp == grp && lr_gprio == dropprio) {
1450 if (!icv_eoi_split(env, cs) || irq >= GICV3_LPI_INTID_START) {
1451 /*
1452 * Priority drop and deactivate not split: deactivate irq now.
1453 * LPIs always get their active state cleared immediately
1454 * because no separate deactivate is expected.
1455 */
1456 icv_deactivate_irq(cs, idx);
1457 }
1458 }
1459 }
1460
1461 gicv3_cpuif_virt_update(cs);
1462 }
1463
icc_eoir_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)1464 static void icc_eoir_write(CPUARMState *env, const ARMCPRegInfo *ri,
1465 uint64_t value)
1466 {
1467 /* End of Interrupt */
1468 GICv3CPUState *cs = icc_cs_from_env(env);
1469 int irq = value & 0xffffff;
1470 int grp;
1471 bool is_eoir0 = ri->crm == 8;
1472
1473 if (icv_access(env, is_eoir0 ? HCR_FMO : HCR_IMO)) {
1474 icv_eoir_write(env, ri, value);
1475 return;
1476 }
1477
1478 trace_gicv3_icc_eoir_write(is_eoir0 ? 0 : 1,
1479 gicv3_redist_affid(cs), value);
1480
1481 if ((irq >= cs->gic->num_irq) &&
1482 !(cs->gic->lpi_enable && (irq >= GICV3_LPI_INTID_START))) {
1483 /* This handles two cases:
1484 * 1. If software writes the ID of a spurious interrupt [ie 1020-1023]
1485 * to the GICC_EOIR, the GIC ignores that write.
1486 * 2. If software writes the number of a non-existent interrupt
1487 * this must be a subcase of "value written does not match the last
1488 * valid interrupt value read from the Interrupt Acknowledge
1489 * register" and so this is UNPREDICTABLE. We choose to ignore it.
1490 */
1491 return;
1492 }
1493
1494 grp = icc_highest_active_group(cs);
1495 switch (grp) {
1496 case GICV3_G0:
1497 if (!is_eoir0) {
1498 return;
1499 }
1500 if (!(cs->gic->gicd_ctlr & GICD_CTLR_DS)
1501 && arm_feature(env, ARM_FEATURE_EL3) && !arm_is_secure(env)) {
1502 return;
1503 }
1504 break;
1505 case GICV3_G1:
1506 if (is_eoir0) {
1507 return;
1508 }
1509 if (!arm_is_secure(env)) {
1510 return;
1511 }
1512 break;
1513 case GICV3_G1NS:
1514 if (is_eoir0) {
1515 return;
1516 }
1517 if (!arm_is_el3_or_mon(env) && arm_is_secure(env)) {
1518 return;
1519 }
1520 break;
1521 default:
1522 qemu_log_mask(LOG_GUEST_ERROR,
1523 "%s: IRQ %d isn't active\n", __func__, irq);
1524 return;
1525 }
1526
1527 icc_drop_prio(cs, grp);
1528
1529 if (!icc_eoi_split(env, cs)) {
1530 /* Priority drop and deactivate not split: deactivate irq now */
1531 icc_deactivate_irq(cs, irq);
1532 }
1533 }
1534
icc_hppir0_read(CPUARMState * env,const ARMCPRegInfo * ri)1535 static uint64_t icc_hppir0_read(CPUARMState *env, const ARMCPRegInfo *ri)
1536 {
1537 GICv3CPUState *cs = icc_cs_from_env(env);
1538 uint64_t value;
1539
1540 if (icv_access(env, HCR_FMO)) {
1541 return icv_hppir_read(env, ri);
1542 }
1543
1544 value = icc_hppir0_value(cs, env);
1545 trace_gicv3_icc_hppir0_read(gicv3_redist_affid(cs), value);
1546 return value;
1547 }
1548
icc_hppir1_read(CPUARMState * env,const ARMCPRegInfo * ri)1549 static uint64_t icc_hppir1_read(CPUARMState *env, const ARMCPRegInfo *ri)
1550 {
1551 GICv3CPUState *cs = icc_cs_from_env(env);
1552 uint64_t value;
1553
1554 if (icv_access(env, HCR_IMO)) {
1555 return icv_hppir_read(env, ri);
1556 }
1557
1558 value = icc_hppir1_value(cs, env);
1559 trace_gicv3_icc_hppir1_read(gicv3_redist_affid(cs), value);
1560 return value;
1561 }
1562
icc_bpr_read(CPUARMState * env,const ARMCPRegInfo * ri)1563 static uint64_t icc_bpr_read(CPUARMState *env, const ARMCPRegInfo *ri)
1564 {
1565 GICv3CPUState *cs = icc_cs_from_env(env);
1566 int grp = (ri->crm == 8) ? GICV3_G0 : GICV3_G1;
1567 bool satinc = false;
1568 uint64_t bpr;
1569
1570 if (icv_access(env, grp == GICV3_G0 ? HCR_FMO : HCR_IMO)) {
1571 return icv_bpr_read(env, ri);
1572 }
1573
1574 if (grp == GICV3_G1 && gicv3_use_ns_bank(env)) {
1575 grp = GICV3_G1NS;
1576 }
1577
1578 if (grp == GICV3_G1 && !arm_is_el3_or_mon(env) &&
1579 (cs->icc_ctlr_el1[GICV3_S] & ICC_CTLR_EL1_CBPR)) {
1580 /* CBPR_EL1S means secure EL1 or AArch32 EL3 !Mon BPR1 accesses
1581 * modify BPR0
1582 */
1583 grp = GICV3_G0;
1584 }
1585
1586 if (grp == GICV3_G1NS && arm_current_el(env) < 3 &&
1587 (cs->icc_ctlr_el1[GICV3_NS] & ICC_CTLR_EL1_CBPR)) {
1588 /* reads return bpr0 + 1 sat to 7, writes ignored */
1589 grp = GICV3_G0;
1590 satinc = true;
1591 }
1592
1593 bpr = cs->icc_bpr[grp];
1594 if (satinc) {
1595 bpr++;
1596 bpr = MIN(bpr, 7);
1597 }
1598
1599 trace_gicv3_icc_bpr_read(ri->crm == 8 ? 0 : 1, gicv3_redist_affid(cs), bpr);
1600
1601 return bpr;
1602 }
1603
icc_bpr_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)1604 static void icc_bpr_write(CPUARMState *env, const ARMCPRegInfo *ri,
1605 uint64_t value)
1606 {
1607 GICv3CPUState *cs = icc_cs_from_env(env);
1608 int grp = (ri->crm == 8) ? GICV3_G0 : GICV3_G1;
1609 uint64_t minval;
1610
1611 if (icv_access(env, grp == GICV3_G0 ? HCR_FMO : HCR_IMO)) {
1612 icv_bpr_write(env, ri, value);
1613 return;
1614 }
1615
1616 trace_gicv3_icc_bpr_write(ri->crm == 8 ? 0 : 1,
1617 gicv3_redist_affid(cs), value);
1618
1619 if (grp == GICV3_G1 && gicv3_use_ns_bank(env)) {
1620 grp = GICV3_G1NS;
1621 }
1622
1623 if (grp == GICV3_G1 && !arm_is_el3_or_mon(env) &&
1624 (cs->icc_ctlr_el1[GICV3_S] & ICC_CTLR_EL1_CBPR)) {
1625 /* CBPR_EL1S means secure EL1 or AArch32 EL3 !Mon BPR1 accesses
1626 * modify BPR0
1627 */
1628 grp = GICV3_G0;
1629 }
1630
1631 if (grp == GICV3_G1NS && arm_current_el(env) < 3 &&
1632 (cs->icc_ctlr_el1[GICV3_NS] & ICC_CTLR_EL1_CBPR)) {
1633 /* reads return bpr0 + 1 sat to 7, writes ignored */
1634 return;
1635 }
1636
1637 minval = (grp == GICV3_G1NS) ? icc_min_bpr_ns(cs) : icc_min_bpr(cs);
1638 if (value < minval) {
1639 value = minval;
1640 }
1641
1642 cs->icc_bpr[grp] = value & 7;
1643 gicv3_cpuif_update(cs);
1644 }
1645
icc_ap_read(CPUARMState * env,const ARMCPRegInfo * ri)1646 static uint64_t icc_ap_read(CPUARMState *env, const ARMCPRegInfo *ri)
1647 {
1648 GICv3CPUState *cs = icc_cs_from_env(env);
1649 uint64_t value;
1650
1651 int regno = ri->opc2 & 3;
1652 int grp = (ri->crm & 1) ? GICV3_G1 : GICV3_G0;
1653
1654 if (icv_access(env, grp == GICV3_G0 ? HCR_FMO : HCR_IMO)) {
1655 return icv_ap_read(env, ri);
1656 }
1657
1658 if (grp == GICV3_G1 && gicv3_use_ns_bank(env)) {
1659 grp = GICV3_G1NS;
1660 }
1661
1662 value = cs->icc_apr[grp][regno];
1663
1664 trace_gicv3_icc_ap_read(ri->crm & 1, regno, gicv3_redist_affid(cs), value);
1665 return value;
1666 }
1667
icc_ap_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)1668 static void icc_ap_write(CPUARMState *env, const ARMCPRegInfo *ri,
1669 uint64_t value)
1670 {
1671 GICv3CPUState *cs = icc_cs_from_env(env);
1672
1673 int regno = ri->opc2 & 3;
1674 int grp = (ri->crm & 1) ? GICV3_G1 : GICV3_G0;
1675
1676 if (icv_access(env, grp == GICV3_G0 ? HCR_FMO : HCR_IMO)) {
1677 icv_ap_write(env, ri, value);
1678 return;
1679 }
1680
1681 trace_gicv3_icc_ap_write(ri->crm & 1, regno, gicv3_redist_affid(cs), value);
1682
1683 if (grp == GICV3_G1 && gicv3_use_ns_bank(env)) {
1684 grp = GICV3_G1NS;
1685 }
1686
1687 /* It's not possible to claim that a Non-secure interrupt is active
1688 * at a priority outside the Non-secure range (128..255), since this
1689 * would otherwise allow malicious NS code to block delivery of S interrupts
1690 * by writing a bad value to these registers.
