arm_gicv3_cpuif.c · samitouri/QOSamiQemu

Code Commits Issues Pulls Sessions CI/CD

master

c 3,204 lines 99.9 KB

Raw

1	/*
2	* ARM Generic Interrupt Controller v3 (emulation)
3	*
4	* Copyright (c) 2016 Linaro Limited
5	* Written by Peter Maydell
6	*
7	* This code is licensed under the GPL, version 2 or (at your option)
8	* any later version.
9	*/
10
11	/* This file contains the code for the system register interface
12	* portions of the GICv3.
13	*/
14
15	#include "qemu/osdep.h"
16	#include "qemu/bitops.h"
17	#include "qemu/log.h"
18	#include "qemu/main-loop.h"
19	#include "qapi/error.h"
20	#include "trace.h"
21	#include "gicv3_internal.h"
22	#include "hw/core/irq.h"
23	#include "target/arm/cpu.h"
24	#include "target/arm/cpregs.h"
25	#include "target/arm/cpu-features.h"
26	#include "target/arm/internals.h"
27	#include "system/tcg.h"
28	#include "system/qtest.h"
29
30	/*
31	* Special case return value from hppvi_index(); must be larger than
32	* the architecturally maximum possible list register index (which is 15)
33	*/
34	#define HPPVI_INDEX_VLPI 16
35
36	static GICv3CPUState icc_cs_from_env(CPUARMState env)
37	{
38	return env->gicv3state;
39	}
40
41	static bool gicv3_use_ns_bank(CPUARMState *env)
42	{
43	/* Return true if we should use the NonSecure bank for a banked GIC
44	* CPU interface register. Note that this differs from the
45	* access_secure_reg() function because GICv3 banked registers are
46	* banked even for AArch64, unlike the other CPU system registers.
47	*/
48	return !arm_is_secure_below_el3(env);
49	}
50
51	/* The minimum BPR for the virtual interface is a configurable property */
52	static inline int icv_min_vbpr(GICv3CPUState *cs)
53	{
54	return 7 - cs->vprebits;
55	}
56
57	static inline int ich_num_aprs(GICv3CPUState *cs)
58	{
59	/* Return the number of virtual APR registers (1, 2, or 4) */
60	int aprmax = 1 << (cs->vprebits - 5);
61	assert(aprmax <= ARRAY_SIZE(cs->ich_apr[0]));
62	return aprmax;
63	}
64
65	/* Simple accessor functions for LR fields */
66	static uint32_t ich_lr_vintid(uint64_t lr)
67	{
68	return extract64(lr, ICH_LR_EL2_VINTID_SHIFT, ICH_LR_EL2_VINTID_LENGTH);
69	}
70
71	static uint32_t ich_lr_pintid(uint64_t lr)
72	{
73	return extract64(lr, ICH_LR_EL2_PINTID_SHIFT, ICH_LR_EL2_PINTID_LENGTH);
74	}
75
76	static uint32_t ich_lr_prio(uint64_t lr)
77	{
78	return extract64(lr, ICH_LR_EL2_PRIORITY_SHIFT, ICH_LR_EL2_PRIORITY_LENGTH);
79	}
80
81	static int ich_lr_state(uint64_t lr)
82	{
83	return extract64(lr, ICH_LR_EL2_STATE_SHIFT, ICH_LR_EL2_STATE_LENGTH);
84	}
85
86	static bool icv_access(CPUARMState *env, int hcr_flags)
87	{
88	/* Return true if this ICC_ register access should really be
89	* directed to an ICV_ access. hcr_flags is a mask of
90	* HCR_EL2 bits to check: we treat this as an ICV_ access
91	* if we are in NS EL1 and at least one of the specified
92	* HCR_EL2 bits is set.
93	*
94	* ICV registers fall into four categories:
95	* * access if NS EL1 and HCR_EL2.FMO == 1:
96	* all ICV regs with '0' in their name
97	* * access if NS EL1 and HCR_EL2.IMO == 1:
98	* all ICV regs with '1' in their name
99	* * access if NS EL1 and either IMO or FMO == 1:
100	* CTLR, DIR, PMR, RPR
101	*/
102	uint64_t hcr_el2 = arm_hcr_el2_eff(env);
103	bool flagmatch = hcr_el2 & hcr_flags & (HCR_IMO \| HCR_FMO);
104
105	return flagmatch && arm_current_el(env) == 1
106	&& !arm_is_secure_below_el3(env);
107	}
108
109	static int read_vbpr(GICv3CPUState *cs, int grp)
110	{
111	/* Read VBPR value out of the VMCR field (caller must handle
112	* VCBPR effects if required)
113	*/
114	if (grp == GICV3_G0) {
115	return extract64(cs->ich_vmcr_el2, ICH_VMCR_EL2_VBPR0_SHIFT,
116	ICH_VMCR_EL2_VBPR0_LENGTH);
117	} else {
118	return extract64(cs->ich_vmcr_el2, ICH_VMCR_EL2_VBPR1_SHIFT,
119	ICH_VMCR_EL2_VBPR1_LENGTH);
120	}
121	}
122
123	static void write_vbpr(GICv3CPUState *cs, int grp, int value)
124	{
125	/* Write new VBPR1 value, handling the "writing a value less than
126	* the minimum sets it to the minimum" semantics.
127	*/
128	int min = icv_min_vbpr(cs);
129
130	if (grp != GICV3_G0) {
131	min++;
132	}
133
134	value = MAX(value, min);
135
136	if (grp == GICV3_G0) {
137	cs->ich_vmcr_el2 = deposit64(cs->ich_vmcr_el2, ICH_VMCR_EL2_VBPR0_SHIFT,
138	ICH_VMCR_EL2_VBPR0_LENGTH, value);
139	} else {
140	cs->ich_vmcr_el2 = deposit64(cs->ich_vmcr_el2, ICH_VMCR_EL2_VBPR1_SHIFT,
141	ICH_VMCR_EL2_VBPR1_LENGTH, value);
142	}
143	}
144
145	static uint32_t icv_fullprio_mask(GICv3CPUState *cs)
146	{
147	/* Return a mask word which clears the unimplemented priority bits
148	* from a priority value for a virtual interrupt. (Not to be confused
149	* with the group priority, whose mask depends on the value of VBPR
150	* for the interrupt group.)
151	*/
152	return (~0U << (8 - cs->vpribits)) & 0xff;
153	}
154
155	static int ich_highest_active_virt_prio(GICv3CPUState *cs)
156	{
157	/* Calculate the current running priority based on the set bits
158	* in the ICH Active Priority Registers.
159	*/
160	int i;
161	int aprmax = ich_num_aprs(cs);
162
163	if (cs->ich_apr[GICV3_G1NS][0] & ICV_AP1R_EL1_NMI) {
164	return 0x0;
165	}
166
167	for (i = 0; i < aprmax; i++) {
168	uint32_t apr = cs->ich_apr[GICV3_G0][i] \|
169	cs->ich_apr[GICV3_G1NS][i];
170
171	if (!apr) {
172	continue;
173	}
174	return (i * 32 + ctz32(apr)) << (icv_min_vbpr(cs) + 1);
175	}
176	/* No current active interrupts: return idle priority */
177	return 0xff;
178	}
179
180	static int hppvi_index(GICv3CPUState *cs)
181	{
182	/*
183	* Return the list register index of the highest priority pending
184	* virtual interrupt, as per the HighestPriorityVirtualInterrupt
185	* pseudocode. If no pending virtual interrupts, return -1.
186	* If the highest priority pending virtual interrupt is a vLPI,
187	* return HPPVI_INDEX_VLPI.
188	* (The pseudocode handles checking whether the vLPI is higher
189	* priority than the highest priority list register at every
190	* callsite of HighestPriorityVirtualInterrupt; we check it here.)
191	*/
192	ARMCPU *cpu = ARM_CPU(cs->cpu);
193	CPUARMState *env = &cpu->env;
194	int idx = -1;
195	int i;
196	/* Note that a list register entry with a priority of 0xff will
197	* never be reported by this function; this is the architecturally
198	* correct behaviour.
199	*/
200	int prio = 0xff;
201	bool nmi = false;
202
203	if (!(cs->ich_vmcr_el2 & (ICH_VMCR_EL2_VENG0 \| ICH_VMCR_EL2_VENG1))) {
204	/* Both groups disabled, definitely nothing to do */
205	return idx;
206	}
207
208	for (i = 0; i < cs->num_list_regs; i++) {
209	uint64_t lr = cs->ich_lr_el2[i];
210	bool thisnmi;
211	int thisprio;
212
213	if (ich_lr_state(lr) != ICH_LR_EL2_STATE_PENDING) {
214	/* Not Pending */
215	continue;
216	}
217
218	/* Ignore interrupts if relevant group enable not set */
219	if (lr & ICH_LR_EL2_GROUP) {
220	if (!(cs->ich_vmcr_el2 & ICH_VMCR_EL2_VENG1)) {
221	continue;
222	}
223	} else {
224	if (!(cs->ich_vmcr_el2 & ICH_VMCR_EL2_VENG0)) {
225	continue;
226	}
227	}
228
229	thisnmi = lr & ICH_LR_EL2_NMI;
230	thisprio = ich_lr_prio(lr);
231
232	if ((thisprio < prio) \|\| ((thisprio == prio) && (thisnmi & (!nmi)))) {
233	prio = thisprio;
234	nmi = thisnmi;
235	idx = i;
236	}
237	}
238
239	/*
240	* "no pending vLPI" is indicated with prio = 0xff, which always
241	* fails the priority check here. vLPIs are only considered
242	* when we are in Non-Secure state.
243	*/
244	if (cs->hppvlpi.prio < prio && !arm_is_secure(env)) {
245	if (cs->hppvlpi.grp == GICV3_G0) {
246	if (cs->ich_vmcr_el2 & ICH_VMCR_EL2_VENG0) {
247	return HPPVI_INDEX_VLPI;
248	}
249	} else {
250	if (cs->ich_vmcr_el2 & ICH_VMCR_EL2_VENG1) {
251	return HPPVI_INDEX_VLPI;
252	}
253	}
254	}
255
256	return idx;
257	}
258
259	static uint32_t icv_gprio_mask(GICv3CPUState *cs, int group)
260	{
261	/* Return a mask word which clears the subpriority bits from
262	* a priority value for a virtual interrupt in the specified group.
263	* This depends on the VBPR value.
264	* If using VBPR0 then:
265	* a BPR of 0 means the group priority bits are [7:1];
266	* a BPR of 1 means they are [7:2], and so on down to
267	* a BPR of 7 meaning no group priority bits at all.
268	* If using VBPR1 then:
269	* a BPR of 0 is impossible (the minimum value is 1)
270	* a BPR of 1 means the group priority bits are [7:1];
271	* a BPR of 2 means they are [7:2], and so on down to
272	* a BPR of 7 meaning the group priority is [7].
273	*
274	* Which BPR to use depends on the group of the interrupt and
275	* the current ICH_VMCR_EL2.VCBPR settings.
276	*
277	* This corresponds to the VGroupBits() pseudocode.
278	*/
279	int bpr;
280
281	if (group == GICV3_G1NS && cs->ich_vmcr_el2 & ICH_VMCR_EL2_VCBPR) {
282	group = GICV3_G0;
283	}
284
285	bpr = read_vbpr(cs, group);
286	if (group == GICV3_G1NS) {
287	assert(bpr > 0);
288	bpr--;
289	}
290
291	return ~0U << (bpr + 1);
292	}
293
294	static bool icv_hppi_can_preempt(GICv3CPUState *cs, uint64_t lr)
295	{
296	/* Return true if we can signal this virtual interrupt defined by
297	* the given list register value; see the pseudocode functions
298	* CanSignalVirtualInterrupt and CanSignalVirtualInt.
299	* Compare also icc_hppi_can_preempt() which is the non-virtual
300	* equivalent of these checks.
301	*/
302	int grp;
303	bool is_nmi;
304	uint32_t mask, prio, rprio, vpmr;
305
306	if (!(cs->ich_hcr_el2 & ICH_HCR_EL2_EN)) {
307	/* Virtual interface disabled */
308	return false;
309	}
310
311	/* We don't need to check that this LR is in Pending state because
312	* that has already been done in hppvi_index().
313	*/
314
315	prio = ich_lr_prio(lr);
316	is_nmi = lr & ICH_LR_EL2_NMI;
317	vpmr = extract64(cs->ich_vmcr_el2, ICH_VMCR_EL2_VPMR_SHIFT,
318	ICH_VMCR_EL2_VPMR_LENGTH);
319
320	if (!is_nmi && prio >= vpmr) {
321	/* Priority mask masks this interrupt */
322	return false;
323	}
324
325	rprio = ich_highest_active_virt_prio(cs);
326	if (rprio == 0xff) {
327	/* No running interrupt so we can preempt */
328	return true;
329	}
330
331	grp = (lr & ICH_LR_EL2_GROUP) ? GICV3_G1NS : GICV3_G0;
332
333	mask = icv_gprio_mask(cs, grp);
334
335	/* We only preempt a running interrupt if the pending interrupt's
336	* group priority is sufficient (the subpriorities are not considered).
337	*/
338	if ((prio & mask) < (rprio & mask)) {
339	return true;
340	}
341
342	if ((prio & mask) == (rprio & mask) && is_nmi &&
343	!(cs->ich_apr[GICV3_G1NS][0] & ICV_AP1R_EL1_NMI)) {
344	return true;
345	}
346
347	return false;
348	}
349
350	static bool icv_hppvlpi_can_preempt(GICv3CPUState *cs)
351	{
352	/*
353	* Return true if we can signal the highest priority pending vLPI.
354	* We can assume we're Non-secure because hppvi_index() already
355	* tested for that.
356	*/
357	uint32_t mask, rprio, vpmr;
358
359	if (!(cs->ich_hcr_el2 & ICH_HCR_EL2_EN)) {
360	/* Virtual interface disabled */
361	return false;
362	}
363
364	vpmr = extract64(cs->ich_vmcr_el2, ICH_VMCR_EL2_VPMR_SHIFT,
365	ICH_VMCR_EL2_VPMR_LENGTH);
366
367	if (cs->hppvlpi.prio >= vpmr) {
368	/* Priority mask masks this interrupt */
369	return false;
370	}
371
372	rprio = ich_highest_active_virt_prio(cs);
373	if (rprio == 0xff) {
374	/* No running interrupt so we can preempt */
375	return true;
376	}
377
378	mask = icv_gprio_mask(cs, cs->hppvlpi.grp);
379
380	/*
381	* We only preempt a running interrupt if the pending interrupt's
382	* group priority is sufficient (the subpriorities are not considered).
383	*/
384	if ((cs->hppvlpi.prio & mask) < (rprio & mask)) {
385	return true;
386	}
387
388	return false;
389	}
390
391	static uint32_t eoi_maintenance_interrupt_state(GICv3CPUState *cs,
392	uint32_t *misr)
393	{
394	/* Return a set of bits indicating the EOI maintenance interrupt status
395	* for each list register. The EOI maintenance interrupt status is
396	* 1 if LR.State == 0 && LR.HW == 0 && LR.EOI == 1
397	* (see the GICv3 spec for the ICH_EISR_EL2 register).
398	* If misr is not NULL then we should also collect the information
399	* about the MISR.EOI, MISR.NP and MISR.U bits.
400	*/
401	uint32_t value = 0;
402	int validcount = 0;
403	bool seenpending = false;
404	int i;
405
406	for (i = 0; i < cs->num_list_regs; i++) {
407	uint64_t lr = cs->ich_lr_el2[i];
408
409	if ((lr & (ICH_LR_EL2_STATE_MASK \| ICH_LR_EL2_HW \| ICH_LR_EL2_EOI))
410	== ICH_LR_EL2_EOI) {
411	value \|= (1 << i);
412	}
413	if ((lr & ICH_LR_EL2_STATE_MASK)) {
414	validcount++;
415	}
416	if (ich_lr_state(lr) == ICH_LR_EL2_STATE_PENDING) {
417	seenpending = true;
418	}
419	}
420
421	if (misr) {
422	if (validcount < 2 && (cs->ich_hcr_el2 & ICH_HCR_EL2_UIE)) {
423	*misr \|= ICH_MISR_EL2_U;
424	}
425	if (!seenpending && (cs->ich_hcr_el2 & ICH_HCR_EL2_NPIE)) {
426	*misr \|= ICH_MISR_EL2_NP;
427	}
428	if (value) {
429	*misr \|= ICH_MISR_EL2_EOI;
430	}
431	}
432	return value;
433	}
434
435	static uint32_t maintenance_interrupt_state(GICv3CPUState *cs)
436	{
437	/* Return a set of bits indicating the maintenance interrupt status
438	* (as seen in the ICH_MISR_EL2 register).
439	*/
440	uint32_t value = 0;
441
442	/* Scan list registers and fill in the U, NP and EOI bits */
443	eoi_maintenance_interrupt_state(cs, &value);
444
445	if ((cs->ich_hcr_el2 & ICH_HCR_EL2_LRENPIE) &&
446	(cs->ich_hcr_el2 & ICH_HCR_EL2_EOICOUNT_MASK)) {
447	value \|= ICH_MISR_EL2_LRENP;
448	}
449
450	if ((cs->ich_hcr_el2 & ICH_HCR_EL2_VGRP0EIE) &&
451	(cs->ich_vmcr_el2 & ICH_VMCR_EL2_VENG0)) {
452	value \|= ICH_MISR_EL2_VGRP0E;
453	}
454
455	if ((cs->ich_hcr_el2 & ICH_HCR_EL2_VGRP0DIE) &&
456	!(cs->ich_vmcr_el2 & ICH_VMCR_EL2_VENG1)) {
457	value \|= ICH_MISR_EL2_VGRP0D;
458	}
459	if ((cs->ich_hcr_el2 & ICH_HCR_EL2_VGRP1EIE) &&
460	(cs->ich_vmcr_el2 & ICH_VMCR_EL2_VENG1)) {
461	value \|= ICH_MISR_EL2_VGRP1E;
462	}
463
464	if ((cs->ich_hcr_el2 & ICH_HCR_EL2_VGRP1DIE) &&
465	!(cs->ich_vmcr_el2 & ICH_VMCR_EL2_VENG1)) {
466	value \|= ICH_MISR_EL2_VGRP1D;
467	}
468
469	return value;
470	}
471
472	void gicv3_cpuif_virt_irq_fiq_update(GICv3CPUState *cs)
473	{
474	/*
475	* Tell the CPU about any pending virtual interrupts.
