xref: /openbmc/qemu/hw/intc/spapr_xive.c (revision 650d103d3ea959212f826acb9d3fe80cf30e347b)
1 /*
2  * QEMU PowerPC sPAPR XIVE interrupt controller model
3  *
4  * Copyright (c) 2017-2018, IBM Corporation.
5  *
6  * This code is licensed under the GPL version 2 or later. See the
7  * COPYING file in the top-level directory.
8  */
9 
10 #include "qemu/osdep.h"
11 #include "qemu/log.h"
12 #include "qemu/module.h"
13 #include "qapi/error.h"
14 #include "qemu/error-report.h"
15 #include "target/ppc/cpu.h"
16 #include "sysemu/cpus.h"
17 #include "sysemu/reset.h"
18 #include "migration/vmstate.h"
19 #include "monitor/monitor.h"
20 #include "hw/ppc/fdt.h"
21 #include "hw/ppc/spapr.h"
22 #include "hw/ppc/spapr_cpu_core.h"
23 #include "hw/ppc/spapr_xive.h"
24 #include "hw/ppc/xive.h"
25 #include "hw/ppc/xive_regs.h"
26 
27 /*
28  * XIVE Virtualization Controller BAR and Thread Managment BAR that we
29  * use for the ESB pages and the TIMA pages
30  */
31 #define SPAPR_XIVE_VC_BASE   0x0006010000000000ull
32 #define SPAPR_XIVE_TM_BASE   0x0006030203180000ull
33 
34 /*
35  * The allocation of VP blocks is a complex operation in OPAL and the
36  * VP identifiers have a relation with the number of HW chips, the
37  * size of the VP blocks, VP grouping, etc. The QEMU sPAPR XIVE
38  * controller model does not have the same constraints and can use a
39  * simple mapping scheme of the CPU vcpu_id
40  *
41  * These identifiers are never returned to the OS.
42  */
43 
44 #define SPAPR_XIVE_NVT_BASE 0x400
45 
46 /*
47  * sPAPR NVT and END indexing helpers
48  */
49 static uint32_t spapr_xive_nvt_to_target(uint8_t nvt_blk, uint32_t nvt_idx)
50 {
51     return nvt_idx - SPAPR_XIVE_NVT_BASE;
52 }
53 
54 static void spapr_xive_cpu_to_nvt(PowerPCCPU *cpu,
55                                   uint8_t *out_nvt_blk, uint32_t *out_nvt_idx)
56 {
57     assert(cpu);
58 
59     if (out_nvt_blk) {
60         *out_nvt_blk = SPAPR_XIVE_BLOCK_ID;
61     }
62 
63     if (out_nvt_blk) {
64         *out_nvt_idx = SPAPR_XIVE_NVT_BASE + cpu->vcpu_id;
65     }
66 }
67 
68 static int spapr_xive_target_to_nvt(uint32_t target,
69                                     uint8_t *out_nvt_blk, uint32_t *out_nvt_idx)
70 {
71     PowerPCCPU *cpu = spapr_find_cpu(target);
72 
73     if (!cpu) {
74         return -1;
75     }
76 
77     spapr_xive_cpu_to_nvt(cpu, out_nvt_blk, out_nvt_idx);
78     return 0;
79 }
80 
81 /*
82  * sPAPR END indexing uses a simple mapping of the CPU vcpu_id, 8
83  * priorities per CPU
84  */
85 int spapr_xive_end_to_target(uint8_t end_blk, uint32_t end_idx,
86                              uint32_t *out_server, uint8_t *out_prio)
87 {
88 
89     assert(end_blk == SPAPR_XIVE_BLOCK_ID);
90 
91     if (out_server) {
92         *out_server = end_idx >> 3;
93     }
94 
95     if (out_prio) {
96         *out_prio = end_idx & 0x7;
97     }
98     return 0;
99 }
100 
101 static void spapr_xive_cpu_to_end(PowerPCCPU *cpu, uint8_t prio,
102                                   uint8_t *out_end_blk, uint32_t *out_end_idx)
103 {
104     assert(cpu);
105 
106     if (out_end_blk) {
107         *out_end_blk = SPAPR_XIVE_BLOCK_ID;
108     }
109 
110     if (out_end_idx) {
111         *out_end_idx = (cpu->vcpu_id << 3) + prio;
112     }
113 }
114 
115 static int spapr_xive_target_to_end(uint32_t target, uint8_t prio,
116                                     uint8_t *out_end_blk, uint32_t *out_end_idx)
117 {
118     PowerPCCPU *cpu = spapr_find_cpu(target);
119 
120     if (!cpu) {
121         return -1;
122     }
123 
124     spapr_xive_cpu_to_end(cpu, prio, out_end_blk, out_end_idx);
125     return 0;
126 }
127 
128 /*
129  * On sPAPR machines, use a simplified output for the XIVE END
130  * structure dumping only the information related to the OS EQ.
131  */
132 static void spapr_xive_end_pic_print_info(SpaprXive *xive, XiveEND *end,
133                                           Monitor *mon)
134 {
135     uint64_t qaddr_base = xive_end_qaddr(end);
136     uint32_t qindex = xive_get_field32(END_W1_PAGE_OFF, end->w1);
137     uint32_t qgen = xive_get_field32(END_W1_GENERATION, end->w1);
138     uint32_t qsize = xive_get_field32(END_W0_QSIZE, end->w0);
139     uint32_t qentries = 1 << (qsize + 10);
140     uint32_t nvt = xive_get_field32(END_W6_NVT_INDEX, end->w6);
141     uint8_t priority = xive_get_field32(END_W7_F0_PRIORITY, end->w7);
142 
143     monitor_printf(mon, "%3d/%d % 6d/%5d @%"PRIx64" ^%d",
144                    spapr_xive_nvt_to_target(0, nvt),
145                    priority, qindex, qentries, qaddr_base, qgen);
146 
147     xive_end_queue_pic_print_info(end, 6, mon);
148     monitor_printf(mon, "]");
149 }
150 
151 void spapr_xive_pic_print_info(SpaprXive *xive, Monitor *mon)
152 {
153     XiveSource *xsrc = &xive->source;
154     int i;
155 
156     if (kvm_irqchip_in_kernel()) {
157         Error *local_err = NULL;
158 
159         kvmppc_xive_synchronize_state(xive, &local_err);
160         if (local_err) {
161             error_report_err(local_err);
162             return;
163         }
164     }
165 
166     monitor_printf(mon, "  LISN         PQ    EISN     CPU/PRIO EQ\n");
167 
168     for (i = 0; i < xive->nr_irqs; i++) {
169         uint8_t pq = xive_source_esb_get(xsrc, i);
170         XiveEAS *eas = &xive->eat[i];
171 
172         if (!xive_eas_is_valid(eas)) {
173             continue;
174         }
175 
176         monitor_printf(mon, "  %08x %s %c%c%c %s %08x ", i,
177                        xive_source_irq_is_lsi(xsrc, i) ? "LSI" : "MSI",
178                        pq & XIVE_ESB_VAL_P ? 'P' : '-',
179                        pq & XIVE_ESB_VAL_Q ? 'Q' : '-',
180                        xsrc->status[i] & XIVE_STATUS_ASSERTED ? 'A' : ' ',
181                        xive_eas_is_masked(eas) ? "M" : " ",
182                        (int) xive_get_field64(EAS_END_DATA, eas->w));
183 
184         if (!xive_eas_is_masked(eas)) {
185             uint32_t end_idx = xive_get_field64(EAS_END_INDEX, eas->w);
186             XiveEND *end;
187 
188             assert(end_idx < xive->nr_ends);
189             end = &xive->endt[end_idx];
190 
191             if (xive_end_is_valid(end)) {
192                 spapr_xive_end_pic_print_info(xive, end, mon);
193             }
194         }
195         monitor_printf(mon, "\n");
196     }
197 }
198 
199 void spapr_xive_mmio_set_enabled(SpaprXive *xive, bool enable)
200 {
201     memory_region_set_enabled(&xive->source.esb_mmio, enable);
202     memory_region_set_enabled(&xive->tm_mmio, enable);
203 
204     /* Disable the END ESBs until a guest OS makes use of them */
205     memory_region_set_enabled(&xive->end_source.esb_mmio, false);
206 }
207 
208 /*
209  * When a Virtual Processor is scheduled to run on a HW thread, the
210  * hypervisor pushes its identifier in the OS CAM line. Emulate the
211  * same behavior under QEMU.
