xref: /openbmc/qemu/hw/intc/arm_gicv3_its.c (revision d4014320a430d2ac07f896b9ce38778258060deb)
1 /*
2  * ITS emulation for a GICv3-based system
3  *
4  * Copyright Linaro.org 2021
5  *
6  * Authors:
7  *  Shashi Mallela <shashi.mallela@linaro.org>
8  *
9  * This work is licensed under the terms of the GNU GPL, version 2 or (at your
10  * option) any later version.  See the COPYING file in the top-level directory.
11  *
12  */
13 
14 #include "qemu/osdep.h"
15 #include "qemu/log.h"
16 #include "trace.h"
17 #include "hw/qdev-properties.h"
18 #include "hw/intc/arm_gicv3_its_common.h"
19 #include "gicv3_internal.h"
20 #include "qom/object.h"
21 #include "qapi/error.h"
22 
23 typedef struct GICv3ITSClass GICv3ITSClass;
24 /* This is reusing the GICv3ITSState typedef from ARM_GICV3_ITS_COMMON */
25 DECLARE_OBJ_CHECKERS(GICv3ITSState, GICv3ITSClass,
26                      ARM_GICV3_ITS, TYPE_ARM_GICV3_ITS)
27 
28 struct GICv3ITSClass {
29     GICv3ITSCommonClass parent_class;
30     void (*parent_reset)(DeviceState *dev);
31 };
32 
33 /*
34  * This is an internal enum used to distinguish between LPI triggered
35  * via command queue and LPI triggered via gits_translater write.
36  */
37 typedef enum ItsCmdType {
38     NONE = 0, /* internal indication for GITS_TRANSLATER write */
39     CLEAR = 1,
40     DISCARD = 2,
41     INTERRUPT = 3,
42 } ItsCmdType;
43 
44 typedef struct DTEntry {
45     bool valid;
46     unsigned size;
47     uint64_t ittaddr;
48 } DTEntry;
49 
50 typedef struct CTEntry {
51     bool valid;
52     uint32_t rdbase;
53 } CTEntry;
54 
55 typedef struct ITEntry {
56     bool valid;
57     int inttype;
58     uint32_t intid;
59     uint32_t doorbell;
60     uint32_t icid;
61     uint32_t vpeid;
62 } ITEntry;
63 
64 typedef struct VTEntry {
65     bool valid;
66     unsigned vptsize;
67     uint32_t rdbase;
68     uint64_t vptaddr;
69 } VTEntry;
70 
71 /*
72  * The ITS spec permits a range of CONSTRAINED UNPREDICTABLE options
73  * if a command parameter is not correct. These include both "stall
74  * processing of the command queue" and "ignore this command, and
75  * keep processing the queue". In our implementation we choose that
76  * memory transaction errors reading the command packet provoke a
77  * stall, but errors in parameters cause us to ignore the command
78  * and continue processing.
79  * The process_* functions which handle individual ITS commands all
80  * return an ItsCmdResult which tells process_cmdq() whether it should
81  * stall, keep going because of an error, or keep going because the
82  * command was a success.
83  */
84 typedef enum ItsCmdResult {
85     CMD_STALL = 0,
86     CMD_CONTINUE = 1,
87     CMD_CONTINUE_OK = 2,
88 } ItsCmdResult;
89 
90 /* True if the ITS supports the GICv4 virtual LPI feature */
91 static bool its_feature_virtual(GICv3ITSState *s)
92 {
93     return s->typer & R_GITS_TYPER_VIRTUAL_MASK;
94 }
95 
96 static inline bool intid_in_lpi_range(uint32_t id)
97 {
98     return id >= GICV3_LPI_INTID_START &&
99         id < (1 << (GICD_TYPER_IDBITS + 1));
100 }
101 
102 static inline bool valid_doorbell(uint32_t id)
103 {
104     /* Doorbell fields may be an LPI, or 1023 to mean "no doorbell" */
105     return id == INTID_SPURIOUS || intid_in_lpi_range(id);
106 }
107 
108 static uint64_t baser_base_addr(uint64_t value, uint32_t page_sz)
109 {
110     uint64_t result = 0;
111 
112     switch (page_sz) {
113     case GITS_PAGE_SIZE_4K:
114     case GITS_PAGE_SIZE_16K:
115         result = FIELD_EX64(value, GITS_BASER, PHYADDR) << 12;
116         break;
117 
118     case GITS_PAGE_SIZE_64K:
119         result = FIELD_EX64(value, GITS_BASER, PHYADDRL_64K) << 16;
120         result |= FIELD_EX64(value, GITS_BASER, PHYADDRH_64K) << 48;
121         break;
122 
123     default:
124         break;
125     }
126     return result;
127 }
128 
129 static uint64_t table_entry_addr(GICv3ITSState *s, TableDesc *td,
130                                  uint32_t idx, MemTxResult *res)
131 {
132     /*
133      * Given a TableDesc describing one of the ITS in-guest-memory
134      * tables and an index into it, return the guest address
135      * corresponding to that table entry.
136      * If there was a memory error reading the L1 table of an
137      * indirect table, *res is set accordingly, and we return -1.
138      * If the L1 table entry is marked not valid, we return -1 with
139      * *res set to MEMTX_OK.
140      *
141      * The specification defines the format of level 1 entries of a
142      * 2-level table, but the format of level 2 entries and the format
143      * of flat-mapped tables is IMPDEF.
144      */
145     AddressSpace *as = &s->gicv3->dma_as;
146     uint32_t l2idx;
147     uint64_t l2;
148     uint32_t num_l2_entries;
149 
150     *res = MEMTX_OK;
151 
152     if (!td->indirect) {
153         /* Single level table */
154         return td->base_addr + idx * td->entry_sz;
155     }
156 
157     /* Two level table */
158     l2idx = idx / (td->page_sz / L1TABLE_ENTRY_SIZE);
159 
160     l2 = address_space_ldq_le(as,
161                               td->base_addr + (l2idx * L1TABLE_ENTRY_SIZE),
162                               MEMTXATTRS_UNSPECIFIED, res);
163     if (*res != MEMTX_OK) {
164         return -1;
165     }
166     if (!(l2 & L2_TABLE_VALID_MASK)) {
167         return -1;
168     }
169 
170     num_l2_entries = td->page_sz / td->entry_sz;
171     return (l2 & ((1ULL << 51) - 1)) + (idx % num_l2_entries) * td->entry_sz;
172 }
173 
174 /*
175  * Read the Collection Table entry at index @icid. On success (including
176  * successfully determining that there is no valid CTE for this index),
177  * we return MEMTX_OK and populate the CTEntry struct @cte accordingly.
178  * If there is an error reading memory then we return the error code.
179  */
180 static MemTxResult get_cte(GICv3ITSState *s, uint16_t icid, CTEntry *cte)
181 {
182     AddressSpace *as = &s->gicv3->dma_as;
183     MemTxResult res = MEMTX_OK;
184     uint64_t entry_addr = table_entry_addr(s, &s->ct, icid, &res);
185     uint64_t cteval;
186 
187     if (entry_addr == -1) {
188         /* No L2 table entry, i.e. no valid CTE, or a memory error */
189         cte->valid = false;
190         goto out;
191     }
192 
193     cteval = address_space_ldq_le(as, entry_addr, MEMTXATTRS_UNSPECIFIED, &res);
194     if (res != MEMTX_OK) {
195         goto out;
196     }
197     cte->valid = FIELD_EX64(cteval, CTE, VALID);
198     cte->rdbase = FIELD_EX64(cteval, CTE, RDBASE);
199 out:
200     if (res != MEMTX_OK) {
201         trace_gicv3_its_cte_read_fault(icid);
202     } else {
203         trace_gicv3_its_cte_read(icid, cte->valid, cte->rdbase);
204     }
205     return res;
206 }
207 
208 /*
209  * Update the Interrupt Table entry at index @evinted in the table specified
210  * by the dte @dte. Returns true on success, false if there was a memory
211  * access error.
212  */
213 static bool update_ite(GICv3ITSState *s, uint32_t eventid, const DTEntry *dte,
214                        const ITEntry *ite)
215 {
216     AddressSpace *as = &s->gicv3->dma_as;
217     MemTxResult res = MEMTX_OK;
218     hwaddr iteaddr = dte->ittaddr + eventid * ITS_ITT_ENTRY_SIZE;
219     uint64_t itel = 0;
220     uint32_t iteh = 0;
221 
222     trace_gicv3_its_ite_write(dte->ittaddr, eventid, ite->valid,
223                               ite->inttype, ite->intid, ite->icid,
224                               ite->vpeid, ite->doorbell);
225 
226     if (ite->valid) {
227         itel = FIELD_DP64(itel, ITE_L, VALID, 1);
228         itel = FIELD_DP64(itel, ITE_L, INTTYPE, ite->inttype);
229         itel = FIELD_DP64(itel, ITE_L, INTID, ite->intid);
230         itel = FIELD_DP64(itel, ITE_L, ICID, ite->icid);
231         itel = FIELD_DP64(itel, ITE_L, VPEID, ite->vpeid);
232         iteh = FIELD_DP32(iteh, ITE_H, DOORBELL, ite->doorbell);
233     }
234 
235     address_space_stq_le(as, iteaddr, itel, MEMTXATTRS_UNSPECIFIED, &res);
236     if (res != MEMTX_OK) {
237         return false;
238     }
239     address_space_stl_le(as, iteaddr + 8, iteh, MEMTXATTRS_UNSPECIFIED, &res);
240     return res == MEMTX_OK;
241 }
242 
243 /*
244  * Read the Interrupt Table entry at index @eventid from the table specified
245  * by the DTE @dte. On success, we return MEMTX_OK and populate the ITEntry
246  * struct @ite accordingly. If there is an error reading memory then we return
247  * the error code.