476	* This should only be called for changes that affect the
477	* vIRQ and vFIQ status and do not change the maintenance
478	* interrupt status. This means that unlike gicv3_cpuif_virt_update()
479	* this function won't recursively call back into the GIC code.
480	* The main use of this is when the redistributor has changed the
481	* highest priority pending virtual LPI.
482	*/
483	int idx;
484	int irqlevel = 0;
485	int fiqlevel = 0;
486	int nmilevel = 0;
487
488	idx = hppvi_index(cs);
489	trace_gicv3_cpuif_virt_update(gicv3_redist_affid(cs), idx,
490	cs->hppvlpi.irq, cs->hppvlpi.grp,
491	cs->hppvlpi.prio);
492	if (idx == HPPVI_INDEX_VLPI) {
493	if (icv_hppvlpi_can_preempt(cs)) {
494	if (cs->hppvlpi.grp == GICV3_G0) {
495	fiqlevel = 1;
496	} else {
497	irqlevel = 1;
498	}
499	}
500	} else if (idx >= 0) {
501	uint64_t lr = cs->ich_lr_el2[idx];
502
503	if (icv_hppi_can_preempt(cs, lr)) {
504	/*
505	* Virtual interrupts are simple: G0 are always FIQ, and G1 are
506	* IRQ or NMI which depends on the ICH_LR<n>_EL2.NMI to have
507	* non-maskable property.
508	*/
509	if (lr & ICH_LR_EL2_GROUP) {
510	if (lr & ICH_LR_EL2_NMI) {
511	nmilevel = 1;
512	} else {
513	irqlevel = 1;
514	}
515	} else {
516	fiqlevel = 1;
517	}
518	}
519	}
520
521	trace_gicv3_cpuif_virt_set_irqs(gicv3_redist_affid(cs), fiqlevel, irqlevel);
522	qemu_set_irq(cs->parent_vfiq, fiqlevel);
523	qemu_set_irq(cs->parent_virq, irqlevel);
524	qemu_set_irq(cs->parent_vnmi, nmilevel);
525	}
526
527	static void gicv3_cpuif_virt_update(GICv3CPUState *cs)
528	{
529	/*
530	* Tell the CPU about any pending virtual interrupts or
531	* maintenance interrupts, following a change to the state
532	* of the CPU interface relevant to virtual interrupts.
533	*
534	* CAUTION: this function will call qemu_set_irq() on the
535	* CPU maintenance IRQ line, which is typically wired up
536	* to the GIC as a per-CPU interrupt. This means that it
537	* will recursively call back into the GIC code via
538	* gicv3_redist_set_irq() and thus into the CPU interface code's
539	* gicv3_cpuif_update(). It is therefore important that this
540	* function is only called as the final action of a CPU interface
541	* register write implementation, after all the GIC state
542	* fields have been updated. gicv3_cpuif_update() also must
543	* not cause this function to be called, but that happens
544	* naturally as a result of there being no architectural
545	* linkage between the physical and virtual GIC logic.
546	*/
547	ARMCPU *cpu = ARM_CPU(cs->cpu);
548	int maintlevel = 0;
549
550	gicv3_cpuif_virt_irq_fiq_update(cs);
551
552	if ((cs->ich_hcr_el2 & ICH_HCR_EL2_EN) &&
553	maintenance_interrupt_state(cs) != 0) {
554	maintlevel = 1;
555	}
556
557	trace_gicv3_cpuif_virt_set_maint_irq(gicv3_redist_affid(cs), maintlevel);
558	qemu_set_irq(cpu->gicv3_maintenance_interrupt, maintlevel);
559	}
560
561	static uint64_t icv_ap_read(CPUARMState env, const ARMCPRegInfo ri)
562	{
563	GICv3CPUState *cs = icc_cs_from_env(env);
564	int regno = ri->opc2 & 3;
565	int grp = (ri->crm & 1) ? GICV3_G1NS : GICV3_G0;
566	uint64_t value = cs->ich_apr[grp][regno];
567
568	trace_gicv3_icv_ap_read(ri->crm & 1, regno, gicv3_redist_affid(cs), value);
569	return value;
570	}
571
572	static void icv_ap_write(CPUARMState env, const ARMCPRegInfo ri,
573	uint64_t value)
574	{
575	GICv3CPUState *cs = icc_cs_from_env(env);
576	int regno = ri->opc2 & 3;
577	int grp = (ri->crm & 1) ? GICV3_G1NS : GICV3_G0;
578
579	trace_gicv3_icv_ap_write(ri->crm & 1, regno, gicv3_redist_affid(cs), value);
580
581	if (cs->nmi_support) {
582	cs->ich_apr[grp][regno] = value & (0xFFFFFFFFU \| ICV_AP1R_EL1_NMI);
583	} else {
584	cs->ich_apr[grp][regno] = value & 0xFFFFFFFFU;
585	}
586
587	gicv3_cpuif_virt_irq_fiq_update(cs);
588	}
589
590	static uint64_t icv_bpr_read(CPUARMState env, const ARMCPRegInfo ri)
591	{
592	GICv3CPUState *cs = icc_cs_from_env(env);
593	int grp = (ri->crm == 8) ? GICV3_G0 : GICV3_G1NS;
594	uint64_t bpr;
595	bool satinc = false;
596
597	if (grp == GICV3_G1NS && (cs->ich_vmcr_el2 & ICH_VMCR_EL2_VCBPR)) {
598	/* reads return bpr0 + 1 saturated to 7, writes ignored */
599	grp = GICV3_G0;
600	satinc = true;
601	}
602
603	bpr = read_vbpr(cs, grp);
604
605	if (satinc) {
606	bpr++;
607	bpr = MIN(bpr, 7);
608	}
609
610	trace_gicv3_icv_bpr_read(ri->crm == 8 ? 0 : 1, gicv3_redist_affid(cs), bpr);
611
612	return bpr;
613	}
614
615	static void icv_bpr_write(CPUARMState env, const ARMCPRegInfo ri,
616	uint64_t value)
617	{
618	GICv3CPUState *cs = icc_cs_from_env(env);
619	int grp = (ri->crm == 8) ? GICV3_G0 : GICV3_G1NS;
620
621	trace_gicv3_icv_bpr_write(ri->crm == 8 ? 0 : 1,
622	gicv3_redist_affid(cs), value);
623
624	if (grp == GICV3_G1NS && (cs->ich_vmcr_el2 & ICH_VMCR_EL2_VCBPR)) {
625	/* reads return bpr0 + 1 saturated to 7, writes ignored */
626	return;
627	}
628
629	write_vbpr(cs, grp, value);
630
631	gicv3_cpuif_virt_irq_fiq_update(cs);
632	}
633
634	static uint64_t icv_pmr_read(CPUARMState env, const ARMCPRegInfo ri)
635	{
636	GICv3CPUState *cs = icc_cs_from_env(env);
637	uint64_t value;
638
639	value = extract64(cs->ich_vmcr_el2, ICH_VMCR_EL2_VPMR_SHIFT,
640	ICH_VMCR_EL2_VPMR_LENGTH);
641
642	trace_gicv3_icv_pmr_read(gicv3_redist_affid(cs), value);
643	return value;
644	}
645
646	static void icv_pmr_write(CPUARMState env, const ARMCPRegInfo ri,
647	uint64_t value)
648	{
649	GICv3CPUState *cs = icc_cs_from_env(env);
650
651	trace_gicv3_icv_pmr_write(gicv3_redist_affid(cs), value);
652
653	value &= icv_fullprio_mask(cs);
654
655	cs->ich_vmcr_el2 = deposit64(cs->ich_vmcr_el2, ICH_VMCR_EL2_VPMR_SHIFT,
656	ICH_VMCR_EL2_VPMR_LENGTH, value);
657
658	gicv3_cpuif_virt_irq_fiq_update(cs);
659	}
660
661	static uint64_t icv_igrpen_read(CPUARMState env, const ARMCPRegInfo ri)
662	{
663	GICv3CPUState *cs = icc_cs_from_env(env);
664	int enbit;
665	uint64_t value;
666
667	enbit = ri->opc2 & 1 ? ICH_VMCR_EL2_VENG1_SHIFT : ICH_VMCR_EL2_VENG0_SHIFT;
668	value = extract64(cs->ich_vmcr_el2, enbit, 1);
669
670	trace_gicv3_icv_igrpen_read(ri->opc2 & 1 ? 1 : 0,
671	gicv3_redist_affid(cs), value);
672	return value;
673	}
674
675	static void icv_igrpen_write(CPUARMState env, const ARMCPRegInfo ri,
676	uint64_t value)
677	{
678	GICv3CPUState *cs = icc_cs_from_env(env);
679	int enbit;
680
681	trace_gicv3_icv_igrpen_write(ri->opc2 & 1 ? 1 : 0,
682	gicv3_redist_affid(cs), value);
683
684	enbit = ri->opc2 & 1 ? ICH_VMCR_EL2_VENG1_SHIFT : ICH_VMCR_EL2_VENG0_SHIFT;
685
686	cs->ich_vmcr_el2 = deposit64(cs->ich_vmcr_el2, enbit, 1, value);
687	gicv3_cpuif_virt_update(cs);
688	}
689
690	static uint64_t icv_ctlr_read(CPUARMState env, const ARMCPRegInfo ri)
691	{
692	GICv3CPUState *cs = icc_cs_from_env(env);
693	uint64_t value;
694
695	/* Note that the fixed fields here (A3V, SEIS, IDbits, PRIbits)
696	* should match the ones reported in ich_vtr_read().
697	*/
698	value = ICC_CTLR_EL1_A3V \| (1 << ICC_CTLR_EL1_IDBITS_SHIFT) \|
699	((cs->vpribits - 1) << ICC_CTLR_EL1_PRIBITS_SHIFT);
700
701	if (cs->ich_vmcr_el2 & ICH_VMCR_EL2_VEOIM) {
702	value \|= ICC_CTLR_EL1_EOIMODE;
703	}
704
705	if (cs->ich_vmcr_el2 & ICH_VMCR_EL2_VCBPR) {
706	value \|= ICC_CTLR_EL1_CBPR;
707	}
708
709	trace_gicv3_icv_ctlr_read(gicv3_redist_affid(cs), value);
710	return value;
711	}
712
713	static void icv_ctlr_write(CPUARMState env, const ARMCPRegInfo ri,
714	uint64_t value)
715	{
716	GICv3CPUState *cs = icc_cs_from_env(env);
717
718	trace_gicv3_icv_ctlr_write(gicv3_redist_affid(cs), value);
719
720	cs->ich_vmcr_el2 = deposit64(cs->ich_vmcr_el2, ICH_VMCR_EL2_VCBPR_SHIFT,
721	1, value & ICC_CTLR_EL1_CBPR ? 1 : 0);
722	cs->ich_vmcr_el2 = deposit64(cs->ich_vmcr_el2, ICH_VMCR_EL2_VEOIM_SHIFT,
723	1, value & ICC_CTLR_EL1_EOIMODE ? 1 : 0);
724
725	gicv3_cpuif_virt_irq_fiq_update(cs);
726	}
727
728	static uint64_t icv_rpr_read(CPUARMState env, const ARMCPRegInfo ri)
729	{
730	GICv3CPUState *cs = icc_cs_from_env(env);
731	uint64_t prio = ich_highest_active_virt_prio(cs);
732
733	if (cs->ich_apr[GICV3_G1NS][0] & ICV_AP1R_EL1_NMI) {
734	prio \|= ICV_RPR_EL1_NMI;
735	}
736
737	trace_gicv3_icv_rpr_read(gicv3_redist_affid(cs), prio);
738	return prio;
739	}
740
741	static uint64_t icv_hppir_read(CPUARMState env, const ARMCPRegInfo ri)
742	{
743	GICv3CPUState *cs = icc_cs_from_env(env);
744	int grp = ri->crm == 8 ? GICV3_G0 : GICV3_G1NS;
745	int idx = hppvi_index(cs);
746	uint64_t value = INTID_SPURIOUS;
747
748	if (idx == HPPVI_INDEX_VLPI) {
749	if (cs->hppvlpi.grp == grp) {
750	value = cs->hppvlpi.irq;
751	}
752	} else if (idx >= 0) {
753	uint64_t lr = cs->ich_lr_el2[idx];
754	int thisgrp = (lr & ICH_LR_EL2_GROUP) ? GICV3_G1NS : GICV3_G0;
755
756	if (grp == thisgrp) {
757	value = ich_lr_vintid(lr);
758	}
759	}
760
761	trace_gicv3_icv_hppir_read(ri->crm == 8 ? 0 : 1,
762	gicv3_redist_affid(cs), value);
763	return value;
764	}
765
766	static void icv_activate_irq(GICv3CPUState *cs, int idx, int grp)
767	{
768	/* Activate the interrupt in the specified list register
769	* by moving it from Pending to Active state, and update the
770	* Active Priority Registers.
771	*/
772	uint32_t mask = icv_gprio_mask(cs, grp);
773	int prio = ich_lr_prio(cs->ich_lr_el2[idx]) & mask;
774	bool nmi = cs->ich_lr_el2[idx] & ICH_LR_EL2_NMI;
775	int aprbit = prio >> (8 - cs->vprebits);
776	int regno = aprbit / 32;
777	int regbit = aprbit % 32;
778
779	cs->ich_lr_el2[idx] &= ~ICH_LR_EL2_STATE_PENDING_BIT;
780	cs->ich_lr_el2[idx] \|= ICH_LR_EL2_STATE_ACTIVE_BIT;
781
782	if (nmi) {
783	cs->ich_apr[grp][regno] \|= ICV_AP1R_EL1_NMI;
784	} else {
785	cs->ich_apr[grp][regno] \|= (1U << regbit);
786	}
787	}
788
789	static void icv_activate_vlpi(GICv3CPUState *cs)
790	{
791	uint32_t mask = icv_gprio_mask(cs, cs->hppvlpi.grp);
792	int prio = cs->hppvlpi.prio & mask;
793	int aprbit = prio >> (8 - cs->vprebits);
794	int regno = aprbit / 32;
795	int regbit = aprbit % 32;
796
797	cs->ich_apr[cs->hppvlpi.grp][regno] \|= (1U << regbit);
798	gicv3_redist_vlpi_pending(cs, cs->hppvlpi.irq, 0);
799	}
800
801	static uint64_t icv_iar_read(CPUARMState env, const ARMCPRegInfo ri)
802	{
803	GICv3CPUState *cs = icc_cs_from_env(env);
804	int grp = ri->crm == 8 ? GICV3_G0 : GICV3_G1NS;
805	int idx = hppvi_index(cs);
806	uint64_t intid = INTID_SPURIOUS;
807	int el = arm_current_el(env);
808
809	if (idx == HPPVI_INDEX_VLPI) {
810	if (cs->hppvlpi.grp == grp && icv_hppvlpi_can_preempt(cs)) {
811	intid = cs->hppvlpi.irq;
812	icv_activate_vlpi(cs);
813	}
814	} else if (idx >= 0) {
815	uint64_t lr = cs->ich_lr_el2[idx];
816	int thisgrp = (lr & ICH_LR_EL2_GROUP) ? GICV3_G1NS : GICV3_G0;
817	bool nmi = env->cp15.sctlr_el[el] & SCTLR_NMI && lr & ICH_LR_EL2_NMI;
818
819	if (thisgrp == grp && icv_hppi_can_preempt(cs, lr)) {
820	intid = ich_lr_vintid(lr);
821	if (!gicv3_intid_is_special(intid)) {
822	if (!nmi) {
823	icv_activate_irq(cs, idx, grp);
824	} else {
825	intid = INTID_NMI;
826	}
827	} else {
828	/* Interrupt goes from Pending to Invalid */
829	cs->ich_lr_el2[idx] &= ~ICH_LR_EL2_STATE_PENDING_BIT;
830	/* We will now return the (bogus) ID from the list register,
831	* as per the pseudocode.
832	*/
833	}
834	}
835	}
836
837	trace_gicv3_icv_iar_read(ri->crm == 8 ? 0 : 1,
838	gicv3_redist_affid(cs), intid);
839
840	gicv3_cpuif_virt_update(cs);
841
842	return intid;
843	}
844
845	static uint64_t icv_nmiar1_read(CPUARMState env, const ARMCPRegInfo ri)
846	{
847	GICv3CPUState *cs = icc_cs_from_env(env);
848	int idx = hppvi_index(cs);
849	uint64_t intid = INTID_SPURIOUS;
850
851	if (idx >= 0 && idx != HPPVI_INDEX_VLPI) {
852	uint64_t lr = cs->ich_lr_el2[idx];
853	int thisgrp = (lr & ICH_LR_EL2_GROUP) ? GICV3_G1NS : GICV3_G0;
854
855	if ((thisgrp == GICV3_G1NS) && icv_hppi_can_preempt(cs, lr)) {
856	intid = ich_lr_vintid(lr);
857	if (!gicv3_intid_is_special(intid)) {
858	if (lr & ICH_LR_EL2_NMI) {
859	icv_activate_irq(cs, idx, GICV3_G1NS);
860	} else {
861	intid = INTID_SPURIOUS;
862	}
863	} else {
864	/* Interrupt goes from Pending to Invalid */
865	cs->ich_lr_el2[idx] &= ~ICH_LR_EL2_STATE_PENDING_BIT;
866	/*
867	* We will now return the (bogus) ID from the list register,
868	* as per the pseudocode.
