xref: /openbmc/qemu/hw/intc/riscv_aplic.c (revision 95a97b3fd25ee1c73a6bbfe0d47ac31864a95a4c)
1 /*
2  * RISC-V APLIC (Advanced Platform Level Interrupt Controller)
3  *
4  * Copyright (c) 2021 Western Digital Corporation or its affiliates.
5  *
6  * This program is free software; you can redistribute it and/or modify it
7  * under the terms and conditions of the GNU General Public License,
8  * version 2 or later, as published by the Free Software Foundation.
9  *
10  * This program is distributed in the hope it will be useful, but WITHOUT
11  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
12  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
13  * more details.
14  *
15  * You should have received a copy of the GNU General Public License along with
16  * this program.  If not, see <http://www.gnu.org/licenses/>.
17  */
18 
19 #include "qemu/osdep.h"
20 #include "qapi/error.h"
21 #include "qemu/log.h"
22 #include "qemu/module.h"
23 #include "qemu/error-report.h"
24 #include "qemu/bswap.h"
25 #include "exec/address-spaces.h"
26 #include "hw/sysbus.h"
27 #include "hw/pci/msi.h"
28 #include "hw/boards.h"
29 #include "hw/qdev-properties.h"
30 #include "hw/intc/riscv_aplic.h"
31 #include "hw/irq.h"
32 #include "target/riscv/cpu.h"
33 #include "sysemu/sysemu.h"
34 #include "sysemu/kvm.h"
35 #include "migration/vmstate.h"
36 
37 #define APLIC_MAX_IDC                  (1UL << 14)
38 #define APLIC_MAX_SOURCE               1024
39 #define APLIC_MIN_IPRIO_BITS           1
40 #define APLIC_MAX_IPRIO_BITS           8
41 #define APLIC_MAX_CHILDREN             1024
42 
43 #define APLIC_DOMAINCFG                0x0000
44 #define APLIC_DOMAINCFG_RDONLY         0x80000000
45 #define APLIC_DOMAINCFG_IE             (1 << 8)
46 #define APLIC_DOMAINCFG_DM             (1 << 2)
47 #define APLIC_DOMAINCFG_BE             (1 << 0)
48 
49 #define APLIC_SOURCECFG_BASE           0x0004
50 #define APLIC_SOURCECFG_D              (1 << 10)
51 #define APLIC_SOURCECFG_CHILDIDX_MASK  0x000003ff
52 #define APLIC_SOURCECFG_SM_MASK        0x00000007
53 #define APLIC_SOURCECFG_SM_INACTIVE    0x0
54 #define APLIC_SOURCECFG_SM_DETACH      0x1
55 #define APLIC_SOURCECFG_SM_EDGE_RISE   0x4
56 #define APLIC_SOURCECFG_SM_EDGE_FALL   0x5
57 #define APLIC_SOURCECFG_SM_LEVEL_HIGH  0x6
58 #define APLIC_SOURCECFG_SM_LEVEL_LOW   0x7
59 
60 #define APLIC_MMSICFGADDR              0x1bc0
61 #define APLIC_MMSICFGADDRH             0x1bc4
62 #define APLIC_SMSICFGADDR              0x1bc8
63 #define APLIC_SMSICFGADDRH             0x1bcc
64 
65 #define APLIC_xMSICFGADDRH_L           (1UL << 31)
66 #define APLIC_xMSICFGADDRH_HHXS_MASK   0x1f
67 #define APLIC_xMSICFGADDRH_HHXS_SHIFT  24
68 #define APLIC_xMSICFGADDRH_LHXS_MASK   0x7
69 #define APLIC_xMSICFGADDRH_LHXS_SHIFT  20
70 #define APLIC_xMSICFGADDRH_HHXW_MASK   0x7
71 #define APLIC_xMSICFGADDRH_HHXW_SHIFT  16
72 #define APLIC_xMSICFGADDRH_LHXW_MASK   0xf
73 #define APLIC_xMSICFGADDRH_LHXW_SHIFT  12
74 #define APLIC_xMSICFGADDRH_BAPPN_MASK  0xfff
75 
76 #define APLIC_xMSICFGADDR_PPN_SHIFT    12
77 
78 #define APLIC_xMSICFGADDR_PPN_HART(__lhxs) \
79     ((1UL << (__lhxs)) - 1)
80 
81 #define APLIC_xMSICFGADDR_PPN_LHX_MASK(__lhxw) \
82     ((1UL << (__lhxw)) - 1)
83 #define APLIC_xMSICFGADDR_PPN_LHX_SHIFT(__lhxs) \
84     ((__lhxs))
85 #define APLIC_xMSICFGADDR_PPN_LHX(__lhxw, __lhxs) \
86     (APLIC_xMSICFGADDR_PPN_LHX_MASK(__lhxw) << \
87      APLIC_xMSICFGADDR_PPN_LHX_SHIFT(__lhxs))
88 
89 #define APLIC_xMSICFGADDR_PPN_HHX_MASK(__hhxw) \
90     ((1UL << (__hhxw)) - 1)
91 #define APLIC_xMSICFGADDR_PPN_HHX_SHIFT(__hhxs) \
92     ((__hhxs) + APLIC_xMSICFGADDR_PPN_SHIFT)
93 #define APLIC_xMSICFGADDR_PPN_HHX(__hhxw, __hhxs) \
94     (APLIC_xMSICFGADDR_PPN_HHX_MASK(__hhxw) << \
95      APLIC_xMSICFGADDR_PPN_HHX_SHIFT(__hhxs))
96 
97 #define APLIC_xMSICFGADDRH_VALID_MASK   \
98     (APLIC_xMSICFGADDRH_L | \
99      (APLIC_xMSICFGADDRH_HHXS_MASK << APLIC_xMSICFGADDRH_HHXS_SHIFT) | \
100      (APLIC_xMSICFGADDRH_LHXS_MASK << APLIC_xMSICFGADDRH_LHXS_SHIFT) | \
101      (APLIC_xMSICFGADDRH_HHXW_MASK << APLIC_xMSICFGADDRH_HHXW_SHIFT) | \
102      (APLIC_xMSICFGADDRH_LHXW_MASK << APLIC_xMSICFGADDRH_LHXW_SHIFT) | \
103      APLIC_xMSICFGADDRH_BAPPN_MASK)
104 
105 #define APLIC_SETIP_BASE               0x1c00
106 #define APLIC_SETIPNUM                 0x1cdc
107 
108 #define APLIC_CLRIP_BASE               0x1d00
109 #define APLIC_CLRIPNUM                 0x1ddc
110 
111 #define APLIC_SETIE_BASE               0x1e00
112 #define APLIC_SETIENUM                 0x1edc
113 
114 #define APLIC_CLRIE_BASE               0x1f00
115 #define APLIC_CLRIENUM                 0x1fdc
116 
117 #define APLIC_SETIPNUM_LE              0x2000
118 #define APLIC_SETIPNUM_BE              0x2004
119 
120 #define APLIC_ISTATE_PENDING           (1U << 0)
