xref: /openbmc/qemu/hw/intc/xive.c (revision 31cf4b97)
1 /*
2  * QEMU PowerPC XIVE interrupt controller model
3  *
4  * Copyright (c) 2017-2018, IBM Corporation.
5  *
6  * This code is licensed under the GPL version 2 or later. See the
7  * COPYING file in the top-level directory.
8  */
9 
10 #include "qemu/osdep.h"
11 #include "qemu/log.h"
12 #include "qapi/error.h"
13 #include "target/ppc/cpu.h"
14 #include "sysemu/cpus.h"
15 #include "sysemu/dma.h"
16 #include "hw/qdev-properties.h"
17 #include "monitor/monitor.h"
18 #include "hw/ppc/xive.h"
19 #include "hw/ppc/xive_regs.h"
20 
21 /*
22  * XIVE Thread Interrupt Management context
23  */
24 
25 /*
26  * Convert a priority number to an Interrupt Pending Buffer (IPB)
27  * register, which indicates a pending interrupt at the priority
28  * corresponding to the bit number
29  */
30 static uint8_t priority_to_ipb(uint8_t priority)
31 {
32     return priority > XIVE_PRIORITY_MAX ?
33         0 : 1 << (XIVE_PRIORITY_MAX - priority);
34 }
35 
36 /*
37  * Convert an Interrupt Pending Buffer (IPB) register to a Pending
38  * Interrupt Priority Register (PIPR), which contains the priority of
39  * the most favored pending notification.
40  */
41 static uint8_t ipb_to_pipr(uint8_t ibp)
42 {
43     return ibp ? clz32((uint32_t)ibp << 24) : 0xff;
44 }
45 
46 static void ipb_update(uint8_t *regs, uint8_t priority)
47 {
48     regs[TM_IPB] |= priority_to_ipb(priority);
49     regs[TM_PIPR] = ipb_to_pipr(regs[TM_IPB]);
50 }
51 
52 static uint8_t exception_mask(uint8_t ring)
53 {
54     switch (ring) {
55     case TM_QW1_OS:
56         return TM_QW1_NSR_EO;
57     default:
58         g_assert_not_reached();
59     }
60 }
61 
62 static uint64_t xive_tctx_accept(XiveTCTX *tctx, uint8_t ring)
63 {
64     uint8_t *regs = &tctx->regs[ring];
65     uint8_t nsr = regs[TM_NSR];
66     uint8_t mask = exception_mask(ring);
67 
68     qemu_irq_lower(tctx->output);
69 
70     if (regs[TM_NSR] & mask) {
71         uint8_t cppr = regs[TM_PIPR];
72 
73         regs[TM_CPPR] = cppr;
74 
75         /* Reset the pending buffer bit */
76         regs[TM_IPB] &= ~priority_to_ipb(cppr);
77         regs[TM_PIPR] = ipb_to_pipr(regs[TM_IPB]);
78 
79         /* Drop Exception bit */
80         regs[TM_NSR] &= ~mask;
81     }
82 
83     return (nsr << 8) | regs[TM_CPPR];
84 }
85 
86 static void xive_tctx_notify(XiveTCTX *tctx, uint8_t ring)
87 {
88     uint8_t *regs = &tctx->regs[ring];
89 
90     if (regs[TM_PIPR] < regs[TM_CPPR]) {
91         regs[TM_NSR] |= exception_mask(ring);
92         qemu_irq_raise(tctx->output);
93     }
94 }
95 
96 static void xive_tctx_set_cppr(XiveTCTX *tctx, uint8_t ring, uint8_t cppr)
97 {
98     if (cppr > XIVE_PRIORITY_MAX) {
99         cppr = 0xff;
100     }
101 
102     tctx->regs[ring + TM_CPPR] = cppr;
103 
104     /* CPPR has changed, check if we need to raise a pending exception */
105     xive_tctx_notify(tctx, ring);
106 }
107 
108 /*
109  * XIVE Thread Interrupt Management Area (TIMA)
110  */
111 
112 /*
113  * Define an access map for each page of the TIMA that we will use in
114  * the memory region ops to filter values when doing loads and stores
115  * of raw registers values
116  *
117  * Registers accessibility bits :
118  *
119  *    0x0 - no access
120  *    0x1 - write only
121  *    0x2 - read only
122  *    0x3 - read/write
123  */
124 
125 static const uint8_t xive_tm_hw_view[] = {
126     /* QW-0 User */   3, 0, 0, 0,   0, 0, 0, 0,   3, 3, 3, 3,   0, 0, 0, 0,
127     /* QW-1 OS   */   3, 3, 3, 3,   3, 3, 0, 3,   3, 3, 3, 3,   0, 0, 0, 0,
128     /* QW-2 POOL */   0, 0, 3, 3,   0, 0, 0, 0,   3, 3, 3, 3,   0, 0, 0, 0,
129     /* QW-3 PHYS */   3, 3, 3, 3,   0, 3, 0, 3,   3, 0, 0, 3,   3, 3, 3, 0,
130 };
131 
132 static const uint8_t xive_tm_hv_view[] = {
133     /* QW-0 User */   3, 0, 0, 0,   0, 0, 0, 0,   3, 3, 3, 3,   0, 0, 0, 0,
134     /* QW-1 OS   */   3, 3, 3, 3,   3, 3, 0, 3,   3, 3, 3, 3,   0, 0, 0, 0,
135     /* QW-2 POOL */   0, 0, 3, 3,   0, 0, 0, 0,   0, 3, 3, 3,   0, 0, 0, 0,
136     /* QW-3 PHYS */   3, 3, 3, 3,   0, 3, 0, 3,   3, 0, 0, 3,   0, 0, 0, 0,
137 };
138 
139 static const uint8_t xive_tm_os_view[] = {
140     /* QW-0 User */   3, 0, 0, 0,   0, 0, 0, 0,   3, 3, 3, 3,   0, 0, 0, 0,
141     /* QW-1 OS   */   2, 3, 2, 2,   2, 2, 0, 2,   0, 0, 0, 0,   0, 0, 0, 0,
142     /* QW-2 POOL */   0, 0, 0, 0,   0, 0, 0, 0,   0, 0, 0, 0,   0, 0, 0, 0,
143     /* QW-3 PHYS */   0, 0, 0, 0,   0, 0, 0, 0,   0, 0, 0, 0,   0, 0, 0, 0,
144 };
145 
146 static const uint8_t xive_tm_user_view[] = {
147     /* QW-0 User */   3, 0, 0, 0,   0, 0, 0, 0,   0, 0, 0, 0,   0, 0, 0, 0,
148     /* QW-1 OS   */   0, 0, 0, 0,   0, 0, 0, 0,   0, 0, 0, 0,   0, 0, 0, 0,
149     /* QW-2 POOL */   0, 0, 0, 0,   0, 0, 0, 0,   0, 0, 0, 0,   0, 0, 0, 0,
150     /* QW-3 PHYS */   0, 0, 0, 0,   0, 0, 0, 0,   0, 0, 0, 0,   0, 0, 0, 0,
151 };
152 
153 /*
154  * Overall TIMA access map for the thread interrupt management context
155  * registers
156  */
157 static const uint8_t *xive_tm_views[] = {
158     [XIVE_TM_HW_PAGE]   = xive_tm_hw_view,
159     [XIVE_TM_HV_PAGE]   = xive_tm_hv_view,
160     [XIVE_TM_OS_PAGE]   = xive_tm_os_view,
161     [XIVE_TM_USER_PAGE] = xive_tm_user_view,
162 };
163 
164 /*
165  * Computes a register access mask for a given offset in the TIMA
166  */
167 static uint64_t xive_tm_mask(hwaddr offset, unsigned size, bool write)
168 {
169     uint8_t page_offset = (offset >> TM_SHIFT) & 0x3;
170     uint8_t reg_offset = offset & 0x3F;
171     uint8_t reg_mask = write ? 0x1 : 0x2;
172     uint64_t mask = 0x0;
173     int i;
174 
175     for (i = 0; i < size; i++) {
176         if (xive_tm_views[page_offset][reg_offset + i] & reg_mask) {
177             mask |= (uint64_t) 0xff << (8 * (size - i - 1));
178         }
179     }
180 
181     return mask;
182 }
183 
184 static void xive_tm_raw_write(XiveTCTX *tctx, hwaddr offset, uint64_t value,
185                               unsigned size)
186 {
187     uint8_t ring_offset = offset & 0x30;
188     uint8_t reg_offset = offset & 0x3F;
189     uint64_t mask = xive_tm_mask(offset, size, true);
190     int i;
191 
192     /*
193      * Only 4 or 8 bytes stores are allowed and the User ring is
194      * excluded
195      */
196     if (size < 4 || !mask || ring_offset == TM_QW0_USER) {
197         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid write access at TIMA @%"
