xref: /openbmc/qemu/hw/intc/arm_gicv3_cpuif.c (revision 0b1183e3)
1 /*
2  * ARM Generic Interrupt Controller v3
3  *
4  * Copyright (c) 2016 Linaro Limited
5  * Written by Peter Maydell
6  *
7  * This code is licensed under the GPL, version 2 or (at your option)
8  * any later version.
9  */
10 
11 /* This file contains the code for the system register interface
12  * portions of the GICv3.
13  */
14 
15 #include "qemu/osdep.h"
16 #include "qemu/bitops.h"
17 #include "qemu/main-loop.h"
18 #include "trace.h"
19 #include "gicv3_internal.h"
20 #include "cpu.h"
21 
22 void gicv3_set_gicv3state(CPUState *cpu, GICv3CPUState *s)
23 {
24     ARMCPU *arm_cpu = ARM_CPU(cpu);
25     CPUARMState *env = &arm_cpu->env;
26 
27     env->gicv3state = (void *)s;
28 };
29 
30 static GICv3CPUState *icc_cs_from_env(CPUARMState *env)
31 {
32     /* Given the CPU, find the right GICv3CPUState struct.
33      * Since we registered the CPU interface with the EL change hook as
34      * the opaque pointer, we can just directly get from the CPU to it.
35      */
36     return arm_get_el_change_hook_opaque(arm_env_get_cpu(env));
37 }
38 
39 static bool gicv3_use_ns_bank(CPUARMState *env)
40 {
41     /* Return true if we should use the NonSecure bank for a banked GIC
42      * CPU interface register. Note that this differs from the
43      * access_secure_reg() function because GICv3 banked registers are
44      * banked even for AArch64, unlike the other CPU system registers.
45      */
46     return !arm_is_secure_below_el3(env);
47 }
48 
49 /* The minimum BPR for the virtual interface is a configurable property */
50 static inline int icv_min_vbpr(GICv3CPUState *cs)
51 {
52     return 7 - cs->vprebits;
53 }
54 
55 /* Simple accessor functions for LR fields */
56 static uint32_t ich_lr_vintid(uint64_t lr)
57 {
58     return extract64(lr, ICH_LR_EL2_VINTID_SHIFT, ICH_LR_EL2_VINTID_LENGTH);
59 }
60 
61 static uint32_t ich_lr_pintid(uint64_t lr)
62 {
63     return extract64(lr, ICH_LR_EL2_PINTID_SHIFT, ICH_LR_EL2_PINTID_LENGTH);
64 }
65 
66 static uint32_t ich_lr_prio(uint64_t lr)
67 {
68     return extract64(lr, ICH_LR_EL2_PRIORITY_SHIFT, ICH_LR_EL2_PRIORITY_LENGTH);
69 }
70 
71 static int ich_lr_state(uint64_t lr)
72 {
73     return extract64(lr, ICH_LR_EL2_STATE_SHIFT, ICH_LR_EL2_STATE_LENGTH);
74 }
75 
76 static bool icv_access(CPUARMState *env, int hcr_flags)
77 {
78     /* Return true if this ICC_ register access should really be
79      * directed to an ICV_ access. hcr_flags is a mask of
80      * HCR_EL2 bits to check: we treat this as an ICV_ access
81      * if we are in NS EL1 and at least one of the specified
82      * HCR_EL2 bits is set.
83      *
84      * ICV registers fall into four categories:
85      *  * access if NS EL1 and HCR_EL2.FMO == 1:
86      *    all ICV regs with '0' in their name
87      *  * access if NS EL1 and HCR_EL2.IMO == 1:
88      *    all ICV regs with '1' in their name
89      *  * access if NS EL1 and either IMO or FMO == 1:
90      *    CTLR, DIR, PMR, RPR
91      */
92     return (env->cp15.hcr_el2 & hcr_flags) && arm_current_el(env) == 1
93         && !arm_is_secure_below_el3(env);
94 }
95 
96 static int read_vbpr(GICv3CPUState *cs, int grp)
97 {
98     /* Read VBPR value out of the VMCR field (caller must handle
99      * VCBPR effects if required)
100      */
101     if (grp == GICV3_G0) {
102         return extract64(cs->ich_vmcr_el2, ICH_VMCR_EL2_VBPR0_SHIFT,
103                      ICH_VMCR_EL2_VBPR0_LENGTH);
104     } else {
105         return extract64(cs->ich_vmcr_el2, ICH_VMCR_EL2_VBPR1_SHIFT,
106                          ICH_VMCR_EL2_VBPR1_LENGTH);
107     }
108 }
109 
110 static void write_vbpr(GICv3CPUState *cs, int grp, int value)
111 {
112     /* Write new VBPR1 value, handling the "writing a value less than
113      * the minimum sets it to the minimum" semantics.
114      */
115     int min = icv_min_vbpr(cs);
116 
117     if (grp != GICV3_G0) {
118         min++;
119     }
120 
121     value = MAX(value, min);
122 
123     if (grp == GICV3_G0) {
124         cs->ich_vmcr_el2 = deposit64(cs->ich_vmcr_el2, ICH_VMCR_EL2_VBPR0_SHIFT,
125                                      ICH_VMCR_EL2_VBPR0_LENGTH, value);
126     } else {
127         cs->ich_vmcr_el2 = deposit64(cs->ich_vmcr_el2, ICH_VMCR_EL2_VBPR1_SHIFT,
128                                      ICH_VMCR_EL2_VBPR1_LENGTH, value);
129     }
130 }
131 
132 static uint32_t icv_fullprio_mask(GICv3CPUState *cs)
133 {
134     /* Return a mask word which clears the unimplemented priority bits
135      * from a priority value for a virtual interrupt. (Not to be confused
136      * with the group priority, whose mask depends on the value of VBPR
137      * for the interrupt group.)
138      */
139     return ~0U << (8 - cs->vpribits);
140 }
141 
142 static int ich_highest_active_virt_prio(GICv3CPUState *cs)
143 {
144     /* Calculate the current running priority based on the set bits
145      * in the ICH Active Priority Registers.
146      */
147     int i;
148     int aprmax = 1 << (cs->vprebits - 5);
149 
150     assert(aprmax <= ARRAY_SIZE(cs->ich_apr[0]));
151 
152     for (i = 0; i < aprmax; i++) {
153         uint32_t apr = cs->ich_apr[GICV3_G0][i] |
154             cs->ich_apr[GICV3_G1NS][i];
155 
156         if (!apr) {
157             continue;
158         }
159         return (i * 32 + ctz32(apr)) << (icv_min_vbpr(cs) + 1);
160     }
161     /* No current active interrupts: return idle priority */
162     return 0xff;
163 }
164 
165 static int hppvi_index(GICv3CPUState *cs)
166 {
167     /* Return the list register index of the highest priority pending
168      * virtual interrupt, as per the HighestPriorityVirtualInterrupt
169      * pseudocode. If no pending virtual interrupts, return -1.
170      */
171     int idx = -1;
172     int i;
173     /* Note that a list register entry with a priority of 0xff will
174      * never be reported by this function; this is the architecturally
175      * correct behaviour.
176      */
177     int prio = 0xff;
178 
179     if (!(cs->ich_vmcr_el2 & (ICH_VMCR_EL2_VENG0 | ICH_VMCR_EL2_VENG1))) {
180         /* Both groups disabled, definitely nothing to do */
181         return idx;
182     }
183 
184     for (i = 0; i < cs->num_list_regs; i++) {
185         uint64_t lr = cs->ich_lr_el2[i];
186         int thisprio;
187 
188         if (ich_lr_state(lr) != ICH_LR_EL2_STATE_PENDING) {
189             /* Not Pending */
190             continue;
191         }
192 
193         /* Ignore interrupts if relevant group enable not set */
194         if (lr & ICH_LR_EL2_GROUP) {
195             if (!(cs->ich_vmcr_el2 & ICH_VMCR_EL2_VENG1)) {
196                 continue;
197             }
198         } else {
199             if (!(cs->ich_vmcr_el2 & ICH_VMCR_EL2_VENG0)) {
200                 continue;
201             }
202         }
203 
204         thisprio = ich_lr_prio(lr);
205 
206         if (thisprio < prio) {
207             prio = thisprio;
208             idx = i;
209         }
210     }
211 
212     return idx;
213 }
214 
215 static uint32_t icv_gprio_mask(GICv3CPUState *cs, int group)
216 {
217     /* Return a mask word which clears the subpriority bits from
218      * a priority value for a virtual interrupt in the specified group.
219      * This depends on the VBPR value.
220      * If using VBPR0 then:
221      *  a BPR of 0 means the group priority bits are [7:1];
222      *  a BPR of 1 means they are [7:2], and so on down to
223      *  a BPR of 7 meaning no group priority bits at all.
224      * If using VBPR1 then:
225      *  a BPR of 0 is impossible (the minimum value is 1)
226      *  a BPR of 1 means the group priority bits are [7:1];
227      *  a BPR of 2 means they are [7:2], and so on down to
228      *  a BPR of 7 meaning the group priority is [7].
229      *
230      * Which BPR to use depends on the group of the interrupt and
231      * the current ICH_VMCR_EL2.VCBPR settings.
232      *
233      * This corresponds to the VGroupBits() pseudocode.
234      */
235     int bpr;
236 
237     if (group == GICV3_G1NS && cs->ich_vmcr_el2 & ICH_VMCR_EL2_VCBPR) {
238         group = GICV3_G0;
239     }
240 
241     bpr = read_vbpr(cs, group);
242     if (group == GICV3_G1NS) {
243         assert(bpr > 0);
244         bpr--;
245     }
246 
247     return ~0U << (bpr + 1);
248 }
249 
250 static bool icv_hppi_can_preempt(GICv3CPUState *cs, uint64_t lr)
251 {
252     /* Return true if we can signal this virtual interrupt defined by
253      * the given list register value; see the pseudocode functions
254      * CanSignalVirtualInterrupt and CanSignalVirtualInt.
255      * Compare also icc_hppi_can_preempt() which is the non-virtual
256      * equivalent of these checks.
257      */
258     int grp;
259     uint32_t mask, prio, rprio, vpmr;
260 
261     if (!(cs->ich_hcr_el2 & ICH_HCR_EL2_EN)) {
262         /* Virtual interface disabled */
263         return false;
264     }
265 
266     /* We don't need to check that this LR is in Pending state because
267      * that has already been done in hppvi_index().
268      */
269 
270     prio = ich_lr_prio(lr);
271     vpmr = extract64(cs->ich_vmcr_el2, ICH_VMCR_EL2_VPMR_SHIFT,
272                      ICH_VMCR_EL2_VPMR_LENGTH);
273 
274     if (prio >= vpmr) {
275         /* Priority mask masks this interrupt */
276         return false;
277     }
278 
279     rprio = ich_highest_active_virt_prio(cs);
280     if (rprio == 0xff) {
281         /* No running interrupt so we can preempt */
282         return true;
283     }
284 
285     grp = (lr & ICH_LR_EL2_GROUP) ? GICV3_G1NS : GICV3_G0;
286 
287     mask = icv_gprio_mask(cs, grp);
288 
289     /* We only preempt a running interrupt if the pending interrupt's
290      * group priority is sufficient (the subpriorities are not considered).
291      */
292     if ((prio & mask) < (rprio & mask)) {
293         return true;
294     }
295 
296     return false;
297 }
298 
299 static uint32_t eoi_maintenance_interrupt_state(GICv3CPUState *cs,
300                                                 uint32_t *misr)
301 {
302     /* Return a set of bits indicating the EOI maintenance interrupt status
303      * for each list register. The EOI maintenance interrupt status is
304      * 1 if LR.State == 0 && LR.HW == 0 && LR.EOI == 1
305      * (see the GICv3 spec for the ICH_EISR_EL2 register).
306      * If misr is not NULL then we should also collect the information
307      * about the MISR.EOI, MISR.NP and MISR.U bits.
308      */
309     uint32_t value = 0;
310     int validcount = 0;
311     bool seenpending = false;
312     int i;
313 
314     for (i = 0; i < cs->num_list_regs; i++) {
315         uint64_t lr = cs->ich_lr_el2[i];
316 
317         if ((lr & (ICH_LR_EL2_STATE_MASK | ICH_LR_EL2_HW | ICH_LR_EL2_EOI))
318             == ICH_LR_EL2_EOI) {
319             value |= (1 << i);
320         }
321         if ((lr & ICH_LR_EL2_STATE_MASK)) {
322             validcount++;
323         }
324         if (ich_lr_state(lr) == ICH_LR_EL2_STATE_PENDING) {
325             seenpending = true;
326         }
327     }
328 
329     if (misr) {
330         if (validcount < 2 && (cs->ich_hcr_el2 & ICH_HCR_EL2_UIE)) {
331             *misr |= ICH_MISR_EL2_U;
332         }
333         if (!seenpending && (cs->ich_hcr_el2 & ICH_HCR_EL2_NPIE)) {
334             *misr |= ICH_MISR_EL2_NP;
335         }
336         if (value) {
337             *misr |= ICH_MISR_EL2_EOI;
338         }
339     }
340     return value;
341 }
342 
343 static uint32_t maintenance_interrupt_state(GICv3CPUState *cs)
344 {
345     /* Return a set of bits indicating the maintenance interrupt status
346      * (as seen in the ICH_MISR_EL2 register).
347      */
348     uint32_t value = 0;
349 
350     /* Scan list registers and fill in the U, NP and EOI bits */
351     eoi_maintenance_interrupt_state(cs, &value);
352 
353     if (cs->ich_hcr_el2 & (ICH_HCR_EL2_LRENPIE | ICH_HCR_EL2_EOICOUNT_MASK)) {
354         value |= ICH_MISR_EL2_LRENP;
355     }
356 
357     if ((cs->ich_hcr_el2 & ICH_HCR_EL2_VGRP0EIE) &&
358         (cs->ich_vmcr_el2 & ICH_VMCR_EL2_VENG0)) {
359         value |= ICH_MISR_EL2_VGRP0E;
360     }
361 
362     if ((cs->ich_hcr_el2 & ICH_HCR_EL2_VGRP0DIE) &&
363         !(cs->ich_vmcr_el2 & ICH_VMCR_EL2_VENG1)) {
364         value |= ICH_MISR_EL2_VGRP0D;
365     }
366     if ((cs->ich_hcr_el2 & ICH_HCR_EL2_VGRP1EIE) &&
367         (cs->ich_vmcr_el2 & ICH_VMCR_EL2_VENG1)) {
368         value |= ICH_MISR_EL2_VGRP1E;
369     }
370 
371     if ((cs->ich_hcr_el2 & ICH_HCR_EL2_VGRP1DIE) &&
372         !(cs->ich_vmcr_el2 & ICH_VMCR_EL2_VENG1)) {
373         value |= ICH_MISR_EL2_VGRP1D;
374     }
375 
376     return value;
377 }
378 
379 static void gicv3_cpuif_virt_update(GICv3CPUState *cs)
380 {
381     /* Tell the CPU about any pending virtual interrupts or
382      * maintenance interrupts, following a change to the state
383      * of the CPU interface relevant to virtual interrupts.