248  */
249 static MemTxResult get_ite(GICv3ITSState *s, uint32_t eventid,
250                            const DTEntry *dte, ITEntry *ite)
251 {
252     AddressSpace *as = &s->gicv3->dma_as;
253     MemTxResult res = MEMTX_OK;
254     uint64_t itel;
255     uint32_t iteh;
256     hwaddr iteaddr = dte->ittaddr + eventid * ITS_ITT_ENTRY_SIZE;
257 
258     itel = address_space_ldq_le(as, iteaddr, MEMTXATTRS_UNSPECIFIED, &res);
259     if (res != MEMTX_OK) {
260         trace_gicv3_its_ite_read_fault(dte->ittaddr, eventid);
261         return res;
262     }
263 
264     iteh = address_space_ldl_le(as, iteaddr + 8, MEMTXATTRS_UNSPECIFIED, &res);
265     if (res != MEMTX_OK) {
266         trace_gicv3_its_ite_read_fault(dte->ittaddr, eventid);
267         return res;
268     }
269 
270     ite->valid = FIELD_EX64(itel, ITE_L, VALID);
271     ite->inttype = FIELD_EX64(itel, ITE_L, INTTYPE);
272     ite->intid = FIELD_EX64(itel, ITE_L, INTID);
273     ite->icid = FIELD_EX64(itel, ITE_L, ICID);
274     ite->vpeid = FIELD_EX64(itel, ITE_L, VPEID);
275     ite->doorbell = FIELD_EX64(iteh, ITE_H, DOORBELL);
276     trace_gicv3_its_ite_read(dte->ittaddr, eventid, ite->valid,
277                              ite->inttype, ite->intid, ite->icid,
278                              ite->vpeid, ite->doorbell);
279     return MEMTX_OK;
280 }
281 
282 /*
283  * Read the Device Table entry at index @devid. On success (including
284  * successfully determining that there is no valid DTE for this index),
285  * we return MEMTX_OK and populate the DTEntry struct accordingly.
286  * If there is an error reading memory then we return the error code.
287  */
288 static MemTxResult get_dte(GICv3ITSState *s, uint32_t devid, DTEntry *dte)
289 {
290     MemTxResult res = MEMTX_OK;
291     AddressSpace *as = &s->gicv3->dma_as;
292     uint64_t entry_addr = table_entry_addr(s, &s->dt, devid, &res);
293     uint64_t dteval;
294 
295     if (entry_addr == -1) {
296         /* No L2 table entry, i.e. no valid DTE, or a memory error */
297         dte->valid = false;
298         goto out;
299     }
300     dteval = address_space_ldq_le(as, entry_addr, MEMTXATTRS_UNSPECIFIED, &res);
301     if (res != MEMTX_OK) {
302         goto out;
303     }
304     dte->valid = FIELD_EX64(dteval, DTE, VALID);
305     dte->size = FIELD_EX64(dteval, DTE, SIZE);
306     /* DTE word field stores bits [51:8] of the ITT address */
307     dte->ittaddr = FIELD_EX64(dteval, DTE, ITTADDR) << ITTADDR_SHIFT;
308 out:
309     if (res != MEMTX_OK) {
310         trace_gicv3_its_dte_read_fault(devid);
311     } else {
312         trace_gicv3_its_dte_read(devid, dte->valid, dte->size, dte->ittaddr);
313     }
314     return res;
315 }
316 
317 /*
318  * Read the vPE Table entry at index @vpeid. On success (including
319  * successfully determining that there is no valid entry for this index),
320  * we return MEMTX_OK and populate the VTEntry struct accordingly.
321  * If there is an error reading memory then we return the error code.
322  */
323 static MemTxResult get_vte(GICv3ITSState *s, uint32_t vpeid, VTEntry *vte)
324 {
325     MemTxResult res = MEMTX_OK;
326     AddressSpace *as = &s->gicv3->dma_as;
327     uint64_t entry_addr = table_entry_addr(s, &s->vpet, vpeid, &res);
328     uint64_t vteval;
329 
330     if (entry_addr == -1) {
331         /* No L2 table entry, i.e. no valid VTE, or a memory error */
332         vte->valid = false;
333         goto out;
334     }
335     vteval = address_space_ldq_le(as, entry_addr, MEMTXATTRS_UNSPECIFIED, &res);
336     if (res != MEMTX_OK) {
337         goto out;
338     }
339     vte->valid = FIELD_EX64(vteval, VTE, VALID);
340     vte->vptsize = FIELD_EX64(vteval, VTE, VPTSIZE);
341     vte->vptaddr = FIELD_EX64(vteval, VTE, VPTADDR);
342     vte->rdbase = FIELD_EX64(vteval, VTE, RDBASE);
343 out:
344     if (res != MEMTX_OK) {
345         trace_gicv3_its_vte_read_fault(vpeid);
346     } else {
347         trace_gicv3_its_vte_read(vpeid, vte->valid, vte->vptsize,
348                                  vte->vptaddr, vte->rdbase);
349     }
350     return res;
351 }
352 
353 /*
354  * Given a (DeviceID, EventID), look up the corresponding ITE, including
355  * checking for the various invalid-value cases. If we find a valid ITE,
356  * fill in @ite and @dte and return CMD_CONTINUE_OK. Otherwise return
357  * CMD_STALL or CMD_CONTINUE as appropriate (and the contents of @ite
358  * should not be relied on).
359  *
360  * The string @who is purely for the LOG_GUEST_ERROR messages,
361  * and should indicate the name of the calling function or similar.
362  */
363 static ItsCmdResult lookup_ite(GICv3ITSState *s, const char *who,
364                                uint32_t devid, uint32_t eventid, ITEntry *ite,
365                                DTEntry *dte)
366 {
367     uint64_t num_eventids;
368 
369     if (devid >= s->dt.num_entries) {
370         qemu_log_mask(LOG_GUEST_ERROR,
371                       "%s: invalid command attributes: devid %d>=%d",
372                       who, devid, s->dt.num_entries);
373         return CMD_CONTINUE;
374     }
375 
376     if (get_dte(s, devid, dte) != MEMTX_OK) {
377         return CMD_STALL;
378     }
379     if (!dte->valid) {
380         qemu_log_mask(LOG_GUEST_ERROR,
381                       "%s: invalid command attributes: "
382                       "invalid dte for %d\n", who, devid);
383         return CMD_CONTINUE;
384     }
385 
386     num_eventids = 1ULL << (dte->size + 1);
387     if (eventid >= num_eventids) {
388         qemu_log_mask(LOG_GUEST_ERROR,
389                       "%s: invalid command attributes: eventid %d >= %"
390                       PRId64 "\n", who, eventid, num_eventids);
391         return CMD_CONTINUE;
392     }
393 
394     if (get_ite(s, eventid, dte, ite) != MEMTX_OK) {
395         return CMD_STALL;
396     }
397 
398     if (!ite->valid) {
399         qemu_log_mask(LOG_GUEST_ERROR,
400                       "%s: invalid command attributes: invalid ITE\n", who);
401         return CMD_CONTINUE;
402     }
403 
404     return CMD_CONTINUE_OK;
405 }
406 
407 /*
408  * Given an ICID, look up the corresponding CTE, including checking for various
409  * invalid-value cases. If we find a valid CTE, fill in @cte and return
410  * CMD_CONTINUE_OK; otherwise return CMD_STALL or CMD_CONTINUE (and the
411  * contents of @cte should not be relied on).
412  *
413  * The string @who is purely for the LOG_GUEST_ERROR messages,
414  * and should indicate the name of the calling function or similar.
415  */
416 static ItsCmdResult lookup_cte(GICv3ITSState *s, const char *who,
417                                uint32_t icid, CTEntry *cte)
418 {
419     if (icid >= s->ct.num_entries) {
420         qemu_log_mask(LOG_GUEST_ERROR, "%s: invalid ICID 0x%x\n", who, icid);
421         return CMD_CONTINUE;
422     }
423     if (get_cte(s, icid, cte) != MEMTX_OK) {
424         return CMD_STALL;
425     }
426     if (!cte->valid) {
427         qemu_log_mask(LOG_GUEST_ERROR, "%s: invalid CTE\n", who);
428         return CMD_CONTINUE;
429     }
430     if (cte->rdbase >= s->gicv3->num_cpu) {
431         return CMD_CONTINUE;
432     }
433     return CMD_CONTINUE_OK;
434 }
435 
436 /*
437  * Given a VPEID, look up the corresponding VTE, including checking
438  * for various invalid-value cases. if we find a valid VTE, fill in @vte
439  * and return CMD_CONTINUE_OK; otherwise return CMD_STALL or CMD_CONTINUE
440  * (and the contents of @vte should not be relied on).
441  *
442  * The string @who is purely for the LOG_GUEST_ERROR messages,
443  * and should indicate the name of the calling function or similar.
