1/*
2 * ARM Generic Interrupt Controller v3
3 *
4 * Copyright (c) 2016 Linaro Limited
5 * Written by Peter Maydell
6 *
7 * This code is licensed under the GPL, version 2 or (at your option)
8 * any later version.
9 */
10
11/* This file contains the code for the system register interface
12 * portions of the GICv3.
13 */
14
15#include "qemu/osdep.h"
16#include "qemu/bitops.h"
17#include "qemu/main-loop.h"
18#include "trace.h"
19#include "gicv3_internal.h"
20#include "hw/irq.h"
21#include "cpu.h"
22
23void gicv3_set_gicv3state(CPUState *cpu, GICv3CPUState *s)
24{
25 ARMCPU *arm_cpu = ARM_CPU(cpu);
26 CPUARMState *env = &arm_cpu->env;
27
28 env->gicv3state = (void *)s;
29};
30
31static GICv3CPUState *icc_cs_from_env(CPUARMState *env)
32{
33 return env->gicv3state;
34}
35
36static bool gicv3_use_ns_bank(CPUARMState *env)
37{
38 /* Return true if we should use the NonSecure bank for a banked GIC
39 * CPU interface register. Note that this differs from the
40 * access_secure_reg() function because GICv3 banked registers are
41 * banked even for AArch64, unlike the other CPU system registers.
42 */
43 return !arm_is_secure_below_el3(env);
44}
45
46/* The minimum BPR for the virtual interface is a configurable property */
47static inline int icv_min_vbpr(GICv3CPUState *cs)
48{
49 return 7 - cs->vprebits;
50}
51
52/* Simple accessor functions for LR fields */
53static uint32_t ich_lr_vintid(uint64_t lr)
54{
55 return extract64(lr, ICH_LR_EL2_VINTID_SHIFT, ICH_LR_EL2_VINTID_LENGTH);
56}
57
58static uint32_t ich_lr_pintid(uint64_t lr)
59{
60 return extract64(lr, ICH_LR_EL2_PINTID_SHIFT, ICH_LR_EL2_PINTID_LENGTH);
61}
62
63static uint32_t ich_lr_prio(uint64_t lr)
64{
65 return extract64(lr, ICH_LR_EL2_PRIORITY_SHIFT, ICH_LR_EL2_PRIORITY_LENGTH);
66}
67
68static int ich_lr_state(uint64_t lr)
69{
70 return extract64(lr, ICH_LR_EL2_STATE_SHIFT, ICH_LR_EL2_STATE_LENGTH);
71}
72
73static bool icv_access(CPUARMState *env, int hcr_flags)
74{
75 /* Return true if this ICC_ register access should really be
76 * directed to an ICV_ access. hcr_flags is a mask of
77 * HCR_EL2 bits to check: we treat this as an ICV_ access
78 * if we are in NS EL1 and at least one of the specified
79 * HCR_EL2 bits is set.
80 *
81 * ICV registers fall into four categories:
82 * * access if NS EL1 and HCR_EL2.FMO == 1:
83 * all ICV regs with '0' in their name
84 * * access if NS EL1 and HCR_EL2.IMO == 1:
85 * all ICV regs with '1' in their name
86 * * access if NS EL1 and either IMO or FMO == 1:
87 * CTLR, DIR, PMR, RPR
88 */
89 uint64_t hcr_el2 = arm_hcr_el2_eff(env);
90 bool flagmatch = hcr_el2 & hcr_flags & (HCR_IMO | HCR_FMO);
91
92 return flagmatch && arm_current_el(env) == 1
93 && !arm_is_secure_below_el3(env);
94}
95
96static int read_vbpr(GICv3CPUState *cs, int grp)
97{
98 /* Read VBPR value out of the VMCR field (caller must handle
99 * VCBPR effects if required)
100 */
101 if (grp == GICV3_G0) {
102 return extract64(cs->ich_vmcr_el2, ICH_VMCR_EL2_VBPR0_SHIFT,
103 ICH_VMCR_EL2_VBPR0_LENGTH);
104 } else {
105 return extract64(cs->ich_vmcr_el2, ICH_VMCR_EL2_VBPR1_SHIFT,
106 ICH_VMCR_EL2_VBPR1_LENGTH);
107 }
108}
109
110static void write_vbpr(GICv3CPUState *cs, int grp, int value)
111{
112 /* Write new VBPR1 value, handling the "writing a value less than
113 * the minimum sets it to the minimum" semantics.
114 */
115 int min = icv_min_vbpr(cs);
116
117 if (grp != GICV3_G0) {
118 min++;
119 }
120
121 value = MAX(value, min);
122
123 if (grp == GICV3_G0) {
124 cs->ich_vmcr_el2 = deposit64(cs->ich_vmcr_el2, ICH_VMCR_EL2_VBPR0_SHIFT,
125 ICH_VMCR_EL2_VBPR0_LENGTH, value);
126 } else {
127 cs->ich_vmcr_el2 = deposit64(cs->ich_vmcr_el2, ICH_VMCR_EL2_VBPR1_SHIFT,
128 ICH_VMCR_EL2_VBPR1_LENGTH, value);
129 }
130}
131
132static uint32_t icv_fullprio_mask(GICv3CPUState *cs)
133{
134 /* Return a mask word which clears the unimplemented priority bits
135 * from a priority value for a virtual interrupt. (Not to be confused
136 * with the group priority, whose mask depends on the value of VBPR
137 * for the interrupt group.)
138 */
139 return ~0U << (8 - cs->vpribits);
140}
141
142static int ich_highest_active_virt_prio(GICv3CPUState *cs)
143{
144 /* Calculate the current running priority based on the set bits
145 * in the ICH Active Priority Registers.
146 */
147 int i;
148 int aprmax = 1 << (cs->vprebits - 5);
149
150 assert(aprmax <= ARRAY_SIZE(cs->ich_apr[0]));
151
152 for (i = 0; i < aprmax; i++) {
153 uint32_t apr = cs->ich_apr[GICV3_G0][i] |
154 cs->ich_apr[GICV3_G1NS][i];
155
156 if (!apr) {
157 continue;
158 }
159 return (i * 32 + ctz32(apr)) << (icv_min_vbpr(cs) + 1);
160 }
161 /* No current active interrupts: return idle priority */
162 return 0xff;
163}
164
165static int hppvi_index(GICv3CPUState *cs)
166{
167 /* Return the list register index of the highest priority pending
168 * virtual interrupt, as per the HighestPriorityVirtualInterrupt
169 * pseudocode. If no pending virtual interrupts, return -1.
170 */
171 int idx = -1;
172 int i;
173 /* Note that a list register entry with a priority of 0xff will
174 * never be reported by this function; this is the architecturally
175 * correct behaviour.
176 */
177 int prio = 0xff;
178
179 if (!(cs->ich_vmcr_el2 & (ICH_VMCR_EL2_VENG0 | ICH_VMCR_EL2_VENG1))) {
180 /* Both groups disabled, definitely nothing to do */
181 return idx;
182 }
183
184 for (i = 0; i < cs->num_list_regs; i++) {
185 uint64_t lr = cs->ich_lr_el2[i];
186 int thisprio;
187
188 if (ich_lr_state(lr) != ICH_LR_EL2_STATE_PENDING) {
189 /* Not Pending */
190 continue;
191 }
192
193 /* Ignore interrupts if relevant group enable not set */
194 if (lr & ICH_LR_EL2_GROUP) {
195 if (!(cs->ich_vmcr_el2 & ICH_VMCR_EL2_VENG1)) {
196 continue;
197 }
198 } else {
199 if (!(cs->ich_vmcr_el2 & ICH_VMCR_EL2_VENG0)) {
200 continue;
201 }
202 }
203
204 thisprio = ich_lr_prio(lr);
205
206 if (thisprio < prio) {
207 prio = thisprio;
208 idx = i;
209 }
210 }
211
212 return idx;
213}
214
215static uint32_t icv_gprio_mask(GICv3CPUState *cs, int group)
216{
217 /* Return a mask word which clears the subpriority bits from
218 * a priority value for a virtual interrupt in the specified group.
219 * This depends on the VBPR value.
220 * If using VBPR0 then:
221 * a BPR of 0 means the group priority bits are [7:1];
222 * a BPR of 1 means they are [7:2], and so on down to
223 * a BPR of 7 meaning no group priority bits at all.
224 * If using VBPR1 then:
225 * a BPR of 0 is impossible (the minimum value is 1)
226 * a BPR of 1 means the group priority bits are [7:1];
227 * a BPR of 2 means they are [7:2], and so on down to
228 * a BPR of 7 meaning the group priority is [7].
229 *
230 * Which BPR to use depends on the group of the interrupt and
231 * the current ICH_VMCR_EL2.VCBPR settings.
232 *
233 * This corresponds to the VGroupBits() pseudocode.
234 */
235 int bpr;
236
237 if (group == GICV3_G1NS && cs->ich_vmcr_el2 & ICH_VMCR_EL2_VCBPR) {
238 group = GICV3_G0;
239 }
240
241 bpr = read_vbpr(cs, group);
242 if (group == GICV3_G1NS) {
243 assert(bpr > 0);
244 bpr--;
245 }
246
247 return ~0U << (bpr + 1);
248}
249
250static bool icv_hppi_can_preempt(GICv3CPUState *cs, uint64_t lr)
251{
252 /* Return true if we can signal this virtual interrupt defined by
253 * the given list register value; see the pseudocode functions
254 * CanSignalVirtualInterrupt and CanSignalVirtualInt.
255 * Compare also icc_hppi_can_preempt() which is the non-virtual
256 * equivalent of these checks.
257 */
258 int grp;
259 uint32_t mask, prio, rprio, vpmr;
260
261 if (!(cs->ich_hcr_el2 & ICH_HCR_EL2_EN)) {
262 /* Virtual interface disabled */
263 return false;
264 }
265
266 /* We don't need to check that this LR is in Pending state because
267 * that has already been done in hppvi_index().
268 */
269
270 prio = ich_lr_prio(lr);
271 vpmr = extract64(cs->ich_vmcr_el2, ICH_VMCR_EL2_VPMR_SHIFT,
272 ICH_VMCR_EL2_VPMR_LENGTH);
273
274 if (prio >= vpmr) {
275 /* Priority mask masks this interrupt */
276 return false;
277 }
278
279 rprio = ich_highest_active_virt_prio(cs);
280 if (rprio == 0xff) {
281 /* No running interrupt so we can preempt */
282 return true;
283 }
284
285 grp = (lr & ICH_LR_EL2_GROUP) ? GICV3_G1NS : GICV3_G0;
286
287 mask = icv_gprio_mask(cs, grp);
288
289 /* We only preempt a running interrupt if the pending interrupt's
290 * group priority is sufficient (the subpriorities are not considered).
291 */
292 if ((prio & mask) < (rprio & mask)) {
293 return true;
294 }
295
296 return false;
297}
298
299static uint32_t eoi_maintenance_interrupt_state(GICv3CPUState *cs,
300 uint32_t *misr)
301{
302 /* Return a set of bits indicating the EOI maintenance interrupt status
303 * for each list register. The EOI maintenance interrupt status is
304 * 1 if LR.State == 0 && LR.HW == 0 && LR.EOI == 1
305 * (see the GICv3 spec for the ICH_EISR_EL2 register).
306 * If misr is not NULL then we should also collect the information
307 * about the MISR.EOI, MISR.NP and MISR.U bits.
308 */
309 uint32_t value = 0;
310 int validcount = 0;
311 bool seenpending = false;
312 int i;
313
314 for (i = 0; i < cs->num_list_regs; i++) {
315 uint64_t lr = cs->ich_lr_el2[i];
316
317 if ((lr & (ICH_LR_EL2_STATE_MASK | ICH_LR_EL2_HW | ICH_LR_EL2_EOI))
318 == ICH_LR_EL2_EOI) {
319 value |= (1 << i);
320 }
321 if ((lr & ICH_LR_EL2_STATE_MASK)) {
322 validcount++;
323 }
324 if (ich_lr_state(lr) == ICH_LR_EL2_STATE_PENDING) {
325 seenpending = true;
326 }
327 }
328
329 if (misr) {
330 if (validcount < 2 && (cs->ich_hcr_el2 & ICH_HCR_EL2_UIE)) {
331 *misr |= ICH_MISR_EL2_U;
332 }
333 if (!seenpending && (cs->ich_hcr_el2 & ICH_HCR_EL2_NPIE)) {
334 *misr |= ICH_MISR_EL2_NP;
335 }
336 if (value) {
337 *misr |= ICH_MISR_EL2_EOI;
338 }
339 }
340 return value;
341}
342
343static uint32_t maintenance_interrupt_state(GICv3CPUState *cs)
344{
345 /* Return a set of bits indicating the maintenance interrupt status
346 * (as seen in the ICH_MISR_EL2 register).
347 */
348 uint32_t value = 0;
349
350 /* Scan list registers and fill in the U, NP and EOI bits */
351 eoi_maintenance_interrupt_state(cs, &value);
352
353 if (cs->ich_hcr_el2 & (ICH_HCR_EL2_LRENPIE | ICH_HCR_EL2_EOICOUNT_MASK)) {
354 value |= ICH_MISR_EL2_LRENP;
355 }
356
357 if ((cs->ich_hcr_el2 & ICH_HCR_EL2_VGRP0EIE) &&
358 (cs->ich_vmcr_el2 & ICH_VMCR_EL2_VENG0)) {
359 value |= ICH_MISR_EL2_VGRP0E;
360 }
361
362 if ((cs->ich_hcr_el2 & ICH_HCR_EL2_VGRP0DIE) &&
363 !(cs->ich_vmcr_el2 & ICH_VMCR_EL2_VENG1)) {
364 value |= ICH_MISR_EL2_VGRP0D;
365 }
366 if ((cs->ich_hcr_el2 & ICH_HCR_EL2_VGRP1EIE) &&
367 (cs->ich_vmcr_el2 & ICH_VMCR_EL2_VENG1)) {
368 value |= ICH_MISR_EL2_VGRP1E;
369 }
370
371 if ((cs->ich_hcr_el2 & ICH_HCR_EL2_VGRP1DIE) &&
372 !(cs->ich_vmcr_el2 & ICH_VMCR_EL2_VENG1)) {
373 value |= ICH_MISR_EL2_VGRP1D;
374 }
375
376 return value;
377}
378
379static void gicv3_cpuif_virt_update(GICv3CPUState *cs)
380{
381 /* Tell the CPU about any pending virtual interrupts or
382 * maintenance interrupts, following a change to the state
383 * of the CPU interface relevant to virtual interrupts.
