2 * ARM Generic Interrupt Controller v3 (emulation)
4 * Copyright (c) 2016 Linaro Limited
5 * Written by Peter Maydell
7 * This code is licensed under the GPL, version 2 or (at your option)
11 /* This file contains the code for the system register interface
12 * portions of the GICv3.
15 #include "qemu/osdep.h"
16 #include "qemu/bitops.h"
18 #include "qemu/main-loop.h"
20 #include "gicv3_internal.h"
23 #include "target/arm/cpregs.h"
26 * Special case return value from hppvi_index(); must be larger than
27 * the architecturally maximum possible list register index (which is 15)
29 #define HPPVI_INDEX_VLPI 16
31 static GICv3CPUState
*icc_cs_from_env(CPUARMState
*env
)
33 return env
->gicv3state
;
36 static bool gicv3_use_ns_bank(CPUARMState
*env
)
38 /* Return true if we should use the NonSecure bank for a banked GIC
39 * CPU interface register. Note that this differs from the
40 * access_secure_reg() function because GICv3 banked registers are
41 * banked even for AArch64, unlike the other CPU system registers.
43 return !arm_is_secure_below_el3(env
);
46 /* The minimum BPR for the virtual interface is a configurable property */
47 static inline int icv_min_vbpr(GICv3CPUState
*cs
)
49 return 7 - cs
->vprebits
;
52 static inline int ich_num_aprs(GICv3CPUState
*cs
)
54 /* Return the number of virtual APR registers (1, 2, or 4) */
55 int aprmax
= 1 << (cs
->vprebits
- 5);
56 assert(aprmax
<= ARRAY_SIZE(cs
->ich_apr
[0]));
60 /* Simple accessor functions for LR fields */
61 static uint32_t ich_lr_vintid(uint64_t lr
)
63 return extract64(lr
, ICH_LR_EL2_VINTID_SHIFT
, ICH_LR_EL2_VINTID_LENGTH
);
66 static uint32_t ich_lr_pintid(uint64_t lr
)
68 return extract64(lr
, ICH_LR_EL2_PINTID_SHIFT
, ICH_LR_EL2_PINTID_LENGTH
);
71 static uint32_t ich_lr_prio(uint64_t lr
)
73 return extract64(lr
, ICH_LR_EL2_PRIORITY_SHIFT
, ICH_LR_EL2_PRIORITY_LENGTH
);
76 static int ich_lr_state(uint64_t lr
)
78 return extract64(lr
, ICH_LR_EL2_STATE_SHIFT
, ICH_LR_EL2_STATE_LENGTH
);
81 static bool icv_access(CPUARMState
*env
, int hcr_flags
)
83 /* Return true if this ICC_ register access should really be
84 * directed to an ICV_ access. hcr_flags is a mask of
85 * HCR_EL2 bits to check: we treat this as an ICV_ access
86 * if we are in NS EL1 and at least one of the specified
87 * HCR_EL2 bits is set.
89 * ICV registers fall into four categories:
90 * * access if NS EL1 and HCR_EL2.FMO == 1:
91 * all ICV regs with '0' in their name
92 * * access if NS EL1 and HCR_EL2.IMO == 1:
93 * all ICV regs with '1' in their name
94 * * access if NS EL1 and either IMO or FMO == 1:
97 uint64_t hcr_el2
= arm_hcr_el2_eff(env
);
98 bool flagmatch
= hcr_el2
& hcr_flags
& (HCR_IMO
| HCR_FMO
);
100 return flagmatch
&& arm_current_el(env
) == 1
101 && !arm_is_secure_below_el3(env
);
104 static int read_vbpr(GICv3CPUState
*cs
, int grp
)
106 /* Read VBPR value out of the VMCR field (caller must handle
107 * VCBPR effects if required)
109 if (grp
== GICV3_G0
) {
110 return extract64(cs
->ich_vmcr_el2
, ICH_VMCR_EL2_VBPR0_SHIFT
,
111 ICH_VMCR_EL2_VBPR0_LENGTH
);
113 return extract64(cs
->ich_vmcr_el2
, ICH_VMCR_EL2_VBPR1_SHIFT
,
114 ICH_VMCR_EL2_VBPR1_LENGTH
);
118 static void write_vbpr(GICv3CPUState
*cs
, int grp
, int value
)
120 /* Write new VBPR1 value, handling the "writing a value less than
121 * the minimum sets it to the minimum" semantics.
123 int min
= icv_min_vbpr(cs
);
125 if (grp
!= GICV3_G0
) {
129 value
= MAX(value
, min
);
131 if (grp
== GICV3_G0
) {
132 cs
->ich_vmcr_el2
= deposit64(cs
->ich_vmcr_el2
, ICH_VMCR_EL2_VBPR0_SHIFT
,
133 ICH_VMCR_EL2_VBPR0_LENGTH
, value
);
135 cs
->ich_vmcr_el2
= deposit64(cs
->ich_vmcr_el2
, ICH_VMCR_EL2_VBPR1_SHIFT
,
136 ICH_VMCR_EL2_VBPR1_LENGTH
, value
);
140 static uint32_t icv_fullprio_mask(GICv3CPUState
*cs
)
142 /* Return a mask word which clears the unimplemented priority bits
143 * from a priority value for a virtual interrupt. (Not to be confused
144 * with the group priority, whose mask depends on the value of VBPR
145 * for the interrupt group.)
147 return ~0U << (8 - cs
->vpribits
);
150 static int ich_highest_active_virt_prio(GICv3CPUState
*cs
)
152 /* Calculate the current running priority based on the set bits
153 * in the ICH Active Priority Registers.
156 int aprmax
= ich_num_aprs(cs
);
158 for (i
= 0; i
< aprmax
; i
++) {
159 uint32_t apr
= cs
->ich_apr
[GICV3_G0
][i
] |
160 cs
->ich_apr
[GICV3_G1NS
][i
];
165 return (i
* 32 + ctz32(apr
)) << (icv_min_vbpr(cs
) + 1);
167 /* No current active interrupts: return idle priority */
171 static int hppvi_index(GICv3CPUState
*cs
)
174 * Return the list register index of the highest priority pending
175 * virtual interrupt, as per the HighestPriorityVirtualInterrupt
176 * pseudocode. If no pending virtual interrupts, return -1.
177 * If the highest priority pending virtual interrupt is a vLPI,
178 * return HPPVI_INDEX_VLPI.
179 * (The pseudocode handles checking whether the vLPI is higher
180 * priority than the highest priority list register at every
181 * callsite of HighestPriorityVirtualInterrupt; we check it here.)
183 ARMCPU
*cpu
= ARM_CPU(cs
->cpu
);
184 CPUARMState
*env
= &cpu
->env
;
187 /* Note that a list register entry with a priority of 0xff will
188 * never be reported by this function; this is the architecturally
193 if (!(cs
->ich_vmcr_el2
& (ICH_VMCR_EL2_VENG0
| ICH_VMCR_EL2_VENG1
))) {
194 /* Both groups disabled, definitely nothing to do */
198 for (i
= 0; i
< cs
->num_list_regs
; i
++) {
199 uint64_t lr
= cs
->ich_lr_el2
[i
];
202 if (ich_lr_state(lr
) != ICH_LR_EL2_STATE_PENDING
) {
207 /* Ignore interrupts if relevant group enable not set */
208 if (lr
& ICH_LR_EL2_GROUP
) {
209 if (!(cs
->ich_vmcr_el2
& ICH_VMCR_EL2_VENG1
)) {
213 if (!(cs
->ich_vmcr_el2
& ICH_VMCR_EL2_VENG0
)) {
218 thisprio
= ich_lr_prio(lr
);
220 if (thisprio
< prio
) {
227 * "no pending vLPI" is indicated with prio = 0xff, which always
228 * fails the priority check here. vLPIs are only considered
229 * when we are in Non-Secure state.
231 if (cs
->hppvlpi
.prio
< prio
&& !arm_is_secure(env
)) {
232 if (cs
->hppvlpi
.grp
== GICV3_G0
) {
233 if (cs
->ich_vmcr_el2
& ICH_VMCR_EL2_VENG0
) {
234 return HPPVI_INDEX_VLPI
;
237 if (cs
->ich_vmcr_el2
& ICH_VMCR_EL2_VENG1
) {
238 return HPPVI_INDEX_VLPI
;
246 static uint32_t icv_gprio_mask(GICv3CPUState
*cs
, int group
)
248 /* Return a mask word which clears the subpriority bits from
249 * a priority value for a virtual interrupt in the specified group.
250 * This depends on the VBPR value.
251 * If using VBPR0 then:
252 * a BPR of 0 means the group priority bits are [7:1];
253 * a BPR of 1 means they are [7:2], and so on down to
254 * a BPR of 7 meaning no group priority bits at all.
255 * If using VBPR1 then:
256 * a BPR of 0 is impossible (the minimum value is 1)
257 * a BPR of 1 means the group priority bits are [7:1];
258 * a BPR of 2 means they are [7:2], and so on down to
259 * a BPR of 7 meaning the group priority is [7].
261 * Which BPR to use depends on the group of the interrupt and
262 * the current ICH_VMCR_EL2.VCBPR settings.
264 * This corresponds to the VGroupBits() pseudocode.
268 if (group
== GICV3_G1NS
&& cs
->ich_vmcr_el2
& ICH_VMCR_EL2_VCBPR
) {
272 bpr
= read_vbpr(cs
, group
);
273 if (group
== GICV3_G1NS
) {
278 return ~0U << (bpr
+ 1);
281 static bool icv_hppi_can_preempt(GICv3CPUState
*cs
, uint64_t lr
)
283 /* Return true if we can signal this virtual interrupt defined by
284 * the given list register value; see the pseudocode functions
285 * CanSignalVirtualInterrupt and CanSignalVirtualInt.
286 * Compare also icc_hppi_can_preempt() which is the non-virtual
287 * equivalent of these checks.
290 uint32_t mask
, prio
, rprio
, vpmr
;
292 if (!(cs
->ich_hcr_el2
& ICH_HCR_EL2_EN
)) {
293 /* Virtual interface disabled */
297 /* We don't need to check that this LR is in Pending state because
298 * that has already been done in hppvi_index().
301 prio
= ich_lr_prio(lr
);
302 vpmr
= extract64(cs
->ich_vmcr_el2
, ICH_VMCR_EL2_VPMR_SHIFT
,
303 ICH_VMCR_EL2_VPMR_LENGTH
);
306 /* Priority mask masks this interrupt */
310 rprio
= ich_highest_active_virt_prio(cs
);
312 /* No running interrupt so we can preempt */
316 grp
= (lr
& ICH_LR_EL2_GROUP
) ? GICV3_G1NS
: GICV3_G0
;
318 mask
= icv_gprio_mask(cs
, grp
);
320 /* We only preempt a running interrupt if the pending interrupt's
321 * group priority is sufficient (the subpriorities are not considered).
323 if ((prio
& mask
) < (rprio
& mask
)) {
330 static bool icv_hppvlpi_can_preempt(GICv3CPUState
*cs
)
333 * Return true if we can signal the highest priority pending vLPI.
334 * We can assume we're Non-secure because hppvi_index() already
337 uint32_t mask
, rprio
, vpmr
;
339 if (!(cs
->ich_hcr_el2
& ICH_HCR_EL2_EN
)) {
340 /* Virtual interface disabled */
344 vpmr
= extract64(cs
->ich_vmcr_el2
, ICH_VMCR_EL2_VPMR_SHIFT
,
345 ICH_VMCR_EL2_VPMR_LENGTH
);
347 if (cs
->hppvlpi
.prio
>= vpmr
) {
348 /* Priority mask masks this interrupt */
352 rprio
= ich_highest_active_virt_prio(cs
);
354 /* No running interrupt so we can preempt */
358 mask
= icv_gprio_mask(cs
, cs
->hppvlpi
.grp
);
361 * We only preempt a running interrupt if the pending interrupt's
362 * group priority is sufficient (the subpriorities are not considered).
364 if ((cs
->hppvlpi
.prio
& mask
) < (rprio
& mask
)) {
371 static uint32_t eoi_maintenance_interrupt_state(GICv3CPUState
*cs
,
374 /* Return a set of bits indicating the EOI maintenance interrupt status
375 * for each list register. The EOI maintenance interrupt status is
376 * 1 if LR.State == 0 && LR.HW == 0 && LR.EOI == 1
377 * (see the GICv3 spec for the ICH_EISR_EL2 register).
378 * If misr is not NULL then we should also collect the information
379 * about the MISR.EOI, MISR.NP and MISR.U bits.
383 bool seenpending
= false;
386 for (i
= 0; i
< cs
->num_list_regs
; i
++) {
387 uint64_t lr
= cs
->ich_lr_el2
[i
];
389 if ((lr
& (ICH_LR_EL2_STATE_MASK
| ICH_LR_EL2_HW
| ICH_LR_EL2_EOI
))
393 if ((lr
& ICH_LR_EL2_STATE_MASK
)) {
396 if (ich_lr_state(lr
) == ICH_LR_EL2_STATE_PENDING
) {
402 if (validcount
< 2 && (cs
->ich_hcr_el2
& ICH_HCR_EL2_UIE
)) {
403 *misr
|= ICH_MISR_EL2_U
;
405 if (!seenpending
&& (cs
->ich_hcr_el2
& ICH_HCR_EL2_NPIE
)) {
406 *misr
|= ICH_MISR_EL2_NP
;
409 *misr
|= ICH_MISR_EL2_EOI
;
415 static uint32_t maintenance_interrupt_state(GICv3CPUState
*cs
)
417 /* Return a set of bits indicating the maintenance interrupt status
418 * (as seen in the ICH_MISR_EL2 register).
422 /* Scan list registers and fill in the U, NP and EOI bits */
423 eoi_maintenance_interrupt_state(cs
, &value
);
425 if ((cs
->ich_hcr_el2
& ICH_HCR_EL2_LRENPIE
) &&
426 (cs
->ich_hcr_el2
& ICH_HCR_EL2_EOICOUNT_MASK
)) {
427 value
|= ICH_MISR_EL2_LRENP
;
430 if ((cs
->ich_hcr_el2
& ICH_HCR_EL2_VGRP0EIE
) &&
431 (cs
->ich_vmcr_el2
& ICH_VMCR_EL2_VENG0
)) {
432 value
|= ICH_MISR_EL2_VGRP0E
;
435 if ((cs
->ich_hcr_el2
& ICH_HCR_EL2_VGRP0DIE
) &&
436 !(cs
->ich_vmcr_el2
& ICH_VMCR_EL2_VENG1
)) {
437 value
|= ICH_MISR_EL2_VGRP0D
;
439 if ((cs
->ich_hcr_el2
& ICH_HCR_EL2_VGRP1EIE
) &&
440 (cs
->ich_vmcr_el2
& ICH_VMCR_EL2_VENG1
)) {
441 value
|= ICH_MISR_EL2_VGRP1E
;
444 if ((cs
->ich_hcr_el2
& ICH_HCR_EL2_VGRP1DIE
) &&
445 !(cs
->ich_vmcr_el2
& ICH_VMCR_EL2_VENG1
)) {
446 value
|= ICH_MISR_EL2_VGRP1D
;
452 void gicv3_cpuif_virt_irq_fiq_update(GICv3CPUState
*cs
)
455 * Tell the CPU about any pending virtual interrupts.
