aboutsummaryrefslogtreecommitdiff
path: root/hw
diff options
context:
space:
mode:
authorPeter Maydell <peter.maydell@linaro.org>2016-06-17 16:16:37 +0100
committerPeter Maydell <peter.maydell@linaro.org>2016-06-17 16:16:37 +0100
commit482b61844ae7c6df39df0b48ac90ffbc87bed7d2 (patch)
treef3344170f132d6c8f01e4693496a37827b654c15 /hw
parentda838dfc40cb7e12e2ae7b33236e426e029fed15 (diff)
parentf06765a94a31bdd8b65fc83fd91a6c3f8e8a1195 (diff)
Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20160617' into staging
target-arm queue: * GICv3 emulation # gpg: Signature made Fri 17 Jun 2016 15:24:28 BST # gpg: using RSA key 0x3C2525ED14360CDE # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" # gpg: aka "Peter Maydell <pmaydell@gmail.com>" # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * remotes/pmaydell/tags/pull-target-arm-20160617: (22 commits) ACPI: ARM: Present GIC version in MADT table hw/timer: Add value matching support to aspeed_timer target-arm/monitor.c: Advertise emulated GICv3 in capabilities target-arm/machine.c: Allow user to request GICv3 emulation hw/intc/arm_gicv3: Add IRQ handling CPU interface registers hw/intc/arm_gicv3: Implement CPU i/f SGI generation registers hw/intc/arm_gicv3: Implement gicv3_cpuif_update() hw/intc/arm_gicv3: Implement GICv3 CPU interface registers hw/intc/arm_gicv3: Implement gicv3_set_irq() hw/intc/arm_gicv3: Wire up distributor and redistributor MMIO regions hw/intc/arm_gicv3: Implement GICv3 redistributor registers hw/intc/arm_gicv3: Implement GICv3 distributor registers hw/intc/arm_gicv3: Implement functions to identify next pending irq hw/intc/arm_gicv3: ARM GICv3 device framework hw/intc/arm_gicv3: Add vmstate descriptors hw/intc/arm_gicv3: Move irq lines into GICv3CPUState structure hw/intc/arm_gicv3: Add state information target-arm: Add mp-affinity property for ARM CPU class target-arm: Provide hook to tell GICv3 about changes of security state target-arm: Define new arm_is_el3_or_mon() function ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Diffstat (limited to 'hw')
-rw-r--r--hw/arm/virt-acpi-build.c1
-rw-r--r--hw/intc/Makefile.objs4
-rw-r--r--hw/intc/arm_gicv3.c400
-rw-r--r--hw/intc/arm_gicv3_common.c225
-rw-r--r--hw/intc/arm_gicv3_cpuif.c1346
-rw-r--r--hw/intc/arm_gicv3_dist.c879
-rw-r--r--hw/intc/arm_gicv3_kvm.c8
-rw-r--r--hw/intc/arm_gicv3_redist.c562
-rw-r--r--hw/intc/gicv3_internal.h331
-rw-r--r--hw/timer/aspeed_timer.c138
10 files changed, 3849 insertions, 45 deletions
diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c
index 1fa0581e33..28fc59c665 100644
--- a/hw/arm/virt-acpi-build.c
+++ b/hw/arm/virt-acpi-build.c
@@ -523,6 +523,7 @@ build_madt(GArray *table_data, BIOSLinker *linker, VirtGuestInfo *guest_info)
gicd->type = ACPI_APIC_GENERIC_DISTRIBUTOR;
gicd->length = sizeof(*gicd);
gicd->base_address = memmap[VIRT_GIC_DIST].base;
+ gicd->version = guest_info->gic_version;
for (i = 0; i < guest_info->smp_cpus; i++) {
AcpiMadtGenericInterrupt *gicc = acpi_data_push(table_data,
diff --git a/hw/intc/Makefile.objs b/hw/intc/Makefile.objs
index 0e47f0f9ec..c7bbf88edf 100644
--- a/hw/intc/Makefile.objs
+++ b/hw/intc/Makefile.objs
@@ -13,6 +13,9 @@ common-obj-$(CONFIG_ARM_GIC) += arm_gic_common.o
common-obj-$(CONFIG_ARM_GIC) += arm_gic.o
common-obj-$(CONFIG_ARM_GIC) += arm_gicv2m.o
common-obj-$(CONFIG_ARM_GIC) += arm_gicv3_common.o
+common-obj-$(CONFIG_ARM_GIC) += arm_gicv3.o
+common-obj-$(CONFIG_ARM_GIC) += arm_gicv3_dist.o
+common-obj-$(CONFIG_ARM_GIC) += arm_gicv3_redist.o
common-obj-$(CONFIG_OPENPIC) += openpic.o
obj-$(CONFIG_APIC) += apic.o apic_common.o
@@ -32,3 +35,4 @@ obj-$(CONFIG_ALLWINNER_A10_PIC) += allwinner-a10-pic.o
obj-$(CONFIG_S390_FLIC) += s390_flic.o
obj-$(CONFIG_S390_FLIC_KVM) += s390_flic_kvm.o
obj-$(CONFIG_ASPEED_SOC) += aspeed_vic.o
+obj-$(CONFIG_ARM_GIC) += arm_gicv3_cpuif.o
diff --git a/hw/intc/arm_gicv3.c b/hw/intc/arm_gicv3.c
new file mode 100644
index 0000000000..8a6c647219
--- /dev/null
+++ b/hw/intc/arm_gicv3.c
@@ -0,0 +1,400 @@
+/*
+ * ARM Generic Interrupt Controller v3
+ *
+ * Copyright (c) 2015 Huawei.
+ * Copyright (c) 2016 Linaro Limited
+ * Written by Shlomo Pongratz, Peter Maydell
+ *
+ * This code is licensed under the GPL, version 2 or (at your option)
+ * any later version.
+ */
+
+/* This file contains implementation code for an interrupt controller
+ * which implements the GICv3 architecture. Specifically this is where
+ * the device class itself and the functions for handling interrupts
+ * coming in and going out live.
+ */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "hw/sysbus.h"
+#include "hw/intc/arm_gicv3.h"
+#include "gicv3_internal.h"
+
+static bool irqbetter(GICv3CPUState *cs, int irq, uint8_t prio)
+{
+ /* Return true if this IRQ at this priority should take
+ * precedence over the current recorded highest priority
+ * pending interrupt for this CPU. We also return true if
+ * the current recorded highest priority pending interrupt
+ * is the same as this one (a property which the calling code
+ * relies on).
+ */
+ if (prio < cs->hppi.prio) {
+ return true;
+ }
+ /* If multiple pending interrupts have the same priority then it is an
+ * IMPDEF choice which of them to signal to the CPU. We choose to
+ * signal the one with the lowest interrupt number.
+ */
+ if (prio == cs->hppi.prio && irq <= cs->hppi.irq) {
+ return true;
+ }
+ return false;
+}
+
+static uint32_t gicd_int_pending(GICv3State *s, int irq)
+{
+ /* Recalculate which distributor interrupts are actually pending
+ * in the group of 32 interrupts starting at irq (which should be a multiple
+ * of 32), and return a 32-bit integer which has a bit set for each
+ * interrupt that is eligible to be signaled to the CPU interface.
+ *
+ * An interrupt is pending if:
+ * + the PENDING latch is set OR it is level triggered and the input is 1
+ * + its ENABLE bit is set
+ * + the GICD enable bit for its group is set
+ * Conveniently we can bulk-calculate this with bitwise operations.
+ */
+ uint32_t pend, grpmask;
+ uint32_t pending = *gic_bmp_ptr32(s->pending, irq);
+ uint32_t edge_trigger = *gic_bmp_ptr32(s->edge_trigger, irq);
+ uint32_t level = *gic_bmp_ptr32(s->level, irq);
+ uint32_t group = *gic_bmp_ptr32(s->group, irq);
+ uint32_t grpmod = *gic_bmp_ptr32(s->grpmod, irq);
+ uint32_t enable = *gic_bmp_ptr32(s->enabled, irq);
+
+ pend = pending | (~edge_trigger & level);
+ pend &= enable;
+
+ if (s->gicd_ctlr & GICD_CTLR_DS) {
+ grpmod = 0;
+ }
+
+ grpmask = 0;
+ if (s->gicd_ctlr & GICD_CTLR_EN_GRP1NS) {
+ grpmask |= group;
+ }
+ if (s->gicd_ctlr & GICD_CTLR_EN_GRP1S) {
+ grpmask |= (~group & grpmod);
+ }
+ if (s->gicd_ctlr & GICD_CTLR_EN_GRP0) {
+ grpmask |= (~group & ~grpmod);
+ }
+ pend &= grpmask;
+
+ return pend;
+}
+
+static uint32_t gicr_int_pending(GICv3CPUState *cs)
+{
+ /* Recalculate which redistributor interrupts are actually pending,
+ * and return a 32-bit integer which has a bit set for each interrupt
+ * that is eligible to be signaled to the CPU interface.
+ *
+ * An interrupt is pending if:
+ * + the PENDING latch is set OR it is level triggered and the input is 1
+ * + its ENABLE bit is set
+ * + the GICD enable bit for its group is set
+ * Conveniently we can bulk-calculate this with bitwise operations.
+ */
+ uint32_t pend, grpmask, grpmod;
+
+ pend = cs->gicr_ipendr0 | (~cs->edge_trigger & cs->level);
+ pend &= cs->gicr_ienabler0;
+
+ if (cs->gic->gicd_ctlr & GICD_CTLR_DS) {
+ grpmod = 0;
+ } else {
+ grpmod = cs->gicr_igrpmodr0;
+ }
+
+ grpmask = 0;
+ if (cs->gic->gicd_ctlr & GICD_CTLR_EN_GRP1NS) {
+ grpmask |= cs->gicr_igroupr0;
+ }
+ if (cs->gic->gicd_ctlr & GICD_CTLR_EN_GRP1S) {
+ grpmask |= (~cs->gicr_igroupr0 & grpmod);
+ }
+ if (cs->gic->gicd_ctlr & GICD_CTLR_EN_GRP0) {
+ grpmask |= (~cs->gicr_igroupr0 & ~grpmod);
+ }
+ pend &= grpmask;
+
+ return pend;
+}
+
+/* Update the interrupt status after state in a redistributor
+ * or CPU interface has changed, but don't tell the CPU i/f.
+ */
+static void gicv3_redist_update_noirqset(GICv3CPUState *cs)
+{
+ /* Find the highest priority pending interrupt among the
+ * redistributor interrupts (SGIs and PPIs).
+ */
+ bool seenbetter = false;
+ uint8_t prio;
+ int i;
+ uint32_t pend;
+
+ /* Find out which redistributor interrupts are eligible to be
+ * signaled to the CPU interface.
+ */
+ pend = gicr_int_pending(cs);
+
+ if (pend) {
+ for (i = 0; i < GIC_INTERNAL; i++) {
+ if (!(pend & (1 << i))) {
+ continue;
+ }
+ prio = cs->gicr_ipriorityr[i];
+ if (irqbetter(cs, i, prio)) {
+ cs->hppi.irq = i;
+ cs->hppi.prio = prio;
+ seenbetter = true;
+ }
+ }
+ }
+
+ if (seenbetter) {
+ cs->hppi.grp = gicv3_irq_group(cs->gic, cs, cs->hppi.irq);
+ }
+
+ /* If the best interrupt we just found would preempt whatever
+ * was the previous best interrupt before this update, then
+ * we know it's definitely the best one now.
+ * If we didn't find an interrupt that would preempt the previous
+ * best, and the previous best is outside our range (or there was no
+ * previous pending interrupt at all), then that is still valid, and
+ * we leave it as the best.
+ * Otherwise, we need to do a full update (because the previous best
+ * interrupt has reduced in priority and any other interrupt could
+ * now be the new best one).
+ */
+ if (!seenbetter && cs->hppi.prio != 0xff && cs->hppi.irq < GIC_INTERNAL) {
+ gicv3_full_update_noirqset(cs->gic);
+ }
+}
+
+/* Update the GIC status after state in a redistributor or
+ * CPU interface has changed, and inform the CPU i/f of
+ * its new highest priority pending interrupt.
+ */
+void gicv3_redist_update(GICv3CPUState *cs)
+{
+ gicv3_redist_update_noirqset(cs);
+ gicv3_cpuif_update(cs);
+}
+
+/* Update the GIC status after state in the distributor has
+ * changed affecting @len interrupts starting at @start,
+ * but don't tell the CPU i/f.
+ */
+static void gicv3_update_noirqset(GICv3State *s, int start, int len)
+{
+ int i;
+ uint8_t prio;
+ uint32_t pend = 0;
+
+ assert(start >= GIC_INTERNAL);
+ assert(len > 0);
+
+ for (i = 0; i < s->num_cpu; i++) {
+ s->cpu[i].seenbetter = false;
+ }
+
+ /* Find the highest priority pending interrupt in this range. */
+ for (i = start; i < start + len; i++) {
+ GICv3CPUState *cs;
+
+ if (i == start || (i & 0x1f) == 0) {
+ /* Calculate the next 32 bits worth of pending status */
+ pend = gicd_int_pending(s, i & ~0x1f);
+ }
+
+ if (!(pend & (1 << (i & 0x1f)))) {
+ continue;
+ }
+ cs = s->gicd_irouter_target[i];
+ if (!cs) {
+ /* Interrupts targeting no implemented CPU should remain pending
+ * and not be forwarded to any CPU.
+ */
+ continue;
+ }
+ prio = s->gicd_ipriority[i];
+ if (irqbetter(cs, i, prio)) {
+ cs->hppi.irq = i;
+ cs->hppi.prio = prio;
+ cs->seenbetter = true;
+ }
+ }
+
+ /* If the best interrupt we just found would preempt whatever
+ * was the previous best interrupt before this update, then
+ * we know it's definitely the best one now.
+ * If we didn't find an interrupt that would preempt the previous
+ * best, and the previous best is outside our range (or there was
+ * no previous pending interrupt at all), then that
+ * is still valid, and we leave it as the best.
+ * Otherwise, we need to do a full update (because the previous best
+ * interrupt has reduced in priority and any other interrupt could
+ * now be the new best one).
+ */
+ for (i = 0; i < s->num_cpu; i++) {
+ GICv3CPUState *cs = &s->cpu[i];
+
+ if (cs->seenbetter) {
+ cs->hppi.grp = gicv3_irq_group(cs->gic, cs, cs->hppi.irq);
+ }
+
+ if (!cs->seenbetter && cs->hppi.prio != 0xff &&
+ cs->hppi.irq >= start && cs->hppi.irq < start + len) {
+ gicv3_full_update_noirqset(s);
+ break;
+ }
+ }
+}
+
+void gicv3_update(GICv3State *s, int start, int len)
+{
+ int i;
+
+ gicv3_update_noirqset(s, start, len);
+ for (i = 0; i < s->num_cpu; i++) {
+ gicv3_cpuif_update(&s->cpu[i]);
+ }
+}
+
+void gicv3_full_update_noirqset(GICv3State *s)
+{
+ /* Completely recalculate the GIC status from scratch, but
+ * don't update any outbound IRQ lines.
+ */
+ int i;
+
+ for (i = 0; i < s->num_cpu; i++) {
+ s->cpu[i].hppi.prio = 0xff;
+ }
+
+ /* Note that we can guarantee that these functions will not
+ * recursively call back into gicv3_full_update(), because
+ * at each point the "previous best" is always outside the
+ * range we ask them to update.
+ */
+ gicv3_update_noirqset(s, GIC_INTERNAL, s->num_irq - GIC_INTERNAL);
+
+ for (i = 0; i < s->num_cpu; i++) {
+ gicv3_redist_update_noirqset(&s->cpu[i]);
+ }
+}
+
+void gicv3_full_update(GICv3State *s)
+{
+ /* Completely recalculate the GIC status from scratch, including
+ * updating outbound IRQ lines.
+ */
+ int i;
+
+ gicv3_full_update_noirqset(s);
+ for (i = 0; i < s->num_cpu; i++) {
+ gicv3_cpuif_update(&s->cpu[i]);
+ }
+}
+
+/* Process a change in an external IRQ input. */
+static void gicv3_set_irq(void *opaque, int irq, int level)
+{
+ /* Meaning of the 'irq' parameter:
+ * [0..N-1] : external interrupts
+ * [N..N+31] : PPI (internal) interrupts for CPU 0
+ * [N+32..N+63] : PPI (internal interrupts for CPU 1
+ * ...
+ */
+ GICv3State *s = opaque;
+
+ if (irq < (s->num_irq - GIC_INTERNAL)) {
+ /* external interrupt (SPI) */
+ gicv3_dist_set_irq(s, irq + GIC_INTERNAL, level);
+ } else {
+ /* per-cpu interrupt (PPI) */
+ int cpu;
+
+ irq -= (s->num_irq - GIC_INTERNAL);
+ cpu = irq / GIC_INTERNAL;
+ irq %= GIC_INTERNAL;
+ assert(cpu < s->num_cpu);
+ /* Raising SGIs via this function would be a bug in how the board
+ * model wires up interrupts.
+ */
+ assert(irq >= GIC_NR_SGIS);
+ gicv3_redist_set_irq(&s->cpu[cpu], irq, level);
+ }
+}
+
+static void arm_gicv3_post_load(GICv3State *s)
+{
+ /* Recalculate our cached idea of the current highest priority
+ * pending interrupt, but don't set IRQ or FIQ lines.
+ */
+ gicv3_full_update_noirqset(s);
+ /* Repopulate the cache of GICv3CPUState pointers for target CPUs */
+ gicv3_cache_all_target_cpustates(s);
+}
+
+static const MemoryRegionOps gic_ops[] = {
+ {
+ .read_with_attrs = gicv3_dist_read,
+ .write_with_attrs = gicv3_dist_write,
+ .endianness = DEVICE_NATIVE_ENDIAN,
+ },
+ {
+ .read_with_attrs = gicv3_redist_read,
+ .write_with_attrs = gicv3_redist_write,
+ .endianness = DEVICE_NATIVE_ENDIAN,
+ }
+};
+
+static void arm_gic_realize(DeviceState *dev, Error **errp)
+{
+ /* Device instance realize function for the GIC sysbus device */
+ GICv3State *s = ARM_GICV3(dev);
+ ARMGICv3Class *agc = ARM_GICV3_GET_CLASS(s);
+ Error *local_err = NULL;
+
+ agc->parent_realize(dev, &local_err);
+ if (local_err) {
+ error_propagate(errp, local_err);
+ return;
+ }
+
+ gicv3_init_irqs_and_mmio(s, gicv3_set_irq, gic_ops);
+
+ gicv3_init_cpuif(s);
+}
+
+static void arm_gicv3_class_init(ObjectClass *klass, void *data)
+{
+ DeviceClass *dc = DEVICE_CLASS(klass);
+ ARMGICv3CommonClass *agcc = ARM_GICV3_COMMON_CLASS(klass);
+ ARMGICv3Class *agc = ARM_GICV3_CLASS(klass);
+
+ agcc->post_load = arm_gicv3_post_load;
+ agc->parent_realize = dc->realize;
+ dc->realize = arm_gic_realize;
+}
+
+static const TypeInfo arm_gicv3_info = {
+ .name = TYPE_ARM_GICV3,
+ .parent = TYPE_ARM_GICV3_COMMON,
+ .instance_size = sizeof(GICv3State),
+ .class_init = arm_gicv3_class_init,
+ .class_size = sizeof(ARMGICv3Class),
+};
+
+static void arm_gicv3_register_types(void)
+{
+ type_register_static(&arm_gicv3_info);
+}
+
+type_init(arm_gicv3_register_types)
diff --git a/hw/intc/arm_gicv3_common.c b/hw/intc/arm_gicv3_common.c
index b9d3824f2b..0f8c4b86e0 100644
--- a/hw/intc/arm_gicv3_common.c
+++ b/hw/intc/arm_gicv3_common.c
@@ -3,8 +3,9 @@
*
* Copyright (c) 2012 Linaro Limited
* Copyright (c) 2015 Huawei.
+ * Copyright (c) 2015 Samsung Electronics Co., Ltd.
