xref: /openbmc/qemu/hw/intc/arm_gicv3_its.c (revision 0cc38f359cbb50dd4f182b4ad3b7f7a17b1a4721)
1 /*
2  * ITS emulation for a GICv3-based system
3  *
4  * Copyright Linaro.org 2021
5  *
6  * Authors:
7  *  Shashi Mallela <shashi.mallela@linaro.org>
8  *
9  * This work is licensed under the terms of the GNU GPL, version 2 or (at your
10  * option) any later version.  See the COPYING file in the top-level directory.
11  *
12  */
13 
14 #include "qemu/osdep.h"
15 #include "qemu/log.h"
16 #include "trace.h"
17 #include "hw/qdev-properties.h"
18 #include "hw/intc/arm_gicv3_its_common.h"
19 #include "gicv3_internal.h"
20 #include "qom/object.h"
21 #include "qapi/error.h"
22 
23 typedef struct GICv3ITSClass GICv3ITSClass;
24 /* This is reusing the GICv3ITSState typedef from ARM_GICV3_ITS_COMMON */
25 DECLARE_OBJ_CHECKERS(GICv3ITSState, GICv3ITSClass,
26                      ARM_GICV3_ITS, TYPE_ARM_GICV3_ITS)
27 
28 struct GICv3ITSClass {
29     GICv3ITSCommonClass parent_class;
30     void (*parent_reset)(DeviceState *dev);
31 };
32 
33 /*
34  * This is an internal enum used to distinguish between LPI triggered
35  * via command queue and LPI triggered via gits_translater write.
36  */
37 typedef enum ItsCmdType {
38     NONE = 0, /* internal indication for GITS_TRANSLATER write */
39     CLEAR = 1,
40     DISCARD = 2,
41     INTERRUPT = 3,
42 } ItsCmdType;
43 
44 typedef struct {
45     uint32_t iteh;
46     uint64_t itel;
47 } IteEntry;
48 
49 /*
50  * The ITS spec permits a range of CONSTRAINED UNPREDICTABLE options
51  * if a command parameter is not correct. These include both "stall
52  * processing of the command queue" and "ignore this command, and
53  * keep processing the queue". In our implementation we choose that
54  * memory transaction errors reading the command packet provoke a
55  * stall, but errors in parameters cause us to ignore the command
56  * and continue processing.
57  * The process_* functions which handle individual ITS commands all
58  * return an ItsCmdResult which tells process_cmdq() whether it should
59  * stall or keep going.
60  */
61 typedef enum ItsCmdResult {
62     CMD_STALL = 0,
63     CMD_CONTINUE = 1,
64 } ItsCmdResult;
65 
66 static uint64_t baser_base_addr(uint64_t value, uint32_t page_sz)
67 {
68     uint64_t result = 0;
69 
70     switch (page_sz) {
71     case GITS_PAGE_SIZE_4K:
72     case GITS_PAGE_SIZE_16K:
73         result = FIELD_EX64(value, GITS_BASER, PHYADDR) << 12;
74         break;
75 
76     case GITS_PAGE_SIZE_64K:
77         result = FIELD_EX64(value, GITS_BASER, PHYADDRL_64K) << 16;
78         result |= FIELD_EX64(value, GITS_BASER, PHYADDRH_64K) << 48;
79         break;
80 
81     default:
82         break;
83     }
84     return result;
85 }
86 
87 static uint64_t table_entry_addr(GICv3ITSState *s, TableDesc *td,
88                                  uint32_t idx, MemTxResult *res)
89 {
90     /*
91      * Given a TableDesc describing one of the ITS in-guest-memory
92      * tables and an index into it, return the guest address
93      * corresponding to that table entry.
94      * If there was a memory error reading the L1 table of an
95      * indirect table, *res is set accordingly, and we return -1.
96      * If the L1 table entry is marked not valid, we return -1 with
97      * *res set to MEMTX_OK.
98      *
99      * The specification defines the format of level 1 entries of a
100      * 2-level table, but the format of level 2 entries and the format
101      * of flat-mapped tables is IMPDEF.
102      */
103     AddressSpace *as = &s->gicv3->dma_as;
104     uint32_t l2idx;
105     uint64_t l2;
106     uint32_t num_l2_entries;
107 
108     *res = MEMTX_OK;
109 
110     if (!td->indirect) {
111         /* Single level table */
112         return td->base_addr + idx * td->entry_sz;
113     }
114 
115     /* Two level table */
116     l2idx = idx / (td->page_sz / L1TABLE_ENTRY_SIZE);
117 
118     l2 = address_space_ldq_le(as,
119                               td->base_addr + (l2idx * L1TABLE_ENTRY_SIZE),
120                               MEMTXATTRS_UNSPECIFIED, res);
121     if (*res != MEMTX_OK) {
122         return -1;
123     }
124     if (!(l2 & L2_TABLE_VALID_MASK)) {
125         return -1;
126     }
127 
128     num_l2_entries = td->page_sz / td->entry_sz;
129     return (l2 & ((1ULL << 51) - 1)) + (idx % num_l2_entries) * td->entry_sz;
130 }
131 
132 static bool get_cte(GICv3ITSState *s, uint16_t icid, uint64_t *cte,
133                     MemTxResult *res)
134 {
135     AddressSpace *as = &s->gicv3->dma_as;
136     uint64_t entry_addr = table_entry_addr(s, &s->ct, icid, res);
137 
138     if (entry_addr == -1) {
139         return false; /* not valid */
140     }
141 
142     *cte = address_space_ldq_le(as, entry_addr, MEMTXATTRS_UNSPECIFIED, res);
143     return FIELD_EX64(*cte, CTE, VALID);
144 }
145 
146 static bool update_ite(GICv3ITSState *s, uint32_t eventid, uint64_t dte,
147                        IteEntry ite)
148 {
149     AddressSpace *as = &s->gicv3->dma_as;
150     uint64_t itt_addr;
151     MemTxResult res = MEMTX_OK;
152 
153     itt_addr = FIELD_EX64(dte, DTE, ITTADDR);
154     itt_addr <<= ITTADDR_SHIFT; /* 256 byte aligned */
155 
156     address_space_stq_le(as, itt_addr + (eventid * (sizeof(uint64_t) +
157                          sizeof(uint32_t))), ite.itel, MEMTXATTRS_UNSPECIFIED,
158                          &res);
159 
160     if (res == MEMTX_OK) {
161         address_space_stl_le(as, itt_addr + (eventid * (sizeof(uint64_t) +
162                              sizeof(uint32_t))) + sizeof(uint32_t), ite.iteh,
