2 * ARM GICv3 support - common bits of emulated and KVM kernel model
4 * Copyright (c) 2012 Linaro Limited
5 * Copyright (c) 2015 Huawei.
6 * Copyright (c) 2015 Samsung Electronics Co., Ltd.
7 * Written by Peter Maydell
8 * Reworked for GICv3 by Shlomo Pongratz and Pavel Fedin
10 * This program is free software; you can redistribute it and/or modify
11 * it under the terms of the GNU General Public License as published by
12 * the Free Software Foundation, either version 2 of the License, or
13 * (at your option) any later version.
15 * This program is distributed in the hope that it will be useful,
16 * but WITHOUT ANY WARRANTY; without even the implied warranty of
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 * GNU General Public License for more details.
20 * You should have received a copy of the GNU General Public License along
21 * with this program; if not, see <http://www.gnu.org/licenses/>.
24 #include "qemu/osdep.h"
25 #include "qapi/error.h"
27 #include "hw/intc/arm_gicv3_common.h"
28 #include "gicv3_internal.h"
29 #include "hw/arm/linux-boot-if.h"
30 #include "sysemu/kvm.h"
32 static int gicv3_pre_save(void *opaque
)
34 GICv3State
*s
= (GICv3State
*)opaque
;
35 ARMGICv3CommonClass
*c
= ARM_GICV3_COMMON_GET_CLASS(s
);
44 static int gicv3_post_load(void *opaque
, int version_id
)
46 GICv3State
*s
= (GICv3State
*)opaque
;
47 ARMGICv3CommonClass
*c
= ARM_GICV3_COMMON_GET_CLASS(s
);
55 static bool virt_state_needed(void *opaque
)
57 GICv3CPUState
*cs
= opaque
;
59 return cs
->num_list_regs
!= 0;
62 static const VMStateDescription vmstate_gicv3_cpu_virt
= {
63 .name
= "arm_gicv3_cpu/virt",
65 .minimum_version_id
= 1,
66 .needed
= virt_state_needed
,
67 .fields
= (VMStateField
[]) {
68 VMSTATE_UINT64_2DARRAY(ich_apr
, GICv3CPUState
, 3, 4),
69 VMSTATE_UINT64(ich_hcr_el2
, GICv3CPUState
),
70 VMSTATE_UINT64_ARRAY(ich_lr_el2
, GICv3CPUState
, GICV3_LR_MAX
),
71 VMSTATE_UINT64(ich_vmcr_el2
, GICv3CPUState
),
76 static int icc_sre_el1_reg_pre_load(void *opaque
)
78 GICv3CPUState
*cs
= opaque
;
81 * If the sre_el1 subsection is not transferred this
82 * means SRE_EL1 is 0x7 (which might not be the same as
85 cs
->icc_sre_el1
= 0x7;
89 static bool icc_sre_el1_reg_needed(void *opaque
)
91 GICv3CPUState
*cs
= opaque
;
93 return cs
->icc_sre_el1
!= 7;
96 const VMStateDescription vmstate_gicv3_cpu_sre_el1
= {
97 .name
= "arm_gicv3_cpu/sre_el1",
99 .minimum_version_id
= 1,
100 .pre_load
= icc_sre_el1_reg_pre_load
,
101 .needed
= icc_sre_el1_reg_needed
,
102 .fields
= (VMStateField
[]) {
103 VMSTATE_UINT64(icc_sre_el1
, GICv3CPUState
),
104 VMSTATE_END_OF_LIST()
108 static const VMStateDescription vmstate_gicv3_cpu
= {
109 .name
= "arm_gicv3_cpu",
111 .minimum_version_id
= 1,
112 .fields
= (VMStateField
[]) {
113 VMSTATE_UINT32(level
, GICv3CPUState
),
114 VMSTATE_UINT32(gicr_ctlr
, GICv3CPUState
),
115 VMSTATE_UINT32_ARRAY(gicr_statusr
, GICv3CPUState
, 2),
116 VMSTATE_UINT32(gicr_waker
, GICv3CPUState
),
117 VMSTATE_UINT64(gicr_propbaser
, GICv3CPUState
),
118 VMSTATE_UINT64(gicr_pendbaser
, GICv3CPUState
),
119 VMSTATE_UINT32(gicr_igroupr0
, GICv3CPUState
),
120 VMSTATE_UINT32(gicr_ienabler0
, GICv3CPUState
