1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * Copyright 2012 Michael Ellerman, IBM Corporation.
4  * Copyright 2012 Benjamin Herrenschmidt, IBM Corporation
5  */
6 
7 #include <linux/kernel.h>
8 #include <linux/kvm_host.h>
9 #include <linux/err.h>
10 #include <linux/kernel_stat.h>
11 #include <linux/pgtable.h>
12 
13 #include <asm/kvm_book3s.h>
14 #include <asm/kvm_ppc.h>
15 #include <asm/hvcall.h>
16 #include <asm/xics.h>
17 #include <asm/synch.h>
18 #include <asm/cputhreads.h>
19 #include <asm/ppc-opcode.h>
20 #include <asm/pnv-pci.h>
21 #include <asm/opal.h>
22 #include <asm/smp.h>
23 
24 #include "book3s_xics.h"
25 
26 #define DEBUG_PASSUP
27 
28 int h_ipi_redirect = 1;
29 EXPORT_SYMBOL(h_ipi_redirect);
30 int kvm_irq_bypass = 1;
31 EXPORT_SYMBOL(kvm_irq_bypass);
32 
33 static void icp_rm_deliver_irq(struct kvmppc_xics *xics, struct kvmppc_icp *icp,
34 			    u32 new_irq, bool check_resend);
35 static int xics_opal_set_server(unsigned int hw_irq, int server_cpu);
36 
37 /* -- ICS routines -- */
38 static void ics_rm_check_resend(struct kvmppc_xics *xics,
39 				struct kvmppc_ics *ics, struct kvmppc_icp *icp)
40 {
41 	int i;
42 
43 	for (i = 0; i < KVMPPC_XICS_IRQ_PER_ICS; i++) {
44 		struct ics_irq_state *state = &ics->irq_state[i];
45 		if (state->resend)
46 			icp_rm_deliver_irq(xics, icp, state->number, true);
47 	}
48 
49 }
50 
51 /* -- ICP routines -- */
52 
53 #ifdef CONFIG_SMP
54 static inline void icp_send_hcore_msg(int hcore, struct kvm_vcpu *vcpu)
55 {
56 	int hcpu;
57 
58 	hcpu = hcore << threads_shift;
59 	kvmppc_host_rm_ops_hv->rm_core[hcore].rm_data = vcpu;
60 	smp_muxed_ipi_set_message(hcpu, PPC_MSG_RM_HOST_ACTION);
61 	kvmppc_set_host_ipi(hcpu);
62 	smp_mb();
63 	kvmhv_rm_send_ipi(hcpu);
64 }
65 #else
66 static inline void icp_send_hcore_msg(int hcore, struct kvm_vcpu *vcpu) { }
67 #endif
68 
69 /*
70  * We start the search from our current CPU Id in the core map
71  * and go in a circle until we get back to our ID looking for a
72  * core that is running in host context and that hasn't already
73  * been targeted for another rm_host_ops.
74  *
75  * In the future, could consider using a fairer algorithm (one
76  * that distributes the IPIs better)
77  *
78  * Returns -1, if no CPU could be found in the host
79  * Else, returns a CPU Id which has been reserved for use
80  */
81 static inline int grab_next_hostcore(int start,
82 		struct kvmppc_host_rm_core *rm_core, int max, int action)
83 {
84 	bool success;
85 	int core;
86 	union kvmppc_rm_state old, new;
87 
88 	for (core = start + 1; core < max; core++)  {
89 		old = new = READ_ONCE(rm_core[core].rm_state);
90 
91 		if (!old.in_host || old.rm_action)
92 			continue;
93 
94 		/* Try to grab this host core if not taken already. */
95 		new.rm_action = action;
96 
97 		success = cmpxchg64(&rm_core[core].rm_state.raw,
98 						old.raw, new.raw) == old.raw;
99 		if (success) {
100 			/*
101 			 * Make sure that the store to the rm_action is made
102 			 * visible before we return to caller (and the
103 			 * subsequent store to rm_data) to synchronize with
104 			 * the IPI handler.