163                              MEMTXATTRS_UNSPECIFIED, &res);
164     }
165     if (res != MEMTX_OK) {
166         return false;
167     } else {
168         return true;
169     }
170 }
171 
172 static bool get_ite(GICv3ITSState *s, uint32_t eventid, uint64_t dte,
173                     uint16_t *icid, uint32_t *pIntid, MemTxResult *res)
174 {
175     AddressSpace *as = &s->gicv3->dma_as;
176     uint64_t itt_addr;
177     bool status = false;
178     IteEntry ite = {};
179 
180     itt_addr = FIELD_EX64(dte, DTE, ITTADDR);
181     itt_addr <<= ITTADDR_SHIFT; /* 256 byte aligned */
182 
183     ite.itel = address_space_ldq_le(as, itt_addr +
184                                     (eventid * (sizeof(uint64_t) +
185                                     sizeof(uint32_t))), MEMTXATTRS_UNSPECIFIED,
186                                     res);
187 
188     if (*res == MEMTX_OK) {
189         ite.iteh = address_space_ldl_le(as, itt_addr +
190                                         (eventid * (sizeof(uint64_t) +
191                                         sizeof(uint32_t))) + sizeof(uint32_t),
192                                         MEMTXATTRS_UNSPECIFIED, res);
193 
194         if (*res == MEMTX_OK) {
195             if (FIELD_EX64(ite.itel, ITE_L, VALID)) {
196                 int inttype = FIELD_EX64(ite.itel, ITE_L, INTTYPE);
197                 if (inttype == ITE_INTTYPE_PHYSICAL) {
198                     *pIntid = FIELD_EX64(ite.itel, ITE_L, INTID);
199                     *icid = FIELD_EX32(ite.iteh, ITE_H, ICID);
200                     status = true;
201                 }
202             }
203         }
204     }
205     return status;
206 }
207 
208 static uint64_t get_dte(GICv3ITSState *s, uint32_t devid, MemTxResult *res)
209 {
210     AddressSpace *as = &s->gicv3->dma_as;
211     uint64_t entry_addr = table_entry_addr(s, &s->dt, devid, res);
212 
213     if (entry_addr == -1) {
214         return 0; /* a DTE entry with the Valid bit clear */
215     }
216     return address_space_ldq_le(as, entry_addr, MEMTXATTRS_UNSPECIFIED, res);
217 }
218 
219 /*
220  * This function handles the processing of following commands based on
221  * the ItsCmdType parameter passed:-
222  * 1. triggering of lpi interrupt translation via ITS INT command
223  * 2. triggering of lpi interrupt translation via gits_translater register
224  * 3. handling of ITS CLEAR command
225  * 4. handling of ITS DISCARD command
226  */
227 static ItsCmdResult process_its_cmd(GICv3ITSState *s, uint64_t value,
228                                     uint32_t offset, ItsCmdType cmd)
229 {
230     AddressSpace *as = &s->gicv3->dma_as;
231     uint32_t devid, eventid;
232     MemTxResult res = MEMTX_OK;
233     bool dte_valid;
234     uint64_t dte = 0;
235     uint64_t num_eventids;
236     uint16_t icid = 0;
237     uint32_t pIntid = 0;
238     bool ite_valid = false;
239     uint64_t cte = 0;
240     bool cte_valid = false;
241     uint64_t rdbase;
242 
243     if (cmd == NONE) {
244         devid = offset;
245     } else {
246         devid = ((value & DEVID_MASK) >> DEVID_SHIFT);
247 
248         offset += NUM_BYTES_IN_DW;
249         value = address_space_ldq_le(as, s->cq.base_addr + offset,
250                                      MEMTXATTRS_UNSPECIFIED, &res);
251     }
252 
253     if (res != MEMTX_OK) {
254         return CMD_STALL;
255     }
256 
257     eventid = (value & EVENTID_MASK);
258 
259     if (devid >= s->dt.num_ids) {
260         qemu_log_mask(LOG_GUEST_ERROR,
261                       "%s: invalid command attributes: devid %d>=%d",
262                       __func__, devid, s->dt.num_ids);
263         return CMD_CONTINUE;
264     }
265 
266     dte = get_dte(s, devid, &res);
267 
268     if (res != MEMTX_OK) {
269         return CMD_STALL;
270     }
271     dte_valid = FIELD_EX64(dte, DTE, VALID);
272 
273     if (!dte_valid) {
274         qemu_log_mask(LOG_GUEST_ERROR,
275                       "%s: invalid command attributes: "
276                       "invalid dte: %"PRIx64" for %d\n",
277                       __func__, dte, devid);
278         return CMD_CONTINUE;
279     }
280 
281     num_eventids = 1ULL << (FIELD_EX64(dte, DTE, SIZE) + 1);
282 
283     if (eventid >= num_eventids) {
284         qemu_log_mask(LOG_GUEST_ERROR,
285                       "%s: invalid command attributes: eventid %d >= %"
286                       PRId64 "\n",
287                       __func__, eventid, num_eventids);
288         return CMD_CONTINUE;
289     }
290 
291     ite_valid = get_ite(s, eventid, dte, &icid, &pIntid, &res);
292     if (res != MEMTX_OK) {
293         return CMD_STALL;
294     }
295 
296     if (!ite_valid) {
297         qemu_log_mask(LOG_GUEST_ERROR,
298                       "%s: invalid command attributes: invalid ITE\n",
299                       __func__);
300         return CMD_CONTINUE;
301     }
302 
303     if (icid >= s->ct.num_ids) {
304         qemu_log_mask(LOG_GUEST_ERROR,
305                       "%s: invalid ICID 0x%x in ITE (table corrupted?)\n",
306                       __func__, icid);
307         return CMD_CONTINUE;
308     }
309 
310     cte_valid = get_cte(s, icid, &cte, &res);
311     if (res != MEMTX_OK) {
312         return CMD_STALL;
313     }
314     if (!cte_valid) {
315         qemu_log_mask(LOG_GUEST_ERROR,
316                       "%s: invalid command attributes: "
317                       "invalid cte: %"PRIx64"\n",
318                       __func__, cte);
319         return CMD_CONTINUE;
320     }
321 
322     /*
323      * Current implementation only supports rdbase == procnum