444  */
445 static ItsCmdResult lookup_vte(GICv3ITSState *s, const char *who,
446                                uint32_t vpeid, VTEntry *vte)
447 {
448     if (vpeid >= s->vpet.num_entries) {
449         qemu_log_mask(LOG_GUEST_ERROR, "%s: invalid VPEID 0x%x\n", who, vpeid);
450         return CMD_CONTINUE;
451     }
452 
453     if (get_vte(s, vpeid, vte) != MEMTX_OK) {
454         return CMD_STALL;
455     }
456     if (!vte->valid) {
457         qemu_log_mask(LOG_GUEST_ERROR,
458                       "%s: invalid VTE for VPEID 0x%x\n", who, vpeid);
459         return CMD_CONTINUE;
460     }
461 
462     if (vte->rdbase >= s->gicv3->num_cpu) {
463         return CMD_CONTINUE;
464     }
465     return CMD_CONTINUE_OK;
466 }
467 
468 static ItsCmdResult process_its_cmd_phys(GICv3ITSState *s, const ITEntry *ite,
469                                          int irqlevel)
470 {
471     CTEntry cte;
472     ItsCmdResult cmdres;
473 
474     cmdres = lookup_cte(s, __func__, ite->icid, &cte);
475     if (cmdres != CMD_CONTINUE_OK) {
476         return cmdres;
477     }
478     gicv3_redist_process_lpi(&s->gicv3->cpu[cte.rdbase], ite->intid, irqlevel);
479     return CMD_CONTINUE_OK;
480 }
481 
482 static ItsCmdResult process_its_cmd_virt(GICv3ITSState *s, const ITEntry *ite,
483                                          int irqlevel)
484 {
485     VTEntry vte;
486     ItsCmdResult cmdres;
487 
488     cmdres = lookup_vte(s, __func__, ite->vpeid, &vte);
489     if (cmdres != CMD_CONTINUE_OK) {
490         return cmdres;
491     }
492 
493     if (!intid_in_lpi_range(ite->intid) ||
494         ite->intid >= (1ULL << (vte.vptsize + 1))) {
495         qemu_log_mask(LOG_GUEST_ERROR, "%s: intid 0x%x out of range\n",
496                       __func__, ite->intid);
497         return CMD_CONTINUE;
498     }
499 
500     /*
501      * For QEMU the actual pending of the vLPI is handled in the
502      * redistributor code
503      */
504     gicv3_redist_process_vlpi(&s->gicv3->cpu[vte.rdbase], ite->intid,
505                               vte.vptaddr << 16, ite->doorbell, irqlevel);
506     return CMD_CONTINUE_OK;
507 }
508 
509 /*
510  * This function handles the processing of following commands based on
511  * the ItsCmdType parameter passed:-
512  * 1. triggering of lpi interrupt translation via ITS INT command
513  * 2. triggering of lpi interrupt translation via gits_translater register
514  * 3. handling of ITS CLEAR command
515  * 4. handling of ITS DISCARD command
516  */
517 static ItsCmdResult do_process_its_cmd(GICv3ITSState *s, uint32_t devid,
518                                        uint32_t eventid, ItsCmdType cmd)
519 {
520     DTEntry dte;
521     ITEntry ite;
522     ItsCmdResult cmdres;
523     int irqlevel;
524 
525     cmdres = lookup_ite(s, __func__, devid, eventid, &ite, &dte);
526     if (cmdres != CMD_CONTINUE_OK) {
527         return cmdres;
528     }
529 
530     irqlevel = (cmd == CLEAR || cmd == DISCARD) ? 0 : 1;
531 
532     switch (ite.inttype) {
533     case ITE_INTTYPE_PHYSICAL:
534         cmdres = process_its_cmd_phys(s, &ite, irqlevel);
535         break;
536     case ITE_INTTYPE_VIRTUAL:
537         if (!its_feature_virtual(s)) {
538             /* Can't happen unless guest is illegally writing to table memory */
539             qemu_log_mask(LOG_GUEST_ERROR,
540                           "%s: invalid type %d in ITE (table corrupted?)\n",
541                           __func__, ite.inttype);
542             return CMD_CONTINUE;
543         }
544         cmdres = process_its_cmd_virt(s, &ite, irqlevel);
545         break;
546     default:
547         g_assert_not_reached();
548     }
549 
550     if (cmdres == CMD_CONTINUE_OK && cmd == DISCARD) {
551         ITEntry ite = {};
552         /* remove mapping from interrupt translation table */
553         ite.valid = false;
554         return update_ite(s, eventid, &dte, &ite) ? CMD_CONTINUE_OK : CMD_STALL;
555     }
556     return CMD_CONTINUE_OK;
557 }
558 
559 static ItsCmdResult process_its_cmd(GICv3ITSState *s, const uint64_t *cmdpkt,
560                                     ItsCmdType cmd)
561 {
562     uint32_t devid, eventid;
563 
564     devid = (cmdpkt[0] & DEVID_MASK) >> DEVID_SHIFT;
565     eventid = cmdpkt[1] & EVENTID_MASK;
566     switch (cmd) {
567     case INTERRUPT:
568         trace_gicv3_its_cmd_int(devid, eventid);
569         break;
570     case CLEAR:
571         trace_gicv3_its_cmd_clear(devid, eventid);
572         break;
573     case DISCARD:
574         trace_gicv3_its_cmd_discard(devid, eventid);
575         break;
576     default:
577         g_assert_not_reached();
578     }
579     return do_process_its_cmd(s, devid, eventid, cmd);
580 }
581 
582 static ItsCmdResult process_mapti(GICv3ITSState *s, const uint64_t *cmdpkt,
583                                   bool ignore_pInt)
584 {
585     uint32_t devid, eventid;
586     uint32_t pIntid = 0;
587     uint64_t num_eventids;
588     uint16_t icid = 0;
589     DTEntry dte;
590     ITEntry ite;
591 
592     devid = (cmdpkt[0] & DEVID_MASK) >> DEVID_SHIFT;
593     eventid = cmdpkt[1] & EVENTID_MASK;
594     icid = cmdpkt[2] & ICID_MASK;
595 
596     if (ignore_pInt) {
597         pIntid = eventid;
598         trace_gicv3_its_cmd_mapi(devid, eventid, icid);
599     } else {
600         pIntid = (cmdpkt[1] & pINTID_MASK) >> pINTID_SHIFT;
601         trace_gicv3_its_cmd_mapti(devid, eventid, icid, pIntid);
602     }
603 
604     if (devid >= s->dt.num_entries) {
605         qemu_log_mask(LOG_GUEST_ERROR,
606                       "%s: invalid command attributes: devid %d>=%d",
607                       __func__, devid, s->dt.num_entries);
608         return CMD_CONTINUE;
609     }
610 
611     if (get_dte(s, devid, &dte) != MEMTX_OK) {
612         return CMD_STALL;
613     }
614     num_eventids = 1ULL << (dte.size + 1);
615 
616     if (icid >= s->ct.num_entries) {
617         qemu_log_mask(LOG_GUEST_ERROR,
618                       "%s: invalid ICID 0x%x >= 0x%x\n",
619                       __func__, icid, s->ct.num_entries);
620         return CMD_CONTINUE;
621     }
622 
623     if (!dte.valid) {
624         qemu_log_mask(LOG_GUEST_ERROR,
625                       "%s: no valid DTE for devid 0x%x\n", __func__, devid);
626         return CMD_CONTINUE;
627     }
628 
629     if (eventid >= num_eventids) {
630         qemu_log_mask(LOG_GUEST_ERROR,
631                       "%s: invalid event ID 0x%x >= 0x%" PRIx64 "\n",
632                       __func__, eventid, num_eventids);
633         return CMD_CONTINUE;
634     }
635 
636     if (!intid_in_lpi_range(pIntid)) {
637         qemu_log_mask(LOG_GUEST_ERROR,
638                       "%s: invalid interrupt ID 0x%x\n", __func__, pIntid);
639         return CMD_CONTINUE;
640     }
641 
642     /* add ite entry to interrupt translation table */
643     ite.valid = true;
644     ite.inttype = ITE_INTTYPE_PHYSICAL;
645     ite.intid = pIntid;
646     ite.icid = icid;
647     ite.doorbell = INTID_SPURIOUS;
648     ite.vpeid = 0;
649     return update_ite(s, eventid, &dte, &ite) ? CMD_CONTINUE_OK : CMD_STALL;
650 }
651 
652 static ItsCmdResult process_vmapti(GICv3ITSState *s, const uint64_t *cmdpkt,
653                                    bool ignore_vintid)
654 {
655     uint32_t devid, eventid, vintid, doorbell, vpeid;
656     uint32_t num_eventids;
657     DTEntry dte;
658     ITEntry ite;
659 
660     if (!its_feature_virtual(s)) {
661         return CMD_CONTINUE;
662     }
663 
664     devid = FIELD_EX64(cmdpkt[0], VMAPTI_0, DEVICEID);
665     eventid = FIELD_EX64(cmdpkt[1], VMAPTI_1, EVENTID);
666     vpeid = FIELD_EX64(cmdpkt[1], VMAPTI_1, VPEID);
667     doorbell = FIELD_EX64(cmdpkt[2], VMAPTI_2, DOORBELL);
668     if (ignore_vintid) {
669         vintid = eventid;
670         trace_gicv3_its_cmd_vmapi(devid, eventid, vpeid, doorbell);
671     } else {
672         vintid = FIELD_EX64(cmdpkt[2], VMAPTI_2, VINTID);
673         trace_gicv3_its_cmd_vmapti(devid, eventid, vpeid, vintid, doorbell);
674     }
675 
676     if (devid >= s->dt.num_entries) {
677         qemu_log_mask(LOG_GUEST_ERROR,
678                       "%s: invalid DeviceID 0x%x (must be less than 0x%x)\n",
679                       __func__, devid, s->dt.num_entries);
680         return CMD_CONTINUE;
681     }
682 
683     if (get_dte(s, devid, &dte) != MEMTX_OK) {
684         return CMD_STALL;
685     }
686 
687     if (!dte.valid) {
688         qemu_log_mask(LOG_GUEST_ERROR,
689                       "%s: no entry in device table for DeviceID 0x%x\n",
690                       __func__, devid);
691         return CMD_CONTINUE;
692     }
693 
694     num_eventids = 1ULL << (dte.size + 1);
695 
696     if (eventid >= num_eventids) {
697         qemu_log_mask(LOG_GUEST_ERROR,
698                       "%s: EventID 0x%x too large for DeviceID 0x%x "
699                       "(must be less than 0x%x)\n",
700                       __func__, eventid, devid, num_eventids);
701         return CMD_CONTINUE;
702     }
703     if (!intid_in_lpi_range(vintid)) {
704         qemu_log_mask(LOG_GUEST_ERROR,
705                       "%s: VIntID 0x%x not a valid LPI\n",
706                       __func__, vintid);
707         return CMD_CONTINUE;
708     }
709     if (!valid_doorbell(doorbell)) {
710         qemu_log_mask(LOG_GUEST_ERROR,
711                       "%s: Doorbell %d not 1023 and not a valid LPI\n",
712                       __func__, doorbell);
713         return CMD_CONTINUE;
714     }
715     if (vpeid >= s->vpet.num_entries) {
716         qemu_log_mask(LOG_GUEST_ERROR,
717                       "%s: VPEID 0x%x out of range (must be less than 0x%x)\n",
718                       __func__, vpeid, s->vpet.num_entries);
719         return CMD_CONTINUE;
720     }
721     /* add ite entry to interrupt translation table */
722     ite.valid = true;
723     ite.inttype = ITE_INTTYPE_VIRTUAL;
724     ite.intid = vintid;
725     ite.icid = 0;
726     ite.doorbell = doorbell;
727     ite.vpeid = vpeid;
728     return update_ite(s, eventid, &dte, &ite) ? CMD_CONTINUE_OK : CMD_STALL;
729 }
730 
731 /*
732  * Update the Collection Table entry for @icid to @cte. Returns true
733  * on success, false if there was a memory access error.
