xref: /openbmc/qemu/hw/intc/arm_gicv3_its.c (revision a686e85d2b4a3b95d97d01dfa3fd4607f1216cf0)
1 /*
2  * ITS emulation for a GICv3-based system
3  *
4  * Copyright Linaro.org 2021
5  *
6  * Authors:
7  *  Shashi Mallela <shashi.mallela@linaro.org>
8  *
9  * This work is licensed under the terms of the GNU GPL, version 2 or (at your
10  * option) any later version.  See the COPYING file in the top-level directory.
11  *
12  */
13 
14 #include "qemu/osdep.h"
15 #include "qemu/log.h"
16 #include "trace.h"
17 #include "hw/qdev-properties.h"
18 #include "hw/intc/arm_gicv3_its_common.h"
19 #include "gicv3_internal.h"
20 #include "qom/object.h"
21 #include "qapi/error.h"
22 
23 typedef struct GICv3ITSClass GICv3ITSClass;
24 /* This is reusing the GICv3ITSState typedef from ARM_GICV3_ITS_COMMON */
25 DECLARE_OBJ_CHECKERS(GICv3ITSState, GICv3ITSClass,
26                      ARM_GICV3_ITS, TYPE_ARM_GICV3_ITS)
27 
28 struct GICv3ITSClass {
29     GICv3ITSCommonClass parent_class;
30     void (*parent_reset)(DeviceState *dev);
31 };
32 
33 /*
34  * This is an internal enum used to distinguish between LPI triggered
35  * via command queue and LPI triggered via gits_translater write.
36  */
37 typedef enum ItsCmdType {
38     NONE = 0, /* internal indication for GITS_TRANSLATER write */
39     CLEAR = 1,
40     DISCARD = 2,
41     INTERRUPT = 3,
42 } ItsCmdType;
43 
44 typedef struct DTEntry {
45     bool valid;
46     unsigned size;
47     uint64_t ittaddr;
48 } DTEntry;
49 
50 typedef struct CTEntry {
51     bool valid;
52     uint32_t rdbase;
53 } CTEntry;
54 
55 typedef struct ITEntry {
56     bool valid;
57     int inttype;
58     uint32_t intid;
59     uint32_t doorbell;
60     uint32_t icid;
61     uint32_t vpeid;
62 } ITEntry;
63 
64 typedef struct VTEntry {
65     bool valid;
66     unsigned vptsize;
67     uint32_t rdbase;
68     uint64_t vptaddr;
69 } VTEntry;
70 
71 /*
72  * The ITS spec permits a range of CONSTRAINED UNPREDICTABLE options
73  * if a command parameter is not correct. These include both "stall
74  * processing of the command queue" and "ignore this command, and
75  * keep processing the queue". In our implementation we choose that
76  * memory transaction errors reading the command packet provoke a
77  * stall, but errors in parameters cause us to ignore the command
78  * and continue processing.
79  * The process_* functions which handle individual ITS commands all
80  * return an ItsCmdResult which tells process_cmdq() whether it should
81  * stall, keep going because of an error, or keep going because the
82  * command was a success.
83  */
84 typedef enum ItsCmdResult {
85     CMD_STALL = 0,
86     CMD_CONTINUE = 1,
87     CMD_CONTINUE_OK = 2,
88 } ItsCmdResult;
89 
90 /* True if the ITS supports the GICv4 virtual LPI feature */
91 static bool its_feature_virtual(GICv3ITSState *s)
92 {
93     return s->typer & R_GITS_TYPER_VIRTUAL_MASK;
94 }
95 
96 static inline bool intid_in_lpi_range(uint32_t id)
97 {
98     return id >= GICV3_LPI_INTID_START &&
99         id < (1 << (GICD_TYPER_IDBITS + 1));
100 }
101 
102 static inline bool valid_doorbell(uint32_t id)
103 {
104     /* Doorbell fields may be an LPI, or 1023 to mean "no doorbell" */
105     return id == INTID_SPURIOUS || intid_in_lpi_range(id);
106 }
107 
108 static uint64_t baser_base_addr(uint64_t value, uint32_t page_sz)
109 {
110     uint64_t result = 0;
111 
112     switch (page_sz) {
113     case GITS_PAGE_SIZE_4K:
114     case GITS_PAGE_SIZE_16K:
115         result = FIELD_EX64(value, GITS_BASER, PHYADDR) << 12;
116         break;
117 
118     case GITS_PAGE_SIZE_64K:
119         result = FIELD_EX64(value, GITS_BASER, PHYADDRL_64K) << 16;
120         result |= FIELD_EX64(value, GITS_BASER, PHYADDRH_64K) << 48;
121         break;
122 
123     default:
124         break;
125     }
126     return result;
127 }
128 
129 static uint64_t table_entry_addr(GICv3ITSState *s, TableDesc *td,
130                                  uint32_t idx, MemTxResult *res)
131 {
132     /*
133      * Given a TableDesc describing one of the ITS in-guest-memory
134      * tables and an index into it, return the guest address
135      * corresponding to that table entry.
136      * If there was a memory error reading the L1 table of an
137      * indirect table, *res is set accordingly, and we return -1.
138      * If the L1 table entry is marked not valid, we return -1 with
139      * *res set to MEMTX_OK.
140      *
141      * The specification defines the format of level 1 entries of a
142      * 2-level table, but the format of level 2 entries and the format
143      * of flat-mapped tables is IMPDEF.
144      */
145     AddressSpace *as = &s->gicv3->dma_as;
146     uint32_t l2idx;
147     uint64_t l2;
148     uint32_t num_l2_entries;
149 
150     *res = MEMTX_OK;
151 
152     if (!td->indirect) {
153         /* Single level table */
154         return td->base_addr + idx * td->entry_sz;
155     }
156 
157     /* Two level table */
158     l2idx = idx / (td->page_sz / L1TABLE_ENTRY_SIZE);
159 
160     l2 = address_space_ldq_le(as,
161                               td->base_addr + (l2idx * L1TABLE_ENTRY_SIZE),
162                               MEMTXATTRS_UNSPECIFIED, res);
163     if (*res != MEMTX_OK) {
164         return -1;
165     }
166     if (!(l2 & L2_TABLE_VALID_MASK)) {
167         return -1;
168     }
169 
170     num_l2_entries = td->page_sz / td->entry_sz;
171     return (l2 & ((1ULL << 51) - 1)) + (idx % num_l2_entries) * td->entry_sz;
172 }
173 
174 /*
175  * Read the Collection Table entry at index @icid. On success (including
176  * successfully determining that there is no valid CTE for this index),
177  * we return MEMTX_OK and populate the CTEntry struct @cte accordingly.
178  * If there is an error reading memory then we return the error code.
179  */
180 static MemTxResult get_cte(GICv3ITSState *s, uint16_t icid, CTEntry *cte)
181 {
182     AddressSpace *as = &s->gicv3->dma_as;
183     MemTxResult res = MEMTX_OK;
184     uint64_t entry_addr = table_entry_addr(s, &s->ct, icid, &res);
185     uint64_t cteval;
186 
187     if (entry_addr == -1) {
188         /* No L2 table entry, i.e. no valid CTE, or a memory error */
189         cte->valid = false;
190         goto out;
191     }
192 
193     cteval = address_space_ldq_le(as, entry_addr, MEMTXATTRS_UNSPECIFIED, &res);
194     if (res != MEMTX_OK) {
195         goto out;
196     }
197     cte->valid = FIELD_EX64(cteval, CTE, VALID);
198     cte->rdbase = FIELD_EX64(cteval, CTE, RDBASE);
199 out:
200     if (res != MEMTX_OK) {
201         trace_gicv3_its_cte_read_fault(icid);
202     } else {
203         trace_gicv3_its_cte_read(icid, cte->valid, cte->rdbase);
204     }
205     return res;
206 }
207 
208 /*
209  * Update the Interrupt Table entry at index @evinted in the table specified
210  * by the dte @dte. Returns true on success, false if there was a memory
211  * access error.
212  */
213 static bool update_ite(GICv3ITSState *s, uint32_t eventid, const DTEntry *dte,
214                        const ITEntry *ite)
215 {
216     AddressSpace *as = &s->gicv3->dma_as;
217     MemTxResult res = MEMTX_OK;
218     hwaddr iteaddr = dte->ittaddr + eventid * ITS_ITT_ENTRY_SIZE;
219     uint64_t itel = 0;
220     uint32_t iteh = 0;
221 
222     trace_gicv3_its_ite_write(dte->ittaddr, eventid, ite->valid,
223                               ite->inttype, ite->intid, ite->icid,
224                               ite->vpeid, ite->doorbell);
225 
226     if (ite->valid) {
227         itel = FIELD_DP64(itel, ITE_L, VALID, 1);
228         itel = FIELD_DP64(itel, ITE_L, INTTYPE, ite->inttype);
229         itel = FIELD_DP64(itel, ITE_L, INTID, ite->intid);
230         itel = FIELD_DP64(itel, ITE_L, ICID, ite->icid);
231         itel = FIELD_DP64(itel, ITE_L, VPEID, ite->vpeid);
232         iteh = FIELD_DP32(iteh, ITE_H, DOORBELL, ite->doorbell);
233     }
234 
235     address_space_stq_le(as, iteaddr, itel, MEMTXATTRS_UNSPECIFIED, &res);
236     if (res != MEMTX_OK) {
237         return false;
238     }
239     address_space_stl_le(as, iteaddr + 8, iteh, MEMTXATTRS_UNSPECIFIED, &res);
240     return res == MEMTX_OK;
241 }
242 
243 /*
244  * Read the Interrupt Table entry at index @eventid from the table specified
245  * by the DTE @dte. On success, we return MEMTX_OK and populate the ITEntry
246  * struct @ite accordingly. If there is an error reading memory then we return
247  * the error code.