384      *
385      * CAUTION: this function will call qemu_set_irq() on the
386      * CPU maintenance IRQ line, which is typically wired up
387      * to the GIC as a per-CPU interrupt. This means that it
388      * will recursively call back into the GIC code via
389      * gicv3_redist_set_irq() and thus into the CPU interface code's
390      * gicv3_cpuif_update(). It is therefore important that this
391      * function is only called as the final action of a CPU interface
392      * register write implementation, after all the GIC state
393      * fields have been updated. gicv3_cpuif_update() also must
394      * not cause this function to be called, but that happens
395      * naturally as a result of there being no architectural
396      * linkage between the physical and virtual GIC logic.
397      */
398     int idx;
399     int irqlevel = 0;
400     int fiqlevel = 0;
401     int maintlevel = 0;
402 
403     idx = hppvi_index(cs);
404     trace_gicv3_cpuif_virt_update(gicv3_redist_affid(cs), idx);
405     if (idx >= 0) {
406         uint64_t lr = cs->ich_lr_el2[idx];
407 
408         if (icv_hppi_can_preempt(cs, lr)) {
409             /* Virtual interrupts are simple: G0 are always FIQ, and G1 IRQ */
410             if (lr & ICH_LR_EL2_GROUP) {
411                 irqlevel = 1;
412             } else {
413                 fiqlevel = 1;
414             }
415         }
416     }
417 
418     if (cs->ich_hcr_el2 & ICH_HCR_EL2_EN) {
419         maintlevel = maintenance_interrupt_state(cs);
420     }
421 
422     trace_gicv3_cpuif_virt_set_irqs(gicv3_redist_affid(cs), fiqlevel,
423                                     irqlevel, maintlevel);
424 
425     qemu_set_irq(cs->parent_vfiq, fiqlevel);
426     qemu_set_irq(cs->parent_virq, irqlevel);
427     qemu_set_irq(cs->maintenance_irq, maintlevel);
428 }
429 
430 static uint64_t icv_ap_read(CPUARMState *env, const ARMCPRegInfo *ri)
431 {
432     GICv3CPUState *cs = icc_cs_from_env(env);
433     int regno = ri->opc2 & 3;
434     int grp = ri->crm & 1 ? GICV3_G0 : GICV3_G1NS;
435     uint64_t value = cs->ich_apr[grp][regno];
436 
437     trace_gicv3_icv_ap_read(ri->crm & 1, regno, gicv3_redist_affid(cs), value);
438     return value;
439 }
440 
441 static void icv_ap_write(CPUARMState *env, const ARMCPRegInfo *ri,
442                          uint64_t value)
443 {
444     GICv3CPUState *cs = icc_cs_from_env(env);
445     int regno = ri->opc2 & 3;
446     int grp = ri->crm & 1 ? GICV3_G0 : GICV3_G1NS;
447 
448     trace_gicv3_icv_ap_write(ri->crm & 1, regno, gicv3_redist_affid(cs), value);
449 
450     cs->ich_apr[grp][regno] = value & 0xFFFFFFFFU;
451 
452     gicv3_cpuif_virt_update(cs);
453     return;
454 }
455 
456 static uint64_t icv_bpr_read(CPUARMState *env, const ARMCPRegInfo *ri)
457 {
458     GICv3CPUState *cs = icc_cs_from_env(env);
459     int grp = (ri->crm == 8) ? GICV3_G0 : GICV3_G1NS;
460     uint64_t bpr;
461     bool satinc = false;
462 
463     if (grp == GICV3_G1NS && (cs->ich_vmcr_el2 & ICH_VMCR_EL2_VCBPR)) {
464         /* reads return bpr0 + 1 saturated to 7, writes ignored */
465         grp = GICV3_G0;
466         satinc = true;
467     }
468 
469     bpr = read_vbpr(cs, grp);
470 
471     if (satinc) {
472         bpr++;
473         bpr = MIN(bpr, 7);
474     }
475 
476     trace_gicv3_icv_bpr_read(ri->crm == 8 ? 0 : 1, gicv3_redist_affid(cs), bpr);
477 
478     return bpr;
479 }
480 
481 static void icv_bpr_write(CPUARMState *env, const ARMCPRegInfo *ri,
482                           uint64_t value)
483 {
484     GICv3CPUState *cs = icc_cs_from_env(env);
485     int grp = (ri->crm == 8) ? GICV3_G0 : GICV3_G1NS;
486 
487     trace_gicv3_icv_bpr_write(ri->crm == 8 ? 0 : 1,
488                               gicv3_redist_affid(cs), value);
489 
490     if (grp == GICV3_G1NS && (cs->ich_vmcr_el2 & ICH_VMCR_EL2_VCBPR)) {
491         /* reads return bpr0 + 1 saturated to 7, writes ignored */
492         return;
493     }
494 
495     write_vbpr(cs, grp, value);
496 
497     gicv3_cpuif_virt_update(cs);
498 }
499 
500 static uint64_t icv_pmr_read(CPUARMState *env, const ARMCPRegInfo *ri)
501 {
502     GICv3CPUState *cs = icc_cs_from_env(env);
503     uint64_t value;
504 
505     value = extract64(cs->ich_vmcr_el2, ICH_VMCR_EL2_VPMR_SHIFT,
506                       ICH_VMCR_EL2_VPMR_LENGTH);
507 
508     trace_gicv3_icv_pmr_read(gicv3_redist_affid(cs), value);
509     return value;
510 }
511 
512 static void icv_pmr_write(CPUARMState *env, const ARMCPRegInfo *ri,
513                           uint64_t value)
514 {
515     GICv3CPUState *cs = icc_cs_from_env(env);
516 
517     trace_gicv3_icv_pmr_write(gicv3_redist_affid(cs), value);
518 
519     value &= icv_fullprio_mask(cs);
520 
521     cs->ich_vmcr_el2 = deposit64(cs->ich_vmcr_el2, ICH_VMCR_EL2_VPMR_SHIFT,
522                                  ICH_VMCR_EL2_VPMR_LENGTH, value);
523 
524     gicv3_cpuif_virt_update(cs);
525 }
526 
527 static uint64_t icv_igrpen_read(CPUARMState *env, const ARMCPRegInfo *ri)
528 {
529     GICv3CPUState *cs = icc_cs_from_env(env);
530     int enbit;
531     uint64_t value;
532 
533     enbit = ri->opc2 & 1 ? ICH_VMCR_EL2_VENG1_SHIFT : ICH_VMCR_EL2_VENG0_SHIFT;
534     value = extract64(cs->ich_vmcr_el2, enbit, 1);
535 
536     trace_gicv3_icv_igrpen_read(ri->opc2 & 1 ? 1 : 0,
537                                 gicv3_redist_affid(cs), value);
538     return value;
539 }
540 
541 static void icv_igrpen_write(CPUARMState *env, const ARMCPRegInfo *ri,
542                              uint64_t value)
543 {
544     GICv3CPUState *cs = icc_cs_from_env(env);
545     int enbit;
546 
547     trace_gicv3_icv_igrpen_write(ri->opc2 & 1 ? 1 : 0,
548                                  gicv3_redist_affid(cs), value);
549 
550     enbit = ri->opc2 & 1 ? ICH_VMCR_EL2_VENG1_SHIFT : ICH_VMCR_EL2_VENG0_SHIFT;
551 
552     cs->ich_vmcr_el2 = deposit64(cs->ich_vmcr_el2, enbit, 1, value);
553     gicv3_cpuif_virt_update(cs);
554 }
555 
556 static uint64_t icv_ctlr_read(CPUARMState *env, const ARMCPRegInfo *ri)
557 {
558     GICv3CPUState *cs = icc_cs_from_env(env);
559     uint64_t value;
560 
561     /* Note that the fixed fields here (A3V, SEIS, IDbits, PRIbits)
562      * should match the ones reported in ich_vtr_read().
563      */
564     value = ICC_CTLR_EL1_A3V | (1 << ICC_CTLR_EL1_IDBITS_SHIFT) |
565         (7 << ICC_CTLR_EL1_PRIBITS_SHIFT);
566 
567     if (cs->ich_vmcr_el2 & ICH_VMCR_EL2_VEOIM) {
568         value |= ICC_CTLR_EL1_EOIMODE;
569     }
570 
571     if (cs->ich_vmcr_el2 & ICH_VMCR_EL2_VCBPR) {
572         value |= ICC_CTLR_EL1_CBPR;
573     }
574 
575     trace_gicv3_icv_ctlr_read(gicv3_redist_affid(cs), value);
576     return value;
577 }
578 
579 static void icv_ctlr_write(CPUARMState *env, const ARMCPRegInfo *ri,
580                                uint64_t value)
581 {
582     GICv3CPUState *cs = icc_cs_from_env(env);
583 
584     trace_gicv3_icv_ctlr_write(gicv3_redist_affid(cs), value);
585 
586     cs->ich_vmcr_el2 = deposit64(cs->ich_vmcr_el2, ICH_VMCR_EL2_VCBPR_SHIFT,
587                                  1, value & ICC_CTLR_EL1_CBPR ? 1 : 0);
588     cs->ich_vmcr_el2 = deposit64(cs->ich_vmcr_el2, ICH_VMCR_EL2_VEOIM_SHIFT,
589                                  1, value & ICC_CTLR_EL1_EOIMODE ? 1 : 0);
590 
591     gicv3_cpuif_virt_update(cs);
592 }
593 
594 static uint64_t icv_rpr_read(CPUARMState *env, const ARMCPRegInfo *ri)
595 {
596     GICv3CPUState *cs = icc_cs_from_env(env);
597     int prio = ich_highest_active_virt_prio(cs);
598 
599     trace_gicv3_icv_rpr_read(gicv3_redist_affid(cs), prio);
600     return prio;
601 }
602 
603 static uint64_t icv_hppir_read(CPUARMState *env, const ARMCPRegInfo *ri)
604 {
605     GICv3CPUState *cs = icc_cs_from_env(env);
606     int grp = ri->crm == 8 ? GICV3_G0 : GICV3_G1NS;
607     int idx = hppvi_index(cs);
608     uint64_t value = INTID_SPURIOUS;
609 
610     if (idx >= 0) {
611         uint64_t lr = cs->ich_lr_el2[idx];
612         int thisgrp = (lr & ICH_LR_EL2_GROUP) ? GICV3_G1NS : GICV3_G0;
613 
614         if (grp == thisgrp) {
615             value = ich_lr_vintid(lr);
616         }
617     }
618 
619     trace_gicv3_icv_hppir_read(grp, gicv3_redist_affid(cs), value);
620     return value;
621 }
622 
623 static void icv_activate_irq(GICv3CPUState *cs, int idx, int grp)
624 {
625     /* Activate the interrupt in the specified list register
626      * by moving it from Pending to Active state, and update the
627      * Active Priority Registers.
628      */
629     uint32_t mask = icv_gprio_mask(cs, grp);
630     int prio = ich_lr_prio(cs->ich_lr_el2[idx]) & mask;
631     int aprbit = prio >> (8 - cs->vprebits);
632     int regno = aprbit / 32;
633     int regbit = aprbit % 32;
634 
635     cs->ich_lr_el2[idx] &= ~ICH_LR_EL2_STATE_PENDING_BIT;
636     cs->ich_lr_el2[idx] |= ICH_LR_EL2_STATE_ACTIVE_BIT;
637     cs->ich_apr[grp][regno] |= (1 << regbit);
638 }
639 
640 static uint64_t icv_iar_read(CPUARMState *env, const ARMCPRegInfo *ri)
641 {
642     GICv3CPUState *cs = icc_cs_from_env(env);
643     int grp = ri->crm == 8 ? GICV3_G0 : GICV3_G1NS;
644     int idx = hppvi_index(cs);
645     uint64_t intid = INTID_SPURIOUS;
646 
647     if (idx >= 0) {
648         uint64_t lr = cs->ich_lr_el2[idx];
649         int thisgrp = (lr & ICH_LR_EL2_GROUP) ? GICV3_G1NS : GICV3_G0;
650 
651         if (thisgrp == grp && icv_hppi_can_preempt(cs, lr)) {
652             intid = ich_lr_vintid(lr);
653             if (intid < INTID_SECURE) {
654                 icv_activate_irq(cs, idx, grp);
655             } else {
656                 /* Interrupt goes from Pending to Invalid */
657                 cs->ich_lr_el2[idx] &= ~ICH_LR_EL2_STATE_PENDING_BIT;
658                 /* We will now return the (bogus) ID from the list register,
659                  * as per the pseudocode.
660                  */
661             }
662         }
663     }
664 
665     trace_gicv3_icv_iar_read(ri->crm == 8 ? 0 : 1,
666                              gicv3_redist_affid(cs), intid);
667     return intid;
668 }
669 
670 static int icc_highest_active_prio(GICv3CPUState *cs)
671 {
672     /* Calculate the current running priority based on the set bits
673      * in the Active Priority Registers.
674      */
675     int i;
676 
677     for (i = 0; i < ARRAY_SIZE(cs->icc_apr[0]); i++) {
678         uint32_t apr = cs->icc_apr[GICV3_G0][i] |
679             cs->icc_apr[GICV3_G1][i] | cs->icc_apr[GICV3_G1NS][i];
680 
681         if (!apr) {
682             continue;
683         }
684         return (i * 32 + ctz32(apr)) << (GIC_MIN_BPR + 1);
685     }
686     /* No current active interrupts: return idle priority */
687     return 0xff;
688 }
689 
690 static uint32_t icc_gprio_mask(GICv3CPUState *cs, int group)
691 {
692     /* Return a mask word which clears the subpriority bits from
693      * a priority value for an interrupt in the specified group.