324      * Hence rdbase physical address is ignored
325      */
326     rdbase = FIELD_EX64(cte, CTE, RDBASE);
327 
328     if (rdbase >= s->gicv3->num_cpu) {
329         return CMD_CONTINUE;
330     }
331 
332     if ((cmd == CLEAR) || (cmd == DISCARD)) {
333         gicv3_redist_process_lpi(&s->gicv3->cpu[rdbase], pIntid, 0);
334     } else {
335         gicv3_redist_process_lpi(&s->gicv3->cpu[rdbase], pIntid, 1);
336     }
337 
338     if (cmd == DISCARD) {
339         IteEntry ite = {};
340         /* remove mapping from interrupt translation table */
341         return update_ite(s, eventid, dte, ite) ? CMD_CONTINUE : CMD_STALL;
342     }
343     return CMD_CONTINUE;
344 }
345 
346 static ItsCmdResult process_mapti(GICv3ITSState *s, uint64_t value,
347                                   uint32_t offset, bool ignore_pInt)
348 {
349     AddressSpace *as = &s->gicv3->dma_as;
350     uint32_t devid, eventid;
351     uint32_t pIntid = 0;
352     uint64_t num_eventids;
353     uint32_t num_intids;
354     bool dte_valid;
355     MemTxResult res = MEMTX_OK;
356     uint16_t icid = 0;
357     uint64_t dte = 0;
358     IteEntry ite = {};
359 
360     devid = ((value & DEVID_MASK) >> DEVID_SHIFT);
361     offset += NUM_BYTES_IN_DW;
362     value = address_space_ldq_le(as, s->cq.base_addr + offset,
363                                  MEMTXATTRS_UNSPECIFIED, &res);
364 
365     if (res != MEMTX_OK) {
366         return CMD_STALL;
367     }
368 
369     eventid = (value & EVENTID_MASK);
370 
371     if (ignore_pInt) {
372         pIntid = eventid;
373     } else {
374         pIntid = ((value & pINTID_MASK) >> pINTID_SHIFT);
375     }
376 
377     offset += NUM_BYTES_IN_DW;
378     value = address_space_ldq_le(as, s->cq.base_addr + offset,
379                                  MEMTXATTRS_UNSPECIFIED, &res);
380 
381     if (res != MEMTX_OK) {
382         return CMD_STALL;
383     }
384 
385     icid = value & ICID_MASK;
386 
387     if (devid >= s->dt.num_ids) {
388         qemu_log_mask(LOG_GUEST_ERROR,
389                       "%s: invalid command attributes: devid %d>=%d",
390                       __func__, devid, s->dt.num_ids);
391         return CMD_CONTINUE;
392     }
393 
394     dte = get_dte(s, devid, &res);
395 
396     if (res != MEMTX_OK) {
397         return CMD_STALL;
398     }
399     dte_valid = FIELD_EX64(dte, DTE, VALID);
400     num_eventids = 1ULL << (FIELD_EX64(dte, DTE, SIZE) + 1);
401     num_intids = 1ULL << (GICD_TYPER_IDBITS + 1);
402 
403     if ((icid >= s->ct.num_ids)
404             || !dte_valid || (eventid >= num_eventids) ||
405             (((pIntid < GICV3_LPI_INTID_START) || (pIntid >= num_intids)) &&
406              (pIntid != INTID_SPURIOUS))) {
407         qemu_log_mask(LOG_GUEST_ERROR,
408                       "%s: invalid command attributes "
409                       "icid %d or eventid %d or pIntid %d or"
410                       "unmapped dte %d\n", __func__, icid, eventid,
411                       pIntid, dte_valid);
412         /*
413          * in this implementation, in case of error
414          * we ignore this command and move onto the next
415          * command in the queue
416          */
417         return CMD_CONTINUE;
418     }
419 
420     /* add ite entry to interrupt translation table */
421     ite.itel = FIELD_DP64(ite.itel, ITE_L, VALID, dte_valid);
422     ite.itel = FIELD_DP64(ite.itel, ITE_L, INTTYPE, ITE_INTTYPE_PHYSICAL);
423     ite.itel = FIELD_DP64(ite.itel, ITE_L, INTID, pIntid);
424     ite.itel = FIELD_DP64(ite.itel, ITE_L, DOORBELL, INTID_SPURIOUS);
425     ite.iteh = FIELD_DP32(ite.iteh, ITE_H, ICID, icid);
426 
427     return update_ite(s, eventid, dte, ite) ? CMD_CONTINUE : CMD_STALL;
428 }
429 
430 static bool update_cte(GICv3ITSState *s, uint16_t icid, bool valid,
431                        uint64_t rdbase)
432 {
433     AddressSpace *as = &s->gicv3->dma_as;
434     uint64_t entry_addr;
435     uint64_t cte = 0;
436     MemTxResult res = MEMTX_OK;
437 
438     if (!s->ct.valid) {
439         return true;
440     }
441 
442     if (valid) {
443         /* add mapping entry to collection table */
444         cte = FIELD_DP64(cte, CTE, VALID, 1);
445         cte = FIELD_DP64(cte, CTE, RDBASE, rdbase);
446     }
447 
448     entry_addr = table_entry_addr(s, &s->ct, icid, &res);
449     if (res != MEMTX_OK) {
450         /* memory access error: stall */
451         return false;
452     }
453     if (entry_addr == -1) {
454         /* No L2 table for this index: discard write and continue */
455         return true;
456     }
457 
458     address_space_stq_le(as, entry_addr, cte, MEMTXATTRS_UNSPECIFIED, &res);
459     return res == MEMTX_OK;
460 }
461 
462 static ItsCmdResult process_mapc(GICv3ITSState *s, uint32_t offset)
463 {
464     AddressSpace *as = &s->gicv3->dma_as;
465     uint16_t icid;
466     uint64_t rdbase;
467     bool valid;
468     MemTxResult res = MEMTX_OK;
469     uint64_t value;
470 
471     offset += NUM_BYTES_IN_DW;
472     offset += NUM_BYTES_IN_DW;
473 
474     value = address_space_ldq_le(as, s->cq.base_addr + offset,
475                                  MEMTXATTRS_UNSPECIFIED, &res);
476 
477     if (res != MEMTX_OK) {
478         return CMD_STALL;
479     }
480 
481     icid = value & ICID_MASK;
482 
483     rdbase = (value & R_MAPC_RDBASE_MASK) >> R_MAPC_RDBASE_SHIFT;
484     rdbase &= RDBASE_PROCNUM_MASK;
485 
486     valid = (value & CMD_FIELD_VALID_MASK);
487 
488     if ((icid >= s->ct.num_ids) || (rdbase >= s->gicv3->num_cpu)) {
489         qemu_log_mask(LOG_GUEST_ERROR,
