xref: /openbmc/qemu/hw/intc/xive.c (revision 701ab1857a9175a86e3ad6f18958df631af86a62)
1 /*
2  * QEMU PowerPC XIVE interrupt controller model
3  *
4  * Copyright (c) 2017-2018, IBM Corporation.
5  *
6  * SPDX-License-Identifier: GPL-2.0-or-later
7  */
8 
9 #include "qemu/osdep.h"
10 #include "qemu/log.h"
11 #include "qemu/module.h"
12 #include "qapi/error.h"
13 #include "target/ppc/cpu.h"
14 #include "system/cpus.h"
15 #include "system/dma.h"
16 #include "system/reset.h"
17 #include "hw/qdev-properties.h"
18 #include "migration/vmstate.h"
19 #include "hw/irq.h"
20 #include "hw/ppc/xive.h"
21 #include "hw/ppc/xive2.h"
22 #include "hw/ppc/xive_regs.h"
23 #include "trace.h"
24 
25 /*
26  * XIVE Thread Interrupt Management context
27  */
28 bool xive_nsr_indicates_exception(uint8_t ring, uint8_t nsr)
29 {
30     switch (ring) {
31     case TM_QW1_OS:
32         return !!(nsr & TM_QW1_NSR_EO);
33     case TM_QW2_HV_POOL:
34     case TM_QW3_HV_PHYS:
35         return !!(nsr & TM_QW3_NSR_HE);
36     default:
37         g_assert_not_reached();
38     }
39 }
40 
41 bool xive_nsr_indicates_group_exception(uint8_t ring, uint8_t nsr)
42 {
43     if ((nsr & TM_NSR_GRP_LVL) > 0) {
44         g_assert(xive_nsr_indicates_exception(ring, nsr));
45         return true;
46     }
47     return false;
48 }
49 
50 uint8_t xive_nsr_exception_ring(uint8_t ring, uint8_t nsr)
51 {
52     /* NSR determines if pool/phys ring is for phys or pool interrupt */
53     if ((ring == TM_QW3_HV_PHYS) || (ring == TM_QW2_HV_POOL)) {
54         uint8_t he = (nsr & TM_QW3_NSR_HE) >> 6;
55 
56         if (he == TM_QW3_NSR_HE_PHYS) {
57             return TM_QW3_HV_PHYS;
58         } else if (he == TM_QW3_NSR_HE_POOL) {
59             return TM_QW2_HV_POOL;
60         } else {
61             /* Don't support LSI mode */
62             g_assert_not_reached();
63         }
64     }
65     return ring;
66 }
67 
68 static qemu_irq xive_tctx_output(XiveTCTX *tctx, uint8_t ring)
69 {
70         switch (ring) {
71         case TM_QW0_USER:
72                 return 0; /* Not supported */
73         case TM_QW1_OS:
74                 return tctx->os_output;
75         case TM_QW2_HV_POOL:
76         case TM_QW3_HV_PHYS:
77                 return tctx->hv_output;
78         default:
79                 return 0;
80         }
81 }
82 
83 static uint64_t xive_tctx_accept(XiveTCTX *tctx, uint8_t ring)
84 {
85     uint8_t *regs = &tctx->regs[ring];
86     uint8_t nsr = regs[TM_NSR];
87 
88     qemu_irq_lower(xive_tctx_output(tctx, ring));
89 
90     if (xive_nsr_indicates_exception(ring, nsr)) {
91         uint8_t cppr = regs[TM_PIPR];
92         uint8_t alt_ring;
93         uint8_t *alt_regs;
94 
95         alt_ring = xive_nsr_exception_ring(ring, nsr);
96         alt_regs = &tctx->regs[alt_ring];
97 
98         regs[TM_CPPR] = cppr;
99 
100         /*
101          * If the interrupt was for a specific VP, reset the pending
102          * buffer bit, otherwise clear the logical server indicator
103          */
104         if (!xive_nsr_indicates_group_exception(ring, nsr)) {
105             alt_regs[TM_IPB] &= ~xive_priority_to_ipb(cppr);
106         }
107 
108         /* Clear the exception from NSR */
109         regs[TM_NSR] = 0;
110 
111         trace_xive_tctx_accept(tctx->cs->cpu_index, alt_ring,
112                                alt_regs[TM_IPB], regs[TM_PIPR],
113                                regs[TM_CPPR], regs[TM_NSR]);
114     }
115 
116     return ((uint64_t)nsr << 8) | regs[TM_CPPR];
117 }
118 
119 void xive_tctx_notify(XiveTCTX *tctx, uint8_t ring, uint8_t group_level)
120 {
121     /* HV_POOL ring uses HV_PHYS NSR, CPPR and PIPR registers */
122     uint8_t alt_ring = (ring == TM_QW2_HV_POOL) ? TM_QW3_HV_PHYS : ring;