248  */
249 static MemTxResult get_ite(GICv3ITSState *s, uint32_t eventid,
250                            const DTEntry *dte, ITEntry *ite)
251 {
252     AddressSpace *as = &s->gicv3->dma_as;
253     MemTxResult res = MEMTX_OK;
254     uint64_t itel;
255     uint32_t iteh;
256     hwaddr iteaddr = dte->ittaddr + eventid * ITS_ITT_ENTRY_SIZE;
257 
258     itel = address_space_ldq_le(as, iteaddr, MEMTXATTRS_UNSPECIFIED, &res);
259     if (res != MEMTX_OK) {
260         trace_gicv3_its_ite_read_fault(dte->ittaddr, eventid);
261         return res;
262     }
263 
264     iteh = address_space_ldl_le(as, iteaddr + 8, MEMTXATTRS_UNSPECIFIED, &res);
265     if (res != MEMTX_OK) {
266         trace_gicv3_its_ite_read_fault(dte->ittaddr, eventid);
267         return res;
268     }
269 
270     ite->valid = FIELD_EX64(itel, ITE_L, VALID);
271     ite->inttype = FIELD_EX64(itel, ITE_L, INTTYPE);
272     ite->intid = FIELD_EX64(itel, ITE_L, INTID);
273     ite->icid = FIELD_EX64(itel, ITE_L, ICID);
274     ite->vpeid = FIELD_EX64(itel, ITE_L, VPEID);
275     ite->doorbell = FIELD_EX64(iteh, ITE_H, DOORBELL);
276     trace_gicv3_its_ite_read(dte->ittaddr, eventid, ite->valid,
277                              ite->inttype, ite->intid, ite->icid,
278                              ite->vpeid, ite->doorbell);
279     return MEMTX_OK;
280 }
281 
282 /*
283  * Read the Device Table entry at index @devid. On success (including
284  * successfully determining that there is no valid DTE for this index),
285  * we return MEMTX_OK and populate the DTEntry struct accordingly.
286  * If there is an error reading memory then we return the error code.
287  */
288 static MemTxResult get_dte(GICv3ITSState *s, uint32_t devid, DTEntry *dte)
289 {
290     MemTxResult res = MEMTX_OK;
291     AddressSpace *as = &s->gicv3->dma_as;
292     uint64_t entry_addr = table_entry_addr(s, &s->dt, devid, &res);
293     uint64_t dteval;
294 
295     if (entry_addr == -1) {
296         /* No L2 table entry, i.e. no valid DTE, or a memory error */
297         dte->valid = false;
298         goto out;
299     }
300     dteval = address_space_ldq_le(as, entry_addr, MEMTXATTRS_UNSPECIFIED, &res);
301     if (res != MEMTX_OK) {
302         goto out;
303     }
304     dte->valid = FIELD_EX64(dteval, DTE, VALID);
305     dte->size = FIELD_EX64(dteval, DTE, SIZE);
306     /* DTE word field stores bits [51:8] of the ITT address */
307     dte->ittaddr = FIELD_EX64(dteval, DTE, ITTADDR) << ITTADDR_SHIFT;
308 out:
309     if (res != MEMTX_OK) {
310         trace_gicv3_its_dte_read_fault(devid);
311     } else {
312         trace_gicv3_its_dte_read(devid, dte->valid, dte->size, dte->ittaddr);
313     }
314     return res;
315 }
316 
317 /*
318  * Read the vPE Table entry at index @vpeid. On success (including
319  * successfully determining that there is no valid entry for this index),
320  * we return MEMTX_OK and populate the VTEntry struct accordingly.
321  * If there is an error reading memory then we return the error code.
322  */
323 static MemTxResult get_vte(GICv3ITSState *s, uint32_t vpeid, VTEntry *vte)
324 {
325     MemTxResult res = MEMTX_OK;
326     AddressSpace *as = &s->gicv3->dma_as;
327     uint64_t entry_addr = table_entry_addr(s, &s->vpet, vpeid, &res);
328     uint64_t vteval;
329 
330     if (entry_addr == -1) {
331         /* No L2 table entry, i.e. no valid VTE, or a memory error */
332         vte->valid = false;
333         goto out;
334     }
335     vteval = address_space_ldq_le(as, entry_addr, MEMTXATTRS_UNSPECIFIED, &res);
336     if (res != MEMTX_OK) {
337         goto out;
338     }
339     vte->valid = FIELD_EX64(vteval, VTE, VALID);
340     vte->vptsize = FIELD_EX64(vteval, VTE, VPTSIZE);
341     vte->vptaddr = FIELD_EX64(vteval, VTE, VPTADDR);
342     vte->rdbase = FIELD_EX64(vteval, VTE, RDBASE);
343 out:
344     if (res != MEMTX_OK) {
345         trace_gicv3_its_vte_read_fault(vpeid);
346     } else {
347         trace_gicv3_its_vte_read(vpeid, vte->valid, vte->vptsize,
348                                  vte->vptaddr, vte->rdbase);
349     }
350     return res;
351 }
352 
353 /*
354  * Given a (DeviceID, EventID), look up the corresponding ITE, including
355  * checking for the various invalid-value cases. If we find a valid ITE,
356  * fill in @ite and @dte and return CMD_CONTINUE_OK. Otherwise return
357  * CMD_STALL or CMD_CONTINUE as appropriate (and the contents of @ite
358  * should not be relied on).
359  *
360  * The string @who is purely for the LOG_GUEST_ERROR messages,
361  * and should indicate the name of the calling function or similar.
362  */
363 static ItsCmdResult lookup_ite(GICv3ITSState *s, const char *who,
364                                uint32_t devid, uint32_t eventid, ITEntry *ite,
365                                DTEntry *dte)
366 {
367     uint64_t num_eventids;
368 
369     if (devid >= s->dt.num_entries) {
370         qemu_log_mask(LOG_GUEST_ERROR,
371                       "%s: invalid command attributes: devid %d>=%d",
372                       who, devid, s->dt.num_entries);
373         return CMD_CONTINUE;
374     }
375 
376     if (get_dte(s, devid, dte) != MEMTX_OK) {
377         return CMD_STALL;
378     }
379     if (!dte->valid) {
380         qemu_log_mask(LOG_GUEST_ERROR,
381                       "%s: invalid command attributes: "
382                       "invalid dte for %d\n", who, devid);
383         return CMD_CONTINUE;
384     }
385 
386     num_eventids = 1ULL << (dte->size + 1);
387     if (eventid >= num_eventids) {
388         qemu_log_mask(LOG_GUEST_ERROR,
389                       "%s: invalid command attributes: eventid %d >= %"
390                       PRId64 "\n", who, eventid, num_eventids);
391         return CMD_CONTINUE;
392     }
393 
394     if (get_ite(s, eventid, dte, ite) != MEMTX_OK) {
395         return CMD_STALL;
396     }
397 
398     if (!ite->valid) {
399         qemu_log_mask(LOG_GUEST_ERROR,
400                       "%s: invalid command attributes: invalid ITE\n", who);
401         return CMD_CONTINUE;
402     }
403 
404     return CMD_CONTINUE_OK;
405 }
406 
407 /*
408  * Given an ICID, look up the corresponding CTE, including checking for various
409  * invalid-value cases. If we find a valid CTE, fill in @cte and return
410  * CMD_CONTINUE_OK; otherwise return CMD_STALL or CMD_CONTINUE (and the
411  * contents of @cte should not be relied on).
412  *
413  * The string @who is purely for the LOG_GUEST_ERROR messages,
414  * and should indicate the name of the calling function or similar.
415  */
416 static ItsCmdResult lookup_cte(GICv3ITSState *s, const char *who,
417                                uint32_t icid, CTEntry *cte)
418 {
419     if (icid >= s->ct.num_entries) {
420         qemu_log_mask(LOG_GUEST_ERROR, "%s: invalid ICID 0x%x\n", who, icid);
421         return CMD_CONTINUE;
422     }
423     if (get_cte(s, icid, cte) != MEMTX_OK) {
424         return CMD_STALL;
425     }
426     if (!cte->valid) {
427         qemu_log_mask(LOG_GUEST_ERROR, "%s: invalid CTE\n", who);
428         return CMD_CONTINUE;
429     }
430     if (cte->rdbase >= s->gicv3->num_cpu) {
431         return CMD_CONTINUE;
432     }
433     return CMD_CONTINUE_OK;
434 }
435 
436 /*
437  * Given a VPEID, look up the corresponding VTE, including checking
438  * for various invalid-value cases. if we find a valid VTE, fill in @vte
439  * and return CMD_CONTINUE_OK; otherwise return CMD_STALL or CMD_CONTINUE
440  * (and the contents of @vte should not be relied on).
441  *
442  * The string @who is purely for the LOG_GUEST_ERROR messages,
443  * and should indicate the name of the calling function or similar.