212  */
213 void spapr_xive_set_tctx_os_cam(XiveTCTX *tctx)
214 {
215     uint8_t  nvt_blk;
216     uint32_t nvt_idx;
217     uint32_t nvt_cam;
218 
219     spapr_xive_cpu_to_nvt(POWERPC_CPU(tctx->cs), &nvt_blk, &nvt_idx);
220 
221     nvt_cam = cpu_to_be32(TM_QW1W2_VO | xive_nvt_cam_line(nvt_blk, nvt_idx));
222     memcpy(&tctx->regs[TM_QW1_OS + TM_WORD2], &nvt_cam, 4);
223 }
224 
225 static void spapr_xive_end_reset(XiveEND *end)
226 {
227     memset(end, 0, sizeof(*end));
228 
229     /* switch off the escalation and notification ESBs */
230     end->w1 = cpu_to_be32(END_W1_ESe_Q | END_W1_ESn_Q);
231 }
232 
233 static void spapr_xive_reset(void *dev)
234 {
235     SpaprXive *xive = SPAPR_XIVE(dev);
236     int i;
237 
238     /*
239      * The XiveSource has its own reset handler, which mask off all
240      * IRQs (!P|Q)
241      */
242 
243     /* Mask all valid EASs in the IRQ number space. */
244     for (i = 0; i < xive->nr_irqs; i++) {
245         XiveEAS *eas = &xive->eat[i];
246         if (xive_eas_is_valid(eas)) {
247             eas->w = cpu_to_be64(EAS_VALID | EAS_MASKED);
248         } else {
249             eas->w = 0;
250         }
251     }
252 
253     /* Clear all ENDs */
254     for (i = 0; i < xive->nr_ends; i++) {
255         spapr_xive_end_reset(&xive->endt[i]);
256     }
257 }
258 
259 static void spapr_xive_instance_init(Object *obj)
260 {
261     SpaprXive *xive = SPAPR_XIVE(obj);
262 
263     object_initialize_child(obj, "source", &xive->source, sizeof(xive->source),
264                             TYPE_XIVE_SOURCE, &error_abort, NULL);
265 
266     object_initialize_child(obj, "end_source", &xive->end_source,
267                             sizeof(xive->end_source), TYPE_XIVE_END_SOURCE,
268                             &error_abort, NULL);
269 
270     /* Not connected to the KVM XIVE device */
271     xive->fd = -1;
272 }
273 
274 static void spapr_xive_realize(DeviceState *dev, Error **errp)
275 {
276     SpaprXive *xive = SPAPR_XIVE(dev);
277     XiveSource *xsrc = &xive->source;
278     XiveENDSource *end_xsrc = &xive->end_source;
279     Error *local_err = NULL;
280 
281     if (!xive->nr_irqs) {
282         error_setg(errp, "Number of interrupt needs to be greater 0");
283         return;
284     }
285 
286     if (!xive->nr_ends) {
287         error_setg(errp, "Number of interrupt needs to be greater 0");
288         return;
289     }
290 
291     /*
292      * Initialize the internal sources, for IPIs and virtual devices.
293      */
294     object_property_set_int(OBJECT(xsrc), xive->nr_irqs, "nr-irqs",
295                             &error_fatal);
296     object_property_add_const_link(OBJECT(xsrc), "xive", OBJECT(xive),
297                                    &error_fatal);
298     object_property_set_bool(OBJECT(xsrc), true, "realized", &local_err);
299     if (local_err) {
300         error_propagate(errp, local_err);
301         return;
302     }
303     sysbus_init_mmio(SYS_BUS_DEVICE(xive), &xsrc->esb_mmio);
304 
305     /*
306      * Initialize the END ESB source
307      */
308     object_property_set_int(OBJECT(end_xsrc), xive->nr_irqs, "nr-ends",
309                             &error_fatal);
310     object_property_add_const_link(OBJECT(end_xsrc), "xive", OBJECT(xive),
311                                    &error_fatal);
312     object_property_set_bool(OBJECT(end_xsrc), true, "realized", &local_err);
313     if (local_err) {
314         error_propagate(errp, local_err);
315         return;
316     }
317     sysbus_init_mmio(SYS_BUS_DEVICE(xive), &end_xsrc->esb_mmio);
318 
319     /* Set the mapping address of the END ESB pages after the source ESBs */
320     xive->end_base = xive->vc_base + (1ull << xsrc->esb_shift) * xsrc->nr_irqs;
321 
322     /*
323      * Allocate the routing tables
324      */
325     xive->eat = g_new0(XiveEAS, xive->nr_irqs);
326     xive->endt = g_new0(XiveEND, xive->nr_ends);
327 
328     xive->nodename = g_strdup_printf("interrupt-controller@%" PRIx64,
329                            xive->tm_base + XIVE_TM_USER_PAGE * (1 << TM_SHIFT));
330 
331     qemu_register_reset(spapr_xive_reset, dev);
332 
333     /* TIMA initialization */
334     memory_region_init_io(&xive->tm_mmio, OBJECT(xive), &xive_tm_ops, xive,
335                           "xive.tima", 4ull << TM_SHIFT);
336     sysbus_init_mmio(SYS_BUS_DEVICE(xive), &xive->tm_mmio);
337 
338     /*
339      * Map all regions. These will be enabled or disabled at reset and
340      * can also be overridden by KVM memory regions if active
341      */
342     sysbus_mmio_map(SYS_BUS_DEVICE(xive), 0, xive->vc_base);
343     sysbus_mmio_map(SYS_BUS_DEVICE(xive), 1, xive->end_base);
344     sysbus_mmio_map(SYS_BUS_DEVICE(xive), 2, xive->tm_base);
345 }
346 
347 static int spapr_xive_get_eas(XiveRouter *xrtr, uint8_t eas_blk,
348                               uint32_t eas_idx, XiveEAS *eas)
349 {
350     SpaprXive *xive = SPAPR_XIVE(xrtr);
351 
352     if (eas_idx >= xive->nr_irqs) {
353         return -1;
354     }
355 
356     *eas = xive->eat[eas_idx];
357     return 0;
358 }
359 
360 static int spapr_xive_get_end(XiveRouter *xrtr,
361                               uint8_t end_blk, uint32_t end_idx, XiveEND *end)
362 {
363     SpaprXive *xive = SPAPR_XIVE(xrtr);
364 
365     if (end_idx >= xive->nr_ends) {
366         return -1;
367     }
368 
369     memcpy(end, &xive->endt[end_idx], sizeof(XiveEND));
370     return 0;
371 }
372 
373 static int spapr_xive_write_end(XiveRouter *xrtr, uint8_t end_blk,
374                                 uint32_t end_idx, XiveEND *end,
375                                 uint8_t word_number)
376 {
377     SpaprXive *xive = SPAPR_XIVE(xrtr);
378 
379     if (end_idx >= xive->nr_ends) {
380         return -1;
381     }
382 
383     memcpy(&xive->endt[end_idx], end, sizeof(XiveEND));
384     return 0;
385 }
386 
387 static int spapr_xive_get_nvt(XiveRouter *xrtr,
388                               uint8_t nvt_blk, uint32_t nvt_idx, XiveNVT *nvt)
389 {
390     uint32_t vcpu_id = spapr_xive_nvt_to_target(nvt_blk, nvt_idx);
391     PowerPCCPU *cpu = spapr_find_cpu(vcpu_id);
392 
393     if (!cpu) {
394         /* TODO: should we assert() if we can find a NVT ? */
395         return -1;
396     }
397 
398     /*
399      * sPAPR does not maintain a NVT table. Return that the NVT is
400      * valid if we have found a matching CPU
401      */
402     nvt->w0 = cpu_to_be32(NVT_W0_VALID);
403     return 0;
404 }
405 
406 static int spapr_xive_write_nvt(XiveRouter *xrtr, uint8_t nvt_blk,
407                                 uint32_t nvt_idx, XiveNVT *nvt,
408                                 uint8_t word_number)
409 {
410     /*
411      * We don't need to write back to the NVTs because the sPAPR
412      * machine should never hit a non-scheduled NVT. It should never
413      * get called.