734  */
735 static bool update_cte(GICv3ITSState *s, uint16_t icid, const CTEntry *cte)
736 {
737     AddressSpace *as = &s->gicv3->dma_as;
738     uint64_t entry_addr;
739     uint64_t cteval = 0;
740     MemTxResult res = MEMTX_OK;
741 
742     trace_gicv3_its_cte_write(icid, cte->valid, cte->rdbase);
743 
744     if (cte->valid) {
745         /* add mapping entry to collection table */
746         cteval = FIELD_DP64(cteval, CTE, VALID, 1);
747         cteval = FIELD_DP64(cteval, CTE, RDBASE, cte->rdbase);
748     }
749 
750     entry_addr = table_entry_addr(s, &s->ct, icid, &res);
751     if (res != MEMTX_OK) {
752         /* memory access error: stall */
753         return false;
754     }
755     if (entry_addr == -1) {
756         /* No L2 table for this index: discard write and continue */
757         return true;
758     }
759 
760     address_space_stq_le(as, entry_addr, cteval, MEMTXATTRS_UNSPECIFIED, &res);
761     return res == MEMTX_OK;
762 }
763 
764 static ItsCmdResult process_mapc(GICv3ITSState *s, const uint64_t *cmdpkt)
765 {
766     uint16_t icid;
767     CTEntry cte;
768 
769     icid = cmdpkt[2] & ICID_MASK;
770     cte.valid = cmdpkt[2] & CMD_FIELD_VALID_MASK;
771     if (cte.valid) {
772         cte.rdbase = (cmdpkt[2] & R_MAPC_RDBASE_MASK) >> R_MAPC_RDBASE_SHIFT;
773         cte.rdbase &= RDBASE_PROCNUM_MASK;
774     } else {
775         cte.rdbase = 0;
776     }
777     trace_gicv3_its_cmd_mapc(icid, cte.rdbase, cte.valid);
778 
779     if (icid >= s->ct.num_entries) {
780         qemu_log_mask(LOG_GUEST_ERROR, "ITS MAPC: invalid ICID 0x%x\n", icid);
781         return CMD_CONTINUE;
782     }
783     if (cte.valid && cte.rdbase >= s->gicv3->num_cpu) {
784         qemu_log_mask(LOG_GUEST_ERROR,
785                       "ITS MAPC: invalid RDBASE %u\n", cte.rdbase);
786         return CMD_CONTINUE;
787     }
788 
789     return update_cte(s, icid, &cte) ? CMD_CONTINUE_OK : CMD_STALL;
790 }
791 
792 /*
793  * Update the Device Table entry for @devid to @dte. Returns true
794  * on success, false if there was a memory access error.
795  */
796 static bool update_dte(GICv3ITSState *s, uint32_t devid, const DTEntry *dte)
797 {
798     AddressSpace *as = &s->gicv3->dma_as;
799     uint64_t entry_addr;
800     uint64_t dteval = 0;
801     MemTxResult res = MEMTX_OK;
802 
803     trace_gicv3_its_dte_write(devid, dte->valid, dte->size, dte->ittaddr);
804 
805     if (dte->valid) {
806         /* add mapping entry to device table */
807         dteval = FIELD_DP64(dteval, DTE, VALID, 1);
808         dteval = FIELD_DP64(dteval, DTE, SIZE, dte->size);
809         dteval = FIELD_DP64(dteval, DTE, ITTADDR, dte->ittaddr);
810     }
811 
812     entry_addr = table_entry_addr(s, &s->dt, devid, &res);
813     if (res != MEMTX_OK) {
814         /* memory access error: stall */
815         return false;
816     }
817     if (entry_addr == -1) {
818         /* No L2 table for this index: discard write and continue */
819         return true;
820     }
821     address_space_stq_le(as, entry_addr, dteval, MEMTXATTRS_UNSPECIFIED, &res);
822     return res == MEMTX_OK;
823 }
824 
825 static ItsCmdResult process_mapd(GICv3ITSState *s, const uint64_t *cmdpkt)
826 {
827     uint32_t devid;
828     DTEntry dte;
829 
830     devid = (cmdpkt[0] & DEVID_MASK) >> DEVID_SHIFT;
831     dte.size = cmdpkt[1] & SIZE_MASK;
832     dte.ittaddr = (cmdpkt[2] & ITTADDR_MASK) >> ITTADDR_SHIFT;
833     dte.valid = cmdpkt[2] & CMD_FIELD_VALID_MASK;
834 
835     trace_gicv3_its_cmd_mapd(devid, dte.size, dte.ittaddr, dte.valid);
836 
837     if (devid >= s->dt.num_entries) {
838         qemu_log_mask(LOG_GUEST_ERROR,
839                       "ITS MAPD: invalid device ID field 0x%x >= 0x%x\n",
840                       devid, s->dt.num_entries);
841         return CMD_CONTINUE;
842     }
843 
844     if (dte.size > FIELD_EX64(s->typer, GITS_TYPER, IDBITS)) {
845         qemu_log_mask(LOG_GUEST_ERROR,
846                       "ITS MAPD: invalid size %d\n", dte.size);
847         return CMD_CONTINUE;
848     }
849 
850     return update_dte(s, devid, &dte) ? CMD_CONTINUE_OK : CMD_STALL;
851 }
852 
853 static ItsCmdResult process_movall(GICv3ITSState *s, const uint64_t *cmdpkt)
854 {
855     uint64_t rd1, rd2;
856 
857     rd1 = FIELD_EX64(cmdpkt[2], MOVALL_2, RDBASE1);
858     rd2 = FIELD_EX64(cmdpkt[3], MOVALL_3, RDBASE2);
859 
860     trace_gicv3_its_cmd_movall(rd1, rd2);
861 
862     if (rd1 >= s->gicv3->num_cpu) {
863         qemu_log_mask(LOG_GUEST_ERROR,
864                       "%s: RDBASE1 %" PRId64
865                       " out of range (must be less than %d)\n",
866                       __func__, rd1, s->gicv3->num_cpu);
867         return CMD_CONTINUE;
868     }
869     if (rd2 >= s->gicv3->num_cpu) {
870         qemu_log_mask(LOG_GUEST_ERROR,
871                       "%s: RDBASE2 %" PRId64
872                       " out of range (must be less than %d)\n",
873                       __func__, rd2, s->gicv3->num_cpu);
874         return CMD_CONTINUE;
875     }
876 
877     if (rd1 == rd2) {
878         /* Move to same target must succeed as a no-op */
879         return CMD_CONTINUE_OK;
880     }
881 
882     /* Move all pending LPIs from redistributor 1 to redistributor 2 */
883     gicv3_redist_movall_lpis(&s->gicv3->cpu[rd1], &s->gicv3->cpu[rd2]);
884 
885     return CMD_CONTINUE_OK;
886 }
887 
888 static ItsCmdResult process_movi(GICv3ITSState *s, const uint64_t *cmdpkt)
889 {
890     uint32_t devid, eventid;
891     uint16_t new_icid;
892     DTEntry dte;
893     CTEntry old_cte, new_cte;
894     ITEntry old_ite;
895     ItsCmdResult cmdres;
896 
897     devid = FIELD_EX64(cmdpkt[0], MOVI_0, DEVICEID);
898     eventid = FIELD_EX64(cmdpkt[1], MOVI_1, EVENTID);
899     new_icid = FIELD_EX64(cmdpkt[2], MOVI_2, ICID);
900 
901     trace_gicv3_its_cmd_movi(devid, eventid, new_icid);
902 
903     cmdres = lookup_ite(s, __func__, devid, eventid, &old_ite, &dte);
904     if (cmdres != CMD_CONTINUE_OK) {
905         return cmdres;
906     }
907 
908     if (old_ite.inttype != ITE_INTTYPE_PHYSICAL) {
909         qemu_log_mask(LOG_GUEST_ERROR,
910                       "%s: invalid command attributes: invalid ITE\n",
911                       __func__);
912         return CMD_CONTINUE;
913     }
914 
915     cmdres = lookup_cte(s, __func__, old_ite.icid, &old_cte);
916     if (cmdres != CMD_CONTINUE_OK) {
917         return cmdres;
918     }
919     cmdres = lookup_cte(s, __func__, new_icid, &new_cte);
920     if (cmdres != CMD_CONTINUE_OK) {
921         return cmdres;
922     }
923 
924     if (old_cte.rdbase != new_cte.rdbase) {
925         /* Move the LPI from the old redistributor to the new one */
926         gicv3_redist_mov_lpi(&s->gicv3->cpu[old_cte.rdbase],
927                              &s->gicv3->cpu[new_cte.rdbase],
928                              old_ite.intid);
929     }
930 
931     /* Update the ICID field in the interrupt translation table entry */
932     old_ite.icid = new_icid;
933     return update_ite(s, eventid, &dte, &old_ite) ? CMD_CONTINUE_OK : CMD_STALL;
934 }
935 
936 /*
937  * Update the vPE Table entry at index @vpeid with the entry @vte.
938  * Returns true on success, false if there was a memory access error.