198                       HWADDR_PRIx"\n", offset);
199         return;
200     }
201 
202     /*
203      * Use the register offset for the raw values and filter out
204      * reserved values
205      */
206     for (i = 0; i < size; i++) {
207         uint8_t byte_mask = (mask >> (8 * (size - i - 1)));
208         if (byte_mask) {
209             tctx->regs[reg_offset + i] = (value >> (8 * (size - i - 1))) &
210                 byte_mask;
211         }
212     }
213 }
214 
215 static uint64_t xive_tm_raw_read(XiveTCTX *tctx, hwaddr offset, unsigned size)
216 {
217     uint8_t ring_offset = offset & 0x30;
218     uint8_t reg_offset = offset & 0x3F;
219     uint64_t mask = xive_tm_mask(offset, size, false);
220     uint64_t ret;
221     int i;
222 
223     /*
224      * Only 4 or 8 bytes loads are allowed and the User ring is
225      * excluded
226      */
227     if (size < 4 || !mask || ring_offset == TM_QW0_USER) {
228         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid read access at TIMA @%"
229                       HWADDR_PRIx"\n", offset);
230         return -1;
231     }
232 
233     /* Use the register offset for the raw values */
234     ret = 0;
235     for (i = 0; i < size; i++) {
236         ret |= (uint64_t) tctx->regs[reg_offset + i] << (8 * (size - i - 1));
237     }
238 
239     /* filter out reserved values */
240     return ret & mask;
241 }
242 
243 /*
244  * The TM context is mapped twice within each page. Stores and loads
245  * to the first mapping below 2K write and read the specified values
246  * without modification. The second mapping above 2K performs specific
247  * state changes (side effects) in addition to setting/returning the
248  * interrupt management area context of the processor thread.
249  */
250 static uint64_t xive_tm_ack_os_reg(XiveTCTX *tctx, hwaddr offset, unsigned size)
251 {
252     return xive_tctx_accept(tctx, TM_QW1_OS);
253 }
254 
255 static void xive_tm_set_os_cppr(XiveTCTX *tctx, hwaddr offset,
256                                 uint64_t value, unsigned size)
257 {
258     xive_tctx_set_cppr(tctx, TM_QW1_OS, value & 0xff);
259 }
260 
261 /*
262  * Adjust the IPB to allow a CPU to process event queues of other
263  * priorities during one physical interrupt cycle.
264  */
265 static void xive_tm_set_os_pending(XiveTCTX *tctx, hwaddr offset,
266                                    uint64_t value, unsigned size)
267 {
268     ipb_update(&tctx->regs[TM_QW1_OS], value & 0xff);
269     xive_tctx_notify(tctx, TM_QW1_OS);
270 }
271 
272 /*
273  * Define a mapping of "special" operations depending on the TIMA page
274  * offset and the size of the operation.
275  */
276 typedef struct XiveTmOp {
277     uint8_t  page_offset;
278     uint32_t op_offset;
279     unsigned size;
280     void     (*write_handler)(XiveTCTX *tctx, hwaddr offset, uint64_t value,
281                               unsigned size);
282     uint64_t (*read_handler)(XiveTCTX *tctx, hwaddr offset, unsigned size);
283 } XiveTmOp;
284 
285 static const XiveTmOp xive_tm_operations[] = {
286     /*
287      * MMIOs below 2K : raw values and special operations without side
288      * effects
289      */
290     { XIVE_TM_OS_PAGE, TM_QW1_OS + TM_CPPR,   1, xive_tm_set_os_cppr, NULL },
291 
292     /* MMIOs above 2K : special operations with side effects */
293     { XIVE_TM_OS_PAGE, TM_SPC_ACK_OS_REG,     2, NULL, xive_tm_ack_os_reg },
294     { XIVE_TM_OS_PAGE, TM_SPC_SET_OS_PENDING, 1, xive_tm_set_os_pending, NULL },
295 };
296 
297 static const XiveTmOp *xive_tm_find_op(hwaddr offset, unsigned size, bool write)
298 {
299     uint8_t page_offset = (offset >> TM_SHIFT) & 0x3;
300     uint32_t op_offset = offset & 0xFFF;
301     int i;
302 
303     for (i = 0; i < ARRAY_SIZE(xive_tm_operations); i++) {
304         const XiveTmOp *xto = &xive_tm_operations[i];
305 
306         /* Accesses done from a more privileged TIMA page is allowed */
307         if (xto->page_offset >= page_offset &&
308             xto->op_offset == op_offset &&
309             xto->size == size &&
310             ((write && xto->write_handler) || (!write && xto->read_handler))) {
311             return xto;
312         }
313     }
314     return NULL;
315 }
316 
317 /*
318  * TIMA MMIO handlers
319  */
320 static void xive_tm_write(void *opaque, hwaddr offset,
321                           uint64_t value, unsigned size)
322 {
323     PowerPCCPU *cpu = POWERPC_CPU(current_cpu);
324     XiveTCTX *tctx = cpu->tctx;
325     const XiveTmOp *xto;
326 
327     /*
328      * TODO: check V bit in Q[0-3]W2, check PTER bit associated with CPU
329      */
330 
331     /*
332      * First, check for special operations in the 2K region
333      */
334     if (offset & 0x800) {
335         xto = xive_tm_find_op(offset, size, true);
336         if (!xto) {
337             qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid write access at TIMA"
338                           "@%"HWADDR_PRIx"\n", offset);
339         } else {
340             xto->write_handler(tctx, offset, value, size);
341         }
342         return;
343     }
344 
345     /*
346      * Then, for special operations in the region below 2K.
347      */
348     xto = xive_tm_find_op(offset, size, true);
349     if (xto) {
350         xto->write_handler(tctx, offset, value, size);
351         return;
352     }
353 
354     /*
355      * Finish with raw access to the register values
356      */
357     xive_tm_raw_write(tctx, offset, value, size);
358 }
359 
360 static uint64_t xive_tm_read(void *opaque, hwaddr offset, unsigned size)
361 {
362     PowerPCCPU *cpu = POWERPC_CPU(current_cpu);
363     XiveTCTX *tctx = cpu->tctx;
364     const XiveTmOp *xto;
365 
366     /*
367      * TODO: check V bit in Q[0-3]W2, check PTER bit associated with CPU
368      */
369 
370     /*
371      * First, check for special operations in the 2K region
372      */
373     if (offset & 0x800) {
374         xto = xive_tm_find_op(offset, size, false);
375         if (!xto) {
376             qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid read access to TIMA"
377                           "@%"HWADDR_PRIx"\n", offset);
378             return -1;
379         }
380         return xto->read_handler(tctx, offset, size);
381     }
382 
383     /*
384      * Then, for special operations in the region below 2K.
