1 /*
2  * ARM Generic Interrupt Controller v3
3  *
4  * Copyright (c) 2016 Linaro Limited
5  * Written by Peter Maydell
6  *
7  * This code is licensed under the GPL, version 2 or (at your option)
8  * any later version.
9  */
10 
11 /* This file contains the code for the system register interface
12  * portions of the GICv3.
13  */
14 
15 #include "qemu/osdep.h"
16 #include "qemu/bitops.h"
17 #include "qemu/main-loop.h"
18 #include "trace.h"
19 #include "gicv3_internal.h"
20 #include "hw/irq.h"
21 #include "cpu.h"
22 
gicv3_set_gicv3state(CPUState * cpu,GICv3CPUState * s)23 void gicv3_set_gicv3state(CPUState *cpu, GICv3CPUState *s)
24 {
25     ARMCPU *arm_cpu = ARM_CPU(cpu);
26     CPUARMState *env = &arm_cpu->env;
27 
28     env->gicv3state = (void *)s;
29 };
30 
icc_cs_from_env(CPUARMState * env)31 static GICv3CPUState *icc_cs_from_env(CPUARMState *env)
32 {
33     return env->gicv3state;
34 }
35 
gicv3_use_ns_bank(CPUARMState * env)36 static bool gicv3_use_ns_bank(CPUARMState *env)
37 {
38     /* Return true if we should use the NonSecure bank for a banked GIC
39      * CPU interface register. Note that this differs from the
40      * access_secure_reg() function because GICv3 banked registers are
41      * banked even for AArch64, unlike the other CPU system registers.
42      */
43     return !arm_is_secure_below_el3(env);
44 }
45 
46 /* The minimum BPR for the virtual interface is a configurable property */
icv_min_vbpr(GICv3CPUState * cs)47 static inline int icv_min_vbpr(GICv3CPUState *cs)
48 {
49     return 7 - cs->vprebits;
50 }
51 
52 /* Simple accessor functions for LR fields */
ich_lr_vintid(uint64_t lr)53 static uint32_t ich_lr_vintid(uint64_t lr)
54 {
55     return extract64(lr, ICH_LR_EL2_VINTID_SHIFT, ICH_LR_EL2_VINTID_LENGTH);
56 }
57 
ich_lr_pintid(uint64_t lr)58 static uint32_t ich_lr_pintid(uint64_t lr)
59 {
60     return extract64(lr, ICH_LR_EL2_PINTID_SHIFT, ICH_LR_EL2_PINTID_LENGTH);
61 }
62 
ich_lr_prio(uint64_t lr)63 static uint32_t ich_lr_prio(uint64_t lr)
64 {
65     return extract64(lr, ICH_LR_EL2_PRIORITY_SHIFT, ICH_LR_EL2_PRIORITY_LENGTH);
66 }
67 
ich_lr_state(uint64_t lr)68 static int ich_lr_state(uint64_t lr)
69 {
70     return extract64(lr, ICH_LR_EL2_STATE_SHIFT, ICH_LR_EL2_STATE_LENGTH);
71 }
72 
icv_access(CPUARMState * env,int hcr_flags)73 static bool icv_access(CPUARMState *env, int hcr_flags)
74 {
75     /* Return true if this ICC_ register access should really be
76      * directed to an ICV_ access. hcr_flags is a mask of
77      * HCR_EL2 bits to check: we treat this as an ICV_ access
78      * if we are in NS EL1 and at least one of the specified
79      * HCR_EL2 bits is set.
80      *
81      * ICV registers fall into four categories:
82      *  * access if NS EL1 and HCR_EL2.FMO == 1:
83      *    all ICV regs with '0' in their name
84      *  * access if NS EL1 and HCR_EL2.IMO == 1:
85      *    all ICV regs with '1' in their name
86      *  * access if NS EL1 and either IMO or FMO == 1:
87      *    CTLR, DIR, PMR, RPR
88      */
89     uint64_t hcr_el2 = arm_hcr_el2_eff(env);
90     bool flagmatch = hcr_el2 & hcr_flags & (HCR_IMO | HCR_FMO);
91 
92     return flagmatch && arm_current_el(env) == 1
93         && !arm_is_secure_below_el3(env);
94 }
95 
read_vbpr(GICv3CPUState * cs,int grp)96 static int read_vbpr(GICv3CPUState *cs, int grp)
97 {
98     /* Read VBPR value out of the VMCR field (caller must handle
99      * VCBPR effects if required)
100      */
101     if (grp == GICV3_G0) {
102         return extract64(cs->ich_vmcr_el2, ICH_VMCR_EL2_VBPR0_SHIFT,
103                      ICH_VMCR_EL2_VBPR0_LENGTH);
104     } else {
105         return extract64(cs->ich_vmcr_el2, ICH_VMCR_EL2_VBPR1_SHIFT,
106                          ICH_VMCR_EL2_VBPR1_LENGTH);
107     }
108 }
109 
write_vbpr(GICv3CPUState * cs,int grp,int value)110 static void write_vbpr(GICv3CPUState *cs, int grp, int value)
111 {
112     /* Write new VBPR1 value, handling the "writing a value less than
113      * the minimum sets it to the minimum" semantics.
114      */
115     int min = icv_min_vbpr(cs);
116 
117     if (grp != GICV3_G0) {
118         min++;
119     }
120 
121     value = MAX(value, min);
122 
123     if (grp == GICV3_G0) {
124         cs->ich_vmcr_el2 = deposit64(cs->ich_vmcr_el2, ICH_VMCR_EL2_VBPR0_SHIFT,
125                                      ICH_VMCR_EL2_VBPR0_LENGTH, value);
126     } else {
127         cs->ich_vmcr_el2 = deposit64(cs->ich_vmcr_el2, ICH_VMCR_EL2_VBPR1_SHIFT,
128                                      ICH_VMCR_EL2_VBPR1_LENGTH, value);
129     }
130 }
131 
icv_fullprio_mask(GICv3CPUState * cs)132 static uint32_t icv_fullprio_mask(GICv3CPUState *cs)
133 {
134     /* Return a mask word which clears the unimplemented priority bits
135      * from a priority value for a virtual interrupt. (Not to be confused
136      * with the group priority, whose mask depends on the value of VBPR
137      * for the interrupt group.)
138      */
139     return ~0U << (8 - cs->vpribits);
140 }
141 
ich_highest_active_virt_prio(GICv3CPUState * cs)142 static int ich_highest_active_virt_prio(GICv3CPUState *cs)
143 {
144     /* Calculate the current running priority based on the set bits
145      * in the ICH Active Priority Registers.
146      */
147     int i;
148     int aprmax = 1 << (cs->vprebits - 5);
149 
150     assert(aprmax <= ARRAY_SIZE(cs->ich_apr[0]));
151 
152     for (i = 0; i < aprmax; i++) {
153         uint32_t apr = cs->ich_apr[GICV3_G0][i] |
154             cs->ich_apr[GICV3_G1NS][i];
155 
156         if (!apr) {
157             continue;
158         }
159         return (i * 32 + ctz32(apr)) << (icv_min_vbpr(cs) + 1);
160     }
161     /* No current active interrupts: return idle priority */
162     return 0xff;
163 }
164 
hppvi_index(GICv3CPUState * cs)165 static int hppvi_index(GICv3CPUState *cs)
166 {
167     /* Return the list register index of the highest priority pending
168      * virtual interrupt, as per the HighestPriorityVirtualInterrupt
169      * pseudocode. If no pending virtual interrupts, return -1.
170      */
171     int idx = -1;
172     int i;
173     /* Note that a list register entry with a priority of 0xff will
174      * never be reported by this function; this is the architecturally
175      * correct behaviour.
176      */
177     int prio = 0xff;
178 
179     if (!(cs->ich_vmcr_el2 & (ICH_VMCR_EL2_VENG0 | ICH_VMCR_EL2_VENG1))) {
180         /* Both groups disabled, definitely nothing to do */
181         return idx;
182     }
183 
184     for (i = 0; i < cs->num_list_regs; i++) {
185         uint64_t lr = cs->ich_lr_el2[i];
186         int thisprio;
187 
188         if (ich_lr_state(lr) != ICH_LR_EL2_STATE_PENDING) {
189             /* Not Pending */
190             continue;
191         }
192 
193         /* Ignore interrupts if relevant group enable not set */
194         if (lr & ICH_LR_EL2_GROUP) {
195             if (!(cs->ich_vmcr_el2 & ICH_VMCR_EL2_VENG1)) {
196                 continue;
197             }
198         } else {
199             if (!(cs->ich_vmcr_el2 & ICH_VMCR_EL2_VENG0)) {
200                 continue;
201             }
202         }
203 
204         thisprio = ich_lr_prio(lr);
205 
206         if (thisprio < prio) {
207             prio = thisprio;
208             idx = i;
209         }
210     }
211 
212     return idx;
213 }
214 
icv_gprio_mask(GICv3CPUState * cs,int group)215 static uint32_t icv_gprio_mask(GICv3CPUState *cs, int group)
216 {
217     /* Return a mask word which clears the subpriority bits from
218      * a priority value for a virtual interrupt in the specified group.
219      * This depends on the VBPR value.
220      * If using VBPR0 then:
221      *  a BPR of 0 means the group priority bits are [7:1];
222      *  a BPR of 1 means they are [7:2], and so on down to
223      *  a BPR of 7 meaning no group priority bits at all.
224      * If using VBPR1 then:
225      *  a BPR of 0 is impossible (the minimum value is 1)
226      *  a BPR of 1 means the group priority bits are [7:1];
227      *  a BPR of 2 means they are [7:2], and so on down to
228      *  a BPR of 7 meaning the group priority is [7].
229      *
230      * Which BPR to use depends on the group of the interrupt and
231      * the current ICH_VMCR_EL2.VCBPR settings.
232      *
233      * This corresponds to the VGroupBits() pseudocode.
234      */
235     int bpr;
236 
237     if (group == GICV3_G1NS && cs->ich_vmcr_el2 & ICH_VMCR_EL2_VCBPR) {
238         group = GICV3_G0;
239     }
240 
241     bpr = read_vbpr(cs, group);
242     if (group == GICV3_G1NS) {
243         assert(bpr > 0);
244         bpr--;
245     }
246 
247     return ~0U << (bpr + 1);
248 }
249 
icv_hppi_can_preempt(GICv3CPUState * cs,uint64_t lr)250 static bool icv_hppi_can_preempt(GICv3CPUState *cs, uint64_t lr)
251 {
252     /* Return true if we can signal this virtual interrupt defined by
253      * the given list register value; see the pseudocode functions
254      * CanSignalVirtualInterrupt and CanSignalVirtualInt.
255      * Compare also icc_hppi_can_preempt() which is the non-virtual
256      * equivalent of these checks.
257      */
258     int grp;
259     uint32_t mask, prio, rprio, vpmr;
260 
261     if (!(cs->ich_hcr_el2 & ICH_HCR_EL2_EN)) {
262         /* Virtual interface disabled */
263         return false;
264     }
265 
266     /* We don't need to check that this LR is in Pending state because
267      * that has already been done in hppvi_index().
268      */
269 
270     prio = ich_lr_prio(lr);
271     vpmr = extract64(cs->ich_vmcr_el2, ICH_VMCR_EL2_VPMR_SHIFT,
272                      ICH_VMCR_EL2_VPMR_LENGTH);
273 
274     if (prio >= vpmr) {
275         /* Priority mask masks this interrupt */
276         return false;
277     }
278 
279     rprio = ich_highest_active_virt_prio(cs);
280     if (rprio == 0xff) {
281         /* No running interrupt so we can preempt */
282         return true;
283     }
284 
285     grp = (lr & ICH_LR_EL2_GROUP) ? GICV3_G1NS : GICV3_G0;
286 
287     mask = icv_gprio_mask(cs, grp);
288 
289     /* We only preempt a running interrupt if the pending interrupt's
290      * group priority is sufficient (the subpriorities are not considered).
291      */
292     if ((prio & mask) < (rprio & mask)) {
293         return true;
294     }
295 
296     return false;
297 }
298 
eoi_maintenance_interrupt_state(GICv3CPUState * cs,uint32_t * misr)299 static uint32_t eoi_maintenance_interrupt_state(GICv3CPUState *cs,
300                                                 uint32_t *misr)
301 {
302     /* Return a set of bits indicating the EOI maintenance interrupt status
303      * for each list register. The EOI maintenance interrupt status is
304      * 1 if LR.State == 0 && LR.HW == 0 && LR.EOI == 1
305      * (see the GICv3 spec for the ICH_EISR_EL2 register).
306      * If misr is not NULL then we should also collect the information
307      * about the MISR.EOI, MISR.NP and MISR.U bits.
308      */
309     uint32_t value = 0;
310     int validcount = 0;
311     bool seenpending = false;
312     int i;
313 
314     for (i = 0; i < cs->num_list_regs; i++) {
315         uint64_t lr = cs->ich_lr_el2[i];
316 
317         if ((lr & (ICH_LR_EL2_STATE_MASK | ICH_LR_EL2_HW | ICH_LR_EL2_EOI))
318             == ICH_LR_EL2_EOI) {
319             value |= (1 << i);
320         }
321         if ((lr & ICH_LR_EL2_STATE_MASK)) {
322             validcount++;
323         }
324         if (ich_lr_state(lr) == ICH_LR_EL2_STATE_PENDING) {
325             seenpending = true;
326         }
327     }
328 
329     if (misr) {
330         if (validcount < 2 && (cs->ich_hcr_el2 & ICH_HCR_EL2_UIE)) {
331             *misr |= ICH_MISR_EL2_U;
332         }
333         if (!seenpending && (cs->ich_hcr_el2 & ICH_HCR_EL2_NPIE)) {
334             *misr |= ICH_MISR_EL2_NP;
335         }
336         if (value) {
337             *misr |= ICH_MISR_EL2_EOI;
338         }
339     }
340     return value;
341 }
342 
maintenance_interrupt_state(GICv3CPUState * cs)343 static uint32_t maintenance_interrupt_state(GICv3CPUState *cs)
344 {
345     /* Return a set of bits indicating the maintenance interrupt status
346      * (as seen in the ICH_MISR_EL2 register).