),
121 VMSTATE_UINT32(gicr_ipendr0
, GICv3CPUState
),
122 VMSTATE_UINT32(gicr_iactiver0
, GICv3CPUState
),
123 VMSTATE_UINT32(edge_trigger
, GICv3CPUState
),
124 VMSTATE_UINT32(gicr_igrpmodr0
, GICv3CPUState
),
125 VMSTATE_UINT32(gicr_nsacr
, GICv3CPUState
),
126 VMSTATE_UINT8_ARRAY(gicr_ipriorityr
, GICv3CPUState
, GIC_INTERNAL
),
127 VMSTATE_UINT64_ARRAY(icc_ctlr_el1
, GICv3CPUState
, 2),
128 VMSTATE_UINT64(icc_pmr_el1
, GICv3CPUState
),
129 VMSTATE_UINT64_ARRAY(icc_bpr
, GICv3CPUState
, 3),
130 VMSTATE_UINT64_2DARRAY(icc_apr
, GICv3CPUState
, 3, 4),
131 VMSTATE_UINT64_ARRAY(icc_igrpen
, GICv3CPUState
, 3),
132 VMSTATE_UINT64(icc_ctlr_el3
, GICv3CPUState
),
133 VMSTATE_END_OF_LIST()
135 .subsections
= (const VMStateDescription
* []) {
136 &vmstate_gicv3_cpu_virt
,
139 .subsections
= (const VMStateDescription
* []) {
140 &vmstate_gicv3_cpu_sre_el1
,
145 static int gicv3_gicd_no_migration_shift_bug_pre_load(void *opaque
)
147 GICv3State
*cs
= opaque
;
150 * The gicd_no_migration_shift_bug flag is used for migration compatibility
151 * for old version QEMU which may have the GICD bmp shift bug under KVM mode.
152 * Strictly, what we want to know is whether the migration source is using
153 * KVM. Since we don't have any way to determine that, we look at whether the
154 * destination is using KVM; this is close enough because for the older QEMU
155 * versions with this bug KVM -> TCG migration didn't work anyway. If the
156 * source is a newer QEMU without this bug it will transmit the migration
157 * subsection which sets the flag to true; otherwise it will remain set to
158 * the value we select here.
161 cs
->gicd_no_migration_shift_bug
= false;
167 static int gicv3_gicd_no_migration_shift_bug_post_load(void *opaque
,
170 GICv3State
*cs
= opaque
;
172 if (cs
->gicd_no_migration_shift_bug
) {
176 /* Older versions of QEMU had a bug in the handling of state save/restore
177 * to the KVM GICv3: they got the offset in the bitmap arrays wrong,
178 * so that instead of the data for external interrupts 32 and up
179 * starting at bit position 32 in the bitmap, it started at bit
180 * position 64. If we're receiving data from a QEMU with that bug,
181 * we must move the data down into the right place.
183 memmove(cs
->group
, (uint8_t *)cs
->group
+ GIC_INTERNAL
/ 8,
184 sizeof(cs
->group
) - GIC_INTERNAL
/ 8);
185 memmove(cs
->grpmod
, (uint8_t *)cs
->grpmod
+ GIC_INTERNAL
/ 8,
186 sizeof(cs
->grpmod
) - GIC_INTERNAL
/ 8);
187 memmove(cs
->enabled
, (uint8_t *)cs
->enabled
+ GIC_INTERNAL
/ 8,
188 sizeof(cs
->enabled
) - GIC_INTERNAL
/ 8);
189 memmove(cs
->pending
, (uint8_t *)cs
->pending
+ GIC_INTERNAL
/ 8,
190 sizeof(cs
->pending
) - GIC_INTERNAL
/ 8);
191 memmove(cs
->active
, (uint8_t *)cs
->active
+ GIC_INTERNAL
/ 8,
192 sizeof(cs
->active
) - GIC_INTERNAL
/ 8);
193 memmove(cs
->edge_trigger
, (uint8_t *)cs
->edge_trigger
+ GIC_INTERNAL
/ 8,
194 sizeof(cs
->edge_trigger
) - GIC_INTERNAL
/ 8);
197 * While this new version QEMU doesn't have this kind of bug as we fix it,
198 * so it needs to set the flag to true to indicate that and it's necessary
199 * for next migration to work from this new version QEMU.