414      */
415     g_assert_not_reached();
416 }
417 
418 static XiveTCTX *spapr_xive_get_tctx(XiveRouter *xrtr, CPUState *cs)
419 {
420     PowerPCCPU *cpu = POWERPC_CPU(cs);
421 
422     return spapr_cpu_state(cpu)->tctx;
423 }
424 
425 static const VMStateDescription vmstate_spapr_xive_end = {
426     .name = TYPE_SPAPR_XIVE "/end",
427     .version_id = 1,
428     .minimum_version_id = 1,
429     .fields = (VMStateField []) {
430         VMSTATE_UINT32(w0, XiveEND),
431         VMSTATE_UINT32(w1, XiveEND),
432         VMSTATE_UINT32(w2, XiveEND),
433         VMSTATE_UINT32(w3, XiveEND),
434         VMSTATE_UINT32(w4, XiveEND),
435         VMSTATE_UINT32(w5, XiveEND),
436         VMSTATE_UINT32(w6, XiveEND),
437         VMSTATE_UINT32(w7, XiveEND),
438         VMSTATE_END_OF_LIST()
439     },
440 };
441 
442 static const VMStateDescription vmstate_spapr_xive_eas = {
443     .name = TYPE_SPAPR_XIVE "/eas",
444     .version_id = 1,
445     .minimum_version_id = 1,
446     .fields = (VMStateField []) {
447         VMSTATE_UINT64(w, XiveEAS),
448         VMSTATE_END_OF_LIST()
449     },
450 };
451 
452 static int vmstate_spapr_xive_pre_save(void *opaque)
453 {
454     if (kvm_irqchip_in_kernel()) {
455         return kvmppc_xive_pre_save(SPAPR_XIVE(opaque));
456     }
457 
458     return 0;
459 }
460 
461 /*
462  * Called by the sPAPR IRQ backend 'post_load' method at the machine
463  * level.
464  */
465 int spapr_xive_post_load(SpaprXive *xive, int version_id)
466 {
467     if (kvm_irqchip_in_kernel()) {
468         return kvmppc_xive_post_load(xive, version_id);
469     }
470 
471     return 0;
472 }
473 
474 static const VMStateDescription vmstate_spapr_xive = {
475     .name = TYPE_SPAPR_XIVE,
476     .version_id = 1,
477     .minimum_version_id = 1,
478     .pre_save = vmstate_spapr_xive_pre_save,
479     .post_load = NULL, /* handled at the machine level */
480     .fields = (VMStateField[]) {
481         VMSTATE_UINT32_EQUAL(nr_irqs, SpaprXive, NULL),
482         VMSTATE_STRUCT_VARRAY_POINTER_UINT32(eat, SpaprXive, nr_irqs,
483                                      vmstate_spapr_xive_eas, XiveEAS),
484         VMSTATE_STRUCT_VARRAY_POINTER_UINT32(endt, SpaprXive, nr_ends,
485                                              vmstate_spapr_xive_end, XiveEND),
486         VMSTATE_END_OF_LIST()
487     },
488 };
489 
490 static Property spapr_xive_properties[] = {
491     DEFINE_PROP_UINT32("nr-irqs", SpaprXive, nr_irqs, 0),
492     DEFINE_PROP_UINT32("nr-ends", SpaprXive, nr_ends, 0),
493     DEFINE_PROP_UINT64("vc-base", SpaprXive, vc_base, SPAPR_XIVE_VC_BASE),
494     DEFINE_PROP_UINT64("tm-base", SpaprXive, tm_base, SPAPR_XIVE_TM_BASE),
495     DEFINE_PROP_END_OF_LIST(),
496 };
497 
498 static void spapr_xive_class_init(ObjectClass *klass, void *data)
499 {
500     DeviceClass *dc = DEVICE_CLASS(klass);
501     XiveRouterClass *xrc = XIVE_ROUTER_CLASS(klass);
502 
503     dc->desc    = "sPAPR XIVE Interrupt Controller";
504     dc->props   = spapr_xive_properties;
505     dc->realize = spapr_xive_realize;
506     dc->vmsd    = &vmstate_spapr_xive;
507 
508     xrc->get_eas = spapr_xive_get_eas;
509     xrc->get_end = spapr_xive_get_end;
510     xrc->write_end = spapr_xive_write_end;
511     xrc->get_nvt = spapr_xive_get_nvt;
512     xrc->write_nvt = spapr_xive_write_nvt;
513     xrc->get_tctx = spapr_xive_get_tctx;
514 }
515 
516 static const TypeInfo spapr_xive_info = {
517     .name = TYPE_SPAPR_XIVE,
518     .parent = TYPE_XIVE_ROUTER,
519     .instance_init = spapr_xive_instance_init,
520     .instance_size = sizeof(SpaprXive),
521     .class_init = spapr_xive_class_init,
522 };
523 
524 static void spapr_xive_register_types(void)
525 {
526     type_register_static(&spapr_xive_info);
527 }
528 
529 type_init(spapr_xive_register_types)
530 
531 bool spapr_xive_irq_claim(SpaprXive *xive, uint32_t lisn, bool lsi)
532 {
533     XiveSource *xsrc = &xive->source;
534 
535     if (lisn >= xive->nr_irqs) {
536         return false;
537     }
538 
539     xive->eat[lisn].w |= cpu_to_be64(EAS_VALID);
540     if (lsi) {
541         xive_source_irq_set_lsi(xsrc, lisn);
542     }
543 
544     if (kvm_irqchip_in_kernel()) {
545         Error *local_err = NULL;
546 
547         kvmppc_xive_source_reset_one(xsrc, lisn, &local_err);
548         if (local_err) {
549             error_report_err(local_err);
550             return false;
551         }
552     }
553 
554     return true;
555 }
556 
557 bool spapr_xive_irq_free(SpaprXive *xive, uint32_t lisn)
558 {
559     if (lisn >= xive->nr_irqs) {
560         return false;
561     }
562 
563     xive->eat[lisn].w &= cpu_to_be64(~EAS_VALID);
564     return true;
565 }
566 
567 /*
568  * XIVE hcalls
569  *
570  * The terminology used by the XIVE hcalls is the following :
571  *
572  *   TARGET vCPU number
573  *   EQ     Event Queue assigned by OS to receive event data
574  *   ESB    page for source interrupt management
575  *   LISN   Logical Interrupt Source Number identifying a source in the
576  *          machine
577  *   EISN   Effective Interrupt Source Number used by guest OS to
578  *          identify source in the guest
579  *
580  * The EAS, END, NVT structures are not exposed.
581  */
582 
583 /*
584  * Linux hosts under OPAL reserve priority 7 for their own escalation
585  * interrupts (DD2.X POWER9). So we only allow the guest to use
586  * priorities [0..6].
587  */
588 static bool spapr_xive_priority_is_reserved(uint8_t priority)
589 {
590     switch (priority) {
591     case 0 ... 6:
592         return false;
593     case 7: /* OPAL escalation queue */
594     default:
595         return true;
596     }
597 }
598 
599 /*
600  * The H_INT_GET_SOURCE_INFO hcall() is used to obtain the logical
601  * real address of the MMIO page through which the Event State Buffer
602  * entry associated with the value of the "lisn" parameter is managed.