939  */
940 static bool update_vte(GICv3ITSState *s, uint32_t vpeid, const VTEntry *vte)
941 {
942     AddressSpace *as = &s->gicv3->dma_as;
943     uint64_t entry_addr;
944     uint64_t vteval = 0;
945     MemTxResult res = MEMTX_OK;
946 
947     trace_gicv3_its_vte_write(vpeid, vte->valid, vte->vptsize, vte->vptaddr,
948                               vte->rdbase);
949 
950     if (vte->valid) {
951         vteval = FIELD_DP64(vteval, VTE, VALID, 1);
952         vteval = FIELD_DP64(vteval, VTE, VPTSIZE, vte->vptsize);
953         vteval = FIELD_DP64(vteval, VTE, VPTADDR, vte->vptaddr);
954         vteval = FIELD_DP64(vteval, VTE, RDBASE, vte->rdbase);
955     }
956 
957     entry_addr = table_entry_addr(s, &s->vpet, vpeid, &res);
958     if (res != MEMTX_OK) {
959         return false;
960     }
961     if (entry_addr == -1) {
962         /* No L2 table for this index: discard write and continue */
963         return true;
964     }
965     address_space_stq_le(as, entry_addr, vteval, MEMTXATTRS_UNSPECIFIED, &res);
966     return res == MEMTX_OK;
967 }
968 
969 static ItsCmdResult process_vmapp(GICv3ITSState *s, const uint64_t *cmdpkt)
970 {
971     VTEntry vte;
972     uint32_t vpeid;
973 
974     if (!its_feature_virtual(s)) {
975         return CMD_CONTINUE;
976     }
977 
978     vpeid = FIELD_EX64(cmdpkt[1], VMAPP_1, VPEID);
979     vte.rdbase = FIELD_EX64(cmdpkt[2], VMAPP_2, RDBASE);
980     vte.valid = FIELD_EX64(cmdpkt[2], VMAPP_2, V);
981     vte.vptsize = FIELD_EX64(cmdpkt[3], VMAPP_3, VPTSIZE);
982     vte.vptaddr = FIELD_EX64(cmdpkt[3], VMAPP_3, VPTADDR);
983 
984     trace_gicv3_its_cmd_vmapp(vpeid, vte.rdbase, vte.valid,
985                               vte.vptaddr, vte.vptsize);
986 
987     /*
988      * For GICv4.0 the VPT_size field is only 5 bits, whereas we
989      * define our field macros to include the full GICv4.1 8 bits.
990      * The range check on VPT_size will catch the cases where
991      * the guest set the RES0-in-GICv4.0 bits [7:6].
992      */
993     if (vte.vptsize > FIELD_EX64(s->typer, GITS_TYPER, IDBITS)) {
994         qemu_log_mask(LOG_GUEST_ERROR,
995                       "%s: invalid VPT_size 0x%x\n", __func__, vte.vptsize);
996         return CMD_CONTINUE;
997     }
998 
999     if (vte.valid && vte.rdbase >= s->gicv3->num_cpu) {
1000         qemu_log_mask(LOG_GUEST_ERROR,
1001                       "%s: invalid rdbase 0x%x\n", __func__, vte.rdbase);
1002         return CMD_CONTINUE;
1003     }
1004 
1005     if (vpeid >= s->vpet.num_entries) {
1006         qemu_log_mask(LOG_GUEST_ERROR,
1007                       "%s: VPEID 0x%x out of range (must be less than 0x%x)\n",
1008                       __func__, vpeid, s->vpet.num_entries);
1009         return CMD_CONTINUE;
1010     }
1011 
1012     return update_vte(s, vpeid, &vte) ? CMD_CONTINUE_OK : CMD_STALL;
1013 }
1014 
1015 typedef struct VmovpCallbackData {
1016     uint64_t rdbase;
1017     uint32_t vpeid;
1018     /*
1019      * Overall command result. If more than one callback finds an
1020      * error, STALL beats CONTINUE.
1021      */
1022     ItsCmdResult result;
1023 } VmovpCallbackData;
1024 
1025 static void vmovp_callback(gpointer data, gpointer opaque)
1026 {
1027     /*
1028      * This function is called to update the VPEID field in a VPE
1029      * table entry for this ITS. This might be because of a VMOVP
1030      * command executed on any ITS that is connected to the same GIC
1031      * as this ITS.  We need to read the VPE table entry for the VPEID
1032      * and update its RDBASE field.
1033      */
1034     GICv3ITSState *s = data;
1035     VmovpCallbackData *cbdata = opaque;
1036     VTEntry vte;
1037     ItsCmdResult cmdres;
1038 
1039     cmdres = lookup_vte(s, __func__, cbdata->vpeid, &vte);
1040     switch (cmdres) {
1041     case CMD_STALL:
1042         cbdata->result = CMD_STALL;
1043         return;
1044     case CMD_CONTINUE:
1045         if (cbdata->result != CMD_STALL) {
1046             cbdata->result = CMD_CONTINUE;
1047         }
1048         return;
1049     case CMD_CONTINUE_OK:
1050         break;
1051     }
1052 
1053     vte.rdbase = cbdata->rdbase;
1054     if (!update_vte(s, cbdata->vpeid, &vte)) {
1055         cbdata->result = CMD_STALL;
1056     }
1057 }
1058 
1059 static ItsCmdResult process_vmovp(GICv3ITSState *s, const uint64_t *cmdpkt)
1060 {
1061     VmovpCallbackData cbdata;
1062 
1063     if (!its_feature_virtual(s)) {
1064         return CMD_CONTINUE;
1065     }
1066 
1067     cbdata.vpeid = FIELD_EX64(cmdpkt[1], VMOVP_1, VPEID);
1068     cbdata.rdbase = FIELD_EX64(cmdpkt[2], VMOVP_2, RDBASE);
1069 
1070     trace_gicv3_its_cmd_vmovp(cbdata.vpeid, cbdata.rdbase);
1071 
1072     if (cbdata.rdbase >= s->gicv3->num_cpu) {
1073         return CMD_CONTINUE;
1074     }
1075 
1076     /*
1077      * Our ITS implementation reports GITS_TYPER.VMOVP == 1, which means
1078      * that when the VMOVP command is executed on an ITS to change the
1079      * VPEID field in a VPE table entry the change must be propagated
1080      * to all the ITSes connected to the same GIC.
1081      */
1082     cbdata.result = CMD_CONTINUE_OK;
1083     gicv3_foreach_its(s->gicv3, vmovp_callback, &cbdata);
1084     return cbdata.result;
1085 }
1086 
1087 static ItsCmdResult process_inv(GICv3ITSState *s, const uint64_t *cmdpkt)
1088 {
1089     uint32_t devid, eventid;
1090     ITEntry ite;
1091     DTEntry dte;
1092     CTEntry cte;
1093     VTEntry vte;
1094     ItsCmdResult cmdres;
1095 
1096     devid = FIELD_EX64(cmdpkt[0], INV_0, DEVICEID);
1097     eventid = FIELD_EX64(cmdpkt[1], INV_1, EVENTID);
1098 
1099     trace_gicv3_its_cmd_inv(devid, eventid);
1100 
1101     cmdres = lookup_ite(s, __func__, devid, eventid, &ite, &dte);
1102     if (cmdres != CMD_CONTINUE_OK) {
1103         return cmdres;
1104     }
1105 
1106     switch (ite.inttype) {
1107     case ITE_INTTYPE_PHYSICAL:
1108         cmdres = lookup_cte(s, __func__, ite.icid, &cte);
1109         if (cmdres != CMD_CONTINUE_OK) {
1110             return cmdres;
1111         }
1112         gicv3_redist_inv_lpi(&s->gicv3->cpu[cte.rdbase], ite.intid);
1113         break;
1114     case ITE_INTTYPE_VIRTUAL:
1115         if (!its_feature_virtual(s)) {
1116             /* Can't happen unless guest is illegally writing to table memory */
1117             qemu_log_mask(LOG_GUEST_ERROR,
1118                           "%s: invalid type %d in ITE (table corrupted?)\n",
1119                           __func__, ite.inttype);
1120             return CMD_CONTINUE;
1121         }
1122 
1123         cmdres = lookup_vte(s, __func__, ite.vpeid, &vte);
1124         if (cmdres != CMD_CONTINUE_OK) {
1125             return cmdres;
1126         }
1127         if (!intid_in_lpi_range(ite.intid) ||
1128             ite.intid >= (1ULL << (vte.vptsize + 1))) {
1129             qemu_log_mask(LOG_GUEST_ERROR, "%s: intid 0x%x out of range\n",
1130                           __func__, ite.intid);
1131             return CMD_CONTINUE;
1132         }
1133         gicv3_redist_inv_vlpi(&s->gicv3->cpu[vte.rdbase], ite.intid,
1134                               vte.vptaddr << 16);
1135         break;
1136     default:
1137         g_assert_not_reached();
1138     }
1139 
1140     return CMD_CONTINUE_OK;
1141 }
1142 
1143 /*
1144  * Current implementation blocks until all
1145  * commands are processed
1146  */
1147 static void process_cmdq(GICv3ITSState *s)
1148 {
1149     uint32_t wr_offset = 0;
1150     uint32_t rd_offset = 0;
1151     uint32_t cq_offset = 0;
1152     AddressSpace *as = &s->gicv3->dma_as;
1153     uint8_t cmd;
1154     int i;
1155 
1156     if (!(s->ctlr & R_GITS_CTLR_ENABLED_MASK)) {
1157         return;
1158     }
1159 
1160     wr_offset = FIELD_EX64(s->cwriter, GITS_CWRITER, OFFSET);
1161 
1162     if (wr_offset >= s->cq.num_entries) {
1163         qemu_log_mask(LOG_GUEST_ERROR,
1164                       "%s: invalid write offset "
1165                       "%d\n", __func__, wr_offset);
1166         return;
1167     }
1168 
1169     rd_offset = FIELD_EX64(s->creadr, GITS_CREADR, OFFSET);
1170 
1171     if (rd_offset >= s->cq.num_entries) {
1172         qemu_log_mask(LOG_GUEST_ERROR,
1173                       "%s: invalid read offset "
1174                       "%d\n", __func__, rd_offset);
1175         return;
1176     }
1177 
1178     while (wr_offset != rd_offset) {
1179         ItsCmdResult result = CMD_CONTINUE_OK;
1180         void *hostmem;
1181         hwaddr buflen;
1182         uint64_t cmdpkt[GITS_CMDQ_ENTRY_WORDS];
1183 
1184         cq_offset = (rd_offset * GITS_CMDQ_ENTRY_SIZE);
1185 
1186         buflen = GITS_CMDQ_ENTRY_SIZE;
1187         hostmem = address_space_map(as, s->cq.base_addr + cq_offset,
1188                                     &buflen, false, MEMTXATTRS_UNSPECIFIED);
1189         if (!hostmem || buflen != GITS_CMDQ_ENTRY_SIZE) {
1190             if (hostmem) {
1191                 address_space_unmap(as, hostmem, buflen, false, 0);
1192             }
1193             s->creadr = FIELD_DP64(s->creadr, GITS_CREADR, STALLED, 1);
1194             qemu_log_mask(LOG_GUEST_ERROR,
1195                           "%s: could not read command at 0x%" PRIx64 "\n",
1196                           __func__, s->cq.base_addr + cq_offset);
1197             break;
1198         }
1199         for (i = 0; i < ARRAY_SIZE(cmdpkt); i++) {
1200             cmdpkt[i] = ldq_le_p(hostmem + i * sizeof(uint64_t));
1201         }
1202         address_space_unmap(as, hostmem, buflen, false, 0);
1203 
1204         cmd = cmdpkt[0] & CMD_MASK;
1205 
1206         trace_gicv3_its_process_command(rd_offset, cmd);
1207 
1208         switch (cmd) {
1209         case GITS_CMD_INT:
1210             result = process_its_cmd(s, cmdpkt, INTERRUPT);
1211             break;
1212         case GITS_CMD_CLEAR:
1213             result = process_its_cmd(s, cmdpkt, CLEAR);
1214             break;
1215         case GITS_CMD_SYNC:
1216             /*
1217              * Current implementation makes a blocking synchronous call
1218              * for every command issued earlier, hence the internal state
1219              * is already consistent by the time SYNC command is executed.
