Enabling and disabling the Distributor and CPU interfaces

This section describes how to enable and disable the Distributor and CPU interfaces, and the differences in behavior in an implementation that supports interrupt grouping. It describes:

• Implementations that support interrupt grouping

• Implementations that do not support interrupt grouping on page 4-79.

Implementations that support interrupt grouping

Interrupt grouping is present in all GICv2 implementations and in GICv1 implementations that include the GIC Security Extensions,

In a GIC that supports interrupt grouping:

• the GICD_CTLR.EnableGrp0 bit controls the forwarding of Group 0 interrupts from the Distributor to the CPU interfaces

4 Programmers’ Model

4.1 About the programmers’ model

• the GICC_CTLR.EnableGrp1 bit controls the signaling of Group 1 interrupts by the CPU interface to the processor.

For the Distributor:

• If the GICD_CTLR.EnableGrp0 and GICD_CTLR.EnableGrp1 bits are both 0: — the Distributor does not forward pending interrupts to the CPU interfaces

— it is IMPLEMENTATIONDEFINED whether an edge-triggered interrupt signal sets the interrupt to the pending state.

— reads of GICC_IAR, GICC_AIAR, GICC_HPPIR, or GICC_AHPPIR return a spurious interrupt ID — software can read or write the Distributor registers

— it is IMPLEMENTATIONDEFINED whether SGIs can be set pending using GICD_SGIR

• If either, but not both, of the GICD_CTLR.EnableGrp0 and GICD_CTLR.EnableGrp1 bits is set to 1, and the highest priority pending interrupt is in the disabled group, the Distributor does not forward any pending interrupts to the CPU interfaces. Although this is IMPLEMENTATIONDEFINED, this applies in the following cases:

— GICD_CTLR.EnableGrp0 set to 0 and GICD_CTLR.EnableGrp1 set to 1, and the highest priority pending interrupt is in group 0

— GICD_CTLR.EnableGrp0 set to 1 and GICD_CTLR.EnableGrp1 set to 0, and the highest priority pending interrupt is in group 1.

In an implementation that includes the GIC Security Extensions, this means that, in cases where there are Group 1 interrupts with a higher priority than some Group 0 interrupts, it is possible for Non-secure software to deny service to Secure software, by clearing the GICD_CTLR.EnableGrp1 bit. To prevent this, ARM strongly recommends that all Group 0 interrupts are assigned a higher priority than all Group 1 interrupts. In addition, to prevent Secure software from denying service to Non-secure software, Secure software must ensure that when GICD_CTLR.EnableGrp1 is set to 1, either GICD_CTLR.EnableGrp0 is also set to 1, or that there are no pending Group 0 interrupts.

See Recommendations for managing priority values on page 3-56 for more information. For a CPU interface, when GICC_CTLR.AckCtl == 0:

• When GICC_CTLR.EnableGrp0 == 0

— Group 0 interrupts forwarded from the Distributor are not signaled to the processor — any read of GICC_IAR returns a spurious interrupt ID

• When GICC_CTLR.EnableGrp0 == 1, Group 0 interrupts forwarded from the Distributor are signaled to the processor.

• When GICC_CTLR.EnableGrp1 == 0

— Group 1 interrupts forwarded from the Distributor are not signaled to the processor — any read of GICC_AIAR returns a spurious interrupt ID

• When GICC_CTLR.EnableGrp1 == 1, Group 1 interrupts forwarded from the Distributor are signaled to the processor

• if either GICC_CTLR.EnableGrp0 or GICC_CTLR.EnableGrp1 is set to 0, and there is a pending interrupt of sufficient priority in the disabled group, it is IMPLEMENTATIONDEFINED whether a read of GICC_HPPIR returns the ID of that interrupt, or a spurious interrupt ID.

For a CPU interface, when GICC_CTLR.AckCtl == 1:

• When GICC_CTLR.EnableGrp1 == 0, any Non-secure read of GICC_IAR returns a spurious interrupt ID • When GICC_CTLR.EnableGrp0 == 0:

4 Programmers’ Model 4.1 About the programmers’ model

— if GICC_CTLR.EnableGrp1 == 1, Group 0 interrupts are ignored and GICC_IAR behaves as GICC_AIAR

• When GICC_CTLR.EnableGrp1 == 0, a Secure read of GICC_AIAR always returns a spurious interrupt ID • if either GICC_CTLR.EnableGrp0 or GICC_CTLR.EnableGrp1 is set to 0, and there is a pending interrupt of sufficient priority in the disabled group, it is IMPLEMENTATIONDEFINED whether a read of GICC_HPPIR returns the ID of that interrupt, or a spurious interrupt ID.

Note

ARM deprecates use of GICC_CTLR.AckCtl, and strongly recommends using a software model where GICC_CTLR.AckCtl is set to 0.