603  *
604  * Parameters:
605  * Input
606  * - R4: "flags"
607  *         Bits 0-63 reserved
608  * - R5: "lisn" is per "interrupts", "interrupt-map", or
609  *       "ibm,xive-lisn-ranges" properties, or as returned by the
610  *       ibm,query-interrupt-source-number RTAS call, or as returned
611  *       by the H_ALLOCATE_VAS_WINDOW hcall
612  *
613  * Output
614  * - R4: "flags"
615  *         Bits 0-59: Reserved
616  *         Bit 60: H_INT_ESB must be used for Event State Buffer
617  *                 management
618  *         Bit 61: 1 == LSI  0 == MSI
619  *         Bit 62: the full function page supports trigger
620  *         Bit 63: Store EOI Supported
621  * - R5: Logical Real address of full function Event State Buffer
622  *       management page, -1 if H_INT_ESB hcall flag is set to 1.
623  * - R6: Logical Real Address of trigger only Event State Buffer
624  *       management page or -1.
625  * - R7: Power of 2 page size for the ESB management pages returned in
626  *       R5 and R6.
627  */
628 
629 #define SPAPR_XIVE_SRC_H_INT_ESB     PPC_BIT(60) /* ESB manage with H_INT_ESB */
630 #define SPAPR_XIVE_SRC_LSI           PPC_BIT(61) /* Virtual LSI type */
631 #define SPAPR_XIVE_SRC_TRIGGER       PPC_BIT(62) /* Trigger and management
632                                                     on same page */
633 #define SPAPR_XIVE_SRC_STORE_EOI     PPC_BIT(63) /* Store EOI support */
634 
635 static target_ulong h_int_get_source_info(PowerPCCPU *cpu,
636                                           SpaprMachineState *spapr,
637                                           target_ulong opcode,
638                                           target_ulong *args)
639 {
640     SpaprXive *xive = spapr->xive;
641     XiveSource *xsrc = &xive->source;
642     target_ulong flags  = args[0];
643     target_ulong lisn   = args[1];
644 
645     if (!spapr_ovec_test(spapr->ov5_cas, OV5_XIVE_EXPLOIT)) {
646         return H_FUNCTION;
647     }
648 
649     if (flags) {
650         return H_PARAMETER;
651     }
652 
653     if (lisn >= xive->nr_irqs) {
654         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: Unknown LISN " TARGET_FMT_lx "\n",
655                       lisn);
656         return H_P2;
657     }
658 
659     if (!xive_eas_is_valid(&xive->eat[lisn])) {
660         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: Invalid LISN " TARGET_FMT_lx "\n",
661                       lisn);
662         return H_P2;
663     }
664 
665     /*
666      * All sources are emulated under the main XIVE object and share
667      * the same characteristics.
668      */
669     args[0] = 0;
670     if (!xive_source_esb_has_2page(xsrc)) {
671         args[0] |= SPAPR_XIVE_SRC_TRIGGER;
672     }
673     if (xsrc->esb_flags & XIVE_SRC_STORE_EOI) {
674         args[0] |= SPAPR_XIVE_SRC_STORE_EOI;
675     }
676 
677     /*
678      * Force the use of the H_INT_ESB hcall in case of an LSI
679      * interrupt. This is necessary under KVM to re-trigger the
680      * interrupt if the level is still asserted
681      */
682     if (xive_source_irq_is_lsi(xsrc, lisn)) {
683         args[0] |= SPAPR_XIVE_SRC_H_INT_ESB | SPAPR_XIVE_SRC_LSI;
684     }
685 
686     if (!(args[0] & SPAPR_XIVE_SRC_H_INT_ESB)) {
687         args[1] = xive->vc_base + xive_source_esb_mgmt(xsrc, lisn);
688     } else {
689         args[1] = -1;
690     }
691 
692     if (xive_source_esb_has_2page(xsrc) &&
693         !(args[0] & SPAPR_XIVE_SRC_H_INT_ESB)) {
694         args[2] = xive->vc_base + xive_source_esb_page(xsrc, lisn);
695     } else {
696         args[2] = -1;
697     }
698 
699     if (xive_source_esb_has_2page(xsrc)) {
700         args[3] = xsrc->esb_shift - 1;
701     } else {
702         args[3] = xsrc->esb_shift;
703     }
704 
705     return H_SUCCESS;
706 }
707 
708 /*
709  * The H_INT_SET_SOURCE_CONFIG hcall() is used to assign a Logical
710  * Interrupt Source to a target. The Logical Interrupt Source is
711  * designated with the "lisn" parameter and the target is designated
712  * with the "target" and "priority" parameters.  Upon return from the
713  * hcall(), no additional interrupts will be directed to the old EQ.
714  *
715  * Parameters:
716  * Input:
717  * - R4: "flags"
718  *         Bits 0-61: Reserved
719  *         Bit 62: set the "eisn" in the EAS
720  *         Bit 63: masks the interrupt source in the hardware interrupt
721  *       control structure. An interrupt masked by this mechanism will
722  *       be dropped, but it's source state bits will still be
723  *       set. There is no race-free way of unmasking and restoring the
724  *       source. Thus this should only be used in interrupts that are
725  *       also masked at the source, and only in cases where the
726  *       interrupt is not meant to be used for a large amount of time
727  *       because no valid target exists for it for example
728  * - R5: "lisn" is per "interrupts", "interrupt-map", or
729  *       "ibm,xive-lisn-ranges" properties, or as returned by the
730  *       ibm,query-interrupt-source-number RTAS call, or as returned by
731  *       the H_ALLOCATE_VAS_WINDOW hcall
732  * - R6: "target" is per "ibm,ppc-interrupt-server#s" or
733  *       "ibm,ppc-interrupt-gserver#s"
734  * - R7: "priority" is a valid priority not in
735  *       "ibm,plat-res-int-priorities"
736  * - R8: "eisn" is the guest EISN associated with the "lisn"
737  *
738  * Output:
739  * - None
740  */
741 
742 #define SPAPR_XIVE_SRC_SET_EISN PPC_BIT(62)
743 #define SPAPR_XIVE_SRC_MASK     PPC_BIT(63)
744 
745 static target_ulong h_int_set_source_config(PowerPCCPU *cpu,
746                                             SpaprMachineState *spapr,
747                                             target_ulong opcode,
748                                             target_ulong *args)
749 {
750     SpaprXive *xive = spapr->xive;
751     XiveEAS eas, new_eas;
752     target_ulong flags    = args[0];
753     target_ulong lisn     = args[1];
754     target_ulong target   = args[2];
755     target_ulong priority = args[3];
756     target_ulong eisn     = args[4];
757     uint8_t end_blk;
758     uint32_t end_idx;
759 
760     if (!spapr_ovec_test(spapr->ov5_cas, OV5_XIVE_EXPLOIT)) {
761         return H_FUNCTION;
762     }
763 
764     if (flags & ~(SPAPR_XIVE_SRC_SET_EISN | SPAPR_XIVE_SRC_MASK)) {
765         return H_PARAMETER;
766     }
767 
768     if (lisn >= xive->nr_irqs) {
769         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: Unknown LISN " TARGET_FMT_lx "\n",
770                       lisn);
771         return H_P2;
772     }
773 
774     eas = xive->eat[lisn];
775     if (!xive_eas_is_valid(&eas)) {
776         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: Invalid LISN " TARGET_FMT_lx "\n",
777                       lisn);
778         return H_P2;
779     }
780 
781     /* priority 0xff is used to reset the EAS */
782     if (priority == 0xff) {
783         new_eas.w = cpu_to_be64(EAS_VALID | EAS_MASKED);
784         goto out;
785     }
786 
787     if (flags & SPAPR_XIVE_SRC_MASK) {
788         new_eas.w = eas.w | cpu_to_be64(EAS_MASKED);
789     } else {
790         new_eas.w = eas.w & cpu_to_be64(~EAS_MASKED);
791     }
792 
793     if (spapr_xive_priority_is_reserved(priority)) {
794         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: priority " TARGET_FMT_ld
795                       " is reserved\n", priority);
796         return H_P4;
797     }
798 
799     /*
800      * Validate that "target" is part of the list of threads allocated
801      * to the partition. For that, find the END corresponding to the
802      * target.