490                       "ITS MAPC: invalid collection table attributes "
491                       "icid %d rdbase %" PRIu64 "\n",  icid, rdbase);
492         /*
493          * in this implementation, in case of error
494          * we ignore this command and move onto the next
495          * command in the queue
496          */
497         return CMD_CONTINUE;
498     }
499 
500     return update_cte(s, icid, valid, rdbase) ? CMD_CONTINUE : CMD_STALL;
501 }
502 
503 static bool update_dte(GICv3ITSState *s, uint32_t devid, bool valid,
504                        uint8_t size, uint64_t itt_addr)
505 {
506     AddressSpace *as = &s->gicv3->dma_as;
507     uint64_t entry_addr;
508     uint64_t dte = 0;
509     MemTxResult res = MEMTX_OK;
510 
511     if (s->dt.valid) {
512         if (valid) {
513             /* add mapping entry to device table */
514             dte = FIELD_DP64(dte, DTE, VALID, 1);
515             dte = FIELD_DP64(dte, DTE, SIZE, size);
516             dte = FIELD_DP64(dte, DTE, ITTADDR, itt_addr);
517         }
518     } else {
519         return true;
520     }
521 
522     entry_addr = table_entry_addr(s, &s->dt, devid, &res);
523     if (res != MEMTX_OK) {
524         /* memory access error: stall */
525         return false;
526     }
527     if (entry_addr == -1) {
528         /* No L2 table for this index: discard write and continue */
529         return true;
530     }
531     address_space_stq_le(as, entry_addr, dte, MEMTXATTRS_UNSPECIFIED, &res);
532     return res == MEMTX_OK;
533 }
534 
535 static ItsCmdResult process_mapd(GICv3ITSState *s, uint64_t value,
536                                  uint32_t offset)
537 {
538     AddressSpace *as = &s->gicv3->dma_as;
539     uint32_t devid;
540     uint8_t size;
541     uint64_t itt_addr;
542     bool valid;
543     MemTxResult res = MEMTX_OK;
544 
545     devid = ((value & DEVID_MASK) >> DEVID_SHIFT);
546 
547     offset += NUM_BYTES_IN_DW;
548     value = address_space_ldq_le(as, s->cq.base_addr + offset,
549                                  MEMTXATTRS_UNSPECIFIED, &res);
550 
551     if (res != MEMTX_OK) {
552         return CMD_STALL;
553     }
554 
555     size = (value & SIZE_MASK);
556 
557     offset += NUM_BYTES_IN_DW;
558     value = address_space_ldq_le(as, s->cq.base_addr + offset,
559                                  MEMTXATTRS_UNSPECIFIED, &res);
560 
561     if (res != MEMTX_OK) {
562         return CMD_STALL;
563     }
564 
565     itt_addr = (value & ITTADDR_MASK) >> ITTADDR_SHIFT;
566 
567     valid = (value & CMD_FIELD_VALID_MASK);
568 
569     if ((devid >= s->dt.num_ids) ||
570         (size > FIELD_EX64(s->typer, GITS_TYPER, IDBITS))) {
571         qemu_log_mask(LOG_GUEST_ERROR,
572                       "ITS MAPD: invalid device table attributes "
573                       "devid %d or size %d\n", devid, size);
574         /*
575          * in this implementation, in case of error
576          * we ignore this command and move onto the next
577          * command in the queue
578          */
579         return CMD_CONTINUE;
580     }
581 
582     return update_dte(s, devid, valid, size, itt_addr) ? CMD_CONTINUE : CMD_STALL;
583 }
584 
585 /*
586  * Current implementation blocks until all
587  * commands are processed
588  */
589 static void process_cmdq(GICv3ITSState *s)
590 {
591     uint32_t wr_offset = 0;
592     uint32_t rd_offset = 0;
593     uint32_t cq_offset = 0;
594     uint64_t data;
595     AddressSpace *as = &s->gicv3->dma_as;
596     MemTxResult res = MEMTX_OK;
597     uint8_t cmd;
598     int i;
599 
600     if (!(s->ctlr & R_GITS_CTLR_ENABLED_MASK)) {
601         return;
602     }
603 
604     wr_offset = FIELD_EX64(s->cwriter, GITS_CWRITER, OFFSET);
605 
606     if (wr_offset >= s->cq.num_entries) {
607         qemu_log_mask(LOG_GUEST_ERROR,
608                       "%s: invalid write offset "
609                       "%d\n", __func__, wr_offset);
610         return;
611     }
612 
613     rd_offset = FIELD_EX64(s->creadr, GITS_CREADR, OFFSET);
614 
615     if (rd_offset >= s->cq.num_entries) {
616         qemu_log_mask(LOG_GUEST_ERROR,
617                       "%s: invalid read offset "
618                       "%d\n", __func__, rd_offset);
619         return;
620     }
621 
622     while (wr_offset != rd_offset) {
623         ItsCmdResult result = CMD_CONTINUE;
624 
625         cq_offset = (rd_offset * GITS_CMDQ_ENTRY_SIZE);
626         data = address_space_ldq_le(as, s->cq.base_addr + cq_offset,
627                                     MEMTXATTRS_UNSPECIFIED, &res);
628         if (res != MEMTX_OK) {
629             s->creadr = FIELD_DP64(s->creadr, GITS_CREADR, STALLED, 1);
630             qemu_log_mask(LOG_GUEST_ERROR,
631                           "%s: could not read command at 0x%" PRIx64 "\n",
632                           __func__, s->cq.base_addr + cq_offset);
633             break;
634         }
635 
636         cmd = (data & CMD_MASK);
637 
638         trace_gicv3_its_process_command(rd_offset, cmd);
639 
640         switch (cmd) {
641         case GITS_CMD_INT:
642             result = process_its_cmd(s, data, cq_offset, INTERRUPT);
643             break;
644         case GITS_CMD_CLEAR:
645             result = process_its_cmd(s, data, cq_offset, CLEAR);
646             break;
647         case GITS_CMD_SYNC:
648             /*
649              * Current implementation makes a blocking synchronous call
650              * for every command issued earlier, hence the internal state
651              * is already consistent by the time SYNC command is executed.