1691 */
1692 if (grp == GICV3_G1NS && regno < 2 && arm_feature(env, ARM_FEATURE_EL3)) {
1693 return;
1694 }
1695
1696 cs->icc_apr[grp][regno] = value & 0xFFFFFFFFU;
1697 gicv3_cpuif_update(cs);
1698 }
1699
icc_dir_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)1700 static void icc_dir_write(CPUARMState *env, const ARMCPRegInfo *ri,
1701 uint64_t value)
1702 {
1703 /* Deactivate interrupt */
1704 GICv3CPUState *cs = icc_cs_from_env(env);
1705 int irq = value & 0xffffff;
1706 bool irq_is_secure, single_sec_state, irq_is_grp0;
1707 bool route_fiq_to_el3, route_irq_to_el3, route_fiq_to_el2, route_irq_to_el2;
1708
1709 if (icv_access(env, HCR_FMO | HCR_IMO)) {
1710 icv_dir_write(env, ri, value);
1711 return;
1712 }
1713
1714 trace_gicv3_icc_dir_write(gicv3_redist_affid(cs), value);
1715
1716 if (irq >= cs->gic->num_irq) {
1717 /* Also catches special interrupt numbers and LPIs */
1718 return;
1719 }
1720
1721 if (!icc_eoi_split(env, cs)) {
1722 return;
1723 }
1724
1725 int grp = gicv3_irq_group(cs->gic, cs, irq);
1726
1727 single_sec_state = cs->gic->gicd_ctlr & GICD_CTLR_DS;
1728 irq_is_secure = !single_sec_state && (grp != GICV3_G1NS);
1729 irq_is_grp0 = grp == GICV3_G0;
1730
1731 /* Check whether we're allowed to deactivate this interrupt based
1732 * on its group and the current CPU state.
1733 * These checks are laid out to correspond to the spec's pseudocode.
1734 */
1735 route_fiq_to_el3 = env->cp15.scr_el3 & SCR_FIQ;
1736 route_irq_to_el3 = env->cp15.scr_el3 & SCR_IRQ;
1737 /* No need to include !IsSecure in route_*_to_el2 as it's only
1738 * tested in cases where we know !IsSecure is true.
1739 */
1740 uint64_t hcr_el2 = arm_hcr_el2_eff(env);
1741 route_fiq_to_el2 = hcr_el2 & HCR_FMO;
1742 route_irq_to_el2 = hcr_el2 & HCR_IMO;
1743
1744 switch (arm_current_el(env)) {
1745 case 3:
1746 break;
1747 case 2:
1748 if (single_sec_state && irq_is_grp0 && !route_fiq_to_el3) {
1749 break;
1750 }
1751 if (!irq_is_secure && !irq_is_grp0 && !route_irq_to_el3) {
1752 break;
1753 }
1754 return;
1755 case 1:
1756 if (!arm_is_secure_below_el3(env)) {
1757 if (single_sec_state && irq_is_grp0 &&
1758 !route_fiq_to_el3 && !route_fiq_to_el2) {
1759 break;
1760 }
1761 if (!irq_is_secure && !irq_is_grp0 &&
1762 !route_irq_to_el3 && !route_irq_to_el2) {
1763 break;
1764 }
1765 } else {
1766 if (irq_is_grp0 && !route_fiq_to_el3) {
1767 break;
1768 }
1769 if (!irq_is_grp0 &&
1770 (!irq_is_secure || !single_sec_state) &&
1771 !route_irq_to_el3) {
1772 break;
1773 }
1774 }
1775 return;
1776 default:
1777 g_assert_not_reached();
1778 }
1779
1780 icc_deactivate_irq(cs, irq);
1781 }
1782
icc_rpr_read(CPUARMState * env,const ARMCPRegInfo * ri)1783 static uint64_t icc_rpr_read(CPUARMState *env, const ARMCPRegInfo *ri)
1784 {
1785 GICv3CPUState *cs = icc_cs_from_env(env);
1786 int prio;
1787
1788 if (icv_access(env, HCR_FMO | HCR_IMO)) {
1789 return icv_rpr_read(env, ri);
1790 }
1791
1792 prio = icc_highest_active_prio(cs);
1793
1794 if (arm_feature(env, ARM_FEATURE_EL3) &&
1795 !arm_is_secure(env) && (env->cp15.scr_el3 & SCR_FIQ)) {
1796 /* NS GIC access and Group 0 is inaccessible to NS */
1797 if ((prio & 0x80) == 0) {
1798 /* NS mustn't see priorities in the Secure half of the range */
1799 prio = 0;
1800 } else if (prio != 0xff) {
1801 /* Non-idle priority: show the Non-secure view of it */
1802 prio = (prio << 1) & 0xff;
1803 }
1804 }
1805
1806 trace_gicv3_icc_rpr_read(gicv3_redist_affid(cs), prio);
1807 return prio;
1808 }
1809
icc_generate_sgi(CPUARMState * env,GICv3CPUState * cs,uint64_t value,int grp,bool ns)1810 static void icc_generate_sgi(CPUARMState *env, GICv3CPUState *cs,
1811 uint64_t value, int grp, bool ns)
1812 {
1813 GICv3State *s = cs->gic;
1814
1815 /* Extract Aff3/Aff2/Aff1 and shift into the bottom 24 bits */
1816 uint64_t aff = extract64(value, 48, 8) << 16 |
1817 extract64(value, 32, 8) << 8 |
1818 extract64(value, 16, 8);
1819 uint32_t targetlist = extract64(value, 0, 16);
1820 uint32_t irq = extract64(value, 24, 4);
1821 bool irm = extract64(value, 40, 1);
1822 int i;
1823
1824 if (grp == GICV3_G1 && s->gicd_ctlr & GICD_CTLR_DS) {
1825 /* If GICD_CTLR.DS == 1, the Distributor treats Secure Group 1
1826 * interrupts as Group 0 interrupts and must send Secure Group 0
1827 * interrupts to the target CPUs.
