2 * ARM GICv3 support - common bits of emulated and KVM kernel model
4 * Copyright (c) 2012 Linaro Limited
5 * Copyright (c) 2015 Huawei.
6 * Copyright (c) 2015 Samsung Electronics Co., Ltd.
7 * Written by Peter Maydell
8 * Reworked for GICv3 by Shlomo Pongratz and Pavel Fedin
10 * This program is free software; you can redistribute it and/or modify
11 * it under the terms of the GNU General Public License as published by
12 * the Free Software Foundation, either version 2 of the License, or
13 * (at your option) any later version.
15 * This program is distributed in the hope that it will be useful,
16 * but WITHOUT ANY WARRANTY; without even the implied warranty of
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 * GNU General Public License for more details.
20 * You should have received a copy of the GNU General Public License along
21 * with this program; if not, see <http://www.gnu.org/licenses/>.
24 #include "qemu/osdep.h"
25 #include "qapi/error.h"
26 #include "qemu/module.h"
28 #include "hw/intc/arm_gicv3_common.h"
29 #include "gicv3_internal.h"
30 #include "hw/arm/linux-boot-if.h"
31 #include "sysemu/kvm.h"
34 static void gicv3_gicd_no_migration_shift_bug_post_load(GICv3State
*cs
)
36 if (cs
->gicd_no_migration_shift_bug
) {
40 /* Older versions of QEMU had a bug in the handling of state save/restore
41 * to the KVM GICv3: they got the offset in the bitmap arrays wrong,
42 * so that instead of the data for external interrupts 32 and up
43 * starting at bit position 32 in the bitmap, it started at bit
44 * position 64. If we're receiving data from a QEMU with that bug,
45 * we must move the data down into the right place.
47 memmove(cs
->group
, (uint8_t *)cs
->group
+ GIC_INTERNAL
/ 8,
48 sizeof(cs
->group
) - GIC_INTERNAL
/ 8);
49 memmove(cs
->grpmod
, (uint8_t *)cs
->grpmod
+ GIC_INTERNAL
/ 8,
50 sizeof(cs
->grpmod
) - GIC_INTERNAL
/ 8);
51 memmove(cs
->enabled
, (uint8_t *)cs
->enabled
+ GIC_INTERNAL
/ 8,
52 sizeof(cs
->enabled
) - GIC_INTERNAL
/ 8);
53 memmove(cs
->pending
, (uint8_t *)cs
->pending
+ GIC_INTERNAL
/ 8,
54 sizeof(cs
->pending
) - GIC_INTERNAL
/ 8);
55 memmove(cs
->active
, (uint8_t *)cs
->active
+ GIC_INTERNAL
/ 8,
56 sizeof(cs
->active
) - GIC_INTERNAL
/ 8);
57 memmove(cs
->edge_trigger
, (uint8_t *)cs
->edge_trigger
+ GIC_INTERNAL
/ 8,
58 sizeof(cs
->edge_trigger
) - GIC_INTERNAL
/ 8);
61 * While this new version QEMU doesn't have this kind of bug as we fix it,
62 * so it needs to set the flag to true to indicate that and it's necessary
63 * for next migration to work from this new version QEMU.