444  */
445 static ItsCmdResult lookup_vte(GICv3ITSState *s, const char *who,
446                                uint32_t vpeid, VTEntry *vte)
447 {
448     if (vpeid >= s->vpet.num_entries) {
449         qemu_log_mask(LOG_GUEST_ERROR, "%s: invalid VPEID 0x%x\n", who, vpeid);
450         return CMD_CONTINUE;
451     }
452 
453     if (get_vte(s, vpeid, vte) != MEMTX_OK) {
454         return CMD_STALL;
455     }
456     if (!vte->valid) {
457         qemu_log_mask(LOG_GUEST_ERROR,
458                       "%s: invalid VTE for VPEID 0x%x\n", who, vpeid);
459         return CMD_CONTINUE;
460     }
461 
462     if (vte->rdbase >= s->gicv3->num_cpu) {
463         return CMD_CONTINUE;
464     }
465     return CMD_CONTINUE_OK;
466 }
467 
468 static ItsCmdResult process_its_cmd_phys(GICv3ITSState *s, const ITEntry *ite,
469                                          int irqlevel)
470 {
471     CTEntry cte;
472     ItsCmdResult cmdres;
473 
474     cmdres = lookup_cte(s, __func__, ite->icid, &cte);
475     if (cmdres != CMD_CONTINUE_OK) {
476         return cmdres;
477     }
478     gicv3_redist_process_lpi(&s->gicv3->cpu[cte.rdbase], ite->intid, irqlevel);
479     return CMD_CONTINUE_OK;
480 }
481 
482 static ItsCmdResult process_its_cmd_virt(GICv3ITSState *s, const ITEntry *ite,
483                                          int irqlevel)
484 {
485     VTEntry vte;
486     ItsCmdResult cmdres;
487 
488     cmdres = lookup_vte(s, __func__, ite->vpeid, &vte);
489     if (cmdres != CMD_CONTINUE_OK) {
490         return cmdres;
491     }
492 
493     if (!intid_in_lpi_range(ite->intid) ||
494         ite->intid >= (1ULL << (vte.vptsize + 1))) {
495         qemu_log_mask(LOG_GUEST_ERROR, "%s: intid 0x%x out of range\n",
496                       __func__, ite->intid);
497         return CMD_CONTINUE;
498     }
499 
500     /*
501      * For QEMU the actual pending of the vLPI is handled in the
502      * redistributor code
503      */
504     gicv3_redist_process_vlpi(&s->gicv3->cpu[vte.rdbase], ite->intid,
505                               vte.vptaddr << 16, ite->doorbell, irqlevel);
506     return CMD_CONTINUE_OK;
507 }
508 
509 /*
510  * This function handles the processing of following commands based on
511  * the ItsCmdType parameter passed:-
512  * 1. triggering of lpi interrupt translation via ITS INT command
513  * 2. triggering of lpi interrupt translation via gits_translater register
514  * 3. handling of ITS CLEAR command
515  * 4. handling of ITS DISCARD command
516  */
517 static ItsCmdResult do_process_its_cmd(GICv3ITSState *s, uint32_t devid,
518                                        uint32_t eventid, ItsCmdType cmd)
519 {
520     DTEntry dte;
521     ITEntry ite;
522     ItsCmdResult cmdres;
523     int irqlevel;
524 
525     cmdres = lookup_ite(s, __func__, devid, eventid, &ite, &dte);
526     if (cmdres != CMD_CONTINUE_OK) {
527         return cmdres;
528     }
529 
530     irqlevel = (cmd == CLEAR || cmd == DISCARD) ? 0 : 1;
531 
532     switch (ite.inttype) {
533     case ITE_INTTYPE_PHYSICAL:
534         cmdres = process_its_cmd_phys(s, &ite, irqlevel);
535         break;
536     case ITE_INTTYPE_VIRTUAL:
537         if (!its_feature_virtual(s)) {
538             /* Can't happen unless guest is illegally writing to table memory */
539             qemu_log_mask(LOG_GUEST_ERROR,
540                           "%s: invalid type %d in ITE (table corrupted?)\n",
541                           __func__, ite.inttype);
542             return CMD_CONTINUE;
543         }
544         cmdres = process_its_cmd_virt(s, &ite, irqlevel);
545         break;
546     default:
547         g_assert_not_reached();
548     }
549 
550     if (cmdres == CMD_CONTINUE_OK && cmd == DISCARD) {
551         ITEntry ite = {};
552         /* remove mapping from interrupt translation table */
553         ite.valid = false;
554         return update_ite(s, eventid, &dte, &ite) ? CMD_CONTINUE_OK : CMD_STALL;
555     }
556     return CMD_CONTINUE_OK;
557 }
558 
559 static ItsCmdResult process_its_cmd(GICv3ITSState *s, const uint64_t *cmdpkt,
560                                     ItsCmdType cmd)
561 {
562     uint32_t devid, eventid;
563 
564     devid = (cmdpkt[0] & DEVID_MASK) >> DEVID_SHIFT;
565     eventid = cmdpkt[1] & EVENTID_MASK;
566     switch (cmd) {
567     case INTERRUPT:
568         trace_gicv3_its_cmd_int(devid, eventid);
569         break;
570     case CLEAR:
571         trace_gicv3_its_cmd_clear(devid, eventid);
572         break;
573     case DISCARD:
574         trace_gicv3_its_cmd_discard(devid, eventid);
575         break;
576     default:
577         g_assert_not_reached();
578     }
579     return do_process_its_cmd(s, devid, eventid, cmd);
580 }
581 
582 static ItsCmdResult process_mapti(GICv3ITSState *s, const uint64_t *cmdpkt,
583                                   bool ignore_pInt)
584 {
585     uint32_t devid, eventid;
586     uint32_t pIntid = 0;
587     uint64_t num_eventids;
588     uint16_t icid = 0;
589     DTEntry dte;
590     ITEntry ite;
591 
592     devid = (cmdpkt[0] & DEVID_MASK) >> DEVID_SHIFT;
593     eventid = cmdpkt[1] & EVENTID_MASK;
594     icid = cmdpkt[2] & ICID_MASK;
595 
596     if (ignore_pInt) {
597         pIntid = eventid;
598         trace_gicv3_its_cmd_mapi(devid, eventid, icid);
599     } else {
600         pIntid = (cmdpkt[1] & pINTID_MASK) >> pINTID_SHIFT;
601         trace_gicv3_its_cmd_mapti(devid, eventid, icid, pIntid);
602     }
603 
604     if (devid >= s->dt.num_entries) {
605         qemu_log_mask(LOG_GUEST_ERROR,
606                       "%s: invalid command attributes: devid %d>=%d",
607                       __func__, devid, s->dt.num_entries);
608         return CMD_CONTINUE;
609     }
610 
611     if (get_dte(s, devid, &dte) != MEMTX_OK) {
612         return CMD_STALL;
613     }
614     num_eventids = 1ULL << (dte.size + 1);
615 
616     if (icid >= s->ct.num_entries) {
617         qemu_log_mask(LOG_GUEST_ERROR,
618                       "%s: invalid ICID 0x%x >= 0x%x\n",
619                       __func__, icid, s->ct.num_entries);
620         return CMD_CONTINUE;
621     }
622 
623     if (!dte.valid) {
624         qemu_log_mask(LOG_GUEST_ERROR,
625                       "%s: no valid DTE for devid 0x%x\n", __func__, devid);
626         return CMD_CONTINUE;
627     }
628 
629     if (eventid >= num_eventids) {
630         qemu_log_mask(LOG_GUEST_ERROR,
631                       "%s: invalid event ID 0x%x >= 0x%" PRIx64 "\n",
632                       __func__, eventid, num_eventids);
633         return CMD_CONTINUE;
634     }
635 
636     if (!intid_in_lpi_range(pIntid)) {
637         qemu_log_mask(LOG_GUEST_ERROR,
638                       "%s: invalid interrupt ID 0x%x\n", __func__, pIntid);
639         return CMD_CONTINUE;
640     }
641 
642     /* add ite entry to interrupt translation table */
643     ite.valid = true;
644     ite.inttype = ITE_INTTYPE_PHYSICAL;
645     ite.intid = pIntid;
646     ite.icid = icid;
647     ite.doorbell = INTID_SPURIOUS;
648     ite.vpeid = 0;
649     return update_ite(s, eventid, &dte, &ite) ? CMD_CONTINUE_OK : CMD_STALL;
650 }
651 
652 static ItsCmdResult process_vmapti(GICv3ITSState *s, const uint64_t *cmdpkt,
653                                    bool ignore_vintid)
654 {
655     uint32_t devid, eventid, vintid, doorbell, vpeid;
656     uint32_t num_eventids;
657     DTEntry dte;
658     ITEntry ite;
659 
660     if (!its_feature_virtual(s)) {
661         return CMD_CONTINUE;
662     }
663 
664     devid = FIELD_EX64(cmdpkt[0], VMAPTI_0, DEVICEID);
665     eventid = FIELD_EX64(cmdpkt[1], VMAPTI_1, EVENTID);
666     vpeid = FIELD_EX64(cmdpkt[1], VMAPTI_1, VPEID);
667     doorbell = FIELD_EX64(cmdpkt[2], VMAPTI_2, DOORBELL);
668     if (ignore_vintid) {
669         vintid = eventid;
670         trace_gicv3_its_cmd_vmapi(devid, eventid, vpeid, doorbell);
671     } else {
672         vintid = FIELD_EX64(cmdpkt[2], VMAPTI_2, VINTID);
673         trace_gicv3_its_cmd_vmapti(devid, eventid, vpeid, vintid, doorbell);
674     }
675 
676     if (devid >= s->dt.num_entries) {
677         qemu_log_mask(LOG_GUEST_ERROR,
678                       "%s: invalid DeviceID 0x%x (must be less than 0x%x)\n",
679                       __func__, devid, s->dt.num_entries);
680         return CMD_CONTINUE;
681     }
682 
683     if (get_dte(s, devid, &dte) != MEMTX_OK) {
684         return CMD_STALL;
685     }
686 
687     if (!dte.valid) {
688         qemu_log_mask(LOG_GUEST_ERROR,
689                       "%s: no entry in device table for DeviceID 0x%x\n",
690                       __func__, devid);
691         return CMD_CONTINUE;
692     }
693 
694     num_eventids = 1ULL << (dte.size + 1);
695 
696     if (eventid >= num_eventids) {
697         qemu_log_mask(LOG_GUEST_ERROR,
698                       "%s: EventID 0x%x too large for DeviceID 0x%x "
699                       "(must be less than 0x%x)\n",
700                       __func__, eventid, devid, num_eventids);
701         return CMD_CONTINUE;
702     }
703     if (!intid_in_lpi_range(vintid)) {
704         qemu_log_mask(LOG_GUEST_ERROR,
705                       "%s: VIntID 0x%x not a valid LPI\n",
706                       __func__, vintid);
707         return CMD_CONTINUE;
708     }
709     if (!valid_doorbell(doorbell)) {
710         qemu_log_mask(LOG_GUEST_ERROR,
711                       "%s: Doorbell %d not 1023 and not a valid LPI\n",
712                       __func__, doorbell);
713         return CMD_CONTINUE;
714     }
715     if (vpeid >= s->vpet.num_entries) {
716         qemu_log_mask(LOG_GUEST_ERROR,
717                       "%s: VPEID 0x%x out of range (must be less than 0x%x)\n",
718                       __func__, vpeid, s->vpet.num_entries);
719         return CMD_CONTINUE;
720     }
721     /* add ite entry to interrupt translation table */
722     ite.valid = true;
723     ite.inttype = ITE_INTTYPE_VIRTUAL;
724     ite.intid = vintid;
725     ite.icid = 0;
726     ite.doorbell = doorbell;
727     ite.vpeid = vpeid;
728     return update_ite(s, eventid, &dte, &ite) ? CMD_CONTINUE_OK : CMD_STALL;
729 }
730 
731 /*
732  * Update the Collection Table entry for @icid to @cte. Returns true
733  * on success, false if there was a memory access error.
