xref: /openbmc/qemu/hw/intc/arm_gic.c (revision 4b4629d9)
1 /*
2  * ARM Generic/Distributed Interrupt Controller
3  *
4  * Copyright (c) 2006-2007 CodeSourcery.
5  * Written by Paul Brook
6  *
7  * This code is licensed under the GPL.
8  */
9 
10 /* This file contains implementation code for the RealView EB interrupt
11  * controller, MPCore distributed interrupt controller and ARMv7-M
12  * Nested Vectored Interrupt Controller.
13  * It is compiled in two ways:
14  *  (1) as a standalone file to produce a sysbus device which is a GIC
15  *  that can be used on the realview board and as one of the builtin
16  *  private peripherals for the ARM MP CPUs (11MPCore, A9, etc)
17  *  (2) by being directly #included into armv7m_nvic.c to produce the
18  *  armv7m_nvic device.
19  */
20 
21 #include "qemu/osdep.h"
22 #include "hw/sysbus.h"
23 #include "gic_internal.h"
24 #include "qapi/error.h"
25 #include "qom/cpu.h"
26 #include "trace.h"
27 
28 //#define DEBUG_GIC
29 
30 #ifdef DEBUG_GIC
31 #define DPRINTF(fmt, ...) \
32 do { fprintf(stderr, "arm_gic: " fmt , ## __VA_ARGS__); } while (0)
33 #else
34 #define DPRINTF(fmt, ...) do {} while(0)
35 #endif
36 
37 static const uint8_t gic_id_11mpcore[] = {
38     0x00, 0x00, 0x00, 0x00, 0x90, 0x13, 0x04, 0x00, 0x0d, 0xf0, 0x05, 0xb1
39 };
40 
41 static const uint8_t gic_id_gicv1[] = {
42     0x04, 0x00, 0x00, 0x00, 0x90, 0xb3, 0x1b, 0x00, 0x0d, 0xf0, 0x05, 0xb1
43 };
44 
45 static const uint8_t gic_id_gicv2[] = {
46     0x04, 0x00, 0x00, 0x00, 0x90, 0xb4, 0x2b, 0x00, 0x0d, 0xf0, 0x05, 0xb1
47 };
48 
49 static inline int gic_get_current_cpu(GICState *s)
50 {
51     if (s->num_cpu > 1) {
52         return current_cpu->cpu_index;
53     }
54     return 0;
55 }
56 
57 /* Return true if this GIC config has interrupt groups, which is
58  * true if we're a GICv2, or a GICv1 with the security extensions.
59  */
60 static inline bool gic_has_groups(GICState *s)
61 {
62     return s->revision == 2 || s->security_extn;
63 }
64 
65 /* TODO: Many places that call this routine could be optimized.  */
66 /* Update interrupt status after enabled or pending bits have been changed.  */
67 void gic_update(GICState *s)
68 {
69     int best_irq;
70     int best_prio;
71     int irq;
72     int irq_level, fiq_level;
73     int cpu;
74     int cm;
75 
76     for (cpu = 0; cpu < s->num_cpu; cpu++) {
77         cm = 1 << cpu;
78         s->current_pending[cpu] = 1023;
79         if (!(s->ctlr & (GICD_CTLR_EN_GRP0 | GICD_CTLR_EN_GRP1))
80             || !(s->cpu_ctlr[cpu] & (GICC_CTLR_EN_GRP0 | GICC_CTLR_EN_GRP1))) {
81             qemu_irq_lower(s->parent_irq[cpu]);
82             qemu_irq_lower(s->parent_fiq[cpu]);
83             continue;
84         }
85         best_prio = 0x100;
86         best_irq = 1023;
87         for (irq = 0; irq < s->num_irq; irq++) {
88             if (GIC_TEST_ENABLED(irq, cm) && gic_test_pending(s, irq, cm) &&
89                 (irq < GIC_INTERNAL || GIC_TARGET(irq) & cm)) {
90                 if (GIC_GET_PRIORITY(irq, cpu) < best_prio) {
91                     best_prio = GIC_GET_PRIORITY(irq, cpu);
92                     best_irq = irq;
93                 }
94             }
95         }
96 
97         if (best_irq != 1023) {
98             trace_gic_update_bestirq(cpu, best_irq, best_prio,
99                 s->priority_mask[cpu], s->running_priority[cpu]);
100         }
101 
102         irq_level = fiq_level = 0;
103 
104         if (best_prio < s->priority_mask[cpu]) {
105             s->current_pending[cpu] = best_irq;
106             if (best_prio < s->running_priority[cpu]) {
107                 int group = GIC_TEST_GROUP(best_irq, cm);
108 
109                 if (extract32(s->ctlr, group, 1) &&
110                     extract32(s->cpu_ctlr[cpu], group, 1)) {
111                     if (group == 0 && s->cpu_ctlr[cpu] & GICC_CTLR_FIQ_EN) {
112                         DPRINTF("Raised pending FIQ %d (cpu %d)\n",
113                                 best_irq, cpu);
114                         fiq_level = 1;
115                         trace_gic_update_set_irq(cpu, "fiq", fiq_level);
116                     } else {
117                         DPRINTF("Raised pending IRQ %d (cpu %d)\n",
118                                 best_irq, cpu);
119                         irq_level = 1;
120                         trace_gic_update_set_irq(cpu, "irq", irq_level);
121                     }
122                 }
123             }
124         }
125 
126         qemu_set_irq(s->parent_irq[cpu], irq_level);
127         qemu_set_irq(s->parent_fiq[cpu], fiq_level);
128     }
129 }
130 
131 void gic_set_pending_private(GICState *s, int cpu, int irq)
132 {
133     int cm = 1 << cpu;
134 
135     if (gic_test_pending(s, irq, cm)) {
136         return;
137     }
138 
139     DPRINTF("Set %d pending cpu %d\n", irq, cpu);
140     GIC_SET_PENDING(irq, cm);
141     gic_update(s);
142 }
143 
144 static void gic_set_irq_11mpcore(GICState *s, int irq, int level,
145                                  int cm, int target)
146 {
147     if (level) {
148         GIC_SET_LEVEL(irq, cm);
149         if (GIC_TEST_EDGE_TRIGGER(irq) || GIC_TEST_ENABLED(irq, cm)) {
150             DPRINTF("Set %d pending mask %x\n", irq, target);
151             GIC_SET_PENDING(irq, target);
152         }
153     } else {
154         GIC_CLEAR_LEVEL(irq, cm);
155     }
156 }
157 
158 static void gic_set_irq_generic(GICState *s, int irq, int level,
159                                 int cm, int target)
160 {
161     if (level) {
162         GIC_SET_LEVEL(irq, cm);
163         DPRINTF("Set %d pending mask %x\n", irq, target);
164         if (GIC_TEST_EDGE_TRIGGER(irq)) {
165             GIC_SET_PENDING(irq, target);
166         }
167     } else {
168         GIC_CLEAR_LEVEL(irq, cm);
169     }
170 }
171 
172 /* Process a change in an external IRQ input.  */
173 static void gic_set_irq(void *opaque, int irq, int level)
174 {
175     /* Meaning of the 'irq' parameter:
176      *  [0..N-1] : external interrupts
177      *  [N..N+31] : PPI (internal) interrupts for CPU 0
178      *  [N+32..N+63] : PPI (internal interrupts for CPU 1
179      *  ...