* Written by Peter Maydell
- * Extended to 64 cores by Shlomo Pongratz
+ * Reworked for GICv3 by Shlomo Pongratz and Pavel Fedin
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
@@ -22,7 +23,10 @@
#include "qemu/osdep.h"
#include "qapi/error.h"
+#include "qom/cpu.h"
#include "hw/intc/arm_gicv3_common.h"
+#include "gicv3_internal.h"
+#include "hw/arm/linux-boot-if.h"
static void gicv3_pre_save(void *opaque)
{
@@ -45,11 +49,59 @@ static int gicv3_post_load(void *opaque, int version_id)
return 0;
}
+static const VMStateDescription vmstate_gicv3_cpu = {
+ .name = "arm_gicv3_cpu",
+ .version_id = 1,
+ .minimum_version_id = 1,
+ .fields = (VMStateField[]) {
+ VMSTATE_UINT32(level, GICv3CPUState),
+ VMSTATE_UINT32(gicr_ctlr, GICv3CPUState),
+ VMSTATE_UINT32_ARRAY(gicr_statusr, GICv3CPUState, 2),
+ VMSTATE_UINT32(gicr_waker, GICv3CPUState),
+ VMSTATE_UINT64(gicr_propbaser, GICv3CPUState),
+ VMSTATE_UINT64(gicr_pendbaser, GICv3CPUState),
+ VMSTATE_UINT32(gicr_igroupr0, GICv3CPUState),
+ VMSTATE_UINT32(gicr_ienabler0, GICv3CPUState),
+ VMSTATE_UINT32(gicr_ipendr0, GICv3CPUState),
+ VMSTATE_UINT32(gicr_iactiver0, GICv3CPUState),
+ VMSTATE_UINT32(edge_trigger, GICv3CPUState),
+ VMSTATE_UINT32(gicr_igrpmodr0, GICv3CPUState),
+ VMSTATE_UINT32(gicr_nsacr, GICv3CPUState),
+ VMSTATE_UINT8_ARRAY(gicr_ipriorityr, GICv3CPUState, GIC_INTERNAL),
+ VMSTATE_UINT64_ARRAY(icc_ctlr_el1, GICv3CPUState, 2),
+ VMSTATE_UINT64(icc_pmr_el1, GICv3CPUState),
+ VMSTATE_UINT64_ARRAY(icc_bpr, GICv3CPUState, 3),
+ VMSTATE_UINT64_2DARRAY(icc_apr, GICv3CPUState, 3, 4),
+ VMSTATE_UINT64_ARRAY(icc_igrpen, GICv3CPUState, 3),
+ VMSTATE_UINT64(icc_ctlr_el3, GICv3CPUState),
+ VMSTATE_END_OF_LIST()
+ }
+};
+
static const VMStateDescription vmstate_gicv3 = {
.name = "arm_gicv3",
- .unmigratable = 1,
+ .version_id = 1,
+ .minimum_version_id = 1,
.pre_save = gicv3_pre_save,
.post_load = gicv3_post_load,
+ .fields = (VMStateField[]) {
+ VMSTATE_UINT32(gicd_ctlr, GICv3State),
+ VMSTATE_UINT32_ARRAY(gicd_statusr, GICv3State, 2),
+ VMSTATE_UINT32_ARRAY(group, GICv3State, GICV3_BMP_SIZE),
+ VMSTATE_UINT32_ARRAY(grpmod, GICv3State, GICV3_BMP_SIZE),
+ VMSTATE_UINT32_ARRAY(enabled, GICv3State, GICV3_BMP_SIZE),
+ VMSTATE_UINT32_ARRAY(pending, GICv3State, GICV3_BMP_SIZE),
+ VMSTATE_UINT32_ARRAY(active, GICv3State, GICV3_BMP_SIZE),
+ VMSTATE_UINT32_ARRAY(level, GICv3State, GICV3_BMP_SIZE),
+ VMSTATE_UINT32_ARRAY(edge_trigger, GICv3State, GICV3_BMP_SIZE),
+ VMSTATE_UINT8_ARRAY(gicd_ipriority, GICv3State, GICV3_MAXIRQ),
+ VMSTATE_UINT64_ARRAY(gicd_irouter, GICv3State, GICV3_MAXIRQ),
+ VMSTATE_UINT32_ARRAY(gicd_nsacr, GICv3State,
+ DIV_ROUND_UP(GICV3_MAXIRQ, 16)),
+ VMSTATE_STRUCT_VARRAY_POINTER_UINT32(cpu, GICv3State, num_cpu,
+ vmstate_gicv3_cpu, GICv3CPUState),
+ VMSTATE_END_OF_LIST()
+ }
};
void gicv3_init_irqs_and_mmio(GICv3State *s, qemu_irq_handler handler,
@@ -68,14 +120,11 @@ void gicv3_init_irqs_and_mmio(GICv3State *s, qemu_irq_handler handler,
i = s->num_irq - GIC_INTERNAL + GIC_INTERNAL * s->num_cpu;
qdev_init_gpio_in(DEVICE(s), handler, i);
- s->parent_irq = g_malloc(s->num_cpu * sizeof(qemu_irq));
- s->parent_fiq = g_malloc(s->num_cpu * sizeof(qemu_irq));
-
for (i = 0; i < s->num_cpu; i++) {
- sysbus_init_irq(sbd, &s->parent_irq[i]);
+ sysbus_init_irq(sbd, &s->cpu[i].parent_irq);
}
for (i = 0; i < s->num_cpu; i++) {
- sysbus_init_irq(sbd, &s->parent_fiq[i]);
+ sysbus_init_irq(sbd, &s->cpu[i].parent_fiq);
}
memory_region_init_io(&s->iomem_dist, OBJECT(s), ops, s,
@@ -90,6 +139,7 @@ void gicv3_init_irqs_and_mmio(GICv3State *s, qemu_irq_handler handler,
static void arm_gicv3_common_realize(DeviceState *dev, Error **errp)
{
GICv3State *s = ARM_GICV3_COMMON(dev);
+ int i;
/* revision property is actually reserved and currently used only in order
* to keep the interface compatible with GICv2 code, avoiding extra
@@ -100,11 +150,164 @@ static void arm_gicv3_common_realize(DeviceState *dev, Error **errp)
error_setg(errp, "unsupported GIC revision %d", s->revision);
return;
}
+
+ if (s->num_irq > GICV3_MAXIRQ) {
+ error_setg(errp,
+ "requested %u interrupt lines exceeds GIC maximum %d",
+ s->num_irq, GICV3_MAXIRQ);
+ return;
+ }
+ if (s->num_irq < GIC_INTERNAL) {
+ error_setg(errp,
+ "requested %u interrupt lines is below GIC minimum %d",
+ s->num_irq, GIC_INTERNAL);
+ return;
+ }
+
+ /* ITLinesNumber is represented as (N / 32) - 1, so this is an
+ * implementation imposed restriction, not an architectural one,
+ * so we don't have to deal with bitfields where only some of the
+ * bits in a 32-bit word should be valid.
+ */
+ if (s->num_irq % 32) {
+ error_setg(errp,
+ "%d interrupt lines unsupported: not divisible by 32",
+ s->num_irq);
+ return;
+ }
+
+ s->cpu = g_new0(GICv3CPUState, s->num_cpu);
+
+ for (i = 0; i < s->num_cpu; i++) {
+ CPUState *cpu = qemu_get_cpu(i);
+ uint64_t cpu_affid;
+ int last;
+
+ s->cpu[i].cpu = cpu;
+ s->cpu[i].gic = s;
+
+ /* Pre-construct the GICR_TYPER:
+ * For our implementation:
+ * Top 32 bits are the affinity value of the associated CPU
+ * CommonLPIAff == 01 (redistributors with same Aff3 share LPI table)
+ * Processor_Number == CPU index starting from 0
+ * DPGS == 0 (GICR_CTLR.DPG* not supported)
+ * Last == 1 if this is the last redistributor in a series of
+ * contiguous redistributor pages
+ * DirectLPI == 0 (direct injection of LPIs not supported)
+ * VLPIS == 0 (virtual LPIs not supported)
+ * PLPIS == 0 (physical LPIs not supported)
+ */
+ cpu_affid = object_property_get_int(OBJECT(cpu), "mp-affinity", NULL);
+ last = (i == s->num_cpu - 1);
+
+ /* The CPU mp-affinity property is in MPIDR register format; squash
+ * the affinity bytes into 32 bits as the GICR_TYPER has them.
+ */
+ cpu_affid = (cpu_affid & 0xFF00000000ULL >> 8) | (cpu_affid & 0xFFFFFF);
+ s->cpu[i].gicr_typer = (cpu_affid << 32) |
+ (1 << 24) |
+ (i << 8) |
+ (last << 4);
+ }
}
static void arm_gicv3_common_reset(DeviceState *dev)
{
- /* TODO */
+ GICv3State *s = ARM_GICV3_COMMON(dev);
+ int i;
+
+ for (i = 0; i < s->num_cpu; i++) {
+ GICv3CPUState *cs = &s->cpu[i];
+
+ cs->level = 0;
+ cs->gicr_ctlr = 0;
+ cs->gicr_statusr[GICV3_S] = 0;
+ cs->gicr_statusr[GICV3_NS] = 0;
+ cs->gicr_waker = GICR_WAKER_ProcessorSleep | GICR_WAKER_ChildrenAsleep;
+ cs->gicr_propbaser = 0;
+ cs->gicr_pendbaser = 0;
+ /* If we're resetting a TZ-aware GIC as if secure firmware
+ * had set it up ready to start a kernel in non-secure, we
+ * need to set interrupts to group 1 so the kernel can use them.
+ * Otherwise they reset to group 0 like the hardware.
+ */
+ if (s->irq_reset_nonsecure) {
+ cs->gicr_igroupr0 = 0xffffffff;
+ } else {
+ cs->gicr_igroupr0 = 0;
+ }
+
+ cs->gicr_ienabler0 = 0;
+ cs->gicr_ipendr0 = 0;
+ cs->gicr_iactiver0 = 0;
+ cs->edge_trigger = 0xffff;
+ cs->gicr_igrpmodr0 = 0;
+ cs->gicr_nsacr = 0;
+ memset(cs->gicr_ipriorityr, 0, sizeof(cs->gicr_ipriorityr));
+
+ cs->hppi.prio = 0xff;
+
+ /* State in the CPU interface must *not* be reset here, because it
+ * is part of the CPU's reset domain, not the GIC device's.
+ */
+ }
+
+ /* For our implementation affinity routing is always enabled */
+ if (s->security_extn) {
+ s->gicd_ctlr = GICD_CTLR_ARE_S | GICD_CTLR_ARE_NS;
+ } else {
+ s->gicd_ctlr = GICD_CTLR_DS | GICD_CTLR_ARE;
+ }
+
+ s->gicd_statusr[GICV3_S] = 0;
+ s->gicd_statusr[GICV3_NS] = 0;
+
+ memset(s->group, 0, sizeof(s->group));
+ memset(s->grpmod, 0, sizeof(s->grpmod));
+ memset(s->enabled, 0, sizeof(s->enabled));
+ memset(s->pending, 0, sizeof(s->pending));
+ memset(s->active, 0, sizeof(s->active));
+ memset(s->level, 0, sizeof(s->level));
+ memset(s->edge_trigger, 0, sizeof(s->edge_trigger));
+ memset(s->gicd_ipriority, 0, sizeof(s->gicd_ipriority));
+ memset(s->gicd_irouter, 0, sizeof(s->gicd_irouter));
+ memset(s->gicd_nsacr, 0, sizeof(s->gicd_nsacr));
+ /* GICD_IROUTER are UNKNOWN at reset so in theory the guest must
+ * write these to get sane behaviour and we need not populate the
+ * pointer cache here; however having the cache be different for
+ * "happened to be 0 from reset" and "guest wrote 0" would be
+ * too confusing.
+ */
+ gicv3_cache_all_target_cpustates(s);
+
+ if (s->irq_reset_nonsecure) {
+ /* If we're resetting a TZ-aware GIC as if secure firmware
+ * had set it up ready to start a kernel in non-secure, we
+ * need to set interrupts to group 1 so the kernel can use them.
+ * Otherwise they reset to group 0 like the hardware.
+ */
+ for (i = GIC_INTERNAL; i < s->num_irq; i++) {
+ gicv3_gicd_group_set(s, i);
+ }
+ }
+}
+
+static void arm_gic_common_linux_init(ARMLinuxBootIf *obj,
+ bool secure_boot)
+{
+ GICv3State *s = ARM_GICV3_COMMON(obj);
+
+ if (s->security_extn && !secure_boot) {
+ /* We're directly booting a kernel into NonSecure. If this GIC
+ * implements the security extensions then we must configure it
+ * to have all the interrupts be NonSecure (this is a job that
+ * is done by the Secure boot firmware in real hardware, and in
+ * this mode QEMU is acting as a minimalist firmware-and-bootloader
+ * equivalent).
+ */
+ s->irq_reset_nonsecure = true;
+ }
}
static Property arm_gicv3_common_properties[] = {
@@ -118,11 +321,13 @@ static Property arm_gicv3_common_properties[] = {
static void arm_gicv3_common_class_init(ObjectClass *klass, void *data)
{
DeviceClass *dc = DEVICE_CLASS(klass);
+ ARMLinuxBootIfClass *albifc = ARM_LINUX_BOOT_IF_CLASS(klass);
dc->reset = arm_gicv3_common_reset;
dc->realize = arm_gicv3_common_realize;
dc->props = arm_gicv3_common_properties;
dc->vmsd = &vmstate_gicv3;
+ albifc->arm_linux_init = arm_gic_common_linux_init;
}
static const TypeInfo arm_gicv3_common_type = {
@@ -132,6 +337,10 @@ static const TypeInfo arm_gicv3_common_type = {
.class_size = sizeof(ARMGICv3CommonClass),
.class_init = arm_gicv3_common_class_init,
.abstract = true,
+ .interfaces = (InterfaceInfo []) {
+ { TYPE_ARM_LINUX_BOOT_IF },
+ { },
+ },
};
static void register_types(void)
diff --git a/hw/intc/arm_gicv3_cpuif.c b/hw/intc/arm_gicv3_cpuif.c
new file mode 100644
index 0000000000..5b2972ea9c
--- /dev/null
+++ b/hw/intc/arm_gicv3_cpuif.c
@@ -0,0 +1,1346 @@
+/*
+ * ARM Generic Interrupt Controller v3
+ *
+ * Copyright (c) 2016 Linaro Limited
+ * Written by Peter Maydell
+ *
+ * This code is licensed under the GPL, version 2 or (at your option)
+ * any later version.
+ */
+
+/* This file contains the code for the system register interface
+ * portions of the GICv3.
+ */
+
+#include "qemu/osdep.h"
+#include "trace.h"
+#include "gicv3_internal.h"
+#include "cpu.h"
+
+static GICv3CPUState *icc_cs_from_env(CPUARMState *env)
+{
+ /* Given the CPU, find the right GICv3CPUState struct.
+ * Since we registered the CPU interface with the EL change hook as
+ * the opaque pointer, we can just directly get from the CPU to it.
+ */
+ return arm_get_el_change_hook_opaque(arm_env_get_cpu(env));
+}
+
+static bool gicv3_use_ns_bank(CPUARMState *env)
+{
+ /* Return true if we should use the NonSecure bank for a banked GIC
+ * CPU interface register. Note that this differs from the
+ * access_secure_reg() function because GICv3 banked registers are
+ * banked even for AArch64, unlike the other CPU system registers.
+ */
+ return !arm_is_secure_below_el3(env);
+}
+
+static int icc_highest_active_prio(GICv3CPUState *cs)
+{
+ /* Calculate the current running priority based on the set bits
+ * in the Active Priority Registers.
+ */
+ int i;
+
+ for (i = 0; i < ARRAY_SIZE(cs->icc_apr[0]); i++) {
+ uint32_t apr = cs->icc_apr[GICV3_G0][i] |
+ cs->icc_apr[GICV3_G1][i] | cs->icc_apr[GICV3_G1NS][i];
+
+ if (!apr) {
+ continue;
+ }
+ return (i * 32 + ctz32(apr)) << (GIC_MIN_BPR + 1);
+ }
+ /* No current active interrupts: return idle priority */
+ return 0xff;
+}
+
+static uint32_t icc_gprio_mask(GICv3CPUState *cs, int group)
+{
+ /* Return a mask word which clears the subpriority bits from
+ * a priority value for an interrupt in the specified group.
+ * This depends on the BPR value:
+ * a BPR of 0 means the group priority bits are [7:1];
+ * a BPR of 1 means they are [7:2], and so on down to
+ * a BPR of 7 meaning no group priority bits at all.
+ * Which BPR to use depends on the group of the interrupt and
+ * the current ICC_CTLR.CBPR settings.
+ */
+ if ((group == GICV3_G1 && cs->icc_ctlr_el1[GICV3_S] & ICC_CTLR_EL1_CBPR) ||
+ (group == GICV3_G1NS &&
+ cs->icc_ctlr_el1[GICV3_NS] & ICC_CTLR_EL1_CBPR)) {
+ group = GICV3_G0;
+ }
+
+ return ~0U << ((cs->icc_bpr[group] & 7) + 1);
+}
+
+static bool icc_no_enabled_hppi(GICv3CPUState *cs)
+{
+ /* Return true if there is no pending interrupt, or the
+ * highest priority pending interrupt is in a group which has been
+ * disabled at the CPU interface by the ICC_IGRPEN* register enable bits.
+ */
+ return cs->hppi.prio == 0xff || (cs->icc_igrpen[cs->hppi.grp] == 0);
+}
+
+static bool icc_hppi_can_preempt(GICv3CPUState *cs)
+{
+ /* Return true if we have a pending interrupt of sufficient
+ * priority to preempt.
+ */
+ int rprio;
+ uint32_t mask;
+
+ if (icc_no_enabled_hppi(cs)) {
+ return false;
+ }
+
+ if (cs->hppi.prio >= cs->icc_pmr_el1) {
+ /* Priority mask masks this interrupt */
+ return false;
+ }
+
+ rprio = icc_highest_active_prio(cs);
+ if (rprio == 0xff) {
+ /* No currently running interrupt so we can preempt */
+ return true;
+ }
+
+ mask = icc_gprio_mask(cs, cs->hppi.grp);
+
+ /* We only preempt a running interrupt if the pending interrupt's
+ * group priority is sufficient (the subpriorities are not considered).
+ */
+ if ((cs->hppi.prio & mask) < (rprio & mask)) {
+ return true;
+ }
+
+ return false;
+}
+
+void gicv3_cpuif_update(GICv3CPUState *cs)
+{
+ /* Tell the CPU about its highest priority pending interrupt */
+ int irqlevel = 0;
+ int fiqlevel = 0;
+ ARMCPU *cpu = ARM_CPU(cs->cpu);
+ CPUARMState *env = &cpu->env;
+
+ trace_gicv3_cpuif_update(gicv3_redist_affid(cs), cs->hppi.irq,
+ cs->hppi.grp, cs->hppi.prio);
+
+ if (cs->hppi.grp == GICV3_G1 && !arm_feature(env, ARM_FEATURE_EL3)) {
+ /* If a Security-enabled GIC sends a G1S interrupt to a
+ * Security-disabled CPU, we must treat it as if it were G0.
+ */
+ cs->hppi.grp = GICV3_G0;
+ }
+
+ if (icc_hppi_can_preempt(cs)) {
+ /* We have an interrupt: should we signal it as IRQ or FIQ?
+ * This is described in the GICv3 spec section 4.6.2.
+ */
+ bool isfiq;
+
+ switch (cs->hppi.grp) {
+ case GICV3_G0:
+ isfiq = true;
+ break;
+ case GICV3_G1:
+ isfiq = (!arm_is_secure(env) ||
+ (arm_current_el(env) == 3 && arm_el_is_aa64(env, 3)));
+ break;
+ case GICV3_G1NS:
+ isfiq = arm_is_secure(env);
+ break;
+ default:
+ g_assert_not_reached();
+ }
+
+ if (isfiq) {
+ fiqlevel = 1;
+ } else {
+ irqlevel = 1;
+ }
+ }
+
+ trace_gicv3_cpuif_set_irqs(gicv3_redist_affid(cs), fiqlevel, irqlevel);
+
+ qemu_set_irq(cs->parent_fiq, fiqlevel);
+ qemu_set_irq(cs->parent_irq, irqlevel);
+}
+
+static uint64_t icc_pmr_read(CPUARMState *env, const ARMCPRegInfo *ri)
+{
+ GICv3CPUState *cs = icc_cs_from_env(env);
+ uint32_t value = cs->icc_pmr_el1;
+
+ if (arm_feature(env, ARM_FEATURE_EL3) && !arm_is_secure(env) &&
+ (env->cp15.scr_el3 & SCR_FIQ)) {
+ /* NS access and Group 0 is inaccessible to NS: return the
+ * NS view of the current priority
+ */
+ if (value & 0x80) {
+ /* Secure priorities not visible to NS */
+ value = 0;
+ } else if (value != 0xff) {
+ value = (value << 1) & 0xff;
+ }
+ }
+
+ trace_gicv3_icc_pmr_read(gicv3_redist_affid(cs), value);
+
+ return value;
+}
+
+static void icc_pmr_write(CPUARMState *env, const ARMCPRegInfo *ri,
+ uint64_t value)
+{
+ GICv3CPUState *cs = icc_cs_from_env(env);
+
+ trace_gicv3_icc_pmr_write(gicv3_redist_affid(cs), value);
+
+ value &= 0xff;
+
+ if (arm_feature(env, ARM_FEATURE_EL3) && !arm_is_secure(env) &&
+ (env->cp15.scr_el3 & SCR_FIQ)) {
+ /* NS access and Group 0 is inaccessible to NS: return the
+ * NS view of the current priority
+ */
+ if (!(cs->icc_pmr_el1 & 0x80)) {
+ /* Current PMR in the secure range, don't allow NS to change it */
+ return;
+ }
+ value = (value >> 1) & 0x80;
+ }
+ cs->icc_pmr_el1 = value;
+ gicv3_cpuif_update(cs);
+}
+
+static void icc_activate_irq(GICv3CPUState *cs, int irq)
+{
+ /* Move the interrupt from the Pending state to Active, and update
+ * the Active Priority Registers
+ */
+ uint32_t mask = icc_gprio_mask(cs, cs->hppi.grp);
+ int prio = cs->hppi.prio & mask;
+ int aprbit = prio >> 1;
+ int regno = aprbit / 32;
+ int regbit = aprbit % 32;
+
+ cs->icc_apr[cs->hppi.grp][regno] |= (1 << regbit);
+
+ if (irq < GIC_INTERNAL) {
+ cs->gicr_iactiver0 = deposit32(cs->gicr_iactiver0, irq, 1, 1);
+ cs->gicr_ipendr0 = deposit32(cs->gicr_ipendr0, irq, 1, 0);
+ gicv3_redist_update(cs);
+ } else {
+ gicv3_gicd_active_set(cs->gic, irq);
+ gicv3_gicd_pending_clear(cs->gic, irq);
+ gicv3_update(cs->gic, irq, 1);
+ }
+}
+
+static uint64_t icc_hppir0_value(GICv3CPUState *cs, CPUARMState *env)
+{
+ /* Return the highest priority pending interrupt register value
+ * for group 0.
+ */
+ bool irq_is_secure;
+
+ if (cs->hppi.prio == 0xff) {
+ return INTID_SPURIOUS;
+ }
+
+ /* Check whether we can return the interrupt or if we should return
+ * a special identifier, as per the CheckGroup0ForSpecialIdentifiers
+ * pseudocode. (We can simplify a little because for us ICC_SRE_EL1.RM
+ * is always zero.)