1828 */
1829 grp = GICV3_G0;
1830 }
1831
1832 trace_gicv3_icc_generate_sgi(gicv3_redist_affid(cs), irq, irm,
1833 aff, targetlist);
1834
1835 for (i = 0; i < s->num_cpu; i++) {
1836 GICv3CPUState *ocs = &s->cpu[i];
1837
1838 if (irm) {
1839 /* IRM == 1 : route to all CPUs except self */
1840 if (cs == ocs) {
1841 continue;
1842 }
1843 } else {
1844 /* IRM == 0 : route to Aff3.Aff2.Aff1.n for all n in [0..15]
1845 * where the corresponding bit is set in targetlist
1846 */
1847 int aff0;
1848
1849 if (ocs->gicr_typer >> 40 != aff) {
1850 continue;
1851 }
1852 aff0 = extract64(ocs->gicr_typer, 32, 8);
1853 if (aff0 > 15 || extract32(targetlist, aff0, 1) == 0) {
1854 continue;
1855 }
1856 }
1857
1858 /* The redistributor will check against its own GICR_NSACR as needed */
1859 gicv3_redist_send_sgi(ocs, grp, irq, ns);
1860 }
1861 }
1862
icc_sgi0r_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)1863 static void icc_sgi0r_write(CPUARMState *env, const ARMCPRegInfo *ri,
1864 uint64_t value)
1865 {
1866 /* Generate Secure Group 0 SGI. */
1867 GICv3CPUState *cs = icc_cs_from_env(env);
1868 bool ns = !arm_is_secure(env);
1869
1870 icc_generate_sgi(env, cs, value, GICV3_G0, ns);
1871 }
1872
icc_sgi1r_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)1873 static void icc_sgi1r_write(CPUARMState *env, const ARMCPRegInfo *ri,
1874 uint64_t value)
1875 {
1876 /* Generate Group 1 SGI for the current Security state */
1877 GICv3CPUState *cs = icc_cs_from_env(env);
1878 int grp;
1879 bool ns = !arm_is_secure(env);
1880
1881 grp = ns ? GICV3_G1NS : GICV3_G1;
1882 icc_generate_sgi(env, cs, value, grp, ns);
1883 }
1884
icc_asgi1r_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)1885 static void icc_asgi1r_write(CPUARMState *env, const ARMCPRegInfo *ri,
1886 uint64_t value)
1887 {
1888 /* Generate Group 1 SGI for the Security state that is not
1889 * the current state
1890 */
1891 GICv3CPUState *cs = icc_cs_from_env(env);
1892 int grp;
1893 bool ns = !arm_is_secure(env);
1894
1895 grp = ns ? GICV3_G1 : GICV3_G1NS;
1896 icc_generate_sgi(env, cs, value, grp, ns);
1897 }
1898
icc_igrpen_read(CPUARMState * env,const ARMCPRegInfo * ri)1899 static uint64_t icc_igrpen_read(CPUARMState *env, const ARMCPRegInfo *ri)
1900 {
1901 GICv3CPUState *cs = icc_cs_from_env(env);
1902 int grp = ri->opc2 & 1 ? GICV3_G1 : GICV3_G0;
1903 uint64_t value;
1904
1905 if (icv_access(env, grp == GICV3_G0 ? HCR_FMO : HCR_IMO)) {
1906 return icv_igrpen_read(env, ri);
1907 }
1908
1909 if (grp == GICV3_G1 && gicv3_use_ns_bank(env)) {
1910 grp = GICV3_G1NS;
1911 }
1912
1913 value = cs->icc_igrpen[grp];
1914 trace_gicv3_icc_igrpen_read(ri->opc2 & 1 ? 1 : 0,
1915 gicv3_redist_affid(cs), value);
1916 return value;
1917 }
1918
icc_igrpen_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)1919 static void icc_igrpen_write(CPUARMState *env, const ARMCPRegInfo *ri,
1920 uint64_t value)
1921 {
1922 GICv3CPUState *cs = icc_cs_from_env(env);
1923 int grp = ri->opc2 & 1 ? GICV3_G1 : GICV3_G0;
1924
1925 if (icv_access(env, grp == GICV3_G0 ? HCR_FMO : HCR_IMO)) {
1926 icv_igrpen_write(env, ri, value);
1927 return;
1928 }
1929
1930 trace_gicv3_icc_igrpen_write(ri->opc2 & 1 ? 1 : 0,
1931 gicv3_redist_affid(cs), value);
1932
1933 if (grp == GICV3_G1 && gicv3_use_ns_bank(env)) {
1934 grp = GICV3_G1NS;
1935 }
1936
1937 cs->icc_igrpen[grp] = value & ICC_IGRPEN_ENABLE;
1938 gicv3_cpuif_update(cs);
1939 }
1940
icc_igrpen1_el3_read(CPUARMState * env,const ARMCPRegInfo * ri)1941 static uint64_t icc_igrpen1_el3_read(CPUARMState *env, const ARMCPRegInfo *ri)
1942 {
1943 GICv3CPUState *cs = icc_cs_from_env(env);
1944 uint64_t value;
1945
1946 /* IGRPEN1_EL3 bits 0 and 1 are r/w aliases into IGRPEN1_EL1 NS and S */
1947 value = cs->icc_igrpen[GICV3_G1NS] | (cs->icc_igrpen[GICV3_G1] << 1);
1948 trace_gicv3_icc_igrpen1_el3_read(gicv3_redist_affid(cs), value);
1949 return value;
1950 }
1951
icc_igrpen1_el3_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)1952 static void icc_igrpen1_el3_write(CPUARMState *env, const ARMCPRegInfo *ri,
1953 uint64_t value)
1954 {
1955 GICv3CPUState *cs = icc_cs_from_env(env);
1956
1957 trace_gicv3_icc_igrpen1_el3_write(gicv3_redist_affid(cs), value);
1958
1959 /* IGRPEN1_EL3 bits 0 and 1 are r/w aliases into IGRPEN1_EL1 NS and S */
1960 cs->icc_igrpen[GICV3_G1NS] = extract32(value, 0, 1);
1961 cs->icc_igrpen[GICV3_G1] = extract32(value, 1, 1);
1962 gicv3_cpuif_update(cs);
1963 }
1964
icc_ctlr_el1_read(CPUARMState * env,const ARMCPRegInfo * ri)1965 static uint64_t icc_ctlr_el1_read(CPUARMState *env, const ARMCPRegInfo *ri)
1966 {
1967 GICv3CPUState *cs = icc_cs_from_env(env);
1968 int bank = gicv3_use_ns_bank(env) ? GICV3_NS : GICV3_S;
1969 uint64_t value;
1970
1971 if (icv_access(env, HCR_FMO | HCR_IMO)) {
1972 return icv_ctlr_read(env, ri);
1973 }
1974
1975 value = cs->icc_ctlr_el1[bank];
1976 trace_gicv3_icc_ctlr_read(gicv3_redist_affid(cs), value);
1977 return value;
1978 }
1979
icc_ctlr_el1_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)1980 static void icc_ctlr_el1_write(CPUARMState *env, const ARMCPRegInfo *ri,
1981 uint64_t value)
1982 {
1983 GICv3CPUState *cs = icc_cs_from_env(env);
1984 int bank = gicv3_use_ns_bank(env) ? GICV3_NS : GICV3_S;
1985 uint64_t mask;
1986
1987 if (icv_access(env, HCR_FMO | HCR_IMO)) {
1988 icv_ctlr_write(env, ri, value);
1989 return;
1990 }
1991
1992 trace_gicv3_icc_ctlr_write(gicv3_redist_affid(cs), value);
1993
1994 /* Only CBPR and EOIMODE can be RW;
1995 * for us PMHE is RAZ/WI (we don't implement 1-of-N interrupts or
1996 * the asseciated priority-based routing of them);
1997 * if EL3 is implemented and GICD_CTLR.DS == 0, then PMHE and CBPR are RO.