456 * This should only be called for changes that affect the
457 * vIRQ and vFIQ status and do not change the maintenance
458 * interrupt status. This means that unlike gicv3_cpuif_virt_update()
459 * this function won't recursively call back into the GIC code.
460 * The main use of this is when the redistributor has changed the
461 * highest priority pending virtual LPI.
467 idx
= hppvi_index(cs
);
468 trace_gicv3_cpuif_virt_update(gicv3_redist_affid(cs
), idx
,
469 cs
->hppvlpi
.irq
, cs
->hppvlpi
.grp
,
471 if (idx
== HPPVI_INDEX_VLPI
) {
472 if (icv_hppvlpi_can_preempt(cs
)) {
473 if (cs
->hppvlpi
.grp
== GICV3_G0
) {
479 } else if (idx
>= 0) {
480 uint64_t lr
= cs
->ich_lr_el2
[idx
];
482 if (icv_hppi_can_preempt(cs
, lr
)) {
483 /* Virtual interrupts are simple: G0 are always FIQ, and G1 IRQ */
484 if (lr
& ICH_LR_EL2_GROUP
) {
492 trace_gicv3_cpuif_virt_set_irqs(gicv3_redist_affid(cs
), fiqlevel
, irqlevel
);
493 qemu_set_irq(cs
->parent_vfiq
, fiqlevel
);
494 qemu_set_irq(cs
->parent_virq
, irqlevel
);
497 static void gicv3_cpuif_virt_update(GICv3CPUState
*cs
)
500 * Tell the CPU about any pending virtual interrupts or
501 * maintenance interrupts, following a change to the state
502 * of the CPU interface relevant to virtual interrupts.
504 * CAUTION: this function will call qemu_set_irq() on the
505 * CPU maintenance IRQ line, which is typically wired up
506 * to the GIC as a per-CPU interrupt. This means that it
507 * will recursively call back into the GIC code via
508 * gicv3_redist_set_irq() and thus into the CPU interface code's
509 * gicv3_cpuif_update(). It is therefore important that this
510 * function is only called as the final action of a CPU interface
511 * register write implementation, after all the GIC state
512 * fields have been updated. gicv3_cpuif_update() also must
513 * not cause this function to be called, but that happens
514 * naturally as a result of there being no architectural
515 * linkage between the physical and virtual GIC logic.
517 ARMCPU
*cpu
= ARM_CPU(cs
->cpu
);
520 gicv3_cpuif_virt_irq_fiq_update(cs
);
522 if ((cs
->ich_hcr_el2
& ICH_HCR_EL2_EN
) &&
523 maintenance_interrupt_state(cs
) != 0) {
527 trace_gicv3_cpuif_virt_set_maint_irq(gicv3_redist_affid(cs
), maintlevel
);
528 qemu_set_irq(cpu
->gicv3_maintenance_interrupt
, maintlevel
);
531 static uint64_t icv_ap_read(CPUARMState
*env
, const ARMCPRegInfo
*ri
)
533 GICv3CPUState
*cs
= icc_cs_from_env(env
);
534 int regno
= ri
->opc2
& 3;
535 int grp
= (ri
->crm
& 1) ? GICV3_G1NS
: GICV3_G0
;
536 uint64_t value
= cs
->ich_apr
[grp
][regno
];
538 trace_gicv3_icv_ap_read(ri
->crm
& 1, regno
, gicv3_redist_affid(cs
), value
);
542 static void icv_ap_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
545 GICv3CPUState
*cs
= icc_cs_from_env(env
);
546 int regno
= ri
->opc2
& 3;
547 int grp
= (ri
->crm
& 1) ? GICV3_G1NS
: GICV3_G0
;
549 trace_gicv3_icv_ap_write(ri
->crm
& 1, regno
, gicv3_redist_affid(cs
), value
);
551 cs
->ich_apr
[grp
][regno
] = value
& 0xFFFFFFFFU
;
553 gicv3_cpuif_virt_irq_fiq_update(cs
);
557 static uint64_t icv_bpr_read(CPUARMState
*env
, const ARMCPRegInfo
*ri
)
559 GICv3CPUState
*cs
= icc_cs_from_env(env
);
560 int grp
= (ri
->crm
== 8) ? GICV3_G0
: GICV3_G1NS
;
564 if (grp
== GICV3_G1NS
&& (cs
->ich_vmcr_el2
& ICH_VMCR_EL2_VCBPR
)) {
565 /* reads return bpr0 + 1 saturated to 7, writes ignored */
570 bpr
= read_vbpr(cs
, grp
);
577 trace_gicv3_icv_bpr_read(ri
->crm
== 8 ? 0 : 1, gicv3_redist_affid(cs
), bpr
);
582 static void icv_bpr_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
585 GICv3CPUState
*cs
= icc_cs_from_env(env
);
586 int grp
= (ri
->crm
== 8) ? GICV3_G0
: GICV3_G1NS
;
588 trace_gicv3_icv_bpr_write(ri
->crm
== 8 ? 0 : 1,
589 gicv3_redist_affid(cs
), value
);
591 if (grp
== GICV3_G1NS
&& (cs
->ich_vmcr_el2
& ICH_VMCR_EL2_VCBPR
)) {
592 /* reads return bpr0 + 1 saturated to 7, writes ignored */
596 write_vbpr(cs
, grp
, value
);
598 gicv3_cpuif_virt_irq_fiq_update(cs
);
601 static uint64_t icv_pmr_read(CPUARMState
*env
, const ARMCPRegInfo
*ri
)
603 GICv3CPUState
*cs
= icc_cs_from_env(env
);
606 value
= extract64(cs
->ich_vmcr_el2
, ICH_VMCR_EL2_VPMR_SHIFT
,
607 ICH_VMCR_EL2_VPMR_LENGTH
);
609 trace_gicv3_icv_pmr_read(gicv3_redist_affid(cs
), value
);
613 static void icv_pmr_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
616 GICv3CPUState
*cs
= icc_cs_from_env(env
);
618 trace_gicv3_icv_pmr_write(gicv3_redist_affid(cs
), value
);
620 value
&= icv_fullprio_mask(cs
);
622 cs
->ich_vmcr_el2
= deposit64(cs
->ich_vmcr_el2
, ICH_VMCR_EL2_VPMR_SHIFT
,
623 ICH_VMCR_EL2_VPMR_LENGTH
, value
);
625 gicv3_cpuif_virt_irq_fiq_update(cs
);
628 static uint64_t icv_igrpen_read(CPUARMState
*env
, const ARMCPRegInfo
*ri
)
630 GICv3CPUState
*cs
= icc_cs_from_env(env
);
634 enbit
= ri
->opc2
& 1 ? ICH_VMCR_EL2_VENG1_SHIFT
: ICH_VMCR_EL2_VENG0_SHIFT
;
635 value
= extract64(cs
->ich_vmcr_el2
, enbit
, 1);
637 trace_gicv3_icv_igrpen_read(ri
->opc2
& 1 ? 1 : 0,
638 gicv3_redist_affid(cs
), value
);
642 static void icv_igrpen_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
645 GICv3CPUState
*cs
= icc_cs_from_env(env
);
648 trace_gicv3_icv_igrpen_write(ri
->opc2
& 1 ? 1 : 0,
649 gicv3_redist_affid(cs
), value
);
651 enbit
= ri
->opc2
& 1 ? ICH_VMCR_EL2_VENG1_SHIFT
: ICH_VMCR_EL2_VENG0_SHIFT
;
653 cs
->ich_vmcr_el2
= deposit64(cs
->ich_vmcr_el2
, enbit
, 1, value
);
654 gicv3_cpuif_virt_update(cs
);
657 static uint64_t icv_ctlr_read(CPUARMState
*env
, const ARMCPRegInfo
*ri
)
659 GICv3CPUState
*cs
= icc_cs_from_env(env
);
662 /* Note that the fixed fields here (A3V, SEIS, IDbits, PRIbits)
663 * should match the ones reported in ich_vtr_read().
665 value
= ICC_CTLR_EL1_A3V
| (1 << ICC_CTLR_EL1_IDBITS_SHIFT
) |
666 ((cs
->vpribits
- 1) << ICC_CTLR_EL1_PRIBITS_SHIFT
);
668 if (cs
->ich_vmcr_el2
& ICH_VMCR_EL2_VEOIM
) {
669 value
|= ICC_CTLR_EL1_EOIMODE
;
672 if (cs
->ich_vmcr_el2
& ICH_VMCR_EL2_VCBPR
) {
673 value
|= ICC_CTLR_EL1_CBPR
;
676 trace_gicv3_icv_ctlr_read(gicv3_redist_affid(cs
), value
);
680 static void icv_ctlr_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
683 GICv3CPUState
*cs
= icc_cs_from_env(env
);
685 trace_gicv3_icv_ctlr_write(gicv3_redist_affid(cs
), value
);
687 cs
->ich_vmcr_el2
= deposit64(cs
->ich_vmcr_el2
, ICH_VMCR_EL2_VCBPR_SHIFT
,
688 1, value
& ICC_CTLR_EL1_CBPR
? 1 : 0);
689 cs
->ich_vmcr_el2
= deposit64(cs
->ich_vmcr_el2
, ICH_VMCR_EL2_VEOIM_SHIFT
,
690 1, value
& ICC_CTLR_EL1_EOIMODE
? 1 : 0);
692 gicv3_cpuif_virt_irq_fiq_update(cs
);
695 static uint64_t icv_rpr_read(CPUARMState
*env
, const ARMCPRegInfo
*ri
)
697 GICv3CPUState
*cs
= icc_cs_from_env(env
);
698 int prio
= ich_highest_active_virt_prio(cs
);
700 trace_gicv3_icv_rpr_read(gicv3_redist_affid(cs
), prio
);
704 static uint64_t icv_hppir_read(CPUARMState
*env
, const ARMCPRegInfo
*ri
)
706 GICv3CPUState
*cs
= icc_cs_from_env(env
);
707 int grp
= ri
->crm
== 8 ? GICV3_G0
: GICV3_G1NS
;
708 int idx
= hppvi_index(cs
);
709 uint64_t value
= INTID_SPURIOUS
;
711 if (idx
== HPPVI_INDEX_VLPI
) {
712 if (cs
->hppvlpi
.grp
== grp
) {
713 value
= cs
->hppvlpi
.irq
;
715 } else if (idx
>= 0) {
716 uint64_t lr
= cs
->ich_lr_el2
[idx
];
717 int thisgrp
= (lr
& ICH_LR_EL2_GROUP
) ? GICV3_G1NS
: GICV3_G0
;
719 if (grp
== thisgrp
) {
720 value
= ich_lr_vintid(lr
);
724 trace_gicv3_icv_hppir_read(ri
->crm
== 8 ? 0 : 1,
725 gicv3_redist_affid(cs
), value
);
729 static void icv_activate_irq(GICv3CPUState
*cs
, int idx
, int grp
)
731 /* Activate the interrupt in the specified list register
732 * by moving it from Pending to Active state, and update the
733 * Active Priority Registers.
735 uint32_t mask
= icv_gprio_mask(cs
, grp
);
736 int prio
= ich_lr_prio(cs
->ich_lr_el2
[idx
]) & mask
;
737 int aprbit
= prio
>> (8 - cs
->vprebits
);
738 int regno
= aprbit
/ 32;
739 int regbit
= aprbit
% 32;
741 cs
->ich_lr_el2
[idx
] &= ~ICH_LR_EL2_STATE_PENDING_BIT
;
742 cs
->ich_lr_el2
[idx
] |= ICH_LR_EL2_STATE_ACTIVE_BIT
;
743 cs
->ich_apr
[grp
][regno
] |= (1 << regbit
);
746 static void icv_activate_vlpi(GICv3CPUState
*cs
)
748 uint32_t mask
= icv_gprio_mask(cs
, cs
->hppvlpi
.grp
);
749 int prio
= cs
->hppvlpi
.prio
& mask
;
750 int aprbit
= prio
>> (8 - cs
->vprebits
);
751 int regno
= aprbit
/ 32;
752 int regbit
= aprbit
% 32;
754 cs
->ich_apr
[cs
->hppvlpi
.grp
][regno
] |= (1 << regbit
);
755 gicv3_redist_vlpi_pending(cs
, cs
->hppvlpi
.irq
, 0);
758 static uint64_t icv_iar_read(CPUARMState
*env
, const ARMCPRegInfo
*ri
)
760 GICv3CPUState
*cs
= icc_cs_from_env(env
);
761 int grp
= ri
->crm
== 8 ? GICV3_G0
: GICV3_G1NS
;
762 int idx
= hppvi_index(cs
);
763 uint64_t intid
= INTID_SPURIOUS
;
765 if (idx
== HPPVI_INDEX_VLPI
) {
766 if (cs
->hppvlpi
.grp
== grp
&& icv_hppvlpi_can_preempt(cs
)) {
767 intid
= cs
->hppvlpi
.irq
;
768 icv_activate_vlpi(cs
);
770 } else if (idx
>= 0) {
771 uint64_t lr
= cs
->ich_lr_el2
[idx
];
772 int thisgrp
= (lr
& ICH_LR_EL2_GROUP
) ? GICV3_G1NS
: GICV3_G0
;
774 if (thisgrp
== grp
&& icv_hppi_can_preempt(cs
, lr
)) {
775 intid
= ich_lr_vintid(lr
);
776 if (!gicv3_intid_is_special(intid
)) {
777 icv_activate_irq(cs
, idx
, grp
);
779 /* Interrupt goes from Pending to Invalid */
780 cs
->ich_lr_el2
[idx
] &= ~ICH_LR_EL2_STATE_PENDING_BIT
;
781 /* We will now return the (bogus) ID from the list register,
782 * as per the pseudocode.
788 trace_gicv3_icv_iar_read(ri
->crm
== 8 ? 0 : 1,
789 gicv3_redist_affid(cs
), intid
);
791 gicv3_cpuif_virt_update(cs
);
796 static uint32_t icc_fullprio_mask(GICv3CPUState
*cs
)
799 * Return a mask word which clears the unimplemented priority bits
800 * from a priority value for a physical interrupt. (Not to be confused
801 * with the group priority, whose mask depends on the value of BPR
802 * for the interrupt group.)
