xref: /openbmc/qemu/hw/intc/riscv_aplic.c (revision b319ef15b899c31cad985e50640393483479a3db)
1 /*
2  * RISC-V APLIC (Advanced Platform Level Interrupt Controller)
3  *
4  * Copyright (c) 2021 Western Digital Corporation or its affiliates.
5  *
6  * This program is free software; you can redistribute it and/or modify it
7  * under the terms and conditions of the GNU General Public License,
8  * version 2 or later, as published by the Free Software Foundation.
9  *
10  * This program is distributed in the hope it will be useful, but WITHOUT
11  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
12  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
13  * more details.
14  *
15  * You should have received a copy of the GNU General Public License along with
16  * this program.  If not, see <http://www.gnu.org/licenses/>.
17  */
18 
19 #include "qemu/osdep.h"
20 #include "qapi/error.h"
21 #include "qemu/log.h"
22 #include "qemu/module.h"
23 #include "qemu/error-report.h"
24 #include "qemu/bswap.h"
25 #include "exec/address-spaces.h"
26 #include "hw/sysbus.h"
27 #include "hw/pci/msi.h"
28 #include "hw/boards.h"
29 #include "hw/qdev-properties.h"
30 #include "hw/intc/riscv_aplic.h"
31 #include "hw/irq.h"
32 #include "target/riscv/cpu.h"
33 #include "sysemu/sysemu.h"
34 #include "sysemu/kvm.h"
35 #include "sysemu/tcg.h"
36 #include "kvm/kvm_riscv.h"
37 #include "migration/vmstate.h"
38 
39 #define APLIC_MAX_IDC                  (1UL << 14)
40 #define APLIC_MAX_SOURCE               1024
41 #define APLIC_MIN_IPRIO_BITS           1
42 #define APLIC_MAX_IPRIO_BITS           8
43 #define APLIC_MAX_CHILDREN             1024
44 
45 #define APLIC_DOMAINCFG                0x0000
46 #define APLIC_DOMAINCFG_RDONLY         0x80000000
47 #define APLIC_DOMAINCFG_IE             (1 << 8)
48 #define APLIC_DOMAINCFG_DM             (1 << 2)
49 #define APLIC_DOMAINCFG_BE             (1 << 0)
50 
51 #define APLIC_SOURCECFG_BASE           0x0004
52 #define APLIC_SOURCECFG_D              (1 << 10)
53 #define APLIC_SOURCECFG_CHILDIDX_MASK  0x000003ff
54 #define APLIC_SOURCECFG_SM_MASK        0x00000007
55 #define APLIC_SOURCECFG_SM_INACTIVE    0x0
56 #define APLIC_SOURCECFG_SM_DETACH      0x1
57 #define APLIC_SOURCECFG_SM_EDGE_RISE   0x4
58 #define APLIC_SOURCECFG_SM_EDGE_FALL   0x5
59 #define APLIC_SOURCECFG_SM_LEVEL_HIGH  0x6
60 #define APLIC_SOURCECFG_SM_LEVEL_LOW   0x7
61 
62 #define APLIC_MMSICFGADDR              0x1bc0
63 #define APLIC_MMSICFGADDRH             0x1bc4
64 #define APLIC_SMSICFGADDR              0x1bc8
65 #define APLIC_SMSICFGADDRH             0x1bcc
66 
67 #define APLIC_xMSICFGADDRH_L           (1UL << 31)
68 #define APLIC_xMSICFGADDRH_HHXS_MASK   0x1f
69 #define APLIC_xMSICFGADDRH_HHXS_SHIFT  24
70 #define APLIC_xMSICFGADDRH_LHXS_MASK   0x7
71 #define APLIC_xMSICFGADDRH_LHXS_SHIFT  20
72 #define APLIC_xMSICFGADDRH_HHXW_MASK   0x7
73 #define APLIC_xMSICFGADDRH_HHXW_SHIFT  16
74 #define APLIC_xMSICFGADDRH_LHXW_MASK   0xf
75 #define APLIC_xMSICFGADDRH_LHXW_SHIFT  12
76 #define APLIC_xMSICFGADDRH_BAPPN_MASK  0xfff
77 
78 #define APLIC_xMSICFGADDR_PPN_SHIFT    12
79 
80 #define APLIC_xMSICFGADDR_PPN_HART(__lhxs) \
81     ((1UL << (__lhxs)) - 1)
82 
83 #define APLIC_xMSICFGADDR_PPN_LHX_MASK(__lhxw) \
84     ((1UL << (__lhxw)) - 1)
85 #define APLIC_xMSICFGADDR_PPN_LHX_SHIFT(__lhxs) \
86     ((__lhxs))
87 #define APLIC_xMSICFGADDR_PPN_LHX(__lhxw, __lhxs) \
88     (APLIC_xMSICFGADDR_PPN_LHX_MASK(__lhxw) << \
89      APLIC_xMSICFGADDR_PPN_LHX_SHIFT(__lhxs))
90 
91 #define APLIC_xMSICFGADDR_PPN_HHX_MASK(__hhxw) \
92     ((1UL << (__hhxw)) - 1)
93 #define APLIC_xMSICFGADDR_PPN_HHX_SHIFT(__hhxs) \
94     ((__hhxs) + APLIC_xMSICFGADDR_PPN_SHIFT)
95 #define APLIC_xMSICFGADDR_PPN_HHX(__hhxw, __hhxs) \
96     (APLIC_xMSICFGADDR_PPN_HHX_MASK(__hhxw) << \
97      APLIC_xMSICFGADDR_PPN_HHX_SHIFT(__hhxs))
98 
99 #define APLIC_xMSICFGADDRH_VALID_MASK   \
100     (APLIC_xMSICFGADDRH_L | \
101      (APLIC_xMSICFGADDRH_HHXS_MASK << APLIC_xMSICFGADDRH_HHXS_SHIFT) | \
102      (APLIC_xMSICFGADDRH_LHXS_MASK << APLIC_xMSICFGADDRH_LHXS_SHIFT) | \
103      (APLIC_xMSICFGADDRH_HHXW_MASK << APLIC_xMSICFGADDRH_HHXW_SHIFT) | \
104      (APLIC_xMSICFGADDRH_LHXW_MASK << APLIC_xMSICFGADDRH_LHXW_SHIFT) | \
105      APLIC_xMSICFGADDRH_BAPPN_MASK)
106 
107 #define APLIC_SETIP_BASE               0x1c00
108 #define APLIC_SETIPNUM                 0x1cdc
109 
110 #define APLIC_CLRIP_BASE               0x1d00
111 #define APLIC_CLRIPNUM                 0x1ddc
112 
113 #define APLIC_SETIE_BASE               0x1e00
114 #define APLIC_SETIENUM                 0x1edc
115 
116 #define APLIC_CLRIE_BASE               0x1f00
117 #define APLIC_CLRIENUM                 0x1fdc
118 
119 #define APLIC_SETIPNUM_LE              0x2000
120 #define APLIC_SETIPNUM_BE              0x2004
121 
122 #define APLIC_ISTATE_PENDING           (1U << 0)
123 #define APLIC_ISTATE_ENABLED           (1U << 1)
124 #define APLIC_ISTATE_ENPEND            (APLIC_ISTATE_ENABLED | \
125                                         APLIC_ISTATE_PENDING)