384 *
385 * CAUTION: this function will call qemu_set_irq() on the
386 * CPU maintenance IRQ line, which is typically wired up
387 * to the GIC as a per-CPU interrupt. This means that it
388 * will recursively call back into the GIC code via
389 * gicv3_redist_set_irq() and thus into the CPU interface code's
390 * gicv3_cpuif_update(). It is therefore important that this
391 * function is only called as the final action of a CPU interface
392 * register write implementation, after all the GIC state
393 * fields have been updated. gicv3_cpuif_update() also must
394 * not cause this function to be called, but that happens
395 * naturally as a result of there being no architectural
396 * linkage between the physical and virtual GIC logic.
397 */
398 int idx;
399 int irqlevel = 0;
400 int fiqlevel = 0;
401 int maintlevel = 0;
402
403 idx = hppvi_index(cs);
404 trace_gicv3_cpuif_virt_update(gicv3_redist_affid(cs), idx);
405 if (idx >= 0) {
406 uint64_t lr = cs->ich_lr_el2[idx];
407
408 if (icv_hppi_can_preempt(cs, lr)) {
409 /* Virtual interrupts are simple: G0 are always FIQ, and G1 IRQ */
410 if (lr & ICH_LR_EL2_GROUP) {
411 irqlevel = 1;
412 } else {
413 fiqlevel = 1;
414 }
415 }
416 }
417
418 if (cs->ich_hcr_el2 & ICH_HCR_EL2_EN) {
419 maintlevel = maintenance_interrupt_state(cs);
420 }
421
422 trace_gicv3_cpuif_virt_set_irqs(gicv3_redist_affid(cs), fiqlevel,
423 irqlevel, maintlevel);
424
425 qemu_set_irq(cs->parent_vfiq, fiqlevel);
426 qemu_set_irq(cs->parent_virq, irqlevel);
427 qemu_set_irq(cs->maintenance_irq, maintlevel);
428}
429
430static uint64_t icv_ap_read(CPUARMState *env, const ARMCPRegInfo *ri)
431{
432 GICv3CPUState *cs = icc_cs_from_env(env);
433 int regno = ri->opc2 & 3;
434 int grp = (ri->crm & 1) ? GICV3_G1NS : GICV3_G0;
435 uint64_t value = cs->ich_apr[grp][regno];
436
437 trace_gicv3_icv_ap_read(ri->crm & 1, regno, gicv3_redist_affid(cs), value);
438 return value;
439}
440
441static void icv_ap_write(CPUARMState *env, const ARMCPRegInfo *ri,
442 uint64_t value)
443{
444 GICv3CPUState *cs = icc_cs_from_env(env);
445 int regno = ri->opc2 & 3;
446 int grp = (ri->crm & 1) ? GICV3_G1NS : GICV3_G0;
447
448 trace_gicv3_icv_ap_write(ri->crm & 1, regno, gicv3_redist_affid(cs), value);
449
450 cs->ich_apr[grp][regno] = value & 0xFFFFFFFFU;
451
452 gicv3_cpuif_virt_update(cs);
453 return;
454}
455
456static uint64_t icv_bpr_read(CPUARMState *env, const ARMCPRegInfo *ri)
457{
458 GICv3CPUState *cs = icc_cs_from_env(env);
459 int grp = (ri->crm == 8) ? GICV3_G0 : GICV3_G1NS;
460 uint64_t bpr;
461 bool satinc = false;
462
463 if (grp == GICV3_G1NS && (cs->ich_vmcr_el2 & ICH_VMCR_EL2_VCBPR)) {
464 /* reads return bpr0 + 1 saturated to 7, writes ignored */
465 grp = GICV3_G0;
466 satinc = true;
467 }
468
469 bpr = read_vbpr(cs, grp);
470
471 if (satinc) {
472 bpr++;
473 bpr = MIN(bpr, 7);
474 }
475
476 trace_gicv3_icv_bpr_read(ri->crm == 8 ? 0 : 1, gicv3_redist_affid(cs), bpr);
477
478 return bpr;
479}
480
481static void icv_bpr_write(CPUARMState *env, const ARMCPRegInfo *ri,
482 uint64_t value)
483{
484 GICv3CPUState *cs = icc_cs_from_env(env);
485 int grp = (ri->crm == 8) ? GICV3_G0 : GICV3_G1NS;
486
487 trace_gicv3_icv_bpr_write(ri->crm == 8 ? 0 : 1,
488 gicv3_redist_affid(cs), value);
489
490 if (grp == GICV3_G1NS && (cs->ich_vmcr_el2 & ICH_VMCR_EL2_VCBPR)) {
491 /* reads return bpr0 + 1 saturated to 7, writes ignored */
492 return;
493 }
494
495 write_vbpr(cs, grp, value);
496
497 gicv3_cpuif_virt_update(cs);
498}
499
500static uint64_t icv_pmr_read(CPUARMState *env, const ARMCPRegInfo *ri)
501{
502 GICv3CPUState *cs = icc_cs_from_env(env);
503 uint64_t value;
504
505 value = extract64(cs->ich_vmcr_el2, ICH_VMCR_EL2_VPMR_SHIFT,
506 ICH_VMCR_EL2_VPMR_LENGTH);
507
508 trace_gicv3_icv_pmr_read(gicv3_redist_affid(cs), value);
509 return value;
510}
511
512static void icv_pmr_write(CPUARMState *env, const ARMCPRegInfo *ri,
513 uint64_t value)
514{
515 GICv3CPUState *cs = icc_cs_from_env(env);
516
517 trace_gicv3_icv_pmr_write(gicv3_redist_affid(cs), value);
518
519 value &= icv_fullprio_mask(cs);
520
521 cs->ich_vmcr_el2 = deposit64(cs->ich_vmcr_el2, ICH_VMCR_EL2_VPMR_SHIFT,
522 ICH_VMCR_EL2_VPMR_LENGTH, value);
523
524 gicv3_cpuif_virt_update(cs);
525}
526
527static uint64_t icv_igrpen_read(CPUARMState *env, const ARMCPRegInfo *ri)
528{
529 GICv3CPUState *cs = icc_cs_from_env(env);
530 int enbit;
531 uint64_t value;
532
533 enbit = ri->opc2 & 1 ? ICH_VMCR_EL2_VENG1_SHIFT : ICH_VMCR_EL2_VENG0_SHIFT;
534 value = extract64(cs->ich_vmcr_el2, enbit, 1);
535
536 trace_gicv3_icv_igrpen_read(ri->opc2 & 1 ? 1 : 0,
537 gicv3_redist_affid(cs), value);
538 return value;
539}
540
541static void icv_igrpen_write(CPUARMState *env, const ARMCPRegInfo *ri,
542 uint64_t value)
543{
544 GICv3CPUState *cs = icc_cs_from_env(env);
545 int enbit;
546
547 trace_gicv3_icv_igrpen_write(ri->opc2 & 1 ? 1 : 0,
548 gicv3_redist_affid(cs), value);
549
550 enbit = ri->opc2 & 1 ? ICH_VMCR_EL2_VENG1_SHIFT : ICH_VMCR_EL2_VENG0_SHIFT;
551
552 cs->ich_vmcr_el2 = deposit64(cs->ich_vmcr_el2, enbit, 1, value);
553 gicv3_cpuif_virt_update(cs);
554}
555
556static uint64_t icv_ctlr_read(CPUARMState *env, const ARMCPRegInfo *ri)
557{
558 GICv3CPUState *cs = icc_cs_from_env(env);
559 uint64_t value;
560
561 /* Note that the fixed fields here (A3V, SEIS, IDbits, PRIbits)
562 * should match the ones reported in ich_vtr_read().
563 */
564 value = ICC_CTLR_EL1_A3V | (1 << ICC_CTLR_EL1_IDBITS_SHIFT) |
565 (7 << ICC_CTLR_EL1_PRIBITS_SHIFT);
566
567 if (cs->ich_vmcr_el2 & ICH_VMCR_EL2_VEOIM) {
568 value |= ICC_CTLR_EL1_EOIMODE;
569 }
570
571 if (cs->ich_vmcr_el2 & ICH_VMCR_EL2_VCBPR) {
572 value |= ICC_CTLR_EL1_CBPR;
573 }
574
575 trace_gicv3_icv_ctlr_read(gicv3_redist_affid(cs), value);
576 return value;
577}
578
579static void icv_ctlr_write(CPUARMState *env, const ARMCPRegInfo *ri,
580 uint64_t value)
581{
582 GICv3CPUState *cs = icc_cs_from_env(env);
583
584 trace_gicv3_icv_ctlr_write(gicv3_redist_affid(cs), value);
585
586 cs->ich_vmcr_el2 = deposit64(cs->ich_vmcr_el2, ICH_VMCR_EL2_VCBPR_SHIFT,
587 1, value & ICC_CTLR_EL1_CBPR ? 1 : 0);
588 cs->ich_vmcr_el2 = deposit64(cs->ich_vmcr_el2, ICH_VMCR_EL2_VEOIM_SHIFT,
589 1, value & ICC_CTLR_EL1_EOIMODE ? 1 : 0);
590
591 gicv3_cpuif_virt_update(cs);
592}
593
594static uint64_t icv_rpr_read(CPUARMState *env, const ARMCPRegInfo *ri)
595{
596 GICv3CPUState *cs = icc_cs_from_env(env);
597 int prio = ich_highest_active_virt_prio(cs);
598
599 trace_gicv3_icv_rpr_read(gicv3_redist_affid(cs), prio);
600 return prio;
601}
602
603static uint64_t icv_hppir_read(CPUARMState *env, const ARMCPRegInfo *ri)
604{
605 GICv3CPUState *cs = icc_cs_from_env(env);
606 int grp = ri->crm == 8 ? GICV3_G0 : GICV3_G1NS;
607 int idx = hppvi_index(cs);
608 uint64_t value = INTID_SPURIOUS;
609
610 if (idx >= 0) {
611 uint64_t lr = cs->ich_lr_el2[idx];
612 int thisgrp = (lr & ICH_LR_EL2_GROUP) ? GICV3_G1NS : GICV3_G0;
613
614 if (grp == thisgrp) {
615 value = ich_lr_vintid(lr);
616 }
617 }
618
619 trace_gicv3_icv_hppir_read(grp, gicv3_redist_affid(cs), value);
620 return value;
621}
622
623static void icv_activate_irq(GICv3CPUState *cs, int idx, int grp)
624{
625 /* Activate the interrupt in the specified list register
626 * by moving it from Pending to Active state, and update the
627 * Active Priority Registers.
628 */
629 uint32_t mask = icv_gprio_mask(cs, grp);
630 int prio = ich_lr_prio(cs->ich_lr_el2[idx]) & mask;
631 int aprbit = prio >> (8 - cs->vprebits);
632 int regno = aprbit / 32;
633 int regbit = aprbit % 32;
634
635 cs->ich_lr_el2[idx] &= ~ICH_LR_EL2_STATE_PENDING_BIT;
636 cs->ich_lr_el2[idx] |= ICH_LR_EL2_STATE_ACTIVE_BIT;
637 cs->ich_apr[grp][regno] |= (1 << regbit);
638}
639
640static uint64_t icv_iar_read(CPUARMState *env, const ARMCPRegInfo *ri)
641{
642 GICv3CPUState *cs = icc_cs_from_env(env);
643 int grp = ri->crm == 8 ? GICV3_G0 : GICV3_G1NS;
644 int idx = hppvi_index(cs);
645 uint64_t intid = INTID_SPURIOUS;
646
647 if (idx >= 0) {
648 uint64_t lr = cs->ich_lr_el2[idx];
649 int thisgrp = (lr & ICH_LR_EL2_GROUP) ? GICV3_G1NS : GICV3_G0;
650
651 if (thisgrp == grp && icv_hppi_can_preempt(cs, lr)) {
652 intid = ich_lr_vintid(lr);
653 if (intid < INTID_SECURE) {
654 icv_activate_irq(cs, idx, grp);
655 } else {
656 /* Interrupt goes from Pending to Invalid */
657 cs->ich_lr_el2[idx] &= ~ICH_LR_EL2_STATE_PENDING_BIT;
658 /* We will now return the (bogus) ID from the list register,
659 * as per the pseudocode.
660 */
661 }
662 }
663 }
664
665 trace_gicv3_icv_iar_read(ri->crm == 8 ? 0 : 1,
666 gicv3_redist_affid(cs), intid);
667 return intid;
668}
669
670static int icc_highest_active_prio(GICv3CPUState *cs)
671{
672 /* Calculate the current running priority based on the set bits
673 * in the Active Priority Registers.
674 */
675 int i;
676
677 for (i = 0; i < ARRAY_SIZE(cs->icc_apr[0]); i++) {
678 uint32_t apr = cs->icc_apr[GICV3_G0][i] |
679 cs->icc_apr[GICV3_G1][i] | cs->icc_apr[GICV3_G1NS][i];
680
681 if (!apr) {
682 continue;
683 }
684 return (i * 32 + ctz32(apr)) << (GIC_MIN_BPR + 1);
685 }
686 /* No current active interrupts: return idle priority */
687 return 0xff;
688}
689
690static uint32_t icc_gprio_mask(GICv3CPUState *cs, int group)
691{
692 /* Return a mask word which clears the subpriority bits from
693 * a priority value for an interrupt in the specified group.
694 * This depends on the BPR value. For CBPR0 (S or NS):
695 * a BPR of 0 means the group priority bits are [7:1];
696 * a BPR of 1 means they are [7:2], and so on down to
697 * a BPR of 7 meaning no group priority bits at all.