734  */
735 static bool update_cte(GICv3ITSState *s, uint16_t icid, const CTEntry *cte)
736 {
737     AddressSpace *as = &s->gicv3->dma_as;
738     uint64_t entry_addr;
739     uint64_t cteval = 0;
740     MemTxResult res = MEMTX_OK;
741 
742     trace_gicv3_its_cte_write(icid, cte->valid, cte->rdbase);
743 
744     if (cte->valid) {
745         /* add mapping entry to collection table */
746         cteval = FIELD_DP64(cteval, CTE, VALID, 1);
747         cteval = FIELD_DP64(cteval, CTE, RDBASE, cte->rdbase);
748     }
749 
750     entry_addr = table_entry_addr(s, &s->ct, icid, &res);
751     if (res != MEMTX_OK) {
752         /* memory access error: stall */
753         return false;
754     }
755     if (entry_addr == -1) {
756         /* No L2 table for this index: discard write and continue */
757         return true;
758     }
759 
760     address_space_stq_le(as, entry_addr, cteval, MEMTXATTRS_UNSPECIFIED, &res);
761     return res == MEMTX_OK;
762 }
763 
764 static ItsCmdResult process_mapc(GICv3ITSState *s, const uint64_t *cmdpkt)
765 {
766     uint16_t icid;
767     CTEntry cte;
768 
769     icid = cmdpkt[2] & ICID_MASK;
770     cte.valid = cmdpkt[2] & CMD_FIELD_VALID_MASK;
771     if (cte.valid) {
772         cte.rdbase = (cmdpkt[2] & R_MAPC_RDBASE_MASK) >> R_MAPC_RDBASE_SHIFT;
773         cte.rdbase &= RDBASE_PROCNUM_MASK;
774     } else {
775         cte.rdbase = 0;
776     }
777     trace_gicv3_its_cmd_mapc(icid, cte.rdbase, cte.valid);
778 
779     if (icid >= s->ct.num_entries) {
780         qemu_log_mask(LOG_GUEST_ERROR, "ITS MAPC: invalid ICID 0x%x\n", icid);
781         return CMD_CONTINUE;
782     }
783     if (cte.valid && cte.rdbase >= s->gicv3->num_cpu) {
784         qemu_log_mask(LOG_GUEST_ERROR,
785                       "ITS MAPC: invalid RDBASE %u\n", cte.rdbase);
786         return CMD_CONTINUE;
787     }
788 
789     return update_cte(s, icid, &cte) ? CMD_CONTINUE_OK : CMD_STALL;
790 }
791 
792 /*
793  * Update the Device Table entry for @devid to @dte. Returns true
794  * on success, false if there was a memory access error.
795  */
796 static bool update_dte(GICv3ITSState *s, uint32_t devid, const DTEntry *dte)
797 {
798     AddressSpace *as = &s->gicv3->dma_as;
799     uint64_t entry_addr;
800     uint64_t dteval = 0;
801     MemTxResult res = MEMTX_OK;
802 
803     trace_gicv3_its_dte_write(devid, dte->valid, dte->size, dte->ittaddr);
804 
805     if (dte->valid) {
806         /* add mapping entry to device table */
807         dteval = FIELD_DP64(dteval, DTE, VALID, 1);
808         dteval = FIELD_DP64(dteval, DTE, SIZE, dte->size);
809         dteval = FIELD_DP64(dteval, DTE, ITTADDR, dte->ittaddr);
810     }
811 
812     entry_addr = table_entry_addr(s, &s->dt, devid, &res);
813     if (res != MEMTX_OK) {
814         /* memory access error: stall */
815         return false;
816     }
817     if (entry_addr == -1) {
818         /* No L2 table for this index: discard write and continue */
819         return true;
820     }
821     address_space_stq_le(as, entry_addr, dteval, MEMTXATTRS_UNSPECIFIED, &res);
822     return res == MEMTX_OK;
823 }
824 
825 static ItsCmdResult process_mapd(GICv3ITSState *s, const uint64_t *cmdpkt)
826 {
827     uint32_t devid;
828     DTEntry dte;
829 
830     devid = (cmdpkt[0] & DEVID_MASK) >> DEVID_SHIFT;
831     dte.size = cmdpkt[1] & SIZE_MASK;
832     dte.ittaddr = (cmdpkt[2] & ITTADDR_MASK) >> ITTADDR_SHIFT;
833     dte.valid = cmdpkt[2] & CMD_FIELD_VALID_MASK;
834 
835     trace_gicv3_its_cmd_mapd(devid, dte.size, dte.ittaddr, dte.valid);
836 
837     if (devid >= s->dt.num_entries) {
838         qemu_log_mask(LOG_GUEST_ERROR,
839                       "ITS MAPD: invalid device ID field 0x%x >= 0x%x\n",
840                       devid, s->dt.num_entries);
841         return CMD_CONTINUE;
842     }
843 
844     if (dte.size > FIELD_EX64(s->typer, GITS_TYPER, IDBITS)) {
845         qemu_log_mask(LOG_GUEST_ERROR,
846                       "ITS MAPD: invalid size %d\n", dte.size);
847         return CMD_CONTINUE;
848     }
849 
850     return update_dte(s, devid, &dte) ? CMD_CONTINUE_OK : CMD_STALL;
851 }
852 
853 static ItsCmdResult process_movall(GICv3ITSState *s, const uint64_t *cmdpkt)
854 {
855     uint64_t rd1, rd2;
856 
857     rd1 = FIELD_EX64(cmdpkt[2], MOVALL_2, RDBASE1);
858     rd2 = FIELD_EX64(cmdpkt[3], MOVALL_3, RDBASE2);
859 
860     trace_gicv3_its_cmd_movall(rd1, rd2);
861 
862     if (rd1 >= s->gicv3->num_cpu) {
863         qemu_log_mask(LOG_GUEST_ERROR,
864                       "%s: RDBASE1 %" PRId64
865                       " out of range (must be less than %d)\n",
866                       __func__, rd1, s->gicv3->num_cpu);
867         return CMD_CONTINUE;
868     }
869     if (rd2 >= s->gicv3->num_cpu) {
870         qemu_log_mask(LOG_GUEST_ERROR,
871                       "%s: RDBASE2 %" PRId64
872                       " out of range (must be less than %d)\n",
873                       __func__, rd2, s->gicv3->num_cpu);
874         return CMD_CONTINUE;
875     }
876 
877     if (rd1 == rd2) {
878         /* Move to same target must succeed as a no-op */
879         return CMD_CONTINUE_OK;
880     }
881 
882     /* Move all pending LPIs from redistributor 1 to redistributor 2 */
883     gicv3_redist_movall_lpis(&s->gicv3->cpu[rd1], &s->gicv3->cpu[rd2]);
884 
885     return CMD_CONTINUE_OK;
886 }
887 
888 static ItsCmdResult process_movi(GICv3ITSState *s, const uint64_t *cmdpkt)
889 {
890     uint32_t devid, eventid;
891     uint16_t new_icid;
892     DTEntry dte;
893     CTEntry old_cte, new_cte;
894     ITEntry old_ite;
895     ItsCmdResult cmdres;
896 
897     devid = FIELD_EX64(cmdpkt[0], MOVI_0, DEVICEID);
898     eventid = FIELD_EX64(cmdpkt[1], MOVI_1, EVENTID);
899     new_icid = FIELD_EX64(cmdpkt[2], MOVI_2, ICID);
900 
901     trace_gicv3_its_cmd_movi(devid, eventid, new_icid);
902 
903     cmdres = lookup_ite(s, __func__, devid, eventid, &old_ite, &dte);
904     if (cmdres != CMD_CONTINUE_OK) {
905         return cmdres;
906     }
907 
908     if (old_ite.inttype != ITE_INTTYPE_PHYSICAL) {
909         qemu_log_mask(LOG_GUEST_ERROR,
910                       "%s: invalid command attributes: invalid ITE\n",
911                       __func__);
912         return CMD_CONTINUE;
913     }
914 
915     cmdres = lookup_cte(s, __func__, old_ite.icid, &old_cte);
916     if (cmdres != CMD_CONTINUE_OK) {
917         return cmdres;
918     }
919     cmdres = lookup_cte(s, __func__, new_icid, &new_cte);
920     if (cmdres != CMD_CONTINUE_OK) {
921         return cmdres;
922     }
923 
924     if (old_cte.rdbase != new_cte.rdbase) {
925         /* Move the LPI from the old redistributor to the new one */
926         gicv3_redist_mov_lpi(&s->gicv3->cpu[old_cte.rdbase],
927                              &s->gicv3->cpu[new_cte.rdbase],
928                              old_ite.intid);
929     }
930 
931     /* Update the ICID field in the interrupt translation table entry */
932     old_ite.icid = new_icid;
933     return update_ite(s, eventid, &dte, &old_ite) ? CMD_CONTINUE_OK : CMD_STALL;
934 }
935 
936 /*
937  * Update the vPE Table entry at index @vpeid with the entry @vte.
938  * Returns true on success, false if there was a memory access error.