869	*/
870	}
871	}
872	}
873
874	trace_gicv3_icv_nmiar1_read(gicv3_redist_affid(cs), intid);
875
876	gicv3_cpuif_virt_update(cs);
877
878	return intid;
879	}
880
881	static uint32_t icc_fullprio_mask(GICv3CPUState *cs)
882	{
883	/*
884	* Return a mask word which clears the unimplemented priority bits
885	* from a priority value for a physical interrupt. (Not to be confused
886	* with the group priority, whose mask depends on the value of BPR
887	* for the interrupt group.)
888	*/
889	return (~0U << (8 - cs->pribits)) & 0xff;
890	}
891
892	static inline int icc_min_bpr(GICv3CPUState *cs)
893	{
894	/* The minimum BPR for the physical interface. */
895	return 7 - cs->prebits;
896	}
897
898	static inline int icc_min_bpr_ns(GICv3CPUState *cs)
899	{
900	return icc_min_bpr(cs) + 1;
901	}
902
903	static inline int icc_num_aprs(GICv3CPUState *cs)
904	{
905	/* Return the number of APR registers (1, 2, or 4) */
906	int aprmax = 1 << MAX(cs->prebits - 5, 0);
907	assert(aprmax <= ARRAY_SIZE(cs->icc_apr[0]));
908	return aprmax;
909	}
910
911	static int icc_highest_active_prio(GICv3CPUState *cs)
912	{
913	/* Calculate the current running priority based on the set bits
914	* in the Active Priority Registers.
915	*/
916	int i;
917
918	if (cs->nmi_support) {
919	/*
920	* If an NMI is active this takes precedence over anything else
921	* for priority purposes; the NMI bit is only in the AP1R0 bit.
922	* We return here the effective priority of the NMI, which is
923	* either 0x0 or 0x80. Callers will need to check NMI again for
924	* purposes of either setting the RPR register bits or for
925	* prioritization of NMI vs non-NMI.
926	*/
927	if (cs->icc_apr[GICV3_G1][0] & ICC_AP1R_EL1_NMI) {
928	return 0;
929	}
930	if (cs->icc_apr[GICV3_G1NS][0] & ICC_AP1R_EL1_NMI) {
931	return (cs->gic->gicd_ctlr & GICD_CTLR_DS) ? 0 : 0x80;
932	}
933	}
934
935	for (i = 0; i < icc_num_aprs(cs); i++) {
936	uint32_t apr = cs->icc_apr[GICV3_G0][i] \|
937	cs->icc_apr[GICV3_G1][i] \| cs->icc_apr[GICV3_G1NS][i];
938
939	if (!apr) {
940	continue;
941	}
942	return (i * 32 + ctz32(apr)) << (icc_min_bpr(cs) + 1);
943	}
944	/* No current active interrupts: return idle priority */
945	return 0xff;
946	}
947
948	static uint32_t icc_gprio_mask(GICv3CPUState *cs, int group)
949	{
950	/* Return a mask word which clears the subpriority bits from
951	* a priority value for an interrupt in the specified group.
952	* This depends on the BPR value. For CBPR0 (S or NS):
953	* a BPR of 0 means the group priority bits are [7:1];
954	* a BPR of 1 means they are [7:2], and so on down to
955	* a BPR of 7 meaning no group priority bits at all.
956	* For CBPR1 NS:
957	* a BPR of 0 is impossible (the minimum value is 1)
958	* a BPR of 1 means the group priority bits are [7:1];
959	* a BPR of 2 means they are [7:2], and so on down to
960	* a BPR of 7 meaning the group priority is [7].
961	*
962	* Which BPR to use depends on the group of the interrupt and
963	* the current ICC_CTLR.CBPR settings.
964	*
965	* This corresponds to the GroupBits() pseudocode.
966	*/
967	int bpr;
968
969	if ((group == GICV3_G1 && cs->icc_ctlr_el1[GICV3_S] & ICC_CTLR_EL1_CBPR) \|\|
970	(group == GICV3_G1NS &&
971	cs->icc_ctlr_el1[GICV3_NS] & ICC_CTLR_EL1_CBPR)) {
972	group = GICV3_G0;
973	}
974
975	bpr = cs->icc_bpr[group] & 7;
976
977	if (group == GICV3_G1NS) {
978	assert(bpr > 0);
979	bpr--;
980	}
981
982	return ~0U << (bpr + 1);
983	}
984
985	static bool icc_no_enabled_hppi(GICv3CPUState *cs)
986	{
987	/* Return true if there is no pending interrupt, or the
988	* highest priority pending interrupt is in a group which has been
989	* disabled at the CPU interface by the ICC_IGRPEN* register enable bits.
990	*/
991	return cs->hppi.prio == 0xff \|\| (cs->icc_igrpen[cs->hppi.grp] == 0);
992	}
993
994	static bool icc_hppi_can_preempt(GICv3CPUState *cs)
995	{
996	/* Return true if we have a pending interrupt of sufficient
997	* priority to preempt.
998	*/
999	int rprio;
1000	uint32_t mask;
1001	ARMCPU *cpu = ARM_CPU(cs->cpu);
1002	CPUARMState *env = &cpu->env;
1003
1004	if (icc_no_enabled_hppi(cs)) {
1005	return false;
1006	}
1007
1008	if (cs->hppi.nmi) {
1009	if (!(cs->gic->gicd_ctlr & GICD_CTLR_DS) &&
1010	cs->hppi.grp == GICV3_G1NS) {
1011	if (cs->icc_pmr_el1 < 0x80) {
1012	return false;
1013	}
1014	if (arm_is_secure(env) && cs->icc_pmr_el1 == 0x80) {
1015	return false;
1016	}
1017	}
1018	} else if (cs->hppi.prio >= cs->icc_pmr_el1) {
1019	/* Priority mask masks this interrupt */
1020	return false;
1021	}
1022
1023	rprio = icc_highest_active_prio(cs);
1024	if (rprio == 0xff) {
1025	/* No currently running interrupt so we can preempt */
1026	return true;
1027	}
1028
1029	mask = icc_gprio_mask(cs, cs->hppi.grp);
1030
1031	/* We only preempt a running interrupt if the pending interrupt's
1032	* group priority is sufficient (the subpriorities are not considered).
1033	*/
1034	if ((cs->hppi.prio & mask) < (rprio & mask)) {
1035	return true;
1036	}
1037
1038	if (cs->hppi.nmi && (cs->hppi.prio & mask) == (rprio & mask)) {
1039	if (!(cs->icc_apr[cs->hppi.grp][0] & ICC_AP1R_EL1_NMI)) {
1040	return true;
1041	}
1042	}
1043
1044	return false;
1045	}
1046
1047	void gicv3_cpuif_update(GICv3CPUState *cs)
1048	{
1049	/* Tell the CPU about its highest priority pending interrupt */
1050	int irqlevel = 0;
1051	int fiqlevel = 0;
1052	int nmilevel = 0;
1053	ARMCPU *cpu = ARM_CPU(cs->cpu);
1054	CPUARMState *env = &cpu->env;
1055
1056	g_assert(bql_locked());
1057
1058	trace_gicv3_cpuif_update(gicv3_redist_affid(cs), cs->hppi.irq,
1059	cs->hppi.grp, cs->hppi.prio);
1060
1061	if (cs->hppi.grp == GICV3_G1 && !arm_feature(env, ARM_FEATURE_EL3)) {
1062	/* If a Security-enabled GIC sends a G1S interrupt to a
1063	* Security-disabled CPU, we must treat it as if it were G0.
1064	*/
1065	cs->hppi.grp = GICV3_G0;
1066	}
1067
1068	if (icc_hppi_can_preempt(cs)) {
1069	/* We have an interrupt: should we signal it as IRQ or FIQ?
1070	* This is described in the GICv3 spec section 4.6.2.
1071	*/
1072	bool isfiq;
1073
1074	switch (cs->hppi.grp) {
1075	case GICV3_G0:
1076	isfiq = true;
1077	break;
1078	case GICV3_G1:
1079	isfiq = (!arm_is_secure(env) \|\|
1080	(arm_current_el(env) == 3 && arm_el_is_aa64(env, 3)));
1081	break;
1082	case GICV3_G1NS:
1083	isfiq = arm_is_secure(env);
1084	break;
1085	default:
1086	g_assert_not_reached();
1087	}
1088
1089	if (isfiq) {
1090	fiqlevel = 1;
1091	} else if (cs->hppi.nmi) {
1092	nmilevel = 1;
1093	} else {
1094	irqlevel = 1;
1095	}
1096	}
1097
1098	trace_gicv3_cpuif_set_irqs(gicv3_redist_affid(cs), fiqlevel, irqlevel);
1099
1100	qemu_set_irq(cs->parent_fiq, fiqlevel);
1101	qemu_set_irq(cs->parent_irq, irqlevel);
1102	qemu_set_irq(cs->parent_nmi, nmilevel);
1103	}
1104
1105	static uint64_t icc_pmr_read(CPUARMState env, const ARMCPRegInfo ri)
1106	{
1107	GICv3CPUState *cs = icc_cs_from_env(env);
1108	uint32_t value = cs->icc_pmr_el1;
1109
1110	if (icv_access(env, HCR_FMO \| HCR_IMO)) {
1111	return icv_pmr_read(env, ri);
1112	}
1113
1114	if (arm_feature(env, ARM_FEATURE_EL3) && !arm_is_secure(env) &&
1115	(env->cp15.scr_el3 & SCR_FIQ)) {
1116	/* NS access and Group 0 is inaccessible to NS: return the
1117	* NS view of the current priority
1118	*/
1119	if ((value & 0x80) == 0) {
1120	/* Secure priorities not visible to NS */
1121	value = 0;
1122	} else if (value != 0xff) {
1123	value = (value << 1) & 0xff;
1124	}
1125	}
1126
1127	trace_gicv3_icc_pmr_read(gicv3_redist_affid(cs), value);
1128
1129	return value;
1130	}
1131
1132	static void icc_pmr_write(CPUARMState env, const ARMCPRegInfo ri,
1133	uint64_t value)
1134	{
1135	GICv3CPUState *cs = icc_cs_from_env(env);
1136
1137	if (icv_access(env, HCR_FMO \| HCR_IMO)) {
1138	return icv_pmr_write(env, ri, value);
1139	}
1140
1141	trace_gicv3_icc_pmr_write(gicv3_redist_affid(cs), value);
1142
1143	if (arm_feature(env, ARM_FEATURE_EL3) && !arm_is_secure(env) &&
1144	(env->cp15.scr_el3 & SCR_FIQ)) {
1145	/* NS access and Group 0 is inaccessible to NS: return the
1146	* NS view of the current priority
1147	*/
1148	if (!(cs->icc_pmr_el1 & 0x80)) {
1149	/* Current PMR in the secure range, don't allow NS to change it */
1150	return;
1151	}
1152	value = (value >> 1) \| 0x80;
1153	}
1154	value &= icc_fullprio_mask(cs);
1155	cs->icc_pmr_el1 = value;
1156	gicv3_cpuif_update(cs);
1157	}
1158
1159	static void icc_activate_irq(GICv3CPUState *cs, int irq)
1160	{
1161	/* Move the interrupt from the Pending state to Active, and update
1162	* the Active Priority Registers
1163	*/
1164	uint32_t mask = icc_gprio_mask(cs, cs->hppi.grp);
1165	int prio = cs->hppi.prio & mask;
1166	int aprbit = prio >> (8 - cs->prebits);
1167	int regno = aprbit / 32;
1168	int regbit = aprbit % 32;
1169	bool nmi = cs->hppi.nmi;
1170
1171	if (nmi) {
1172	cs->icc_apr[cs->hppi.grp][regno] \|= ICC_AP1R_EL1_NMI;
1173	} else {
1174	cs->icc_apr[cs->hppi.grp][regno] \|= (1U << regbit);
1175	}
1176
1177	if (irq < GIC_INTERNAL) {
1178	cs->gicr_iactiver0 = deposit32(cs->gicr_iactiver0, irq, 1, 1);
1179	cs->gicr_ipendr0 = deposit32(cs->gicr_ipendr0, irq, 1, 0);
1180	gicv3_redist_update(cs);
1181	} else if (irq < GICV3_LPI_INTID_START) {
1182	gicv3_gicd_active_set(cs->gic, irq);
1183	gicv3_gicd_pending_clear(cs->gic, irq);
1184	gicv3_update(cs->gic, irq, 1);
1185	} else {
1186	gicv3_redist_lpi_pending(cs, irq, 0);
1187	}
1188	}
1189
1190	static uint64_t icc_hppir0_value(GICv3CPUState cs, CPUARMState env)
1191	{
1192	/* Return the highest priority pending interrupt register value
1193	* for group 0.
1194	*/
1195	bool irq_is_secure;
1196
1197	if (icc_no_enabled_hppi(cs)) {
1198	return INTID_SPURIOUS;
1199	}
1200
1201	/* Check whether we can return the interrupt or if we should return
1202	* a special identifier, as per the CheckGroup0ForSpecialIdentifiers
1203	* pseudocode. (We can simplify a little because for us ICC_SRE_EL1.RM
1204	* is always zero.)
1205	*/
1206	irq_is_secure = (!(cs->gic->gicd_ctlr & GICD_CTLR_DS) &&
1207	(cs->hppi.grp != GICV3_G1NS));
1208
1209	if (cs->hppi.grp != GICV3_G0 && !arm_is_el3_or_mon(env)) {
1210	return INTID_SPURIOUS;
1211	}
1212	if (irq_is_secure && !arm_is_secure(env)) {
1213	/* Secure interrupts not visible to Nonsecure */
1214	return INTID_SPURIOUS;
1215	}
1216
1217	if (cs->hppi.grp != GICV3_G0) {
1218	/* Indicate to EL3 that there's a Group 1 interrupt for the other
1219	* state pending.
1220	*/
1221	return irq_is_secure ? INTID_SECURE : INTID_NONSECURE;
1222	}
1223
1224	return cs->hppi.irq;
1225	}
1226
1227	static uint64_t icc_hppir1_value(GICv3CPUState cs, CPUARMState env)
1228	{
1229	/* Return the highest priority pending interrupt register value
1230	* for group 1.
1231	*/
1232	bool irq_is_secure;
1233
1234	if (icc_no_enabled_hppi(cs)) {
1235	return INTID_SPURIOUS;
1236	}
1237
1238	/* Check whether we can return the interrupt or if we should return
1239	* a special identifier, as per the CheckGroup1ForSpecialIdentifiers
1240	* pseudocode. (We can simplify a little because for us ICC_SRE_EL1.RM
1241	* is always zero.)
1242	*/
1243	irq_is_secure = (!(cs->gic->gicd_ctlr & GICD_CTLR_DS) &&
1244	(cs->hppi.grp != GICV3_G1NS));
1245
1246	if (cs->hppi.grp == GICV3_G0) {
1247	/* Group 0 interrupts not visible via HPPIR1 */
1248	return INTID_SPURIOUS;
1249	}
1250	if (irq_is_secure) {
1251	if (!arm_is_secure(env)) {
1252	/* Secure interrupts not visible in Non-secure */
1253	return INTID_SPURIOUS;
1254	}
1255	} else if (!arm_is_el3_or_mon(env) && arm_is_secure(env)) {
1256	/* Group 1 non-secure interrupts not visible in Secure EL1 */
1257	return INTID_SPURIOUS;
1258	}
1259
1260	return cs->hppi.irq;
1261	}
1262
1263	static uint64_t icc_iar0_read(CPUARMState env, const ARMCPRegInfo ri)
1264	{
1265	GICv3CPUState *cs = icc_cs_from_env(env);
1266	uint64_t intid;
1267
1268	if (icv_access(env, HCR_FMO)) {
1269	return icv_iar_read(env, ri);
1270	}
1271
1272	if (!icc_hppi_can_preempt(cs)) {
1273	intid = INTID_SPURIOUS;
1274	} else {
1275	intid = icc_hppir0_value(cs, env);
1276	}
1277
1278	if (!gicv3_intid_is_special(intid)) {
1279	icc_activate_irq(cs, intid);
1280	}
1281
1282	trace_gicv3_icc_iar0_read(gicv3_redist_affid(cs), intid);
1283	return intid;
1284	}
1285
1286	static uint64_t icc_iar1_read(CPUARMState env, const ARMCPRegInfo ri)
1287	{
1288	GICv3CPUState *cs = icc_cs_from_env(env);
1289	int el = arm_current_el(env);
1290	uint64_t intid;
1291
1292	if (icv_access(env, HCR_IMO)) {
1293	return icv_iar_read(env, ri);
1294	}
1295
1296	if (!icc_hppi_can_preempt(cs)) {
1297	intid = INTID_SPURIOUS;
1298	} else {
1299	intid = icc_hppir1_value(cs, env);
1300	}
1301
1302	if (!gicv3_intid_is_special(intid)) {
1303	if (cs->hppi.nmi && env->cp15.sctlr_el[el] & SCTLR_NMI) {
1304	intid = INTID_NMI;
1305	} else {
1306	icc_activate_irq(cs, intid);
1307	}
1308	}
1309
1310	trace_gicv3_icc_iar1_read(gicv3_redist_affid(cs), intid);
1311	return intid;
1312	}
1313
1314	static uint64_t icc_nmiar1_read(CPUARMState env, const ARMCPRegInfo ri)
1315	{
1316	GICv3CPUState *cs = icc_cs_from_env(env);
1317	uint64_t intid;
1318
1319	if (icv_access(env, HCR_IMO)) {
1320	return icv_nmiar1_read(env, ri);
1321	}
1322
1323	if (!icc_hppi_can_preempt(cs)) {
1324	intid = INTID_SPURIOUS;
1325	} else {
1326	intid = icc_hppir1_value(cs, env);
1327	}
1328
1329	if (!gicv3_intid_is_special(intid)) {
1330	if (!cs->hppi.nmi) {
1331	intid = INTID_SPURIOUS;
1332	} else {
1333	icc_activate_irq(cs, intid);
1334	}
1335	}
1336
1337	trace_gicv3_icc_nmiar1_read(gicv3_redist_affid(cs), intid);
1338	return intid;
1339	}
1340
1341	static void icc_drop_prio(GICv3CPUState *cs, int grp)
1342	{
1343	/* Drop the priority of the currently active interrupt in
1344	* the specified group.