698 * For CBPR1 NS:
699 * a BPR of 0 is impossible (the minimum value is 1)
700 * a BPR of 1 means the group priority bits are [7:1];
701 * a BPR of 2 means they are [7:2], and so on down to
702 * a BPR of 7 meaning the group priority is [7].
703 *
704 * Which BPR to use depends on the group of the interrupt and
705 * the current ICC_CTLR.CBPR settings.
706 *
707 * This corresponds to the GroupBits() pseudocode.
708 */
709 int bpr;
710
711 if ((group == GICV3_G1 && cs->icc_ctlr_el1[GICV3_S] & ICC_CTLR_EL1_CBPR) ||
712 (group == GICV3_G1NS &&
713 cs->icc_ctlr_el1[GICV3_NS] & ICC_CTLR_EL1_CBPR)) {
714 group = GICV3_G0;
715 }
716
717 bpr = cs->icc_bpr[group] & 7;
718
719 if (group == GICV3_G1NS) {
720 assert(bpr > 0);
721 bpr--;
722 }
723
724 return ~0U << (bpr + 1);
725}
726
727static bool icc_no_enabled_hppi(GICv3CPUState *cs)
728{
729 /* Return true if there is no pending interrupt, or the
730 * highest priority pending interrupt is in a group which has been
731 * disabled at the CPU interface by the ICC_IGRPEN* register enable bits.
732 */
733 return cs->hppi.prio == 0xff || (cs->icc_igrpen[cs->hppi.grp] == 0);
734}
735
736static bool icc_hppi_can_preempt(GICv3CPUState *cs)
737{
738 /* Return true if we have a pending interrupt of sufficient
739 * priority to preempt.
740 */
741 int rprio;
742 uint32_t mask;
743
744 if (icc_no_enabled_hppi(cs)) {
745 return false;
746 }
747
748 if (cs->hppi.prio >= cs->icc_pmr_el1) {
749 /* Priority mask masks this interrupt */
750 return false;
751 }
752
753 rprio = icc_highest_active_prio(cs);
754 if (rprio == 0xff) {
755 /* No currently running interrupt so we can preempt */
756 return true;
757 }
758
759 mask = icc_gprio_mask(cs, cs->hppi.grp);
760
761 /* We only preempt a running interrupt if the pending interrupt's
762 * group priority is sufficient (the subpriorities are not considered).
763 */
764 if ((cs->hppi.prio & mask) < (rprio & mask)) {
765 return true;
766 }
767
768 return false;
769}
770
771void gicv3_cpuif_update(GICv3CPUState *cs)
772{
773 /* Tell the CPU about its highest priority pending interrupt */
774 int irqlevel = 0;
775 int fiqlevel = 0;
776 ARMCPU *cpu = ARM_CPU(cs->cpu);
777 CPUARMState *env = &cpu->env;
778
779 g_assert(qemu_mutex_iothread_locked());
780
781 trace_gicv3_cpuif_update(gicv3_redist_affid(cs), cs->hppi.irq,
782 cs->hppi.grp, cs->hppi.prio);
783
784 if (cs->hppi.grp == GICV3_G1 && !arm_feature(env, ARM_FEATURE_EL3)) {
785 /* If a Security-enabled GIC sends a G1S interrupt to a
786 * Security-disabled CPU, we must treat it as if it were G0.
787 */
788 cs->hppi.grp = GICV3_G0;
789 }
790
791 if (icc_hppi_can_preempt(cs)) {
792 /* We have an interrupt: should we signal it as IRQ or FIQ?
793 * This is described in the GICv3 spec section 4.6.2.
794 */
795 bool isfiq;
796
797 switch (cs->hppi.grp) {
798 case GICV3_G0:
799 isfiq = true;
800 break;
801 case GICV3_G1:
802 isfiq = (!arm_is_secure(env) ||
803 (arm_current_el(env) == 3 && arm_el_is_aa64(env, 3)));
804 break;
805 case GICV3_G1NS:
806 isfiq = arm_is_secure(env);
807 break;
808 default:
809 g_assert_not_reached();
810 }
811
812 if (isfiq) {
813 fiqlevel = 1;
814 } else {
815 irqlevel = 1;
816 }
817 }
818
819 trace_gicv3_cpuif_set_irqs(gicv3_redist_affid(cs), fiqlevel, irqlevel);
820
821 qemu_set_irq(cs->parent_fiq, fiqlevel);
822 qemu_set_irq(cs->parent_irq, irqlevel);
823}
824
825static uint64_t icc_pmr_read(CPUARMState *env, const ARMCPRegInfo *ri)
826{
827 GICv3CPUState *cs = icc_cs_from_env(env);
828 uint32_t value = cs->icc_pmr_el1;
829
830 if (icv_access(env, HCR_FMO | HCR_IMO)) {
831 return icv_pmr_read(env, ri);
832 }
833
834 if (arm_feature(env, ARM_FEATURE_EL3) && !arm_is_secure(env) &&
835 (env->cp15.scr_el3 & SCR_FIQ)) {
836 /* NS access and Group 0 is inaccessible to NS: return the
837 * NS view of the current priority
838 */
839 if ((value & 0x80) == 0) {
840 /* Secure priorities not visible to NS */
841 value = 0;
842 } else if (value != 0xff) {
843 value = (value << 1) & 0xff;
844 }
845 }
846
847 trace_gicv3_icc_pmr_read(gicv3_redist_affid(cs), value);
848
849 return value;
850}
851
852static void icc_pmr_write(CPUARMState *env, const ARMCPRegInfo *ri,
853 uint64_t value)
854{
855 GICv3CPUState *cs = icc_cs_from_env(env);
856
857 if (icv_access(env, HCR_FMO | HCR_IMO)) {
858 return icv_pmr_write(env, ri, value);
859 }
860
861 trace_gicv3_icc_pmr_write(gicv3_redist_affid(cs), value);
862
863 value &= 0xff;
864
865 if (arm_feature(env, ARM_FEATURE_EL3) && !arm_is_secure(env) &&
866 (env->cp15.scr_el3 & SCR_FIQ)) {
867 /* NS access and Group 0 is inaccessible to NS: return the
868 * NS view of the current priority
869 */
870 if (!(cs->icc_pmr_el1 & 0x80)) {
871 /* Current PMR in the secure range, don't allow NS to change it */
872 return;
873 }
874 value = (value >> 1) | 0x80;
875 }
876 cs->icc_pmr_el1 = value;
877 gicv3_cpuif_update(cs);
878}
879
880static void icc_activate_irq(GICv3CPUState *cs, int irq)
881{
882 /* Move the interrupt from the Pending state to Active, and update
883 * the Active Priority Registers
884 */
885 uint32_t mask = icc_gprio_mask(cs, cs->hppi.grp);
886 int prio = cs->hppi.prio & mask;
887 int aprbit = prio >> 1;
888 int regno = aprbit / 32;
889 int regbit = aprbit % 32;
890
891 cs->icc_apr[cs->hppi.grp][regno] |= (1 << regbit);
892
893 if (irq < GIC_INTERNAL) {
894 cs->gicr_iactiver0 = deposit32(cs->gicr_iactiver0, irq, 1, 1);
895 cs->gicr_ipendr0 = deposit32(cs->gicr_ipendr0, irq, 1, 0);
896 gicv3_redist_update(cs);
897 } else {
898 gicv3_gicd_active_set(cs->gic, irq);
899 gicv3_gicd_pending_clear(cs->gic, irq);
900 gicv3_update(cs->gic, irq, 1);
901 }
902}
903
904static uint64_t icc_hppir0_value(GICv3CPUState *cs, CPUARMState *env)
905{
906 /* Return the highest priority pending interrupt register value
907 * for group 0.
908 */
909 bool irq_is_secure;
910
911 if (cs->hppi.prio == 0xff) {
912 return INTID_SPURIOUS;
913 }
914
915 /* Check whether we can return the interrupt or if we should return
916 * a special identifier, as per the CheckGroup0ForSpecialIdentifiers
917 * pseudocode. (We can simplify a little because for us ICC_SRE_EL1.RM
918 * is always zero.)
919 */
920 irq_is_secure = (!(cs->gic->gicd_ctlr & GICD_CTLR_DS) &&
921 (cs->hppi.grp != GICV3_G1NS));
922
923 if (cs->hppi.grp != GICV3_G0 && !arm_is_el3_or_mon(env)) {
924 return INTID_SPURIOUS;
925 }
926 if (irq_is_secure && !arm_is_secure(env)) {
927 /* Secure interrupts not visible to Nonsecure */
928 return INTID_SPURIOUS;
929 }
930
931 if (cs->hppi.grp != GICV3_G0) {
932 /* Indicate to EL3 that there's a Group 1 interrupt for the other
933 * state pending.
934 */
935 return irq_is_secure ? INTID_SECURE : INTID_NONSECURE;
936 }
937
938 return cs->hppi.irq;
939}
940
941static uint64_t icc_hppir1_value(GICv3CPUState *cs, CPUARMState *env)
942{
943 /* Return the highest priority pending interrupt register value
944 * for group 1.
945 */
946 bool irq_is_secure;
947
948 if (cs->hppi.prio == 0xff) {
949 return INTID_SPURIOUS;
950 }
951
952 /* Check whether we can return the interrupt or if we should return
953 * a special identifier, as per the CheckGroup1ForSpecialIdentifiers
954 * pseudocode. (We can simplify a little because for us ICC_SRE_EL1.RM
955 * is always zero.)
956 */
957 irq_is_secure = (!(cs->gic->gicd_ctlr & GICD_CTLR_DS) &&
958 (cs->hppi.grp != GICV3_G1NS));
959
960 if (cs->hppi.grp == GICV3_G0) {
961 /* Group 0 interrupts not visible via HPPIR1 */
962 return INTID_SPURIOUS;
963 }
964 if (irq_is_secure) {
965 if (!arm_is_secure(env)) {
966 /* Secure interrupts not visible in Non-secure */
967 return INTID_SPURIOUS;
968 }
969 } else if (!arm_is_el3_or_mon(env) && arm_is_secure(env)) {
970 /* Group 1 non-secure interrupts not visible in Secure EL1 */
971 return INTID_SPURIOUS;
972 }
973
974 return cs->hppi.irq;
975}
976
977static uint64_t icc_iar0_read(CPUARMState *env, const ARMCPRegInfo *ri)
978{
979 GICv3CPUState *cs = icc_cs_from_env(env);
980 uint64_t intid;
981
982 if (icv_access(env, HCR_FMO)) {
983 return icv_iar_read(env, ri);
984 }
985
986 if (!icc_hppi_can_preempt(cs)) {
987 intid = INTID_SPURIOUS;
988 } else {
989 intid = icc_hppir0_value(cs, env);
990 }
991
992 if (!(intid >= INTID_SECURE && intid <= INTID_SPURIOUS)) {
993 icc_activate_irq(cs, intid);
994 }
995
996 trace_gicv3_icc_iar0_read(gicv3_redist_affid(cs), intid);
997 return intid;
998}
999
1000static uint64_t icc_iar1_read(CPUARMState *env, const ARMCPRegInfo *ri)
1001{
1002 GICv3CPUState *cs = icc_cs_from_env(env);
1003 uint64_t intid;
1004
1005 if (icv_access(env, HCR_IMO)) {
1006 return icv_iar_read(env, ri);
1007 }
1008
1009 if (!icc_hppi_can_preempt(cs)) {
1010 intid = INTID_SPURIOUS;
1011 } else {
1012 intid = icc_hppir1_value(cs, env);
1013 }
1014
1015 if (!(intid >= INTID_SECURE && intid <= INTID_SPURIOUS)) {
1016 icc_activate_irq(cs, intid);
1017 }
1018
1019 trace_gicv3_icc_iar1_read(gicv3_redist_affid(cs), intid);
1020 return intid;
1021}
1022
1023static void icc_drop_prio(GICv3CPUState *cs, int grp)
1024{
1025 /* Drop the priority of the currently active interrupt in
1026 * the specified group.
1027 *
1028 * Note that we can guarantee (because of the requirement to nest
1029 * ICC_IAR reads [which activate an interrupt and raise priority]
1030 * with ICC_EOIR writes [which drop the priority for the interrupt])
1031 * that the interrupt we're being called for is the highest priority
1032 * active interrupt, meaning that it has the lowest set bit in the
1033 * APR registers.
1034 *
1035 * If the guest does not honour the ordering constraints then the
1036 * behaviour of the GIC is UNPREDICTABLE, which for us means that
1037 * the values of the APR registers might become incorrect and the
1038 * running priority will be wrong, so interrupts that should preempt
1039 * might not do so, and interrupts that should not preempt might do so.
1040 */
1041 int i;
1042
1043 for (i = 0; i < ARRAY_SIZE(cs->icc_apr[grp]); i++) {
1044 uint64_t *papr = &cs->icc_apr[grp][i];
1045
1046 if (!*papr) {
1047 continue;
1048 }
1049 /* Clear the lowest set bit */
1050 *papr &= *papr - 1;
1051 break;
1052 }
1053
1054 /* running priority change means we need an update for this cpu i/f */
1055 gicv3_cpuif_update(cs);
1056}
1057
1058static bool icc_eoi_split(CPUARMState *env, GICv3CPUState *cs)
1059{
1060 /* Return true if we should split priority drop and interrupt
1061 * deactivation, ie whether the relevant EOIMode bit is set.
1062 */
1063 if (arm_is_el3_or_mon(env)) {
1064 return cs->icc_ctlr_el3 & ICC_CTLR_EL3_EOIMODE_EL3;
1065 }
1066 if (arm_is_secure_below_el3(env)) {
1067 return cs->icc_ctlr_el1[GICV3_S] & ICC_CTLR_EL1_EOIMODE;
1068 } else {
1069 return cs->icc_ctlr_el1[GICV3_NS] & ICC_CTLR_EL1_EOIMODE;
1070 }
1071}
1072
1073static int icc_highest_active_group(GICv3CPUState *cs)
1074{
1075 /* Return the group with the highest priority active interrupt.
1076 * We can do this by just comparing the APRs to see which one
1077 * has the lowest set bit.