+ */
+ irq_is_secure = (!(cs->gic->gicd_ctlr & GICD_CTLR_DS) &&
+ (cs->hppi.grp != GICV3_G1NS));
+
+ if (cs->hppi.grp != GICV3_G0 && !arm_is_el3_or_mon(env)) {
+ return INTID_SPURIOUS;
+ }
+ if (irq_is_secure && !arm_is_secure(env)) {
+ /* Secure interrupts not visible to Nonsecure */
+ return INTID_SPURIOUS;
+ }
+
+ if (cs->hppi.grp != GICV3_G0) {
+ /* Indicate to EL3 that there's a Group 1 interrupt for the other
+ * state pending.
+ */
+ return irq_is_secure ? INTID_SECURE : INTID_NONSECURE;
+ }
+
+ return cs->hppi.irq;
+}
+
+static uint64_t icc_hppir1_value(GICv3CPUState *cs, CPUARMState *env)
+{
+ /* Return the highest priority pending interrupt register value
+ * for group 1.
+ */
+ bool irq_is_secure;
+
+ if (cs->hppi.prio == 0xff) {
+ return INTID_SPURIOUS;
+ }
+
+ /* Check whether we can return the interrupt or if we should return
+ * a special identifier, as per the CheckGroup1ForSpecialIdentifiers
+ * pseudocode. (We can simplify a little because for us ICC_SRE_EL1.RM
+ * is always zero.)
+ */
+ irq_is_secure = (!(cs->gic->gicd_ctlr & GICD_CTLR_DS) &&
+ (cs->hppi.grp != GICV3_G1NS));
+
+ if (cs->hppi.grp == GICV3_G0) {
+ /* Group 0 interrupts not visible via HPPIR1 */
+ return INTID_SPURIOUS;
+ }
+ if (irq_is_secure) {
+ if (!arm_is_secure(env)) {
+ /* Secure interrupts not visible in Non-secure */
+ return INTID_SPURIOUS;
+ }
+ } else if (!arm_is_el3_or_mon(env) && arm_is_secure(env)) {
+ /* Group 1 non-secure interrupts not visible in Secure EL1 */
+ return INTID_SPURIOUS;
+ }
+
+ return cs->hppi.irq;
+}
+
+static uint64_t icc_iar0_read(CPUARMState *env, const ARMCPRegInfo *ri)
+{
+ GICv3CPUState *cs = icc_cs_from_env(env);
+ uint64_t intid;
+
+ if (!icc_hppi_can_preempt(cs)) {
+ intid = INTID_SPURIOUS;
+ } else {
+ intid = icc_hppir0_value(cs, env);
+ }
+
+ if (!(intid >= INTID_SECURE && intid <= INTID_SPURIOUS)) {
+ icc_activate_irq(cs, intid);
+ }
+
+ trace_gicv3_icc_iar0_read(gicv3_redist_affid(cs), intid);
+ return intid;
+}
+
+static uint64_t icc_iar1_read(CPUARMState *env, const ARMCPRegInfo *ri)
+{
+ GICv3CPUState *cs = icc_cs_from_env(env);
+ uint64_t intid;
+
+ if (!icc_hppi_can_preempt(cs)) {
+ intid = INTID_SPURIOUS;
+ } else {
+ intid = icc_hppir1_value(cs, env);
+ }
+
+ if (!(intid >= INTID_SECURE && intid <= INTID_SPURIOUS)) {
+ icc_activate_irq(cs, intid);
+ }
+
+ trace_gicv3_icc_iar1_read(gicv3_redist_affid(cs), intid);
+ return intid;
+}
+
+static void icc_drop_prio(GICv3CPUState *cs, int grp)
+{
+ /* Drop the priority of the currently active interrupt in
+ * the specified group.
+ *
+ * Note that we can guarantee (because of the requirement to nest
+ * ICC_IAR reads [which activate an interrupt and raise priority]
+ * with ICC_EOIR writes [which drop the priority for the interrupt])
+ * that the interrupt we're being called for is the highest priority
+ * active interrupt, meaning that it has the lowest set bit in the
+ * APR registers.
+ *
+ * If the guest does not honour the ordering constraints then the
+ * behaviour of the GIC is UNPREDICTABLE, which for us means that
+ * the values of the APR registers might become incorrect and the
+ * running priority will be wrong, so interrupts that should preempt
+ * might not do so, and interrupts that should not preempt might do so.
+ */
+ int i;
+
+ for (i = 0; i < ARRAY_SIZE(cs->icc_apr[grp]); i++) {
+ uint64_t *papr = &cs->icc_apr[grp][i];
+
+ if (!*papr) {
+ continue;
+ }
+ /* Clear the lowest set bit */
+ *papr &= *papr - 1;
+ break;
+ }
+
+ /* running priority change means we need an update for this cpu i/f */
+ gicv3_cpuif_update(cs);
+}
+
+static bool icc_eoi_split(CPUARMState *env, GICv3CPUState *cs)
+{
+ /* Return true if we should split priority drop and interrupt
+ * deactivation, ie whether the relevant EOIMode bit is set.
+ */
+ if (arm_is_el3_or_mon(env)) {
+ return cs->icc_ctlr_el3 & ICC_CTLR_EL3_EOIMODE_EL3;
+ }
+ if (arm_is_secure_below_el3(env)) {
+ return cs->icc_ctlr_el1[GICV3_S] & ICC_CTLR_EL1_EOIMODE;
+ } else {
+ return cs->icc_ctlr_el1[GICV3_NS] & ICC_CTLR_EL1_EOIMODE;
+ }
+}
+
+static int icc_highest_active_group(GICv3CPUState *cs)
+{
+ /* Return the group with the highest priority active interrupt.
+ * We can do this by just comparing the APRs to see which one
+ * has the lowest set bit.
+ * (If more than one group is active at the same priority then
+ * we're in UNPREDICTABLE territory.)
+ */
+ int i;
+
+ for (i = 0; i < ARRAY_SIZE(cs->icc_apr[0]); i++) {
+ int g0ctz = ctz32(cs->icc_apr[GICV3_G0][i]);
+ int g1ctz = ctz32(cs->icc_apr[GICV3_G1][i]);
+ int g1nsctz = ctz32(cs->icc_apr[GICV3_G1NS][i]);
+
+ if (g1nsctz < g0ctz && g1nsctz < g1ctz) {
+ return GICV3_G1NS;
+ }
+ if (g1ctz < g0ctz) {
+ return GICV3_G1;
+ }
+ if (g0ctz < 32) {
+ return GICV3_G0;
+ }
+ }
+ /* No set active bits? UNPREDICTABLE; return -1 so the caller
+ * ignores the spurious EOI attempt.
+ */
+ return -1;
+}
+
+static void icc_deactivate_irq(GICv3CPUState *cs, int irq)
+{
+ if (irq < GIC_INTERNAL) {
+ cs->gicr_iactiver0 = deposit32(cs->gicr_iactiver0, irq, 1, 0);
+ gicv3_redist_update(cs);
+ } else {
+ gicv3_gicd_active_clear(cs->gic, irq);
+ gicv3_update(cs->gic, irq, 1);
+ }
+}
+
+static void icc_eoir_write(CPUARMState *env, const ARMCPRegInfo *ri,
+ uint64_t value)
+{
+ /* End of Interrupt */
+ GICv3CPUState *cs = icc_cs_from_env(env);
+ int irq = value & 0xffffff;
+ int grp;
+
+ trace_gicv3_icc_eoir_write(gicv3_redist_affid(cs), value);
+
+ if (ri->crm == 8) {
+ /* EOIR0 */
+ grp = GICV3_G0;
+ } else {
+ /* EOIR1 */
+ if (arm_is_secure(env)) {
+ grp = GICV3_G1;
+ } else {
+ grp = GICV3_G1NS;
+ }
+ }
+
+ if (irq >= cs->gic->num_irq) {
+ /* This handles two cases:
+ * 1. If software writes the ID of a spurious interrupt [ie 1020-1023]
+ * to the GICC_EOIR, the GIC ignores that write.
+ * 2. If software writes the number of a non-existent interrupt
+ * this must be a subcase of "value written does not match the last
+ * valid interrupt value read from the Interrupt Acknowledge
+ * register" and so this is UNPREDICTABLE. We choose to ignore it.
+ */
+ return;
+ }
+
+ if (icc_highest_active_group(cs) != grp) {
+ return;
+ }
+
+ icc_drop_prio(cs, grp);
+
+ if (!icc_eoi_split(env, cs)) {
+ /* Priority drop and deactivate not split: deactivate irq now */
+ icc_deactivate_irq(cs, irq);
+ }
+}
+
+static uint64_t icc_hppir0_read(CPUARMState *env, const ARMCPRegInfo *ri)
+{
+ GICv3CPUState *cs = icc_cs_from_env(env);
+ uint64_t value = icc_hppir0_value(cs, env);
+
+ trace_gicv3_icc_hppir0_read(gicv3_redist_affid(cs), value);
+ return value;
+}
+
+static uint64_t icc_hppir1_read(CPUARMState *env, const ARMCPRegInfo *ri)
+{
+ GICv3CPUState *cs = icc_cs_from_env(env);
+ uint64_t value = icc_hppir1_value(cs, env);
+
+ trace_gicv3_icc_hppir1_read(gicv3_redist_affid(cs), value);
+ return value;
+}
+
+static uint64_t icc_bpr_read(CPUARMState *env, const ARMCPRegInfo *ri)
+{
+ GICv3CPUState *cs = icc_cs_from_env(env);
+ int grp = (ri->crm == 8) ? GICV3_G0 : GICV3_G1;
+ bool satinc = false;
+ uint64_t bpr;
+
+ if (grp == GICV3_G1 && gicv3_use_ns_bank(env)) {
+ grp = GICV3_G1NS;
+ }
+
+ if (grp == GICV3_G1 && !arm_is_el3_or_mon(env) &&
+ (cs->icc_ctlr_el1[GICV3_S] & ICC_CTLR_EL1_CBPR)) {
+ /* CBPR_EL1S means secure EL1 or AArch32 EL3 !Mon BPR1 accesses
+ * modify BPR0
+ */
+ grp = GICV3_G0;
+ }
+
+ if (grp == GICV3_G1NS && arm_current_el(env) < 3 &&
+ (cs->icc_ctlr_el1[GICV3_NS] & ICC_CTLR_EL1_CBPR)) {
+ /* reads return bpr0 + 1 sat to 7, writes ignored */
+ grp = GICV3_G0;
+ satinc = true;
+ }
+
+ bpr = cs->icc_bpr[grp];
+ if (satinc) {
+ bpr++;
+ bpr = MIN(bpr, 7);
+ }
+
+ trace_gicv3_icc_bpr_read(gicv3_redist_affid(cs), bpr);
+
+ return bpr;
+}
+
+static void icc_bpr_write(CPUARMState *env, const ARMCPRegInfo *ri,
+ uint64_t value)
+{
+ GICv3CPUState *cs = icc_cs_from_env(env);
+ int grp = (ri->crm == 8) ? GICV3_G0 : GICV3_G1;
+
+ trace_gicv3_icc_pmr_write(gicv3_redist_affid(cs), value);
+
+ if (grp == GICV3_G1 && gicv3_use_ns_bank(env)) {
+ grp = GICV3_G1NS;
+ }
+
+ if (grp == GICV3_G1 && !arm_is_el3_or_mon(env) &&
+ (cs->icc_ctlr_el1[GICV3_S] & ICC_CTLR_EL1_CBPR)) {
+ /* CBPR_EL1S means secure EL1 or AArch32 EL3 !Mon BPR1 accesses
+ * modify BPR0
+ */
+ grp = GICV3_G0;
+ }
+
+ if (grp == GICV3_G1NS && arm_current_el(env) < 3 &&
+ (cs->icc_ctlr_el1[GICV3_NS] & ICC_CTLR_EL1_CBPR)) {
+ /* reads return bpr0 + 1 sat to 7, writes ignored */
+ return;
+ }
+
+ cs->icc_bpr[grp] = value & 7;
+ gicv3_cpuif_update(cs);
+}
+
+static uint64_t icc_ap_read(CPUARMState *env, const ARMCPRegInfo *ri)
+{
+ GICv3CPUState *cs = icc_cs_from_env(env);
+ uint64_t value;
+
+ int regno = ri->opc2 & 3;
+ int grp = ri->crm & 1 ? GICV3_G0 : GICV3_G1;
+
+ if (grp == GICV3_G1 && gicv3_use_ns_bank(env)) {
+ grp = GICV3_G1NS;
+ }
+
+ value = cs->icc_apr[grp][regno];
+
+ trace_gicv3_icc_ap_read(regno, gicv3_redist_affid(cs), value);
+ return value;
+}
+
+static void icc_ap_write(CPUARMState *env, const ARMCPRegInfo *ri,
+ uint64_t value)
+{
+ GICv3CPUState *cs = icc_cs_from_env(env);
+
+ int regno = ri->opc2 & 3;
+ int grp = ri->crm & 1 ? GICV3_G0 : GICV3_G1;
+
+ trace_gicv3_icc_ap_write(regno, gicv3_redist_affid(cs), value);
+
+ if (grp == GICV3_G1 && gicv3_use_ns_bank(env)) {
+ grp = GICV3_G1NS;
+ }
+
+ /* It's not possible to claim that a Non-secure interrupt is active
+ * at a priority outside the Non-secure range (128..255), since this
+ * would otherwise allow malicious NS code to block delivery of S interrupts
+ * by writing a bad value to these registers.
+ */
+ if (grp == GICV3_G1NS && regno < 2 && arm_feature(env, ARM_FEATURE_EL3)) {
+ return;
+ }
+
+ cs->icc_apr[grp][regno] = value & 0xFFFFFFFFU;
+ gicv3_cpuif_update(cs);
+}
+
+static void icc_dir_write(CPUARMState *env, const ARMCPRegInfo *ri,
+ uint64_t value)
+{
+ /* Deactivate interrupt */
+ GICv3CPUState *cs = icc_cs_from_env(env);
+ int irq = value & 0xffffff;
+ bool irq_is_secure, single_sec_state, irq_is_grp0;
+ bool route_fiq_to_el3, route_irq_to_el3, route_fiq_to_el2, route_irq_to_el2;
+
+ trace_gicv3_icc_dir_write(gicv3_redist_affid(cs), value);
+
+ if (irq >= cs->gic->num_irq) {
+ /* Also catches special interrupt numbers and LPIs */
+ return;
+ }
+
+ if (!icc_eoi_split(env, cs)) {
+ return;
+ }
+
+ int grp = gicv3_irq_group(cs->gic, cs, irq);
+
+ single_sec_state = cs->gic->gicd_ctlr & GICD_CTLR_DS;
+ irq_is_secure = !single_sec_state && (grp != GICV3_G1NS);
+ irq_is_grp0 = grp == GICV3_G0;
+
+ /* Check whether we're allowed to deactivate this interrupt based
+ * on its group and the current CPU state.
+ * These checks are laid out to correspond to the spec's pseudocode.
+ */
+ route_fiq_to_el3 = env->cp15.scr_el3 & SCR_FIQ;
+ route_irq_to_el3 = env->cp15.scr_el3 & SCR_IRQ;
+ /* No need to include !IsSecure in route_*_to_el2 as it's only
+ * tested in cases where we know !IsSecure is true.
+ */
+ route_fiq_to_el2 = env->cp15.hcr_el2 & HCR_FMO;
+ route_irq_to_el2 = env->cp15.hcr_el2 & HCR_FMO;
+
+ switch (arm_current_el(env)) {
+ case 3:
+ break;
+ case 2:
+ if (single_sec_state && irq_is_grp0 && !route_fiq_to_el3) {
+ break;
+ }
+ if (!irq_is_secure && !irq_is_grp0 && !route_irq_to_el3) {
+ break;
+ }
+ return;
+ case 1:
+ if (!arm_is_secure_below_el3(env)) {
+ if (single_sec_state && irq_is_grp0 &&
+ !route_fiq_to_el3 && !route_fiq_to_el2) {
+ break;
+ }
+ if (!irq_is_secure && !irq_is_grp0 &&
+ !route_irq_to_el3 && !route_irq_to_el2) {
+ break;
+ }
+ } else {
+ if (irq_is_grp0 && !route_fiq_to_el3) {
+ break;
+ }
+ if (!irq_is_grp0 &&
+ (!irq_is_secure || !single_sec_state) &&
+ !route_irq_to_el3) {
+ break;
+ }
+ }
+ return;
+ default:
+ g_assert_not_reached();
+ }
+
+ icc_deactivate_irq(cs, irq);
+}
+
+static uint64_t icc_rpr_read(CPUARMState *env, const ARMCPRegInfo *ri)
+{
+ GICv3CPUState *cs = icc_cs_from_env(env);
+ int prio = icc_highest_active_prio(cs);
+
+ if (arm_feature(env, ARM_FEATURE_EL3) &&
+ !arm_is_secure(env) && (env->cp15.scr_el3 & SCR_FIQ)) {
+ /* NS GIC access and Group 0 is inaccessible to NS */
+ if (prio & 0x80) {
+ /* NS mustn't see priorities in the Secure half of the range */
+ prio = 0;
+ } else if (prio != 0xff) {
+ /* Non-idle priority: show the Non-secure view of it */
+ prio = (prio << 1) & 0xff;
+ }
+ }
+
+ trace_gicv3_icc_rpr_read(gicv3_redist_affid(cs), prio);
+ return prio;
+}
+
+static void icc_generate_sgi(CPUARMState *env, GICv3CPUState *cs,
+ uint64_t value, int grp, bool ns)
+{
+ GICv3State *s = cs->gic;
+
+ /* Extract Aff3/Aff2/Aff1 and shift into the bottom 24 bits */
+ uint64_t aff = extract64(value, 48, 8) << 16 |
+ extract64(value, 32, 8) << 8 |
+ extract64(value, 16, 8);
+ uint32_t targetlist = extract64(value, 0, 16);
+ uint32_t irq = extract64(value, 24, 4);
+ bool irm = extract64(value, 40, 1);
+ int i;
+
+ if (grp == GICV3_G1 && s->gicd_ctlr & GICD_CTLR_DS) {
+ /* If GICD_CTLR.DS == 1, the Distributor treats Secure Group 1
+ * interrupts as Group 0 interrupts and must send Secure Group 0
+ * interrupts to the target CPUs.
+ */
+ grp = GICV3_G0;
+ }
+
+ trace_gicv3_icc_generate_sgi(gicv3_redist_affid(cs), irq, irm,
+ aff, targetlist);
+
+ for (i = 0; i < s->num_cpu; i++) {
+ GICv3CPUState *ocs = &s->cpu[i];
+
+ if (irm) {
+ /* IRM == 1 : route to all CPUs except self */
+ if (cs == ocs) {
+ continue;
+ }
+ } else {
+ /* IRM == 0 : route to Aff3.Aff2.Aff1.n for all n in [0..15]
+ * where the corresponding bit is set in targetlist
+ */
+ int aff0;
+
+ if (ocs->gicr_typer >> 40 != aff) {
+ continue;
+ }
+ aff0 = extract64(ocs->gicr_typer, 32, 8);
+ if (aff0 > 15 || extract32(targetlist, aff0, 1) == 0) {
+ continue;
+ }
+ }
+
+ /* The redistributor will check against its own GICR_NSACR as needed */
+ gicv3_redist_send_sgi(ocs, grp, irq, ns);
+ }
+}
+
+static void icc_sgi0r_write(CPUARMState *env, const ARMCPRegInfo *ri,
+ uint64_t value)
+{
+ /* Generate Secure Group 0 SGI. */
+ GICv3CPUState *cs = icc_cs_from_env(env);
+ bool ns = !arm_is_secure(env);
+
+ icc_generate_sgi(env, cs, value, GICV3_G0, ns);
+}
+
+static void icc_sgi1r_write(CPUARMState *env, const ARMCPRegInfo *ri,
+ uint64_t value)
+{
+ /* Generate Group 1 SGI for the current Security state */
+ GICv3CPUState *cs = icc_cs_from_env(env);
+ int grp;
+ bool ns = !arm_is_secure(env);
+
+ grp = ns ? GICV3_G1NS : GICV3_G1;
+ icc_generate_sgi(env, cs, value, grp, ns);
+}
+
+static void icc_asgi1r_write(CPUARMState *env, const ARMCPRegInfo *ri,
+ uint64_t value)
+{
+ /* Generate Group 1 SGI for the Security state that is not
+ * the current state
+ */
+ GICv3CPUState *cs = icc_cs_from_env(env);
+ int grp;
+ bool ns = !arm_is_secure(env);
+
+ grp = ns ? GICV3_G1 : GICV3_G1NS;
+ icc_generate_sgi(env, cs, value, grp, ns);
+}
+
+static uint64_t icc_igrpen_read(CPUARMState *env, const ARMCPRegInfo *ri)
+{
+ GICv3CPUState *cs = icc_cs_from_env(env);
+ int grp = ri->opc2 & 1 ? GICV3_G1 : GICV3_G0;
+ uint64_t value;
+
+ if (grp == GICV3_G1 && gicv3_use_ns_bank(env)) {
+ grp = GICV3_G1NS;
+ }
+
+ value = cs->icc_igrpen[grp];
+ trace_gicv3_icc_igrpen_read(gicv3_redist_affid(cs), value);
+ return value;
+}
+
+static void icc_igrpen_write(CPUARMState *env, const ARMCPRegInfo *ri,
+ uint64_t value)
+{
+ GICv3CPUState *cs = icc_cs_from_env(env);
+ int grp = ri->opc2 & 1 ? GICV3_G1 : GICV3_G0;
+
+ trace_gicv3_icc_igrpen_write(gicv3_redist_affid(cs), value);
+
+ if (grp == GICV3_G1 && gicv3_use_ns_bank(env)) {
+ grp = GICV3_G1NS;
+ }
+
+ cs->icc_igrpen[grp] = value & ICC_IGRPEN_ENABLE;
+ gicv3_cpuif_update(cs);
+}
+
+static uint64_t icc_igrpen1_el3_read(CPUARMState *env, const ARMCPRegInfo *ri)
+{
+ GICv3CPUState *cs = icc_cs_from_env(env);
+
+ /* IGRPEN1_EL3 bits 0 and 1 are r/w aliases into IGRPEN1_EL1 NS and S */
+ return cs->icc_igrpen[GICV3_G1NS] | (cs->icc_igrpen[GICV3_G1] << 1);
+}
+
+static void icc_igrpen1_el3_write(CPUARMState *env, const ARMCPRegInfo *ri,
+ uint64_t value)
+{
+ GICv3CPUState *cs = icc_cs_from_env(env);
+
+ trace_gicv3_icc_igrpen1_el3_write(gicv3_redist_affid(cs), value);
+
+ /* IGRPEN1_EL3 bits 0 and 1 are r/w aliases into IGRPEN1_EL1 NS and S */
+ cs->icc_igrpen[GICV3_G1NS] = extract32(value, 0, 1);
+ cs->icc_igrpen[GICV3_G1] = extract32(value, 1, 1);
+ gicv3_cpuif_update(cs);
+}
+
+static uint64_t icc_ctlr_el1_read(CPUARMState *env, const ARMCPRegInfo *ri)
+{
+ GICv3CPUState *cs = icc_cs_from_env(env);
+ int bank = gicv3_use_ns_bank(env) ? GICV3_NS : GICV3_S;
+ uint64_t value;
+
+ value = cs->icc_ctlr_el1[bank];
+ trace_gicv3_icc_ctlr_read(gicv3_redist_affid(cs), value);
+ return value;
+}
+
+static void icc_ctlr_el1_write(CPUARMState *env, const ARMCPRegInfo *ri,
+ uint64_t value)
+{
+ GICv3CPUState *cs = icc_cs_from_env(env);
+ int bank = gicv3_use_ns_bank(env) ? GICV3_NS : GICV3_S;
+ uint64_t mask;
+
+ trace_gicv3_icc_ctlr_write(gicv3_redist_affid(cs), value);
+
+ /* Only CBPR and EOIMODE can be RW;
+ * for us PMHE is RAZ/WI (we don't implement 1-of-N interrupts or
+ * the asseciated priority-based routing of them);
+ * if EL3 is implemented and GICD_CTLR.DS == 0, then PMHE and CBPR are RO.