121 #define APLIC_ISTATE_ENABLED           (1U << 1)
122 #define APLIC_ISTATE_ENPEND            (APLIC_ISTATE_ENABLED | \
123                                         APLIC_ISTATE_PENDING)
124 #define APLIC_ISTATE_INPUT             (1U << 8)
125 
126 #define APLIC_GENMSI                   0x3000
127 
128 #define APLIC_TARGET_BASE              0x3004
129 #define APLIC_TARGET_HART_IDX_SHIFT    18
130 #define APLIC_TARGET_HART_IDX_MASK     0x3fff
131 #define APLIC_TARGET_GUEST_IDX_SHIFT   12
132 #define APLIC_TARGET_GUEST_IDX_MASK    0x3f
133 #define APLIC_TARGET_IPRIO_MASK        0xff
134 #define APLIC_TARGET_EIID_MASK         0x7ff
135 
136 #define APLIC_IDC_BASE                 0x4000
137 #define APLIC_IDC_SIZE                 32
138 
139 #define APLIC_IDC_IDELIVERY            0x00
140 
141 #define APLIC_IDC_IFORCE               0x04
142 
143 #define APLIC_IDC_ITHRESHOLD           0x08
144 
145 #define APLIC_IDC_TOPI                 0x18
146 #define APLIC_IDC_TOPI_ID_SHIFT        16
147 #define APLIC_IDC_TOPI_ID_MASK         0x3ff
148 #define APLIC_IDC_TOPI_PRIO_MASK       0xff
149 
150 #define APLIC_IDC_CLAIMI               0x1c
151 
152 /*
153  * KVM AIA only supports APLIC MSI, fallback to QEMU emulation if we want to use
154  * APLIC Wired.
155  */
156 static bool is_kvm_aia(bool msimode)
157 {
158     return kvm_irqchip_in_kernel() && msimode;
159 }
160 
161 static uint32_t riscv_aplic_read_input_word(RISCVAPLICState *aplic,
162                                             uint32_t word)
163 {
164     uint32_t i, irq, ret = 0;
165 
166     for (i = 0; i < 32; i++) {
167         irq = word * 32 + i;
168         if (!irq || aplic->num_irqs <= irq) {
169             continue;
170         }
171 
172         ret |= ((aplic->state[irq] & APLIC_ISTATE_INPUT) ? 1 : 0) << i;
173     }
174 
175     return ret;
176 }
177 
178 static uint32_t riscv_aplic_read_pending_word(RISCVAPLICState *aplic,
179                                               uint32_t word)
180 {
181     uint32_t i, irq, ret = 0;
182 
183     for (i = 0; i < 32; i++) {
184         irq = word * 32 + i;
185         if (!irq || aplic->num_irqs <= irq) {
186             continue;
187         }
188 
189         ret |= ((aplic->state[irq] & APLIC_ISTATE_PENDING) ? 1 : 0) << i;
190     }
191 
192     return ret;
193 }
194 
195 static void riscv_aplic_set_pending_raw(RISCVAPLICState *aplic,
196                                         uint32_t irq, bool pending)
197 {
198     if (pending) {
199         aplic->state[irq] |= APLIC_ISTATE_PENDING;
200     } else {
201         aplic->state[irq] &= ~APLIC_ISTATE_PENDING;
202     }
203 }
204 
205 static void riscv_aplic_set_pending(RISCVAPLICState *aplic,
206                                     uint32_t irq, bool pending)
207 {
208     uint32_t sourcecfg, sm;
209 
210     if ((irq <= 0) || (aplic->num_irqs <= irq)) {
211         return;
212     }
213 
214     sourcecfg = aplic->sourcecfg[irq];
215     if (sourcecfg & APLIC_SOURCECFG_D) {
216         return;
217     }
218 
219     sm = sourcecfg & APLIC_SOURCECFG_SM_MASK;
220     if ((sm == APLIC_SOURCECFG_SM_INACTIVE) ||
221         ((!aplic->msimode || (aplic->msimode && !pending)) &&
222          ((sm == APLIC_SOURCECFG_SM_LEVEL_HIGH) ||
223           (sm == APLIC_SOURCECFG_SM_LEVEL_LOW)))) {
224         return;
225     }
226 
227     riscv_aplic_set_pending_raw(aplic, irq, pending);
228 }
229 
230 static void riscv_aplic_set_pending_word(RISCVAPLICState *aplic,
231                                          uint32_t word, uint32_t value,
232                                          bool pending)
233 {
234     uint32_t i, irq;
235 
236     for (i = 0; i < 32; i++) {
237         irq = word * 32 + i;
238         if (!irq || aplic->num_irqs <= irq) {
239             continue;
240         }
241 
242         if (value & (1U << i)) {
243             riscv_aplic_set_pending(aplic, irq, pending);
244         }
245     }
246 }
247 
248 static uint32_t riscv_aplic_read_enabled_word(RISCVAPLICState *aplic,
249                                               int word)
250 {
251     uint32_t i, irq, ret = 0;
252 
253     for (i = 0; i < 32; i++) {
254         irq = word * 32 + i;
255         if (!irq || aplic->num_irqs <= irq) {
256             continue;
257         }
258 
259         ret |= ((aplic->state[irq] & APLIC_ISTATE_ENABLED) ? 1 : 0) << i;
260     }
261 
262     return ret;
263 }
264 
265 static void riscv_aplic_set_enabled_raw(RISCVAPLICState *aplic,
266                                         uint32_t irq, bool enabled)
267 {
268     if (enabled) {
269         aplic->state[irq] |= APLIC_ISTATE_ENABLED;
270     } else {
271         aplic->state[irq] &= ~APLIC_ISTATE_ENABLED;
272     }
273 }
274 
275 static void riscv_aplic_set_enabled(RISCVAPLICState *aplic,