803      */
804     if (spapr_xive_target_to_end(target, priority, &end_blk, &end_idx)) {
805         return H_P3;
806     }
807 
808     new_eas.w = xive_set_field64(EAS_END_BLOCK, new_eas.w, end_blk);
809     new_eas.w = xive_set_field64(EAS_END_INDEX, new_eas.w, end_idx);
810 
811     if (flags & SPAPR_XIVE_SRC_SET_EISN) {
812         new_eas.w = xive_set_field64(EAS_END_DATA, new_eas.w, eisn);
813     }
814 
815     if (kvm_irqchip_in_kernel()) {
816         Error *local_err = NULL;
817 
818         kvmppc_xive_set_source_config(xive, lisn, &new_eas, &local_err);
819         if (local_err) {
820             error_report_err(local_err);
821             return H_HARDWARE;
822         }
823     }
824 
825 out:
826     xive->eat[lisn] = new_eas;
827     return H_SUCCESS;
828 }
829 
830 /*
831  * The H_INT_GET_SOURCE_CONFIG hcall() is used to determine to which
832  * target/priority pair is assigned to the specified Logical Interrupt
833  * Source.
834  *
835  * Parameters:
836  * Input:
837  * - R4: "flags"
838  *         Bits 0-63 Reserved
839  * - R5: "lisn" is per "interrupts", "interrupt-map", or
840  *       "ibm,xive-lisn-ranges" properties, or as returned by the
841  *       ibm,query-interrupt-source-number RTAS call, or as
842  *       returned by the H_ALLOCATE_VAS_WINDOW hcall
843  *
844  * Output:
845  * - R4: Target to which the specified Logical Interrupt Source is
846  *       assigned
847  * - R5: Priority to which the specified Logical Interrupt Source is
848  *       assigned
849  * - R6: EISN for the specified Logical Interrupt Source (this will be
850  *       equivalent to the LISN if not changed by H_INT_SET_SOURCE_CONFIG)
851  */
852 static target_ulong h_int_get_source_config(PowerPCCPU *cpu,
853                                             SpaprMachineState *spapr,
854                                             target_ulong opcode,
855                                             target_ulong *args)
856 {
857     SpaprXive *xive = spapr->xive;
858     target_ulong flags = args[0];
859     target_ulong lisn = args[1];
860     XiveEAS eas;
861     XiveEND *end;
862     uint8_t nvt_blk;
863     uint32_t end_idx, nvt_idx;
864 
865     if (!spapr_ovec_test(spapr->ov5_cas, OV5_XIVE_EXPLOIT)) {
866         return H_FUNCTION;
867     }
868 
869     if (flags) {
870         return H_PARAMETER;
871     }
872 
873     if (lisn >= xive->nr_irqs) {
874         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: Unknown LISN " TARGET_FMT_lx "\n",
875                       lisn);
876         return H_P2;
877     }
878 
879     eas = xive->eat[lisn];
880     if (!xive_eas_is_valid(&eas)) {
881         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: Invalid LISN " TARGET_FMT_lx "\n",
882                       lisn);
883         return H_P2;
884     }
885 
886     /* EAS_END_BLOCK is unused on sPAPR */
887     end_idx = xive_get_field64(EAS_END_INDEX, eas.w);
888 
889     assert(end_idx < xive->nr_ends);
890     end = &xive->endt[end_idx];
891 
892     nvt_blk = xive_get_field32(END_W6_NVT_BLOCK, end->w6);
893     nvt_idx = xive_get_field32(END_W6_NVT_INDEX, end->w6);
894     args[0] = spapr_xive_nvt_to_target(nvt_blk, nvt_idx);
895 
896     if (xive_eas_is_masked(&eas)) {
897         args[1] = 0xff;
898     } else {
899         args[1] = xive_get_field32(END_W7_F0_PRIORITY, end->w7);
900     }
901 
902     args[2] = xive_get_field64(EAS_END_DATA, eas.w);
903 
904     return H_SUCCESS;
905 }
906 
907 /*
908  * The H_INT_GET_QUEUE_INFO hcall() is used to get the logical real
909  * address of the notification management page associated with the
910  * specified target and priority.
911  *
912  * Parameters:
913  * Input:
914  * - R4: "flags"
915  *         Bits 0-63 Reserved
916  * - R5: "target" is per "ibm,ppc-interrupt-server#s" or
917  *       "ibm,ppc-interrupt-gserver#s"
918  * - R6: "priority" is a valid priority not in
919  *       "ibm,plat-res-int-priorities"
920  *
921  * Output:
922  * - R4: Logical real address of notification page
923  * - R5: Power of 2 page size of the notification page
924  */
925 static target_ulong h_int_get_queue_info(PowerPCCPU *cpu,
926                                          SpaprMachineState *spapr,
927                                          target_ulong opcode,
928                                          target_ulong *args)
929 {
930     SpaprXive *xive = spapr->xive;
931     XiveENDSource *end_xsrc = &xive->end_source;
932     target_ulong flags = args[0];
933     target_ulong target = args[1];
934     target_ulong priority = args[2];
935     XiveEND *end;
936     uint8_t end_blk;
937     uint32_t end_idx;
938 
939     if (!spapr_ovec_test(spapr->ov5_cas, OV5_XIVE_EXPLOIT)) {
940         return H_FUNCTION;
941     }
942 
943     if (flags) {
944         return H_PARAMETER;
945     }
946 
947     /*
948      * H_STATE should be returned if a H_INT_RESET is in progress.
949      * This is not needed when running the emulation under QEMU
950      */
951 
952     if (spapr_xive_priority_is_reserved(priority)) {
953         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: priority " TARGET_FMT_ld
954                       " is reserved\n", priority);
955         return H_P3;
956     }
957 
958     /*
959      * Validate that "target" is part of the list of threads allocated
960      * to the partition. For that, find the END corresponding to the
961      * target.
962      */
963     if (spapr_xive_target_to_end(target, priority, &end_blk, &end_idx)) {
964         return H_P2;
965     }
966 
967     assert(end_idx < xive->nr_ends);
968     end = &xive->endt[end_idx];
969 
970     args[0] = xive->end_base + (1ull << (end_xsrc->esb_shift + 1)) * end_idx;
971     if (xive_end_is_enqueue(end)) {
972         args[1] = xive_get_field32(END_W0_QSIZE, end->w0) + 12;
973     } else {
974         args[1] = 0;
975     }
976 
977     return H_SUCCESS;
978 }
979 
980 /*
981  * The H_INT_SET_QUEUE_CONFIG hcall() is used to set or reset a EQ for
982  * a given "target" and "priority".  It is also used to set the
983  * notification config associated with the EQ.  An EQ size of 0 is
984  * used to reset the EQ config for a given target and priority. If
985  * resetting the EQ config, the END associated with the given "target"
986  * and "priority" will be changed to disable queueing.
987  *
988  * Upon return from the hcall(), no additional interrupts will be
989  * directed to the old EQ (if one was set). The old EQ (if one was
990  * set) should be investigated for interrupts that occurred prior to
991  * or during the hcall().
992  *
993  * Parameters:
994  * Input:
995  * - R4: "flags"
996  *         Bits 0-62: Reserved
997  *         Bit 63: Unconditional Notify (n) per the XIVE spec
998  * - R5: "target" is per "ibm,ppc-interrupt-server#s" or
999  *       "ibm,ppc-interrupt-gserver#s"
1000  * - R6: "priority" is a valid priority not in
1001  *       "ibm,plat-res-int-priorities"
1002  * - R7: "eventQueue": The logical real address of the start of the EQ
1003  * - R8: "eventQueueSize": The power of 2 EQ size per "ibm,xive-eq-sizes"
1004  *
1005  * Output:
1006  * - None
1007  */
1008 
1009 #define SPAPR_XIVE_END_ALWAYS_NOTIFY PPC_BIT(63)
1010 
1011 static target_ulong h_int_set_queue_config(PowerPCCPU *cpu,
1012                                            SpaprMachineState *spapr,
1013                                            target_ulong opcode,
1014                                            target_ulong *args)
1015 {
1016     SpaprXive *xive = spapr->xive;
1017     target_ulong flags = args[0];
1018     target_ulong target = args[1];
1019     target_ulong priority = args[2];
1020     target_ulong qpage = args[3];
1021     target_ulong qsize = args[4];
1022     XiveEND end;
1023     uint8_t end_blk, nvt_blk;
1024     uint32_t end_idx, nvt_idx;
1025 
1026     if (!spapr_ovec_test(spapr->ov5_cas, OV5_XIVE_EXPLOIT)) {
1027         return H_FUNCTION;
1028     }
1029 
1030     if (flags & ~SPAPR_XIVE_END_ALWAYS_NOTIFY) {
1031         return H_PARAMETER;
1032     }
1033 
1034     /*
1035      * H_STATE should be returned if a H_INT_RESET is in progress.