126 #define APLIC_ISTATE_INPUT             (1U << 8)
127 
128 #define APLIC_GENMSI                   0x3000
129 
130 #define APLIC_TARGET_BASE              0x3004
131 #define APLIC_TARGET_HART_IDX_SHIFT    18
132 #define APLIC_TARGET_HART_IDX_MASK     0x3fff
133 #define APLIC_TARGET_GUEST_IDX_SHIFT   12
134 #define APLIC_TARGET_GUEST_IDX_MASK    0x3f
135 #define APLIC_TARGET_IPRIO_MASK        0xff
136 #define APLIC_TARGET_EIID_MASK         0x7ff
137 
138 #define APLIC_IDC_BASE                 0x4000
139 #define APLIC_IDC_SIZE                 32
140 
141 #define APLIC_IDC_IDELIVERY            0x00
142 
143 #define APLIC_IDC_IFORCE               0x04
144 
145 #define APLIC_IDC_ITHRESHOLD           0x08
146 
147 #define APLIC_IDC_TOPI                 0x18
148 #define APLIC_IDC_TOPI_ID_SHIFT        16
149 #define APLIC_IDC_TOPI_ID_MASK         0x3ff
150 #define APLIC_IDC_TOPI_PRIO_MASK       0xff
151 
152 #define APLIC_IDC_CLAIMI               0x1c
153 
154 /*
155  * KVM AIA only supports APLIC MSI, fallback to QEMU emulation if we want to use
156  * APLIC Wired.
157  */
158 bool riscv_is_kvm_aia_aplic_imsic(bool msimode)
159 {
160     return kvm_irqchip_in_kernel() && msimode;
161 }
162 
163 bool riscv_use_emulated_aplic(bool msimode)
164 {
165 #ifdef CONFIG_KVM
166     if (tcg_enabled()) {
167         return true;
168     }
169 
170     if (!riscv_is_kvm_aia_aplic_imsic(msimode)) {
171         return true;
172     }
173 
174     return kvm_kernel_irqchip_split();
175 #else
176     return true;
177 #endif
178 }
179 
180 static bool riscv_aplic_irq_rectified_val(RISCVAPLICState *aplic,
181                                           uint32_t irq)
182 {
183     uint32_t sourcecfg, sm, raw_input, irq_inverted;
184 
185     if (!irq || aplic->num_irqs <= irq) {
186         return false;
187     }
188 
189     sourcecfg = aplic->sourcecfg[irq];
190     if (sourcecfg & APLIC_SOURCECFG_D) {
191         return false;
192     }
193 
194     sm = sourcecfg & APLIC_SOURCECFG_SM_MASK;
195     if (sm == APLIC_SOURCECFG_SM_INACTIVE) {
196         return false;
197     }
198 
199     raw_input = (aplic->state[irq] & APLIC_ISTATE_INPUT) ? 1 : 0;
200     irq_inverted = (sm == APLIC_SOURCECFG_SM_LEVEL_LOW ||
201                     sm == APLIC_SOURCECFG_SM_EDGE_FALL) ? 1 : 0;
202 
203     return !!(raw_input ^ irq_inverted);
204 }
205 
206 static uint32_t riscv_aplic_read_input_word(RISCVAPLICState *aplic,
207                                             uint32_t word)
208 {
209     uint32_t i, irq, rectified_val, ret = 0;
210 
211     for (i = 0; i < 32; i++) {
212         irq = word * 32 + i;
213 
214         rectified_val = riscv_aplic_irq_rectified_val(aplic, irq);
215         ret |= rectified_val << i;
216     }
217 
218     return ret;
219 }
220 
221 static uint32_t riscv_aplic_read_pending_word(RISCVAPLICState *aplic,
222                                               uint32_t word)
223 {
224     uint32_t i, irq, ret = 0;
225 
226     for (i = 0; i < 32; i++) {
227         irq = word * 32 + i;
228         if (!irq || aplic->num_irqs <= irq) {
229             continue;
230         }
231 
232         ret |= ((aplic->state[irq] & APLIC_ISTATE_PENDING) ? 1 : 0) << i;
233     }
234 
235     return ret;
236 }
237 
238 static void riscv_aplic_set_pending_raw(RISCVAPLICState *aplic,
239                                         uint32_t irq, bool pending)
240 {
241     if (pending) {
242         aplic->state[irq] |= APLIC_ISTATE_PENDING;
243     } else {
244         aplic->state[irq] &= ~APLIC_ISTATE_PENDING;
245     }
246 }
247 
248 static void riscv_aplic_set_pending(RISCVAPLICState *aplic,
249                                     uint32_t irq, bool pending)
250 {
251     uint32_t sourcecfg, sm;
252 
253     if ((irq <= 0) || (aplic->num_irqs <= irq)) {
254         return;
255     }
256 
257     sourcecfg = aplic->sourcecfg[irq];
258     if (sourcecfg & APLIC_SOURCECFG_D) {
259         return;
260     }
261 
262     sm = sourcecfg & APLIC_SOURCECFG_SM_MASK;
263     if (sm == APLIC_SOURCECFG_SM_INACTIVE) {
264         return;
265     }
266 
267     if ((sm == APLIC_SOURCECFG_SM_LEVEL_HIGH) ||
268         (sm == APLIC_SOURCECFG_SM_LEVEL_LOW)) {
269         if (!aplic->msimode) {
270             return;
271         }
272         if (aplic->msimode && !pending) {
273             goto noskip_write_pending;
274         }
275         if ((aplic->state[irq] & APLIC_ISTATE_INPUT) &&
276             (sm == APLIC_SOURCECFG_SM_LEVEL_LOW)) {
277             return;
278         }
279         if (!(aplic->state[irq] & APLIC_ISTATE_INPUT) &&
280             (sm == APLIC_SOURCECFG_SM_LEVEL_HIGH)) {
281             return;
282         }
283     }
284 
285 noskip_write_pending:
286     riscv_aplic_set_pending_raw(aplic, irq, pending);
287 }
288 
289 static void riscv_aplic_set_pending_word(RISCVAPLICState *aplic,
290                                          uint32_t word, uint32_t value,
291                                          bool pending)
292 {
293     uint32_t i, irq;
294 
295     for (i = 0; i < 32; i++) {
296         irq = word * 32 + i;