276                                     uint32_t irq, bool enabled)
277 {
278     uint32_t sourcecfg, sm;
279 
280     if ((irq <= 0) || (aplic->num_irqs <= irq)) {
281         return;
282     }
283 
284     sourcecfg = aplic->sourcecfg[irq];
285     if (sourcecfg & APLIC_SOURCECFG_D) {
286         return;
287     }
288 
289     sm = sourcecfg & APLIC_SOURCECFG_SM_MASK;
290     if (sm == APLIC_SOURCECFG_SM_INACTIVE) {
291         return;
292     }
293 
294     riscv_aplic_set_enabled_raw(aplic, irq, enabled);
295 }
296 
297 static void riscv_aplic_set_enabled_word(RISCVAPLICState *aplic,
298                                          uint32_t word, uint32_t value,
299                                          bool enabled)
300 {
301     uint32_t i, irq;
302 
303     for (i = 0; i < 32; i++) {
304         irq = word * 32 + i;
305         if (!irq || aplic->num_irqs <= irq) {
306             continue;
307         }
308 
309         if (value & (1U << i)) {
310             riscv_aplic_set_enabled(aplic, irq, enabled);
311         }
312     }
313 }
314 
315 static void riscv_aplic_msi_send(RISCVAPLICState *aplic,
316                                  uint32_t hart_idx, uint32_t guest_idx,
317                                  uint32_t eiid)
318 {
319     uint64_t addr;
320     MemTxResult result;
321     RISCVAPLICState *aplic_m;
322     uint32_t lhxs, lhxw, hhxs, hhxw, group_idx, msicfgaddr, msicfgaddrH;
323 
324     aplic_m = aplic;
325     while (aplic_m && !aplic_m->mmode) {
326         aplic_m = aplic_m->parent;
327     }
328     if (!aplic_m) {
329         qemu_log_mask(LOG_GUEST_ERROR, "%s: m-level APLIC not found\n",
330                       __func__);
331         return;
332     }
333 
334     if (aplic->mmode) {
335         msicfgaddr = aplic_m->mmsicfgaddr;
336         msicfgaddrH = aplic_m->mmsicfgaddrH;
337     } else {
338         msicfgaddr = aplic_m->smsicfgaddr;
339         msicfgaddrH = aplic_m->smsicfgaddrH;
340     }
341 
342     lhxs = (msicfgaddrH >> APLIC_xMSICFGADDRH_LHXS_SHIFT) &
343             APLIC_xMSICFGADDRH_LHXS_MASK;
344     lhxw = (msicfgaddrH >> APLIC_xMSICFGADDRH_LHXW_SHIFT) &
345             APLIC_xMSICFGADDRH_LHXW_MASK;
346     hhxs = (msicfgaddrH >> APLIC_xMSICFGADDRH_HHXS_SHIFT) &
347             APLIC_xMSICFGADDRH_HHXS_MASK;
348     hhxw = (msicfgaddrH >> APLIC_xMSICFGADDRH_HHXW_SHIFT) &
349             APLIC_xMSICFGADDRH_HHXW_MASK;
350 
351     group_idx = hart_idx >> lhxw;
352     hart_idx &= APLIC_xMSICFGADDR_PPN_LHX_MASK(lhxw);
353 
354     addr = msicfgaddr;
355     addr |= ((uint64_t)(msicfgaddrH & APLIC_xMSICFGADDRH_BAPPN_MASK)) << 32;
356     addr |= ((uint64_t)(group_idx & APLIC_xMSICFGADDR_PPN_HHX_MASK(hhxw))) <<
357              APLIC_xMSICFGADDR_PPN_HHX_SHIFT(hhxs);
358     addr |= ((uint64_t)(hart_idx & APLIC_xMSICFGADDR_PPN_LHX_MASK(lhxw))) <<
359              APLIC_xMSICFGADDR_PPN_LHX_SHIFT(lhxs);
360     addr |= (uint64_t)(guest_idx & APLIC_xMSICFGADDR_PPN_HART(lhxs));
361     addr <<= APLIC_xMSICFGADDR_PPN_SHIFT;
362 
363     address_space_stl_le(&address_space_memory, addr,
364                          eiid, MEMTXATTRS_UNSPECIFIED, &result);
365     if (result != MEMTX_OK) {
366         qemu_log_mask(LOG_GUEST_ERROR, "%s: MSI write failed for "
367                       "hart_index=%d guest_index=%d eiid=%d\n",
368                       __func__, hart_idx, guest_idx, eiid);
369     }
370 }
371 
372 static void riscv_aplic_msi_irq_update(RISCVAPLICState *aplic, uint32_t irq)
373 {
374     uint32_t hart_idx, guest_idx, eiid;
375 
376     if (!aplic->msimode || (aplic->num_irqs <= irq) ||
377         !(aplic->domaincfg & APLIC_DOMAINCFG_IE)) {
378         return;
379     }
380 
381     if ((aplic->state[irq] & APLIC_ISTATE_ENPEND) != APLIC_ISTATE_ENPEND) {
382         return;
383     }
384 
385     riscv_aplic_set_pending_raw(aplic, irq, false);
386 
387     hart_idx = aplic->target[irq] >> APLIC_TARGET_HART_IDX_SHIFT;
388     hart_idx &= APLIC_TARGET_HART_IDX_MASK;
389     if (aplic->mmode) {
390         /* M-level APLIC ignores guest_index */
391         guest_idx = 0;
392     } else {
393         guest_idx = aplic->target[irq] >> APLIC_TARGET_GUEST_IDX_SHIFT;
394         guest_idx &= APLIC_TARGET_GUEST_IDX_MASK;
395     }
396     eiid = aplic->target[irq] & APLIC_TARGET_EIID_MASK;
397     riscv_aplic_msi_send(aplic, hart_idx, guest_idx, eiid);
398 }
399 
400 static uint32_t riscv_aplic_idc_topi(RISCVAPLICState *aplic, uint32_t idc)
401 {
402     uint32_t best_irq, best_iprio;
403     uint32_t irq, iprio, ihartidx, ithres;
404 
405     if (aplic->num_harts <= idc) {
406         return 0;
407     }
408 
409     ithres = aplic->ithreshold[idc];
410     best_irq = best_iprio = UINT32_MAX;
411     for (irq = 1; irq < aplic->num_irqs; irq++) {