347      */
348     uint32_t value = 0;
349 
350     /* Scan list registers and fill in the U, NP and EOI bits */
351     eoi_maintenance_interrupt_state(cs, &value);
352 
353     if (cs->ich_hcr_el2 & (ICH_HCR_EL2_LRENPIE | ICH_HCR_EL2_EOICOUNT_MASK)) {
354         value |= ICH_MISR_EL2_LRENP;
355     }
356 
357     if ((cs->ich_hcr_el2 & ICH_HCR_EL2_VGRP0EIE) &&
358         (cs->ich_vmcr_el2 & ICH_VMCR_EL2_VENG0)) {
359         value |= ICH_MISR_EL2_VGRP0E;
360     }
361 
362     if ((cs->ich_hcr_el2 & ICH_HCR_EL2_VGRP0DIE) &&
363         !(cs->ich_vmcr_el2 & ICH_VMCR_EL2_VENG1)) {
364         value |= ICH_MISR_EL2_VGRP0D;
365     }
366     if ((cs->ich_hcr_el2 & ICH_HCR_EL2_VGRP1EIE) &&
367         (cs->ich_vmcr_el2 & ICH_VMCR_EL2_VENG1)) {
368         value |= ICH_MISR_EL2_VGRP1E;
369     }
370 
371     if ((cs->ich_hcr_el2 & ICH_HCR_EL2_VGRP1DIE) &&
372         !(cs->ich_vmcr_el2 & ICH_VMCR_EL2_VENG1)) {
373         value |= ICH_MISR_EL2_VGRP1D;
374     }
375 
376     return value;
377 }
378 
gicv3_cpuif_virt_update(GICv3CPUState * cs)379 static void gicv3_cpuif_virt_update(GICv3CPUState *cs)
380 {
381     /* Tell the CPU about any pending virtual interrupts or
382      * maintenance interrupts, following a change to the state
383      * of the CPU interface relevant to virtual interrupts.
384      *
385      * CAUTION: this function will call qemu_set_irq() on the
386      * CPU maintenance IRQ line, which is typically wired up
387      * to the GIC as a per-CPU interrupt. This means that it
388      * will recursively call back into the GIC code via
389      * gicv3_redist_set_irq() and thus into the CPU interface code's
390      * gicv3_cpuif_update(). It is therefore important that this
391      * function is only called as the final action of a CPU interface
392      * register write implementation, after all the GIC state
393      * fields have been updated. gicv3_cpuif_update() also must
394      * not cause this function to be called, but that happens
395      * naturally as a result of there being no architectural
396      * linkage between the physical and virtual GIC logic.
397      */
398     int idx;
399     int irqlevel = 0;
400     int fiqlevel = 0;
401     int maintlevel = 0;
402     ARMCPU *cpu = ARM_CPU(cs->cpu);
403 
404     idx = hppvi_index(cs);
405     trace_gicv3_cpuif_virt_update(gicv3_redist_affid(cs), idx);
406     if (idx >= 0) {
407         uint64_t lr = cs->ich_lr_el2[idx];
408 
409         if (icv_hppi_can_preempt(cs, lr)) {
410             /* Virtual interrupts are simple: G0 are always FIQ, and G1 IRQ */
411             if (lr & ICH_LR_EL2_GROUP) {
412                 irqlevel = 1;
413             } else {
414                 fiqlevel = 1;
415             }
416         }
417     }
418 
419     if (cs->ich_hcr_el2 & ICH_HCR_EL2_EN) {
420         maintlevel = maintenance_interrupt_state(cs);
421     }
422 
423     trace_gicv3_cpuif_virt_set_irqs(gicv3_redist_affid(cs), fiqlevel,
424                                     irqlevel, maintlevel);
425 
426     qemu_set_irq(cs->parent_vfiq, fiqlevel);
427     qemu_set_irq(cs->parent_virq, irqlevel);
428     qemu_set_irq(cpu->gicv3_maintenance_interrupt, maintlevel);
429 }
430 
icv_ap_read(CPUARMState * env,const ARMCPRegInfo * ri)431 static uint64_t icv_ap_read(CPUARMState *env, const ARMCPRegInfo *ri)
432 {
433     GICv3CPUState *cs = icc_cs_from_env(env);
434     int regno = ri->opc2 & 3;
435     int grp = (ri->crm & 1) ? GICV3_G1NS : GICV3_G0;
436     uint64_t value = cs->ich_apr[grp][regno];
437 
438     trace_gicv3_icv_ap_read(ri->crm & 1, regno, gicv3_redist_affid(cs), value);
439     return value;
440 }
441 
icv_ap_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)442 static void icv_ap_write(CPUARMState *env, const ARMCPRegInfo *ri,
443                          uint64_t value)
444 {
445     GICv3CPUState *cs = icc_cs_from_env(env);
446     int regno = ri->opc2 & 3;
447     int grp = (ri->crm & 1) ? GICV3_G1NS : GICV3_G0;
448 
449     trace_gicv3_icv_ap_write(ri->crm & 1, regno, gicv3_redist_affid(cs), value);
450 
451     cs->ich_apr[grp][regno] = value & 0xFFFFFFFFU;
452 
453     gicv3_cpuif_virt_update(cs);
454     return;
455 }
456 
icv_bpr_read(CPUARMState * env,const ARMCPRegInfo * ri)457 static uint64_t icv_bpr_read(CPUARMState *env, const ARMCPRegInfo *ri)
458 {
459     GICv3CPUState *cs = icc_cs_from_env(env);
460     int grp = (ri->crm == 8) ? GICV3_G0 : GICV3_G1NS;
461     uint64_t bpr;
462     bool satinc = false;
463 
464     if (grp == GICV3_G1NS && (cs->ich_vmcr_el2 & ICH_VMCR_EL2_VCBPR)) {
465         /* reads return bpr0 + 1 saturated to 7, writes ignored */
466         grp = GICV3_G0;
467         satinc = true;
468     }
469 
470     bpr = read_vbpr(cs, grp);
471 
472     if (satinc) {
473         bpr++;
474         bpr = MIN(bpr, 7);
475     }
476 
477     trace_gicv3_icv_bpr_read(ri->crm == 8 ? 0 : 1, gicv3_redist_affid(cs), bpr);
478 
479     return bpr;
480 }
481 
icv_bpr_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)482 static void icv_bpr_write(CPUARMState *env, const ARMCPRegInfo *ri,
483                           uint64_t value)
484 {
485     GICv3CPUState *cs = icc_cs_from_env(env);
486     int grp = (ri->crm == 8) ? GICV3_G0 : GICV3_G1NS;
487 
488     trace_gicv3_icv_bpr_write(ri->crm == 8 ? 0 : 1,
489                               gicv3_redist_affid(cs), value);
490 
491     if (grp == GICV3_G1NS && (cs->ich_vmcr_el2 & ICH_VMCR_EL2_VCBPR)) {
492         /* reads return bpr0 + 1 saturated to 7, writes ignored */
493         return;
494     }
495 
496     write_vbpr(cs, grp, value);
497 
498     gicv3_cpuif_virt_update(cs);
499 }
500 
icv_pmr_read(CPUARMState * env,const ARMCPRegInfo * ri)501 static uint64_t icv_pmr_read(CPUARMState *env, const ARMCPRegInfo *ri)
502 {
503     GICv3CPUState *cs = icc_cs_from_env(env);
504     uint64_t value;
505 
506     value = extract64(cs->ich_vmcr_el2, ICH_VMCR_EL2_VPMR_SHIFT,
507                       ICH_VMCR_EL2_VPMR_LENGTH);
508 
509     trace_gicv3_icv_pmr_read(gicv3_redist_affid(cs), value);
510     return value;
511 }
512 
icv_pmr_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)513 static void icv_pmr_write(CPUARMState *env, const ARMCPRegInfo *ri,
514                           uint64_t value)
515 {
516     GICv3CPUState *cs = icc_cs_from_env(env);
517 
518     trace_gicv3_icv_pmr_write(gicv3_redist_affid(cs), value);
519 
520     value &= icv_fullprio_mask(cs);
521 
522     cs->ich_vmcr_el2 = deposit64(cs->ich_vmcr_el2, ICH_VMCR_EL2_VPMR_SHIFT,
523                                  ICH_VMCR_EL2_VPMR_LENGTH, value);
524 
525     gicv3_cpuif_virt_update(cs);
526 }
527 
icv_igrpen_read(CPUARMState * env,const ARMCPRegInfo * ri)528 static uint64_t icv_igrpen_read(CPUARMState *env, const ARMCPRegInfo *ri)
529 {
530     GICv3CPUState *cs = icc_cs_from_env(env);
531     int enbit;
532     uint64_t value;
533 
534     enbit = ri->opc2 & 1 ? ICH_VMCR_EL2_VENG1_SHIFT : ICH_VMCR_EL2_VENG0_SHIFT;
535     value = extract64(cs->ich_vmcr_el2, enbit, 1);
536 
537     trace_gicv3_icv_igrpen_read(ri->opc2 & 1 ? 1 : 0,
538                                 gicv3_redist_affid(cs), value);
539     return value;
540 }
541 
icv_igrpen_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)542 static void icv_igrpen_write(CPUARMState *env, const ARMCPRegInfo *ri,
543                              uint64_t value)
544 {
545     GICv3CPUState *cs = icc_cs_from_env(env);
546     int enbit;
547 
548     trace_gicv3_icv_igrpen_write(ri->opc2 & 1 ? 1 : 0,
549                                  gicv3_redist_affid(cs), value);
550 
551     enbit = ri->opc2 & 1 ? ICH_VMCR_EL2_VENG1_SHIFT : ICH_VMCR_EL2_VENG0_SHIFT;
552 
553     cs->ich_vmcr_el2 = deposit64(cs->ich_vmcr_el2, enbit, 1, value);
554     gicv3_cpuif_virt_update(cs);
555 }
556 
icv_ctlr_read(CPUARMState * env,const ARMCPRegInfo * ri)557 static uint64_t icv_ctlr_read(CPUARMState *env, const ARMCPRegInfo *ri)
558 {
559     GICv3CPUState *cs = icc_cs_from_env(env);
560     uint64_t value;
561 
562     /* Note that the fixed fields here (A3V, SEIS, IDbits, PRIbits)
563      * should match the ones reported in ich_vtr_read().
564      */
565     value = ICC_CTLR_EL1_A3V | (1 << ICC_CTLR_EL1_IDBITS_SHIFT) |
566         (7 << ICC_CTLR_EL1_PRIBITS_SHIFT);
567 
568     if (cs->ich_vmcr_el2 & ICH_VMCR_EL2_VEOIM) {
569         value |= ICC_CTLR_EL1_EOIMODE;
570     }
571 
572     if (cs->ich_vmcr_el2 & ICH_VMCR_EL2_VCBPR) {
573         value |= ICC_CTLR_EL1_CBPR;
574     }
575 
576     trace_gicv3_icv_ctlr_read(gicv3_redist_affid(cs), value);
577     return value;
578 }
579 
icv_ctlr_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)580 static void icv_ctlr_write(CPUARMState *env, const ARMCPRegInfo *ri,
581                                uint64_t value)
582 {
583     GICv3CPUState *cs = icc_cs_from_env(env);
584 
585     trace_gicv3_icv_ctlr_write(gicv3_redist_affid(cs), value);
586 
587     cs->ich_vmcr_el2 = deposit64(cs->ich_vmcr_el2, ICH_VMCR_EL2_VCBPR_SHIFT,
588                                  1, value & ICC_CTLR_EL1_CBPR ? 1 : 0);
589     cs->ich_vmcr_el2 = deposit64(cs->ich_vmcr_el2, ICH_VMCR_EL2_VEOIM_SHIFT,
590                                  1, value & ICC_CTLR_EL1_EOIMODE ? 1 : 0);
591 
592     gicv3_cpuif_virt_update(cs);
593 }
594 
icv_rpr_read(CPUARMState * env,const ARMCPRegInfo * ri)595 static uint64_t icv_rpr_read(CPUARMState *env, const ARMCPRegInfo *ri)
596 {
597     GICv3CPUState *cs = icc_cs_from_env(env);
598     int prio = ich_highest_active_virt_prio(cs);
599 
600     trace_gicv3_icv_rpr_read(gicv3_redist_affid(cs), prio);
601     return prio;
602 }
603 
icv_hppir_read(CPUARMState * env,const ARMCPRegInfo * ri)604 static uint64_t icv_hppir_read(CPUARMState *env, const ARMCPRegInfo *ri)
605 {
606     GICv3CPUState *cs = icc_cs_from_env(env);
607     int grp = ri->crm == 8 ? GICV3_G0 : GICV3_G1NS;
608     int idx = hppvi_index(cs);
609     uint64_t value = INTID_SPURIOUS;
610 
611     if (idx >= 0) {
612         uint64_t lr = cs->ich_lr_el2[idx];
613         int thisgrp = (lr & ICH_LR_EL2_GROUP) ? GICV3_G1NS : GICV3_G0;
614 
615         if (grp == thisgrp) {
616             value = ich_lr_vintid(lr);
617         }
618     }
619 
620     trace_gicv3_icv_hppir_read(grp, gicv3_redist_affid(cs), value);
621     return value;
622 }
623 
icv_activate_irq(GICv3CPUState * cs,int idx,int grp)624 static void icv_activate_irq(GICv3CPUState *cs, int idx, int grp)
625 {
626     /* Activate the interrupt in the specified list register
627      * by moving it from Pending to Active state, and update the
628      * Active Priority Registers.
629      */
630     uint32_t mask = icv_gprio_mask(cs, grp);
631     int prio = ich_lr_prio(cs->ich_lr_el2[idx]) & mask;
632     int aprbit = prio >> (8 - cs->vprebits);
633     int regno = aprbit / 32;
634     int regbit = aprbit % 32;
635 
636     cs->ich_lr_el2[idx] &= ~ICH_LR_EL2_STATE_PENDING_BIT;
637     cs->ich_lr_el2[idx] |= ICH_LR_EL2_STATE_ACTIVE_BIT;
638     cs->ich_apr[grp][regno] |= (1 << regbit);
639 }
640 
icv_iar_read(CPUARMState * env,const ARMCPRegInfo * ri)641 static uint64_t icv_iar_read(CPUARMState *env, const ARMCPRegInfo *ri)
642 {
643     GICv3CPUState *cs = icc_cs_from_env(env);
644     int grp = ri->crm == 8 ? GICV3_G0 : GICV3_G1NS;
645     int idx = hppvi_index(cs);
646     uint64_t intid = INTID_SPURIOUS;
647 
648     if (idx >= 0) {
649         uint64_t lr = cs->ich_lr_el2[idx];
650         int thisgrp = (lr & ICH_LR_EL2_GROUP) ? GICV3_G1NS : GICV3_G0;
651 
652         if (thisgrp == grp && icv_hppi_can_preempt(cs, lr)) {
653             intid = ich_lr_vintid(lr);
654             if (intid < INTID_SECURE) {
655                 icv_activate_irq(cs, idx, grp);
656             } else {
657                 /* Interrupt goes from Pending to Invalid */
658                 cs->ich_lr_el2[idx] &= ~ICH_LR_EL2_STATE_PENDING_BIT;
659                 /* We will now return the (bogus) ID from the list register,
660                  * as per the pseudocode.
661                  */
662             }
663         }
664     }
665 
666     trace_gicv3_icv_iar_read(ri->crm == 8 ? 0 : 1,
667                              gicv3_redist_affid(cs), intid);
668 
669     gicv3_cpuif_virt_update(cs);
670 
671     return intid;
672 }
673 
icc_highest_active_prio(GICv3CPUState * cs)674 static int icc_highest_active_prio(GICv3CPUState *cs)
675 {
676     /* Calculate the current running priority based on the set bits
677      * in the Active Priority Registers.