939  */
940 static bool update_vte(GICv3ITSState *s, uint32_t vpeid, const VTEntry *vte)
941 {
942     AddressSpace *as = &s->gicv3->dma_as;
943     uint64_t entry_addr;
944     uint64_t vteval = 0;
945     MemTxResult res = MEMTX_OK;
946 
947     trace_gicv3_its_vte_write(vpeid, vte->valid, vte->vptsize, vte->vptaddr,
948                               vte->rdbase);
949 
950     if (vte->valid) {
951         vteval = FIELD_DP64(vteval, VTE, VALID, 1);
952         vteval = FIELD_DP64(vteval, VTE, VPTSIZE, vte->vptsize);
953         vteval = FIELD_DP64(vteval, VTE, VPTADDR, vte->vptaddr);
954         vteval = FIELD_DP64(vteval, VTE, RDBASE, vte->rdbase);
955     }
956 
957     entry_addr = table_entry_addr(s, &s->vpet, vpeid, &res);
958     if (res != MEMTX_OK) {
959         return false;
960     }
961     if (entry_addr == -1) {
962         /* No L2 table for this index: discard write and continue */
963         return true;
964     }
965     address_space_stq_le(as, entry_addr, vteval, MEMTXATTRS_UNSPECIFIED, &res);
966     return res == MEMTX_OK;
967 }
968 
969 static ItsCmdResult process_vmapp(GICv3ITSState *s, const uint64_t *cmdpkt)
970 {
971     VTEntry vte;
972     uint32_t vpeid;
973 
974     if (!its_feature_virtual(s)) {
975         return CMD_CONTINUE;
976     }
977 
978     vpeid = FIELD_EX64(cmdpkt[1], VMAPP_1, VPEID);
979     vte.rdbase = FIELD_EX64(cmdpkt[2], VMAPP_2, RDBASE);
980     vte.valid = FIELD_EX64(cmdpkt[2], VMAPP_2, V);
981     vte.vptsize = FIELD_EX64(cmdpkt[3], VMAPP_3, VPTSIZE);
982     vte.vptaddr = FIELD_EX64(cmdpkt[3], VMAPP_3, VPTADDR);
983 
984     trace_gicv3_its_cmd_vmapp(vpeid, vte.rdbase, vte.valid,
985                               vte.vptaddr, vte.vptsize);
986 
987     /*
988      * For GICv4.0 the VPT_size field is only 5 bits, whereas we
989      * define our field macros to include the full GICv4.1 8 bits.
990      * The range check on VPT_size will catch the cases where
991      * the guest set the RES0-in-GICv4.0 bits [7:6].
992      */
993     if (vte.vptsize > FIELD_EX64(s->typer, GITS_TYPER, IDBITS)) {
994         qemu_log_mask(LOG_GUEST_ERROR,
995                       "%s: invalid VPT_size 0x%x\n", __func__, vte.vptsize);
996         return CMD_CONTINUE;
997     }
998 
999     if (vte.valid && vte.rdbase >= s->gicv3->num_cpu) {
1000         qemu_log_mask(LOG_GUEST_ERROR,
1001                       "%s: invalid rdbase 0x%x\n", __func__, vte.rdbase);
1002         return CMD_CONTINUE;
1003     }
1004 
1005     if (vpeid >= s->vpet.num_entries) {
1006         qemu_log_mask(LOG_GUEST_ERROR,
1007                       "%s: VPEID 0x%x out of range (must be less than 0x%x)\n",
1008                       __func__, vpeid, s->vpet.num_entries);
1009         return CMD_CONTINUE;
1010     }
1011 
1012     return update_vte(s, vpeid, &vte) ? CMD_CONTINUE_OK : CMD_STALL;
1013 }
1014 
1015 typedef struct VmovpCallbackData {
1016     uint64_t rdbase;
1017     uint32_t vpeid;
1018     /*
1019      * Overall command result. If more than one callback finds an
1020      * error, STALL beats CONTINUE.
1021      */
1022     ItsCmdResult result;
1023 } VmovpCallbackData;
1024 
1025 static void vmovp_callback(gpointer data, gpointer opaque)
1026 {
1027     /*
1028      * This function is called to update the VPEID field in a VPE
1029      * table entry for this ITS. This might be because of a VMOVP
1030      * command executed on any ITS that is connected to the same GIC
1031      * as this ITS.  We need to read the VPE table entry for the VPEID
1032      * and update its RDBASE field.
1033      */
1034     GICv3ITSState *s = data;
1035     VmovpCallbackData *cbdata = opaque;
1036     VTEntry vte;
1037     ItsCmdResult cmdres;
1038 
1039     cmdres = lookup_vte(s, __func__, cbdata->vpeid, &vte);
1040     switch (cmdres) {
1041     case CMD_STALL:
1042         cbdata->result = CMD_STALL;
1043         return;
1044     case CMD_CONTINUE:
1045         if (cbdata->result != CMD_STALL) {
1046             cbdata->result = CMD_CONTINUE;
1047         }
1048         return;
1049     case CMD_CONTINUE_OK:
1050         break;
1051     }
1052 
1053     vte.rdbase = cbdata->rdbase;
1054     if (!update_vte(s, cbdata->vpeid, &vte)) {
1055         cbdata->result = CMD_STALL;
1056     }
1057 }
1058 
1059 static ItsCmdResult process_vmovp(GICv3ITSState *s, const uint64_t *cmdpkt)
1060 {
1061     VmovpCallbackData cbdata;
1062 
1063     if (!its_feature_virtual(s)) {
1064         return CMD_CONTINUE;
1065     }
1066 
1067     cbdata.vpeid = FIELD_EX64(cmdpkt[1], VMOVP_1, VPEID);
1068     cbdata.rdbase = FIELD_EX64(cmdpkt[2], VMOVP_2, RDBASE);
1069 
1070     trace_gicv3_its_cmd_vmovp(cbdata.vpeid, cbdata.rdbase);
1071 
1072     if (cbdata.rdbase >= s->gicv3->num_cpu) {
1073         return CMD_CONTINUE;
1074     }
1075 
1076     /*
1077      * Our ITS implementation reports GITS_TYPER.VMOVP == 1, which means
1078      * that when the VMOVP command is executed on an ITS to change the
1079      * VPEID field in a VPE table entry the change must be propagated
1080      * to all the ITSes connected to the same GIC.
1081      */
1082     cbdata.result = CMD_CONTINUE_OK;
1083     gicv3_foreach_its(s->gicv3, vmovp_callback, &cbdata);
1084     return cbdata.result;
1085 }
1086 
1087 static ItsCmdResult process_inv(GICv3ITSState *s, const uint64_t *cmdpkt)
1088 {
1089     uint32_t devid, eventid;
1090     ITEntry ite;
1091     DTEntry dte;
1092     CTEntry cte;
1093     ItsCmdResult cmdres;
1094 
1095     devid = FIELD_EX64(cmdpkt[0], INV_0, DEVICEID);
1096     eventid = FIELD_EX64(cmdpkt[1], INV_1, EVENTID);
1097 
1098     trace_gicv3_its_cmd_inv(devid, eventid);
1099 
1100     cmdres = lookup_ite(s, __func__, devid, eventid, &ite, &dte);
1101     if (cmdres != CMD_CONTINUE_OK) {
1102         return cmdres;
1103     }
1104 
1105     switch (ite.inttype) {
1106     case ITE_INTTYPE_PHYSICAL:
1107         cmdres = lookup_cte(s, __func__, ite.icid, &cte);
1108         if (cmdres != CMD_CONTINUE_OK) {
1109             return cmdres;
1110         }
1111         gicv3_redist_inv_lpi(&s->gicv3->cpu[cte.rdbase], ite.intid);
1112         break;
1113     case ITE_INTTYPE_VIRTUAL:
1114         if (!its_feature_virtual(s)) {
1115             /* Can't happen unless guest is illegally writing to table memory */
1116             qemu_log_mask(LOG_GUEST_ERROR,
1117                           "%s: invalid type %d in ITE (table corrupted?)\n",
1118                           __func__, ite.inttype);
1119             return CMD_CONTINUE;
1120         }
1121         /* We will implement the vLPI invalidation in a later commit */
1122         g_assert_not_reached();
1123         break;
1124     default:
1125         g_assert_not_reached();
1126     }
1127 
1128     return CMD_CONTINUE_OK;
1129 }
1130 
1131 /*
1132  * Current implementation blocks until all
1133  * commands are processed
1134  */
1135 static void process_cmdq(GICv3ITSState *s)
1136 {
1137     uint32_t wr_offset = 0;
1138     uint32_t rd_offset = 0;
1139     uint32_t cq_offset = 0;
1140     AddressSpace *as = &s->gicv3->dma_as;
1141     uint8_t cmd;
1142     int i;
1143 
1144     if (!(s->ctlr & R_GITS_CTLR_ENABLED_MASK)) {
1145         return;
1146     }
1147 
1148     wr_offset = FIELD_EX64(s->cwriter, GITS_CWRITER, OFFSET);
1149 
1150     if (wr_offset >= s->cq.num_entries) {
1151         qemu_log_mask(LOG_GUEST_ERROR,
1152                       "%s: invalid write offset "
1153                       "%d\n", __func__, wr_offset);
1154         return;
1155     }
1156 
1157     rd_offset = FIELD_EX64(s->creadr, GITS_CREADR, OFFSET);
1158 
1159     if (rd_offset >= s->cq.num_entries) {
1160         qemu_log_mask(LOG_GUEST_ERROR,
1161                       "%s: invalid read offset "
1162                       "%d\n", __func__, rd_offset);
1163         return;
1164     }
1165 
1166     while (wr_offset != rd_offset) {
1167         ItsCmdResult result = CMD_CONTINUE_OK;
1168         void *hostmem;
1169         hwaddr buflen;
1170         uint64_t cmdpkt[GITS_CMDQ_ENTRY_WORDS];
1171 
1172         cq_offset = (rd_offset * GITS_CMDQ_ENTRY_SIZE);
1173 
1174         buflen = GITS_CMDQ_ENTRY_SIZE;
1175         hostmem = address_space_map(as, s->cq.base_addr + cq_offset,
1176                                     &buflen, false, MEMTXATTRS_UNSPECIFIED);
1177         if (!hostmem || buflen != GITS_CMDQ_ENTRY_SIZE) {
1178             if (hostmem) {
1179                 address_space_unmap(as, hostmem, buflen, false, 0);
1180             }
1181             s->creadr = FIELD_DP64(s->creadr, GITS_CREADR, STALLED, 1);
1182             qemu_log_mask(LOG_GUEST_ERROR,
1183                           "%s: could not read command at 0x%" PRIx64 "\n",
1184                           __func__, s->cq.base_addr + cq_offset);
1185             break;
1186         }
1187         for (i = 0; i < ARRAY_SIZE(cmdpkt); i++) {
1188             cmdpkt[i] = ldq_le_p(hostmem + i * sizeof(uint64_t));
1189         }
1190         address_space_unmap(as, hostmem, buflen, false, 0);
1191 
1192         cmd = cmdpkt[0] & CMD_MASK;
1193 
1194         trace_gicv3_its_process_command(rd_offset, cmd);
1195 
1196         switch (cmd) {
1197         case GITS_CMD_INT:
1198             result = process_its_cmd(s, cmdpkt, INTERRUPT);
1199             break;
1200         case GITS_CMD_CLEAR:
1201             result = process_its_cmd(s, cmdpkt, CLEAR);
1202             break;
1203         case GITS_CMD_SYNC:
1204             /*
1205              * Current implementation makes a blocking synchronous call
1206              * for every command issued earlier, hence the internal state
1207              * is already consistent by the time SYNC command is executed.