694      * This depends on the BPR value. For CBPR0 (S or NS):
695      *  a BPR of 0 means the group priority bits are [7:1];
696      *  a BPR of 1 means they are [7:2], and so on down to
697      *  a BPR of 7 meaning no group priority bits at all.
698      * For CBPR1 NS:
699      *  a BPR of 0 is impossible (the minimum value is 1)
700      *  a BPR of 1 means the group priority bits are [7:1];
701      *  a BPR of 2 means they are [7:2], and so on down to
702      *  a BPR of 7 meaning the group priority is [7].
703      *
704      * Which BPR to use depends on the group of the interrupt and
705      * the current ICC_CTLR.CBPR settings.
706      *
707      * This corresponds to the GroupBits() pseudocode.
708      */
709     int bpr;
710 
711     if ((group == GICV3_G1 && cs->icc_ctlr_el1[GICV3_S] & ICC_CTLR_EL1_CBPR) ||
712         (group == GICV3_G1NS &&
713          cs->icc_ctlr_el1[GICV3_NS] & ICC_CTLR_EL1_CBPR)) {
714         group = GICV3_G0;
715     }
716 
717     bpr = cs->icc_bpr[group] & 7;
718 
719     if (group == GICV3_G1NS) {
720         assert(bpr > 0);
721         bpr--;
722     }
723 
724     return ~0U << (bpr + 1);
725 }
726 
727 static bool icc_no_enabled_hppi(GICv3CPUState *cs)
728 {
729     /* Return true if there is no pending interrupt, or the
730      * highest priority pending interrupt is in a group which has been
731      * disabled at the CPU interface by the ICC_IGRPEN* register enable bits.
732      */
733     return cs->hppi.prio == 0xff || (cs->icc_igrpen[cs->hppi.grp] == 0);
734 }
735 
736 static bool icc_hppi_can_preempt(GICv3CPUState *cs)
737 {
738     /* Return true if we have a pending interrupt of sufficient
739      * priority to preempt.
740      */
741     int rprio;
742     uint32_t mask;
743 
744     if (icc_no_enabled_hppi(cs)) {
745         return false;
746     }
747 
748     if (cs->hppi.prio >= cs->icc_pmr_el1) {
749         /* Priority mask masks this interrupt */
750         return false;
751     }
752 
753     rprio = icc_highest_active_prio(cs);
754     if (rprio == 0xff) {
755         /* No currently running interrupt so we can preempt */
756         return true;
757     }
758 
759     mask = icc_gprio_mask(cs, cs->hppi.grp);
760 
761     /* We only preempt a running interrupt if the pending interrupt's
762      * group priority is sufficient (the subpriorities are not considered).
763      */
764     if ((cs->hppi.prio & mask) < (rprio & mask)) {
765         return true;
766     }
767 
768     return false;
769 }
770 
771 void gicv3_cpuif_update(GICv3CPUState *cs)
772 {
773     /* Tell the CPU about its highest priority pending interrupt */
774     int irqlevel = 0;
775     int fiqlevel = 0;
776     ARMCPU *cpu = ARM_CPU(cs->cpu);
777     CPUARMState *env = &cpu->env;
778 
779     g_assert(qemu_mutex_iothread_locked());
780 
781     trace_gicv3_cpuif_update(gicv3_redist_affid(cs), cs->hppi.irq,
782                              cs->hppi.grp, cs->hppi.prio);
783 
784     if (cs->hppi.grp == GICV3_G1 && !arm_feature(env, ARM_FEATURE_EL3)) {
785         /* If a Security-enabled GIC sends a G1S interrupt to a
786          * Security-disabled CPU, we must treat it as if it were G0.
787          */
788         cs->hppi.grp = GICV3_G0;
789     }
790 
791     if (icc_hppi_can_preempt(cs)) {
792         /* We have an interrupt: should we signal it as IRQ or FIQ?
793          * This is described in the GICv3 spec section 4.6.2.
794          */
795         bool isfiq;
796 
797         switch (cs->hppi.grp) {
798         case GICV3_G0:
799             isfiq = true;
800             break;
801         case GICV3_G1:
802             isfiq = (!arm_is_secure(env) ||
803                      (arm_current_el(env) == 3 && arm_el_is_aa64(env, 3)));
804             break;
805         case GICV3_G1NS:
806             isfiq = arm_is_secure(env);
807             break;
808         default:
809             g_assert_not_reached();
810         }
811 
812         if (isfiq) {
813             fiqlevel = 1;
814         } else {
815             irqlevel = 1;
816         }
817     }
818 
819     trace_gicv3_cpuif_set_irqs(gicv3_redist_affid(cs), fiqlevel, irqlevel);
820 
821     qemu_set_irq(cs->parent_fiq, fiqlevel);
822     qemu_set_irq(cs->parent_irq, irqlevel);
823 }
824 
825 static uint64_t icc_pmr_read(CPUARMState *env, const ARMCPRegInfo *ri)
826 {
827     GICv3CPUState *cs = icc_cs_from_env(env);
828     uint32_t value = cs->icc_pmr_el1;
829 
830     if (icv_access(env, HCR_FMO | HCR_IMO)) {
831         return icv_pmr_read(env, ri);
832     }
833 
834     if (arm_feature(env, ARM_FEATURE_EL3) && !arm_is_secure(env) &&
835         (env->cp15.scr_el3 & SCR_FIQ)) {
836         /* NS access and Group 0 is inaccessible to NS: return the
837          * NS view of the current priority
838          */
839         if (value & 0x80) {
840             /* Secure priorities not visible to NS */
841             value = 0;
842         } else if (value != 0xff) {
843             value = (value << 1) & 0xff;
844         }
845     }
846 
847     trace_gicv3_icc_pmr_read(gicv3_redist_affid(cs), value);
848 
849     return value;
850 }
851 
852 static void icc_pmr_write(CPUARMState *env, const ARMCPRegInfo *ri,
853                           uint64_t value)
854 {
855     GICv3CPUState *cs = icc_cs_from_env(env);
856 
857     if (icv_access(env, HCR_FMO | HCR_IMO)) {
858         return icv_pmr_write(env, ri, value);
859     }
860 
861     trace_gicv3_icc_pmr_write(gicv3_redist_affid(cs), value);
862 
863     value &= 0xff;
864 
865     if (arm_feature(env, ARM_FEATURE_EL3) && !arm_is_secure(env) &&
866         (env->cp15.scr_el3 & SCR_FIQ)) {
867         /* NS access and Group 0 is inaccessible to NS: return the
868          * NS view of the current priority
869          */
870         if (!(cs->icc_pmr_el1 & 0x80)) {
871             /* Current PMR in the secure range, don't allow NS to change it */
872             return;
873         }
874         value = (value >> 1) & 0x80;
875     }
876     cs->icc_pmr_el1 = value;
877     gicv3_cpuif_update(cs);
878 }
879 
880 static void icc_activate_irq(GICv3CPUState *cs, int irq)
881 {
882     /* Move the interrupt from the Pending state to Active, and update
883      * the Active Priority Registers
884      */
885     uint32_t mask = icc_gprio_mask(cs, cs->hppi.grp);
886     int prio = cs->hppi.prio & mask;
887     int aprbit = prio >> 1;
888     int regno = aprbit / 32;
889     int regbit = aprbit % 32;
890 
891     cs->icc_apr[cs->hppi.grp][regno] |= (1 << regbit);
892 
893     if (irq < GIC_INTERNAL) {
894         cs->gicr_iactiver0 = deposit32(cs->gicr_iactiver0, irq, 1, 1);
895         cs->gicr_ipendr0 = deposit32(cs->gicr_ipendr0, irq, 1, 0);
896         gicv3_redist_update(cs);
897     } else {
898         gicv3_gicd_active_set(cs->gic, irq);
899         gicv3_gicd_pending_clear(cs->gic, irq);
900         gicv3_update(cs->gic, irq, 1);
901     }
902 }
903 
904 static uint64_t icc_hppir0_value(GICv3CPUState *cs, CPUARMState *env)
905 {
906     /* Return the highest priority pending interrupt register value
907      * for group 0.
908      */
909     bool irq_is_secure;
910 
911     if (cs->hppi.prio == 0xff) {
912         return INTID_SPURIOUS;
913     }
914 
915     /* Check whether we can return the interrupt or if we should return
916      * a special identifier, as per the CheckGroup0ForSpecialIdentifiers
917      * pseudocode. (We can simplify a little because for us ICC_SRE_EL1.RM
918      * is always zero.)
919      */
920     irq_is_secure = (!(cs->gic->gicd_ctlr & GICD_CTLR_DS) &&
921                      (cs->hppi.grp != GICV3_G1NS));
922 
923     if (cs->hppi.grp != GICV3_G0 && !arm_is_el3_or_mon(env)) {
924         return INTID_SPURIOUS;
925     }
926     if (irq_is_secure && !arm_is_secure(env)) {
927         /* Secure interrupts not visible to Nonsecure */
928         return INTID_SPURIOUS;
929     }
930 
931     if (cs->hppi.grp != GICV3_G0) {
932         /* Indicate to EL3 that there's a Group 1 interrupt for the other
933          * state pending.
934          */
935         return irq_is_secure ? INTID_SECURE : INTID_NONSECURE;
936     }
937 
938     return cs->hppi.irq;
939 }
940 
941 static uint64_t icc_hppir1_value(GICv3CPUState *cs, CPUARMState *env)
942 {
943     /* Return the highest priority pending interrupt register value
944      * for group 1.
945      */
946     bool irq_is_secure;
947 
948     if (cs->hppi.prio == 0xff) {
949         return INTID_SPURIOUS;
950     }
951 
952     /* Check whether we can return the interrupt or if we should return
953      * a special identifier, as per the CheckGroup1ForSpecialIdentifiers
954      * pseudocode. (We can simplify a little because for us ICC_SRE_EL1.RM
955      * is always zero.)
956      */
957     irq_is_secure = (!(cs->gic->gicd_ctlr & GICD_CTLR_DS) &&
958                      (cs->hppi.grp != GICV3_G1NS));
959 
960     if (cs->hppi.grp == GICV3_G0) {
961         /* Group 0 interrupts not visible via HPPIR1 */
962         return INTID_SPURIOUS;
963     }
964     if (irq_is_secure) {
965         if (!arm_is_secure(env)) {
966             /* Secure interrupts not visible in Non-secure */
967             return INTID_SPURIOUS;
968         }
969     } else if (!arm_is_el3_or_mon(env) && arm_is_secure(env)) {
970         /* Group 1 non-secure interrupts not visible in Secure EL1 */
971         return INTID_SPURIOUS;
972     }
973 
974     return cs->hppi.irq;
975 }
976 
977 static uint64_t icc_iar0_read(CPUARMState *env, const ARMCPRegInfo *ri)
978 {
979     GICv3CPUState *cs = icc_cs_from_env(env);
980     uint64_t intid;
981 
982     if (icv_access(env, HCR_FMO)) {
983         return icv_iar_read(env, ri);
984     }
985 
986     if (!icc_hppi_can_preempt(cs)) {
987         intid = INTID_SPURIOUS;
988     } else {
989         intid = icc_hppir0_value(cs, env);
990     }
991 
992     if (!(intid >= INTID_SECURE && intid <= INTID_SPURIOUS)) {
993         icc_activate_irq(cs, intid);
994     }
995 
996     trace_gicv3_icc_iar0_read(gicv3_redist_affid(cs), intid);
997     return intid;
998 }
999 
1000 static uint64_t icc_iar1_read(CPUARMState *env, const ARMCPRegInfo *ri)
1001 {
1002     GICv3CPUState *cs = icc_cs_from_env(env);
1003     uint64_t intid;
1004 
1005     if (icv_access(env, HCR_IMO)) {
1006         return icv_iar_read(env, ri);
1007     }
1008 
1009     if (!icc_hppi_can_preempt(cs)) {
1010         intid = INTID_SPURIOUS;
1011     } else {
1012         intid = icc_hppir1_value(cs, env);
1013     }
1014 
1015     if (!(intid >= INTID_SECURE && intid <= INTID_SPURIOUS)) {
1016         icc_activate_irq(cs, intid);
1017     }
1018 
1019     trace_gicv3_icc_iar1_read(gicv3_redist_affid(cs), intid);
1020     return intid;
1021 }
1022 
1023 static void icc_drop_prio(GICv3CPUState *cs, int grp)
1024 {
1025     /* Drop the priority of the currently active interrupt in
1026      * the specified group.
1027      *
1028      * Note that we can guarantee (because of the requirement to nest
1029      * ICC_IAR reads [which activate an interrupt and raise priority]
1030      * with ICC_EOIR writes [which drop the priority for the interrupt])
1031      * that the interrupt we're being called for is the highest priority
1032      * active interrupt, meaning that it has the lowest set bit in the
1033      * APR registers.
1034      *
1035      * If the guest does not honour the ordering constraints then the
1036      * behaviour of the GIC is UNPREDICTABLE, which for us means that
1037      * the values of the APR registers might become incorrect and the
1038      * running priority will be wrong, so interrupts that should preempt
1039      * might not do so, and interrupts that should not preempt might do so.
1040      */
1041     int i;
1042 
1043     for (i = 0; i < ARRAY_SIZE(cs->icc_apr[grp]); i++) {
1044         uint64_t *papr = &cs->icc_apr[grp][i];
1045 
1046         if (!*papr) {
1047             continue;
1048         }
1049         /* Clear the lowest set bit */
1050         *papr &= *papr - 1;
1051         break;
1052     }
1053 
1054     /* running priority change means we need an update for this cpu i/f */
1055     gicv3_cpuif_update(cs);
1056 }
1057 
1058 static bool icc_eoi_split(CPUARMState *env, GICv3CPUState *cs)
1059 {
1060     /* Return true if we should split priority drop and interrupt
1061      * deactivation, ie whether the relevant EOIMode bit is set.
1062      */
1063     if (arm_is_el3_or_mon(env)) {
1064         return cs->icc_ctlr_el3 & ICC_CTLR_EL3_EOIMODE_EL3;
1065     }
1066     if (arm_is_secure_below_el3(env)) {
1067         return cs->icc_ctlr_el1[GICV3_S] & ICC_CTLR_EL1_EOIMODE;
1068     } else {
1069         return cs->icc_ctlr_el1[GICV3_NS] & ICC_CTLR_EL1_EOIMODE;
1070     }
1071 }
1072 
1073 static int icc_highest_active_group(GICv3CPUState *cs)
1074 {
1075     /* Return the group with the highest priority active interrupt.