1220              * Hence no further processing is required for SYNC command.
1221              */
1222             trace_gicv3_its_cmd_sync();
1223             break;
1224         case GITS_CMD_VSYNC:
1225             /*
1226              * VSYNC also is a nop, because our implementation is always
1227              * in sync.
1228              */
1229             if (!its_feature_virtual(s)) {
1230                 result = CMD_CONTINUE;
1231                 break;
1232             }
1233             trace_gicv3_its_cmd_vsync();
1234             break;
1235         case GITS_CMD_MAPD:
1236             result = process_mapd(s, cmdpkt);
1237             break;
1238         case GITS_CMD_MAPC:
1239             result = process_mapc(s, cmdpkt);
1240             break;
1241         case GITS_CMD_MAPTI:
1242             result = process_mapti(s, cmdpkt, false);
1243             break;
1244         case GITS_CMD_MAPI:
1245             result = process_mapti(s, cmdpkt, true);
1246             break;
1247         case GITS_CMD_DISCARD:
1248             result = process_its_cmd(s, cmdpkt, DISCARD);
1249             break;
1250         case GITS_CMD_INV:
1251             result = process_inv(s, cmdpkt);
1252             break;
1253         case GITS_CMD_INVALL:
1254             /*
1255              * Current implementation doesn't cache any ITS tables,
1256              * but the calculated lpi priority information. We only
1257              * need to trigger lpi priority re-calculation to be in
1258              * sync with LPI config table or pending table changes.
1259              * INVALL operates on a collection specified by ICID so
1260              * it only affects physical LPIs.
1261              */
1262             trace_gicv3_its_cmd_invall();
1263             for (i = 0; i < s->gicv3->num_cpu; i++) {
1264                 gicv3_redist_update_lpi(&s->gicv3->cpu[i]);
1265             }
1266             break;
1267         case GITS_CMD_MOVI:
1268             result = process_movi(s, cmdpkt);
1269             break;
1270         case GITS_CMD_MOVALL:
1271             result = process_movall(s, cmdpkt);
1272             break;
1273         case GITS_CMD_VMAPTI:
1274             result = process_vmapti(s, cmdpkt, false);
1275             break;
1276         case GITS_CMD_VMAPI:
1277             result = process_vmapti(s, cmdpkt, true);
1278             break;
1279         case GITS_CMD_VMAPP:
1280             result = process_vmapp(s, cmdpkt);
1281             break;
1282         case GITS_CMD_VMOVP:
1283             result = process_vmovp(s, cmdpkt);
1284             break;
1285         default:
1286             trace_gicv3_its_cmd_unknown(cmd);
1287             break;
1288         }
1289         if (result != CMD_STALL) {
1290             /* CMD_CONTINUE or CMD_CONTINUE_OK */
1291             rd_offset++;
1292             rd_offset %= s->cq.num_entries;
1293             s->creadr = FIELD_DP64(s->creadr, GITS_CREADR, OFFSET, rd_offset);
1294         } else {
1295             /* CMD_STALL */
1296             s->creadr = FIELD_DP64(s->creadr, GITS_CREADR, STALLED, 1);
1297             qemu_log_mask(LOG_GUEST_ERROR,
1298                           "%s: 0x%x cmd processing failed, stalling\n",
1299                           __func__, cmd);
1300             break;
1301         }
1302     }
1303 }
1304 
1305 /*
1306  * This function extracts the ITS Device and Collection table specific
1307  * parameters (like base_addr, size etc) from GITS_BASER register.
1308  * It is called during ITS enable and also during post_load migration
1309  */
1310 static void extract_table_params(GICv3ITSState *s)
1311 {
1312     uint16_t num_pages = 0;
1313     uint8_t  page_sz_type;
1314     uint8_t type;
1315     uint32_t page_sz = 0;
1316     uint64_t value;
1317 
1318     for (int i = 0; i < 8; i++) {
1319         TableDesc *td;
1320         int idbits;
1321 
1322         value = s->baser[i];
1323 
1324         if (!value) {
1325             continue;
1326         }
1327 
1328         page_sz_type = FIELD_EX64(value, GITS_BASER, PAGESIZE);
1329 
1330         switch (page_sz_type) {
1331         case 0:
1332             page_sz = GITS_PAGE_SIZE_4K;
1333             break;
1334 
1335         case 1:
1336             page_sz = GITS_PAGE_SIZE_16K;
1337             break;
1338 
1339         case 2:
1340         case 3:
1341             page_sz = GITS_PAGE_SIZE_64K;
1342             break;
1343 
1344         default:
1345             g_assert_not_reached();
1346         }
1347 
1348         num_pages = FIELD_EX64(value, GITS_BASER, SIZE) + 1;
1349 
1350         type = FIELD_EX64(value, GITS_BASER, TYPE);
1351 
1352         switch (type) {
1353         case GITS_BASER_TYPE_DEVICE:
1354             td = &s->dt;
1355             idbits = FIELD_EX64(s->typer, GITS_TYPER, DEVBITS) + 1;
1356             break;
1357         case GITS_BASER_TYPE_COLLECTION:
1358             td = &s->ct;
1359             if (FIELD_EX64(s->typer, GITS_TYPER, CIL)) {
1360                 idbits = FIELD_EX64(s->typer, GITS_TYPER, CIDBITS) + 1;
1361             } else {
1362                 /* 16-bit CollectionId supported when CIL == 0 */
1363                 idbits = 16;
1364             }
1365             break;
1366         case GITS_BASER_TYPE_VPE:
1367             td = &s->vpet;
1368             /*
1369              * For QEMU vPEIDs are always 16 bits. (GICv4.1 allows an
1370              * implementation to implement fewer bits and report this
1371              * via GICD_TYPER2.)
1372              */
1373             idbits = 16;
1374             break;
1375         default:
1376             /*
1377              * GITS_BASER<n>.TYPE is read-only, so GITS_BASER_RO_MASK
1378              * ensures we will only see type values corresponding to
1379              * the values set up in gicv3_its_reset().
1380              */
1381             g_assert_not_reached();
1382         }
1383 
1384         memset(td, 0, sizeof(*td));
1385         /*
1386          * If GITS_BASER<n>.Valid is 0 for any <n> then we will not process
1387          * interrupts. (GITS_TYPER.HCC is 0 for this implementation, so we
1388          * do not have a special case where the GITS_BASER<n>.Valid bit is 0
1389          * for the register corresponding to the Collection table but we
1390          * still have to process interrupts using non-memory-backed
1391          * Collection table entries.)
1392          * The specification makes it UNPREDICTABLE to enable the ITS without
1393          * marking each BASER<n> as valid. We choose to handle these as if
1394          * the table was zero-sized, so commands using the table will fail
1395          * and interrupts requested via GITS_TRANSLATER writes will be ignored.
1396          * This happens automatically by leaving the num_entries field at
1397          * zero, which will be caught by the bounds checks we have before
1398          * every table lookup anyway.
1399          */
1400         if (!FIELD_EX64(value, GITS_BASER, VALID)) {
1401             continue;
1402         }
1403         td->page_sz = page_sz;
1404         td->indirect = FIELD_EX64(value, GITS_BASER, INDIRECT);
1405         td->entry_sz = FIELD_EX64(value, GITS_BASER, ENTRYSIZE) + 1;
1406         td->base_addr = baser_base_addr(value, page_sz);
1407         if (!td->indirect) {
1408             td->num_entries = (num_pages * page_sz) / td->entry_sz;
1409         } else {
1410             td->num_entries = (((num_pages * page_sz) /
1411                                   L1TABLE_ENTRY_SIZE) *
1412                                  (page_sz / td->entry_sz));
1413         }
1414         td->num_entries = MIN(td->num_entries, 1ULL << idbits);
1415     }
1416 }
1417 
1418 static void extract_cmdq_params(GICv3ITSState *s)
1419 {
1420     uint16_t num_pages = 0;
1421     uint64_t value = s->cbaser;
1422 
1423     num_pages = FIELD_EX64(value, GITS_CBASER, SIZE) + 1;
1424 
1425     memset(&s->cq, 0 , sizeof(s->cq));
1426 
1427     if (FIELD_EX64(value, GITS_CBASER, VALID)) {
1428         s->cq.num_entries = (num_pages * GITS_PAGE_SIZE_4K) /
1429                              GITS_CMDQ_ENTRY_SIZE;
1430         s->cq.base_addr = FIELD_EX64(value, GITS_CBASER, PHYADDR);
1431         s->cq.base_addr <<= R_GITS_CBASER_PHYADDR_SHIFT;
1432     }
1433 }
1434 
1435 static MemTxResult gicv3_its_translation_read(void *opaque, hwaddr offset,
1436                                               uint64_t *data, unsigned size,
1437                                               MemTxAttrs attrs)
1438 {
1439     /*
1440      * GITS_TRANSLATER is write-only, and all other addresses
1441      * in the interrupt translation space frame are RES0.