804 return ~0U << (8 - cs
->pribits
);
807 static inline int icc_min_bpr(GICv3CPUState
*cs
)
809 /* The minimum BPR for the physical interface. */
810 return 7 - cs
->prebits
;
813 static inline int icc_min_bpr_ns(GICv3CPUState
*cs
)
815 return icc_min_bpr(cs
) + 1;
818 static inline int icc_num_aprs(GICv3CPUState
*cs
)
820 /* Return the number of APR registers (1, 2, or 4) */
821 int aprmax
= 1 << MAX(cs
->prebits
- 5, 0);
822 assert(aprmax
<= ARRAY_SIZE(cs
->icc_apr
[0]));
826 static int icc_highest_active_prio(GICv3CPUState
*cs
)
828 /* Calculate the current running priority based on the set bits
829 * in the Active Priority Registers.
833 for (i
= 0; i
< icc_num_aprs(cs
); i
++) {
834 uint32_t apr
= cs
->icc_apr
[GICV3_G0
][i
] |
835 cs
->icc_apr
[GICV3_G1
][i
] | cs
->icc_apr
[GICV3_G1NS
][i
];
840 return (i
* 32 + ctz32(apr
)) << (icc_min_bpr(cs
) + 1);
842 /* No current active interrupts: return idle priority */
846 static uint32_t icc_gprio_mask(GICv3CPUState
*cs
, int group
)
848 /* Return a mask word which clears the subpriority bits from
849 * a priority value for an interrupt in the specified group.
850 * This depends on the BPR value. For CBPR0 (S or NS):
851 * a BPR of 0 means the group priority bits are [7:1];
852 * a BPR of 1 means they are [7:2], and so on down to
853 * a BPR of 7 meaning no group priority bits at all.
855 * a BPR of 0 is impossible (the minimum value is 1)
856 * a BPR of 1 means the group priority bits are [7:1];
857 * a BPR of 2 means they are [7:2], and so on down to
858 * a BPR of 7 meaning the group priority is [7].
860 * Which BPR to use depends on the group of the interrupt and
861 * the current ICC_CTLR.CBPR settings.
863 * This corresponds to the GroupBits() pseudocode.
867 if ((group
== GICV3_G1
&& cs
->icc_ctlr_el1
[GICV3_S
] & ICC_CTLR_EL1_CBPR
) ||
868 (group
== GICV3_G1NS
&&
869 cs
->icc_ctlr_el1
[GICV3_NS
] & ICC_CTLR_EL1_CBPR
)) {
873 bpr
= cs
->icc_bpr
[group
] & 7;
875 if (group
== GICV3_G1NS
) {
880 return ~0U << (bpr
+ 1);
883 static bool icc_no_enabled_hppi(GICv3CPUState
*cs
)
885 /* Return true if there is no pending interrupt, or the
886 * highest priority pending interrupt is in a group which has been
887 * disabled at the CPU interface by the ICC_IGRPEN* register enable bits.
889 return cs
->hppi
.prio
== 0xff || (cs
->icc_igrpen
[cs
->hppi
.grp
] == 0);
892 static bool icc_hppi_can_preempt(GICv3CPUState
*cs
)
894 /* Return true if we have a pending interrupt of sufficient
895 * priority to preempt.
900 if (icc_no_enabled_hppi(cs
)) {
904 if (cs
->hppi
.prio
>= cs
->icc_pmr_el1
) {
905 /* Priority mask masks this interrupt */
909 rprio
= icc_highest_active_prio(cs
);
911 /* No currently running interrupt so we can preempt */
915 mask
= icc_gprio_mask(cs
, cs
->hppi
.grp
);
917 /* We only preempt a running interrupt if the pending interrupt's
918 * group priority is sufficient (the subpriorities are not considered).
920 if ((cs
->hppi
.prio
& mask
) < (rprio
& mask
)) {
927 void gicv3_cpuif_update(GICv3CPUState
*cs
)
929 /* Tell the CPU about its highest priority pending interrupt */
932 ARMCPU
*cpu
= ARM_CPU(cs
->cpu
);
933 CPUARMState
*env
= &cpu
->env
;
935 g_assert(qemu_mutex_iothread_locked());
937 trace_gicv3_cpuif_update(gicv3_redist_affid(cs
), cs
->hppi
.irq
,
938 cs
->hppi
.grp
, cs
->hppi
.prio
);
940 if (cs
->hppi
.grp
== GICV3_G1
&& !arm_feature(env
, ARM_FEATURE_EL3
)) {
941 /* If a Security-enabled GIC sends a G1S interrupt to a
942 * Security-disabled CPU, we must treat it as if it were G0.
944 cs
->hppi
.grp
= GICV3_G0
;
947 if (icc_hppi_can_preempt(cs
)) {
948 /* We have an interrupt: should we signal it as IRQ or FIQ?
949 * This is described in the GICv3 spec section 4.6.2.
953 switch (cs
->hppi
.grp
) {
958 isfiq
= (!arm_is_secure(env
) ||
959 (arm_current_el(env
) == 3 && arm_el_is_aa64(env
, 3)));
962 isfiq
= arm_is_secure(env
);
965 g_assert_not_reached();
975 trace_gicv3_cpuif_set_irqs(gicv3_redist_affid(cs
), fiqlevel
, irqlevel
);
977 qemu_set_irq(cs
->parent_fiq
, fiqlevel
);
978 qemu_set_irq(cs
->parent_irq
, irqlevel
);
981 static uint64_t icc_pmr_read(CPUARMState
*env
, const ARMCPRegInfo
*ri
)
983 GICv3CPUState
*cs
= icc_cs_from_env(env
);
984 uint32_t value
= cs
->icc_pmr_el1
;
986 if (icv_access(env
, HCR_FMO
| HCR_IMO
)) {
987 return icv_pmr_read(env
, ri
);
990 if (arm_feature(env
, ARM_FEATURE_EL3
) && !arm_is_secure(env
) &&
991 (env
->cp15
.scr_el3
& SCR_FIQ
)) {
992 /* NS access and Group 0 is inaccessible to NS: return the
993 * NS view of the current priority
995 if ((value
& 0x80) == 0) {
996 /* Secure priorities not visible to NS */
998 } else if (value
!= 0xff) {
999 value
= (value
<< 1) & 0xff;
1003 trace_gicv3_icc_pmr_read(gicv3_redist_affid(cs
), value
);
1008 static void icc_pmr_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
1011 GICv3CPUState
*cs
= icc_cs_from_env(env
);
1013 if (icv_access(env
, HCR_FMO
| HCR_IMO
)) {
1014 return icv_pmr_write(env
, ri
, value
);
1017 trace_gicv3_icc_pmr_write(gicv3_redist_affid(cs
), value
);
1019 value
&= icc_fullprio_mask(cs
);
1021 if (arm_feature(env
, ARM_FEATURE_EL3
) && !arm_is_secure(env
) &&
1022 (env
->cp15
.scr_el3
& SCR_FIQ
)) {
1023 /* NS access and Group 0 is inaccessible to NS: return the
1024 * NS view of the current priority
1026 if (!(cs
->icc_pmr_el1
& 0x80)) {
1027 /* Current PMR in the secure range, don't allow NS to change it */
1030 value
= (value
>> 1) | 0x80;
1032 cs
->icc_pmr_el1
= value
;
1033 gicv3_cpuif_update(cs
);
1036 static void icc_activate_irq(GICv3CPUState
*cs
, int irq
)
1038 /* Move the interrupt from the Pending state to Active, and update
1039 * the Active Priority Registers
1041 uint32_t mask
= icc_gprio_mask(cs
, cs
->hppi
.grp
);
1042 int prio
= cs
->hppi
.prio
& mask
;
1043 int aprbit
= prio
>> (8 - cs
->prebits
);
1044 int regno
= aprbit
/ 32;
1045 int regbit
= aprbit
% 32;
1047 cs
->icc_apr
[cs
->hppi
.grp
][regno
] |= (1 << regbit
);
1049 if (irq
< GIC_INTERNAL
) {
1050 cs
->gicr_iactiver0
= deposit32(cs
->gicr_iactiver0
, irq
, 1, 1);
1051 cs
->gicr_ipendr0
= deposit32(cs
->gicr_ipendr0
, irq
, 1, 0);
1052 gicv3_redist_update(cs
);
1053 } else if (irq
< GICV3_LPI_INTID_START
) {
1054 gicv3_gicd_active_set(cs
->gic
, irq
);
1055 gicv3_gicd_pending_clear(cs
->gic
, irq
);
1056 gicv3_update(cs
->gic
, irq
, 1);
1058 gicv3_redist_lpi_pending(cs
, irq
, 0);
1062 static uint64_t icc_hppir0_value(GICv3CPUState
*cs
, CPUARMState
*env
)
1064 /* Return the highest priority pending interrupt register value
1069 if (cs
->hppi
.prio
== 0xff) {
1070 return INTID_SPURIOUS
;
1073 /* Check whether we can return the interrupt or if we should return
1074 * a special identifier, as per the CheckGroup0ForSpecialIdentifiers
1075 * pseudocode. (We can simplify a little because for us ICC_SRE_EL1.RM
1078 irq_is_secure
= (!(cs
->gic
->gicd_ctlr
& GICD_CTLR_DS
) &&
1079 (cs
->hppi
.grp
!= GICV3_G1NS
));
1081 if (cs
->hppi
.grp
!= GICV3_G0
&& !arm_is_el3_or_mon(env
)) {
1082 return INTID_SPURIOUS
;
1084 if (irq_is_secure
&& !arm_is_secure(env
)) {
1085 /* Secure interrupts not visible to Nonsecure */
1086 return INTID_SPURIOUS
;
1089 if (cs
->hppi
.grp
!= GICV3_G0
) {
1090 /* Indicate to EL3 that there's a Group 1 interrupt for the other
1093 return irq_is_secure
? INTID_SECURE
: INTID_NONSECURE
;
1096 return cs
->hppi
.irq
;
1099 static uint64_t icc_hppir1_value(GICv3CPUState
*cs
, CPUARMState
*env
)
1101 /* Return the highest priority pending interrupt register value
1106 if (cs
->hppi
.prio
== 0xff) {
1107 return INTID_SPURIOUS
;
1110 /* Check whether we can return the interrupt or if we should return
1111 * a special identifier, as per the CheckGroup1ForSpecialIdentifiers
1112 * pseudocode. (We can simplify a little because for us ICC_SRE_EL1.RM
1115 irq_is_secure
= (!(cs
->gic
->gicd_ctlr
& GICD_CTLR_DS
) &&
1116 (cs
->hppi
.grp
!= GICV3_G1NS
));
1118 if (cs
->hppi
.grp
== GICV3_G0
) {
1119 /* Group 0 interrupts not visible via HPPIR1 */
1120 return INTID_SPURIOUS
;
1122 if (irq_is_secure
) {
1123 if (!arm_is_secure(env
)) {
1124 /* Secure interrupts not visible in Non-secure */
1125 return INTID_SPURIOUS
;
1127 } else if (!arm_is_el3_or_mon(env
) && arm_is_secure(env
)) {
1128 /* Group 1 non-secure interrupts not visible in Secure EL1 */
1129 return INTID_SPURIOUS
;
1132 return cs
->hppi
.irq
;
1135 static uint64_t icc_iar0_read(CPUARMState
*env
, const ARMCPRegInfo
*ri
)
1137 GICv3CPUState
*cs
= icc_cs_from_env(env
);
1140 if (icv_access(env
, HCR_FMO
)) {
1141 return icv_iar_read(env
, ri
);
1144 if (!icc_hppi_can_preempt(cs
)) {
1145 intid
= INTID_SPURIOUS
;
1147 intid
= icc_hppir0_value(cs
, env
);
1150 if (!gicv3_intid_is_special(intid
)) {
1151 icc_activate_irq(cs
, intid
);
1154 trace_gicv3_icc_iar0_read(gicv3_redist_affid(cs
), intid
);
1158 static uint64_t icc_iar1_read(CPUARMState
*env
, const ARMCPRegInfo
*ri
)
1160 GICv3CPUState
*cs
= icc_cs_from_env(env
);
1163 if (icv_access(env
, HCR_IMO
)) {
1164 return icv_iar_read(env
, ri
);
1167 if (!icc_hppi_can_preempt(cs
)) {
1168 intid
= INTID_SPURIOUS
;
1170 intid
= icc_hppir1_value(cs
, env
);
1173 if (!gicv3_intid_is_special(intid
)) {
1174 icc_activate_irq(cs
, intid
);
1177 trace_gicv3_icc_iar1_read(gicv3_redist_affid(cs
), intid
);
1181 static void icc_drop_prio(GICv3CPUState
*cs
, int grp
)
1183 /* Drop the priority of the currently active interrupt in
1184 * the specified group.
1186 * Note that we can guarantee (because of the requirement to nest
1187 * ICC_IAR reads [which activate an interrupt and raise priority]
1188 * with ICC_EOIR writes [which drop the priority for the interrupt])
1189 * that the interrupt we're being called for is the highest priority
1190 * active interrupt, meaning that it has the lowest set bit in the
1193 * If the guest does not honour the ordering constraints then the
1194 * behaviour of the GIC is UNPREDICTABLE, which for us means that
1195 * the values of the APR registers might become incorrect and the
1196 * running priority will be wrong, so interrupts that should preempt
1197 * might not do so, and interrupts that should not preempt might do so.
1201 for (i
= 0; i
< icc_num_aprs(cs
); i
++) {
1202 uint64_t *papr
= &cs
->icc_apr
[grp
][i
];
1207 /* Clear the lowest set bit */
1212 /* running priority change means we need an update for this cpu i/f */
1213 gicv3_cpuif_update(cs
);
1216 static bool icc_eoi_split(CPUARMState
*env
, GICv3CPUState
*cs
)
1218 /* Return true if we should split priority drop and interrupt
1219 * deactivation, ie whether the relevant EOIMode bit is set.
1221 if (arm_is_el3_or_mon(env
)) {
1222 return cs
->icc_ctlr_el3
& ICC_CTLR_EL3_EOIMODE_EL3
;
1224 if (arm_is_secure_below_el3(env
)) {
1225 return cs
->icc_ctlr_el1
[GICV3_S
] & ICC_CTLR_EL1_EOIMODE
;
1227 return cs
->icc_ctlr_el1
[GICV3_NS
] & ICC_CTLR_EL1_EOIMODE
;
1231 static int icc_highest_active_group(GICv3CPUState
*cs
)
1233 /* Return the group with the highest priority active interrupt.