1076      * We can do this by just comparing the APRs to see which one
1077      * has the lowest set bit.
1078      * (If more than one group is active at the same priority then
1079      * we're in UNPREDICTABLE territory.)
1080      */
1081     int i;
1082 
1083     for (i = 0; i < ARRAY_SIZE(cs->icc_apr[0]); i++) {
1084         int g0ctz = ctz32(cs->icc_apr[GICV3_G0][i]);
1085         int g1ctz = ctz32(cs->icc_apr[GICV3_G1][i]);
1086         int g1nsctz = ctz32(cs->icc_apr[GICV3_G1NS][i]);
1087 
1088         if (g1nsctz < g0ctz && g1nsctz < g1ctz) {
1089             return GICV3_G1NS;
1090         }
1091         if (g1ctz < g0ctz) {
1092             return GICV3_G1;
1093         }
1094         if (g0ctz < 32) {
1095             return GICV3_G0;
1096         }
1097     }
1098     /* No set active bits? UNPREDICTABLE; return -1 so the caller
1099      * ignores the spurious EOI attempt.
1100      */
1101     return -1;
1102 }
1103 
1104 static void icc_deactivate_irq(GICv3CPUState *cs, int irq)
1105 {
1106     if (irq < GIC_INTERNAL) {
1107         cs->gicr_iactiver0 = deposit32(cs->gicr_iactiver0, irq, 1, 0);
1108         gicv3_redist_update(cs);
1109     } else {
1110         gicv3_gicd_active_clear(cs->gic, irq);
1111         gicv3_update(cs->gic, irq, 1);
1112     }
1113 }
1114 
1115 static bool icv_eoi_split(CPUARMState *env, GICv3CPUState *cs)
1116 {
1117     /* Return true if we should split priority drop and interrupt
1118      * deactivation, ie whether the virtual EOIMode bit is set.
1119      */
1120     return cs->ich_vmcr_el2 & ICH_VMCR_EL2_VEOIM;
1121 }
1122 
1123 static int icv_find_active(GICv3CPUState *cs, int irq)
1124 {
1125     /* Given an interrupt number for an active interrupt, return the index
1126      * of the corresponding list register, or -1 if there is no match.
1127      * Corresponds to FindActiveVirtualInterrupt pseudocode.
1128      */
1129     int i;
1130 
1131     for (i = 0; i < cs->num_list_regs; i++) {
1132         uint64_t lr = cs->ich_lr_el2[i];
1133 
1134         if ((lr & ICH_LR_EL2_STATE_ACTIVE_BIT) && ich_lr_vintid(lr) == irq) {
1135             return i;
1136         }
1137     }
1138 
1139     return -1;
1140 }
1141 
1142 static void icv_deactivate_irq(GICv3CPUState *cs, int idx)
1143 {
1144     /* Deactivate the interrupt in the specified list register index */
1145     uint64_t lr = cs->ich_lr_el2[idx];
1146 
1147     if (lr & ICH_LR_EL2_HW) {
1148         /* Deactivate the associated physical interrupt */
1149         int pirq = ich_lr_pintid(lr);
1150 
1151         if (pirq < INTID_SECURE) {
1152             icc_deactivate_irq(cs, pirq);
1153         }
1154     }
1155 
1156     /* Clear the 'active' part of the state, so ActivePending->Pending
1157      * and Active->Invalid.
1158      */
1159     lr &= ~ICH_LR_EL2_STATE_ACTIVE_BIT;
1160     cs->ich_lr_el2[idx] = lr;
1161 }
1162 
1163 static void icv_increment_eoicount(GICv3CPUState *cs)
1164 {
1165     /* Increment the EOICOUNT field in ICH_HCR_EL2 */
1166     int eoicount = extract64(cs->ich_hcr_el2, ICH_HCR_EL2_EOICOUNT_SHIFT,
1167                              ICH_HCR_EL2_EOICOUNT_LENGTH);
1168 
1169     cs->ich_hcr_el2 = deposit64(cs->ich_hcr_el2, ICH_HCR_EL2_EOICOUNT_SHIFT,
1170                                 ICH_HCR_EL2_EOICOUNT_LENGTH, eoicount + 1);
1171 }
1172 
1173 static int icv_drop_prio(GICv3CPUState *cs)
1174 {
1175     /* Drop the priority of the currently active virtual interrupt
1176      * (favouring group 0 if there is a set active bit at
1177      * the same priority for both group 0 and group 1).
1178      * Return the priority value for the bit we just cleared,
1179      * or 0xff if no bits were set in the AP registers at all.
1180      * Note that though the ich_apr[] are uint64_t only the low
1181      * 32 bits are actually relevant.
1182      */
1183     int i;
1184     int aprmax = 1 << (cs->vprebits - 5);
1185 
1186     assert(aprmax <= ARRAY_SIZE(cs->ich_apr[0]));
1187 
1188     for (i = 0; i < aprmax; i++) {
1189         uint64_t *papr0 = &cs->ich_apr[GICV3_G0][i];
1190         uint64_t *papr1 = &cs->ich_apr[GICV3_G1NS][i];
1191         int apr0count, apr1count;
1192 
1193         if (!*papr0 && !*papr1) {
1194             continue;
1195         }
1196 
1197         /* We can't just use the bit-twiddling hack icc_drop_prio() does
1198          * because we need to return the bit number we cleared so
1199          * it can be compared against the list register's priority field.
1200          */
1201         apr0count = ctz32(*papr0);
1202         apr1count = ctz32(*papr1);
1203 
1204         if (apr0count <= apr1count) {
1205             *papr0 &= *papr0 - 1;
1206             return (apr0count + i * 32) << (icv_min_vbpr(cs) + 1);
1207         } else {
1208             *papr1 &= *papr1 - 1;
1209             return (apr1count + i * 32) << (icv_min_vbpr(cs) + 1);
1210         }
1211     }
1212     return 0xff;
1213 }
1214 
1215 static void icv_dir_write(CPUARMState *env, const ARMCPRegInfo *ri,
1216                           uint64_t value)
1217 {
1218     /* Deactivate interrupt */
1219     GICv3CPUState *cs = icc_cs_from_env(env);
1220     int idx;
1221     int irq = value & 0xffffff;
1222 
1223     trace_gicv3_icv_dir_write(gicv3_redist_affid(cs), value);
1224 
1225     if (irq >= cs->gic->num_irq) {
1226         /* Also catches special interrupt numbers and LPIs */
1227         return;
1228     }
1229 
1230     if (!icv_eoi_split(env, cs)) {
1231         return;
1232     }
1233 
1234     idx = icv_find_active(cs, irq);
1235 
1236     if (idx < 0) {
1237         /* No list register matching this, so increment the EOI count
1238          * (might trigger a maintenance interrupt)
1239          */
1240         icv_increment_eoicount(cs);
1241     } else {
1242         icv_deactivate_irq(cs, idx);
1243     }
1244 
1245     gicv3_cpuif_virt_update(cs);
1246 }
1247 
1248 static void icv_eoir_write(CPUARMState *env, const ARMCPRegInfo *ri,
1249                            uint64_t value)
1250 {
1251     /* End of Interrupt */
1252     GICv3CPUState *cs = icc_cs_from_env(env);
1253     int irq = value & 0xffffff;
1254     int grp = ri->crm == 8 ? GICV3_G0 : GICV3_G1NS;
1255     int idx, dropprio;
1256 
1257     trace_gicv3_icv_eoir_write(ri->crm == 8 ? 0 : 1,
1258                                gicv3_redist_affid(cs), value);
1259 
1260     if (irq >= cs->gic->num_irq) {
1261         /* Also catches special interrupt numbers and LPIs */
1262         return;
1263     }
1264 
1265     /* We implement the IMPDEF choice of "drop priority before doing
1266      * error checks" (because that lets us avoid scanning the AP
1267      * registers twice).
1268      */
1269     dropprio = icv_drop_prio(cs);
1270     if (dropprio == 0xff) {
1271         /* No active interrupt. It is CONSTRAINED UNPREDICTABLE
1272          * whether the list registers are checked in this
1273          * situation; we choose not to.
1274          */
1275         return;
1276     }
1277 
1278     idx = icv_find_active(cs, irq);
1279 
1280     if (idx < 0) {
1281         /* No valid list register corresponding to EOI ID */
1282         icv_increment_eoicount(cs);
1283     } else {
1284         uint64_t lr = cs->ich_lr_el2[idx];
1285         int thisgrp = (lr & ICH_LR_EL2_GROUP) ? GICV3_G1NS : GICV3_G0;
1286         int lr_gprio = ich_lr_prio(lr) & icv_gprio_mask(cs, grp);
1287 
1288         if (thisgrp == grp && lr_gprio == dropprio) {
1289             if (!icv_eoi_split(env, cs)) {
1290                 /* Priority drop and deactivate not split: deactivate irq now */
1291                 icv_deactivate_irq(cs, idx);
1292             }
1293         }
1294     }
1295 
1296     gicv3_cpuif_virt_update(cs);
1297 }
1298 
1299 static void icc_eoir_write(CPUARMState *env, const ARMCPRegInfo *ri,
1300                            uint64_t value)
1301 {
1302     /* End of Interrupt */
1303     GICv3CPUState *cs = icc_cs_from_env(env);
1304     int irq = value & 0xffffff;
1305     int grp;
1306 
1307     if (icv_access(env, ri->crm == 8 ? HCR_FMO : HCR_IMO)) {
1308         icv_eoir_write(env, ri, value);
1309         return;
1310     }
1311 
1312     trace_gicv3_icc_eoir_write(ri->crm == 8 ? 0 : 1,
1313                                gicv3_redist_affid(cs), value);
1314 
1315     if (ri->crm == 8) {
1316         /* EOIR0 */
1317         grp = GICV3_G0;
1318     } else {
1319         /* EOIR1 */
1320         if (arm_is_secure(env)) {
1321             grp = GICV3_G1;
1322         } else {
1323             grp = GICV3_G1NS;
1324         }
1325     }
1326 
1327     if (irq >= cs->gic->num_irq) {
1328         /* This handles two cases:
1329          * 1. If software writes the ID of a spurious interrupt [ie 1020-1023]
1330          * to the GICC_EOIR, the GIC ignores that write.
1331          * 2. If software writes the number of a non-existent interrupt
1332          * this must be a subcase of "value written does not match the last
1333          * valid interrupt value read from the Interrupt Acknowledge
1334          * register" and so this is UNPREDICTABLE. We choose to ignore it.
1335          */
1336         return;
1337     }
1338 
1339     if (icc_highest_active_group(cs) != grp) {
1340         return;
1341     }
1342 
1343     icc_drop_prio(cs, grp);
1344 
1345     if (!icc_eoi_split(env, cs)) {
1346         /* Priority drop and deactivate not split: deactivate irq now */
1347         icc_deactivate_irq(cs, irq);
1348     }
1349 }
1350 
1351 static uint64_t icc_hppir0_read(CPUARMState *env, const ARMCPRegInfo *ri)
1352 {
1353     GICv3CPUState *cs = icc_cs_from_env(env);
1354     uint64_t value;
1355 
1356     if (icv_access(env, HCR_FMO)) {
1357         return icv_hppir_read(env, ri);
1358     }
1359 
1360     value = icc_hppir0_value(cs, env);
1361     trace_gicv3_icc_hppir0_read(gicv3_redist_affid(cs), value);
1362     return value;
1363 }
1364 
1365 static uint64_t icc_hppir1_read(CPUARMState *env, const ARMCPRegInfo *ri)
1366 {
1367     GICv3CPUState *cs = icc_cs_from_env(env);
1368     uint64_t value;
1369 
1370     if (icv_access(env, HCR_IMO)) {
1371         return icv_hppir_read(env, ri);
1372     }
1373 
1374     value = icc_hppir1_value(cs, env);
1375     trace_gicv3_icc_hppir1_read(gicv3_redist_affid(cs), value);
1376     return value;
1377 }
1378 
1379 static uint64_t icc_bpr_read(CPUARMState *env, const ARMCPRegInfo *ri)
1380 {
1381     GICv3CPUState *cs = icc_cs_from_env(env);
1382     int grp = (ri->crm == 8) ? GICV3_G0 : GICV3_G1;
1383     bool satinc = false;
1384     uint64_t bpr;
1385 
1386     if (icv_access(env, grp == GICV3_G0 ? HCR_FMO : HCR_IMO)) {
1387         return icv_bpr_read(env, ri);
1388     }
1389 
1390     if (grp == GICV3_G1 && gicv3_use_ns_bank(env)) {
1391         grp = GICV3_G1NS;
1392     }
1393 
1394     if (grp == GICV3_G1 && !arm_is_el3_or_mon(env) &&
1395         (cs->icc_ctlr_el1[GICV3_S] & ICC_CTLR_EL1_CBPR)) {
1396         /* CBPR_EL1S means secure EL1 or AArch32 EL3 !Mon BPR1 accesses
1397          * modify BPR0
1398          */
1399         grp = GICV3_G0;
1400     }
1401 
1402     if (grp == GICV3_G1NS && arm_current_el(env) < 3 &&
1403         (cs->icc_ctlr_el1[GICV3_NS] & ICC_CTLR_EL1_CBPR)) {
1404         /* reads return bpr0 + 1 sat to 7, writes ignored */
1405         grp = GICV3_G0;
1406         satinc = true;
1407     }
1408 
1409     bpr = cs->icc_bpr[grp];
1410     if (satinc) {
1411         bpr++;
1412         bpr = MIN(bpr, 7);
1413     }
1414 
1415     trace_gicv3_icc_bpr_read(ri->crm == 8 ? 0 : 1, gicv3_redist_affid(cs), bpr);
1416 
1417     return bpr;
1418 }
1419 
1420 static void icc_bpr_write(CPUARMState *env, const ARMCPRegInfo *ri,
1421                           uint64_t value)
1422 {
1423     GICv3CPUState *cs = icc_cs_from_env(env);
1424     int grp = (ri->crm == 8) ? GICV3_G0 : GICV3_G1;
1425     uint64_t minval;
1426 
1427     if (icv_access(env, grp == GICV3_G0 ? HCR_FMO : HCR_IMO)) {
1428         icv_bpr_write(env, ri, value);
1429         return;
1430     }
1431 
1432     trace_gicv3_icc_bpr_write(ri->crm == 8 ? 0 : 1,
1433                               gicv3_redist_affid(cs), value);
1434 
1435     if (grp == GICV3_G1 && gicv3_use_ns_bank(env)) {
1436         grp = GICV3_G1NS;
1437     }
1438 
1439     if (grp == GICV3_G1 && !arm_is_el3_or_mon(env) &&
1440         (cs->icc_ctlr_el1[GICV3_S] & ICC_CTLR_EL1_CBPR)) {
1441         /* CBPR_EL1S means secure EL1 or AArch32 EL3 !Mon BPR1 accesses
1442          * modify BPR0
1443          */
1444         grp = GICV3_G0;
1445     }
1446 
1447     if (grp == GICV3_G1NS && arm_current_el(env) < 3 &&
1448         (cs->icc_ctlr_el1[GICV3_NS] & ICC_CTLR_EL1_CBPR)) {
1449         /* reads return bpr0 + 1 sat to 7, writes ignored */
1450         return;
1451     }
1452 
1453     minval = (grp == GICV3_G1NS) ? GIC_MIN_BPR_NS : GIC_MIN_BPR;
1454     if (value < minval) {
1455         value = minval;
1456     }
1457 
1458     cs->icc_bpr[grp] = value & 7;
1459     gicv3_cpuif_update(cs);
1460 }
1461 
1462 static uint64_t icc_ap_read(CPUARMState *env, const ARMCPRegInfo *ri)
1463 {
1464     GICv3CPUState *cs = icc_cs_from_env(env);
1465     uint64_t value;
1466 
1467     int regno = ri->opc2 & 3;
1468     int grp = ri->crm & 1 ? GICV3_G0 : GICV3_G1;
1469 
1470     if (icv_access(env, grp == GICV3_G0 ? HCR_FMO : HCR_IMO)) {
1471         return icv_ap_read(env, ri);
1472     }
1473 
1474     if (grp == GICV3_G1 && gicv3_use_ns_bank(env)) {
1475         grp = GICV3_G1NS;
1476     }
1477 
1478     value = cs->icc_apr[grp][regno];
1479 
1480     trace_gicv3_icc_ap_read(ri->crm & 1, regno, gicv3_redist_affid(cs), value);
1481     return value;
1482 }
1483 
1484 static void icc_ap_write(CPUARMState *env, const ARMCPRegInfo *ri,
1485                          uint64_t value)
1486 {
1487     GICv3CPUState *cs = icc_cs_from_env(env);
1488 
1489     int regno = ri->opc2 & 3;
1490     int grp = ri->crm & 1 ? GICV3_G0 : GICV3_G1;
1491 
1492     if (icv_access(env, grp == GICV3_G0 ? HCR_FMO : HCR_IMO)) {
1493         icv_ap_write(env, ri, value);
1494         return;
1495     }
1496 
1497     trace_gicv3_icc_ap_write(ri->crm & 1, regno, gicv3_redist_affid(cs), value);
1498 
1499     if (grp == GICV3_G1 && gicv3_use_ns_bank(env)) {
1500         grp = GICV3_G1NS;
1501     }
1502 
1503     /* It's not possible to claim that a Non-secure interrupt is active
1504      * at a priority outside the Non-secure range (128..255), since this
1505      * would otherwise allow malicious NS code to block delivery of S interrupts
1506      * by writing a bad value to these registers.