1998 */
1999 if (arm_feature(env, ARM_FEATURE_EL3) &&
2000 ((cs->gic->gicd_ctlr & GICD_CTLR_DS) == 0)) {
2001 mask = ICC_CTLR_EL1_EOIMODE;
2002 } else {
2003 mask = ICC_CTLR_EL1_CBPR | ICC_CTLR_EL1_EOIMODE;
2004 }
2005
2006 cs->icc_ctlr_el1[bank] &= ~mask;
2007 cs->icc_ctlr_el1[bank] |= (value & mask);
2008 gicv3_cpuif_update(cs);
2009 }
2010
2011
icc_ctlr_el3_read(CPUARMState * env,const ARMCPRegInfo * ri)2012 static uint64_t icc_ctlr_el3_read(CPUARMState *env, const ARMCPRegInfo *ri)
2013 {
2014 GICv3CPUState *cs = icc_cs_from_env(env);
2015 uint64_t value;
2016
2017 value = cs->icc_ctlr_el3;
2018 if (cs->icc_ctlr_el1[GICV3_NS] & ICC_CTLR_EL1_EOIMODE) {
2019 value |= ICC_CTLR_EL3_EOIMODE_EL1NS;
2020 }
2021 if (cs->icc_ctlr_el1[GICV3_NS] & ICC_CTLR_EL1_CBPR) {
2022 value |= ICC_CTLR_EL3_CBPR_EL1NS;
2023 }
2024 if (cs->icc_ctlr_el1[GICV3_NS] & ICC_CTLR_EL1_EOIMODE) {
2025 value |= ICC_CTLR_EL3_EOIMODE_EL1S;
2026 }
2027 if (cs->icc_ctlr_el1[GICV3_NS] & ICC_CTLR_EL1_CBPR) {
2028 value |= ICC_CTLR_EL3_CBPR_EL1S;
2029 }
2030
2031 trace_gicv3_icc_ctlr_el3_read(gicv3_redist_affid(cs), value);
2032 return value;
2033 }
2034
icc_ctlr_el3_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)2035 static void icc_ctlr_el3_write(CPUARMState *env, const ARMCPRegInfo *ri,
2036 uint64_t value)
2037 {
2038 GICv3CPUState *cs = icc_cs_from_env(env);
2039 uint64_t mask;
2040
2041 trace_gicv3_icc_ctlr_el3_write(gicv3_redist_affid(cs), value);
2042
2043 /* *_EL1NS and *_EL1S bits are aliases into the ICC_CTLR_EL1 bits. */
2044 cs->icc_ctlr_el1[GICV3_NS] &= ~(ICC_CTLR_EL1_CBPR | ICC_CTLR_EL1_EOIMODE);
2045 if (value & ICC_CTLR_EL3_EOIMODE_EL1NS) {
2046 cs->icc_ctlr_el1[GICV3_NS] |= ICC_CTLR_EL1_EOIMODE;
2047 }
2048 if (value & ICC_CTLR_EL3_CBPR_EL1NS) {
2049 cs->icc_ctlr_el1[GICV3_NS] |= ICC_CTLR_EL1_CBPR;
2050 }
2051
2052 cs->icc_ctlr_el1[GICV3_S] &= ~(ICC_CTLR_EL1_CBPR | ICC_CTLR_EL1_EOIMODE);
2053 if (value & ICC_CTLR_EL3_EOIMODE_EL1S) {
2054 cs->icc_ctlr_el1[GICV3_S] |= ICC_CTLR_EL1_EOIMODE;
2055 }
2056 if (value & ICC_CTLR_EL3_CBPR_EL1S) {
2057 cs->icc_ctlr_el1[GICV3_S] |= ICC_CTLR_EL1_CBPR;
2058 }
2059
2060 /* The only bit stored in icc_ctlr_el3 which is writable is EOIMODE_EL3: */
2061 mask = ICC_CTLR_EL3_EOIMODE_EL3;
2062
2063 cs->icc_ctlr_el3 &= ~mask;
2064 cs->icc_ctlr_el3 |= (value & mask);
2065 gicv3_cpuif_update(cs);
2066 }
2067
gicv3_irqfiq_access(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)2068 static CPAccessResult gicv3_irqfiq_access(CPUARMState *env,
2069 const ARMCPRegInfo *ri, bool isread)
2070 {
2071 CPAccessResult r = CP_ACCESS_OK;
2072 GICv3CPUState *cs = icc_cs_from_env(env);
2073 int el = arm_current_el(env);
2074
2075 if ((cs->ich_hcr_el2 & ICH_HCR_EL2_TC) &&
2076 el == 1 && !arm_is_secure_below_el3(env)) {
2077 /* Takes priority over a possible EL3 trap */
2078 return CP_ACCESS_TRAP_EL2;
2079 }
2080
2081 if ((env->cp15.scr_el3 & (SCR_FIQ | SCR_IRQ)) == (SCR_FIQ | SCR_IRQ)) {
2082 switch (el) {
2083 case 1:
2084 /* Note that arm_hcr_el2_eff takes secure state into account. */
2085 if ((arm_hcr_el2_eff(env) & (HCR_IMO | HCR_FMO)) == 0) {
2086 r = CP_ACCESS_TRAP_EL3;
2087 }
2088 break;
2089 case 2:
2090 r = CP_ACCESS_TRAP_EL3;
2091 break;
2092 case 3:
2093 if (!is_a64(env) && !arm_is_el3_or_mon(env)) {
2094 r = CP_ACCESS_TRAP_EL3;
2095 }
2096 break;
2097 default:
2098 g_assert_not_reached();
2099 }
2100 }
2101
2102 if (r == CP_ACCESS_TRAP_EL3 && !arm_el_is_aa64(env, 3)) {
2103 r = CP_ACCESS_TRAP;
2104 }
2105 return r;
2106 }
2107
gicv3_dir_access(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)2108 static CPAccessResult gicv3_dir_access(CPUARMState *env,
2109 const ARMCPRegInfo *ri, bool isread)
2110 {
2111 GICv3CPUState *cs = icc_cs_from_env(env);
2112
2113 if ((cs->ich_hcr_el2 & ICH_HCR_EL2_TDIR) &&
2114 arm_current_el(env) == 1 && !arm_is_secure_below_el3(env)) {
2115 /* Takes priority over a possible EL3 trap */
2116 return CP_ACCESS_TRAP_EL2;
2117 }
2118
2119 return gicv3_irqfiq_access(env, ri, isread);
2120 }
2121
gicv3_sgi_access(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)2122 static CPAccessResult gicv3_sgi_access(CPUARMState *env,
2123 const ARMCPRegInfo *ri, bool isread)
2124 {
2125 if (arm_current_el(env) == 1 &&
2126 (arm_hcr_el2_eff(env) & (HCR_IMO | HCR_FMO)) != 0) {
2127 /* Takes priority over a possible EL3 trap */
2128 return CP_ACCESS_TRAP_EL2;
2129 }
2130
2131 return gicv3_irqfiq_access(env, ri, isread);
2132 }
2133
gicv3_fiq_access(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)2134 static CPAccessResult gicv3_fiq_access(CPUARMState *env,
2135 const ARMCPRegInfo *ri, bool isread)
2136 {
2137 CPAccessResult r = CP_ACCESS_OK;
2138 GICv3CPUState *cs = icc_cs_from_env(env);
2139 int el = arm_current_el(env);
2140
2141 if ((cs->ich_hcr_el2 & ICH_HCR_EL2_TALL0) &&
2142 el == 1 && !arm_is_secure_below_el3(env)) {
2143 /* Takes priority over a possible EL3 trap */
2144 return CP_ACCESS_TRAP_EL2;
2145 }
2146
2147 if (env->cp15.scr_el3 & SCR_FIQ) {
2148 switch (el) {
2149 case 1:
2150 if ((arm_hcr_el2_eff(env) & HCR_FMO) == 0) {
2151 r = CP_ACCESS_TRAP_EL3;
2152 }
2153 break;
2154 case 2:
2155 r = CP_ACCESS_TRAP_EL3;
2156 break;
2157 case 3:
2158 if (!is_a64(env) && !arm_is_el3_or_mon(env)) {
2159 r = CP_ACCESS_TRAP_EL3;
2160 }
2161 break;
2162 default:
2163 g_assert_not_reached();
2164 }
2165 }
2166
2167 if (r == CP_ACCESS_TRAP_EL3 && !arm_el_is_aa64(env, 3)) {
2168 r = CP_ACCESS_TRAP;
2169 }
2170 return r;
2171 }
2172
gicv3_irq_access(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)2173 static CPAccessResult gicv3_irq_access(CPUARMState *env,
2174 const ARMCPRegInfo *ri, bool isread)
2175 {
2176 CPAccessResult r = CP_ACCESS_OK;
2177 GICv3CPUState *cs = icc_cs_from_env(env);
2178 int el = arm_current_el(env);
2179
2180 if ((cs->ich_hcr_el2 & ICH_HCR_EL2_TALL1) &&
2181 el == 1 && !arm_is_secure_below_el3(env)) {
2182 /* Takes priority over a possible EL3 trap */
2183 return CP_ACCESS_TRAP_EL2;
2184 }
2185
2186 if (env->cp15.scr_el3 & SCR_IRQ) {
2187 switch (el) {
2188 case 1:
2189 if ((arm_hcr_el2_eff(env) & HCR_IMO) == 0) {
2190 r = CP_ACCESS_TRAP_EL3;
2191 }
2192 break;
2193 case 2:
2194 r = CP_ACCESS_TRAP_EL3;
2195 break;
2196 case 3:
2197 if (!is_a64(env) && !arm_is_el3_or_mon(env)) {
2198 r = CP_ACCESS_TRAP_EL3;
2199 }
2200 break;
2201 default:
2202 g_assert_not_reached();
2203 }
2204 }
2205
2206 if (r == CP_ACCESS_TRAP_EL3 && !arm_el_is_aa64(env, 3)) {
2207 r = CP_ACCESS_TRAP;
2208 }
2209 return r;
2210 }
2211
icc_reset(CPUARMState * env,const ARMCPRegInfo * ri)2212 static void icc_reset(CPUARMState *env, const ARMCPRegInfo *ri)
2213 {
2214 GICv3CPUState *cs = icc_cs_from_env(env);
2215
2216 cs->icc_ctlr_el1[GICV3_S] = ICC_CTLR_EL1_A3V |
2217 (1 << ICC_CTLR_EL1_IDBITS_SHIFT) |
2218 ((cs->pribits - 1) << ICC_CTLR_EL1_PRIBITS_SHIFT);
2219 cs->icc_ctlr_el1[GICV3_NS] = ICC_CTLR_EL1_A3V |
2220 (1 << ICC_CTLR_EL1_IDBITS_SHIFT) |
2221 ((cs->pribits - 1) << ICC_CTLR_EL1_PRIBITS_SHIFT);
2222 cs->icc_pmr_el1 = 0;
2223 cs->icc_bpr[GICV3_G0] = icc_min_bpr(cs);
2224 cs->icc_bpr[GICV3_G1] = icc_min_bpr(cs);