1234 * We can do this by just comparing the APRs to see which one
1235 * has the lowest set bit.
1236 * (If more than one group is active at the same priority then
1237 * we're in UNPREDICTABLE territory.)
1241 for (i
= 0; i
< ARRAY_SIZE(cs
->icc_apr
[0]); i
++) {
1242 int g0ctz
= ctz32(cs
->icc_apr
[GICV3_G0
][i
]);
1243 int g1ctz
= ctz32(cs
->icc_apr
[GICV3_G1
][i
]);
1244 int g1nsctz
= ctz32(cs
->icc_apr
[GICV3_G1NS
][i
]);
1246 if (g1nsctz
< g0ctz
&& g1nsctz
< g1ctz
) {
1249 if (g1ctz
< g0ctz
) {
1256 /* No set active bits? UNPREDICTABLE; return -1 so the caller
1257 * ignores the spurious EOI attempt.
1262 static void icc_deactivate_irq(GICv3CPUState
*cs
, int irq
)
1264 if (irq
< GIC_INTERNAL
) {
1265 cs
->gicr_iactiver0
= deposit32(cs
->gicr_iactiver0
, irq
, 1, 0);
1266 gicv3_redist_update(cs
);
1268 gicv3_gicd_active_clear(cs
->gic
, irq
);
1269 gicv3_update(cs
->gic
, irq
, 1);
1273 static bool icv_eoi_split(CPUARMState
*env
, GICv3CPUState
*cs
)
1275 /* Return true if we should split priority drop and interrupt
1276 * deactivation, ie whether the virtual EOIMode bit is set.
1278 return cs
->ich_vmcr_el2
& ICH_VMCR_EL2_VEOIM
;
1281 static int icv_find_active(GICv3CPUState
*cs
, int irq
)
1283 /* Given an interrupt number for an active interrupt, return the index
1284 * of the corresponding list register, or -1 if there is no match.
1285 * Corresponds to FindActiveVirtualInterrupt pseudocode.
1289 for (i
= 0; i
< cs
->num_list_regs
; i
++) {
1290 uint64_t lr
= cs
->ich_lr_el2
[i
];
1292 if ((lr
& ICH_LR_EL2_STATE_ACTIVE_BIT
) && ich_lr_vintid(lr
) == irq
) {
1300 static void icv_deactivate_irq(GICv3CPUState
*cs
, int idx
)
1302 /* Deactivate the interrupt in the specified list register index */
1303 uint64_t lr
= cs
->ich_lr_el2
[idx
];
1305 if (lr
& ICH_LR_EL2_HW
) {
1306 /* Deactivate the associated physical interrupt */
1307 int pirq
= ich_lr_pintid(lr
);
1309 if (pirq
< INTID_SECURE
) {
1310 icc_deactivate_irq(cs
, pirq
);
1314 /* Clear the 'active' part of the state, so ActivePending->Pending
1315 * and Active->Invalid.
1317 lr
&= ~ICH_LR_EL2_STATE_ACTIVE_BIT
;
1318 cs
->ich_lr_el2
[idx
] = lr
;
1321 static void icv_increment_eoicount(GICv3CPUState
*cs
)
1323 /* Increment the EOICOUNT field in ICH_HCR_EL2 */
1324 int eoicount
= extract64(cs
->ich_hcr_el2
, ICH_HCR_EL2_EOICOUNT_SHIFT
,
1325 ICH_HCR_EL2_EOICOUNT_LENGTH
);
1327 cs
->ich_hcr_el2
= deposit64(cs
->ich_hcr_el2
, ICH_HCR_EL2_EOICOUNT_SHIFT
,
1328 ICH_HCR_EL2_EOICOUNT_LENGTH
, eoicount
+ 1);
1331 static int icv_drop_prio(GICv3CPUState
*cs
)
1333 /* Drop the priority of the currently active virtual interrupt
1334 * (favouring group 0 if there is a set active bit at
1335 * the same priority for both group 0 and group 1).
1336 * Return the priority value for the bit we just cleared,
1337 * or 0xff if no bits were set in the AP registers at all.
1338 * Note that though the ich_apr[] are uint64_t only the low
1339 * 32 bits are actually relevant.
1342 int aprmax
= ich_num_aprs(cs
);
1344 for (i
= 0; i
< aprmax
; i
++) {
1345 uint64_t *papr0
= &cs
->ich_apr
[GICV3_G0
][i
];
1346 uint64_t *papr1
= &cs
->ich_apr
[GICV3_G1NS
][i
];
1347 int apr0count
, apr1count
;
1349 if (!*papr0
&& !*papr1
) {
1353 /* We can't just use the bit-twiddling hack icc_drop_prio() does
1354 * because we need to return the bit number we cleared so
1355 * it can be compared against the list register's priority field.
1357 apr0count
= ctz32(*papr0
);
1358 apr1count
= ctz32(*papr1
);
1360 if (apr0count
<= apr1count
) {
1361 *papr0
&= *papr0
- 1;
1362 return (apr0count
+ i
* 32) << (icv_min_vbpr(cs
) + 1);
1364 *papr1
&= *papr1
- 1;
1365 return (apr1count
+ i
* 32) << (icv_min_vbpr(cs
) + 1);
1371 static void icv_dir_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
1374 /* Deactivate interrupt */
1375 GICv3CPUState
*cs
= icc_cs_from_env(env
);
1377 int irq
= value
& 0xffffff;
1379 trace_gicv3_icv_dir_write(gicv3_redist_affid(cs
), value
);
1381 if (irq
>= GICV3_MAXIRQ
) {
1382 /* Also catches special interrupt numbers and LPIs */
1386 if (!icv_eoi_split(env
, cs
)) {
1390 idx
= icv_find_active(cs
, irq
);
1393 /* No list register matching this, so increment the EOI count
1394 * (might trigger a maintenance interrupt)
1396 icv_increment_eoicount(cs
);
1398 icv_deactivate_irq(cs
, idx
);
1401 gicv3_cpuif_virt_update(cs
);
1404 static void icv_eoir_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
1407 /* End of Interrupt */
1408 GICv3CPUState
*cs
= icc_cs_from_env(env
);
1409 int irq
= value
& 0xffffff;
1410 int grp
= ri
->crm
== 8 ? GICV3_G0
: GICV3_G1NS
;
1413 trace_gicv3_icv_eoir_write(ri
->crm
== 8 ? 0 : 1,
1414 gicv3_redist_affid(cs
), value
);
1416 if (gicv3_intid_is_special(irq
)) {
1420 /* We implement the IMPDEF choice of "drop priority before doing
1421 * error checks" (because that lets us avoid scanning the AP
1424 dropprio
= icv_drop_prio(cs
);
1425 if (dropprio
== 0xff) {
1426 /* No active interrupt. It is CONSTRAINED UNPREDICTABLE
1427 * whether the list registers are checked in this
1428 * situation; we choose not to.
1433 idx
= icv_find_active(cs
, irq
);
1436 /* No valid list register corresponding to EOI ID */
1437 icv_increment_eoicount(cs
);
1439 uint64_t lr
= cs
->ich_lr_el2
[idx
];
1440 int thisgrp
= (lr
& ICH_LR_EL2_GROUP
) ? GICV3_G1NS
: GICV3_G0
;
1441 int lr_gprio
= ich_lr_prio(lr
) & icv_gprio_mask(cs
, grp
);
1443 if (thisgrp
== grp
&& lr_gprio
== dropprio
) {
1444 if (!icv_eoi_split(env
, cs
)) {
1445 /* Priority drop and deactivate not split: deactivate irq now */
1446 icv_deactivate_irq(cs
, idx
);
1451 gicv3_cpuif_virt_update(cs
);
1454 static void icc_eoir_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
1457 /* End of Interrupt */
1458 GICv3CPUState
*cs
= icc_cs_from_env(env
);
1459 int irq
= value
& 0xffffff;
1461 bool is_eoir0
= ri
->crm
== 8;
1463 if (icv_access(env
, is_eoir0
? HCR_FMO
: HCR_IMO
)) {
1464 icv_eoir_write(env
, ri
, value
);
1468 trace_gicv3_icc_eoir_write(is_eoir0
? 0 : 1,
1469 gicv3_redist_affid(cs
), value
);
1471 if ((irq
>= cs
->gic
->num_irq
) &&
1472 !(cs
->gic
->lpi_enable
&& (irq
>= GICV3_LPI_INTID_START
))) {
1473 /* This handles two cases:
1474 * 1. If software writes the ID of a spurious interrupt [ie 1020-1023]
1475 * to the GICC_EOIR, the GIC ignores that write.
1476 * 2. If software writes the number of a non-existent interrupt
1477 * this must be a subcase of "value written does not match the last
1478 * valid interrupt value read from the Interrupt Acknowledge
1479 * register" and so this is UNPREDICTABLE. We choose to ignore it.
1484 grp
= icc_highest_active_group(cs
);
1490 if (!(cs
->gic
->gicd_ctlr
& GICD_CTLR_DS
)
1491 && arm_feature(env
, ARM_FEATURE_EL3
) && !arm_is_secure(env
)) {
1499 if (!arm_is_secure(env
)) {
1507 if (!arm_is_el3_or_mon(env
) && arm_is_secure(env
)) {
1512 qemu_log_mask(LOG_GUEST_ERROR
,
1513 "%s: IRQ %d isn't active\n", __func__
, irq
);
1517 icc_drop_prio(cs
, grp
);
1519 if (!icc_eoi_split(env
, cs
)) {
1520 /* Priority drop and deactivate not split: deactivate irq now */
1521 icc_deactivate_irq(cs
, irq
);
1525 static uint64_t icc_hppir0_read(CPUARMState
*env
, const ARMCPRegInfo
*ri
)
1527 GICv3CPUState
*cs
= icc_cs_from_env(env
);
1530 if (icv_access(env
, HCR_FMO
)) {
1531 return icv_hppir_read(env
, ri
);
1534 value
= icc_hppir0_value(cs
, env
);
1535 trace_gicv3_icc_hppir0_read(gicv3_redist_affid(cs
), value
);
1539 static uint64_t icc_hppir1_read(CPUARMState
*env
, const ARMCPRegInfo
*ri
)
1541 GICv3CPUState
*cs
= icc_cs_from_env(env
);
1544 if (icv_access(env
, HCR_IMO
)) {
1545 return icv_hppir_read(env
, ri
);
1548 value
= icc_hppir1_value(cs
, env
);
1549 trace_gicv3_icc_hppir1_read(gicv3_redist_affid(cs
), value
);
1553 static uint64_t icc_bpr_read(CPUARMState
*env
, const ARMCPRegInfo
*ri
)
1555 GICv3CPUState
*cs
= icc_cs_from_env(env
);
1556 int grp
= (ri
->crm
== 8) ? GICV3_G0
: GICV3_G1
;
1557 bool satinc
= false;
1560 if (icv_access(env
, grp
== GICV3_G0
? HCR_FMO
: HCR_IMO
)) {
1561 return icv_bpr_read(env
, ri
);
1564 if (grp
== GICV3_G1
&& gicv3_use_ns_bank(env
)) {
1568 if (grp
== GICV3_G1
&& !arm_is_el3_or_mon(env
) &&
1569 (cs
->icc_ctlr_el1
[GICV3_S
] & ICC_CTLR_EL1_CBPR
)) {
1570 /* CBPR_EL1S means secure EL1 or AArch32 EL3 !Mon BPR1 accesses
1576 if (grp
== GICV3_G1NS
&& arm_current_el(env
) < 3 &&
1577 (cs
->icc_ctlr_el1
[GICV3_NS
] & ICC_CTLR_EL1_CBPR
)) {
1578 /* reads return bpr0 + 1 sat to 7, writes ignored */
1583 bpr
= cs
->icc_bpr
[grp
];
1589 trace_gicv3_icc_bpr_read(ri
->crm
== 8 ? 0 : 1, gicv3_redist_affid(cs
), bpr
);
1594 static void icc_bpr_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
1597 GICv3CPUState
*cs
= icc_cs_from_env(env
);
1598 int grp
= (ri
->crm
== 8) ? GICV3_G0
: GICV3_G1
;
1601 if (icv_access(env
, grp
== GICV3_G0
? HCR_FMO
: HCR_IMO
)) {
1602 icv_bpr_write(env
, ri
, value
);
1606 trace_gicv3_icc_bpr_write(ri
->crm
== 8 ? 0 : 1,
1607 gicv3_redist_affid(cs
), value
);
1609 if (grp
== GICV3_G1
&& gicv3_use_ns_bank(env
)) {
1613 if (grp
== GICV3_G1
&& !arm_is_el3_or_mon(env
) &&
1614 (cs
->icc_ctlr_el1
[GICV3_S
] & ICC_CTLR_EL1_CBPR
)) {
1615 /* CBPR_EL1S means secure EL1 or AArch32 EL3 !Mon BPR1 accesses
1621 if (grp
== GICV3_G1NS
&& arm_current_el(env
) < 3 &&
1622 (cs
->icc_ctlr_el1
[GICV3_NS
] & ICC_CTLR_EL1_CBPR
)) {
1623 /* reads return bpr0 + 1 sat to 7, writes ignored */
1627 minval
= (grp
== GICV3_G1NS
) ? icc_min_bpr_ns(cs
) : icc_min_bpr(cs
);
1628 if (value
< minval
) {
1632 cs
->icc_bpr
[grp
] = value
& 7;
1633 gicv3_cpuif_update(cs
);
1636 static uint64_t icc_ap_read(CPUARMState
*env
, const ARMCPRegInfo
*ri
)
1638 GICv3CPUState
*cs
= icc_cs_from_env(env
);
1641 int regno
= ri
->opc2
& 3;
1642 int grp
= (ri
->crm
& 1) ? GICV3_G1
: GICV3_G0
;
1644 if (icv_access(env
, grp
== GICV3_G0
? HCR_FMO
: HCR_IMO
)) {
1645 return icv_ap_read(env
, ri
);
1648 if (grp
== GICV3_G1
&& gicv3_use_ns_bank(env
)) {
1652 value
= cs
->icc_apr
[grp
][regno
];
1654 trace_gicv3_icc_ap_read(ri
->crm
& 1, regno
, gicv3_redist_affid(cs
), value
);
1658 static void icc_ap_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
1661 GICv3CPUState
*cs
= icc_cs_from_env(env
);
1663 int regno
= ri
->opc2
& 3;
1664 int grp
= (ri
->crm
& 1) ? GICV3_G1
: GICV3_G0
;
1666 if (icv_access(env
, grp
== GICV3_G0
? HCR_FMO
: HCR_IMO
)) {
1667 icv_ap_write(env
, ri
, value
);
1671 trace_gicv3_icc_ap_write(ri
->crm
& 1, regno
, gicv3_redist_affid(cs
), value
);
1673 if (grp
== GICV3_G1
&& gicv3_use_ns_bank(env
)) {
1677 /* It's not possible to claim that a Non-secure interrupt is active
1678 * at a priority outside the Non-secure range (128..255), since this
1679 * would otherwise allow malicious NS code to block delivery of S interrupts
1680 * by writing a bad value to these registers.