1345	*
1346	* Note that we can guarantee (because of the requirement to nest
1347	* ICC_IAR reads [which activate an interrupt and raise priority]
1348	* with ICC_EOIR writes [which drop the priority for the interrupt])
1349	* that the interrupt we're being called for is the highest priority
1350	* active interrupt, meaning that it has the lowest set bit in the
1351	* APR registers.
1352	*
1353	* If the guest does not honour the ordering constraints then the
1354	* behaviour of the GIC is UNPREDICTABLE, which for us means that
1355	* the values of the APR registers might become incorrect and the
1356	* running priority will be wrong, so interrupts that should preempt
1357	* might not do so, and interrupts that should not preempt might do so.
1358	*/
1359	int i;
1360
1361	for (i = 0; i < icc_num_aprs(cs); i++) {
1362	uint64_t *papr = &cs->icc_apr[grp][i];
1363
1364	if (!*papr) {
1365	continue;
1366	}
1367
1368	if (i == 0 && cs->nmi_support && (*papr & ICC_AP1R_EL1_NMI)) {
1369	*papr &= (~ICC_AP1R_EL1_NMI);
1370	break;
1371	}
1372
1373	/* Clear the lowest set bit */
1374	papr &= papr - 1;
1375	break;
1376	}
1377
1378	/* running priority change means we need an update for this cpu i/f */
1379	gicv3_cpuif_update(cs);
1380	}
1381
1382	static bool icc_eoi_split(CPUARMState env, GICv3CPUState cs)
1383	{
1384	/* Return true if we should split priority drop and interrupt
1385	* deactivation, ie whether the relevant EOIMode bit is set.
1386	*/
1387	if (arm_is_el3_or_mon(env)) {
1388	return cs->icc_ctlr_el3 & ICC_CTLR_EL3_EOIMODE_EL3;
1389	}
1390	if (arm_is_secure_below_el3(env)) {
1391	return cs->icc_ctlr_el1[GICV3_S] & ICC_CTLR_EL1_EOIMODE;
1392	} else {
1393	return cs->icc_ctlr_el1[GICV3_NS] & ICC_CTLR_EL1_EOIMODE;
1394	}
1395	}
1396
1397	static int icc_highest_active_group(GICv3CPUState *cs)
1398	{
1399	/* Return the group with the highest priority active interrupt.
1400	* We can do this by just comparing the APRs to see which one
1401	* has the lowest set bit.
1402	* (If more than one group is active at the same priority then
1403	* we're in UNPREDICTABLE territory.)
1404	*/
1405	int i;
1406
1407	if (cs->nmi_support) {
1408	if (cs->icc_apr[GICV3_G1][0] & ICC_AP1R_EL1_NMI) {
1409	return GICV3_G1;
1410	}
1411	if (cs->icc_apr[GICV3_G1NS][0] & ICC_AP1R_EL1_NMI) {
1412	return GICV3_G1NS;
1413	}
1414	}
1415
1416	for (i = 0; i < ARRAY_SIZE(cs->icc_apr[0]); i++) {
1417	int g0ctz = ctz32(cs->icc_apr[GICV3_G0][i]);
1418	int g1ctz = ctz32(cs->icc_apr[GICV3_G1][i]);
1419	int g1nsctz = ctz32(cs->icc_apr[GICV3_G1NS][i]);
1420
1421	if (g1nsctz < g0ctz && g1nsctz < g1ctz) {
1422	return GICV3_G1NS;
1423	}
1424	if (g1ctz < g0ctz) {
1425	return GICV3_G1;
1426	}
1427	if (g0ctz < 32) {
1428	return GICV3_G0;
1429	}
1430	}
1431	/* No set active bits? UNPREDICTABLE; return -1 so the caller
1432	* ignores the spurious EOI attempt.
1433	*/
1434	return -1;
1435	}
1436
1437	static void icc_deactivate_irq(GICv3CPUState *cs, int irq)
1438	{
1439	if (irq < GIC_INTERNAL) {
1440	cs->gicr_iactiver0 = deposit32(cs->gicr_iactiver0, irq, 1, 0);
1441	gicv3_redist_update(cs);
1442	} else {
1443	gicv3_gicd_active_clear(cs->gic, irq);
1444	gicv3_update(cs->gic, irq, 1);
1445	}
1446	}
1447
1448	static bool icv_eoi_split(CPUARMState env, GICv3CPUState cs)
1449	{
1450	/* Return true if we should split priority drop and interrupt
1451	* deactivation, ie whether the virtual EOIMode bit is set.
1452	*/
1453	return cs->ich_vmcr_el2 & ICH_VMCR_EL2_VEOIM;
1454	}
1455
1456	static int icv_find_active(GICv3CPUState *cs, int irq)
1457	{
1458	/* Given an interrupt number for an active interrupt, return the index
1459	* of the corresponding list register, or -1 if there is no match.
1460	* Corresponds to FindActiveVirtualInterrupt pseudocode.
1461	*/
1462	int i;
1463
1464	for (i = 0; i < cs->num_list_regs; i++) {
1465	uint64_t lr = cs->ich_lr_el2[i];
1466
1467	if ((lr & ICH_LR_EL2_STATE_ACTIVE_BIT) && ich_lr_vintid(lr) == irq) {
1468	return i;
1469	}
1470	}
1471
1472	return -1;
1473	}
1474
1475	static void icv_deactivate_irq(GICv3CPUState *cs, int idx)
1476	{
1477	/* Deactivate the interrupt in the specified list register index */
1478	uint64_t lr = cs->ich_lr_el2[idx];
1479
1480	if (lr & ICH_LR_EL2_HW) {
1481	/* Deactivate the associated physical interrupt */
1482	int pirq = ich_lr_pintid(lr);
1483
1484	if (pirq < INTID_SECURE) {
1485	icc_deactivate_irq(cs, pirq);
1486	}
1487	}
1488
1489	/* Clear the 'active' part of the state, so ActivePending->Pending
1490	* and Active->Invalid.
1491	*/
1492	lr &= ~ICH_LR_EL2_STATE_ACTIVE_BIT;
1493	cs->ich_lr_el2[idx] = lr;
1494	}
1495
1496	static void icv_increment_eoicount(GICv3CPUState *cs)
1497	{
1498	/* Increment the EOICOUNT field in ICH_HCR_EL2 */
1499	int eoicount = extract64(cs->ich_hcr_el2, ICH_HCR_EL2_EOICOUNT_SHIFT,
1500	ICH_HCR_EL2_EOICOUNT_LENGTH);
1501
1502	cs->ich_hcr_el2 = deposit64(cs->ich_hcr_el2, ICH_HCR_EL2_EOICOUNT_SHIFT,
1503	ICH_HCR_EL2_EOICOUNT_LENGTH, eoicount + 1);
1504	}
1505
1506	static int icv_drop_prio(GICv3CPUState cs, bool nmi)
1507	{
1508	/* Drop the priority of the currently active virtual interrupt
1509	* (favouring group 0 if there is a set active bit at
1510	* the same priority for both group 0 and group 1).
1511	* Return the priority value for the bit we just cleared,
1512	* or 0xff if no bits were set in the AP registers at all.
1513	* Note that though the ich_apr[] are uint64_t only the low
1514	* 32 bits are actually relevant.
1515	*/
1516	int i;
1517	int aprmax = ich_num_aprs(cs);
1518
1519	for (i = 0; i < aprmax; i++) {
1520	uint64_t *papr0 = &cs->ich_apr[GICV3_G0][i];
1521	uint64_t *papr1 = &cs->ich_apr[GICV3_G1NS][i];
1522	int apr0count, apr1count;
1523
1524	if (!papr0 && !papr1) {
1525	continue;
1526	}
1527
1528	if (i == 0 && cs->nmi_support && (*papr1 & ICV_AP1R_EL1_NMI)) {
1529	*papr1 &= (~ICV_AP1R_EL1_NMI);
1530	*nmi = true;
1531	return 0xff;
1532	}
1533
1534	/* We can't just use the bit-twiddling hack icc_drop_prio() does
1535	* because we need to return the bit number we cleared so
1536	* it can be compared against the list register's priority field.
1537	*/
1538	apr0count = ctz32(*papr0);
1539	apr1count = ctz32(*papr1);
1540
1541	if (apr0count <= apr1count) {
1542	papr0 &= papr0 - 1;
1543	return (apr0count + i * 32) << (icv_min_vbpr(cs) + 1);
1544	} else {
1545	papr1 &= papr1 - 1;
1546	return (apr1count + i * 32) << (icv_min_vbpr(cs) + 1);
1547	}
1548	}
1549	return 0xff;
1550	}
1551
1552	static void icv_dir_write(CPUARMState env, const ARMCPRegInfo ri,
1553	uint64_t value)
1554	{
1555	/* Deactivate interrupt */
1556	GICv3CPUState *cs = icc_cs_from_env(env);
1557	int idx;
1558	int irq = value & 0xffffff;
1559
1560	trace_gicv3_icv_dir_write(gicv3_redist_affid(cs), value);
1561
1562	if (irq >= GICV3_MAXIRQ) {
1563	/* Also catches special interrupt numbers and LPIs */
1564	return;
1565	}
1566
1567	if (!icv_eoi_split(env, cs)) {
1568	return;
1569	}
1570
1571	idx = icv_find_active(cs, irq);
1572
1573	if (idx < 0) {
1574	/* No list register matching this, so increment the EOI count
1575	* (might trigger a maintenance interrupt)
1576	*/
1577	icv_increment_eoicount(cs);
1578	} else {
1579	icv_deactivate_irq(cs, idx);
1580	}
1581
1582	gicv3_cpuif_virt_update(cs);
1583	}
1584
1585	static void icv_eoir_write(CPUARMState env, const ARMCPRegInfo ri,
1586	uint64_t value)
1587	{
1588	/* End of Interrupt */
1589	GICv3CPUState *cs = icc_cs_from_env(env);
1590	int irq = value & 0xffffff;
1591	int grp = ri->crm == 8 ? GICV3_G0 : GICV3_G1NS;
1592	int idx, dropprio;
1593	bool nmi = false;
1594
1595	trace_gicv3_icv_eoir_write(ri->crm == 8 ? 0 : 1,
1596	gicv3_redist_affid(cs), value);
1597
1598	if (gicv3_intid_is_special(irq)) {
1599	return;
1600	}
1601
1602	/* We implement the IMPDEF choice of "drop priority before doing
1603	* error checks" (because that lets us avoid scanning the AP
1604	* registers twice).
1605	*/
1606	dropprio = icv_drop_prio(cs, &nmi);
1607	if (dropprio == 0xff && !nmi) {
1608	/* No active interrupt. It is CONSTRAINED UNPREDICTABLE
1609	* whether the list registers are checked in this
1610	* situation; we choose not to.
1611	*/
1612	return;
1613	}
1614
1615	idx = icv_find_active(cs, irq);
1616
1617	if (idx < 0) {
1618	/*
1619	* No valid list register corresponding to EOI ID; if this is a vLPI
1620	* not in the list regs then do nothing; otherwise increment EOI count
1621	*/
1622	if (irq < GICV3_LPI_INTID_START) {
1623	icv_increment_eoicount(cs);
1624	}
1625	} else {
1626	uint64_t lr = cs->ich_lr_el2[idx];
1627	int thisgrp = (lr & ICH_LR_EL2_GROUP) ? GICV3_G1NS : GICV3_G0;
1628	int lr_gprio = ich_lr_prio(lr) & icv_gprio_mask(cs, grp);
1629	bool thisnmi = lr & ICH_LR_EL2_NMI;
1630
1631	if (thisgrp == grp && (lr_gprio == dropprio \|\| (thisnmi & nmi))) {
1632	if (!icv_eoi_split(env, cs) \|\| irq >= GICV3_LPI_INTID_START) {
1633	/*
1634	* Priority drop and deactivate not split: deactivate irq now.
1635	* LPIs always get their active state cleared immediately
1636	* because no separate deactivate is expected.
1637	*/
1638	icv_deactivate_irq(cs, idx);
1639	}
1640	}
1641	}
1642
1643	gicv3_cpuif_virt_update(cs);
1644	}
1645
1646	static void icc_eoir_write(CPUARMState env, const ARMCPRegInfo ri,
1647	uint64_t value)
1648	{
1649	/* End of Interrupt */
1650	GICv3CPUState *cs = icc_cs_from_env(env);
1651	int irq = value & 0xffffff;
1652	int grp;
1653	bool is_eoir0 = ri->crm == 8;
1654
1655	if (icv_access(env, is_eoir0 ? HCR_FMO : HCR_IMO)) {
1656	icv_eoir_write(env, ri, value);
1657	return;
1658	}
1659
1660	trace_gicv3_icc_eoir_write(is_eoir0 ? 0 : 1,
1661	gicv3_redist_affid(cs), value);
1662
1663	if ((irq >= cs->gic->num_irq) &&
1664	!(cs->gic->lpi_enable && (irq >= GICV3_LPI_INTID_START))) {
1665	/* This handles two cases:
1666	* 1. If software writes the ID of a spurious interrupt [ie 1020-1023]
1667	* to the GICC_EOIR, the GIC ignores that write.
1668	* 2. If software writes the number of a non-existent interrupt
1669	* this must be a subcase of "value written does not match the last
1670	* valid interrupt value read from the Interrupt Acknowledge
1671	* register" and so this is UNPREDICTABLE. We choose to ignore it.