678      */
679     int i;
680 
681     for (i = 0; i < ARRAY_SIZE(cs->icc_apr[0]); i++) {
682         uint32_t apr = cs->icc_apr[GICV3_G0][i] |
683             cs->icc_apr[GICV3_G1][i] | cs->icc_apr[GICV3_G1NS][i];
684 
685         if (!apr) {
686             continue;
687         }
688         return (i * 32 + ctz32(apr)) << (GIC_MIN_BPR + 1);
689     }
690     /* No current active interrupts: return idle priority */
691     return 0xff;
692 }
693 
icc_gprio_mask(GICv3CPUState * cs,int group)694 static uint32_t icc_gprio_mask(GICv3CPUState *cs, int group)
695 {
696     /* Return a mask word which clears the subpriority bits from
697      * a priority value for an interrupt in the specified group.
698      * This depends on the BPR value. For CBPR0 (S or NS):
699      *  a BPR of 0 means the group priority bits are [7:1];
700      *  a BPR of 1 means they are [7:2], and so on down to
701      *  a BPR of 7 meaning no group priority bits at all.
702      * For CBPR1 NS:
703      *  a BPR of 0 is impossible (the minimum value is 1)
704      *  a BPR of 1 means the group priority bits are [7:1];
705      *  a BPR of 2 means they are [7:2], and so on down to
706      *  a BPR of 7 meaning the group priority is [7].
707      *
708      * Which BPR to use depends on the group of the interrupt and
709      * the current ICC_CTLR.CBPR settings.
710      *
711      * This corresponds to the GroupBits() pseudocode.
712      */
713     int bpr;
714 
715     if ((group == GICV3_G1 && cs->icc_ctlr_el1[GICV3_S] & ICC_CTLR_EL1_CBPR) ||
716         (group == GICV3_G1NS &&
717          cs->icc_ctlr_el1[GICV3_NS] & ICC_CTLR_EL1_CBPR)) {
718         group = GICV3_G0;
719     }
720 
721     bpr = cs->icc_bpr[group] & 7;
722 
723     if (group == GICV3_G1NS) {
724         assert(bpr > 0);
725         bpr--;
726     }
727 
728     return ~0U << (bpr + 1);
729 }
730 
icc_no_enabled_hppi(GICv3CPUState * cs)731 static bool icc_no_enabled_hppi(GICv3CPUState *cs)
732 {
733     /* Return true if there is no pending interrupt, or the
734      * highest priority pending interrupt is in a group which has been
735      * disabled at the CPU interface by the ICC_IGRPEN* register enable bits.
736      */
737     return cs->hppi.prio == 0xff || (cs->icc_igrpen[cs->hppi.grp] == 0);
738 }
739 
icc_hppi_can_preempt(GICv3CPUState * cs)740 static bool icc_hppi_can_preempt(GICv3CPUState *cs)
741 {
742     /* Return true if we have a pending interrupt of sufficient
743      * priority to preempt.
744      */
745     int rprio;
746     uint32_t mask;
747 
748     if (icc_no_enabled_hppi(cs)) {
749         return false;
750     }
751 
752     if (cs->hppi.prio >= cs->icc_pmr_el1) {
753         /* Priority mask masks this interrupt */
754         return false;
755     }
756 
757     rprio = icc_highest_active_prio(cs);
758     if (rprio == 0xff) {
759         /* No currently running interrupt so we can preempt */
760         return true;
761     }
762 
763     mask = icc_gprio_mask(cs, cs->hppi.grp);
764 
765     /* We only preempt a running interrupt if the pending interrupt's
766      * group priority is sufficient (the subpriorities are not considered).
767      */
768     if ((cs->hppi.prio & mask) < (rprio & mask)) {
769         return true;
770     }
771 
772     return false;
773 }
774 
gicv3_cpuif_update(GICv3CPUState * cs)775 void gicv3_cpuif_update(GICv3CPUState *cs)
776 {
777     /* Tell the CPU about its highest priority pending interrupt */
778     int irqlevel = 0;
779     int fiqlevel = 0;
780     ARMCPU *cpu = ARM_CPU(cs->cpu);
781     CPUARMState *env = &cpu->env;
782 
783     g_assert(qemu_mutex_iothread_locked());
784 
785     trace_gicv3_cpuif_update(gicv3_redist_affid(cs), cs->hppi.irq,
786                              cs->hppi.grp, cs->hppi.prio);
787 
788     if (cs->hppi.grp == GICV3_G1 && !arm_feature(env, ARM_FEATURE_EL3)) {
789         /* If a Security-enabled GIC sends a G1S interrupt to a
790          * Security-disabled CPU, we must treat it as if it were G0.
791          */
792         cs->hppi.grp = GICV3_G0;
793     }
794 
795     if (icc_hppi_can_preempt(cs)) {
796         /* We have an interrupt: should we signal it as IRQ or FIQ?
797          * This is described in the GICv3 spec section 4.6.2.
798          */
799         bool isfiq;
800 
801         switch (cs->hppi.grp) {
802         case GICV3_G0:
803             isfiq = true;
804             break;
805         case GICV3_G1:
806             isfiq = (!arm_is_secure(env) ||
807                      (arm_current_el(env) == 3 && arm_el_is_aa64(env, 3)));
808             break;
809         case GICV3_G1NS:
810             isfiq = arm_is_secure(env);
811             break;
812         default:
813             g_assert_not_reached();
814         }
815 
816         if (isfiq) {
817             fiqlevel = 1;
818         } else {
819             irqlevel = 1;
820         }
821     }
822 
823     trace_gicv3_cpuif_set_irqs(gicv3_redist_affid(cs), fiqlevel, irqlevel);
824 
825     qemu_set_irq(cs->parent_fiq, fiqlevel);
826     qemu_set_irq(cs->parent_irq, irqlevel);
827 }
828 
icc_pmr_read(CPUARMState * env,const ARMCPRegInfo * ri)829 static uint64_t icc_pmr_read(CPUARMState *env, const ARMCPRegInfo *ri)
830 {
831     GICv3CPUState *cs = icc_cs_from_env(env);
832     uint32_t value = cs->icc_pmr_el1;
833 
834     if (icv_access(env, HCR_FMO | HCR_IMO)) {
835         return icv_pmr_read(env, ri);
836     }
837 
838     if (arm_feature(env, ARM_FEATURE_EL3) && !arm_is_secure(env) &&
839         (env->cp15.scr_el3 & SCR_FIQ)) {
840         /* NS access and Group 0 is inaccessible to NS: return the
841          * NS view of the current priority
842          */
843         if ((value & 0x80) == 0) {
844             /* Secure priorities not visible to NS */
845             value = 0;
846         } else if (value != 0xff) {
847             value = (value << 1) & 0xff;
848         }
849     }
850 
851     trace_gicv3_icc_pmr_read(gicv3_redist_affid(cs), value);
852 
853     return value;
854 }
855 
icc_pmr_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)856 static void icc_pmr_write(CPUARMState *env, const ARMCPRegInfo *ri,
857                           uint64_t value)
858 {
859     GICv3CPUState *cs = icc_cs_from_env(env);
860 
861     if (icv_access(env, HCR_FMO | HCR_IMO)) {
862         return icv_pmr_write(env, ri, value);
863     }
864 
865     trace_gicv3_icc_pmr_write(gicv3_redist_affid(cs), value);
866 
867     value &= 0xff;
868 
869     if (arm_feature(env, ARM_FEATURE_EL3) && !arm_is_secure(env) &&
870         (env->cp15.scr_el3 & SCR_FIQ)) {
871         /* NS access and Group 0 is inaccessible to NS: return the
872          * NS view of the current priority
873          */
874         if (!(cs->icc_pmr_el1 & 0x80)) {
875             /* Current PMR in the secure range, don't allow NS to change it */
876             return;
877         }
878         value = (value >> 1) | 0x80;
879     }
880     cs->icc_pmr_el1 = value;
881     gicv3_cpuif_update(cs);
882 }
883 
icc_activate_irq(GICv3CPUState * cs,int irq)884 static void icc_activate_irq(GICv3CPUState *cs, int irq)
885 {
886     /* Move the interrupt from the Pending state to Active, and update
887      * the Active Priority Registers
888      */
889     uint32_t mask = icc_gprio_mask(cs, cs->hppi.grp);
890     int prio = cs->hppi.prio & mask;
891     int aprbit = prio >> 1;
892     int regno = aprbit / 32;
893     int regbit = aprbit % 32;
894 
895     cs->icc_apr[cs->hppi.grp][regno] |= (1 << regbit);
896 
897     if (irq < GIC_INTERNAL) {
898         cs->gicr_iactiver0 = deposit32(cs->gicr_iactiver0, irq, 1, 1);
899         cs->gicr_ipendr0 = deposit32(cs->gicr_ipendr0, irq, 1, 0);
900         gicv3_redist_update(cs);
901     } else {
902         gicv3_gicd_active_set(cs->gic, irq);
903         gicv3_gicd_pending_clear(cs->gic, irq);
904         gicv3_update(cs->gic, irq, 1);
905     }
906 }
907 
icc_hppir0_value(GICv3CPUState * cs,CPUARMState * env)908 static uint64_t icc_hppir0_value(GICv3CPUState *cs, CPUARMState *env)
909 {
910     /* Return the highest priority pending interrupt register value
911      * for group 0.
912      */
913     bool irq_is_secure;
914 
915     if (cs->hppi.prio == 0xff) {
916         return INTID_SPURIOUS;
917     }
918 
919     /* Check whether we can return the interrupt or if we should return
920      * a special identifier, as per the CheckGroup0ForSpecialIdentifiers
921      * pseudocode. (We can simplify a little because for us ICC_SRE_EL1.RM
922      * is always zero.)
923      */
924     irq_is_secure = (!(cs->gic->gicd_ctlr & GICD_CTLR_DS) &&
925                      (cs->hppi.grp != GICV3_G1NS));
926 
927     if (cs->hppi.grp != GICV3_G0 && !arm_is_el3_or_mon(env)) {
928         return INTID_SPURIOUS;
929     }
930     if (irq_is_secure && !arm_is_secure(env)) {
931         /* Secure interrupts not visible to Nonsecure */
932         return INTID_SPURIOUS;
933     }
934 
935     if (cs->hppi.grp != GICV3_G0) {
936         /* Indicate to EL3 that there's a Group 1 interrupt for the other
937          * state pending.
938          */
939         return irq_is_secure ? INTID_SECURE : INTID_NONSECURE;
940     }
941 
942     return cs->hppi.irq;
943 }
944 
icc_hppir1_value(GICv3CPUState * cs,CPUARMState * env)945 static uint64_t icc_hppir1_value(GICv3CPUState *cs, CPUARMState *env)
946 {
947     /* Return the highest priority pending interrupt register value
948      * for group 1.
949      */
950     bool irq_is_secure;
951 
952     if (cs->hppi.prio == 0xff) {
953         return INTID_SPURIOUS;
954     }
955 
956     /* Check whether we can return the interrupt or if we should return
957      * a special identifier, as per the CheckGroup1ForSpecialIdentifiers
958      * pseudocode. (We can simplify a little because for us ICC_SRE_EL1.RM
959      * is always zero.)
960      */
961     irq_is_secure = (!(cs->gic->gicd_ctlr & GICD_CTLR_DS) &&
962                      (cs->hppi.grp != GICV3_G1NS));
963 
964     if (cs->hppi.grp == GICV3_G0) {
965         /* Group 0 interrupts not visible via HPPIR1 */
966         return INTID_SPURIOUS;
967     }
968     if (irq_is_secure) {
969         if (!arm_is_secure(env)) {
970             /* Secure interrupts not visible in Non-secure */
971             return INTID_SPURIOUS;
972         }
973     } else if (!arm_is_el3_or_mon(env) && arm_is_secure(env)) {
974         /* Group 1 non-secure interrupts not visible in Secure EL1 */
975         return INTID_SPURIOUS;
976     }
977 
978     return cs->hppi.irq;
979 }
980 
icc_iar0_read(CPUARMState * env,const ARMCPRegInfo * ri)981 static uint64_t icc_iar0_read(CPUARMState *env, const ARMCPRegInfo *ri)
982 {
983     GICv3CPUState *cs = icc_cs_from_env(env);
984     uint64_t intid;
985 
986     if (icv_access(env, HCR_FMO)) {
987         return icv_iar_read(env, ri);
988     }
989 
990     if (!icc_hppi_can_preempt(cs)) {
991         intid = INTID_SPURIOUS;
992     } else {
993         intid = icc_hppir0_value(cs, env);
994     }
995 
996     if (!(intid >= INTID_SECURE && intid <= INTID_SPURIOUS)) {
997         icc_activate_irq(cs, intid);
998     }
999 
1000     trace_gicv3_icc_iar0_read(gicv3_redist_affid(cs), intid);
1001     return intid;
1002 }
1003 
icc_iar1_read(CPUARMState * env,const ARMCPRegInfo * ri)1004 static uint64_t icc_iar1_read(CPUARMState *env, const ARMCPRegInfo *ri)
1005 {
1006     GICv3CPUState *cs = icc_cs_from_env(env);
1007     uint64_t intid;
1008 
1009     if (icv_access(env, HCR_IMO)) {
1010         return icv_iar_read(env, ri);
1011     }
1012 
1013     if (!icc_hppi_can_preempt(cs)) {
1014         intid = INTID_SPURIOUS;
1015     } else {
1016         intid = icc_hppir1_value(cs, env);
1017     }
1018 
1019     if (!(intid >= INTID_SECURE && intid <= INTID_SPURIOUS)) {
1020         icc_activate_irq(cs, intid);
1021     }
1022 
1023     trace_gicv3_icc_iar1_read(gicv3_redist_affid(cs), intid);
1024     return intid;
1025 }
1026 
icc_drop_prio(GICv3CPUState * cs,int grp)1027 static void icc_drop_prio(GICv3CPUState *cs, int grp)
1028 {
1029     /* Drop the priority of the currently active interrupt in
1030      * the specified group.
1031      *
1032      * Note that we can guarantee (because of the requirement to nest
1033      * ICC_IAR reads [which activate an interrupt and raise priority]
1034      * with ICC_EOIR writes [which drop the priority for the interrupt])
1035      * that the interrupt we're being called for is the highest priority
1036      * active interrupt, meaning that it has the lowest set bit in the
1037      * APR registers.
1038      *
1039      * If the guest does not honour the ordering constraints then the
1040      * behaviour of the GIC is UNPREDICTABLE, which for us means that
1041      * the values of the APR registers might become incorrect and the
1042      * running priority will be wrong, so interrupts that should preempt
1043      * might not do so, and interrupts that should not preempt might do so.
1044      */
1045     int i;
1046 
1047     for (i = 0; i < ARRAY_SIZE(cs->icc_apr[grp]); i++) {
1048         uint64_t *papr = &cs->icc_apr[grp][i];
1049 
1050         if (!*papr) {
1051             continue;
1052         }
1053         /* Clear the lowest set bit */
1054         *papr &= *papr - 1;
1055         break;
1056     }
1057 
1058     /* running priority change means we need an update for this cpu i/f */
1059     gicv3_cpuif_update(cs);
1060 }
1061 
icc_eoi_split(CPUARMState * env,GICv3CPUState * cs)1062 static bool icc_eoi_split(CPUARMState *env, GICv3CPUState *cs)
1063 {
1064     /* Return true if we should split priority drop and interrupt
1065      * deactivation, ie whether the relevant EOIMode bit is set.