1036      * This is not needed when running the emulation under QEMU
1037      */
1038 
1039     if (spapr_xive_priority_is_reserved(priority)) {
1040         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: priority " TARGET_FMT_ld
1041                       " is reserved\n", priority);
1042         return H_P3;
1043     }
1044 
1045     /*
1046      * Validate that "target" is part of the list of threads allocated
1047      * to the partition. For that, find the END corresponding to the
1048      * target.
1049      */
1050 
1051     if (spapr_xive_target_to_end(target, priority, &end_blk, &end_idx)) {
1052         return H_P2;
1053     }
1054 
1055     assert(end_idx < xive->nr_ends);
1056     memcpy(&end, &xive->endt[end_idx], sizeof(XiveEND));
1057 
1058     switch (qsize) {
1059     case 12:
1060     case 16:
1061     case 21:
1062     case 24:
1063         if (!QEMU_IS_ALIGNED(qpage, 1ul << qsize)) {
1064             qemu_log_mask(LOG_GUEST_ERROR, "XIVE: EQ @0x%" HWADDR_PRIx
1065                           " is not naturally aligned with %" HWADDR_PRIx "\n",
1066                           qpage, (hwaddr)1 << qsize);
1067             return H_P4;
1068         }
1069         end.w2 = cpu_to_be32((qpage >> 32) & 0x0fffffff);
1070         end.w3 = cpu_to_be32(qpage & 0xffffffff);
1071         end.w0 |= cpu_to_be32(END_W0_ENQUEUE);
1072         end.w0 = xive_set_field32(END_W0_QSIZE, end.w0, qsize - 12);
1073         break;
1074     case 0:
1075         /* reset queue and disable queueing */
1076         spapr_xive_end_reset(&end);
1077         goto out;
1078 
1079     default:
1080         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid EQ size %"PRIx64"\n",
1081                       qsize);
1082         return H_P5;
1083     }
1084 
1085     if (qsize) {
1086         hwaddr plen = 1 << qsize;
1087         void *eq;
1088 
1089         /*
1090          * Validate the guest EQ. We should also check that the queue
1091          * has been zeroed by the OS.
1092          */
1093         eq = address_space_map(CPU(cpu)->as, qpage, &plen, true,
1094                                MEMTXATTRS_UNSPECIFIED);
1095         if (plen != 1 << qsize) {
1096             qemu_log_mask(LOG_GUEST_ERROR, "XIVE: failed to map EQ @0x%"
1097                           HWADDR_PRIx "\n", qpage);
1098             return H_P4;
1099         }
1100         address_space_unmap(CPU(cpu)->as, eq, plen, true, plen);
1101     }
1102 
1103     /* "target" should have been validated above */
1104     if (spapr_xive_target_to_nvt(target, &nvt_blk, &nvt_idx)) {
1105         g_assert_not_reached();
1106     }
1107 
1108     /*
1109      * Ensure the priority and target are correctly set (they will not
1110      * be right after allocation)
1111      */
1112     end.w6 = xive_set_field32(END_W6_NVT_BLOCK, 0ul, nvt_blk) |
1113         xive_set_field32(END_W6_NVT_INDEX, 0ul, nvt_idx);
1114     end.w7 = xive_set_field32(END_W7_F0_PRIORITY, 0ul, priority);
1115 
1116     if (flags & SPAPR_XIVE_END_ALWAYS_NOTIFY) {
1117         end.w0 |= cpu_to_be32(END_W0_UCOND_NOTIFY);
1118     } else {
1119         end.w0 &= cpu_to_be32((uint32_t)~END_W0_UCOND_NOTIFY);
1120     }
1121 
1122     /*
1123      * The generation bit for the END starts at 1 and The END page
1124      * offset counter starts at 0.
1125      */
1126     end.w1 = cpu_to_be32(END_W1_GENERATION) |
1127         xive_set_field32(END_W1_PAGE_OFF, 0ul, 0ul);
1128     end.w0 |= cpu_to_be32(END_W0_VALID);
1129 
1130     /*
1131      * TODO: issue syncs required to ensure all in-flight interrupts
1132      * are complete on the old END
1133      */
1134 
1135 out:
1136     if (kvm_irqchip_in_kernel()) {
1137         Error *local_err = NULL;
1138 
1139         kvmppc_xive_set_queue_config(xive, end_blk, end_idx, &end, &local_err);
1140         if (local_err) {
1141             error_report_err(local_err);
1142             return H_HARDWARE;
1143         }
1144     }
1145 
1146     /* Update END */
1147     memcpy(&xive->endt[end_idx], &end, sizeof(XiveEND));
1148     return H_SUCCESS;
1149 }
1150 
1151 /*
1152  * The H_INT_GET_QUEUE_CONFIG hcall() is used to get a EQ for a given
1153  * target and priority.
1154  *
1155  * Parameters:
1156  * Input:
1157  * - R4: "flags"
1158  *         Bits 0-62: Reserved
1159  *         Bit 63: Debug: Return debug data
1160  * - R5: "target" is per "ibm,ppc-interrupt-server#s" or
1161  *       "ibm,ppc-interrupt-gserver#s"
1162  * - R6: "priority" is a valid priority not in
1163  *       "ibm,plat-res-int-priorities"
1164  *
1165  * Output:
1166  * - R4: "flags":
1167  *       Bits 0-61: Reserved
1168  *       Bit 62: The value of Event Queue Generation Number (g) per
1169  *              the XIVE spec if "Debug" = 1
1170  *       Bit 63: The value of Unconditional Notify (n) per the XIVE spec
1171  * - R5: The logical real address of the start of the EQ
1172  * - R6: The power of 2 EQ size per "ibm,xive-eq-sizes"
1173  * - R7: The value of Event Queue Offset Counter per XIVE spec
1174  *       if "Debug" = 1, else 0
1175  *
1176  */
1177 
1178 #define SPAPR_XIVE_END_DEBUG     PPC_BIT(63)
1179 
1180 static target_ulong h_int_get_queue_config(PowerPCCPU *cpu,
1181                                            SpaprMachineState *spapr,
1182                                            target_ulong opcode,
1183                                            target_ulong *args)
1184 {
1185     SpaprXive *xive = spapr->xive;
1186     target_ulong flags = args[0];
1187     target_ulong target = args[1];
1188     target_ulong priority = args[2];
1189     XiveEND *end;
1190     uint8_t end_blk;
1191     uint32_t end_idx;
1192 
1193     if (!spapr_ovec_test(spapr->ov5_cas, OV5_XIVE_EXPLOIT)) {
1194         return H_FUNCTION;
1195     }
1196 
1197     if (flags & ~SPAPR_XIVE_END_DEBUG) {
1198         return H_PARAMETER;
1199     }
1200 
1201     /*
1202      * H_STATE should be returned if a H_INT_RESET is in progress.
1203      * This is not needed when running the emulation under QEMU
1204      */
1205 
1206     if (spapr_xive_priority_is_reserved(priority)) {
1207         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: priority " TARGET_FMT_ld
1208                       " is reserved\n", priority);
1209         return H_P3;
1210     }
1211 
1212     /*
1213      * Validate that "target" is part of the list of threads allocated
1214      * to the partition. For that, find the END corresponding to the
1215      * target.