201 cs
->gicd_no_migration_shift_bug
= true;
206 const VMStateDescription vmstate_gicv3_gicd_no_migration_shift_bug
= {
207 .name
= "arm_gicv3/gicd_no_migration_shift_bug",
209 .minimum_version_id
= 1,
210 .pre_load
= gicv3_gicd_no_migration_shift_bug_pre_load
,
211 .post_load
= gicv3_gicd_no_migration_shift_bug_post_load
,
212 .fields
= (VMStateField
[]) {
213 VMSTATE_BOOL(gicd_no_migration_shift_bug
, GICv3State
),
214 VMSTATE_END_OF_LIST()
218 static const VMStateDescription vmstate_gicv3
= {
221 .minimum_version_id
= 1,
222 .pre_save
= gicv3_pre_save
,
223 .post_load
= gicv3_post_load
,
224 .priority
= MIG_PRI_GICV3
,
225 .fields
= (VMStateField
[]) {
226 VMSTATE_UINT32(gicd_ctlr
, GICv3State
),
227 VMSTATE_UINT32_ARRAY(gicd_statusr
, GICv3State
, 2),
228 VMSTATE_UINT32_ARRAY(group
, GICv3State
, GICV3_BMP_SIZE
),
229 VMSTATE_UINT32_ARRAY(grpmod
, GICv3State
, GICV3_BMP_SIZE
),
230 VMSTATE_UINT32_ARRAY(enabled
, GICv3State
, GICV3_BMP_SIZE
),
231 VMSTATE_UINT32_ARRAY(pending
, GICv3State
, GICV3_BMP_SIZE
),
232 VMSTATE_UINT32_ARRAY(active
, GICv3State
, GICV3_BMP_SIZE
),
233 VMSTATE_UINT32_ARRAY(level
, GICv3State
, GICV3_BMP_SIZE
),
234 VMSTATE_UINT32_ARRAY(edge_trigger
, GICv3State
, GICV3_BMP_SIZE
),
235 VMSTATE_UINT8_ARRAY(gicd_ipriority
, GICv3State
, GICV3_MAXIRQ
),
236 VMSTATE_UINT64_ARRAY(gicd_irouter
, GICv3State
, GICV3_MAXIRQ
),
237 VMSTATE_UINT32_ARRAY(gicd_nsacr
, GICv3State
,
238 DIV_ROUND_UP(GICV3_MAXIRQ
, 16)),
239 VMSTATE_STRUCT_VARRAY_POINTER_UINT32(cpu
, GICv3State
, num_cpu
,
240 vmstate_gicv3_cpu
, GICv3CPUState
),
241 VMSTATE_END_OF_LIST()
243 .subsections
= (const VMStateDescription
* []) {
244 &vmstate_gicv3_gicd_no_migration_shift_bug
,
249 void gicv3_init_irqs_and_mmio(GICv3State
*s
, qemu_irq_handler handler
,
250 const MemoryRegionOps
*ops
)
252 SysBusDevice
*sbd
= SYS_BUS_DEVICE(s
);
255 /* For the GIC, also expose incoming GPIO lines for PPIs for each CPU.
256 * GPIO array layout is thus:
258 * [N..N+31] PPIs for CPU 0
259 * [N+32..N+63] PPIs for CPU 1
262 i
= s
->num_irq
- GIC_INTERNAL
+ GIC_INTERNAL
* s
->num_cpu
;
263 qdev_init_gpio_in(DEVICE(s
), handler
, i
);
265 for (i
= 0; i
< s
->num_cpu
; i
++) {
266 sysbus_init_irq(sbd
, &s
->cpu
[i
].parent_irq
);
268 for (i
= 0; i
< s
->num_cpu
; i
++) {
269 sysbus_init_irq(sbd
, &s
->cpu
[i
].parent_fiq
);
271 for (i
= 0; i
< s
->num_cpu
; i
++) {
272 sysbus_init_irq(sbd
, &s
->cpu
[i
].parent_virq
);
274 for (i
= 0; i
< s
->num_cpu
; i
++) {
275 sysbus_init_irq(sbd
, &s
->cpu
[i
].parent_vfiq
);
278 memory_region_init_io(&s
->iomem_dist
, OBJECT(s
), ops
, s
,
279 "gicv3_dist", 0x10000);
280 memory_region_init_io(&s
->iomem_redist
, OBJECT(s
), ops
? &ops
[1] : NULL
, s
,
281 "gicv3_redist", 0x20000 * s
->num_cpu
);
283 sysbus_init_mmio(sbd
, &s
->iomem_dist
);
284 sysbus_init_mmio(sbd
, &s
->iomem_redist
);
287 static void arm_gicv3_common_realize(DeviceState
*dev
, Error
**errp
)
289 GICv3State
*s
= ARM_GICV3_COMMON(dev
);
292 /* revision property is actually reserved and currently used only in order
293 * to keep the interface compatible with GICv2 code, avoiding extra
294 * conditions. However, in future it could be used, for example, if we
297 if (s
->revision
!= 3) {
298 error_setg(errp
, "unsupported GIC revision %d", s
->revision
);
302 if (s
->num_irq
> GICV3_MAXIRQ
) {
304 "requested %u interrupt lines exceeds GIC maximum %d",
305 s
->num_irq
, GICV3_MAXIRQ
);
308 if (s
->num_irq
< GIC_INTERNAL
) {
310 "requested %u interrupt lines is below GIC minimum %d",
311 s
->num_irq
, GIC_INTERNAL
);
315 /* ITLinesNumber is represented as (N / 32) - 1, so this is an
316 * implementation imposed restriction, not an architectural one,
317 * so we don't have to deal with bitfields where only some of the
318 * bits in a 32-bit word should be valid.