180      */
181     GICState *s = (GICState *)opaque;
182     int cm, target;
183     if (irq < (s->num_irq - GIC_INTERNAL)) {
184         /* The first external input line is internal interrupt 32.  */
185         cm = ALL_CPU_MASK;
186         irq += GIC_INTERNAL;
187         target = GIC_TARGET(irq);
188     } else {
189         int cpu;
190         irq -= (s->num_irq - GIC_INTERNAL);
191         cpu = irq / GIC_INTERNAL;
192         irq %= GIC_INTERNAL;
193         cm = 1 << cpu;
194         target = cm;
195     }
196 
197     assert(irq >= GIC_NR_SGIS);
198 
199     if (level == GIC_TEST_LEVEL(irq, cm)) {
200         return;
201     }
202 
203     if (s->revision == REV_11MPCORE || s->revision == REV_NVIC) {
204         gic_set_irq_11mpcore(s, irq, level, cm, target);
205     } else {
206         gic_set_irq_generic(s, irq, level, cm, target);
207     }
208     trace_gic_set_irq(irq, level, cm, target);
209 
210     gic_update(s);
211 }
212 
213 static uint16_t gic_get_current_pending_irq(GICState *s, int cpu,
214                                             MemTxAttrs attrs)
215 {
216     uint16_t pending_irq = s->current_pending[cpu];
217 
218     if (pending_irq < GIC_MAXIRQ && gic_has_groups(s)) {
219         int group = GIC_TEST_GROUP(pending_irq, (1 << cpu));
220         /* On a GIC without the security extensions, reading this register
221          * behaves in the same way as a secure access to a GIC with them.
222          */
223         bool secure = !s->security_extn || attrs.secure;
224 
225         if (group == 0 && !secure) {
226             /* Group0 interrupts hidden from Non-secure access */
227             return 1023;
228         }
229         if (group == 1 && secure && !(s->cpu_ctlr[cpu] & GICC_CTLR_ACK_CTL)) {
230             /* Group1 interrupts only seen by Secure access if
231              * AckCtl bit set.
232              */
233             return 1022;
234         }
235     }
236     return pending_irq;
237 }
238 
239 static int gic_get_group_priority(GICState *s, int cpu, int irq)
240 {
241     /* Return the group priority of the specified interrupt
242      * (which is the top bits of its priority, with the number
243      * of bits masked determined by the applicable binary point register).
244      */
245     int bpr;
246     uint32_t mask;
247 
248     if (gic_has_groups(s) &&
249         !(s->cpu_ctlr[cpu] & GICC_CTLR_CBPR) &&
250         GIC_TEST_GROUP(irq, (1 << cpu))) {
251         bpr = s->abpr[cpu];
252     } else {
253         bpr = s->bpr[cpu];
254     }
255 
256     /* a BPR of 0 means the group priority bits are [7:1];
257      * a BPR of 1 means they are [7:2], and so on down to
258      * a BPR of 7 meaning no group priority bits at all.
259      */
260     mask = ~0U << ((bpr & 7) + 1);
261 
262     return GIC_GET_PRIORITY(irq, cpu) & mask;
263 }
264 
265 static void gic_activate_irq(GICState *s, int cpu, int irq)
266 {
267     /* Set the appropriate Active Priority Register bit for this IRQ,
268      * and update the running priority.
269      */
270     int prio = gic_get_group_priority(s, cpu, irq);
271     int preemption_level = prio >> (GIC_MIN_BPR + 1);
272     int regno = preemption_level / 32;
273     int bitno = preemption_level % 32;
274 
275     if (gic_has_groups(s) && GIC_TEST_GROUP(irq, (1 << cpu))) {
276         s->nsapr[regno][cpu] |= (1 << bitno);
277     } else {
278         s->apr[regno][cpu] |= (1 << bitno);
279     }
280 
281     s->running_priority[cpu] = prio;
282     GIC_SET_ACTIVE(irq, 1 << cpu);
283 }
284 
285 static int gic_get_prio_from_apr_bits(GICState *s, int cpu)
286 {
287     /* Recalculate the current running priority for this CPU based
288      * on the set bits in the Active Priority Registers.
289      */
290     int i;
291     for (i = 0; i < GIC_NR_APRS; i++) {
292         uint32_t apr = s->apr[i][cpu] | s->nsapr[i][cpu];
293         if (!apr) {
294             continue;
295         }
296         return (i * 32 + ctz32(apr)) << (GIC_MIN_BPR + 1);
297     }
298     return 0x100;
299 }
300 
301 static void gic_drop_prio(GICState *s, int cpu, int group)
302 {
303     /* Drop the priority of the currently active interrupt in the
304      * specified group.
305      *
306      * Note that we can guarantee (because of the requirement to nest
307      * GICC_IAR reads [which activate an interrupt and raise priority]
308      * with GICC_EOIR writes [which drop the priority for the interrupt])
309      * that the interrupt we're being called for is the highest priority
310      * active interrupt, meaning that it has the lowest set bit in the
311      * APR registers.
312      *
313      * If the guest does not honour the ordering constraints then the
314      * behaviour of the GIC is UNPREDICTABLE, which for us means that
315      * the values of the APR registers might become incorrect and the
316      * running priority will be wrong, so interrupts that should preempt
317      * might not do so, and interrupts that should not preempt might do so.
318      */
319     int i;
320 
321     for (i = 0; i < GIC_NR_APRS; i++) {
322         uint32_t *papr = group ? &s->nsapr[i][cpu] : &s->apr[i][cpu];
323         if (!*papr) {
324             continue;
325         }
326         /* Clear lowest set bit */
327         *papr &= *papr - 1;
328         break;
329     }
330 
331     s->running_priority[cpu] = gic_get_prio_from_apr_bits(s, cpu);
332 }
333 
334 uint32_t gic_acknowledge_irq(GICState *s, int cpu, MemTxAttrs attrs)
335 {
336     int ret, irq, src;
337     int cm = 1 << cpu;
338 
339     /* gic_get_current_pending_irq() will return 1022 or 1023 appropriately
340      * for the case where this GIC supports grouping and the pending interrupt
341      * is in the wrong group.
342      */
343     irq = gic_get_current_pending_irq(s, cpu, attrs);
344     trace_gic_acknowledge_irq(cpu, irq);
345 
346     if (irq >= GIC_MAXIRQ) {
347         DPRINTF("ACK, no pending interrupt or it is hidden: %d\n", irq);
348         return irq;
349     }
350 
351     if (GIC_GET_PRIORITY(irq, cpu) >= s->running_priority[cpu]) {
352         DPRINTF("ACK, pending interrupt (%d) has insufficient priority\n", irq);
353         return 1023;
354     }
355 
356     if (s->revision == REV_11MPCORE || s->revision == REV_NVIC) {
357         /* Clear pending flags for both level and edge triggered interrupts.