297         if (!irq || aplic->num_irqs <= irq) {
298             continue;
299         }
300 
301         if (value & (1U << i)) {
302             riscv_aplic_set_pending(aplic, irq, pending);
303         }
304     }
305 }
306 
307 static uint32_t riscv_aplic_read_enabled_word(RISCVAPLICState *aplic,
308                                               int word)
309 {
310     uint32_t i, irq, ret = 0;
311 
312     for (i = 0; i < 32; i++) {
313         irq = word * 32 + i;
314         if (!irq || aplic->num_irqs <= irq) {
315             continue;
316         }
317 
318         ret |= ((aplic->state[irq] & APLIC_ISTATE_ENABLED) ? 1 : 0) << i;
319     }
320 
321     return ret;
322 }
323 
324 static void riscv_aplic_set_enabled_raw(RISCVAPLICState *aplic,
325                                         uint32_t irq, bool enabled)
326 {
327     if (enabled) {
328         aplic->state[irq] |= APLIC_ISTATE_ENABLED;
329     } else {
330         aplic->state[irq] &= ~APLIC_ISTATE_ENABLED;
331     }
332 }
333 
334 static void riscv_aplic_set_enabled(RISCVAPLICState *aplic,
335                                     uint32_t irq, bool enabled)
336 {
337     uint32_t sourcecfg, sm;
338 
339     if ((irq <= 0) || (aplic->num_irqs <= irq)) {
340         return;
341     }
342 
343     sourcecfg = aplic->sourcecfg[irq];
344     if (sourcecfg & APLIC_SOURCECFG_D) {
345         return;
346     }
347 
348     sm = sourcecfg & APLIC_SOURCECFG_SM_MASK;
349     if (sm == APLIC_SOURCECFG_SM_INACTIVE) {
350         return;
351     }
352 
353     riscv_aplic_set_enabled_raw(aplic, irq, enabled);
354 }
355 
356 static void riscv_aplic_set_enabled_word(RISCVAPLICState *aplic,
357                                          uint32_t word, uint32_t value,
358                                          bool enabled)
359 {
360     uint32_t i, irq;
361 
362     for (i = 0; i < 32; i++) {
363         irq = word * 32 + i;
364         if (!irq || aplic->num_irqs <= irq) {
365             continue;
366         }
367 
368         if (value & (1U << i)) {
369             riscv_aplic_set_enabled(aplic, irq, enabled);
370         }
371     }
372 }
373 
374 static void riscv_aplic_msi_send(RISCVAPLICState *aplic,
375                                  uint32_t hart_idx, uint32_t guest_idx,
376                                  uint32_t eiid)
377 {
378     uint64_t addr;
379     MemTxResult result;
380     RISCVAPLICState *aplic_m;
381     uint32_t lhxs, lhxw, hhxs, hhxw, group_idx, msicfgaddr, msicfgaddrH;
382 
383     aplic_m = aplic;
384     while (aplic_m && !aplic_m->mmode) {
385         aplic_m = aplic_m->parent;
386     }
387     if (!aplic_m) {
388         qemu_log_mask(LOG_GUEST_ERROR, "%s: m-level APLIC not found\n",
389                       __func__);
390         return;
391     }
392 
393     if (aplic->mmode) {
394         msicfgaddr = aplic_m->mmsicfgaddr;
395         msicfgaddrH = aplic_m->mmsicfgaddrH;
396     } else {
397         msicfgaddr = aplic_m->smsicfgaddr;
398         msicfgaddrH = aplic_m->smsicfgaddrH;
399     }
400 
401     lhxs = (msicfgaddrH >> APLIC_xMSICFGADDRH_LHXS_SHIFT) &
402             APLIC_xMSICFGADDRH_LHXS_MASK;
403     lhxw = (msicfgaddrH >> APLIC_xMSICFGADDRH_LHXW_SHIFT) &
404             APLIC_xMSICFGADDRH_LHXW_MASK;
405     hhxs = (msicfgaddrH >> APLIC_xMSICFGADDRH_HHXS_SHIFT) &
406             APLIC_xMSICFGADDRH_HHXS_MASK;
407     hhxw = (msicfgaddrH >> APLIC_xMSICFGADDRH_HHXW_SHIFT) &
408             APLIC_xMSICFGADDRH_HHXW_MASK;
409 
410     group_idx = hart_idx >> lhxw;
411     hart_idx &= APLIC_xMSICFGADDR_PPN_LHX_MASK(lhxw);
412 
413     addr = msicfgaddr;
414     addr |= ((uint64_t)(msicfgaddrH & APLIC_xMSICFGADDRH_BAPPN_MASK)) << 32;
415     addr |= ((uint64_t)(group_idx & APLIC_xMSICFGADDR_PPN_HHX_MASK(hhxw))) <<
416              APLIC_xMSICFGADDR_PPN_HHX_SHIFT(hhxs);
417     addr |= ((uint64_t)(hart_idx & APLIC_xMSICFGADDR_PPN_LHX_MASK(lhxw))) <<
418              APLIC_xMSICFGADDR_PPN_LHX_SHIFT(lhxs);
419     addr |= (uint64_t)(guest_idx & APLIC_xMSICFGADDR_PPN_HART(lhxs));
420     addr <<= APLIC_xMSICFGADDR_PPN_SHIFT;
421 
422     address_space_stl_le(&address_space_memory, addr,
423                          eiid, MEMTXATTRS_UNSPECIFIED, &result);
424     if (result != MEMTX_OK) {
425         qemu_log_mask(LOG_GUEST_ERROR, "%s: MSI write failed for "
426                       "hart_index=%d guest_index=%d eiid=%d\n",
427                       __func__, hart_idx, guest_idx, eiid);
428     }
429 }
430 
431 static void riscv_aplic_msi_irq_update(RISCVAPLICState *aplic, uint32_t irq)
432 {
433     uint32_t hart_idx, guest_idx, eiid;
434 
435     if (!aplic->msimode || (aplic->num_irqs <= irq) ||
436         !(aplic->domaincfg & APLIC_DOMAINCFG_IE)) {
437         return;
438     }
439 
440     if ((aplic->state[irq] & APLIC_ISTATE_ENPEND) != APLIC_ISTATE_ENPEND) {
441         return;
442     }
443 
444     riscv_aplic_set_pending_raw(aplic, irq, false);
445 
446     hart_idx = aplic->target[irq] >> APLIC_TARGET_HART_IDX_SHIFT;
447     hart_idx &= APLIC_TARGET_HART_IDX_MASK;
448     if (aplic->mmode) {