652              * Hence no further processing is required for SYNC command.
653              */
654             break;
655         case GITS_CMD_MAPD:
656             result = process_mapd(s, data, cq_offset);
657             break;
658         case GITS_CMD_MAPC:
659             result = process_mapc(s, cq_offset);
660             break;
661         case GITS_CMD_MAPTI:
662             result = process_mapti(s, data, cq_offset, false);
663             break;
664         case GITS_CMD_MAPI:
665             result = process_mapti(s, data, cq_offset, true);
666             break;
667         case GITS_CMD_DISCARD:
668             result = process_its_cmd(s, data, cq_offset, DISCARD);
669             break;
670         case GITS_CMD_INV:
671         case GITS_CMD_INVALL:
672             /*
673              * Current implementation doesn't cache any ITS tables,
674              * but the calculated lpi priority information. We only
675              * need to trigger lpi priority re-calculation to be in
676              * sync with LPI config table or pending table changes.
677              */
678             for (i = 0; i < s->gicv3->num_cpu; i++) {
679                 gicv3_redist_update_lpi(&s->gicv3->cpu[i]);
680             }
681             break;
682         default:
683             break;
684         }
685         if (result == CMD_CONTINUE) {
686             rd_offset++;
687             rd_offset %= s->cq.num_entries;
688             s->creadr = FIELD_DP64(s->creadr, GITS_CREADR, OFFSET, rd_offset);
689         } else {
690             /* CMD_STALL */
691             s->creadr = FIELD_DP64(s->creadr, GITS_CREADR, STALLED, 1);
692             qemu_log_mask(LOG_GUEST_ERROR,
693                           "%s: 0x%x cmd processing failed, stalling\n",
694                           __func__, cmd);
695             break;
696         }
697     }
698 }
699 
700 /*
701  * This function extracts the ITS Device and Collection table specific
702  * parameters (like base_addr, size etc) from GITS_BASER register.
703  * It is called during ITS enable and also during post_load migration
704  */
705 static void extract_table_params(GICv3ITSState *s)
706 {
707     uint16_t num_pages = 0;
708     uint8_t  page_sz_type;
709     uint8_t type;
710     uint32_t page_sz = 0;
711     uint64_t value;
712 
713     for (int i = 0; i < 8; i++) {
714         TableDesc *td;
715         int idbits;
716 
717         value = s->baser[i];
718 
719         if (!value) {
720             continue;
721         }
722 
723         page_sz_type = FIELD_EX64(value, GITS_BASER, PAGESIZE);
724 
725         switch (page_sz_type) {
726         case 0:
727             page_sz = GITS_PAGE_SIZE_4K;
728             break;
729 
730         case 1:
731             page_sz = GITS_PAGE_SIZE_16K;
732             break;
733 
734         case 2:
735         case 3:
736             page_sz = GITS_PAGE_SIZE_64K;
737             break;
738 
739         default:
740             g_assert_not_reached();
741         }
742 
743         num_pages = FIELD_EX64(value, GITS_BASER, SIZE) + 1;
744 
745         type = FIELD_EX64(value, GITS_BASER, TYPE);
746 
747         switch (type) {
748         case GITS_BASER_TYPE_DEVICE:
749             td = &s->dt;
750             idbits = FIELD_EX64(s->typer, GITS_TYPER, DEVBITS) + 1;
751             break;
752         case GITS_BASER_TYPE_COLLECTION:
753             td = &s->ct;
754             if (FIELD_EX64(s->typer, GITS_TYPER, CIL)) {
755                 idbits = FIELD_EX64(s->typer, GITS_TYPER, CIDBITS) + 1;
756             } else {
757                 /* 16-bit CollectionId supported when CIL == 0 */
758                 idbits = 16;
759             }
760             break;
761         default:
762             /*
763              * GITS_BASER<n>.TYPE is read-only, so GITS_BASER_RO_MASK
764              * ensures we will only see type values corresponding to
765              * the values set up in gicv3_its_reset().
766              */
767             g_assert_not_reached();
768         }
769 
770         memset(td, 0, sizeof(*td));
771         td->valid = FIELD_EX64(value, GITS_BASER, VALID);
772         /*
773          * If GITS_BASER<n>.Valid is 0 for any <n> then we will not process
774          * interrupts. (GITS_TYPER.HCC is 0 for this implementation, so we
775          * do not have a special case where the GITS_BASER<n>.Valid bit is 0
776          * for the register corresponding to the Collection table but we
777          * still have to process interrupts using non-memory-backed
778          * Collection table entries.)