1078 * (If more than one group is active at the same priority then
1079 * we're in UNPREDICTABLE territory.)
1080 */
1081 int i;
1082
1083 for (i = 0; i < ARRAY_SIZE(cs->icc_apr[0]); i++) {
1084 int g0ctz = ctz32(cs->icc_apr[GICV3_G0][i]);
1085 int g1ctz = ctz32(cs->icc_apr[GICV3_G1][i]);
1086 int g1nsctz = ctz32(cs->icc_apr[GICV3_G1NS][i]);
1087
1088 if (g1nsctz < g0ctz && g1nsctz < g1ctz) {
1089 return GICV3_G1NS;
1090 }
1091 if (g1ctz < g0ctz) {
1092 return GICV3_G1;
1093 }
1094 if (g0ctz < 32) {
1095 return GICV3_G0;
1096 }
1097 }
1098 /* No set active bits? UNPREDICTABLE; return -1 so the caller
1099 * ignores the spurious EOI attempt.
1100 */
1101 return -1;
1102}
1103
1104static void icc_deactivate_irq(GICv3CPUState *cs, int irq)
1105{
1106 if (irq < GIC_INTERNAL) {
1107 cs->gicr_iactiver0 = deposit32(cs->gicr_iactiver0, irq, 1, 0);
1108 gicv3_redist_update(cs);
1109 } else {
1110 gicv3_gicd_active_clear(cs->gic, irq);
1111 gicv3_update(cs->gic, irq, 1);
1112 }
1113}
1114
1115static bool icv_eoi_split(CPUARMState *env, GICv3CPUState *cs)
1116{
1117 /* Return true if we should split priority drop and interrupt
1118 * deactivation, ie whether the virtual EOIMode bit is set.
1119 */
1120 return cs->ich_vmcr_el2 & ICH_VMCR_EL2_VEOIM;
1121}
1122
1123static int icv_find_active(GICv3CPUState *cs, int irq)
1124{
1125 /* Given an interrupt number for an active interrupt, return the index
1126 * of the corresponding list register, or -1 if there is no match.
1127 * Corresponds to FindActiveVirtualInterrupt pseudocode.
1128 */
1129 int i;
1130
1131 for (i = 0; i < cs->num_list_regs; i++) {
1132 uint64_t lr = cs->ich_lr_el2[i];
1133
1134 if ((lr & ICH_LR_EL2_STATE_ACTIVE_BIT) && ich_lr_vintid(lr) == irq) {
1135 return i;
1136 }
1137 }
1138
1139 return -1;
1140}
1141
1142static void icv_deactivate_irq(GICv3CPUState *cs, int idx)
1143{
1144 /* Deactivate the interrupt in the specified list register index */
1145 uint64_t lr = cs->ich_lr_el2[idx];
1146
1147 if (lr & ICH_LR_EL2_HW) {
1148 /* Deactivate the associated physical interrupt */
1149 int pirq = ich_lr_pintid(lr);
1150
1151 if (pirq < INTID_SECURE) {
1152 icc_deactivate_irq(cs, pirq);
1153 }
1154 }
1155
1156 /* Clear the 'active' part of the state, so ActivePending->Pending
1157 * and Active->Invalid.
1158 */
1159 lr &= ~ICH_LR_EL2_STATE_ACTIVE_BIT;
1160 cs->ich_lr_el2[idx] = lr;
1161}
1162
1163static void icv_increment_eoicount(GICv3CPUState *cs)
1164{
1165 /* Increment the EOICOUNT field in ICH_HCR_EL2 */
1166 int eoicount = extract64(cs->ich_hcr_el2, ICH_HCR_EL2_EOICOUNT_SHIFT,
1167 ICH_HCR_EL2_EOICOUNT_LENGTH);
1168
1169 cs->ich_hcr_el2 = deposit64(cs->ich_hcr_el2, ICH_HCR_EL2_EOICOUNT_SHIFT,
1170 ICH_HCR_EL2_EOICOUNT_LENGTH, eoicount + 1);
1171}
1172
1173static int icv_drop_prio(GICv3CPUState *cs)
1174{
1175 /* Drop the priority of the currently active virtual interrupt
1176 * (favouring group 0 if there is a set active bit at
1177 * the same priority for both group 0 and group 1).
1178 * Return the priority value for the bit we just cleared,
1179 * or 0xff if no bits were set in the AP registers at all.
1180 * Note that though the ich_apr[] are uint64_t only the low
1181 * 32 bits are actually relevant.
1182 */
1183 int i;
1184 int aprmax = 1 << (cs->vprebits - 5);
1185
1186 assert(aprmax <= ARRAY_SIZE(cs->ich_apr[0]));
1187
1188 for (i = 0; i < aprmax; i++) {
1189 uint64_t *papr0 = &cs->ich_apr[GICV3_G0][i];
1190 uint64_t *papr1 = &cs->ich_apr[GICV3_G1NS][i];
1191 int apr0count, apr1count;
1192
1193 if (!*papr0 && !*papr1) {
1194 continue;
1195 }
1196
1197 /* We can't just use the bit-twiddling hack icc_drop_prio() does
1198 * because we need to return the bit number we cleared so
1199 * it can be compared against the list register's priority field.
1200 */
1201 apr0count = ctz32(*papr0);
1202 apr1count = ctz32(*papr1);
1203
1204 if (apr0count <= apr1count) {
1205 *papr0 &= *papr0 - 1;
1206 return (apr0count + i * 32) << (icv_min_vbpr(cs) + 1);
1207 } else {
1208 *papr1 &= *papr1 - 1;
1209 return (apr1count + i * 32) << (icv_min_vbpr(cs) + 1);
1210 }
1211 }
1212 return 0xff;
1213}
1214
1215static void icv_dir_write(CPUARMState *env, const ARMCPRegInfo *ri,
1216 uint64_t value)
1217{
1218 /* Deactivate interrupt */
1219 GICv3CPUState *cs = icc_cs_from_env(env);
1220 int idx;
1221 int irq = value & 0xffffff;
1222
1223 trace_gicv3_icv_dir_write(gicv3_redist_affid(cs), value);
1224
1225 if (irq >= cs->gic->num_irq) {
1226 /* Also catches special interrupt numbers and LPIs */
1227 return;
1228 }
1229
1230 if (!icv_eoi_split(env, cs)) {
1231 return;
1232 }
1233
1234 idx = icv_find_active(cs, irq);
1235
1236 if (idx < 0) {
1237 /* No list register matching this, so increment the EOI count
1238 * (might trigger a maintenance interrupt)
1239 */
1240 icv_increment_eoicount(cs);
1241 } else {
1242 icv_deactivate_irq(cs, idx);
1243 }
1244
1245 gicv3_cpuif_virt_update(cs);
1246}
1247
1248static void icv_eoir_write(CPUARMState *env, const ARMCPRegInfo *ri,
1249 uint64_t value)
1250{
1251 /* End of Interrupt */
1252 GICv3CPUState *cs = icc_cs_from_env(env);
1253 int irq = value & 0xffffff;
1254 int grp = ri->crm == 8 ? GICV3_G0 : GICV3_G1NS;
1255 int idx, dropprio;
1256
1257 trace_gicv3_icv_eoir_write(ri->crm == 8 ? 0 : 1,
1258 gicv3_redist_affid(cs), value);
1259
1260 if (irq >= cs->gic->num_irq) {
1261 /* Also catches special interrupt numbers and LPIs */
1262 return;
1263 }
1264
1265 /* We implement the IMPDEF choice of "drop priority before doing
1266 * error checks" (because that lets us avoid scanning the AP
1267 * registers twice).
1268 */
1269 dropprio = icv_drop_prio(cs);
1270 if (dropprio == 0xff) {
1271 /* No active interrupt. It is CONSTRAINED UNPREDICTABLE
1272 * whether the list registers are checked in this
1273 * situation; we choose not to.
1274 */
1275 return;
1276 }
1277
1278 idx = icv_find_active(cs, irq);
1279
1280 if (idx < 0) {
1281 /* No valid list register corresponding to EOI ID */
1282 icv_increment_eoicount(cs);
1283 } else {
1284 uint64_t lr = cs->ich_lr_el2[idx];
1285 int thisgrp = (lr & ICH_LR_EL2_GROUP) ? GICV3_G1NS : GICV3_G0;
1286 int lr_gprio = ich_lr_prio(lr) & icv_gprio_mask(cs, grp);
1287
1288 if (thisgrp == grp && lr_gprio == dropprio) {
1289 if (!icv_eoi_split(env, cs)) {
1290 /* Priority drop and deactivate not split: deactivate irq now */
1291 icv_deactivate_irq(cs, idx);
1292 }
1293 }
1294 }
1295
1296 gicv3_cpuif_virt_update(cs);
1297}
1298
1299static void icc_eoir_write(CPUARMState *env, const ARMCPRegInfo *ri,
1300 uint64_t value)
1301{
1302 /* End of Interrupt */
1303 GICv3CPUState *cs = icc_cs_from_env(env);
1304 int irq = value & 0xffffff;
1305 int grp;
1306
1307 if (icv_access(env, ri->crm == 8 ? HCR_FMO : HCR_IMO)) {
1308 icv_eoir_write(env, ri, value);
1309 return;
1310 }
1311
1312 trace_gicv3_icc_eoir_write(ri->crm == 8 ? 0 : 1,
1313 gicv3_redist_affid(cs), value);
1314
1315 if (ri->crm == 8) {
1316 /* EOIR0 */
1317 grp = GICV3_G0;
1318 } else {
1319 /* EOIR1 */
1320 if (arm_is_secure(env)) {
1321 grp = GICV3_G1;
1322 } else {
1323 grp = GICV3_G1NS;
1324 }
1325 }
1326
1327 if (irq >= cs->gic->num_irq) {
1328 /* This handles two cases:
1329 * 1. If software writes the ID of a spurious interrupt [ie 1020-1023]
1330 * to the GICC_EOIR, the GIC ignores that write.
1331 * 2. If software writes the number of a non-existent interrupt
1332 * this must be a subcase of "value written does not match the last
1333 * valid interrupt value read from the Interrupt Acknowledge
1334 * register" and so this is UNPREDICTABLE. We choose to ignore it.
1335 */
1336 return;
1337 }
1338
1339 if (icc_highest_active_group(cs) != grp) {
1340 return;
1341 }
1342
1343 icc_drop_prio(cs, grp);
1344
1345 if (!icc_eoi_split(env, cs)) {
1346 /* Priority drop and deactivate not split: deactivate irq now */
1347 icc_deactivate_irq(cs, irq);
1348 }
1349}
1350
1351static uint64_t icc_hppir0_read(CPUARMState *env, const ARMCPRegInfo *ri)
1352{
1353 GICv3CPUState *cs = icc_cs_from_env(env);
1354 uint64_t value;
1355
1356 if (icv_access(env, HCR_FMO)) {
1357 return icv_hppir_read(env, ri);
1358 }
1359
1360 value = icc_hppir0_value(cs, env);
1361 trace_gicv3_icc_hppir0_read(gicv3_redist_affid(cs), value);
1362 return value;
1363}
1364
1365static uint64_t icc_hppir1_read(CPUARMState *env, const ARMCPRegInfo *ri)
1366{
1367 GICv3CPUState *cs = icc_cs_from_env(env);
1368 uint64_t value;
1369
1370 if (icv_access(env, HCR_IMO)) {
1371 return icv_hppir_read(env, ri);
1372 }
1373
1374 value = icc_hppir1_value(cs, env);
1375 trace_gicv3_icc_hppir1_read(gicv3_redist_affid(cs), value);
1376 return value;
1377}
1378
1379static uint64_t icc_bpr_read(CPUARMState *env, const ARMCPRegInfo *ri)
1380{
1381 GICv3CPUState *cs = icc_cs_from_env(env);
1382 int grp = (ri->crm == 8) ? GICV3_G0 : GICV3_G1;
1383 bool satinc = false;
1384 uint64_t bpr;
1385
1386 if (icv_access(env, grp == GICV3_G0 ? HCR_FMO : HCR_IMO)) {
1387 return icv_bpr_read(env, ri);
1388 }
1389
1390 if (grp == GICV3_G1 && gicv3_use_ns_bank(env)) {
1391 grp = GICV3_G1NS;
1392 }
1393
1394 if (grp == GICV3_G1 && !arm_is_el3_or_mon(env) &&
1395 (cs->icc_ctlr_el1[GICV3_S] & ICC_CTLR_EL1_CBPR)) {
1396 /* CBPR_EL1S means secure EL1 or AArch32 EL3 !Mon BPR1 accesses
1397 * modify BPR0
1398 */
1399 grp = GICV3_G0;
1400 }
1401
1402 if (grp == GICV3_G1NS && arm_current_el(env) < 3 &&
1403 (cs->icc_ctlr_el1[GICV3_NS] & ICC_CTLR_EL1_CBPR)) {
1404 /* reads return bpr0 + 1 sat to 7, writes ignored */
1405 grp = GICV3_G0;
1406 satinc = true;
1407 }
1408
1409 bpr = cs->icc_bpr[grp];
1410 if (satinc) {
1411 bpr++;
1412 bpr = MIN(bpr, 7);
1413 }
1414
1415 trace_gicv3_icc_bpr_read(ri->crm == 8 ? 0 : 1, gicv3_redist_affid(cs), bpr);
1416
1417 return bpr;
1418}
1419
1420static void icc_bpr_write(CPUARMState *env, const ARMCPRegInfo *ri,
1421 uint64_t value)
1422{
1423 GICv3CPUState *cs = icc_cs_from_env(env);
1424 int grp = (ri->crm == 8) ? GICV3_G0 : GICV3_G1;
1425 uint64_t minval;
1426
1427 if (icv_access(env, grp == GICV3_G0 ? HCR_FMO : HCR_IMO)) {
1428 icv_bpr_write(env, ri, value);
1429 return;
1430 }
1431
1432 trace_gicv3_icc_bpr_write(ri->crm == 8 ? 0 : 1,
1433 gicv3_redist_affid(cs), value);
1434
1435 if (grp == GICV3_G1 && gicv3_use_ns_bank(env)) {
1436 grp = GICV3_G1NS;
1437 }
1438
1439 if (grp == GICV3_G1 && !arm_is_el3_or_mon(env) &&
1440 (cs->icc_ctlr_el1[GICV3_S] & ICC_CTLR_EL1_CBPR)) {
1441 /* CBPR_EL1S means secure EL1 or AArch32 EL3 !Mon BPR1 accesses
1442 * modify BPR0
1443 */
1444 grp = GICV3_G0;
1445 }
1446
1447 if (grp == GICV3_G1NS && arm_current_el(env) < 3 &&
1448 (cs->icc_ctlr_el1[GICV3_NS] & ICC_CTLR_EL1_CBPR)) {
1449 /* reads return bpr0 + 1 sat to 7, writes ignored */
1450 return;
1451 }
1452
1453 minval = (grp == GICV3_G1NS) ? GIC_MIN_BPR_NS : GIC_MIN_BPR;
1454 if (value < minval) {
1455 value = minval;
1456 }
1457
1458 cs->icc_bpr[grp] = value & 7;
1459 gicv3_cpuif_update(cs);
1460}
1461
1462static uint64_t icc_ap_read(CPUARMState *env, const ARMCPRegInfo *ri)
1463{
1464 GICv3CPUState *cs = icc_cs_from_env(env);
1465 uint64_t value;
1466
1467 int regno = ri->opc2 & 3;
1468 int grp = (ri->crm & 1) ? GICV3_G1 : GICV3_G0;
1469
1470 if (icv_access(env, grp == GICV3_G0 ? HCR_FMO : HCR_IMO)) {
1471 return icv_ap_read(env, ri);
1472 }
1473
1474 if (grp == GICV3_G1 && gicv3_use_ns_bank(env)) {
1475 grp = GICV3_G1NS;
1476 }
1477
1478 value = cs->icc_apr[grp][regno];
1479
1480 trace_gicv3_icc_ap_read(ri->crm & 1, regno, gicv3_redist_affid(cs), value);
1481 return value;
1482}
1483
1484static void icc_ap_write(CPUARMState *env, const ARMCPRegInfo *ri,
1485 uint64_t value)
1486{
1487 GICv3CPUState *cs = icc_cs_from_env(env);
1488
1489 int regno = ri->opc2 & 3;
1490 int grp = (ri->crm & 1) ? GICV3_G1 : GICV3_G0;
1491
1492 if (icv_access(env, grp == GICV3_G0 ? HCR_FMO : HCR_IMO)) {
1493 icv_ap_write(env, ri, value);
1494 return;
1495 }
1496
1497 trace_gicv3_icc_ap_write(ri->crm & 1, regno, gicv3_redist_affid(cs), value);
1498
1499 if (grp == GICV3_G1 && gicv3_use_ns_bank(env)) {
1500 grp = GICV3_G1NS;
1501 }
1502
1503 /* It's not possible to claim that a Non-secure interrupt is active
1504 * at a priority outside the Non-secure range (128..255), since this
1505 * would otherwise allow malicious NS code to block delivery of S interrupts
1506 * by writing a bad value to these registers.