105 			 */
106 			smp_wmb();
107 			return core;
108 		}
109 	}
110 
111 	return -1;
112 }
113 
114 static inline int find_available_hostcore(int action)
115 {
116 	int core;
117 	int my_core = smp_processor_id() >> threads_shift;
118 	struct kvmppc_host_rm_core *rm_core = kvmppc_host_rm_ops_hv->rm_core;
119 
120 	core = grab_next_hostcore(my_core, rm_core, cpu_nr_cores(), action);
121 	if (core == -1)
122 		core = grab_next_hostcore(core, rm_core, my_core, action);
123 
124 	return core;
125 }
126 
127 static void icp_rm_set_vcpu_irq(struct kvm_vcpu *vcpu,
128 				struct kvm_vcpu *this_vcpu)
129 {
130 	struct kvmppc_icp *this_icp = this_vcpu->arch.icp;
131 	int cpu;
132 	int hcore;
133 
134 	/* Mark the target VCPU as having an interrupt pending */
135 	vcpu->stat.queue_intr++;
136 	set_bit(BOOK3S_IRQPRIO_EXTERNAL, &vcpu->arch.pending_exceptions);
137 
138 	/* Kick self ? Just set MER and return */
139 	if (vcpu == this_vcpu) {
140 		mtspr(SPRN_LPCR, mfspr(SPRN_LPCR) | LPCR_MER);
141 		return;
142 	}
143 
144 	/*
145 	 * Check if the core is loaded,
146 	 * if not, find an available host core to post to wake the VCPU,
147 	 * if we can't find one, set up state to eventually return too hard.
148 	 */
149 	cpu = vcpu->arch.thread_cpu;
150 	if (cpu < 0 || cpu >= nr_cpu_ids) {
151 		hcore = -1;
152 		if (kvmppc_host_rm_ops_hv && h_ipi_redirect)
153 			hcore = find_available_hostcore(XICS_RM_KICK_VCPU);
154 		if (hcore != -1) {
155 			icp_send_hcore_msg(hcore, vcpu);
156 		} else {
157 			this_icp->rm_action |= XICS_RM_KICK_VCPU;
158 			this_icp->rm_kick_target = vcpu;
159 		}
160 		return;
161 	}
162 
163 	smp_mb();
164 	kvmhv_rm_send_ipi(cpu);
165 }
166 
167 static void icp_rm_clr_vcpu_irq(struct kvm_vcpu *vcpu)
168 {
169 	/* Note: Only called on self ! */
170 	clear_bit(BOOK3S_IRQPRIO_EXTERNAL, &vcpu->arch.pending_exceptions);
171 	mtspr(SPRN_LPCR, mfspr(SPRN_LPCR) & ~LPCR_MER);
172 }
173 
174 static inline bool icp_rm_try_update(struct kvmppc_icp *icp,
175 				     union kvmppc_icp_state old,
176 				     union kvmppc_icp_state new)
177 {
178 	struct kvm_vcpu *this_vcpu = local_paca->kvm_hstate.kvm_vcpu;
179 	bool success;
180 
181 	/* Calculate new output value */
182 	new.out_ee = (new.xisr && (new.pending_pri < new.cppr));
183 
184 	/* Attempt atomic update */
185 	success = cmpxchg64(&icp->state.raw, old.raw, new.raw) == old.raw;
186 	if (!success)
187 		goto bail;
188 
189 	/*
190 	 * Check for output state update
191 	 *
192 	 * Note that this is racy since another processor could be updating
193 	 * the state already. This is why we never clear the interrupt output
194 	 * here, we only ever set it. The clear only happens prior to doing
195 	 * an update and only by the processor itself. Currently we do it
196 	 * in Accept (H_XIRR) and Up_Cppr (H_XPPR).
197 	 *
198 	 * We also do not try to figure out whether the EE state has changed,
199 	 * we unconditionally set it if the new state calls for it. The reason
200 	 * for that is that we opportunistically remove the pending interrupt
201 	 * flag when raising CPPR, so we need to set it back here if an
202 	 * interrupt is still pending.
