1 /*
2 * ARM Generic Interrupt Controller v3
3 *
4 * Copyright (c) 2016 Linaro Limited
5 * Written by Peter Maydell
6 *
7 * This code is licensed under the GPL, version 2 or (at your option)
8 * any later version.
9 */
10
11 /* This file contains the code for the system register interface
12 * portions of the GICv3.
13 */
14
15 #include "qemu/osdep.h"
16 #include "qemu/bitops.h"
17 #include "qemu/log.h"
18 #include "qemu/main-loop.h"
19 #include "trace.h"
20 #include "gicv3_internal.h"
21 #include "hw/irq.h"
22 #include "cpu.h"
23
gicv3_set_gicv3state(CPUState * cpu,GICv3CPUState * s)24 void gicv3_set_gicv3state(CPUState *cpu, GICv3CPUState *s)
25 {
26 ARMCPU *arm_cpu = ARM_CPU(cpu);
27 CPUARMState *env = &arm_cpu->env;
28
29 env->gicv3state = (void *)s;
30 };
31
icc_cs_from_env(CPUARMState * env)32 static GICv3CPUState *icc_cs_from_env(CPUARMState *env)
33 {
34 return env->gicv3state;
35 }
36
gicv3_use_ns_bank(CPUARMState * env)37 static bool gicv3_use_ns_bank(CPUARMState *env)
38 {
39 /* Return true if we should use the NonSecure bank for a banked GIC
40 * CPU interface register. Note that this differs from the
41 * access_secure_reg() function because GICv3 banked registers are
42 * banked even for AArch64, unlike the other CPU system registers.
43 */
44 return !arm_is_secure_below_el3(env);
45 }
46
47 /* The minimum BPR for the virtual interface is a configurable property */
icv_min_vbpr(GICv3CPUState * cs)48 static inline int icv_min_vbpr(GICv3CPUState *cs)
49 {
50 return 7 - cs->vprebits;
51 }
52
53 /* Simple accessor functions for LR fields */
ich_lr_vintid(uint64_t lr)54 static uint32_t ich_lr_vintid(uint64_t lr)
55 {
56 return extract64(lr, ICH_LR_EL2_VINTID_SHIFT, ICH_LR_EL2_VINTID_LENGTH);
57 }
58
ich_lr_pintid(uint64_t lr)59 static uint32_t ich_lr_pintid(uint64_t lr)
60 {
61 return extract64(lr, ICH_LR_EL2_PINTID_SHIFT, ICH_LR_EL2_PINTID_LENGTH);
62 }
63
ich_lr_prio(uint64_t lr)64 static uint32_t ich_lr_prio(uint64_t lr)
65 {
66 return extract64(lr, ICH_LR_EL2_PRIORITY_SHIFT, ICH_LR_EL2_PRIORITY_LENGTH);
67 }
68
ich_lr_state(uint64_t lr)69 static int ich_lr_state(uint64_t lr)
70 {
71 return extract64(lr, ICH_LR_EL2_STATE_SHIFT, ICH_LR_EL2_STATE_LENGTH);
72 }
73
icv_access(CPUARMState * env,int hcr_flags)74 static bool icv_access(CPUARMState *env, int hcr_flags)
75 {
76 /* Return true if this ICC_ register access should really be
77 * directed to an ICV_ access. hcr_flags is a mask of
78 * HCR_EL2 bits to check: we treat this as an ICV_ access
79 * if we are in NS EL1 and at least one of the specified
80 * HCR_EL2 bits is set.
81 *
82 * ICV registers fall into four categories:
83 * * access if NS EL1 and HCR_EL2.FMO == 1:
84 * all ICV regs with '0' in their name
85 * * access if NS EL1 and HCR_EL2.IMO == 1:
86 * all ICV regs with '1' in their name
87 * * access if NS EL1 and either IMO or FMO == 1:
88 * CTLR, DIR, PMR, RPR
89 */
90 uint64_t hcr_el2 = arm_hcr_el2_eff(env);
91 bool flagmatch = hcr_el2 & hcr_flags & (HCR_IMO | HCR_FMO);
92
93 return flagmatch && arm_current_el(env) == 1
94 && !arm_is_secure_below_el3(env);
95 }
96
read_vbpr(GICv3CPUState * cs,int grp)97 static int read_vbpr(GICv3CPUState *cs, int grp)
98 {
99 /* Read VBPR value out of the VMCR field (caller must handle
100 * VCBPR effects if required)
101 */
102 if (grp == GICV3_G0) {
103 return extract64(cs->ich_vmcr_el2, ICH_VMCR_EL2_VBPR0_SHIFT,
104 ICH_VMCR_EL2_VBPR0_LENGTH);
105 } else {
106 return extract64(cs->ich_vmcr_el2, ICH_VMCR_EL2_VBPR1_SHIFT,
107 ICH_VMCR_EL2_VBPR1_LENGTH);
108 }
109 }
110
write_vbpr(GICv3CPUState * cs,int grp,int value)111 static void write_vbpr(GICv3CPUState *cs, int grp, int value)
112 {
113 /* Write new VBPR1 value, handling the "writing a value less than
114 * the minimum sets it to the minimum" semantics.
115 */
116 int min = icv_min_vbpr(cs);
117
118 if (grp != GICV3_G0) {
119 min++;
120 }
121
122 value = MAX(value, min);
123
124 if (grp == GICV3_G0) {
125 cs->ich_vmcr_el2 = deposit64(cs->ich_vmcr_el2, ICH_VMCR_EL2_VBPR0_SHIFT,
126 ICH_VMCR_EL2_VBPR0_LENGTH, value);
127 } else {
128 cs->ich_vmcr_el2 = deposit64(cs->ich_vmcr_el2, ICH_VMCR_EL2_VBPR1_SHIFT,
129 ICH_VMCR_EL2_VBPR1_LENGTH, value);
130 }
131 }
132
icv_fullprio_mask(GICv3CPUState * cs)133 static uint32_t icv_fullprio_mask(GICv3CPUState *cs)
134 {
135 /* Return a mask word which clears the unimplemented priority bits
136 * from a priority value for a virtual interrupt. (Not to be confused
137 * with the group priority, whose mask depends on the value of VBPR
138 * for the interrupt group.)
139 */
140 return ~0U << (8 - cs->vpribits);
141 }
142
ich_highest_active_virt_prio(GICv3CPUState * cs)143 static int ich_highest_active_virt_prio(GICv3CPUState *cs)
144 {
145 /* Calculate the current running priority based on the set bits
146 * in the ICH Active Priority Registers.
147 */
148 int i;
149 int aprmax = 1 << (cs->vprebits - 5);
150
151 assert(aprmax <= ARRAY_SIZE(cs->ich_apr[0]));
152
153 for (i = 0; i < aprmax; i++) {
154 uint32_t apr = cs->ich_apr[GICV3_G0][i] |
155 cs->ich_apr[GICV3_G1NS][i];
156
157 if (!apr) {
158 continue;
159 }
160 return (i * 32 + ctz32(apr)) << (icv_min_vbpr(cs) + 1);
161 }
162 /* No current active interrupts: return idle priority */
163 return 0xff;
164 }
165
hppvi_index(GICv3CPUState * cs)166 static int hppvi_index(GICv3CPUState *cs)
167 {
168 /* Return the list register index of the highest priority pending
169 * virtual interrupt, as per the HighestPriorityVirtualInterrupt
170 * pseudocode. If no pending virtual interrupts, return -1.
171 */
172 int idx = -1;
173 int i;
174 /* Note that a list register entry with a priority of 0xff will
175 * never be reported by this function; this is the architecturally
176 * correct behaviour.
177 */
178 int prio = 0xff;
179
180 if (!(cs->ich_vmcr_el2 & (ICH_VMCR_EL2_VENG0 | ICH_VMCR_EL2_VENG1))) {
181 /* Both groups disabled, definitely nothing to do */
182 return idx;
183 }
184
185 for (i = 0; i < cs->num_list_regs; i++) {
186 uint64_t lr = cs->ich_lr_el2[i];
187 int thisprio;
188
189 if (ich_lr_state(lr) != ICH_LR_EL2_STATE_PENDING) {
190 /* Not Pending */
191 continue;
192 }
193
194 /* Ignore interrupts if relevant group enable not set */
195 if (lr & ICH_LR_EL2_GROUP) {
196 if (!(cs->ich_vmcr_el2 & ICH_VMCR_EL2_VENG1)) {
197 continue;
198 }
199 } else {
200 if (!(cs->ich_vmcr_el2 & ICH_VMCR_EL2_VENG0)) {
201 continue;
202 }
203 }
204
205 thisprio = ich_lr_prio(lr);
206
207 if (thisprio < prio) {
208 prio = thisprio;
209 idx = i;
210 }
211 }
212
213 return idx;
214 }
215
icv_gprio_mask(GICv3CPUState * cs,int group)216 static uint32_t icv_gprio_mask(GICv3CPUState *cs, int group)
217 {
218 /* Return a mask word which clears the subpriority bits from
219 * a priority value for a virtual interrupt in the specified group.
220 * This depends on the VBPR value.
221 * If using VBPR0 then:
222 * a BPR of 0 means the group priority bits are [7:1];
223 * a BPR of 1 means they are [7:2], and so on down to
224 * a BPR of 7 meaning no group priority bits at all.
225 * If using VBPR1 then:
226 * a BPR of 0 is impossible (the minimum value is 1)
227 * a BPR of 1 means the group priority bits are [7:1];
228 * a BPR of 2 means they are [7:2], and so on down to
229 * a BPR of 7 meaning the group priority is [7].
230 *
231 * Which BPR to use depends on the group of the interrupt and
232 * the current ICH_VMCR_EL2.VCBPR settings.
233 *
234 * This corresponds to the VGroupBits() pseudocode.
235 */
236 int bpr;
237
238 if (group == GICV3_G1NS && cs->ich_vmcr_el2 & ICH_VMCR_EL2_VCBPR) {
239 group = GICV3_G0;
240 }
241
242 bpr = read_vbpr(cs, group);
243 if (group == GICV3_G1NS) {
244 assert(bpr > 0);
245 bpr--;
246 }
247
248 return ~0U << (bpr + 1);
249 }
250
icv_hppi_can_preempt(GICv3CPUState * cs,uint64_t lr)251 static bool icv_hppi_can_preempt(GICv3CPUState *cs, uint64_t lr)
252 {
253 /* Return true if we can signal this virtual interrupt defined by
254 * the given list register value; see the pseudocode functions
255 * CanSignalVirtualInterrupt and CanSignalVirtualInt.
256 * Compare also icc_hppi_can_preempt() which is the non-virtual
257 * equivalent of these checks.
258 */
259 int grp;
260 uint32_t mask, prio, rprio, vpmr;
261
262 if (!(cs->ich_hcr_el2 & ICH_HCR_EL2_EN)) {
263 /* Virtual interface disabled */
264 return false;
265 }
266
267 /* We don't need to check that this LR is in Pending state because
268 * that has already been done in hppvi_index().
269 */
270
271 prio = ich_lr_prio(lr);
272 vpmr = extract64(cs->ich_vmcr_el2, ICH_VMCR_EL2_VPMR_SHIFT,
273 ICH_VMCR_EL2_VPMR_LENGTH);
274
275 if (prio >= vpmr) {
276 /* Priority mask masks this interrupt */
277 return false;
278 }
279
280 rprio = ich_highest_active_virt_prio(cs);
281 if (rprio == 0xff) {
282 /* No running interrupt so we can preempt */
283 return true;
284 }
285
286 grp = (lr & ICH_LR_EL2_GROUP) ? GICV3_G1NS : GICV3_G0;
287
288 mask = icv_gprio_mask(cs, grp);
289
290 /* We only preempt a running interrupt if the pending interrupt's
291 * group priority is sufficient (the subpriorities are not considered).
292 */
293 if ((prio & mask) < (rprio & mask)) {
294 return true;
295 }
296
297 return false;
298 }
299
eoi_maintenance_interrupt_state(GICv3CPUState * cs,uint32_t * misr)300 static uint32_t eoi_maintenance_interrupt_state(GICv3CPUState *cs,
301 uint32_t *misr)
302 {
303 /* Return a set of bits indicating the EOI maintenance interrupt status
304 * for each list register. The EOI maintenance interrupt status is
305 * 1 if LR.State == 0 && LR.HW == 0 && LR.EOI == 1
306 * (see the GICv3 spec for the ICH_EISR_EL2 register).
307 * If misr is not NULL then we should also collect the information
308 * about the MISR.EOI, MISR.NP and MISR.U bits.
309 */
310 uint32_t value = 0;
311 int validcount = 0;
312 bool seenpending = false;
313 int i;
314
315 for (i = 0; i < cs->num_list_regs; i++) {
316 uint64_t lr = cs->ich_lr_el2[i];
317
318 if ((lr & (ICH_LR_EL2_STATE_MASK | ICH_LR_EL2_HW | ICH_LR_EL2_EOI))
319 == ICH_LR_EL2_EOI) {
320 value |= (1 << i);
321 }
322 if ((lr & ICH_LR_EL2_STATE_MASK)) {
323 validcount++;
324 }
325 if (ich_lr_state(lr) == ICH_LR_EL2_STATE_PENDING) {
326 seenpending = true;
327 }
328 }
329
330 if (misr) {
331 if (validcount < 2 && (cs->ich_hcr_el2 & ICH_HCR_EL2_UIE)) {
332 *misr |= ICH_MISR_EL2_U;
333 }
334 if (!seenpending && (cs->ich_hcr_el2 & ICH_HCR_EL2_NPIE)) {
335 *misr |= ICH_MISR_EL2_NP;
336 }
337 if (value) {
338 *misr |= ICH_MISR_EL2_EOI;
339 }
340 }
341 return value;
342 }
343
maintenance_interrupt_state(GICv3CPUState * cs)344 static uint32_t maintenance_interrupt_state(GICv3CPUState *cs)
345 {
346 /* Return a set of bits indicating the maintenance interrupt status
347 * (as seen in the ICH_MISR_EL2 register).
348 */
349 uint32_t value = 0;
350
351 /* Scan list registers and fill in the U, NP and EOI bits */
352 eoi_maintenance_interrupt_state(cs, &value);
353
354 if ((cs->ich_hcr_el2 & ICH_HCR_EL2_LRENPIE) &&
355 (cs->ich_hcr_el2 & ICH_HCR_EL2_EOICOUNT_MASK)) {
356 value |= ICH_MISR_EL2_LRENP;
357 }
358
359 if ((cs->ich_hcr_el2 & ICH_HCR_EL2_VGRP0EIE) &&
360 (cs->ich_vmcr_el2 & ICH_VMCR_EL2_VENG0)) {
361 value |= ICH_MISR_EL2_VGRP0E;
362 }
363
364 if ((cs->ich_hcr_el2 & ICH_HCR_EL2_VGRP0DIE) &&
365 !(cs->ich_vmcr_el2 & ICH_VMCR_EL2_VENG1)) {
366 value |= ICH_MISR_EL2_VGRP0D;
367 }
368 if ((cs->ich_hcr_el2 & ICH_HCR_EL2_VGRP1EIE) &&
369 (cs->ich_vmcr_el2 & ICH_VMCR_EL2_VENG1)) {
370 value |= ICH_MISR_EL2_VGRP1E;
371 }
372
373 if ((cs->ich_hcr_el2 & ICH_HCR_EL2_VGRP1DIE) &&
374 !(cs->ich_vmcr_el2 & ICH_VMCR_EL2_VENG1)) {
375 value |= ICH_MISR_EL2_VGRP1D;
376 }
377
378 return value;
379 }
380
gicv3_cpuif_virt_update(GICv3CPUState * cs)381 static void gicv3_cpuif_virt_update(GICv3CPUState *cs)
382 {
383 /* Tell the CPU about any pending virtual interrupts or
384 * maintenance interrupts, following a change to the state
385 * of the CPU interface relevant to virtual interrupts.