123     uint8_t *alt_regs = &tctx->regs[alt_ring];
124     uint8_t *regs = &tctx->regs[ring];
125 
126     if (alt_regs[TM_PIPR] < alt_regs[TM_CPPR]) {
127         switch (ring) {
128         case TM_QW1_OS:
129             regs[TM_NSR] = TM_QW1_NSR_EO | (group_level & 0x3F);
130             break;
131         case TM_QW2_HV_POOL:
132             alt_regs[TM_NSR] = (TM_QW3_NSR_HE_POOL << 6) | (group_level & 0x3F);
133             break;
134         case TM_QW3_HV_PHYS:
135             regs[TM_NSR] = (TM_QW3_NSR_HE_PHYS << 6) | (group_level & 0x3F);
136             break;
137         default:
138             g_assert_not_reached();
139         }
140         trace_xive_tctx_notify(tctx->cs->cpu_index, ring,
141                                regs[TM_IPB], alt_regs[TM_PIPR],
142                                alt_regs[TM_CPPR], alt_regs[TM_NSR]);
143         qemu_irq_raise(xive_tctx_output(tctx, ring));
144     } else {
145         alt_regs[TM_NSR] = 0;
146         qemu_irq_lower(xive_tctx_output(tctx, ring));
147     }
148 }
149 
150 void xive_tctx_reset_signal(XiveTCTX *tctx, uint8_t ring)
151 {
152     /*
153      * Lower the External interrupt. Used when pulling a context. It is
154      * necessary to avoid catching it in the higher privilege context. It
155      * should be raised again when re-pushing the lower privilege context.
156      */
157     qemu_irq_lower(xive_tctx_output(tctx, ring));
158 }
159 
160 static void xive_tctx_set_cppr(XiveTCTX *tctx, uint8_t ring, uint8_t cppr)
161 {
162     uint8_t *regs = &tctx->regs[ring];
163     uint8_t pipr_min;
164     uint8_t ring_min;
165 
166     trace_xive_tctx_set_cppr(tctx->cs->cpu_index, ring,
167                              regs[TM_IPB], regs[TM_PIPR],
168                              cppr, regs[TM_NSR]);
169 
170     if (cppr > XIVE_PRIORITY_MAX) {
171         cppr = 0xff;
172     }
173 
174     tctx->regs[ring + TM_CPPR] = cppr;
175 
176     /*
177      * Recompute the PIPR based on local pending interrupts.  The PHYS
178      * ring must take the minimum of both the PHYS and POOL PIPR values.
179      */
180     pipr_min = xive_ipb_to_pipr(regs[TM_IPB]);
181     ring_min = ring;
182 
183     /* PHYS updates also depend on POOL values */
184     if (ring == TM_QW3_HV_PHYS) {
185         uint8_t *pool_regs = &tctx->regs[TM_QW2_HV_POOL];
186 
187         /* POOL values only matter if POOL ctx is valid */
188         if (pool_regs[TM_WORD2] & 0x80) {
189 
190             uint8_t pool_pipr = xive_ipb_to_pipr(pool_regs[TM_IPB]);
191 
192             /*
193              * Determine highest priority interrupt and
194              * remember which ring has it.
195              */
196             if (pool_pipr < pipr_min) {
197                 pipr_min = pool_pipr;
198                 ring_min = TM_QW2_HV_POOL;
199             }
200         }
201     }
202 
203     regs[TM_PIPR] = pipr_min;
204 
205     /* CPPR has changed, check if we need to raise a pending exception */
206     xive_tctx_notify(tctx, ring_min, 0);
207 }
208 
209 void xive_tctx_pipr_update(XiveTCTX *tctx, uint8_t ring, uint8_t priority,
210                            uint8_t group_level)
211  {
212     /* HV_POOL ring uses HV_PHYS NSR, CPPR and PIPR registers */
213     uint8_t alt_ring = (ring == TM_QW2_HV_POOL) ? TM_QW3_HV_PHYS : ring;
214     uint8_t *alt_regs = &tctx->regs[alt_ring];
215     uint8_t *regs = &tctx->regs[ring];
216 
217     if (group_level == 0) {
218         /* VP-specific */
219         regs[TM_IPB] |= xive_priority_to_ipb(priority);
220         alt_regs[TM_PIPR] = xive_ipb_to_pipr(regs[TM_IPB]);
221     } else {
222         /* VP-group */
223         alt_regs[TM_PIPR] = xive_priority_to_pipr(priority);