+ */
+ if (arm_feature(env, ARM_FEATURE_EL3) &&
+ ((cs->gic->gicd_ctlr & GICD_CTLR_DS) == 0)) {
+ mask = ICC_CTLR_EL1_EOIMODE;
+ } else {
+ mask = ICC_CTLR_EL1_CBPR | ICC_CTLR_EL1_EOIMODE;
+ }
+
+ cs->icc_ctlr_el1[bank] &= ~mask;
+ cs->icc_ctlr_el1[bank] |= (value & mask);
+ gicv3_cpuif_update(cs);
+}
+
+
+static uint64_t icc_ctlr_el3_read(CPUARMState *env, const ARMCPRegInfo *ri)
+{
+ GICv3CPUState *cs = icc_cs_from_env(env);
+ uint64_t value;
+
+ value = cs->icc_ctlr_el3;
+ if (cs->icc_ctlr_el1[GICV3_NS] & ICC_CTLR_EL1_EOIMODE) {
+ value |= ICC_CTLR_EL3_EOIMODE_EL1NS;
+ }
+ if (cs->icc_ctlr_el1[GICV3_NS] & ICC_CTLR_EL1_CBPR) {
+ value |= ICC_CTLR_EL3_CBPR_EL1NS;
+ }
+ if (cs->icc_ctlr_el1[GICV3_NS] & ICC_CTLR_EL1_EOIMODE) {
+ value |= ICC_CTLR_EL3_EOIMODE_EL1S;
+ }
+ if (cs->icc_ctlr_el1[GICV3_NS] & ICC_CTLR_EL1_CBPR) {
+ value |= ICC_CTLR_EL3_CBPR_EL1S;
+ }
+
+ trace_gicv3_icc_ctlr_el3_read(gicv3_redist_affid(cs), value);
+ return value;
+}
+
+static void icc_ctlr_el3_write(CPUARMState *env, const ARMCPRegInfo *ri,
+ uint64_t value)
+{
+ GICv3CPUState *cs = icc_cs_from_env(env);
+ uint64_t mask;
+
+ trace_gicv3_icc_ctlr_el3_write(gicv3_redist_affid(cs), value);
+
+ /* *_EL1NS and *_EL1S bits are aliases into the ICC_CTLR_EL1 bits. */
+ cs->icc_ctlr_el1[GICV3_NS] &= (ICC_CTLR_EL1_CBPR | ICC_CTLR_EL1_EOIMODE);
+ if (value & ICC_CTLR_EL3_EOIMODE_EL1NS) {
+ cs->icc_ctlr_el1[GICV3_NS] |= ICC_CTLR_EL1_EOIMODE;
+ }
+ if (value & ICC_CTLR_EL3_CBPR_EL1NS) {
+ cs->icc_ctlr_el1[GICV3_NS] |= ICC_CTLR_EL1_CBPR;
+ }
+
+ cs->icc_ctlr_el1[GICV3_S] &= (ICC_CTLR_EL1_CBPR | ICC_CTLR_EL1_EOIMODE);
+ if (value & ICC_CTLR_EL3_EOIMODE_EL1S) {
+ cs->icc_ctlr_el1[GICV3_S] |= ICC_CTLR_EL1_EOIMODE;
+ }
+ if (value & ICC_CTLR_EL3_CBPR_EL1S) {
+ cs->icc_ctlr_el1[GICV3_S] |= ICC_CTLR_EL1_CBPR;
+ }
+
+ /* The only bit stored in icc_ctlr_el3 which is writeable is EOIMODE_EL3: */
+ mask = ICC_CTLR_EL3_EOIMODE_EL3;
+
+ cs->icc_ctlr_el3 &= ~mask;
+ cs->icc_ctlr_el3 |= (value & mask);
+ gicv3_cpuif_update(cs);
+}
+
+static CPAccessResult gicv3_irqfiq_access(CPUARMState *env,
+ const ARMCPRegInfo *ri, bool isread)
+{
+ CPAccessResult r = CP_ACCESS_OK;
+
+ if ((env->cp15.scr_el3 & (SCR_FIQ | SCR_IRQ)) == (SCR_FIQ | SCR_IRQ)) {
+ switch (arm_current_el(env)) {
+ case 1:
+ if (arm_is_secure_below_el3(env) ||
+ ((env->cp15.hcr_el2 & (HCR_IMO | HCR_FMO)) == 0)) {
+ r = CP_ACCESS_TRAP_EL3;
+ }
+ break;
+ case 2:
+ r = CP_ACCESS_TRAP_EL3;
+ break;
+ case 3:
+ if (!is_a64(env) && !arm_is_el3_or_mon(env)) {
+ r = CP_ACCESS_TRAP_EL3;
+ }
+ default:
+ g_assert_not_reached();
+ }
+ }
+
+ if (r == CP_ACCESS_TRAP_EL3 && !arm_el_is_aa64(env, 3)) {
+ r = CP_ACCESS_TRAP;
+ }
+ return r;
+}
+
+static CPAccessResult gicv3_fiq_access(CPUARMState *env,
+ const ARMCPRegInfo *ri, bool isread)
+{
+ CPAccessResult r = CP_ACCESS_OK;
+
+ if (env->cp15.scr_el3 & SCR_FIQ) {
+ switch (arm_current_el(env)) {
+ case 1:
+ if (arm_is_secure_below_el3(env) ||
+ ((env->cp15.hcr_el2 & HCR_FMO) == 0)) {
+ r = CP_ACCESS_TRAP_EL3;
+ }
+ break;
+ case 2:
+ r = CP_ACCESS_TRAP_EL3;
+ break;
+ case 3:
+ if (!is_a64(env) && !arm_is_el3_or_mon(env)) {
+ r = CP_ACCESS_TRAP_EL3;
+ }
+ default:
+ g_assert_not_reached();
+ }
+ }
+
+ if (r == CP_ACCESS_TRAP_EL3 && !arm_el_is_aa64(env, 3)) {
+ r = CP_ACCESS_TRAP;
+ }
+ return r;
+}
+
+static CPAccessResult gicv3_irq_access(CPUARMState *env,
+ const ARMCPRegInfo *ri, bool isread)
+{
+ CPAccessResult r = CP_ACCESS_OK;
+
+ if (env->cp15.scr_el3 & SCR_IRQ) {
+ switch (arm_current_el(env)) {
+ case 1:
+ if (arm_is_secure_below_el3(env) ||
+ ((env->cp15.hcr_el2 & HCR_IMO) == 0)) {
+ r = CP_ACCESS_TRAP_EL3;
+ }
+ break;
+ case 2:
+ r = CP_ACCESS_TRAP_EL3;
+ break;
+ case 3:
+ if (!is_a64(env) && !arm_is_el3_or_mon(env)) {
+ r = CP_ACCESS_TRAP_EL3;
+ }
+ break;
+ default:
+ g_assert_not_reached();
+ }
+ }
+
+ if (r == CP_ACCESS_TRAP_EL3 && !arm_el_is_aa64(env, 3)) {
+ r = CP_ACCESS_TRAP;
+ }
+ return r;
+}
+
+static void icc_reset(CPUARMState *env, const ARMCPRegInfo *ri)
+{
+ GICv3CPUState *cs = icc_cs_from_env(env);
+
+ cs->icc_ctlr_el1[GICV3_S] = ICC_CTLR_EL1_A3V |
+ (1 << ICC_CTLR_EL1_IDBITS_SHIFT) |
+ (7 << ICC_CTLR_EL1_PRIBITS_SHIFT);
+ cs->icc_ctlr_el1[GICV3_NS] = ICC_CTLR_EL1_A3V |
+ (1 << ICC_CTLR_EL1_IDBITS_SHIFT) |
+ (7 << ICC_CTLR_EL1_PRIBITS_SHIFT);
+ cs->icc_pmr_el1 = 0;
+ cs->icc_bpr[GICV3_G0] = GIC_MIN_BPR;
+ cs->icc_bpr[GICV3_G1] = GIC_MIN_BPR;
+ if (arm_feature(env, ARM_FEATURE_EL3)) {
+ cs->icc_bpr[GICV3_G1NS] = GIC_MIN_BPR_NS;
+ } else {
+ cs->icc_bpr[GICV3_G1NS] = GIC_MIN_BPR;
+ }
+ memset(cs->icc_apr, 0, sizeof(cs->icc_apr));
+ memset(cs->icc_igrpen, 0, sizeof(cs->icc_igrpen));
+ cs->icc_ctlr_el3 = ICC_CTLR_EL3_NDS | ICC_CTLR_EL3_A3V |
+ (1 << ICC_CTLR_EL3_IDBITS_SHIFT) |
+ (7 << ICC_CTLR_EL3_PRIBITS_SHIFT);
+}
+
+static const ARMCPRegInfo gicv3_cpuif_reginfo[] = {
+ { .name = "ICC_PMR_EL1", .state = ARM_CP_STATE_BOTH,
+ .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 6, .opc2 = 0,
+ .type = ARM_CP_IO | ARM_CP_NO_RAW,
+ .access = PL1_RW, .accessfn = gicv3_irqfiq_access,
+ .readfn = icc_pmr_read,
+ .writefn = icc_pmr_write,
+ /* We hang the whole cpu interface reset routine off here
+ * rather than parcelling it out into one little function
+ * per register
+ */
+ .resetfn = icc_reset,
+ },
+ { .name = "ICC_IAR0_EL1", .state = ARM_CP_STATE_BOTH,
+ .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 8, .opc2 = 0,
+ .type = ARM_CP_IO | ARM_CP_NO_RAW,
+ .access = PL1_R, .accessfn = gicv3_fiq_access,
+ .readfn = icc_iar0_read,
+ },
+ { .name = "ICC_EOIR0_EL1", .state = ARM_CP_STATE_BOTH,
+ .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 8, .opc2 = 1,
+ .type = ARM_CP_IO | ARM_CP_NO_RAW,
+ .access = PL1_W, .accessfn = gicv3_fiq_access,
+ .writefn = icc_eoir_write,
+ },
+ { .name = "ICC_HPPIR0_EL1", .state = ARM_CP_STATE_BOTH,
+ .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 8, .opc2 = 2,
+ .type = ARM_CP_IO | ARM_CP_NO_RAW,
+ .access = PL1_R, .accessfn = gicv3_fiq_access,
+ .readfn = icc_hppir0_read,
+ },
+ { .name = "ICC_BPR0_EL1", .state = ARM_CP_STATE_BOTH,
+ .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 8, .opc2 = 3,
+ .type = ARM_CP_IO | ARM_CP_NO_RAW,
+ .access = PL1_RW, .accessfn = gicv3_fiq_access,
+ .fieldoffset = offsetof(GICv3CPUState, icc_bpr[GICV3_G0]),
+ .writefn = icc_bpr_write,
+ },
+ { .name = "ICC_AP0R0_EL1", .state = ARM_CP_STATE_BOTH,
+ .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 8, .opc2 = 4,
+ .type = ARM_CP_IO | ARM_CP_NO_RAW,
+ .access = PL1_RW, .accessfn = gicv3_fiq_access,
+ .fieldoffset = offsetof(GICv3CPUState, icc_apr[GICV3_G0][0]),
+ .writefn = icc_ap_write,
+ },
+ { .name = "ICC_AP0R1_EL1", .state = ARM_CP_STATE_BOTH,
+ .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 8, .opc2 = 5,
+ .type = ARM_CP_IO | ARM_CP_NO_RAW,
+ .access = PL1_RW, .accessfn = gicv3_fiq_access,
+ .fieldoffset = offsetof(GICv3CPUState, icc_apr[GICV3_G0][1]),
+ .writefn = icc_ap_write,
+ },
+ { .name = "ICC_AP0R2_EL1", .state = ARM_CP_STATE_BOTH,
+ .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 8, .opc2 = 6,
+ .type = ARM_CP_IO | ARM_CP_NO_RAW,
+ .access = PL1_RW, .accessfn = gicv3_fiq_access,
+ .fieldoffset = offsetof(GICv3CPUState, icc_apr[GICV3_G0][2]),
+ .writefn = icc_ap_write,
+ },
+ { .name = "ICC_AP0R3_EL1", .state = ARM_CP_STATE_BOTH,
+ .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 8, .opc2 = 7,
+ .type = ARM_CP_IO | ARM_CP_NO_RAW,
+ .access = PL1_RW, .accessfn = gicv3_fiq_access,
+ .fieldoffset = offsetof(GICv3CPUState, icc_apr[GICV3_G0][3]),
+ .writefn = icc_ap_write,
+ },
+ /* All the ICC_AP1R*_EL1 registers are banked */
+ { .name = "ICC_AP1R0_EL1", .state = ARM_CP_STATE_BOTH,
+ .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 9, .opc2 = 0,
+ .type = ARM_CP_IO | ARM_CP_NO_RAW,
+ .access = PL1_RW, .accessfn = gicv3_irq_access,
+ .readfn = icc_ap_read,
+ .writefn = icc_ap_write,
+ },
+ { .name = "ICC_AP1R1_EL1", .state = ARM_CP_STATE_BOTH,
+ .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 9, .opc2 = 1,
+ .type = ARM_CP_IO | ARM_CP_NO_RAW,
+ .access = PL1_RW, .accessfn = gicv3_irq_access,
+ .readfn = icc_ap_read,
+ .writefn = icc_ap_write,
+ },
+ { .name = "ICC_AP1R2_EL1", .state = ARM_CP_STATE_BOTH,
+ .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 9, .opc2 = 2,
+ .type = ARM_CP_IO | ARM_CP_NO_RAW,
+ .access = PL1_RW, .accessfn = gicv3_irq_access,
+ .readfn = icc_ap_read,
+ .writefn = icc_ap_write,
+ },
+ { .name = "ICC_AP1R3_EL1", .state = ARM_CP_STATE_BOTH,
+ .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 9, .opc2 = 3,
+ .type = ARM_CP_IO | ARM_CP_NO_RAW,
+ .access = PL1_RW, .accessfn = gicv3_irq_access,
+ .readfn = icc_ap_read,
+ .writefn = icc_ap_write,
+ },
+ { .name = "ICC_DIR_EL1", .state = ARM_CP_STATE_BOTH,
+ .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 11, .opc2 = 1,
+ .type = ARM_CP_IO | ARM_CP_NO_RAW,
+ .access = PL1_W, .accessfn = gicv3_irqfiq_access,
+ .writefn = icc_dir_write,
+ },
+ { .name = "ICC_RPR_EL1", .state = ARM_CP_STATE_BOTH,
+ .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 11, .opc2 = 3,
+ .type = ARM_CP_IO | ARM_CP_NO_RAW,
+ .access = PL1_R, .accessfn = gicv3_irqfiq_access,
+ .readfn = icc_rpr_read,
+ },
+ { .name = "ICC_SGI1R_EL1", .state = ARM_CP_STATE_AA64,
+ .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 11, .opc2 = 5,
+ .type = ARM_CP_IO | ARM_CP_NO_RAW,
+ .access = PL1_W, .accessfn = gicv3_irqfiq_access,
+ .writefn = icc_sgi1r_write,
+ },
+ { .name = "ICC_SGI1R",
+ .cp = 15, .opc1 = 0, .crm = 12,
+ .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_NO_RAW,
+ .access = PL1_W, .accessfn = gicv3_irqfiq_access,
+ .writefn = icc_sgi1r_write,
+ },
+ { .name = "ICC_ASGI1R_EL1", .state = ARM_CP_STATE_AA64,
+ .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 11, .opc2 = 6,
+ .type = ARM_CP_IO | ARM_CP_NO_RAW,
+ .access = PL1_W, .accessfn = gicv3_irqfiq_access,
+ .writefn = icc_asgi1r_write,
+ },
+ { .name = "ICC_ASGI1R",
+ .cp = 15, .opc1 = 1, .crm = 12,
+ .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_NO_RAW,
+ .access = PL1_W, .accessfn = gicv3_irqfiq_access,
+ .writefn = icc_asgi1r_write,
+ },
+ { .name = "ICC_SGI0R_EL1", .state = ARM_CP_STATE_AA64,
+ .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 11, .opc2 = 7,
+ .type = ARM_CP_IO | ARM_CP_NO_RAW,
+ .access = PL1_W, .accessfn = gicv3_irqfiq_access,
+ .writefn = icc_sgi0r_write,
+ },
+ { .name = "ICC_SGI0R",
+ .cp = 15, .opc1 = 2, .crm = 12,
+ .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_NO_RAW,
+ .access = PL1_W, .accessfn = gicv3_irqfiq_access,
+ .writefn = icc_sgi0r_write,
+ },
+ { .name = "ICC_IAR1_EL1", .state = ARM_CP_STATE_BOTH,
+ .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 12, .opc2 = 0,
+ .type = ARM_CP_IO | ARM_CP_NO_RAW,
+ .access = PL1_R, .accessfn = gicv3_irq_access,
+ .readfn = icc_iar1_read,
+ },
+ { .name = "ICC_EOIR1_EL1", .state = ARM_CP_STATE_BOTH,
+ .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 12, .opc2 = 1,
+ .type = ARM_CP_IO | ARM_CP_NO_RAW,
+ .access = PL1_W, .accessfn = gicv3_irq_access,
+ .writefn = icc_eoir_write,
+ },
+ { .name = "ICC_HPPIR1_EL1", .state = ARM_CP_STATE_BOTH,
+ .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 12, .opc2 = 2,
+ .type = ARM_CP_IO | ARM_CP_NO_RAW,
+ .access = PL1_R, .accessfn = gicv3_irq_access,
+ .readfn = icc_hppir1_read,
+ },
+ /* This register is banked */
+ { .name = "ICC_BPR1_EL1", .state = ARM_CP_STATE_BOTH,
+ .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 12, .opc2 = 3,
+ .type = ARM_CP_IO | ARM_CP_NO_RAW,
+ .access = PL1_RW, .accessfn = gicv3_irq_access,
+ .readfn = icc_bpr_read,
+ .writefn = icc_bpr_write,
+ },
+ /* This register is banked */
+ { .name = "ICC_CTLR_EL1", .state = ARM_CP_STATE_BOTH,
+ .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 12, .opc2 = 4,
+ .type = ARM_CP_IO | ARM_CP_NO_RAW,
+ .access = PL1_RW, .accessfn = gicv3_irqfiq_access,
+ .readfn = icc_ctlr_el1_read,
+ .writefn = icc_ctlr_el1_write,
+ },
+ { .name = "ICC_SRE_EL1", .state = ARM_CP_STATE_BOTH,
+ .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 12, .opc2 = 5,
+ .type = ARM_CP_NO_RAW | ARM_CP_CONST,
+ .access = PL1_RW,
+ /* We don't support IRQ/FIQ bypass and system registers are
+ * always enabled, so all our bits are RAZ/WI or RAO/WI.
+ * This register is banked but since it's constant we don't
+ * need to do anything special.