386 *
387 * CAUTION: this function will call qemu_set_irq() on the
388 * CPU maintenance IRQ line, which is typically wired up
389 * to the GIC as a per-CPU interrupt. This means that it
390 * will recursively call back into the GIC code via
391 * gicv3_redist_set_irq() and thus into the CPU interface code's
392 * gicv3_cpuif_update(). It is therefore important that this
393 * function is only called as the final action of a CPU interface
394 * register write implementation, after all the GIC state
395 * fields have been updated. gicv3_cpuif_update() also must
396 * not cause this function to be called, but that happens
397 * naturally as a result of there being no architectural
398 * linkage between the physical and virtual GIC logic.
399 */
400 int idx;
401 int irqlevel = 0;
402 int fiqlevel = 0;
403 int maintlevel = 0;
404 ARMCPU *cpu = ARM_CPU(cs->cpu);
405
406 idx = hppvi_index(cs);
407 trace_gicv3_cpuif_virt_update(gicv3_redist_affid(cs), idx);
408 if (idx >= 0) {
409 uint64_t lr = cs->ich_lr_el2[idx];
410
411 if (icv_hppi_can_preempt(cs, lr)) {
412 /* Virtual interrupts are simple: G0 are always FIQ, and G1 IRQ */
413 if (lr & ICH_LR_EL2_GROUP) {
414 irqlevel = 1;
415 } else {
416 fiqlevel = 1;
417 }
418 }
419 }
420
421 if ((cs->ich_hcr_el2 & ICH_HCR_EL2_EN) &&
422 maintenance_interrupt_state(cs) != 0) {
423 maintlevel = 1;
424 }
425
426 trace_gicv3_cpuif_virt_set_irqs(gicv3_redist_affid(cs), fiqlevel,
427 irqlevel, maintlevel);
428
429 qemu_set_irq(cs->parent_vfiq, fiqlevel);
430 qemu_set_irq(cs->parent_virq, irqlevel);
431 qemu_set_irq(cpu->gicv3_maintenance_interrupt, maintlevel);
432 }
433
icv_ap_read(CPUARMState * env,const ARMCPRegInfo * ri)434 static uint64_t icv_ap_read(CPUARMState *env, const ARMCPRegInfo *ri)
435 {
436 GICv3CPUState *cs = icc_cs_from_env(env);
437 int regno = ri->opc2 & 3;
438 int grp = (ri->crm & 1) ? GICV3_G1NS : GICV3_G0;
439 uint64_t value = cs->ich_apr[grp][regno];
440
441 trace_gicv3_icv_ap_read(ri->crm & 1, regno, gicv3_redist_affid(cs), value);
442 return value;
443 }
444
icv_ap_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)445 static void icv_ap_write(CPUARMState *env, const ARMCPRegInfo *ri,
446 uint64_t value)
447 {
448 GICv3CPUState *cs = icc_cs_from_env(env);
449 int regno = ri->opc2 & 3;
450 int grp = (ri->crm & 1) ? GICV3_G1NS : GICV3_G0;
451
452 trace_gicv3_icv_ap_write(ri->crm & 1, regno, gicv3_redist_affid(cs), value);
453
454 cs->ich_apr[grp][regno] = value & 0xFFFFFFFFU;
455
456 gicv3_cpuif_virt_update(cs);
457 return;
458 }
459
icv_bpr_read(CPUARMState * env,const ARMCPRegInfo * ri)460 static uint64_t icv_bpr_read(CPUARMState *env, const ARMCPRegInfo *ri)
461 {
462 GICv3CPUState *cs = icc_cs_from_env(env);
463 int grp = (ri->crm == 8) ? GICV3_G0 : GICV3_G1NS;
464 uint64_t bpr;
465 bool satinc = false;
466
467 if (grp == GICV3_G1NS && (cs->ich_vmcr_el2 & ICH_VMCR_EL2_VCBPR)) {
468 /* reads return bpr0 + 1 saturated to 7, writes ignored */
469 grp = GICV3_G0;
470 satinc = true;
471 }
472
473 bpr = read_vbpr(cs, grp);
474
475 if (satinc) {
476 bpr++;
477 bpr = MIN(bpr, 7);
478 }
479
480 trace_gicv3_icv_bpr_read(ri->crm == 8 ? 0 : 1, gicv3_redist_affid(cs), bpr);
481
482 return bpr;
483 }
484
icv_bpr_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)485 static void icv_bpr_write(CPUARMState *env, const ARMCPRegInfo *ri,
486 uint64_t value)
487 {
488 GICv3CPUState *cs = icc_cs_from_env(env);
489 int grp = (ri->crm == 8) ? GICV3_G0 : GICV3_G1NS;
490
491 trace_gicv3_icv_bpr_write(ri->crm == 8 ? 0 : 1,
492 gicv3_redist_affid(cs), value);
493
494 if (grp == GICV3_G1NS && (cs->ich_vmcr_el2 & ICH_VMCR_EL2_VCBPR)) {
495 /* reads return bpr0 + 1 saturated to 7, writes ignored */
496 return;
497 }
498
499 write_vbpr(cs, grp, value);
500
501 gicv3_cpuif_virt_update(cs);
502 }
503
icv_pmr_read(CPUARMState * env,const ARMCPRegInfo * ri)504 static uint64_t icv_pmr_read(CPUARMState *env, const ARMCPRegInfo *ri)
505 {
506 GICv3CPUState *cs = icc_cs_from_env(env);
507 uint64_t value;
508
509 value = extract64(cs->ich_vmcr_el2, ICH_VMCR_EL2_VPMR_SHIFT,
510 ICH_VMCR_EL2_VPMR_LENGTH);
511
512 trace_gicv3_icv_pmr_read(gicv3_redist_affid(cs), value);
513 return value;
514 }
515
icv_pmr_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)516 static void icv_pmr_write(CPUARMState *env, const ARMCPRegInfo *ri,
517 uint64_t value)
518 {
519 GICv3CPUState *cs = icc_cs_from_env(env);
520
521 trace_gicv3_icv_pmr_write(gicv3_redist_affid(cs), value);
522
523 value &= icv_fullprio_mask(cs);
524
525 cs->ich_vmcr_el2 = deposit64(cs->ich_vmcr_el2, ICH_VMCR_EL2_VPMR_SHIFT,
526 ICH_VMCR_EL2_VPMR_LENGTH, value);
527
528 gicv3_cpuif_virt_update(cs);
529 }
530
icv_igrpen_read(CPUARMState * env,const ARMCPRegInfo * ri)531 static uint64_t icv_igrpen_read(CPUARMState *env, const ARMCPRegInfo *ri)
532 {
533 GICv3CPUState *cs = icc_cs_from_env(env);
534 int enbit;
535 uint64_t value;
536
537 enbit = ri->opc2 & 1 ? ICH_VMCR_EL2_VENG1_SHIFT : ICH_VMCR_EL2_VENG0_SHIFT;
538 value = extract64(cs->ich_vmcr_el2, enbit, 1);
539
540 trace_gicv3_icv_igrpen_read(ri->opc2 & 1 ? 1 : 0,
541 gicv3_redist_affid(cs), value);
542 return value;
543 }
544
icv_igrpen_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)545 static void icv_igrpen_write(CPUARMState *env, const ARMCPRegInfo *ri,
546 uint64_t value)
547 {
548 GICv3CPUState *cs = icc_cs_from_env(env);
549 int enbit;
550
551 trace_gicv3_icv_igrpen_write(ri->opc2 & 1 ? 1 : 0,
552 gicv3_redist_affid(cs), value);
553
554 enbit = ri->opc2 & 1 ? ICH_VMCR_EL2_VENG1_SHIFT : ICH_VMCR_EL2_VENG0_SHIFT;
555
556 cs->ich_vmcr_el2 = deposit64(cs->ich_vmcr_el2, enbit, 1, value);
557 gicv3_cpuif_virt_update(cs);
558 }
559
icv_ctlr_read(CPUARMState * env,const ARMCPRegInfo * ri)560 static uint64_t icv_ctlr_read(CPUARMState *env, const ARMCPRegInfo *ri)
561 {
562 GICv3CPUState *cs = icc_cs_from_env(env);
563 uint64_t value;
564
565 /* Note that the fixed fields here (A3V, SEIS, IDbits, PRIbits)
566 * should match the ones reported in ich_vtr_read().
567 */
568 value = ICC_CTLR_EL1_A3V | (1 << ICC_CTLR_EL1_IDBITS_SHIFT) |
569 (7 << ICC_CTLR_EL1_PRIBITS_SHIFT);
570
571 if (cs->ich_vmcr_el2 & ICH_VMCR_EL2_VEOIM) {
572 value |= ICC_CTLR_EL1_EOIMODE;
573 }
574
575 if (cs->ich_vmcr_el2 & ICH_VMCR_EL2_VCBPR) {
576 value |= ICC_CTLR_EL1_CBPR;
577 }
578
579 trace_gicv3_icv_ctlr_read(gicv3_redist_affid(cs), value);
580 return value;
581 }
582
icv_ctlr_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)583 static void icv_ctlr_write(CPUARMState *env, const ARMCPRegInfo *ri,
584 uint64_t value)
585 {
586 GICv3CPUState *cs = icc_cs_from_env(env);
587
588 trace_gicv3_icv_ctlr_write(gicv3_redist_affid(cs), value);
589
590 cs->ich_vmcr_el2 = deposit64(cs->ich_vmcr_el2, ICH_VMCR_EL2_VCBPR_SHIFT,
591 1, value & ICC_CTLR_EL1_CBPR ? 1 : 0);
592 cs->ich_vmcr_el2 = deposit64(cs->ich_vmcr_el2, ICH_VMCR_EL2_VEOIM_SHIFT,
593 1, value & ICC_CTLR_EL1_EOIMODE ? 1 : 0);
594
595 gicv3_cpuif_virt_update(cs);
596 }
597
icv_rpr_read(CPUARMState * env,const ARMCPRegInfo * ri)598 static uint64_t icv_rpr_read(CPUARMState *env, const ARMCPRegInfo *ri)
599 {
600 GICv3CPUState *cs = icc_cs_from_env(env);
601 int prio = ich_highest_active_virt_prio(cs);
602
603 trace_gicv3_icv_rpr_read(gicv3_redist_affid(cs), prio);
604 return prio;
605 }
606
icv_hppir_read(CPUARMState * env,const ARMCPRegInfo * ri)607 static uint64_t icv_hppir_read(CPUARMState *env, const ARMCPRegInfo *ri)
608 {
609 GICv3CPUState *cs = icc_cs_from_env(env);
610 int grp = ri->crm == 8 ? GICV3_G0 : GICV3_G1NS;
611 int idx = hppvi_index(cs);
612 uint64_t value = INTID_SPURIOUS;
613
614 if (idx >= 0) {
615 uint64_t lr = cs->ich_lr_el2[idx];
616 int thisgrp = (lr & ICH_LR_EL2_GROUP) ? GICV3_G1NS : GICV3_G0;
617
618 if (grp == thisgrp) {
619 value = ich_lr_vintid(lr);
620 }
621 }
622
623 trace_gicv3_icv_hppir_read(grp, gicv3_redist_affid(cs), value);
624 return value;
625 }
626
icv_activate_irq(GICv3CPUState * cs,int idx,int grp)627 static void icv_activate_irq(GICv3CPUState *cs, int idx, int grp)
628 {
629 /* Activate the interrupt in the specified list register
630 * by moving it from Pending to Active state, and update the
631 * Active Priority Registers.
632 */
633 uint32_t mask = icv_gprio_mask(cs, grp);
634 int prio = ich_lr_prio(cs->ich_lr_el2[idx]) & mask;
635 int aprbit = prio >> (8 - cs->vprebits);
636 int regno = aprbit / 32;
637 int regbit = aprbit % 32;
638
639 cs->ich_lr_el2[idx] &= ~ICH_LR_EL2_STATE_PENDING_BIT;
640 cs->ich_lr_el2[idx] |= ICH_LR_EL2_STATE_ACTIVE_BIT;
641 cs->ich_apr[grp][regno] |= (1 << regbit);
642 }
643
icv_iar_read(CPUARMState * env,const ARMCPRegInfo * ri)644 static uint64_t icv_iar_read(CPUARMState *env, const ARMCPRegInfo *ri)
645 {
646 GICv3CPUState *cs = icc_cs_from_env(env);
647 int grp = ri->crm == 8 ? GICV3_G0 : GICV3_G1NS;
648 int idx = hppvi_index(cs);
649 uint64_t intid = INTID_SPURIOUS;
650
651 if (idx >= 0) {
652 uint64_t lr = cs->ich_lr_el2[idx];
653 int thisgrp = (lr & ICH_LR_EL2_GROUP) ? GICV3_G1NS : GICV3_G0;
654
655 if (thisgrp == grp && icv_hppi_can_preempt(cs, lr)) {
656 intid = ich_lr_vintid(lr);
657 if (!gicv3_intid_is_special(intid)) {
658 icv_activate_irq(cs, idx, grp);
659 } else {
660 /* Interrupt goes from Pending to Invalid */
661 cs->ich_lr_el2[idx] &= ~ICH_LR_EL2_STATE_PENDING_BIT;
662 /* We will now return the (bogus) ID from the list register,
663 * as per the pseudocode.
664 */
665 }
666 }
667 }
668
669 trace_gicv3_icv_iar_read(ri->crm == 8 ? 0 : 1,
670 gicv3_redist_affid(cs), intid);
671
672 gicv3_cpuif_virt_update(cs);
673
674 return intid;
675 }
676
icc_highest_active_prio(GICv3CPUState * cs)677 static int icc_highest_active_prio(GICv3CPUState *cs)
678 {
679 /* Calculate the current running priority based on the set bits
680 * in the Active Priority Registers.