1672	*/
1673	return;
1674	}
1675
1676	grp = icc_highest_active_group(cs);
1677	switch (grp) {
1678	case GICV3_G0:
1679	if (!is_eoir0) {
1680	return;
1681	}
1682	if (!(cs->gic->gicd_ctlr & GICD_CTLR_DS)
1683	&& arm_feature(env, ARM_FEATURE_EL3) && !arm_is_secure(env)) {
1684	return;
1685	}
1686	break;
1687	case GICV3_G1:
1688	if (is_eoir0) {
1689	return;
1690	}
1691	if (!arm_is_secure(env)) {
1692	return;
1693	}
1694	break;
1695	case GICV3_G1NS:
1696	if (is_eoir0) {
1697	return;
1698	}
1699	if (!arm_is_el3_or_mon(env) && arm_is_secure(env)) {
1700	return;
1701	}
1702	break;
1703	default:
1704	qemu_log_mask(LOG_GUEST_ERROR,
1705	"%s: IRQ %d isn't active\n", __func__, irq);
1706	return;
1707	}
1708
1709	icc_drop_prio(cs, grp);
1710
1711	if (!icc_eoi_split(env, cs)) {
1712	/* Priority drop and deactivate not split: deactivate irq now */
1713	icc_deactivate_irq(cs, irq);
1714	}
1715	}
1716
1717	static uint64_t icc_hppir0_read(CPUARMState env, const ARMCPRegInfo ri)
1718	{
1719	GICv3CPUState *cs = icc_cs_from_env(env);
1720	uint64_t value;
1721
1722	if (icv_access(env, HCR_FMO)) {
1723	return icv_hppir_read(env, ri);
1724	}
1725
1726	value = icc_hppir0_value(cs, env);
1727	trace_gicv3_icc_hppir0_read(gicv3_redist_affid(cs), value);
1728	return value;
1729	}
1730
1731	static uint64_t icc_hppir1_read(CPUARMState env, const ARMCPRegInfo ri)
1732	{
1733	GICv3CPUState *cs = icc_cs_from_env(env);
1734	uint64_t value;
1735
1736	if (icv_access(env, HCR_IMO)) {
1737	return icv_hppir_read(env, ri);
1738	}
1739
1740	value = icc_hppir1_value(cs, env);
1741	trace_gicv3_icc_hppir1_read(gicv3_redist_affid(cs), value);
1742	return value;
1743	}
1744
1745	static uint64_t icc_bpr_read(CPUARMState env, const ARMCPRegInfo ri)
1746	{
1747	GICv3CPUState *cs = icc_cs_from_env(env);
1748	int grp = (ri->crm == 8) ? GICV3_G0 : GICV3_G1;
1749	bool satinc = false;
1750	uint64_t bpr;
1751
1752	if (icv_access(env, grp == GICV3_G0 ? HCR_FMO : HCR_IMO)) {
1753	return icv_bpr_read(env, ri);
1754	}
1755
1756	if (grp == GICV3_G1 && gicv3_use_ns_bank(env)) {
1757	grp = GICV3_G1NS;
1758	}
1759
1760	if (grp == GICV3_G1 && !arm_is_el3_or_mon(env) &&
1761	(cs->icc_ctlr_el1[GICV3_S] & ICC_CTLR_EL1_CBPR)) {
1762	/* CBPR_EL1S means secure EL1 or AArch32 EL3 !Mon BPR1 accesses
1763	* modify BPR0
1764	*/
1765	grp = GICV3_G0;
1766	}
1767
1768	if (grp == GICV3_G1NS && arm_current_el(env) < 3 &&
1769	(cs->icc_ctlr_el1[GICV3_NS] & ICC_CTLR_EL1_CBPR)) {
1770	/* reads return bpr0 + 1 sat to 7, writes ignored */
1771	grp = GICV3_G0;
1772	satinc = true;
1773	}
1774
1775	bpr = cs->icc_bpr[grp];
1776	if (satinc) {
1777	bpr++;
1778	bpr = MIN(bpr, 7);
1779	}
1780
1781	trace_gicv3_icc_bpr_read(ri->crm == 8 ? 0 : 1, gicv3_redist_affid(cs), bpr);
1782
1783	return bpr;
1784	}
1785
1786	static void icc_bpr_write(CPUARMState env, const ARMCPRegInfo ri,
1787	uint64_t value)
1788	{
1789	GICv3CPUState *cs = icc_cs_from_env(env);
1790	int grp = (ri->crm == 8) ? GICV3_G0 : GICV3_G1;
1791	uint64_t minval;
1792
1793	if (icv_access(env, grp == GICV3_G0 ? HCR_FMO : HCR_IMO)) {
1794	icv_bpr_write(env, ri, value);
1795	return;
1796	}
1797
1798	trace_gicv3_icc_bpr_write(ri->crm == 8 ? 0 : 1,
1799	gicv3_redist_affid(cs), value);
1800
1801	if (grp == GICV3_G1 && gicv3_use_ns_bank(env)) {
1802	grp = GICV3_G1NS;
1803	}
1804
1805	if (grp == GICV3_G1 && !arm_is_el3_or_mon(env) &&
1806	(cs->icc_ctlr_el1[GICV3_S] & ICC_CTLR_EL1_CBPR)) {
1807	/* CBPR_EL1S means secure EL1 or AArch32 EL3 !Mon BPR1 accesses
1808	* modify BPR0
1809	*/
1810	grp = GICV3_G0;
1811	}
1812
1813	if (grp == GICV3_G1NS && arm_current_el(env) < 3 &&
1814	(cs->icc_ctlr_el1[GICV3_NS] & ICC_CTLR_EL1_CBPR)) {
1815	/* reads return bpr0 + 1 sat to 7, writes ignored */
1816	return;
1817	}
1818
1819	minval = (grp == GICV3_G1NS) ? icc_min_bpr_ns(cs) : icc_min_bpr(cs);
1820	if (value < minval) {
1821	value = minval;
1822	}
1823
1824	cs->icc_bpr[grp] = value & 7;
1825	gicv3_cpuif_update(cs);
1826	}
1827
1828	static uint64_t icc_ap_read(CPUARMState env, const ARMCPRegInfo ri)
1829	{
1830	GICv3CPUState *cs = icc_cs_from_env(env);
1831	uint64_t value;
1832
1833	int regno = ri->opc2 & 3;
1834	int grp = (ri->crm & 1) ? GICV3_G1 : GICV3_G0;
1835
1836	if (icv_access(env, grp == GICV3_G0 ? HCR_FMO : HCR_IMO)) {
1837	return icv_ap_read(env, ri);
1838	}
1839
1840	if (grp == GICV3_G1 && gicv3_use_ns_bank(env)) {
1841	grp = GICV3_G1NS;
1842	}
1843
1844	value = cs->icc_apr[grp][regno];
1845
1846	trace_gicv3_icc_ap_read(ri->crm & 1, regno, gicv3_redist_affid(cs), value);
1847	return value;
1848	}
1849
1850	static void icc_ap_write(CPUARMState env, const ARMCPRegInfo ri,
1851	uint64_t value)
1852	{
1853	GICv3CPUState *cs = icc_cs_from_env(env);
1854
1855	int regno = ri->opc2 & 3;
1856	int grp = (ri->crm & 1) ? GICV3_G1 : GICV3_G0;
1857
1858	if (icv_access(env, grp == GICV3_G0 ? HCR_FMO : HCR_IMO)) {
1859	icv_ap_write(env, ri, value);
1860	return;
1861	}
1862
1863	trace_gicv3_icc_ap_write(ri->crm & 1, regno, gicv3_redist_affid(cs), value);
1864
1865	if (grp == GICV3_G1 && gicv3_use_ns_bank(env)) {
1866	grp = GICV3_G1NS;
1867	}
1868
1869	/* It's not possible to claim that a Non-secure interrupt is active
1870	* at a priority outside the Non-secure range (128..255), since this
1871	* would otherwise allow malicious NS code to block delivery of S interrupts
1872	* by writing a bad value to these registers.
1873	*
1874	* The NS priority range (128..255) maps to APR bits starting at
1875	* aprbit = 0x80 >> (8 - prebits). Depending on prebits, this boundary
1876	* may fall within AP1R0 or AP1R1, so we cannot simply WI the entire
1877	* register. Instead we calculate which bits within each register
1878	* correspond to the Secure range and preserve those, while allowing
1879	* NS code to modify only the NS range bits.
1880	*
1881	* prebits=4: num_aprs=1, NS starts at AP1R0[8]
1882	* prebits=5: num_aprs=1, NS starts at AP1R0[16]
1883	* prebits=6: num_aprs=2, NS starts at AP1R1[0]
1884	* prebits=7: num_aprs=4, NS starts at AP1R2[0]
1885	*/
1886	if (grp == GICV3_G1NS && arm_feature(env, ARM_FEATURE_EL3)) {
1887	int ns_start_bit = 0x80 >> (8 - cs->prebits);
1888	int ns_start_regno = ns_start_bit / 32;
1889	int ns_start_regbit = ns_start_bit % 32;
1890
1891	if (regno < ns_start_regno) {
1892	/* This entire register is in the Secure range: WI */
1893	return;
1894	} else if (regno == ns_start_regno && ns_start_regbit > 0) {
1895	/*
1896	* This register is split: low bits are Secure, high bits are NS.
1897	* Preserve the Secure bits (below ns_start_regbit) from the
1898	* current value, and take the NS bits (at and above
1899	* ns_start_regbit) from the written value.
1900	*/
1901	uint32_t secure_mask = MAKE_64BIT_MASK(0, ns_start_regbit);
1902
1903	value = (cs->icc_apr[grp][regno] & secure_mask) \|
1904	(value & ~secure_mask);
1905	}
1906	/* else: regno > ns_start_regno, entire register is NS: allow write */
1907	}
1908
1909	if (cs->nmi_support) {
1910	cs->icc_apr[grp][regno] = value & (0xFFFFFFFFU \| ICC_AP1R_EL1_NMI);
1911	} else {
1912	cs->icc_apr[grp][regno] = value & 0xFFFFFFFFU;
1913	}
1914	gicv3_cpuif_update(cs);
1915	}
1916
1917	static void icc_dir_write(CPUARMState env, const ARMCPRegInfo ri,
1918	uint64_t value)
1919	{
1920	/* Deactivate interrupt */
1921	GICv3CPUState *cs = icc_cs_from_env(env);
1922	int irq = value & 0xffffff;
1923	bool irq_is_secure, single_sec_state, irq_is_grp0;
1924	bool route_fiq_to_el3, route_irq_to_el3, route_fiq_to_el2, route_irq_to_el2;
1925
1926	if (icv_access(env, HCR_FMO \| HCR_IMO)) {
1927	icv_dir_write(env, ri, value);
1928	return;
1929	}
1930
1931	trace_gicv3_icc_dir_write(gicv3_redist_affid(cs), value);
1932
1933	if (irq >= cs->gic->num_irq) {
1934	/* Also catches special interrupt numbers and LPIs */
1935	return;
1936	}
1937
1938	if (!icc_eoi_split(env, cs)) {
1939	return;
1940	}
1941
1942	int grp = gicv3_irq_group(cs->gic, cs, irq);
1943
1944	single_sec_state = cs->gic->gicd_ctlr & GICD_CTLR_DS;
1945	irq_is_secure = !single_sec_state && (grp != GICV3_G1NS);
1946	irq_is_grp0 = grp == GICV3_G0;
1947
1948	/* Check whether we're allowed to deactivate this interrupt based
1949	* on its group and the current CPU state.
1950	* These checks are laid out to correspond to the spec's pseudocode.
1951	*/
1952	route_fiq_to_el3 = env->cp15.scr_el3 & SCR_FIQ;
1953	route_irq_to_el3 = env->cp15.scr_el3 & SCR_IRQ;
1954	/* No need to include !IsSecure in route_*_to_el2 as it's only
1955	* tested in cases where we know !IsSecure is true.
1956	*/
1957	uint64_t hcr_el2 = arm_hcr_el2_eff(env);
1958	route_fiq_to_el2 = hcr_el2 & HCR_FMO;
1959	route_irq_to_el2 = hcr_el2 & HCR_IMO;
1960
1961	switch (arm_current_el(env)) {
1962	case 3:
1963	break;
1964	case 2:
1965	if (single_sec_state && irq_is_grp0 && !route_fiq_to_el3) {
1966	break;
1967	}
1968	if (!irq_is_secure && !irq_is_grp0 && !route_irq_to_el3) {
1969	break;
1970	}
1971	return;
1972	case 1:
1973	if (!arm_is_secure_below_el3(env)) {
1974	if (single_sec_state && irq_is_grp0 &&
1975	!route_fiq_to_el3 && !route_fiq_to_el2) {
1976	break;
1977	}
1978	if (!irq_is_secure && !irq_is_grp0 &&
1979	!route_irq_to_el3 && !route_irq_to_el2) {
1980	break;
1981	}
1982	} else {
1983	if (irq_is_grp0 && !route_fiq_to_el3) {
1984	break;
1985	}
1986	if (!irq_is_grp0 &&
1987	(!irq_is_secure \|\| !single_sec_state) &&
1988	!route_irq_to_el3) {
1989	break;
1990	}
1991	}
1992	return;
1993	default:
1994	g_assert_not_reached();
1995	}
1996
1997	icc_deactivate_irq(cs, irq);
1998	}
1999
2000	static uint64_t icc_rpr_read(CPUARMState env, const ARMCPRegInfo ri)
2001	{
2002	GICv3CPUState *cs = icc_cs_from_env(env);
2003	uint64_t prio;
2004
2005	if (icv_access(env, HCR_FMO \| HCR_IMO)) {
2006	return icv_rpr_read(env, ri);
2007	}
2008
2009	prio = icc_highest_active_prio(cs);
2010
2011	if (arm_feature(env, ARM_FEATURE_EL3) &&
2012	!arm_is_secure(env) && (env->cp15.scr_el3 & SCR_FIQ)) {
2013	/* NS GIC access and Group 0 is inaccessible to NS */
2014	if ((prio & 0x80) == 0) {
2015	/* NS mustn't see priorities in the Secure half of the range */
2016	prio = 0;
2017	} else if (prio != 0xff) {
2018	/* Non-idle priority: show the Non-secure view of it */
2019	prio = (prio << 1) & 0xff;
2020	}
2021	}
2022
2023	if (cs->nmi_support) {
2024	/* NMI info is reported in the high bits of RPR */
2025	if (arm_feature(env, ARM_FEATURE_EL3) && !arm_is_secure(env)) {
2026	if (cs->icc_apr[GICV3_G1NS][0] & ICC_AP1R_EL1_NMI) {
2027	prio \|= ICC_RPR_EL1_NMI;
2028	}
2029	} else {
2030	if (cs->icc_apr[GICV3_G1NS][0] & ICC_AP1R_EL1_NMI) {
2031	prio \|= ICC_RPR_EL1_NSNMI;
2032	}
2033	if (cs->icc_apr[GICV3_G1][0] & ICC_AP1R_EL1_NMI) {
2034	prio \|= ICC_RPR_EL1_NMI;
2035	}
2036	}
2037	}
2038
2039	trace_gicv3_icc_rpr_read(gicv3_redist_affid(cs), prio);
2040	return prio;
2041	}
2042
2043	static void icc_generate_sgi(CPUARMState env, GICv3CPUState cs,
2044	uint64_t value, int grp, bool ns)
2045	{
2046	GICv3State *s = cs->gic;
2047
2048	/* Extract Aff3/Aff2/Aff1 and shift into the bottom 24 bits */
2049	uint64_t aff = extract64(value, 48, 8) << 16 \|
2050	extract64(value, 32, 8) << 8 \|
2051	extract64(value, 16, 8);
2052	uint32_t targetlist = extract64(value, 0, 16);
2053	uint32_t irq = extract64(value, 24, 4);
2054	bool irm = extract64(value, 40, 1);
2055	int i;
2056
2057	if (grp == GICV3_G1 && s->gicd_ctlr & GICD_CTLR_DS) {
2058	/* If GICD_CTLR.DS == 1, the Distributor treats Secure Group 1
2059	* interrupts as Group 0 interrupts and must send Secure Group 0
2060	* interrupts to the target CPUs.
2061	*/
2062	grp = GICV3_G0;
2063	}
2064
2065	trace_gicv3_icc_generate_sgi(gicv3_redist_affid(cs), irq, irm,
2066	aff, targetlist);
2067
2068	for (i = 0; i < s->num_cpu; i++) {
2069	GICv3CPUState *ocs = &s->cpu[i];
2070
2071	if (irm) {
2072	/* IRM == 1 : route to all CPUs except self */
2073	if (cs == ocs) {
2074	continue;
2075	}
2076	} else {
2077	/* IRM == 0 : route to Aff3.Aff2.Aff1.n for all n in [0..15]
2078	* where the corresponding bit is set in targetlist
2079	*/
2080	int aff0;
2081
2082	if (ocs->gicr_typer >> 40 != aff) {
2083	continue;
2084	}
2085	aff0 = extract64(ocs->gicr_typer, 32, 8);
2086	if (aff0 > 15 \|\| extract32(targetlist, aff0, 1) == 0) {
2087	continue;
2088	}
2089	}
2090
2091	/* The redistributor will check against its own GICR_NSACR as needed */
2092	gicv3_redist_send_sgi(ocs, grp, irq, ns);
2093	}
2094	}
2095
2096	static void icc_sgi0r_write(CPUARMState env, const ARMCPRegInfo ri,
2097	uint64_t value)
2098	{
2099	/* Generate Secure Group 0 SGI. */
2100	GICv3CPUState *cs = icc_cs_from_env(env);
2101	bool ns = !arm_is_secure(env);
2102
2103	icc_generate_sgi(env, cs, value, GICV3_G0, ns);
2104	}
2105
2106	static void icc_sgi1r_write(CPUARMState env, const ARMCPRegInfo ri,
2107	uint64_t value)
2108	{
2109	/* Generate Group 1 SGI for the current Security state */
2110	GICv3CPUState *cs = icc_cs_from_env(env);
2111	int grp;
2112	bool ns = !arm_is_secure(env);
2113
2114	grp = ns ? GICV3_G1NS : GICV3_G1;
2115	icc_generate_sgi(env, cs, value, grp, ns);
2116	}
2117
2118	static void icc_asgi1r_write(CPUARMState env, const ARMCPRegInfo ri,
2119	uint64_t value)
2120	{
2121	/* Generate Group 1 SGI for the Security state that is not
2122	* the current state
2123	*/
2124	GICv3CPUState *cs = icc_cs_from_env(env);
2125	int grp;
2126	bool ns = !arm_is_secure(env);
2127
2128	grp = ns ? GICV3_G1 : GICV3_G1NS;
2129	icc_generate_sgi(env, cs, value, grp, ns);
2130	}
2131
2132	static uint64_t icc_igrpen_read(CPUARMState env, const ARMCPRegInfo ri)
2133	{
2134	GICv3CPUState *cs = icc_cs_from_env(env);
2135	int grp = ri->opc2 & 1 ? GICV3_G1 : GICV3_G0;
2136	uint64_t value;
2137
2138	if (icv_access(env, grp == GICV3_G0 ? HCR_FMO : HCR_IMO)) {
2139	return icv_igrpen_read(env, ri);
2140	}
2141
2142	if (grp == GICV3_G1 && gicv3_use_ns_bank(env)) {
2143	grp = GICV3_G1NS;
2144	}
2145
2146	value = cs->icc_igrpen[grp];
2147	trace_gicv3_icc_igrpen_read(ri->opc2 & 1 ? 1 : 0,
2148	gicv3_redist_affid(cs), value);
2149	return value;
2150	}
2151
2152	static void icc_igrpen_write(CPUARMState env, const ARMCPRegInfo ri,
2153	uint64_t value)
2154	{
2155	GICv3CPUState *cs = icc_cs_from_env(env);
2156	int grp = ri->opc2 & 1 ? GICV3_G1 : GICV3_G0;
2157
2158	if (icv_access(env, grp == GICV3_G0 ? HCR_FMO : HCR_IMO)) {
2159	icv_igrpen_write(env, ri, value);
2160	return;
2161	}
2162
2163	trace_gicv3_icc_igrpen_write(ri->opc2 & 1 ? 1 : 0,
2164	gicv3_redist_affid(cs), value);
2165
2166	if (grp == GICV3_G1 && gicv3_use_ns_bank(env)) {
2167	grp = GICV3_G1NS;
2168	}
2169
2170	cs->icc_igrpen[grp] = value & ICC_IGRPEN_ENABLE;
2171	gicv3_cpuif_update(cs);
2172	}
2173
2174	static uint64_t icc_igrpen1_el3_read(CPUARMState env, const ARMCPRegInfo ri)
2175	{
2176	GICv3CPUState *cs = icc_cs_from_env(env);
2177	uint64_t value;
2178
2179	/* IGRPEN1_EL3 bits 0 and 1 are r/w aliases into IGRPEN1_EL1 NS and S */
2180	value = cs->icc_igrpen[GICV3_G1NS] \| (cs->icc_igrpen[GICV3_G1] << 1);
2181	trace_gicv3_icc_igrpen1_el3_read(gicv3_redist_affid(cs), value);
2182	return value;
2183	}
2184
2185	static void icc_igrpen1_el3_write(CPUARMState env, const ARMCPRegInfo ri,
2186	uint64_t value)
2187	{
2188	GICv3CPUState *cs = icc_cs_from_env(env);
2189
2190	trace_gicv3_icc_igrpen1_el3_write(gicv3_redist_affid(cs), value);
2191
2192	/* IGRPEN1_EL3 bits 0 and 1 are r/w aliases into IGRPEN1_EL1 NS and S */
2193	cs->icc_igrpen[GICV3_G1NS] = extract32(value, 0, 1);
2194	cs->icc_igrpen[GICV3_G1] = extract32(value, 1, 1);
2195	gicv3_cpuif_update(cs);
2196	}
2197
2198	static uint64_t icc_ctlr_el1_read(CPUARMState env, const ARMCPRegInfo ri)
2199	{
2200	GICv3CPUState *cs = icc_cs_from_env(env);
2201	int bank = gicv3_use_ns_bank(env) ? GICV3_NS : GICV3_S;
2202	uint64_t value;
2203
2204	if (icv_access(env, HCR_FMO \| HCR_IMO)) {
2205	return icv_ctlr_read(env, ri);
2206	}
2207
2208	value = cs->icc_ctlr_el1[bank];
2209	trace_gicv3_icc_ctlr_read(gicv3_redist_affid(cs), value);
2210	return value;
2211	}
2212
2213	static void icc_ctlr_el1_write(CPUARMState env, const ARMCPRegInfo ri,
2214	uint64_t value)
2215	{
2216	GICv3CPUState *cs = icc_cs_from_env(env);
2217	int bank = gicv3_use_ns_bank(env) ? GICV3_NS : GICV3_S;
2218	uint64_t mask;
2219
2220	if (icv_access(env, HCR_FMO \| HCR_IMO)) {
2221	icv_ctlr_write(env, ri, value);
2222	return;
2223	}
2224
2225	trace_gicv3_icc_ctlr_write(gicv3_redist_affid(cs), value);
2226
2227	/* Only CBPR and EOIMODE can be RW;
2228	* for us PMHE is RAZ/WI (we don't implement 1-of-N interrupts or
2229	* the asseciated priority-based routing of them);
2230	* if EL3 is implemented and GICD_CTLR.DS == 0, then PMHE and CBPR are RO.