449         /* M-level APLIC ignores guest_index */
450         guest_idx = 0;
451     } else {
452         guest_idx = aplic->target[irq] >> APLIC_TARGET_GUEST_IDX_SHIFT;
453         guest_idx &= APLIC_TARGET_GUEST_IDX_MASK;
454     }
455     eiid = aplic->target[irq] & APLIC_TARGET_EIID_MASK;
456     riscv_aplic_msi_send(aplic, hart_idx, guest_idx, eiid);
457 }
458 
459 static uint32_t riscv_aplic_idc_topi(RISCVAPLICState *aplic, uint32_t idc)
460 {
461     uint32_t best_irq, best_iprio;
462     uint32_t irq, iprio, ihartidx, ithres;
463 
464     if (aplic->num_harts <= idc) {
465         return 0;
466     }
467 
468     ithres = aplic->ithreshold[idc];
469     best_irq = best_iprio = UINT32_MAX;
470     for (irq = 1; irq < aplic->num_irqs; irq++) {
471         if ((aplic->state[irq] & APLIC_ISTATE_ENPEND) !=
472             APLIC_ISTATE_ENPEND) {
473             continue;
474         }
475 
476         ihartidx = aplic->target[irq] >> APLIC_TARGET_HART_IDX_SHIFT;
477         ihartidx &= APLIC_TARGET_HART_IDX_MASK;
478         if (ihartidx != idc) {
479             continue;
480         }
481 
482         iprio = aplic->target[irq] & aplic->iprio_mask;
483         if (ithres && iprio >= ithres) {
484             continue;
485         }
486 
487         if (iprio < best_iprio) {
488             best_irq = irq;
489             best_iprio = iprio;
490         }
491     }
492 
493     if (best_irq < aplic->num_irqs && best_iprio <= aplic->iprio_mask) {
494         return (best_irq << APLIC_IDC_TOPI_ID_SHIFT) | best_iprio;
495     }
496 
497     return 0;
498 }
499 
500 static void riscv_aplic_idc_update(RISCVAPLICState *aplic, uint32_t idc)
501 {
502     uint32_t topi;
503 
504     if (aplic->msimode || aplic->num_harts <= idc) {
505         return;
506     }
507 
508     topi = riscv_aplic_idc_topi(aplic, idc);
509     if ((aplic->domaincfg & APLIC_DOMAINCFG_IE) &&
510         aplic->idelivery[idc] &&
511         (aplic->iforce[idc] || topi)) {
512         qemu_irq_raise(aplic->external_irqs[idc]);
513     } else {
514         qemu_irq_lower(aplic->external_irqs[idc]);
515     }
516 }
517 
518 static uint32_t riscv_aplic_idc_claimi(RISCVAPLICState *aplic, uint32_t idc)
519 {
520     uint32_t irq, state, sm, topi = riscv_aplic_idc_topi(aplic, idc);
521 
522     if (!topi) {
523         aplic->iforce[idc] = 0;
524         riscv_aplic_idc_update(aplic, idc);
525         return 0;
526     }
527 
528     irq = (topi >> APLIC_IDC_TOPI_ID_SHIFT) & APLIC_IDC_TOPI_ID_MASK;
529     sm = aplic->sourcecfg[irq] & APLIC_SOURCECFG_SM_MASK;
530     state = aplic->state[irq];
531     riscv_aplic_set_pending_raw(aplic, irq, false);
532     if ((sm == APLIC_SOURCECFG_SM_LEVEL_HIGH) &&
533         (state & APLIC_ISTATE_INPUT)) {
534         riscv_aplic_set_pending_raw(aplic, irq, true);
535     } else if ((sm == APLIC_SOURCECFG_SM_LEVEL_LOW) &&
536                !(state & APLIC_ISTATE_INPUT)) {
537         riscv_aplic_set_pending_raw(aplic, irq, true);
538     }
539     riscv_aplic_idc_update(aplic, idc);
540 
541     return topi;
542 }
543 
544 static void riscv_aplic_request(void *opaque, int irq, int level)
545 {
546     bool update = false;
547     RISCVAPLICState *aplic = opaque;
548     uint32_t sourcecfg, childidx, state, idc;
549 
550     assert((0 < irq) && (irq < aplic->num_irqs));
551 
552     sourcecfg = aplic->sourcecfg[irq];
553     if (sourcecfg & APLIC_SOURCECFG_D) {
554         childidx = sourcecfg & APLIC_SOURCECFG_CHILDIDX_MASK;
555         if (childidx < aplic->num_children) {
556             riscv_aplic_request(aplic->children[childidx], irq, level);
557         }
558         return;
559     }
560 
561     state = aplic->state[irq];
562     switch (sourcecfg & APLIC_SOURCECFG_SM_MASK) {
563     case APLIC_SOURCECFG_SM_EDGE_RISE:
564         if ((level > 0) && !(state & APLIC_ISTATE_INPUT) &&
565             !(state & APLIC_ISTATE_PENDING)) {
566             riscv_aplic_set_pending_raw(aplic, irq, true);
567             update = true;
568         }
569         break;
570     case APLIC_SOURCECFG_SM_EDGE_FALL:
571         if ((level <= 0) && (state & APLIC_ISTATE_INPUT) &&
572             !(state & APLIC_ISTATE_PENDING)) {
573             riscv_aplic_set_pending_raw(aplic, irq, true);
574             update = true;
575         }
576         break;
577     case APLIC_SOURCECFG_SM_LEVEL_HIGH:
578         if ((level > 0) && !(state & APLIC_ISTATE_PENDING)) {
579             riscv_aplic_set_pending_raw(aplic, irq, true);
580             update = true;
581         }
582         break;
583     case APLIC_SOURCECFG_SM_LEVEL_LOW:
584         if ((level <= 0) && !(state & APLIC_ISTATE_PENDING)) {
585             riscv_aplic_set_pending_raw(aplic, irq, true);
586             update = true;
587         }
588         break;
589     default:
590         break;
591     }
592 
593     if (level <= 0) {
594         aplic->state[irq] &= ~APLIC_ISTATE_INPUT;
595     } else {
596         aplic->state[irq] |= APLIC_ISTATE_INPUT;
597     }
598 
599     if (update) {
600         if (aplic->msimode) {