2225 cs->icc_bpr[GICV3_G1NS] = icc_min_bpr_ns(cs);
2226 memset(cs->icc_apr, 0, sizeof(cs->icc_apr));
2227 memset(cs->icc_igrpen, 0, sizeof(cs->icc_igrpen));
2228 cs->icc_ctlr_el3 = ICC_CTLR_EL3_NDS | ICC_CTLR_EL3_A3V |
2229 (1 << ICC_CTLR_EL3_IDBITS_SHIFT) |
2230 ((cs->pribits - 1) << ICC_CTLR_EL3_PRIBITS_SHIFT);
2231
2232 memset(cs->ich_apr, 0, sizeof(cs->ich_apr));
2233 cs->ich_hcr_el2 = 0;
2234 memset(cs->ich_lr_el2, 0, sizeof(cs->ich_lr_el2));
2235 cs->ich_vmcr_el2 = ICH_VMCR_EL2_VFIQEN |
2236 ((icv_min_vbpr(cs) + 1) << ICH_VMCR_EL2_VBPR1_SHIFT) |
2237 (icv_min_vbpr(cs) << ICH_VMCR_EL2_VBPR0_SHIFT);
2238 }
2239
2240 static const ARMCPRegInfo gicv3_cpuif_reginfo[] = {
2241 { .name = "ICC_PMR_EL1", .state = ARM_CP_STATE_BOTH,
2242 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 6, .opc2 = 0,
2243 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2244 .access = PL1_RW, .accessfn = gicv3_irqfiq_access,
2245 .readfn = icc_pmr_read,
2246 .writefn = icc_pmr_write,
2247 /* We hang the whole cpu interface reset routine off here
2248 * rather than parcelling it out into one little function
2249 * per register
2250 */
2251 .resetfn = icc_reset,
2252 },
2253 { .name = "ICC_IAR0_EL1", .state = ARM_CP_STATE_BOTH,
2254 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 8, .opc2 = 0,
2255 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2256 .access = PL1_R, .accessfn = gicv3_fiq_access,
2257 .readfn = icc_iar0_read,
2258 },
2259 { .name = "ICC_EOIR0_EL1", .state = ARM_CP_STATE_BOTH,
2260 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 8, .opc2 = 1,
2261 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2262 .access = PL1_W, .accessfn = gicv3_fiq_access,
2263 .writefn = icc_eoir_write,
2264 },
2265 { .name = "ICC_HPPIR0_EL1", .state = ARM_CP_STATE_BOTH,
2266 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 8, .opc2 = 2,
2267 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2268 .access = PL1_R, .accessfn = gicv3_fiq_access,
2269 .readfn = icc_hppir0_read,
2270 },
2271 { .name = "ICC_BPR0_EL1", .state = ARM_CP_STATE_BOTH,
2272 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 8, .opc2 = 3,
2273 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2274 .access = PL1_RW, .accessfn = gicv3_fiq_access,
2275 .readfn = icc_bpr_read,
2276 .writefn = icc_bpr_write,
2277 },
2278 { .name = "ICC_AP0R0_EL1", .state = ARM_CP_STATE_BOTH,
2279 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 8, .opc2 = 4,
2280 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2281 .access = PL1_RW, .accessfn = gicv3_fiq_access,
2282 .readfn = icc_ap_read,
2283 .writefn = icc_ap_write,
2284 },
2285 /* All the ICC_AP1R*_EL1 registers are banked */
2286 { .name = "ICC_AP1R0_EL1", .state = ARM_CP_STATE_BOTH,
2287 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 9, .opc2 = 0,
2288 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2289 .access = PL1_RW, .accessfn = gicv3_irq_access,
2290 .readfn = icc_ap_read,
2291 .writefn = icc_ap_write,
2292 },
2293 { .name = "ICC_DIR_EL1", .state = ARM_CP_STATE_BOTH,
2294 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 11, .opc2 = 1,
2295 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2296 .access = PL1_W, .accessfn = gicv3_dir_access,
2297 .writefn = icc_dir_write,
2298 },
2299 { .name = "ICC_RPR_EL1", .state = ARM_CP_STATE_BOTH,
2300 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 11, .opc2 = 3,
2301 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2302 .access = PL1_R, .accessfn = gicv3_irqfiq_access,
2303 .readfn = icc_rpr_read,
2304 },
2305 { .name = "ICC_SGI1R_EL1", .state = ARM_CP_STATE_AA64,
2306 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 11, .opc2 = 5,
2307 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2308 .access = PL1_W, .accessfn = gicv3_sgi_access,
2309 .writefn = icc_sgi1r_write,
2310 },
2311 { .name = "ICC_SGI1R",
2312 .cp = 15, .opc1 = 0, .crm = 12,
2313 .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_NO_RAW,
2314 .access = PL1_W, .accessfn = gicv3_sgi_access,
2315 .writefn = icc_sgi1r_write,
2316 },
2317 { .name = "ICC_ASGI1R_EL1", .state = ARM_CP_STATE_AA64,
2318 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 11, .opc2 = 6,
2319 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2320 .access = PL1_W, .accessfn = gicv3_sgi_access,
2321 .writefn = icc_asgi1r_write,
2322 },
2323 { .name = "ICC_ASGI1R",
2324 .cp = 15, .opc1 = 1, .crm = 12,
2325 .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_NO_RAW,
2326 .access = PL1_W, .accessfn = gicv3_sgi_access,
2327 .writefn = icc_asgi1r_write,
2328 },
2329 { .name = "ICC_SGI0R_EL1", .state = ARM_CP_STATE_AA64,
2330 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 11, .opc2 = 7,
2331 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2332 .access = PL1_W, .accessfn = gicv3_sgi_access,
2333 .writefn = icc_sgi0r_write,
2334 },
2335 { .name = "ICC_SGI0R",
2336 .cp = 15, .opc1 = 2, .crm = 12,
2337 .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_NO_RAW,
2338 .access = PL1_W, .accessfn = gicv3_sgi_access,
2339 .writefn = icc_sgi0r_write,
2340 },
2341 { .name = "ICC_IAR1_EL1", .state = ARM_CP_STATE_BOTH,
2342 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 12, .opc2 = 0,
2343 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2344 .access = PL1_R, .accessfn = gicv3_irq_access,
2345 .readfn = icc_iar1_read,
2346 },
2347 { .name = "ICC_EOIR1_EL1", .state = ARM_CP_STATE_BOTH,
2348 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 12, .opc2 = 1,
2349 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2350 .access = PL1_W, .accessfn = gicv3_irq_access,
2351 .writefn = icc_eoir_write,
2352 },
2353 { .name = "ICC_HPPIR1_EL1", .state = ARM_CP_STATE_BOTH,
2354 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 12, .opc2 = 2,
2355 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2356 .access = PL1_R, .accessfn = gicv3_irq_access,
2357 .readfn = icc_hppir1_read,
2358 },
2359 /* This register is banked */
2360 { .name = "ICC_BPR1_EL1", .state = ARM_CP_STATE_BOTH,
2361 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 12, .opc2 = 3,
2362 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2363 .access = PL1_RW, .accessfn = gicv3_irq_access,
2364 .readfn = icc_bpr_read,
2365 .writefn = icc_bpr_write,
2366 },
2367 /* This register is banked */
2368 { .name = "ICC_CTLR_EL1", .state = ARM_CP_STATE_BOTH,
2369 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 12, .opc2 = 4,
2370 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2371 .access = PL1_RW, .accessfn = gicv3_irqfiq_access,
2372 .readfn = icc_ctlr_el1_read,
2373 .writefn = icc_ctlr_el1_write,
2374 },
2375 { .name = "ICC_SRE_EL1", .state = ARM_CP_STATE_BOTH,
2376 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 12, .opc2 = 5,
2377 .type = ARM_CP_NO_RAW | ARM_CP_CONST,
2378 .access = PL1_RW,
2379 /* We don't support IRQ/FIQ bypass and system registers are
2380 * always enabled, so all our bits are RAZ/WI or RAO/WI.
2381 * This register is banked but since it's constant we don't
2382 * need to do anything special.