385      */
386     xto = xive_tm_find_op(offset, size, false);
387     if (xto) {
388         return xto->read_handler(tctx, offset, size);
389     }
390 
391     /*
392      * Finish with raw access to the register values
393      */
394     return xive_tm_raw_read(tctx, offset, size);
395 }
396 
397 const MemoryRegionOps xive_tm_ops = {
398     .read = xive_tm_read,
399     .write = xive_tm_write,
400     .endianness = DEVICE_BIG_ENDIAN,
401     .valid = {
402         .min_access_size = 1,
403         .max_access_size = 8,
404     },
405     .impl = {
406         .min_access_size = 1,
407         .max_access_size = 8,
408     },
409 };
410 
411 static inline uint32_t xive_tctx_word2(uint8_t *ring)
412 {
413     return *((uint32_t *) &ring[TM_WORD2]);
414 }
415 
416 static char *xive_tctx_ring_print(uint8_t *ring)
417 {
418     uint32_t w2 = xive_tctx_word2(ring);
419 
420     return g_strdup_printf("%02x   %02x  %02x    %02x   %02x  "
421                    "%02x  %02x   %02x  %08x",
422                    ring[TM_NSR], ring[TM_CPPR], ring[TM_IPB], ring[TM_LSMFB],
423                    ring[TM_ACK_CNT], ring[TM_INC], ring[TM_AGE], ring[TM_PIPR],
424                    be32_to_cpu(w2));
425 }
426 
427 static const char * const xive_tctx_ring_names[] = {
428     "USER", "OS", "POOL", "PHYS",
429 };
430 
431 void xive_tctx_pic_print_info(XiveTCTX *tctx, Monitor *mon)
432 {
433     int cpu_index = tctx->cs ? tctx->cs->cpu_index : -1;
434     int i;
435 
436     monitor_printf(mon, "CPU[%04x]:   QW   NSR CPPR IPB LSMFB ACK# INC AGE PIPR"
437                    "  W2\n", cpu_index);
438 
439     for (i = 0; i < XIVE_TM_RING_COUNT; i++) {
440         char *s = xive_tctx_ring_print(&tctx->regs[i * XIVE_TM_RING_SIZE]);
441         monitor_printf(mon, "CPU[%04x]: %4s    %s\n", cpu_index,
442                        xive_tctx_ring_names[i], s);
443         g_free(s);
444     }
445 }
446 
447 static void xive_tctx_reset(void *dev)
448 {
449     XiveTCTX *tctx = XIVE_TCTX(dev);
450 
451     memset(tctx->regs, 0, sizeof(tctx->regs));
452 
453     /* Set some defaults */
454     tctx->regs[TM_QW1_OS + TM_LSMFB] = 0xFF;
455     tctx->regs[TM_QW1_OS + TM_ACK_CNT] = 0xFF;
456     tctx->regs[TM_QW1_OS + TM_AGE] = 0xFF;
457 
458     /*
459      * Initialize PIPR to 0xFF to avoid phantom interrupts when the
460      * CPPR is first set.
461      */
462     tctx->regs[TM_QW1_OS + TM_PIPR] =
463         ipb_to_pipr(tctx->regs[TM_QW1_OS + TM_IPB]);
464 }
465 
466 static void xive_tctx_realize(DeviceState *dev, Error **errp)
467 {
468     XiveTCTX *tctx = XIVE_TCTX(dev);
469     PowerPCCPU *cpu;
470     CPUPPCState *env;
471     Object *obj;
472     Error *local_err = NULL;
473 
474     obj = object_property_get_link(OBJECT(dev), "cpu", &local_err);
475     if (!obj) {
476         error_propagate(errp, local_err);
477         error_prepend(errp, "required link 'cpu' not found: ");
478         return;
479     }
480 
481     cpu = POWERPC_CPU(obj);
482     tctx->cs = CPU(obj);
483 
484     env = &cpu->env;
485     switch (PPC_INPUT(env)) {
486     case PPC_FLAGS_INPUT_POWER7:
487         tctx->output = env->irq_inputs[POWER7_INPUT_INT];
488         break;
489 
490     default:
491         error_setg(errp, "XIVE interrupt controller does not support "
492                    "this CPU bus model");
493         return;
494     }
495 
496     qemu_register_reset(xive_tctx_reset, dev);
497 }
498 
499 static void xive_tctx_unrealize(DeviceState *dev, Error **errp)
500 {
501     qemu_unregister_reset(xive_tctx_reset, dev);
502 }
503 
504 static const VMStateDescription vmstate_xive_tctx = {
505     .name = TYPE_XIVE_TCTX,
506     .version_id = 1,
507     .minimum_version_id = 1,
508     .fields = (VMStateField[]) {
509         VMSTATE_BUFFER(regs, XiveTCTX),
510         VMSTATE_END_OF_LIST()
511     },
512 };
513 
514 static void xive_tctx_class_init(ObjectClass *klass, void *data)
515 {
516     DeviceClass *dc = DEVICE_CLASS(klass);
517 
518     dc->desc = "XIVE Interrupt Thread Context";
519     dc->realize = xive_tctx_realize;
520     dc->unrealize = xive_tctx_unrealize;
521     dc->vmsd = &vmstate_xive_tctx;
522 }
523 
524 static const TypeInfo xive_tctx_info = {
525     .name          = TYPE_XIVE_TCTX,
526     .parent        = TYPE_DEVICE,
527     .instance_size = sizeof(XiveTCTX),
528     .class_init    = xive_tctx_class_init,
529 };
530 
531 Object *xive_tctx_create(Object *cpu, XiveRouter *xrtr, Error **errp)
532 {
533     Error *local_err = NULL;
534     Object *obj;
535 
536     obj = object_new(TYPE_XIVE_TCTX);
537     object_property_add_child(cpu, TYPE_XIVE_TCTX, obj, &error_abort);
538     object_unref(obj);
539     object_property_add_const_link(obj, "cpu", cpu, &error_abort);
540     object_property_set_bool(obj, true, "realized", &local_err);
541     if (local_err) {
542         goto error;
543     }
544 
545     return obj;
546 
547 error:
548     object_unparent(obj);
549     error_propagate(errp, local_err);
550     return NULL;
551 }
552 
553 /*
554  * XIVE ESB helpers
555  */
556 
557 static uint8_t xive_esb_set(uint8_t *pq, uint8_t value)
558 {
559     uint8_t old_pq = *pq & 0x3;
560 
561     *pq &= ~0x3;
562     *pq |= value & 0x3;
563 
564     return old_pq;
565 }
566 
567 static bool xive_esb_trigger(uint8_t *pq)
568 {
569     uint8_t old_pq = *pq & 0x3;
570 
571     switch (old_pq) {
572     case XIVE_ESB_RESET:
573         xive_esb_set(pq, XIVE_ESB_PENDING);
574         return true;
575     case XIVE_ESB_PENDING:
576     case XIVE_ESB_QUEUED:
577         xive_esb_set(pq, XIVE_ESB_QUEUED);
578         return false;
579     case XIVE_ESB_OFF:
580         xive_esb_set(pq, XIVE_ESB_OFF);
581         return false;
582     default:
583          g_assert_not_reached();
584     }
585 }
586 
587 static bool xive_esb_eoi(uint8_t *pq)
588 {
589     uint8_t old_pq = *pq & 0x3;
590 
591     switch (old_pq) {
592     case XIVE_ESB_RESET:
593     case XIVE_ESB_PENDING:
594         xive_esb_set(pq, XIVE_ESB_RESET);
595         return false;
596     case XIVE_ESB_QUEUED:
597         xive_esb_set(pq, XIVE_ESB_PENDING);
598         return true;
599     case XIVE_ESB_OFF:
600         xive_esb_set(pq, XIVE_ESB_OFF);
601         return false;
602     default:
603          g_assert_not_reached();
604     }
605 }
606 
607 /*
608  * XIVE Interrupt Source (or IVSE)
609  */
610 
611 uint8_t xive_source_esb_get(XiveSource *xsrc, uint32_t srcno)
612 {
613     assert(srcno < xsrc->nr_irqs);
614 
615     return xsrc->status[srcno] & 0x3;
616 }
617 
618 uint8_t xive_source_esb_set(XiveSource *xsrc, uint32_t srcno, uint8_t pq)
619 {
620     assert(srcno < xsrc->nr_irqs);
621 
622     return xive_esb_set(&xsrc->status[srcno], pq);
623 }
624 
625 /*
626  * Returns whether the event notification should be forwarded.