1682 if (grp
== GICV3_G1NS
&& regno
< 2 && arm_feature(env
, ARM_FEATURE_EL3
)) {
1686 cs
->icc_apr
[grp
][regno
] = value
& 0xFFFFFFFFU
;
1687 gicv3_cpuif_update(cs
);
1690 static void icc_dir_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
1693 /* Deactivate interrupt */
1694 GICv3CPUState
*cs
= icc_cs_from_env(env
);
1695 int irq
= value
& 0xffffff;
1696 bool irq_is_secure
, single_sec_state
, irq_is_grp0
;
1697 bool route_fiq_to_el3
, route_irq_to_el3
, route_fiq_to_el2
, route_irq_to_el2
;
1699 if (icv_access(env
, HCR_FMO
| HCR_IMO
)) {
1700 icv_dir_write(env
, ri
, value
);
1704 trace_gicv3_icc_dir_write(gicv3_redist_affid(cs
), value
);
1706 if (irq
>= cs
->gic
->num_irq
) {
1707 /* Also catches special interrupt numbers and LPIs */
1711 if (!icc_eoi_split(env
, cs
)) {
1715 int grp
= gicv3_irq_group(cs
->gic
, cs
, irq
);
1717 single_sec_state
= cs
->gic
->gicd_ctlr
& GICD_CTLR_DS
;
1718 irq_is_secure
= !single_sec_state
&& (grp
!= GICV3_G1NS
);
1719 irq_is_grp0
= grp
== GICV3_G0
;
1721 /* Check whether we're allowed to deactivate this interrupt based
1722 * on its group and the current CPU state.
1723 * These checks are laid out to correspond to the spec's pseudocode.
1725 route_fiq_to_el3
= env
->cp15
.scr_el3
& SCR_FIQ
;
1726 route_irq_to_el3
= env
->cp15
.scr_el3
& SCR_IRQ
;
1727 /* No need to include !IsSecure in route_*_to_el2 as it's only
1728 * tested in cases where we know !IsSecure is true.
1730 uint64_t hcr_el2
= arm_hcr_el2_eff(env
);
1731 route_fiq_to_el2
= hcr_el2
& HCR_FMO
;
1732 route_irq_to_el2
= hcr_el2
& HCR_IMO
;
1734 switch (arm_current_el(env
)) {
1738 if (single_sec_state
&& irq_is_grp0
&& !route_fiq_to_el3
) {
1741 if (!irq_is_secure
&& !irq_is_grp0
&& !route_irq_to_el3
) {
1746 if (!arm_is_secure_below_el3(env
)) {
1747 if (single_sec_state
&& irq_is_grp0
&&
1748 !route_fiq_to_el3
&& !route_fiq_to_el2
) {
1751 if (!irq_is_secure
&& !irq_is_grp0
&&
1752 !route_irq_to_el3
&& !route_irq_to_el2
) {
1756 if (irq_is_grp0
&& !route_fiq_to_el3
) {
1760 (!irq_is_secure
|| !single_sec_state
) &&
1761 !route_irq_to_el3
) {
1767 g_assert_not_reached();
1770 icc_deactivate_irq(cs
, irq
);
1773 static uint64_t icc_rpr_read(CPUARMState
*env
, const ARMCPRegInfo
*ri
)
1775 GICv3CPUState
*cs
= icc_cs_from_env(env
);
1778 if (icv_access(env
, HCR_FMO
| HCR_IMO
)) {
1779 return icv_rpr_read(env
, ri
);
1782 prio
= icc_highest_active_prio(cs
);
1784 if (arm_feature(env
, ARM_FEATURE_EL3
) &&
1785 !arm_is_secure(env
) && (env
->cp15
.scr_el3
& SCR_FIQ
)) {
1786 /* NS GIC access and Group 0 is inaccessible to NS */
1787 if ((prio
& 0x80) == 0) {
1788 /* NS mustn't see priorities in the Secure half of the range */
1790 } else if (prio
!= 0xff) {
1791 /* Non-idle priority: show the Non-secure view of it */
1792 prio
= (prio
<< 1) & 0xff;
1796 trace_gicv3_icc_rpr_read(gicv3_redist_affid(cs
), prio
);
1800 static void icc_generate_sgi(CPUARMState
*env
, GICv3CPUState
*cs
,
1801 uint64_t value
, int grp
, bool ns
)
1803 GICv3State
*s
= cs
->gic
;
1805 /* Extract Aff3/Aff2/Aff1 and shift into the bottom 24 bits */
1806 uint64_t aff
= extract64(value
, 48, 8) << 16 |
1807 extract64(value
, 32, 8) << 8 |
1808 extract64(value
, 16, 8);
1809 uint32_t targetlist
= extract64(value
, 0, 16);
1810 uint32_t irq
= extract64(value
, 24, 4);
1811 bool irm
= extract64(value
, 40, 1);
1814 if (grp
== GICV3_G1
&& s
->gicd_ctlr
& GICD_CTLR_DS
) {
1815 /* If GICD_CTLR.DS == 1, the Distributor treats Secure Group 1
1816 * interrupts as Group 0 interrupts and must send Secure Group 0
1817 * interrupts to the target CPUs.
1822 trace_gicv3_icc_generate_sgi(gicv3_redist_affid(cs
), irq
, irm
,
1825 for (i
= 0; i
< s
->num_cpu
; i
++) {
1826 GICv3CPUState
*ocs
= &s
->cpu
[i
];
1829 /* IRM == 1 : route to all CPUs except self */
1834 /* IRM == 0 : route to Aff3.Aff2.Aff1.n for all n in [0..15]
1835 * where the corresponding bit is set in targetlist
1839 if (ocs
->gicr_typer
>> 40 != aff
) {
1842 aff0
= extract64(ocs
->gicr_typer
, 32, 8);
1843 if (aff0
> 15 || extract32(targetlist
, aff0
, 1) == 0) {
1848 /* The redistributor will check against its own GICR_NSACR as needed */
1849 gicv3_redist_send_sgi(ocs
, grp
, irq
, ns
);
1853 static void icc_sgi0r_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
1856 /* Generate Secure Group 0 SGI. */
1857 GICv3CPUState
*cs
= icc_cs_from_env(env
);
1858 bool ns
= !arm_is_secure(env
);
1860 icc_generate_sgi(env
, cs
, value
, GICV3_G0
, ns
);
1863 static void icc_sgi1r_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
1866 /* Generate Group 1 SGI for the current Security state */
1867 GICv3CPUState
*cs
= icc_cs_from_env(env
);
1869 bool ns
= !arm_is_secure(env
);
1871 grp
= ns
? GICV3_G1NS
: GICV3_G1
;
1872 icc_generate_sgi(env
, cs
, value
, grp
, ns
);
1875 static void icc_asgi1r_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
1878 /* Generate Group 1 SGI for the Security state that is not
1881 GICv3CPUState
*cs
= icc_cs_from_env(env
);
1883 bool ns
= !arm_is_secure(env
);
1885 grp
= ns
? GICV3_G1
: GICV3_G1NS
;
1886 icc_generate_sgi(env
, cs
, value
, grp
, ns
);
1889 static uint64_t icc_igrpen_read(CPUARMState
*env
, const ARMCPRegInfo
*ri
)
1891 GICv3CPUState
*cs
= icc_cs_from_env(env
);
1892 int grp
= ri
->opc2
& 1 ? GICV3_G1
: GICV3_G0
;
1895 if (icv_access(env
, grp
== GICV3_G0
? HCR_FMO
: HCR_IMO
)) {
1896 return icv_igrpen_read(env
, ri
);
1899 if (grp
== GICV3_G1
&& gicv3_use_ns_bank(env
)) {
1903 value
= cs
->icc_igrpen
[grp
];
1904 trace_gicv3_icc_igrpen_read(ri
->opc2
& 1 ? 1 : 0,
1905 gicv3_redist_affid(cs
), value
);
1909 static void icc_igrpen_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
1912 GICv3CPUState
*cs
= icc_cs_from_env(env
);
1913 int grp
= ri
->opc2
& 1 ? GICV3_G1
: GICV3_G0
;
1915 if (icv_access(env
, grp
== GICV3_G0
? HCR_FMO
: HCR_IMO
)) {
1916 icv_igrpen_write(env
, ri
, value
);
1920 trace_gicv3_icc_igrpen_write(ri
->opc2
& 1 ? 1 : 0,
1921 gicv3_redist_affid(cs
), value
);
1923 if (grp
== GICV3_G1
&& gicv3_use_ns_bank(env
)) {
1927 cs
->icc_igrpen
[grp
] = value
& ICC_IGRPEN_ENABLE
;
1928 gicv3_cpuif_update(cs
);
1931 static uint64_t icc_igrpen1_el3_read(CPUARMState
*env
, const ARMCPRegInfo
*ri
)
1933 GICv3CPUState
*cs
= icc_cs_from_env(env
);
1936 /* IGRPEN1_EL3 bits 0 and 1 are r/w aliases into IGRPEN1_EL1 NS and S */
1937 value
= cs
->icc_igrpen
[GICV3_G1NS
] | (cs
->icc_igrpen
[GICV3_G1
] << 1);
1938 trace_gicv3_icc_igrpen1_el3_read(gicv3_redist_affid(cs
), value
);
1942 static void icc_igrpen1_el3_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
1945 GICv3CPUState
*cs
= icc_cs_from_env(env
);
1947 trace_gicv3_icc_igrpen1_el3_write(gicv3_redist_affid(cs
), value
);
1949 /* IGRPEN1_EL3 bits 0 and 1 are r/w aliases into IGRPEN1_EL1 NS and S */
1950 cs
->icc_igrpen
[GICV3_G1NS
] = extract32(value
, 0, 1);
1951 cs
->icc_igrpen
[GICV3_G1
] = extract32(value
, 1, 1);
1952 gicv3_cpuif_update(cs
);
1955 static uint64_t icc_ctlr_el1_read(CPUARMState
*env
, const ARMCPRegInfo
*ri
)
1957 GICv3CPUState
*cs
= icc_cs_from_env(env
);
1958 int bank
= gicv3_use_ns_bank(env
) ? GICV3_NS
: GICV3_S
;
1961 if (icv_access(env
, HCR_FMO
| HCR_IMO
)) {
1962 return icv_ctlr_read(env
, ri
);
1965 value
= cs
->icc_ctlr_el1
[bank
];
1966 trace_gicv3_icc_ctlr_read(gicv3_redist_affid(cs
), value
);
1970 static void icc_ctlr_el1_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
1973 GICv3CPUState
*cs
= icc_cs_from_env(env
);
1974 int bank
= gicv3_use_ns_bank(env
) ? GICV3_NS
: GICV3_S
;
1977 if (icv_access(env
, HCR_FMO
| HCR_IMO
)) {
1978 icv_ctlr_write(env
, ri
, value
);
1982 trace_gicv3_icc_ctlr_write(gicv3_redist_affid(cs
), value
);
1984 /* Only CBPR and EOIMODE can be RW;
1985 * for us PMHE is RAZ/WI (we don't implement 1-of-N interrupts or
1986 * the asseciated priority-based routing of them);
1987 * if EL3 is implemented and GICD_CTLR.DS == 0, then PMHE and CBPR are RO.