2383 */
2384 .resetvalue = 0x7,
2385 },
2386 { .name = "ICC_IGRPEN0_EL1", .state = ARM_CP_STATE_BOTH,
2387 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 12, .opc2 = 6,
2388 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2389 .access = PL1_RW, .accessfn = gicv3_fiq_access,
2390 .fgt = FGT_ICC_IGRPENN_EL1,
2391 .readfn = icc_igrpen_read,
2392 .writefn = icc_igrpen_write,
2393 },
2394 /* This register is banked */
2395 { .name = "ICC_IGRPEN1_EL1", .state = ARM_CP_STATE_BOTH,
2396 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 12, .opc2 = 7,
2397 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2398 .access = PL1_RW, .accessfn = gicv3_irq_access,
2399 .fgt = FGT_ICC_IGRPENN_EL1,
2400 .readfn = icc_igrpen_read,
2401 .writefn = icc_igrpen_write,
2402 },
2403 { .name = "ICC_SRE_EL2", .state = ARM_CP_STATE_BOTH,
2404 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 9, .opc2 = 5,
2405 .type = ARM_CP_NO_RAW | ARM_CP_CONST,
2406 .access = PL2_RW,
2407 /* We don't support IRQ/FIQ bypass and system registers are
2408 * always enabled, so all our bits are RAZ/WI or RAO/WI.
2409 */
2410 .resetvalue = 0xf,
2411 },
2412 { .name = "ICC_CTLR_EL3", .state = ARM_CP_STATE_BOTH,
2413 .opc0 = 3, .opc1 = 6, .crn = 12, .crm = 12, .opc2 = 4,
2414 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2415 .access = PL3_RW,
2416 .readfn = icc_ctlr_el3_read,
2417 .writefn = icc_ctlr_el3_write,
2418 },
2419 { .name = "ICC_SRE_EL3", .state = ARM_CP_STATE_BOTH,
2420 .opc0 = 3, .opc1 = 6, .crn = 12, .crm = 12, .opc2 = 5,
2421 .type = ARM_CP_NO_RAW | ARM_CP_CONST,
2422 .access = PL3_RW,
2423 /* We don't support IRQ/FIQ bypass and system registers are
2424 * always enabled, so all our bits are RAZ/WI or RAO/WI.
2425 */
2426 .resetvalue = 0xf,
2427 },
2428 { .name = "ICC_IGRPEN1_EL3", .state = ARM_CP_STATE_BOTH,
2429 .opc0 = 3, .opc1 = 6, .crn = 12, .crm = 12, .opc2 = 7,
2430 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2431 .access = PL3_RW,
2432 .readfn = icc_igrpen1_el3_read,
2433 .writefn = icc_igrpen1_el3_write,
2434 },
2435 };
2436
2437 static const ARMCPRegInfo gicv3_cpuif_icc_apxr1_reginfo[] = {
2438 { .name = "ICC_AP0R1_EL1", .state = ARM_CP_STATE_BOTH,
2439 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 8, .opc2 = 5,
2440 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2441 .access = PL1_RW, .accessfn = gicv3_fiq_access,
2442 .readfn = icc_ap_read,
2443 .writefn = icc_ap_write,
2444 },
2445 { .name = "ICC_AP1R1_EL1", .state = ARM_CP_STATE_BOTH,
2446 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 9, .opc2 = 1,
2447 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2448 .access = PL1_RW, .accessfn = gicv3_irq_access,
2449 .readfn = icc_ap_read,
2450 .writefn = icc_ap_write,
2451 },
2452 };
2453
2454 static const ARMCPRegInfo gicv3_cpuif_icc_apxr23_reginfo[] = {
2455 { .name = "ICC_AP0R2_EL1", .state = ARM_CP_STATE_BOTH,
2456 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 8, .opc2 = 6,
2457 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2458 .access = PL1_RW, .accessfn = gicv3_fiq_access,
2459 .readfn = icc_ap_read,
2460 .writefn = icc_ap_write,
2461 },
2462 { .name = "ICC_AP0R3_EL1", .state = ARM_CP_STATE_BOTH,
2463 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 8, .opc2 = 7,
2464 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2465 .access = PL1_RW, .accessfn = gicv3_fiq_access,
2466 .readfn = icc_ap_read,
2467 .writefn = icc_ap_write,
2468 },
2469 { .name = "ICC_AP1R2_EL1", .state = ARM_CP_STATE_BOTH,
2470 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 9, .opc2 = 2,
2471 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2472 .access = PL1_RW, .accessfn = gicv3_irq_access,
2473 .readfn = icc_ap_read,
2474 .writefn = icc_ap_write,
2475 },
2476 { .name = "ICC_AP1R3_EL1", .state = ARM_CP_STATE_BOTH,
2477 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 9, .opc2 = 3,
2478 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2479 .access = PL1_RW, .accessfn = gicv3_irq_access,
2480 .readfn = icc_ap_read,
2481 .writefn = icc_ap_write,
2482 },
2483 };
2484
ich_ap_read(CPUARMState * env,const ARMCPRegInfo * ri)2485 static uint64_t ich_ap_read(CPUARMState *env, const ARMCPRegInfo *ri)
2486 {
2487 GICv3CPUState *cs = icc_cs_from_env(env);
2488 int regno = ri->opc2 & 3;
2489 int grp = (ri->crm & 1) ? GICV3_G1NS : GICV3_G0;
2490 uint64_t value;
2491
2492 value = cs->ich_apr[grp][regno];
2493 trace_gicv3_ich_ap_read(ri->crm & 1, regno, gicv3_redist_affid(cs), value);
2494 return value;
2495 }
2496
ich_ap_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)2497 static void ich_ap_write(CPUARMState *env, const ARMCPRegInfo *ri,
2498 uint64_t value)
2499 {
2500 GICv3CPUState *cs = icc_cs_from_env(env);
2501 int regno = ri->opc2 & 3;
2502 int grp = (ri->crm & 1) ? GICV3_G1NS : GICV3_G0;
2503
2504 trace_gicv3_ich_ap_write(ri->crm & 1, regno, gicv3_redist_affid(cs), value);
2505
2506 cs->ich_apr[grp][regno] = value & 0xFFFFFFFFU;
2507 gicv3_cpuif_virt_irq_fiq_update(cs);
2508 }
2509
ich_hcr_read(CPUARMState * env,const ARMCPRegInfo * ri)2510 static uint64_t ich_hcr_read(CPUARMState *env, const ARMCPRegInfo *ri)
2511 {
2512 GICv3CPUState *cs = icc_cs_from_env(env);
2513 uint64_t value = cs->ich_hcr_el2;
2514
2515 trace_gicv3_ich_hcr_read(gicv3_redist_affid(cs), value);
2516 return value;
2517 }
2518
ich_hcr_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)2519 static void ich_hcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
2520 uint64_t value)
2521 {
2522 GICv3CPUState *cs = icc_cs_from_env(env);
2523
2524 trace_gicv3_ich_hcr_write(gicv3_redist_affid(cs), value);
2525
2526 value &= ICH_HCR_EL2_EN | ICH_HCR_EL2_UIE | ICH_HCR_EL2_LRENPIE |
2527 ICH_HCR_EL2_NPIE | ICH_HCR_EL2_VGRP0EIE | ICH_HCR_EL2_VGRP0DIE |
2528 ICH_HCR_EL2_VGRP1EIE | ICH_HCR_EL2_VGRP1DIE | ICH_HCR_EL2_TC |
2529 ICH_HCR_EL2_TALL0 | ICH_HCR_EL2_TALL1 | ICH_HCR_EL2_TSEI |
2530 ICH_HCR_EL2_TDIR | ICH_HCR_EL2_EOICOUNT_MASK;
2531
2532 cs->ich_hcr_el2 = value;
2533 gicv3_cpuif_virt_update(cs);
2534 }
2535
ich_vmcr_read(CPUARMState * env,const ARMCPRegInfo * ri)2536 static uint64_t ich_vmcr_read(CPUARMState *env, const ARMCPRegInfo *ri)
2537 {
2538 GICv3CPUState *cs = icc_cs_from_env(env);
2539 uint64_t value = cs->ich_vmcr_el2;
2540
2541 trace_gicv3_ich_vmcr_read(gicv3_redist_affid(cs), value);
2542 return value;
2543 }
2544
ich_vmcr_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)2545 static void ich_vmcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
2546 uint64_t value)
2547 {
2548 GICv3CPUState *cs = icc_cs_from_env(env);
2549
2550 trace_gicv3_ich_vmcr_write(gicv3_redist_affid(cs), value);
2551
2552 value &= ICH_VMCR_EL2_VENG0 | ICH_VMCR_EL2_VENG1 | ICH_VMCR_EL2_VCBPR |
2553 ICH_VMCR_EL2_VEOIM | ICH_VMCR_EL2_VBPR1_MASK |
2554 ICH_VMCR_EL2_VBPR0_MASK | ICH_VMCR_EL2_VPMR_MASK;
2555 value |= ICH_VMCR_EL2_VFIQEN;
2556
2557 cs->ich_vmcr_el2 = value;
2558 /* Enforce "writing BPRs to less than minimum sets them to the minimum"
2559 * by reading and writing back the fields.