1216      */
1217     if (spapr_xive_target_to_end(target, priority, &end_blk, &end_idx)) {
1218         return H_P2;
1219     }
1220 
1221     assert(end_idx < xive->nr_ends);
1222     end = &xive->endt[end_idx];
1223 
1224     args[0] = 0;
1225     if (xive_end_is_notify(end)) {
1226         args[0] |= SPAPR_XIVE_END_ALWAYS_NOTIFY;
1227     }
1228 
1229     if (xive_end_is_enqueue(end)) {
1230         args[1] = xive_end_qaddr(end);
1231         args[2] = xive_get_field32(END_W0_QSIZE, end->w0) + 12;
1232     } else {
1233         args[1] = 0;
1234         args[2] = 0;
1235     }
1236 
1237     if (kvm_irqchip_in_kernel()) {
1238         Error *local_err = NULL;
1239 
1240         kvmppc_xive_get_queue_config(xive, end_blk, end_idx, end, &local_err);
1241         if (local_err) {
1242             error_report_err(local_err);
1243             return H_HARDWARE;
1244         }
1245     }
1246 
1247     /* TODO: do we need any locking on the END ? */
1248     if (flags & SPAPR_XIVE_END_DEBUG) {
1249         /* Load the event queue generation number into the return flags */
1250         args[0] |= (uint64_t)xive_get_field32(END_W1_GENERATION, end->w1) << 62;
1251 
1252         /* Load R7 with the event queue offset counter */
1253         args[3] = xive_get_field32(END_W1_PAGE_OFF, end->w1);
1254     } else {
1255         args[3] = 0;
1256     }
1257 
1258     return H_SUCCESS;
1259 }
1260 
1261 /*
1262  * The H_INT_SET_OS_REPORTING_LINE hcall() is used to set the
1263  * reporting cache line pair for the calling thread.  The reporting
1264  * cache lines will contain the OS interrupt context when the OS
1265  * issues a CI store byte to @TIMA+0xC10 to acknowledge the OS
1266  * interrupt. The reporting cache lines can be reset by inputting -1
1267  * in "reportingLine".  Issuing the CI store byte without reporting
1268  * cache lines registered will result in the data not being accessible
1269  * to the OS.
1270  *
1271  * Parameters:
1272  * Input:
1273  * - R4: "flags"
1274  *         Bits 0-63: Reserved
1275  * - R5: "reportingLine": The logical real address of the reporting cache
1276  *       line pair
1277  *
1278  * Output:
1279  * - None
1280  */
1281 static target_ulong h_int_set_os_reporting_line(PowerPCCPU *cpu,
1282                                                 SpaprMachineState *spapr,
1283                                                 target_ulong opcode,
1284                                                 target_ulong *args)
1285 {
1286     if (!spapr_ovec_test(spapr->ov5_cas, OV5_XIVE_EXPLOIT)) {
1287         return H_FUNCTION;
1288     }
1289 
1290     /*
1291      * H_STATE should be returned if a H_INT_RESET is in progress.
1292      * This is not needed when running the emulation under QEMU
1293      */
1294 
1295     /* TODO: H_INT_SET_OS_REPORTING_LINE */
1296     return H_FUNCTION;
1297 }
1298 
1299 /*
1300  * The H_INT_GET_OS_REPORTING_LINE hcall() is used to get the logical
1301  * real address of the reporting cache line pair set for the input
1302  * "target".  If no reporting cache line pair has been set, -1 is
1303  * returned.
1304  *
1305  * Parameters:
1306  * Input:
1307  * - R4: "flags"
1308  *         Bits 0-63: Reserved
1309  * - R5: "target" is per "ibm,ppc-interrupt-server#s" or
1310  *       "ibm,ppc-interrupt-gserver#s"
1311  * - R6: "reportingLine": The logical real address of the reporting
1312  *        cache line pair
1313  *
1314  * Output:
1315  * - R4: The logical real address of the reporting line if set, else -1
1316  */
1317 static target_ulong h_int_get_os_reporting_line(PowerPCCPU *cpu,
1318                                                 SpaprMachineState *spapr,
1319                                                 target_ulong opcode,
1320                                                 target_ulong *args)
1321 {
1322     if (!spapr_ovec_test(spapr->ov5_cas, OV5_XIVE_EXPLOIT)) {
1323         return H_FUNCTION;
1324     }
1325 
1326     /*
1327      * H_STATE should be returned if a H_INT_RESET is in progress.
1328      * This is not needed when running the emulation under QEMU
1329      */
1330 
1331     /* TODO: H_INT_GET_OS_REPORTING_LINE */
1332     return H_FUNCTION;
1333 }
1334 
1335 /*
1336  * The H_INT_ESB hcall() is used to issue a load or store to the ESB
1337  * page for the input "lisn".  This hcall is only supported for LISNs
1338  * that have the ESB hcall flag set to 1 when returned from hcall()
1339  * H_INT_GET_SOURCE_INFO.
1340  *
1341  * Parameters:
1342  * Input:
1343  * - R4: "flags"
1344  *         Bits 0-62: Reserved
1345  *         bit 63: Store: Store=1, store operation, else load operation
1346  * - R5: "lisn" is per "interrupts", "interrupt-map", or
1347  *       "ibm,xive-lisn-ranges" properties, or as returned by the
1348  *       ibm,query-interrupt-source-number RTAS call, or as
1349  *       returned by the H_ALLOCATE_VAS_WINDOW hcall
1350  * - R6: "esbOffset" is the offset into the ESB page for the load or
1351  *       store operation
1352  * - R7: "storeData" is the data to write for a store operation
1353  *
1354  * Output:
1355  * - R4: The value of the load if load operation, else -1
1356  */
1357 
1358 #define SPAPR_XIVE_ESB_STORE PPC_BIT(63)
1359 
1360 static target_ulong h_int_esb(PowerPCCPU *cpu,
1361                               SpaprMachineState *spapr,
1362                               target_ulong opcode,
1363                               target_ulong *args)
1364 {
1365     SpaprXive *xive = spapr->xive;
1366     XiveEAS eas;
1367     target_ulong flags  = args[0];
1368     target_ulong lisn   = args[1];
1369     target_ulong offset = args[2];
1370     target_ulong data   = args[3];
1371     hwaddr mmio_addr;
1372     XiveSource *xsrc = &xive->source;
1373 
1374     if (!spapr_ovec_test(spapr->ov5_cas, OV5_XIVE_EXPLOIT)) {
1375         return H_FUNCTION;
1376     }
1377 
1378     if (flags & ~SPAPR_XIVE_ESB_STORE) {
1379         return H_PARAMETER;
1380     }
1381 
1382     if (lisn >= xive->nr_irqs) {
1383         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: Unknown LISN " TARGET_FMT_lx "\n",
1384                       lisn);
1385         return H_P2;
1386     }
1387 
1388     eas = xive->eat[lisn];
1389     if (!xive_eas_is_valid(&eas)) {
1390         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: Invalid LISN " TARGET_FMT_lx "\n",
1391                       lisn);
1392         return H_P2;
1393     }
1394 
1395     if (offset > (1ull << xsrc->esb_shift)) {
1396         return H_P3;
1397     }
1398 
1399     if (kvm_irqchip_in_kernel()) {
1400         args[0] = kvmppc_xive_esb_rw(xsrc, lisn, offset, data,
1401                                      flags & SPAPR_XIVE_ESB_STORE);
1402     } else {
1403         mmio_addr = xive->vc_base + xive_source_esb_mgmt(xsrc, lisn) + offset;
1404 
1405         if (dma_memory_rw(&address_space_memory, mmio_addr, &data, 8,
1406                           (flags & SPAPR_XIVE_ESB_STORE))) {
1407             qemu_log_mask(LOG_GUEST_ERROR, "XIVE: failed to access ESB @0x%"
1408                           HWADDR_PRIx "\n", mmio_addr);
1409             return H_HARDWARE;
1410         }
1411         args[0] = (flags & SPAPR_XIVE_ESB_STORE) ? -1 : data;
1412     }
1413     return H_SUCCESS;
1414 }
1415 
1416 /*
1417  * The H_INT_SYNC hcall() is used to issue hardware syncs that will
1418  * ensure any in flight events for the input lisn are in the event
1419  * queue.