2231	*/
2232	if (arm_feature(env, ARM_FEATURE_EL3) &&
2233	((cs->gic->gicd_ctlr & GICD_CTLR_DS) == 0)) {
2234	mask = ICC_CTLR_EL1_EOIMODE;
2235	} else {
2236	mask = ICC_CTLR_EL1_CBPR \| ICC_CTLR_EL1_EOIMODE;
2237	}
2238
2239	cs->icc_ctlr_el1[bank] &= ~mask;
2240	cs->icc_ctlr_el1[bank] \|= (value & mask);
2241	gicv3_cpuif_update(cs);
2242	}
2243
2244
2245	static uint64_t icc_ctlr_el3_read(CPUARMState env, const ARMCPRegInfo ri)
2246	{
2247	GICv3CPUState *cs = icc_cs_from_env(env);
2248	uint64_t value;
2249
2250	value = cs->icc_ctlr_el3;
2251	if (cs->icc_ctlr_el1[GICV3_NS] & ICC_CTLR_EL1_EOIMODE) {
2252	value \|= ICC_CTLR_EL3_EOIMODE_EL1NS;
2253	}
2254	if (cs->icc_ctlr_el1[GICV3_NS] & ICC_CTLR_EL1_CBPR) {
2255	value \|= ICC_CTLR_EL3_CBPR_EL1NS;
2256	}
2257	if (cs->icc_ctlr_el1[GICV3_NS] & ICC_CTLR_EL1_EOIMODE) {
2258	value \|= ICC_CTLR_EL3_EOIMODE_EL1S;
2259	}
2260	if (cs->icc_ctlr_el1[GICV3_NS] & ICC_CTLR_EL1_CBPR) {
2261	value \|= ICC_CTLR_EL3_CBPR_EL1S;
2262	}
2263
2264	trace_gicv3_icc_ctlr_el3_read(gicv3_redist_affid(cs), value);
2265	return value;
2266	}
2267
2268	static void icc_ctlr_el3_write(CPUARMState env, const ARMCPRegInfo ri,
2269	uint64_t value)
2270	{
2271	GICv3CPUState *cs = icc_cs_from_env(env);
2272	uint64_t mask;
2273
2274	trace_gicv3_icc_ctlr_el3_write(gicv3_redist_affid(cs), value);
2275
2276	/* _EL1NS and _EL1S bits are aliases into the ICC_CTLR_EL1 bits. */
2277	cs->icc_ctlr_el1[GICV3_NS] &= ~(ICC_CTLR_EL1_CBPR \| ICC_CTLR_EL1_EOIMODE);
2278	if (value & ICC_CTLR_EL3_EOIMODE_EL1NS) {
2279	cs->icc_ctlr_el1[GICV3_NS] \|= ICC_CTLR_EL1_EOIMODE;
2280	}
2281	if (value & ICC_CTLR_EL3_CBPR_EL1NS) {
2282	cs->icc_ctlr_el1[GICV3_NS] \|= ICC_CTLR_EL1_CBPR;
2283	}
2284
2285	cs->icc_ctlr_el1[GICV3_S] &= ~(ICC_CTLR_EL1_CBPR \| ICC_CTLR_EL1_EOIMODE);
2286	if (value & ICC_CTLR_EL3_EOIMODE_EL1S) {
2287	cs->icc_ctlr_el1[GICV3_S] \|= ICC_CTLR_EL1_EOIMODE;
2288	}
2289	if (value & ICC_CTLR_EL3_CBPR_EL1S) {
2290	cs->icc_ctlr_el1[GICV3_S] \|= ICC_CTLR_EL1_CBPR;
2291	}
2292
2293	/* The only bit stored in icc_ctlr_el3 which is writable is EOIMODE_EL3: */
2294	mask = ICC_CTLR_EL3_EOIMODE_EL3;
2295
2296	cs->icc_ctlr_el3 &= ~mask;
2297	cs->icc_ctlr_el3 \|= (value & mask);
2298	gicv3_cpuif_update(cs);
2299	}
2300
2301	static CPAccessResult gicv3_irqfiq_access(CPUARMState *env,
2302	const ARMCPRegInfo *ri, bool isread)
2303	{
2304	CPAccessResult r = CP_ACCESS_OK;
2305	GICv3CPUState *cs = icc_cs_from_env(env);
2306	int el = arm_current_el(env);
2307
2308	if ((cs->ich_hcr_el2 & ICH_HCR_EL2_TC) &&
2309	el == 1 && !arm_is_secure_below_el3(env)) {
2310	/* Takes priority over a possible EL3 trap */
2311	return CP_ACCESS_TRAP_EL2;
2312	}
2313
2314	if ((env->cp15.scr_el3 & (SCR_FIQ \| SCR_IRQ)) == (SCR_FIQ \| SCR_IRQ)) {
2315	switch (el) {
2316	case 1:
2317	/* Note that arm_hcr_el2_eff takes secure state into account. */
2318	if ((arm_hcr_el2_eff(env) & (HCR_IMO \| HCR_FMO)) == 0) {
2319	r = CP_ACCESS_TRAP_EL3;
2320	}
2321	break;
2322	case 2:
2323	r = CP_ACCESS_TRAP_EL3;
2324	break;
2325	case 3:
2326	if (!arm_is_el3_or_mon(env)) {
2327	r = CP_ACCESS_TRAP_EL3;
2328	}
2329	break;
2330	default:
2331	g_assert_not_reached();
2332	}
2333	}
2334
2335	return r;
2336	}
2337
2338	static CPAccessResult gicv3_dir_access(CPUARMState *env,
2339	const ARMCPRegInfo *ri, bool isread)
2340	{
2341	GICv3CPUState *cs = icc_cs_from_env(env);
2342
2343	if ((cs->ich_hcr_el2 & ICH_HCR_EL2_TDIR) &&
2344	arm_current_el(env) == 1 && !arm_is_secure_below_el3(env)) {
2345	/* Takes priority over a possible EL3 trap */
2346	return CP_ACCESS_TRAP_EL2;
2347	}
2348
2349	return gicv3_irqfiq_access(env, ri, isread);
2350	}
2351
2352	static CPAccessResult gicv3_sgi_access(CPUARMState *env,
2353	const ARMCPRegInfo *ri, bool isread)
2354	{
2355	if (arm_current_el(env) == 1 &&
2356	(arm_hcr_el2_eff(env) & (HCR_IMO \| HCR_FMO)) != 0) {
2357	/* Takes priority over a possible EL3 trap */
2358	return CP_ACCESS_TRAP_EL2;
2359	}
2360
2361	return gicv3_irqfiq_access(env, ri, isread);
2362	}
2363
2364	static CPAccessResult gicv3_fiq_access(CPUARMState *env,
2365	const ARMCPRegInfo *ri, bool isread)
2366	{
2367	CPAccessResult r = CP_ACCESS_OK;
2368	GICv3CPUState *cs = icc_cs_from_env(env);
2369	int el = arm_current_el(env);
2370
2371	if ((cs->ich_hcr_el2 & ICH_HCR_EL2_TALL0) &&
2372	el == 1 && !arm_is_secure_below_el3(env)) {
2373	/* Takes priority over a possible EL3 trap */
2374	return CP_ACCESS_TRAP_EL2;
2375	}
2376
2377	if (env->cp15.scr_el3 & SCR_FIQ) {
2378	switch (el) {
2379	case 1:
2380	if ((arm_hcr_el2_eff(env) & HCR_FMO) == 0) {
2381	r = CP_ACCESS_TRAP_EL3;
2382	}
2383	break;
2384	case 2:
2385	r = CP_ACCESS_TRAP_EL3;
2386	break;
2387	case 3:
2388	if (!arm_is_el3_or_mon(env)) {
2389	r = CP_ACCESS_TRAP_EL3;
2390	}
2391	break;
2392	default:
2393	g_assert_not_reached();
2394	}
2395	}
2396
2397	return r;
2398	}
2399
2400	static CPAccessResult gicv3_irq_access(CPUARMState *env,
2401	const ARMCPRegInfo *ri, bool isread)
2402	{
2403	CPAccessResult r = CP_ACCESS_OK;
2404	GICv3CPUState *cs = icc_cs_from_env(env);
2405	int el = arm_current_el(env);
2406
2407	if ((cs->ich_hcr_el2 & ICH_HCR_EL2_TALL1) &&
2408	el == 1 && !arm_is_secure_below_el3(env)) {
2409	/* Takes priority over a possible EL3 trap */
2410	return CP_ACCESS_TRAP_EL2;
2411	}
2412
2413	if (env->cp15.scr_el3 & SCR_IRQ) {
2414	switch (el) {
2415	case 1:
2416	if ((arm_hcr_el2_eff(env) & HCR_IMO) == 0) {
2417	r = CP_ACCESS_TRAP_EL3;
2418	}
2419	break;
2420	case 2:
2421	r = CP_ACCESS_TRAP_EL3;
2422	break;
2423	case 3:
2424	if (!arm_is_el3_or_mon(env)) {
2425	r = CP_ACCESS_TRAP_EL3;
2426	}
2427	break;
2428	default:
2429	g_assert_not_reached();
2430	}
2431	}
2432
2433	return r;
2434	}
2435
2436	static void icc_reset(CPUARMState env, const ARMCPRegInfo ri)
2437	{
2438	GICv3CPUState *cs = icc_cs_from_env(env);
2439
2440	cs->icc_ctlr_el1[GICV3_S] = ICC_CTLR_EL1_A3V \|
2441	(1 << ICC_CTLR_EL1_IDBITS_SHIFT) \|
2442	((cs->pribits - 1) << ICC_CTLR_EL1_PRIBITS_SHIFT);
2443	cs->icc_ctlr_el1[GICV3_NS] = ICC_CTLR_EL1_A3V \|
2444	(1 << ICC_CTLR_EL1_IDBITS_SHIFT) \|
2445	((cs->pribits - 1) << ICC_CTLR_EL1_PRIBITS_SHIFT);
2446	cs->icc_pmr_el1 = 0;
2447	cs->icc_bpr[GICV3_G0] = icc_min_bpr(cs);
2448	cs->icc_bpr[GICV3_G1] = icc_min_bpr(cs);
2449	cs->icc_bpr[GICV3_G1NS] = icc_min_bpr_ns(cs);
2450	memset(cs->icc_apr, 0, sizeof(cs->icc_apr));
2451	memset(cs->icc_igrpen, 0, sizeof(cs->icc_igrpen));
2452	cs->icc_ctlr_el3 = ICC_CTLR_EL3_NDS \| ICC_CTLR_EL3_A3V \|
2453	(1 << ICC_CTLR_EL3_IDBITS_SHIFT) \|
2454	((cs->pribits - 1) << ICC_CTLR_EL3_PRIBITS_SHIFT);
2455
2456	memset(cs->ich_apr, 0, sizeof(cs->ich_apr));
2457	cs->ich_hcr_el2 = 0;
2458	memset(cs->ich_lr_el2, 0, sizeof(cs->ich_lr_el2));
2459	cs->ich_vmcr_el2 = ICH_VMCR_EL2_VFIQEN \|
2460	((icv_min_vbpr(cs) + 1) << ICH_VMCR_EL2_VBPR1_SHIFT) \|
2461	(icv_min_vbpr(cs) << ICH_VMCR_EL2_VBPR0_SHIFT);
2462	}
2463
2464	static const ARMCPRegInfo gicv3_cpuif_reginfo[] = {
2465	{ .name = "ICC_PMR_EL1", .state = ARM_CP_STATE_BOTH,
2466	.opc0 = 3, .opc1 = 0, .crn = 4, .crm = 6, .opc2 = 0,
2467	.type = ARM_CP_IO \| ARM_CP_NO_RAW,
2468	.access = PL1_RW, .accessfn = gicv3_irqfiq_access,
2469	.readfn = icc_pmr_read,
2470	.writefn = icc_pmr_write,
2471	/* We hang the whole cpu interface reset routine off here
2472	* rather than parcelling it out into one little function
2473	* per register
2474	*/
2475	.resetfn = icc_reset,
2476	},
2477	{ .name = "ICC_IAR0_EL1", .state = ARM_CP_STATE_BOTH,
2478	.opc0 = 3, .opc1 = 0, .crn = 12, .crm = 8, .opc2 = 0,
2479	.type = ARM_CP_IO \| ARM_CP_NO_RAW,
2480	.access = PL1_R, .accessfn = gicv3_fiq_access,
2481	.readfn = icc_iar0_read,
2482	},
2483	{ .name = "ICC_EOIR0_EL1", .state = ARM_CP_STATE_BOTH,
2484	.opc0 = 3, .opc1 = 0, .crn = 12, .crm = 8, .opc2 = 1,
2485	.type = ARM_CP_IO \| ARM_CP_NO_RAW,
2486	.access = PL1_W, .accessfn = gicv3_fiq_access,
2487	.writefn = icc_eoir_write,
2488	},
2489	{ .name = "ICC_HPPIR0_EL1", .state = ARM_CP_STATE_BOTH,
2490	.opc0 = 3, .opc1 = 0, .crn = 12, .crm = 8, .opc2 = 2,
2491	.type = ARM_CP_IO \| ARM_CP_NO_RAW,
2492	.access = PL1_R, .accessfn = gicv3_fiq_access,
2493	.readfn = icc_hppir0_read,
2494	},
2495	{ .name = "ICC_BPR0_EL1", .state = ARM_CP_STATE_BOTH,
2496	.opc0 = 3, .opc1 = 0, .crn = 12, .crm = 8, .opc2 = 3,
2497	.type = ARM_CP_IO \| ARM_CP_NO_RAW,
2498	.access = PL1_RW, .accessfn = gicv3_fiq_access,
2499	.readfn = icc_bpr_read,
2500	.writefn = icc_bpr_write,
2501	},
2502	{ .name = "ICC_AP0R0_EL1", .state = ARM_CP_STATE_BOTH,
2503	.opc0 = 3, .opc1 = 0, .crn = 12, .crm = 8, .opc2 = 4,
2504	.type = ARM_CP_IO \| ARM_CP_NO_RAW,
2505	.access = PL1_RW, .accessfn = gicv3_fiq_access,
2506	.readfn = icc_ap_read,
2507	.writefn = icc_ap_write,
2508	},
2509	/* All the ICC_AP1R_EL1 registers are banked /
2510	{ .name = "ICC_AP1R0_EL1", .state = ARM_CP_STATE_BOTH,
2511	.opc0 = 3, .opc1 = 0, .crn = 12, .crm = 9, .opc2 = 0,
2512	.type = ARM_CP_IO \| ARM_CP_NO_RAW,
2513	.access = PL1_RW, .accessfn = gicv3_irq_access,
2514	.readfn = icc_ap_read,
2515	.writefn = icc_ap_write,
2516	},
2517	{ .name = "ICC_DIR_EL1", .state = ARM_CP_STATE_BOTH,
2518	.opc0 = 3, .opc1 = 0, .crn = 12, .crm = 11, .opc2 = 1,
2519	.type = ARM_CP_IO \| ARM_CP_NO_RAW,
2520	.access = PL1_W, .accessfn = gicv3_dir_access,
2521	.writefn = icc_dir_write,
2522	},
2523	{ .name = "ICC_RPR_EL1", .state = ARM_CP_STATE_BOTH,
2524	.opc0 = 3, .opc1 = 0, .crn = 12, .crm = 11, .opc2 = 3,
2525	.type = ARM_CP_IO \| ARM_CP_NO_RAW,
2526	.access = PL1_R, .accessfn = gicv3_irqfiq_access,
2527	.readfn = icc_rpr_read,
2528	},
2529	{ .name = "ICC_SGI1R_EL1", .state = ARM_CP_STATE_AA64,
2530	.opc0 = 3, .opc1 = 0, .crn = 12, .crm = 11, .opc2 = 5,
2531	.type = ARM_CP_IO \| ARM_CP_NO_RAW,
2532	.access = PL1_W, .accessfn = gicv3_sgi_access,
2533	.writefn = icc_sgi1r_write,
2534	},
2535	{ .name = "ICC_SGI1R",
2536	.cp = 15, .opc1 = 0, .crm = 12,
2537	.type = ARM_CP_64BIT \| ARM_CP_IO \| ARM_CP_NO_RAW,
2538	.access = PL1_W, .accessfn = gicv3_sgi_access,
2539	.writefn = icc_sgi1r_write,
2540	},
2541	{ .name = "ICC_ASGI1R_EL1", .state = ARM_CP_STATE_AA64,
2542	.opc0 = 3, .opc1 = 0, .crn = 12, .crm = 11, .opc2 = 6,
2543	.type = ARM_CP_IO \| ARM_CP_NO_RAW,
2544	.access = PL1_W, .accessfn = gicv3_sgi_access,
2545	.writefn = icc_asgi1r_write,
2546	},
2547	{ .name = "ICC_ASGI1R",
2548	.cp = 15, .opc1 = 1, .crm = 12,
2549	.type = ARM_CP_64BIT \| ARM_CP_IO \| ARM_CP_NO_RAW,
2550	.access = PL1_W, .accessfn = gicv3_sgi_access,
2551	.writefn = icc_asgi1r_write,
2552	},
2553	{ .name = "ICC_SGI0R_EL1", .state = ARM_CP_STATE_AA64,
2554	.opc0 = 3, .opc1 = 0, .crn = 12, .crm = 11, .opc2 = 7,
2555	.type = ARM_CP_IO \| ARM_CP_NO_RAW,
2556	.access = PL1_W, .accessfn = gicv3_sgi_access,
2557	.writefn = icc_sgi0r_write,
2558	},
2559	{ .name = "ICC_SGI0R",
2560	.cp = 15, .opc1 = 2, .crm = 12,
2561	.type = ARM_CP_64BIT \| ARM_CP_IO \| ARM_CP_NO_RAW,
2562	.access = PL1_W, .accessfn = gicv3_sgi_access,
2563	.writefn = icc_sgi0r_write,
2564	},
2565	{ .name = "ICC_IAR1_EL1", .state = ARM_CP_STATE_BOTH,
2566	.opc0 = 3, .opc1 = 0, .crn = 12, .crm = 12, .opc2 = 0,
2567	.type = ARM_CP_IO \| ARM_CP_NO_RAW,
2568	.access = PL1_R, .accessfn = gicv3_irq_access,
2569	.readfn = icc_iar1_read,
2570	},
2571	{ .name = "ICC_EOIR1_EL1", .state = ARM_CP_STATE_BOTH,
2572	.opc0 = 3, .opc1 = 0, .crn = 12, .crm = 12, .opc2 = 1,
2573	.type = ARM_CP_IO \| ARM_CP_NO_RAW,
2574	.access = PL1_W, .accessfn = gicv3_irq_access,
2575	.writefn = icc_eoir_write,
2576	},
2577	{ .name = "ICC_HPPIR1_EL1", .state = ARM_CP_STATE_BOTH,
2578	.opc0 = 3, .opc1 = 0, .crn = 12, .crm = 12, .opc2 = 2,
2579	.type = ARM_CP_IO \| ARM_CP_NO_RAW,
2580	.access = PL1_R, .accessfn = gicv3_irq_access,
2581	.readfn = icc_hppir1_read,
2582	},
2583	/* This register is banked */
2584	{ .name = "ICC_BPR1_EL1", .state = ARM_CP_STATE_BOTH,
2585	.opc0 = 3, .opc1 = 0, .crn = 12, .crm = 12, .opc2 = 3,
2586	.type = ARM_CP_IO \| ARM_CP_NO_RAW,
2587	.access = PL1_RW, .accessfn = gicv3_irq_access,
2588	.readfn = icc_bpr_read,
2589	.writefn = icc_bpr_write,
2590	},
2591	/* This register is banked */
2592	{ .name = "ICC_CTLR_EL1", .state = ARM_CP_STATE_BOTH,
2593	.opc0 = 3, .opc1 = 0, .crn = 12, .crm = 12, .opc2 = 4,
2594	.type = ARM_CP_IO \| ARM_CP_NO_RAW,
2595	.access = PL1_RW, .accessfn = gicv3_irqfiq_access,
2596	.readfn = icc_ctlr_el1_read,
2597	.writefn = icc_ctlr_el1_write,
2598	},
2599	{ .name = "ICC_SRE_EL1", .state = ARM_CP_STATE_BOTH,
2600	.opc0 = 3, .opc1 = 0, .crn = 12, .crm = 12, .opc2 = 5,
2601	.type = ARM_CP_NO_RAW \| ARM_CP_CONST,
2602	.access = PL1_RW,
2603	/* We don't support IRQ/FIQ bypass and system registers are
2604	* always enabled, so all our bits are RAZ/WI or RAO/WI.
