GIC — the Generic Interrupt Controller

• Cortex-M has NVIC integrated in the core — simple, deterministic, phone/MCU-sized.
• Cortex-A needs to route interrupts across:
  • Many cores (1-128+)
  • Multiple Exception Levels (EL0-EL3)
  • Two security states (Secure / Non-secure)
  • Virtualized guests (vGIC)
• Scale + complexity = a dedicated architectural interrupt controller IP, the GIC.
• Every A-profile OS (Linux, XNU, Windows) drives the GIC via a standard memory-mapped + system-register interface. Kernel has one GIC driver, not one per silicon vendor.

• Distributor — global state for SPIs; enable/priority/target routing tables.
• Redistributors — one per CPU; hold PPI + SGI + LPI state for that CPU.
• CPU interface — in GICv3, accessed via system registers (ICC_IAR1_EL1, ICC_EOIR1_EL1, ICC_PMR_EL1), not MMIO. Much faster.
• Affinity routing — each core has a 32-bit Aff3.Aff2.Aff1.Aff0; interrupts are routed to targets by affinity tuple.

1. UART raises its level interrupt line → Distributor.
2. Distributor marks the SPI Pending; consults target routing (GICD_IROUTER<n>) to pick a CPU affinity.
3. Distributor forwards to target CPU's redistributor.
4. Redistributor raises CPU's IRQ (or FIQ) line.
5. CPU enters exception at lower-EL synchronous IRQ vector of EL1 (or EL2 / EL3 depending on routing).
6. Handler reads ICC_IAR1_EL1 → gets INTID and acknowledges.
7. Handler services device, clears device IRQ.
8. Handler writes ICC_EOIR1_EL1 → GIC moves INT from Active to Inactive.

// Linux arm64 IRQ entry (simplified)

el1_irq:
  kernel_entry 1, irq
  irq_handler_entry 1

  // inside handler -> GIC driver
  mrs  x0, icc_iar1_el1          // ack interrupt
  // lower 24 bits = INTID
  ubfx x1, x0, #0, #24

  bl   generic_handle_irq_by_intid

  msr  icc_eoir1_el1, x0          // end-of-interrupt

  kernel_exit 1

• GIC supports up to 256 priority values (8 bits); many implementations expose 5-8 bits.
• Each INTID has a priority register (GICD_IPRIORITYR<n> for SPI, GICR_IPRIORITYR<n> for PPI/SGI).
• The Priority Mask Register (ICC_PMR_EL1) blocks interrupts below a given priority at the CPU interface.
• The Binary Point Register (ICC_BPR1_EL1) splits the priority field into group vs sub-priority — only group differences preempt.
• Interrupts with higher priority (lower numeric value) preempt running lower-priority handlers — similar to Cortex-M NVIC but at much larger scale.

• Problem: PCIe MSI/MSI-X devices write to a memory address to signal an interrupt. The CPU needs to turn that write into an LPI pointed at a specific core.
• GICv3 introduced the ITS to do exactly this, in hardware.
• PCIe device writes to ITS's GITS_TRANSLATER register, supplying an EventID.
• ITS looks up DeviceID (from AXI Requester ID) + EventID in its tables → produces (LPI ID, target CPU).
• ITS injects LPI into the target redistributor → CPU IRQ.
• Tables are in DRAM, programmed by firmware/OS: Device Table, Collection Table, Interrupt Translation Table.

// ITS lookup (simplified)

PCIe MSI write: DeviceID + EventID
   |
   v
ITS Device Table[DeviceID]
   -> pointer to this device's ITT
   |
   v
ITS Interrupt Translation Table[EventID]
   -> { LPI ID, Collection ID }
   |
   v
ITS Collection Table[Collection ID]
   -> target Redistributor (CPU)
   |
   v
Redistributor raises LPI->CPU

ITS commands (MAPD, MAPI, MAPC, SYNC, INV) are issued via a DRAM-resident command queue. Linux GIC-ITS driver sends these to set up a device's MSI routing.

• A guest at EL1 believes it has its own GIC. The hypervisor at EL2 arranges this via the vGIC:
  • Guest accesses to ICC_*_EL1 registers are trapped (HCR_EL2 settings) and remapped to virtual state
  • Guest IRQ delivery uses a virtual CPU interface (ICH_*_EL2 registers)
  • Up to 16 list registers (ICH_LR<n>_EL2) hold guest-pending interrupts
• GICv2 had rudimentary vGIC (optional); GICv3 made it mandatory.
• GICv4 adds direct injection of vLPIs — the ITS can target a guest's redistributor directly, no hypervisor trap. Huge for I/O-heavy VMs.
• GICv4.1 adds direct injection of vSGIs — guest-to-guest IPIs also skip the hypervisor.