+ */
+ .resetvalue = 0x7,
+ },
+ { .name = "ICC_IGRPEN0_EL1", .state = ARM_CP_STATE_BOTH,
+ .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 12, .opc2 = 6,
+ .type = ARM_CP_IO | ARM_CP_NO_RAW,
+ .access = PL1_RW, .accessfn = gicv3_fiq_access,
+ .fieldoffset = offsetof(GICv3CPUState, icc_igrpen[GICV3_G0]),
+ .writefn = icc_igrpen_write,
+ },
+ /* This register is banked */
+ { .name = "ICC_IGRPEN1_EL1", .state = ARM_CP_STATE_BOTH,
+ .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 12, .opc2 = 7,
+ .type = ARM_CP_IO | ARM_CP_NO_RAW,
+ .access = PL1_RW, .accessfn = gicv3_irq_access,
+ .readfn = icc_igrpen_read,
+ .writefn = icc_igrpen_write,
+ },
+ { .name = "ICC_SRE_EL2", .state = ARM_CP_STATE_BOTH,
+ .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 9, .opc2 = 5,
+ .type = ARM_CP_NO_RAW | ARM_CP_CONST,
+ .access = PL2_RW,
+ /* We don't support IRQ/FIQ bypass and system registers are
+ * always enabled, so all our bits are RAZ/WI or RAO/WI.
+ */
+ .resetvalue = 0xf,
+ },
+ { .name = "ICC_CTLR_EL3", .state = ARM_CP_STATE_BOTH,
+ .opc0 = 3, .opc1 = 6, .crn = 12, .crm = 12, .opc2 = 4,
+ .type = ARM_CP_IO | ARM_CP_NO_RAW,
+ .access = PL3_RW,
+ .fieldoffset = offsetof(GICv3CPUState, icc_ctlr_el3),
+ .readfn = icc_ctlr_el3_read,
+ .writefn = icc_ctlr_el3_write,
+ },
+ { .name = "ICC_SRE_EL3", .state = ARM_CP_STATE_BOTH,
+ .opc0 = 3, .opc1 = 6, .crn = 12, .crm = 12, .opc2 = 5,
+ .type = ARM_CP_NO_RAW | ARM_CP_CONST,
+ .access = PL3_RW,
+ /* We don't support IRQ/FIQ bypass and system registers are
+ * always enabled, so all our bits are RAZ/WI or RAO/WI.
+ */
+ .resetvalue = 0xf,
+ },
+ { .name = "ICC_IGRPEN1_EL3", .state = ARM_CP_STATE_BOTH,
+ .opc0 = 3, .opc1 = 6, .crn = 12, .crm = 12, .opc2 = 7,
+ .type = ARM_CP_IO | ARM_CP_NO_RAW,
+ .access = PL3_RW,
+ .readfn = icc_igrpen1_el3_read,
+ .writefn = icc_igrpen1_el3_write,
+ },
+ REGINFO_SENTINEL
+};
+
+static void gicv3_cpuif_el_change_hook(ARMCPU *cpu, void *opaque)
+{
+ GICv3CPUState *cs = opaque;
+
+ gicv3_cpuif_update(cs);
+}
+
+void gicv3_init_cpuif(GICv3State *s)
+{
+ /* Called from the GICv3 realize function; register our system
+ * registers with the CPU
+ */
+ int i;
+
+ for (i = 0; i < s->num_cpu; i++) {
+ ARMCPU *cpu = ARM_CPU(qemu_get_cpu(i));
+ GICv3CPUState *cs = &s->cpu[i];
+
+ /* Note that we can't just use the GICv3CPUState as an opaque pointer
+ * in define_arm_cp_regs_with_opaque(), because when we're called back
+ * it might be with code translated by CPU 0 but run by CPU 1, in
+ * which case we'd get the wrong value.
+ * So instead we define the regs with no ri->opaque info, and
+ * get back to the GICv3CPUState from the ARMCPU by reading back
+ * the opaque pointer from the el_change_hook, which we're going
+ * to need to register anyway.
+ */
+ define_arm_cp_regs(cpu, gicv3_cpuif_reginfo);
+ arm_register_el_change_hook(cpu, gicv3_cpuif_el_change_hook, cs);
+ }
+}
diff --git a/hw/intc/arm_gicv3_dist.c b/hw/intc/arm_gicv3_dist.c
new file mode 100644
index 0000000000..b977ae5984
--- /dev/null
+++ b/hw/intc/arm_gicv3_dist.c
@@ -0,0 +1,879 @@
+/*
+ * ARM GICv3 emulation: Distributor
+ *
+ * Copyright (c) 2015 Huawei.
+ * Copyright (c) 2016 Linaro Limited.
+ * Written by Shlomo Pongratz, Peter Maydell
+ *
+ * This code is licensed under the GPL, version 2 or (at your option)
+ * any later version.
+ */
+
+#include "qemu/osdep.h"
+#include "trace.h"
+#include "gicv3_internal.h"
+
+/* The GICD_NSACR registers contain a two bit field for each interrupt which
+ * allows the guest to give NonSecure code access to registers controlling
+ * Secure interrupts:
+ * 0b00: no access (NS accesses to bits for Secure interrupts will RAZ/WI)
+ * 0b01: NS r/w accesses permitted to ISPENDR, SETSPI_NSR, SGIR
+ * 0b10: as 0b01, and also r/w to ICPENDR, r/o to ISACTIVER/ICACTIVER,
+ * and w/o to CLRSPI_NSR
+ * 0b11: as 0b10, and also r/w to IROUTER and ITARGETSR
+ *
+ * Given a (multiple-of-32) interrupt number, these mask functions return
+ * a mask word where each bit is 1 if the NSACR settings permit access
+ * to the interrupt. The mask returned can then be ORed with the GICD_GROUP
+ * word for this set of interrupts to give an overall mask.
+ */
+
+typedef uint32_t maskfn(GICv3State *s, int irq);
+
+static uint32_t mask_nsacr_ge1(GICv3State *s, int irq)
+{
+ /* Return a mask where each bit is set if the NSACR field is >= 1 */
+ uint64_t raw_nsacr = s->gicd_nsacr[irq / 16 + 1];
+
+ raw_nsacr = raw_nsacr << 32 | s->gicd_nsacr[irq / 16];
+ raw_nsacr = (raw_nsacr >> 1) | raw_nsacr;
+ return half_unshuffle64(raw_nsacr);
+}
+
+static uint32_t mask_nsacr_ge2(GICv3State *s, int irq)
+{
+ /* Return a mask where each bit is set if the NSACR field is >= 2 */
+ uint64_t raw_nsacr = s->gicd_nsacr[irq / 16 + 1];
+
+ raw_nsacr = raw_nsacr << 32 | s->gicd_nsacr[irq / 16];
+ raw_nsacr = raw_nsacr >> 1;
+ return half_unshuffle64(raw_nsacr);
+}
+
+/* We don't need a mask_nsacr_ge3() because IROUTER<n> isn't a bitmap register,
+ * but it would be implemented using:
+ * raw_nsacr = (raw_nsacr >> 1) & raw_nsacr;
+ */
+
+static uint32_t mask_group_and_nsacr(GICv3State *s, MemTxAttrs attrs,
+ maskfn *maskfn, int irq)
+{
+ /* Return a 32-bit mask which should be applied for this set of 32
+ * interrupts; each bit is 1 if access is permitted by the
+ * combination of attrs.secure, GICD_GROUPR and GICD_NSACR.
+ */
+ uint32_t mask;
+
+ if (!attrs.secure && !(s->gicd_ctlr & GICD_CTLR_DS)) {
+ /* bits for Group 0 or Secure Group 1 interrupts are RAZ/WI
+ * unless the NSACR bits permit access.
+ */
+ mask = *gic_bmp_ptr32(s->group, irq);
+ if (maskfn) {
+ mask |= maskfn(s, irq);
+ }
+ return mask;
+ }
+ return 0xFFFFFFFFU;
+}
+
+static int gicd_ns_access(GICv3State *s, int irq)
+{
+ /* Return the 2 bit NS_access<x> field from GICD_NSACR<n> for the
+ * specified interrupt.
+ */
+ if (irq < GIC_INTERNAL || irq >= s->num_irq) {
+ return 0;
+ }
+ return extract32(s->gicd_nsacr[irq / 16], (irq % 16) * 2, 2);
+}
+
+static void gicd_write_set_bitmap_reg(GICv3State *s, MemTxAttrs attrs,
+ uint32_t *bmp,
+ maskfn *maskfn,
+ int offset, uint32_t val)
+{
+ /* Helper routine to implement writing to a "set-bitmap" register
+ * (GICD_ISENABLER, GICD_ISPENDR, etc).
+ * Semantics implemented here:
+ * RAZ/WI for SGIs, PPIs, unimplemented IRQs
+ * Bits corresponding to Group 0 or Secure Group 1 interrupts RAZ/WI.
+ * Writing 1 means "set bit in bitmap"; writing 0 is ignored.
+ * offset should be the offset in bytes of the register from the start
+ * of its group.
+ */
+ int irq = offset * 8;
+
+ if (irq < GIC_INTERNAL || irq >= s->num_irq) {
+ return;
+ }
+ val &= mask_group_and_nsacr(s, attrs, maskfn, irq);
+ *gic_bmp_ptr32(bmp, irq) |= val;
+ gicv3_update(s, irq, 32);
+}
+
+static void gicd_write_clear_bitmap_reg(GICv3State *s, MemTxAttrs attrs,
+ uint32_t *bmp,
+ maskfn *maskfn,
+ int offset, uint32_t val)
+{
+ /* Helper routine to implement writing to a "clear-bitmap" register
+ * (GICD_ICENABLER, GICD_ICPENDR, etc).
+ * Semantics implemented here:
+ * RAZ/WI for SGIs, PPIs, unimplemented IRQs
+ * Bits corresponding to Group 0 or Secure Group 1 interrupts RAZ/WI.
+ * Writing 1 means "clear bit in bitmap"; writing 0 is ignored.
+ * offset should be the offset in bytes of the register from the start
+ * of its group.
+ */
+ int irq = offset * 8;
+
+ if (irq < GIC_INTERNAL || irq >= s->num_irq) {
+ return;
+ }
+ val &= mask_group_and_nsacr(s, attrs, maskfn, irq);
+ *gic_bmp_ptr32(bmp, irq) &= ~val;
+ gicv3_update(s, irq, 32);
+}
+
+static uint32_t gicd_read_bitmap_reg(GICv3State *s, MemTxAttrs attrs,
+ uint32_t *bmp,
+ maskfn *maskfn,
+ int offset)
+{
+ /* Helper routine to implement reading a "set/clear-bitmap" register
+ * (GICD_ICENABLER, GICD_ISENABLER, GICD_ICPENDR, etc).
+ * Semantics implemented here:
+ * RAZ/WI for SGIs, PPIs, unimplemented IRQs
+ * Bits corresponding to Group 0 or Secure Group 1 interrupts RAZ/WI.
+ * offset should be the offset in bytes of the register from the start
+ * of its group.
+ */
+ int irq = offset * 8;
+ uint32_t val;
+
+ if (irq < GIC_INTERNAL || irq >= s->num_irq) {
+ return 0;
+ }
+ val = *gic_bmp_ptr32(bmp, irq);
+ if (bmp == s->pending) {
+ /* The PENDING register is a special case -- for level triggered
+ * interrupts, the PENDING state is the logical OR of the state of
+ * the PENDING latch with the input line level.
+ */
+ uint32_t edge = *gic_bmp_ptr32(s->edge_trigger, irq);
+ uint32_t level = *gic_bmp_ptr32(s->level, irq);
+ val |= (~edge & level);
+ }
+ val &= mask_group_and_nsacr(s, attrs, maskfn, irq);
+ return val;
+}
+
+static uint8_t gicd_read_ipriorityr(GICv3State *s, MemTxAttrs attrs, int irq)
+{
+ /* Read the value of GICD_IPRIORITYR<n> for the specified interrupt,
+ * honouring security state (these are RAZ/WI for Group 0 or Secure
+ * Group 1 interrupts).
+ */
+ uint32_t prio;
+
+ if (irq < GIC_INTERNAL || irq >= s->num_irq) {
+ return 0;
+ }
+
+ prio = s->gicd_ipriority[irq];
+
+ if (!attrs.secure && !(s->gicd_ctlr & GICD_CTLR_DS)) {
+ if (!gicv3_gicd_group_test(s, irq)) {
+ /* Fields for Group 0 or Secure Group 1 interrupts are RAZ/WI */
+ return 0;
+ }
+ /* NS view of the interrupt priority */
+ prio = (prio << 1) & 0xff;
+ }
+ return prio;
+}
+
+static void gicd_write_ipriorityr(GICv3State *s, MemTxAttrs attrs, int irq,
+ uint8_t value)
+{
+ /* Write the value of GICD_IPRIORITYR<n> for the specified interrupt,
+ * honouring security state (these are RAZ/WI for Group 0 or Secure
+ * Group 1 interrupts).
+ */
+ if (irq < GIC_INTERNAL || irq >= s->num_irq) {
+ return;
+ }
+
+ if (!attrs.secure && !(s->gicd_ctlr & GICD_CTLR_DS)) {
+ if (!gicv3_gicd_group_test(s, irq)) {
+ /* Fields for Group 0 or Secure Group 1 interrupts are RAZ/WI */
+ return;
+ }
+ /* NS view of the interrupt priority */
+ value = 0x80 | (value >> 1);
+ }
+ s->gicd_ipriority[irq] = value;
+}
+
+static uint64_t gicd_read_irouter(GICv3State *s, MemTxAttrs attrs, int irq)
+{
+ /* Read the value of GICD_IROUTER<n> for the specified interrupt,
+ * honouring security state.
+ */
+ if (irq < GIC_INTERNAL || irq >= s->num_irq) {
+ return 0;
+ }
+
+ if (!attrs.secure && !(s->gicd_ctlr & GICD_CTLR_DS)) {
+ /* RAZ/WI for NS accesses to secure interrupts */
+ if (!gicv3_gicd_group_test(s, irq)) {
+ if (gicd_ns_access(s, irq) != 3) {
+ return 0;
+ }
+ }
+ }
+
+ return s->gicd_irouter[irq];
+}
+
+static void gicd_write_irouter(GICv3State *s, MemTxAttrs attrs, int irq,
+ uint64_t val)
+{
+ /* Write the value of GICD_IROUTER<n> for the specified interrupt,
+ * honouring security state.
+ */
+ if (irq < GIC_INTERNAL || irq >= s->num_irq) {
+ return;
+ }
+
+ if (!attrs.secure && !(s->gicd_ctlr & GICD_CTLR_DS)) {
+ /* RAZ/WI for NS accesses to secure interrupts */
+ if (!gicv3_gicd_group_test(s, irq)) {
+ if (gicd_ns_access(s, irq) != 3) {
+ return;
+ }
+ }
+ }
+
+ s->gicd_irouter[irq] = val;
+ gicv3_cache_target_cpustate(s, irq);
+ gicv3_update(s, irq, 1);
+}
+
+static MemTxResult gicd_readb(GICv3State *s, hwaddr offset,
+ uint64_t *data, MemTxAttrs attrs)
+{
+ /* Most GICv3 distributor registers do not support byte accesses. */
+ switch (offset) {
+ case GICD_CPENDSGIR ... GICD_CPENDSGIR + 0xf:
+ case GICD_SPENDSGIR ... GICD_SPENDSGIR + 0xf:
+ case GICD_ITARGETSR ... GICD_ITARGETSR + 0x3ff:
+ /* This GIC implementation always has affinity routing enabled,
+ * so these registers are all RAZ/WI.
+ */
+ return MEMTX_OK;
+ case GICD_IPRIORITYR ... GICD_IPRIORITYR + 0x3ff:
+ *data = gicd_read_ipriorityr(s, attrs, offset - GICD_IPRIORITYR);
+ return MEMTX_OK;
+ default:
+ return MEMTX_ERROR;
+ }
+}
+
+static MemTxResult gicd_writeb(GICv3State *s, hwaddr offset,
+ uint64_t value, MemTxAttrs attrs)
+{
+ /* Most GICv3 distributor registers do not support byte accesses. */
+ switch (offset) {
+ case GICD_CPENDSGIR ... GICD_CPENDSGIR + 0xf:
+ case GICD_SPENDSGIR ... GICD_SPENDSGIR + 0xf:
+ case GICD_ITARGETSR ... GICD_ITARGETSR + 0x3ff:
+ /* This GIC implementation always has affinity routing enabled,
+ * so these registers are all RAZ/WI.
+ */
+ return MEMTX_OK;
+ case GICD_IPRIORITYR ... GICD_IPRIORITYR + 0x3ff:
+ {
+ int irq = offset - GICD_IPRIORITYR;
+
+ if (irq < GIC_INTERNAL || irq >= s->num_irq) {
+ return MEMTX_OK;
+ }
+ gicd_write_ipriorityr(s, attrs, irq, value);
+ gicv3_update(s, irq, 1);
+ return MEMTX_OK;
+ }
+ default:
+ return MEMTX_ERROR;
+ }
+}
+
+static MemTxResult gicd_readw(GICv3State *s, hwaddr offset,
+ uint64_t *data, MemTxAttrs attrs)
+{
+ /* Only GICD_SETSPI_NSR, GICD_CLRSPI_NSR, GICD_SETSPI_SR and GICD_SETSPI_NSR
+ * support 16 bit accesses, and those registers are all part of the
+ * optional message-based SPI feature which this GIC does not currently
+ * implement (ie for us GICD_TYPER.MBIS == 0), so for us they are
+ * reserved.
+ */
+ return MEMTX_ERROR;
+}
+
+static MemTxResult gicd_writew(GICv3State *s, hwaddr offset,
+ uint64_t value, MemTxAttrs attrs)
+{
+ /* Only GICD_SETSPI_NSR, GICD_CLRSPI_NSR, GICD_SETSPI_SR and GICD_SETSPI_NSR
+ * support 16 bit accesses, and those registers are all part of the
+ * optional message-based SPI feature which this GIC does not currently
+ * implement (ie for us GICD_TYPER.MBIS == 0), so for us they are
+ * reserved.
+ */
+ return MEMTX_ERROR;
+}
+
+static MemTxResult gicd_readl(GICv3State *s, hwaddr offset,
+ uint64_t *data, MemTxAttrs attrs)
+{
+ /* Almost all GICv3 distributor registers are 32-bit.
+ * Note that WO registers must return an UNKNOWN value on reads,
+ * not an abort.
+ */
+
+ switch (offset) {
+ case GICD_CTLR:
+ if (!attrs.secure && !(s->gicd_ctlr & GICD_CTLR_DS)) {
+ /* The NS view of the GICD_CTLR sees only certain bits:
+ * + bit [31] (RWP) is an alias of the Secure bit [31]
+ * + bit [4] (ARE_NS) is an alias of Secure bit [5]
+ * + bit [1] (EnableGrp1A) is an alias of Secure bit [1] if
+ * NS affinity routing is enabled, otherwise RES0
+ * + bit [0] (EnableGrp1) is an alias of Secure bit [1] if
+ * NS affinity routing is not enabled, otherwise RES0
+ * Since for QEMU affinity routing is always enabled
+ * for both S and NS this means that bits [4] and [5] are
+ * both always 1, and we can simply make the NS view
+ * be bits 31, 4 and 1 of the S view.
+ */
+ *data = s->gicd_ctlr & (GICD_CTLR_ARE_S |
+ GICD_CTLR_EN_GRP1NS |
+ GICD_CTLR_RWP);
+ } else {
+ *data = s->gicd_ctlr;
+ }
+ return MEMTX_OK;
+ case GICD_TYPER:
+ {
+ /* For this implementation:
+ * No1N == 1 (1-of-N SPI interrupts not supported)
+ * A3V == 1 (non-zero values of Affinity level 3 supported)
+ * IDbits == 0xf (we support 16-bit interrupt identifiers)
+ * DVIS == 0 (Direct virtual LPI injection not supported)
+ * LPIS == 0 (LPIs not supported)
+ * MBIS == 0 (message-based SPIs not supported)
+ * SecurityExtn == 1 if security extns supported
+ * CPUNumber == 0 since for us ARE is always 1
+ * ITLinesNumber == (num external irqs / 32) - 1
+ */
+ int itlinesnumber = ((s->num_irq - GIC_INTERNAL) / 32) - 1;
+
+ *data = (1 << 25) | (1 << 24) | (s->security_extn << 10) |
+ (0xf << 19) | itlinesnumber;
+ return MEMTX_OK;
+ }
+ case GICD_IIDR:
+ /* We claim to be an ARM r0p0 with a zero ProductID.
+ * This is the same as an r0p0 GIC-500.