358          * Level triggered IRQs will be reasserted once they become inactive.
359          */
360         GIC_CLEAR_PENDING(irq, GIC_TEST_MODEL(irq) ? ALL_CPU_MASK : cm);
361         ret = irq;
362     } else {
363         if (irq < GIC_NR_SGIS) {
364             /* Lookup the source CPU for the SGI and clear this in the
365              * sgi_pending map.  Return the src and clear the overall pending
366              * state on this CPU if the SGI is not pending from any CPUs.
367              */
368             assert(s->sgi_pending[irq][cpu] != 0);
369             src = ctz32(s->sgi_pending[irq][cpu]);
370             s->sgi_pending[irq][cpu] &= ~(1 << src);
371             if (s->sgi_pending[irq][cpu] == 0) {
372                 GIC_CLEAR_PENDING(irq, GIC_TEST_MODEL(irq) ? ALL_CPU_MASK : cm);
373             }
374             ret = irq | ((src & 0x7) << 10);
375         } else {
376             /* Clear pending state for both level and edge triggered
377              * interrupts. (level triggered interrupts with an active line
378              * remain pending, see gic_test_pending)
379              */
380             GIC_CLEAR_PENDING(irq, GIC_TEST_MODEL(irq) ? ALL_CPU_MASK : cm);
381             ret = irq;
382         }
383     }
384 
385     gic_activate_irq(s, cpu, irq);
386     gic_update(s);
387     DPRINTF("ACK %d\n", irq);
388     return ret;
389 }
390 
391 void gic_set_priority(GICState *s, int cpu, int irq, uint8_t val,
392                       MemTxAttrs attrs)
393 {
394     if (s->security_extn && !attrs.secure) {
395         if (!GIC_TEST_GROUP(irq, (1 << cpu))) {
396             return; /* Ignore Non-secure access of Group0 IRQ */
397         }
398         val = 0x80 | (val >> 1); /* Non-secure view */
399     }
400 
401     if (irq < GIC_INTERNAL) {
402         s->priority1[irq][cpu] = val;
403     } else {
404         s->priority2[(irq) - GIC_INTERNAL] = val;
405     }
406 }
407 
408 static uint32_t gic_get_priority(GICState *s, int cpu, int irq,
409                                  MemTxAttrs attrs)
410 {
411     uint32_t prio = GIC_GET_PRIORITY(irq, cpu);
412 
413     if (s->security_extn && !attrs.secure) {
414         if (!GIC_TEST_GROUP(irq, (1 << cpu))) {
415             return 0; /* Non-secure access cannot read priority of Group0 IRQ */
416         }
417         prio = (prio << 1) & 0xff; /* Non-secure view */
418     }
419     return prio;
420 }
421 
422 static void gic_set_priority_mask(GICState *s, int cpu, uint8_t pmask,
423                                   MemTxAttrs attrs)
424 {
425     if (s->security_extn && !attrs.secure) {
426         if (s->priority_mask[cpu] & 0x80) {
427             /* Priority Mask in upper half */
428             pmask = 0x80 | (pmask >> 1);
429         } else {
430             /* Non-secure write ignored if priority mask is in lower half */
431             return;
432         }
433     }
434     s->priority_mask[cpu] = pmask;
435 }
436 
437 static uint32_t gic_get_priority_mask(GICState *s, int cpu, MemTxAttrs attrs)
438 {
439     uint32_t pmask = s->priority_mask[cpu];
440 
441     if (s->security_extn && !attrs.secure) {
442         if (pmask & 0x80) {
443             /* Priority Mask in upper half, return Non-secure view */
444             pmask = (pmask << 1) & 0xff;
445         } else {
446             /* Priority Mask in lower half, RAZ */
447             pmask = 0;
448         }
449     }
450     return pmask;
451 }
452 
453 static uint32_t gic_get_cpu_control(GICState *s, int cpu, MemTxAttrs attrs)
454 {
455     uint32_t ret = s->cpu_ctlr[cpu];
456 
457     if (s->security_extn && !attrs.secure) {
458         /* Construct the NS banked view of GICC_CTLR from the correct
459          * bits of the S banked view. We don't need to move the bypass
460          * control bits because we don't implement that (IMPDEF) part
461          * of the GIC architecture.
462          */
463         ret = (ret & (GICC_CTLR_EN_GRP1 | GICC_CTLR_EOIMODE_NS)) >> 1;
464     }
465     return ret;
466 }
467 
468 static void gic_set_cpu_control(GICState *s, int cpu, uint32_t value,
469                                 MemTxAttrs attrs)
470 {
471     uint32_t mask;
472 
473     if (s->security_extn && !attrs.secure) {
474         /* The NS view can only write certain bits in the register;
475          * the rest are unchanged
476          */
477         mask = GICC_CTLR_EN_GRP1;
478         if (s->revision == 2) {
479             mask |= GICC_CTLR_EOIMODE_NS;
480         }
481         s->cpu_ctlr[cpu] &= ~mask;
482         s->cpu_ctlr[cpu] |= (value << 1) & mask;
483     } else {
484         if (s->revision == 2) {
485             mask = s->security_extn ? GICC_CTLR_V2_S_MASK : GICC_CTLR_V2_MASK;
486         } else {
487             mask = s->security_extn ? GICC_CTLR_V1_S_MASK : GICC_CTLR_V1_MASK;
488         }
489         s->cpu_ctlr[cpu] = value & mask;
490     }
491     DPRINTF("CPU Interface %d: Group0 Interrupts %sabled, "
492             "Group1 Interrupts %sabled\n", cpu,
493             (s->cpu_ctlr[cpu] & GICC_CTLR_EN_GRP0) ? "En" : "Dis",
494             (s->cpu_ctlr[cpu] & GICC_CTLR_EN_GRP1) ? "En" : "Dis");
495 }
496 
497 static uint8_t gic_get_running_priority(GICState *s, int cpu, MemTxAttrs attrs)
498 {
499     if (s->security_extn && !attrs.secure) {
500         if (s->running_priority[cpu] & 0x80) {
501             /* Running priority in upper half of range: return the Non-secure
502              * view of the priority.
503              */
504             return s->running_priority[cpu] << 1;
505         } else {
506             /* Running priority in lower half of range: RAZ */
507             return 0;
508         }
509     } else {
510         return s->running_priority[cpu];
511     }
512 }
513 
514 /* Return true if we should split priority drop and interrupt deactivation,
515  * ie whether the relevant EOIMode bit is set.