601             riscv_aplic_msi_irq_update(aplic, irq);
602         } else {
603             idc = aplic->target[irq] >> APLIC_TARGET_HART_IDX_SHIFT;
604             idc &= APLIC_TARGET_HART_IDX_MASK;
605             riscv_aplic_idc_update(aplic, idc);
606         }
607     }
608 }
609 
610 static uint64_t riscv_aplic_read(void *opaque, hwaddr addr, unsigned size)
611 {
612     uint32_t irq, word, idc;
613     RISCVAPLICState *aplic = opaque;
614 
615     /* Reads must be 4 byte words */
616     if ((addr & 0x3) != 0) {
617         goto err;
618     }
619 
620     if (addr == APLIC_DOMAINCFG) {
621         return APLIC_DOMAINCFG_RDONLY | aplic->domaincfg |
622                (aplic->msimode ? APLIC_DOMAINCFG_DM : 0);
623     } else if ((APLIC_SOURCECFG_BASE <= addr) &&
624             (addr < (APLIC_SOURCECFG_BASE + (aplic->num_irqs - 1) * 4))) {
625         irq  = ((addr - APLIC_SOURCECFG_BASE) >> 2) + 1;
626         return aplic->sourcecfg[irq];
627     } else if (aplic->mmode && aplic->msimode &&
628                (addr == APLIC_MMSICFGADDR)) {
629         return aplic->mmsicfgaddr;
630     } else if (aplic->mmode && aplic->msimode &&
631                (addr == APLIC_MMSICFGADDRH)) {
632         return aplic->mmsicfgaddrH;
633     } else if (aplic->mmode && aplic->msimode &&
634                (addr == APLIC_SMSICFGADDR)) {
635         /*
636          * Registers SMSICFGADDR and SMSICFGADDRH are implemented only if:
637          * (a) the interrupt domain is at machine level
638          * (b) the domain's harts implement supervisor mode
639          * (c) the domain has one or more child supervisor-level domains
640          *     that support MSI delivery mode (domaincfg.DM is not read-
641          *     only zero in at least one of the supervisor-level child
642          * domains).
643          */
644         return (aplic->num_children) ? aplic->smsicfgaddr : 0;
645     } else if (aplic->mmode && aplic->msimode &&
646                (addr == APLIC_SMSICFGADDRH)) {
647         return (aplic->num_children) ? aplic->smsicfgaddrH : 0;
648     } else if ((APLIC_SETIP_BASE <= addr) &&
649             (addr < (APLIC_SETIP_BASE + aplic->bitfield_words * 4))) {
650         word = (addr - APLIC_SETIP_BASE) >> 2;
651         return riscv_aplic_read_pending_word(aplic, word);
652     } else if (addr == APLIC_SETIPNUM) {
653         return 0;
654     } else if ((APLIC_CLRIP_BASE <= addr) &&
655             (addr < (APLIC_CLRIP_BASE + aplic->bitfield_words * 4))) {
656         word = (addr - APLIC_CLRIP_BASE) >> 2;
657         return riscv_aplic_read_input_word(aplic, word);
658     } else if (addr == APLIC_CLRIPNUM) {
659         return 0;
660     } else if ((APLIC_SETIE_BASE <= addr) &&
661             (addr < (APLIC_SETIE_BASE + aplic->bitfield_words * 4))) {
662         word = (addr - APLIC_SETIE_BASE) >> 2;
663         return riscv_aplic_read_enabled_word(aplic, word);
664     } else if (addr == APLIC_SETIENUM) {
665         return 0;
666     } else if ((APLIC_CLRIE_BASE <= addr) &&
667             (addr < (APLIC_CLRIE_BASE + aplic->bitfield_words * 4))) {
668         return 0;
669     } else if (addr == APLIC_CLRIENUM) {
670         return 0;
671     } else if (addr == APLIC_SETIPNUM_LE) {
672         return 0;
673     } else if (addr == APLIC_SETIPNUM_BE) {
674         return 0;
675     } else if (addr == APLIC_GENMSI) {
676         return (aplic->msimode) ? aplic->genmsi : 0;
677     } else if ((APLIC_TARGET_BASE <= addr) &&
678             (addr < (APLIC_TARGET_BASE + (aplic->num_irqs - 1) * 4))) {
679         irq = ((addr - APLIC_TARGET_BASE) >> 2) + 1;
680         return aplic->target[irq];
681     } else if (!aplic->msimode && (APLIC_IDC_BASE <= addr) &&
682             (addr < (APLIC_IDC_BASE + aplic->num_harts * APLIC_IDC_SIZE))) {
683         idc = (addr - APLIC_IDC_BASE) / APLIC_IDC_SIZE;
684         switch (addr - (APLIC_IDC_BASE + idc * APLIC_IDC_SIZE)) {
685         case APLIC_IDC_IDELIVERY:
686             return aplic->idelivery[idc];
687         case APLIC_IDC_IFORCE:
688             return aplic->iforce[idc];
689         case APLIC_IDC_ITHRESHOLD:
690             return aplic->ithreshold[idc];
691         case APLIC_IDC_TOPI:
692             return riscv_aplic_idc_topi(aplic, idc);
693         case APLIC_IDC_CLAIMI:
694             return riscv_aplic_idc_claimi(aplic, idc);
695         default:
696             goto err;
697         };
698     }
699 
700 err:
701     qemu_log_mask(LOG_GUEST_ERROR,
702                   "%s: Invalid register read 0x%" HWADDR_PRIx "\n",
703                   __func__, addr);
704     return 0;
705 }
706 
707 static void riscv_aplic_write(void *opaque, hwaddr addr, uint64_t value,
708         unsigned size)
709 {
710     RISCVAPLICState *aplic = opaque;
711     uint32_t irq, word, idc = UINT32_MAX;
712 
713     /* Writes must be 4 byte words */
714     if ((addr & 0x3) != 0) {
715         goto err;
716     }
717 
718     if (addr == APLIC_DOMAINCFG) {
719         /* Only IE bit writable at the moment */
720         value &= APLIC_DOMAINCFG_IE;