+ */
+ *data = gicv3_iidr();
+ return MEMTX_OK;
+ case GICD_STATUSR:
+ /* RAZ/WI for us (this is an optional register and our implementation
+ * does not track RO/WO/reserved violations to report them to the guest)
+ */
+ *data = 0;
+ return MEMTX_OK;
+ case GICD_IGROUPR ... GICD_IGROUPR + 0x7f:
+ {
+ int irq;
+
+ if (!attrs.secure && !(s->gicd_ctlr & GICD_CTLR_DS)) {
+ *data = 0;
+ return MEMTX_OK;
+ }
+ /* RAZ/WI for SGIs, PPIs, unimplemented irqs */
+ irq = (offset - GICD_IGROUPR) * 8;
+ if (irq < GIC_INTERNAL || irq >= s->num_irq) {
+ *data = 0;
+ return MEMTX_OK;
+ }
+ *data = *gic_bmp_ptr32(s->group, irq);
+ return MEMTX_OK;
+ }
+ case GICD_ISENABLER ... GICD_ISENABLER + 0x7f:
+ *data = gicd_read_bitmap_reg(s, attrs, s->enabled, NULL,
+ offset - GICD_ISENABLER);
+ return MEMTX_OK;
+ case GICD_ICENABLER ... GICD_ICENABLER + 0x7f:
+ *data = gicd_read_bitmap_reg(s, attrs, s->enabled, NULL,
+ offset - GICD_ICENABLER);
+ return MEMTX_OK;
+ case GICD_ISPENDR ... GICD_ISPENDR + 0x7f:
+ *data = gicd_read_bitmap_reg(s, attrs, s->pending, mask_nsacr_ge1,
+ offset - GICD_ISPENDR);
+ return MEMTX_OK;
+ case GICD_ICPENDR ... GICD_ICPENDR + 0x7f:
+ *data = gicd_read_bitmap_reg(s, attrs, s->pending, mask_nsacr_ge2,
+ offset - GICD_ICPENDR);
+ return MEMTX_OK;
+ case GICD_ISACTIVER ... GICD_ISACTIVER + 0x7f:
+ *data = gicd_read_bitmap_reg(s, attrs, s->active, mask_nsacr_ge2,
+ offset - GICD_ISACTIVER);
+ return MEMTX_OK;
+ case GICD_ICACTIVER ... GICD_ICACTIVER + 0x7f:
+ *data = gicd_read_bitmap_reg(s, attrs, s->active, mask_nsacr_ge2,
+ offset - GICD_ICACTIVER);
+ return MEMTX_OK;
+ case GICD_IPRIORITYR ... GICD_IPRIORITYR + 0x3ff:
+ {
+ int i, irq = offset - GICD_IPRIORITYR;
+ uint32_t value = 0;
+
+ for (i = irq + 3; i >= irq; i--, value <<= 8) {
+ value |= gicd_read_ipriorityr(s, attrs, i);
+ }
+ *data = value;
+ return MEMTX_OK;
+ }
+ case GICD_ITARGETSR ... GICD_ITARGETSR + 0x3ff:
+ /* RAZ/WI since affinity routing is always enabled */
+ *data = 0;
+ return MEMTX_OK;
+ case GICD_ICFGR ... GICD_ICFGR + 0xff:
+ {
+ /* Here only the even bits are used; odd bits are RES0 */
+ int irq = (offset - GICD_ICFGR) * 4;
+ uint32_t value = 0;
+
+ if (irq < GIC_INTERNAL || irq >= s->num_irq) {
+ *data = 0;
+ return MEMTX_OK;
+ }
+
+ /* Since our edge_trigger bitmap is one bit per irq, we only need
+ * half of the 32-bit word, which we can then spread out
+ * into the odd bits.
+ */
+ value = *gic_bmp_ptr32(s->edge_trigger, irq & ~0x1f);
+ value &= mask_group_and_nsacr(s, attrs, NULL, irq & ~0x1f);
+ value = extract32(value, (irq & 0x1f) ? 16 : 0, 16);
+ value = half_shuffle32(value) << 1;
+ *data = value;
+ return MEMTX_OK;
+ }
+ case GICD_IGRPMODR ... GICD_IGRPMODR + 0xff:
+ {
+ int irq;
+
+ if ((s->gicd_ctlr & GICD_CTLR_DS) || !attrs.secure) {
+ /* RAZ/WI if security disabled, or if
+ * security enabled and this is an NS access
+ */
+ *data = 0;
+ return MEMTX_OK;
+ }
+ /* RAZ/WI for SGIs, PPIs, unimplemented irqs */
+ irq = (offset - GICD_IGRPMODR) * 8;
+ if (irq < GIC_INTERNAL || irq >= s->num_irq) {
+ *data = 0;
+ return MEMTX_OK;
+ }
+ *data = *gic_bmp_ptr32(s->grpmod, irq);
+ return MEMTX_OK;
+ }
+ case GICD_NSACR ... GICD_NSACR + 0xff:
+ {
+ /* Two bits per interrupt */
+ int irq = (offset - GICD_NSACR) * 4;
+
+ if (irq < GIC_INTERNAL || irq >= s->num_irq) {
+ *data = 0;
+ return MEMTX_OK;
+ }
+
+ if ((s->gicd_ctlr & GICD_CTLR_DS) || !attrs.secure) {
+ /* RAZ/WI if security disabled, or if
+ * security enabled and this is an NS access
+ */
+ *data = 0;
+ return MEMTX_OK;
+ }
+
+ *data = s->gicd_nsacr[irq / 16];
+ return MEMTX_OK;
+ }
+ case GICD_CPENDSGIR ... GICD_CPENDSGIR + 0xf:
+ case GICD_SPENDSGIR ... GICD_SPENDSGIR + 0xf:
+ /* RAZ/WI since affinity routing is always enabled */
+ *data = 0;
+ return MEMTX_OK;
+ case GICD_IROUTER ... GICD_IROUTER + 0x1fdf:
+ {
+ uint64_t r;
+ int irq = (offset - GICD_IROUTER) / 8;
+
+ r = gicd_read_irouter(s, attrs, irq);
+ if (offset & 7) {
+ *data = r >> 32;
+ } else {
+ *data = (uint32_t)r;
+ }
+ return MEMTX_OK;
+ }
+ case GICD_IDREGS ... GICD_IDREGS + 0x1f:
+ /* ID registers */
+ *data = gicv3_idreg(offset - GICD_IDREGS);
+ return MEMTX_OK;
+ case GICD_SGIR:
+ /* WO registers, return unknown value */
+ qemu_log_mask(LOG_GUEST_ERROR,
+ "%s: invalid guest read from WO register at offset "
+ TARGET_FMT_plx "\n", __func__, offset);
+ *data = 0;
+ return MEMTX_OK;
+ default:
+ return MEMTX_ERROR;
+ }
+}
+
+static MemTxResult gicd_writel(GICv3State *s, hwaddr offset,
+ uint64_t value, MemTxAttrs attrs)
+{
+ /* Almost all GICv3 distributor registers are 32-bit. Note that
+ * RO registers must ignore writes, not abort.
+ */
+
+ switch (offset) {
+ case GICD_CTLR:
+ {
+ uint32_t mask;
+ /* GICv3 5.3.20 */
+ if (s->gicd_ctlr & GICD_CTLR_DS) {
+ /* With only one security state, E1NWF is RAZ/WI, DS is RAO/WI,
+ * ARE is RAO/WI (affinity routing always on), and only
+ * bits 0 and 1 (group enables) are writable.
+ */
+ mask = GICD_CTLR_EN_GRP0 | GICD_CTLR_EN_GRP1NS;
+ } else {
+ if (attrs.secure) {
+ /* for secure access:
+ * ARE_NS and ARE_S are RAO/WI (affinity routing always on)
+ * E1NWF is RAZ/WI (we don't support enable-1-of-n-wakeup)
+ *
+ * We can only modify bits[2:0] (the group enables).
+ */
+ mask = GICD_CTLR_DS | GICD_CTLR_EN_GRP0 | GICD_CTLR_EN_GRP1_ALL;
+ } else {
+ /* For non secure access ARE_NS is RAO/WI and EnableGrp1
+ * is RES0. The only writable bit is [1] (EnableGrp1A), which
+ * is an alias of the Secure bit [1].
+ */
+ mask = GICD_CTLR_EN_GRP1NS;
+ }
+ }
+ s->gicd_ctlr = (s->gicd_ctlr & ~mask) | (value & mask);
+ if (value & mask & GICD_CTLR_DS) {
+ /* We just set DS, so the ARE_NS and EnG1S bits are now RES0.
+ * Note that this is a one-way transition because if DS is set
+ * then it's not writeable, so it can only go back to 0 with a
+ * hardware reset.
+ */
+ s->gicd_ctlr &= ~(GICD_CTLR_EN_GRP1S | GICD_CTLR_ARE_NS);
+ }
+ gicv3_full_update(s);
+ return MEMTX_OK;
+ }
+ case GICD_STATUSR:
+ /* RAZ/WI for our implementation */
+ return MEMTX_OK;
+ case GICD_IGROUPR ... GICD_IGROUPR + 0x7f:
+ {
+ int irq;
+
+ if (!attrs.secure && !(s->gicd_ctlr & GICD_CTLR_DS)) {
+ return MEMTX_OK;
+ }
+ /* RAZ/WI for SGIs, PPIs, unimplemented irqs */
+ irq = (offset - GICD_IGROUPR) * 8;
+ if (irq < GIC_INTERNAL || irq >= s->num_irq) {
+ return MEMTX_OK;
+ }
+ *gic_bmp_ptr32(s->group, irq) = value;
+ gicv3_update(s, irq, 32);
+ return MEMTX_OK;
+ }
+ case GICD_ISENABLER ... GICD_ISENABLER + 0x7f:
+ gicd_write_set_bitmap_reg(s, attrs, s->enabled, NULL,
+ offset - GICD_ISENABLER, value);
+ return MEMTX_OK;
+ case GICD_ICENABLER ... GICD_ICENABLER + 0x7f:
+ gicd_write_clear_bitmap_reg(s, attrs, s->enabled, NULL,
+ offset - GICD_ICENABLER, value);
+ return MEMTX_OK;
+ case GICD_ISPENDR ... GICD_ISPENDR + 0x7f:
+ gicd_write_set_bitmap_reg(s, attrs, s->pending, mask_nsacr_ge1,
+ offset - GICD_ISPENDR, value);
+ return MEMTX_OK;
+ case GICD_ICPENDR ... GICD_ICPENDR + 0x7f:
+ gicd_write_clear_bitmap_reg(s, attrs, s->pending, mask_nsacr_ge2,
+ offset - GICD_ICPENDR, value);
+ return MEMTX_OK;
+ case GICD_ISACTIVER ... GICD_ISACTIVER + 0x7f:
+ gicd_write_set_bitmap_reg(s, attrs, s->active, NULL,
+ offset - GICD_ISACTIVER, value);
+ return MEMTX_OK;
+ case GICD_ICACTIVER ... GICD_ICACTIVER + 0x7f:
+ gicd_write_clear_bitmap_reg(s, attrs, s->active, NULL,
+ offset - GICD_ICACTIVER, value);
+ return MEMTX_OK;
+ case GICD_IPRIORITYR ... GICD_IPRIORITYR + 0x3ff:
+ {
+ int i, irq = offset - GICD_IPRIORITYR;
+
+ if (irq < GIC_INTERNAL || irq + 3 >= s->num_irq) {
+ return MEMTX_OK;
+ }
+
+ for (i = irq; i < irq + 4; i++, value >>= 8) {
+ gicd_write_ipriorityr(s, attrs, i, value);
+ }
+ gicv3_update(s, irq, 4);
+ return MEMTX_OK;
+ }
+ case GICD_ITARGETSR ... GICD_ITARGETSR + 0x3ff:
+ /* RAZ/WI since affinity routing is always enabled */
+ return MEMTX_OK;
+ case GICD_ICFGR ... GICD_ICFGR + 0xff:
+ {
+ /* Here only the odd bits are used; even bits are RES0 */
+ int irq = (offset - GICD_ICFGR) * 4;
+ uint32_t mask, oldval;
+
+ if (irq < GIC_INTERNAL || irq >= s->num_irq) {
+ return MEMTX_OK;
+ }
+
+ /* Since our edge_trigger bitmap is one bit per irq, our input
+ * 32-bits will compress down into 16 bits which we need
+ * to write into the bitmap.
+ */
+ value = half_unshuffle32(value >> 1);
+ mask = mask_group_and_nsacr(s, attrs, NULL, irq & ~0x1f);
+ if (irq & 0x1f) {
+ value <<= 16;
+ mask &= 0xffff0000U;
+ } else {
+ mask &= 0xffff;
+ }
+ oldval = *gic_bmp_ptr32(s->edge_trigger, (irq & ~0x1f));
+ value = (oldval & ~mask) | (value & mask);
+ *gic_bmp_ptr32(s->edge_trigger, irq & ~0x1f) = value;
+ return MEMTX_OK;
+ }
+ case GICD_IGRPMODR ... GICD_IGRPMODR + 0xff:
+ {
+ int irq;
+
+ if ((s->gicd_ctlr & GICD_CTLR_DS) || !attrs.secure) {
+ /* RAZ/WI if security disabled, or if
+ * security enabled and this is an NS access
+ */
+ return MEMTX_OK;
+ }
+ /* RAZ/WI for SGIs, PPIs, unimplemented irqs */
+ irq = (offset - GICD_IGRPMODR) * 8;
+ if (irq < GIC_INTERNAL || irq >= s->num_irq) {
+ return MEMTX_OK;
+ }
+ *gic_bmp_ptr32(s->grpmod, irq) = value;
+ gicv3_update(s, irq, 32);
+ return MEMTX_OK;
+ }
+ case GICD_NSACR ... GICD_NSACR + 0xff:
+ {
+ /* Two bits per interrupt */
+ int irq = (offset - GICD_NSACR) * 4;
+
+ if (irq < GIC_INTERNAL || irq >= s->num_irq) {
+ return MEMTX_OK;
+ }
+
+ if ((s->gicd_ctlr & GICD_CTLR_DS) || !attrs.secure) {
+ /* RAZ/WI if security disabled, or if
+ * security enabled and this is an NS access
+ */
+ return MEMTX_OK;
+ }
+
+ s->gicd_nsacr[irq / 16] = value;
+ /* No update required as this only affects access permission checks */
+ return MEMTX_OK;
+ }
+ case GICD_SGIR:
+ /* RES0 if affinity routing is enabled */
+ return MEMTX_OK;
+ case GICD_CPENDSGIR ... GICD_CPENDSGIR + 0xf:
+ case GICD_SPENDSGIR ... GICD_SPENDSGIR + 0xf:
+ /* RAZ/WI since affinity routing is always enabled */
+ return MEMTX_OK;
+ case GICD_IROUTER ... GICD_IROUTER + 0x1fdf:
+ {
+ uint64_t r;
+ int irq = (offset - GICD_IROUTER) / 8;
+
+ if (irq < GIC_INTERNAL || irq >= s->num_irq) {
+ return MEMTX_OK;
+ }
+
+ /* Write half of the 64-bit register */
+ r = gicd_read_irouter(s, attrs, irq);
+ r = deposit64(r, (offset & 7) ? 32 : 0, 32, value);
+ gicd_write_irouter(s, attrs, irq, r);
+ return MEMTX_OK;
+ }
+ case GICD_IDREGS ... GICD_IDREGS + 0x1f:
+ case GICD_TYPER:
+ case GICD_IIDR:
+ /* RO registers, ignore the write */
+ qemu_log_mask(LOG_GUEST_ERROR,
+ "%s: invalid guest write to RO register at offset "
+ TARGET_FMT_plx "\n", __func__, offset);
+ return MEMTX_OK;
+ default:
+ return MEMTX_ERROR;
+ }
+}
+
+static MemTxResult gicd_writell(GICv3State *s, hwaddr offset,
+ uint64_t value, MemTxAttrs attrs)
+{
+ /* Our only 64-bit registers are GICD_IROUTER<n> */
+ int irq;
+
+ switch (offset) {
+ case GICD_IROUTER ... GICD_IROUTER + 0x1fdf:
+ irq = (offset - GICD_IROUTER) / 8;
+ gicd_write_irouter(s, attrs, irq, value);
+ return MEMTX_OK;
+ default:
+ return MEMTX_ERROR;
+ }
+}
+
+static MemTxResult gicd_readll(GICv3State *s, hwaddr offset,
+ uint64_t *data, MemTxAttrs attrs)
+{
+ /* Our only 64-bit registers are GICD_IROUTER<n> */
+ int irq;
+
+ switch (offset) {
+ case GICD_IROUTER ... GICD_IROUTER + 0x1fdf:
+ irq = (offset - GICD_IROUTER) / 8;
+ *data = gicd_read_irouter(s, attrs, irq);
+ return MEMTX_OK;
+ default:
+ return MEMTX_ERROR;
+ }
+}
+
+MemTxResult gicv3_dist_read(void *opaque, hwaddr offset, uint64_t *data,
+ unsigned size, MemTxAttrs attrs)
+{
+ GICv3State *s = (GICv3State *)opaque;
+ MemTxResult r;
+
+ switch (size) {
+ case 1:
+ r = gicd_readb(s, offset, data, attrs);
+ break;
+ case 2:
+ r = gicd_readw(s, offset, data, attrs);
+ break;
+ case 4:
+ r = gicd_readl(s, offset, data, attrs);
+ break;
+ case 8:
+ r = gicd_readll(s, offset, data, attrs);
+ break;
+ default:
+ r = MEMTX_ERROR;
+ break;
+ }
+
+ if (r == MEMTX_ERROR) {
+ qemu_log_mask(LOG_GUEST_ERROR,
+ "%s: invalid guest read at offset " TARGET_FMT_plx
+ "size %u\n", __func__, offset, size);
+ trace_gicv3_dist_badread(offset, size, attrs.secure);
+ } else {
+ trace_gicv3_dist_read(offset, *data, size, attrs.secure);
+ }
+ return r;
+}
+
+MemTxResult gicv3_dist_write(void *opaque, hwaddr offset, uint64_t data,
+ unsigned size, MemTxAttrs attrs)
+{
+ GICv3State *s = (GICv3State *)opaque;
+ MemTxResult r;
+
+ switch (size) {
+ case 1:
+ r = gicd_writeb(s, offset, data, attrs);
+ break;
+ case 2:
+ r = gicd_writew(s, offset, data, attrs);
+ break;
+ case 4:
+ r = gicd_writel(s, offset, data, attrs);
+ break;
+ case 8:
+ r = gicd_writell(s, offset, data, attrs);
+ break;
+ default:
+ r = MEMTX_ERROR;
+ break;
+ }
+
+ if (r == MEMTX_ERROR) {
+ qemu_log_mask(LOG_GUEST_ERROR,
+ "%s: invalid guest write at offset " TARGET_FMT_plx
+ "size %u\n", __func__, offset, size);
+ trace_gicv3_dist_badwrite(offset, data, size, attrs.secure);
+ } else {
+ trace_gicv3_dist_write(offset, data, size, attrs.secure);
+ }
+ return r;
+}
+
+void gicv3_dist_set_irq(GICv3State *s, int irq, int level)
+{
+ /* Update distributor state for a change in an external SPI input line */
+ if (level == gicv3_gicd_level_test(s, irq)) {
+ return;
+ }
+
+ trace_gicv3_dist_set_irq(irq, level);
+
+ gicv3_gicd_level_replace(s, irq, level);
+
+ if (level) {
+ /* 0->1 edges latch the pending bit for edge-triggered interrupts */
+ if (gicv3_gicd_edge_trigger_test(s, irq)) {
+ gicv3_gicd_pending_set(s, irq);
+ }
+ }
+
+ gicv3_update(s, irq, 1);
+}
diff --git a/hw/intc/arm_gicv3_kvm.c b/hw/intc/arm_gicv3_kvm.c
index acc1730048..711fde38f3 100644
--- a/hw/intc/arm_gicv3_kvm.c
+++ b/hw/intc/arm_gicv3_kvm.c
@@ -26,6 +26,7 @@
#include "sysemu/kvm.h"
#include "kvm_arm.h"
#include "vgic_common.h"
+#include "migration/migration.h"
#ifdef DEBUG_GICV3_KVM
#define DPRINTF(fmt, ...) \
@@ -119,6 +120,13 @@ static void kvm_arm_gicv3_realize(DeviceState *dev, Error **errp)
KVM_VGIC_V3_ADDR_TYPE_DIST, s->dev_fd);
kvm_arm_register_device(&s->iomem_redist, -1, KVM_DEV_ARM_VGIC_GRP_ADDR,
KVM_VGIC_V3_ADDR_TYPE_REDIST, s->dev_fd);
+
+ /* Block migration of a KVM GICv3 device: the API for saving and restoring
+ * the state in the kernel is not yet finalised in the kernel or
+ * implemented in QEMU.
+ */
+ error_setg(&s->migration_blocker, "vGICv3 migration is not implemented");
+ migrate_add_blocker(s->migration_blocker);
}
static void kvm_arm_gicv3_class_init(ObjectClass *klass, void *data)
diff --git a/hw/intc/arm_gicv3_redist.c b/hw/intc/arm_gicv3_redist.c
new file mode 100644
index 0000000000..55c25e8935
--- /dev/null
+++ b/hw/intc/arm_gicv3_redist.c
@@ -0,0 +1,562 @@
+/*
+ * ARM GICv3 emulation: Redistributor
+ *
+ * Copyright (c) 2015 Huawei.
+ * Copyright (c) 2016 Linaro Limited.
+ * Written by Shlomo Pongratz, Peter Maydell
+ *
+ * This code is licensed under the GPL, version 2 or (at your option)
+ * any later version.
+ */
+
+#include "qemu/osdep.h"
+#include "trace.h"
+#include "gicv3_internal.h"
+
+static uint32_t mask_group(GICv3CPUState *cs, MemTxAttrs attrs)
+{
+ /* Return a 32-bit mask which should be applied for this set of 32
+ * interrupts; each bit is 1 if access is permitted by the
+ * combination of attrs.secure and GICR_GROUPR. (GICR_NSACR does
+ * not affect config register accesses, unlike GICD_NSACR.)
+ */
+ if (!attrs.secure && !(cs->gic->gicd_ctlr & GICD_CTLR_DS)) {
+ /* bits for Group 0 or Secure Group 1 interrupts are RAZ/WI */
+ return cs->gicr_igroupr0;
+ }
+ return 0xFFFFFFFFU;
+}
+
+static int gicr_ns_access(GICv3CPUState *cs, int irq)
+{
+ /* Return the 2 bit NSACR.NS_access field for this SGI */
+ assert(irq < 16);
+ return extract32(cs->gicr_nsacr, irq * 2, 2);
+}
+
+static void gicr_write_set_bitmap_reg(GICv3CPUState *cs, MemTxAttrs attrs,
+ uint32_t *reg, uint32_t val)
+{
+ /* Helper routine to implement writing to a "set-bitmap" register */
+ val &= mask_group(cs, attrs);
+ *reg |= val;
+ gicv3_redist_update(cs);
+}
+
+static void gicr_write_clear_bitmap_reg(GICv3CPUState *cs, MemTxAttrs attrs,
+ uint32_t *reg, uint32_t val)
+{
+ /* Helper routine to implement writing to a "clear-bitmap" register */
+ val &= mask_group(cs, attrs);
+ *reg &= ~val;
+ gicv3_redist_update(cs);
+}
+
+static uint32_t gicr_read_bitmap_reg(GICv3CPUState *cs, MemTxAttrs attrs,
+ uint32_t reg)
+{
+ reg &= mask_group(cs, attrs);
+ return reg;
+}
+
+static uint8_t gicr_read_ipriorityr(GICv3CPUState *cs, MemTxAttrs attrs,
+ int irq)
+{
+ /* Read the value of GICR_IPRIORITYR<n> for the specified interrupt,
+ * honouring security state (these are RAZ/WI for Group 0 or Secure
+ * Group 1 interrupts).