516  */
517 static bool gic_eoi_split(GICState *s, int cpu, MemTxAttrs attrs)
518 {
519     if (s->revision != 2) {
520         /* Before GICv2 prio-drop and deactivate are not separable */
521         return false;
522     }
523     if (s->security_extn && !attrs.secure) {
524         return s->cpu_ctlr[cpu] & GICC_CTLR_EOIMODE_NS;
525     }
526     return s->cpu_ctlr[cpu] & GICC_CTLR_EOIMODE;
527 }
528 
529 static void gic_deactivate_irq(GICState *s, int cpu, int irq, MemTxAttrs attrs)
530 {
531     int cm = 1 << cpu;
532     int group = gic_has_groups(s) && GIC_TEST_GROUP(irq, cm);
533 
534     if (!gic_eoi_split(s, cpu, attrs)) {
535         /* This is UNPREDICTABLE; we choose to ignore it */
536         qemu_log_mask(LOG_GUEST_ERROR,
537                       "gic_deactivate_irq: GICC_DIR write when EOIMode clear");
538         return;
539     }
540 
541     if (s->security_extn && !attrs.secure && !group) {
542         DPRINTF("Non-secure DI for Group0 interrupt %d ignored\n", irq);
543         return;
544     }
545 
546     GIC_CLEAR_ACTIVE(irq, cm);
547 }
548 
549 void gic_complete_irq(GICState *s, int cpu, int irq, MemTxAttrs attrs)
550 {
551     int cm = 1 << cpu;
552     int group;
553 
554     DPRINTF("EOI %d\n", irq);
555     if (irq >= s->num_irq) {
556         /* This handles two cases:
557          * 1. If software writes the ID of a spurious interrupt [ie 1023]
558          * to the GICC_EOIR, the GIC ignores that write.
559          * 2. If software writes the number of a non-existent interrupt
560          * this must be a subcase of "value written does not match the last
561          * valid interrupt value read from the Interrupt Acknowledge
562          * register" and so this is UNPREDICTABLE. We choose to ignore it.
563          */
564         return;
565     }
566     if (s->running_priority[cpu] == 0x100) {
567         return; /* No active IRQ.  */
568     }
569 
570     if (s->revision == REV_11MPCORE || s->revision == REV_NVIC) {
571         /* Mark level triggered interrupts as pending if they are still
572            raised.  */
573         if (!GIC_TEST_EDGE_TRIGGER(irq) && GIC_TEST_ENABLED(irq, cm)
574             && GIC_TEST_LEVEL(irq, cm) && (GIC_TARGET(irq) & cm) != 0) {
575             DPRINTF("Set %d pending mask %x\n", irq, cm);
576             GIC_SET_PENDING(irq, cm);
577         }
578     }
579 
580     group = gic_has_groups(s) && GIC_TEST_GROUP(irq, cm);
581 
582     if (s->security_extn && !attrs.secure && !group) {
583         DPRINTF("Non-secure EOI for Group0 interrupt %d ignored\n", irq);
584         return;
585     }
586 
587     /* Secure EOI with GICC_CTLR.AckCtl == 0 when the IRQ is a Group 1
588      * interrupt is UNPREDICTABLE. We choose to handle it as if AckCtl == 1,
589      * i.e. go ahead and complete the irq anyway.
590      */
591 
592     gic_drop_prio(s, cpu, group);
593 
594     /* In GICv2 the guest can choose to split priority-drop and deactivate */
595     if (!gic_eoi_split(s, cpu, attrs)) {
596         GIC_CLEAR_ACTIVE(irq, cm);
597     }
598     gic_update(s);
599 }
600 
601 static uint32_t gic_dist_readb(void *opaque, hwaddr offset, MemTxAttrs attrs)
602 {
603     GICState *s = (GICState *)opaque;
604     uint32_t res;
605     int irq;
606     int i;
607     int cpu;
608     int cm;
609     int mask;
610 
611     cpu = gic_get_current_cpu(s);
612     cm = 1 << cpu;
613     if (offset < 0x100) {
614         if (offset == 0) {      /* GICD_CTLR */
615             if (s->security_extn && !attrs.secure) {
616                 /* The NS bank of this register is just an alias of the
617                  * EnableGrp1 bit in the S bank version.
618                  */
619                 return extract32(s->ctlr, 1, 1);
620             } else {
621                 return s->ctlr;
622             }
623         }
624         if (offset == 4)
625             /* Interrupt Controller Type Register */
626             return ((s->num_irq / 32) - 1)
627                     | ((s->num_cpu - 1) << 5)
628                     | (s->security_extn << 10);
629         if (offset < 0x08)
630             return 0;
631         if (offset >= 0x80) {
632             /* Interrupt Group Registers: these RAZ/WI if this is an NS
633              * access to a GIC with the security extensions, or if the GIC
634              * doesn't have groups at all.
635              */
636             res = 0;
637             if (!(s->security_extn && !attrs.secure) && gic_has_groups(s)) {
638                 /* Every byte offset holds 8 group status bits */
639                 irq = (offset - 0x080) * 8 + GIC_BASE_IRQ;
640                 if (irq >= s->num_irq) {
641                     goto bad_reg;
642                 }
643                 for (i = 0; i < 8; i++) {
644                     if (GIC_TEST_GROUP(irq + i, cm)) {
645                         res |= (1 << i);
646                     }
647                 }
648             }
649             return res;
650         }
651         goto bad_reg;
652     } else if (offset < 0x200) {
653         /* Interrupt Set/Clear Enable.  */
654         if (offset < 0x180)
655             irq = (offset - 0x100) * 8;
656         else
657             irq = (offset - 0x180) * 8;
658         irq += GIC_BASE_IRQ;
659         if (irq >= s->num_irq)
660             goto bad_reg;
661         res = 0;
662         for (i = 0; i < 8; i++) {
663             if (GIC_TEST_ENABLED(irq + i, cm)) {
664                 res |= (1 << i);
665             }
666         }
667     } else if (offset < 0x300) {
668         /* Interrupt Set/Clear Pending.  */
669         if (offset < 0x280)
670             irq = (offset - 0x200) * 8;