721         aplic->domaincfg = value;
722     } else if ((APLIC_SOURCECFG_BASE <= addr) &&
723             (addr < (APLIC_SOURCECFG_BASE + (aplic->num_irqs - 1) * 4))) {
724         irq  = ((addr - APLIC_SOURCECFG_BASE) >> 2) + 1;
725         if (!aplic->num_children && (value & APLIC_SOURCECFG_D)) {
726             value = 0;
727         }
728         if (value & APLIC_SOURCECFG_D) {
729             value &= (APLIC_SOURCECFG_D | APLIC_SOURCECFG_CHILDIDX_MASK);
730         } else {
731             value &= (APLIC_SOURCECFG_D | APLIC_SOURCECFG_SM_MASK);
732         }
733         aplic->sourcecfg[irq] = value;
734         if ((aplic->sourcecfg[irq] & APLIC_SOURCECFG_D) ||
735             (aplic->sourcecfg[irq] == 0)) {
736             riscv_aplic_set_pending_raw(aplic, irq, false);
737             riscv_aplic_set_enabled_raw(aplic, irq, false);
738         } else {
739             if (riscv_aplic_irq_rectified_val(aplic, irq)) {
740                 riscv_aplic_set_pending_raw(aplic, irq, true);
741             }
742         }
743     } else if (aplic->mmode && aplic->msimode &&
744                (addr == APLIC_MMSICFGADDR)) {
745         if (!(aplic->mmsicfgaddrH & APLIC_xMSICFGADDRH_L)) {
746             aplic->mmsicfgaddr = value;
747         }
748     } else if (aplic->mmode && aplic->msimode &&
749                (addr == APLIC_MMSICFGADDRH)) {
750         if (!(aplic->mmsicfgaddrH & APLIC_xMSICFGADDRH_L)) {
751             aplic->mmsicfgaddrH = value & APLIC_xMSICFGADDRH_VALID_MASK;
752         }
753     } else if (aplic->mmode && aplic->msimode &&
754                (addr == APLIC_SMSICFGADDR)) {
755         /*
756          * Registers SMSICFGADDR and SMSICFGADDRH are implemented only if:
757          * (a) the interrupt domain is at machine level
758          * (b) the domain's harts implement supervisor mode
759          * (c) the domain has one or more child supervisor-level domains
760          *     that support MSI delivery mode (domaincfg.DM is not read-
761          *     only zero in at least one of the supervisor-level child
762          * domains).
763          */
764         if (aplic->num_children &&
765             !(aplic->mmsicfgaddrH & APLIC_xMSICFGADDRH_L)) {
766             aplic->smsicfgaddr = value;
767         }
768     } else if (aplic->mmode && aplic->msimode &&
769                (addr == APLIC_SMSICFGADDRH)) {
770         if (aplic->num_children &&
771             !(aplic->mmsicfgaddrH & APLIC_xMSICFGADDRH_L)) {
772             aplic->smsicfgaddrH = value & APLIC_xMSICFGADDRH_VALID_MASK;
773         }
774     } else if ((APLIC_SETIP_BASE <= addr) &&
775             (addr < (APLIC_SETIP_BASE + aplic->bitfield_words * 4))) {
776         word = (addr - APLIC_SETIP_BASE) >> 2;
777         riscv_aplic_set_pending_word(aplic, word, value, true);
778     } else if (addr == APLIC_SETIPNUM) {
779         riscv_aplic_set_pending(aplic, value, true);
780     } else if ((APLIC_CLRIP_BASE <= addr) &&
781             (addr < (APLIC_CLRIP_BASE + aplic->bitfield_words * 4))) {
782         word = (addr - APLIC_CLRIP_BASE) >> 2;
783         riscv_aplic_set_pending_word(aplic, word, value, false);
784     } else if (addr == APLIC_CLRIPNUM) {
785         riscv_aplic_set_pending(aplic, value, false);
786     } else if ((APLIC_SETIE_BASE <= addr) &&
787             (addr < (APLIC_SETIE_BASE + aplic->bitfield_words * 4))) {
788         word = (addr - APLIC_SETIE_BASE) >> 2;
789         riscv_aplic_set_enabled_word(aplic, word, value, true);
790     } else if (addr == APLIC_SETIENUM) {
791         riscv_aplic_set_enabled(aplic, value, true);
792     } else if ((APLIC_CLRIE_BASE <= addr) &&
793             (addr < (APLIC_CLRIE_BASE + aplic->bitfield_words * 4))) {
794         word = (addr - APLIC_CLRIE_BASE) >> 2;
795         riscv_aplic_set_enabled_word(aplic, word, value, false);
796     } else if (addr == APLIC_CLRIENUM) {
797         riscv_aplic_set_enabled(aplic, value, false);
798     } else if (addr == APLIC_SETIPNUM_LE) {
799         riscv_aplic_set_pending(aplic, value, true);
800     } else if (addr == APLIC_SETIPNUM_BE) {
801         riscv_aplic_set_pending(aplic, bswap32(value), true);
802     } else if (addr == APLIC_GENMSI) {
803         if (aplic->msimode) {
804             aplic->genmsi = value & ~(APLIC_TARGET_GUEST_IDX_MASK <<
805                                       APLIC_TARGET_GUEST_IDX_SHIFT);
806             riscv_aplic_msi_send(aplic,
807                                  value >> APLIC_TARGET_HART_IDX_SHIFT,
808                                  0,
809                                  value & APLIC_TARGET_EIID_MASK);
810         }
811     } else if ((APLIC_TARGET_BASE <= addr) &&
812             (addr < (APLIC_TARGET_BASE + (aplic->num_irqs - 1) * 4))) {
813         irq = ((addr - APLIC_TARGET_BASE) >> 2) + 1;
814         if (aplic->msimode) {
815             aplic->target[irq] = value;
816         } else {
817             aplic->target[irq] = (value & ~APLIC_TARGET_IPRIO_MASK) |
818                                  ((value & aplic->iprio_mask) ?