Implementations that do not support interrupt grouping Note

The only implementations that do not support interrupt grouping are GICv1 implementations that do not include the GIC Security Extensions.

In a GIC that does not support interrupt grouping:

• the GICD_CTLR.Enable bit controls the forwarding of interrupts from the Distributor to the CPU interfaces • the GICC_CTLR.Enable bit controls the signaling of interrupts by the CPU interface to the connected

processor. For the Distributor:

• When GICD_CTLR.Enable is set to 1, the Distributor forwards the highest priority pending interrupt for each CPU interface, subject to the prioritization rules.

• When GICD_CTLR.Enable is set to 0:

— the Distributor does not forward pending interrupts to the CPU interfaces

— it is IMPLEMENTATIONDEFINED whether an edge-triggered interrupt signal sets the interrupt to the pending state.

— reads of GICC_IAR, GICC_AIAR, GICC_HPPIR, or GICC_AHPPIR return a spurious interrupt ID — software can read or write the Distributor registers

— it is IMPLEMENTATIONDEFINED whether SGIs can be set pending using GICD_SGIR. For a CPU interface:

• When GICC_CTLR.Enable is set to 1, the highest priority pending interrupt forwarded from the Distributor to the CPU interface is signaled to the connected processor

• When GICC_CTLR.Enable is set to 0:

— any pending interrupts forwarded from the Distributor are not signaled to the processor — software can read or write the CPU interface registers

— any read of the GICC_IAR returns a spurious interrupt ID

— if the Distributor is forwarding an interrupt to the CPU interface, that the interface cannot signal because GICC_CTLR.Enable is set to 0, it is IMPLEMENTATIONDEFINED whether a read of

GICC_HPPIR returns the ID of that interrupt, or a spurious interrupt ID.

Note

The EnableGrp1 bit in the Non-secure copies of the GICD_CTLR and GICC_CTLR registers are cleared to 0 on reset. This means that software can program the Distributor and CPU interface registers before enabling the GIC.

4 Programmers’ Model

4.2 Effect of the GIC Security Extensions on the programmers’ model

4.2

Effect of the GIC Security Extensions on the programmers’ model

Note

For an overview of the GIC Security Extensions, see Security Extensions support on page 1-16.

If the GIC implements the Security Extensions, the GICD_TYPER.SecurityExtn bit is RAO. The GIC Security Extensions provide the following features:

• The GIC must support interrupt grouping, and:

— the GIC might implement some interrupts as always Group 0, or as always Group 1 — otherwise, software configures each interrupt as Group 0 or Group 1

— some aspects of interrupt handling depend on whether interrupts are Group 0 or Group 1.

• Register implementations that are consistent with those on a processor that implements the ARM Security Extensions, with banked, Common, and Secure registers, as described in this section. The GIC Security Extensions recognise that register accesses are either Secure or Non-secure, see Processor security state and Secure and Non-secure GIC accesses on page 1-20, and that the security level of the access can determine the required response.

Note

• In a GICv1 implementation, interrupt grouping is a feature of the GIC Security Extensions. All GICv2 implementations include support for interrupt grouping, regardless of whether they include the GIC Security Extensions.

• When a processor that implements the ARM Security Extensions is connected to the GIC, Secure software executing on the processor usually accesses the GIC using only Secure accesses.

The ARM Architecture Reference Manual, ARMv7-A and ARMv7-R edition defines the following ARM Security Extensions register types:

Banked The device implements Secure and Non-secure copies of the register. The register bit assignments can differ in the Secure and Non-secure copies of a register. A Secure access always accesses the Secure copy of the register, and a Non-secure access always accesses the Non-secure copy.

Note

The GIC can also bank registers when implemented as part of a multiprocessor system, where registers associated with PPIs or SGIs are banked to provide a separate copy for each connected processor.

Secure The register is accessible only from a Secure access. The address of a Secure register is RAZ/WI to any Non-secure access.

Common The register is accessible from both Secure and Non-secure accesses. The access permissions of some or all fields in the register might depend on whether the access is Secure or Non-secure. In addition, in a GIC that implements the GIC Security Extensions, the priority range available for Group 1 interrupts is half the range available for Group 0 interrupts, see Interrupt grouping and interrupt prioritization on

page 3-53.

Table 4-3 shows the registers that are implemented differently as part of the GIC Security Extensions. All registers not listed in Table 4-3 are Common registers.

Table 4-3 Registers implemented differently when the GIC includes the GIC Security Extensions

Register Type Description Effect

GICD_CTLR Banked Distributor Control Register Register is bankeda

4 Programmers’ Model 4.2 Effect of the GIC Security Extensions on the programmers’ model

The following sections give more information about the effect of the GIC Security Extensions on the GIC programmers’ model:

• Non-secure access to register fields for Group 0 interrupt priorities

• Configuration lockdown on page 4-82.