65 cs
->gicd_no_migration_shift_bug
= true;
68 static int gicv3_pre_save(void *opaque
)
70 GICv3State
*s
= (GICv3State
*)opaque
;
71 ARMGICv3CommonClass
*c
= ARM_GICV3_COMMON_GET_CLASS(s
);
80 static int gicv3_post_load(void *opaque
, int version_id
)
82 GICv3State
*s
= (GICv3State
*)opaque
;
83 ARMGICv3CommonClass
*c
= ARM_GICV3_COMMON_GET_CLASS(s
);
85 gicv3_gicd_no_migration_shift_bug_post_load(s
);
93 static bool virt_state_needed(void *opaque
)
95 GICv3CPUState
*cs
= opaque
;
97 return cs
->num_list_regs
!= 0;
100 static const VMStateDescription vmstate_gicv3_cpu_virt
= {
101 .name
= "arm_gicv3_cpu/virt",
103 .minimum_version_id
= 1,
104 .needed
= virt_state_needed
,
105 .fields
= (VMStateField
[]) {
106 VMSTATE_UINT64_2DARRAY(ich_apr
, GICv3CPUState
, 3, 4),
107 VMSTATE_UINT64(ich_hcr_el2
, GICv3CPUState
),
108 VMSTATE_UINT64_ARRAY(ich_lr_el2
, GICv3CPUState
, GICV3_LR_MAX
),
109 VMSTATE_UINT64(ich_vmcr_el2
, GICv3CPUState
),
110 VMSTATE_END_OF_LIST()
114 static int vmstate_gicv3_cpu_pre_load(void *opaque
)
116 GICv3CPUState
*cs
= opaque
;
119 * If the sre_el1 subsection is not transferred this
120 * means SRE_EL1 is 0x7 (which might not be the same as
123 cs
->icc_sre_el1
= 0x7;
127 static bool icc_sre_el1_reg_needed(void *opaque
)
129 GICv3CPUState
*cs
= opaque
;
131 return cs
->icc_sre_el1
!= 7;
134 const VMStateDescription vmstate_gicv3_cpu_sre_el1
= {
135 .name
= "arm_gicv3_cpu/sre_el1",
137 .minimum_version_id
= 1,
138 .needed
= icc_sre_el1_reg_needed
,
139 .fields
= (VMStateField
[]) {
140 VMSTATE_UINT64(icc_sre_el1
, GICv3CPUState
),
141 VMSTATE_END_OF_LIST()
145 static const VMStateDescription vmstate_gicv3_cpu
= {
146 .name
= "arm_gicv3_cpu",
148 .minimum_version_id
= 1,
149 .pre_load
= vmstate_gicv3_cpu_pre_load
,
150 .fields
= (VMStateField
[]) {
151 VMSTATE_UINT32(level
, GICv3CPUState
),
152 VMSTATE_UINT32(gicr_ctlr
, GICv3CPUState
),
153 VMSTATE_UINT32_ARRAY(gicr_statusr
, GICv3CPUState
, 2),
154 VMSTATE_UINT32(gicr_waker
, GICv3CPUState
),
155 VMSTATE_UINT64(gicr_propbaser
, GICv3CPUState
),
156 VMSTATE_UINT64(gicr_pendbaser
, GICv3CPUState
),
157 VMSTATE_UINT32(gicr_igroupr0
, GICv3CPUState
),
158 VMSTATE_UINT32(gicr_ienabler0
, GICv3CPUState
),
159 VMSTATE_UINT32(gicr_ipendr0
, GICv3CPUState
),
160 VMSTATE_UINT32(gicr_iactiver0
, GICv3CPUState
),
161 VMSTATE_UINT32(edge_trigger
, GICv3CPUState
),
162 VMSTATE_UINT32(gicr_igrpmodr0
, GICv3CPUState
),
163 VMSTATE_UINT32(gicr_nsacr
, GICv3CPUState
),
164 VMSTATE_UINT8_ARRAY(gicr_ipriorityr
, GICv3CPUState
, GIC_INTERNAL
),
165 VMSTATE_UINT64_ARRAY(icc_ctlr_el1
, GICv3CPUState
, 2),
166 VMSTATE_UINT64(icc_pmr_el1
, GICv3CPUState
),
167 VMSTATE_UINT64_ARRAY(icc_bpr
, GICv3CPUState
, 3),
168 VMSTATE_UINT64_2DARRAY(icc_apr
, GICv3CPUState
, 3, 4),
169 VMSTATE_UINT64_ARRAY(icc_igrpen
, GICv3CPUState
, 3),
170 VMSTATE_UINT64(icc_ctlr_el3
, GICv3CPUState
),
171 VMSTATE_END_OF_LIST()
173 .subsections
= (const VMStateDescription
* []) {
174 &vmstate_gicv3_cpu_virt
,
175 &vmstate_gicv3_cpu_sre_el1
,
180 static int gicv3_pre_load(void *opaque
)
182 GICv3State
*cs
= opaque
;
185 * The gicd_no_migration_shift_bug flag is used for migration compatibility
186 * for old version QEMU which may have the GICD bmp shift bug under KVM mode.