2560 */
2561 write_vbpr(cs, GICV3_G0, read_vbpr(cs, GICV3_G0));
2562 write_vbpr(cs, GICV3_G1, read_vbpr(cs, GICV3_G1));
2563
2564 gicv3_cpuif_virt_update(cs);
2565 }
2566
ich_lr_read(CPUARMState * env,const ARMCPRegInfo * ri)2567 static uint64_t ich_lr_read(CPUARMState *env, const ARMCPRegInfo *ri)
2568 {
2569 GICv3CPUState *cs = icc_cs_from_env(env);
2570 int regno = ri->opc2 | ((ri->crm & 1) << 3);
2571 uint64_t value;
2572
2573 /* This read function handles all of:
2574 * 64-bit reads of the whole LR
2575 * 32-bit reads of the low half of the LR
2576 * 32-bit reads of the high half of the LR
2577 */
2578 if (ri->state == ARM_CP_STATE_AA32) {
2579 if (ri->crm >= 14) {
2580 value = extract64(cs->ich_lr_el2[regno], 32, 32);
2581 trace_gicv3_ich_lrc_read(regno, gicv3_redist_affid(cs), value);
2582 } else {
2583 value = extract64(cs->ich_lr_el2[regno], 0, 32);
2584 trace_gicv3_ich_lr32_read(regno, gicv3_redist_affid(cs), value);
2585 }
2586 } else {
2587 value = cs->ich_lr_el2[regno];
2588 trace_gicv3_ich_lr_read(regno, gicv3_redist_affid(cs), value);
2589 }
2590
2591 return value;
2592 }
2593
ich_lr_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)2594 static void ich_lr_write(CPUARMState *env, const ARMCPRegInfo *ri,
2595 uint64_t value)
2596 {
2597 GICv3CPUState *cs = icc_cs_from_env(env);
2598 int regno = ri->opc2 | ((ri->crm & 1) << 3);
2599
2600 /* This write function handles all of:
2601 * 64-bit writes to the whole LR
2602 * 32-bit writes to the low half of the LR
2603 * 32-bit writes to the high half of the LR
2604 */
2605 if (ri->state == ARM_CP_STATE_AA32) {
2606 if (ri->crm >= 14) {
2607 trace_gicv3_ich_lrc_write(regno, gicv3_redist_affid(cs), value);
2608 value = deposit64(cs->ich_lr_el2[regno], 32, 32, value);
2609 } else {
2610 trace_gicv3_ich_lr32_write(regno, gicv3_redist_affid(cs), value);
2611 value = deposit64(cs->ich_lr_el2[regno], 0, 32, value);
2612 }
2613 } else {
2614 trace_gicv3_ich_lr_write(regno, gicv3_redist_affid(cs), value);
2615 }
2616
2617 /* Enforce RES0 bits in priority field */
2618 if (cs->vpribits < 8) {
2619 value = deposit64(value, ICH_LR_EL2_PRIORITY_SHIFT,
2620 8 - cs->vpribits, 0);
2621 }
2622
2623 cs->ich_lr_el2[regno] = value;
2624 gicv3_cpuif_virt_update(cs);
2625 }
2626
ich_vtr_read(CPUARMState * env,const ARMCPRegInfo * ri)2627 static uint64_t ich_vtr_read(CPUARMState *env, const ARMCPRegInfo *ri)
2628 {
2629 GICv3CPUState *cs = icc_cs_from_env(env);
2630 uint64_t value;
2631
2632 value = ((cs->num_list_regs - 1) << ICH_VTR_EL2_LISTREGS_SHIFT)
2633 | ICH_VTR_EL2_TDS | ICH_VTR_EL2_A3V
2634 | (1 << ICH_VTR_EL2_IDBITS_SHIFT)
2635 | ((cs->vprebits - 1) << ICH_VTR_EL2_PREBITS_SHIFT)
2636 | ((cs->vpribits - 1) << ICH_VTR_EL2_PRIBITS_SHIFT);
2637
2638 if (cs->gic->revision < 4) {
2639 value |= ICH_VTR_EL2_NV4;
2640 }
2641
2642 trace_gicv3_ich_vtr_read(gicv3_redist_affid(cs), value);
2643 return value;
2644 }
2645
ich_misr_read(CPUARMState * env,const ARMCPRegInfo * ri)2646 static uint64_t ich_misr_read(CPUARMState *env, const ARMCPRegInfo *ri)
2647 {
2648 GICv3CPUState *cs = icc_cs_from_env(env);
2649 uint64_t value = maintenance_interrupt_state(cs);
2650
2651 trace_gicv3_ich_misr_read(gicv3_redist_affid(cs), value);
2652 return value;
2653 }
2654
ich_eisr_read(CPUARMState * env,const ARMCPRegInfo * ri)2655 static uint64_t ich_eisr_read(CPUARMState *env, const ARMCPRegInfo *ri)
2656 {
2657 GICv3CPUState *cs = icc_cs_from_env(env);
2658 uint64_t value = eoi_maintenance_interrupt_state(cs, NULL);
2659
2660 trace_gicv3_ich_eisr_read(gicv3_redist_affid(cs), value);
2661 return value;
2662 }
2663
ich_elrsr_read(CPUARMState * env,const ARMCPRegInfo * ri)2664 static uint64_t ich_elrsr_read(CPUARMState *env, const ARMCPRegInfo *ri)
2665 {
2666 GICv3CPUState *cs = icc_cs_from_env(env);
2667 uint64_t value = 0;
2668 int i;
2669
2670 for (i = 0; i < cs->num_list_regs; i++) {
2671 uint64_t lr = cs->ich_lr_el2[i];
2672
2673 if ((lr & ICH_LR_EL2_STATE_MASK) == 0 &&
2674 ((lr & ICH_LR_EL2_HW) != 0 || (lr & ICH_LR_EL2_EOI) == 0)) {
2675 value |= (1 << i);
2676 }
2677 }
2678
2679 trace_gicv3_ich_elrsr_read(gicv3_redist_affid(cs), value);
2680 return value;
2681 }
2682
2683 static const ARMCPRegInfo gicv3_cpuif_hcr_reginfo[] = {
2684 { .name = "ICH_AP0R0_EL2", .state = ARM_CP_STATE_BOTH,
2685 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 8, .opc2 = 0,
2686 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2687 .access = PL2_RW,
2688 .readfn = ich_ap_read,
2689 .writefn = ich_ap_write,
2690 },
2691 { .name = "ICH_AP1R0_EL2", .state = ARM_CP_STATE_BOTH,
2692 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 9, .opc2 = 0,
2693 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2694 .access = PL2_RW,
2695 .readfn = ich_ap_read,
2696 .writefn = ich_ap_write,
2697 },
2698 { .name = "ICH_HCR_EL2", .state = ARM_CP_STATE_BOTH,
2699 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 11, .opc2 = 0,
2700 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2701 .access = PL2_RW,
2702 .readfn = ich_hcr_read,
2703 .writefn = ich_hcr_write,
2704 },
2705 { .name = "ICH_VTR_EL2", .state = ARM_CP_STATE_BOTH,
2706 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 11, .opc2 = 1,
2707 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2708 .access = PL2_R,
2709 .readfn = ich_vtr_read,
2710 },
2711 { .name = "ICH_MISR_EL2", .state = ARM_CP_STATE_BOTH,
2712 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 11, .opc2 = 2,
2713 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2714 .access = PL2_R,
2715 .readfn = ich_misr_read,
2716 },
2717 { .name = "ICH_EISR_EL2", .state = ARM_CP_STATE_BOTH,
2718 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 11, .opc2 = 3,
2719 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2720 .access = PL2_R,
2721 .readfn = ich_eisr_read,
2722 },
2723 { .name = "ICH_ELRSR_EL2", .state = ARM_CP_STATE_BOTH,
2724 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 11, .opc2 = 5,
2725 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2726 .access = PL2_R,
2727 .readfn = ich_elrsr_read,
2728 },
2729 { .name = "ICH_VMCR_EL2", .state = ARM_CP_STATE_BOTH,
2730 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 11, .opc2 = 7,
2731 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2732 .access = PL2_RW,
2733 .readfn = ich_vmcr_read,
2734 .writefn = ich_vmcr_write,
2735 },
2736 };
2737
2738 static const ARMCPRegInfo gicv3_cpuif_ich_apxr1_reginfo[] = {
2739 { .name = "ICH_AP0R1_EL2", .state = ARM_CP_STATE_BOTH,
2740 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 8, .opc2 = 1,
2741 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2742 .access = PL2_RW,
2743 .readfn = ich_ap_read,
2744 .writefn = ich_ap_write,
2745 },
2746 { .name = "ICH_AP1R1_EL2", .state = ARM_CP_STATE_BOTH,