203 	 */
204 	if (new.out_ee)
205 		icp_rm_set_vcpu_irq(icp->vcpu, this_vcpu);
206 
207 	/* Expose the state change for debug purposes */
208 	this_vcpu->arch.icp->rm_dbgstate = new;
209 	this_vcpu->arch.icp->rm_dbgtgt = icp->vcpu;
210 
211  bail:
212 	return success;
213 }
214 
215 static inline int check_too_hard(struct kvmppc_xics *xics,
216 				 struct kvmppc_icp *icp)
217 {
218 	return (xics->real_mode_dbg || icp->rm_action) ? H_TOO_HARD : H_SUCCESS;
219 }
220 
221 static void icp_rm_check_resend(struct kvmppc_xics *xics,
222 			     struct kvmppc_icp *icp)
223 {
224 	u32 icsid;
225 
226 	/* Order this load with the test for need_resend in the caller */
227 	smp_rmb();
228 	for_each_set_bit(icsid, icp->resend_map, xics->max_icsid + 1) {
229 		struct kvmppc_ics *ics = xics->ics[icsid];
230 
231 		if (!test_and_clear_bit(icsid, icp->resend_map))
232 			continue;
233 		if (!ics)
234 			continue;
235 		ics_rm_check_resend(xics, ics, icp);
236 	}
237 }
238 
239 static bool icp_rm_try_to_deliver(struct kvmppc_icp *icp, u32 irq, u8 priority,
240 			       u32 *reject)
241 {
242 	union kvmppc_icp_state old_state, new_state;
243 	bool success;
244 
245 	do {
246 		old_state = new_state = READ_ONCE(icp->state);
247 
248 		*reject = 0;
249 
250 		/* See if we can deliver */
251 		success = new_state.cppr > priority &&
252 			new_state.mfrr > priority &&
253 			new_state.pending_pri > priority;
254 
255 		/*
256 		 * If we can, check for a rejection and perform the
257 		 * delivery
258 		 */
259 		if (success) {
260 			*reject = new_state.xisr;
261 			new_state.xisr = irq;
262 			new_state.pending_pri = priority;
263 		} else {
264 			/*
265 			 * If we failed to deliver we set need_resend
266 			 * so a subsequent CPPR state change causes us
267 			 * to try a new delivery.
268 			 */
269 			new_state.need_resend = true;
270 		}
271 
272 	} while (!icp_rm_try_update(icp, old_state, new_state));
273 
274 	return success;
275 }
276 
277 static void icp_rm_deliver_irq(struct kvmppc_xics *xics, struct kvmppc_icp *icp,
278 			    u32 new_irq, bool check_resend)
279 {
280 	struct ics_irq_state *state;
281 	struct kvmppc_ics *ics;
282 	u32 reject;
283 	u16 src;
284 
285 	/*
286 	 * This is used both for initial delivery of an interrupt and
287 	 * for subsequent rejection.
288 	 *
289 	 * Rejection can be racy vs. resends. We have evaluated the
290 	 * rejection in an atomic ICP transaction which is now complete,
291 	 * so potentially the ICP can already accept the interrupt again.
292 	 *
293 	 * So we need to retry the delivery. Essentially the reject path
294 	 * boils down to a failed delivery. Always.
295 	 *
296 	 * Now the interrupt could also have moved to a different target,
297 	 * thus we may need to re-do the ICP lookup as well
298 	 */
299 
300  again:
301 	/* Get the ICS state and lock it */
302 	ics = kvmppc_xics_find_ics(xics, new_irq, &src);
303 	if (!ics) {
304 		/* Unsafe increment, but this does not need to be accurate */
305 		xics->err_noics++;
306 		return;
307 	}
308 	state = &ics->irq_state[src];
309 
310 	/* Get a lock on the ICS */
311 	arch_spin_lock(&ics->lock);
312 
313 	/* Get our server */
314 	if (!icp || state->server != icp->server_num) {
315 		icp = kvmppc_xics_find_server(xics->kvm, state->server);
316 		if (!icp) {
317 			/* Unsafe increment again*/
318 			xics->err_noicp++;
319 			goto out;
320 		}
321 	}
322 
323 	if (check_resend)
324 		if (!state->resend)
325 			goto out;
326 
327 	/* Clear the resend bit of that interrupt */
328 	state->resend = 0;
329 
330 	/*
331 	 * If masked, bail out
332 	 *
333 	 * Note: PAPR doesn't mention anything about masked pending
334 	 * when doing a resend, only when doing a delivery.
335 	 *
336 	 * However that would have the effect of losing a masked
337 	 * interrupt that was rejected and isn't consistent with
338 	 * the whole masked_pending business which is about not
339 	 * losing interrupts that occur while masked.
340 	 *
341 	 * I don't differentiate normal deliveries and resends, this
342 	 * implementation will differ from PAPR and not lose such
343 	 * interrupts.