1208              * Hence no further processing is required for SYNC command.
1209              */
1210             trace_gicv3_its_cmd_sync();
1211             break;
1212         case GITS_CMD_VSYNC:
1213             /*
1214              * VSYNC also is a nop, because our implementation is always
1215              * in sync.
1216              */
1217             if (!its_feature_virtual(s)) {
1218                 result = CMD_CONTINUE;
1219                 break;
1220             }
1221             trace_gicv3_its_cmd_vsync();
1222             break;
1223         case GITS_CMD_MAPD:
1224             result = process_mapd(s, cmdpkt);
1225             break;
1226         case GITS_CMD_MAPC:
1227             result = process_mapc(s, cmdpkt);
1228             break;
1229         case GITS_CMD_MAPTI:
1230             result = process_mapti(s, cmdpkt, false);
1231             break;
1232         case GITS_CMD_MAPI:
1233             result = process_mapti(s, cmdpkt, true);
1234             break;
1235         case GITS_CMD_DISCARD:
1236             result = process_its_cmd(s, cmdpkt, DISCARD);
1237             break;
1238         case GITS_CMD_INV:
1239             result = process_inv(s, cmdpkt);
1240             break;
1241         case GITS_CMD_INVALL:
1242             /*
1243              * Current implementation doesn't cache any ITS tables,
1244              * but the calculated lpi priority information. We only
1245              * need to trigger lpi priority re-calculation to be in
1246              * sync with LPI config table or pending table changes.
1247              * INVALL operates on a collection specified by ICID so
1248              * it only affects physical LPIs.
1249              */
1250             trace_gicv3_its_cmd_invall();
1251             for (i = 0; i < s->gicv3->num_cpu; i++) {
1252                 gicv3_redist_update_lpi(&s->gicv3->cpu[i]);
1253             }
1254             break;
1255         case GITS_CMD_MOVI:
1256             result = process_movi(s, cmdpkt);
1257             break;
1258         case GITS_CMD_MOVALL:
1259             result = process_movall(s, cmdpkt);
1260             break;
1261         case GITS_CMD_VMAPTI:
1262             result = process_vmapti(s, cmdpkt, false);
1263             break;
1264         case GITS_CMD_VMAPI:
1265             result = process_vmapti(s, cmdpkt, true);
1266             break;
1267         case GITS_CMD_VMAPP:
1268             result = process_vmapp(s, cmdpkt);
1269             break;
1270         case GITS_CMD_VMOVP:
1271             result = process_vmovp(s, cmdpkt);
1272             break;
1273         default:
1274             trace_gicv3_its_cmd_unknown(cmd);
1275             break;
1276         }
1277         if (result != CMD_STALL) {
1278             /* CMD_CONTINUE or CMD_CONTINUE_OK */
1279             rd_offset++;
1280             rd_offset %= s->cq.num_entries;
1281             s->creadr = FIELD_DP64(s->creadr, GITS_CREADR, OFFSET, rd_offset);
1282         } else {
1283             /* CMD_STALL */
1284             s->creadr = FIELD_DP64(s->creadr, GITS_CREADR, STALLED, 1);
1285             qemu_log_mask(LOG_GUEST_ERROR,
1286                           "%s: 0x%x cmd processing failed, stalling\n",
1287                           __func__, cmd);
1288             break;
1289         }
1290     }
1291 }
1292 
1293 /*
1294  * This function extracts the ITS Device and Collection table specific
1295  * parameters (like base_addr, size etc) from GITS_BASER register.
1296  * It is called during ITS enable and also during post_load migration
1297  */
1298 static void extract_table_params(GICv3ITSState *s)
1299 {
1300     uint16_t num_pages = 0;
1301     uint8_t  page_sz_type;
1302     uint8_t type;
1303     uint32_t page_sz = 0;
1304     uint64_t value;
1305 
1306     for (int i = 0; i < 8; i++) {
1307         TableDesc *td;
1308         int idbits;
1309 
1310         value = s->baser[i];
1311 
1312         if (!value) {
1313             continue;
1314         }
1315 
1316         page_sz_type = FIELD_EX64(value, GITS_BASER, PAGESIZE);
1317 
1318         switch (page_sz_type) {
1319         case 0:
1320             page_sz = GITS_PAGE_SIZE_4K;
1321             break;
1322 
1323         case 1:
1324             page_sz = GITS_PAGE_SIZE_16K;
1325             break;
1326 
1327         case 2:
1328         case 3:
1329             page_sz = GITS_PAGE_SIZE_64K;
1330             break;
1331 
1332         default:
1333             g_assert_not_reached();
1334         }
1335 
1336         num_pages = FIELD_EX64(value, GITS_BASER, SIZE) + 1;
1337 
1338         type = FIELD_EX64(value, GITS_BASER, TYPE);
1339 
1340         switch (type) {
1341         case GITS_BASER_TYPE_DEVICE:
1342             td = &s->dt;
1343             idbits = FIELD_EX64(s->typer, GITS_TYPER, DEVBITS) + 1;
1344             break;
1345         case GITS_BASER_TYPE_COLLECTION:
1346             td = &s->ct;
1347             if (FIELD_EX64(s->typer, GITS_TYPER, CIL)) {
1348                 idbits = FIELD_EX64(s->typer, GITS_TYPER, CIDBITS) + 1;
1349             } else {
1350                 /* 16-bit CollectionId supported when CIL == 0 */
1351                 idbits = 16;
1352             }
1353             break;
1354         case GITS_BASER_TYPE_VPE:
1355             td = &s->vpet;
1356             /*
1357              * For QEMU vPEIDs are always 16 bits. (GICv4.1 allows an
1358              * implementation to implement fewer bits and report this
1359              * via GICD_TYPER2.)
1360              */
1361             idbits = 16;
1362             break;
1363         default:
1364             /*
1365              * GITS_BASER<n>.TYPE is read-only, so GITS_BASER_RO_MASK
1366              * ensures we will only see type values corresponding to
1367              * the values set up in gicv3_its_reset().
1368              */
1369             g_assert_not_reached();
1370         }
1371 
1372         memset(td, 0, sizeof(*td));
1373         /*
1374          * If GITS_BASER<n>.Valid is 0 for any <n> then we will not process
1375          * interrupts. (GITS_TYPER.HCC is 0 for this implementation, so we
1376          * do not have a special case where the GITS_BASER<n>.Valid bit is 0
1377          * for the register corresponding to the Collection table but we
1378          * still have to process interrupts using non-memory-backed
1379          * Collection table entries.)
1380          * The specification makes it UNPREDICTABLE to enable the ITS without
1381          * marking each BASER<n> as valid. We choose to handle these as if
1382          * the table was zero-sized, so commands using the table will fail
1383          * and interrupts requested via GITS_TRANSLATER writes will be ignored.
1384          * This happens automatically by leaving the num_entries field at
1385          * zero, which will be caught by the bounds checks we have before
1386          * every table lookup anyway.
1387          */
1388         if (!FIELD_EX64(value, GITS_BASER, VALID)) {
1389             continue;
1390         }
1391         td->page_sz = page_sz;
1392         td->indirect = FIELD_EX64(value, GITS_BASER, INDIRECT);
1393         td->entry_sz = FIELD_EX64(value, GITS_BASER, ENTRYSIZE) + 1;
1394         td->base_addr = baser_base_addr(value, page_sz);
1395         if (!td->indirect) {
1396             td->num_entries = (num_pages * page_sz) / td->entry_sz;
1397         } else {
1398             td->num_entries = (((num_pages * page_sz) /
1399                                   L1TABLE_ENTRY_SIZE) *
1400                                  (page_sz / td->entry_sz));
1401         }
1402         td->num_entries = MIN(td->num_entries, 1ULL << idbits);
1403     }
1404 }
1405 
1406 static void extract_cmdq_params(GICv3ITSState *s)
1407 {
1408     uint16_t num_pages = 0;
1409     uint64_t value = s->cbaser;
1410 
1411     num_pages = FIELD_EX64(value, GITS_CBASER, SIZE) + 1;
1412 
1413     memset(&s->cq, 0 , sizeof(s->cq));
1414 
1415     if (FIELD_EX64(value, GITS_CBASER, VALID)) {
1416         s->cq.num_entries = (num_pages * GITS_PAGE_SIZE_4K) /
1417                              GITS_CMDQ_ENTRY_SIZE;
1418         s->cq.base_addr = FIELD_EX64(value, GITS_CBASER, PHYADDR);
1419         s->cq.base_addr <<= R_GITS_CBASER_PHYADDR_SHIFT;
1420     }
1421 }
1422 
1423 static MemTxResult gicv3_its_translation_read(void *opaque, hwaddr offset,
1424                                               uint64_t *data, unsigned size,
1425                                               MemTxAttrs attrs)
1426 {
1427     /*
1428      * GITS_TRANSLATER is write-only, and all other addresses
1429      * in the interrupt translation space frame are RES0.