1507      */
1508     if (grp == GICV3_G1NS && regno < 2 && arm_feature(env, ARM_FEATURE_EL3)) {
1509         return;
1510     }
1511 
1512     cs->icc_apr[grp][regno] = value & 0xFFFFFFFFU;
1513     gicv3_cpuif_update(cs);
1514 }
1515 
1516 static void icc_dir_write(CPUARMState *env, const ARMCPRegInfo *ri,
1517                           uint64_t value)
1518 {
1519     /* Deactivate interrupt */
1520     GICv3CPUState *cs = icc_cs_from_env(env);
1521     int irq = value & 0xffffff;
1522     bool irq_is_secure, single_sec_state, irq_is_grp0;
1523     bool route_fiq_to_el3, route_irq_to_el3, route_fiq_to_el2, route_irq_to_el2;
1524 
1525     if (icv_access(env, HCR_FMO | HCR_IMO)) {
1526         icv_dir_write(env, ri, value);
1527         return;
1528     }
1529 
1530     trace_gicv3_icc_dir_write(gicv3_redist_affid(cs), value);
1531 
1532     if (irq >= cs->gic->num_irq) {
1533         /* Also catches special interrupt numbers and LPIs */
1534         return;
1535     }
1536 
1537     if (!icc_eoi_split(env, cs)) {
1538         return;
1539     }
1540 
1541     int grp = gicv3_irq_group(cs->gic, cs, irq);
1542 
1543     single_sec_state = cs->gic->gicd_ctlr & GICD_CTLR_DS;
1544     irq_is_secure = !single_sec_state && (grp != GICV3_G1NS);
1545     irq_is_grp0 = grp == GICV3_G0;
1546 
1547     /* Check whether we're allowed to deactivate this interrupt based
1548      * on its group and the current CPU state.
1549      * These checks are laid out to correspond to the spec's pseudocode.
1550      */
1551     route_fiq_to_el3 = env->cp15.scr_el3 & SCR_FIQ;
1552     route_irq_to_el3 = env->cp15.scr_el3 & SCR_IRQ;
1553     /* No need to include !IsSecure in route_*_to_el2 as it's only
1554      * tested in cases where we know !IsSecure is true.
1555      */
1556     route_fiq_to_el2 = env->cp15.hcr_el2 & HCR_FMO;
1557     route_irq_to_el2 = env->cp15.hcr_el2 & HCR_FMO;
1558 
1559     switch (arm_current_el(env)) {
1560     case 3:
1561         break;
1562     case 2:
1563         if (single_sec_state && irq_is_grp0 && !route_fiq_to_el3) {
1564             break;
1565         }
1566         if (!irq_is_secure && !irq_is_grp0 && !route_irq_to_el3) {
1567             break;
1568         }
1569         return;
1570     case 1:
1571         if (!arm_is_secure_below_el3(env)) {
1572             if (single_sec_state && irq_is_grp0 &&
1573                 !route_fiq_to_el3 && !route_fiq_to_el2) {
1574                 break;
1575             }
1576             if (!irq_is_secure && !irq_is_grp0 &&
1577                 !route_irq_to_el3 && !route_irq_to_el2) {
1578                 break;
1579             }
1580         } else {
1581             if (irq_is_grp0 && !route_fiq_to_el3) {
1582                 break;
1583             }
1584             if (!irq_is_grp0 &&
1585                 (!irq_is_secure || !single_sec_state) &&
1586                 !route_irq_to_el3) {
1587                 break;
1588             }
1589         }
1590         return;
1591     default:
1592         g_assert_not_reached();
1593     }
1594 
1595     icc_deactivate_irq(cs, irq);
1596 }
1597 
1598 static uint64_t icc_rpr_read(CPUARMState *env, const ARMCPRegInfo *ri)
1599 {
1600     GICv3CPUState *cs = icc_cs_from_env(env);
1601     int prio;
1602 
1603     if (icv_access(env, HCR_FMO | HCR_IMO)) {
1604         return icv_rpr_read(env, ri);
1605     }
1606 
1607     prio = icc_highest_active_prio(cs);
1608 
1609     if (arm_feature(env, ARM_FEATURE_EL3) &&
1610         !arm_is_secure(env) && (env->cp15.scr_el3 & SCR_FIQ)) {
1611         /* NS GIC access and Group 0 is inaccessible to NS */
1612         if (prio & 0x80) {
1613             /* NS mustn't see priorities in the Secure half of the range */
1614             prio = 0;
1615         } else if (prio != 0xff) {
1616             /* Non-idle priority: show the Non-secure view of it */
1617             prio = (prio << 1) & 0xff;
1618         }
1619     }
1620 
1621     trace_gicv3_icc_rpr_read(gicv3_redist_affid(cs), prio);
1622     return prio;
1623 }
1624 
1625 static void icc_generate_sgi(CPUARMState *env, GICv3CPUState *cs,
1626                              uint64_t value, int grp, bool ns)
1627 {
1628     GICv3State *s = cs->gic;
1629 
1630     /* Extract Aff3/Aff2/Aff1 and shift into the bottom 24 bits */
1631     uint64_t aff = extract64(value, 48, 8) << 16 |
1632         extract64(value, 32, 8) << 8 |
1633         extract64(value, 16, 8);
1634     uint32_t targetlist = extract64(value, 0, 16);
1635     uint32_t irq = extract64(value, 24, 4);
1636     bool irm = extract64(value, 40, 1);
1637     int i;
1638 
1639     if (grp == GICV3_G1 && s->gicd_ctlr & GICD_CTLR_DS) {
1640         /* If GICD_CTLR.DS == 1, the Distributor treats Secure Group 1
1641          * interrupts as Group 0 interrupts and must send Secure Group 0
1642          * interrupts to the target CPUs.
1643          */
1644         grp = GICV3_G0;
1645     }
1646 
1647     trace_gicv3_icc_generate_sgi(gicv3_redist_affid(cs), irq, irm,
1648                                  aff, targetlist);
1649 
1650     for (i = 0; i < s->num_cpu; i++) {
1651         GICv3CPUState *ocs = &s->cpu[i];
1652 
1653         if (irm) {
1654             /* IRM == 1 : route to all CPUs except self */
1655             if (cs == ocs) {
1656                 continue;
1657             }
1658         } else {
1659             /* IRM == 0 : route to Aff3.Aff2.Aff1.n for all n in [0..15]
1660              * where the corresponding bit is set in targetlist
1661              */
1662             int aff0;
1663 
1664             if (ocs->gicr_typer >> 40 != aff) {
1665                 continue;
1666             }
1667             aff0 = extract64(ocs->gicr_typer, 32, 8);
1668             if (aff0 > 15 || extract32(targetlist, aff0, 1) == 0) {
1669                 continue;
1670             }
1671         }
1672 
1673         /* The redistributor will check against its own GICR_NSACR as needed */
1674         gicv3_redist_send_sgi(ocs, grp, irq, ns);
1675     }
1676 }
1677 
1678 static void icc_sgi0r_write(CPUARMState *env, const ARMCPRegInfo *ri,
1679                            uint64_t value)
1680 {
1681     /* Generate Secure Group 0 SGI. */
1682     GICv3CPUState *cs = icc_cs_from_env(env);
1683     bool ns = !arm_is_secure(env);
1684 
1685     icc_generate_sgi(env, cs, value, GICV3_G0, ns);
1686 }
1687 
1688 static void icc_sgi1r_write(CPUARMState *env, const ARMCPRegInfo *ri,
1689                            uint64_t value)
1690 {
1691     /* Generate Group 1 SGI for the current Security state */
1692     GICv3CPUState *cs = icc_cs_from_env(env);
1693     int grp;
1694     bool ns = !arm_is_secure(env);
1695 
1696     grp = ns ? GICV3_G1NS : GICV3_G1;
1697     icc_generate_sgi(env, cs, value, grp, ns);
1698 }
1699 
1700 static void icc_asgi1r_write(CPUARMState *env, const ARMCPRegInfo *ri,
1701                              uint64_t value)
1702 {
1703     /* Generate Group 1 SGI for the Security state that is not
1704      * the current state
1705      */
1706     GICv3CPUState *cs = icc_cs_from_env(env);
1707     int grp;
1708     bool ns = !arm_is_secure(env);
1709 
1710     grp = ns ? GICV3_G1 : GICV3_G1NS;
1711     icc_generate_sgi(env, cs, value, grp, ns);
1712 }
1713 
1714 static uint64_t icc_igrpen_read(CPUARMState *env, const ARMCPRegInfo *ri)
1715 {
1716     GICv3CPUState *cs = icc_cs_from_env(env);
1717     int grp = ri->opc2 & 1 ? GICV3_G1 : GICV3_G0;
1718     uint64_t value;
1719 
1720     if (icv_access(env, grp == GICV3_G0 ? HCR_FMO : HCR_IMO)) {
1721         return icv_igrpen_read(env, ri);
1722     }
1723 
1724     if (grp == GICV3_G1 && gicv3_use_ns_bank(env)) {
1725         grp = GICV3_G1NS;
1726     }
1727 
1728     value = cs->icc_igrpen[grp];
1729     trace_gicv3_icc_igrpen_read(ri->opc2 & 1 ? 1 : 0,
1730                                 gicv3_redist_affid(cs), value);
1731     return value;
1732 }
1733 
1734 static void icc_igrpen_write(CPUARMState *env, const ARMCPRegInfo *ri,
1735                              uint64_t value)
1736 {
1737     GICv3CPUState *cs = icc_cs_from_env(env);
1738     int grp = ri->opc2 & 1 ? GICV3_G1 : GICV3_G0;
1739 
1740     if (icv_access(env, grp == GICV3_G0 ? HCR_FMO : HCR_IMO)) {
1741         icv_igrpen_write(env, ri, value);
1742         return;
1743     }
1744 
1745     trace_gicv3_icc_igrpen_write(ri->opc2 & 1 ? 1 : 0,
1746                                  gicv3_redist_affid(cs), value);
1747 
1748     if (grp == GICV3_G1 && gicv3_use_ns_bank(env)) {
1749         grp = GICV3_G1NS;
1750     }
1751 
1752     cs->icc_igrpen[grp] = value & ICC_IGRPEN_ENABLE;
1753     gicv3_cpuif_update(cs);
1754 }
1755 
1756 static uint64_t icc_igrpen1_el3_read(CPUARMState *env, const ARMCPRegInfo *ri)
1757 {
1758     GICv3CPUState *cs = icc_cs_from_env(env);
1759     uint64_t value;
1760 
1761     /* IGRPEN1_EL3 bits 0 and 1 are r/w aliases into IGRPEN1_EL1 NS and S */
1762     value = cs->icc_igrpen[GICV3_G1NS] | (cs->icc_igrpen[GICV3_G1] << 1);
1763     trace_gicv3_icc_igrpen1_el3_read(gicv3_redist_affid(cs), value);
1764     return value;
1765 }
1766 
1767 static void icc_igrpen1_el3_write(CPUARMState *env, const ARMCPRegInfo *ri,
1768                                   uint64_t value)
1769 {
1770     GICv3CPUState *cs = icc_cs_from_env(env);
1771 
1772     trace_gicv3_icc_igrpen1_el3_write(gicv3_redist_affid(cs), value);
1773 
1774     /* IGRPEN1_EL3 bits 0 and 1 are r/w aliases into IGRPEN1_EL1 NS and S */
1775     cs->icc_igrpen[GICV3_G1NS] = extract32(value, 0, 1);
1776     cs->icc_igrpen[GICV3_G1] = extract32(value, 1, 1);
1777     gicv3_cpuif_update(cs);
1778 }
1779 
1780 static uint64_t icc_ctlr_el1_read(CPUARMState *env, const ARMCPRegInfo *ri)
1781 {
1782     GICv3CPUState *cs = icc_cs_from_env(env);
1783     int bank = gicv3_use_ns_bank(env) ? GICV3_NS : GICV3_S;
1784     uint64_t value;
1785 
1786     if (icv_access(env, HCR_FMO | HCR_IMO)) {
1787         return icv_ctlr_read(env, ri);
1788     }
1789 
1790     value = cs->icc_ctlr_el1[bank];
1791     trace_gicv3_icc_ctlr_read(gicv3_redist_affid(cs), value);
1792     return value;
1793 }
1794 
1795 static void icc_ctlr_el1_write(CPUARMState *env, const ARMCPRegInfo *ri,
1796                                uint64_t value)
1797 {
1798     GICv3CPUState *cs = icc_cs_from_env(env);
1799     int bank = gicv3_use_ns_bank(env) ? GICV3_NS : GICV3_S;
1800     uint64_t mask;
1801 
1802     if (icv_access(env, HCR_FMO | HCR_IMO)) {
1803         icv_ctlr_write(env, ri, value);
1804         return;
1805     }
1806 
1807     trace_gicv3_icc_ctlr_write(gicv3_redist_affid(cs), value);
1808 
1809     /* Only CBPR and EOIMODE can be RW;
1810      * for us PMHE is RAZ/WI (we don't implement 1-of-N interrupts or
1811      * the asseciated priority-based routing of them);
1812      * if EL3 is implemented and GICD_CTLR.DS == 0, then PMHE and CBPR are RO.