344 	 */
345 	if (state->priority == MASKED) {
346 		state->masked_pending = 1;
347 		goto out;
348 	}
349 
350 	/*
351 	 * Try the delivery, this will set the need_resend flag
352 	 * in the ICP as part of the atomic transaction if the
353 	 * delivery is not possible.
354 	 *
355 	 * Note that if successful, the new delivery might have itself
356 	 * rejected an interrupt that was "delivered" before we took the
357 	 * ics spin lock.
358 	 *
359 	 * In this case we do the whole sequence all over again for the
360 	 * new guy. We cannot assume that the rejected interrupt is less
361 	 * favored than the new one, and thus doesn't need to be delivered,
362 	 * because by the time we exit icp_rm_try_to_deliver() the target
363 	 * processor may well have already consumed & completed it, and thus
364 	 * the rejected interrupt might actually be already acceptable.
365 	 */
366 	if (icp_rm_try_to_deliver(icp, new_irq, state->priority, &reject)) {
367 		/*
368 		 * Delivery was successful, did we reject somebody else ?
369 		 */
370 		if (reject && reject != XICS_IPI) {
371 			arch_spin_unlock(&ics->lock);
372 			icp->n_reject++;
373 			new_irq = reject;
374 			check_resend = 0;
375 			goto again;
376 		}
377 	} else {
378 		/*
379 		 * We failed to deliver the interrupt we need to set the
380 		 * resend map bit and mark the ICS state as needing a resend
381 		 */
382 		state->resend = 1;
383 
384 		/*
385 		 * Make sure when checking resend, we don't miss the resend
386 		 * if resend_map bit is seen and cleared.
387 		 */
388 		smp_wmb();
389 		set_bit(ics->icsid, icp->resend_map);
390 
391 		/*
392 		 * If the need_resend flag got cleared in the ICP some time
393 		 * between icp_rm_try_to_deliver() atomic update and now, then
394 		 * we know it might have missed the resend_map bit. So we
395 		 * retry
396 		 */
397 		smp_mb();
398 		if (!icp->state.need_resend) {
399 			state->resend = 0;
400 			arch_spin_unlock(&ics->lock);
401 			check_resend = 0;
402 			goto again;
403 		}
404 	}
405  out:
406 	arch_spin_unlock(&ics->lock);
407 }
408 
409 static void icp_rm_down_cppr(struct kvmppc_xics *xics, struct kvmppc_icp *icp,
410 			     u8 new_cppr)
411 {
412 	union kvmppc_icp_state old_state, new_state;
413 	bool resend;
414 
415 	/*
416 	 * This handles several related states in one operation:
417 	 *
418 	 * ICP State: Down_CPPR
419 	 *
420 	 * Load CPPR with new value and if the XISR is 0
421 	 * then check for resends:
422 	 *
423 	 * ICP State: Resend
424 	 *
425 	 * If MFRR is more favored than CPPR, check for IPIs
426 	 * and notify ICS of a potential resend. This is done
427 	 * asynchronously (when used in real mode, we will have
428 	 * to exit here).
429 	 *
430 	 * We do not handle the complete Check_IPI as documented
431 	 * here. In the PAPR, this state will be used for both
432 	 * Set_MFRR and Down_CPPR. However, we know that we aren't
433 	 * changing the MFRR state here so we don't need to handle
434 	 * the case of an MFRR causing a reject of a pending irq,
435 	 * this will have been handled when the MFRR was set in the
436 	 * first place.
437 	 *
438 	 * Thus we don't have to handle rejects, only resends.
439 	 *
440 	 * When implementing real mode for HV KVM, resend will lead to
441 	 * a H_TOO_HARD return and the whole transaction will be handled
442 	 * in virtual mode.