1989 if (arm_feature(env
, ARM_FEATURE_EL3
) &&
1990 ((cs
->gic
->gicd_ctlr
& GICD_CTLR_DS
) == 0)) {
1991 mask
= ICC_CTLR_EL1_EOIMODE
;
1993 mask
= ICC_CTLR_EL1_CBPR
| ICC_CTLR_EL1_EOIMODE
;
1996 cs
->icc_ctlr_el1
[bank
] &= ~mask
;
1997 cs
->icc_ctlr_el1
[bank
] |= (value
& mask
);
1998 gicv3_cpuif_update(cs
);
2002 static uint64_t icc_ctlr_el3_read(CPUARMState
*env
, const ARMCPRegInfo
*ri
)
2004 GICv3CPUState
*cs
= icc_cs_from_env(env
);
2007 value
= cs
->icc_ctlr_el3
;
2008 if (cs
->icc_ctlr_el1
[GICV3_NS
] & ICC_CTLR_EL1_EOIMODE
) {
2009 value
|= ICC_CTLR_EL3_EOIMODE_EL1NS
;
2011 if (cs
->icc_ctlr_el1
[GICV3_NS
] & ICC_CTLR_EL1_CBPR
) {
2012 value
|= ICC_CTLR_EL3_CBPR_EL1NS
;
2014 if (cs
->icc_ctlr_el1
[GICV3_NS
] & ICC_CTLR_EL1_EOIMODE
) {
2015 value
|= ICC_CTLR_EL3_EOIMODE_EL1S
;
2017 if (cs
->icc_ctlr_el1
[GICV3_NS
] & ICC_CTLR_EL1_CBPR
) {
2018 value
|= ICC_CTLR_EL3_CBPR_EL1S
;
2021 trace_gicv3_icc_ctlr_el3_read(gicv3_redist_affid(cs
), value
);
2025 static void icc_ctlr_el3_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
2028 GICv3CPUState
*cs
= icc_cs_from_env(env
);
2031 trace_gicv3_icc_ctlr_el3_write(gicv3_redist_affid(cs
), value
);
2033 /* *_EL1NS and *_EL1S bits are aliases into the ICC_CTLR_EL1 bits. */
2034 cs
->icc_ctlr_el1
[GICV3_NS
] &= ~(ICC_CTLR_EL1_CBPR
| ICC_CTLR_EL1_EOIMODE
);
2035 if (value
& ICC_CTLR_EL3_EOIMODE_EL1NS
) {
2036 cs
->icc_ctlr_el1
[GICV3_NS
] |= ICC_CTLR_EL1_EOIMODE
;
2038 if (value
& ICC_CTLR_EL3_CBPR_EL1NS
) {
2039 cs
->icc_ctlr_el1
[GICV3_NS
] |= ICC_CTLR_EL1_CBPR
;
2042 cs
->icc_ctlr_el1
[GICV3_S
] &= ~(ICC_CTLR_EL1_CBPR
| ICC_CTLR_EL1_EOIMODE
);
2043 if (value
& ICC_CTLR_EL3_EOIMODE_EL1S
) {
2044 cs
->icc_ctlr_el1
[GICV3_S
] |= ICC_CTLR_EL1_EOIMODE
;
2046 if (value
& ICC_CTLR_EL3_CBPR_EL1S
) {
2047 cs
->icc_ctlr_el1
[GICV3_S
] |= ICC_CTLR_EL1_CBPR
;
2050 /* The only bit stored in icc_ctlr_el3 which is writable is EOIMODE_EL3: */
2051 mask
= ICC_CTLR_EL3_EOIMODE_EL3
;
2053 cs
->icc_ctlr_el3
&= ~mask
;
2054 cs
->icc_ctlr_el3
|= (value
& mask
);
2055 gicv3_cpuif_update(cs
);
2058 static CPAccessResult
gicv3_irqfiq_access(CPUARMState
*env
,
2059 const ARMCPRegInfo
*ri
, bool isread
)
2061 CPAccessResult r
= CP_ACCESS_OK
;
2062 GICv3CPUState
*cs
= icc_cs_from_env(env
);
2063 int el
= arm_current_el(env
);
2065 if ((cs
->ich_hcr_el2
& ICH_HCR_EL2_TC
) &&
2066 el
== 1 && !arm_is_secure_below_el3(env
)) {
2067 /* Takes priority over a possible EL3 trap */
2068 return CP_ACCESS_TRAP_EL2
;
2071 if ((env
->cp15
.scr_el3
& (SCR_FIQ
| SCR_IRQ
)) == (SCR_FIQ
| SCR_IRQ
)) {
2074 /* Note that arm_hcr_el2_eff takes secure state into account. */
2075 if ((arm_hcr_el2_eff(env
) & (HCR_IMO
| HCR_FMO
)) == 0) {
2076 r
= CP_ACCESS_TRAP_EL3
;
2080 r
= CP_ACCESS_TRAP_EL3
;
2083 if (!is_a64(env
) && !arm_is_el3_or_mon(env
)) {
2084 r
= CP_ACCESS_TRAP_EL3
;
2088 g_assert_not_reached();
2092 if (r
== CP_ACCESS_TRAP_EL3
&& !arm_el_is_aa64(env
, 3)) {
2098 static CPAccessResult
gicv3_dir_access(CPUARMState
*env
,
2099 const ARMCPRegInfo
*ri
, bool isread
)
2101 GICv3CPUState
*cs
= icc_cs_from_env(env
);
2103 if ((cs
->ich_hcr_el2
& ICH_HCR_EL2_TDIR
) &&
2104 arm_current_el(env
) == 1 && !arm_is_secure_below_el3(env
)) {
2105 /* Takes priority over a possible EL3 trap */
2106 return CP_ACCESS_TRAP_EL2
;
2109 return gicv3_irqfiq_access(env
, ri
, isread
);
2112 static CPAccessResult
gicv3_sgi_access(CPUARMState
*env
,
2113 const ARMCPRegInfo
*ri
, bool isread
)
2115 if (arm_current_el(env
) == 1 &&
2116 (arm_hcr_el2_eff(env
) & (HCR_IMO
| HCR_FMO
)) != 0) {
2117 /* Takes priority over a possible EL3 trap */
2118 return CP_ACCESS_TRAP_EL2
;
2121 return gicv3_irqfiq_access(env
, ri
, isread
);
2124 static CPAccessResult
gicv3_fiq_access(CPUARMState
*env
,
2125 const ARMCPRegInfo
*ri
, bool isread
)
2127 CPAccessResult r
= CP_ACCESS_OK
;
2128 GICv3CPUState
*cs
= icc_cs_from_env(env
);
2129 int el
= arm_current_el(env
);
2131 if ((cs
->ich_hcr_el2
& ICH_HCR_EL2_TALL0
) &&
2132 el
== 1 && !arm_is_secure_below_el3(env
)) {
2133 /* Takes priority over a possible EL3 trap */
2134 return CP_ACCESS_TRAP_EL2
;
2137 if (env
->cp15
.scr_el3
& SCR_FIQ
) {
2140 if ((arm_hcr_el2_eff(env
) & HCR_FMO
) == 0) {
2141 r
= CP_ACCESS_TRAP_EL3
;
2145 r
= CP_ACCESS_TRAP_EL3
;
2148 if (!is_a64(env
) && !arm_is_el3_or_mon(env
)) {
2149 r
= CP_ACCESS_TRAP_EL3
;
2153 g_assert_not_reached();
2157 if (r
== CP_ACCESS_TRAP_EL3
&& !arm_el_is_aa64(env
, 3)) {
2163 static CPAccessResult
gicv3_irq_access(CPUARMState
*env
,
2164 const ARMCPRegInfo
*ri
, bool isread
)
2166 CPAccessResult r
= CP_ACCESS_OK
;
2167 GICv3CPUState
*cs
= icc_cs_from_env(env
);
2168 int el
= arm_current_el(env
);
2170 if ((cs
->ich_hcr_el2
& ICH_HCR_EL2_TALL1
) &&
2171 el
== 1 && !arm_is_secure_below_el3(env
)) {
2172 /* Takes priority over a possible EL3 trap */
2173 return CP_ACCESS_TRAP_EL2
;
2176 if (env
->cp15
.scr_el3
& SCR_IRQ
) {
2179 if ((arm_hcr_el2_eff(env
) & HCR_IMO
) == 0) {
2180 r
= CP_ACCESS_TRAP_EL3
;
2184 r
= CP_ACCESS_TRAP_EL3
;
2187 if (!is_a64(env
) && !arm_is_el3_or_mon(env
)) {
2188 r
= CP_ACCESS_TRAP_EL3
;
2192 g_assert_not_reached();
2196 if (r
== CP_ACCESS_TRAP_EL3
&& !arm_el_is_aa64(env
, 3)) {
2202 static void icc_reset(CPUARMState
*env
, const ARMCPRegInfo
*ri
)
2204 GICv3CPUState
*cs
= icc_cs_from_env(env
);
2206 cs
->icc_ctlr_el1
[GICV3_S
] = ICC_CTLR_EL1_A3V
|
2207 (1 << ICC_CTLR_EL1_IDBITS_SHIFT
) |
2208 ((cs
->pribits
- 1) << ICC_CTLR_EL1_PRIBITS_SHIFT
);
2209 cs
->icc_ctlr_el1
[GICV3_NS
] = ICC_CTLR_EL1_A3V
|
2210 (1 << ICC_CTLR_EL1_IDBITS_SHIFT
) |
2211 ((cs
->pribits
- 1) << ICC_CTLR_EL1_PRIBITS_SHIFT
);
2212 cs
->icc_pmr_el1
= 0;
2213 cs
->icc_bpr
[GICV3_G0
] = icc_min_bpr(cs
);
2214 cs
->icc_bpr
[GICV3_G1
] = icc_min_bpr(cs
);
2215 cs
->icc_bpr
[GICV3_G1NS
] = icc_min_bpr_ns(cs
);
2216 memset(cs
->icc_apr
, 0, sizeof(cs
->icc_apr
));
2217 memset(cs
->icc_igrpen
, 0, sizeof(cs
->icc_igrpen
));
2218 cs
->icc_ctlr_el3
= ICC_CTLR_EL3_NDS
| ICC_CTLR_EL3_A3V
|
2219 (1 << ICC_CTLR_EL3_IDBITS_SHIFT
) |
2220 ((cs
->pribits
- 1) << ICC_CTLR_EL3_PRIBITS_SHIFT
);
2222 memset(cs
->ich_apr
, 0, sizeof(cs
->ich_apr
));
2223 cs
->ich_hcr_el2
= 0;
2224 memset(cs
->ich_lr_el2
, 0, sizeof(cs
->ich_lr_el2
));
2225 cs
->ich_vmcr_el2
= ICH_VMCR_EL2_VFIQEN
|
2226 ((icv_min_vbpr(cs
) + 1) << ICH_VMCR_EL2_VBPR1_SHIFT
) |
2227 (icv_min_vbpr(cs
) << ICH_VMCR_EL2_VBPR0_SHIFT
);
2230 static const ARMCPRegInfo gicv3_cpuif_reginfo
[] = {
2231 { .name
= "ICC_PMR_EL1", .state
= ARM_CP_STATE_BOTH
,
2232 .opc0
= 3, .opc1
= 0, .crn
= 4, .crm
= 6, .opc2
= 0,
2233 .type
= ARM_CP_IO
| ARM_CP_NO_RAW
,
2234 .access
= PL1_RW
, .accessfn
= gicv3_irqfiq_access
,
2235 .readfn
= icc_pmr_read
,
2236 .writefn
= icc_pmr_write
,
2237 /* We hang the whole cpu interface reset routine off here
2238 * rather than parcelling it out into one little function
2241 .resetfn
= icc_reset
,
2243 { .name
= "ICC_IAR0_EL1", .state
= ARM_CP_STATE_BOTH
,
2244 .opc0
= 3, .opc1
= 0, .crn
= 12, .crm
= 8, .opc2
= 0,
2245 .type
= ARM_CP_IO
| ARM_CP_NO_RAW
,
2246 .access
= PL1_R
, .accessfn
= gicv3_fiq_access
,
2247 .readfn
= icc_iar0_read
,
2249 { .name
= "ICC_EOIR0_EL1", .state
= ARM_CP_STATE_BOTH
,
2250 .opc0
= 3, .opc1
= 0, .crn
= 12, .crm
= 8, .opc2
= 1,
2251 .type
= ARM_CP_IO
| ARM_CP_NO_RAW
,
2252 .access
= PL1_W
, .accessfn
= gicv3_fiq_access
,
2253 .writefn
= icc_eoir_write
,
2255 { .name
= "ICC_HPPIR0_EL1", .state
= ARM_CP_STATE_BOTH
,
2256 .opc0
= 3, .opc1
= 0, .crn
= 12, .crm
= 8, .opc2
= 2,
2257 .type
= ARM_CP_IO
| ARM_CP_NO_RAW
,
2258 .access
= PL1_R
, .accessfn
= gicv3_fiq_access
,
2259 .readfn
= icc_hppir0_read
,
2261 { .name
= "ICC_BPR0_EL1", .state
= ARM_CP_STATE_BOTH
,
2262 .opc0
= 3, .opc1
= 0, .crn
= 12, .crm
= 8, .opc2
= 3,
2263 .type
= ARM_CP_IO
| ARM_CP_NO_RAW
,
2264 .access
= PL1_RW
, .accessfn
= gicv3_fiq_access
,
2265 .readfn
= icc_bpr_read
,
2266 .writefn
= icc_bpr_write
,
2268 { .name
= "ICC_AP0R0_EL1", .state
= ARM_CP_STATE_BOTH
,
2269 .opc0
= 3, .opc1
= 0, .crn
= 12, .crm
= 8, .opc2
= 4,
2270 .type
= ARM_CP_IO
| ARM_CP_NO_RAW
,
2271 .access
= PL1_RW
, .accessfn
= gicv3_fiq_access
,
2272 .readfn
= icc_ap_read
,
2273 .writefn
= icc_ap_write
,
2275 /* All the ICC_AP1R*_EL1 registers are banked */
2276 { .name
= "ICC_AP1R0_EL1", .state
= ARM_CP_STATE_BOTH
,
2277 .opc0
= 3, .opc1
= 0, .crn
= 12, .crm
= 9, .opc2
= 0,
2278 .type
= ARM_CP_IO
| ARM_CP_NO_RAW
,
2279 .access
= PL1_RW
, .accessfn
= gicv3_irq_access
,
2280 .readfn
= icc_ap_read
,
2281 .writefn
= icc_ap_write
,
2283 { .name
= "ICC_DIR_EL1", .state
= ARM_CP_STATE_BOTH
,
2284 .opc0
= 3, .opc1
= 0, .crn
= 12, .crm
= 11, .opc2
= 1,
2285 .type
= ARM_CP_IO
| ARM_CP_NO_RAW
,
2286 .access
= PL1_W
, .accessfn
= gicv3_dir_access
,
2287 .writefn
= icc_dir_write
,
2289 { .name
= "ICC_RPR_EL1", .state
= ARM_CP_STATE_BOTH
,
2290 .opc0
= 3, .opc1
= 0, .crn
= 12, .crm
= 11, .opc2
= 3,
2291 .type
= ARM_CP_IO
| ARM_CP_NO_RAW
,
2292 .access
= PL1_R
, .accessfn
= gicv3_irqfiq_access
,
2293 .readfn
= icc_rpr_read
,
2295 { .name
= "ICC_SGI1R_EL1", .state
= ARM_CP_STATE_AA64
,
2296 .opc0
= 3, .opc1
= 0, .crn
= 12, .crm
= 11, .opc2
= 5,
2297 .type
= ARM_CP_IO
| ARM_CP_NO_RAW
,
2298 .access
= PL1_W
, .accessfn
= gicv3_sgi_access
,
2299 .writefn
= icc_sgi1r_write
,
2301 { .name
= "ICC_SGI1R",
2302 .cp
= 15, .opc1
= 0, .crm
= 12,
2303 .type
= ARM_CP_64BIT
| ARM_CP_IO
| ARM_CP_NO_RAW
,
2304 .access
= PL1_W
, .accessfn
= gicv3_sgi_access
,
2305 .writefn
= icc_sgi1r_write
,
2307 { .name
= "ICC_ASGI1R_EL1", .state
= ARM_CP_STATE_AA64
,
2308 .opc0
= 3, .opc1
= 0, .crn
= 12, .crm
= 11, .opc2
= 6,
2309 .type
= ARM_CP_IO
| ARM_CP_NO_RAW
,
2310 .access
= PL1_W
, .accessfn
= gicv3_sgi_access
,
2311 .writefn
= icc_asgi1r_write
,
2313 { .name
= "ICC_ASGI1R",
2314 .cp
= 15, .opc1
= 1, .crm
= 12,
2315 .type
= ARM_CP_64BIT
| ARM_CP_IO
| ARM_CP_NO_RAW
,
2316 .access
= PL1_W
, .accessfn
= gicv3_sgi_access
,
2317 .writefn
= icc_asgi1r_write
,
2319 { .name
= "ICC_SGI0R_EL1", .state
= ARM_CP_STATE_AA64
,
2320 .opc0
= 3, .opc1
= 0, .crn
= 12, .crm
= 11, .opc2
= 7,
2321 .type
= ARM_CP_IO
| ARM_CP_NO_RAW
,
2322 .access
= PL1_W
, .accessfn
= gicv3_sgi_access
,
2323 .writefn
= icc_sgi0r_write
,
2325 { .name
= "ICC_SGI0R",
2326 .cp
= 15, .opc1
= 2, .crm
= 12,
2327 .type
= ARM_CP_64BIT
| ARM_CP_IO
| ARM_CP_NO_RAW
,
2328 .access
= PL1_W
, .accessfn
= gicv3_sgi_access
,
2329 .writefn
= icc_sgi0r_write
,
2331 { .name
= "ICC_IAR1_EL1", .state
= ARM_CP_STATE_BOTH
,
2332 .opc0
= 3, .opc1
= 0, .crn
= 12, .crm
= 12, .opc2
= 0,
2333 .type
= ARM_CP_IO
| ARM_CP_NO_RAW
,
2334 .access
= PL1_R
, .accessfn
= gicv3_irq_access
,
2335 .readfn
= icc_iar1_read
,
2337 { .name
= "ICC_EOIR1_EL1", .state
= ARM_CP_STATE_BOTH
,
2338 .opc0
= 3, .opc1
= 0, .crn
= 12, .crm
= 12, .opc2
= 1,
2339 .type
= ARM_CP_IO
| ARM_CP_NO_RAW
,
2340 .access
= PL1_W
, .accessfn
= gicv3_irq_access
,
2341 .writefn
= icc_eoir_write
,
2343 { .name
= "ICC_HPPIR1_EL1", .state
= ARM_CP_STATE_BOTH
,
2344 .opc0
= 3, .opc1
= 0, .crn
= 12, .crm
= 12, .opc2
= 2,
2345 .type
= ARM_CP_IO
| ARM_CP_NO_RAW
,
2346 .access
= PL1_R
, .accessfn
= gicv3_irq_access
,
2347 .readfn
= icc_hppir1_read
,
2349 /* This register is banked */
2350 { .name
= "ICC_BPR1_EL1", .state
= ARM_CP_STATE_BOTH
,
2351 .opc0
= 3, .opc1
= 0, .crn
= 12, .crm
= 12, .opc2
= 3,
2352 .type
= ARM_CP_IO
| ARM_CP_NO_RAW
,
2353 .access
= PL1_RW
, .accessfn
= gicv3_irq_access
,
2354 .readfn
= icc_bpr_read
,
2355 .writefn
= icc_bpr_write
,
2357 /* This register is banked */
2358 { .name
= "ICC_CTLR_EL1", .state
= ARM_CP_STATE_BOTH
,
2359 .opc0
= 3, .opc1
= 0, .crn
= 12, .crm
= 12, .opc2
= 4,
2360 .type
= ARM_CP_IO
| ARM_CP_NO_RAW
,
2361 .access
= PL1_RW
, .accessfn
= gicv3_irqfiq_access
,
2362 .readfn
= icc_ctlr_el1_read
,
2363 .writefn
= icc_ctlr_el1_write
,
2365 { .name
= "ICC_SRE_EL1", .state
= ARM_CP_STATE_BOTH
,
2366 .opc0
= 3, .opc1
= 0, .crn
= 12, .crm
= 12, .opc2
= 5,
2367 .type
= ARM_CP_NO_RAW
| ARM_CP_CONST
,
2369 /* We don't support IRQ/FIQ bypass and system registers are
2370 * always enabled, so all our bits are RAZ/WI or RAO/WI.