320 if (s
->num_irq
% 32) {
322 "%d interrupt lines unsupported: not divisible by 32",
327 s
->cpu
= g_new0(GICv3CPUState
, s
->num_cpu
);
329 for (i
= 0; i
< s
->num_cpu
; i
++) {
330 CPUState
*cpu
= qemu_get_cpu(i
);
336 /* Store GICv3CPUState in CPUARMState gicv3state pointer */
337 gicv3_set_gicv3state(cpu
, &s
->cpu
[i
]);
339 /* Pre-construct the GICR_TYPER:
340 * For our implementation:
341 * Top 32 bits are the affinity value of the associated CPU
342 * CommonLPIAff == 01 (redistributors with same Aff3 share LPI table)
343 * Processor_Number == CPU index starting from 0
344 * DPGS == 0 (GICR_CTLR.DPG* not supported)
345 * Last == 1 if this is the last redistributor in a series of
346 * contiguous redistributor pages
347 * DirectLPI == 0 (direct injection of LPIs not supported)
348 * VLPIS == 0 (virtual LPIs not supported)
349 * PLPIS == 0 (physical LPIs not supported)
351 cpu_affid
= object_property_get_uint(OBJECT(cpu
), "mp-affinity", NULL
);
352 last
= (i
== s
->num_cpu
- 1);
354 /* The CPU mp-affinity property is in MPIDR register format; squash
355 * the affinity bytes into 32 bits as the GICR_TYPER has them.
357 cpu_affid
= ((cpu_affid
& 0xFF00000000ULL
) >> 8) |
358 (cpu_affid
& 0xFFFFFF);
359 s
->cpu
[i
].gicr_typer
= (cpu_affid
<< 32) |
366 static void arm_gicv3_common_reset(DeviceState
*dev
)
368 GICv3State
*s
= ARM_GICV3_COMMON(dev
);
371 for (i
= 0; i
< s
->num_cpu
; i
++) {
372 GICv3CPUState
*cs
= &s
->cpu
[i
];
376 cs
->gicr_statusr
[GICV3_S
] = 0;
377 cs
->gicr_statusr
[GICV3_NS
] = 0;
378 cs
->gicr_waker
= GICR_WAKER_ProcessorSleep
| GICR_WAKER_ChildrenAsleep
;
379 cs
->gicr_propbaser
= 0;
380 cs
->gicr_pendbaser
= 0;
381 /* If we're resetting a TZ-aware GIC as if secure firmware
382 * had set it up ready to start a kernel in non-secure, we
383 * need to set interrupts to group 1 so the kernel can use them.
384 * Otherwise they reset to group 0 like the hardware.
386 if (s
->irq_reset_nonsecure
) {
387 cs
->gicr_igroupr0
= 0xffffffff;
389 cs
->gicr_igroupr0
= 0;
392 cs
->gicr_ienabler0
= 0;
393 cs
->gicr_ipendr0
= 0;
394 cs
->gicr_iactiver0
= 0;
395 cs
->edge_trigger
= 0xffff;
396 cs
->gicr_igrpmodr0
= 0;
398 memset(cs
->gicr_ipriorityr
, 0, sizeof(cs
->gicr_ipriorityr
));
400 cs
->hppi
.prio
= 0xff;
402 /* State in the CPU interface must *not* be reset here, because it
403 * is part of the CPU's reset domain, not the GIC device's.