443 	 */
444 	do {
445 		old_state = new_state = READ_ONCE(icp->state);
446 
447 		/* Down_CPPR */
448 		new_state.cppr = new_cppr;
449 
450 		/*
451 		 * Cut down Resend / Check_IPI / IPI
452 		 *
453 		 * The logic is that we cannot have a pending interrupt
454 		 * trumped by an IPI at this point (see above), so we
455 		 * know that either the pending interrupt is already an
456 		 * IPI (in which case we don't care to override it) or
457 		 * it's either more favored than us or non existent
458 		 */
459 		if (new_state.mfrr < new_cppr &&
460 		    new_state.mfrr <= new_state.pending_pri) {
461 			new_state.pending_pri = new_state.mfrr;
462 			new_state.xisr = XICS_IPI;
463 		}
464 
465 		/* Latch/clear resend bit */
466 		resend = new_state.need_resend;
467 		new_state.need_resend = 0;
468 
469 	} while (!icp_rm_try_update(icp, old_state, new_state));
470 
471 	/*
472 	 * Now handle resend checks. Those are asynchronous to the ICP
473 	 * state update in HW (ie bus transactions) so we can handle them
474 	 * separately here as well.
475 	 */
476 	if (resend) {
477 		icp->n_check_resend++;
478 		icp_rm_check_resend(xics, icp);
479 	}
480 }
481 
482 
483 unsigned long xics_rm_h_xirr(struct kvm_vcpu *vcpu)
484 {
485 	union kvmppc_icp_state old_state, new_state;
486 	struct kvmppc_xics *xics = vcpu->kvm->arch.xics;
487 	struct kvmppc_icp *icp = vcpu->arch.icp;
488 	u32 xirr;
489 
490 	if (!xics || !xics->real_mode)
491 		return H_TOO_HARD;
492 
493 	/* First clear the interrupt */
494 	icp_rm_clr_vcpu_irq(icp->vcpu);
495 
496 	/*
497 	 * ICP State: Accept_Interrupt
498 	 *
499 	 * Return the pending interrupt (if any) along with the
500 	 * current CPPR, then clear the XISR & set CPPR to the
501 	 * pending priority
502 	 */
503 	do {
504 		old_state = new_state = READ_ONCE(icp->state);
505 
506 		xirr = old_state.xisr | (((u32)old_state.cppr) << 24);
507 		if (!old_state.xisr)
508 			break;
509 		new_state.cppr = new_state.pending_pri;
510 		new_state.pending_pri = 0xff;
511 		new_state.xisr = 0;
512 
513 	} while (!icp_rm_try_update(icp, old_state, new_state));
514 
515 	/* Return the result in GPR4 */
516 	vcpu->arch.regs.gpr[4] = xirr;
517 
518 	return check_too_hard(xics, icp);
519 }
520 
521 int xics_rm_h_ipi(struct kvm_vcpu *vcpu, unsigned long server,
522 		  unsigned long mfrr)
523 {
524 	union kvmppc_icp_state old_state, new_state;
525 	struct kvmppc_xics *xics = vcpu->kvm->arch.xics;
526 	struct kvmppc_icp *icp, *this_icp = vcpu->arch.icp;
527 	u32 reject;
528 	bool resend;
529 	bool local;
530 
531 	if (!xics || !xics->real_mode)
532 		return H_TOO_HARD;
533 
534 	local = this_icp->server_num == server;
535 	if (local)
536 		icp = this_icp;
537 	else
538 		icp = kvmppc_xics_find_server(vcpu->kvm, server);
539 	if (!icp)
540 		return H_PARAMETER;
541 
542 	/*
543 	 * ICP state: Set_MFRR
544 	 *
545 	 * If the CPPR is more favored than the new MFRR, then
546 	 * nothing needs to be done as there can be no XISR to
547 	 * reject.
548 	 *
549 	 * ICP state: Check_IPI
550 	 *
551 	 * If the CPPR is less favored, then we might be replacing
552 	 * an interrupt, and thus need to possibly reject it.
553 	 *
554 	 * ICP State: IPI
555 	 *
556 	 * Besides rejecting any pending interrupts, we also
557 	 * update XISR and pending_pri to mark IPI as pending.
558 	 *
559 	 * PAPR does not describe this state, but if the MFRR is being
560 	 * made less favored than its earlier value, there might be
561 	 * a previously-rejected interrupt needing to be resent.
562 	 * Ideally, we would want to resend only if
563 	 *	prio(pending_interrupt) < mfrr &&
564 	 *	prio(pending_interrupt) < cppr
565 	 * where pending interrupt is the one that was rejected. But
566 	 * we don't have that state, so we simply trigger a resend
567 	 * whenever the MFRR is made less favored.