779          */
780         if (!td->valid) {
781             continue;
782         }
783         td->page_sz = page_sz;
784         td->indirect = FIELD_EX64(value, GITS_BASER, INDIRECT);
785         td->entry_sz = FIELD_EX64(value, GITS_BASER, ENTRYSIZE) + 1;
786         td->base_addr = baser_base_addr(value, page_sz);
787         if (!td->indirect) {
788             td->num_entries = (num_pages * page_sz) / td->entry_sz;
789         } else {
790             td->num_entries = (((num_pages * page_sz) /
791                                   L1TABLE_ENTRY_SIZE) *
792                                  (page_sz / td->entry_sz));
793         }
794         td->num_ids = 1ULL << idbits;
795     }
796 }
797 
798 static void extract_cmdq_params(GICv3ITSState *s)
799 {
800     uint16_t num_pages = 0;
801     uint64_t value = s->cbaser;
802 
803     num_pages = FIELD_EX64(value, GITS_CBASER, SIZE) + 1;
804 
805     memset(&s->cq, 0 , sizeof(s->cq));
806     s->cq.valid = FIELD_EX64(value, GITS_CBASER, VALID);
807 
808     if (s->cq.valid) {
809         s->cq.num_entries = (num_pages * GITS_PAGE_SIZE_4K) /
810                              GITS_CMDQ_ENTRY_SIZE;
811         s->cq.base_addr = FIELD_EX64(value, GITS_CBASER, PHYADDR);
812         s->cq.base_addr <<= R_GITS_CBASER_PHYADDR_SHIFT;
813     }
814 }
815 
816 static MemTxResult gicv3_its_translation_write(void *opaque, hwaddr offset,
817                                                uint64_t data, unsigned size,
818                                                MemTxAttrs attrs)
819 {
820     GICv3ITSState *s = (GICv3ITSState *)opaque;
821     bool result = true;
822     uint32_t devid = 0;
823 
824     trace_gicv3_its_translation_write(offset, data, size, attrs.requester_id);
825 
826     switch (offset) {
827     case GITS_TRANSLATER:
828         if (s->ctlr & R_GITS_CTLR_ENABLED_MASK) {
829             devid = attrs.requester_id;
830             result = process_its_cmd(s, data, devid, NONE);
831         }
832         break;
833     default:
834         break;
835     }
836 
837     if (result) {
838         return MEMTX_OK;
839     } else {
840         return MEMTX_ERROR;
841     }
842 }
843 
844 static bool its_writel(GICv3ITSState *s, hwaddr offset,
845                               uint64_t value, MemTxAttrs attrs)
846 {
847     bool result = true;
848     int index;
849 
850     switch (offset) {
851     case GITS_CTLR:
852         if (value & R_GITS_CTLR_ENABLED_MASK) {
853             s->ctlr |= R_GITS_CTLR_ENABLED_MASK;
854             extract_table_params(s);
855             extract_cmdq_params(s);
856             process_cmdq(s);
857         } else {
858             s->ctlr &= ~R_GITS_CTLR_ENABLED_MASK;
859         }
860         break;
861     case GITS_CBASER:
862         /*
863          * IMPDEF choice:- GITS_CBASER register becomes RO if ITS is
864          *                 already enabled
865          */
866         if (!(s->ctlr & R_GITS_CTLR_ENABLED_MASK)) {
867             s->cbaser = deposit64(s->cbaser, 0, 32, value);
868             s->creadr = 0;
869         }
870         break;
871     case GITS_CBASER + 4:
872         /*
873          * IMPDEF choice:- GITS_CBASER register becomes RO if ITS is
874          *                 already enabled
875          */
876         if (!(s->ctlr & R_GITS_CTLR_ENABLED_MASK)) {
877             s->cbaser = deposit64(s->cbaser, 32, 32, value);
878             s->creadr = 0;
879         }
880         break;
881     case GITS_CWRITER:
882         s->cwriter = deposit64(s->cwriter, 0, 32,
883                                (value & ~R_GITS_CWRITER_RETRY_MASK));
884         if (s->cwriter != s->creadr) {
885             process_cmdq(s);
886         }
887         break;
888     case GITS_CWRITER + 4:
889         s->cwriter = deposit64(s->cwriter, 32, 32, value);
890         break;
891     case GITS_CREADR:
892         if (s->gicv3->gicd_ctlr & GICD_CTLR_DS) {
893             s->creadr = deposit64(s->creadr, 0, 32,
894                                   (value & ~R_GITS_CREADR_STALLED_MASK));
895         } else {
896             /* RO register, ignore the write */
897             qemu_log_mask(LOG_GUEST_ERROR,
898                           "%s: invalid guest write to RO register at offset "
899                           TARGET_FMT_plx "\n", __func__, offset);
900         }
901         break;
902     case GITS_CREADR + 4:
903         if (s->gicv3->gicd_ctlr & GICD_CTLR_DS) {
904             s->creadr = deposit64(s->creadr, 32, 32, value);
905         } else {
906             /* RO register, ignore the write */
907             qemu_log_mask(LOG_GUEST_ERROR,
908                           "%s: invalid guest write to RO register at offset "
909                           TARGET_FMT_plx "\n", __func__, offset);
910         }
911         break;
912     case GITS_BASER ... GITS_BASER + 0x3f:
913         /*
914          * IMPDEF choice:- GITS_BASERn register becomes RO if ITS is
915          *                 already enabled
916          */
917         if (!(s->ctlr & R_GITS_CTLR_ENABLED_MASK)) {
918             index = (offset - GITS_BASER) / 8;
919 
920             if (offset & 7) {
921                 value <<= 32;
922                 value &= ~GITS_BASER_RO_MASK;
923                 s->baser[index] &= GITS_BASER_RO_MASK | MAKE_64BIT_MASK(0, 32);
924                 s->baser[index] |= value;
925             } else {
926                 value &= ~GITS_BASER_RO_MASK;
927                 s->baser[index] &= GITS_BASER_RO_MASK | MAKE_64BIT_MASK(32, 32);
928                 s->baser[index] |= value;
929             }
930         }
931         break;
932     case GITS_IIDR:
933     case GITS_IDREGS ... GITS_IDREGS + 0x2f:
934         /* RO registers, ignore the write */
935         qemu_log_mask(LOG_GUEST_ERROR,
936                       "%s: invalid guest write to RO register at offset "
937                       TARGET_FMT_plx "\n", __func__, offset);
938         break;
939     default:
940         result = false;
941         break;
942     }
943     return result;
944 }
945 
946 static bool its_readl(GICv3ITSState *s, hwaddr offset,
947                              uint64_t *data, MemTxAttrs attrs)
948 {
949     bool result = true;
950     int index;
951 
952     switch (offset) {
953     case GITS_CTLR:
954         *data = s->ctlr;
955         break;
956     case GITS_IIDR:
957         *data = gicv3_iidr();
958         break;
959     case GITS_IDREGS ... GITS_IDREGS + 0x2f:
960         /* ID registers */