2371 * This register is banked but since it's constant we don't
2372 * need to do anything special.
2376 { .name
= "ICC_IGRPEN0_EL1", .state
= ARM_CP_STATE_BOTH
,
2377 .opc0
= 3, .opc1
= 0, .crn
= 12, .crm
= 12, .opc2
= 6,
2378 .type
= ARM_CP_IO
| ARM_CP_NO_RAW
,
2379 .access
= PL1_RW
, .accessfn
= gicv3_fiq_access
,
2380 .readfn
= icc_igrpen_read
,
2381 .writefn
= icc_igrpen_write
,
2383 /* This register is banked */
2384 { .name
= "ICC_IGRPEN1_EL1", .state
= ARM_CP_STATE_BOTH
,
2385 .opc0
= 3, .opc1
= 0, .crn
= 12, .crm
= 12, .opc2
= 7,
2386 .type
= ARM_CP_IO
| ARM_CP_NO_RAW
,
2387 .access
= PL1_RW
, .accessfn
= gicv3_irq_access
,
2388 .readfn
= icc_igrpen_read
,
2389 .writefn
= icc_igrpen_write
,
2391 { .name
= "ICC_SRE_EL2", .state
= ARM_CP_STATE_BOTH
,
2392 .opc0
= 3, .opc1
= 4, .crn
= 12, .crm
= 9, .opc2
= 5,
2393 .type
= ARM_CP_NO_RAW
| ARM_CP_CONST
,
2395 /* We don't support IRQ/FIQ bypass and system registers are
2396 * always enabled, so all our bits are RAZ/WI or RAO/WI.
2400 { .name
= "ICC_CTLR_EL3", .state
= ARM_CP_STATE_BOTH
,
2401 .opc0
= 3, .opc1
= 6, .crn
= 12, .crm
= 12, .opc2
= 4,
2402 .type
= ARM_CP_IO
| ARM_CP_NO_RAW
,
2404 .readfn
= icc_ctlr_el3_read
,
2405 .writefn
= icc_ctlr_el3_write
,
2407 { .name
= "ICC_SRE_EL3", .state
= ARM_CP_STATE_BOTH
,
2408 .opc0
= 3, .opc1
= 6, .crn
= 12, .crm
= 12, .opc2
= 5,
2409 .type
= ARM_CP_NO_RAW
| ARM_CP_CONST
,
2411 /* We don't support IRQ/FIQ bypass and system registers are
2412 * always enabled, so all our bits are RAZ/WI or RAO/WI.
2416 { .name
= "ICC_IGRPEN1_EL3", .state
= ARM_CP_STATE_BOTH
,
2417 .opc0
= 3, .opc1
= 6, .crn
= 12, .crm
= 12, .opc2
= 7,
2418 .type
= ARM_CP_IO
| ARM_CP_NO_RAW
,
2420 .readfn
= icc_igrpen1_el3_read
,
2421 .writefn
= icc_igrpen1_el3_write
,
2425 static const ARMCPRegInfo gicv3_cpuif_icc_apxr1_reginfo
[] = {
2426 { .name
= "ICC_AP0R1_EL1", .state
= ARM_CP_STATE_BOTH
,
2427 .opc0
= 3, .opc1
= 0, .crn
= 12, .crm
= 8, .opc2
= 5,
2428 .type
= ARM_CP_IO
| ARM_CP_NO_RAW
,
2429 .access
= PL1_RW
, .accessfn
= gicv3_fiq_access
,
2430 .readfn
= icc_ap_read
,
2431 .writefn
= icc_ap_write
,
2433 { .name
= "ICC_AP1R1_EL1", .state
= ARM_CP_STATE_BOTH
,
2434 .opc0
= 3, .opc1
= 0, .crn
= 12, .crm
= 9, .opc2
= 1,
2435 .type
= ARM_CP_IO
| ARM_CP_NO_RAW
,
2436 .access
= PL1_RW
, .accessfn
= gicv3_irq_access
,
2437 .readfn
= icc_ap_read
,
2438 .writefn
= icc_ap_write
,
2442 static const ARMCPRegInfo gicv3_cpuif_icc_apxr23_reginfo
[] = {
2443 { .name
= "ICC_AP0R2_EL1", .state
= ARM_CP_STATE_BOTH
,
2444 .opc0
= 3, .opc1
= 0, .crn
= 12, .crm
= 8, .opc2
= 6,
2445 .type
= ARM_CP_IO
| ARM_CP_NO_RAW
,
2446 .access
= PL1_RW
, .accessfn
= gicv3_fiq_access
,
2447 .readfn
= icc_ap_read
,
2448 .writefn
= icc_ap_write
,
2450 { .name
= "ICC_AP0R3_EL1", .state
= ARM_CP_STATE_BOTH
,
2451 .opc0
= 3, .opc1
= 0, .crn
= 12, .crm
= 8, .opc2
= 7,
2452 .type
= ARM_CP_IO
| ARM_CP_NO_RAW
,
2453 .access
= PL1_RW
, .accessfn
= gicv3_fiq_access
,
2454 .readfn
= icc_ap_read
,
2455 .writefn
= icc_ap_write
,
2457 { .name
= "ICC_AP1R2_EL1", .state
= ARM_CP_STATE_BOTH
,
2458 .opc0
= 3, .opc1
= 0, .crn
= 12, .crm
= 9, .opc2
= 2,
2459 .type
= ARM_CP_IO
| ARM_CP_NO_RAW
,
2460 .access
= PL1_RW
, .accessfn
= gicv3_irq_access
,
2461 .readfn
= icc_ap_read
,
2462 .writefn
= icc_ap_write
,
2464 { .name
= "ICC_AP1R3_EL1", .state
= ARM_CP_STATE_BOTH
,
2465 .opc0
= 3, .opc1
= 0, .crn
= 12, .crm
= 9, .opc2
= 3,
2466 .type
= ARM_CP_IO
| ARM_CP_NO_RAW
,
2467 .access
= PL1_RW
, .accessfn
= gicv3_irq_access
,
2468 .readfn
= icc_ap_read
,
2469 .writefn
= icc_ap_write
,
2473 static uint64_t ich_ap_read(CPUARMState
*env
, const ARMCPRegInfo
*ri
)
2475 GICv3CPUState
*cs
= icc_cs_from_env(env
);
2476 int regno
= ri
->opc2
& 3;
2477 int grp
= (ri
->crm
& 1) ? GICV3_G1NS
: GICV3_G0
;
2480 value
= cs
->ich_apr
[grp
][regno
];
2481 trace_gicv3_ich_ap_read(ri
->crm
& 1, regno
, gicv3_redist_affid(cs
), value
);
2485 static void ich_ap_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
2488 GICv3CPUState
*cs
= icc_cs_from_env(env
);
2489 int regno
= ri
->opc2
& 3;
2490 int grp
= (ri
->crm
& 1) ? GICV3_G1NS
: GICV3_G0
;
2492 trace_gicv3_ich_ap_write(ri
->crm
& 1, regno
, gicv3_redist_affid(cs
), value
);
2494 cs
->ich_apr
[grp
][regno
] = value
& 0xFFFFFFFFU
;
2495 gicv3_cpuif_virt_irq_fiq_update(cs
);
2498 static uint64_t ich_hcr_read(CPUARMState
*env
, const ARMCPRegInfo
*ri
)
2500 GICv3CPUState
*cs
= icc_cs_from_env(env
);
2501 uint64_t value
= cs
->ich_hcr_el2
;
2503 trace_gicv3_ich_hcr_read(gicv3_redist_affid(cs
), value
);
2507 static void ich_hcr_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
2510 GICv3CPUState
*cs
= icc_cs_from_env(env
);
2512 trace_gicv3_ich_hcr_write(gicv3_redist_affid(cs
), value
);
2514 value
&= ICH_HCR_EL2_EN
| ICH_HCR_EL2_UIE
| ICH_HCR_EL2_LRENPIE
|
2515 ICH_HCR_EL2_NPIE
| ICH_HCR_EL2_VGRP0EIE
| ICH_HCR_EL2_VGRP0DIE
|
2516 ICH_HCR_EL2_VGRP1EIE
| ICH_HCR_EL2_VGRP1DIE
| ICH_HCR_EL2_TC
|
2517 ICH_HCR_EL2_TALL0
| ICH_HCR_EL2_TALL1
| ICH_HCR_EL2_TSEI
|
2518 ICH_HCR_EL2_TDIR
| ICH_HCR_EL2_EOICOUNT_MASK
;
2520 cs
->ich_hcr_el2
= value
;
2521 gicv3_cpuif_virt_update(cs
);
2524 static uint64_t ich_vmcr_read(CPUARMState
*env
, const ARMCPRegInfo
*ri
)
2526 GICv3CPUState
*cs
= icc_cs_from_env(env
);
2527 uint64_t value
= cs
->ich_vmcr_el2
;
2529 trace_gicv3_ich_vmcr_read(gicv3_redist_affid(cs
), value
);
2533 static void ich_vmcr_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
2536 GICv3CPUState
*cs
= icc_cs_from_env(env
);
2538 trace_gicv3_ich_vmcr_write(gicv3_redist_affid(cs
), value
);
2540 value
&= ICH_VMCR_EL2_VENG0
| ICH_VMCR_EL2_VENG1
| ICH_VMCR_EL2_VCBPR
|
2541 ICH_VMCR_EL2_VEOIM
| ICH_VMCR_EL2_VBPR1_MASK
|
2542 ICH_VMCR_EL2_VBPR0_MASK
| ICH_VMCR_EL2_VPMR_MASK
;
2543 value
|= ICH_VMCR_EL2_VFIQEN
;
2545 cs
->ich_vmcr_el2
= value
;
2546 /* Enforce "writing BPRs to less than minimum sets them to the minimum"
2547 * by reading and writing back the fields.