2747 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 9, .opc2 = 1,
2748 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2749 .access = PL2_RW,
2750 .readfn = ich_ap_read,
2751 .writefn = ich_ap_write,
2752 },
2753 };
2754
2755 static const ARMCPRegInfo gicv3_cpuif_ich_apxr23_reginfo[] = {
2756 { .name = "ICH_AP0R2_EL2", .state = ARM_CP_STATE_BOTH,
2757 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 8, .opc2 = 2,
2758 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2759 .access = PL2_RW,
2760 .readfn = ich_ap_read,
2761 .writefn = ich_ap_write,
2762 },
2763 { .name = "ICH_AP0R3_EL2", .state = ARM_CP_STATE_BOTH,
2764 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 8, .opc2 = 3,
2765 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2766 .access = PL2_RW,
2767 .readfn = ich_ap_read,
2768 .writefn = ich_ap_write,
2769 },
2770 { .name = "ICH_AP1R2_EL2", .state = ARM_CP_STATE_BOTH,
2771 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 9, .opc2 = 2,
2772 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2773 .access = PL2_RW,
2774 .readfn = ich_ap_read,
2775 .writefn = ich_ap_write,
2776 },
2777 { .name = "ICH_AP1R3_EL2", .state = ARM_CP_STATE_BOTH,
2778 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 9, .opc2 = 3,
2779 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2780 .access = PL2_RW,
2781 .readfn = ich_ap_read,
2782 .writefn = ich_ap_write,
2783 },
2784 };
2785
gicv3_cpuif_el_change_hook(ARMCPU * cpu,void * opaque)2786 static void gicv3_cpuif_el_change_hook(ARMCPU *cpu, void *opaque)
2787 {
2788 GICv3CPUState *cs = opaque;
2789
2790 gicv3_cpuif_update(cs);
2791 /*
2792 * Because vLPIs are only pending in NonSecure state,
2793 * an EL change can change the VIRQ/VFIQ status (but
2794 * cannot affect the maintenance interrupt state)
2795 */
2796 gicv3_cpuif_virt_irq_fiq_update(cs);
2797 }
2798
gicv3_init_cpuif(GICv3State * s)2799 void gicv3_init_cpuif(GICv3State *s)
2800 {
2801 /* Called from the GICv3 realize function; register our system
2802 * registers with the CPU
2803 */
2804 int i;
2805
2806 for (i = 0; i < s->num_cpu; i++) {
2807 ARMCPU *cpu = ARM_CPU(qemu_get_cpu(i));
2808 GICv3CPUState *cs = &s->cpu[i];
2809
2810 /*
2811 * If the CPU doesn't define a GICv3 configuration, probably because
2812 * in real hardware it doesn't have one, then we use default values
2813 * matching the one used by most Arm CPUs. This applies to:
2814 * cpu->gic_num_lrs
2815 * cpu->gic_vpribits
2816 * cpu->gic_vprebits
2817 * cpu->gic_pribits
2818 */
2819
2820 /* Note that we can't just use the GICv3CPUState as an opaque pointer
2821 * in define_arm_cp_regs_with_opaque(), because when we're called back
2822 * it might be with code translated by CPU 0 but run by CPU 1, in
2823 * which case we'd get the wrong value.
2824 * So instead we define the regs with no ri->opaque info, and
2825 * get back to the GICv3CPUState from the CPUARMState.
2826 *
2827 * These CP regs callbacks can be called from either TCG or HVF code.
2828 */
2829 define_arm_cp_regs(cpu, gicv3_cpuif_reginfo);
2830
2831 /*
2832 * The CPU implementation specifies the number of supported
2833 * bits of physical priority. For backwards compatibility
2834 * of migration, we have a compat property that forces use
2835 * of 8 priority bits regardless of what the CPU really has.
2836 */
2837 if (s->force_8bit_prio) {
2838 cs->pribits = 8;
2839 } else {
2840 cs->pribits = cpu->gic_pribits ?: 5;
2841 }
2842
2843 /*
2844 * The GICv3 has separate ID register fields for virtual priority
2845 * and preemption bit values, but only a single ID register field
2846 * for the physical priority bits. The preemption bit count is
2847 * always the same as the priority bit count, except that 8 bits
2848 * of priority means 7 preemption bits. We precalculate the
2849 * preemption bits because it simplifies the code and makes the
2850 * parallels between the virtual and physical bits of the GIC
2851 * a bit clearer.
2852 */
2853 cs->prebits = cs->pribits;
2854 if (cs->prebits == 8) {
2855 cs->prebits--;
2856 }
2857 /*
2858 * Check that CPU code defining pribits didn't violate
2859 * architectural constraints our implementation relies on.
2860 */
2861 g_assert(cs->pribits >= 4 && cs->pribits <= 8);
2862
2863 /*
2864 * gicv3_cpuif_reginfo[] defines ICC_AP*R0_EL1; add definitions
2865 * for ICC_AP*R{1,2,3}_EL1 if the prebits value requires them.
2866 */
2867 if (cs->prebits >= 6) {
2868 define_arm_cp_regs(cpu, gicv3_cpuif_icc_apxr1_reginfo);
2869 }
2870 if (cs->prebits == 7) {
2871 define_arm_cp_regs(cpu, gicv3_cpuif_icc_apxr23_reginfo);
2872 }
2873
2874 if (arm_feature(&cpu->env, ARM_FEATURE_EL2)) {
2875 int j;
2876
2877 cs->num_list_regs = cpu->gic_num_lrs ?: 4;
2878 cs->vpribits = cpu->gic_vpribits ?: 5;
2879 cs->vprebits = cpu->gic_vprebits ?: 5;
2880
2881 /* Check against architectural constraints: getting these
2882 * wrong would be a bug in the CPU code defining these,
2883 * and the implementation relies on them holding.
2884 */
2885 g_assert(cs->vprebits <= cs->vpribits);
2886 g_assert(cs->vprebits >= 5 && cs->vprebits <= 7);
2887 g_assert(cs->vpribits >= 5 && cs->vpribits <= 8);
2888
2889 define_arm_cp_regs(cpu, gicv3_cpuif_hcr_reginfo);
2890
2891 for (j = 0; j < cs->num_list_regs; j++) {
2892 /* Note that the AArch64 LRs are 64-bit; the AArch32 LRs
2893 * are split into two cp15 regs, LR (the low part, with the
2894 * same encoding as the AArch64 LR) and LRC (the high part).
2895 */
2896 ARMCPRegInfo lr_regset[] = {
2897 { .name = "ICH_LRn_EL2", .state = ARM_CP_STATE_BOTH,
2898 .opc0 = 3, .opc1 = 4, .crn = 12,
2899 .crm = 12 + (j >> 3), .opc2 = j & 7,
2900 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2901 .access = PL2_RW,
2902 .readfn = ich_lr_read,
2903 .writefn = ich_lr_write,
2904 },
2905 { .name = "ICH_LRCn_EL2", .state = ARM_CP_STATE_AA32,
2906 .cp = 15, .opc1 = 4, .crn = 12,
2907 .crm = 14 + (j >> 3), .opc2 = j & 7,
2908 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2909 .access = PL2_RW,
2910 .readfn = ich_lr_read,
2911 .writefn = ich_lr_write,
2912 },
2913 };
2914 define_arm_cp_regs(cpu, lr_regset);
2915 }
2916 if (cs->vprebits >= 6) {
2917 define_arm_cp_regs(cpu, gicv3_cpuif_ich_apxr1_reginfo);
2918 }
2919 if (cs->vprebits == 7) {
2920 define_arm_cp_regs(cpu, gicv3_cpuif_ich_apxr23_reginfo);
2921 }
2922 }
2923 if (tcg_enabled() || qtest_enabled()) {
2924 /*
2925 * We can only trap EL changes with TCG. However the GIC interrupt
2926 * state only changes on EL changes involving EL2 or EL3, so for
2927 * the non-TCG case this is OK, as EL2 and EL3 can't exist.
2928 */
2929 arm_register_el_change_hook(cpu, gicv3_cpuif_el_change_hook, cs);
2930 } else {
2931 assert(!arm_feature(&cpu->env, ARM_FEATURE_EL2));
2932 assert(!arm_feature(&cpu->env, ARM_FEATURE_EL3));
2933 }
2934 }
2935 }
2936