681 */
682 int i;
683
684 for (i = 0; i < ARRAY_SIZE(cs->icc_apr[0]); i++) {
685 uint32_t apr = cs->icc_apr[GICV3_G0][i] |
686 cs->icc_apr[GICV3_G1][i] | cs->icc_apr[GICV3_G1NS][i];
687
688 if (!apr) {
689 continue;
690 }
691 return (i * 32 + ctz32(apr)) << (GIC_MIN_BPR + 1);
692 }
693 /* No current active interrupts: return idle priority */
694 return 0xff;
695 }
696
icc_gprio_mask(GICv3CPUState * cs,int group)697 static uint32_t icc_gprio_mask(GICv3CPUState *cs, int group)
698 {
699 /* Return a mask word which clears the subpriority bits from
700 * a priority value for an interrupt in the specified group.
701 * This depends on the BPR value. For CBPR0 (S or NS):
702 * a BPR of 0 means the group priority bits are [7:1];
703 * a BPR of 1 means they are [7:2], and so on down to
704 * a BPR of 7 meaning no group priority bits at all.
705 * For CBPR1 NS:
706 * a BPR of 0 is impossible (the minimum value is 1)
707 * a BPR of 1 means the group priority bits are [7:1];
708 * a BPR of 2 means they are [7:2], and so on down to
709 * a BPR of 7 meaning the group priority is [7].
710 *
711 * Which BPR to use depends on the group of the interrupt and
712 * the current ICC_CTLR.CBPR settings.
713 *
714 * This corresponds to the GroupBits() pseudocode.
715 */
716 int bpr;
717
718 if ((group == GICV3_G1 && cs->icc_ctlr_el1[GICV3_S] & ICC_CTLR_EL1_CBPR) ||
719 (group == GICV3_G1NS &&
720 cs->icc_ctlr_el1[GICV3_NS] & ICC_CTLR_EL1_CBPR)) {
721 group = GICV3_G0;
722 }
723
724 bpr = cs->icc_bpr[group] & 7;
725
726 if (group == GICV3_G1NS) {
727 assert(bpr > 0);
728 bpr--;
729 }
730
731 return ~0U << (bpr + 1);
732 }
733
icc_no_enabled_hppi(GICv3CPUState * cs)734 static bool icc_no_enabled_hppi(GICv3CPUState *cs)
735 {
736 /* Return true if there is no pending interrupt, or the
737 * highest priority pending interrupt is in a group which has been
738 * disabled at the CPU interface by the ICC_IGRPEN* register enable bits.
739 */
740 return cs->hppi.prio == 0xff || (cs->icc_igrpen[cs->hppi.grp] == 0);
741 }
742
icc_hppi_can_preempt(GICv3CPUState * cs)743 static bool icc_hppi_can_preempt(GICv3CPUState *cs)
744 {
745 /* Return true if we have a pending interrupt of sufficient
746 * priority to preempt.
747 */
748 int rprio;
749 uint32_t mask;
750
751 if (icc_no_enabled_hppi(cs)) {
752 return false;
753 }
754
755 if (cs->hppi.prio >= cs->icc_pmr_el1) {
756 /* Priority mask masks this interrupt */
757 return false;
758 }
759
760 rprio = icc_highest_active_prio(cs);
761 if (rprio == 0xff) {
762 /* No currently running interrupt so we can preempt */
763 return true;
764 }
765
766 mask = icc_gprio_mask(cs, cs->hppi.grp);
767
768 /* We only preempt a running interrupt if the pending interrupt's
769 * group priority is sufficient (the subpriorities are not considered).
770 */
771 if ((cs->hppi.prio & mask) < (rprio & mask)) {
772 return true;
773 }
774
775 return false;
776 }
777
gicv3_cpuif_update(GICv3CPUState * cs)778 void gicv3_cpuif_update(GICv3CPUState *cs)
779 {
780 /* Tell the CPU about its highest priority pending interrupt */
781 int irqlevel = 0;
782 int fiqlevel = 0;
783 ARMCPU *cpu = ARM_CPU(cs->cpu);
784 CPUARMState *env = &cpu->env;
785
786 g_assert(qemu_mutex_iothread_locked());
787
788 trace_gicv3_cpuif_update(gicv3_redist_affid(cs), cs->hppi.irq,
789 cs->hppi.grp, cs->hppi.prio);
790
791 if (cs->hppi.grp == GICV3_G1 && !arm_feature(env, ARM_FEATURE_EL3)) {
792 /* If a Security-enabled GIC sends a G1S interrupt to a
793 * Security-disabled CPU, we must treat it as if it were G0.
794 */
795 cs->hppi.grp = GICV3_G0;
796 }
797
798 if (icc_hppi_can_preempt(cs)) {
799 /* We have an interrupt: should we signal it as IRQ or FIQ?
800 * This is described in the GICv3 spec section 4.6.2.
801 */
802 bool isfiq;
803
804 switch (cs->hppi.grp) {
805 case GICV3_G0:
806 isfiq = true;
807 break;
808 case GICV3_G1:
809 isfiq = (!arm_is_secure(env) ||
810 (arm_current_el(env) == 3 && arm_el_is_aa64(env, 3)));
811 break;
812 case GICV3_G1NS:
813 isfiq = arm_is_secure(env);
814 break;
815 default:
816 g_assert_not_reached();
817 }
818
819 if (isfiq) {
820 fiqlevel = 1;
821 } else {
822 irqlevel = 1;
823 }
824 }
825
826 trace_gicv3_cpuif_set_irqs(gicv3_redist_affid(cs), fiqlevel, irqlevel);
827
828 qemu_set_irq(cs->parent_fiq, fiqlevel);
829 qemu_set_irq(cs->parent_irq, irqlevel);
830 }
831
icc_pmr_read(CPUARMState * env,const ARMCPRegInfo * ri)832 static uint64_t icc_pmr_read(CPUARMState *env, const ARMCPRegInfo *ri)
833 {
834 GICv3CPUState *cs = icc_cs_from_env(env);
835 uint32_t value = cs->icc_pmr_el1;
836
837 if (icv_access(env, HCR_FMO | HCR_IMO)) {
838 return icv_pmr_read(env, ri);
839 }
840
841 if (arm_feature(env, ARM_FEATURE_EL3) && !arm_is_secure(env) &&
842 (env->cp15.scr_el3 & SCR_FIQ)) {
843 /* NS access and Group 0 is inaccessible to NS: return the
844 * NS view of the current priority
845 */
846 if ((value & 0x80) == 0) {
847 /* Secure priorities not visible to NS */
848 value = 0;
849 } else if (value != 0xff) {
850 value = (value << 1) & 0xff;
851 }
852 }
853
854 trace_gicv3_icc_pmr_read(gicv3_redist_affid(cs), value);
855
856 return value;
857 }
858
icc_pmr_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)859 static void icc_pmr_write(CPUARMState *env, const ARMCPRegInfo *ri,
860 uint64_t value)
861 {
862 GICv3CPUState *cs = icc_cs_from_env(env);
863
864 if (icv_access(env, HCR_FMO | HCR_IMO)) {
865 return icv_pmr_write(env, ri, value);
866 }
867
868 trace_gicv3_icc_pmr_write(gicv3_redist_affid(cs), value);
869
870 value &= 0xff;
871
872 if (arm_feature(env, ARM_FEATURE_EL3) && !arm_is_secure(env) &&
873 (env->cp15.scr_el3 & SCR_FIQ)) {
874 /* NS access and Group 0 is inaccessible to NS: return the
875 * NS view of the current priority
876 */
877 if (!(cs->icc_pmr_el1 & 0x80)) {
878 /* Current PMR in the secure range, don't allow NS to change it */
879 return;
880 }
881 value = (value >> 1) | 0x80;
882 }
883 cs->icc_pmr_el1 = value;
884 gicv3_cpuif_update(cs);
885 }
886
icc_activate_irq(GICv3CPUState * cs,int irq)887 static void icc_activate_irq(GICv3CPUState *cs, int irq)
888 {
889 /* Move the interrupt from the Pending state to Active, and update
890 * the Active Priority Registers
891 */
892 uint32_t mask = icc_gprio_mask(cs, cs->hppi.grp);
893 int prio = cs->hppi.prio & mask;
894 int aprbit = prio >> 1;
895 int regno = aprbit / 32;
896 int regbit = aprbit % 32;
897
898 cs->icc_apr[cs->hppi.grp][regno] |= (1 << regbit);
899
900 if (irq < GIC_INTERNAL) {
901 cs->gicr_iactiver0 = deposit32(cs->gicr_iactiver0, irq, 1, 1);
902 cs->gicr_ipendr0 = deposit32(cs->gicr_ipendr0, irq, 1, 0);
903 gicv3_redist_update(cs);
904 } else if (irq < GICV3_LPI_INTID_START) {
905 gicv3_gicd_active_set(cs->gic, irq);
906 gicv3_gicd_pending_clear(cs->gic, irq);
907 gicv3_update(cs->gic, irq, 1);
908 } else {
909 gicv3_redist_lpi_pending(cs, irq, 0);
910 }
911 }
912
icc_hppir0_value(GICv3CPUState * cs,CPUARMState * env)913 static uint64_t icc_hppir0_value(GICv3CPUState *cs, CPUARMState *env)
914 {
915 /* Return the highest priority pending interrupt register value
916 * for group 0.
917 */
918 bool irq_is_secure;
919
920 if (cs->hppi.prio == 0xff) {
921 return INTID_SPURIOUS;
922 }
923
924 /* Check whether we can return the interrupt or if we should return
925 * a special identifier, as per the CheckGroup0ForSpecialIdentifiers
926 * pseudocode. (We can simplify a little because for us ICC_SRE_EL1.RM
927 * is always zero.)
928 */
929 irq_is_secure = (!(cs->gic->gicd_ctlr & GICD_CTLR_DS) &&
930 (cs->hppi.grp != GICV3_G1NS));
931
932 if (cs->hppi.grp != GICV3_G0 && !arm_is_el3_or_mon(env)) {
933 return INTID_SPURIOUS;
934 }
935 if (irq_is_secure && !arm_is_secure(env)) {
936 /* Secure interrupts not visible to Nonsecure */
937 return INTID_SPURIOUS;
938 }
939
940 if (cs->hppi.grp != GICV3_G0) {
941 /* Indicate to EL3 that there's a Group 1 interrupt for the other
942 * state pending.
943 */
944 return irq_is_secure ? INTID_SECURE : INTID_NONSECURE;
945 }
946
947 return cs->hppi.irq;
948 }
949
icc_hppir1_value(GICv3CPUState * cs,CPUARMState * env)950 static uint64_t icc_hppir1_value(GICv3CPUState *cs, CPUARMState *env)
951 {
952 /* Return the highest priority pending interrupt register value
953 * for group 1.
954 */
955 bool irq_is_secure;
956
957 if (cs->hppi.prio == 0xff) {
958 return INTID_SPURIOUS;
959 }
960
961 /* Check whether we can return the interrupt or if we should return
962 * a special identifier, as per the CheckGroup1ForSpecialIdentifiers
963 * pseudocode. (We can simplify a little because for us ICC_SRE_EL1.RM
964 * is always zero.)
965 */
966 irq_is_secure = (!(cs->gic->gicd_ctlr & GICD_CTLR_DS) &&
967 (cs->hppi.grp != GICV3_G1NS));
968
969 if (cs->hppi.grp == GICV3_G0) {
970 /* Group 0 interrupts not visible via HPPIR1 */
971 return INTID_SPURIOUS;
972 }
973 if (irq_is_secure) {
974 if (!arm_is_secure(env)) {
975 /* Secure interrupts not visible in Non-secure */
976 return INTID_SPURIOUS;
977 }
978 } else if (!arm_is_el3_or_mon(env) && arm_is_secure(env)) {
979 /* Group 1 non-secure interrupts not visible in Secure EL1 */
980 return INTID_SPURIOUS;
981 }
982
983 return cs->hppi.irq;
984 }
985
icc_iar0_read(CPUARMState * env,const ARMCPRegInfo * ri)986 static uint64_t icc_iar0_read(CPUARMState *env, const ARMCPRegInfo *ri)
987 {
988 GICv3CPUState *cs = icc_cs_from_env(env);
989 uint64_t intid;
990
991 if (icv_access(env, HCR_FMO)) {
992 return icv_iar_read(env, ri);
993 }
994
995 if (!icc_hppi_can_preempt(cs)) {
996 intid = INTID_SPURIOUS;
997 } else {
998 intid = icc_hppir0_value(cs, env);
999 }
1000
1001 if (!gicv3_intid_is_special(intid)) {
1002 icc_activate_irq(cs, intid);
1003 }
1004
1005 trace_gicv3_icc_iar0_read(gicv3_redist_affid(cs), intid);
1006 return intid;
1007 }
1008
icc_iar1_read(CPUARMState * env,const ARMCPRegInfo * ri)1009 static uint64_t icc_iar1_read(CPUARMState *env, const ARMCPRegInfo *ri)
1010 {
1011 GICv3CPUState *cs = icc_cs_from_env(env);
1012 uint64_t intid;
1013
1014 if (icv_access(env, HCR_IMO)) {
1015 return icv_iar_read(env, ri);
1016 }
1017
1018 if (!icc_hppi_can_preempt(cs)) {
1019 intid = INTID_SPURIOUS;
1020 } else {
1021 intid = icc_hppir1_value(cs, env);
1022 }
1023
1024 if (!gicv3_intid_is_special(intid)) {
1025 icc_activate_irq(cs, intid);
1026 }
1027
1028 trace_gicv3_icc_iar1_read(gicv3_redist_affid(cs), intid);
1029 return intid;
1030 }
1031
icc_drop_prio(GICv3CPUState * cs,int grp)1032 static void icc_drop_prio(GICv3CPUState *cs, int grp)
1033 {
1034 /* Drop the priority of the currently active interrupt in
1035 * the specified group.
1036 *
1037 * Note that we can guarantee (because of the requirement to nest
1038 * ICC_IAR reads [which activate an interrupt and raise priority]
1039 * with ICC_EOIR writes [which drop the priority for the interrupt])
1040 * that the interrupt we're being called for is the highest priority
1041 * active interrupt, meaning that it has the lowest set bit in the
1042 * APR registers.
1043 *
1044 * If the guest does not honour the ordering constraints then the
1045 * behaviour of the GIC is UNPREDICTABLE, which for us means that
1046 * the values of the APR registers might become incorrect and the
1047 * running priority will be wrong, so interrupts that should preempt
1048 * might not do so, and interrupts that should not preempt might do so.
1049 */
1050 int i;
1051
1052 for (i = 0; i < ARRAY_SIZE(cs->icc_apr[grp]); i++) {
1053 uint64_t *papr = &cs->icc_apr[grp][i];
1054
1055 if (!*papr) {
1056 continue;
1057 }
1058 /* Clear the lowest set bit */
1059 *papr &= *papr - 1;
1060 break;
1061 }
1062
1063 /* running priority change means we need an update for this cpu i/f */
1064 gicv3_cpuif_update(cs);
1065 }
1066
icc_eoi_split(CPUARMState * env,GICv3CPUState * cs)1067 static bool icc_eoi_split(CPUARMState *env, GICv3CPUState *cs)
1068 {
1069 /* Return true if we should split priority drop and interrupt
1070 * deactivation, ie whether the relevant EOIMode bit is set.