671         else
672             irq = (offset - 0x280) * 8;
673         irq += GIC_BASE_IRQ;
674         if (irq >= s->num_irq)
675             goto bad_reg;
676         res = 0;
677         mask = (irq < GIC_INTERNAL) ?  cm : ALL_CPU_MASK;
678         for (i = 0; i < 8; i++) {
679             if (gic_test_pending(s, irq + i, mask)) {
680                 res |= (1 << i);
681             }
682         }
683     } else if (offset < 0x400) {
684         /* Interrupt Active.  */
685         irq = (offset - 0x300) * 8 + GIC_BASE_IRQ;
686         if (irq >= s->num_irq)
687             goto bad_reg;
688         res = 0;
689         mask = (irq < GIC_INTERNAL) ?  cm : ALL_CPU_MASK;
690         for (i = 0; i < 8; i++) {
691             if (GIC_TEST_ACTIVE(irq + i, mask)) {
692                 res |= (1 << i);
693             }
694         }
695     } else if (offset < 0x800) {
696         /* Interrupt Priority.  */
697         irq = (offset - 0x400) + GIC_BASE_IRQ;
698         if (irq >= s->num_irq)
699             goto bad_reg;
700         res = gic_get_priority(s, cpu, irq, attrs);
701     } else if (offset < 0xc00) {
702         /* Interrupt CPU Target.  */
703         if (s->num_cpu == 1 && s->revision != REV_11MPCORE) {
704             /* For uniprocessor GICs these RAZ/WI */
705             res = 0;
706         } else {
707             irq = (offset - 0x800) + GIC_BASE_IRQ;
708             if (irq >= s->num_irq) {
709                 goto bad_reg;
710             }
711             if (irq >= 29 && irq <= 31) {
712                 res = cm;
713             } else {
714                 res = GIC_TARGET(irq);
715             }
716         }
717     } else if (offset < 0xf00) {
718         /* Interrupt Configuration.  */
719         irq = (offset - 0xc00) * 4 + GIC_BASE_IRQ;
720         if (irq >= s->num_irq)
721             goto bad_reg;
722         res = 0;
723         for (i = 0; i < 4; i++) {
724             if (GIC_TEST_MODEL(irq + i))
725                 res |= (1 << (i * 2));
726             if (GIC_TEST_EDGE_TRIGGER(irq + i))
727                 res |= (2 << (i * 2));
728         }
729     } else if (offset < 0xf10) {
730         goto bad_reg;
731     } else if (offset < 0xf30) {
732         if (s->revision == REV_11MPCORE || s->revision == REV_NVIC) {
733             goto bad_reg;
734         }
735 
736         if (offset < 0xf20) {
737             /* GICD_CPENDSGIRn */
738             irq = (offset - 0xf10);
739         } else {
740             irq = (offset - 0xf20);
741             /* GICD_SPENDSGIRn */
742         }
743 
744         res = s->sgi_pending[irq][cpu];
745     } else if (offset < 0xfd0) {
746         goto bad_reg;
747     } else if (offset < 0x1000) {
748         if (offset & 3) {
749             res = 0;
750         } else {
751             switch (s->revision) {
752             case REV_11MPCORE:
753                 res = gic_id_11mpcore[(offset - 0xfd0) >> 2];
754                 break;
755             case 1:
756                 res = gic_id_gicv1[(offset - 0xfd0) >> 2];
757                 break;
758             case 2:
759                 res = gic_id_gicv2[(offset - 0xfd0) >> 2];
760                 break;
761             case REV_NVIC:
762                 /* Shouldn't be able to get here */
763                 abort();
764             default:
765                 res = 0;
766             }
767         }
768     } else {
769         g_assert_not_reached();
770     }
771     return res;
772 bad_reg:
773     qemu_log_mask(LOG_GUEST_ERROR,
774                   "gic_dist_readb: Bad offset %x\n", (int)offset);
775     return 0;
776 }
777 
778 static MemTxResult gic_dist_read(void *opaque, hwaddr offset, uint64_t *data,
779                                  unsigned size, MemTxAttrs attrs)
780 {
781     switch (size) {
782     case 1:
783         *data = gic_dist_readb(opaque, offset, attrs);
784         return MEMTX_OK;
785     case 2:
786         *data = gic_dist_readb(opaque, offset, attrs);
787         *data |= gic_dist_readb(opaque, offset + 1, attrs) << 8;
788         return MEMTX_OK;
789     case 4:
790         *data = gic_dist_readb(opaque, offset, attrs);
791         *data |= gic_dist_readb(opaque, offset + 1, attrs) << 8;
792         *data |= gic_dist_readb(opaque, offset + 2, attrs) << 16;
793         *data |= gic_dist_readb(opaque, offset + 3, attrs) << 24;
794         return MEMTX_OK;
795     default:
796         return MEMTX_ERROR;
797     }
798 }
799 
800 static void gic_dist_writeb(void *opaque, hwaddr offset,
801                             uint32_t value, MemTxAttrs attrs)
802 {
803     GICState *s = (GICState *)opaque;
804     int irq;
805     int i;
806     int cpu;
807 
808     cpu = gic_get_current_cpu(s);
809     if (offset < 0x100) {
810         if (offset == 0) {
811             if (s->security_extn && !attrs.secure) {
812                 /* NS version is just an alias of the S version's bit 1 */
813                 s->ctlr = deposit32(s->ctlr, 1, 1, value);
814             } else if (gic_has_groups(s)) {
815                 s->ctlr = value & (GICD_CTLR_EN_GRP0 | GICD_CTLR_EN_GRP1);
816             } else {
817                 s->ctlr = value & GICD_CTLR_EN_GRP0;
818             }
819             DPRINTF("Distributor: Group0 %sabled; Group 1 %sabled\n",
820                     s->ctlr & GICD_CTLR_EN_GRP0 ? "En" : "Dis",
821                     s->ctlr & GICD_CTLR_EN_GRP1 ? "En" : "Dis");
822         } else if (offset < 4) {
823             /* ignored.  */
824         } else if (offset >= 0x80) {
825             /* Interrupt Group Registers: RAZ/WI for NS access to secure
826              * GIC, or for GICs without groups.