1442      */
1443     *data = 0;
1444     return MEMTX_OK;
1445 }
1446 
1447 static MemTxResult gicv3_its_translation_write(void *opaque, hwaddr offset,
1448                                                uint64_t data, unsigned size,
1449                                                MemTxAttrs attrs)
1450 {
1451     GICv3ITSState *s = (GICv3ITSState *)opaque;
1452     bool result = true;
1453 
1454     trace_gicv3_its_translation_write(offset, data, size, attrs.requester_id);
1455 
1456     switch (offset) {
1457     case GITS_TRANSLATER:
1458         if (s->ctlr & R_GITS_CTLR_ENABLED_MASK) {
1459             result = do_process_its_cmd(s, attrs.requester_id, data, NONE);
1460         }
1461         break;
1462     default:
1463         break;
1464     }
1465 
1466     if (result) {
1467         return MEMTX_OK;
1468     } else {
1469         return MEMTX_ERROR;
1470     }
1471 }
1472 
1473 static bool its_writel(GICv3ITSState *s, hwaddr offset,
1474                               uint64_t value, MemTxAttrs attrs)
1475 {
1476     bool result = true;
1477     int index;
1478 
1479     switch (offset) {
1480     case GITS_CTLR:
1481         if (value & R_GITS_CTLR_ENABLED_MASK) {
1482             s->ctlr |= R_GITS_CTLR_ENABLED_MASK;
1483             extract_table_params(s);
1484             extract_cmdq_params(s);
1485             process_cmdq(s);
1486         } else {
1487             s->ctlr &= ~R_GITS_CTLR_ENABLED_MASK;
1488         }
1489         break;
1490     case GITS_CBASER:
1491         /*
1492          * IMPDEF choice:- GITS_CBASER register becomes RO if ITS is
1493          *                 already enabled
1494          */
1495         if (!(s->ctlr & R_GITS_CTLR_ENABLED_MASK)) {
1496             s->cbaser = deposit64(s->cbaser, 0, 32, value);
1497             s->creadr = 0;
1498         }
1499         break;
1500     case GITS_CBASER + 4:
1501         /*
1502          * IMPDEF choice:- GITS_CBASER register becomes RO if ITS is
1503          *                 already enabled
1504          */
1505         if (!(s->ctlr & R_GITS_CTLR_ENABLED_MASK)) {
1506             s->cbaser = deposit64(s->cbaser, 32, 32, value);
1507             s->creadr = 0;
1508         }
1509         break;
1510     case GITS_CWRITER:
1511         s->cwriter = deposit64(s->cwriter, 0, 32,
1512                                (value & ~R_GITS_CWRITER_RETRY_MASK));
1513         if (s->cwriter != s->creadr) {
1514             process_cmdq(s);
1515         }
1516         break;
1517     case GITS_CWRITER + 4:
1518         s->cwriter = deposit64(s->cwriter, 32, 32, value);
1519         break;
1520     case GITS_CREADR:
1521         if (s->gicv3->gicd_ctlr & GICD_CTLR_DS) {
1522             s->creadr = deposit64(s->creadr, 0, 32,
1523                                   (value & ~R_GITS_CREADR_STALLED_MASK));
1524         } else {
1525             /* RO register, ignore the write */
1526             qemu_log_mask(LOG_GUEST_ERROR,
1527                           "%s: invalid guest write to RO register at offset "
1528                           TARGET_FMT_plx "\n", __func__, offset);
1529         }
1530         break;
1531     case GITS_CREADR + 4:
1532         if (s->gicv3->gicd_ctlr & GICD_CTLR_DS) {
1533             s->creadr = deposit64(s->creadr, 32, 32, value);
1534         } else {
1535             /* RO register, ignore the write */
1536             qemu_log_mask(LOG_GUEST_ERROR,
1537                           "%s: invalid guest write to RO register at offset "
1538                           TARGET_FMT_plx "\n", __func__, offset);
1539         }
1540         break;
1541     case GITS_BASER ... GITS_BASER + 0x3f:
1542         /*
1543          * IMPDEF choice:- GITS_BASERn register becomes RO if ITS is
1544          *                 already enabled
1545          */
1546         if (!(s->ctlr & R_GITS_CTLR_ENABLED_MASK)) {
1547             index = (offset - GITS_BASER) / 8;
1548 
1549             if (s->baser[index] == 0) {
1550                 /* Unimplemented GITS_BASERn: RAZ/WI */
1551                 break;
1552             }
1553             if (offset & 7) {
1554                 value <<= 32;
1555                 value &= ~GITS_BASER_RO_MASK;
1556                 s->baser[index] &= GITS_BASER_RO_MASK | MAKE_64BIT_MASK(0, 32);
1557                 s->baser[index] |= value;
1558             } else {
1559                 value &= ~GITS_BASER_RO_MASK;
1560                 s->baser[index] &= GITS_BASER_RO_MASK | MAKE_64BIT_MASK(32, 32);
1561                 s->baser[index] |= value;
1562             }
1563         }
1564         break;
1565     case GITS_IIDR:
1566     case GITS_IDREGS ... GITS_IDREGS + 0x2f:
1567         /* RO registers, ignore the write */
1568         qemu_log_mask(LOG_GUEST_ERROR,
1569                       "%s: invalid guest write to RO register at offset "
1570                       TARGET_FMT_plx "\n", __func__, offset);
1571         break;
1572     default:
1573         result = false;
1574         break;
1575     }
1576     return result;
1577 }
1578 
1579 static bool its_readl(GICv3ITSState *s, hwaddr offset,
1580                              uint64_t *data, MemTxAttrs attrs)
1581 {
1582     bool result = true;
1583     int index;
1584 
1585     switch (offset) {
1586     case GITS_CTLR:
1587         *data = s->ctlr;
1588         break;
1589     case GITS_IIDR:
1590         *data = gicv3_iidr();
1591         break;
1592     case GITS_IDREGS ... GITS_IDREGS + 0x2f:
1593         /* ID registers */
1594         *data = gicv3_idreg(offset - GITS_IDREGS, GICV3_PIDR0_ITS);
1595         break;
1596     case GITS_TYPER:
1597         *data = extract64(s->typer, 0, 32);
1598         break;
1599     case GITS_TYPER + 4:
1600         *data = extract64(s->typer, 32, 32);
1601         break;
1602     case GITS_CBASER:
1603         *data = extract64(s->cbaser, 0, 32);
1604         break;
1605     case GITS_CBASER + 4:
1606         *data = extract64(s->cbaser, 32, 32);
1607         break;
1608     case GITS_CREADR:
1609         *data = extract64(s->creadr, 0, 32);
1610         break;
1611     case GITS_CREADR + 4:
1612         *data = extract64(s->creadr, 32, 32);
1613         break;
1614     case GITS_CWRITER:
1615         *data = extract64(s->cwriter, 0, 32);
1616         break;
1617     case GITS_CWRITER + 4:
1618         *data = extract64(s->cwriter, 32, 32);
1619         break;
1620     case GITS_BASER ... GITS_BASER + 0x3f:
1621         index = (offset - GITS_BASER) / 8;
1622         if (offset & 7) {
1623             *data = extract64(s->baser[index], 32, 32);
1624         } else {
1625             *data = extract64(s->baser[index], 0, 32);
1626         }
1627         break;
1628     default:
1629         result = false;
1630         break;
1631     }
1632     return result;
1633 }
1634 
1635 static bool its_writell(GICv3ITSState *s, hwaddr offset,
1636                                uint64_t value, MemTxAttrs attrs)
1637 {
1638     bool result = true;
1639     int index;
1640 
1641     switch (offset) {
1642     case GITS_BASER ... GITS_BASER + 0x3f:
1643         /*
1644          * IMPDEF choice:- GITS_BASERn register becomes RO if ITS is
1645          *                 already enabled
1646          */
1647         if (!(s->ctlr & R_GITS_CTLR_ENABLED_MASK)) {
1648             index = (offset - GITS_BASER) / 8;
1649             if (s->baser[index] == 0) {
1650                 /* Unimplemented GITS_BASERn: RAZ/WI */
1651                 break;
1652             }
1653             s->baser[index] &= GITS_BASER_RO_MASK;
1654             s->baser[index] |= (value & ~GITS_BASER_RO_MASK);
1655         }
1656         break;
1657     case GITS_CBASER:
1658         /*
1659          * IMPDEF choice:- GITS_CBASER register becomes RO if ITS is
1660          *                 already enabled
1661          */
1662         if (!(s->ctlr & R_GITS_CTLR_ENABLED_MASK)) {
1663             s->cbaser = value;
1664             s->creadr = 0;
1665         }
1666         break;
1667     case GITS_CWRITER:
1668         s->cwriter = value & ~R_GITS_CWRITER_RETRY_MASK;
1669         if (s->cwriter != s->creadr) {
1670             process_cmdq(s);
1671         }
1672         break;
1673     case GITS_CREADR:
1674         if (s->gicv3->gicd_ctlr & GICD_CTLR_DS) {
1675             s->creadr = value & ~R_GITS_CREADR_STALLED_MASK;
1676         } else {
1677             /* RO register, ignore the write */
1678             qemu_log_mask(LOG_GUEST_ERROR,
1679                           "%s: invalid guest write to RO register at offset "
1680                           TARGET_FMT_plx "\n", __func__, offset);
1681         }
1682         break;
1683     case GITS_TYPER:
1684         /* RO registers, ignore the write */
1685         qemu_log_mask(LOG_GUEST_ERROR,
1686                       "%s: invalid guest write to RO register at offset "
1687                       TARGET_FMT_plx "\n", __func__, offset);
1688         break;
1689     default:
1690         result = false;
1691         break;
1692     }
1693     return result;
1694 }
1695 
1696 static bool its_readll(GICv3ITSState *s, hwaddr offset,
1697                               uint64_t *data, MemTxAttrs attrs)
1698 {
1699     bool result = true;
1700     int index;
1701 
1702     switch (offset) {
1703     case GITS_TYPER:
1704         *data = s->typer;
1705         break;
1706     case GITS_BASER ... GITS_BASER + 0x3f:
1707         index = (offset - GITS_BASER) / 8;
1708         *data = s->baser[index];
1709         break;
1710     case GITS_CBASER:
1711         *data = s->cbaser;
1712         break;
1713     case GITS_CREADR:
1714         *data = s->creadr;
1715         break;
1716     case GITS_CWRITER:
1717         *data = s->cwriter;
1718         break;
1719     default:
1720         result = false;
1721         break;
1722     }
1723     return result;
1724 }
1725 
1726 static MemTxResult gicv3_its_read(void *opaque, hwaddr offset, uint64_t *data,
1727                                   unsigned size, MemTxAttrs attrs)
1728 {
1729     GICv3ITSState *s = (GICv3ITSState *)opaque;
1730     bool result;
1731 
1732     switch (size) {
1733     case 4:
1734         result = its_readl(s, offset, data, attrs);
1735         break;
1736     case 8:
1737         result = its_readll(s, offset, data, attrs);
1738         break;
1739     default:
1740         result = false;
1741         break;
1742     }
1743 
1744     if (!result) {
1745         qemu_log_mask(LOG_GUEST_ERROR,
1746                       "%s: invalid guest read at offset " TARGET_FMT_plx
1747                       " size %u\n", __func__, offset, size);
1748         trace_gicv3_its_badread(offset, size);
1749         /*
1750          * The spec requires that reserved registers are RAZ/WI;
1751          * so use false returns from leaf functions as a way to
1752          * trigger the guest-error logging but don't return it to
1753          * the caller, or we'll cause a spurious guest data abort.