1507 */
1508 if (grp == GICV3_G1NS && regno < 2 && arm_feature(env, ARM_FEATURE_EL3)) {
1509 return;
1510 }
1511
1512 cs->icc_apr[grp][regno] = value & 0xFFFFFFFFU;
1513 gicv3_cpuif_update(cs);
1514}
1515
1516static void icc_dir_write(CPUARMState *env, const ARMCPRegInfo *ri,
1517 uint64_t value)
1518{
1519 /* Deactivate interrupt */
1520 GICv3CPUState *cs = icc_cs_from_env(env);
1521 int irq = value & 0xffffff;
1522 bool irq_is_secure, single_sec_state, irq_is_grp0;
1523 bool route_fiq_to_el3, route_irq_to_el3, route_fiq_to_el2, route_irq_to_el2;
1524
1525 if (icv_access(env, HCR_FMO | HCR_IMO)) {
1526 icv_dir_write(env, ri, value);
1527 return;
1528 }
1529
1530 trace_gicv3_icc_dir_write(gicv3_redist_affid(cs), value);
1531
1532 if (irq >= cs->gic->num_irq) {
1533 /* Also catches special interrupt numbers and LPIs */
1534 return;
1535 }
1536
1537 if (!icc_eoi_split(env, cs)) {
1538 return;
1539 }
1540
1541 int grp = gicv3_irq_group(cs->gic, cs, irq);
1542
1543 single_sec_state = cs->gic->gicd_ctlr & GICD_CTLR_DS;
1544 irq_is_secure = !single_sec_state && (grp != GICV3_G1NS);
1545 irq_is_grp0 = grp == GICV3_G0;
1546
1547 /* Check whether we're allowed to deactivate this interrupt based
1548 * on its group and the current CPU state.
1549 * These checks are laid out to correspond to the spec's pseudocode.
1550 */
1551 route_fiq_to_el3 = env->cp15.scr_el3 & SCR_FIQ;
1552 route_irq_to_el3 = env->cp15.scr_el3 & SCR_IRQ;
1553 /* No need to include !IsSecure in route_*_to_el2 as it's only
1554 * tested in cases where we know !IsSecure is true.
1555 */
1556 uint64_t hcr_el2 = arm_hcr_el2_eff(env);
1557 route_fiq_to_el2 = hcr_el2 & HCR_FMO;
1558 route_irq_to_el2 = hcr_el2 & HCR_IMO;
1559
1560 switch (arm_current_el(env)) {
1561 case 3:
1562 break;
1563 case 2:
1564 if (single_sec_state && irq_is_grp0 && !route_fiq_to_el3) {
1565 break;
1566 }
1567 if (!irq_is_secure && !irq_is_grp0 && !route_irq_to_el3) {
1568 break;
1569 }
1570 return;
1571 case 1:
1572 if (!arm_is_secure_below_el3(env)) {
1573 if (single_sec_state && irq_is_grp0 &&
1574 !route_fiq_to_el3 && !route_fiq_to_el2) {
1575 break;
1576 }
1577 if (!irq_is_secure && !irq_is_grp0 &&
1578 !route_irq_to_el3 && !route_irq_to_el2) {
1579 break;
1580 }
1581 } else {
1582 if (irq_is_grp0 && !route_fiq_to_el3) {
1583 break;
1584 }
1585 if (!irq_is_grp0 &&
1586 (!irq_is_secure || !single_sec_state) &&
1587 !route_irq_to_el3) {
1588 break;
1589 }
1590 }
1591 return;
1592 default:
1593 g_assert_not_reached();
1594 }
1595
1596 icc_deactivate_irq(cs, irq);
1597}
1598
1599static uint64_t icc_rpr_read(CPUARMState *env, const ARMCPRegInfo *ri)
1600{
1601 GICv3CPUState *cs = icc_cs_from_env(env);
1602 int prio;
1603
1604 if (icv_access(env, HCR_FMO | HCR_IMO)) {
1605 return icv_rpr_read(env, ri);
1606 }
1607
1608 prio = icc_highest_active_prio(cs);
1609
1610 if (arm_feature(env, ARM_FEATURE_EL3) &&
1611 !arm_is_secure(env) && (env->cp15.scr_el3 & SCR_FIQ)) {
1612 /* NS GIC access and Group 0 is inaccessible to NS */
1613 if ((prio & 0x80) == 0) {
1614 /* NS mustn't see priorities in the Secure half of the range */
1615 prio = 0;
1616 } else if (prio != 0xff) {
1617 /* Non-idle priority: show the Non-secure view of it */
1618 prio = (prio << 1) & 0xff;
1619 }
1620 }
1621
1622 trace_gicv3_icc_rpr_read(gicv3_redist_affid(cs), prio);
1623 return prio;
1624}
1625
1626static void icc_generate_sgi(CPUARMState *env, GICv3CPUState *cs,
1627 uint64_t value, int grp, bool ns)
1628{
1629 GICv3State *s = cs->gic;
1630
1631 /* Extract Aff3/Aff2/Aff1 and shift into the bottom 24 bits */
1632 uint64_t aff = extract64(value, 48, 8) << 16 |
1633 extract64(value, 32, 8) << 8 |
1634 extract64(value, 16, 8);
1635 uint32_t targetlist = extract64(value, 0, 16);
1636 uint32_t irq = extract64(value, 24, 4);
1637 bool irm = extract64(value, 40, 1);
1638 int i;
1639
1640 if (grp == GICV3_G1 && s->gicd_ctlr & GICD_CTLR_DS) {
1641 /* If GICD_CTLR.DS == 1, the Distributor treats Secure Group 1
1642 * interrupts as Group 0 interrupts and must send Secure Group 0
1643 * interrupts to the target CPUs.
1644 */
1645 grp = GICV3_G0;
1646 }
1647
1648 trace_gicv3_icc_generate_sgi(gicv3_redist_affid(cs), irq, irm,
1649 aff, targetlist);
1650
1651 for (i = 0; i < s->num_cpu; i++) {
1652 GICv3CPUState *ocs = &s->cpu[i];
1653
1654 if (irm) {
1655 /* IRM == 1 : route to all CPUs except self */
1656 if (cs == ocs) {
1657 continue;
1658 }
1659 } else {
1660 /* IRM == 0 : route to Aff3.Aff2.Aff1.n for all n in [0..15]
1661 * where the corresponding bit is set in targetlist
1662 */
1663 int aff0;
1664
1665 if (ocs->gicr_typer >> 40 != aff) {
1666 continue;
1667 }
1668 aff0 = extract64(ocs->gicr_typer, 32, 8);
1669 if (aff0 > 15 || extract32(targetlist, aff0, 1) == 0) {
1670 continue;
1671 }
1672 }
1673
1674 /* The redistributor will check against its own GICR_NSACR as needed */
1675 gicv3_redist_send_sgi(ocs, grp, irq, ns);
1676 }
1677}
1678
1679static void icc_sgi0r_write(CPUARMState *env, const ARMCPRegInfo *ri,
1680 uint64_t value)
1681{
1682 /* Generate Secure Group 0 SGI. */
1683 GICv3CPUState *cs = icc_cs_from_env(env);
1684 bool ns = !arm_is_secure(env);
1685
1686 icc_generate_sgi(env, cs, value, GICV3_G0, ns);
1687}
1688
1689static void icc_sgi1r_write(CPUARMState *env, const ARMCPRegInfo *ri,
1690 uint64_t value)
1691{
1692 /* Generate Group 1 SGI for the current Security state */
1693 GICv3CPUState *cs = icc_cs_from_env(env);
1694 int grp;
1695 bool ns = !arm_is_secure(env);
1696
1697 grp = ns ? GICV3_G1NS : GICV3_G1;
1698 icc_generate_sgi(env, cs, value, grp, ns);
1699}
1700
1701static void icc_asgi1r_write(CPUARMState *env, const ARMCPRegInfo *ri,
1702 uint64_t value)
1703{
1704 /* Generate Group 1 SGI for the Security state that is not
1705 * the current state
1706 */
1707 GICv3CPUState *cs = icc_cs_from_env(env);
1708 int grp;
1709 bool ns = !arm_is_secure(env);
1710
1711 grp = ns ? GICV3_G1 : GICV3_G1NS;
1712 icc_generate_sgi(env, cs, value, grp, ns);
1713}
1714
1715static uint64_t icc_igrpen_read(CPUARMState *env, const ARMCPRegInfo *ri)
1716{
1717 GICv3CPUState *cs = icc_cs_from_env(env);
1718 int grp = ri->opc2 & 1 ? GICV3_G1 : GICV3_G0;
1719 uint64_t value;
1720
1721 if (icv_access(env, grp == GICV3_G0 ? HCR_FMO : HCR_IMO)) {
1722 return icv_igrpen_read(env, ri);
1723 }
1724
1725 if (grp == GICV3_G1 && gicv3_use_ns_bank(env)) {
1726 grp = GICV3_G1NS;
1727 }
1728
1729 value = cs->icc_igrpen[grp];
1730 trace_gicv3_icc_igrpen_read(ri->opc2 & 1 ? 1 : 0,
1731 gicv3_redist_affid(cs), value);
1732 return value;
1733}
1734
1735static void icc_igrpen_write(CPUARMState *env, const ARMCPRegInfo *ri,
1736 uint64_t value)
1737{
1738 GICv3CPUState *cs = icc_cs_from_env(env);
1739 int grp = ri->opc2 & 1 ? GICV3_G1 : GICV3_G0;
1740
1741 if (icv_access(env, grp == GICV3_G0 ? HCR_FMO : HCR_IMO)) {
1742 icv_igrpen_write(env, ri, value);
1743 return;
1744 }
1745
1746 trace_gicv3_icc_igrpen_write(ri->opc2 & 1 ? 1 : 0,
1747 gicv3_redist_affid(cs), value);
1748
1749 if (grp == GICV3_G1 && gicv3_use_ns_bank(env)) {
1750 grp = GICV3_G1NS;
1751 }
1752
1753 cs->icc_igrpen[grp] = value & ICC_IGRPEN_ENABLE;
1754 gicv3_cpuif_update(cs);
1755}
1756
1757static uint64_t icc_igrpen1_el3_read(CPUARMState *env, const ARMCPRegInfo *ri)
1758{
1759 GICv3CPUState *cs = icc_cs_from_env(env);
1760 uint64_t value;
1761
1762 /* IGRPEN1_EL3 bits 0 and 1 are r/w aliases into IGRPEN1_EL1 NS and S */
1763 value = cs->icc_igrpen[GICV3_G1NS] | (cs->icc_igrpen[GICV3_G1] << 1);
1764 trace_gicv3_icc_igrpen1_el3_read(gicv3_redist_affid(cs), value);
1765 return value;
1766}
1767
1768static void icc_igrpen1_el3_write(CPUARMState *env, const ARMCPRegInfo *ri,
1769 uint64_t value)
1770{
1771 GICv3CPUState *cs = icc_cs_from_env(env);
1772
1773 trace_gicv3_icc_igrpen1_el3_write(gicv3_redist_affid(cs), value);
1774
1775 /* IGRPEN1_EL3 bits 0 and 1 are r/w aliases into IGRPEN1_EL1 NS and S */
1776 cs->icc_igrpen[GICV3_G1NS] = extract32(value, 0, 1);
1777 cs->icc_igrpen[GICV3_G1] = extract32(value, 1, 1);
1778 gicv3_cpuif_update(cs);
1779}
1780
1781static uint64_t icc_ctlr_el1_read(CPUARMState *env, const ARMCPRegInfo *ri)
1782{
1783 GICv3CPUState *cs = icc_cs_from_env(env);
1784 int bank = gicv3_use_ns_bank(env) ? GICV3_NS : GICV3_S;
1785 uint64_t value;
1786
1787 if (icv_access(env, HCR_FMO | HCR_IMO)) {
1788 return icv_ctlr_read(env, ri);
1789 }
1790
1791 value = cs->icc_ctlr_el1[bank];
1792 trace_gicv3_icc_ctlr_read(gicv3_redist_affid(cs), value);
1793 return value;
1794}
1795
1796static void icc_ctlr_el1_write(CPUARMState *env, const ARMCPRegInfo *ri,
1797 uint64_t value)
1798{
1799 GICv3CPUState *cs = icc_cs_from_env(env);
1800 int bank = gicv3_use_ns_bank(env) ? GICV3_NS : GICV3_S;
1801 uint64_t mask;
1802
1803 if (icv_access(env, HCR_FMO | HCR_IMO)) {
1804 icv_ctlr_write(env, ri, value);
1805 return;
1806 }
1807
1808 trace_gicv3_icc_ctlr_write(gicv3_redist_affid(cs), value);
1809
1810 /* Only CBPR and EOIMODE can be RW;
1811 * for us PMHE is RAZ/WI (we don't implement 1-of-N interrupts or
1812 * the asseciated priority-based routing of them);
1813 * if EL3 is implemented and GICD_CTLR.DS == 0, then PMHE and CBPR are RO.