187 * Strictly, what we want to know is whether the migration source is using
188 * KVM. Since we don't have any way to determine that, we look at whether the
189 * destination is using KVM; this is close enough because for the older QEMU
190 * versions with this bug KVM -> TCG migration didn't work anyway. If the
191 * source is a newer QEMU without this bug it will transmit the migration
192 * subsection which sets the flag to true; otherwise it will remain set to
193 * the value we select here.
196 cs
->gicd_no_migration_shift_bug
= false;
202 static bool needed_always(void *opaque
)
207 const VMStateDescription vmstate_gicv3_gicd_no_migration_shift_bug
= {
208 .name
= "arm_gicv3/gicd_no_migration_shift_bug",
210 .minimum_version_id
= 1,
211 .needed
= needed_always
,
212 .fields
= (VMStateField
[]) {
213 VMSTATE_BOOL(gicd_no_migration_shift_bug
, GICv3State
),
214 VMSTATE_END_OF_LIST()
218 static const VMStateDescription vmstate_gicv3
= {
221 .minimum_version_id
= 1,
222 .pre_load
= gicv3_pre_load
,
223 .pre_save
= gicv3_pre_save
,
224 .post_load
= gicv3_post_load
,
225 .priority
= MIG_PRI_GICV3
,
226 .fields
= (VMStateField
[]) {
227 VMSTATE_UINT32(gicd_ctlr
, GICv3State
),
228 VMSTATE_UINT32_ARRAY(gicd_statusr
, GICv3State
, 2),
229 VMSTATE_UINT32_ARRAY(group
, GICv3State
, GICV3_BMP_SIZE
),
230 VMSTATE_UINT32_ARRAY(grpmod
, GICv3State
, GICV3_BMP_SIZE
),
231 VMSTATE_UINT32_ARRAY(enabled
, GICv3State
, GICV3_BMP_SIZE
),
232 VMSTATE_UINT32_ARRAY(pending
, GICv3State
, GICV3_BMP_SIZE
),
233 VMSTATE_UINT32_ARRAY(active
, GICv3State
, GICV3_BMP_SIZE
),
234 VMSTATE_UINT32_ARRAY(level
, GICv3State
, GICV3_BMP_SIZE
),
235 VMSTATE_UINT32_ARRAY(edge_trigger
, GICv3State
, GICV3_BMP_SIZE
),
236 VMSTATE_UINT8_ARRAY(gicd_ipriority
, GICv3State
, GICV3_MAXIRQ
),
237 VMSTATE_UINT64_ARRAY(gicd_irouter
, GICv3State
, GICV3_MAXIRQ
),
238 VMSTATE_UINT32_ARRAY(gicd_nsacr
, GICv3State
,
239 DIV_ROUND_UP(GICV3_MAXIRQ
, 16)),
240 VMSTATE_STRUCT_VARRAY_POINTER_UINT32(cpu
, GICv3State
, num_cpu
,
241 vmstate_gicv3_cpu
, GICv3CPUState
),
242 VMSTATE_END_OF_LIST()
244 .subsections
= (const VMStateDescription
* []) {
245 &vmstate_gicv3_gicd_no_migration_shift_bug
,
250 void gicv3_init_irqs_and_mmio(GICv3State
*s
, qemu_irq_handler handler
,
251 const MemoryRegionOps
*ops
, Error
**errp
)
253 SysBusDevice
*sbd
= SYS_BUS_DEVICE(s
);
254 int rdist_capacity
= 0;
257 for (i
= 0; i
< s
->nb_redist_regions
; i
++) {
258 rdist_capacity
+= s
->redist_region_count
[i
];
260 if (rdist_capacity
< s
->num_cpu
) {
261 error_setg(errp
, "Capacity of the redist regions(%d) "
262 "is less than number of vcpus(%d)",
263 rdist_capacity
, s
->num_cpu
);
267 /* For the GIC, also expose incoming GPIO lines for PPIs for each CPU.