1813      */
1814     if (arm_feature(env, ARM_FEATURE_EL3) &&
1815         ((cs->gic->gicd_ctlr & GICD_CTLR_DS) == 0)) {
1816         mask = ICC_CTLR_EL1_EOIMODE;
1817     } else {
1818         mask = ICC_CTLR_EL1_CBPR | ICC_CTLR_EL1_EOIMODE;
1819     }
1820 
1821     cs->icc_ctlr_el1[bank] &= ~mask;
1822     cs->icc_ctlr_el1[bank] |= (value & mask);
1823     gicv3_cpuif_update(cs);
1824 }
1825 
1826 
1827 static uint64_t icc_ctlr_el3_read(CPUARMState *env, const ARMCPRegInfo *ri)
1828 {
1829     GICv3CPUState *cs = icc_cs_from_env(env);
1830     uint64_t value;
1831 
1832     value = cs->icc_ctlr_el3;
1833     if (cs->icc_ctlr_el1[GICV3_NS] & ICC_CTLR_EL1_EOIMODE) {
1834         value |= ICC_CTLR_EL3_EOIMODE_EL1NS;
1835     }
1836     if (cs->icc_ctlr_el1[GICV3_NS] & ICC_CTLR_EL1_CBPR) {
1837         value |= ICC_CTLR_EL3_CBPR_EL1NS;
1838     }
1839     if (cs->icc_ctlr_el1[GICV3_NS] & ICC_CTLR_EL1_EOIMODE) {
1840         value |= ICC_CTLR_EL3_EOIMODE_EL1S;
1841     }
1842     if (cs->icc_ctlr_el1[GICV3_NS] & ICC_CTLR_EL1_CBPR) {
1843         value |= ICC_CTLR_EL3_CBPR_EL1S;
1844     }
1845 
1846     trace_gicv3_icc_ctlr_el3_read(gicv3_redist_affid(cs), value);
1847     return value;
1848 }
1849 
1850 static void icc_ctlr_el3_write(CPUARMState *env, const ARMCPRegInfo *ri,
1851                                uint64_t value)
1852 {
1853     GICv3CPUState *cs = icc_cs_from_env(env);
1854     uint64_t mask;
1855 
1856     trace_gicv3_icc_ctlr_el3_write(gicv3_redist_affid(cs), value);
1857 
1858     /* *_EL1NS and *_EL1S bits are aliases into the ICC_CTLR_EL1 bits. */
1859     cs->icc_ctlr_el1[GICV3_NS] &= (ICC_CTLR_EL1_CBPR | ICC_CTLR_EL1_EOIMODE);
1860     if (value & ICC_CTLR_EL3_EOIMODE_EL1NS) {
1861         cs->icc_ctlr_el1[GICV3_NS] |= ICC_CTLR_EL1_EOIMODE;
1862     }
1863     if (value & ICC_CTLR_EL3_CBPR_EL1NS) {
1864         cs->icc_ctlr_el1[GICV3_NS] |= ICC_CTLR_EL1_CBPR;
1865     }
1866 
1867     cs->icc_ctlr_el1[GICV3_S] &= (ICC_CTLR_EL1_CBPR | ICC_CTLR_EL1_EOIMODE);
1868     if (value & ICC_CTLR_EL3_EOIMODE_EL1S) {
1869         cs->icc_ctlr_el1[GICV3_S] |= ICC_CTLR_EL1_EOIMODE;
1870     }
1871     if (value & ICC_CTLR_EL3_CBPR_EL1S) {
1872         cs->icc_ctlr_el1[GICV3_S] |= ICC_CTLR_EL1_CBPR;
1873     }
1874 
1875     /* The only bit stored in icc_ctlr_el3 which is writeable is EOIMODE_EL3: */
1876     mask = ICC_CTLR_EL3_EOIMODE_EL3;
1877 
1878     cs->icc_ctlr_el3 &= ~mask;
1879     cs->icc_ctlr_el3 |= (value & mask);
1880     gicv3_cpuif_update(cs);
1881 }
1882 
1883 static CPAccessResult gicv3_irqfiq_access(CPUARMState *env,
1884                                           const ARMCPRegInfo *ri, bool isread)
1885 {
1886     CPAccessResult r = CP_ACCESS_OK;
1887     GICv3CPUState *cs = icc_cs_from_env(env);
1888     int el = arm_current_el(env);
1889 
1890     if ((cs->ich_hcr_el2 & ICH_HCR_EL2_TC) &&
1891         el == 1 && !arm_is_secure_below_el3(env)) {
1892         /* Takes priority over a possible EL3 trap */
1893         return CP_ACCESS_TRAP_EL2;
1894     }
1895 
1896     if ((env->cp15.scr_el3 & (SCR_FIQ | SCR_IRQ)) == (SCR_FIQ | SCR_IRQ)) {
1897         switch (el) {
1898         case 1:
1899             if (arm_is_secure_below_el3(env) ||
1900                 ((env->cp15.hcr_el2 & (HCR_IMO | HCR_FMO)) == 0)) {
1901                 r = CP_ACCESS_TRAP_EL3;
1902             }
1903             break;
1904         case 2:
1905             r = CP_ACCESS_TRAP_EL3;
1906             break;
1907         case 3:
1908             if (!is_a64(env) && !arm_is_el3_or_mon(env)) {
1909                 r = CP_ACCESS_TRAP_EL3;
1910             }
1911             break;
1912         default:
1913             g_assert_not_reached();
1914         }
1915     }
1916 
1917     if (r == CP_ACCESS_TRAP_EL3 && !arm_el_is_aa64(env, 3)) {
1918         r = CP_ACCESS_TRAP;
1919     }
1920     return r;
1921 }
1922 
1923 static CPAccessResult gicv3_dir_access(CPUARMState *env,
1924                                        const ARMCPRegInfo *ri, bool isread)
1925 {
1926     GICv3CPUState *cs = icc_cs_from_env(env);
1927 
1928     if ((cs->ich_hcr_el2 & ICH_HCR_EL2_TDIR) &&
1929         arm_current_el(env) == 1 && !arm_is_secure_below_el3(env)) {
1930         /* Takes priority over a possible EL3 trap */
1931         return CP_ACCESS_TRAP_EL2;
1932     }
1933 
1934     return gicv3_irqfiq_access(env, ri, isread);
1935 }
1936 
1937 static CPAccessResult gicv3_sgi_access(CPUARMState *env,
1938                                        const ARMCPRegInfo *ri, bool isread)
1939 {
1940     if ((env->cp15.hcr_el2 & (HCR_IMO | HCR_FMO)) &&
1941         arm_current_el(env) == 1 && !arm_is_secure_below_el3(env)) {
1942         /* Takes priority over a possible EL3 trap */
1943         return CP_ACCESS_TRAP_EL2;
1944     }
1945 
1946     return gicv3_irqfiq_access(env, ri, isread);
1947 }
1948 
1949 static CPAccessResult gicv3_fiq_access(CPUARMState *env,
1950                                        const ARMCPRegInfo *ri, bool isread)
1951 {
1952     CPAccessResult r = CP_ACCESS_OK;
1953     GICv3CPUState *cs = icc_cs_from_env(env);
1954     int el = arm_current_el(env);
1955 
1956     if ((cs->ich_hcr_el2 & ICH_HCR_EL2_TALL0) &&
1957         el == 1 && !arm_is_secure_below_el3(env)) {
1958         /* Takes priority over a possible EL3 trap */
1959         return CP_ACCESS_TRAP_EL2;
1960     }
1961 
1962     if (env->cp15.scr_el3 & SCR_FIQ) {
1963         switch (el) {
1964         case 1:
1965             if (arm_is_secure_below_el3(env) ||
1966                 ((env->cp15.hcr_el2 & HCR_FMO) == 0)) {
1967                 r = CP_ACCESS_TRAP_EL3;
1968             }
1969             break;
1970         case 2:
1971             r = CP_ACCESS_TRAP_EL3;
1972             break;
1973         case 3:
1974             if (!is_a64(env) && !arm_is_el3_or_mon(env)) {
1975                 r = CP_ACCESS_TRAP_EL3;
1976             }
1977             break;
1978         default:
1979             g_assert_not_reached();
1980         }
1981     }
1982 
1983     if (r == CP_ACCESS_TRAP_EL3 && !arm_el_is_aa64(env, 3)) {
1984         r = CP_ACCESS_TRAP;
1985     }
1986     return r;
1987 }
1988 
1989 static CPAccessResult gicv3_irq_access(CPUARMState *env,
1990                                        const ARMCPRegInfo *ri, bool isread)
1991 {
1992     CPAccessResult r = CP_ACCESS_OK;
1993     GICv3CPUState *cs = icc_cs_from_env(env);
1994     int el = arm_current_el(env);
1995 
1996     if ((cs->ich_hcr_el2 & ICH_HCR_EL2_TALL1) &&
1997         el == 1 && !arm_is_secure_below_el3(env)) {
1998         /* Takes priority over a possible EL3 trap */
1999         return CP_ACCESS_TRAP_EL2;
2000     }
2001 
2002     if (env->cp15.scr_el3 & SCR_IRQ) {
2003         switch (el) {
2004         case 1:
2005             if (arm_is_secure_below_el3(env) ||
2006                 ((env->cp15.hcr_el2 & HCR_IMO) == 0)) {
2007                 r = CP_ACCESS_TRAP_EL3;
2008             }
2009             break;
2010         case 2:
2011             r = CP_ACCESS_TRAP_EL3;
2012             break;
2013         case 3:
2014             if (!is_a64(env) && !arm_is_el3_or_mon(env)) {
2015                 r = CP_ACCESS_TRAP_EL3;
2016             }
2017             break;
2018         default:
2019             g_assert_not_reached();
2020         }
2021     }
2022 
2023     if (r == CP_ACCESS_TRAP_EL3 && !arm_el_is_aa64(env, 3)) {
2024         r = CP_ACCESS_TRAP;
2025     }
2026     return r;
2027 }
2028 
2029 static void icc_reset(CPUARMState *env, const ARMCPRegInfo *ri)
2030 {
2031     GICv3CPUState *cs = icc_cs_from_env(env);
2032 
2033     cs->icc_ctlr_el1[GICV3_S] = ICC_CTLR_EL1_A3V |
2034         (1 << ICC_CTLR_EL1_IDBITS_SHIFT) |
2035         (7 << ICC_CTLR_EL1_PRIBITS_SHIFT);
2036     cs->icc_ctlr_el1[GICV3_NS] = ICC_CTLR_EL1_A3V |
2037         (1 << ICC_CTLR_EL1_IDBITS_SHIFT) |
2038         (7 << ICC_CTLR_EL1_PRIBITS_SHIFT);
2039     cs->icc_pmr_el1 = 0;
2040     cs->icc_bpr[GICV3_G0] = GIC_MIN_BPR;
2041     cs->icc_bpr[GICV3_G1] = GIC_MIN_BPR;
2042     cs->icc_bpr[GICV3_G1NS] = GIC_MIN_BPR_NS;
2043     memset(cs->icc_apr, 0, sizeof(cs->icc_apr));
2044     memset(cs->icc_igrpen, 0, sizeof(cs->icc_igrpen));
2045     cs->icc_ctlr_el3 = ICC_CTLR_EL3_NDS | ICC_CTLR_EL3_A3V |
2046         (1 << ICC_CTLR_EL3_IDBITS_SHIFT) |
2047         (7 << ICC_CTLR_EL3_PRIBITS_SHIFT);
2048 
2049     memset(cs->ich_apr, 0, sizeof(cs->ich_apr));
2050     cs->ich_hcr_el2 = 0;
2051     memset(cs->ich_lr_el2, 0, sizeof(cs->ich_lr_el2));
2052     cs->ich_vmcr_el2 = ICH_VMCR_EL2_VFIQEN |
2053         ((icv_min_vbpr(cs) + 1) << ICH_VMCR_EL2_VBPR1_SHIFT) |
2054         (icv_min_vbpr(cs) << ICH_VMCR_EL2_VBPR0_SHIFT);
2055 }
2056 
2057 static const ARMCPRegInfo gicv3_cpuif_reginfo[] = {
2058     { .name = "ICC_PMR_EL1", .state = ARM_CP_STATE_BOTH,
2059       .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 6, .opc2 = 0,
2060       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2061       .access = PL1_RW, .accessfn = gicv3_irqfiq_access,
2062       .readfn = icc_pmr_read,
2063       .writefn = icc_pmr_write,
2064       /* We hang the whole cpu interface reset routine off here
2065        * rather than parcelling it out into one little function
2066        * per register
2067        */
2068       .resetfn = icc_reset,
2069     },
2070     { .name = "ICC_IAR0_EL1", .state = ARM_CP_STATE_BOTH,
2071       .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 8, .opc2 = 0,
2072       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2073       .access = PL1_R, .accessfn = gicv3_fiq_access,
2074       .readfn = icc_iar0_read,
2075     },
2076     { .name = "ICC_EOIR0_EL1", .state = ARM_CP_STATE_BOTH,
2077       .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 8, .opc2 = 1,
2078       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2079       .access = PL1_W, .accessfn = gicv3_fiq_access,
2080       .writefn = icc_eoir_write,
2081     },
2082     { .name = "ICC_HPPIR0_EL1", .state = ARM_CP_STATE_BOTH,
2083       .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 8, .opc2 = 2,
2084       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2085       .access = PL1_R, .accessfn = gicv3_fiq_access,
2086       .readfn = icc_hppir0_read,
2087     },
2088     { .name = "ICC_BPR0_EL1", .state = ARM_CP_STATE_BOTH,
2089       .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 8, .opc2 = 3,
2090       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2091       .access = PL1_RW, .accessfn = gicv3_fiq_access,
2092       .readfn = icc_bpr_read,
2093       .writefn = icc_bpr_write,
2094     },
2095     { .name = "ICC_AP0R0_EL1", .state = ARM_CP_STATE_BOTH,
2096       .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 8, .opc2 = 4,
2097       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2098       .access = PL1_RW, .accessfn = gicv3_fiq_access,
2099       .readfn = icc_ap_read,
2100       .writefn = icc_ap_write,
2101     },
2102     { .name = "ICC_AP0R1_EL1", .state = ARM_CP_STATE_BOTH,
2103       .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 8, .opc2 = 5,
2104       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2105       .access = PL1_RW, .accessfn = gicv3_fiq_access,
2106       .readfn = icc_ap_read,
2107       .writefn = icc_ap_write,
2108     },
2109     { .name = "ICC_AP0R2_EL1", .state = ARM_CP_STATE_BOTH,
2110       .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 8, .opc2 = 6,
2111       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2112       .access = PL1_RW, .accessfn = gicv3_fiq_access,
2113       .readfn = icc_ap_read,