1066      */
1067     if (arm_is_el3_or_mon(env)) {
1068         return cs->icc_ctlr_el3 & ICC_CTLR_EL3_EOIMODE_EL3;
1069     }
1070     if (arm_is_secure_below_el3(env)) {
1071         return cs->icc_ctlr_el1[GICV3_S] & ICC_CTLR_EL1_EOIMODE;
1072     } else {
1073         return cs->icc_ctlr_el1[GICV3_NS] & ICC_CTLR_EL1_EOIMODE;
1074     }
1075 }
1076 
icc_highest_active_group(GICv3CPUState * cs)1077 static int icc_highest_active_group(GICv3CPUState *cs)
1078 {
1079     /* Return the group with the highest priority active interrupt.
1080      * We can do this by just comparing the APRs to see which one
1081      * has the lowest set bit.
1082      * (If more than one group is active at the same priority then
1083      * we're in UNPREDICTABLE territory.)
1084      */
1085     int i;
1086 
1087     for (i = 0; i < ARRAY_SIZE(cs->icc_apr[0]); i++) {
1088         int g0ctz = ctz32(cs->icc_apr[GICV3_G0][i]);
1089         int g1ctz = ctz32(cs->icc_apr[GICV3_G1][i]);
1090         int g1nsctz = ctz32(cs->icc_apr[GICV3_G1NS][i]);
1091 
1092         if (g1nsctz < g0ctz && g1nsctz < g1ctz) {
1093             return GICV3_G1NS;
1094         }
1095         if (g1ctz < g0ctz) {
1096             return GICV3_G1;
1097         }
1098         if (g0ctz < 32) {
1099             return GICV3_G0;
1100         }
1101     }
1102     /* No set active bits? UNPREDICTABLE; return -1 so the caller
1103      * ignores the spurious EOI attempt.
1104      */
1105     return -1;
1106 }
1107 
icc_deactivate_irq(GICv3CPUState * cs,int irq)1108 static void icc_deactivate_irq(GICv3CPUState *cs, int irq)
1109 {
1110     if (irq < GIC_INTERNAL) {
1111         cs->gicr_iactiver0 = deposit32(cs->gicr_iactiver0, irq, 1, 0);
1112         gicv3_redist_update(cs);
1113     } else {
1114         gicv3_gicd_active_clear(cs->gic, irq);
1115         gicv3_update(cs->gic, irq, 1);
1116     }
1117 }
1118 
icv_eoi_split(CPUARMState * env,GICv3CPUState * cs)1119 static bool icv_eoi_split(CPUARMState *env, GICv3CPUState *cs)
1120 {
1121     /* Return true if we should split priority drop and interrupt
1122      * deactivation, ie whether the virtual EOIMode bit is set.
1123      */
1124     return cs->ich_vmcr_el2 & ICH_VMCR_EL2_VEOIM;
1125 }
1126 
icv_find_active(GICv3CPUState * cs,int irq)1127 static int icv_find_active(GICv3CPUState *cs, int irq)
1128 {
1129     /* Given an interrupt number for an active interrupt, return the index
1130      * of the corresponding list register, or -1 if there is no match.
1131      * Corresponds to FindActiveVirtualInterrupt pseudocode.
1132      */
1133     int i;
1134 
1135     for (i = 0; i < cs->num_list_regs; i++) {
1136         uint64_t lr = cs->ich_lr_el2[i];
1137 
1138         if ((lr & ICH_LR_EL2_STATE_ACTIVE_BIT) && ich_lr_vintid(lr) == irq) {
1139             return i;
1140         }
1141     }
1142 
1143     return -1;
1144 }
1145 
icv_deactivate_irq(GICv3CPUState * cs,int idx)1146 static void icv_deactivate_irq(GICv3CPUState *cs, int idx)
1147 {
1148     /* Deactivate the interrupt in the specified list register index */
1149     uint64_t lr = cs->ich_lr_el2[idx];
1150 
1151     if (lr & ICH_LR_EL2_HW) {
1152         /* Deactivate the associated physical interrupt */
1153         int pirq = ich_lr_pintid(lr);
1154 
1155         if (pirq < INTID_SECURE) {
1156             icc_deactivate_irq(cs, pirq);
1157         }
1158     }
1159 
1160     /* Clear the 'active' part of the state, so ActivePending->Pending
1161      * and Active->Invalid.
1162      */
1163     lr &= ~ICH_LR_EL2_STATE_ACTIVE_BIT;
1164     cs->ich_lr_el2[idx] = lr;
1165 }
1166 
icv_increment_eoicount(GICv3CPUState * cs)1167 static void icv_increment_eoicount(GICv3CPUState *cs)
1168 {
1169     /* Increment the EOICOUNT field in ICH_HCR_EL2 */
1170     int eoicount = extract64(cs->ich_hcr_el2, ICH_HCR_EL2_EOICOUNT_SHIFT,
1171                              ICH_HCR_EL2_EOICOUNT_LENGTH);
1172 
1173     cs->ich_hcr_el2 = deposit64(cs->ich_hcr_el2, ICH_HCR_EL2_EOICOUNT_SHIFT,
1174                                 ICH_HCR_EL2_EOICOUNT_LENGTH, eoicount + 1);
1175 }
1176 
icv_drop_prio(GICv3CPUState * cs)1177 static int icv_drop_prio(GICv3CPUState *cs)
1178 {
1179     /* Drop the priority of the currently active virtual interrupt
1180      * (favouring group 0 if there is a set active bit at
1181      * the same priority for both group 0 and group 1).
1182      * Return the priority value for the bit we just cleared,
1183      * or 0xff if no bits were set in the AP registers at all.
1184      * Note that though the ich_apr[] are uint64_t only the low
1185      * 32 bits are actually relevant.
1186      */
1187     int i;
1188     int aprmax = 1 << (cs->vprebits - 5);
1189 
1190     assert(aprmax <= ARRAY_SIZE(cs->ich_apr[0]));
1191 
1192     for (i = 0; i < aprmax; i++) {
1193         uint64_t *papr0 = &cs->ich_apr[GICV3_G0][i];
1194         uint64_t *papr1 = &cs->ich_apr[GICV3_G1NS][i];
1195         int apr0count, apr1count;
1196 
1197         if (!*papr0 && !*papr1) {
1198             continue;
1199         }
1200 
1201         /* We can't just use the bit-twiddling hack icc_drop_prio() does
1202          * because we need to return the bit number we cleared so
1203          * it can be compared against the list register's priority field.
1204          */
1205         apr0count = ctz32(*papr0);
1206         apr1count = ctz32(*papr1);
1207 
1208         if (apr0count <= apr1count) {
1209             *papr0 &= *papr0 - 1;
1210             return (apr0count + i * 32) << (icv_min_vbpr(cs) + 1);
1211         } else {
1212             *papr1 &= *papr1 - 1;
1213             return (apr1count + i * 32) << (icv_min_vbpr(cs) + 1);
1214         }
1215     }
1216     return 0xff;
1217 }
1218 
icv_dir_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)1219 static void icv_dir_write(CPUARMState *env, const ARMCPRegInfo *ri,
1220                           uint64_t value)
1221 {
1222     /* Deactivate interrupt */
1223     GICv3CPUState *cs = icc_cs_from_env(env);
1224     int idx;
1225     int irq = value & 0xffffff;
1226 
1227     trace_gicv3_icv_dir_write(gicv3_redist_affid(cs), value);
1228 
1229     if (irq >= cs->gic->num_irq) {
1230         /* Also catches special interrupt numbers and LPIs */
1231         return;
1232     }
1233 
1234     if (!icv_eoi_split(env, cs)) {
1235         return;
1236     }
1237 
1238     idx = icv_find_active(cs, irq);
1239 
1240     if (idx < 0) {
1241         /* No list register matching this, so increment the EOI count
1242          * (might trigger a maintenance interrupt)
1243          */
1244         icv_increment_eoicount(cs);
1245     } else {
1246         icv_deactivate_irq(cs, idx);
1247     }
1248 
1249     gicv3_cpuif_virt_update(cs);
1250 }
1251 
icv_eoir_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)1252 static void icv_eoir_write(CPUARMState *env, const ARMCPRegInfo *ri,
1253                            uint64_t value)
1254 {
1255     /* End of Interrupt */
1256     GICv3CPUState *cs = icc_cs_from_env(env);
1257     int irq = value & 0xffffff;
1258     int grp = ri->crm == 8 ? GICV3_G0 : GICV3_G1NS;
1259     int idx, dropprio;
1260 
1261     trace_gicv3_icv_eoir_write(ri->crm == 8 ? 0 : 1,
1262                                gicv3_redist_affid(cs), value);
1263 
1264     if (irq >= cs->gic->num_irq) {
1265         /* Also catches special interrupt numbers and LPIs */
1266         return;
1267     }
1268 
1269     /* We implement the IMPDEF choice of "drop priority before doing
1270      * error checks" (because that lets us avoid scanning the AP
1271      * registers twice).
1272      */
1273     dropprio = icv_drop_prio(cs);
1274     if (dropprio == 0xff) {
1275         /* No active interrupt. It is CONSTRAINED UNPREDICTABLE
1276          * whether the list registers are checked in this
1277          * situation; we choose not to.
1278          */
1279         return;
1280     }
1281 
1282     idx = icv_find_active(cs, irq);
1283 
1284     if (idx < 0) {
1285         /* No valid list register corresponding to EOI ID */
1286         icv_increment_eoicount(cs);
1287     } else {
1288         uint64_t lr = cs->ich_lr_el2[idx];
1289         int thisgrp = (lr & ICH_LR_EL2_GROUP) ? GICV3_G1NS : GICV3_G0;
1290         int lr_gprio = ich_lr_prio(lr) & icv_gprio_mask(cs, grp);
1291 
1292         if (thisgrp == grp && lr_gprio == dropprio) {
1293             if (!icv_eoi_split(env, cs)) {
1294                 /* Priority drop and deactivate not split: deactivate irq now */
1295                 icv_deactivate_irq(cs, idx);
1296             }
1297         }
1298     }
1299 
1300     gicv3_cpuif_virt_update(cs);
1301 }
1302 
icc_eoir_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)1303 static void icc_eoir_write(CPUARMState *env, const ARMCPRegInfo *ri,
1304                            uint64_t value)
1305 {
1306     /* End of Interrupt */
1307     GICv3CPUState *cs = icc_cs_from_env(env);
1308     int irq = value & 0xffffff;
1309     int grp;
1310 
1311     if (icv_access(env, ri->crm == 8 ? HCR_FMO : HCR_IMO)) {
1312         icv_eoir_write(env, ri, value);
1313         return;
1314     }
1315 
1316     trace_gicv3_icc_eoir_write(ri->crm == 8 ? 0 : 1,
1317                                gicv3_redist_affid(cs), value);
1318 
1319     if (ri->crm == 8) {
1320         /* EOIR0 */
1321         grp = GICV3_G0;
1322     } else {
1323         /* EOIR1 */
1324         if (arm_is_secure(env)) {
1325             grp = GICV3_G1;
1326         } else {
1327             grp = GICV3_G1NS;
1328         }
1329     }
1330 
1331     if (irq >= cs->gic->num_irq) {
1332         /* This handles two cases:
1333          * 1. If software writes the ID of a spurious interrupt [ie 1020-1023]
1334          * to the GICC_EOIR, the GIC ignores that write.
1335          * 2. If software writes the number of a non-existent interrupt
1336          * this must be a subcase of "value written does not match the last
1337          * valid interrupt value read from the Interrupt Acknowledge
1338          * register" and so this is UNPREDICTABLE. We choose to ignore it.