627  */
628 static bool xive_source_lsi_trigger(XiveSource *xsrc, uint32_t srcno)
629 {
630     uint8_t old_pq = xive_source_esb_get(xsrc, srcno);
631 
632     xsrc->status[srcno] |= XIVE_STATUS_ASSERTED;
633 
634     switch (old_pq) {
635     case XIVE_ESB_RESET:
636         xive_source_esb_set(xsrc, srcno, XIVE_ESB_PENDING);
637         return true;
638     default:
639         return false;
640     }
641 }
642 
643 /*
644  * Returns whether the event notification should be forwarded.
645  */
646 static bool xive_source_esb_trigger(XiveSource *xsrc, uint32_t srcno)
647 {
648     bool ret;
649 
650     assert(srcno < xsrc->nr_irqs);
651 
652     ret = xive_esb_trigger(&xsrc->status[srcno]);
653 
654     if (xive_source_irq_is_lsi(xsrc, srcno) &&
655         xive_source_esb_get(xsrc, srcno) == XIVE_ESB_QUEUED) {
656         qemu_log_mask(LOG_GUEST_ERROR,
657                       "XIVE: queued an event on LSI IRQ %d\n", srcno);
658     }
659 
660     return ret;
661 }
662 
663 /*
664  * Returns whether the event notification should be forwarded.
665  */
666 static bool xive_source_esb_eoi(XiveSource *xsrc, uint32_t srcno)
667 {
668     bool ret;
669 
670     assert(srcno < xsrc->nr_irqs);
671 
672     ret = xive_esb_eoi(&xsrc->status[srcno]);
673 
674     /*
675      * LSI sources do not set the Q bit but they can still be
676      * asserted, in which case we should forward a new event
677      * notification
678      */
679     if (xive_source_irq_is_lsi(xsrc, srcno) &&
680         xsrc->status[srcno] & XIVE_STATUS_ASSERTED) {
681         ret = xive_source_lsi_trigger(xsrc, srcno);
682     }
683 
684     return ret;
685 }
686 
687 /*
688  * Forward the source event notification to the Router
689  */
690 static void xive_source_notify(XiveSource *xsrc, int srcno)
691 {
692     XiveNotifierClass *xnc = XIVE_NOTIFIER_GET_CLASS(xsrc->xive);
693 
694     if (xnc->notify) {
695         xnc->notify(xsrc->xive, srcno);
696     }
697 }
698 
699 /*
700  * In a two pages ESB MMIO setting, even page is the trigger page, odd
701  * page is for management
702  */
703 static inline bool addr_is_even(hwaddr addr, uint32_t shift)
704 {
705     return !((addr >> shift) & 1);
706 }
707 
708 static inline bool xive_source_is_trigger_page(XiveSource *xsrc, hwaddr addr)
709 {
710     return xive_source_esb_has_2page(xsrc) &&
711         addr_is_even(addr, xsrc->esb_shift - 1);
712 }
713 
714 /*
715  * ESB MMIO loads
716  *                      Trigger page    Management/EOI page
717  *
718  * ESB MMIO setting     2 pages         1 or 2 pages
719  *
720  * 0x000 .. 0x3FF       -1              EOI and return 0|1
721  * 0x400 .. 0x7FF       -1              EOI and return 0|1
722  * 0x800 .. 0xBFF       -1              return PQ
723  * 0xC00 .. 0xCFF       -1              return PQ and atomically PQ=00
724  * 0xD00 .. 0xDFF       -1              return PQ and atomically PQ=01
725  * 0xE00 .. 0xDFF       -1              return PQ and atomically PQ=10
726  * 0xF00 .. 0xDFF       -1              return PQ and atomically PQ=11
727  */
728 static uint64_t xive_source_esb_read(void *opaque, hwaddr addr, unsigned size)
729 {
730     XiveSource *xsrc = XIVE_SOURCE(opaque);
731     uint32_t offset = addr & 0xFFF;
732     uint32_t srcno = addr >> xsrc->esb_shift;
733     uint64_t ret = -1;
734 
735     /* In a two pages ESB MMIO setting, trigger page should not be read */
736     if (xive_source_is_trigger_page(xsrc, addr)) {
737         qemu_log_mask(LOG_GUEST_ERROR,
738                       "XIVE: invalid load on IRQ %d trigger page at "
739                       "0x%"HWADDR_PRIx"\n", srcno, addr);
740         return -1;
741     }
742 
743     switch (offset) {
744     case XIVE_ESB_LOAD_EOI ... XIVE_ESB_LOAD_EOI + 0x7FF:
745         ret = xive_source_esb_eoi(xsrc, srcno);
746 
747         /* Forward the source event notification for routing */
748         if (ret) {
749             xive_source_notify(xsrc, srcno);
750         }
751         break;
752 
753     case XIVE_ESB_GET ... XIVE_ESB_GET + 0x3FF:
754         ret = xive_source_esb_get(xsrc, srcno);
755         break;
756 
757     case XIVE_ESB_SET_PQ_00 ... XIVE_ESB_SET_PQ_00 + 0x0FF:
758     case XIVE_ESB_SET_PQ_01 ... XIVE_ESB_SET_PQ_01 + 0x0FF:
759     case XIVE_ESB_SET_PQ_10 ... XIVE_ESB_SET_PQ_10 + 0x0FF:
760     case XIVE_ESB_SET_PQ_11 ... XIVE_ESB_SET_PQ_11 + 0x0FF:
761         ret = xive_source_esb_set(xsrc, srcno, (offset >> 8) & 0x3);
762         break;
763     default:
764         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid ESB load addr %x\n",
765                       offset);
766     }
767 
768     return ret;
769 }
770 
771 /*
772  * ESB MMIO stores
773  *                      Trigger page    Management/EOI page
774  *
775  * ESB MMIO setting     2 pages         1 or 2 pages
776  *
777  * 0x000 .. 0x3FF       Trigger         Trigger
778  * 0x400 .. 0x7FF       Trigger         EOI
779  * 0x800 .. 0xBFF       Trigger         undefined
780  * 0xC00 .. 0xCFF       Trigger         PQ=00
781  * 0xD00 .. 0xDFF       Trigger         PQ=01
782  * 0xE00 .. 0xDFF       Trigger         PQ=10
783  * 0xF00 .. 0xDFF       Trigger         PQ=11
784  */
785 static void xive_source_esb_write(void *opaque, hwaddr addr,
786                                   uint64_t value, unsigned size)
787 {
788     XiveSource *xsrc = XIVE_SOURCE(opaque);
789     uint32_t offset = addr & 0xFFF;
790     uint32_t srcno = addr >> xsrc->esb_shift;
791     bool notify = false;
792 
793     /* In a two pages ESB MMIO setting, trigger page only triggers */
794     if (xive_source_is_trigger_page(xsrc, addr)) {
795         notify = xive_source_esb_trigger(xsrc, srcno);
796         goto out;
797     }
798 
799     switch (offset) {
800     case 0 ... 0x3FF:
801         notify = xive_source_esb_trigger(xsrc, srcno);
802         break;
803 
804     case XIVE_ESB_STORE_EOI ... XIVE_ESB_STORE_EOI + 0x3FF:
805         if (!(xsrc->esb_flags & XIVE_SRC_STORE_EOI)) {
806             qemu_log_mask(LOG_GUEST_ERROR,
807                           "XIVE: invalid Store EOI for IRQ %d\n", srcno);
808             return;
809         }
810 
811         notify = xive_source_esb_eoi(xsrc, srcno);
812         break;
813 
814     case XIVE_ESB_SET_PQ_00 ... XIVE_ESB_SET_PQ_00 + 0x0FF:
815     case XIVE_ESB_SET_PQ_01 ... XIVE_ESB_SET_PQ_01 + 0x0FF:
816     case XIVE_ESB_SET_PQ_10 ... XIVE_ESB_SET_PQ_10 + 0x0FF:
817     case XIVE_ESB_SET_PQ_11 ... XIVE_ESB_SET_PQ_11 + 0x0FF:
818         xive_source_esb_set(xsrc, srcno, (offset >> 8) & 0x3);
819         break;
820 
821     default:
822         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid ESB write addr %x\n",
823                       offset);
824         return;
825     }
826 
827 out:
828     /* Forward the source event notification for routing */
829     if (notify) {
830         xive_source_notify(xsrc, srcno);
831     }
832 }
833 
834 static const MemoryRegionOps xive_source_esb_ops = {
835     .read = xive_source_esb_read,
836     .write = xive_source_esb_write,
837     .endianness = DEVICE_BIG_ENDIAN,
838     .valid = {
839         .min_access_size = 8,
840         .max_access_size = 8,
841     },
842     .impl = {
843         .min_access_size = 8,
844         .max_access_size = 8,
845     },
846 };
847 
848 void xive_source_set_irq(void *opaque, int srcno, int val)
849 {
850     XiveSource *xsrc = XIVE_SOURCE(opaque);
851     bool notify = false;
852 
853     if (xive_source_irq_is_lsi(xsrc, srcno)) {
854         if (val) {
855             notify = xive_source_lsi_trigger(xsrc, srcno);
856         } else {
857             xsrc->status[srcno] &= ~XIVE_STATUS_ASSERTED;
858         }
859     } else {
860         if (val) {
861             notify = xive_source_esb_trigger(xsrc, srcno);
862         }
863     }
864 
865     /* Forward the source event notification for routing */
866     if (notify) {
867         xive_source_notify(xsrc, srcno);
868     }
869 }
870 
871 void xive_source_pic_print_info(XiveSource *xsrc, uint32_t offset, Monitor *mon)
872 {
873     int i;
874 
875     for (i = 0; i < xsrc->nr_irqs; i++) {
876         uint8_t pq = xive_source_esb_get(xsrc, i);
877 
878         if (pq == XIVE_ESB_OFF) {
879             continue;
880         }
881 
882         monitor_printf(mon, "  %08x %s %c%c%c\n", i + offset,
883                        xive_source_irq_is_lsi(xsrc, i) ? "LSI" : "MSI",
884                        pq & XIVE_ESB_VAL_P ? 'P' : '-',
885                        pq & XIVE_ESB_VAL_Q ? 'Q' : '-',
886                        xsrc->status[i] & XIVE_STATUS_ASSERTED ? 'A' : ' ');
887     }
888 }
889 
890 static void xive_source_reset(void *dev)
891 {
892     XiveSource *xsrc = XIVE_SOURCE(dev);
893 
894     /* Do not clear the LSI bitmap */
895 
896     /* PQs are initialized to 0b01 (Q=1) which corresponds to "ints off" */
897     memset(xsrc->status, XIVE_ESB_OFF, xsrc->nr_irqs);
898 }
899 
900 static void xive_source_realize(DeviceState *dev, Error **errp)
901 {
902     XiveSource *xsrc = XIVE_SOURCE(dev);
903     Object *obj;
904     Error *local_err = NULL;
905 
906     obj = object_property_get_link(OBJECT(dev), "xive", &local_err);
907     if (!obj) {
908         error_propagate(errp, local_err);
909         error_prepend(errp, "required link 'xive' not found: ");
910         return;
911     }
912 
913     xsrc->xive = XIVE_NOTIFIER(obj);
914 
915     if (!xsrc->nr_irqs) {
916         error_setg(errp, "Number of interrupt needs to be greater than 0");
917         return;
918     }
919 
920     if (xsrc->esb_shift != XIVE_ESB_4K &&
921         xsrc->esb_shift != XIVE_ESB_4K_2PAGE &&
922         xsrc->esb_shift != XIVE_ESB_64K &&
923         xsrc->esb_shift != XIVE_ESB_64K_2PAGE) {
924         error_setg(errp, "Invalid ESB shift setting");
925         return;
926     }
927 
928     xsrc->status = g_malloc0(xsrc->nr_irqs);
929     xsrc->lsi_map = bitmap_new(xsrc->nr_irqs);
930 
931     memory_region_init_io(&xsrc->esb_mmio, OBJECT(xsrc),
932                           &xive_source_esb_ops, xsrc, "xive.esb",
933                           (1ull << xsrc->esb_shift) * xsrc->nr_irqs);
934 
935     qemu_register_reset(xive_source_reset, dev);
936 }
937 
938 static const VMStateDescription vmstate_xive_source = {
939     .name = TYPE_XIVE_SOURCE,
940     .version_id = 1,
941     .minimum_version_id = 1,
942     .fields = (VMStateField[]) {
943         VMSTATE_UINT32_EQUAL(nr_irqs, XiveSource, NULL),
944         VMSTATE_VBUFFER_UINT32(status, XiveSource, 1, NULL, nr_irqs),
945         VMSTATE_END_OF_LIST()
946     },
947 };
948 
949 /*
950  * The default XIVE interrupt source setting for the ESB MMIOs is two
951  * 64k pages without Store EOI, to be in sync with KVM.
952  */
953 static Property xive_source_properties[] = {
954     DEFINE_PROP_UINT64("flags", XiveSource, esb_flags, 0),
955     DEFINE_PROP_UINT32("nr-irqs", XiveSource, nr_irqs, 0),
956     DEFINE_PROP_UINT32("shift", XiveSource, esb_shift, XIVE_ESB_64K_2PAGE),
957     DEFINE_PROP_END_OF_LIST(),
958 };
959 
960 static void xive_source_class_init(ObjectClass *klass, void *data)
961 {
962     DeviceClass *dc = DEVICE_CLASS(klass);
963 
964     dc->desc    = "XIVE Interrupt Source";
965     dc->props   = xive_source_properties;
966     dc->realize = xive_source_realize;
967     dc->vmsd    = &vmstate_xive_source;
968 }
969 
970 static const TypeInfo xive_source_info = {
971     .name          = TYPE_XIVE_SOURCE,
972     .parent        = TYPE_DEVICE,
973     .instance_size = sizeof(XiveSource),
974     .class_init    = xive_source_class_init,
975 };
976 
977 /*
978  * XiveEND helpers
979  */
980 
981 void xive_end_queue_pic_print_info(XiveEND *end, uint32_t width, Monitor *mon)
982 {
983     uint64_t qaddr_base = (uint64_t) be32_to_cpu(end->w2 & 0x0fffffff) << 32
984         | be32_to_cpu(end->w3);
985     uint32_t qsize = xive_get_field32(END_W0_QSIZE, end->w0);
986     uint32_t qindex = xive_get_field32(END_W1_PAGE_OFF, end->w1);
987     uint32_t qentries = 1 << (qsize + 10);
988     int i;
989 
990     /*
991      * print out the [ (qindex - (width - 1)) .. (qindex + 1)] window
992      */
993     monitor_printf(mon, " [ ");
994     qindex = (qindex - (width - 1)) & (qentries - 1);
995     for (i = 0; i < width; i++) {
996         uint64_t qaddr = qaddr_base + (qindex << 2);
997         uint32_t qdata = -1;
998 
999         if (dma_memory_read(&address_space_memory, qaddr, &qdata,
1000                             sizeof(qdata))) {
1001             qemu_log_mask(LOG_GUEST_ERROR, "XIVE: failed to read EQ @0x%"
1002                           HWADDR_PRIx "\n", qaddr);
1003             return;
1004         }
1005         monitor_printf(mon, "%s%08x ", i == width - 1 ? "^" : "",
1006                        be32_to_cpu(qdata));
1007         qindex = (qindex + 1) & (qentries - 1);
1008     }
1009 }
1010 
1011 void xive_end_pic_print_info(XiveEND *end, uint32_t end_idx, Monitor *mon)
1012 {
1013     uint64_t qaddr_base = (uint64_t) be32_to_cpu(end->w2 & 0x0fffffff) << 32
1014         | be32_to_cpu(end->w3);
1015     uint32_t qindex = xive_get_field32(END_W1_PAGE_OFF, end->w1);
1016     uint32_t qgen = xive_get_field32(END_W1_GENERATION, end->w1);
1017     uint32_t qsize = xive_get_field32(END_W0_QSIZE, end->w0);