412         if ((aplic->state[irq] & APLIC_ISTATE_ENPEND) !=
413             APLIC_ISTATE_ENPEND) {
414             continue;
415         }
416 
417         ihartidx = aplic->target[irq] >> APLIC_TARGET_HART_IDX_SHIFT;
418         ihartidx &= APLIC_TARGET_HART_IDX_MASK;
419         if (ihartidx != idc) {
420             continue;
421         }
422 
423         iprio = aplic->target[irq] & aplic->iprio_mask;
424         if (ithres && iprio >= ithres) {
425             continue;
426         }
427 
428         if (iprio < best_iprio) {
429             best_irq = irq;
430             best_iprio = iprio;
431         }
432     }
433 
434     if (best_irq < aplic->num_irqs && best_iprio <= aplic->iprio_mask) {
435         return (best_irq << APLIC_IDC_TOPI_ID_SHIFT) | best_iprio;
436     }
437 
438     return 0;
439 }
440 
441 static void riscv_aplic_idc_update(RISCVAPLICState *aplic, uint32_t idc)
442 {
443     uint32_t topi;
444 
445     if (aplic->msimode || aplic->num_harts <= idc) {
446         return;
447     }
448 
449     topi = riscv_aplic_idc_topi(aplic, idc);
450     if ((aplic->domaincfg & APLIC_DOMAINCFG_IE) &&
451         aplic->idelivery[idc] &&
452         (aplic->iforce[idc] || topi)) {
453         qemu_irq_raise(aplic->external_irqs[idc]);
454     } else {
455         qemu_irq_lower(aplic->external_irqs[idc]);
456     }
457 }
458 
459 static uint32_t riscv_aplic_idc_claimi(RISCVAPLICState *aplic, uint32_t idc)
460 {
461     uint32_t irq, state, sm, topi = riscv_aplic_idc_topi(aplic, idc);
462 
463     if (!topi) {
464         aplic->iforce[idc] = 0;
465         return 0;
466     }
467 
468     irq = (topi >> APLIC_IDC_TOPI_ID_SHIFT) & APLIC_IDC_TOPI_ID_MASK;
469     sm = aplic->sourcecfg[irq] & APLIC_SOURCECFG_SM_MASK;
470     state = aplic->state[irq];
471     riscv_aplic_set_pending_raw(aplic, irq, false);
472     if ((sm == APLIC_SOURCECFG_SM_LEVEL_HIGH) &&
473         (state & APLIC_ISTATE_INPUT)) {
474         riscv_aplic_set_pending_raw(aplic, irq, true);
475     } else if ((sm == APLIC_SOURCECFG_SM_LEVEL_LOW) &&
476                !(state & APLIC_ISTATE_INPUT)) {
477         riscv_aplic_set_pending_raw(aplic, irq, true);
478     }
479     riscv_aplic_idc_update(aplic, idc);
480 
481     return topi;
482 }
483 
484 static void riscv_kvm_aplic_request(void *opaque, int irq, int level)
485 {
486     kvm_set_irq(kvm_state, irq, !!level);
487 }
488 
489 static void riscv_aplic_request(void *opaque, int irq, int level)
490 {
491     bool update = false;
492     RISCVAPLICState *aplic = opaque;
493     uint32_t sourcecfg, childidx, state, idc;
494 
495     assert((0 < irq) && (irq < aplic->num_irqs));
496 
497     sourcecfg = aplic->sourcecfg[irq];
498     if (sourcecfg & APLIC_SOURCECFG_D) {
499         childidx = sourcecfg & APLIC_SOURCECFG_CHILDIDX_MASK;
500         if (childidx < aplic->num_children) {
501             riscv_aplic_request(aplic->children[childidx], irq, level);
502         }
503         return;
504     }
505 
506     state = aplic->state[irq];
507     switch (sourcecfg & APLIC_SOURCECFG_SM_MASK) {
508     case APLIC_SOURCECFG_SM_EDGE_RISE:
509         if ((level > 0) && !(state & APLIC_ISTATE_INPUT) &&
510             !(state & APLIC_ISTATE_PENDING)) {
511             riscv_aplic_set_pending_raw(aplic, irq, true);
512             update = true;
513         }
514         break;
515     case APLIC_SOURCECFG_SM_EDGE_FALL:
516         if ((level <= 0) && (state & APLIC_ISTATE_INPUT) &&
517             !(state & APLIC_ISTATE_PENDING)) {
518             riscv_aplic_set_pending_raw(aplic, irq, true);
519             update = true;
520         }
521         break;
522     case APLIC_SOURCECFG_SM_LEVEL_HIGH:
523         if ((level > 0) && !(state & APLIC_ISTATE_PENDING)) {
524             riscv_aplic_set_pending_raw(aplic, irq, true);
525             update = true;
526         }
527         break;
528     case APLIC_SOURCECFG_SM_LEVEL_LOW:
529         if ((level <= 0) && !(state & APLIC_ISTATE_PENDING)) {
530             riscv_aplic_set_pending_raw(aplic, irq, true);
531             update = true;
532         }
533         break;
534     default:
535         break;
536     }
537 
538     if (level <= 0) {
539         aplic->state[irq] &= ~APLIC_ISTATE_INPUT;
540     } else {
541         aplic->state[irq] |= APLIC_ISTATE_INPUT;
542     }
543 
544     if (update) {
545         if (aplic->msimode) {
546             riscv_aplic_msi_irq_update(aplic, irq);
547         } else {
548             idc = aplic->target[irq] >> APLIC_TARGET_HART_IDX_SHIFT;
549             idc &= APLIC_TARGET_HART_IDX_MASK;
550             riscv_aplic_idc_update(aplic, idc);
551         }
552     }
553 }
554 
555 static uint64_t riscv_aplic_read(void *opaque, hwaddr addr, unsigned size)
556 {
557     uint32_t irq, word, idc;