568 	 */
569 	do {
570 		old_state = new_state = READ_ONCE(icp->state);
571 
572 		/* Set_MFRR */
573 		new_state.mfrr = mfrr;
574 
575 		/* Check_IPI */
576 		reject = 0;
577 		resend = false;
578 		if (mfrr < new_state.cppr) {
579 			/* Reject a pending interrupt if not an IPI */
580 			if (mfrr <= new_state.pending_pri) {
581 				reject = new_state.xisr;
582 				new_state.pending_pri = mfrr;
583 				new_state.xisr = XICS_IPI;
584 			}
585 		}
586 
587 		if (mfrr > old_state.mfrr) {
588 			resend = new_state.need_resend;
589 			new_state.need_resend = 0;
590 		}
591 	} while (!icp_rm_try_update(icp, old_state, new_state));
592 
593 	/* Handle reject in real mode */
594 	if (reject && reject != XICS_IPI) {
595 		this_icp->n_reject++;
596 		icp_rm_deliver_irq(xics, icp, reject, false);
597 	}
598 
599 	/* Handle resends in real mode */
600 	if (resend) {
601 		this_icp->n_check_resend++;
602 		icp_rm_check_resend(xics, icp);
603 	}
604 
605 	return check_too_hard(xics, this_icp);
606 }
607 
608 int xics_rm_h_cppr(struct kvm_vcpu *vcpu, unsigned long cppr)
609 {
610 	union kvmppc_icp_state old_state, new_state;
611 	struct kvmppc_xics *xics = vcpu->kvm->arch.xics;
612 	struct kvmppc_icp *icp = vcpu->arch.icp;
613 	u32 reject;
614 
615 	if (!xics || !xics->real_mode)
616 		return H_TOO_HARD;
617 
618 	/*
619 	 * ICP State: Set_CPPR
620 	 *
621 	 * We can safely compare the new value with the current
622 	 * value outside of the transaction as the CPPR is only
623 	 * ever changed by the processor on itself
624 	 */
625 	if (cppr > icp->state.cppr) {
626 		icp_rm_down_cppr(xics, icp, cppr);
627 		goto bail;
628 	} else if (cppr == icp->state.cppr)
629 		return H_SUCCESS;
630 
631 	/*
632 	 * ICP State: Up_CPPR
633 	 *
634 	 * The processor is raising its priority, this can result
635 	 * in a rejection of a pending interrupt:
636 	 *
637 	 * ICP State: Reject_Current
638 	 *
639 	 * We can remove EE from the current processor, the update
640 	 * transaction will set it again if needed
641 	 */
642 	icp_rm_clr_vcpu_irq(icp->vcpu);
643 
644 	do {
645 		old_state = new_state = READ_ONCE(icp->state);
646 
647 		reject = 0;
648 		new_state.cppr = cppr;
649 
650 		if (cppr <= new_state.pending_pri) {
651 			reject = new_state.xisr;
652 			new_state.xisr = 0;
653 			new_state.pending_pri = 0xff;
654 		}
655 
656 	} while (!icp_rm_try_update(icp, old_state, new_state));
657 
658 	/*
659 	 * Check for rejects. They are handled by doing a new delivery
660 	 * attempt (see comments in icp_rm_deliver_irq).
661 	 */
662 	if (reject && reject != XICS_IPI) {
663 		icp->n_reject++;
664 		icp_rm_deliver_irq(xics, icp, reject, false);
665 	}
666  bail:
667 	return check_too_hard(xics, icp);
668 }
669 
670 static int ics_rm_eoi(struct kvm_vcpu *vcpu, u32 irq)
671 {
672 	struct kvmppc_xics *xics = vcpu->kvm->arch.xics;
673 	struct kvmppc_icp *icp = vcpu->arch.icp;
674 	struct kvmppc_ics *ics;
675 	struct ics_irq_state *state;
676 	u16 src;
677 	u32 pq_old, pq_new;
678 
679 	/*
680 	 * ICS EOI handling: For LSI, if P bit is still set, we need to
681 	 * resend it.
682 	 *
683 	 * For MSI, we move Q bit into P (and clear Q). If it is set,
684 	 * resend it.