1339          */
1340         return;
1341     }
1342 
1343     if (icc_highest_active_group(cs) != grp) {
1344         return;
1345     }
1346 
1347     icc_drop_prio(cs, grp);
1348 
1349     if (!icc_eoi_split(env, cs)) {
1350         /* Priority drop and deactivate not split: deactivate irq now */
1351         icc_deactivate_irq(cs, irq);
1352     }
1353 }
1354 
icc_hppir0_read(CPUARMState * env,const ARMCPRegInfo * ri)1355 static uint64_t icc_hppir0_read(CPUARMState *env, const ARMCPRegInfo *ri)
1356 {
1357     GICv3CPUState *cs = icc_cs_from_env(env);
1358     uint64_t value;
1359 
1360     if (icv_access(env, HCR_FMO)) {
1361         return icv_hppir_read(env, ri);
1362     }
1363 
1364     value = icc_hppir0_value(cs, env);
1365     trace_gicv3_icc_hppir0_read(gicv3_redist_affid(cs), value);
1366     return value;
1367 }
1368 
icc_hppir1_read(CPUARMState * env,const ARMCPRegInfo * ri)1369 static uint64_t icc_hppir1_read(CPUARMState *env, const ARMCPRegInfo *ri)
1370 {
1371     GICv3CPUState *cs = icc_cs_from_env(env);
1372     uint64_t value;
1373 
1374     if (icv_access(env, HCR_IMO)) {
1375         return icv_hppir_read(env, ri);
1376     }
1377 
1378     value = icc_hppir1_value(cs, env);
1379     trace_gicv3_icc_hppir1_read(gicv3_redist_affid(cs), value);
1380     return value;
1381 }
1382 
icc_bpr_read(CPUARMState * env,const ARMCPRegInfo * ri)1383 static uint64_t icc_bpr_read(CPUARMState *env, const ARMCPRegInfo *ri)
1384 {
1385     GICv3CPUState *cs = icc_cs_from_env(env);
1386     int grp = (ri->crm == 8) ? GICV3_G0 : GICV3_G1;
1387     bool satinc = false;
1388     uint64_t bpr;
1389 
1390     if (icv_access(env, grp == GICV3_G0 ? HCR_FMO : HCR_IMO)) {
1391         return icv_bpr_read(env, ri);
1392     }
1393 
1394     if (grp == GICV3_G1 && gicv3_use_ns_bank(env)) {
1395         grp = GICV3_G1NS;
1396     }
1397 
1398     if (grp == GICV3_G1 && !arm_is_el3_or_mon(env) &&
1399         (cs->icc_ctlr_el1[GICV3_S] & ICC_CTLR_EL1_CBPR)) {
1400         /* CBPR_EL1S means secure EL1 or AArch32 EL3 !Mon BPR1 accesses
1401          * modify BPR0
1402          */
1403         grp = GICV3_G0;
1404     }
1405 
1406     if (grp == GICV3_G1NS && arm_current_el(env) < 3 &&
1407         (cs->icc_ctlr_el1[GICV3_NS] & ICC_CTLR_EL1_CBPR)) {
1408         /* reads return bpr0 + 1 sat to 7, writes ignored */
1409         grp = GICV3_G0;
1410         satinc = true;
1411     }
1412 
1413     bpr = cs->icc_bpr[grp];
1414     if (satinc) {
1415         bpr++;
1416         bpr = MIN(bpr, 7);
1417     }
1418 
1419     trace_gicv3_icc_bpr_read(ri->crm == 8 ? 0 : 1, gicv3_redist_affid(cs), bpr);
1420 
1421     return bpr;
1422 }
1423 
icc_bpr_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)1424 static void icc_bpr_write(CPUARMState *env, const ARMCPRegInfo *ri,
1425                           uint64_t value)
1426 {
1427     GICv3CPUState *cs = icc_cs_from_env(env);
1428     int grp = (ri->crm == 8) ? GICV3_G0 : GICV3_G1;
1429     uint64_t minval;
1430 
1431     if (icv_access(env, grp == GICV3_G0 ? HCR_FMO : HCR_IMO)) {
1432         icv_bpr_write(env, ri, value);
1433         return;
1434     }
1435 
1436     trace_gicv3_icc_bpr_write(ri->crm == 8 ? 0 : 1,
1437                               gicv3_redist_affid(cs), value);
1438 
1439     if (grp == GICV3_G1 && gicv3_use_ns_bank(env)) {
1440         grp = GICV3_G1NS;
1441     }
1442 
1443     if (grp == GICV3_G1 && !arm_is_el3_or_mon(env) &&
1444         (cs->icc_ctlr_el1[GICV3_S] & ICC_CTLR_EL1_CBPR)) {
1445         /* CBPR_EL1S means secure EL1 or AArch32 EL3 !Mon BPR1 accesses
1446          * modify BPR0
1447          */
1448         grp = GICV3_G0;
1449     }
1450 
1451     if (grp == GICV3_G1NS && arm_current_el(env) < 3 &&
1452         (cs->icc_ctlr_el1[GICV3_NS] & ICC_CTLR_EL1_CBPR)) {
1453         /* reads return bpr0 + 1 sat to 7, writes ignored */
1454         return;
1455     }
1456 
1457     minval = (grp == GICV3_G1NS) ? GIC_MIN_BPR_NS : GIC_MIN_BPR;
1458     if (value < minval) {
1459         value = minval;
1460     }
1461 
1462     cs->icc_bpr[grp] = value & 7;
1463     gicv3_cpuif_update(cs);
1464 }
1465 
icc_ap_read(CPUARMState * env,const ARMCPRegInfo * ri)1466 static uint64_t icc_ap_read(CPUARMState *env, const ARMCPRegInfo *ri)
1467 {
1468     GICv3CPUState *cs = icc_cs_from_env(env);
1469     uint64_t value;
1470 
1471     int regno = ri->opc2 & 3;
1472     int grp = (ri->crm & 1) ? GICV3_G1 : GICV3_G0;
1473 
1474     if (icv_access(env, grp == GICV3_G0 ? HCR_FMO : HCR_IMO)) {
1475         return icv_ap_read(env, ri);
1476     }
1477 
1478     if (grp == GICV3_G1 && gicv3_use_ns_bank(env)) {
1479         grp = GICV3_G1NS;
1480     }
1481 
1482     value = cs->icc_apr[grp][regno];
1483 
1484     trace_gicv3_icc_ap_read(ri->crm & 1, regno, gicv3_redist_affid(cs), value);
1485     return value;
1486 }
1487 
icc_ap_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)1488 static void icc_ap_write(CPUARMState *env, const ARMCPRegInfo *ri,
1489                          uint64_t value)
1490 {
1491     GICv3CPUState *cs = icc_cs_from_env(env);
1492 
1493     int regno = ri->opc2 & 3;
1494     int grp = (ri->crm & 1) ? GICV3_G1 : GICV3_G0;
1495 
1496     if (icv_access(env, grp == GICV3_G0 ? HCR_FMO : HCR_IMO)) {
1497         icv_ap_write(env, ri, value);
1498         return;
1499     }
1500 
1501     trace_gicv3_icc_ap_write(ri->crm & 1, regno, gicv3_redist_affid(cs), value);
1502 
1503     if (grp == GICV3_G1 && gicv3_use_ns_bank(env)) {
1504         grp = GICV3_G1NS;
1505     }
1506 
1507     /* It's not possible to claim that a Non-secure interrupt is active
1508      * at a priority outside the Non-secure range (128..255), since this
1509      * would otherwise allow malicious NS code to block delivery of S interrupts
1510      * by writing a bad value to these registers.
1511      */
1512     if (grp == GICV3_G1NS && regno < 2 && arm_feature(env, ARM_FEATURE_EL3)) {
1513         return;
1514     }
1515 
1516     cs->icc_apr[grp][regno] = value & 0xFFFFFFFFU;
1517     gicv3_cpuif_update(cs);
1518 }
1519 
icc_dir_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)1520 static void icc_dir_write(CPUARMState *env, const ARMCPRegInfo *ri,
1521                           uint64_t value)
1522 {
1523     /* Deactivate interrupt */
1524     GICv3CPUState *cs = icc_cs_from_env(env);
1525     int irq = value & 0xffffff;
1526     bool irq_is_secure, single_sec_state, irq_is_grp0;
1527     bool route_fiq_to_el3, route_irq_to_el3, route_fiq_to_el2, route_irq_to_el2;
1528 
1529     if (icv_access(env, HCR_FMO | HCR_IMO)) {
1530         icv_dir_write(env, ri, value);
1531         return;
1532     }
1533 
1534     trace_gicv3_icc_dir_write(gicv3_redist_affid(cs), value);
1535 
1536     if (irq >= cs->gic->num_irq) {
1537         /* Also catches special interrupt numbers and LPIs */
1538         return;
1539     }
1540 
1541     if (!icc_eoi_split(env, cs)) {
1542         return;
1543     }
1544 
1545     int grp = gicv3_irq_group(cs->gic, cs, irq);
1546 
1547     single_sec_state = cs->gic->gicd_ctlr & GICD_CTLR_DS;
1548     irq_is_secure = !single_sec_state && (grp != GICV3_G1NS);
1549     irq_is_grp0 = grp == GICV3_G0;
1550 
1551     /* Check whether we're allowed to deactivate this interrupt based
1552      * on its group and the current CPU state.
1553      * These checks are laid out to correspond to the spec's pseudocode.
1554      */
1555     route_fiq_to_el3 = env->cp15.scr_el3 & SCR_FIQ;
1556     route_irq_to_el3 = env->cp15.scr_el3 & SCR_IRQ;
1557     /* No need to include !IsSecure in route_*_to_el2 as it's only
1558      * tested in cases where we know !IsSecure is true.
1559      */
1560     uint64_t hcr_el2 = arm_hcr_el2_eff(env);
1561     route_fiq_to_el2 = hcr_el2 & HCR_FMO;
1562     route_irq_to_el2 = hcr_el2 & HCR_IMO;
1563 
1564     switch (arm_current_el(env)) {
1565     case 3:
1566         break;
1567     case 2:
1568         if (single_sec_state && irq_is_grp0 && !route_fiq_to_el3) {
1569             break;
1570         }
1571         if (!irq_is_secure && !irq_is_grp0 && !route_irq_to_el3) {
1572             break;
1573         }
1574         return;
1575     case 1:
1576         if (!arm_is_secure_below_el3(env)) {
1577             if (single_sec_state && irq_is_grp0 &&
1578                 !route_fiq_to_el3 && !route_fiq_to_el2) {
1579                 break;
1580             }
1581             if (!irq_is_secure && !irq_is_grp0 &&
1582                 !route_irq_to_el3 && !route_irq_to_el2) {
1583                 break;
1584             }
1585         } else {
1586             if (irq_is_grp0 && !route_fiq_to_el3) {
1587                 break;
1588             }
1589             if (!irq_is_grp0 &&
1590                 (!irq_is_secure || !single_sec_state) &&
1591                 !route_irq_to_el3) {
1592                 break;
1593             }
1594         }
1595         return;
1596     default:
1597         g_assert_not_reached();
1598     }
1599 
1600     icc_deactivate_irq(cs, irq);
1601 }
1602 
icc_rpr_read(CPUARMState * env,const ARMCPRegInfo * ri)1603 static uint64_t icc_rpr_read(CPUARMState *env, const ARMCPRegInfo *ri)
1604 {
1605     GICv3CPUState *cs = icc_cs_from_env(env);
1606     int prio;
1607 
1608     if (icv_access(env, HCR_FMO | HCR_IMO)) {
1609         return icv_rpr_read(env, ri);
1610     }
1611 
1612     prio = icc_highest_active_prio(cs);
1613 
1614     if (arm_feature(env, ARM_FEATURE_EL3) &&
1615         !arm_is_secure(env) && (env->cp15.scr_el3 & SCR_FIQ)) {
1616         /* NS GIC access and Group 0 is inaccessible to NS */
1617         if ((prio & 0x80) == 0) {
1618             /* NS mustn't see priorities in the Secure half of the range */
1619             prio = 0;
1620         } else if (prio != 0xff) {
1621             /* Non-idle priority: show the Non-secure view of it */
1622             prio = (prio << 1) & 0xff;
1623         }
1624     }
1625 
1626     trace_gicv3_icc_rpr_read(gicv3_redist_affid(cs), prio);
1627     return prio;
1628 }
1629 
icc_generate_sgi(CPUARMState * env,GICv3CPUState * cs,uint64_t value,int grp,bool ns)1630 static void icc_generate_sgi(CPUARMState *env, GICv3CPUState *cs,
1631                              uint64_t value, int grp, bool ns)
1632 {
1633     GICv3State *s = cs->gic;
1634 
1635     /* Extract Aff3/Aff2/Aff1 and shift into the bottom 24 bits */
1636     uint64_t aff = extract64(value, 48, 8) << 16 |
1637         extract64(value, 32, 8) << 8 |
1638         extract64(value, 16, 8);
1639     uint32_t targetlist = extract64(value, 0, 16);
1640     uint32_t irq = extract64(value, 24, 4);
1641     bool irm = extract64(value, 40, 1);
1642     int i;
1643 
1644     if (grp == GICV3_G1 && s->gicd_ctlr & GICD_CTLR_DS) {
1645         /* If GICD_CTLR.DS == 1, the Distributor treats Secure Group 1
1646          * interrupts as Group 0 interrupts and must send Secure Group 0
1647          * interrupts to the target CPUs.
1648          */
1649         grp = GICV3_G0;
1650     }
1651 
1652     trace_gicv3_icc_generate_sgi(gicv3_redist_affid(cs), irq, irm,
1653                                  aff, targetlist);
1654 
1655     for (i = 0; i < s->num_cpu; i++) {
1656         GICv3CPUState *ocs = &s->cpu[i];
1657 
1658         if (irm) {
1659             /* IRM == 1 : route to all CPUs except self */
1660             if (cs == ocs) {
1661                 continue;
1662             }
1663         } else {
1664             /* IRM == 0 : route to Aff3.Aff2.Aff1.n for all n in [0..15]
1665              * where the corresponding bit is set in targetlist
1666              */
1667             int aff0;
1668 
1669             if (ocs->gicr_typer >> 40 != aff) {
1670                 continue;
1671             }
1672             aff0 = extract64(ocs->gicr_typer, 32, 8);
1673             if (aff0 > 15 || extract32(targetlist, aff0, 1) == 0) {
1674                 continue;
1675             }
1676         }
1677 
1678         /* The redistributor will check against its own GICR_NSACR as needed */
1679         gicv3_redist_send_sgi(ocs, grp, irq, ns);
1680     }
1681 }
1682 
icc_sgi0r_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)1683 static void icc_sgi0r_write(CPUARMState *env, const ARMCPRegInfo *ri,
1684                            uint64_t value)
1685 {
1686     /* Generate Secure Group 0 SGI. */
1687     GICv3CPUState *cs = icc_cs_from_env(env);
1688     bool ns = !arm_is_secure(env);
1689 
1690     icc_generate_sgi(env, cs, value, GICV3_G0, ns);
1691 }
1692 
icc_sgi1r_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)1693 static void icc_sgi1r_write(CPUARMState *env, const ARMCPRegInfo *ri,
1694                            uint64_t value)
1695 {
1696     /* Generate Group 1 SGI for the current Security state */
1697     GICv3CPUState *cs = icc_cs_from_env(env);
1698     int grp;
1699     bool ns = !arm_is_secure(env);
1700 
1701     grp = ns ? GICV3_G1NS : GICV3_G1;
1702     icc_generate_sgi(env, cs, value, grp, ns);
1703 }
1704 
icc_asgi1r_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)1705 static void icc_asgi1r_write(CPUARMState *env, const ARMCPRegInfo *ri,
1706                              uint64_t value)
1707 {
1708     /* Generate Group 1 SGI for the Security state that is not
1709      * the current state
1710      */
1711     GICv3CPUState *cs = icc_cs_from_env(env);
1712     int grp;
1713     bool ns = !arm_is_secure(env);
1714 
1715     grp = ns ? GICV3_G1 : GICV3_G1NS;
1716     icc_generate_sgi(env, cs, value, grp, ns);
1717 }
1718 
icc_igrpen_read(CPUARMState * env,const ARMCPRegInfo * ri)1719 static uint64_t icc_igrpen_read(CPUARMState *env, const ARMCPRegInfo *ri)
1720 {
1721     GICv3CPUState *cs = icc_cs_from_env(env);
1722     int grp = ri->opc2 & 1 ? GICV3_G1 : GICV3_G0;
1723     uint64_t value;
1724 
1725     if (icv_access(env, grp == GICV3_G0 ? HCR_FMO : HCR_IMO)) {
1726         return icv_igrpen_read(env, ri);
1727     }
1728 
1729     if (grp == GICV3_G1 && gicv3_use_ns_bank(env)) {
1730         grp = GICV3_G1NS;
1731     }
1732 
1733     value = cs->icc_igrpen[grp];
1734     trace_gicv3_icc_igrpen_read(ri->opc2 & 1 ? 1 : 0,
1735                                 gicv3_redist_affid(cs), value);
1736     return value;
1737 }
1738 
icc_igrpen_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)1739 static void icc_igrpen_write(CPUARMState *env, const ARMCPRegInfo *ri,
1740                              uint64_t value)
1741 {
1742     GICv3CPUState *cs = icc_cs_from_env(env);
1743     int grp = ri->opc2 & 1 ? GICV3_G1 : GICV3_G0;
1744 
1745     if (icv_access(env, grp == GICV3_G0 ? HCR_FMO : HCR_IMO)) {
1746         icv_igrpen_write(env, ri, value);
1747         return;
1748     }
1749 
1750     trace_gicv3_icc_igrpen_write(ri->opc2 & 1 ? 1 : 0,
1751                                  gicv3_redist_affid(cs), value);
1752 
1753     if (grp == GICV3_G1 && gicv3_use_ns_bank(env)) {
1754         grp = GICV3_G1NS;
1755     }
1756 
1757     cs->icc_igrpen[grp] = value & ICC_IGRPEN_ENABLE;
1758     gicv3_cpuif_update(cs);
1759 }
1760 
icc_igrpen1_el3_read(CPUARMState * env,const ARMCPRegInfo * ri)1761 static uint64_t icc_igrpen1_el3_read(CPUARMState *env, const ARMCPRegInfo *ri)
1762 {
1763     GICv3CPUState *cs = icc_cs_from_env(env);
1764     uint64_t value;
1765 
1766     /* IGRPEN1_EL3 bits 0 and 1 are r/w aliases into IGRPEN1_EL1 NS and S */
1767     value = cs->icc_igrpen[GICV3_G1NS] | (cs->icc_igrpen[GICV3_G1] << 1);
1768     trace_gicv3_icc_igrpen1_el3_read(gicv3_redist_affid(cs), value);
1769     return value;
1770 }
1771 
icc_igrpen1_el3_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)1772 static void icc_igrpen1_el3_write(CPUARMState *env, const ARMCPRegInfo *ri,
1773                                   uint64_t value)
1774 {
1775     GICv3CPUState *cs = icc_cs_from_env(env);
1776 
1777     trace_gicv3_icc_igrpen1_el3_write(gicv3_redist_affid(cs), value);
1778 
1779     /* IGRPEN1_EL3 bits 0 and 1 are r/w aliases into IGRPEN1_EL1 NS and S */
1780     cs->icc_igrpen[GICV3_G1NS] = extract32(value, 0, 1);
1781     cs->icc_igrpen[GICV3_G1] = extract32(value, 1, 1);
1782     gicv3_cpuif_update(cs);
1783 }
1784 
icc_ctlr_el1_read(CPUARMState * env,const ARMCPRegInfo * ri)1785 static uint64_t icc_ctlr_el1_read(CPUARMState *env, const ARMCPRegInfo *ri)
1786 {
1787     GICv3CPUState *cs = icc_cs_from_env(env);
1788     int bank = gicv3_use_ns_bank(env) ? GICV3_NS : GICV3_S;
1789     uint64_t value;
1790 
1791     if (icv_access(env, HCR_FMO | HCR_IMO)) {
1792         return icv_ctlr_read(env, ri);
1793     }
1794 
1795     value = cs->icc_ctlr_el1[bank];
1796     trace_gicv3_icc_ctlr_read(gicv3_redist_affid(cs), value);
1797     return value;
1798 }
1799 
icc_ctlr_el1_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)1800 static void icc_ctlr_el1_write(CPUARMState *env, const ARMCPRegInfo *ri,
1801                                uint64_t value)
1802 {
1803     GICv3CPUState *cs = icc_cs_from_env(env);
1804     int bank = gicv3_use_ns_bank(env) ? GICV3_NS : GICV3_S;
1805     uint64_t mask;
1806 
1807     if (icv_access(env, HCR_FMO | HCR_IMO)) {
1808         icv_ctlr_write(env, ri, value);
1809         return;
1810     }
1811 
1812     trace_gicv3_icc_ctlr_write(gicv3_redist_affid(cs), value);
1813 
1814     /* Only CBPR and EOIMODE can be RW;
1815      * for us PMHE is RAZ/WI (we don't implement 1-of-N interrupts or
1816      * the asseciated priority-based routing of them);
1817      * if EL3 is implemented and GICD_CTLR.DS == 0, then PMHE and CBPR are RO.