268 * GPIO array layout is thus:
270 * [N..N+31] PPIs for CPU 0
271 * [N+32..N+63] PPIs for CPU 1
274 i
= s
->num_irq
- GIC_INTERNAL
+ GIC_INTERNAL
* s
->num_cpu
;
275 qdev_init_gpio_in(DEVICE(s
), handler
, i
);
277 for (i
= 0; i
< s
->num_cpu
; i
++) {
278 sysbus_init_irq(sbd
, &s
->cpu
[i
].parent_irq
);
280 for (i
= 0; i
< s
->num_cpu
; i
++) {
281 sysbus_init_irq(sbd
, &s
->cpu
[i
].parent_fiq
);
283 for (i
= 0; i
< s
->num_cpu
; i
++) {
284 sysbus_init_irq(sbd
, &s
->cpu
[i
].parent_virq
);
286 for (i
= 0; i
< s
->num_cpu
; i
++) {
287 sysbus_init_irq(sbd
, &s
->cpu
[i
].parent_vfiq
);
290 memory_region_init_io(&s
->iomem_dist
, OBJECT(s
), ops
, s
,
291 "gicv3_dist", 0x10000);
292 sysbus_init_mmio(sbd
, &s
->iomem_dist
);
294 s
->iomem_redist
= g_new0(MemoryRegion
, s
->nb_redist_regions
);
295 for (i
= 0; i
< s
->nb_redist_regions
; i
++) {
296 char *name
= g_strdup_printf("gicv3_redist_region[%d]", i
);
298 memory_region_init_io(&s
->iomem_redist
[i
], OBJECT(s
),
299 ops
? &ops
[1] : NULL
, s
, name
,
300 s
->redist_region_count
[i
] * GICV3_REDIST_SIZE
);
301 sysbus_init_mmio(sbd
, &s
->iomem_redist
[i
]);
306 static void arm_gicv3_common_realize(DeviceState
*dev
, Error
**errp
)
308 GICv3State
*s
= ARM_GICV3_COMMON(dev
);
311 /* revision property is actually reserved and currently used only in order
312 * to keep the interface compatible with GICv2 code, avoiding extra
313 * conditions. However, in future it could be used, for example, if we
316 if (s
->revision
!= 3) {
317 error_setg(errp
, "unsupported GIC revision %d", s
->revision
);
321 if (s
->num_irq
> GICV3_MAXIRQ
) {
323 "requested %u interrupt lines exceeds GIC maximum %d",
324 s
->num_irq
, GICV3_MAXIRQ
);
327 if (s
->num_irq
< GIC_INTERNAL
) {
329 "requested %u interrupt lines is below GIC minimum %d",
330 s
->num_irq
, GIC_INTERNAL
);
334 /* ITLinesNumber is represented as (N / 32) - 1, so this is an
335 * implementation imposed restriction, not an architectural one,
336 * so we don't have to deal with bitfields where only some of the
337 * bits in a 32-bit word should be valid.