961         *data = gicv3_idreg(offset - GITS_IDREGS);
962         break;
963     case GITS_TYPER:
964         *data = extract64(s->typer, 0, 32);
965         break;
966     case GITS_TYPER + 4:
967         *data = extract64(s->typer, 32, 32);
968         break;
969     case GITS_CBASER:
970         *data = extract64(s->cbaser, 0, 32);
971         break;
972     case GITS_CBASER + 4:
973         *data = extract64(s->cbaser, 32, 32);
974         break;
975     case GITS_CREADR:
976         *data = extract64(s->creadr, 0, 32);
977         break;
978     case GITS_CREADR + 4:
979         *data = extract64(s->creadr, 32, 32);
980         break;
981     case GITS_CWRITER:
982         *data = extract64(s->cwriter, 0, 32);
983         break;
984     case GITS_CWRITER + 4:
985         *data = extract64(s->cwriter, 32, 32);
986         break;
987     case GITS_BASER ... GITS_BASER + 0x3f:
988         index = (offset - GITS_BASER) / 8;
989         if (offset & 7) {
990             *data = extract64(s->baser[index], 32, 32);
991         } else {
992             *data = extract64(s->baser[index], 0, 32);
993         }
994         break;
995     default:
996         result = false;
997         break;
998     }
999     return result;
1000 }
1001 
1002 static bool its_writell(GICv3ITSState *s, hwaddr offset,
1003                                uint64_t value, MemTxAttrs attrs)
1004 {
1005     bool result = true;
1006     int index;
1007 
1008     switch (offset) {
1009     case GITS_BASER ... GITS_BASER + 0x3f:
1010         /*
1011          * IMPDEF choice:- GITS_BASERn register becomes RO if ITS is
1012          *                 already enabled
1013          */
1014         if (!(s->ctlr & R_GITS_CTLR_ENABLED_MASK)) {
1015             index = (offset - GITS_BASER) / 8;
1016             s->baser[index] &= GITS_BASER_RO_MASK;
1017             s->baser[index] |= (value & ~GITS_BASER_RO_MASK);
1018         }
1019         break;
1020     case GITS_CBASER:
1021         /*
1022          * IMPDEF choice:- GITS_CBASER register becomes RO if ITS is
1023          *                 already enabled
1024          */
1025         if (!(s->ctlr & R_GITS_CTLR_ENABLED_MASK)) {
1026             s->cbaser = value;
1027             s->creadr = 0;
1028         }
1029         break;
1030     case GITS_CWRITER:
1031         s->cwriter = value & ~R_GITS_CWRITER_RETRY_MASK;
1032         if (s->cwriter != s->creadr) {
1033             process_cmdq(s);
1034         }
1035         break;
1036     case GITS_CREADR:
1037         if (s->gicv3->gicd_ctlr & GICD_CTLR_DS) {
1038             s->creadr = value & ~R_GITS_CREADR_STALLED_MASK;
1039         } else {
1040             /* RO register, ignore the write */
1041             qemu_log_mask(LOG_GUEST_ERROR,
1042                           "%s: invalid guest write to RO register at offset "
1043                           TARGET_FMT_plx "\n", __func__, offset);
1044         }
1045         break;
1046     case GITS_TYPER:
1047         /* RO registers, ignore the write */
1048         qemu_log_mask(LOG_GUEST_ERROR,
1049                       "%s: invalid guest write to RO register at offset "
1050                       TARGET_FMT_plx "\n", __func__, offset);
1051         break;
1052     default:
1053         result = false;
1054         break;
1055     }
1056     return result;
1057 }
1058 
1059 static bool its_readll(GICv3ITSState *s, hwaddr offset,
1060                               uint64_t *data, MemTxAttrs attrs)
1061 {
1062     bool result = true;
1063     int index;
1064 
1065     switch (offset) {
1066     case GITS_TYPER:
1067         *data = s->typer;
1068         break;
1069     case GITS_BASER ... GITS_BASER + 0x3f:
1070         index = (offset - GITS_BASER) / 8;
1071         *data = s->baser[index];
1072         break;
1073     case GITS_CBASER:
1074         *data = s->cbaser;
1075         break;
1076     case GITS_CREADR:
1077         *data = s->creadr;
1078         break;
1079     case GITS_CWRITER:
1080         *data = s->cwriter;
1081         break;
1082     default:
1083         result = false;
1084         break;
1085     }
1086     return result;
1087 }
1088 
1089 static MemTxResult gicv3_its_read(void *opaque, hwaddr offset, uint64_t *data,
1090                                   unsigned size, MemTxAttrs attrs)
1091 {
1092     GICv3ITSState *s = (GICv3ITSState *)opaque;
1093     bool result;
1094 
1095     switch (size) {
1096     case 4:
1097         result = its_readl(s, offset, data, attrs);
1098         break;
1099     case 8:
1100         result = its_readll(s, offset, data, attrs);
1101         break;
1102     default:
1103         result = false;
1104         break;
1105     }
1106 
1107     if (!result) {
1108         qemu_log_mask(LOG_GUEST_ERROR,
1109                       "%s: invalid guest read at offset " TARGET_FMT_plx
1110                       "size %u\n", __func__, offset, size);
1111         trace_gicv3_its_badread(offset, size);
1112         /*
1113          * The spec requires that reserved registers are RAZ/WI;
1114          * so use false returns from leaf functions as a way to
1115          * trigger the guest-error logging but don't return it to
1116          * the caller, or we'll cause a spurious guest data abort.
1117          */
1118         *data = 0;
1119     } else {
1120         trace_gicv3_its_read(offset, *data, size);
1121     }
1122     return MEMTX_OK;
1123 }
1124 
1125 static MemTxResult gicv3_its_write(void *opaque, hwaddr offset, uint64_t data,
1126                                    unsigned size, MemTxAttrs attrs)
1127 {
1128     GICv3ITSState *s = (GICv3ITSState *)opaque;
1129     bool result;
1130 
1131     switch (size) {
1132     case 4:
1133         result = its_writel(s, offset, data, attrs);
1134         break;
1135     case 8:
1136         result = its_writell(s, offset, data, attrs);
1137         break;
1138     default:
1139         result = false;
1140         break;
1141     }
1142 
1143     if (!result) {
1144         qemu_log_mask(LOG_GUEST_ERROR,
1145                       "%s: invalid guest write at offset " TARGET_FMT_plx
1146                       "size %u\n", __func__, offset, size);
1147         trace_gicv3_its_badwrite(offset, data, size);
1148         /*
1149          * The spec requires that reserved registers are RAZ/WI;
1150          * so use false returns from leaf functions as a way to
1151          * trigger the guest-error logging but don't return it to
1152          * the caller, or we'll cause a spurious guest data abort.