1018     uint32_t qentries = 1 << (qsize + 10);
1019 
1020     uint32_t nvt = xive_get_field32(END_W6_NVT_INDEX, end->w6);
1021     uint8_t priority = xive_get_field32(END_W7_F0_PRIORITY, end->w7);
1022 
1023     if (!xive_end_is_valid(end)) {
1024         return;
1025     }
1026 
1027     monitor_printf(mon, "  %08x %c%c%c%c%c prio:%d nvt:%04x eq:@%08"PRIx64
1028                    "% 6d/%5d ^%d", end_idx,
1029                    xive_end_is_valid(end)    ? 'v' : '-',
1030                    xive_end_is_enqueue(end)  ? 'q' : '-',
1031                    xive_end_is_notify(end)   ? 'n' : '-',
1032                    xive_end_is_backlog(end)  ? 'b' : '-',
1033                    xive_end_is_escalate(end) ? 'e' : '-',
1034                    priority, nvt, qaddr_base, qindex, qentries, qgen);
1035 
1036     xive_end_queue_pic_print_info(end, 6, mon);
1037     monitor_printf(mon, "]\n");
1038 }
1039 
1040 static void xive_end_enqueue(XiveEND *end, uint32_t data)
1041 {
1042     uint64_t qaddr_base = (uint64_t) be32_to_cpu(end->w2 & 0x0fffffff) << 32
1043         | be32_to_cpu(end->w3);
1044     uint32_t qsize = xive_get_field32(END_W0_QSIZE, end->w0);
1045     uint32_t qindex = xive_get_field32(END_W1_PAGE_OFF, end->w1);
1046     uint32_t qgen = xive_get_field32(END_W1_GENERATION, end->w1);
1047 
1048     uint64_t qaddr = qaddr_base + (qindex << 2);
1049     uint32_t qdata = cpu_to_be32((qgen << 31) | (data & 0x7fffffff));
1050     uint32_t qentries = 1 << (qsize + 10);
1051 
1052     if (dma_memory_write(&address_space_memory, qaddr, &qdata, sizeof(qdata))) {
1053         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: failed to write END data @0x%"
1054                       HWADDR_PRIx "\n", qaddr);
1055         return;
1056     }
1057 
1058     qindex = (qindex + 1) & (qentries - 1);
1059     if (qindex == 0) {
1060         qgen ^= 1;
1061         end->w1 = xive_set_field32(END_W1_GENERATION, end->w1, qgen);
1062     }
1063     end->w1 = xive_set_field32(END_W1_PAGE_OFF, end->w1, qindex);
1064 }
1065 
1066 /*
1067  * XIVE Router (aka. Virtualization Controller or IVRE)
1068  */
1069 
1070 int xive_router_get_eas(XiveRouter *xrtr, uint8_t eas_blk, uint32_t eas_idx,
1071                         XiveEAS *eas)
1072 {
1073     XiveRouterClass *xrc = XIVE_ROUTER_GET_CLASS(xrtr);
1074 
1075     return xrc->get_eas(xrtr, eas_blk, eas_idx, eas);
1076 }
1077 
1078 int xive_router_get_end(XiveRouter *xrtr, uint8_t end_blk, uint32_t end_idx,
1079                         XiveEND *end)
1080 {
1081    XiveRouterClass *xrc = XIVE_ROUTER_GET_CLASS(xrtr);
1082 
1083    return xrc->get_end(xrtr, end_blk, end_idx, end);
1084 }
1085 
1086 int xive_router_write_end(XiveRouter *xrtr, uint8_t end_blk, uint32_t end_idx,
1087                           XiveEND *end, uint8_t word_number)
1088 {
1089    XiveRouterClass *xrc = XIVE_ROUTER_GET_CLASS(xrtr);
1090 
1091    return xrc->write_end(xrtr, end_blk, end_idx, end, word_number);
1092 }
1093 
1094 int xive_router_get_nvt(XiveRouter *xrtr, uint8_t nvt_blk, uint32_t nvt_idx,
1095                         XiveNVT *nvt)
1096 {
1097    XiveRouterClass *xrc = XIVE_ROUTER_GET_CLASS(xrtr);
1098 
1099    return xrc->get_nvt(xrtr, nvt_blk, nvt_idx, nvt);
1100 }
1101 
1102 int xive_router_write_nvt(XiveRouter *xrtr, uint8_t nvt_blk, uint32_t nvt_idx,
1103                         XiveNVT *nvt, uint8_t word_number)
1104 {
1105    XiveRouterClass *xrc = XIVE_ROUTER_GET_CLASS(xrtr);
1106 
1107    return xrc->write_nvt(xrtr, nvt_blk, nvt_idx, nvt, word_number);
1108 }
1109 
1110 /*
1111  * The thread context register words are in big-endian format.
1112  */
1113 static int xive_presenter_tctx_match(XiveTCTX *tctx, uint8_t format,
1114                                      uint8_t nvt_blk, uint32_t nvt_idx,
1115                                      bool cam_ignore, uint32_t logic_serv)
1116 {
1117     uint32_t cam = xive_nvt_cam_line(nvt_blk, nvt_idx);
1118     uint32_t qw2w2 = xive_tctx_word2(&tctx->regs[TM_QW2_HV_POOL]);
1119     uint32_t qw1w2 = xive_tctx_word2(&tctx->regs[TM_QW1_OS]);
1120     uint32_t qw0w2 = xive_tctx_word2(&tctx->regs[TM_QW0_USER]);
1121 
1122     /*
1123      * TODO (PowerNV): ignore mode. The low order bits of the NVT
1124      * identifier are ignored in the "CAM" match.
1125      */
1126 
1127     if (format == 0) {
1128         if (cam_ignore == true) {
1129             /*
1130              * F=0 & i=1: Logical server notification (bits ignored at
1131              * the end of the NVT identifier)
1132              */
1133             qemu_log_mask(LOG_UNIMP, "XIVE: no support for LS NVT %x/%x\n",
1134                           nvt_blk, nvt_idx);
1135              return -1;
1136         }
1137 
1138         /* F=0 & i=0: Specific NVT notification */
1139 
1140         /* TODO (PowerNV) : PHYS ring */
1141 
1142         /* HV POOL ring */
1143         if ((be32_to_cpu(qw2w2) & TM_QW2W2_VP) &&
1144             cam == xive_get_field32(TM_QW2W2_POOL_CAM, qw2w2)) {
1145             return TM_QW2_HV_POOL;
1146         }
1147 
1148         /* OS ring */
1149         if ((be32_to_cpu(qw1w2) & TM_QW1W2_VO) &&
1150             cam == xive_get_field32(TM_QW1W2_OS_CAM, qw1w2)) {
1151             return TM_QW1_OS;
1152         }
1153     } else {
1154         /* F=1 : User level Event-Based Branch (EBB) notification */
1155 
1156         /* USER ring */
1157         if  ((be32_to_cpu(qw1w2) & TM_QW1W2_VO) &&
1158              (cam == xive_get_field32(TM_QW1W2_OS_CAM, qw1w2)) &&
1159              (be32_to_cpu(qw0w2) & TM_QW0W2_VU) &&
1160              (logic_serv == xive_get_field32(TM_QW0W2_LOGIC_SERV, qw0w2))) {
1161             return TM_QW0_USER;
1162         }
1163     }
1164     return -1;
1165 }
1166 
1167 typedef struct XiveTCTXMatch {
1168     XiveTCTX *tctx;
1169     uint8_t ring;
1170 } XiveTCTXMatch;
1171 
1172 static bool xive_presenter_match(XiveRouter *xrtr, uint8_t format,
1173                                  uint8_t nvt_blk, uint32_t nvt_idx,
1174                                  bool cam_ignore, uint8_t priority,
1175                                  uint32_t logic_serv, XiveTCTXMatch *match)
1176 {
1177     CPUState *cs;
1178 
1179     /*
1180      * TODO (PowerNV): handle chip_id overwrite of block field for
1181      * hardwired CAM compares
1182      */
1183 
1184     CPU_FOREACH(cs) {
1185         PowerPCCPU *cpu = POWERPC_CPU(cs);
1186         XiveTCTX *tctx = cpu->tctx;
1187         int ring;
1188 
1189         /*
1190          * HW checks that the CPU is enabled in the Physical Thread
1191          * Enable Register (PTER).