819                                   (value & aplic->iprio_mask) : 1);
820         }
821     } else if (!aplic->msimode && (APLIC_IDC_BASE <= addr) &&
822             (addr < (APLIC_IDC_BASE + aplic->num_harts * APLIC_IDC_SIZE))) {
823         idc = (addr - APLIC_IDC_BASE) / APLIC_IDC_SIZE;
824         switch (addr - (APLIC_IDC_BASE + idc * APLIC_IDC_SIZE)) {
825         case APLIC_IDC_IDELIVERY:
826             aplic->idelivery[idc] = value & 0x1;
827             break;
828         case APLIC_IDC_IFORCE:
829             aplic->iforce[idc] = value & 0x1;
830             break;
831         case APLIC_IDC_ITHRESHOLD:
832             aplic->ithreshold[idc] = value & aplic->iprio_mask;
833             break;
834         default:
835             goto err;
836         };
837     } else {
838         goto err;
839     }
840 
841     if (aplic->msimode) {
842         for (irq = 1; irq < aplic->num_irqs; irq++) {
843             riscv_aplic_msi_irq_update(aplic, irq);
844         }
845     } else {
846         if (idc == UINT32_MAX) {
847             for (idc = 0; idc < aplic->num_harts; idc++) {
848                 riscv_aplic_idc_update(aplic, idc);
849             }
850         } else {
851             riscv_aplic_idc_update(aplic, idc);
852         }
853     }
854 
855     return;
856 
857 err:
858     qemu_log_mask(LOG_GUEST_ERROR,
859                   "%s: Invalid register write 0x%" HWADDR_PRIx "\n",
860                   __func__, addr);
861 }
862 
863 static const MemoryRegionOps riscv_aplic_ops = {
864     .read = riscv_aplic_read,
865     .write = riscv_aplic_write,
866     .endianness = DEVICE_LITTLE_ENDIAN,
867     .valid = {
868         .min_access_size = 4,
869         .max_access_size = 4
870     }
871 };
872 
873 static void riscv_aplic_realize(DeviceState *dev, Error **errp)
874 {
875     uint32_t i;
876     RISCVAPLICState *aplic = RISCV_APLIC(dev);
877 
878     if (riscv_use_emulated_aplic(aplic->msimode)) {
879         aplic->bitfield_words = (aplic->num_irqs + 31) >> 5;
880         aplic->sourcecfg = g_new0(uint32_t, aplic->num_irqs);
881         aplic->state = g_new0(uint32_t, aplic->num_irqs);
882         aplic->target = g_new0(uint32_t, aplic->num_irqs);
883         if (!aplic->msimode) {
884             for (i = 0; i < aplic->num_irqs; i++) {
885                 aplic->target[i] = 1;
886             }
887         }
888         aplic->idelivery = g_new0(uint32_t, aplic->num_harts);
889         aplic->iforce = g_new0(uint32_t, aplic->num_harts);
890         aplic->ithreshold = g_new0(uint32_t, aplic->num_harts);
891 
892         memory_region_init_io(&aplic->mmio, OBJECT(dev), &riscv_aplic_ops,
893                               aplic, TYPE_RISCV_APLIC, aplic->aperture_size);
894         sysbus_init_mmio(SYS_BUS_DEVICE(dev), &aplic->mmio);
895     }
896 
897     /*
898      * Only root APLICs have hardware IRQ lines. All non-root APLICs
899      * have IRQ lines delegated by their parent APLIC.