827              */
828             if (!(s->security_extn && !attrs.secure) && gic_has_groups(s)) {
829                 /* Every byte offset holds 8 group status bits */
830                 irq = (offset - 0x80) * 8 + GIC_BASE_IRQ;
831                 if (irq >= s->num_irq) {
832                     goto bad_reg;
833                 }
834                 for (i = 0; i < 8; i++) {
835                     /* Group bits are banked for private interrupts */
836                     int cm = (irq < GIC_INTERNAL) ? (1 << cpu) : ALL_CPU_MASK;
837                     if (value & (1 << i)) {
838                         /* Group1 (Non-secure) */
839                         GIC_SET_GROUP(irq + i, cm);
840                     } else {
841                         /* Group0 (Secure) */
842                         GIC_CLEAR_GROUP(irq + i, cm);
843                     }
844                 }
845             }
846         } else {
847             goto bad_reg;
848         }
849     } else if (offset < 0x180) {
850         /* Interrupt Set Enable.  */
851         irq = (offset - 0x100) * 8 + GIC_BASE_IRQ;
852         if (irq >= s->num_irq)
853             goto bad_reg;
854         if (irq < GIC_NR_SGIS) {
855             value = 0xff;
856         }
857 
858         for (i = 0; i < 8; i++) {
859             if (value & (1 << i)) {
860                 int mask =
861                     (irq < GIC_INTERNAL) ? (1 << cpu) : GIC_TARGET(irq + i);
862                 int cm = (irq < GIC_INTERNAL) ? (1 << cpu) : ALL_CPU_MASK;
863 
864                 if (!GIC_TEST_ENABLED(irq + i, cm)) {
865                     DPRINTF("Enabled IRQ %d\n", irq + i);
866                     trace_gic_enable_irq(irq + i);
867                 }
868                 GIC_SET_ENABLED(irq + i, cm);
869                 /* If a raised level triggered IRQ enabled then mark
870                    is as pending.  */
871                 if (GIC_TEST_LEVEL(irq + i, mask)
872                         && !GIC_TEST_EDGE_TRIGGER(irq + i)) {
873                     DPRINTF("Set %d pending mask %x\n", irq + i, mask);
874                     GIC_SET_PENDING(irq + i, mask);
875                 }
876             }
877         }
878     } else if (offset < 0x200) {
879         /* Interrupt Clear Enable.  */
880         irq = (offset - 0x180) * 8 + GIC_BASE_IRQ;
881         if (irq >= s->num_irq)
882             goto bad_reg;
883         if (irq < GIC_NR_SGIS) {
884             value = 0;
885         }
886 
887         for (i = 0; i < 8; i++) {
888             if (value & (1 << i)) {
889                 int cm = (irq < GIC_INTERNAL) ? (1 << cpu) : ALL_CPU_MASK;
890 
891                 if (GIC_TEST_ENABLED(irq + i, cm)) {
892                     DPRINTF("Disabled IRQ %d\n", irq + i);
893                     trace_gic_disable_irq(irq + i);
894                 }
895                 GIC_CLEAR_ENABLED(irq + i, cm);
896             }
897         }
898     } else if (offset < 0x280) {
899         /* Interrupt Set Pending.  */
900         irq = (offset - 0x200) * 8 + GIC_BASE_IRQ;
901         if (irq >= s->num_irq)
902             goto bad_reg;
903         if (irq < GIC_NR_SGIS) {
904             value = 0;
905         }
906 
907         for (i = 0; i < 8; i++) {
908             if (value & (1 << i)) {
909                 GIC_SET_PENDING(irq + i, GIC_TARGET(irq + i));
910             }
911         }
912     } else if (offset < 0x300) {
913         /* Interrupt Clear Pending.  */
914         irq = (offset - 0x280) * 8 + GIC_BASE_IRQ;
915         if (irq >= s->num_irq)
916             goto bad_reg;
917         if (irq < GIC_NR_SGIS) {
918             value = 0;
919         }
920 
921         for (i = 0; i < 8; i++) {
922             /* ??? This currently clears the pending bit for all CPUs, even
923                for per-CPU interrupts.  It's unclear whether this is the
924                corect behavior.  */
925             if (value & (1 << i)) {
926                 GIC_CLEAR_PENDING(irq + i, ALL_CPU_MASK);
927             }
928         }
929     } else if (offset < 0x400) {
930         /* Interrupt Active.  */
931         goto bad_reg;
932     } else if (offset < 0x800) {
933         /* Interrupt Priority.  */
934         irq = (offset - 0x400) + GIC_BASE_IRQ;
935         if (irq >= s->num_irq)
936             goto bad_reg;
937         gic_set_priority(s, cpu, irq, value, attrs);
938     } else if (offset < 0xc00) {
939         /* Interrupt CPU Target. RAZ/WI on uniprocessor GICs, with the
940          * annoying exception of the 11MPCore's GIC.
941          */
942         if (s->num_cpu != 1 || s->revision == REV_11MPCORE) {
943             irq = (offset - 0x800) + GIC_BASE_IRQ;
944             if (irq >= s->num_irq) {
945                 goto bad_reg;
946             }
947             if (irq < 29) {
948                 value = 0;
949             } else if (irq < GIC_INTERNAL) {
950                 value = ALL_CPU_MASK;
951             }
952             s->irq_target[irq] = value & ALL_CPU_MASK;
953         }
954     } else if (offset < 0xf00) {
955         /* Interrupt Configuration.  */
956         irq = (offset - 0xc00) * 4 + GIC_BASE_IRQ;
957         if (irq >= s->num_irq)
958             goto bad_reg;
959         if (irq < GIC_NR_SGIS)
960             value |= 0xaa;
961         for (i = 0; i < 4; i++) {
962             if (s->revision == REV_11MPCORE || s->revision == REV_NVIC) {
963                 if (value & (1 << (i * 2))) {
964                     GIC_SET_MODEL(irq + i);
965                 } else {
966                     GIC_CLEAR_MODEL(irq + i);
967                 }
968             }
969             if (value & (2 << (i * 2))) {
970                 GIC_SET_EDGE_TRIGGER(irq + i);
971             } else {
972                 GIC_CLEAR_EDGE_TRIGGER(irq + i);
973             }
974         }
975     } else if (offset < 0xf10) {
976         /* 0xf00 is only handled for 32-bit writes.  */
977         goto bad_reg;
978     } else if (offset < 0xf20) {
979         /* GICD_CPENDSGIRn */
980         if (s->revision == REV_11MPCORE || s->revision == REV_NVIC) {
981             goto bad_reg;
982         }
983         irq = (offset - 0xf10);
984 
985         s->sgi_pending[irq][cpu] &= ~value;
986         if (s->sgi_pending[irq][cpu] == 0) {
987             GIC_CLEAR_PENDING(irq, 1 << cpu);
988         }
989     } else if (offset < 0xf30) {
990         /* GICD_SPENDSGIRn */
991         if (s->revision == REV_11MPCORE || s->revision == REV_NVIC) {
992             goto bad_reg;
993         }
994         irq = (offset - 0xf20);
995 
996         GIC_SET_PENDING(irq, 1 << cpu);
997         s->sgi_pending[irq][cpu] |= value;
998     } else {
999         goto bad_reg;
1000     }
1001     gic_update(s);
1002     return;
1003 bad_reg:
1004     qemu_log_mask(LOG_GUEST_ERROR,
1005                   "gic_dist_writeb: Bad offset %x\n", (int)offset);
1006 }
1007 
1008 static void gic_dist_writew(void *opaque, hwaddr offset,
1009                             uint32_t value, MemTxAttrs attrs)
1010 {
1011     gic_dist_writeb(opaque, offset, value & 0xff, attrs);
1012     gic_dist_writeb(opaque, offset + 1, value >> 8, attrs);
1013 }
1014 
1015 static void gic_dist_writel(void *opaque, hwaddr offset,
1016                             uint32_t value, MemTxAttrs attrs)
1017 {
1018     GICState *s = (GICState *)opaque;
1019     if (offset == 0xf00) {
1020         int cpu;
1021         int irq;
1022         int mask;
1023         int target_cpu;
1024 
1025         cpu = gic_get_current_cpu(s);
1026         irq = value & 0x3ff;
1027         switch ((value >> 24) & 3) {
1028         case 0:
1029             mask = (value >> 16) & ALL_CPU_MASK;
1030             break;
1031         case 1:
1032             mask = ALL_CPU_MASK ^ (1 << cpu);
1033             break;
1034         case 2:
1035             mask = 1 << cpu;
1036             break;
1037         default:
1038             DPRINTF("Bad Soft Int target filter\n");
1039             mask = ALL_CPU_MASK;
1040             break;
1041         }
1042         GIC_SET_PENDING(irq, mask);
1043         target_cpu = ctz32(mask);
1044         while (target_cpu < GIC_NCPU) {
1045             s->sgi_pending[irq][target_cpu] |= (1 << cpu);
1046             mask &= ~(1 << target_cpu);
1047             target_cpu = ctz32(mask);
1048         }
1049         gic_update(s);
1050         return;
1051     }
1052     gic_dist_writew(opaque, offset, value & 0xffff, attrs);
1053     gic_dist_writew(opaque, offset + 2, value >> 16, attrs);
1054 }
1055 
1056 static MemTxResult gic_dist_write(void *opaque, hwaddr offset, uint64_t data,
1057                                   unsigned size, MemTxAttrs attrs)
1058 {
1059     switch (size) {
1060     case 1:
1061         gic_dist_writeb(opaque, offset, data, attrs);
1062         return MEMTX_OK;
1063     case 2:
1064         gic_dist_writew(opaque, offset, data, attrs);
1065         return MEMTX_OK;
1066     case 4:
1067         gic_dist_writel(opaque, offset, data, attrs);
1068         return MEMTX_OK;
1069     default:
1070         return MEMTX_ERROR;
1071     }
1072 }
1073 
1074 static inline uint32_t gic_apr_ns_view(GICState *s, int cpu, int regno)
1075 {
1076     /* Return the Nonsecure view of GICC_APR<regno>. This is the
1077      * second half of GICC_NSAPR.