1071 */
1072 if (arm_is_el3_or_mon(env)) {
1073 return cs->icc_ctlr_el3 & ICC_CTLR_EL3_EOIMODE_EL3;
1074 }
1075 if (arm_is_secure_below_el3(env)) {
1076 return cs->icc_ctlr_el1[GICV3_S] & ICC_CTLR_EL1_EOIMODE;
1077 } else {
1078 return cs->icc_ctlr_el1[GICV3_NS] & ICC_CTLR_EL1_EOIMODE;
1079 }
1080 }
1081
icc_highest_active_group(GICv3CPUState * cs)1082 static int icc_highest_active_group(GICv3CPUState *cs)
1083 {
1084 /* Return the group with the highest priority active interrupt.
1085 * We can do this by just comparing the APRs to see which one
1086 * has the lowest set bit.
1087 * (If more than one group is active at the same priority then
1088 * we're in UNPREDICTABLE territory.)
1089 */
1090 int i;
1091
1092 for (i = 0; i < ARRAY_SIZE(cs->icc_apr[0]); i++) {
1093 int g0ctz = ctz32(cs->icc_apr[GICV3_G0][i]);
1094 int g1ctz = ctz32(cs->icc_apr[GICV3_G1][i]);
1095 int g1nsctz = ctz32(cs->icc_apr[GICV3_G1NS][i]);
1096
1097 if (g1nsctz < g0ctz && g1nsctz < g1ctz) {
1098 return GICV3_G1NS;
1099 }
1100 if (g1ctz < g0ctz) {
1101 return GICV3_G1;
1102 }
1103 if (g0ctz < 32) {
1104 return GICV3_G0;
1105 }
1106 }
1107 /* No set active bits? UNPREDICTABLE; return -1 so the caller
1108 * ignores the spurious EOI attempt.
1109 */
1110 return -1;
1111 }
1112
icc_deactivate_irq(GICv3CPUState * cs,int irq)1113 static void icc_deactivate_irq(GICv3CPUState *cs, int irq)
1114 {
1115 if (irq < GIC_INTERNAL) {
1116 cs->gicr_iactiver0 = deposit32(cs->gicr_iactiver0, irq, 1, 0);
1117 gicv3_redist_update(cs);
1118 } else {
1119 gicv3_gicd_active_clear(cs->gic, irq);
1120 gicv3_update(cs->gic, irq, 1);
1121 }
1122 }
1123
icv_eoi_split(CPUARMState * env,GICv3CPUState * cs)1124 static bool icv_eoi_split(CPUARMState *env, GICv3CPUState *cs)
1125 {
1126 /* Return true if we should split priority drop and interrupt
1127 * deactivation, ie whether the virtual EOIMode bit is set.
1128 */
1129 return cs->ich_vmcr_el2 & ICH_VMCR_EL2_VEOIM;
1130 }
1131
icv_find_active(GICv3CPUState * cs,int irq)1132 static int icv_find_active(GICv3CPUState *cs, int irq)
1133 {
1134 /* Given an interrupt number for an active interrupt, return the index
1135 * of the corresponding list register, or -1 if there is no match.
1136 * Corresponds to FindActiveVirtualInterrupt pseudocode.
1137 */
1138 int i;
1139
1140 for (i = 0; i < cs->num_list_regs; i++) {
1141 uint64_t lr = cs->ich_lr_el2[i];
1142
1143 if ((lr & ICH_LR_EL2_STATE_ACTIVE_BIT) && ich_lr_vintid(lr) == irq) {
1144 return i;
1145 }
1146 }
1147
1148 return -1;
1149 }
1150
icv_deactivate_irq(GICv3CPUState * cs,int idx)1151 static void icv_deactivate_irq(GICv3CPUState *cs, int idx)
1152 {
1153 /* Deactivate the interrupt in the specified list register index */
1154 uint64_t lr = cs->ich_lr_el2[idx];
1155
1156 if (lr & ICH_LR_EL2_HW) {
1157 /* Deactivate the associated physical interrupt */
1158 int pirq = ich_lr_pintid(lr);
1159
1160 if (pirq < INTID_SECURE) {
1161 icc_deactivate_irq(cs, pirq);
1162 }
1163 }
1164
1165 /* Clear the 'active' part of the state, so ActivePending->Pending
1166 * and Active->Invalid.
1167 */
1168 lr &= ~ICH_LR_EL2_STATE_ACTIVE_BIT;
1169 cs->ich_lr_el2[idx] = lr;
1170 }
1171
icv_increment_eoicount(GICv3CPUState * cs)1172 static void icv_increment_eoicount(GICv3CPUState *cs)
1173 {
1174 /* Increment the EOICOUNT field in ICH_HCR_EL2 */
1175 int eoicount = extract64(cs->ich_hcr_el2, ICH_HCR_EL2_EOICOUNT_SHIFT,
1176 ICH_HCR_EL2_EOICOUNT_LENGTH);
1177
1178 cs->ich_hcr_el2 = deposit64(cs->ich_hcr_el2, ICH_HCR_EL2_EOICOUNT_SHIFT,
1179 ICH_HCR_EL2_EOICOUNT_LENGTH, eoicount + 1);
1180 }
1181
icv_drop_prio(GICv3CPUState * cs)1182 static int icv_drop_prio(GICv3CPUState *cs)
1183 {
1184 /* Drop the priority of the currently active virtual interrupt
1185 * (favouring group 0 if there is a set active bit at
1186 * the same priority for both group 0 and group 1).
1187 * Return the priority value for the bit we just cleared,
1188 * or 0xff if no bits were set in the AP registers at all.
1189 * Note that though the ich_apr[] are uint64_t only the low
1190 * 32 bits are actually relevant.
1191 */
1192 int i;
1193 int aprmax = 1 << (cs->vprebits - 5);
1194
1195 assert(aprmax <= ARRAY_SIZE(cs->ich_apr[0]));
1196
1197 for (i = 0; i < aprmax; i++) {
1198 uint64_t *papr0 = &cs->ich_apr[GICV3_G0][i];
1199 uint64_t *papr1 = &cs->ich_apr[GICV3_G1NS][i];
1200 int apr0count, apr1count;
1201
1202 if (!*papr0 && !*papr1) {
1203 continue;
1204 }
1205
1206 /* We can't just use the bit-twiddling hack icc_drop_prio() does
1207 * because we need to return the bit number we cleared so
1208 * it can be compared against the list register's priority field.
1209 */
1210 apr0count = ctz32(*papr0);
1211 apr1count = ctz32(*papr1);
1212
1213 if (apr0count <= apr1count) {
1214 *papr0 &= *papr0 - 1;
1215 return (apr0count + i * 32) << (icv_min_vbpr(cs) + 1);
1216 } else {
1217 *papr1 &= *papr1 - 1;
1218 return (apr1count + i * 32) << (icv_min_vbpr(cs) + 1);
1219 }
1220 }
1221 return 0xff;
1222 }
1223
icv_dir_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)1224 static void icv_dir_write(CPUARMState *env, const ARMCPRegInfo *ri,
1225 uint64_t value)
1226 {
1227 /* Deactivate interrupt */
1228 GICv3CPUState *cs = icc_cs_from_env(env);
1229 int idx;
1230 int irq = value & 0xffffff;
1231
1232 trace_gicv3_icv_dir_write(gicv3_redist_affid(cs), value);
1233
1234 if (irq >= GICV3_MAXIRQ) {
1235 /* Also catches special interrupt numbers and LPIs */
1236 return;
1237 }
1238
1239 if (!icv_eoi_split(env, cs)) {
1240 return;
1241 }
1242
1243 idx = icv_find_active(cs, irq);
1244
1245 if (idx < 0) {
1246 /* No list register matching this, so increment the EOI count
1247 * (might trigger a maintenance interrupt)
1248 */
1249 icv_increment_eoicount(cs);
1250 } else {
1251 icv_deactivate_irq(cs, idx);
1252 }
1253
1254 gicv3_cpuif_virt_update(cs);
1255 }
1256
icv_eoir_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)1257 static void icv_eoir_write(CPUARMState *env, const ARMCPRegInfo *ri,
1258 uint64_t value)
1259 {
1260 /* End of Interrupt */
1261 GICv3CPUState *cs = icc_cs_from_env(env);
1262 int irq = value & 0xffffff;
1263 int grp = ri->crm == 8 ? GICV3_G0 : GICV3_G1NS;
1264 int idx, dropprio;
1265
1266 trace_gicv3_icv_eoir_write(ri->crm == 8 ? 0 : 1,
1267 gicv3_redist_affid(cs), value);
1268
1269 if (gicv3_intid_is_special(irq)) {
1270 return;
1271 }
1272
1273 /* We implement the IMPDEF choice of "drop priority before doing
1274 * error checks" (because that lets us avoid scanning the AP
1275 * registers twice).
1276 */
1277 dropprio = icv_drop_prio(cs);
1278 if (dropprio == 0xff) {
1279 /* No active interrupt. It is CONSTRAINED UNPREDICTABLE
1280 * whether the list registers are checked in this
1281 * situation; we choose not to.
1282 */
1283 return;
1284 }
1285
1286 idx = icv_find_active(cs, irq);
1287
1288 if (idx < 0) {
1289 /* No valid list register corresponding to EOI ID */
1290 icv_increment_eoicount(cs);
1291 } else {
1292 uint64_t lr = cs->ich_lr_el2[idx];
1293 int thisgrp = (lr & ICH_LR_EL2_GROUP) ? GICV3_G1NS : GICV3_G0;
1294 int lr_gprio = ich_lr_prio(lr) & icv_gprio_mask(cs, grp);
1295
1296 if (thisgrp == grp && lr_gprio == dropprio) {
1297 if (!icv_eoi_split(env, cs)) {
1298 /* Priority drop and deactivate not split: deactivate irq now */
1299 icv_deactivate_irq(cs, idx);
1300 }
1301 }
1302 }
1303
1304 gicv3_cpuif_virt_update(cs);
1305 }
1306
icc_eoir_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)1307 static void icc_eoir_write(CPUARMState *env, const ARMCPRegInfo *ri,
1308 uint64_t value)
1309 {
1310 /* End of Interrupt */
1311 GICv3CPUState *cs = icc_cs_from_env(env);
1312 int irq = value & 0xffffff;
1313 int grp;
1314 bool is_eoir0 = ri->crm == 8;
1315
1316 if (icv_access(env, is_eoir0 ? HCR_FMO : HCR_IMO)) {
1317 icv_eoir_write(env, ri, value);
1318 return;
1319 }
1320
1321 trace_gicv3_icc_eoir_write(is_eoir0 ? 0 : 1,
1322 gicv3_redist_affid(cs), value);
1323
1324 if ((irq >= cs->gic->num_irq) &&
1325 !(cs->gic->lpi_enable && (irq >= GICV3_LPI_INTID_START))) {
1326 /* This handles two cases:
1327 * 1. If software writes the ID of a spurious interrupt [ie 1020-1023]
1328 * to the GICC_EOIR, the GIC ignores that write.
1329 * 2. If software writes the number of a non-existent interrupt
1330 * this must be a subcase of "value written does not match the last
1331 * valid interrupt value read from the Interrupt Acknowledge
1332 * register" and so this is UNPREDICTABLE. We choose to ignore it.