558     RISCVAPLICState *aplic = opaque;
559 
560     /* Reads must be 4 byte words */
561     if ((addr & 0x3) != 0) {
562         goto err;
563     }
564 
565     if (addr == APLIC_DOMAINCFG) {
566         return APLIC_DOMAINCFG_RDONLY | aplic->domaincfg |
567                (aplic->msimode ? APLIC_DOMAINCFG_DM : 0);
568     } else if ((APLIC_SOURCECFG_BASE <= addr) &&
569             (addr < (APLIC_SOURCECFG_BASE + (aplic->num_irqs - 1) * 4))) {
570         irq  = ((addr - APLIC_SOURCECFG_BASE) >> 2) + 1;
571         return aplic->sourcecfg[irq];
572     } else if (aplic->mmode && aplic->msimode &&
573                (addr == APLIC_MMSICFGADDR)) {
574         return aplic->mmsicfgaddr;
575     } else if (aplic->mmode && aplic->msimode &&
576                (addr == APLIC_MMSICFGADDRH)) {
577         return aplic->mmsicfgaddrH;
578     } else if (aplic->mmode && aplic->msimode &&
579                (addr == APLIC_SMSICFGADDR)) {
580         /*
581          * Registers SMSICFGADDR and SMSICFGADDRH are implemented only if:
582          * (a) the interrupt domain is at machine level
583          * (b) the domain's harts implement supervisor mode
584          * (c) the domain has one or more child supervisor-level domains
585          *     that support MSI delivery mode (domaincfg.DM is not read-
586          *     only zero in at least one of the supervisor-level child
587          * domains).
588          */
589         return (aplic->num_children) ? aplic->smsicfgaddr : 0;
590     } else if (aplic->mmode && aplic->msimode &&
591                (addr == APLIC_SMSICFGADDRH)) {
592         return (aplic->num_children) ? aplic->smsicfgaddrH : 0;
593     } else if ((APLIC_SETIP_BASE <= addr) &&
594             (addr < (APLIC_SETIP_BASE + aplic->bitfield_words * 4))) {
595         word = (addr - APLIC_SETIP_BASE) >> 2;
596         return riscv_aplic_read_pending_word(aplic, word);
597     } else if (addr == APLIC_SETIPNUM) {
598         return 0;
599     } else if ((APLIC_CLRIP_BASE <= addr) &&
600             (addr < (APLIC_CLRIP_BASE + aplic->bitfield_words * 4))) {
601         word = (addr - APLIC_CLRIP_BASE) >> 2;
602         return riscv_aplic_read_input_word(aplic, word);
603     } else if (addr == APLIC_CLRIPNUM) {
604         return 0;
605     } else if ((APLIC_SETIE_BASE <= addr) &&
606             (addr < (APLIC_SETIE_BASE + aplic->bitfield_words * 4))) {
607         word = (addr - APLIC_SETIE_BASE) >> 2;
608         return riscv_aplic_read_enabled_word(aplic, word);
609     } else if (addr == APLIC_SETIENUM) {
610         return 0;
611     } else if ((APLIC_CLRIE_BASE <= addr) &&
612             (addr < (APLIC_CLRIE_BASE + aplic->bitfield_words * 4))) {
613         return 0;
614     } else if (addr == APLIC_CLRIENUM) {
615         return 0;
616     } else if (addr == APLIC_SETIPNUM_LE) {
617         return 0;
618     } else if (addr == APLIC_SETIPNUM_BE) {
619         return 0;
620     } else if (addr == APLIC_GENMSI) {
621         return (aplic->msimode) ? aplic->genmsi : 0;
622     } else if ((APLIC_TARGET_BASE <= addr) &&
623             (addr < (APLIC_TARGET_BASE + (aplic->num_irqs - 1) * 4))) {
624         irq = ((addr - APLIC_TARGET_BASE) >> 2) + 1;
625         return aplic->target[irq];
626     } else if (!aplic->msimode && (APLIC_IDC_BASE <= addr) &&
627             (addr < (APLIC_IDC_BASE + aplic->num_harts * APLIC_IDC_SIZE))) {
628         idc = (addr - APLIC_IDC_BASE) / APLIC_IDC_SIZE;
629         switch (addr - (APLIC_IDC_BASE + idc * APLIC_IDC_SIZE)) {
630         case APLIC_IDC_IDELIVERY:
631             return aplic->idelivery[idc];
632         case APLIC_IDC_IFORCE:
633             return aplic->iforce[idc];
634         case APLIC_IDC_ITHRESHOLD:
635             return aplic->ithreshold[idc];
636         case APLIC_IDC_TOPI:
637             return riscv_aplic_idc_topi(aplic, idc);
638         case APLIC_IDC_CLAIMI:
639             return riscv_aplic_idc_claimi(aplic, idc);
640         default:
641             goto err;
642         };
643     }
644 
645 err:
646     qemu_log_mask(LOG_GUEST_ERROR,
647                   "%s: Invalid register read 0x%" HWADDR_PRIx "\n",
648                   __func__, addr);
649     return 0;
650 }
651 
652 static void riscv_aplic_write(void *opaque, hwaddr addr, uint64_t value,
653         unsigned size)
654 {
655     RISCVAPLICState *aplic = opaque;
656     uint32_t irq, word, idc = UINT32_MAX;
657 
658     /* Writes must be 4 byte words */
659     if ((addr & 0x3) != 0) {
660         goto err;
661     }
662 
663     if (addr == APLIC_DOMAINCFG) {
664         /* Only IE bit writable at the moment */
665         value &= APLIC_DOMAINCFG_IE;
666         aplic->domaincfg = value;
667     } else if ((APLIC_SOURCECFG_BASE <= addr) &&