• Every CPU has a PPI-timer interrupt (PPI 30 — CNTP physical EL1 timer; PPI 27 for EL1 virtual; PPI 26 for EL2 timer).
• These are delivered per core via the redistributor — no cross-CPU traffic.
• Timers + CPU idle states coordinate via PSCI: OS tells TF-A/EL3 to put a core to sleep; GIC retains interrupt pending state so the core wakes on IRQ.
• The GIC wake-up interface — redistributor can be quiesced to save power but must remain responsive to incoming interrupts that will wake the core.
• GIC itself has multiple power domains — on GIC-600/700 the distributor and redistributors can be power-managed independently.

• Each INTID has a Group (G0/G1) and a Non-secure bit.
• Routing per Group:
  • Group 0 (Secure, unbanked) → FIQ to Secure EL1/EL3
  • Group 1 Non-secure → IRQ to Non-secure EL1/EL2
  • Group 1 Secure → FIQ to Secure EL1 (via SCR_EL3 routing)
• Banked registers: secure and non-secure worlds each see their own view of most GIC registers. Secure state can see all; non-secure is limited.
• TF-A / secure monitor at EL3 configures GIC security before handing off to Non-secure.

• ACPI path: UEFI-booted servers describe GIC topology in the MADT table (distributor base, redistributor bases, ITS bases).
• Device-tree path: phones + embedded use DT nodes like:
  • compatible = "arm,gic-v3"
  • #interrupt-cells = <3> (type + ID + flags)
• Linux driver: drivers/irqchip/irq-gic-v3.c — ~3000 LoC, implements everything from IRQ allocation to GICv4 direct injection.
• IRQ domain abstraction isolates the driver from per-SoC board code.
• Every interrupt in /proc/interrupts on a Cortex-A Linux box comes from this driver (SPI/PPI/SGI/LPI hierarchical).

// Device-tree GIC-700 excerpt (simplified)
gic: interrupt-controller@40000000 {
  compatible = "arm,gic-v3";
  #interrupt-cells = <3>;
  interrupt-controller;
  ranges;

  reg = <0x4000_0000 0x10000>,     // GICD
        <0x4010_0000 0x200000>;    // GICR ×128

  msi-controller;
  #msi-cells = <1>;

  its: msi-controller@4200000 {
    compatible = "arm,gic-v3-its";
    msi-controller;
    reg = <0x4200_0000 0x20000>;
  };
};

// Device referencing SPI 42 rising-edge:
uart@...  { interrupts = <GIC_SPI 42 IRQ_TYPE_EDGE_RISING>; };

• /proc/interrupts — which IRQs are firing and on which CPUs.
• /sys/kernel/debug/irq/irqs/<irq> — affinity, edge/level, trigger counts.
• dmesg | grep GIC — probe messages, redistributor + ITS bring-up.
• perf counters for irq_handler_entry + irq_handler_exit — latency histograms.
• Common failure modes:
  • "Interrupt stuck" — usually EOI not issued
  • "Lost wakeup" — priority mask wrong in idle
  • "CPU never takes IRQ" — affinity masks wrong
  • "Guest hangs" — vGIC list-register exhaustion

• "Why two halves — Distributor + Redistributors?" → Distributor holds SPI state (global); redistributors hold per-core PPI/SGI/LPI state (private). Scales to thousands of cores because per-core state is distributed, not central.
• "What is an LPI and why do we need ITS?" → LPI = Locality-specific Peripheral Interrupt, used for PCIe MSI/MSI-X. ITS translates (DeviceID, EventID) → LPI + target CPU, avoiding the SPI namespace (which is too small for 1000s of PCIe functions).
• "What does GICv4 add?" → direct injection of vLPIs — ITS delivers guest interrupts to guest redistributors without hypervisor trap. GICv4.1 adds vSGI direct injection.

• "Difference between ICC_IAR1_EL1 and ICC_EOIR1_EL1?" → IAR = Interrupt Acknowledge Register, reads the next pending INTID (moves it Pending → Active). EOIR = End-of-Interrupt, writes back to mark Active → Inactive.
• "Why Group 0 vs Group 1?" → Group 0 is Secure-side (FIQ to EL3), Group 1 is Non-secure + Secure-EL1 variants. Separates TrustZone OS interrupts from Linux.
• "Why GICv3 for servers but GIC-400 for old phones?" → GIC-400 (GICv2) tops out at 8 cores and no LPIs — insufficient for server MSI loads. Every modern A-profile system uses GICv3+.