1333 */
1334 return;
1335 }
1336
1337 grp = icc_highest_active_group(cs);
1338 switch (grp) {
1339 case GICV3_G0:
1340 if (!is_eoir0) {
1341 return;
1342 }
1343 if (!(cs->gic->gicd_ctlr & GICD_CTLR_DS)
1344 && arm_feature(env, ARM_FEATURE_EL3) && !arm_is_secure(env)) {
1345 return;
1346 }
1347 break;
1348 case GICV3_G1:
1349 if (is_eoir0) {
1350 return;
1351 }
1352 if (!arm_is_secure(env)) {
1353 return;
1354 }
1355 break;
1356 case GICV3_G1NS:
1357 if (is_eoir0) {
1358 return;
1359 }
1360 if (!arm_is_el3_or_mon(env) && arm_is_secure(env)) {
1361 return;
1362 }
1363 break;
1364 default:
1365 qemu_log_mask(LOG_GUEST_ERROR,
1366 "%s: IRQ %d isn't active\n", __func__, irq);
1367 return;
1368 }
1369
1370 icc_drop_prio(cs, grp);
1371
1372 if (!icc_eoi_split(env, cs)) {
1373 /* Priority drop and deactivate not split: deactivate irq now */
1374 icc_deactivate_irq(cs, irq);
1375 }
1376 }
1377
icc_hppir0_read(CPUARMState * env,const ARMCPRegInfo * ri)1378 static uint64_t icc_hppir0_read(CPUARMState *env, const ARMCPRegInfo *ri)
1379 {
1380 GICv3CPUState *cs = icc_cs_from_env(env);
1381 uint64_t value;
1382
1383 if (icv_access(env, HCR_FMO)) {
1384 return icv_hppir_read(env, ri);
1385 }
1386
1387 value = icc_hppir0_value(cs, env);
1388 trace_gicv3_icc_hppir0_read(gicv3_redist_affid(cs), value);
1389 return value;
1390 }
1391
icc_hppir1_read(CPUARMState * env,const ARMCPRegInfo * ri)1392 static uint64_t icc_hppir1_read(CPUARMState *env, const ARMCPRegInfo *ri)
1393 {
1394 GICv3CPUState *cs = icc_cs_from_env(env);
1395 uint64_t value;
1396
1397 if (icv_access(env, HCR_IMO)) {
1398 return icv_hppir_read(env, ri);
1399 }
1400
1401 value = icc_hppir1_value(cs, env);
1402 trace_gicv3_icc_hppir1_read(gicv3_redist_affid(cs), value);
1403 return value;
1404 }
1405
icc_bpr_read(CPUARMState * env,const ARMCPRegInfo * ri)1406 static uint64_t icc_bpr_read(CPUARMState *env, const ARMCPRegInfo *ri)
1407 {
1408 GICv3CPUState *cs = icc_cs_from_env(env);
1409 int grp = (ri->crm == 8) ? GICV3_G0 : GICV3_G1;
1410 bool satinc = false;
1411 uint64_t bpr;
1412
1413 if (icv_access(env, grp == GICV3_G0 ? HCR_FMO : HCR_IMO)) {
1414 return icv_bpr_read(env, ri);
1415 }
1416
1417 if (grp == GICV3_G1 && gicv3_use_ns_bank(env)) {
1418 grp = GICV3_G1NS;
1419 }
1420
1421 if (grp == GICV3_G1 && !arm_is_el3_or_mon(env) &&
1422 (cs->icc_ctlr_el1[GICV3_S] & ICC_CTLR_EL1_CBPR)) {
1423 /* CBPR_EL1S means secure EL1 or AArch32 EL3 !Mon BPR1 accesses
1424 * modify BPR0
1425 */
1426 grp = GICV3_G0;
1427 }
1428
1429 if (grp == GICV3_G1NS && arm_current_el(env) < 3 &&
1430 (cs->icc_ctlr_el1[GICV3_NS] & ICC_CTLR_EL1_CBPR)) {
1431 /* reads return bpr0 + 1 sat to 7, writes ignored */
1432 grp = GICV3_G0;
1433 satinc = true;
1434 }
1435
1436 bpr = cs->icc_bpr[grp];
1437 if (satinc) {
1438 bpr++;
1439 bpr = MIN(bpr, 7);
1440 }
1441
1442 trace_gicv3_icc_bpr_read(ri->crm == 8 ? 0 : 1, gicv3_redist_affid(cs), bpr);
1443
1444 return bpr;
1445 }
1446
icc_bpr_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)1447 static void icc_bpr_write(CPUARMState *env, const ARMCPRegInfo *ri,
1448 uint64_t value)
1449 {
1450 GICv3CPUState *cs = icc_cs_from_env(env);
1451 int grp = (ri->crm == 8) ? GICV3_G0 : GICV3_G1;
1452 uint64_t minval;
1453
1454 if (icv_access(env, grp == GICV3_G0 ? HCR_FMO : HCR_IMO)) {
1455 icv_bpr_write(env, ri, value);
1456 return;
1457 }
1458
1459 trace_gicv3_icc_bpr_write(ri->crm == 8 ? 0 : 1,
1460 gicv3_redist_affid(cs), value);
1461
1462 if (grp == GICV3_G1 && gicv3_use_ns_bank(env)) {
1463 grp = GICV3_G1NS;
1464 }
1465
1466 if (grp == GICV3_G1 && !arm_is_el3_or_mon(env) &&
1467 (cs->icc_ctlr_el1[GICV3_S] & ICC_CTLR_EL1_CBPR)) {
1468 /* CBPR_EL1S means secure EL1 or AArch32 EL3 !Mon BPR1 accesses
1469 * modify BPR0
1470 */
1471 grp = GICV3_G0;
1472 }
1473
1474 if (grp == GICV3_G1NS && arm_current_el(env) < 3 &&
1475 (cs->icc_ctlr_el1[GICV3_NS] & ICC_CTLR_EL1_CBPR)) {
1476 /* reads return bpr0 + 1 sat to 7, writes ignored */
1477 return;
1478 }
1479
1480 minval = (grp == GICV3_G1NS) ? GIC_MIN_BPR_NS : GIC_MIN_BPR;
1481 if (value < minval) {
1482 value = minval;
1483 }
1484
1485 cs->icc_bpr[grp] = value & 7;
1486 gicv3_cpuif_update(cs);
1487 }
1488
icc_ap_read(CPUARMState * env,const ARMCPRegInfo * ri)1489 static uint64_t icc_ap_read(CPUARMState *env, const ARMCPRegInfo *ri)
1490 {
1491 GICv3CPUState *cs = icc_cs_from_env(env);
1492 uint64_t value;
1493
1494 int regno = ri->opc2 & 3;
1495 int grp = (ri->crm & 1) ? GICV3_G1 : GICV3_G0;
1496
1497 if (icv_access(env, grp == GICV3_G0 ? HCR_FMO : HCR_IMO)) {
1498 return icv_ap_read(env, ri);
1499 }
1500
1501 if (grp == GICV3_G1 && gicv3_use_ns_bank(env)) {
1502 grp = GICV3_G1NS;
1503 }
1504
1505 value = cs->icc_apr[grp][regno];
1506
1507 trace_gicv3_icc_ap_read(ri->crm & 1, regno, gicv3_redist_affid(cs), value);
1508 return value;
1509 }
1510
icc_ap_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)1511 static void icc_ap_write(CPUARMState *env, const ARMCPRegInfo *ri,
1512 uint64_t value)
1513 {
1514 GICv3CPUState *cs = icc_cs_from_env(env);
1515
1516 int regno = ri->opc2 & 3;
1517 int grp = (ri->crm & 1) ? GICV3_G1 : GICV3_G0;
1518
1519 if (icv_access(env, grp == GICV3_G0 ? HCR_FMO : HCR_IMO)) {
1520 icv_ap_write(env, ri, value);
1521 return;
1522 }
1523
1524 trace_gicv3_icc_ap_write(ri->crm & 1, regno, gicv3_redist_affid(cs), value);
1525
1526 if (grp == GICV3_G1 && gicv3_use_ns_bank(env)) {
1527 grp = GICV3_G1NS;
1528 }
1529
1530 /* It's not possible to claim that a Non-secure interrupt is active
1531 * at a priority outside the Non-secure range (128..255), since this
1532 * would otherwise allow malicious NS code to block delivery of S interrupts
1533 * by writing a bad value to these registers.
1534 */
1535 if (grp == GICV3_G1NS && regno < 2 && arm_feature(env, ARM_FEATURE_EL3)) {
1536 return;
1537 }
1538
1539 cs->icc_apr[grp][regno] = value & 0xFFFFFFFFU;
1540 gicv3_cpuif_update(cs);
1541 }
1542
icc_dir_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)1543 static void icc_dir_write(CPUARMState *env, const ARMCPRegInfo *ri,
1544 uint64_t value)
1545 {
1546 /* Deactivate interrupt */
1547 GICv3CPUState *cs = icc_cs_from_env(env);
1548 int irq = value & 0xffffff;
1549 bool irq_is_secure, single_sec_state, irq_is_grp0;
1550 bool route_fiq_to_el3, route_irq_to_el3, route_fiq_to_el2, route_irq_to_el2;
1551
1552 if (icv_access(env, HCR_FMO | HCR_IMO)) {
1553 icv_dir_write(env, ri, value);
1554 return;
1555 }
1556
1557 trace_gicv3_icc_dir_write(gicv3_redist_affid(cs), value);
1558
1559 if (irq >= cs->gic->num_irq) {
1560 /* Also catches special interrupt numbers and LPIs */
1561 return;
1562 }
1563
1564 if (!icc_eoi_split(env, cs)) {
1565 return;
1566 }
1567
1568 int grp = gicv3_irq_group(cs->gic, cs, irq);
1569
1570 single_sec_state = cs->gic->gicd_ctlr & GICD_CTLR_DS;
1571 irq_is_secure = !single_sec_state && (grp != GICV3_G1NS);
1572 irq_is_grp0 = grp == GICV3_G0;
1573
1574 /* Check whether we're allowed to deactivate this interrupt based
1575 * on its group and the current CPU state.
1576 * These checks are laid out to correspond to the spec's pseudocode.
1577 */
1578 route_fiq_to_el3 = env->cp15.scr_el3 & SCR_FIQ;
1579 route_irq_to_el3 = env->cp15.scr_el3 & SCR_IRQ;
1580 /* No need to include !IsSecure in route_*_to_el2 as it's only
1581 * tested in cases where we know !IsSecure is true.
1582 */
1583 uint64_t hcr_el2 = arm_hcr_el2_eff(env);
1584 route_fiq_to_el2 = hcr_el2 & HCR_FMO;
1585 route_irq_to_el2 = hcr_el2 & HCR_IMO;
1586
1587 switch (arm_current_el(env)) {
1588 case 3:
1589 break;
1590 case 2:
1591 if (single_sec_state && irq_is_grp0 && !route_fiq_to_el3) {
1592 break;
1593 }
1594 if (!irq_is_secure && !irq_is_grp0 && !route_irq_to_el3) {
1595 break;
1596 }
1597 return;
1598 case 1:
1599 if (!arm_is_secure_below_el3(env)) {
1600 if (single_sec_state && irq_is_grp0 &&
1601 !route_fiq_to_el3 && !route_fiq_to_el2) {
1602 break;
1603 }
1604 if (!irq_is_secure && !irq_is_grp0 &&
1605 !route_irq_to_el3 && !route_irq_to_el2) {
1606 break;
1607 }
1608 } else {
1609 if (irq_is_grp0 && !route_fiq_to_el3) {
1610 break;
1611 }
1612 if (!irq_is_grp0 &&
1613 (!irq_is_secure || !single_sec_state) &&
1614 !route_irq_to_el3) {
1615 break;
1616 }
1617 }
1618 return;
1619 default:
1620 g_assert_not_reached();
1621 }
1622
1623 icc_deactivate_irq(cs, irq);
1624 }
1625
icc_rpr_read(CPUARMState * env,const ARMCPRegInfo * ri)1626 static uint64_t icc_rpr_read(CPUARMState *env, const ARMCPRegInfo *ri)
1627 {
1628 GICv3CPUState *cs = icc_cs_from_env(env);
1629 int prio;
1630
1631 if (icv_access(env, HCR_FMO | HCR_IMO)) {
1632 return icv_rpr_read(env, ri);
1633 }
1634
1635 prio = icc_highest_active_prio(cs);
1636
1637 if (arm_feature(env, ARM_FEATURE_EL3) &&
1638 !arm_is_secure(env) && (env->cp15.scr_el3 & SCR_FIQ)) {
1639 /* NS GIC access and Group 0 is inaccessible to NS */
1640 if ((prio & 0x80) == 0) {
1641 /* NS mustn't see priorities in the Secure half of the range */
1642 prio = 0;
1643 } else if (prio != 0xff) {
1644 /* Non-idle priority: show the Non-secure view of it */
1645 prio = (prio << 1) & 0xff;
1646 }
1647 }
1648
1649 trace_gicv3_icc_rpr_read(gicv3_redist_affid(cs), prio);
1650 return prio;
1651 }
1652
icc_generate_sgi(CPUARMState * env,GICv3CPUState * cs,uint64_t value,int grp,bool ns)1653 static void icc_generate_sgi(CPUARMState *env, GICv3CPUState *cs,
1654 uint64_t value, int grp, bool ns)
1655 {
1656 GICv3State *s = cs->gic;
1657
1658 /* Extract Aff3/Aff2/Aff1 and shift into the bottom 24 bits */
1659 uint64_t aff = extract64(value, 48, 8) << 16 |
1660 extract64(value, 32, 8) << 8 |
1661 extract64(value, 16, 8);
1662 uint32_t targetlist = extract64(value, 0, 16);
1663 uint32_t irq = extract64(value, 24, 4);
1664 bool irm = extract64(value, 40, 1);
1665 int i;
1666
1667 if (grp == GICV3_G1 && s->gicd_ctlr & GICD_CTLR_DS) {
1668 /* If GICD_CTLR.DS == 1, the Distributor treats Secure Group 1
1669 * interrupts as Group 0 interrupts and must send Secure Group 0
1670 * interrupts to the target CPUs.
1671 */
1672 grp = GICV3_G0;
1673 }
1674
1675 trace_gicv3_icc_generate_sgi(gicv3_redist_affid(cs), irq, irm,
1676 aff, targetlist);
1677
1678 for (i = 0; i < s->num_cpu; i++) {
1679 GICv3CPUState *ocs = &s->cpu[i];
1680
1681 if (irm) {
1682 /* IRM == 1 : route to all CPUs except self */
1683 if (cs == ocs) {
1684 continue;
1685 }
1686 } else {
1687 /* IRM == 0 : route to Aff3.Aff2.Aff1.n for all n in [0..15]
1688 * where the corresponding bit is set in targetlist
1689 */
1690 int aff0;
1691
1692 if (ocs->gicr_typer >> 40 != aff) {
1693 continue;
1694 }
1695 aff0 = extract64(ocs->gicr_typer, 32, 8);
1696 if (aff0 > 15 || extract32(targetlist, aff0, 1) == 0) {
1697 continue;
1698 }
1699 }
1700
1701 /* The redistributor will check against its own GICR_NSACR as needed */
1702 gicv3_redist_send_sgi(ocs, grp, irq, ns);
1703 }
1704 }
1705
icc_sgi0r_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)1706 static void icc_sgi0r_write(CPUARMState *env, const ARMCPRegInfo *ri,
1707 uint64_t value)
1708 {
1709 /* Generate Secure Group 0 SGI. */
1710 GICv3CPUState *cs = icc_cs_from_env(env);
1711 bool ns = !arm_is_secure(env);
1712
1713 icc_generate_sgi(env, cs, value, GICV3_G0, ns);
1714 }
1715
icc_sgi1r_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)1716 static void icc_sgi1r_write(CPUARMState *env, const ARMCPRegInfo *ri,
1717 uint64_t value)
1718 {
1719 /* Generate Group 1 SGI for the current Security state */
1720 GICv3CPUState *cs = icc_cs_from_env(env);
1721 int grp;
1722 bool ns = !arm_is_secure(env);
1723
1724 grp = ns ? GICV3_G1NS : GICV3_G1;
1725 icc_generate_sgi(env, cs, value, grp, ns);
1726 }
1727
icc_asgi1r_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)1728 static void icc_asgi1r_write(CPUARMState *env, const ARMCPRegInfo *ri,
1729 uint64_t value)
1730 {
1731 /* Generate Group 1 SGI for the Security state that is not
1732 * the current state
1733 */
1734 GICv3CPUState *cs = icc_cs_from_env(env);
1735 int grp;
1736 bool ns = !arm_is_secure(env);
1737
1738 grp = ns ? GICV3_G1 : GICV3_G1NS;
1739 icc_generate_sgi(env, cs, value, grp, ns);
1740 }
1741
icc_igrpen_read(CPUARMState * env,const ARMCPRegInfo * ri)1742 static uint64_t icc_igrpen_read(CPUARMState *env, const ARMCPRegInfo *ri)
1743 {
1744 GICv3CPUState *cs = icc_cs_from_env(env);
1745 int grp = ri->opc2 & 1 ? GICV3_G1 : GICV3_G0;
1746 uint64_t value;
1747
1748 if (icv_access(env, grp == GICV3_G0 ? HCR_FMO : HCR_IMO)) {
1749 return icv_igrpen_read(env, ri);
1750 }
1751
1752 if (grp == GICV3_G1 && gicv3_use_ns_bank(env)) {
1753 grp = GICV3_G1NS;
1754 }
1755
1756 value = cs->icc_igrpen[grp];
1757 trace_gicv3_icc_igrpen_read(ri->opc2 & 1 ? 1 : 0,
1758 gicv3_redist_affid(cs), value);
1759 return value;
1760 }
1761
icc_igrpen_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)1762 static void icc_igrpen_write(CPUARMState *env, const ARMCPRegInfo *ri,
1763 uint64_t value)
1764 {
1765 GICv3CPUState *cs = icc_cs_from_env(env);
1766 int grp = ri->opc2 & 1 ? GICV3_G1 : GICV3_G0;
1767
1768 if (icv_access(env, grp == GICV3_G0 ? HCR_FMO : HCR_IMO)) {
1769 icv_igrpen_write(env, ri, value);
1770 return;
1771 }
1772
1773 trace_gicv3_icc_igrpen_write(ri->opc2 & 1 ? 1 : 0,
1774 gicv3_redist_affid(cs), value);
1775
1776 if (grp == GICV3_G1 && gicv3_use_ns_bank(env)) {
1777 grp = GICV3_G1NS;
1778 }
1779
1780 cs->icc_igrpen[grp] = value & ICC_IGRPEN_ENABLE;
1781 gicv3_cpuif_update(cs);
1782 }
1783
icc_igrpen1_el3_read(CPUARMState * env,const ARMCPRegInfo * ri)1784 static uint64_t icc_igrpen1_el3_read(CPUARMState *env, const ARMCPRegInfo *ri)
1785 {
1786 GICv3CPUState *cs = icc_cs_from_env(env);
1787 uint64_t value;
1788
1789 /* IGRPEN1_EL3 bits 0 and 1 are r/w aliases into IGRPEN1_EL1 NS and S */
1790 value = cs->icc_igrpen[GICV3_G1NS] | (cs->icc_igrpen[GICV3_G1] << 1);
1791 trace_gicv3_icc_igrpen1_el3_read(gicv3_redist_affid(cs), value);
1792 return value;
1793 }
1794
icc_igrpen1_el3_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)1795 static void icc_igrpen1_el3_write(CPUARMState *env, const ARMCPRegInfo *ri,
1796 uint64_t value)
1797 {
1798 GICv3CPUState *cs = icc_cs_from_env(env);
1799
1800 trace_gicv3_icc_igrpen1_el3_write(gicv3_redist_affid(cs), value);
1801
1802 /* IGRPEN1_EL3 bits 0 and 1 are r/w aliases into IGRPEN1_EL1 NS and S */
1803 cs->icc_igrpen[GICV3_G1NS] = extract32(value, 0, 1);
1804 cs->icc_igrpen[GICV3_G1] = extract32(value, 1, 1);
1805 gicv3_cpuif_update(cs);
1806 }
1807
icc_ctlr_el1_read(CPUARMState * env,const ARMCPRegInfo * ri)1808 static uint64_t icc_ctlr_el1_read(CPUARMState *env, const ARMCPRegInfo *ri)
1809 {
1810 GICv3CPUState *cs = icc_cs_from_env(env);
1811 int bank = gicv3_use_ns_bank(env) ? GICV3_NS : GICV3_S;
1812 uint64_t value;
1813
1814 if (icv_access(env, HCR_FMO | HCR_IMO)) {
1815 return icv_ctlr_read(env, ri);
1816 }
1817
1818 value = cs->icc_ctlr_el1[bank];
1819 trace_gicv3_icc_ctlr_read(gicv3_redist_affid(cs), value);
1820 return value;
1821 }
1822
icc_ctlr_el1_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)1823 static void icc_ctlr_el1_write(CPUARMState *env, const ARMCPRegInfo *ri,
1824 uint64_t value)
1825 {
1826 GICv3CPUState *cs = icc_cs_from_env(env);
1827 int bank = gicv3_use_ns_bank(env) ? GICV3_NS : GICV3_S;
1828 uint64_t mask;
1829
1830 if (icv_access(env, HCR_FMO | HCR_IMO)) {
1831 icv_ctlr_write(env, ri, value);
1832 return;
1833 }
1834
1835 trace_gicv3_icc_ctlr_write(gicv3_redist_affid(cs), value);
1836
1837 /* Only CBPR and EOIMODE can be RW;
1838 * for us PMHE is RAZ/WI (we don't implement 1-of-N interrupts or
1839 * the asseciated priority-based routing of them);
1840 * if EL3 is implemented and GICD_CTLR.DS == 0, then PMHE and CBPR are RO.