2114       .writefn = icc_ap_write,
2115     },
2116     { .name = "ICC_AP0R3_EL1", .state = ARM_CP_STATE_BOTH,
2117       .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 8, .opc2 = 7,
2118       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2119       .access = PL1_RW, .accessfn = gicv3_fiq_access,
2120       .readfn = icc_ap_read,
2121       .writefn = icc_ap_write,
2122     },
2123     /* All the ICC_AP1R*_EL1 registers are banked */
2124     { .name = "ICC_AP1R0_EL1", .state = ARM_CP_STATE_BOTH,
2125       .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 9, .opc2 = 0,
2126       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2127       .access = PL1_RW, .accessfn = gicv3_irq_access,
2128       .readfn = icc_ap_read,
2129       .writefn = icc_ap_write,
2130     },
2131     { .name = "ICC_AP1R1_EL1", .state = ARM_CP_STATE_BOTH,
2132       .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 9, .opc2 = 1,
2133       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2134       .access = PL1_RW, .accessfn = gicv3_irq_access,
2135       .readfn = icc_ap_read,
2136       .writefn = icc_ap_write,
2137     },
2138     { .name = "ICC_AP1R2_EL1", .state = ARM_CP_STATE_BOTH,
2139       .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 9, .opc2 = 2,
2140       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2141       .access = PL1_RW, .accessfn = gicv3_irq_access,
2142       .readfn = icc_ap_read,
2143       .writefn = icc_ap_write,
2144     },
2145     { .name = "ICC_AP1R3_EL1", .state = ARM_CP_STATE_BOTH,
2146       .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 9, .opc2 = 3,
2147       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2148       .access = PL1_RW, .accessfn = gicv3_irq_access,
2149       .readfn = icc_ap_read,
2150       .writefn = icc_ap_write,
2151     },
2152     { .name = "ICC_DIR_EL1", .state = ARM_CP_STATE_BOTH,
2153       .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 11, .opc2 = 1,
2154       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2155       .access = PL1_W, .accessfn = gicv3_dir_access,
2156       .writefn = icc_dir_write,
2157     },
2158     { .name = "ICC_RPR_EL1", .state = ARM_CP_STATE_BOTH,
2159       .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 11, .opc2 = 3,
2160       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2161       .access = PL1_R, .accessfn = gicv3_irqfiq_access,
2162       .readfn = icc_rpr_read,
2163     },
2164     { .name = "ICC_SGI1R_EL1", .state = ARM_CP_STATE_AA64,
2165       .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 11, .opc2 = 5,
2166       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2167       .access = PL1_W, .accessfn = gicv3_sgi_access,
2168       .writefn = icc_sgi1r_write,
2169     },
2170     { .name = "ICC_SGI1R",
2171       .cp = 15, .opc1 = 0, .crm = 12,
2172       .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_NO_RAW,
2173       .access = PL1_W, .accessfn = gicv3_sgi_access,
2174       .writefn = icc_sgi1r_write,
2175     },
2176     { .name = "ICC_ASGI1R_EL1", .state = ARM_CP_STATE_AA64,
2177       .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 11, .opc2 = 6,
2178       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2179       .access = PL1_W, .accessfn = gicv3_sgi_access,
2180       .writefn = icc_asgi1r_write,
2181     },
2182     { .name = "ICC_ASGI1R",
2183       .cp = 15, .opc1 = 1, .crm = 12,
2184       .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_NO_RAW,
2185       .access = PL1_W, .accessfn = gicv3_sgi_access,
2186       .writefn = icc_asgi1r_write,
2187     },
2188     { .name = "ICC_SGI0R_EL1", .state = ARM_CP_STATE_AA64,
2189       .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 11, .opc2 = 7,
2190       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2191       .access = PL1_W, .accessfn = gicv3_sgi_access,
2192       .writefn = icc_sgi0r_write,
2193     },
2194     { .name = "ICC_SGI0R",
2195       .cp = 15, .opc1 = 2, .crm = 12,
2196       .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_NO_RAW,
2197       .access = PL1_W, .accessfn = gicv3_sgi_access,
2198       .writefn = icc_sgi0r_write,
2199     },
2200     { .name = "ICC_IAR1_EL1", .state = ARM_CP_STATE_BOTH,
2201       .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 12, .opc2 = 0,
2202       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2203       .access = PL1_R, .accessfn = gicv3_irq_access,
2204       .readfn = icc_iar1_read,
2205     },
2206     { .name = "ICC_EOIR1_EL1", .state = ARM_CP_STATE_BOTH,
2207       .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 12, .opc2 = 1,
2208       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2209       .access = PL1_W, .accessfn = gicv3_irq_access,
2210       .writefn = icc_eoir_write,
2211     },
2212     { .name = "ICC_HPPIR1_EL1", .state = ARM_CP_STATE_BOTH,
2213       .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 12, .opc2 = 2,
2214       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2215       .access = PL1_R, .accessfn = gicv3_irq_access,
2216       .readfn = icc_hppir1_read,
2217     },
2218     /* This register is banked */
2219     { .name = "ICC_BPR1_EL1", .state = ARM_CP_STATE_BOTH,
2220       .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 12, .opc2 = 3,
2221       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2222       .access = PL1_RW, .accessfn = gicv3_irq_access,
2223       .readfn = icc_bpr_read,
2224       .writefn = icc_bpr_write,
2225     },
2226     /* This register is banked */
2227     { .name = "ICC_CTLR_EL1", .state = ARM_CP_STATE_BOTH,
2228       .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 12, .opc2 = 4,
2229       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2230       .access = PL1_RW, .accessfn = gicv3_irqfiq_access,
2231       .readfn = icc_ctlr_el1_read,
2232       .writefn = icc_ctlr_el1_write,
2233     },
2234     { .name = "ICC_SRE_EL1", .state = ARM_CP_STATE_BOTH,
2235       .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 12, .opc2 = 5,
2236       .type = ARM_CP_NO_RAW | ARM_CP_CONST,
2237       .access = PL1_RW,
2238       /* We don't support IRQ/FIQ bypass and system registers are
2239        * always enabled, so all our bits are RAZ/WI or RAO/WI.
2240        * This register is banked but since it's constant we don't
2241        * need to do anything special.
2242        */
2243       .resetvalue = 0x7,
2244     },
2245     { .name = "ICC_IGRPEN0_EL1", .state = ARM_CP_STATE_BOTH,
2246       .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 12, .opc2 = 6,
2247       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2248       .access = PL1_RW, .accessfn = gicv3_fiq_access,
2249       .readfn = icc_igrpen_read,
2250       .writefn = icc_igrpen_write,
2251     },
2252     /* This register is banked */
2253     { .name = "ICC_IGRPEN1_EL1", .state = ARM_CP_STATE_BOTH,
2254       .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 12, .opc2 = 7,
2255       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2256       .access = PL1_RW, .accessfn = gicv3_irq_access,
2257       .readfn = icc_igrpen_read,
2258       .writefn = icc_igrpen_write,
2259     },
2260     { .name = "ICC_SRE_EL2", .state = ARM_CP_STATE_BOTH,
2261       .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 9, .opc2 = 5,
2262       .type = ARM_CP_NO_RAW | ARM_CP_CONST,
2263       .access = PL2_RW,
2264       /* We don't support IRQ/FIQ bypass and system registers are
2265        * always enabled, so all our bits are RAZ/WI or RAO/WI.
2266        */
2267       .resetvalue = 0xf,
2268     },
2269     { .name = "ICC_CTLR_EL3", .state = ARM_CP_STATE_BOTH,
2270       .opc0 = 3, .opc1 = 6, .crn = 12, .crm = 12, .opc2 = 4,
2271       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2272       .access = PL3_RW,
2273       .readfn = icc_ctlr_el3_read,
2274       .writefn = icc_ctlr_el3_write,
2275     },
2276     { .name = "ICC_SRE_EL3", .state = ARM_CP_STATE_BOTH,
2277       .opc0 = 3, .opc1 = 6, .crn = 12, .crm = 12, .opc2 = 5,
2278       .type = ARM_CP_NO_RAW | ARM_CP_CONST,
2279       .access = PL3_RW,
2280       /* We don't support IRQ/FIQ bypass and system registers are
2281        * always enabled, so all our bits are RAZ/WI or RAO/WI.
2282        */
2283       .resetvalue = 0xf,
2284     },
2285     { .name = "ICC_IGRPEN1_EL3", .state = ARM_CP_STATE_BOTH,
2286       .opc0 = 3, .opc1 = 6, .crn = 12, .crm = 12, .opc2 = 7,
2287       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2288       .access = PL3_RW,
2289       .readfn = icc_igrpen1_el3_read,
2290       .writefn = icc_igrpen1_el3_write,
2291     },
2292     REGINFO_SENTINEL
2293 };
2294 
2295 static uint64_t ich_ap_read(CPUARMState *env, const ARMCPRegInfo *ri)
2296 {
2297     GICv3CPUState *cs = icc_cs_from_env(env);
2298     int regno = ri->opc2 & 3;
2299     int grp = ri->crm & 1 ? GICV3_G0 : GICV3_G1NS;
2300     uint64_t value;
2301 
2302     value = cs->ich_apr[grp][regno];
2303     trace_gicv3_ich_ap_read(ri->crm & 1, regno, gicv3_redist_affid(cs), value);
2304     return value;
2305 }
2306 
2307 static void ich_ap_write(CPUARMState *env, const ARMCPRegInfo *ri,
2308                          uint64_t value)
2309 {
2310     GICv3CPUState *cs = icc_cs_from_env(env);
2311     int regno = ri->opc2 & 3;
2312     int grp = ri->crm & 1 ? GICV3_G0 : GICV3_G1NS;
2313 
2314     trace_gicv3_ich_ap_write(ri->crm & 1, regno, gicv3_redist_affid(cs), value);
2315 
2316     cs->ich_apr[grp][regno] = value & 0xFFFFFFFFU;
2317     gicv3_cpuif_virt_update(cs);
2318 }
2319 
2320 static uint64_t ich_hcr_read(CPUARMState *env, const ARMCPRegInfo *ri)
2321 {
2322     GICv3CPUState *cs = icc_cs_from_env(env);
2323     uint64_t value = cs->ich_hcr_el2;
2324 
2325     trace_gicv3_ich_hcr_read(gicv3_redist_affid(cs), value);
2326     return value;
2327 }
2328 
2329 static void ich_hcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
2330                           uint64_t value)
2331 {
2332     GICv3CPUState *cs = icc_cs_from_env(env);
2333 
2334     trace_gicv3_ich_hcr_write(gicv3_redist_affid(cs), value);
2335 
2336     value &= ICH_HCR_EL2_EN | ICH_HCR_EL2_UIE | ICH_HCR_EL2_LRENPIE |
2337         ICH_HCR_EL2_NPIE | ICH_HCR_EL2_VGRP0EIE | ICH_HCR_EL2_VGRP0DIE |
2338         ICH_HCR_EL2_VGRP1EIE | ICH_HCR_EL2_VGRP1DIE | ICH_HCR_EL2_TC |
2339         ICH_HCR_EL2_TALL0 | ICH_HCR_EL2_TALL1 | ICH_HCR_EL2_TSEI |
2340         ICH_HCR_EL2_TDIR | ICH_HCR_EL2_EOICOUNT_MASK;
2341 
2342     cs->ich_hcr_el2 = value;
2343     gicv3_cpuif_virt_update(cs);
2344 }
2345 
2346 static uint64_t ich_vmcr_read(CPUARMState *env, const ARMCPRegInfo *ri)
2347 {
2348     GICv3CPUState *cs = icc_cs_from_env(env);
2349     uint64_t value = cs->ich_vmcr_el2;
2350 
2351     trace_gicv3_ich_vmcr_read(gicv3_redist_affid(cs), value);
2352     return value;
2353 }
2354 
2355 static void ich_vmcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
2356                          uint64_t value)
2357 {
2358     GICv3CPUState *cs = icc_cs_from_env(env);
2359 
2360     trace_gicv3_ich_vmcr_write(gicv3_redist_affid(cs), value);
2361 
2362     value &= ICH_VMCR_EL2_VENG0 | ICH_VMCR_EL2_VENG1 | ICH_VMCR_EL2_VCBPR |
2363         ICH_VMCR_EL2_VEOIM | ICH_VMCR_EL2_VBPR1_MASK |
2364         ICH_VMCR_EL2_VBPR0_MASK | ICH_VMCR_EL2_VPMR_MASK;
2365     value |= ICH_VMCR_EL2_VFIQEN;
2366 
2367     cs->ich_vmcr_el2 = value;
2368     /* Enforce "writing BPRs to less than minimum sets them to the minimum"
2369      * by reading and writing back the fields.