1818      */
1819     if (arm_feature(env, ARM_FEATURE_EL3) &&
1820         ((cs->gic->gicd_ctlr & GICD_CTLR_DS) == 0)) {
1821         mask = ICC_CTLR_EL1_EOIMODE;
1822     } else {
1823         mask = ICC_CTLR_EL1_CBPR | ICC_CTLR_EL1_EOIMODE;
1824     }
1825 
1826     cs->icc_ctlr_el1[bank] &= ~mask;
1827     cs->icc_ctlr_el1[bank] |= (value & mask);
1828     gicv3_cpuif_update(cs);
1829 }
1830 
1831 
icc_ctlr_el3_read(CPUARMState * env,const ARMCPRegInfo * ri)1832 static uint64_t icc_ctlr_el3_read(CPUARMState *env, const ARMCPRegInfo *ri)
1833 {
1834     GICv3CPUState *cs = icc_cs_from_env(env);
1835     uint64_t value;
1836 
1837     value = cs->icc_ctlr_el3;
1838     if (cs->icc_ctlr_el1[GICV3_NS] & ICC_CTLR_EL1_EOIMODE) {
1839         value |= ICC_CTLR_EL3_EOIMODE_EL1NS;
1840     }
1841     if (cs->icc_ctlr_el1[GICV3_NS] & ICC_CTLR_EL1_CBPR) {
1842         value |= ICC_CTLR_EL3_CBPR_EL1NS;
1843     }
1844     if (cs->icc_ctlr_el1[GICV3_NS] & ICC_CTLR_EL1_EOIMODE) {
1845         value |= ICC_CTLR_EL3_EOIMODE_EL1S;
1846     }
1847     if (cs->icc_ctlr_el1[GICV3_NS] & ICC_CTLR_EL1_CBPR) {
1848         value |= ICC_CTLR_EL3_CBPR_EL1S;
1849     }
1850 
1851     trace_gicv3_icc_ctlr_el3_read(gicv3_redist_affid(cs), value);
1852     return value;
1853 }
1854 
icc_ctlr_el3_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)1855 static void icc_ctlr_el3_write(CPUARMState *env, const ARMCPRegInfo *ri,
1856                                uint64_t value)
1857 {
1858     GICv3CPUState *cs = icc_cs_from_env(env);
1859     uint64_t mask;
1860 
1861     trace_gicv3_icc_ctlr_el3_write(gicv3_redist_affid(cs), value);
1862 
1863     /* *_EL1NS and *_EL1S bits are aliases into the ICC_CTLR_EL1 bits. */
1864     cs->icc_ctlr_el1[GICV3_NS] &= ~(ICC_CTLR_EL1_CBPR | ICC_CTLR_EL1_EOIMODE);
1865     if (value & ICC_CTLR_EL3_EOIMODE_EL1NS) {
1866         cs->icc_ctlr_el1[GICV3_NS] |= ICC_CTLR_EL1_EOIMODE;
1867     }
1868     if (value & ICC_CTLR_EL3_CBPR_EL1NS) {
1869         cs->icc_ctlr_el1[GICV3_NS] |= ICC_CTLR_EL1_CBPR;
1870     }
1871 
1872     cs->icc_ctlr_el1[GICV3_S] &= ~(ICC_CTLR_EL1_CBPR | ICC_CTLR_EL1_EOIMODE);
1873     if (value & ICC_CTLR_EL3_EOIMODE_EL1S) {
1874         cs->icc_ctlr_el1[GICV3_S] |= ICC_CTLR_EL1_EOIMODE;
1875     }
1876     if (value & ICC_CTLR_EL3_CBPR_EL1S) {
1877         cs->icc_ctlr_el1[GICV3_S] |= ICC_CTLR_EL1_CBPR;
1878     }
1879 
1880     /* The only bit stored in icc_ctlr_el3 which is writeable is EOIMODE_EL3: */
1881     mask = ICC_CTLR_EL3_EOIMODE_EL3;
1882 
1883     cs->icc_ctlr_el3 &= ~mask;
1884     cs->icc_ctlr_el3 |= (value & mask);
1885     gicv3_cpuif_update(cs);
1886 }
1887 
gicv3_irqfiq_access(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)1888 static CPAccessResult gicv3_irqfiq_access(CPUARMState *env,
1889                                           const ARMCPRegInfo *ri, bool isread)
1890 {
1891     CPAccessResult r = CP_ACCESS_OK;
1892     GICv3CPUState *cs = icc_cs_from_env(env);
1893     int el = arm_current_el(env);
1894 
1895     if ((cs->ich_hcr_el2 & ICH_HCR_EL2_TC) &&
1896         el == 1 && !arm_is_secure_below_el3(env)) {
1897         /* Takes priority over a possible EL3 trap */
1898         return CP_ACCESS_TRAP_EL2;
1899     }
1900 
1901     if ((env->cp15.scr_el3 & (SCR_FIQ | SCR_IRQ)) == (SCR_FIQ | SCR_IRQ)) {
1902         switch (el) {
1903         case 1:
1904             /* Note that arm_hcr_el2_eff takes secure state into account.  */
1905             if ((arm_hcr_el2_eff(env) & (HCR_IMO | HCR_FMO)) == 0) {
1906                 r = CP_ACCESS_TRAP_EL3;
1907             }
1908             break;
1909         case 2:
1910             r = CP_ACCESS_TRAP_EL3;
1911             break;
1912         case 3:
1913             if (!is_a64(env) && !arm_is_el3_or_mon(env)) {
1914                 r = CP_ACCESS_TRAP_EL3;
1915             }
1916             break;
1917         default:
1918             g_assert_not_reached();
1919         }
1920     }
1921 
1922     if (r == CP_ACCESS_TRAP_EL3 && !arm_el_is_aa64(env, 3)) {
1923         r = CP_ACCESS_TRAP;
1924     }
1925     return r;
1926 }
1927 
gicv3_dir_access(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)1928 static CPAccessResult gicv3_dir_access(CPUARMState *env,
1929                                        const ARMCPRegInfo *ri, bool isread)
1930 {
1931     GICv3CPUState *cs = icc_cs_from_env(env);
1932 
1933     if ((cs->ich_hcr_el2 & ICH_HCR_EL2_TDIR) &&
1934         arm_current_el(env) == 1 && !arm_is_secure_below_el3(env)) {
1935         /* Takes priority over a possible EL3 trap */
1936         return CP_ACCESS_TRAP_EL2;
1937     }
1938 
1939     return gicv3_irqfiq_access(env, ri, isread);
1940 }
1941 
gicv3_sgi_access(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)1942 static CPAccessResult gicv3_sgi_access(CPUARMState *env,
1943                                        const ARMCPRegInfo *ri, bool isread)
1944 {
1945     if (arm_current_el(env) == 1 &&
1946         (arm_hcr_el2_eff(env) & (HCR_IMO | HCR_FMO)) != 0) {
1947         /* Takes priority over a possible EL3 trap */
1948         return CP_ACCESS_TRAP_EL2;
1949     }
1950 
1951     return gicv3_irqfiq_access(env, ri, isread);
1952 }
1953 
gicv3_fiq_access(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)1954 static CPAccessResult gicv3_fiq_access(CPUARMState *env,
1955                                        const ARMCPRegInfo *ri, bool isread)
1956 {
1957     CPAccessResult r = CP_ACCESS_OK;
1958     GICv3CPUState *cs = icc_cs_from_env(env);
1959     int el = arm_current_el(env);
1960 
1961     if ((cs->ich_hcr_el2 & ICH_HCR_EL2_TALL0) &&
1962         el == 1 && !arm_is_secure_below_el3(env)) {
1963         /* Takes priority over a possible EL3 trap */
1964         return CP_ACCESS_TRAP_EL2;
1965     }
1966 
1967     if (env->cp15.scr_el3 & SCR_FIQ) {
1968         switch (el) {
1969         case 1:
1970             if ((arm_hcr_el2_eff(env) & HCR_FMO) == 0) {
1971                 r = CP_ACCESS_TRAP_EL3;
1972             }
1973             break;
1974         case 2:
1975             r = CP_ACCESS_TRAP_EL3;
1976             break;
1977         case 3:
1978             if (!is_a64(env) && !arm_is_el3_or_mon(env)) {
1979                 r = CP_ACCESS_TRAP_EL3;
1980             }
1981             break;
1982         default:
1983             g_assert_not_reached();
1984         }
1985     }
1986 
1987     if (r == CP_ACCESS_TRAP_EL3 && !arm_el_is_aa64(env, 3)) {
1988         r = CP_ACCESS_TRAP;
1989     }
1990     return r;
1991 }
1992 
gicv3_irq_access(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)1993 static CPAccessResult gicv3_irq_access(CPUARMState *env,
1994                                        const ARMCPRegInfo *ri, bool isread)
1995 {
1996     CPAccessResult r = CP_ACCESS_OK;
1997     GICv3CPUState *cs = icc_cs_from_env(env);
1998     int el = arm_current_el(env);
1999 
2000     if ((cs->ich_hcr_el2 & ICH_HCR_EL2_TALL1) &&
2001         el == 1 && !arm_is_secure_below_el3(env)) {
2002         /* Takes priority over a possible EL3 trap */
2003         return CP_ACCESS_TRAP_EL2;
2004     }
2005 
2006     if (env->cp15.scr_el3 & SCR_IRQ) {
2007         switch (el) {
2008         case 1:
2009             if ((arm_hcr_el2_eff(env) & HCR_IMO) == 0) {
2010                 r = CP_ACCESS_TRAP_EL3;
2011             }
2012             break;
2013         case 2:
2014             r = CP_ACCESS_TRAP_EL3;
2015             break;
2016         case 3:
2017             if (!is_a64(env) && !arm_is_el3_or_mon(env)) {
2018                 r = CP_ACCESS_TRAP_EL3;
2019             }
2020             break;
2021         default:
2022             g_assert_not_reached();
2023         }
2024     }
2025 
2026     if (r == CP_ACCESS_TRAP_EL3 && !arm_el_is_aa64(env, 3)) {
2027         r = CP_ACCESS_TRAP;
2028     }
2029     return r;
2030 }
2031 
icc_reset(CPUARMState * env,const ARMCPRegInfo * ri)2032 static void icc_reset(CPUARMState *env, const ARMCPRegInfo *ri)
2033 {
2034     GICv3CPUState *cs = icc_cs_from_env(env);
2035 
2036     cs->icc_ctlr_el1[GICV3_S] = ICC_CTLR_EL1_A3V |
2037         (1 << ICC_CTLR_EL1_IDBITS_SHIFT) |
2038         (7 << ICC_CTLR_EL1_PRIBITS_SHIFT);
2039     cs->icc_ctlr_el1[GICV3_NS] = ICC_CTLR_EL1_A3V |
2040         (1 << ICC_CTLR_EL1_IDBITS_SHIFT) |
2041         (7 << ICC_CTLR_EL1_PRIBITS_SHIFT);
2042     cs->icc_pmr_el1 = 0;
2043     cs->icc_bpr[GICV3_G0] = GIC_MIN_BPR;
2044     cs->icc_bpr[GICV3_G1] = GIC_MIN_BPR;
2045     cs->icc_bpr[GICV3_G1NS] = GIC_MIN_BPR_NS;
2046     memset(cs->icc_apr, 0, sizeof(cs->icc_apr));
2047     memset(cs->icc_igrpen, 0, sizeof(cs->icc_igrpen));
2048     cs->icc_ctlr_el3 = ICC_CTLR_EL3_NDS | ICC_CTLR_EL3_A3V |
2049         (1 << ICC_CTLR_EL3_IDBITS_SHIFT) |
2050         (7 << ICC_CTLR_EL3_PRIBITS_SHIFT);
2051 
2052     memset(cs->ich_apr, 0, sizeof(cs->ich_apr));
2053     cs->ich_hcr_el2 = 0;
2054     memset(cs->ich_lr_el2, 0, sizeof(cs->ich_lr_el2));
2055     cs->ich_vmcr_el2 = ICH_VMCR_EL2_VFIQEN |
2056         ((icv_min_vbpr(cs) + 1) << ICH_VMCR_EL2_VBPR1_SHIFT) |
2057         (icv_min_vbpr(cs) << ICH_VMCR_EL2_VBPR0_SHIFT);
2058 }
2059 
2060 static const ARMCPRegInfo gicv3_cpuif_reginfo[] = {
2061     { .name = "ICC_PMR_EL1", .state = ARM_CP_STATE_BOTH,
2062       .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 6, .opc2 = 0,
2063       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2064       .access = PL1_RW, .accessfn = gicv3_irqfiq_access,
2065       .readfn = icc_pmr_read,
2066       .writefn = icc_pmr_write,
2067       /* We hang the whole cpu interface reset routine off here
2068        * rather than parcelling it out into one little function
2069        * per register
2070        */
2071       .resetfn = icc_reset,
2072     },
2073     { .name = "ICC_IAR0_EL1", .state = ARM_CP_STATE_BOTH,
2074       .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 8, .opc2 = 0,
2075       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2076       .access = PL1_R, .accessfn = gicv3_fiq_access,
2077       .readfn = icc_iar0_read,
2078     },
2079     { .name = "ICC_EOIR0_EL1", .state = ARM_CP_STATE_BOTH,
2080       .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 8, .opc2 = 1,
2081       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2082       .access = PL1_W, .accessfn = gicv3_fiq_access,
2083       .writefn = icc_eoir_write,
2084     },
2085     { .name = "ICC_HPPIR0_EL1", .state = ARM_CP_STATE_BOTH,
2086       .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 8, .opc2 = 2,
2087       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2088       .access = PL1_R, .accessfn = gicv3_fiq_access,
2089       .readfn = icc_hppir0_read,
2090     },
2091     { .name = "ICC_BPR0_EL1", .state = ARM_CP_STATE_BOTH,
2092       .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 8, .opc2 = 3,
2093       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2094       .access = PL1_RW, .accessfn = gicv3_fiq_access,
2095       .readfn = icc_bpr_read,
2096       .writefn = icc_bpr_write,
2097     },
2098     { .name = "ICC_AP0R0_EL1", .state = ARM_CP_STATE_BOTH,
2099       .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 8, .opc2 = 4,
2100       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2101       .access = PL1_RW, .accessfn = gicv3_fiq_access,
2102       .readfn = icc_ap_read,
2103       .writefn = icc_ap_write,
2104     },
2105     { .name = "ICC_AP0R1_EL1", .state = ARM_CP_STATE_BOTH,
2106       .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 8, .opc2 = 5,
2107       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2108       .access = PL1_RW, .accessfn = gicv3_fiq_access,
2109       .readfn = icc_ap_read,
2110       .writefn = icc_ap_write,
2111     },
2112     { .name = "ICC_AP0R2_EL1", .state = ARM_CP_STATE_BOTH,
2113       .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 8, .opc2 = 6,
2114       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2115       .access = PL1_RW, .accessfn = gicv3_fiq_access,