1153          */
1154     } else {
1155         trace_gicv3_its_write(offset, data, size);
1156     }
1157     return MEMTX_OK;
1158 }
1159 
1160 static const MemoryRegionOps gicv3_its_control_ops = {
1161     .read_with_attrs = gicv3_its_read,
1162     .write_with_attrs = gicv3_its_write,
1163     .valid.min_access_size = 4,
1164     .valid.max_access_size = 8,
1165     .impl.min_access_size = 4,
1166     .impl.max_access_size = 8,
1167     .endianness = DEVICE_NATIVE_ENDIAN,
1168 };
1169 
1170 static const MemoryRegionOps gicv3_its_translation_ops = {
1171     .write_with_attrs = gicv3_its_translation_write,
1172     .valid.min_access_size = 2,
1173     .valid.max_access_size = 4,
1174     .impl.min_access_size = 2,
1175     .impl.max_access_size = 4,
1176     .endianness = DEVICE_NATIVE_ENDIAN,
1177 };
1178 
1179 static void gicv3_arm_its_realize(DeviceState *dev, Error **errp)
1180 {
1181     GICv3ITSState *s = ARM_GICV3_ITS_COMMON(dev);
1182     int i;
1183 
1184     for (i = 0; i < s->gicv3->num_cpu; i++) {
1185         if (!(s->gicv3->cpu[i].gicr_typer & GICR_TYPER_PLPIS)) {
1186             error_setg(errp, "Physical LPI not supported by CPU %d", i);
1187             return;
1188         }
1189     }
1190 
1191     gicv3_its_init_mmio(s, &gicv3_its_control_ops, &gicv3_its_translation_ops);
1192 
1193     /* set the ITS default features supported */
1194     s->typer = FIELD_DP64(s->typer, GITS_TYPER, PHYSICAL, 1);
1195     s->typer = FIELD_DP64(s->typer, GITS_TYPER, ITT_ENTRY_SIZE,
1196                           ITS_ITT_ENTRY_SIZE - 1);
1197     s->typer = FIELD_DP64(s->typer, GITS_TYPER, IDBITS, ITS_IDBITS);
1198     s->typer = FIELD_DP64(s->typer, GITS_TYPER, DEVBITS, ITS_DEVBITS);
1199     s->typer = FIELD_DP64(s->typer, GITS_TYPER, CIL, 1);
1200     s->typer = FIELD_DP64(s->typer, GITS_TYPER, CIDBITS, ITS_CIDBITS);
1201 }
1202 
1203 static void gicv3_its_reset(DeviceState *dev)
1204 {
1205     GICv3ITSState *s = ARM_GICV3_ITS_COMMON(dev);
1206     GICv3ITSClass *c = ARM_GICV3_ITS_GET_CLASS(s);
1207 
1208     c->parent_reset(dev);
1209 
1210     /* Quiescent bit reset to 1 */
1211     s->ctlr = FIELD_DP32(s->ctlr, GITS_CTLR, QUIESCENT, 1);
1212 
1213     /*
1214      * setting GITS_BASER0.Type = 0b001 (Device)
1215      *         GITS_BASER1.Type = 0b100 (Collection Table)
1216      *         GITS_BASER<n>.Type,where n = 3 to 7 are 0b00 (Unimplemented)
1217      *         GITS_BASER<0,1>.Page_Size = 64KB
1218      * and default translation table entry size to 16 bytes
1219      */
1220     s->baser[0] = FIELD_DP64(s->baser[0], GITS_BASER, TYPE,
1221                              GITS_BASER_TYPE_DEVICE);
1222     s->baser[0] = FIELD_DP64(s->baser[0], GITS_BASER, PAGESIZE,
1223                              GITS_BASER_PAGESIZE_64K);
1224     s->baser[0] = FIELD_DP64(s->baser[0], GITS_BASER, ENTRYSIZE,
1225                              GITS_DTE_SIZE - 1);
1226 
1227     s->baser[1] = FIELD_DP64(s->baser[1], GITS_BASER, TYPE,
1228                              GITS_BASER_TYPE_COLLECTION);
1229     s->baser[1] = FIELD_DP64(s->baser[1], GITS_BASER, PAGESIZE,
1230                              GITS_BASER_PAGESIZE_64K);
1231     s->baser[1] = FIELD_DP64(s->baser[1], GITS_BASER, ENTRYSIZE,
1232                              GITS_CTE_SIZE - 1);
1233 }
1234 
1235 static void gicv3_its_post_load(GICv3ITSState *s)
1236 {
1237     if (s->ctlr & R_GITS_CTLR_ENABLED_MASK) {
1238         extract_table_params(s);
1239         extract_cmdq_params(s);
1240     }
1241 }
1242 
1243 static Property gicv3_its_props[] = {
1244     DEFINE_PROP_LINK("parent-gicv3", GICv3ITSState, gicv3, "arm-gicv3",
1245                      GICv3State *),
1246     DEFINE_PROP_END_OF_LIST(),
1247 };
1248 
1249 static void gicv3_its_class_init(ObjectClass *klass, void *data)
1250 {
1251     DeviceClass *dc = DEVICE_CLASS(klass);
1252     GICv3ITSClass *ic = ARM_GICV3_ITS_CLASS(klass);
1253     GICv3ITSCommonClass *icc = ARM_GICV3_ITS_COMMON_CLASS(klass);
1254 
1255     dc->realize = gicv3_arm_its_realize;
1256     device_class_set_props(dc, gicv3_its_props);
1257     device_class_set_parent_reset(dc, gicv3_its_reset, &ic->parent_reset);
1258     icc->post_load = gicv3_its_post_load;
1259 }
1260 
1261 static const TypeInfo gicv3_its_info = {
1262     .name = TYPE_ARM_GICV3_ITS,
1263     .parent = TYPE_ARM_GICV3_ITS_COMMON,
1264     .instance_size = sizeof(GICv3ITSState),
1265     .class_init = gicv3_its_class_init,
1266     .class_size = sizeof(GICv3ITSClass),
1267 };
1268 
1269 static void gicv3_its_register_types(void)
1270 {
1271     type_register_static(&gicv3_its_info);
1272 }
1273 
1274 type_init(gicv3_its_register_types)
1275