668             (addr < (APLIC_SOURCECFG_BASE + (aplic->num_irqs - 1) * 4))) {
669         irq  = ((addr - APLIC_SOURCECFG_BASE) >> 2) + 1;
670         if (!aplic->num_children && (value & APLIC_SOURCECFG_D)) {
671             value = 0;
672         }
673         if (value & APLIC_SOURCECFG_D) {
674             value &= (APLIC_SOURCECFG_D | APLIC_SOURCECFG_CHILDIDX_MASK);
675         } else {
676             value &= (APLIC_SOURCECFG_D | APLIC_SOURCECFG_SM_MASK);
677         }
678         aplic->sourcecfg[irq] = value;
679         if ((aplic->sourcecfg[irq] & APLIC_SOURCECFG_D) ||
680             (aplic->sourcecfg[irq] == 0)) {
681             riscv_aplic_set_pending_raw(aplic, irq, false);
682             riscv_aplic_set_enabled_raw(aplic, irq, false);
683         }
684     } else if (aplic->mmode && aplic->msimode &&
685                (addr == APLIC_MMSICFGADDR)) {
686         if (!(aplic->mmsicfgaddrH & APLIC_xMSICFGADDRH_L)) {
687             aplic->mmsicfgaddr = value;
688         }
689     } else if (aplic->mmode && aplic->msimode &&
690                (addr == APLIC_MMSICFGADDRH)) {
691         if (!(aplic->mmsicfgaddrH & APLIC_xMSICFGADDRH_L)) {
692             aplic->mmsicfgaddrH = value & APLIC_xMSICFGADDRH_VALID_MASK;
693         }
694     } else if (aplic->mmode && aplic->msimode &&
695                (addr == APLIC_SMSICFGADDR)) {
696         /*
697          * Registers SMSICFGADDR and SMSICFGADDRH are implemented only if:
698          * (a) the interrupt domain is at machine level
699          * (b) the domain's harts implement supervisor mode
700          * (c) the domain has one or more child supervisor-level domains
701          *     that support MSI delivery mode (domaincfg.DM is not read-
702          *     only zero in at least one of the supervisor-level child
703          * domains).
704          */
705         if (aplic->num_children &&
706             !(aplic->mmsicfgaddrH & APLIC_xMSICFGADDRH_L)) {
707             aplic->smsicfgaddr = value;
708         }
709     } else if (aplic->mmode && aplic->msimode &&
710                (addr == APLIC_SMSICFGADDRH)) {
711         if (aplic->num_children &&
712             !(aplic->mmsicfgaddrH & APLIC_xMSICFGADDRH_L)) {
713             aplic->smsicfgaddrH = value & APLIC_xMSICFGADDRH_VALID_MASK;
714         }
715     } else if ((APLIC_SETIP_BASE <= addr) &&
716             (addr < (APLIC_SETIP_BASE + aplic->bitfield_words * 4))) {
717         word = (addr - APLIC_SETIP_BASE) >> 2;
718         riscv_aplic_set_pending_word(aplic, word, value, true);
719     } else if (addr == APLIC_SETIPNUM) {
720         riscv_aplic_set_pending(aplic, value, true);
721     } else if ((APLIC_CLRIP_BASE <= addr) &&
722             (addr < (APLIC_CLRIP_BASE + aplic->bitfield_words * 4))) {
723         word = (addr - APLIC_CLRIP_BASE) >> 2;
724         riscv_aplic_set_pending_word(aplic, word, value, false);
725     } else if (addr == APLIC_CLRIPNUM) {
726         riscv_aplic_set_pending(aplic, value, false);
727     } else if ((APLIC_SETIE_BASE <= addr) &&
728             (addr < (APLIC_SETIE_BASE + aplic->bitfield_words * 4))) {
729         word = (addr - APLIC_SETIE_BASE) >> 2;
730         riscv_aplic_set_enabled_word(aplic, word, value, true);
731     } else if (addr == APLIC_SETIENUM) {
732         riscv_aplic_set_enabled(aplic, value, true);
733     } else if ((APLIC_CLRIE_BASE <= addr) &&
734             (addr < (APLIC_CLRIE_BASE + aplic->bitfield_words * 4))) {
735         word = (addr - APLIC_CLRIE_BASE) >> 2;
736         riscv_aplic_set_enabled_word(aplic, word, value, false);
737     } else if (addr == APLIC_CLRIENUM) {
738         riscv_aplic_set_enabled(aplic, value, false);
739     } else if (addr == APLIC_SETIPNUM_LE) {
740         riscv_aplic_set_pending(aplic, value, true);
741     } else if (addr == APLIC_SETIPNUM_BE) {
742         riscv_aplic_set_pending(aplic, bswap32(value), true);
743     } else if (addr == APLIC_GENMSI) {
744         if (aplic->msimode) {
745             aplic->genmsi = value & ~(APLIC_TARGET_GUEST_IDX_MASK <<
746                                       APLIC_TARGET_GUEST_IDX_SHIFT);
747             riscv_aplic_msi_send(aplic,
748                                  value >> APLIC_TARGET_HART_IDX_SHIFT,
749                                  0,
750                                  value & APLIC_TARGET_EIID_MASK);
751         }
752     } else if ((APLIC_TARGET_BASE <= addr) &&
753             (addr < (APLIC_TARGET_BASE + (aplic->num_irqs - 1) * 4))) {
754         irq = ((addr - APLIC_TARGET_BASE) >> 2) + 1;
755         if (aplic->msimode) {
756             aplic->target[irq] = value;
757         } else {
758             aplic->target[irq] = (value & ~APLIC_TARGET_IPRIO_MASK) |
759                                  ((value & aplic->iprio_mask) ?