+ */
+ uint32_t prio;
+
+ prio = cs->gicr_ipriorityr[irq];
+
+ if (!attrs.secure && !(cs->gic->gicd_ctlr & GICD_CTLR_DS)) {
+ if (!(cs->gicr_igroupr0 & (1U << irq))) {
+ /* Fields for Group 0 or Secure Group 1 interrupts are RAZ/WI */
+ return 0;
+ }
+ /* NS view of the interrupt priority */
+ prio = (prio << 1) & 0xff;
+ }
+ return prio;
+}
+
+static void gicr_write_ipriorityr(GICv3CPUState *cs, MemTxAttrs attrs, int irq,
+ uint8_t value)
+{
+ /* Write the value of GICD_IPRIORITYR<n> for the specified interrupt,
+ * honouring security state (these are RAZ/WI for Group 0 or Secure
+ * Group 1 interrupts).
+ */
+ if (!attrs.secure && !(cs->gic->gicd_ctlr & GICD_CTLR_DS)) {
+ if (!(cs->gicr_igroupr0 & (1U << irq))) {
+ /* Fields for Group 0 or Secure Group 1 interrupts are RAZ/WI */
+ return;
+ }
+ /* NS view of the interrupt priority */
+ value = 0x80 | (value >> 1);
+ }
+ cs->gicr_ipriorityr[irq] = value;
+}
+
+static MemTxResult gicr_readb(GICv3CPUState *cs, hwaddr offset,
+ uint64_t *data, MemTxAttrs attrs)
+{
+ switch (offset) {
+ case GICR_IPRIORITYR ... GICR_IPRIORITYR + 0x1f:
+ *data = gicr_read_ipriorityr(cs, attrs, offset - GICR_IPRIORITYR);
+ return MEMTX_OK;
+ default:
+ return MEMTX_ERROR;
+ }
+}
+
+static MemTxResult gicr_writeb(GICv3CPUState *cs, hwaddr offset,
+ uint64_t value, MemTxAttrs attrs)
+{
+ switch (offset) {
+ case GICR_IPRIORITYR ... GICR_IPRIORITYR + 0x1f:
+ gicr_write_ipriorityr(cs, attrs, offset - GICR_IPRIORITYR, value);
+ gicv3_redist_update(cs);
+ return MEMTX_OK;
+ default:
+ return MEMTX_ERROR;
+ }
+}
+
+static MemTxResult gicr_readl(GICv3CPUState *cs, hwaddr offset,
+ uint64_t *data, MemTxAttrs attrs)
+{
+ switch (offset) {
+ case GICR_CTLR:
+ *data = cs->gicr_ctlr;
+ return MEMTX_OK;
+ case GICR_IIDR:
+ *data = gicv3_iidr();
+ return MEMTX_OK;
+ case GICR_TYPER:
+ *data = extract64(cs->gicr_typer, 0, 32);
+ return MEMTX_OK;
+ case GICR_TYPER + 4:
+ *data = extract64(cs->gicr_typer, 32, 32);
+ return MEMTX_OK;
+ case GICR_STATUSR:
+ /* RAZ/WI for us (this is an optional register and our implementation
+ * does not track RO/WO/reserved violations to report them to the guest)
+ */
+ *data = 0;
+ return MEMTX_OK;
+ case GICR_WAKER:
+ *data = cs->gicr_waker;
+ return MEMTX_OK;
+ case GICR_PROPBASER:
+ *data = extract64(cs->gicr_propbaser, 0, 32);
+ return MEMTX_OK;
+ case GICR_PROPBASER + 4:
+ *data = extract64(cs->gicr_propbaser, 32, 32);
+ return MEMTX_OK;
+ case GICR_PENDBASER:
+ *data = extract64(cs->gicr_pendbaser, 0, 32);
+ return MEMTX_OK;
+ case GICR_PENDBASER + 4:
+ *data = extract64(cs->gicr_pendbaser, 32, 32);
+ return MEMTX_OK;
+ case GICR_IGROUPR0:
+ if (!attrs.secure && !(cs->gic->gicd_ctlr & GICD_CTLR_DS)) {
+ *data = 0;
+ return MEMTX_OK;
+ }
+ *data = cs->gicr_igroupr0;
+ return MEMTX_OK;
+ case GICR_ISENABLER0:
+ case GICR_ICENABLER0:
+ *data = gicr_read_bitmap_reg(cs, attrs, cs->gicr_ienabler0);
+ return MEMTX_OK;
+ case GICR_ISPENDR0:
+ case GICR_ICPENDR0:
+ {
+ /* The pending register reads as the logical OR of the pending
+ * latch and the input line level for level-triggered interrupts.
+ */
+ uint32_t val = cs->gicr_ipendr0 | (~cs->edge_trigger & cs->level);
+ *data = gicr_read_bitmap_reg(cs, attrs, val);
+ return MEMTX_OK;
+ }
+ case GICR_ISACTIVER0:
+ case GICR_ICACTIVER0:
+ *data = gicr_read_bitmap_reg(cs, attrs, cs->gicr_iactiver0);
+ return MEMTX_OK;
+ case GICR_IPRIORITYR ... GICR_IPRIORITYR + 0x1f:
+ {
+ int i, irq = offset - GICR_IPRIORITYR;
+ uint32_t value = 0;
+
+ for (i = irq + 3; i >= irq; i--, value <<= 8) {
+ value |= gicr_read_ipriorityr(cs, attrs, i);
+ }
+ *data = value;
+ return MEMTX_OK;
+ }
+ case GICR_ICFGR0:
+ case GICR_ICFGR1:
+ {
+ /* Our edge_trigger bitmap is one bit per irq; take the correct
+ * half of it, and spread it out into the odd bits.
+ */
+ uint32_t value;
+
+ value = cs->edge_trigger & mask_group(cs, attrs);
+ value = extract32(value, (offset == GICR_ICFGR1) ? 16 : 0, 16);
+ value = half_shuffle32(value) << 1;
+ *data = value;
+ return MEMTX_OK;
+ }
+ case GICR_IGRPMODR0:
+ if ((cs->gic->gicd_ctlr & GICD_CTLR_DS) || !attrs.secure) {
+ /* RAZ/WI if security disabled, or if
+ * security enabled and this is an NS access
+ */
+ *data = 0;
+ return MEMTX_OK;
+ }
+ *data = cs->gicr_igrpmodr0;
+ return MEMTX_OK;
+ case GICR_NSACR:
+ if ((cs->gic->gicd_ctlr & GICD_CTLR_DS) || !attrs.secure) {
+ /* RAZ/WI if security disabled, or if
+ * security enabled and this is an NS access
+ */
+ *data = 0;
+ return MEMTX_OK;
+ }
+ *data = cs->gicr_nsacr;
+ return MEMTX_OK;
+ case GICR_IDREGS ... GICR_IDREGS + 0x1f:
+ *data = gicv3_idreg(offset - GICR_IDREGS);
+ return MEMTX_OK;
+ default:
+ return MEMTX_ERROR;
+ }
+}
+
+static MemTxResult gicr_writel(GICv3CPUState *cs, hwaddr offset,
+ uint64_t value, MemTxAttrs attrs)
+{
+ switch (offset) {
+ case GICR_CTLR:
+ /* For our implementation, GICR_TYPER.DPGS is 0 and so all
+ * the DPG bits are RAZ/WI. We don't do anything asynchronously,
+ * so UWP and RWP are RAZ/WI. And GICR_TYPER.LPIS is 0 (we don't
+ * implement LPIs) so Enable_LPIs is RES0. So there are no writable
+ * bits for us.
+ */
+ return MEMTX_OK;
+ case GICR_STATUSR:
+ /* RAZ/WI for our implementation */
+ return MEMTX_OK;
+ case GICR_WAKER:
+ /* Only the ProcessorSleep bit is writeable. When the guest sets
+ * it it requests that we transition the channel between the
+ * redistributor and the cpu interface to quiescent, and that
+ * we set the ChildrenAsleep bit once the inteface has reached the
+ * quiescent state.
+ * Setting the ProcessorSleep to 0 reverses the quiescing, and
+ * ChildrenAsleep is cleared once the transition is complete.
+ * Since our interface is not asynchronous, we complete these
+ * transitions instantaneously, so we set ChildrenAsleep to the
+ * same value as ProcessorSleep here.
+ */
+ value &= GICR_WAKER_ProcessorSleep;
+ if (value & GICR_WAKER_ProcessorSleep) {
+ value |= GICR_WAKER_ChildrenAsleep;
+ }
+ cs->gicr_waker = value;
+ return MEMTX_OK;
+ case GICR_PROPBASER:
+ cs->gicr_propbaser = deposit64(cs->gicr_propbaser, 0, 32, value);
+ return MEMTX_OK;
+ case GICR_PROPBASER + 4:
+ cs->gicr_propbaser = deposit64(cs->gicr_propbaser, 32, 32, value);
+ return MEMTX_OK;
+ case GICR_PENDBASER:
+ cs->gicr_pendbaser = deposit64(cs->gicr_pendbaser, 0, 32, value);
+ return MEMTX_OK;
+ case GICR_PENDBASER + 4:
+ cs->gicr_pendbaser = deposit64(cs->gicr_pendbaser, 32, 32, value);
+ return MEMTX_OK;
+ case GICR_IGROUPR0:
+ if (!attrs.secure && !(cs->gic->gicd_ctlr & GICD_CTLR_DS)) {
+ return MEMTX_OK;
+ }
+ cs->gicr_igroupr0 = value;
+ gicv3_redist_update(cs);
+ return MEMTX_OK;
+ case GICR_ISENABLER0:
+ gicr_write_set_bitmap_reg(cs, attrs, &cs->gicr_ienabler0, value);
+ return MEMTX_OK;
+ case GICR_ICENABLER0:
+ gicr_write_clear_bitmap_reg(cs, attrs, &cs->gicr_ienabler0, value);
+ return MEMTX_OK;
+ case GICR_ISPENDR0:
+ gicr_write_set_bitmap_reg(cs, attrs, &cs->gicr_ipendr0, value);
+ return MEMTX_OK;
+ case GICR_ICPENDR0:
+ gicr_write_clear_bitmap_reg(cs, attrs, &cs->gicr_ipendr0, value);
+ return MEMTX_OK;
+ case GICR_ISACTIVER0:
+ gicr_write_set_bitmap_reg(cs, attrs, &cs->gicr_iactiver0, value);
+ return MEMTX_OK;
+ case GICR_ICACTIVER0:
+ gicr_write_clear_bitmap_reg(cs, attrs, &cs->gicr_iactiver0, value);
+ return MEMTX_OK;
+ case GICR_IPRIORITYR ... GICR_IPRIORITYR + 0x1f:
+ {
+ int i, irq = offset - GICR_IPRIORITYR;
+
+ for (i = irq; i < irq + 4; i++, value >>= 8) {
+ gicr_write_ipriorityr(cs, attrs, i, value);
+ }
+ gicv3_redist_update(cs);
+ return MEMTX_OK;
+ }
+ case GICR_ICFGR0:
+ /* Register is all RAZ/WI or RAO/WI bits */
+ return MEMTX_OK;
+ case GICR_ICFGR1:
+ {
+ uint32_t mask;
+
+ /* Since our edge_trigger bitmap is one bit per irq, our input
+ * 32-bits will compress down into 16 bits which we need
+ * to write into the bitmap.
+ */
+ value = half_unshuffle32(value >> 1) << 16;
+ mask = mask_group(cs, attrs) & 0xffff0000U;
+
+ cs->edge_trigger &= ~mask;
+ cs->edge_trigger |= (value & mask);
+
+ gicv3_redist_update(cs);
+ return MEMTX_OK;
+ }
+ case GICR_IGRPMODR0:
+ if ((cs->gic->gicd_ctlr & GICD_CTLR_DS) || !attrs.secure) {
+ /* RAZ/WI if security disabled, or if
+ * security enabled and this is an NS access
+ */
+ return MEMTX_OK;
+ }
+ cs->gicr_igrpmodr0 = value;
+ gicv3_redist_update(cs);
+ return MEMTX_OK;
+ case GICR_NSACR:
+ if ((cs->gic->gicd_ctlr & GICD_CTLR_DS) || !attrs.secure) {
+ /* RAZ/WI if security disabled, or if
+ * security enabled and this is an NS access
+ */
+ return MEMTX_OK;
+ }
+ cs->gicr_nsacr = value;
+ /* no update required as this only affects access permission checks */
+ return MEMTX_OK;
+ case GICR_IIDR:
+ case GICR_TYPER:
+ case GICR_IDREGS ... GICR_IDREGS + 0x1f:
+ /* RO registers, ignore the write */
+ qemu_log_mask(LOG_GUEST_ERROR,
+ "%s: invalid guest write to RO register at offset "
+ TARGET_FMT_plx "\n", __func__, offset);
+ return MEMTX_OK;
+ default:
+ return MEMTX_ERROR;
+ }
+}
+
+static MemTxResult gicr_readll(GICv3CPUState *cs, hwaddr offset,
+ uint64_t *data, MemTxAttrs attrs)
+{
+ switch (offset) {
+ case GICR_TYPER:
+ *data = cs->gicr_typer;
+ return MEMTX_OK;
+ case GICR_PROPBASER:
+ *data = cs->gicr_propbaser;
+ return MEMTX_OK;
+ case GICR_PENDBASER:
+ *data = cs->gicr_pendbaser;
+ return MEMTX_OK;
+ default:
+ return MEMTX_ERROR;
+ }
+}
+
+static MemTxResult gicr_writell(GICv3CPUState *cs, hwaddr offset,
+ uint64_t value, MemTxAttrs attrs)
+{
+ switch (offset) {
+ case GICR_PROPBASER:
+ cs->gicr_propbaser = value;
+ return MEMTX_OK;
+ case GICR_PENDBASER:
+ cs->gicr_pendbaser = value;
+ return MEMTX_OK;
+ case GICR_TYPER:
+ /* RO register, ignore the write */
+ qemu_log_mask(LOG_GUEST_ERROR,
+ "%s: invalid guest write to RO register at offset "
+ TARGET_FMT_plx "\n", __func__, offset);
+ return MEMTX_OK;
+ default:
+ return MEMTX_ERROR;
+ }
+}
+
+MemTxResult gicv3_redist_read(void *opaque, hwaddr offset, uint64_t *data,
+ unsigned size, MemTxAttrs attrs)
+{
+ GICv3State *s = opaque;
+ GICv3CPUState *cs;
+ MemTxResult r;
+ int cpuidx;
+
+ /* This region covers all the redistributor pages; there are
+ * (for GICv3) two 64K pages per CPU. At the moment they are
+ * all contiguous (ie in this one region), though we might later
+ * want to allow splitting of redistributor pages into several
+ * blocks so we can support more CPUs.
+ */
+ cpuidx = offset / 0x20000;
+ offset %= 0x20000;
+ assert(cpuidx < s->num_cpu);
+
+ cs = &s->cpu[cpuidx];
+
+ switch (size) {
+ case 1:
+ r = gicr_readb(cs, offset, data, attrs);
+ break;
+ case 4:
+ r = gicr_readl(cs, offset, data, attrs);
+ break;
+ case 8:
+ r = gicr_readll(cs, offset, data, attrs);
+ break;
+ default:
+ r = MEMTX_ERROR;
+ break;
+ }
+
+ if (r == MEMTX_ERROR) {
+ qemu_log_mask(LOG_GUEST_ERROR,
+ "%s: invalid guest read at offset " TARGET_FMT_plx
+ "size %u\n", __func__, offset, size);
+ trace_gicv3_redist_badread(gicv3_redist_affid(cs), offset,
+ size, attrs.secure);
+ } else {
+ trace_gicv3_redist_read(gicv3_redist_affid(cs), offset, *data,
+ size, attrs.secure);
+ }
+ return r;
+}
+
+MemTxResult gicv3_redist_write(void *opaque, hwaddr offset, uint64_t data,
+ unsigned size, MemTxAttrs attrs)
+{
+ GICv3State *s = opaque;
+ GICv3CPUState *cs;
+ MemTxResult r;
+ int cpuidx;
+
+ /* This region covers all the redistributor pages; there are
+ * (for GICv3) two 64K pages per CPU. At the moment they are
+ * all contiguous (ie in this one region), though we might later
+ * want to allow splitting of redistributor pages into several
+ * blocks so we can support more CPUs.
+ */
+ cpuidx = offset / 0x20000;
+ offset %= 0x20000;
+ assert(cpuidx < s->num_cpu);
+
+ cs = &s->cpu[cpuidx];
+
+ switch (size) {
+ case 1:
+ r = gicr_writeb(cs, offset, data, attrs);
+ break;
+ case 4:
+ r = gicr_writel(cs, offset, data, attrs);
+ break;
+ case 8:
+ r = gicr_writell(cs, offset, data, attrs);
+ break;
+ default:
+ r = MEMTX_ERROR;
+ break;
+ }
+
+ if (r == MEMTX_ERROR) {
+ qemu_log_mask(LOG_GUEST_ERROR,
+ "%s: invalid guest write at offset " TARGET_FMT_plx
+ "size %u\n", __func__, offset, size);
+ trace_gicv3_redist_badwrite(gicv3_redist_affid(cs), offset, data,
+ size, attrs.secure);
+ } else {
+ trace_gicv3_redist_write(gicv3_redist_affid(cs), offset, data,
+ size, attrs.secure);
+ }
+ return r;
+}
+
+void gicv3_redist_set_irq(GICv3CPUState *cs, int irq, int level)
+{
+ /* Update redistributor state for a change in an external PPI input line */
+ if (level == extract32(cs->level, irq, 1)) {
+ return;
+ }
+
+ trace_gicv3_redist_set_irq(gicv3_redist_affid(cs), irq, level);
+
+ cs->level = deposit32(cs->level, irq, 1, level);
+
+ if (level) {
+ /* 0->1 edges latch the pending bit for edge-triggered interrupts */
+ if (extract32(cs->edge_trigger, irq, 1)) {
+ cs->gicr_ipendr0 = deposit32(cs->gicr_ipendr0, irq, 1, 1);
+ }
+ }
+
+ gicv3_redist_update(cs);
+}
+
+void gicv3_redist_send_sgi(GICv3CPUState *cs, int grp, int irq, bool ns)
+{
+ /* Update redistributor state for a generated SGI */
+ int irqgrp = gicv3_irq_group(cs->gic, cs, irq);
+
+ /* If we are asked for a Secure Group 1 SGI and it's actually
+ * configured as Secure Group 0 this is OK (subject to the usual
+ * NSACR checks).
+ */
+ if (grp == GICV3_G1 && irqgrp == GICV3_G0) {
+ grp = GICV3_G0;
+ }
+
+ if (grp != irqgrp) {
+ return;
+ }
+
+ if (ns && !(cs->gic->gicd_ctlr & GICD_CTLR_DS)) {
+ /* If security is enabled we must test the NSACR bits */
+ int nsaccess = gicr_ns_access(cs, irq);
+
+ if ((irqgrp == GICV3_G0 && nsaccess < 1) ||
+ (irqgrp == GICV3_G1 && nsaccess < 2)) {
+ return;
+ }
+ }
+
+ /* OK, we can accept the SGI */
+ trace_gicv3_redist_send_sgi(gicv3_redist_affid(cs), irq);
+ cs->gicr_ipendr0 = deposit32(cs->gicr_ipendr0, irq, 1, 1);
+ gicv3_redist_update(cs);
+}
diff --git a/hw/intc/gicv3_internal.h b/hw/intc/gicv3_internal.h
new file mode 100644
index 0000000000..6ce5d49bde
--- /dev/null
+++ b/hw/intc/gicv3_internal.h
@@ -0,0 +1,331 @@
+/*
+ * ARM GICv3 support - internal interfaces
+ *
+ * Copyright (c) 2012 Linaro Limited
+ * Copyright (c) 2015 Huawei.
+ * Copyright (c) 2015 Samsung Electronics Co., Ltd.