1430      */
1431     *data = 0;
1432     return MEMTX_OK;
1433 }
1434 
1435 static MemTxResult gicv3_its_translation_write(void *opaque, hwaddr offset,
1436                                                uint64_t data, unsigned size,
1437                                                MemTxAttrs attrs)
1438 {
1439     GICv3ITSState *s = (GICv3ITSState *)opaque;
1440     bool result = true;
1441 
1442     trace_gicv3_its_translation_write(offset, data, size, attrs.requester_id);
1443 
1444     switch (offset) {
1445     case GITS_TRANSLATER:
1446         if (s->ctlr & R_GITS_CTLR_ENABLED_MASK) {
1447             result = do_process_its_cmd(s, attrs.requester_id, data, NONE);
1448         }
1449         break;
1450     default:
1451         break;
1452     }
1453 
1454     if (result) {
1455         return MEMTX_OK;
1456     } else {
1457         return MEMTX_ERROR;
1458     }
1459 }
1460 
1461 static bool its_writel(GICv3ITSState *s, hwaddr offset,
1462                               uint64_t value, MemTxAttrs attrs)
1463 {
1464     bool result = true;
1465     int index;
1466 
1467     switch (offset) {
1468     case GITS_CTLR:
1469         if (value & R_GITS_CTLR_ENABLED_MASK) {
1470             s->ctlr |= R_GITS_CTLR_ENABLED_MASK;
1471             extract_table_params(s);
1472             extract_cmdq_params(s);
1473             process_cmdq(s);
1474         } else {
1475             s->ctlr &= ~R_GITS_CTLR_ENABLED_MASK;
1476         }
1477         break;
1478     case GITS_CBASER:
1479         /*
1480          * IMPDEF choice:- GITS_CBASER register becomes RO if ITS is
1481          *                 already enabled
1482          */
1483         if (!(s->ctlr & R_GITS_CTLR_ENABLED_MASK)) {
1484             s->cbaser = deposit64(s->cbaser, 0, 32, value);
1485             s->creadr = 0;
1486         }
1487         break;
1488     case GITS_CBASER + 4:
1489         /*
1490          * IMPDEF choice:- GITS_CBASER register becomes RO if ITS is
1491          *                 already enabled
1492          */
1493         if (!(s->ctlr & R_GITS_CTLR_ENABLED_MASK)) {
1494             s->cbaser = deposit64(s->cbaser, 32, 32, value);
1495             s->creadr = 0;
1496         }
1497         break;
1498     case GITS_CWRITER:
1499         s->cwriter = deposit64(s->cwriter, 0, 32,
1500                                (value & ~R_GITS_CWRITER_RETRY_MASK));
1501         if (s->cwriter != s->creadr) {
1502             process_cmdq(s);
1503         }
1504         break;
1505     case GITS_CWRITER + 4:
1506         s->cwriter = deposit64(s->cwriter, 32, 32, value);
1507         break;
1508     case GITS_CREADR:
1509         if (s->gicv3->gicd_ctlr & GICD_CTLR_DS) {
1510             s->creadr = deposit64(s->creadr, 0, 32,
1511                                   (value & ~R_GITS_CREADR_STALLED_MASK));
1512         } else {
1513             /* RO register, ignore the write */
1514             qemu_log_mask(LOG_GUEST_ERROR,
1515                           "%s: invalid guest write to RO register at offset "
1516                           TARGET_FMT_plx "\n", __func__, offset);
1517         }
1518         break;
1519     case GITS_CREADR + 4:
1520         if (s->gicv3->gicd_ctlr & GICD_CTLR_DS) {
1521             s->creadr = deposit64(s->creadr, 32, 32, value);
1522         } else {
1523             /* RO register, ignore the write */
1524             qemu_log_mask(LOG_GUEST_ERROR,
1525                           "%s: invalid guest write to RO register at offset "
1526                           TARGET_FMT_plx "\n", __func__, offset);
1527         }
1528         break;
1529     case GITS_BASER ... GITS_BASER + 0x3f:
1530         /*
1531          * IMPDEF choice:- GITS_BASERn register becomes RO if ITS is
1532          *                 already enabled
1533          */
1534         if (!(s->ctlr & R_GITS_CTLR_ENABLED_MASK)) {
1535             index = (offset - GITS_BASER) / 8;
1536 
1537             if (s->baser[index] == 0) {
1538                 /* Unimplemented GITS_BASERn: RAZ/WI */
1539                 break;
1540             }
1541             if (offset & 7) {
1542                 value <<= 32;
1543                 value &= ~GITS_BASER_RO_MASK;
1544                 s->baser[index] &= GITS_BASER_RO_MASK | MAKE_64BIT_MASK(0, 32);
1545                 s->baser[index] |= value;
1546             } else {
1547                 value &= ~GITS_BASER_RO_MASK;
1548                 s->baser[index] &= GITS_BASER_RO_MASK | MAKE_64BIT_MASK(32, 32);
1549                 s->baser[index] |= value;
1550             }
1551         }
1552         break;
1553     case GITS_IIDR:
1554     case GITS_IDREGS ... GITS_IDREGS + 0x2f:
1555         /* RO registers, ignore the write */
1556         qemu_log_mask(LOG_GUEST_ERROR,
1557                       "%s: invalid guest write to RO register at offset "
1558                       TARGET_FMT_plx "\n", __func__, offset);
1559         break;
1560     default:
1561         result = false;
1562         break;
1563     }
1564     return result;
1565 }
1566 
1567 static bool its_readl(GICv3ITSState *s, hwaddr offset,
1568                              uint64_t *data, MemTxAttrs attrs)
1569 {
1570     bool result = true;
1571     int index;
1572 
1573     switch (offset) {
1574     case GITS_CTLR:
1575         *data = s->ctlr;
1576         break;
1577     case GITS_IIDR:
1578         *data = gicv3_iidr();
1579         break;
1580     case GITS_IDREGS ... GITS_IDREGS + 0x2f:
1581         /* ID registers */
1582         *data = gicv3_idreg(offset - GITS_IDREGS, GICV3_PIDR0_ITS);
1583         break;
1584     case GITS_TYPER:
1585         *data = extract64(s->typer, 0, 32);
1586         break;
1587     case GITS_TYPER + 4:
1588         *data = extract64(s->typer, 32, 32);
1589         break;
1590     case GITS_CBASER:
1591         *data = extract64(s->cbaser, 0, 32);
1592         break;
1593     case GITS_CBASER + 4:
1594         *data = extract64(s->cbaser, 32, 32);
1595         break;
1596     case GITS_CREADR:
1597         *data = extract64(s->creadr, 0, 32);
1598         break;
1599     case GITS_CREADR + 4:
1600         *data = extract64(s->creadr, 32, 32);
1601         break;
1602     case GITS_CWRITER:
1603         *data = extract64(s->cwriter, 0, 32);
1604         break;
1605     case GITS_CWRITER + 4:
1606         *data = extract64(s->cwriter, 32, 32);
1607         break;
1608     case GITS_BASER ... GITS_BASER + 0x3f:
1609         index = (offset - GITS_BASER) / 8;
1610         if (offset & 7) {
1611             *data = extract64(s->baser[index], 32, 32);
1612         } else {
1613             *data = extract64(s->baser[index], 0, 32);
1614         }
1615         break;
1616     default:
1617         result = false;
1618         break;
1619     }
1620     return result;
1621 }
1622 
1623 static bool its_writell(GICv3ITSState *s, hwaddr offset,
1624                                uint64_t value, MemTxAttrs attrs)
1625 {
1626     bool result = true;
1627     int index;
1628 
1629     switch (offset) {
1630     case GITS_BASER ... GITS_BASER + 0x3f:
1631         /*
1632          * IMPDEF choice:- GITS_BASERn register becomes RO if ITS is
1633          *                 already enabled
1634          */
1635         if (!(s->ctlr & R_GITS_CTLR_ENABLED_MASK)) {
1636             index = (offset - GITS_BASER) / 8;
1637             if (s->baser[index] == 0) {
1638                 /* Unimplemented GITS_BASERn: RAZ/WI */
1639                 break;
1640             }
1641             s->baser[index] &= GITS_BASER_RO_MASK;
1642             s->baser[index] |= (value & ~GITS_BASER_RO_MASK);
1643         }
1644         break;
1645     case GITS_CBASER:
1646         /*
1647          * IMPDEF choice:- GITS_CBASER register becomes RO if ITS is
1648          *                 already enabled
1649          */
1650         if (!(s->ctlr & R_GITS_CTLR_ENABLED_MASK)) {
1651             s->cbaser = value;
1652             s->creadr = 0;
1653         }
1654         break;
1655     case GITS_CWRITER:
1656         s->cwriter = value & ~R_GITS_CWRITER_RETRY_MASK;
1657         if (s->cwriter != s->creadr) {
1658             process_cmdq(s);
1659         }
1660         break;
1661     case GITS_CREADR:
1662         if (s->gicv3->gicd_ctlr & GICD_CTLR_DS) {
1663             s->creadr = value & ~R_GITS_CREADR_STALLED_MASK;
1664         } else {
1665             /* RO register, ignore the write */
1666             qemu_log_mask(LOG_GUEST_ERROR,
1667                           "%s: invalid guest write to RO register at offset "
1668                           TARGET_FMT_plx "\n", __func__, offset);
1669         }
1670         break;
1671     case GITS_TYPER:
1672         /* RO registers, ignore the write */
1673         qemu_log_mask(LOG_GUEST_ERROR,
1674                       "%s: invalid guest write to RO register at offset "
1675                       TARGET_FMT_plx "\n", __func__, offset);
1676         break;
1677     default:
1678         result = false;
1679         break;
1680     }
1681     return result;
1682 }
1683 
1684 static bool its_readll(GICv3ITSState *s, hwaddr offset,
1685                               uint64_t *data, MemTxAttrs attrs)
1686 {
1687     bool result = true;
1688     int index;
1689 
1690     switch (offset) {
1691     case GITS_TYPER:
1692         *data = s->typer;
1693         break;
1694     case GITS_BASER ... GITS_BASER + 0x3f:
1695         index = (offset - GITS_BASER) / 8;
1696         *data = s->baser[index];
1697         break;
1698     case GITS_CBASER:
1699         *data = s->cbaser;
1700         break;
1701     case GITS_CREADR:
1702         *data = s->creadr;
1703         break;
1704     case GITS_CWRITER:
1705         *data = s->cwriter;
1706         break;
1707     default:
1708         result = false;
1709         break;
1710     }
1711     return result;
1712 }
1713 
1714 static MemTxResult gicv3_its_read(void *opaque, hwaddr offset, uint64_t *data,
1715                                   unsigned size, MemTxAttrs attrs)
1716 {
1717     GICv3ITSState *s = (GICv3ITSState *)opaque;
1718     bool result;
1719 
1720     switch (size) {
1721     case 4:
1722         result = its_readl(s, offset, data, attrs);
1723         break;
1724     case 8:
1725         result = its_readll(s, offset, data, attrs);
1726         break;
1727     default:
1728         result = false;
1729         break;
1730     }
1731 
1732     if (!result) {
1733         qemu_log_mask(LOG_GUEST_ERROR,
1734                       "%s: invalid guest read at offset " TARGET_FMT_plx
1735                       " size %u\n", __func__, offset, size);
1736         trace_gicv3_its_badread(offset, size);
1737         /*
1738          * The spec requires that reserved registers are RAZ/WI;
1739          * so use false returns from leaf functions as a way to
1740          * trigger the guest-error logging but don't return it to
1741          * the caller, or we'll cause a spurious guest data abort.