2370      */
2371     write_vbpr(cs, GICV3_G1, read_vbpr(cs, GICV3_G0));
2372     write_vbpr(cs, GICV3_G1, read_vbpr(cs, GICV3_G1));
2373 
2374     gicv3_cpuif_virt_update(cs);
2375 }
2376 
2377 static uint64_t ich_lr_read(CPUARMState *env, const ARMCPRegInfo *ri)
2378 {
2379     GICv3CPUState *cs = icc_cs_from_env(env);
2380     int regno = ri->opc2 | ((ri->crm & 1) << 3);
2381     uint64_t value;
2382 
2383     /* This read function handles all of:
2384      * 64-bit reads of the whole LR
2385      * 32-bit reads of the low half of the LR
2386      * 32-bit reads of the high half of the LR
2387      */
2388     if (ri->state == ARM_CP_STATE_AA32) {
2389         if (ri->crm >= 14) {
2390             value = extract64(cs->ich_lr_el2[regno], 32, 32);
2391             trace_gicv3_ich_lrc_read(regno, gicv3_redist_affid(cs), value);
2392         } else {
2393             value = extract64(cs->ich_lr_el2[regno], 0, 32);
2394             trace_gicv3_ich_lr32_read(regno, gicv3_redist_affid(cs), value);
2395         }
2396     } else {
2397         value = cs->ich_lr_el2[regno];
2398         trace_gicv3_ich_lr_read(regno, gicv3_redist_affid(cs), value);
2399     }
2400 
2401     return value;
2402 }
2403 
2404 static void ich_lr_write(CPUARMState *env, const ARMCPRegInfo *ri,
2405                          uint64_t value)
2406 {
2407     GICv3CPUState *cs = icc_cs_from_env(env);
2408     int regno = ri->opc2 | ((ri->crm & 1) << 3);
2409 
2410     /* This write function handles all of:
2411      * 64-bit writes to the whole LR
2412      * 32-bit writes to the low half of the LR
2413      * 32-bit writes to the high half of the LR
2414      */
2415     if (ri->state == ARM_CP_STATE_AA32) {
2416         if (ri->crm >= 14) {
2417             trace_gicv3_ich_lrc_write(regno, gicv3_redist_affid(cs), value);
2418             value = deposit64(cs->ich_lr_el2[regno], 32, 32, value);
2419         } else {
2420             trace_gicv3_ich_lr32_write(regno, gicv3_redist_affid(cs), value);
2421             value = deposit64(cs->ich_lr_el2[regno], 0, 32, value);
2422         }
2423     } else {
2424         trace_gicv3_ich_lr_write(regno, gicv3_redist_affid(cs), value);
2425     }
2426 
2427     /* Enforce RES0 bits in priority field */
2428     if (cs->vpribits < 8) {
2429         value = deposit64(value, ICH_LR_EL2_PRIORITY_SHIFT,
2430                           8 - cs->vpribits, 0);
2431     }
2432 
2433     cs->ich_lr_el2[regno] = value;
2434     gicv3_cpuif_virt_update(cs);
2435 }
2436 
2437 static uint64_t ich_vtr_read(CPUARMState *env, const ARMCPRegInfo *ri)
2438 {
2439     GICv3CPUState *cs = icc_cs_from_env(env);
2440     uint64_t value;
2441 
2442     value = ((cs->num_list_regs - 1) << ICH_VTR_EL2_LISTREGS_SHIFT)
2443         | ICH_VTR_EL2_TDS | ICH_VTR_EL2_NV4 | ICH_VTR_EL2_A3V
2444         | (1 << ICH_VTR_EL2_IDBITS_SHIFT)
2445         | ((cs->vprebits - 1) << ICH_VTR_EL2_PREBITS_SHIFT)
2446         | ((cs->vpribits - 1) << ICH_VTR_EL2_PRIBITS_SHIFT);
2447 
2448     trace_gicv3_ich_vtr_read(gicv3_redist_affid(cs), value);
2449     return value;
2450 }
2451 
2452 static uint64_t ich_misr_read(CPUARMState *env, const ARMCPRegInfo *ri)
2453 {
2454     GICv3CPUState *cs = icc_cs_from_env(env);
2455     uint64_t value = maintenance_interrupt_state(cs);
2456 
2457     trace_gicv3_ich_misr_read(gicv3_redist_affid(cs), value);
2458     return value;
2459 }
2460 
2461 static uint64_t ich_eisr_read(CPUARMState *env, const ARMCPRegInfo *ri)
2462 {
2463     GICv3CPUState *cs = icc_cs_from_env(env);
2464     uint64_t value = eoi_maintenance_interrupt_state(cs, NULL);
2465 
2466     trace_gicv3_ich_eisr_read(gicv3_redist_affid(cs), value);
2467     return value;
2468 }
2469 
2470 static uint64_t ich_elrsr_read(CPUARMState *env, const ARMCPRegInfo *ri)
2471 {
2472     GICv3CPUState *cs = icc_cs_from_env(env);
2473     uint64_t value = 0;
2474     int i;
2475 
2476     for (i = 0; i < cs->num_list_regs; i++) {
2477         uint64_t lr = cs->ich_lr_el2[i];
2478 
2479         if ((lr & ICH_LR_EL2_STATE_MASK) == 0 &&
2480             ((lr & ICH_LR_EL2_HW) != 0 || (lr & ICH_LR_EL2_EOI) == 0)) {
2481             value |= (1 << i);
2482         }
2483     }
2484 
2485     trace_gicv3_ich_elrsr_read(gicv3_redist_affid(cs), value);
2486     return value;
2487 }
2488 
2489 static const ARMCPRegInfo gicv3_cpuif_hcr_reginfo[] = {
2490     { .name = "ICH_AP0R0_EL2", .state = ARM_CP_STATE_BOTH,
2491       .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 8, .opc2 = 0,
2492       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2493       .access = PL2_RW,
2494       .readfn = ich_ap_read,
2495       .writefn = ich_ap_write,
2496     },
2497     { .name = "ICH_AP1R0_EL2", .state = ARM_CP_STATE_BOTH,
2498       .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 9, .opc2 = 0,
2499       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2500       .access = PL2_RW,
2501       .readfn = ich_ap_read,
2502       .writefn = ich_ap_write,
2503     },
2504     { .name = "ICH_HCR_EL2", .state = ARM_CP_STATE_BOTH,
2505       .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 11, .opc2 = 0,
2506       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2507       .access = PL2_RW,
2508       .readfn = ich_hcr_read,
2509       .writefn = ich_hcr_write,
2510     },
2511     { .name = "ICH_VTR_EL2", .state = ARM_CP_STATE_BOTH,
2512       .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 11, .opc2 = 1,
2513       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2514       .access = PL2_R,
2515       .readfn = ich_vtr_read,
2516     },
2517     { .name = "ICH_MISR_EL2", .state = ARM_CP_STATE_BOTH,
2518       .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 11, .opc2 = 2,
2519       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2520       .access = PL2_R,
2521       .readfn = ich_misr_read,
2522     },
2523     { .name = "ICH_EISR_EL2", .state = ARM_CP_STATE_BOTH,
2524       .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 11, .opc2 = 3,
2525       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2526       .access = PL2_R,
2527       .readfn = ich_eisr_read,
2528     },
2529     { .name = "ICH_ELRSR_EL2", .state = ARM_CP_STATE_BOTH,
2530       .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 11, .opc2 = 5,
2531       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2532       .access = PL2_R,
2533       .readfn = ich_elrsr_read,
2534     },
2535     { .name = "ICH_VMCR_EL2", .state = ARM_CP_STATE_BOTH,
2536       .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 11, .opc2 = 7,
2537       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2538       .access = PL2_RW,
2539       .readfn = ich_vmcr_read,
2540       .writefn = ich_vmcr_write,
2541     },
2542     REGINFO_SENTINEL
2543 };
2544 
2545 static const ARMCPRegInfo gicv3_cpuif_ich_apxr1_reginfo[] = {
2546     { .name = "ICH_AP0R1_EL2", .state = ARM_CP_STATE_BOTH,
2547       .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 8, .opc2 = 1,
2548       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2549       .access = PL2_RW,
2550       .readfn = ich_ap_read,
2551       .writefn = ich_ap_write,
2552     },
2553     { .name = "ICH_AP1R1_EL2", .state = ARM_CP_STATE_BOTH,
2554       .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 9, .opc2 = 1,
2555       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2556       .access = PL2_RW,
2557       .readfn = ich_ap_read,
2558       .writefn = ich_ap_write,
2559     },
2560     REGINFO_SENTINEL
2561 };
2562 
2563 static const ARMCPRegInfo gicv3_cpuif_ich_apxr23_reginfo[] = {
2564     { .name = "ICH_AP0R2_EL2", .state = ARM_CP_STATE_BOTH,
2565       .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 8, .opc2 = 2,
2566       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2567       .access = PL2_RW,
2568       .readfn = ich_ap_read,
2569       .writefn = ich_ap_write,
2570     },
2571     { .name = "ICH_AP0R3_EL2", .state = ARM_CP_STATE_BOTH,
2572       .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 8, .opc2 = 3,
2573       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2574       .access = PL2_RW,
2575       .readfn = ich_ap_read,
2576       .writefn = ich_ap_write,
2577     },
2578     { .name = "ICH_AP1R2_EL2", .state = ARM_CP_STATE_BOTH,
2579       .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 9, .opc2 = 2,
2580       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2581       .access = PL2_RW,
2582       .readfn = ich_ap_read,
2583       .writefn = ich_ap_write,
2584     },
2585     { .name = "ICH_AP1R3_EL2", .state = ARM_CP_STATE_BOTH,
2586       .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 9, .opc2 = 3,
2587       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2588       .access = PL2_RW,
2589       .readfn = ich_ap_read,
2590       .writefn = ich_ap_write,
2591     },
2592     REGINFO_SENTINEL
2593 };
2594 
2595 static void gicv3_cpuif_el_change_hook(ARMCPU *cpu, void *opaque)
2596 {
2597     GICv3CPUState *cs = opaque;
2598 
2599     gicv3_cpuif_update(cs);
2600 }
2601 
2602 void gicv3_init_cpuif(GICv3State *s)
2603 {
2604     /* Called from the GICv3 realize function; register our system
2605      * registers with the CPU
2606      */
2607     int i;
2608 
2609     for (i = 0; i < s->num_cpu; i++) {
2610         ARMCPU *cpu = ARM_CPU(qemu_get_cpu(i));
2611         GICv3CPUState *cs = &s->cpu[i];
2612 
2613         /* Note that we can't just use the GICv3CPUState as an opaque pointer
2614          * in define_arm_cp_regs_with_opaque(), because when we're called back
2615          * it might be with code translated by CPU 0 but run by CPU 1, in
2616          * which case we'd get the wrong value.
2617          * So instead we define the regs with no ri->opaque info, and
2618          * get back to the GICv3CPUState from the ARMCPU by reading back
2619          * the opaque pointer from the el_change_hook, which we're going
2620          * to need to register anyway.
2621          */
2622         define_arm_cp_regs(cpu, gicv3_cpuif_reginfo);
2623         if (arm_feature(&cpu->env, ARM_FEATURE_EL2)
2624             && cpu->gic_num_lrs) {
2625             int j;
2626 
2627             cs->maintenance_irq = cpu->gicv3_maintenance_interrupt;
2628 
2629             cs->num_list_regs = cpu->gic_num_lrs;
2630             cs->vpribits = cpu->gic_vpribits;
2631             cs->vprebits = cpu->gic_vprebits;
2632 
2633             /* Check against architectural constraints: getting these
2634              * wrong would be a bug in the CPU code defining these,
2635              * and the implementation relies on them holding.
2636              */
2637             g_assert(cs->vprebits <= cs->vpribits);
2638             g_assert(cs->vprebits >= 5 && cs->vprebits <= 7);
2639             g_assert(cs->vpribits >= 5 && cs->vpribits <= 8);
2640 
2641             define_arm_cp_regs(cpu, gicv3_cpuif_hcr_reginfo);
2642 
2643             for (j = 0; j < cs->num_list_regs; j++) {
2644                 /* Note that the AArch64 LRs are 64-bit; the AArch32 LRs
2645                  * are split into two cp15 regs, LR (the low part, with the
2646                  * same encoding as the AArch64 LR) and LRC (the high part).
2647                  */
2648                 ARMCPRegInfo lr_regset[] = {
2649                     { .name = "ICH_LRn_EL2", .state = ARM_CP_STATE_BOTH,
2650                       .opc0 = 3, .opc1 = 4, .crn = 12,
2651                       .crm = 12 + (j >> 3), .opc2 = j & 7,
2652                       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2653                       .access = PL2_RW,
2654                       .readfn = ich_lr_read,
2655                       .writefn = ich_lr_write,
2656                     },
2657                     { .name = "ICH_LRCn_EL2", .state = ARM_CP_STATE_AA32,
2658                       .cp = 15, .opc1 = 4, .crn = 12,
2659                       .crm = 14 + (j >> 3), .opc2 = j & 7,
2660                       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2661                       .access = PL2_RW,
2662                       .readfn = ich_lr_read,
2663                       .writefn = ich_lr_write,
2664                     },
2665                     REGINFO_SENTINEL
2666                 };
2667                 define_arm_cp_regs(cpu, lr_regset);
2668             }
2669             if (cs->vprebits >= 6) {
2670                 define_arm_cp_regs(cpu, gicv3_cpuif_ich_apxr1_reginfo);
2671             }
2672             if (cs->vprebits == 7) {
2673                 define_arm_cp_regs(cpu, gicv3_cpuif_ich_apxr23_reginfo);
2674             }
2675         }
2676         arm_register_el_change_hook(cpu, gicv3_cpuif_el_change_hook, cs);
2677     }
2678 }
2679