339 if (s
->num_irq
% 32) {
341 "%d interrupt lines unsupported: not divisible by 32",
346 s
->cpu
= g_new0(GICv3CPUState
, s
->num_cpu
);
348 for (i
= 0; i
< s
->num_cpu
; i
++) {
349 CPUState
*cpu
= qemu_get_cpu(i
);
355 /* Store GICv3CPUState in CPUARMState gicv3state pointer */
356 gicv3_set_gicv3state(cpu
, &s
->cpu
[i
]);
358 /* Pre-construct the GICR_TYPER:
359 * For our implementation:
360 * Top 32 bits are the affinity value of the associated CPU
361 * CommonLPIAff == 01 (redistributors with same Aff3 share LPI table)
362 * Processor_Number == CPU index starting from 0
363 * DPGS == 0 (GICR_CTLR.DPG* not supported)
364 * Last == 1 if this is the last redistributor in a series of
365 * contiguous redistributor pages
366 * DirectLPI == 0 (direct injection of LPIs not supported)
367 * VLPIS == 0 (virtual LPIs not supported)
368 * PLPIS == 0 (physical LPIs not supported)
370 cpu_affid
= object_property_get_uint(OBJECT(cpu
), "mp-affinity", NULL
);
371 last
= (i
== s
->num_cpu
- 1);
373 /* The CPU mp-affinity property is in MPIDR register format; squash
374 * the affinity bytes into 32 bits as the GICR_TYPER has them.
376 cpu_affid
= ((cpu_affid
& 0xFF00000000ULL
) >> 8) |
377 (cpu_affid
& 0xFFFFFF);
378 s
->cpu
[i
].gicr_typer
= (cpu_affid
<< 32) |
385 static void arm_gicv3_finalize(Object
*obj
)
387 GICv3State
*s
= ARM_GICV3_COMMON(obj
);
389 g_free(s
->redist_region_count
);
392 static void arm_gicv3_common_reset(DeviceState
*dev
)
394 GICv3State
*s
= ARM_GICV3_COMMON(dev
);
397 for (i
= 0; i
< s
->num_cpu
; i
++) {
398 GICv3CPUState
*cs
= &s
->cpu
[i
];
402 cs
->gicr_statusr
[GICV3_S
] = 0;
403 cs
->gicr_statusr
[GICV3_NS
] = 0;
404 cs
->gicr_waker
= GICR_WAKER_ProcessorSleep
| GICR_WAKER_ChildrenAsleep
;
405 cs
->gicr_propbaser
= 0;
406 cs
->gicr_pendbaser
= 0;
407 /* If we're resetting a TZ-aware GIC as if secure firmware
408 * had set it up ready to start a kernel in non-secure, we
409 * need to set interrupts to group 1 so the kernel can use them.
410 * Otherwise they reset to group 0 like the hardware.
412 if (s
->irq_reset_nonsecure
) {
413 cs
->gicr_igroupr0
= 0xffffffff;
415 cs
->gicr_igroupr0
= 0;
418 cs
->gicr_ienabler0
= 0;
419 cs
->gicr_ipendr0
= 0;
420 cs
->gicr_iactiver0
= 0;
421 cs
->edge_trigger
= 0xffff;
422 cs
->gicr_igrpmodr0
= 0;
424 memset(cs
->gicr_ipriorityr
, 0, sizeof(cs
->gicr_ipriorityr
));
426 cs
->hppi
.prio
= 0xff;
428 /* State in the CPU interface must *not* be reset here, because it
429 * is part of the CPU's reset domain, not the GIC device's.