2549 write_vbpr(cs
, GICV3_G0
, read_vbpr(cs
, GICV3_G0
));
2550 write_vbpr(cs
, GICV3_G1
, read_vbpr(cs
, GICV3_G1
));
2552 gicv3_cpuif_virt_update(cs
);
2555 static uint64_t ich_lr_read(CPUARMState
*env
, const ARMCPRegInfo
*ri
)
2557 GICv3CPUState
*cs
= icc_cs_from_env(env
);
2558 int regno
= ri
->opc2
| ((ri
->crm
& 1) << 3);
2561 /* This read function handles all of:
2562 * 64-bit reads of the whole LR
2563 * 32-bit reads of the low half of the LR
2564 * 32-bit reads of the high half of the LR
2566 if (ri
->state
== ARM_CP_STATE_AA32
) {
2567 if (ri
->crm
>= 14) {
2568 value
= extract64(cs
->ich_lr_el2
[regno
], 32, 32);
2569 trace_gicv3_ich_lrc_read(regno
, gicv3_redist_affid(cs
), value
);
2571 value
= extract64(cs
->ich_lr_el2
[regno
], 0, 32);
2572 trace_gicv3_ich_lr32_read(regno
, gicv3_redist_affid(cs
), value
);
2575 value
= cs
->ich_lr_el2
[regno
];
2576 trace_gicv3_ich_lr_read(regno
, gicv3_redist_affid(cs
), value
);
2582 static void ich_lr_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
2585 GICv3CPUState
*cs
= icc_cs_from_env(env
);
2586 int regno
= ri
->opc2
| ((ri
->crm
& 1) << 3);
2588 /* This write function handles all of:
2589 * 64-bit writes to the whole LR
2590 * 32-bit writes to the low half of the LR
2591 * 32-bit writes to the high half of the LR
2593 if (ri
->state
== ARM_CP_STATE_AA32
) {
2594 if (ri
->crm
>= 14) {
2595 trace_gicv3_ich_lrc_write(regno
, gicv3_redist_affid(cs
), value
);
2596 value
= deposit64(cs
->ich_lr_el2
[regno
], 32, 32, value
);
2598 trace_gicv3_ich_lr32_write(regno
, gicv3_redist_affid(cs
), value
);
2599 value
= deposit64(cs
->ich_lr_el2
[regno
], 0, 32, value
);
2602 trace_gicv3_ich_lr_write(regno
, gicv3_redist_affid(cs
), value
);
2605 /* Enforce RES0 bits in priority field */
2606 if (cs
->vpribits
< 8) {
2607 value
= deposit64(value
, ICH_LR_EL2_PRIORITY_SHIFT
,
2608 8 - cs
->vpribits
, 0);
2611 cs
->ich_lr_el2
[regno
] = value
;
2612 gicv3_cpuif_virt_update(cs
);
2615 static uint64_t ich_vtr_read(CPUARMState
*env
, const ARMCPRegInfo
*ri
)
2617 GICv3CPUState
*cs
= icc_cs_from_env(env
);
2620 value
= ((cs
->num_list_regs
- 1) << ICH_VTR_EL2_LISTREGS_SHIFT
)
2621 | ICH_VTR_EL2_TDS
| ICH_VTR_EL2_A3V
2622 | (1 << ICH_VTR_EL2_IDBITS_SHIFT
)
2623 | ((cs
->vprebits
- 1) << ICH_VTR_EL2_PREBITS_SHIFT
)
2624 | ((cs
->vpribits
- 1) << ICH_VTR_EL2_PRIBITS_SHIFT
);
2626 if (cs
->gic
->revision
< 4) {
2627 value
|= ICH_VTR_EL2_NV4
;
2630 trace_gicv3_ich_vtr_read(gicv3_redist_affid(cs
), value
);
2634 static uint64_t ich_misr_read(CPUARMState
*env
, const ARMCPRegInfo
*ri
)
2636 GICv3CPUState
*cs
= icc_cs_from_env(env
);
2637 uint64_t value
= maintenance_interrupt_state(cs
);
2639 trace_gicv3_ich_misr_read(gicv3_redist_affid(cs
), value
);
2643 static uint64_t ich_eisr_read(CPUARMState
*env
, const ARMCPRegInfo
*ri
)
2645 GICv3CPUState
*cs
= icc_cs_from_env(env
);
2646 uint64_t value
= eoi_maintenance_interrupt_state(cs
, NULL
);
2648 trace_gicv3_ich_eisr_read(gicv3_redist_affid(cs
), value
);
2652 static uint64_t ich_elrsr_read(CPUARMState
*env
, const ARMCPRegInfo
*ri
)
2654 GICv3CPUState
*cs
= icc_cs_from_env(env
);
2658 for (i
= 0; i
< cs
->num_list_regs
; i
++) {
2659 uint64_t lr
= cs
->ich_lr_el2
[i
];
2661 if ((lr
& ICH_LR_EL2_STATE_MASK
) == 0 &&
2662 ((lr
& ICH_LR_EL2_HW
) != 0 || (lr
& ICH_LR_EL2_EOI
) == 0)) {
2667 trace_gicv3_ich_elrsr_read(gicv3_redist_affid(cs
), value
);
2671 static const ARMCPRegInfo gicv3_cpuif_hcr_reginfo
[] = {
2672 { .name
= "ICH_AP0R0_EL2", .state
= ARM_CP_STATE_BOTH
,
2673 .opc0
= 3, .opc1
= 4, .crn
= 12, .crm
= 8, .opc2
= 0,
2674 .type
= ARM_CP_IO
| ARM_CP_NO_RAW
,
2676 .readfn
= ich_ap_read
,
2677 .writefn
= ich_ap_write
,
2679 { .name
= "ICH_AP1R0_EL2", .state
= ARM_CP_STATE_BOTH
,
2680 .opc0
= 3, .opc1
= 4, .crn
= 12, .crm
= 9, .opc2
= 0,
2681 .type
= ARM_CP_IO
| ARM_CP_NO_RAW
,
2683 .readfn
= ich_ap_read
,
2684 .writefn
= ich_ap_write
,
2686 { .name
= "ICH_HCR_EL2", .state
= ARM_CP_STATE_BOTH
,
2687 .opc0
= 3, .opc1
= 4, .crn
= 12, .crm
= 11, .opc2
= 0,
2688 .type
= ARM_CP_IO
| ARM_CP_NO_RAW
,
2690 .readfn
= ich_hcr_read
,
2691 .writefn
= ich_hcr_write
,
2693 { .name
= "ICH_VTR_EL2", .state
= ARM_CP_STATE_BOTH
,
2694 .opc0
= 3, .opc1
= 4, .crn
= 12, .crm
= 11, .opc2
= 1,
2695 .type
= ARM_CP_IO
| ARM_CP_NO_RAW
,
2697 .readfn
= ich_vtr_read
,
2699 { .name
= "ICH_MISR_EL2", .state
= ARM_CP_STATE_BOTH
,
2700 .opc0
= 3, .opc1
= 4, .crn
= 12, .crm
= 11, .opc2
= 2,
2701 .type
= ARM_CP_IO
| ARM_CP_NO_RAW
,
2703 .readfn
= ich_misr_read
,
2705 { .name
= "ICH_EISR_EL2", .state
= ARM_CP_STATE_BOTH
,
2706 .opc0
= 3, .opc1
= 4, .crn
= 12, .crm
= 11, .opc2
= 3,
2707 .type
= ARM_CP_IO
| ARM_CP_NO_RAW
,
2709 .readfn
= ich_eisr_read
,
2711 { .name
= "ICH_ELRSR_EL2", .state
= ARM_CP_STATE_BOTH
,
2712 .opc0
= 3, .opc1
= 4, .crn
= 12, .crm
= 11, .opc2
= 5,
2713 .type
= ARM_CP_IO
| ARM_CP_NO_RAW
,
2715 .readfn
= ich_elrsr_read
,
2717 { .name
= "ICH_VMCR_EL2", .state
= ARM_CP_STATE_BOTH
,
2718 .opc0
= 3, .opc1
= 4, .crn
= 12, .crm
= 11, .opc2
= 7,
2719 .type
= ARM_CP_IO
| ARM_CP_NO_RAW
,
2721 .readfn
= ich_vmcr_read
,
2722 .writefn
= ich_vmcr_write
,
2726 static const ARMCPRegInfo gicv3_cpuif_ich_apxr1_reginfo
[] = {
2727 { .name
= "ICH_AP0R1_EL2", .state
= ARM_CP_STATE_BOTH
,
2728 .opc0
= 3, .opc1
= 4, .crn
= 12, .crm
= 8, .opc2
= 1,
2729 .type
= ARM_CP_IO
| ARM_CP_NO_RAW
,
2731 .readfn
= ich_ap_read
,
2732 .writefn
= ich_ap_write
,
2734 { .name
= "ICH_AP1R1_EL2", .state
= ARM_CP_STATE_BOTH
,
2735 .opc0
= 3, .opc1
= 4, .crn
= 12, .crm
= 9, .opc2
= 1,
2736 .type
= ARM_CP_IO
| ARM_CP_NO_RAW
,
2738 .readfn
= ich_ap_read
,
2739 .writefn
= ich_ap_write
,
2743 static const ARMCPRegInfo gicv3_cpuif_ich_apxr23_reginfo
[] = {
2744 { .name
= "ICH_AP0R2_EL2", .state
= ARM_CP_STATE_BOTH
,
2745 .opc0
= 3, .opc1
= 4, .crn
= 12, .crm
= 8, .opc2
= 2,
2746 .type
= ARM_CP_IO
| ARM_CP_NO_RAW
,
2748 .readfn
= ich_ap_read
,
2749 .writefn
= ich_ap_write
,
2751 { .name
= "ICH_AP0R3_EL2", .state
= ARM_CP_STATE_BOTH
,
2752 .opc0
= 3, .opc1
= 4, .crn
= 12, .crm
= 8, .opc2
= 3,
2753 .type
= ARM_CP_IO
| ARM_CP_NO_RAW
,
2755 .readfn
= ich_ap_read
,
2756 .writefn
= ich_ap_write
,
2758 { .name
= "ICH_AP1R2_EL2", .state
= ARM_CP_STATE_BOTH
,
2759 .opc0
= 3, .opc1
= 4, .crn
= 12, .crm
= 9, .opc2
= 2,
2760 .type
= ARM_CP_IO
| ARM_CP_NO_RAW
,
2762 .readfn
= ich_ap_read
,
2763 .writefn
= ich_ap_write
,
2765 { .name
= "ICH_AP1R3_EL2", .state
= ARM_CP_STATE_BOTH
,
2766 .opc0
= 3, .opc1
= 4, .crn
= 12, .crm
= 9, .opc2
= 3,
2767 .type
= ARM_CP_IO
| ARM_CP_NO_RAW
,
2769 .readfn
= ich_ap_read
,
2770 .writefn
= ich_ap_write
,
2774 static void gicv3_cpuif_el_change_hook(ARMCPU
*cpu
, void *opaque
)
2776 GICv3CPUState
*cs
= opaque
;
2778 gicv3_cpuif_update(cs
);
2780 * Because vLPIs are only pending in NonSecure state,
2781 * an EL change can change the VIRQ/VFIQ status (but
2782 * cannot affect the maintenance interrupt state)
2784 gicv3_cpuif_virt_irq_fiq_update(cs
);
2787 void gicv3_init_cpuif(GICv3State
*s
)
2789 /* Called from the GICv3 realize function; register our system
2790 * registers with the CPU
2794 for (i
= 0; i
< s
->num_cpu
; i
++) {
2795 ARMCPU
*cpu
= ARM_CPU(qemu_get_cpu(i
));
2796 GICv3CPUState
*cs
= &s
->cpu
[i
];
2799 * If the CPU doesn't define a GICv3 configuration, probably because
2800 * in real hardware it doesn't have one, then we use default values
2801 * matching the one used by most Arm CPUs. This applies to:
2808 /* Note that we can't just use the GICv3CPUState as an opaque pointer
2809 * in define_arm_cp_regs_with_opaque(), because when we're called back
2810 * it might be with code translated by CPU 0 but run by CPU 1, in
2811 * which case we'd get the wrong value.
2812 * So instead we define the regs with no ri->opaque info, and
2813 * get back to the GICv3CPUState from the CPUARMState.
2815 define_arm_cp_regs(cpu
, gicv3_cpuif_reginfo
);
2818 * The CPU implementation specifies the number of supported
2819 * bits of physical priority. For backwards compatibility
2820 * of migration, we have a compat property that forces use
2821 * of 8 priority bits regardless of what the CPU really has.
2823 if (s
->force_8bit_prio
) {
2826 cs
->pribits
= cpu
->gic_pribits
?: 5;
2830 * The GICv3 has separate ID register fields for virtual priority
2831 * and preemption bit values, but only a single ID register field
2832 * for the physical priority bits. The preemption bit count is
2833 * always the same as the priority bit count, except that 8 bits
2834 * of priority means 7 preemption bits. We precalculate the
2835 * preemption bits because it simplifies the code and makes the
2836 * parallels between the virtual and physical bits of the GIC
2839 cs
->prebits
= cs
->pribits
;
2840 if (cs
->prebits
== 8) {
2844 * Check that CPU code defining pribits didn't violate
2845 * architectural constraints our implementation relies on.
2847 g_assert(cs
->pribits
>= 4 && cs
->pribits
<= 8);
2850 * gicv3_cpuif_reginfo[] defines ICC_AP*R0_EL1; add definitions
2851 * for ICC_AP*R{1,2,3}_EL1 if the prebits value requires them.
2853 if (cs
->prebits
>= 6) {
2854 define_arm_cp_regs(cpu
, gicv3_cpuif_icc_apxr1_reginfo
);
2856 if (cs
->prebits
== 7) {
2857 define_arm_cp_regs(cpu
, gicv3_cpuif_icc_apxr23_reginfo
);
2860 if (arm_feature(&cpu
->env
, ARM_FEATURE_EL2
)) {
2863 cs
->num_list_regs
= cpu
->gic_num_lrs
?: 4;
2864 cs
->vpribits
= cpu
->gic_vpribits
?: 5;
2865 cs
->vprebits
= cpu
->gic_vprebits
?: 5;
2867 /* Check against architectural constraints: getting these
2868 * wrong would be a bug in the CPU code defining these,
2869 * and the implementation relies on them holding.
2871 g_assert(cs
->vprebits
<= cs
->vpribits
);
2872 g_assert(cs
->vprebits
>= 5 && cs
->vprebits
<= 7);
2873 g_assert(cs
->vpribits
>= 5 && cs
->vpribits
<= 8);
2875 define_arm_cp_regs(cpu
, gicv3_cpuif_hcr_reginfo
);
2877 for (j
= 0; j
< cs
->num_list_regs
; j
++) {
2878 /* Note that the AArch64 LRs are 64-bit; the AArch32 LRs
2879 * are split into two cp15 regs, LR (the low part, with the
2880 * same encoding as the AArch64 LR) and LRC (the high part).
2882 ARMCPRegInfo lr_regset
[] = {
2883 { .name
= "ICH_LRn_EL2", .state
= ARM_CP_STATE_BOTH
,
2884 .opc0
= 3, .opc1
= 4, .crn
= 12,
2885 .crm
= 12 + (j
>> 3), .opc2
= j
& 7,
2886 .type
= ARM_CP_IO
| ARM_CP_NO_RAW
,
2888 .readfn
= ich_lr_read
,
2889 .writefn
= ich_lr_write
,
2891 { .name
= "ICH_LRCn_EL2", .state
= ARM_CP_STATE_AA32
,
2892 .cp
= 15, .opc1
= 4, .crn
= 12,
2893 .crm
= 14 + (j
>> 3), .opc2
= j
& 7,
2894 .type
= ARM_CP_IO
| ARM_CP_NO_RAW
,
2896 .readfn
= ich_lr_read
,
2897 .writefn
= ich_lr_write
,
2900 define_arm_cp_regs(cpu
, lr_regset
);
2902 if (cs
->vprebits
>= 6) {
2903 define_arm_cp_regs(cpu
, gicv3_cpuif_ich_apxr1_reginfo
);
2905 if (cs
->vprebits
== 7) {
2906 define_arm_cp_regs(cpu
, gicv3_cpuif_ich_apxr23_reginfo
);
2909 arm_register_el_change_hook(cpu
, gicv3_cpuif_el_change_hook
, cs
);