1841 */
1842 if (arm_feature(env, ARM_FEATURE_EL3) &&
1843 ((cs->gic->gicd_ctlr & GICD_CTLR_DS) == 0)) {
1844 mask = ICC_CTLR_EL1_EOIMODE;
1845 } else {
1846 mask = ICC_CTLR_EL1_CBPR | ICC_CTLR_EL1_EOIMODE;
1847 }
1848
1849 cs->icc_ctlr_el1[bank] &= ~mask;
1850 cs->icc_ctlr_el1[bank] |= (value & mask);
1851 gicv3_cpuif_update(cs);
1852 }
1853
1854
icc_ctlr_el3_read(CPUARMState * env,const ARMCPRegInfo * ri)1855 static uint64_t icc_ctlr_el3_read(CPUARMState *env, const ARMCPRegInfo *ri)
1856 {
1857 GICv3CPUState *cs = icc_cs_from_env(env);
1858 uint64_t value;
1859
1860 value = cs->icc_ctlr_el3;
1861 if (cs->icc_ctlr_el1[GICV3_NS] & ICC_CTLR_EL1_EOIMODE) {
1862 value |= ICC_CTLR_EL3_EOIMODE_EL1NS;
1863 }
1864 if (cs->icc_ctlr_el1[GICV3_NS] & ICC_CTLR_EL1_CBPR) {
1865 value |= ICC_CTLR_EL3_CBPR_EL1NS;
1866 }
1867 if (cs->icc_ctlr_el1[GICV3_NS] & ICC_CTLR_EL1_EOIMODE) {
1868 value |= ICC_CTLR_EL3_EOIMODE_EL1S;
1869 }
1870 if (cs->icc_ctlr_el1[GICV3_NS] & ICC_CTLR_EL1_CBPR) {
1871 value |= ICC_CTLR_EL3_CBPR_EL1S;
1872 }
1873
1874 trace_gicv3_icc_ctlr_el3_read(gicv3_redist_affid(cs), value);
1875 return value;
1876 }
1877
icc_ctlr_el3_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)1878 static void icc_ctlr_el3_write(CPUARMState *env, const ARMCPRegInfo *ri,
1879 uint64_t value)
1880 {
1881 GICv3CPUState *cs = icc_cs_from_env(env);
1882 uint64_t mask;
1883
1884 trace_gicv3_icc_ctlr_el3_write(gicv3_redist_affid(cs), value);
1885
1886 /* *_EL1NS and *_EL1S bits are aliases into the ICC_CTLR_EL1 bits. */
1887 cs->icc_ctlr_el1[GICV3_NS] &= ~(ICC_CTLR_EL1_CBPR | ICC_CTLR_EL1_EOIMODE);
1888 if (value & ICC_CTLR_EL3_EOIMODE_EL1NS) {
1889 cs->icc_ctlr_el1[GICV3_NS] |= ICC_CTLR_EL1_EOIMODE;
1890 }
1891 if (value & ICC_CTLR_EL3_CBPR_EL1NS) {
1892 cs->icc_ctlr_el1[GICV3_NS] |= ICC_CTLR_EL1_CBPR;
1893 }
1894
1895 cs->icc_ctlr_el1[GICV3_S] &= ~(ICC_CTLR_EL1_CBPR | ICC_CTLR_EL1_EOIMODE);
1896 if (value & ICC_CTLR_EL3_EOIMODE_EL1S) {
1897 cs->icc_ctlr_el1[GICV3_S] |= ICC_CTLR_EL1_EOIMODE;
1898 }
1899 if (value & ICC_CTLR_EL3_CBPR_EL1S) {
1900 cs->icc_ctlr_el1[GICV3_S] |= ICC_CTLR_EL1_CBPR;
1901 }
1902
1903 /* The only bit stored in icc_ctlr_el3 which is writeable is EOIMODE_EL3: */
1904 mask = ICC_CTLR_EL3_EOIMODE_EL3;
1905
1906 cs->icc_ctlr_el3 &= ~mask;
1907 cs->icc_ctlr_el3 |= (value & mask);
1908 gicv3_cpuif_update(cs);
1909 }
1910
gicv3_irqfiq_access(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)1911 static CPAccessResult gicv3_irqfiq_access(CPUARMState *env,
1912 const ARMCPRegInfo *ri, bool isread)
1913 {
1914 CPAccessResult r = CP_ACCESS_OK;
1915 GICv3CPUState *cs = icc_cs_from_env(env);
1916 int el = arm_current_el(env);
1917
1918 if ((cs->ich_hcr_el2 & ICH_HCR_EL2_TC) &&
1919 el == 1 && !arm_is_secure_below_el3(env)) {
1920 /* Takes priority over a possible EL3 trap */
1921 return CP_ACCESS_TRAP_EL2;
1922 }
1923
1924 if ((env->cp15.scr_el3 & (SCR_FIQ | SCR_IRQ)) == (SCR_FIQ | SCR_IRQ)) {
1925 switch (el) {
1926 case 1:
1927 /* Note that arm_hcr_el2_eff takes secure state into account. */
1928 if ((arm_hcr_el2_eff(env) & (HCR_IMO | HCR_FMO)) == 0) {
1929 r = CP_ACCESS_TRAP_EL3;
1930 }
1931 break;
1932 case 2:
1933 r = CP_ACCESS_TRAP_EL3;
1934 break;
1935 case 3:
1936 if (!is_a64(env) && !arm_is_el3_or_mon(env)) {
1937 r = CP_ACCESS_TRAP_EL3;
1938 }
1939 break;
1940 default:
1941 g_assert_not_reached();
1942 }
1943 }
1944
1945 if (r == CP_ACCESS_TRAP_EL3 && !arm_el_is_aa64(env, 3)) {
1946 r = CP_ACCESS_TRAP;
1947 }
1948 return r;
1949 }
1950
gicv3_dir_access(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)1951 static CPAccessResult gicv3_dir_access(CPUARMState *env,
1952 const ARMCPRegInfo *ri, bool isread)
1953 {
1954 GICv3CPUState *cs = icc_cs_from_env(env);
1955
1956 if ((cs->ich_hcr_el2 & ICH_HCR_EL2_TDIR) &&
1957 arm_current_el(env) == 1 && !arm_is_secure_below_el3(env)) {
1958 /* Takes priority over a possible EL3 trap */
1959 return CP_ACCESS_TRAP_EL2;
1960 }
1961
1962 return gicv3_irqfiq_access(env, ri, isread);
1963 }
1964
gicv3_sgi_access(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)1965 static CPAccessResult gicv3_sgi_access(CPUARMState *env,
1966 const ARMCPRegInfo *ri, bool isread)
1967 {
1968 if (arm_current_el(env) == 1 &&
1969 (arm_hcr_el2_eff(env) & (HCR_IMO | HCR_FMO)) != 0) {
1970 /* Takes priority over a possible EL3 trap */
1971 return CP_ACCESS_TRAP_EL2;
1972 }
1973
1974 return gicv3_irqfiq_access(env, ri, isread);
1975 }
1976
gicv3_fiq_access(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)1977 static CPAccessResult gicv3_fiq_access(CPUARMState *env,
1978 const ARMCPRegInfo *ri, bool isread)
1979 {
1980 CPAccessResult r = CP_ACCESS_OK;
1981 GICv3CPUState *cs = icc_cs_from_env(env);
1982 int el = arm_current_el(env);
1983
1984 if ((cs->ich_hcr_el2 & ICH_HCR_EL2_TALL0) &&
1985 el == 1 && !arm_is_secure_below_el3(env)) {
1986 /* Takes priority over a possible EL3 trap */
1987 return CP_ACCESS_TRAP_EL2;
1988 }
1989
1990 if (env->cp15.scr_el3 & SCR_FIQ) {
1991 switch (el) {
1992 case 1:
1993 if ((arm_hcr_el2_eff(env) & HCR_FMO) == 0) {
1994 r = CP_ACCESS_TRAP_EL3;
1995 }
1996 break;
1997 case 2:
1998 r = CP_ACCESS_TRAP_EL3;
1999 break;
2000 case 3:
2001 if (!is_a64(env) && !arm_is_el3_or_mon(env)) {
2002 r = CP_ACCESS_TRAP_EL3;
2003 }
2004 break;
2005 default:
2006 g_assert_not_reached();
2007 }
2008 }
2009
2010 if (r == CP_ACCESS_TRAP_EL3 && !arm_el_is_aa64(env, 3)) {
2011 r = CP_ACCESS_TRAP;
2012 }
2013 return r;
2014 }
2015
gicv3_irq_access(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)2016 static CPAccessResult gicv3_irq_access(CPUARMState *env,
2017 const ARMCPRegInfo *ri, bool isread)
2018 {
2019 CPAccessResult r = CP_ACCESS_OK;
2020 GICv3CPUState *cs = icc_cs_from_env(env);
2021 int el = arm_current_el(env);
2022
2023 if ((cs->ich_hcr_el2 & ICH_HCR_EL2_TALL1) &&
2024 el == 1 && !arm_is_secure_below_el3(env)) {
2025 /* Takes priority over a possible EL3 trap */
2026 return CP_ACCESS_TRAP_EL2;
2027 }
2028
2029 if (env->cp15.scr_el3 & SCR_IRQ) {
2030 switch (el) {
2031 case 1:
2032 if ((arm_hcr_el2_eff(env) & HCR_IMO) == 0) {
2033 r = CP_ACCESS_TRAP_EL3;
2034 }
2035 break;
2036 case 2:
2037 r = CP_ACCESS_TRAP_EL3;
2038 break;
2039 case 3:
2040 if (!is_a64(env) && !arm_is_el3_or_mon(env)) {
2041 r = CP_ACCESS_TRAP_EL3;
2042 }
2043 break;
2044 default:
2045 g_assert_not_reached();
2046 }
2047 }
2048
2049 if (r == CP_ACCESS_TRAP_EL3 && !arm_el_is_aa64(env, 3)) {
2050 r = CP_ACCESS_TRAP;
2051 }
2052 return r;
2053 }
2054
icc_reset(CPUARMState * env,const ARMCPRegInfo * ri)2055 static void icc_reset(CPUARMState *env, const ARMCPRegInfo *ri)
2056 {
2057 GICv3CPUState *cs = icc_cs_from_env(env);
2058
2059 cs->icc_ctlr_el1[GICV3_S] = ICC_CTLR_EL1_A3V |
2060 (1 << ICC_CTLR_EL1_IDBITS_SHIFT) |
2061 (7 << ICC_CTLR_EL1_PRIBITS_SHIFT);
2062 cs->icc_ctlr_el1[GICV3_NS] = ICC_CTLR_EL1_A3V |
2063 (1 << ICC_CTLR_EL1_IDBITS_SHIFT) |
2064 (7 << ICC_CTLR_EL1_PRIBITS_SHIFT);
2065 cs->icc_pmr_el1 = 0;
2066 cs->icc_bpr[GICV3_G0] = GIC_MIN_BPR;
2067 cs->icc_bpr[GICV3_G1] = GIC_MIN_BPR;
2068 cs->icc_bpr[GICV3_G1NS] = GIC_MIN_BPR_NS;
2069 memset(cs->icc_apr, 0, sizeof(cs->icc_apr));
2070 memset(cs->icc_igrpen, 0, sizeof(cs->icc_igrpen));
2071 cs->icc_ctlr_el3 = ICC_CTLR_EL3_NDS | ICC_CTLR_EL3_A3V |
2072 (1 << ICC_CTLR_EL3_IDBITS_SHIFT) |
2073 (7 << ICC_CTLR_EL3_PRIBITS_SHIFT);
2074
2075 memset(cs->ich_apr, 0, sizeof(cs->ich_apr));
2076 cs->ich_hcr_el2 = 0;
2077 memset(cs->ich_lr_el2, 0, sizeof(cs->ich_lr_el2));
2078 cs->ich_vmcr_el2 = ICH_VMCR_EL2_VFIQEN |
2079 ((icv_min_vbpr(cs) + 1) << ICH_VMCR_EL2_VBPR1_SHIFT) |
2080 (icv_min_vbpr(cs) << ICH_VMCR_EL2_VBPR0_SHIFT);
2081 }
2082
2083 static const ARMCPRegInfo gicv3_cpuif_reginfo[] = {
2084 { .name = "ICC_PMR_EL1", .state = ARM_CP_STATE_BOTH,
2085 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 6, .opc2 = 0,
2086 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2087 .access = PL1_RW, .accessfn = gicv3_irqfiq_access,
2088 .readfn = icc_pmr_read,
2089 .writefn = icc_pmr_write,
2090 /* We hang the whole cpu interface reset routine off here
2091 * rather than parcelling it out into one little function
2092 * per register
2093 */
2094 .resetfn = icc_reset,
2095 },
2096 { .name = "ICC_IAR0_EL1", .state = ARM_CP_STATE_BOTH,
2097 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 8, .opc2 = 0,
2098 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2099 .access = PL1_R, .accessfn = gicv3_fiq_access,
2100 .readfn = icc_iar0_read,
2101 },
2102 { .name = "ICC_EOIR0_EL1", .state = ARM_CP_STATE_BOTH,
2103 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 8, .opc2 = 1,
2104 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2105 .access = PL1_W, .accessfn = gicv3_fiq_access,
2106 .writefn = icc_eoir_write,
2107 },
2108 { .name = "ICC_HPPIR0_EL1", .state = ARM_CP_STATE_BOTH,
2109 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 8, .opc2 = 2,
2110 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2111 .access = PL1_R, .accessfn = gicv3_fiq_access,
2112 .readfn = icc_hppir0_read,
2113 },
2114 { .name = "ICC_BPR0_EL1", .state = ARM_CP_STATE_BOTH,
2115 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 8, .opc2 = 3,
2116 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2117 .access = PL1_RW, .accessfn = gicv3_fiq_access,
2118 .readfn = icc_bpr_read,
2119 .writefn = icc_bpr_write,
2120 },
2121 { .name = "ICC_AP0R0_EL1", .state = ARM_CP_STATE_BOTH,
2122 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 8, .opc2 = 4,
2123 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2124 .access = PL1_RW, .accessfn = gicv3_fiq_access,
2125 .readfn = icc_ap_read,
2126 .writefn = icc_ap_write,
2127 },
2128 { .name = "ICC_AP0R1_EL1", .state = ARM_CP_STATE_BOTH,
2129 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 8, .opc2 = 5,
2130 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2131 .access = PL1_RW, .accessfn = gicv3_fiq_access,
2132 .readfn = icc_ap_read,
2133 .writefn = icc_ap_write,
2134 },
2135 { .name = "ICC_AP0R2_EL1", .state = ARM_CP_STATE_BOTH,
2136 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 8, .opc2 = 6,
2137 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2138 .access = PL1_RW, .accessfn = gicv3_fiq_access,
2139 .readfn = icc_ap_read,
2140 .writefn = icc_ap_write,
2141 },
2142 { .name = "ICC_AP0R3_EL1", .state = ARM_CP_STATE_BOTH,
2143 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 8, .opc2 = 7,