685 	 */
686 
687 	ics = kvmppc_xics_find_ics(xics, irq, &src);
688 	if (!ics)
689 		goto bail;
690 
691 	state = &ics->irq_state[src];
692 
693 	if (state->lsi)
694 		pq_new = state->pq_state;
695 	else
696 		do {
697 			pq_old = state->pq_state;
698 			pq_new = pq_old >> 1;
699 		} while (cmpxchg(&state->pq_state, pq_old, pq_new) != pq_old);
700 
701 	if (pq_new & PQ_PRESENTED)
702 		icp_rm_deliver_irq(xics, NULL, irq, false);
703 
704 	if (!hlist_empty(&vcpu->kvm->irq_ack_notifier_list)) {
705 		icp->rm_action |= XICS_RM_NOTIFY_EOI;
706 		icp->rm_eoied_irq = irq;
707 	}
708 
709 	/* Handle passthrough interrupts */
710 	if (state->host_irq) {
711 		++vcpu->stat.pthru_all;
712 		if (state->intr_cpu != -1) {
713 			int pcpu = raw_smp_processor_id();
714 
715 			pcpu = cpu_first_thread_sibling(pcpu);
716 			++vcpu->stat.pthru_host;
717 			if (state->intr_cpu != pcpu) {
718 				++vcpu->stat.pthru_bad_aff;
719 				xics_opal_set_server(state->host_irq, pcpu);
720 			}
721 			state->intr_cpu = -1;
722 		}
723 	}
724 
725  bail:
726 	return check_too_hard(xics, icp);
727 }
728 
729 int xics_rm_h_eoi(struct kvm_vcpu *vcpu, unsigned long xirr)
730 {
731 	struct kvmppc_xics *xics = vcpu->kvm->arch.xics;
732 	struct kvmppc_icp *icp = vcpu->arch.icp;
733 	u32 irq = xirr & 0x00ffffff;
734 
735 	if (!xics || !xics->real_mode)
736 		return H_TOO_HARD;
737 
738 	/*
739 	 * ICP State: EOI
740 	 *
741 	 * Note: If EOI is incorrectly used by SW to lower the CPPR
742 	 * value (ie more favored), we do not check for rejection of
743 	 * a pending interrupt, this is a SW error and PAPR specifies
744 	 * that we don't have to deal with it.
745 	 *
746 	 * The sending of an EOI to the ICS is handled after the
747 	 * CPPR update
748 	 *
749 	 * ICP State: Down_CPPR which we handle
750 	 * in a separate function as it's shared with H_CPPR.
751 	 */
752 	icp_rm_down_cppr(xics, icp, xirr >> 24);
753 
754 	/* IPIs have no EOI */
755 	if (irq == XICS_IPI)
756 		return check_too_hard(xics, icp);
757 
758 	return ics_rm_eoi(vcpu, irq);
759 }
760 
761 static unsigned long eoi_rc;
762 
763 static void icp_eoi(struct irq_data *d, u32 hwirq, __be32 xirr, bool *again)
764 {
765 	void __iomem *xics_phys;
766 	int64_t rc;
767 
768 	rc = pnv_opal_pci_msi_eoi(d);
769 
770 	if (rc)
771 		eoi_rc = rc;
772 
773 	iosync();
774 
775 	/* EOI it */
776 	xics_phys = local_paca->kvm_hstate.xics_phys;
777 	if (xics_phys) {
778 		__raw_rm_writel(xirr, xics_phys + XICS_XIRR);
779 	} else {
780 		rc = opal_int_eoi(be32_to_cpu(xirr));
781 		*again = rc > 0;
782 	}
783 }
784 
785 static int xics_opal_set_server(unsigned int hw_irq, int server_cpu)
786 {
787 	unsigned int mangle_cpu = get_hard_smp_processor_id(server_cpu) << 2;
788 
789 	return opal_set_xive(hw_irq, mangle_cpu, DEFAULT_PRIORITY);
790 }
791 
792 /*
793  * Increment a per-CPU 32-bit unsigned integer variable.
794  * Safe to call in real-mode. Handles vmalloc'ed addresses
795  *
796  * ToDo: Make this work for any integral type
797  */
798 
799 static inline void this_cpu_inc_rm(unsigned int __percpu *addr)
800 {
801 	unsigned long l;
802 	unsigned int *raddr;
803 	int cpu = smp_processor_id();
804 
805 	raddr = per_cpu_ptr(addr, cpu);
806 	l = (unsigned long)raddr;
807 
808 	if (get_region_id(l) == VMALLOC_REGION_ID) {
809 		l = vmalloc_to_phys(raddr);
810 		raddr = (unsigned int *)l;
811 	}
812 	++*raddr;
813 }
814 
815 /*
816  * We don't try to update the flags in the irq_desc 'istate' field in
817  * here as would happen in the normal IRQ handling path for several reasons:
818  *  - state flags represent internal IRQ state and are not expected to be
819  *    updated outside the IRQ subsystem
820  *  - more importantly, these are useful for edge triggered interrupts,
821  *    IRQ probing, etc., but we are only handling MSI/MSIx interrupts here
822  *    and these states shouldn't apply to us.