760                                   (value & aplic->iprio_mask) : 1);
761         }
762     } else if (!aplic->msimode && (APLIC_IDC_BASE <= addr) &&
763             (addr < (APLIC_IDC_BASE + aplic->num_harts * APLIC_IDC_SIZE))) {
764         idc = (addr - APLIC_IDC_BASE) / APLIC_IDC_SIZE;
765         switch (addr - (APLIC_IDC_BASE + idc * APLIC_IDC_SIZE)) {
766         case APLIC_IDC_IDELIVERY:
767             aplic->idelivery[idc] = value & 0x1;
768             break;
769         case APLIC_IDC_IFORCE:
770             aplic->iforce[idc] = value & 0x1;
771             break;
772         case APLIC_IDC_ITHRESHOLD:
773             aplic->ithreshold[idc] = value & aplic->iprio_mask;
774             break;
775         default:
776             goto err;
777         };
778     } else {
779         goto err;
780     }
781 
782     if (aplic->msimode) {
783         for (irq = 1; irq < aplic->num_irqs; irq++) {
784             riscv_aplic_msi_irq_update(aplic, irq);
785         }
786     } else {
787         if (idc == UINT32_MAX) {
788             for (idc = 0; idc < aplic->num_harts; idc++) {
789                 riscv_aplic_idc_update(aplic, idc);
790             }
791         } else {
792             riscv_aplic_idc_update(aplic, idc);
793         }
794     }
795 
796     return;
797 
798 err:
799     qemu_log_mask(LOG_GUEST_ERROR,
800                   "%s: Invalid register write 0x%" HWADDR_PRIx "\n",
801                   __func__, addr);
802 }
803 
804 static const MemoryRegionOps riscv_aplic_ops = {
805     .read = riscv_aplic_read,
806     .write = riscv_aplic_write,
807     .endianness = DEVICE_LITTLE_ENDIAN,
808     .valid = {
809         .min_access_size = 4,
810         .max_access_size = 4
811     }
812 };
813 
814 static void riscv_aplic_realize(DeviceState *dev, Error **errp)
815 {
816     uint32_t i;
817     RISCVAPLICState *aplic = RISCV_APLIC(dev);
818 
819     if (!is_kvm_aia(aplic->msimode)) {
820         aplic->bitfield_words = (aplic->num_irqs + 31) >> 5;
821         aplic->sourcecfg = g_new0(uint32_t, aplic->num_irqs);
822         aplic->state = g_new0(uint32_t, aplic->num_irqs);
823         aplic->target = g_new0(uint32_t, aplic->num_irqs);
824         if (!aplic->msimode) {
825             for (i = 0; i < aplic->num_irqs; i++) {
826                 aplic->target[i] = 1;
827             }
828         }
829         aplic->idelivery = g_new0(uint32_t, aplic->num_harts);
830         aplic->iforce = g_new0(uint32_t, aplic->num_harts);
831         aplic->ithreshold = g_new0(uint32_t, aplic->num_harts);
832 
833         memory_region_init_io(&aplic->mmio, OBJECT(dev), &riscv_aplic_ops,
834                               aplic, TYPE_RISCV_APLIC, aplic->aperture_size);
835         sysbus_init_mmio(SYS_BUS_DEVICE(dev), &aplic->mmio);
836     }
837 
838     /*
839      * Only root APLICs have hardware IRQ lines. All non-root APLICs
840      * have IRQ lines delegated by their parent APLIC.