1754          */
1755         *data = 0;
1756     } else {
1757         trace_gicv3_its_read(offset, *data, size);
1758     }
1759     return MEMTX_OK;
1760 }
1761 
1762 static MemTxResult gicv3_its_write(void *opaque, hwaddr offset, uint64_t data,
1763                                    unsigned size, MemTxAttrs attrs)
1764 {
1765     GICv3ITSState *s = (GICv3ITSState *)opaque;
1766     bool result;
1767 
1768     switch (size) {
1769     case 4:
1770         result = its_writel(s, offset, data, attrs);
1771         break;
1772     case 8:
1773         result = its_writell(s, offset, data, attrs);
1774         break;
1775     default:
1776         result = false;
1777         break;
1778     }
1779 
1780     if (!result) {
1781         qemu_log_mask(LOG_GUEST_ERROR,
1782                       "%s: invalid guest write at offset " TARGET_FMT_plx
1783                       " size %u\n", __func__, offset, size);
1784         trace_gicv3_its_badwrite(offset, data, size);
1785         /*
1786          * The spec requires that reserved registers are RAZ/WI;
1787          * so use false returns from leaf functions as a way to
1788          * trigger the guest-error logging but don't return it to
1789          * the caller, or we'll cause a spurious guest data abort.
1790          */
1791     } else {
1792         trace_gicv3_its_write(offset, data, size);
1793     }
1794     return MEMTX_OK;
1795 }
1796 
1797 static const MemoryRegionOps gicv3_its_control_ops = {
1798     .read_with_attrs = gicv3_its_read,
1799     .write_with_attrs = gicv3_its_write,
1800     .valid.min_access_size = 4,
1801     .valid.max_access_size = 8,
1802     .impl.min_access_size = 4,
1803     .impl.max_access_size = 8,
1804     .endianness = DEVICE_NATIVE_ENDIAN,
1805 };
1806 
1807 static const MemoryRegionOps gicv3_its_translation_ops = {
1808     .read_with_attrs = gicv3_its_translation_read,
1809     .write_with_attrs = gicv3_its_translation_write,
1810     .valid.min_access_size = 2,
1811     .valid.max_access_size = 4,
1812     .impl.min_access_size = 2,
1813     .impl.max_access_size = 4,
1814     .endianness = DEVICE_NATIVE_ENDIAN,
1815 };
1816 
1817 static void gicv3_arm_its_realize(DeviceState *dev, Error **errp)
1818 {
1819     GICv3ITSState *s = ARM_GICV3_ITS_COMMON(dev);
1820     int i;
1821 
1822     for (i = 0; i < s->gicv3->num_cpu; i++) {
1823         if (!(s->gicv3->cpu[i].gicr_typer & GICR_TYPER_PLPIS)) {
1824             error_setg(errp, "Physical LPI not supported by CPU %d", i);
1825             return;
1826         }
1827     }
1828 
1829     gicv3_add_its(s->gicv3, dev);
1830 
1831     gicv3_its_init_mmio(s, &gicv3_its_control_ops, &gicv3_its_translation_ops);
1832 
1833     /* set the ITS default features supported */
1834     s->typer = FIELD_DP64(s->typer, GITS_TYPER, PHYSICAL, 1);
1835     s->typer = FIELD_DP64(s->typer, GITS_TYPER, ITT_ENTRY_SIZE,
1836                           ITS_ITT_ENTRY_SIZE - 1);
1837     s->typer = FIELD_DP64(s->typer, GITS_TYPER, IDBITS, ITS_IDBITS);
1838     s->typer = FIELD_DP64(s->typer, GITS_TYPER, DEVBITS, ITS_DEVBITS);
1839     s->typer = FIELD_DP64(s->typer, GITS_TYPER, CIL, 1);
1840     s->typer = FIELD_DP64(s->typer, GITS_TYPER, CIDBITS, ITS_CIDBITS);
1841 }
1842 
1843 static void gicv3_its_reset(DeviceState *dev)
1844 {
1845     GICv3ITSState *s = ARM_GICV3_ITS_COMMON(dev);
1846     GICv3ITSClass *c = ARM_GICV3_ITS_GET_CLASS(s);
1847 
1848     c->parent_reset(dev);
1849 
1850     /* Quiescent bit reset to 1 */
1851     s->ctlr = FIELD_DP32(s->ctlr, GITS_CTLR, QUIESCENT, 1);
1852 
1853     /*
1854      * setting GITS_BASER0.Type = 0b001 (Device)
1855      *         GITS_BASER1.Type = 0b100 (Collection Table)
1856      *         GITS_BASER2.Type = 0b010 (vPE) for GICv4 and later
1857      *         GITS_BASER<n>.Type,where n = 3 to 7 are 0b00 (Unimplemented)
1858      *         GITS_BASER<0,1>.Page_Size = 64KB
1859      * and default translation table entry size to 16 bytes
1860      */
1861     s->baser[0] = FIELD_DP64(s->baser[0], GITS_BASER, TYPE,
1862                              GITS_BASER_TYPE_DEVICE);
1863     s->baser[0] = FIELD_DP64(s->baser[0], GITS_BASER, PAGESIZE,
1864                              GITS_BASER_PAGESIZE_64K);
1865     s->baser[0] = FIELD_DP64(s->baser[0], GITS_BASER, ENTRYSIZE,
1866                              GITS_DTE_SIZE - 1);
1867 
1868     s->baser[1] = FIELD_DP64(s->baser[1], GITS_BASER, TYPE,
1869                              GITS_BASER_TYPE_COLLECTION);
1870     s->baser[1] = FIELD_DP64(s->baser[1], GITS_BASER, PAGESIZE,
1871                              GITS_BASER_PAGESIZE_64K);
1872     s->baser[1] = FIELD_DP64(s->baser[1], GITS_BASER, ENTRYSIZE,
1873                              GITS_CTE_SIZE - 1);
1874 
1875     if (its_feature_virtual(s)) {
1876         s->baser[2] = FIELD_DP64(s->baser[2], GITS_BASER, TYPE,
1877                                  GITS_BASER_TYPE_VPE);
1878         s->baser[2] = FIELD_DP64(s->baser[2], GITS_BASER, PAGESIZE,
1879                                  GITS_BASER_PAGESIZE_64K);
1880         s->baser[2] = FIELD_DP64(s->baser[2], GITS_BASER, ENTRYSIZE,
1881                                  GITS_VPE_SIZE - 1);
1882     }
1883 }
1884 
1885 static void gicv3_its_post_load(GICv3ITSState *s)
1886 {
1887     if (s->ctlr & R_GITS_CTLR_ENABLED_MASK) {
1888         extract_table_params(s);
1889         extract_cmdq_params(s);
1890     }
1891 }
1892 
1893 static Property gicv3_its_props[] = {
1894     DEFINE_PROP_LINK("parent-gicv3", GICv3ITSState, gicv3, "arm-gicv3",
1895                      GICv3State *),
1896     DEFINE_PROP_END_OF_LIST(),
1897 };
1898 
1899 static void gicv3_its_class_init(ObjectClass *klass, void *data)
1900 {
1901     DeviceClass *dc = DEVICE_CLASS(klass);
1902     GICv3ITSClass *ic = ARM_GICV3_ITS_CLASS(klass);
1903     GICv3ITSCommonClass *icc = ARM_GICV3_ITS_COMMON_CLASS(klass);
1904 
1905     dc->realize = gicv3_arm_its_realize;
1906     device_class_set_props(dc, gicv3_its_props);
1907     device_class_set_parent_reset(dc, gicv3_its_reset, &ic->parent_reset);
1908     icc->post_load = gicv3_its_post_load;
1909 }
1910 
1911 static const TypeInfo gicv3_its_info = {
1912     .name = TYPE_ARM_GICV3_ITS,
1913     .parent = TYPE_ARM_GICV3_ITS_COMMON,
1914     .instance_size = sizeof(GICv3ITSState),
1915     .class_init = gicv3_its_class_init,
1916     .class_size = sizeof(GICv3ITSClass),
1917 };
1918 
1919 static void gicv3_its_register_types(void)
1920 {
1921     type_register_static(&gicv3_its_info);
1922 }
1923 
1924 type_init(gicv3_its_register_types)
1925