2116       .readfn = icc_ap_read,
2117       .writefn = icc_ap_write,
2118     },
2119     { .name = "ICC_AP0R3_EL1", .state = ARM_CP_STATE_BOTH,
2120       .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 8, .opc2 = 7,
2121       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2122       .access = PL1_RW, .accessfn = gicv3_fiq_access,
2123       .readfn = icc_ap_read,
2124       .writefn = icc_ap_write,
2125     },
2126     /* All the ICC_AP1R*_EL1 registers are banked */
2127     { .name = "ICC_AP1R0_EL1", .state = ARM_CP_STATE_BOTH,
2128       .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 9, .opc2 = 0,
2129       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2130       .access = PL1_RW, .accessfn = gicv3_irq_access,
2131       .readfn = icc_ap_read,
2132       .writefn = icc_ap_write,
2133     },
2134     { .name = "ICC_AP1R1_EL1", .state = ARM_CP_STATE_BOTH,
2135       .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 9, .opc2 = 1,
2136       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2137       .access = PL1_RW, .accessfn = gicv3_irq_access,
2138       .readfn = icc_ap_read,
2139       .writefn = icc_ap_write,
2140     },
2141     { .name = "ICC_AP1R2_EL1", .state = ARM_CP_STATE_BOTH,
2142       .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 9, .opc2 = 2,
2143       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2144       .access = PL1_RW, .accessfn = gicv3_irq_access,
2145       .readfn = icc_ap_read,
2146       .writefn = icc_ap_write,
2147     },
2148     { .name = "ICC_AP1R3_EL1", .state = ARM_CP_STATE_BOTH,
2149       .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 9, .opc2 = 3,
2150       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2151       .access = PL1_RW, .accessfn = gicv3_irq_access,
2152       .readfn = icc_ap_read,
2153       .writefn = icc_ap_write,
2154     },
2155     { .name = "ICC_DIR_EL1", .state = ARM_CP_STATE_BOTH,
2156       .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 11, .opc2 = 1,
2157       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2158       .access = PL1_W, .accessfn = gicv3_dir_access,
2159       .writefn = icc_dir_write,
2160     },
2161     { .name = "ICC_RPR_EL1", .state = ARM_CP_STATE_BOTH,
2162       .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 11, .opc2 = 3,
2163       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2164       .access = PL1_R, .accessfn = gicv3_irqfiq_access,
2165       .readfn = icc_rpr_read,
2166     },
2167     { .name = "ICC_SGI1R_EL1", .state = ARM_CP_STATE_AA64,
2168       .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 11, .opc2 = 5,
2169       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2170       .access = PL1_W, .accessfn = gicv3_sgi_access,
2171       .writefn = icc_sgi1r_write,
2172     },
2173     { .name = "ICC_SGI1R",
2174       .cp = 15, .opc1 = 0, .crm = 12,
2175       .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_NO_RAW,
2176       .access = PL1_W, .accessfn = gicv3_sgi_access,
2177       .writefn = icc_sgi1r_write,
2178     },
2179     { .name = "ICC_ASGI1R_EL1", .state = ARM_CP_STATE_AA64,
2180       .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 11, .opc2 = 6,
2181       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2182       .access = PL1_W, .accessfn = gicv3_sgi_access,
2183       .writefn = icc_asgi1r_write,
2184     },
2185     { .name = "ICC_ASGI1R",
2186       .cp = 15, .opc1 = 1, .crm = 12,
2187       .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_NO_RAW,
2188       .access = PL1_W, .accessfn = gicv3_sgi_access,
2189       .writefn = icc_asgi1r_write,
2190     },
2191     { .name = "ICC_SGI0R_EL1", .state = ARM_CP_STATE_AA64,
2192       .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 11, .opc2 = 7,
2193       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2194       .access = PL1_W, .accessfn = gicv3_sgi_access,
2195       .writefn = icc_sgi0r_write,
2196     },
2197     { .name = "ICC_SGI0R",
2198       .cp = 15, .opc1 = 2, .crm = 12,
2199       .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_NO_RAW,
2200       .access = PL1_W, .accessfn = gicv3_sgi_access,
2201       .writefn = icc_sgi0r_write,
2202     },
2203     { .name = "ICC_IAR1_EL1", .state = ARM_CP_STATE_BOTH,
2204       .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 12, .opc2 = 0,
2205       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2206       .access = PL1_R, .accessfn = gicv3_irq_access,
2207       .readfn = icc_iar1_read,
2208     },
2209     { .name = "ICC_EOIR1_EL1", .state = ARM_CP_STATE_BOTH,
2210       .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 12, .opc2 = 1,
2211       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2212       .access = PL1_W, .accessfn = gicv3_irq_access,
2213       .writefn = icc_eoir_write,
2214     },
2215     { .name = "ICC_HPPIR1_EL1", .state = ARM_CP_STATE_BOTH,
2216       .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 12, .opc2 = 2,
2217       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2218       .access = PL1_R, .accessfn = gicv3_irq_access,
2219       .readfn = icc_hppir1_read,
2220     },
2221     /* This register is banked */
2222     { .name = "ICC_BPR1_EL1", .state = ARM_CP_STATE_BOTH,
2223       .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 12, .opc2 = 3,
2224       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2225       .access = PL1_RW, .accessfn = gicv3_irq_access,
2226       .readfn = icc_bpr_read,
2227       .writefn = icc_bpr_write,
2228     },
2229     /* This register is banked */
2230     { .name = "ICC_CTLR_EL1", .state = ARM_CP_STATE_BOTH,
2231       .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 12, .opc2 = 4,
2232       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2233       .access = PL1_RW, .accessfn = gicv3_irqfiq_access,
2234       .readfn = icc_ctlr_el1_read,
2235       .writefn = icc_ctlr_el1_write,
2236     },
2237     { .name = "ICC_SRE_EL1", .state = ARM_CP_STATE_BOTH,
2238       .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 12, .opc2 = 5,
2239       .type = ARM_CP_NO_RAW | ARM_CP_CONST,
2240       .access = PL1_RW,
2241       /* We don't support IRQ/FIQ bypass and system registers are
2242        * always enabled, so all our bits are RAZ/WI or RAO/WI.
2243        * This register is banked but since it's constant we don't
2244        * need to do anything special.
2245        */
2246       .resetvalue = 0x7,
2247     },
2248     { .name = "ICC_IGRPEN0_EL1", .state = ARM_CP_STATE_BOTH,
2249       .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 12, .opc2 = 6,
2250       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2251       .access = PL1_RW, .accessfn = gicv3_fiq_access,
2252       .readfn = icc_igrpen_read,
2253       .writefn = icc_igrpen_write,
2254     },
2255     /* This register is banked */
2256     { .name = "ICC_IGRPEN1_EL1", .state = ARM_CP_STATE_BOTH,
2257       .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 12, .opc2 = 7,
2258       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2259       .access = PL1_RW, .accessfn = gicv3_irq_access,
2260       .readfn = icc_igrpen_read,
2261       .writefn = icc_igrpen_write,
2262     },
2263     { .name = "ICC_SRE_EL2", .state = ARM_CP_STATE_BOTH,
2264       .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 9, .opc2 = 5,
2265       .type = ARM_CP_NO_RAW | ARM_CP_CONST,
2266       .access = PL2_RW,
2267       /* We don't support IRQ/FIQ bypass and system registers are
2268        * always enabled, so all our bits are RAZ/WI or RAO/WI.
2269        */
2270       .resetvalue = 0xf,
2271     },
2272     { .name = "ICC_CTLR_EL3", .state = ARM_CP_STATE_BOTH,
2273       .opc0 = 3, .opc1 = 6, .crn = 12, .crm = 12, .opc2 = 4,
2274       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2275       .access = PL3_RW,
2276       .readfn = icc_ctlr_el3_read,
2277       .writefn = icc_ctlr_el3_write,
2278     },
2279     { .name = "ICC_SRE_EL3", .state = ARM_CP_STATE_BOTH,
2280       .opc0 = 3, .opc1 = 6, .crn = 12, .crm = 12, .opc2 = 5,
2281       .type = ARM_CP_NO_RAW | ARM_CP_CONST,
2282       .access = PL3_RW,
2283       /* We don't support IRQ/FIQ bypass and system registers are
2284        * always enabled, so all our bits are RAZ/WI or RAO/WI.
2285        */
2286       .resetvalue = 0xf,
2287     },
2288     { .name = "ICC_IGRPEN1_EL3", .state = ARM_CP_STATE_BOTH,
2289       .opc0 = 3, .opc1 = 6, .crn = 12, .crm = 12, .opc2 = 7,
2290       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2291       .access = PL3_RW,
2292       .readfn = icc_igrpen1_el3_read,
2293       .writefn = icc_igrpen1_el3_write,
2294     },
2295     REGINFO_SENTINEL
2296 };
2297 
ich_ap_read(CPUARMState * env,const ARMCPRegInfo * ri)2298 static uint64_t ich_ap_read(CPUARMState *env, const ARMCPRegInfo *ri)
2299 {
2300     GICv3CPUState *cs = icc_cs_from_env(env);
2301     int regno = ri->opc2 & 3;
2302     int grp = (ri->crm & 1) ? GICV3_G1NS : GICV3_G0;
2303     uint64_t value;
2304 
2305     value = cs->ich_apr[grp][regno];
2306     trace_gicv3_ich_ap_read(ri->crm & 1, regno, gicv3_redist_affid(cs), value);
2307     return value;
2308 }
2309 
ich_ap_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)2310 static void ich_ap_write(CPUARMState *env, const ARMCPRegInfo *ri,
2311                          uint64_t value)
2312 {
2313     GICv3CPUState *cs = icc_cs_from_env(env);
2314     int regno = ri->opc2 & 3;
2315     int grp = (ri->crm & 1) ? GICV3_G1NS : GICV3_G0;
2316 
2317     trace_gicv3_ich_ap_write(ri->crm & 1, regno, gicv3_redist_affid(cs), value);
2318 
2319     cs->ich_apr[grp][regno] = value & 0xFFFFFFFFU;
2320     gicv3_cpuif_virt_update(cs);
2321 }
2322 
ich_hcr_read(CPUARMState * env,const ARMCPRegInfo * ri)2323 static uint64_t ich_hcr_read(CPUARMState *env, const ARMCPRegInfo *ri)
2324 {
2325     GICv3CPUState *cs = icc_cs_from_env(env);
2326     uint64_t value = cs->ich_hcr_el2;
2327 
2328     trace_gicv3_ich_hcr_read(gicv3_redist_affid(cs), value);
2329     return value;
2330 }
2331 
ich_hcr_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)2332 static void ich_hcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
2333                           uint64_t value)
2334 {
2335     GICv3CPUState *cs = icc_cs_from_env(env);
2336 
2337     trace_gicv3_ich_hcr_write(gicv3_redist_affid(cs), value);
2338 
2339     value &= ICH_HCR_EL2_EN | ICH_HCR_EL2_UIE | ICH_HCR_EL2_LRENPIE |
2340         ICH_HCR_EL2_NPIE | ICH_HCR_EL2_VGRP0EIE | ICH_HCR_EL2_VGRP0DIE |
2341         ICH_HCR_EL2_VGRP1EIE | ICH_HCR_EL2_VGRP1DIE | ICH_HCR_EL2_TC |
2342         ICH_HCR_EL2_TALL0 | ICH_HCR_EL2_TALL1 | ICH_HCR_EL2_TSEI |
2343         ICH_HCR_EL2_TDIR | ICH_HCR_EL2_EOICOUNT_MASK;
2344 
2345     cs->ich_hcr_el2 = value;
2346     gicv3_cpuif_virt_update(cs);
2347 }
2348 
ich_vmcr_read(CPUARMState * env,const ARMCPRegInfo * ri)2349 static uint64_t ich_vmcr_read(CPUARMState *env, const ARMCPRegInfo *ri)
2350 {
2351     GICv3CPUState *cs = icc_cs_from_env(env);
2352     uint64_t value = cs->ich_vmcr_el2;
2353 
2354     trace_gicv3_ich_vmcr_read(gicv3_redist_affid(cs), value);
2355     return value;
2356 }
2357 
ich_vmcr_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)2358 static void ich_vmcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
2359                          uint64_t value)
2360 {
2361     GICv3CPUState *cs = icc_cs_from_env(env);
2362 
2363     trace_gicv3_ich_vmcr_write(gicv3_redist_affid(cs), value);
2364 
2365     value &= ICH_VMCR_EL2_VENG0 | ICH_VMCR_EL2_VENG1 | ICH_VMCR_EL2_VCBPR |
2366         ICH_VMCR_EL2_VEOIM | ICH_VMCR_EL2_VBPR1_MASK |
2367         ICH_VMCR_EL2_VBPR0_MASK | ICH_VMCR_EL2_VPMR_MASK;
2368     value |= ICH_VMCR_EL2_VFIQEN;
2369 
2370     cs->ich_vmcr_el2 = value;
2371     /* Enforce "writing BPRs to less than minimum sets them to the minimum"
2372      * by reading and writing back the fields.