1814 */
1815 if (arm_feature(env, ARM_FEATURE_EL3) &&
1816 ((cs->gic->gicd_ctlr & GICD_CTLR_DS) == 0)) {
1817 mask = ICC_CTLR_EL1_EOIMODE;
1818 } else {
1819 mask = ICC_CTLR_EL1_CBPR | ICC_CTLR_EL1_EOIMODE;
1820 }
1821
1822 cs->icc_ctlr_el1[bank] &= ~mask;
1823 cs->icc_ctlr_el1[bank] |= (value & mask);
1824 gicv3_cpuif_update(cs);
1825}
1826
1827
1828static uint64_t icc_ctlr_el3_read(CPUARMState *env, const ARMCPRegInfo *ri)
1829{
1830 GICv3CPUState *cs = icc_cs_from_env(env);
1831 uint64_t value;
1832
1833 value = cs->icc_ctlr_el3;
1834 if (cs->icc_ctlr_el1[GICV3_NS] & ICC_CTLR_EL1_EOIMODE) {
1835 value |= ICC_CTLR_EL3_EOIMODE_EL1NS;
1836 }
1837 if (cs->icc_ctlr_el1[GICV3_NS] & ICC_CTLR_EL1_CBPR) {
1838 value |= ICC_CTLR_EL3_CBPR_EL1NS;
1839 }
1840 if (cs->icc_ctlr_el1[GICV3_NS] & ICC_CTLR_EL1_EOIMODE) {
1841 value |= ICC_CTLR_EL3_EOIMODE_EL1S;
1842 }
1843 if (cs->icc_ctlr_el1[GICV3_NS] & ICC_CTLR_EL1_CBPR) {
1844 value |= ICC_CTLR_EL3_CBPR_EL1S;
1845 }
1846
1847 trace_gicv3_icc_ctlr_el3_read(gicv3_redist_affid(cs), value);
1848 return value;
1849}
1850
1851static void icc_ctlr_el3_write(CPUARMState *env, const ARMCPRegInfo *ri,
1852 uint64_t value)
1853{
1854 GICv3CPUState *cs = icc_cs_from_env(env);
1855 uint64_t mask;
1856
1857 trace_gicv3_icc_ctlr_el3_write(gicv3_redist_affid(cs), value);
1858
1859 /* *_EL1NS and *_EL1S bits are aliases into the ICC_CTLR_EL1 bits. */
1860 cs->icc_ctlr_el1[GICV3_NS] &= ~(ICC_CTLR_EL1_CBPR | ICC_CTLR_EL1_EOIMODE);
1861 if (value & ICC_CTLR_EL3_EOIMODE_EL1NS) {
1862 cs->icc_ctlr_el1[GICV3_NS] |= ICC_CTLR_EL1_EOIMODE;
1863 }
1864 if (value & ICC_CTLR_EL3_CBPR_EL1NS) {
1865 cs->icc_ctlr_el1[GICV3_NS] |= ICC_CTLR_EL1_CBPR;
1866 }
1867
1868 cs->icc_ctlr_el1[GICV3_S] &= ~(ICC_CTLR_EL1_CBPR | ICC_CTLR_EL1_EOIMODE);
1869 if (value & ICC_CTLR_EL3_EOIMODE_EL1S) {
1870 cs->icc_ctlr_el1[GICV3_S] |= ICC_CTLR_EL1_EOIMODE;
1871 }
1872 if (value & ICC_CTLR_EL3_CBPR_EL1S) {
1873 cs->icc_ctlr_el1[GICV3_S] |= ICC_CTLR_EL1_CBPR;
1874 }
1875
1876 /* The only bit stored in icc_ctlr_el3 which is writeable is EOIMODE_EL3: */
1877 mask = ICC_CTLR_EL3_EOIMODE_EL3;
1878
1879 cs->icc_ctlr_el3 &= ~mask;
1880 cs->icc_ctlr_el3 |= (value & mask);
1881 gicv3_cpuif_update(cs);
1882}
1883
1884static CPAccessResult gicv3_irqfiq_access(CPUARMState *env,
1885 const ARMCPRegInfo *ri, bool isread)
1886{
1887 CPAccessResult r = CP_ACCESS_OK;
1888 GICv3CPUState *cs = icc_cs_from_env(env);
1889 int el = arm_current_el(env);
1890
1891 if ((cs->ich_hcr_el2 & ICH_HCR_EL2_TC) &&
1892 el == 1 && !arm_is_secure_below_el3(env)) {
1893 /* Takes priority over a possible EL3 trap */
1894 return CP_ACCESS_TRAP_EL2;
1895 }
1896
1897 if ((env->cp15.scr_el3 & (SCR_FIQ | SCR_IRQ)) == (SCR_FIQ | SCR_IRQ)) {
1898 switch (el) {
1899 case 1:
1900 /* Note that arm_hcr_el2_eff takes secure state into account. */
1901 if ((arm_hcr_el2_eff(env) & (HCR_IMO | HCR_FMO)) == 0) {
1902 r = CP_ACCESS_TRAP_EL3;
1903 }
1904 break;
1905 case 2:
1906 r = CP_ACCESS_TRAP_EL3;
1907 break;
1908 case 3:
1909 if (!is_a64(env) && !arm_is_el3_or_mon(env)) {
1910 r = CP_ACCESS_TRAP_EL3;
1911 }
1912 break;
1913 default:
1914 g_assert_not_reached();
1915 }
1916 }
1917
1918 if (r == CP_ACCESS_TRAP_EL3 && !arm_el_is_aa64(env, 3)) {
1919 r = CP_ACCESS_TRAP;
1920 }
1921 return r;
1922}
1923
1924static CPAccessResult gicv3_dir_access(CPUARMState *env,
1925 const ARMCPRegInfo *ri, bool isread)
1926{
1927 GICv3CPUState *cs = icc_cs_from_env(env);
1928
1929 if ((cs->ich_hcr_el2 & ICH_HCR_EL2_TDIR) &&
1930 arm_current_el(env) == 1 && !arm_is_secure_below_el3(env)) {
1931 /* Takes priority over a possible EL3 trap */
1932 return CP_ACCESS_TRAP_EL2;
1933 }
1934
1935 return gicv3_irqfiq_access(env, ri, isread);
1936}
1937
1938static CPAccessResult gicv3_sgi_access(CPUARMState *env,
1939 const ARMCPRegInfo *ri, bool isread)
1940{
1941 if (arm_current_el(env) == 1 &&
1942 (arm_hcr_el2_eff(env) & (HCR_IMO | HCR_FMO)) != 0) {
1943 /* Takes priority over a possible EL3 trap */
1944 return CP_ACCESS_TRAP_EL2;
1945 }
1946
1947 return gicv3_irqfiq_access(env, ri, isread);
1948}
1949
1950static CPAccessResult gicv3_fiq_access(CPUARMState *env,
1951 const ARMCPRegInfo *ri, bool isread)
1952{
1953 CPAccessResult r = CP_ACCESS_OK;
1954 GICv3CPUState *cs = icc_cs_from_env(env);
1955 int el = arm_current_el(env);
1956
1957 if ((cs->ich_hcr_el2 & ICH_HCR_EL2_TALL0) &&
1958 el == 1 && !arm_is_secure_below_el3(env)) {
1959 /* Takes priority over a possible EL3 trap */
1960 return CP_ACCESS_TRAP_EL2;
1961 }
1962
1963 if (env->cp15.scr_el3 & SCR_FIQ) {
1964 switch (el) {
1965 case 1:
1966 if ((arm_hcr_el2_eff(env) & HCR_FMO) == 0) {
1967 r = CP_ACCESS_TRAP_EL3;
1968 }
1969 break;
1970 case 2:
1971 r = CP_ACCESS_TRAP_EL3;
1972 break;
1973 case 3:
1974 if (!is_a64(env) && !arm_is_el3_or_mon(env)) {
1975 r = CP_ACCESS_TRAP_EL3;
1976 }
1977 break;
1978 default:
1979 g_assert_not_reached();
1980 }
1981 }
1982
1983 if (r == CP_ACCESS_TRAP_EL3 && !arm_el_is_aa64(env, 3)) {
1984 r = CP_ACCESS_TRAP;
1985 }
1986 return r;
1987}
1988
1989static CPAccessResult gicv3_irq_access(CPUARMState *env,
1990 const ARMCPRegInfo *ri, bool isread)
1991{
1992 CPAccessResult r = CP_ACCESS_OK;
1993 GICv3CPUState *cs = icc_cs_from_env(env);
1994 int el = arm_current_el(env);
1995
1996 if ((cs->ich_hcr_el2 & ICH_HCR_EL2_TALL1) &&
1997 el == 1 && !arm_is_secure_below_el3(env)) {
1998 /* Takes priority over a possible EL3 trap */
1999 return CP_ACCESS_TRAP_EL2;
2000 }
2001
2002 if (env->cp15.scr_el3 & SCR_IRQ) {
2003 switch (el) {
2004 case 1:
2005 if ((arm_hcr_el2_eff(env) & HCR_IMO) == 0) {
2006 r = CP_ACCESS_TRAP_EL3;
2007 }
2008 break;
2009 case 2:
2010 r = CP_ACCESS_TRAP_EL3;
2011 break;
2012 case 3:
2013 if (!is_a64(env) && !arm_is_el3_or_mon(env)) {
2014 r = CP_ACCESS_TRAP_EL3;
2015 }
2016 break;
2017 default:
2018 g_assert_not_reached();
2019 }
2020 }
2021
2022 if (r == CP_ACCESS_TRAP_EL3 && !arm_el_is_aa64(env, 3)) {
2023 r = CP_ACCESS_TRAP;
2024 }
2025 return r;
2026}
2027
2028static void icc_reset(CPUARMState *env, const ARMCPRegInfo *ri)
2029{
2030 GICv3CPUState *cs = icc_cs_from_env(env);
2031
2032 cs->icc_ctlr_el1[GICV3_S] = ICC_CTLR_EL1_A3V |
2033 (1 << ICC_CTLR_EL1_IDBITS_SHIFT) |
2034 (7 << ICC_CTLR_EL1_PRIBITS_SHIFT);
2035 cs->icc_ctlr_el1[GICV3_NS] = ICC_CTLR_EL1_A3V |
2036 (1 << ICC_CTLR_EL1_IDBITS_SHIFT) |
2037 (7 << ICC_CTLR_EL1_PRIBITS_SHIFT);
2038 cs->icc_pmr_el1 = 0;
2039 cs->icc_bpr[GICV3_G0] = GIC_MIN_BPR;
2040 cs->icc_bpr[GICV3_G1] = GIC_MIN_BPR;
2041 cs->icc_bpr[GICV3_G1NS] = GIC_MIN_BPR_NS;
2042 memset(cs->icc_apr, 0, sizeof(cs->icc_apr));
2043 memset(cs->icc_igrpen, 0, sizeof(cs->icc_igrpen));
2044 cs->icc_ctlr_el3 = ICC_CTLR_EL3_NDS | ICC_CTLR_EL3_A3V |
2045 (1 << ICC_CTLR_EL3_IDBITS_SHIFT) |
2046 (7 << ICC_CTLR_EL3_PRIBITS_SHIFT);
2047
2048 memset(cs->ich_apr, 0, sizeof(cs->ich_apr));
2049 cs->ich_hcr_el2 = 0;
2050 memset(cs->ich_lr_el2, 0, sizeof(cs->ich_lr_el2));
2051 cs->ich_vmcr_el2 = ICH_VMCR_EL2_VFIQEN |
2052 ((icv_min_vbpr(cs) + 1) << ICH_VMCR_EL2_VBPR1_SHIFT) |
2053 (icv_min_vbpr(cs) << ICH_VMCR_EL2_VBPR0_SHIFT);
2054}
2055
2056static const ARMCPRegInfo gicv3_cpuif_reginfo[] = {
2057 { .name = "ICC_PMR_EL1", .state = ARM_CP_STATE_BOTH,
2058 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 6, .opc2 = 0,
2059 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2060 .access = PL1_RW, .accessfn = gicv3_irqfiq_access,
2061 .readfn = icc_pmr_read,
2062 .writefn = icc_pmr_write,
2063 /* We hang the whole cpu interface reset routine off here
2064 * rather than parcelling it out into one little function
2065 * per register
2066 */
2067 .resetfn = icc_reset,
2068 },
2069 { .name = "ICC_IAR0_EL1", .state = ARM_CP_STATE_BOTH,
2070 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 8, .opc2 = 0,
2071 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2072 .access = PL1_R, .accessfn = gicv3_fiq_access,
2073 .readfn = icc_iar0_read,
2074 },
2075 { .name = "ICC_EOIR0_EL1", .state = ARM_CP_STATE_BOTH,
2076 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 8, .opc2 = 1,
2077 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2078 .access = PL1_W, .accessfn = gicv3_fiq_access,
2079 .writefn = icc_eoir_write,
2080 },
2081 { .name = "ICC_HPPIR0_EL1", .state = ARM_CP_STATE_BOTH,
2082 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 8, .opc2 = 2,
2083 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2084 .access = PL1_R, .accessfn = gicv3_fiq_access,
2085 .readfn = icc_hppir0_read,
2086 },
2087 { .name = "ICC_BPR0_EL1", .state = ARM_CP_STATE_BOTH,
2088 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 8, .opc2 = 3,
2089 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2090 .access = PL1_RW, .accessfn = gicv3_fiq_access,
2091 .readfn = icc_bpr_read,
2092 .writefn = icc_bpr_write,
2093 },
2094 { .name = "ICC_AP0R0_EL1", .state = ARM_CP_STATE_BOTH,
2095 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 8, .opc2 = 4,
2096 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2097 .access = PL1_RW, .accessfn = gicv3_fiq_access,
2098 .readfn = icc_ap_read,
2099 .writefn = icc_ap_write,
2100 },
2101 { .name = "ICC_AP0R1_EL1", .state = ARM_CP_STATE_BOTH,
2102 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 8, .opc2 = 5,
2103 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2104 .access = PL1_RW, .accessfn = gicv3_fiq_access,
2105 .readfn = icc_ap_read,
2106 .writefn = icc_ap_write,
2107 },
2108 { .name = "ICC_AP0R2_EL1", .state = ARM_CP_STATE_BOTH,
2109 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 8, .opc2 = 6,
2110 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2111 .access = PL1_RW, .accessfn = gicv3_fiq_access,
2112 .readfn = icc_ap_read,
2113 .writefn = icc_ap_write,
2114 },
2115 { .name = "ICC_AP0R3_EL1", .state = ARM_CP_STATE_BOTH,
2116 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 8, .opc2 = 7,
2117 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2118 .access = PL1_RW, .accessfn = gicv3_fiq_access,
2119 .readfn = icc_ap_read,