841      */
842     if (!aplic->parent) {
843         if (is_kvm_aia(aplic->msimode)) {
844             qdev_init_gpio_in(dev, riscv_kvm_aplic_request, aplic->num_irqs);
845         } else {
846             qdev_init_gpio_in(dev, riscv_aplic_request, aplic->num_irqs);
847         }
848     }
849 
850     /* Create output IRQ lines for non-MSI mode */
851     if (!aplic->msimode) {
852         aplic->external_irqs = g_malloc(sizeof(qemu_irq) * aplic->num_harts);
853         qdev_init_gpio_out(dev, aplic->external_irqs, aplic->num_harts);
854 
855         /* Claim the CPU interrupt to be triggered by this APLIC */
856         for (i = 0; i < aplic->num_harts; i++) {
857             RISCVCPU *cpu = RISCV_CPU(cpu_by_arch_id(aplic->hartid_base + i));
858             if (riscv_cpu_claim_interrupts(cpu,
859                 (aplic->mmode) ? MIP_MEIP : MIP_SEIP) < 0) {
860                 error_report("%s already claimed",
861                              (aplic->mmode) ? "MEIP" : "SEIP");
862                 exit(1);
863             }
864         }
865     }
866 
867     msi_nonbroken = true;
868 }
869 
870 static Property riscv_aplic_properties[] = {
871     DEFINE_PROP_UINT32("aperture-size", RISCVAPLICState, aperture_size, 0),
872     DEFINE_PROP_UINT32("hartid-base", RISCVAPLICState, hartid_base, 0),
873     DEFINE_PROP_UINT32("num-harts", RISCVAPLICState, num_harts, 0),
874     DEFINE_PROP_UINT32("iprio-mask", RISCVAPLICState, iprio_mask, 0),
875     DEFINE_PROP_UINT32("num-irqs", RISCVAPLICState, num_irqs, 0),
876     DEFINE_PROP_BOOL("msimode", RISCVAPLICState, msimode, 0),
877     DEFINE_PROP_BOOL("mmode", RISCVAPLICState, mmode, 0),
878     DEFINE_PROP_END_OF_LIST(),
879 };
880 
881 static const VMStateDescription vmstate_riscv_aplic = {
882     .name = "riscv_aplic",
883     .version_id = 1,
884     .minimum_version_id = 1,
885     .fields = (VMStateField[]) {
886             VMSTATE_UINT32(domaincfg, RISCVAPLICState),
887             VMSTATE_UINT32(mmsicfgaddr, RISCVAPLICState),
888             VMSTATE_UINT32(mmsicfgaddrH, RISCVAPLICState),
889             VMSTATE_UINT32(smsicfgaddr, RISCVAPLICState),
890             VMSTATE_UINT32(smsicfgaddrH, RISCVAPLICState),
891             VMSTATE_UINT32(genmsi, RISCVAPLICState),
892             VMSTATE_VARRAY_UINT32(sourcecfg, RISCVAPLICState,
893                                   num_irqs, 0,
894                                   vmstate_info_uint32, uint32_t),
895             VMSTATE_VARRAY_UINT32(state, RISCVAPLICState,
896                                   num_irqs, 0,
897                                   vmstate_info_uint32, uint32_t),
898             VMSTATE_VARRAY_UINT32(target, RISCVAPLICState,
899                                   num_irqs, 0,
900                                   vmstate_info_uint32, uint32_t),
901             VMSTATE_VARRAY_UINT32(idelivery, RISCVAPLICState,
902                                   num_harts, 0,
903                                   vmstate_info_uint32, uint32_t),
904             VMSTATE_VARRAY_UINT32(iforce, RISCVAPLICState,
905                                   num_harts, 0,
906                                   vmstate_info_uint32, uint32_t),
907             VMSTATE_VARRAY_UINT32(ithreshold, RISCVAPLICState,
908                                   num_harts, 0,
909                                   vmstate_info_uint32, uint32_t),
910             VMSTATE_END_OF_LIST()
911         }
912 };
913 
914 static void riscv_aplic_class_init(ObjectClass *klass, void *data)
915 {
916     DeviceClass *dc = DEVICE_CLASS(klass);
917 
918     device_class_set_props(dc, riscv_aplic_properties);
919     dc->realize = riscv_aplic_realize;
920     dc->vmsd = &vmstate_riscv_aplic;
921 }
922 
923 static const TypeInfo riscv_aplic_info = {
924     .name          = TYPE_RISCV_APLIC,
925     .parent        = TYPE_SYS_BUS_DEVICE,
926     .instance_size = sizeof(RISCVAPLICState),
927     .class_init    = riscv_aplic_class_init,
928 };
929 
930 static void riscv_aplic_register_types(void)
931 {
932     type_register_static(&riscv_aplic_info);
933 }
934 
935 type_init(riscv_aplic_register_types)
936 
937 /*
938  * Add a APLIC device to another APLIC device as child for
939  * interrupt delegation.
940  */
941 void riscv_aplic_add_child(DeviceState *parent, DeviceState *child)
942 {
943     RISCVAPLICState *caplic, *paplic;
944 
945     assert(parent && child);
946     caplic = RISCV_APLIC(child);
947     paplic = RISCV_APLIC(parent);
948 
949     assert(paplic->num_irqs == caplic->num_irqs);
950     assert(paplic->num_children <= QEMU_APLIC_MAX_CHILDREN);
951 
952     caplic->parent = paplic;
953     paplic->children[paplic->num_children] = caplic;
954     paplic->num_children++;
955 }
956 
957 /*
958  * Create APLIC device.
959  */
960 DeviceState *riscv_aplic_create(hwaddr addr, hwaddr size,
961     uint32_t hartid_base, uint32_t num_harts, uint32_t num_sources,
962     uint32_t iprio_bits, bool msimode, bool mmode, DeviceState *parent)
963 {
964     DeviceState *dev = qdev_new(TYPE_RISCV_APLIC);
965     uint32_t i;
966 
967     assert(num_harts < APLIC_MAX_IDC);
968     assert((APLIC_IDC_BASE + (num_harts * APLIC_IDC_SIZE)) <= size);
969     assert(num_sources < APLIC_MAX_SOURCE);
970     assert(APLIC_MIN_IPRIO_BITS <= iprio_bits);
971     assert(iprio_bits <= APLIC_MAX_IPRIO_BITS);
972 
973     qdev_prop_set_uint32(dev, "aperture-size", size);
974     qdev_prop_set_uint32(dev, "hartid-base", hartid_base);
975     qdev_prop_set_uint32(dev, "num-harts", num_harts);
976     qdev_prop_set_uint32(dev, "iprio-mask", ((1U << iprio_bits) - 1));
977     qdev_prop_set_uint32(dev, "num-irqs", num_sources + 1);
978     qdev_prop_set_bit(dev, "msimode", msimode);
979     qdev_prop_set_bit(dev, "mmode", mmode);
980 
981     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
982 
983     if (!is_kvm_aia(msimode)) {
984         sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, addr);
985     }
986 
987     if (parent) {
988         riscv_aplic_add_child(parent, dev);
989     }
990 
991     if (!msimode) {
992         for (i = 0; i < num_harts; i++) {
993             CPUState *cpu = cpu_by_arch_id(hartid_base + i);
994 
995             qdev_connect_gpio_out_named(dev, NULL, i,
996                                         qdev_get_gpio_in(DEVICE(cpu),
997                                             (mmode) ? IRQ_M_EXT : IRQ_S_EXT));
998         }
999     }
1000 
1001     return dev;
1002 }
1003