1742          */
1743         *data = 0;
1744     } else {
1745         trace_gicv3_its_read(offset, *data, size);
1746     }
1747     return MEMTX_OK;
1748 }
1749 
1750 static MemTxResult gicv3_its_write(void *opaque, hwaddr offset, uint64_t data,
1751                                    unsigned size, MemTxAttrs attrs)
1752 {
1753     GICv3ITSState *s = (GICv3ITSState *)opaque;
1754     bool result;
1755 
1756     switch (size) {
1757     case 4:
1758         result = its_writel(s, offset, data, attrs);
1759         break;
1760     case 8:
1761         result = its_writell(s, offset, data, attrs);
1762         break;
1763     default:
1764         result = false;
1765         break;
1766     }
1767 
1768     if (!result) {
1769         qemu_log_mask(LOG_GUEST_ERROR,
1770                       "%s: invalid guest write at offset " TARGET_FMT_plx
1771                       " size %u\n", __func__, offset, size);
1772         trace_gicv3_its_badwrite(offset, data, size);
1773         /*
1774          * The spec requires that reserved registers are RAZ/WI;
1775          * so use false returns from leaf functions as a way to
1776          * trigger the guest-error logging but don't return it to
1777          * the caller, or we'll cause a spurious guest data abort.
1778          */
1779     } else {
1780         trace_gicv3_its_write(offset, data, size);
1781     }
1782     return MEMTX_OK;
1783 }
1784 
1785 static const MemoryRegionOps gicv3_its_control_ops = {
1786     .read_with_attrs = gicv3_its_read,
1787     .write_with_attrs = gicv3_its_write,
1788     .valid.min_access_size = 4,
1789     .valid.max_access_size = 8,
1790     .impl.min_access_size = 4,
1791     .impl.max_access_size = 8,
1792     .endianness = DEVICE_NATIVE_ENDIAN,
1793 };
1794 
1795 static const MemoryRegionOps gicv3_its_translation_ops = {
1796     .read_with_attrs = gicv3_its_translation_read,
1797     .write_with_attrs = gicv3_its_translation_write,
1798     .valid.min_access_size = 2,
1799     .valid.max_access_size = 4,
1800     .impl.min_access_size = 2,
1801     .impl.max_access_size = 4,
1802     .endianness = DEVICE_NATIVE_ENDIAN,
1803 };
1804 
1805 static void gicv3_arm_its_realize(DeviceState *dev, Error **errp)
1806 {
1807     GICv3ITSState *s = ARM_GICV3_ITS_COMMON(dev);
1808     int i;
1809 
1810     for (i = 0; i < s->gicv3->num_cpu; i++) {
1811         if (!(s->gicv3->cpu[i].gicr_typer & GICR_TYPER_PLPIS)) {
1812             error_setg(errp, "Physical LPI not supported by CPU %d", i);
1813             return;
1814         }
1815     }
1816 
1817     gicv3_add_its(s->gicv3, dev);
1818 
1819     gicv3_its_init_mmio(s, &gicv3_its_control_ops, &gicv3_its_translation_ops);
1820 
1821     /* set the ITS default features supported */
1822     s->typer = FIELD_DP64(s->typer, GITS_TYPER, PHYSICAL, 1);
1823     s->typer = FIELD_DP64(s->typer, GITS_TYPER, ITT_ENTRY_SIZE,
1824                           ITS_ITT_ENTRY_SIZE - 1);
1825     s->typer = FIELD_DP64(s->typer, GITS_TYPER, IDBITS, ITS_IDBITS);
1826     s->typer = FIELD_DP64(s->typer, GITS_TYPER, DEVBITS, ITS_DEVBITS);
1827     s->typer = FIELD_DP64(s->typer, GITS_TYPER, CIL, 1);
1828     s->typer = FIELD_DP64(s->typer, GITS_TYPER, CIDBITS, ITS_CIDBITS);
1829 }
1830 
1831 static void gicv3_its_reset(DeviceState *dev)
1832 {
1833     GICv3ITSState *s = ARM_GICV3_ITS_COMMON(dev);
1834     GICv3ITSClass *c = ARM_GICV3_ITS_GET_CLASS(s);
1835 
1836     c->parent_reset(dev);
1837 
1838     /* Quiescent bit reset to 1 */
1839     s->ctlr = FIELD_DP32(s->ctlr, GITS_CTLR, QUIESCENT, 1);
1840 
1841     /*
1842      * setting GITS_BASER0.Type = 0b001 (Device)
1843      *         GITS_BASER1.Type = 0b100 (Collection Table)
1844      *         GITS_BASER2.Type = 0b010 (vPE) for GICv4 and later
1845      *         GITS_BASER<n>.Type,where n = 3 to 7 are 0b00 (Unimplemented)
1846      *         GITS_BASER<0,1>.Page_Size = 64KB
1847      * and default translation table entry size to 16 bytes
1848      */
1849     s->baser[0] = FIELD_DP64(s->baser[0], GITS_BASER, TYPE,
1850                              GITS_BASER_TYPE_DEVICE);
1851     s->baser[0] = FIELD_DP64(s->baser[0], GITS_BASER, PAGESIZE,
1852                              GITS_BASER_PAGESIZE_64K);
1853     s->baser[0] = FIELD_DP64(s->baser[0], GITS_BASER, ENTRYSIZE,
1854                              GITS_DTE_SIZE - 1);
1855 
1856     s->baser[1] = FIELD_DP64(s->baser[1], GITS_BASER, TYPE,
1857                              GITS_BASER_TYPE_COLLECTION);
1858     s->baser[1] = FIELD_DP64(s->baser[1], GITS_BASER, PAGESIZE,
1859                              GITS_BASER_PAGESIZE_64K);
1860     s->baser[1] = FIELD_DP64(s->baser[1], GITS_BASER, ENTRYSIZE,
1861                              GITS_CTE_SIZE - 1);
1862 
1863     if (its_feature_virtual(s)) {
1864         s->baser[2] = FIELD_DP64(s->baser[2], GITS_BASER, TYPE,
1865                                  GITS_BASER_TYPE_VPE);
1866         s->baser[2] = FIELD_DP64(s->baser[2], GITS_BASER, PAGESIZE,
1867                                  GITS_BASER_PAGESIZE_64K);
1868         s->baser[2] = FIELD_DP64(s->baser[2], GITS_BASER, ENTRYSIZE,
1869                                  GITS_VPE_SIZE - 1);
1870     }
1871 }
1872 
1873 static void gicv3_its_post_load(GICv3ITSState *s)
1874 {
1875     if (s->ctlr & R_GITS_CTLR_ENABLED_MASK) {
1876         extract_table_params(s);
1877         extract_cmdq_params(s);
1878     }
1879 }
1880 
1881 static Property gicv3_its_props[] = {
1882     DEFINE_PROP_LINK("parent-gicv3", GICv3ITSState, gicv3, "arm-gicv3",
1883                      GICv3State *),
1884     DEFINE_PROP_END_OF_LIST(),
1885 };
1886 
1887 static void gicv3_its_class_init(ObjectClass *klass, void *data)
1888 {
1889     DeviceClass *dc = DEVICE_CLASS(klass);
1890     GICv3ITSClass *ic = ARM_GICV3_ITS_CLASS(klass);
1891     GICv3ITSCommonClass *icc = ARM_GICV3_ITS_COMMON_CLASS(klass);
1892 
1893     dc->realize = gicv3_arm_its_realize;
1894     device_class_set_props(dc, gicv3_its_props);
1895     device_class_set_parent_reset(dc, gicv3_its_reset, &ic->parent_reset);
1896     icc->post_load = gicv3_its_post_load;
1897 }
1898 
1899 static const TypeInfo gicv3_its_info = {
1900     .name = TYPE_ARM_GICV3_ITS,
1901     .parent = TYPE_ARM_GICV3_ITS_COMMON,
1902     .instance_size = sizeof(GICv3ITSState),
1903     .class_init = gicv3_its_class_init,
1904     .class_size = sizeof(GICv3ITSClass),
1905 };
1906 
1907 static void gicv3_its_register_types(void)
1908 {
1909     type_register_static(&gicv3_its_info);
1910 }
1911 
1912 type_init(gicv3_its_register_types)
1913