823  *
824  * However, we do update irq_stats - we somewhat duplicate the code in
825  * kstat_incr_irqs_this_cpu() for this since this function is defined
826  * in irq/internal.h which we don't want to include here.
827  * The only difference is that desc->kstat_irqs is an allocated per CPU
828  * variable and could have been vmalloc'ed, so we can't directly
829  * call __this_cpu_inc() on it. The kstat structure is a static
830  * per CPU variable and it should be accessible by real-mode KVM.
831  *
832  */
833 static void kvmppc_rm_handle_irq_desc(struct irq_desc *desc)
834 {
835 	this_cpu_inc_rm(desc->kstat_irqs);
836 	__this_cpu_inc(kstat.irqs_sum);
837 }
838 
839 long kvmppc_deliver_irq_passthru(struct kvm_vcpu *vcpu,
840 				 __be32 xirr,
841 				 struct kvmppc_irq_map *irq_map,
842 				 struct kvmppc_passthru_irqmap *pimap,
843 				 bool *again)
844 {
845 	struct kvmppc_xics *xics;
846 	struct kvmppc_icp *icp;
847 	struct kvmppc_ics *ics;
848 	struct ics_irq_state *state;
849 	u32 irq;
850 	u16 src;
851 	u32 pq_old, pq_new;
852 
853 	irq = irq_map->v_hwirq;
854 	xics = vcpu->kvm->arch.xics;
855 	icp = vcpu->arch.icp;
856 
857 	kvmppc_rm_handle_irq_desc(irq_map->desc);
858 
859 	ics = kvmppc_xics_find_ics(xics, irq, &src);
860 	if (!ics)
861 		return 2;
862 
863 	state = &ics->irq_state[src];
864 
865 	/* only MSIs register bypass producers, so it must be MSI here */
866 	do {
867 		pq_old = state->pq_state;
868 		pq_new = ((pq_old << 1) & 3) | PQ_PRESENTED;
869 	} while (cmpxchg(&state->pq_state, pq_old, pq_new) != pq_old);
870 
871 	/* Test P=1, Q=0, this is the only case where we present */
872 	if (pq_new == PQ_PRESENTED)
873 		icp_rm_deliver_irq(xics, icp, irq, false);
874 
875 	/* EOI the interrupt */
876 	icp_eoi(irq_desc_get_irq_data(irq_map->desc), irq_map->r_hwirq, xirr, again);
877 
878 	if (check_too_hard(xics, icp) == H_TOO_HARD)
879 		return 2;
880 	else
881 		return -2;
882 }
883 
884 /*  --- Non-real mode XICS-related built-in routines ---  */
885 
886 /**
887  * Host Operations poked by RM KVM
888  */
889 static void rm_host_ipi_action(int action, void *data)
890 {
891 	switch (action) {
892 	case XICS_RM_KICK_VCPU:
893 		kvmppc_host_rm_ops_hv->vcpu_kick(data);
894 		break;
895 	default:
896 		WARN(1, "Unexpected rm_action=%d data=%p\n", action, data);
897 		break;
898 	}
899 
900 }
901 
902 void kvmppc_xics_ipi_action(void)
903 {
904 	int core;
905 	unsigned int cpu = smp_processor_id();
906 	struct kvmppc_host_rm_core *rm_corep;
907 
908 	core = cpu >> threads_shift;
909 	rm_corep = &kvmppc_host_rm_ops_hv->rm_core[core];
910 
911 	if (rm_corep->rm_data) {
912 		rm_host_ipi_action(rm_corep->rm_state.rm_action,
913 							rm_corep->rm_data);
914 		/* Order these stores against the real mode KVM */
915 		rm_corep->rm_data = NULL;
916 		smp_wmb();
917 		rm_corep->rm_state.rm_action = 0;
918 	}
919 }
920