2605	* This register is banked but since it's constant we don't
2606	* need to do anything special.
2607	*/
2608	.resetvalue = 0x7,
2609	},
2610	{ .name = "ICC_IGRPEN0_EL1", .state = ARM_CP_STATE_BOTH,
2611	.opc0 = 3, .opc1 = 0, .crn = 12, .crm = 12, .opc2 = 6,
2612	.type = ARM_CP_IO \| ARM_CP_NO_RAW,
2613	.access = PL1_RW, .accessfn = gicv3_fiq_access,
2614	.fgt = FGT_ICC_IGRPENN_EL1,
2615	.readfn = icc_igrpen_read,
2616	.writefn = icc_igrpen_write,
2617	},
2618	/* This register is banked */
2619	{ .name = "ICC_IGRPEN1_EL1", .state = ARM_CP_STATE_BOTH,
2620	.opc0 = 3, .opc1 = 0, .crn = 12, .crm = 12, .opc2 = 7,
2621	.type = ARM_CP_IO \| ARM_CP_NO_RAW,
2622	.access = PL1_RW, .accessfn = gicv3_irq_access,
2623	.fgt = FGT_ICC_IGRPENN_EL1,
2624	.readfn = icc_igrpen_read,
2625	.writefn = icc_igrpen_write,
2626	},
2627	{ .name = "ICC_SRE_EL2", .state = ARM_CP_STATE_BOTH,
2628	.opc0 = 3, .opc1 = 4, .crn = 12, .crm = 9, .opc2 = 5,
2629	.type = ARM_CP_NO_RAW \| ARM_CP_CONST,
2630	.access = PL2_RW,
2631	/* We don't support IRQ/FIQ bypass and system registers are
2632	* always enabled, so all our bits are RAZ/WI or RAO/WI.
2633	*/
2634	.resetvalue = 0xf,
2635	},
2636	{ .name = "ICC_CTLR_EL3", .state = ARM_CP_STATE_BOTH,
2637	.opc0 = 3, .opc1 = 6, .crn = 12, .crm = 12, .opc2 = 4,
2638	.type = ARM_CP_IO \| ARM_CP_NO_RAW,
2639	.access = PL3_RW,
2640	.readfn = icc_ctlr_el3_read,
2641	.writefn = icc_ctlr_el3_write,
2642	},
2643	{ .name = "ICC_SRE_EL3", .state = ARM_CP_STATE_BOTH,
2644	.opc0 = 3, .opc1 = 6, .crn = 12, .crm = 12, .opc2 = 5,
2645	.type = ARM_CP_NO_RAW \| ARM_CP_CONST,
2646	.access = PL3_RW,
2647	/* We don't support IRQ/FIQ bypass and system registers are
2648	* always enabled, so all our bits are RAZ/WI or RAO/WI.
2649	*/
2650	.resetvalue = 0xf,
2651	},
2652	{ .name = "ICC_IGRPEN1_EL3", .state = ARM_CP_STATE_BOTH,
2653	.opc0 = 3, .opc1 = 6, .crn = 12, .crm = 12, .opc2 = 7,
2654	.type = ARM_CP_IO \| ARM_CP_NO_RAW,
2655	.access = PL3_RW,
2656	.readfn = icc_igrpen1_el3_read,
2657	.writefn = icc_igrpen1_el3_write,
2658	},
2659	};
2660
2661	static const ARMCPRegInfo gicv3_cpuif_icc_apxr1_reginfo[] = {
2662	{ .name = "ICC_AP0R1_EL1", .state = ARM_CP_STATE_BOTH,
2663	.opc0 = 3, .opc1 = 0, .crn = 12, .crm = 8, .opc2 = 5,
2664	.type = ARM_CP_IO \| ARM_CP_NO_RAW,
2665	.access = PL1_RW, .accessfn = gicv3_fiq_access,
2666	.readfn = icc_ap_read,
2667	.writefn = icc_ap_write,
2668	},
2669	{ .name = "ICC_AP1R1_EL1", .state = ARM_CP_STATE_BOTH,
2670	.opc0 = 3, .opc1 = 0, .crn = 12, .crm = 9, .opc2 = 1,
2671	.type = ARM_CP_IO \| ARM_CP_NO_RAW,
2672	.access = PL1_RW, .accessfn = gicv3_irq_access,
2673	.readfn = icc_ap_read,
2674	.writefn = icc_ap_write,
2675	},
2676	};
2677
2678	static const ARMCPRegInfo gicv3_cpuif_icc_apxr23_reginfo[] = {
2679	{ .name = "ICC_AP0R2_EL1", .state = ARM_CP_STATE_BOTH,
2680	.opc0 = 3, .opc1 = 0, .crn = 12, .crm = 8, .opc2 = 6,
2681	.type = ARM_CP_IO \| ARM_CP_NO_RAW,
2682	.access = PL1_RW, .accessfn = gicv3_fiq_access,
2683	.readfn = icc_ap_read,
2684	.writefn = icc_ap_write,
2685	},
2686	{ .name = "ICC_AP0R3_EL1", .state = ARM_CP_STATE_BOTH,
2687	.opc0 = 3, .opc1 = 0, .crn = 12, .crm = 8, .opc2 = 7,
2688	.type = ARM_CP_IO \| ARM_CP_NO_RAW,
2689	.access = PL1_RW, .accessfn = gicv3_fiq_access,
2690	.readfn = icc_ap_read,
2691	.writefn = icc_ap_write,
2692	},
2693	{ .name = "ICC_AP1R2_EL1", .state = ARM_CP_STATE_BOTH,
2694	.opc0 = 3, .opc1 = 0, .crn = 12, .crm = 9, .opc2 = 2,
2695	.type = ARM_CP_IO \| ARM_CP_NO_RAW,
2696	.access = PL1_RW, .accessfn = gicv3_irq_access,
2697	.readfn = icc_ap_read,
2698	.writefn = icc_ap_write,
2699	},
2700	{ .name = "ICC_AP1R3_EL1", .state = ARM_CP_STATE_BOTH,
2701	.opc0 = 3, .opc1 = 0, .crn = 12, .crm = 9, .opc2 = 3,
2702	.type = ARM_CP_IO \| ARM_CP_NO_RAW,
2703	.access = PL1_RW, .accessfn = gicv3_irq_access,
2704	.readfn = icc_ap_read,
2705	.writefn = icc_ap_write,
2706	},
2707	};
2708
2709	static const ARMCPRegInfo gicv3_cpuif_gicv3_nmi_reginfo[] = {
2710	{ .name = "ICC_NMIAR1_EL1", .state = ARM_CP_STATE_BOTH,
2711	.opc0 = 3, .opc1 = 0, .crn = 12, .crm = 9, .opc2 = 5,
2712	.type = ARM_CP_IO \| ARM_CP_NO_RAW,
2713	.access = PL1_R, .accessfn = gicv3_irq_access,
2714	.readfn = icc_nmiar1_read,
2715	},
2716	};
2717
2718	static uint64_t ich_ap_read(CPUARMState env, const ARMCPRegInfo ri)
2719	{
2720	GICv3CPUState *cs = icc_cs_from_env(env);
2721	int regno = ri->opc2 & 3;
2722	int grp = (ri->crm & 1) ? GICV3_G1NS : GICV3_G0;
2723	uint64_t value;
2724
2725	value = cs->ich_apr[grp][regno];
2726	trace_gicv3_ich_ap_read(ri->crm & 1, regno, gicv3_redist_affid(cs), value);
2727	return value;
2728	}
2729
2730	static void ich_ap_write(CPUARMState env, const ARMCPRegInfo ri,
2731	uint64_t value)
2732	{
2733	GICv3CPUState *cs = icc_cs_from_env(env);
2734	int regno = ri->opc2 & 3;
2735	int grp = (ri->crm & 1) ? GICV3_G1NS : GICV3_G0;
2736
2737	trace_gicv3_ich_ap_write(ri->crm & 1, regno, gicv3_redist_affid(cs), value);
2738
2739	if (cs->nmi_support) {
2740	cs->ich_apr[grp][regno] = value & (0xFFFFFFFFU \| ICV_AP1R_EL1_NMI);
2741	} else {
2742	cs->ich_apr[grp][regno] = value & 0xFFFFFFFFU;
2743	}
2744	gicv3_cpuif_virt_irq_fiq_update(cs);
2745	}
2746
2747	static uint64_t ich_hcr_read(CPUARMState env, const ARMCPRegInfo ri)
2748	{
2749	GICv3CPUState *cs = icc_cs_from_env(env);
2750	uint64_t value = cs->ich_hcr_el2;
2751
2752	trace_gicv3_ich_hcr_read(gicv3_redist_affid(cs), value);
2753	return value;
2754	}
2755
2756	static void ich_hcr_write(CPUARMState env, const ARMCPRegInfo ri,
2757	uint64_t value)
2758	{
2759	GICv3CPUState *cs = icc_cs_from_env(env);
2760
2761	trace_gicv3_ich_hcr_write(gicv3_redist_affid(cs), value);
2762
2763	value &= ICH_HCR_EL2_EN \| ICH_HCR_EL2_UIE \| ICH_HCR_EL2_LRENPIE \|
2764	ICH_HCR_EL2_NPIE \| ICH_HCR_EL2_VGRP0EIE \| ICH_HCR_EL2_VGRP0DIE \|
2765	ICH_HCR_EL2_VGRP1EIE \| ICH_HCR_EL2_VGRP1DIE \| ICH_HCR_EL2_TC \|
2766	ICH_HCR_EL2_TALL0 \| ICH_HCR_EL2_TALL1 \| ICH_HCR_EL2_TSEI \|
2767	ICH_HCR_EL2_TDIR \| ICH_HCR_EL2_EOICOUNT_MASK;
2768
2769	cs->ich_hcr_el2 = value;
2770	gicv3_cpuif_virt_update(cs);
2771	}
2772
2773	static uint64_t ich_vmcr_read(CPUARMState env, const ARMCPRegInfo ri)
2774	{
2775	GICv3CPUState *cs = icc_cs_from_env(env);
2776	uint64_t value = cs->ich_vmcr_el2;
2777
2778	trace_gicv3_ich_vmcr_read(gicv3_redist_affid(cs), value);
2779	return value;
2780	}
2781
2782	static void ich_vmcr_write(CPUARMState env, const ARMCPRegInfo ri,
2783	uint64_t value)
2784	{
2785	GICv3CPUState *cs = icc_cs_from_env(env);
2786
2787	trace_gicv3_ich_vmcr_write(gicv3_redist_affid(cs), value);
2788
2789	value &= ICH_VMCR_EL2_VENG0 \| ICH_VMCR_EL2_VENG1 \| ICH_VMCR_EL2_VCBPR \|
2790	ICH_VMCR_EL2_VEOIM \| ICH_VMCR_EL2_VBPR1_MASK \|
2791	ICH_VMCR_EL2_VBPR0_MASK \| ICH_VMCR_EL2_VPMR_MASK;
2792	value \|= ICH_VMCR_EL2_VFIQEN;
2793
2794	cs->ich_vmcr_el2 = value;
2795	/* Enforce "writing BPRs to less than minimum sets them to the minimum"
2796	* by reading and writing back the fields.