2120 .writefn = icc_ap_write,
2121 },
2122 /* All the ICC_AP1R*_EL1 registers are banked */
2123 { .name = "ICC_AP1R0_EL1", .state = ARM_CP_STATE_BOTH,
2124 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 9, .opc2 = 0,
2125 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2126 .access = PL1_RW, .accessfn = gicv3_irq_access,
2127 .readfn = icc_ap_read,
2128 .writefn = icc_ap_write,
2129 },
2130 { .name = "ICC_AP1R1_EL1", .state = ARM_CP_STATE_BOTH,
2131 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 9, .opc2 = 1,
2132 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2133 .access = PL1_RW, .accessfn = gicv3_irq_access,
2134 .readfn = icc_ap_read,
2135 .writefn = icc_ap_write,
2136 },
2137 { .name = "ICC_AP1R2_EL1", .state = ARM_CP_STATE_BOTH,
2138 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 9, .opc2 = 2,
2139 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2140 .access = PL1_RW, .accessfn = gicv3_irq_access,
2141 .readfn = icc_ap_read,
2142 .writefn = icc_ap_write,
2143 },
2144 { .name = "ICC_AP1R3_EL1", .state = ARM_CP_STATE_BOTH,
2145 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 9, .opc2 = 3,
2146 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2147 .access = PL1_RW, .accessfn = gicv3_irq_access,
2148 .readfn = icc_ap_read,
2149 .writefn = icc_ap_write,
2150 },
2151 { .name = "ICC_DIR_EL1", .state = ARM_CP_STATE_BOTH,
2152 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 11, .opc2 = 1,
2153 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2154 .access = PL1_W, .accessfn = gicv3_dir_access,
2155 .writefn = icc_dir_write,
2156 },
2157 { .name = "ICC_RPR_EL1", .state = ARM_CP_STATE_BOTH,
2158 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 11, .opc2 = 3,
2159 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2160 .access = PL1_R, .accessfn = gicv3_irqfiq_access,
2161 .readfn = icc_rpr_read,
2162 },
2163 { .name = "ICC_SGI1R_EL1", .state = ARM_CP_STATE_AA64,
2164 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 11, .opc2 = 5,
2165 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2166 .access = PL1_W, .accessfn = gicv3_sgi_access,
2167 .writefn = icc_sgi1r_write,
2168 },
2169 { .name = "ICC_SGI1R",
2170 .cp = 15, .opc1 = 0, .crm = 12,
2171 .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_NO_RAW,
2172 .access = PL1_W, .accessfn = gicv3_sgi_access,
2173 .writefn = icc_sgi1r_write,
2174 },
2175 { .name = "ICC_ASGI1R_EL1", .state = ARM_CP_STATE_AA64,
2176 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 11, .opc2 = 6,
2177 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2178 .access = PL1_W, .accessfn = gicv3_sgi_access,
2179 .writefn = icc_asgi1r_write,
2180 },
2181 { .name = "ICC_ASGI1R",
2182 .cp = 15, .opc1 = 1, .crm = 12,
2183 .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_NO_RAW,
2184 .access = PL1_W, .accessfn = gicv3_sgi_access,
2185 .writefn = icc_asgi1r_write,
2186 },
2187 { .name = "ICC_SGI0R_EL1", .state = ARM_CP_STATE_AA64,
2188 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 11, .opc2 = 7,
2189 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2190 .access = PL1_W, .accessfn = gicv3_sgi_access,
2191 .writefn = icc_sgi0r_write,
2192 },
2193 { .name = "ICC_SGI0R",
2194 .cp = 15, .opc1 = 2, .crm = 12,
2195 .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_NO_RAW,
2196 .access = PL1_W, .accessfn = gicv3_sgi_access,
2197 .writefn = icc_sgi0r_write,
2198 },
2199 { .name = "ICC_IAR1_EL1", .state = ARM_CP_STATE_BOTH,
2200 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 12, .opc2 = 0,
2201 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2202 .access = PL1_R, .accessfn = gicv3_irq_access,
2203 .readfn = icc_iar1_read,
2204 },
2205 { .name = "ICC_EOIR1_EL1", .state = ARM_CP_STATE_BOTH,
2206 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 12, .opc2 = 1,
2207 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2208 .access = PL1_W, .accessfn = gicv3_irq_access,
2209 .writefn = icc_eoir_write,
2210 },
2211 { .name = "ICC_HPPIR1_EL1", .state = ARM_CP_STATE_BOTH,
2212 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 12, .opc2 = 2,
2213 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2214 .access = PL1_R, .accessfn = gicv3_irq_access,
2215 .readfn = icc_hppir1_read,
2216 },
2217 /* This register is banked */
2218 { .name = "ICC_BPR1_EL1", .state = ARM_CP_STATE_BOTH,
2219 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 12, .opc2 = 3,
2220 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2221 .access = PL1_RW, .accessfn = gicv3_irq_access,
2222 .readfn = icc_bpr_read,
2223 .writefn = icc_bpr_write,
2224 },
2225 /* This register is banked */
2226 { .name = "ICC_CTLR_EL1", .state = ARM_CP_STATE_BOTH,
2227 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 12, .opc2 = 4,
2228 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2229 .access = PL1_RW, .accessfn = gicv3_irqfiq_access,
2230 .readfn = icc_ctlr_el1_read,
2231 .writefn = icc_ctlr_el1_write,
2232 },
2233 { .name = "ICC_SRE_EL1", .state = ARM_CP_STATE_BOTH,
2234 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 12, .opc2 = 5,
2235 .type = ARM_CP_NO_RAW | ARM_CP_CONST,
2236 .access = PL1_RW,
2237 /* We don't support IRQ/FIQ bypass and system registers are
2238 * always enabled, so all our bits are RAZ/WI or RAO/WI.
2239 * This register is banked but since it's constant we don't
2240 * need to do anything special.
2241 */
2242 .resetvalue = 0x7,
2243 },
2244 { .name = "ICC_IGRPEN0_EL1", .state = ARM_CP_STATE_BOTH,
2245 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 12, .opc2 = 6,
2246 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2247 .access = PL1_RW, .accessfn = gicv3_fiq_access,
2248 .readfn = icc_igrpen_read,
2249 .writefn = icc_igrpen_write,
2250 },
2251 /* This register is banked */
2252 { .name = "ICC_IGRPEN1_EL1", .state = ARM_CP_STATE_BOTH,
2253 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 12, .opc2 = 7,
2254 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2255 .access = PL1_RW, .accessfn = gicv3_irq_access,
2256 .readfn = icc_igrpen_read,
2257 .writefn = icc_igrpen_write,
2258 },
2259 { .name = "ICC_SRE_EL2", .state = ARM_CP_STATE_BOTH,
2260 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 9, .opc2 = 5,
2261 .type = ARM_CP_NO_RAW | ARM_CP_CONST,
2262 .access = PL2_RW,
2263 /* We don't support IRQ/FIQ bypass and system registers are
2264 * always enabled, so all our bits are RAZ/WI or RAO/WI.
2265 */
2266 .resetvalue = 0xf,
2267 },
2268 { .name = "ICC_CTLR_EL3", .state = ARM_CP_STATE_BOTH,
2269 .opc0 = 3, .opc1 = 6, .crn = 12, .crm = 12, .opc2 = 4,
2270 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2271 .access = PL3_RW,
2272 .readfn = icc_ctlr_el3_read,
2273 .writefn = icc_ctlr_el3_write,
2274 },
2275 { .name = "ICC_SRE_EL3", .state = ARM_CP_STATE_BOTH,
2276 .opc0 = 3, .opc1 = 6, .crn = 12, .crm = 12, .opc2 = 5,
2277 .type = ARM_CP_NO_RAW | ARM_CP_CONST,
2278 .access = PL3_RW,
2279 /* We don't support IRQ/FIQ bypass and system registers are
2280 * always enabled, so all our bits are RAZ/WI or RAO/WI.
2281 */
2282 .resetvalue = 0xf,
2283 },
2284 { .name = "ICC_IGRPEN1_EL3", .state = ARM_CP_STATE_BOTH,
2285 .opc0 = 3, .opc1 = 6, .crn = 12, .crm = 12, .opc2 = 7,
2286 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2287 .access = PL3_RW,
2288 .readfn = icc_igrpen1_el3_read,
2289 .writefn = icc_igrpen1_el3_write,
2290 },
2291 REGINFO_SENTINEL
2292};
2293
2294static uint64_t ich_ap_read(CPUARMState *env, const ARMCPRegInfo *ri)
2295{
2296 GICv3CPUState *cs = icc_cs_from_env(env);
2297 int regno = ri->opc2 & 3;
2298 int grp = (ri->crm & 1) ? GICV3_G1NS : GICV3_G0;
2299 uint64_t value;
2300
2301 value = cs->ich_apr[grp][regno];
2302 trace_gicv3_ich_ap_read(ri->crm & 1, regno, gicv3_redist_affid(cs), value);
2303 return value;
2304}
2305
2306static void ich_ap_write(CPUARMState *env, const ARMCPRegInfo *ri,
2307 uint64_t value)
2308{
2309 GICv3CPUState *cs = icc_cs_from_env(env);
2310 int regno = ri->opc2 & 3;
2311 int grp = (ri->crm & 1) ? GICV3_G1NS : GICV3_G0;
2312
2313 trace_gicv3_ich_ap_write(ri->crm & 1, regno, gicv3_redist_affid(cs), value);
2314
2315 cs->ich_apr[grp][regno] = value & 0xFFFFFFFFU;
2316 gicv3_cpuif_virt_update(cs);
2317}
2318
2319static uint64_t ich_hcr_read(CPUARMState *env, const ARMCPRegInfo *ri)
2320{
2321 GICv3CPUState *cs = icc_cs_from_env(env);
2322 uint64_t value = cs->ich_hcr_el2;
2323
2324 trace_gicv3_ich_hcr_read(gicv3_redist_affid(cs), value);
2325 return value;
2326}
2327
2328static void ich_hcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
2329 uint64_t value)
2330{
2331 GICv3CPUState *cs = icc_cs_from_env(env);
2332
2333 trace_gicv3_ich_hcr_write(gicv3_redist_affid(cs), value);
2334
2335 value &= ICH_HCR_EL2_EN | ICH_HCR_EL2_UIE | ICH_HCR_EL2_LRENPIE |
2336 ICH_HCR_EL2_NPIE | ICH_HCR_EL2_VGRP0EIE | ICH_HCR_EL2_VGRP0DIE |
2337 ICH_HCR_EL2_VGRP1EIE | ICH_HCR_EL2_VGRP1DIE | ICH_HCR_EL2_TC |
2338 ICH_HCR_EL2_TALL0 | ICH_HCR_EL2_TALL1 | ICH_HCR_EL2_TSEI |
2339 ICH_HCR_EL2_TDIR | ICH_HCR_EL2_EOICOUNT_MASK;
2340
2341 cs->ich_hcr_el2 = value;
2342 gicv3_cpuif_virt_update(cs);
2343}
2344
2345static uint64_t ich_vmcr_read(CPUARMState *env, const ARMCPRegInfo *ri)
2346{
2347 GICv3CPUState *cs = icc_cs_from_env(env);
2348 uint64_t value = cs->ich_vmcr_el2;
2349
2350 trace_gicv3_ich_vmcr_read(gicv3_redist_affid(cs), value);
2351 return value;
2352}
2353
2354static void ich_vmcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
2355 uint64_t value)
2356{
2357 GICv3CPUState *cs = icc_cs_from_env(env);
2358
2359 trace_gicv3_ich_vmcr_write(gicv3_redist_affid(cs), value);
2360
2361 value &= ICH_VMCR_EL2_VENG0 | ICH_VMCR_EL2_VENG1 | ICH_VMCR_EL2_VCBPR |
2362 ICH_VMCR_EL2_VEOIM | ICH_VMCR_EL2_VBPR1_MASK |
2363 ICH_VMCR_EL2_VBPR0_MASK | ICH_VMCR_EL2_VPMR_MASK;
2364 value |= ICH_VMCR_EL2_VFIQEN;
2365
2366 cs->ich_vmcr_el2 = value;
2367 /* Enforce "writing BPRs to less than minimum sets them to the minimum"
2368 * by reading and writing back the fields.