1192          */
1193 
1194         /*
1195          * Check the thread context CAM lines and record matches. We
1196          * will handle CPU exception delivery later
1197          */
1198         ring = xive_presenter_tctx_match(tctx, format, nvt_blk, nvt_idx,
1199                                          cam_ignore, logic_serv);
1200         /*
1201          * Save the context and follow on to catch duplicates, that we
1202          * don't support yet.
1203          */
1204         if (ring != -1) {
1205             if (match->tctx) {
1206                 qemu_log_mask(LOG_GUEST_ERROR, "XIVE: already found a thread "
1207                               "context NVT %x/%x\n", nvt_blk, nvt_idx);
1208                 return false;
1209             }
1210 
1211             match->ring = ring;
1212             match->tctx = tctx;
1213         }
1214     }
1215 
1216     if (!match->tctx) {
1217         qemu_log_mask(LOG_UNIMP, "XIVE: NVT %x/%x is not dispatched\n",
1218                       nvt_blk, nvt_idx);
1219         return false;
1220     }
1221 
1222     return true;
1223 }
1224 
1225 /*
1226  * This is our simple Xive Presenter Engine model. It is merged in the
1227  * Router as it does not require an extra object.
1228  *
1229  * It receives notification requests sent by the IVRE to find one
1230  * matching NVT (or more) dispatched on the processor threads. In case
1231  * of a single NVT notification, the process is abreviated and the
1232  * thread is signaled if a match is found. In case of a logical server
1233  * notification (bits ignored at the end of the NVT identifier), the
1234  * IVPE and IVRE select a winning thread using different filters. This
1235  * involves 2 or 3 exchanges on the PowerBus that the model does not
1236  * support.
1237  *
1238  * The parameters represent what is sent on the PowerBus
1239  */
1240 static void xive_presenter_notify(XiveRouter *xrtr, uint8_t format,
1241                                   uint8_t nvt_blk, uint32_t nvt_idx,
1242                                   bool cam_ignore, uint8_t priority,
1243                                   uint32_t logic_serv)
1244 {
1245     XiveNVT nvt;
1246     XiveTCTXMatch match = { .tctx = NULL, .ring = 0 };
1247     bool found;
1248 
1249     /* NVT cache lookup */
1250     if (xive_router_get_nvt(xrtr, nvt_blk, nvt_idx, &nvt)) {
1251         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: no NVT %x/%x\n",
1252                       nvt_blk, nvt_idx);
1253         return;
1254     }
1255 
1256     if (!xive_nvt_is_valid(&nvt)) {
1257         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: NVT %x/%x is invalid\n",
1258                       nvt_blk, nvt_idx);
1259         return;
1260     }
1261 
1262     found = xive_presenter_match(xrtr, format, nvt_blk, nvt_idx, cam_ignore,
1263                                  priority, logic_serv, &match);
1264     if (found) {
1265         ipb_update(&match.tctx->regs[match.ring], priority);
1266         xive_tctx_notify(match.tctx, match.ring);
1267         return;
1268     }
1269 
1270     /* Record the IPB in the associated NVT structure */
1271     ipb_update((uint8_t *) &nvt.w4, priority);
1272     xive_router_write_nvt(xrtr, nvt_blk, nvt_idx, &nvt, 4);
1273 
1274     /*
1275      * If no matching NVT is dispatched on a HW thread :
1276      * - update the NVT structure if backlog is activated
1277      * - escalate (ESe PQ bits and EAS in w4-5) if escalation is
1278      *   activated
1279      */
1280 }
1281 
1282 /*
1283  * An END trigger can come from an event trigger (IPI or HW) or from
1284  * another chip. We don't model the PowerBus but the END trigger
1285  * message has the same parameters than in the function below.
1286  */
1287 static void xive_router_end_notify(XiveRouter *xrtr, uint8_t end_blk,
1288                                    uint32_t end_idx, uint32_t end_data)
1289 {
1290     XiveEND end;
1291     uint8_t priority;
1292     uint8_t format;
1293 
1294     /* END cache lookup */
1295     if (xive_router_get_end(xrtr, end_blk, end_idx, &end)) {
1296         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: No END %x/%x\n", end_blk,
1297                       end_idx);
1298         return;
1299     }
1300 
1301     if (!xive_end_is_valid(&end)) {
1302         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: END %x/%x is invalid\n",
1303                       end_blk, end_idx);
1304         return;
1305     }
1306 
1307     if (xive_end_is_enqueue(&end)) {
1308         xive_end_enqueue(&end, end_data);
1309         /* Enqueuing event data modifies the EQ toggle and index */
1310         xive_router_write_end(xrtr, end_blk, end_idx, &end, 1);
1311     }
1312 
1313     /*
1314      * The W7 format depends on the F bit in W6. It defines the type
1315      * of the notification :
1316      *
1317      *   F=0 : single or multiple NVT notification
1318      *   F=1 : User level Event-Based Branch (EBB) notification, no
1319      *         priority
1320      */
1321     format = xive_get_field32(END_W6_FORMAT_BIT, end.w6);
1322     priority = xive_get_field32(END_W7_F0_PRIORITY, end.w7);
1323 
1324     /* The END is masked */
1325     if (format == 0 && priority == 0xff) {
1326         return;
1327     }
1328 
1329     /*
1330      * Check the END ESn (Event State Buffer for notification) for
1331      * even futher coalescing in the Router
1332      */
1333     if (!xive_end_is_notify(&end)) {
1334         uint8_t pq = xive_get_field32(END_W1_ESn, end.w1);
1335         bool notify = xive_esb_trigger(&pq);
1336 
1337         if (pq != xive_get_field32(END_W1_ESn, end.w1)) {
1338             end.w1 = xive_set_field32(END_W1_ESn, end.w1, pq);
1339             xive_router_write_end(xrtr, end_blk, end_idx, &end, 1);
1340         }
1341 
1342         /* ESn[Q]=1 : end of notification */
1343         if (!notify) {
1344             return;
1345         }
1346     }
1347 
1348     /*
1349      * Follows IVPE notification
1350      */
1351     xive_presenter_notify(xrtr, format,
1352                           xive_get_field32(END_W6_NVT_BLOCK, end.w6),
1353                           xive_get_field32(END_W6_NVT_INDEX, end.w6),
1354                           xive_get_field32(END_W7_F0_IGNORE, end.w7),
1355                           priority,
1356                           xive_get_field32(END_W7_F1_LOG_SERVER_ID, end.w7));
1357 
1358     /* TODO: Auto EOI. */
1359 }
1360 
1361 static void xive_router_notify(XiveNotifier *xn, uint32_t lisn)
1362 {
1363     XiveRouter *xrtr = XIVE_ROUTER(xn);
1364     uint8_t eas_blk = XIVE_SRCNO_BLOCK(lisn);
1365     uint32_t eas_idx = XIVE_SRCNO_INDEX(lisn);
1366     XiveEAS eas;
1367 
1368     /* EAS cache lookup */
1369     if (xive_router_get_eas(xrtr, eas_blk, eas_idx, &eas)) {
1370         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: Unknown LISN %x\n", lisn);
1371         return;
1372     }
1373 
1374     /*
1375      * The IVRE checks the State Bit Cache at this point. We skip the
1376      * SBC lookup because the state bits of the sources are modeled
1377      * internally in QEMU.