433 /* For our implementation affinity routing is always enabled */
434 if (s
->security_extn
) {
435 s
->gicd_ctlr
= GICD_CTLR_ARE_S
| GICD_CTLR_ARE_NS
;
437 s
->gicd_ctlr
= GICD_CTLR_DS
| GICD_CTLR_ARE
;
440 s
->gicd_statusr
[GICV3_S
] = 0;
441 s
->gicd_statusr
[GICV3_NS
] = 0;
443 memset(s
->group
, 0, sizeof(s
->group
));
444 memset(s
->grpmod
, 0, sizeof(s
->grpmod
));
445 memset(s
->enabled
, 0, sizeof(s
->enabled
));
446 memset(s
->pending
, 0, sizeof(s
->pending
));
447 memset(s
->active
, 0, sizeof(s
->active
));
448 memset(s
->level
, 0, sizeof(s
->level
));
449 memset(s
->edge_trigger
, 0, sizeof(s
->edge_trigger
));
450 memset(s
->gicd_ipriority
, 0, sizeof(s
->gicd_ipriority
));
451 memset(s
->gicd_irouter
, 0, sizeof(s
->gicd_irouter
));
452 memset(s
->gicd_nsacr
, 0, sizeof(s
->gicd_nsacr
));
453 /* GICD_IROUTER are UNKNOWN at reset so in theory the guest must
454 * write these to get sane behaviour and we need not populate the
455 * pointer cache here; however having the cache be different for
456 * "happened to be 0 from reset" and "guest wrote 0" would be
459 gicv3_cache_all_target_cpustates(s
);
461 if (s
->irq_reset_nonsecure
) {
462 /* If we're resetting a TZ-aware GIC as if secure firmware
463 * had set it up ready to start a kernel in non-secure, we
464 * need to set interrupts to group 1 so the kernel can use them.
465 * Otherwise they reset to group 0 like the hardware.
467 for (i
= GIC_INTERNAL
; i
< s
->num_irq
; i
++) {
468 gicv3_gicd_group_set(s
, i
);
471 s
->gicd_no_migration_shift_bug
= true;
474 static void arm_gic_common_linux_init(ARMLinuxBootIf
*obj
,
477 GICv3State
*s
= ARM_GICV3_COMMON(obj
);
479 if (s
->security_extn
&& !secure_boot
) {
480 /* We're directly booting a kernel into NonSecure. If this GIC
481 * implements the security extensions then we must configure it
482 * to have all the interrupts be NonSecure (this is a job that
483 * is done by the Secure boot firmware in real hardware, and in
484 * this mode QEMU is acting as a minimalist firmware-and-bootloader
487 s
->irq_reset_nonsecure
= true;
491 static Property arm_gicv3_common_properties
[] = {
492 DEFINE_PROP_UINT32("num-cpu", GICv3State
, num_cpu
, 1),
493 DEFINE_PROP_UINT32("num-irq", GICv3State
, num_irq
, 32),
494 DEFINE_PROP_UINT32("revision", GICv3State
, revision
, 3),
495 DEFINE_PROP_BOOL("has-security-extensions", GICv3State
, security_extn
, 0),
496 DEFINE_PROP_ARRAY("redist-region-count", GICv3State
, nb_redist_regions
,
497 redist_region_count
, qdev_prop_uint32
, uint32_t),
498 DEFINE_PROP_END_OF_LIST(),
501 static void arm_gicv3_common_class_init(ObjectClass
*klass
, void *data
)
503 DeviceClass
*dc
= DEVICE_CLASS(klass
);
504 ARMLinuxBootIfClass
*albifc
= ARM_LINUX_BOOT_IF_CLASS(klass
);
506 dc
->reset
= arm_gicv3_common_reset
;
507 dc
->realize
= arm_gicv3_common_realize
;
508 dc
->props
= arm_gicv3_common_properties
;
509 dc
->vmsd
= &vmstate_gicv3
;
510 albifc
->arm_linux_init
= arm_gic_common_linux_init
;
513 static const TypeInfo arm_gicv3_common_type
= {
514 .name
= TYPE_ARM_GICV3_COMMON
,
515 .parent
= TYPE_SYS_BUS_DEVICE
,
516 .instance_size
= sizeof(GICv3State
),
517 .class_size
= sizeof(ARMGICv3CommonClass
),
518 .class_init
= arm_gicv3_common_class_init
,
519 .instance_finalize
= arm_gicv3_finalize
,
521 .interfaces
= (InterfaceInfo
[]) {
522 { TYPE_ARM_LINUX_BOOT_IF
},
527 static void register_types(void)
529 type_register_static(&arm_gicv3_common_type
);
532 type_init(register_types
)