1078      */
1079     switch (GIC_MIN_BPR) {
1080     case 0:
1081         if (regno < 2) {
1082             return s->nsapr[regno + 2][cpu];
1083         }
1084         break;
1085     case 1:
1086         if (regno == 0) {
1087             return s->nsapr[regno + 1][cpu];
1088         }
1089         break;
1090     case 2:
1091         if (regno == 0) {
1092             return extract32(s->nsapr[0][cpu], 16, 16);
1093         }
1094         break;
1095     case 3:
1096         if (regno == 0) {
1097             return extract32(s->nsapr[0][cpu], 8, 8);
1098         }
1099         break;
1100     default:
1101         g_assert_not_reached();
1102     }
1103     return 0;
1104 }
1105 
1106 static inline void gic_apr_write_ns_view(GICState *s, int cpu, int regno,
1107                                          uint32_t value)
1108 {
1109     /* Write the Nonsecure view of GICC_APR<regno>. */
1110     switch (GIC_MIN_BPR) {
1111     case 0:
1112         if (regno < 2) {
1113             s->nsapr[regno + 2][cpu] = value;
1114         }
1115         break;
1116     case 1:
1117         if (regno == 0) {
1118             s->nsapr[regno + 1][cpu] = value;
1119         }
1120         break;
1121     case 2:
1122         if (regno == 0) {
1123             s->nsapr[0][cpu] = deposit32(s->nsapr[0][cpu], 16, 16, value);
1124         }
1125         break;
1126     case 3:
1127         if (regno == 0) {
1128             s->nsapr[0][cpu] = deposit32(s->nsapr[0][cpu], 8, 8, value);
1129         }
1130         break;
1131     default:
1132         g_assert_not_reached();
1133     }
1134 }
1135 
1136 static MemTxResult gic_cpu_read(GICState *s, int cpu, int offset,
1137                                 uint64_t *data, MemTxAttrs attrs)
1138 {
1139     switch (offset) {
1140     case 0x00: /* Control */
1141         *data = gic_get_cpu_control(s, cpu, attrs);
1142         break;
1143     case 0x04: /* Priority mask */
1144         *data = gic_get_priority_mask(s, cpu, attrs);
1145         break;
1146     case 0x08: /* Binary Point */
1147         if (s->security_extn && !attrs.secure) {
1148             /* BPR is banked. Non-secure copy stored in ABPR. */
1149             *data = s->abpr[cpu];
1150         } else {
1151             *data = s->bpr[cpu];
1152         }
1153         break;
1154     case 0x0c: /* Acknowledge */
1155         *data = gic_acknowledge_irq(s, cpu, attrs);
1156         break;
1157     case 0x14: /* Running Priority */
1158         *data = gic_get_running_priority(s, cpu, attrs);
1159         break;
1160     case 0x18: /* Highest Pending Interrupt */
1161         *data = gic_get_current_pending_irq(s, cpu, attrs);
1162         break;
1163     case 0x1c: /* Aliased Binary Point */
1164         /* GIC v2, no security: ABPR
1165          * GIC v1, no security: not implemented (RAZ/WI)
1166          * With security extensions, secure access: ABPR (alias of NS BPR)
1167          * With security extensions, nonsecure access: RAZ/WI
1168          */
1169         if (!gic_has_groups(s) || (s->security_extn && !attrs.secure)) {
1170             *data = 0;
1171         } else {
1172             *data = s->abpr[cpu];
1173         }
1174         break;
1175     case 0xd0: case 0xd4: case 0xd8: case 0xdc:
1176     {
1177         int regno = (offset - 0xd0) / 4;
1178 
1179         if (regno >= GIC_NR_APRS || s->revision != 2) {
1180             *data = 0;
1181         } else if (s->security_extn && !attrs.secure) {
1182             /* NS view of GICC_APR<n> is the top half of GIC_NSAPR<n> */
1183             *data = gic_apr_ns_view(s, regno, cpu);
1184         } else {
1185             *data = s->apr[regno][cpu];
1186         }
1187         break;
1188     }
1189     case 0xe0: case 0xe4: case 0xe8: case 0xec:
1190     {
1191         int regno = (offset - 0xe0) / 4;
1192 
1193         if (regno >= GIC_NR_APRS || s->revision != 2 || !gic_has_groups(s) ||
1194             (s->security_extn && !attrs.secure)) {
1195             *data = 0;
1196         } else {
1197             *data = s->nsapr[regno][cpu];
1198         }
1199         break;
1200     }
1201     default:
1202         qemu_log_mask(LOG_GUEST_ERROR,
1203                       "gic_cpu_read: Bad offset %x\n", (int)offset);
1204         return MEMTX_ERROR;
1205     }
1206     return MEMTX_OK;
1207 }
1208 
1209 static MemTxResult gic_cpu_write(GICState *s, int cpu, int offset,
1210                                  uint32_t value, MemTxAttrs attrs)
1211 {
1212     switch (offset) {
1213     case 0x00: /* Control */
1214         gic_set_cpu_control(s, cpu, value, attrs);
1215         break;
1216     case 0x04: /* Priority mask */
1217         gic_set_priority_mask(s, cpu, value, attrs);
1218         break;
1219     case 0x08: /* Binary Point */
1220         if (s->security_extn && !attrs.secure) {
1221             s->abpr[cpu] = MAX(value & 0x7, GIC_MIN_ABPR);
1222         } else {
1223             s->bpr[cpu] = MAX(value & 0x7, GIC_MIN_BPR);
1224         }
1225         break;
1226     case 0x10: /* End Of Interrupt */
1227         gic_complete_irq(s, cpu, value & 0x3ff, attrs);
1228         return MEMTX_OK;
1229     case 0x1c: /* Aliased Binary Point */
1230         if (!gic_has_groups(s) || (s->security_extn && !attrs.secure)) {
1231             /* unimplemented, or NS access: RAZ/WI */
1232             return MEMTX_OK;
1233         } else {
1234             s->abpr[cpu] = MAX(value & 0x7, GIC_MIN_ABPR);
1235         }
1236         break;
1237     case 0xd0: case 0xd4: case 0xd8: case 0xdc:
1238     {
1239         int regno = (offset - 0xd0) / 4;
1240 
1241         if (regno >= GIC_NR_APRS || s->revision != 2) {