2797	*/
2798	write_vbpr(cs, GICV3_G0, read_vbpr(cs, GICV3_G0));
2799	write_vbpr(cs, GICV3_G1, read_vbpr(cs, GICV3_G1));
2800
2801	gicv3_cpuif_virt_update(cs);
2802	}
2803
2804	static uint64_t ich_lr_read(CPUARMState env, const ARMCPRegInfo ri)
2805	{
2806	GICv3CPUState *cs = icc_cs_from_env(env);
2807	int regno = ri->opc2 \| ((ri->crm & 1) << 3);
2808	uint64_t value;
2809
2810	/* This read function handles all of:
2811	* 64-bit reads of the whole LR
2812	* 32-bit reads of the low half of the LR
2813	* 32-bit reads of the high half of the LR
2814	*/
2815	if (ri->state == ARM_CP_STATE_AA32) {
2816	if (ri->crm >= 14) {
2817	value = extract64(cs->ich_lr_el2[regno], 32, 32);
2818	trace_gicv3_ich_lrc_read(regno, gicv3_redist_affid(cs), value);
2819	} else {
2820	value = extract64(cs->ich_lr_el2[regno], 0, 32);
2821	trace_gicv3_ich_lr32_read(regno, gicv3_redist_affid(cs), value);
2822	}
2823	} else {
2824	value = cs->ich_lr_el2[regno];
2825	trace_gicv3_ich_lr_read(regno, gicv3_redist_affid(cs), value);
2826	}
2827
2828	return value;
2829	}
2830
2831	static void ich_lr_write(CPUARMState env, const ARMCPRegInfo ri,
2832	uint64_t value)
2833	{
2834	GICv3CPUState *cs = icc_cs_from_env(env);
2835	int regno = ri->opc2 \| ((ri->crm & 1) << 3);
2836
2837	/* This write function handles all of:
2838	* 64-bit writes to the whole LR
2839	* 32-bit writes to the low half of the LR
2840	* 32-bit writes to the high half of the LR
2841	*/
2842	if (ri->state == ARM_CP_STATE_AA32) {
2843	if (ri->crm >= 14) {
2844	trace_gicv3_ich_lrc_write(regno, gicv3_redist_affid(cs), value);
2845	value = deposit64(cs->ich_lr_el2[regno], 32, 32, value);
2846	} else {
2847	trace_gicv3_ich_lr32_write(regno, gicv3_redist_affid(cs), value);
2848	value = deposit64(cs->ich_lr_el2[regno], 0, 32, value);
2849	}
2850	} else {
2851	trace_gicv3_ich_lr_write(regno, gicv3_redist_affid(cs), value);
2852	}
2853
2854	/* Enforce RES0 bits in priority field */
2855	if (cs->vpribits < 8) {
2856	value = deposit64(value, ICH_LR_EL2_PRIORITY_SHIFT,
2857	8 - cs->vpribits, 0);
2858	}
2859
2860	/* Enforce RES0 bit in NMI field when FEAT_GICv3_NMI is not implemented */
2861	if (!cs->nmi_support) {
2862	value &= ~ICH_LR_EL2_NMI;
2863	}
2864
2865	cs->ich_lr_el2[regno] = value;
2866	gicv3_cpuif_virt_update(cs);
2867	}
2868
2869	static uint64_t ich_vtr_read(CPUARMState env, const ARMCPRegInfo ri)
2870	{
2871	GICv3CPUState *cs = icc_cs_from_env(env);
2872	uint64_t value;
2873
2874	value = ((cs->num_list_regs - 1) << ICH_VTR_EL2_LISTREGS_SHIFT)
2875	\| ICH_VTR_EL2_TDS \| ICH_VTR_EL2_A3V
2876	\| (1 << ICH_VTR_EL2_IDBITS_SHIFT)
2877	\| ((cs->vprebits - 1) << ICH_VTR_EL2_PREBITS_SHIFT)
2878	\| ((cs->vpribits - 1) << ICH_VTR_EL2_PRIBITS_SHIFT);
2879
2880	if (cs->gic->revision < 4) {
2881	value \|= ICH_VTR_EL2_NV4;
2882	}
2883
2884	trace_gicv3_ich_vtr_read(gicv3_redist_affid(cs), value);
2885	return value;
2886	}
2887
2888	static uint64_t ich_misr_read(CPUARMState env, const ARMCPRegInfo ri)
2889	{
2890	GICv3CPUState *cs = icc_cs_from_env(env);
2891	uint64_t value = maintenance_interrupt_state(cs);
2892
2893	trace_gicv3_ich_misr_read(gicv3_redist_affid(cs), value);
2894	return value;
2895	}
2896
2897	static uint64_t ich_eisr_read(CPUARMState env, const ARMCPRegInfo ri)
2898	{
2899	GICv3CPUState *cs = icc_cs_from_env(env);
2900	uint64_t value = eoi_maintenance_interrupt_state(cs, NULL);
2901
2902	trace_gicv3_ich_eisr_read(gicv3_redist_affid(cs), value);
2903	return value;
2904	}
2905
2906	static uint64_t ich_elrsr_read(CPUARMState env, const ARMCPRegInfo ri)
2907	{
2908	GICv3CPUState *cs = icc_cs_from_env(env);
2909	uint64_t value = 0;
2910	int i;
2911
2912	for (i = 0; i < cs->num_list_regs; i++) {
2913	uint64_t lr = cs->ich_lr_el2[i];
2914
2915	if ((lr & ICH_LR_EL2_STATE_MASK) == 0 &&
2916	((lr & ICH_LR_EL2_HW) != 0 \|\| (lr & ICH_LR_EL2_EOI) == 0)) {
2917	value \|= (1 << i);
2918	}
2919	}
2920
2921	trace_gicv3_ich_elrsr_read(gicv3_redist_affid(cs), value);
2922	return value;
2923	}
2924
2925	static const ARMCPRegInfo gicv3_cpuif_hcr_reginfo[] = {
2926	{ .name = "ICH_AP0R0_EL2", .state = ARM_CP_STATE_BOTH,
2927	.opc0 = 3, .opc1 = 4, .crn = 12, .crm = 8, .opc2 = 0,
2928	.type = ARM_CP_IO \| ARM_CP_NO_RAW,
2929	.nv2_redirect_offset = 0x480,
2930	.access = PL2_RW,
2931	.readfn = ich_ap_read,
2932	.writefn = ich_ap_write,
2933	},
2934	{ .name = "ICH_AP1R0_EL2", .state = ARM_CP_STATE_BOTH,
2935	.opc0 = 3, .opc1 = 4, .crn = 12, .crm = 9, .opc2 = 0,
2936	.type = ARM_CP_IO \| ARM_CP_NO_RAW,
2937	.nv2_redirect_offset = 0x4a0,
2938	.access = PL2_RW,
2939	.readfn = ich_ap_read,
2940	.writefn = ich_ap_write,
2941	},
2942	{ .name = "ICH_HCR_EL2", .state = ARM_CP_STATE_BOTH,
2943	.opc0 = 3, .opc1 = 4, .crn = 12, .crm = 11, .opc2 = 0,
2944	.type = ARM_CP_IO \| ARM_CP_NO_RAW,
2945	.nv2_redirect_offset = 0x4c0,
2946	.access = PL2_RW,
2947	.readfn = ich_hcr_read,
2948	.writefn = ich_hcr_write,
2949	},
2950	{ .name = "ICH_VTR_EL2", .state = ARM_CP_STATE_BOTH,
2951	.opc0 = 3, .opc1 = 4, .crn = 12, .crm = 11, .opc2 = 1,
2952	.type = ARM_CP_IO \| ARM_CP_NO_RAW,
2953	.access = PL2_R,
2954	.readfn = ich_vtr_read,
2955	},
2956	{ .name = "ICH_MISR_EL2", .state = ARM_CP_STATE_BOTH,
2957	.opc0 = 3, .opc1 = 4, .crn = 12, .crm = 11, .opc2 = 2,
2958	.type = ARM_CP_IO \| ARM_CP_NO_RAW,
2959	.access = PL2_R,
2960	.readfn = ich_misr_read,
2961	},
2962	{ .name = "ICH_EISR_EL2", .state = ARM_CP_STATE_BOTH,
2963	.opc0 = 3, .opc1 = 4, .crn = 12, .crm = 11, .opc2 = 3,
2964	.type = ARM_CP_IO \| ARM_CP_NO_RAW,
2965	.access = PL2_R,
2966	.readfn = ich_eisr_read,
2967	},
2968	{ .name = "ICH_ELRSR_EL2", .state = ARM_CP_STATE_BOTH,
2969	.opc0 = 3, .opc1 = 4, .crn = 12, .crm = 11, .opc2 = 5,
2970	.type = ARM_CP_IO \| ARM_CP_NO_RAW,
2971	.access = PL2_R,
2972	.readfn = ich_elrsr_read,
2973	},
2974	{ .name = "ICH_VMCR_EL2", .state = ARM_CP_STATE_BOTH,
2975	.opc0 = 3, .opc1 = 4, .crn = 12, .crm = 11, .opc2 = 7,
2976	.type = ARM_CP_IO \| ARM_CP_NO_RAW,
2977	.nv2_redirect_offset = 0x4c8,
2978	.access = PL2_RW,
2979	.readfn = ich_vmcr_read,
2980	.writefn = ich_vmcr_write,
2981	},
2982	};
2983
2984	static const ARMCPRegInfo gicv3_cpuif_ich_apxr1_reginfo[] = {
2985	{ .name = "ICH_AP0R1_EL2", .state = ARM_CP_STATE_BOTH,
2986	.opc0 = 3, .opc1 = 4, .crn = 12, .crm = 8, .opc2 = 1,
2987	.type = ARM_CP_IO \| ARM_CP_NO_RAW,
2988	.nv2_redirect_offset = 0x488,
2989	.access = PL2_RW,
2990	.readfn = ich_ap_read,
2991	.writefn = ich_ap_write,
2992	},
2993	{ .name = "ICH_AP1R1_EL2", .state = ARM_CP_STATE_BOTH,
2994	.opc0 = 3, .opc1 = 4, .crn = 12, .crm = 9, .opc2 = 1,
2995	.type = ARM_CP_IO \| ARM_CP_NO_RAW,
2996	.nv2_redirect_offset = 0x4a8,
2997	.access = PL2_RW,
2998	.readfn = ich_ap_read,
2999	.writefn = ich_ap_write,
3000	},
3001	};
3002
3003	static const ARMCPRegInfo gicv3_cpuif_ich_apxr23_reginfo[] = {
3004	{ .name = "ICH_AP0R2_EL2", .state = ARM_CP_STATE_BOTH,
3005	.opc0 = 3, .opc1 = 4, .crn = 12, .crm = 8, .opc2 = 2,
3006	.type = ARM_CP_IO \| ARM_CP_NO_RAW,
3007	.nv2_redirect_offset = 0x490,
3008	.access = PL2_RW,
3009	.readfn = ich_ap_read,
3010	.writefn = ich_ap_write,
3011	},
3012	{ .name = "ICH_AP0R3_EL2", .state = ARM_CP_STATE_BOTH,
3013	.opc0 = 3, .opc1 = 4, .crn = 12, .crm = 8, .opc2 = 3,
3014	.type = ARM_CP_IO \| ARM_CP_NO_RAW,
3015	.nv2_redirect_offset = 0x498,
3016	.access = PL2_RW,
3017	.readfn = ich_ap_read,
3018	.writefn = ich_ap_write,
3019	},
3020	{ .name = "ICH_AP1R2_EL2", .state = ARM_CP_STATE_BOTH,
3021	.opc0 = 3, .opc1 = 4, .crn = 12, .crm = 9, .opc2 = 2,
3022	.type = ARM_CP_IO \| ARM_CP_NO_RAW,
3023	.nv2_redirect_offset = 0x4b0,
3024	.access = PL2_RW,
3025	.readfn = ich_ap_read,
3026	.writefn = ich_ap_write,
3027	},
3028	{ .name = "ICH_AP1R3_EL2", .state = ARM_CP_STATE_BOTH,
3029	.opc0 = 3, .opc1 = 4, .crn = 12, .crm = 9, .opc2 = 3,
3030	.type = ARM_CP_IO \| ARM_CP_NO_RAW,
3031	.nv2_redirect_offset = 0x4b8,
3032	.access = PL2_RW,
3033	.readfn = ich_ap_read,
3034	.writefn = ich_ap_write,
3035	},
3036	};
3037
3038	static void gicv3_cpuif_el_change_hook(ARMCPU cpu, void opaque)
3039	{
3040	GICv3CPUState *cs = opaque;
3041
3042	gicv3_cpuif_update(cs);
3043	/*
3044	* Because vLPIs are only pending in NonSecure state,
3045	* an EL change can change the VIRQ/VFIQ status (but
3046	* cannot affect the maintenance interrupt state)
3047	*/
3048	gicv3_cpuif_virt_irq_fiq_update(cs);
3049	}
3050
3051	void gicv3_init_cpuif(GICv3State s, Error *errp)
3052	{
3053	/* Called from the GICv3 realize function; register our system
3054	* registers with the CPU
3055	*/
3056	int i;
3057
3058	for (i = 0; i < s->num_cpu; i++) {
3059	ARMCPU *cpu = ARM_CPU(qemu_get_cpu(s->first_cpu_idx + i));
3060	GICv3CPUState *cs = &s->cpu[i];
3061
3062	if (cpu_isar_feature(aa64_gcie, cpu)) {
3063	/*
3064	* Attempt to connect GICv3 to a CPU with GICv5 cpuif
3065	* (almost certainly a bug in the board code)
3066	*/
3067	error_setg(errp,
3068	"Cannot connect GICv3 to CPU %d which has GICv5 cpuif",
3069	i);
3070	return;
3071	}
3072
3073	/*
3074	* If the CPU doesn't define a GICv3 configuration, probably because
3075	* in real hardware it doesn't have one, then we use default values
3076	* matching the one used by most Arm CPUs. This applies to:
3077	* cpu->gic_num_lrs
3078	* cpu->gic_vpribits
3079	* cpu->gic_vprebits
3080	* cpu->gic_pribits
3081	*/
3082
3083	/* These CP regs callbacks can be called from either TCG or HVF. */
3084	define_arm_cp_regs(cpu, gicv3_cpuif_reginfo);
3085
3086	/*
3087	* If the CPU implements FEAT_NMI and FEAT_GICv3 it must also
3088	* implement FEAT_GICv3_NMI, which is the CPU interface part
3089	* of NMI support. This is distinct from whether the GIC proper
3090	* (redistributors and distributor) have NMI support. In QEMU
3091	* that is a property of the GIC device in s->nmi_support;
3092	* cs->nmi_support indicates the CPU interface's support.
3093	*/
3094	if (cpu_isar_feature(aa64_nmi, cpu)) {
3095	cs->nmi_support = true;
3096	define_arm_cp_regs(cpu, gicv3_cpuif_gicv3_nmi_reginfo);
3097	}
3098
3099	/*
3100	* The CPU implementation specifies the number of supported
3101	* bits of physical priority. For backwards compatibility
3102	* of migration, we have a compat property that forces use
3103	* of 8 priority bits regardless of what the CPU really has.
3104	*/
3105	if (s->force_8bit_prio) {
3106	cs->pribits = 8;
3107	} else {
3108	cs->pribits = cpu->gic_pribits ?: 5;
3109	}
3110
3111	/*
3112	* The GICv3 has separate ID register fields for virtual priority
3113	* and preemption bit values, but only a single ID register field
3114	* for the physical priority bits. The preemption bit count is
3115	* always the same as the priority bit count, except that 8 bits
3116	* of priority means 7 preemption bits. We precalculate the
3117	* preemption bits because it simplifies the code and makes the
3118	* parallels between the virtual and physical bits of the GIC
3119	* a bit clearer.
3120	*/
3121	cs->prebits = cs->pribits;
3122	if (cs->prebits == 8) {
3123	cs->prebits--;
3124	}
3125	/*
3126	* Check that CPU code defining pribits didn't violate
3127	* architectural constraints our implementation relies on.
3128	*/
3129	g_assert(cs->pribits >= 4 && cs->pribits <= 8);
3130
3131	/*
3132	* gicv3_cpuif_reginfo[] defines ICC_AP*R0_EL1; add definitions
3133	* for ICC_AP*R{1,2,3}_EL1 if the prebits value requires them.
3134	*/
3135	if (cs->prebits >= 6) {
3136	define_arm_cp_regs(cpu, gicv3_cpuif_icc_apxr1_reginfo);
3137	}
3138	if (cs->prebits == 7) {
3139	define_arm_cp_regs(cpu, gicv3_cpuif_icc_apxr23_reginfo);
3140	}
3141
3142	if (arm_feature(&cpu->env, ARM_FEATURE_EL2)) {
3143	int j;
3144
3145	cs->num_list_regs = cpu->gic_num_lrs ?: 4;
3146	cs->vpribits = cpu->gic_vpribits ?: 5;
3147	cs->vprebits = cpu->gic_vprebits ?: 5;
3148
3149	/* Check against architectural constraints: getting these
3150	* wrong would be a bug in the CPU code defining these,
3151	* and the implementation relies on them holding.
3152	*/
3153	g_assert(cs->vprebits <= cs->vpribits);
3154	g_assert(cs->vprebits >= 5 && cs->vprebits <= 7);
3155	g_assert(cs->vpribits >= 5 && cs->vpribits <= 8);
3156
3157	define_arm_cp_regs(cpu, gicv3_cpuif_hcr_reginfo);
3158
3159	for (j = 0; j < cs->num_list_regs; j++) {
3160	/* Note that the AArch64 LRs are 64-bit; the AArch32 LRs
3161	* are split into two cp15 regs, LR (the low part, with the
3162	* same encoding as the AArch64 LR) and LRC (the high part).
3163	*/
3164	ARMCPRegInfo lr_regset[] = {
3165	{ .name = "ICH_LRn_EL2", .state = ARM_CP_STATE_BOTH,
3166	.opc0 = 3, .opc1 = 4, .crn = 12,
3167	.crm = 12 + (j >> 3), .opc2 = j & 7,
3168	.type = ARM_CP_IO \| ARM_CP_NO_RAW,
3169	.nv2_redirect_offset = 0x400 + 8 * j,
3170	.access = PL2_RW,
3171	.readfn = ich_lr_read,
3172	.writefn = ich_lr_write,
3173	},
3174	{ .name = "ICH_LRCn_EL2", .state = ARM_CP_STATE_AA32,
3175	.cp = 15, .opc1 = 4, .crn = 12,
3176	.crm = 14 + (j >> 3), .opc2 = j & 7,
3177	.type = ARM_CP_IO \| ARM_CP_NO_RAW,
3178	.access = PL2_RW,
3179	.readfn = ich_lr_read,
3180	.writefn = ich_lr_write,
3181	},
3182	};
3183	define_arm_cp_regs(cpu, lr_regset);
3184	}
3185	if (cs->vprebits >= 6) {
3186	define_arm_cp_regs(cpu, gicv3_cpuif_ich_apxr1_reginfo);
3187	}
3188	if (cs->vprebits == 7) {
3189	define_arm_cp_regs(cpu, gicv3_cpuif_ich_apxr23_reginfo);
3190	}
3191	}
3192	if (tcg_enabled() \|\| qtest_enabled()) {
3193	/*
3194	* We can only trap EL changes with TCG. However the GIC interrupt
3195	* state only changes on EL changes involving EL2 or EL3, so for
3196	* the non-TCG case this is OK, as EL2 and EL3 can't exist.
3197	*/
3198	arm_register_el_change_hook(cpu, gicv3_cpuif_el_change_hook, cs);
3199	} else {
3200	assert(!arm_feature(&cpu->env, ARM_FEATURE_EL2));
3201	assert(!arm_feature(&cpu->env, ARM_FEATURE_EL3));
3202	}
3203	}
3204	}