2144 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2145 .access = PL1_RW, .accessfn = gicv3_fiq_access,
2146 .readfn = icc_ap_read,
2147 .writefn = icc_ap_write,
2148 },
2149 /* All the ICC_AP1R*_EL1 registers are banked */
2150 { .name = "ICC_AP1R0_EL1", .state = ARM_CP_STATE_BOTH,
2151 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 9, .opc2 = 0,
2152 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2153 .access = PL1_RW, .accessfn = gicv3_irq_access,
2154 .readfn = icc_ap_read,
2155 .writefn = icc_ap_write,
2156 },
2157 { .name = "ICC_AP1R1_EL1", .state = ARM_CP_STATE_BOTH,
2158 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 9, .opc2 = 1,
2159 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2160 .access = PL1_RW, .accessfn = gicv3_irq_access,
2161 .readfn = icc_ap_read,
2162 .writefn = icc_ap_write,
2163 },
2164 { .name = "ICC_AP1R2_EL1", .state = ARM_CP_STATE_BOTH,
2165 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 9, .opc2 = 2,
2166 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2167 .access = PL1_RW, .accessfn = gicv3_irq_access,
2168 .readfn = icc_ap_read,
2169 .writefn = icc_ap_write,
2170 },
2171 { .name = "ICC_AP1R3_EL1", .state = ARM_CP_STATE_BOTH,
2172 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 9, .opc2 = 3,
2173 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2174 .access = PL1_RW, .accessfn = gicv3_irq_access,
2175 .readfn = icc_ap_read,
2176 .writefn = icc_ap_write,
2177 },
2178 { .name = "ICC_DIR_EL1", .state = ARM_CP_STATE_BOTH,
2179 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 11, .opc2 = 1,
2180 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2181 .access = PL1_W, .accessfn = gicv3_dir_access,
2182 .writefn = icc_dir_write,
2183 },
2184 { .name = "ICC_RPR_EL1", .state = ARM_CP_STATE_BOTH,
2185 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 11, .opc2 = 3,
2186 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2187 .access = PL1_R, .accessfn = gicv3_irqfiq_access,
2188 .readfn = icc_rpr_read,
2189 },
2190 { .name = "ICC_SGI1R_EL1", .state = ARM_CP_STATE_AA64,
2191 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 11, .opc2 = 5,
2192 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2193 .access = PL1_W, .accessfn = gicv3_sgi_access,
2194 .writefn = icc_sgi1r_write,
2195 },
2196 { .name = "ICC_SGI1R",
2197 .cp = 15, .opc1 = 0, .crm = 12,
2198 .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_NO_RAW,
2199 .access = PL1_W, .accessfn = gicv3_sgi_access,
2200 .writefn = icc_sgi1r_write,
2201 },
2202 { .name = "ICC_ASGI1R_EL1", .state = ARM_CP_STATE_AA64,
2203 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 11, .opc2 = 6,
2204 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2205 .access = PL1_W, .accessfn = gicv3_sgi_access,
2206 .writefn = icc_asgi1r_write,
2207 },
2208 { .name = "ICC_ASGI1R",
2209 .cp = 15, .opc1 = 1, .crm = 12,
2210 .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_NO_RAW,
2211 .access = PL1_W, .accessfn = gicv3_sgi_access,
2212 .writefn = icc_asgi1r_write,
2213 },
2214 { .name = "ICC_SGI0R_EL1", .state = ARM_CP_STATE_AA64,
2215 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 11, .opc2 = 7,
2216 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2217 .access = PL1_W, .accessfn = gicv3_sgi_access,
2218 .writefn = icc_sgi0r_write,
2219 },
2220 { .name = "ICC_SGI0R",
2221 .cp = 15, .opc1 = 2, .crm = 12,
2222 .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_NO_RAW,
2223 .access = PL1_W, .accessfn = gicv3_sgi_access,
2224 .writefn = icc_sgi0r_write,
2225 },
2226 { .name = "ICC_IAR1_EL1", .state = ARM_CP_STATE_BOTH,
2227 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 12, .opc2 = 0,
2228 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2229 .access = PL1_R, .accessfn = gicv3_irq_access,
2230 .readfn = icc_iar1_read,
2231 },
2232 { .name = "ICC_EOIR1_EL1", .state = ARM_CP_STATE_BOTH,
2233 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 12, .opc2 = 1,
2234 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2235 .access = PL1_W, .accessfn = gicv3_irq_access,
2236 .writefn = icc_eoir_write,
2237 },
2238 { .name = "ICC_HPPIR1_EL1", .state = ARM_CP_STATE_BOTH,
2239 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 12, .opc2 = 2,
2240 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2241 .access = PL1_R, .accessfn = gicv3_irq_access,
2242 .readfn = icc_hppir1_read,
2243 },
2244 /* This register is banked */
2245 { .name = "ICC_BPR1_EL1", .state = ARM_CP_STATE_BOTH,
2246 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 12, .opc2 = 3,
2247 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2248 .access = PL1_RW, .accessfn = gicv3_irq_access,
2249 .readfn = icc_bpr_read,
2250 .writefn = icc_bpr_write,
2251 },
2252 /* This register is banked */
2253 { .name = "ICC_CTLR_EL1", .state = ARM_CP_STATE_BOTH,
2254 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 12, .opc2 = 4,
2255 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2256 .access = PL1_RW, .accessfn = gicv3_irqfiq_access,
2257 .readfn = icc_ctlr_el1_read,
2258 .writefn = icc_ctlr_el1_write,
2259 },
2260 { .name = "ICC_SRE_EL1", .state = ARM_CP_STATE_BOTH,
2261 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 12, .opc2 = 5,
2262 .type = ARM_CP_NO_RAW | ARM_CP_CONST,
2263 .access = PL1_RW,
2264 /* We don't support IRQ/FIQ bypass and system registers are
2265 * always enabled, so all our bits are RAZ/WI or RAO/WI.
2266 * This register is banked but since it's constant we don't
2267 * need to do anything special.
2268 */
2269 .resetvalue = 0x7,
2270 },
2271 { .name = "ICC_IGRPEN0_EL1", .state = ARM_CP_STATE_BOTH,
2272 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 12, .opc2 = 6,
2273 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2274 .access = PL1_RW, .accessfn = gicv3_fiq_access,
2275 .readfn = icc_igrpen_read,
2276 .writefn = icc_igrpen_write,
2277 },
2278 /* This register is banked */
2279 { .name = "ICC_IGRPEN1_EL1", .state = ARM_CP_STATE_BOTH,
2280 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 12, .opc2 = 7,
2281 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2282 .access = PL1_RW, .accessfn = gicv3_irq_access,
2283 .readfn = icc_igrpen_read,
2284 .writefn = icc_igrpen_write,
2285 },
2286 { .name = "ICC_SRE_EL2", .state = ARM_CP_STATE_BOTH,
2287 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 9, .opc2 = 5,
2288 .type = ARM_CP_NO_RAW | ARM_CP_CONST,
2289 .access = PL2_RW,
2290 /* We don't support IRQ/FIQ bypass and system registers are
2291 * always enabled, so all our bits are RAZ/WI or RAO/WI.
2292 */
2293 .resetvalue = 0xf,
2294 },
2295 { .name = "ICC_CTLR_EL3", .state = ARM_CP_STATE_BOTH,
2296 .opc0 = 3, .opc1 = 6, .crn = 12, .crm = 12, .opc2 = 4,
2297 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2298 .access = PL3_RW,
2299 .readfn = icc_ctlr_el3_read,
2300 .writefn = icc_ctlr_el3_write,
2301 },
2302 { .name = "ICC_SRE_EL3", .state = ARM_CP_STATE_BOTH,
2303 .opc0 = 3, .opc1 = 6, .crn = 12, .crm = 12, .opc2 = 5,
2304 .type = ARM_CP_NO_RAW | ARM_CP_CONST,
2305 .access = PL3_RW,
2306 /* We don't support IRQ/FIQ bypass and system registers are
2307 * always enabled, so all our bits are RAZ/WI or RAO/WI.
2308 */
2309 .resetvalue = 0xf,
2310 },
2311 { .name = "ICC_IGRPEN1_EL3", .state = ARM_CP_STATE_BOTH,
2312 .opc0 = 3, .opc1 = 6, .crn = 12, .crm = 12, .opc2 = 7,
2313 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2314 .access = PL3_RW,
2315 .readfn = icc_igrpen1_el3_read,
2316 .writefn = icc_igrpen1_el3_write,
2317 },
2318 REGINFO_SENTINEL
2319 };
2320
ich_ap_read(CPUARMState * env,const ARMCPRegInfo * ri)2321 static uint64_t ich_ap_read(CPUARMState *env, const ARMCPRegInfo *ri)
2322 {
2323 GICv3CPUState *cs = icc_cs_from_env(env);
2324 int regno = ri->opc2 & 3;
2325 int grp = (ri->crm & 1) ? GICV3_G1NS : GICV3_G0;
2326 uint64_t value;
2327
2328 value = cs->ich_apr[grp][regno];
2329 trace_gicv3_ich_ap_read(ri->crm & 1, regno, gicv3_redist_affid(cs), value);
2330 return value;
2331 }
2332
ich_ap_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)2333 static void ich_ap_write(CPUARMState *env, const ARMCPRegInfo *ri,
2334 uint64_t value)
2335 {
2336 GICv3CPUState *cs = icc_cs_from_env(env);
2337 int regno = ri->opc2 & 3;
2338 int grp = (ri->crm & 1) ? GICV3_G1NS : GICV3_G0;
2339
2340 trace_gicv3_ich_ap_write(ri->crm & 1, regno, gicv3_redist_affid(cs), value);
2341
2342 cs->ich_apr[grp][regno] = value & 0xFFFFFFFFU;
2343 gicv3_cpuif_virt_update(cs);
2344 }
2345
ich_hcr_read(CPUARMState * env,const ARMCPRegInfo * ri)2346 static uint64_t ich_hcr_read(CPUARMState *env, const ARMCPRegInfo *ri)
2347 {
2348 GICv3CPUState *cs = icc_cs_from_env(env);
2349 uint64_t value = cs->ich_hcr_el2;
2350
2351 trace_gicv3_ich_hcr_read(gicv3_redist_affid(cs), value);
2352 return value;
2353 }
2354
ich_hcr_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)2355 static void ich_hcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
2356 uint64_t value)
2357 {
2358 GICv3CPUState *cs = icc_cs_from_env(env);
2359
2360 trace_gicv3_ich_hcr_write(gicv3_redist_affid(cs), value);
2361
2362 value &= ICH_HCR_EL2_EN | ICH_HCR_EL2_UIE | ICH_HCR_EL2_LRENPIE |
2363 ICH_HCR_EL2_NPIE | ICH_HCR_EL2_VGRP0EIE | ICH_HCR_EL2_VGRP0DIE |
2364 ICH_HCR_EL2_VGRP1EIE | ICH_HCR_EL2_VGRP1DIE | ICH_HCR_EL2_TC |
2365 ICH_HCR_EL2_TALL0 | ICH_HCR_EL2_TALL1 | ICH_HCR_EL2_TSEI |
2366 ICH_HCR_EL2_TDIR | ICH_HCR_EL2_EOICOUNT_MASK;
2367
2368 cs->ich_hcr_el2 = value;
2369 gicv3_cpuif_virt_update(cs);
2370 }
2371
ich_vmcr_read(CPUARMState * env,const ARMCPRegInfo * ri)2372 static uint64_t ich_vmcr_read(CPUARMState *env, const ARMCPRegInfo *ri)
2373 {
2374 GICv3CPUState *cs = icc_cs_from_env(env);
2375 uint64_t value = cs->ich_vmcr_el2;
2376
2377 trace_gicv3_ich_vmcr_read(gicv3_redist_affid(cs), value);
2378 return value;
2379 }
2380
ich_vmcr_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)2381 static void ich_vmcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
2382 uint64_t value)
2383 {
2384 GICv3CPUState *cs = icc_cs_from_env(env);
2385
2386 trace_gicv3_ich_vmcr_write(gicv3_redist_affid(cs), value);
2387
2388 value &= ICH_VMCR_EL2_VENG0 | ICH_VMCR_EL2_VENG1 | ICH_VMCR_EL2_VCBPR |
2389 ICH_VMCR_EL2_VEOIM | ICH_VMCR_EL2_VBPR1_MASK |
2390 ICH_VMCR_EL2_VBPR0_MASK | ICH_VMCR_EL2_VPMR_MASK;
2391 value |= ICH_VMCR_EL2_VFIQEN;
2392
2393 cs->ich_vmcr_el2 = value;
2394 /* Enforce "writing BPRs to less than minimum sets them to the minimum"
2395 * by reading and writing back the fields.