2373      */
2374     write_vbpr(cs, GICV3_G0, read_vbpr(cs, GICV3_G0));
2375     write_vbpr(cs, GICV3_G1, read_vbpr(cs, GICV3_G1));
2376 
2377     gicv3_cpuif_virt_update(cs);
2378 }
2379 
ich_lr_read(CPUARMState * env,const ARMCPRegInfo * ri)2380 static uint64_t ich_lr_read(CPUARMState *env, const ARMCPRegInfo *ri)
2381 {
2382     GICv3CPUState *cs = icc_cs_from_env(env);
2383     int regno = ri->opc2 | ((ri->crm & 1) << 3);
2384     uint64_t value;
2385 
2386     /* This read function handles all of:
2387      * 64-bit reads of the whole LR
2388      * 32-bit reads of the low half of the LR
2389      * 32-bit reads of the high half of the LR
2390      */
2391     if (ri->state == ARM_CP_STATE_AA32) {
2392         if (ri->crm >= 14) {
2393             value = extract64(cs->ich_lr_el2[regno], 32, 32);
2394             trace_gicv3_ich_lrc_read(regno, gicv3_redist_affid(cs), value);
2395         } else {
2396             value = extract64(cs->ich_lr_el2[regno], 0, 32);
2397             trace_gicv3_ich_lr32_read(regno, gicv3_redist_affid(cs), value);
2398         }
2399     } else {
2400         value = cs->ich_lr_el2[regno];
2401         trace_gicv3_ich_lr_read(regno, gicv3_redist_affid(cs), value);
2402     }
2403 
2404     return value;
2405 }
2406 
ich_lr_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)2407 static void ich_lr_write(CPUARMState *env, const ARMCPRegInfo *ri,
2408                          uint64_t value)
2409 {
2410     GICv3CPUState *cs = icc_cs_from_env(env);
2411     int regno = ri->opc2 | ((ri->crm & 1) << 3);
2412 
2413     /* This write function handles all of:
2414      * 64-bit writes to the whole LR
2415      * 32-bit writes to the low half of the LR
2416      * 32-bit writes to the high half of the LR
2417      */
2418     if (ri->state == ARM_CP_STATE_AA32) {
2419         if (ri->crm >= 14) {
2420             trace_gicv3_ich_lrc_write(regno, gicv3_redist_affid(cs), value);
2421             value = deposit64(cs->ich_lr_el2[regno], 32, 32, value);
2422         } else {
2423             trace_gicv3_ich_lr32_write(regno, gicv3_redist_affid(cs), value);
2424             value = deposit64(cs->ich_lr_el2[regno], 0, 32, value);
2425         }
2426     } else {
2427         trace_gicv3_ich_lr_write(regno, gicv3_redist_affid(cs), value);
2428     }
2429 
2430     /* Enforce RES0 bits in priority field */
2431     if (cs->vpribits < 8) {
2432         value = deposit64(value, ICH_LR_EL2_PRIORITY_SHIFT,
2433                           8 - cs->vpribits, 0);
2434     }
2435 
2436     cs->ich_lr_el2[regno] = value;
2437     gicv3_cpuif_virt_update(cs);
2438 }
2439 
ich_vtr_read(CPUARMState * env,const ARMCPRegInfo * ri)2440 static uint64_t ich_vtr_read(CPUARMState *env, const ARMCPRegInfo *ri)
2441 {
2442     GICv3CPUState *cs = icc_cs_from_env(env);
2443     uint64_t value;
2444 
2445     value = ((cs->num_list_regs - 1) << ICH_VTR_EL2_LISTREGS_SHIFT)
2446         | ICH_VTR_EL2_TDS | ICH_VTR_EL2_NV4 | ICH_VTR_EL2_A3V
2447         | (1 << ICH_VTR_EL2_IDBITS_SHIFT)
2448         | ((cs->vprebits - 1) << ICH_VTR_EL2_PREBITS_SHIFT)
2449         | ((cs->vpribits - 1) << ICH_VTR_EL2_PRIBITS_SHIFT);
2450 
2451     trace_gicv3_ich_vtr_read(gicv3_redist_affid(cs), value);
2452     return value;
2453 }
2454 
ich_misr_read(CPUARMState * env,const ARMCPRegInfo * ri)2455 static uint64_t ich_misr_read(CPUARMState *env, const ARMCPRegInfo *ri)
2456 {
2457     GICv3CPUState *cs = icc_cs_from_env(env);
2458     uint64_t value = maintenance_interrupt_state(cs);
2459 
2460     trace_gicv3_ich_misr_read(gicv3_redist_affid(cs), value);
2461     return value;
2462 }
2463 
ich_eisr_read(CPUARMState * env,const ARMCPRegInfo * ri)2464 static uint64_t ich_eisr_read(CPUARMState *env, const ARMCPRegInfo *ri)
2465 {
2466     GICv3CPUState *cs = icc_cs_from_env(env);
2467     uint64_t value = eoi_maintenance_interrupt_state(cs, NULL);
2468 
2469     trace_gicv3_ich_eisr_read(gicv3_redist_affid(cs), value);
2470     return value;
2471 }
2472 
ich_elrsr_read(CPUARMState * env,const ARMCPRegInfo * ri)2473 static uint64_t ich_elrsr_read(CPUARMState *env, const ARMCPRegInfo *ri)
2474 {
2475     GICv3CPUState *cs = icc_cs_from_env(env);
2476     uint64_t value = 0;
2477     int i;
2478 
2479     for (i = 0; i < cs->num_list_regs; i++) {
2480         uint64_t lr = cs->ich_lr_el2[i];
2481 
2482         if ((lr & ICH_LR_EL2_STATE_MASK) == 0 &&
2483             ((lr & ICH_LR_EL2_HW) != 0 || (lr & ICH_LR_EL2_EOI) == 0)) {
2484             value |= (1 << i);
2485         }
2486     }
2487 
2488     trace_gicv3_ich_elrsr_read(gicv3_redist_affid(cs), value);
2489     return value;
2490 }
2491 
2492 static const ARMCPRegInfo gicv3_cpuif_hcr_reginfo[] = {
2493     { .name = "ICH_AP0R0_EL2", .state = ARM_CP_STATE_BOTH,
2494       .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 8, .opc2 = 0,
2495       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2496       .access = PL2_RW,
2497       .readfn = ich_ap_read,
2498       .writefn = ich_ap_write,
2499     },
2500     { .name = "ICH_AP1R0_EL2", .state = ARM_CP_STATE_BOTH,
2501       .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 9, .opc2 = 0,
2502       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2503       .access = PL2_RW,
2504       .readfn = ich_ap_read,
2505       .writefn = ich_ap_write,
2506     },
2507     { .name = "ICH_HCR_EL2", .state = ARM_CP_STATE_BOTH,
2508       .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 11, .opc2 = 0,
2509       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2510       .access = PL2_RW,
2511       .readfn = ich_hcr_read,
2512       .writefn = ich_hcr_write,
2513     },
2514     { .name = "ICH_VTR_EL2", .state = ARM_CP_STATE_BOTH,
2515       .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 11, .opc2 = 1,
2516       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2517       .access = PL2_R,
2518       .readfn = ich_vtr_read,
2519     },
2520     { .name = "ICH_MISR_EL2", .state = ARM_CP_STATE_BOTH,
2521       .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 11, .opc2 = 2,
2522       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2523       .access = PL2_R,
2524       .readfn = ich_misr_read,
2525     },
2526     { .name = "ICH_EISR_EL2", .state = ARM_CP_STATE_BOTH,
2527       .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 11, .opc2 = 3,
2528       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2529       .access = PL2_R,
2530       .readfn = ich_eisr_read,
2531     },
2532     { .name = "ICH_ELRSR_EL2", .state = ARM_CP_STATE_BOTH,
2533       .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 11, .opc2 = 5,
2534       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2535       .access = PL2_R,
2536       .readfn = ich_elrsr_read,
2537     },
2538     { .name = "ICH_VMCR_EL2", .state = ARM_CP_STATE_BOTH,
2539       .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 11, .opc2 = 7,
2540       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2541       .access = PL2_RW,
2542       .readfn = ich_vmcr_read,
2543       .writefn = ich_vmcr_write,
2544     },
2545     REGINFO_SENTINEL
2546 };
2547 
2548 static const ARMCPRegInfo gicv3_cpuif_ich_apxr1_reginfo[] = {
2549     { .name = "ICH_AP0R1_EL2", .state = ARM_CP_STATE_BOTH,
2550       .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 8, .opc2 = 1,
2551       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2552       .access = PL2_RW,
2553       .readfn = ich_ap_read,
2554       .writefn = ich_ap_write,
2555     },
2556     { .name = "ICH_AP1R1_EL2", .state = ARM_CP_STATE_BOTH,
2557       .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 9, .opc2 = 1,
2558       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2559       .access = PL2_RW,
2560       .readfn = ich_ap_read,
2561       .writefn = ich_ap_write,
2562     },
2563     REGINFO_SENTINEL
2564 };
2565 
2566 static const ARMCPRegInfo gicv3_cpuif_ich_apxr23_reginfo[] = {
2567     { .name = "ICH_AP0R2_EL2", .state = ARM_CP_STATE_BOTH,
2568       .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 8, .opc2 = 2,
2569       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2570       .access = PL2_RW,
2571       .readfn = ich_ap_read,
2572       .writefn = ich_ap_write,
2573     },
2574     { .name = "ICH_AP0R3_EL2", .state = ARM_CP_STATE_BOTH,
2575       .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 8, .opc2 = 3,
2576       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2577       .access = PL2_RW,
2578       .readfn = ich_ap_read,
2579       .writefn = ich_ap_write,
2580     },
2581     { .name = "ICH_AP1R2_EL2", .state = ARM_CP_STATE_BOTH,
2582       .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 9, .opc2 = 2,
2583       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2584       .access = PL2_RW,
2585       .readfn = ich_ap_read,
2586       .writefn = ich_ap_write,
2587     },
2588     { .name = "ICH_AP1R3_EL2", .state = ARM_CP_STATE_BOTH,
2589       .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 9, .opc2 = 3,
2590       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2591       .access = PL2_RW,
2592       .readfn = ich_ap_read,
2593       .writefn = ich_ap_write,
2594     },
2595     REGINFO_SENTINEL
2596 };
2597 
gicv3_cpuif_el_change_hook(ARMCPU * cpu,void * opaque)2598 static void gicv3_cpuif_el_change_hook(ARMCPU *cpu, void *opaque)
2599 {
2600     GICv3CPUState *cs = opaque;
2601 
2602     gicv3_cpuif_update(cs);
2603 }
2604 
gicv3_init_cpuif(GICv3State * s)2605 void gicv3_init_cpuif(GICv3State *s)
2606 {
2607     /* Called from the GICv3 realize function; register our system
2608      * registers with the CPU
2609      */
2610     int i;
2611 
2612     for (i = 0; i < s->num_cpu; i++) {
2613         ARMCPU *cpu = ARM_CPU(qemu_get_cpu(i));
2614         GICv3CPUState *cs = &s->cpu[i];
2615 
2616         /* Note that we can't just use the GICv3CPUState as an opaque pointer
2617          * in define_arm_cp_regs_with_opaque(), because when we're called back
2618          * it might be with code translated by CPU 0 but run by CPU 1, in
2619          * which case we'd get the wrong value.
2620          * So instead we define the regs with no ri->opaque info, and
2621          * get back to the GICv3CPUState from the CPUARMState.
2622          */
2623         define_arm_cp_regs(cpu, gicv3_cpuif_reginfo);
2624         if (arm_feature(&cpu->env, ARM_FEATURE_EL2)
2625             && cpu->gic_num_lrs) {
2626             int j;
2627 
2628             cs->num_list_regs = cpu->gic_num_lrs;
2629             cs->vpribits = cpu->gic_vpribits;
2630             cs->vprebits = cpu->gic_vprebits;
2631 
2632             /* Check against architectural constraints: getting these
2633              * wrong would be a bug in the CPU code defining these,
2634              * and the implementation relies on them holding.
2635              */
2636             g_assert(cs->vprebits <= cs->vpribits);
2637             g_assert(cs->vprebits >= 5 && cs->vprebits <= 7);
2638             g_assert(cs->vpribits >= 5 && cs->vpribits <= 8);
2639 
2640             define_arm_cp_regs(cpu, gicv3_cpuif_hcr_reginfo);
2641 
2642             for (j = 0; j < cs->num_list_regs; j++) {
2643                 /* Note that the AArch64 LRs are 64-bit; the AArch32 LRs
2644                  * are split into two cp15 regs, LR (the low part, with the
2645                  * same encoding as the AArch64 LR) and LRC (the high part).
2646                  */
2647                 ARMCPRegInfo lr_regset[] = {
2648                     { .name = "ICH_LRn_EL2", .state = ARM_CP_STATE_BOTH,
2649                       .opc0 = 3, .opc1 = 4, .crn = 12,
2650                       .crm = 12 + (j >> 3), .opc2 = j & 7,
2651                       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2652                       .access = PL2_RW,
2653                       .readfn = ich_lr_read,
2654                       .writefn = ich_lr_write,
2655                     },
2656                     { .name = "ICH_LRCn_EL2", .state = ARM_CP_STATE_AA32,
2657                       .cp = 15, .opc1 = 4, .crn = 12,
2658                       .crm = 14 + (j >> 3), .opc2 = j & 7,
2659                       .type = ARM_CP_IO | ARM_CP_NO_RAW,
2660                       .access = PL2_RW,
2661                       .readfn = ich_lr_read,
2662                       .writefn = ich_lr_write,
2663                     },
2664                     REGINFO_SENTINEL
2665                 };
2666                 define_arm_cp_regs(cpu, lr_regset);
2667             }
2668             if (cs->vprebits >= 6) {
2669                 define_arm_cp_regs(cpu, gicv3_cpuif_ich_apxr1_reginfo);
2670             }
2671             if (cs->vprebits == 7) {
2672                 define_arm_cp_regs(cpu, gicv3_cpuif_ich_apxr23_reginfo);
2673             }
2674         }
2675         arm_register_el_change_hook(cpu, gicv3_cpuif_el_change_hook, cs);
2676     }
2677 }
2678