407 /* For our implementation affinity routing is always enabled */
408 if (s
->security_extn
) {
409 s
->gicd_ctlr
= GICD_CTLR_ARE_S
| GICD_CTLR_ARE_NS
;
411 s
->gicd_ctlr
= GICD_CTLR_DS
| GICD_CTLR_ARE
;
414 s
->gicd_statusr
[GICV3_S
] = 0;
415 s
->gicd_statusr
[GICV3_NS
] = 0;
417 memset(s
->group
, 0, sizeof(s
->group
));
418 memset(s
->grpmod
, 0, sizeof(s
->grpmod
));
419 memset(s
->enabled
, 0, sizeof(s
->enabled
));
420 memset(s
->pending
, 0, sizeof(s
->pending
));
421 memset(s
->active
, 0, sizeof(s
->active
));
422 memset(s
->level
, 0, sizeof(s
->level
));
423 memset(s
->edge_trigger
, 0, sizeof(s
->edge_trigger
));
424 memset(s
->gicd_ipriority
, 0, sizeof(s
->gicd_ipriority
));
425 memset(s
->gicd_irouter
, 0, sizeof(s
->gicd_irouter
));
426 memset(s
->gicd_nsacr
, 0, sizeof(s
->gicd_nsacr
));
427 /* GICD_IROUTER are UNKNOWN at reset so in theory the guest must
428 * write these to get sane behaviour and we need not populate the
429 * pointer cache here; however having the cache be different for
430 * "happened to be 0 from reset" and "guest wrote 0" would be
433 gicv3_cache_all_target_cpustates(s
);
435 if (s
->irq_reset_nonsecure
) {
436 /* If we're resetting a TZ-aware GIC as if secure firmware
437 * had set it up ready to start a kernel in non-secure, we
438 * need to set interrupts to group 1 so the kernel can use them.
439 * Otherwise they reset to group 0 like the hardware.
441 for (i
= GIC_INTERNAL
; i
< s
->num_irq
; i
++) {
442 gicv3_gicd_group_set(s
, i
);
445 s
->gicd_no_migration_shift_bug
= true;
448 static void arm_gic_common_linux_init(ARMLinuxBootIf
*obj
,
451 GICv3State
*s
= ARM_GICV3_COMMON(obj
);
453 if (s
->security_extn
&& !secure_boot
) {
454 /* We're directly booting a kernel into NonSecure. If this GIC
455 * implements the security extensions then we must configure it
456 * to have all the interrupts be NonSecure (this is a job that
457 * is done by the Secure boot firmware in real hardware, and in
458 * this mode QEMU is acting as a minimalist firmware-and-bootloader
461 s
->irq_reset_nonsecure
= true;
465 static Property arm_gicv3_common_properties
[] = {
466 DEFINE_PROP_UINT32("num-cpu", GICv3State
, num_cpu
, 1),
467 DEFINE_PROP_UINT32("num-irq", GICv3State
, num_irq
, 32),
468 DEFINE_PROP_UINT32("revision", GICv3State
, revision
, 3),
469 DEFINE_PROP_BOOL("has-security-extensions", GICv3State
, security_extn
, 0),
470 DEFINE_PROP_END_OF_LIST(),
473 static void arm_gicv3_common_class_init(ObjectClass
*klass
, void *data
)
475 DeviceClass
*dc
= DEVICE_CLASS(klass
);
476 ARMLinuxBootIfClass
*albifc
= ARM_LINUX_BOOT_IF_CLASS(klass
);
478 dc
->reset
= arm_gicv3_common_reset
;
479 dc
->realize
= arm_gicv3_common_realize
;
480 dc
->props
= arm_gicv3_common_properties
;
481 dc
->vmsd
= &vmstate_gicv3
;
482 albifc
->arm_linux_init
= arm_gic_common_linux_init
;
485 static const TypeInfo arm_gicv3_common_type
= {
486 .name
= TYPE_ARM_GICV3_COMMON
,
487 .parent
= TYPE_SYS_BUS_DEVICE
,
488 .instance_size
= sizeof(GICv3State
),
489 .class_size
= sizeof(ARMGICv3CommonClass
),
490 .class_init
= arm_gicv3_common_class_init
,
492 .interfaces
= (InterfaceInfo
[]) {
493 { TYPE_ARM_LINUX_BOOT_IF
},
498 static void register_types(void)
500 type_register_static(&arm_gicv3_common_type
);
503 type_init(register_types
)