2396 */
2397 write_vbpr(cs, GICV3_G0, read_vbpr(cs, GICV3_G0));
2398 write_vbpr(cs, GICV3_G1, read_vbpr(cs, GICV3_G1));
2399
2400 gicv3_cpuif_virt_update(cs);
2401 }
2402
ich_lr_read(CPUARMState * env,const ARMCPRegInfo * ri)2403 static uint64_t ich_lr_read(CPUARMState *env, const ARMCPRegInfo *ri)
2404 {
2405 GICv3CPUState *cs = icc_cs_from_env(env);
2406 int regno = ri->opc2 | ((ri->crm & 1) << 3);
2407 uint64_t value;
2408
2409 /* This read function handles all of:
2410 * 64-bit reads of the whole LR
2411 * 32-bit reads of the low half of the LR
2412 * 32-bit reads of the high half of the LR
2413 */
2414 if (ri->state == ARM_CP_STATE_AA32) {
2415 if (ri->crm >= 14) {
2416 value = extract64(cs->ich_lr_el2[regno], 32, 32);
2417 trace_gicv3_ich_lrc_read(regno, gicv3_redist_affid(cs), value);
2418 } else {
2419 value = extract64(cs->ich_lr_el2[regno], 0, 32);
2420 trace_gicv3_ich_lr32_read(regno, gicv3_redist_affid(cs), value);
2421 }
2422 } else {
2423 value = cs->ich_lr_el2[regno];
2424 trace_gicv3_ich_lr_read(regno, gicv3_redist_affid(cs), value);
2425 }
2426
2427 return value;
2428 }
2429
ich_lr_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)2430 static void ich_lr_write(CPUARMState *env, const ARMCPRegInfo *ri,
2431 uint64_t value)
2432 {
2433 GICv3CPUState *cs = icc_cs_from_env(env);
2434 int regno = ri->opc2 | ((ri->crm & 1) << 3);
2435
2436 /* This write function handles all of:
2437 * 64-bit writes to the whole LR
2438 * 32-bit writes to the low half of the LR
2439 * 32-bit writes to the high half of the LR
2440 */
2441 if (ri->state == ARM_CP_STATE_AA32) {
2442 if (ri->crm >= 14) {
2443 trace_gicv3_ich_lrc_write(regno, gicv3_redist_affid(cs), value);
2444 value = deposit64(cs->ich_lr_el2[regno], 32, 32, value);
2445 } else {
2446 trace_gicv3_ich_lr32_write(regno, gicv3_redist_affid(cs), value);
2447 value = deposit64(cs->ich_lr_el2[regno], 0, 32, value);
2448 }
2449 } else {
2450 trace_gicv3_ich_lr_write(regno, gicv3_redist_affid(cs), value);
2451 }
2452
2453 /* Enforce RES0 bits in priority field */
2454 if (cs->vpribits < 8) {
2455 value = deposit64(value, ICH_LR_EL2_PRIORITY_SHIFT,
2456 8 - cs->vpribits, 0);
2457 }
2458
2459 cs->ich_lr_el2[regno] = value;
2460 gicv3_cpuif_virt_update(cs);
2461 }
2462
ich_vtr_read(CPUARMState * env,const ARMCPRegInfo * ri)2463 static uint64_t ich_vtr_read(CPUARMState *env, const ARMCPRegInfo *ri)
2464 {
2465 GICv3CPUState *cs = icc_cs_from_env(env);
2466 uint64_t value;
2467
2468 value = ((cs->num_list_regs - 1) << ICH_VTR_EL2_LISTREGS_SHIFT)
2469 | ICH_VTR_EL2_TDS | ICH_VTR_EL2_NV4 | ICH_VTR_EL2_A3V
2470 | (1 << ICH_VTR_EL2_IDBITS_SHIFT)
2471 | ((cs->vprebits - 1) << ICH_VTR_EL2_PREBITS_SHIFT)
2472 | ((cs->vpribits - 1) << ICH_VTR_EL2_PRIBITS_SHIFT);
2473
2474 trace_gicv3_ich_vtr_read(gicv3_redist_affid(cs), value);
2475 return value;
2476 }
2477
ich_misr_read(CPUARMState * env,const ARMCPRegInfo * ri)2478 static uint64_t ich_misr_read(CPUARMState *env, const ARMCPRegInfo *ri)
2479 {
2480 GICv3CPUState *cs = icc_cs_from_env(env);
2481 uint64_t value = maintenance_interrupt_state(cs);
2482
2483 trace_gicv3_ich_misr_read(gicv3_redist_affid(cs), value);
2484 return value;
2485 }
2486
ich_eisr_read(CPUARMState * env,const ARMCPRegInfo * ri)2487 static uint64_t ich_eisr_read(CPUARMState *env, const ARMCPRegInfo *ri)
2488 {
2489 GICv3CPUState *cs = icc_cs_from_env(env);
2490 uint64_t value = eoi_maintenance_interrupt_state(cs, NULL);
2491
2492 trace_gicv3_ich_eisr_read(gicv3_redist_affid(cs), value);
2493 return value;
2494 }
2495
ich_elrsr_read(CPUARMState * env,const ARMCPRegInfo * ri)2496 static uint64_t ich_elrsr_read(CPUARMState *env, const ARMCPRegInfo *ri)
2497 {
2498 GICv3CPUState *cs = icc_cs_from_env(env);
2499 uint64_t value = 0;
2500 int i;
2501
2502 for (i = 0; i < cs->num_list_regs; i++) {
2503 uint64_t lr = cs->ich_lr_el2[i];
2504
2505 if ((lr & ICH_LR_EL2_STATE_MASK) == 0 &&
2506 ((lr & ICH_LR_EL2_HW) != 0 || (lr & ICH_LR_EL2_EOI) == 0)) {
2507 value |= (1 << i);
2508 }
2509 }
2510
2511 trace_gicv3_ich_elrsr_read(gicv3_redist_affid(cs), value);
2512 return value;
2513 }
2514
2515 static const ARMCPRegInfo gicv3_cpuif_hcr_reginfo[] = {
2516 { .name = "ICH_AP0R0_EL2", .state = ARM_CP_STATE_BOTH,
2517 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 8, .opc2 = 0,
2518 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2519 .access = PL2_RW,
2520 .readfn = ich_ap_read,
2521 .writefn = ich_ap_write,
2522 },
2523 { .name = "ICH_AP1R0_EL2", .state = ARM_CP_STATE_BOTH,
2524 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 9, .opc2 = 0,
2525 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2526 .access = PL2_RW,
2527 .readfn = ich_ap_read,
2528 .writefn = ich_ap_write,
2529 },
2530 { .name = "ICH_HCR_EL2", .state = ARM_CP_STATE_BOTH,
2531 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 11, .opc2 = 0,
2532 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2533 .access = PL2_RW,
2534 .readfn = ich_hcr_read,
2535 .writefn = ich_hcr_write,
2536 },
2537 { .name = "ICH_VTR_EL2", .state = ARM_CP_STATE_BOTH,
2538 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 11, .opc2 = 1,
2539 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2540 .access = PL2_R,
2541 .readfn = ich_vtr_read,
2542 },
2543 { .name = "ICH_MISR_EL2", .state = ARM_CP_STATE_BOTH,
2544 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 11, .opc2 = 2,
2545 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2546 .access = PL2_R,
2547 .readfn = ich_misr_read,
2548 },
2549 { .name = "ICH_EISR_EL2", .state = ARM_CP_STATE_BOTH,
2550 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 11, .opc2 = 3,
2551 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2552 .access = PL2_R,
2553 .readfn = ich_eisr_read,
2554 },
2555 { .name = "ICH_ELRSR_EL2", .state = ARM_CP_STATE_BOTH,
2556 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 11, .opc2 = 5,
2557 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2558 .access = PL2_R,
2559 .readfn = ich_elrsr_read,
2560 },
2561 { .name = "ICH_VMCR_EL2", .state = ARM_CP_STATE_BOTH,
2562 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 11, .opc2 = 7,
2563 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2564 .access = PL2_RW,
2565 .readfn = ich_vmcr_read,
2566 .writefn = ich_vmcr_write,
2567 },
2568 REGINFO_SENTINEL
2569 };
2570
2571 static const ARMCPRegInfo gicv3_cpuif_ich_apxr1_reginfo[] = {
2572 { .name = "ICH_AP0R1_EL2", .state = ARM_CP_STATE_BOTH,
2573 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 8, .opc2 = 1,
2574 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2575 .access = PL2_RW,
2576 .readfn = ich_ap_read,
2577 .writefn = ich_ap_write,
2578 },
2579 { .name = "ICH_AP1R1_EL2", .state = ARM_CP_STATE_BOTH,
2580 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 9, .opc2 = 1,
2581 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2582 .access = PL2_RW,
2583 .readfn = ich_ap_read,
2584 .writefn = ich_ap_write,
2585 },
2586 REGINFO_SENTINEL
2587 };
2588
2589 static const ARMCPRegInfo gicv3_cpuif_ich_apxr23_reginfo[] = {
2590 { .name = "ICH_AP0R2_EL2", .state = ARM_CP_STATE_BOTH,
2591 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 8, .opc2 = 2,
2592 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2593 .access = PL2_RW,
2594 .readfn = ich_ap_read,
2595 .writefn = ich_ap_write,
2596 },
2597 { .name = "ICH_AP0R3_EL2", .state = ARM_CP_STATE_BOTH,
2598 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 8, .opc2 = 3,
2599 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2600 .access = PL2_RW,
2601 .readfn = ich_ap_read,
2602 .writefn = ich_ap_write,
2603 },
2604 { .name = "ICH_AP1R2_EL2", .state = ARM_CP_STATE_BOTH,
2605 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 9, .opc2 = 2,
2606 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2607 .access = PL2_RW,
2608 .readfn = ich_ap_read,
2609 .writefn = ich_ap_write,
2610 },
2611 { .name = "ICH_AP1R3_EL2", .state = ARM_CP_STATE_BOTH,
2612 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 9, .opc2 = 3,
2613 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2614 .access = PL2_RW,
2615 .readfn = ich_ap_read,
2616 .writefn = ich_ap_write,
2617 },
2618 REGINFO_SENTINEL
2619 };
2620
gicv3_cpuif_el_change_hook(ARMCPU * cpu,void * opaque)2621 static void gicv3_cpuif_el_change_hook(ARMCPU *cpu, void *opaque)
2622 {
2623 GICv3CPUState *cs = opaque;
2624
2625 gicv3_cpuif_update(cs);
2626 }
2627
gicv3_init_cpuif(GICv3State * s)2628 void gicv3_init_cpuif(GICv3State *s)
2629 {
2630 /* Called from the GICv3 realize function; register our system
2631 * registers with the CPU
2632 */
2633 int i;
2634
2635 for (i = 0; i < s->num_cpu; i++) {
2636 ARMCPU *cpu = ARM_CPU(qemu_get_cpu(i));
2637 GICv3CPUState *cs = &s->cpu[i];
2638
2639 /* Note that we can't just use the GICv3CPUState as an opaque pointer
2640 * in define_arm_cp_regs_with_opaque(), because when we're called back
2641 * it might be with code translated by CPU 0 but run by CPU 1, in
2642 * which case we'd get the wrong value.
2643 * So instead we define the regs with no ri->opaque info, and
2644 * get back to the GICv3CPUState from the CPUARMState.
2645 */
2646 define_arm_cp_regs(cpu, gicv3_cpuif_reginfo);
2647 if (arm_feature(&cpu->env, ARM_FEATURE_EL2)
2648 && cpu->gic_num_lrs) {
2649 int j;
2650
2651 cs->num_list_regs = cpu->gic_num_lrs;
2652 cs->vpribits = cpu->gic_vpribits;
2653 cs->vprebits = cpu->gic_vprebits;
2654
2655 /* Check against architectural constraints: getting these
2656 * wrong would be a bug in the CPU code defining these,
2657 * and the implementation relies on them holding.
2658 */
2659 g_assert(cs->vprebits <= cs->vpribits);
2660 g_assert(cs->vprebits >= 5 && cs->vprebits <= 7);
2661 g_assert(cs->vpribits >= 5 && cs->vpribits <= 8);
2662
2663 define_arm_cp_regs(cpu, gicv3_cpuif_hcr_reginfo);
2664
2665 for (j = 0; j < cs->num_list_regs; j++) {
2666 /* Note that the AArch64 LRs are 64-bit; the AArch32 LRs
2667 * are split into two cp15 regs, LR (the low part, with the
2668 * same encoding as the AArch64 LR) and LRC (the high part).
2669 */
2670 ARMCPRegInfo lr_regset[] = {
2671 { .name = "ICH_LRn_EL2", .state = ARM_CP_STATE_BOTH,
2672 .opc0 = 3, .opc1 = 4, .crn = 12,
2673 .crm = 12 + (j >> 3), .opc2 = j & 7,
2674 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2675 .access = PL2_RW,
2676 .readfn = ich_lr_read,
2677 .writefn = ich_lr_write,
2678 },
2679 { .name = "ICH_LRCn_EL2", .state = ARM_CP_STATE_AA32,
2680 .cp = 15, .opc1 = 4, .crn = 12,
2681 .crm = 14 + (j >> 3), .opc2 = j & 7,
2682 .type = ARM_CP_IO | ARM_CP_NO_RAW,
2683 .access = PL2_RW,
2684 .readfn = ich_lr_read,
2685 .writefn = ich_lr_write,
2686 },
2687 REGINFO_SENTINEL
2688 };
2689 define_arm_cp_regs(cpu, lr_regset);
2690 }
2691 if (cs->vprebits >= 6) {
2692 define_arm_cp_regs(cpu, gicv3_cpuif_ich_apxr1_reginfo);
2693 }
2694 if (cs->vprebits == 7) {
2695 define_arm_cp_regs(cpu, gicv3_cpuif_ich_apxr23_reginfo);
2696 }
2697 }
2698 arm_register_el_change_hook(cpu, gicv3_cpuif_el_change_hook, cs);
2699 }
2700 }
2701