+ * Written by Peter Maydell
+ * Reworked for GICv3 by Shlomo Pongratz and Pavel Fedin
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef QEMU_ARM_GICV3_INTERNAL_H
+#define QEMU_ARM_GICV3_INTERNAL_H
+
+#include "hw/intc/arm_gicv3_common.h"
+
+/* Distributor registers, as offsets from the distributor base address */
+#define GICD_CTLR 0x0000
+#define GICD_TYPER 0x0004
+#define GICD_IIDR 0x0008
+#define GICD_STATUSR 0x0010
+#define GICD_SETSPI_NSR 0x0040
+#define GICD_CLRSPI_NSR 0x0048
+#define GICD_SETSPI_SR 0x0050
+#define GICD_CLRSPI_SR 0x0058
+#define GICD_SEIR 0x0068
+#define GICD_IGROUPR 0x0080
+#define GICD_ISENABLER 0x0100
+#define GICD_ICENABLER 0x0180
+#define GICD_ISPENDR 0x0200
+#define GICD_ICPENDR 0x0280
+#define GICD_ISACTIVER 0x0300
+#define GICD_ICACTIVER 0x0380
+#define GICD_IPRIORITYR 0x0400
+#define GICD_ITARGETSR 0x0800
+#define GICD_ICFGR 0x0C00
+#define GICD_IGRPMODR 0x0D00
+#define GICD_NSACR 0x0E00
+#define GICD_SGIR 0x0F00
+#define GICD_CPENDSGIR 0x0F10
+#define GICD_SPENDSGIR 0x0F20
+#define GICD_IROUTER 0x6000
+#define GICD_IDREGS 0xFFD0
+
+/* GICD_CTLR fields */
+#define GICD_CTLR_EN_GRP0 (1U << 0)
+#define GICD_CTLR_EN_GRP1NS (1U << 1) /* GICv3 5.3.20 */
+#define GICD_CTLR_EN_GRP1S (1U << 2)
+#define GICD_CTLR_EN_GRP1_ALL (GICD_CTLR_EN_GRP1NS | GICD_CTLR_EN_GRP1S)
+/* Bit 4 is ARE if the system doesn't support TrustZone, ARE_S otherwise */
+#define GICD_CTLR_ARE (1U << 4)
+#define GICD_CTLR_ARE_S (1U << 4)
+#define GICD_CTLR_ARE_NS (1U << 5)
+#define GICD_CTLR_DS (1U << 6)
+#define GICD_CTLR_E1NWF (1U << 7)
+#define GICD_CTLR_RWP (1U << 31)
+
+/*
+ * Redistributor frame offsets from RD_base
+ */
+#define GICR_SGI_OFFSET 0x10000
+
+/*
+ * Redistributor registers, offsets from RD_base
+ */
+#define GICR_CTLR 0x0000
+#define GICR_IIDR 0x0004
+#define GICR_TYPER 0x0008
+#define GICR_STATUSR 0x0010
+#define GICR_WAKER 0x0014
+#define GICR_SETLPIR 0x0040
+#define GICR_CLRLPIR 0x0048
+#define GICR_PROPBASER 0x0070
+#define GICR_PENDBASER 0x0078
+#define GICR_INVLPIR 0x00A0
+#define GICR_INVALLR 0x00B0
+#define GICR_SYNCR 0x00C0
+#define GICR_IDREGS 0xFFD0
+
+/* SGI and PPI Redistributor registers, offsets from RD_base */
+#define GICR_IGROUPR0 (GICR_SGI_OFFSET + 0x0080)
+#define GICR_ISENABLER0 (GICR_SGI_OFFSET + 0x0100)
+#define GICR_ICENABLER0 (GICR_SGI_OFFSET + 0x0180)
+#define GICR_ISPENDR0 (GICR_SGI_OFFSET + 0x0200)
+#define GICR_ICPENDR0 (GICR_SGI_OFFSET + 0x0280)
+#define GICR_ISACTIVER0 (GICR_SGI_OFFSET + 0x0300)
+#define GICR_ICACTIVER0 (GICR_SGI_OFFSET + 0x0380)
+#define GICR_IPRIORITYR (GICR_SGI_OFFSET + 0x0400)
+#define GICR_ICFGR0 (GICR_SGI_OFFSET + 0x0C00)
+#define GICR_ICFGR1 (GICR_SGI_OFFSET + 0x0C04)
+#define GICR_IGRPMODR0 (GICR_SGI_OFFSET + 0x0D00)
+#define GICR_NSACR (GICR_SGI_OFFSET + 0x0E00)
+
+#define GICR_CTLR_ENABLE_LPIS (1U << 0)
+#define GICR_CTLR_RWP (1U << 3)
+#define GICR_CTLR_DPG0 (1U << 24)
+#define GICR_CTLR_DPG1NS (1U << 25)
+#define GICR_CTLR_DPG1S (1U << 26)
+#define GICR_CTLR_UWP (1U << 31)
+
+#define GICR_TYPER_PLPIS (1U << 0)
+#define GICR_TYPER_VLPIS (1U << 1)
+#define GICR_TYPER_DIRECTLPI (1U << 3)
+#define GICR_TYPER_LAST (1U << 4)
+#define GICR_TYPER_DPGS (1U << 5)
+#define GICR_TYPER_PROCNUM (0xFFFFU << 8)
+#define GICR_TYPER_COMMONLPIAFF (0x3 << 24)
+#define GICR_TYPER_AFFINITYVALUE (0xFFFFFFFFULL << 32)
+
+#define GICR_WAKER_ProcessorSleep (1U << 1)
+#define GICR_WAKER_ChildrenAsleep (1U << 2)
+
+#define GICR_PROPBASER_OUTER_CACHEABILITY_MASK (7ULL << 56)
+#define GICR_PROPBASER_ADDR_MASK (0xfffffffffULL << 12)
+#define GICR_PROPBASER_SHAREABILITY_MASK (3U << 10)
+#define GICR_PROPBASER_CACHEABILITY_MASK (7U << 7)
+#define GICR_PROPBASER_IDBITS_MASK (0x1f)
+
+#define GICR_PENDBASER_PTZ (1ULL << 62)
+#define GICR_PENDBASER_OUTER_CACHEABILITY_MASK (7ULL << 56)
+#define GICR_PENDBASER_ADDR_MASK (0xffffffffULL << 16)
+#define GICR_PENDBASER_SHAREABILITY_MASK (3U << 10)
+#define GICR_PENDBASER_CACHEABILITY_MASK (7U << 7)
+
+#define ICC_CTLR_EL1_CBPR (1U << 0)
+#define ICC_CTLR_EL1_EOIMODE (1U << 1)
+#define ICC_CTLR_EL1_PMHE (1U << 6)
+#define ICC_CTLR_EL1_PRIBITS_SHIFT 8
+#define ICC_CTLR_EL1_IDBITS_SHIFT 11
+#define ICC_CTLR_EL1_SEIS (1U << 14)
+#define ICC_CTLR_EL1_A3V (1U << 15)
+
+#define ICC_PMR_PRIORITY_MASK 0xff
+#define ICC_BPR_BINARYPOINT_MASK 0x07
+#define ICC_IGRPEN_ENABLE 0x01
+
+#define ICC_CTLR_EL3_CBPR_EL1S (1U << 0)
+#define ICC_CTLR_EL3_CBPR_EL1NS (1U << 1)
+#define ICC_CTLR_EL3_EOIMODE_EL3 (1U << 2)
+#define ICC_CTLR_EL3_EOIMODE_EL1S (1U << 3)
+#define ICC_CTLR_EL3_EOIMODE_EL1NS (1U << 4)
+#define ICC_CTLR_EL3_RM (1U << 5)
+#define ICC_CTLR_EL3_PMHE (1U << 6)
+#define ICC_CTLR_EL3_PRIBITS_SHIFT 8
+#define ICC_CTLR_EL3_IDBITS_SHIFT 11
+#define ICC_CTLR_EL3_SEIS (1U << 14)
+#define ICC_CTLR_EL3_A3V (1U << 15)
+#define ICC_CTLR_EL3_NDS (1U << 17)
+
+/* Special interrupt IDs */
+#define INTID_SECURE 1020
+#define INTID_NONSECURE 1021
+#define INTID_SPURIOUS 1023
+
+/* Functions internal to the emulated GICv3 */
+
+/**
+ * gicv3_redist_update:
+ * @cs: GICv3CPUState for this redistributor
+ *
+ * Recalculate the highest priority pending interrupt after a
+ * change to redistributor state, and inform the CPU accordingly.
+ */
+void gicv3_redist_update(GICv3CPUState *cs);
+
+/**
+ * gicv3_update:
+ * @s: GICv3State
+ * @start: first interrupt whose state changed
+ * @len: length of the range of interrupts whose state changed
+ *
+ * Recalculate the highest priority pending interrupts after a
+ * change to the distributor state affecting @len interrupts
+ * starting at @start, and inform the CPUs accordingly.
+ */
+void gicv3_update(GICv3State *s, int start, int len);
+
+/**
+ * gicv3_full_update_noirqset:
+ * @s: GICv3State
+ *
+ * Recalculate the cached information about highest priority
+ * pending interrupts, but don't inform the CPUs. This should be
+ * called after an incoming migration has loaded new state.
+ */
+void gicv3_full_update_noirqset(GICv3State *s);
+
+/**
+ * gicv3_full_update:
+ * @s: GICv3State
+ *
+ * Recalculate the highest priority pending interrupts after
+ * a change that could affect the status of all interrupts,
+ * and inform the CPUs accordingly.
+ */
+void gicv3_full_update(GICv3State *s);
+MemTxResult gicv3_dist_read(void *opaque, hwaddr offset, uint64_t *data,
+ unsigned size, MemTxAttrs attrs);
+MemTxResult gicv3_dist_write(void *opaque, hwaddr addr, uint64_t data,
+ unsigned size, MemTxAttrs attrs);
+MemTxResult gicv3_redist_read(void *opaque, hwaddr offset, uint64_t *data,
+ unsigned size, MemTxAttrs attrs);
+MemTxResult gicv3_redist_write(void *opaque, hwaddr offset, uint64_t data,
+ unsigned size, MemTxAttrs attrs);
+void gicv3_dist_set_irq(GICv3State *s, int irq, int level);
+void gicv3_redist_set_irq(GICv3CPUState *cs, int irq, int level);
+void gicv3_redist_send_sgi(GICv3CPUState *cs, int grp, int irq, bool ns);
+void gicv3_init_cpuif(GICv3State *s);
+
+/**
+ * gicv3_cpuif_update:
+ * @cs: GICv3CPUState for the CPU to update
+ *
+ * Recalculate whether to assert the IRQ or FIQ lines after a change
+ * to the current highest priority pending interrupt, the CPU's
+ * current running priority or the CPU's current exception level or
+ * security state.
+ */
+void gicv3_cpuif_update(GICv3CPUState *cs);
+
+static inline uint32_t gicv3_iidr(void)
+{
+ /* Return the Implementer Identification Register value
+ * for the emulated GICv3, as reported in GICD_IIDR and GICR_IIDR.
+ *
+ * We claim to be an ARM r0p0 with a zero ProductID.
+ * This is the same as an r0p0 GIC-500.
+ */
+ return 0x43b;
+}
+
+static inline uint32_t gicv3_idreg(int regoffset)
+{
+ /* Return the value of the CoreSight ID register at the specified
+ * offset from the first ID register (as found in the distributor
+ * and redistributor register banks).
+ * These values indicate an ARM implementation of a GICv3.
+ */
+ static const uint8_t gicd_ids[] = {
+ 0x44, 0x00, 0x00, 0x00, 0x92, 0xB4, 0x3B, 0x00, 0x0D, 0xF0, 0x05, 0xB1
+ };
+ return gicd_ids[regoffset / 4];
+}
+
+/**
+ * gicv3_irq_group:
+ *
+ * Return the group which this interrupt is configured as (GICV3_G0,
+ * GICV3_G1 or GICV3_G1NS).
+ */
+static inline int gicv3_irq_group(GICv3State *s, GICv3CPUState *cs, int irq)
+{
+ bool grpbit, grpmodbit;
+
+ if (irq < GIC_INTERNAL) {
+ grpbit = extract32(cs->gicr_igroupr0, irq, 1);
+ grpmodbit = extract32(cs->gicr_igrpmodr0, irq, 1);
+ } else {
+ grpbit = gicv3_gicd_group_test(s, irq);
+ grpmodbit = gicv3_gicd_grpmod_test(s, irq);
+ }
+ if (grpbit) {
+ return GICV3_G1NS;
+ }
+ if (s->gicd_ctlr & GICD_CTLR_DS) {
+ return GICV3_G0;
+ }
+ return grpmodbit ? GICV3_G1 : GICV3_G0;
+}
+
+/**
+ * gicv3_redist_affid:
+ *
+ * Return the 32-bit affinity ID of the CPU connected to this redistributor
+ */
+static inline uint32_t gicv3_redist_affid(GICv3CPUState *cs)
+{
+ return cs->gicr_typer >> 32;
+}
+
+/**
+ * gicv3_cache_target_cpustate:
+ *
+ * Update the cached CPU state corresponding to the target for this interrupt
+ * (which is kept in s->gicd_irouter_target[]).
+ */
+static inline void gicv3_cache_target_cpustate(GICv3State *s, int irq)
+{
+ GICv3CPUState *cs = NULL;
+ int i;
+ uint32_t tgtaff = extract64(s->gicd_irouter[irq], 0, 24) |
+ extract64(s->gicd_irouter[irq], 32, 8) << 24;
+
+ for (i = 0; i < s->num_cpu; i++) {
+ if (s->cpu[i].gicr_typer >> 32 == tgtaff) {
+ cs = &s->cpu[i];
+ break;
+ }
+ }
+
+ s->gicd_irouter_target[irq] = cs;
+}
+
+/**
+ * gicv3_cache_all_target_cpustates:
+ *
+ * Populate the entire cache of CPU state pointers for interrupt targets
+ * (eg after inbound migration or CPU reset)
+ */
+static inline void gicv3_cache_all_target_cpustates(GICv3State *s)
+{
+ int irq;
+
+ for (irq = GIC_INTERNAL; irq < GICV3_MAXIRQ; irq++) {
+ gicv3_cache_target_cpustate(s, irq);
+ }
+}
+
+#endif /* !QEMU_ARM_GIC_INTERNAL_H */
diff --git a/hw/timer/aspeed_timer.c b/hw/timer/aspeed_timer.c
index 4b94808821..9b70ee09b0 100644
--- a/hw/timer/aspeed_timer.c
+++ b/hw/timer/aspeed_timer.c
@@ -10,12 +10,10 @@
*/
#include "qemu/osdep.h"
-#include "hw/ptimer.h"
#include "hw/sysbus.h"
#include "hw/timer/aspeed_timer.h"
#include "qemu-common.h"
#include "qemu/bitops.h"
-#include "qemu/main-loop.h"
#include "qemu/timer.h"
#include "qemu/log.h"
#include "trace.h"
@@ -77,21 +75,96 @@ static inline bool timer_can_pulse(AspeedTimer *t)
return t->id >= TIMER_FIRST_CAP_PULSE;
}
+static inline bool timer_external_clock(AspeedTimer *t)
+{
+ return timer_ctrl_status(t, op_external_clock);
+}
+
+static uint32_t clock_rates[] = { TIMER_CLOCK_APB_HZ, TIMER_CLOCK_EXT_HZ };
+
+static inline uint32_t calculate_rate(struct AspeedTimer *t)
+{
+ return clock_rates[timer_external_clock(t)];
+}
+
+static inline uint32_t calculate_ticks(struct AspeedTimer *t, uint64_t now_ns)
+{
+ uint64_t delta_ns = now_ns - MIN(now_ns, t->start);
+ uint32_t rate = calculate_rate(t);
+ uint64_t ticks = muldiv64(delta_ns, rate, NANOSECONDS_PER_SECOND);
+
+ return t->reload - MIN(t->reload, ticks);
+}
+
+static inline uint64_t calculate_time(struct AspeedTimer *t, uint32_t ticks)
+{
+ uint64_t delta_ns;
+ uint64_t delta_ticks;
+
+ delta_ticks = t->reload - MIN(t->reload, ticks);
+ delta_ns = muldiv64(delta_ticks, NANOSECONDS_PER_SECOND, calculate_rate(t));
+
+ return t->start + delta_ns;
+}
+
+static uint64_t calculate_next(struct AspeedTimer *t)
+{
+ uint64_t next = 0;
+ uint32_t rate = calculate_rate(t);
+
+ while (!next) {
+ /* We don't know the relationship between the values in the match
+ * registers, so sort using MAX/MIN/zero. We sort in that order as the
+ * timer counts down to zero. */
+ uint64_t seq[] = {
+ calculate_time(t, MAX(t->match[0], t->match[1])),
+ calculate_time(t, MIN(t->match[0], t->match[1])),
+ calculate_time(t, 0),
+ };
+ uint64_t reload_ns;
+ uint64_t now = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
+
+ if (now < seq[0]) {
+ next = seq[0];
+ } else if (now < seq[1]) {
+ next = seq[1];
+ } else if (now < seq[2]) {
+ next = seq[2];
+ } else {
+ reload_ns = muldiv64(t->reload, NANOSECONDS_PER_SECOND, rate);
+ t->start = now - ((now - t->start) % reload_ns);
+ }
+ }
+
+ return next;
+}
+
static void aspeed_timer_expire(void *opaque)
{
AspeedTimer *t = opaque;
+ bool interrupt = false;
+ uint32_t ticks;
- /* Only support interrupts on match values of zero for the moment - this is
- * sufficient to boot an aspeed_defconfig Linux kernel.
- *
- * TODO: matching on arbitrary values (see e.g. hw/timer/a9gtimer.c)
- */
- bool match = !(t->match[0] && t->match[1]);
- bool interrupt = timer_overflow_interrupt(t) || match;
- if (timer_enabled(t) && interrupt) {
+ if (!timer_enabled(t)) {
+ return;
+ }
+
+ ticks = calculate_ticks(t, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL));
+
+ if (!ticks) {
+ interrupt = timer_overflow_interrupt(t) || !t->match[0] || !t->match[1];
+ } else if (ticks <= MIN(t->match[0], t->match[1])) {
+ interrupt = true;
+ } else if (ticks <= MAX(t->match[0], t->match[1])) {
+ interrupt = true;
+ }
+
+ if (interrupt) {
t->level = !t->level;
qemu_set_irq(t->irq, t->level);
}
+
+ timer_mod(&t->timer, calculate_next(t));
}
static uint64_t aspeed_timer_get_value(AspeedTimer *t, int reg)
@@ -100,7 +173,7 @@ static uint64_t aspeed_timer_get_value(AspeedTimer *t, int reg)
switch (reg) {
case TIMER_REG_STATUS:
- value = ptimer_get_count(t->timer);
+ value = calculate_ticks(t, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL));
break;
case TIMER_REG_RELOAD:
value = t->reload;
@@ -160,24 +233,22 @@ static void aspeed_timer_set_value(AspeedTimerCtrlState *s, int timer, int reg,
switch (reg) {
case TIMER_REG_STATUS:
if (timer_enabled(t)) {
- ptimer_set_count(t->timer, value);
+ uint64_t now = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
+ int64_t delta = (int64_t) value - (int64_t) calculate_ticks(t, now);
+ uint32_t rate = calculate_rate(t);
+
+ t->start += muldiv64(delta, NANOSECONDS_PER_SECOND, rate);
+ timer_mod(&t->timer, calculate_next(t));
}
break;
case TIMER_REG_RELOAD:
t->reload = value;
- ptimer_set_limit(t->timer, value, 1);
break;
case TIMER_REG_MATCH_FIRST:
case TIMER_REG_MATCH_SECOND:
- if (value) {
- /* Non-zero match values are unsupported. As such an interrupt will
- * always be triggered when the timer reaches zero even if the
- * overflow interrupt control bit is clear.
- */
- qemu_log_mask(LOG_UNIMP, "%s: Match value unsupported by device: "
- "0x%" PRIx32 "\n", __func__, value);
- } else {
- t->match[reg - 2] = value;
+ t->match[reg - 2] = value;
+ if (timer_enabled(t)) {
+ timer_mod(&t->timer, calculate_next(t));
}
break;
default:
@@ -196,21 +267,16 @@ static void aspeed_timer_ctrl_enable(AspeedTimer *t, bool enable)
{
trace_aspeed_timer_ctrl_enable(t->id, enable);
if (enable) {
- ptimer_run(t->timer, 0);
+ t->start = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
+ timer_mod(&t->timer, calculate_next(t));
} else {
- ptimer_stop(t->timer);
- ptimer_set_limit(t->timer, t->reload, 1);
+ timer_del(&t->timer);
}
}
static void aspeed_timer_ctrl_external_clock(AspeedTimer *t, bool enable)
{
trace_aspeed_timer_ctrl_external_clock(t->id, enable);
- if (enable) {
- ptimer_set_freq(t->timer, TIMER_CLOCK_EXT_HZ);
- } else {
- ptimer_set_freq(t->timer, TIMER_CLOCK_APB_HZ);
- }
}
static void aspeed_timer_ctrl_overflow_interrupt(AspeedTimer *t, bool enable)
@@ -351,12 +417,10 @@ static const MemoryRegionOps aspeed_timer_ops = {
static void aspeed_init_one_timer(AspeedTimerCtrlState *s, uint8_t id)
{
- QEMUBH *bh;
AspeedTimer *t = &s->timers[id];
t->id = id;
- bh = qemu_bh_new(aspeed_timer_expire, t);
- t->timer = ptimer_init(bh);
+ timer_init_ns(&t->timer, QEMU_CLOCK_VIRTUAL, aspeed_timer_expire, t);
}
static void aspeed_timer_realize(DeviceState *dev, Error **errp)
@@ -399,12 +463,12 @@ static void aspeed_timer_reset(DeviceState *dev)
static const VMStateDescription vmstate_aspeed_timer = {
.name = "aspeed.timer",
- .version_id = 1,
- .minimum_version_id = 1,
+ .version_id = 2,
+ .minimum_version_id = 2,
.fields = (VMStateField[]) {
VMSTATE_UINT8(id, AspeedTimer),
VMSTATE_INT32(level, AspeedTimer),
- VMSTATE_PTIMER(timer, AspeedTimer),
+ VMSTATE_TIMER(timer, AspeedTimer),
VMSTATE_UINT32(reload, AspeedTimer),
VMSTATE_UINT32_ARRAY(match, AspeedTimer, 2),
VMSTATE_END_OF_LIST()
@@ -419,7 +483,7 @@ static const VMStateDescription vmstate_aspeed_timer_state = {
VMSTATE_UINT32(ctrl, AspeedTimerCtrlState),
VMSTATE_UINT32(ctrl2, AspeedTimerCtrlState),
VMSTATE_STRUCT_ARRAY(timers, AspeedTimerCtrlState,
- ASPEED_TIMER_NR_TIMERS, 1, vmstate_aspeed_timer,
+ ASPEED_TIMER_NR_TIMERS, 2, vmstate_aspeed_timer,
AspeedTimer),
VMSTATE_END_OF_LIST()
}