1420  *
1421  * Parameters:
1422  * Input:
1423  * - R4: "flags"
1424  *         Bits 0-63: Reserved
1425  * - R5: "lisn" is per "interrupts", "interrupt-map", or
1426  *       "ibm,xive-lisn-ranges" properties, or as returned by the
1427  *       ibm,query-interrupt-source-number RTAS call, or as
1428  *       returned by the H_ALLOCATE_VAS_WINDOW hcall
1429  *
1430  * Output:
1431  * - None
1432  */
1433 static target_ulong h_int_sync(PowerPCCPU *cpu,
1434                                SpaprMachineState *spapr,
1435                                target_ulong opcode,
1436                                target_ulong *args)
1437 {
1438     SpaprXive *xive = spapr->xive;
1439     XiveEAS eas;
1440     target_ulong flags = args[0];
1441     target_ulong lisn = args[1];
1442 
1443     if (!spapr_ovec_test(spapr->ov5_cas, OV5_XIVE_EXPLOIT)) {
1444         return H_FUNCTION;
1445     }
1446 
1447     if (flags) {
1448         return H_PARAMETER;
1449     }
1450 
1451     if (lisn >= xive->nr_irqs) {
1452         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: Unknown LISN " TARGET_FMT_lx "\n",
1453                       lisn);
1454         return H_P2;
1455     }
1456 
1457     eas = xive->eat[lisn];
1458     if (!xive_eas_is_valid(&eas)) {
1459         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: Invalid LISN " TARGET_FMT_lx "\n",
1460                       lisn);
1461         return H_P2;
1462     }
1463 
1464     /*
1465      * H_STATE should be returned if a H_INT_RESET is in progress.
1466      * This is not needed when running the emulation under QEMU
1467      */
1468 
1469     /*
1470      * This is not real hardware. Nothing to be done unless when
1471      * under KVM
1472      */
1473 
1474     if (kvm_irqchip_in_kernel()) {
1475         Error *local_err = NULL;
1476 
1477         kvmppc_xive_sync_source(xive, lisn, &local_err);
1478         if (local_err) {
1479             error_report_err(local_err);
1480             return H_HARDWARE;
1481         }
1482     }
1483     return H_SUCCESS;
1484 }
1485 
1486 /*
1487  * The H_INT_RESET hcall() is used to reset all of the partition's
1488  * interrupt exploitation structures to their initial state.  This
1489  * means losing all previously set interrupt state set via
1490  * H_INT_SET_SOURCE_CONFIG and H_INT_SET_QUEUE_CONFIG.
1491  *
1492  * Parameters:
1493  * Input:
1494  * - R4: "flags"
1495  *         Bits 0-63: Reserved
1496  *
1497  * Output:
1498  * - None
1499  */
1500 static target_ulong h_int_reset(PowerPCCPU *cpu,
1501                                 SpaprMachineState *spapr,
1502                                 target_ulong opcode,
1503                                 target_ulong *args)
1504 {
1505     SpaprXive *xive = spapr->xive;
1506     target_ulong flags   = args[0];
1507 
1508     if (!spapr_ovec_test(spapr->ov5_cas, OV5_XIVE_EXPLOIT)) {
1509         return H_FUNCTION;
1510     }
1511 
1512     if (flags) {
1513         return H_PARAMETER;
1514     }
1515 
1516     device_reset(DEVICE(xive));
1517 
1518     if (kvm_irqchip_in_kernel()) {
1519         Error *local_err = NULL;
1520 
1521         kvmppc_xive_reset(xive, &local_err);
1522         if (local_err) {
1523             error_report_err(local_err);
1524             return H_HARDWARE;
1525         }
1526     }
1527     return H_SUCCESS;
1528 }
1529 
1530 void spapr_xive_hcall_init(SpaprMachineState *spapr)
1531 {
1532     spapr_register_hypercall(H_INT_GET_SOURCE_INFO, h_int_get_source_info);
1533     spapr_register_hypercall(H_INT_SET_SOURCE_CONFIG, h_int_set_source_config);
1534     spapr_register_hypercall(H_INT_GET_SOURCE_CONFIG, h_int_get_source_config);
1535     spapr_register_hypercall(H_INT_GET_QUEUE_INFO, h_int_get_queue_info);
1536     spapr_register_hypercall(H_INT_SET_QUEUE_CONFIG, h_int_set_queue_config);
1537     spapr_register_hypercall(H_INT_GET_QUEUE_CONFIG, h_int_get_queue_config);
1538     spapr_register_hypercall(H_INT_SET_OS_REPORTING_LINE,
1539                              h_int_set_os_reporting_line);
1540     spapr_register_hypercall(H_INT_GET_OS_REPORTING_LINE,
1541                              h_int_get_os_reporting_line);
1542     spapr_register_hypercall(H_INT_ESB, h_int_esb);
1543     spapr_register_hypercall(H_INT_SYNC, h_int_sync);
1544     spapr_register_hypercall(H_INT_RESET, h_int_reset);
1545 }
1546 
1547 void spapr_dt_xive(SpaprMachineState *spapr, uint32_t nr_servers, void *fdt,
1548                    uint32_t phandle)
1549 {
1550     SpaprXive *xive = spapr->xive;
1551     int node;
1552     uint64_t timas[2 * 2];
1553     /* Interrupt number ranges for the IPIs */
1554     uint32_t lisn_ranges[] = {
1555         cpu_to_be32(0),
1556         cpu_to_be32(nr_servers),
1557     };
1558     /*
1559      * EQ size - the sizes of pages supported by the system 4K, 64K,
1560      * 2M, 16M. We only advertise 64K for the moment.
1561      */
1562     uint32_t eq_sizes[] = {
1563         cpu_to_be32(16), /* 64K */
1564     };
1565     /*
1566      * The following array is in sync with the reserved priorities
1567      * defined by the 'spapr_xive_priority_is_reserved' routine.
1568      */
1569     uint32_t plat_res_int_priorities[] = {
1570         cpu_to_be32(7),    /* start */
1571         cpu_to_be32(0xf8), /* count */
1572     };
1573 
1574     /* Thread Interrupt Management Area : User (ring 3) and OS (ring 2) */
1575     timas[0] = cpu_to_be64(xive->tm_base +
1576                            XIVE_TM_USER_PAGE * (1ull << TM_SHIFT));
1577     timas[1] = cpu_to_be64(1ull << TM_SHIFT);
1578     timas[2] = cpu_to_be64(xive->tm_base +
1579                            XIVE_TM_OS_PAGE * (1ull << TM_SHIFT));
1580     timas[3] = cpu_to_be64(1ull << TM_SHIFT);
1581 
1582     _FDT(node = fdt_add_subnode(fdt, 0, xive->nodename));
1583 
1584     _FDT(fdt_setprop_string(fdt, node, "device_type", "power-ivpe"));
1585     _FDT(fdt_setprop(fdt, node, "reg", timas, sizeof(timas)));
1586 
1587     _FDT(fdt_setprop_string(fdt, node, "compatible", "ibm,power-ivpe"));
1588     _FDT(fdt_setprop(fdt, node, "ibm,xive-eq-sizes", eq_sizes,
1589                      sizeof(eq_sizes)));
1590     _FDT(fdt_setprop(fdt, node, "ibm,xive-lisn-ranges", lisn_ranges,
1591                      sizeof(lisn_ranges)));
1592 
1593     /* For Linux to link the LSIs to the interrupt controller. */
1594     _FDT(fdt_setprop(fdt, node, "interrupt-controller", NULL, 0));
1595     _FDT(fdt_setprop_cell(fdt, node, "#interrupt-cells", 2));
1596 
1597     /* For SLOF */
1598     _FDT(fdt_setprop_cell(fdt, node, "linux,phandle", phandle));
1599     _FDT(fdt_setprop_cell(fdt, node, "phandle", phandle));
1600 
1601     /*
1602      * The "ibm,plat-res-int-priorities" property defines the priority
1603      * ranges reserved by the hypervisor
1604      */
1605     _FDT(fdt_setprop(fdt, 0, "ibm,plat-res-int-priorities",
1606                      plat_res_int_priorities, sizeof(plat_res_int_priorities)));
1607 }
1608