2369 */
2370 write_vbpr(cs, GICV3_G0, read_vbpr(cs, GICV3_G0));
2371 write_vbpr(cs, GICV3_G1, read_vbpr(cs, GICV3_G1));
2372
2373 gicv3_cpuif_virt_update(cs);
2374}
2375
2376static uint64_t ich_lr_read(CPUARMState *env, const ARMCPRegInfo *ri)
2377{
2378 GICv3CPUState *cs = icc_cs_from_env(env);
2379 int regno = ri->opc2 | ((ri->crm & 1) << 3);
2380 uint64_t value;
2381
2382 /* This read function handles all of:
2383 * 64-bit reads of the whole LR
2384 * 32-bit reads of the low half of the LR
2385 * 32-bit reads of the high half of the LR
2386 */
2387 if (ri->state == ARM_CP_STATE_AA32) {
2388 if (ri->crm >= 14) {
2389 value = extract64(cs->ich_lr_el2[regno], 32, 32);
2390 trace_gicv3_ich_lrc_read(regno, gicv3_redist_affid(cs), value);
2391 } else {
2392 value = extract64(cs->ich_lr_el2[regno], 0, 32);
2393 trace_gicv3_ich_lr32_read(regno, gicv3_redist_affid(cs), value);
2394 }
2395 } else {
2396 value = cs->ich_lr_el2[regno];
2397 trace_gicv3_ich_lr_read(regno, gicv3_redist_affid(cs), value);
2398 }
2399
2400 return value;
2401}
2402
2403static void ich_lr_write(CPUARMState *env, const ARMCPRegInfo *ri,
2404 uint64_t value)
2405{
2406 GICv3CPUState *cs = icc_cs_from_env(env);
2407 int regno = ri->opc2 | ((ri->crm & 1) << 3);
2408
2409 /* This write function handles all of:
2410 * 64-bit writes to the whole LR
2411 * 32-bit writes to the low half of the LR
2412 * 32-bit writes to the high half of the LR
2413 */
2414 if (ri->state == ARM_CP_STATE_AA32) {
2415 if (ri->crm >= 14) {
2416 trace_gicv3_ich_lrc_write(regno, gicv3_redist_affid(cs), value);
2417 value = deposit64(cs->ich_lr_el2[regno], 32, 32, value);
2418 } else {
2419 trace_gicv3_ich_lr32_write(regno, gicv3_redist_affid(cs), value);
2420 value = deposit64(cs->ich_lr_el2[regno], 0, 32, value);
2421 }
2422 } else {
2423 trace_gicv3_ich_lr_write(regno, gicv3_redist_affid(cs), value);
2424 }
2425
2426 /* Enforce RES0 bits in priority field */
2427 if (cs->vpribits < 8) {
2428 value = deposit64(value, ICH_LR_EL2_PRIORITY_SHIFT,
2429 8 - cs->vpribits, 0);
2430 }
2431
2432 cs->ich_lr_el2[regno] = value;
2433 gicv3_cpuif_virt_update(cs);
2434}
2435
2436static uint64_t ich_vtr_read(CPUARMState *env, const ARMCPRegInfo *ri)
2437{
2438 GICv3CPUState *cs = icc_cs_from_env(env);
2439 uint64_t value;
2440
2441 value = ((cs->num_list_regs - 1) << ICH_VTR_EL2_LISTREGS_SHIFT)
2442 | ICH_VTR_EL2_TDS | ICH_VTR_EL2_NV4 | ICH_VTR_EL2_A3V
2443 | (1 << ICH_VTR_EL2_IDBITS_SHIFT)
2444 | ((cs->vprebits - 1) << ICH_VTR_EL2_PREBITS_SHIFT)
2445 | ((cs->vpribits - 1) << ICH_VTR_EL2_PRIBITS_SHIFT);
2446
2447 trace_gicv3_ich_vtr_read(gicv3_redist_affid(cs), value);
2448 return value;
2449}
2450
2451static uint64_t ich_misr_read(CPUARMState *env, const ARMCPRegInfo *ri)
2452{
2453 GICv3CPUState *cs = icc_cs_from_env(env);
2454 uint64_t value = maintenance_interrupt_state(cs);
2455
2456 trace_gicv3_ich_misr_read(gicv3_redist_affid(cs), value);
2457 return value;
2458}
2459
2460static uint64_t ich_eisr_read(CPUARMState *env, const ARMCPRegInfo *ri)
2461{
2462 GICv3CPUState *cs = icc_cs_from_env(env);
2463 uint64_t value = eoi_maintenance_interrupt_state(cs, NULL);
2464
2465 trace_gicv3_ich_eisr_read(gicv3_redist_affid(cs), value);
2466 return value;
2467}
2468
2469static uint64_t ich_elrsr_read(CPUARMState *env, const ARMCPRegInfo *ri)
2470{
2471 GICv3CPUState *cs = icc_cs_from_env(env);
2472 uint64_t value = 0;
2473 int i;
2474
2475 for (i = 0; i < cs->num_list_regs; i++) {
2476 uint64_t lr = cs->ich_lr_el2[i];
2477
2478 if ((lr & ICH_LR_EL2_STATE_MASK) == 0 &&
2479 ((lr & ICH_LR_EL2_HW) != 0 || (lr & ICH_LR_EL2_EOI) == 0)) {
2480 value |= (1 << i);
2481 }
2482 }
2483
2484 trace_gicv3_ich_elrsr_read(gicv3_redist_affid(cs), value);
2485 return value;
2486}
2487
2488static const ARMCPRegInfo gicv3_cpuif_hcr_reginfo[] = {
2489 { .name = "ICH_AP0R0_EL2", .state = ARM_CP_STATE_BOTH,
2490 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 8, .opc2 = 0,
2491 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2492 .access = PL2_RW,
2493 .readfn = ich_ap_read,
2494 .writefn = ich_ap_write,
2495 },
2496 { .name = "ICH_AP1R0_EL2", .state = ARM_CP_STATE_BOTH,
2497 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 9, .opc2 = 0,
2498 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2499 .access = PL2_RW,
2500 .readfn = ich_ap_read,
2501 .writefn = ich_ap_write,
2502 },
2503 { .name = "ICH_HCR_EL2", .state = ARM_CP_STATE_BOTH,
2504 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 11, .opc2 = 0,
2505 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2506 .access = PL2_RW,
2507 .readfn = ich_hcr_read,
2508 .writefn = ich_hcr_write,
2509 },
2510 { .name = "ICH_VTR_EL2", .state = ARM_CP_STATE_BOTH,
2511 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 11, .opc2 = 1,
2512 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2513 .access = PL2_R,
2514 .readfn = ich_vtr_read,
2515 },
2516 { .name = "ICH_MISR_EL2", .state = ARM_CP_STATE_BOTH,
2517 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 11, .opc2 = 2,
2518 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2519 .access = PL2_R,
2520 .readfn = ich_misr_read,
2521 },
2522 { .name = "ICH_EISR_EL2", .state = ARM_CP_STATE_BOTH,
2523 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 11, .opc2 = 3,
2524 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2525 .access = PL2_R,
2526 .readfn = ich_eisr_read,
2527 },
2528 { .name = "ICH_ELRSR_EL2", .state = ARM_CP_STATE_BOTH,
2529 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 11, .opc2 = 5,
2530 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2531 .access = PL2_R,
2532 .readfn = ich_elrsr_read,
2533 },
2534 { .name = "ICH_VMCR_EL2", .state = ARM_CP_STATE_BOTH,
2535 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 11, .opc2 = 7,
2536 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2537 .access = PL2_RW,
2538 .readfn = ich_vmcr_read,
2539 .writefn = ich_vmcr_write,
2540 },
2541 REGINFO_SENTINEL
2542};
2543
2544static const ARMCPRegInfo gicv3_cpuif_ich_apxr1_reginfo[] = {
2545 { .name = "ICH_AP0R1_EL2", .state = ARM_CP_STATE_BOTH,
2546 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 8, .opc2 = 1,
2547 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2548 .access = PL2_RW,
2549 .readfn = ich_ap_read,
2550 .writefn = ich_ap_write,
2551 },
2552 { .name = "ICH_AP1R1_EL2", .state = ARM_CP_STATE_BOTH,
2553 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 9, .opc2 = 1,
2554 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2555 .access = PL2_RW,
2556 .readfn = ich_ap_read,
2557 .writefn = ich_ap_write,
2558 },
2559 REGINFO_SENTINEL
2560};
2561
2562static const ARMCPRegInfo gicv3_cpuif_ich_apxr23_reginfo[] = {
2563 { .name = "ICH_AP0R2_EL2", .state = ARM_CP_STATE_BOTH,
2564 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 8, .opc2 = 2,
2565 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2566 .access = PL2_RW,
2567 .readfn = ich_ap_read,
2568 .writefn = ich_ap_write,
2569 },
2570 { .name = "ICH_AP0R3_EL2", .state = ARM_CP_STATE_BOTH,
2571 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 8, .opc2 = 3,
2572 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2573 .access = PL2_RW,
2574 .readfn = ich_ap_read,
2575 .writefn = ich_ap_write,
2576 },
2577 { .name = "ICH_AP1R2_EL2", .state = ARM_CP_STATE_BOTH,
2578 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 9, .opc2 = 2,
2579 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2580 .access = PL2_RW,
2581 .readfn = ich_ap_read,
2582 .writefn = ich_ap_write,
2583 },
2584 { .name = "ICH_AP1R3_EL2", .state = ARM_CP_STATE_BOTH,
2585 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 9, .opc2 = 3,
2586 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2587 .access = PL2_RW,
2588 .readfn = ich_ap_read,
2589 .writefn = ich_ap_write,
2590 },
2591 REGINFO_SENTINEL
2592};
2593
2594static void gicv3_cpuif_el_change_hook(ARMCPU *cpu, void *opaque)
2595{
2596 GICv3CPUState *cs = opaque;
2597
2598 gicv3_cpuif_update(cs);
2599}
2600
2601void gicv3_init_cpuif(GICv3State *s)
2602{
2603 /* Called from the GICv3 realize function; register our system
2604 * registers with the CPU
2605 */
2606 int i;
2607
2608 for (i = 0; i < s->num_cpu; i++) {
2609 ARMCPU *cpu = ARM_CPU(qemu_get_cpu(i));
2610 GICv3CPUState *cs = &s->cpu[i];
2611
2612 /* Note that we can't just use the GICv3CPUState as an opaque pointer
2613 * in define_arm_cp_regs_with_opaque(), because when we're called back
2614 * it might be with code translated by CPU 0 but run by CPU 1, in
2615 * which case we'd get the wrong value.
2616 * So instead we define the regs with no ri->opaque info, and
2617 * get back to the GICv3CPUState from the CPUARMState.
2618 */
2619 define_arm_cp_regs(cpu, gicv3_cpuif_reginfo);
2620 if (arm_feature(&cpu->env, ARM_FEATURE_EL2)
2621 && cpu->gic_num_lrs) {
2622 int j;
2623
2624 cs->maintenance_irq = cpu->gicv3_maintenance_interrupt;
2625
2626 cs->num_list_regs = cpu->gic_num_lrs;
2627 cs->vpribits = cpu->gic_vpribits;
2628 cs->vprebits = cpu->gic_vprebits;
2629
2630 /* Check against architectural constraints: getting these
2631 * wrong would be a bug in the CPU code defining these,
2632 * and the implementation relies on them holding.
2633 */
2634 g_assert(cs->vprebits <= cs->vpribits);
2635 g_assert(cs->vprebits >= 5 && cs->vprebits <= 7);
2636 g_assert(cs->vpribits >= 5 && cs->vpribits <= 8);
2637
2638 define_arm_cp_regs(cpu, gicv3_cpuif_hcr_reginfo);
2639
2640 for (j = 0; j < cs->num_list_regs; j++) {
2641 /* Note that the AArch64 LRs are 64-bit; the AArch32 LRs
2642 * are split into two cp15 regs, LR (the low part, with the
2643 * same encoding as the AArch64 LR) and LRC (the high part).
2644 */
2645 ARMCPRegInfo lr_regset[] = {
2646 { .name = "ICH_LRn_EL2", .state = ARM_CP_STATE_BOTH,
2647 .opc0 = 3, .opc1 = 4, .crn = 12,
2648 .crm = 12 + (j >> 3), .opc2 = j & 7,
2649 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2650 .access = PL2_RW,
2651 .readfn = ich_lr_read,
2652 .writefn = ich_lr_write,
2653 },
2654 { .name = "ICH_LRCn_EL2", .state = ARM_CP_STATE_AA32,
2655 .cp = 15, .opc1 = 4, .crn = 12,
2656 .crm = 14 + (j >> 3), .opc2 = j & 7,
2657 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2658 .access = PL2_RW,
2659 .readfn = ich_lr_read,
2660 .writefn = ich_lr_write,
2661 },
2662 REGINFO_SENTINEL
2663 };
2664 define_arm_cp_regs(cpu, lr_regset);
2665 }
2666 if (cs->vprebits >= 6) {
2667 define_arm_cp_regs(cpu, gicv3_cpuif_ich_apxr1_reginfo);
2668 }
2669 if (cs->vprebits == 7) {
2670 define_arm_cp_regs(cpu, gicv3_cpuif_ich_apxr23_reginfo);
2671 }
2672 }
2673 arm_register_el_change_hook(cpu, gicv3_cpuif_el_change_hook, cs);
2674 }
2675}
2676