900      */
901     if (!aplic->parent) {
902         if (kvm_enabled() && !riscv_use_emulated_aplic(aplic->msimode)) {
903             qdev_init_gpio_in(dev, riscv_kvm_aplic_request, aplic->num_irqs);
904         } else {
905             qdev_init_gpio_in(dev, riscv_aplic_request, aplic->num_irqs);
906         }
907     }
908 
909     /* Create output IRQ lines for non-MSI mode */
910     if (!aplic->msimode) {
911         aplic->external_irqs = g_malloc(sizeof(qemu_irq) * aplic->num_harts);
912         qdev_init_gpio_out(dev, aplic->external_irqs, aplic->num_harts);
913 
914         /* Claim the CPU interrupt to be triggered by this APLIC */
915         for (i = 0; i < aplic->num_harts; i++) {
916             RISCVCPU *cpu = RISCV_CPU(cpu_by_arch_id(aplic->hartid_base + i));
917             if (riscv_cpu_claim_interrupts(cpu,
918                 (aplic->mmode) ? MIP_MEIP : MIP_SEIP) < 0) {
919                 error_report("%s already claimed",
920                              (aplic->mmode) ? "MEIP" : "SEIP");
921                 exit(1);
922             }
923         }
924     }
925 
926     msi_nonbroken = true;
927 }
928 
929 static const Property riscv_aplic_properties[] = {
930     DEFINE_PROP_UINT32("aperture-size", RISCVAPLICState, aperture_size, 0),
931     DEFINE_PROP_UINT32("hartid-base", RISCVAPLICState, hartid_base, 0),
932     DEFINE_PROP_UINT32("num-harts", RISCVAPLICState, num_harts, 0),
933     DEFINE_PROP_UINT32("iprio-mask", RISCVAPLICState, iprio_mask, 0),
934     DEFINE_PROP_UINT32("num-irqs", RISCVAPLICState, num_irqs, 0),
935     DEFINE_PROP_BOOL("msimode", RISCVAPLICState, msimode, 0),
936     DEFINE_PROP_BOOL("mmode", RISCVAPLICState, mmode, 0),
937     DEFINE_PROP_END_OF_LIST(),
938 };
939 
940 static const VMStateDescription vmstate_riscv_aplic = {
941     .name = "riscv_aplic",
942     .version_id = 1,
943     .minimum_version_id = 1,
944     .fields = (const VMStateField[]) {
945             VMSTATE_UINT32(domaincfg, RISCVAPLICState),
946             VMSTATE_UINT32(mmsicfgaddr, RISCVAPLICState),
947             VMSTATE_UINT32(mmsicfgaddrH, RISCVAPLICState),
948             VMSTATE_UINT32(smsicfgaddr, RISCVAPLICState),
949             VMSTATE_UINT32(smsicfgaddrH, RISCVAPLICState),
950             VMSTATE_UINT32(genmsi, RISCVAPLICState),
951             VMSTATE_VARRAY_UINT32(sourcecfg, RISCVAPLICState,
952                                   num_irqs, 0,
953                                   vmstate_info_uint32, uint32_t),
954             VMSTATE_VARRAY_UINT32(state, RISCVAPLICState,
955                                   num_irqs, 0,
956                                   vmstate_info_uint32, uint32_t),
957             VMSTATE_VARRAY_UINT32(target, RISCVAPLICState,
958                                   num_irqs, 0,
959                                   vmstate_info_uint32, uint32_t),
960             VMSTATE_VARRAY_UINT32(idelivery, RISCVAPLICState,
961                                   num_harts, 0,
962                                   vmstate_info_uint32, uint32_t),
963             VMSTATE_VARRAY_UINT32(iforce, RISCVAPLICState,
964                                   num_harts, 0,
965                                   vmstate_info_uint32, uint32_t),
966             VMSTATE_VARRAY_UINT32(ithreshold, RISCVAPLICState,
967                                   num_harts, 0,
968                                   vmstate_info_uint32, uint32_t),
969             VMSTATE_END_OF_LIST()
970         }
971 };
972 
973 static void riscv_aplic_class_init(ObjectClass *klass, void *data)
974 {
975     DeviceClass *dc = DEVICE_CLASS(klass);
976 
977     device_class_set_props(dc, riscv_aplic_properties);
978     dc->realize = riscv_aplic_realize;
979     dc->vmsd = &vmstate_riscv_aplic;
980 }
981 
982 static const TypeInfo riscv_aplic_info = {
983     .name          = TYPE_RISCV_APLIC,
984     .parent        = TYPE_SYS_BUS_DEVICE,
985     .instance_size = sizeof(RISCVAPLICState),
986     .class_init    = riscv_aplic_class_init,
987 };
988 
989 static void riscv_aplic_register_types(void)
990 {
991     type_register_static(&riscv_aplic_info);
992 }
993 
994 type_init(riscv_aplic_register_types)
995 
996 /*
997  * Add a APLIC device to another APLIC device as child for
998  * interrupt delegation.
999  */
1000 void riscv_aplic_add_child(DeviceState *parent, DeviceState *child)
1001 {
1002     RISCVAPLICState *caplic, *paplic;
1003 
1004     assert(parent && child);
1005     caplic = RISCV_APLIC(child);
1006     paplic = RISCV_APLIC(parent);
1007 
1008     assert(paplic->num_irqs == caplic->num_irqs);
1009     assert(paplic->num_children <= QEMU_APLIC_MAX_CHILDREN);
1010 
1011     caplic->parent = paplic;
1012     paplic->children[paplic->num_children] = caplic;
1013     paplic->num_children++;
1014 }
1015 
1016 /*
1017  * Create APLIC device.
1018  */
1019 DeviceState *riscv_aplic_create(hwaddr addr, hwaddr size,
1020     uint32_t hartid_base, uint32_t num_harts, uint32_t num_sources,
1021     uint32_t iprio_bits, bool msimode, bool mmode, DeviceState *parent)
1022 {
1023     DeviceState *dev = qdev_new(TYPE_RISCV_APLIC);
1024     uint32_t i;
1025 
1026     assert(num_harts < APLIC_MAX_IDC);
1027     assert((APLIC_IDC_BASE + (num_harts * APLIC_IDC_SIZE)) <= size);
1028     assert(num_sources < APLIC_MAX_SOURCE);
1029     assert(APLIC_MIN_IPRIO_BITS <= iprio_bits);
1030     assert(iprio_bits <= APLIC_MAX_IPRIO_BITS);
1031 
1032     qdev_prop_set_uint32(dev, "aperture-size", size);
1033     qdev_prop_set_uint32(dev, "hartid-base", hartid_base);
1034     qdev_prop_set_uint32(dev, "num-harts", num_harts);
1035     qdev_prop_set_uint32(dev, "iprio-mask", ((1U << iprio_bits) - 1));
1036     qdev_prop_set_uint32(dev, "num-irqs", num_sources + 1);
1037     qdev_prop_set_bit(dev, "msimode", msimode);
1038     qdev_prop_set_bit(dev, "mmode", mmode);
1039 
1040     if (parent) {
1041         riscv_aplic_add_child(parent, dev);
1042     }
1043 
1044     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
1045 
1046     if (riscv_use_emulated_aplic(msimode)) {
1047         sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, addr);
1048     }
1049 
1050     if (!msimode) {
1051         for (i = 0; i < num_harts; i++) {
1052             CPUState *cpu = cpu_by_arch_id(hartid_base + i);
1053 
1054             qdev_connect_gpio_out_named(dev, NULL, i,
1055                                         qdev_get_gpio_in(DEVICE(cpu),
1056                                             (mmode) ? IRQ_M_EXT : IRQ_S_EXT));
1057         }
1058     }
1059 
1060     return dev;
1061 }
1062