1242             return MEMTX_OK;
1243         }
1244         if (s->security_extn && !attrs.secure) {
1245             /* NS view of GICC_APR<n> is the top half of GIC_NSAPR<n> */
1246             gic_apr_write_ns_view(s, regno, cpu, value);
1247         } else {
1248             s->apr[regno][cpu] = value;
1249         }
1250         break;
1251     }
1252     case 0xe0: case 0xe4: case 0xe8: case 0xec:
1253     {
1254         int regno = (offset - 0xe0) / 4;
1255 
1256         if (regno >= GIC_NR_APRS || s->revision != 2) {
1257             return MEMTX_OK;
1258         }
1259         if (!gic_has_groups(s) || (s->security_extn && !attrs.secure)) {
1260             return MEMTX_OK;
1261         }
1262         s->nsapr[regno][cpu] = value;
1263         break;
1264     }
1265     case 0x1000:
1266         /* GICC_DIR */
1267         gic_deactivate_irq(s, cpu, value & 0x3ff, attrs);
1268         break;
1269     default:
1270         qemu_log_mask(LOG_GUEST_ERROR,
1271                       "gic_cpu_write: Bad offset %x\n", (int)offset);
1272         return MEMTX_ERROR;
1273     }
1274     gic_update(s);
1275     return MEMTX_OK;
1276 }
1277 
1278 /* Wrappers to read/write the GIC CPU interface for the current CPU */
1279 static MemTxResult gic_thiscpu_read(void *opaque, hwaddr addr, uint64_t *data,
1280                                     unsigned size, MemTxAttrs attrs)
1281 {
1282     GICState *s = (GICState *)opaque;
1283     return gic_cpu_read(s, gic_get_current_cpu(s), addr, data, attrs);
1284 }
1285 
1286 static MemTxResult gic_thiscpu_write(void *opaque, hwaddr addr,
1287                                      uint64_t value, unsigned size,
1288                                      MemTxAttrs attrs)
1289 {
1290     GICState *s = (GICState *)opaque;
1291     return gic_cpu_write(s, gic_get_current_cpu(s), addr, value, attrs);
1292 }
1293 
1294 /* Wrappers to read/write the GIC CPU interface for a specific CPU.
1295  * These just decode the opaque pointer into GICState* + cpu id.
1296  */
1297 static MemTxResult gic_do_cpu_read(void *opaque, hwaddr addr, uint64_t *data,
1298                                    unsigned size, MemTxAttrs attrs)
1299 {
1300     GICState **backref = (GICState **)opaque;
1301     GICState *s = *backref;
1302     int id = (backref - s->backref);
1303     return gic_cpu_read(s, id, addr, data, attrs);
1304 }
1305 
1306 static MemTxResult gic_do_cpu_write(void *opaque, hwaddr addr,
1307                                     uint64_t value, unsigned size,
1308                                     MemTxAttrs attrs)
1309 {
1310     GICState **backref = (GICState **)opaque;
1311     GICState *s = *backref;
1312     int id = (backref - s->backref);
1313     return gic_cpu_write(s, id, addr, value, attrs);
1314 }
1315 
1316 static const MemoryRegionOps gic_ops[2] = {
1317     {
1318         .read_with_attrs = gic_dist_read,
1319         .write_with_attrs = gic_dist_write,
1320         .endianness = DEVICE_NATIVE_ENDIAN,
1321     },
1322     {
1323         .read_with_attrs = gic_thiscpu_read,
1324         .write_with_attrs = gic_thiscpu_write,
1325         .endianness = DEVICE_NATIVE_ENDIAN,
1326     }
1327 };
1328 
1329 static const MemoryRegionOps gic_cpu_ops = {
1330     .read_with_attrs = gic_do_cpu_read,
1331     .write_with_attrs = gic_do_cpu_write,
1332     .endianness = DEVICE_NATIVE_ENDIAN,
1333 };
1334 
1335 /* This function is used by nvic model */
1336 void gic_init_irqs_and_distributor(GICState *s)
1337 {
1338     gic_init_irqs_and_mmio(s, gic_set_irq, gic_ops);
1339 }
1340 
1341 static void arm_gic_realize(DeviceState *dev, Error **errp)
1342 {
1343     /* Device instance realize function for the GIC sysbus device */
1344     int i;
1345     GICState *s = ARM_GIC(dev);
1346     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
1347     ARMGICClass *agc = ARM_GIC_GET_CLASS(s);
1348     Error *local_err = NULL;
1349 
1350     agc->parent_realize(dev, &local_err);
1351     if (local_err) {
1352         error_propagate(errp, local_err);
1353         return;
1354     }
1355 
1356     /* This creates distributor and main CPU interface (s->cpuiomem[0]) */
1357     gic_init_irqs_and_mmio(s, gic_set_irq, gic_ops);
1358 
1359     /* Extra core-specific regions for the CPU interfaces. This is
1360      * necessary for "franken-GIC" implementations, for example on
1361      * Exynos 4.
1362      * NB that the memory region size of 0x100 applies for the 11MPCore
1363      * and also cores following the GIC v1 spec (ie A9).
1364      * GIC v2 defines a larger memory region (0x1000) so this will need
1365      * to be extended when we implement A15.
1366      */
1367     for (i = 0; i < s->num_cpu; i++) {
1368         s->backref[i] = s;
1369         memory_region_init_io(&s->cpuiomem[i+1], OBJECT(s), &gic_cpu_ops,
1370                               &s->backref[i], "gic_cpu", 0x100);
1371         sysbus_init_mmio(sbd, &s->cpuiomem[i+1]);
1372     }
1373 }
1374 
1375 static void arm_gic_class_init(ObjectClass *klass, void *data)
1376 {
1377     DeviceClass *dc = DEVICE_CLASS(klass);
1378     ARMGICClass *agc = ARM_GIC_CLASS(klass);
1379 
1380     agc->parent_realize = dc->realize;
1381     dc->realize = arm_gic_realize;
1382 }
1383 
1384 static const TypeInfo arm_gic_info = {
1385     .name = TYPE_ARM_GIC,
1386     .parent = TYPE_ARM_GIC_COMMON,
1387     .instance_size = sizeof(GICState),
1388     .class_init = arm_gic_class_init,
1389     .class_size = sizeof(ARMGICClass),
1390 };
1391 
1392 static void arm_gic_register_types(void)
1393 {
1394     type_register_static(&arm_gic_info);
1395 }
1396 
1397 type_init(arm_gic_register_types)
1398