1378      */
1379 
1380     if (!xive_eas_is_valid(&eas)) {
1381         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid LISN %x\n", lisn);
1382         return;
1383     }
1384 
1385     if (xive_eas_is_masked(&eas)) {
1386         /* Notification completed */
1387         return;
1388     }
1389 
1390     /*
1391      * The event trigger becomes an END trigger
1392      */
1393     xive_router_end_notify(xrtr,
1394                            xive_get_field64(EAS_END_BLOCK, eas.w),
1395                            xive_get_field64(EAS_END_INDEX, eas.w),
1396                            xive_get_field64(EAS_END_DATA,  eas.w));
1397 }
1398 
1399 static void xive_router_class_init(ObjectClass *klass, void *data)
1400 {
1401     DeviceClass *dc = DEVICE_CLASS(klass);
1402     XiveNotifierClass *xnc = XIVE_NOTIFIER_CLASS(klass);
1403 
1404     dc->desc    = "XIVE Router Engine";
1405     xnc->notify = xive_router_notify;
1406 }
1407 
1408 static const TypeInfo xive_router_info = {
1409     .name          = TYPE_XIVE_ROUTER,
1410     .parent        = TYPE_SYS_BUS_DEVICE,
1411     .abstract      = true,
1412     .class_size    = sizeof(XiveRouterClass),
1413     .class_init    = xive_router_class_init,
1414     .interfaces    = (InterfaceInfo[]) {
1415         { TYPE_XIVE_NOTIFIER },
1416         { }
1417     }
1418 };
1419 
1420 void xive_eas_pic_print_info(XiveEAS *eas, uint32_t lisn, Monitor *mon)
1421 {
1422     if (!xive_eas_is_valid(eas)) {
1423         return;
1424     }
1425 
1426     monitor_printf(mon, "  %08x %s end:%02x/%04x data:%08x\n",
1427                    lisn, xive_eas_is_masked(eas) ? "M" : " ",
1428                    (uint8_t)  xive_get_field64(EAS_END_BLOCK, eas->w),
1429                    (uint32_t) xive_get_field64(EAS_END_INDEX, eas->w),
1430                    (uint32_t) xive_get_field64(EAS_END_DATA, eas->w));
1431 }
1432 
1433 /*
1434  * END ESB MMIO loads
1435  */
1436 static uint64_t xive_end_source_read(void *opaque, hwaddr addr, unsigned size)
1437 {
1438     XiveENDSource *xsrc = XIVE_END_SOURCE(opaque);
1439     uint32_t offset = addr & 0xFFF;
1440     uint8_t end_blk;
1441     uint32_t end_idx;
1442     XiveEND end;
1443     uint32_t end_esmask;
1444     uint8_t pq;
1445     uint64_t ret = -1;
1446 
1447     end_blk = xsrc->block_id;
1448     end_idx = addr >> (xsrc->esb_shift + 1);
1449 
1450     if (xive_router_get_end(xsrc->xrtr, end_blk, end_idx, &end)) {
1451         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: No END %x/%x\n", end_blk,
1452                       end_idx);
1453         return -1;
1454     }
1455 
1456     if (!xive_end_is_valid(&end)) {
1457         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: END %x/%x is invalid\n",
1458                       end_blk, end_idx);
1459         return -1;
1460     }
1461 
1462     end_esmask = addr_is_even(addr, xsrc->esb_shift) ? END_W1_ESn : END_W1_ESe;
1463     pq = xive_get_field32(end_esmask, end.w1);
1464 
1465     switch (offset) {
1466     case XIVE_ESB_LOAD_EOI ... XIVE_ESB_LOAD_EOI + 0x7FF:
1467         ret = xive_esb_eoi(&pq);
1468 
1469         /* Forward the source event notification for routing ?? */
1470         break;
1471 
1472     case XIVE_ESB_GET ... XIVE_ESB_GET + 0x3FF:
1473         ret = pq;
1474         break;
1475 
1476     case XIVE_ESB_SET_PQ_00 ... XIVE_ESB_SET_PQ_00 + 0x0FF:
1477     case XIVE_ESB_SET_PQ_01 ... XIVE_ESB_SET_PQ_01 + 0x0FF:
1478     case XIVE_ESB_SET_PQ_10 ... XIVE_ESB_SET_PQ_10 + 0x0FF:
1479     case XIVE_ESB_SET_PQ_11 ... XIVE_ESB_SET_PQ_11 + 0x0FF:
1480         ret = xive_esb_set(&pq, (offset >> 8) & 0x3);
1481         break;
1482     default:
1483         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid END ESB load addr %d\n",
1484                       offset);
1485         return -1;
1486     }
1487 
1488     if (pq != xive_get_field32(end_esmask, end.w1)) {
1489         end.w1 = xive_set_field32(end_esmask, end.w1, pq);
1490         xive_router_write_end(xsrc->xrtr, end_blk, end_idx, &end, 1);
1491     }
1492 
1493     return ret;
1494 }
1495 
1496 /*
1497  * END ESB MMIO stores are invalid
1498  */
1499 static void xive_end_source_write(void *opaque, hwaddr addr,
1500                                   uint64_t value, unsigned size)
1501 {
1502     qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid ESB write addr 0x%"
1503                   HWADDR_PRIx"\n", addr);
1504 }
1505 
1506 static const MemoryRegionOps xive_end_source_ops = {
1507     .read = xive_end_source_read,
1508     .write = xive_end_source_write,
1509     .endianness = DEVICE_BIG_ENDIAN,
1510     .valid = {
1511         .min_access_size = 8,
1512         .max_access_size = 8,
1513     },
1514     .impl = {
1515         .min_access_size = 8,
1516         .max_access_size = 8,
1517     },
1518 };
1519 
1520 static void xive_end_source_realize(DeviceState *dev, Error **errp)
1521 {
1522     XiveENDSource *xsrc = XIVE_END_SOURCE(dev);
1523     Object *obj;
1524     Error *local_err = NULL;
1525 
1526     obj = object_property_get_link(OBJECT(dev), "xive", &local_err);
1527     if (!obj) {
1528         error_propagate(errp, local_err);
1529         error_prepend(errp, "required link 'xive' not found: ");
1530         return;
1531     }
1532 
1533     xsrc->xrtr = XIVE_ROUTER(obj);
1534 
1535     if (!xsrc->nr_ends) {
1536         error_setg(errp, "Number of interrupt needs to be greater than 0");
1537         return;
1538     }
1539 
1540     if (xsrc->esb_shift != XIVE_ESB_4K &&
1541         xsrc->esb_shift != XIVE_ESB_64K) {
1542         error_setg(errp, "Invalid ESB shift setting");
1543         return;
1544     }
1545 
1546     /*
1547      * Each END is assigned an even/odd pair of MMIO pages, the even page
1548      * manages the ESn field while the odd page manages the ESe field.
1549      */
1550     memory_region_init_io(&xsrc->esb_mmio, OBJECT(xsrc),
1551                           &xive_end_source_ops, xsrc, "xive.end",
1552                           (1ull << (xsrc->esb_shift + 1)) * xsrc->nr_ends);
1553 }
1554 
1555 static Property xive_end_source_properties[] = {
1556     DEFINE_PROP_UINT8("block-id", XiveENDSource, block_id, 0),
1557     DEFINE_PROP_UINT32("nr-ends", XiveENDSource, nr_ends, 0),
1558     DEFINE_PROP_UINT32("shift", XiveENDSource, esb_shift, XIVE_ESB_64K),
1559     DEFINE_PROP_END_OF_LIST(),
1560 };
1561 
1562 static void xive_end_source_class_init(ObjectClass *klass, void *data)
1563 {
1564     DeviceClass *dc = DEVICE_CLASS(klass);
1565 
1566     dc->desc    = "XIVE END Source";
1567     dc->props   = xive_end_source_properties;
1568     dc->realize = xive_end_source_realize;
1569 }
1570 
1571 static const TypeInfo xive_end_source_info = {
1572     .name          = TYPE_XIVE_END_SOURCE,
1573     .parent        = TYPE_DEVICE,
1574     .instance_size = sizeof(XiveENDSource),
1575     .class_init    = xive_end_source_class_init,
1576 };
1577 
1578 /*
1579  * XIVE Fabric
1580  */
1581 static const TypeInfo xive_fabric_info = {
1582     .name = TYPE_XIVE_NOTIFIER,
1583     .parent = TYPE_INTERFACE,
1584     .class_size = sizeof(XiveNotifierClass),
1585 };
1586 
1587 static void xive_register_types(void)
1588 {
1589     type_register_static(&xive_source_info);
1590     type_register_static(&xive_fabric_info);
1591     type_register_static(&xive_router_info);
1592     type_register_static(&xive_end_source_info);
1593     type_register_static(&xive_tctx_info);
1594 }
1595 
1596 type_init(xive_register_types)
1597