224     }
225     xive_tctx_notify(tctx, ring, group_level);
226  }
227 
228 /*
229  * XIVE Thread Interrupt Management Area (TIMA)
230  */
231 
232 static void xive_tm_set_hv_cppr(XivePresenter *xptr, XiveTCTX *tctx,
233                                 hwaddr offset, uint64_t value, unsigned size)
234 {
235     xive_tctx_set_cppr(tctx, TM_QW3_HV_PHYS, value & 0xff);
236 }
237 
238 static uint64_t xive_tm_ack_hv_reg(XivePresenter *xptr, XiveTCTX *tctx,
239                                    hwaddr offset, unsigned size)
240 {
241     return xive_tctx_accept(tctx, TM_QW3_HV_PHYS);
242 }
243 
244 static void xive_pool_cam_decode(uint32_t cam, uint8_t *nvt_blk,
245                                  uint32_t *nvt_idx, bool *vp)
246 {
247     if (nvt_blk) {
248         *nvt_blk = xive_nvt_blk(cam);
249     }
250     if (nvt_idx) {
251         *nvt_idx = xive_nvt_idx(cam);
252     }
253     if (vp) {
254         *vp = !!(cam & TM_QW2W2_VP);
255     }
256 }
257 
258 static uint32_t xive_tctx_get_pool_cam(XiveTCTX *tctx, uint8_t *nvt_blk,
259                                        uint32_t *nvt_idx, bool *vp)
260 {
261     uint32_t qw2w2 = xive_tctx_word2(&tctx->regs[TM_QW2_HV_POOL]);
262     uint32_t cam = be32_to_cpu(qw2w2);
263 
264     xive_pool_cam_decode(cam, nvt_blk, nvt_idx, vp);
265     return qw2w2;
266 }
267 
268 static void xive_tctx_set_pool_cam(XiveTCTX *tctx, uint32_t qw2w2)
269 {
270     memcpy(&tctx->regs[TM_QW2_HV_POOL + TM_WORD2], &qw2w2, 4);
271 }
272 
273 static uint64_t xive_tm_pull_pool_ctx(XivePresenter *xptr, XiveTCTX *tctx,
274                                       hwaddr offset, unsigned size)
275 {
276     uint32_t qw2w2;
277     uint32_t qw2w2_new;
278     uint8_t nvt_blk;
279     uint32_t nvt_idx;
280     bool vp;
281 
282     qw2w2 = xive_tctx_get_pool_cam(tctx, &nvt_blk, &nvt_idx, &vp);
283 
284     if (!vp) {
285         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: pull invalid POOL NVT %x/%x !?\n",
286                       nvt_blk, nvt_idx);
287     }
288 
289     /* Invalidate CAM line */
290     qw2w2_new = xive_set_field32(TM_QW2W2_VP, qw2w2, 0);
291     xive_tctx_set_pool_cam(tctx, qw2w2_new);
292 
293     xive_tctx_reset_signal(tctx, TM_QW1_OS);
294     xive_tctx_reset_signal(tctx, TM_QW2_HV_POOL);
295     return qw2w2;
296 }
297 
298 static uint64_t xive_tm_pull_phys_ctx(XivePresenter *xptr, XiveTCTX *tctx,
299                                       hwaddr offset, unsigned size)
300 {
301     uint8_t qw3b8 = tctx->regs[TM_QW3_HV_PHYS + TM_WORD2];
302     uint8_t qw3b8_new;
303 
304     qw3b8 = tctx->regs[TM_QW3_HV_PHYS + TM_WORD2];
305     if (!(qw3b8 & TM_QW3B8_VT)) {
306         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: pulling invalid PHYS thread!?\n");
307     }
308     qw3b8_new = qw3b8 & ~TM_QW3B8_VT;
309     tctx->regs[TM_QW3_HV_PHYS + TM_WORD2] = qw3b8_new;
310 
311     xive_tctx_reset_signal(tctx, TM_QW1_OS);
312     xive_tctx_reset_signal(tctx, TM_QW3_HV_PHYS);
313     return qw3b8;
314 }
315 
316 static void xive_tm_vt_push(XivePresenter *xptr, XiveTCTX *tctx, hwaddr offset,
317                             uint64_t value, unsigned size)
318 {
319     tctx->regs[TM_QW3_HV_PHYS + TM_WORD2] = value & 0xff;
320 }
321 
322 static uint64_t xive_tm_vt_poll(XivePresenter *xptr, XiveTCTX *tctx,
323                                 hwaddr offset, unsigned size)
324 {
325     return tctx->regs[TM_QW3_HV_PHYS + TM_WORD2] & 0xff;
326 }
327 
328 /*
329  * Define an access map for each page of the TIMA that we will use in
330  * the memory region ops to filter values when doing loads and stores
331  * of raw registers values
332  *
333  * Registers accessibility bits :
334  *
335  *    0x0 - no access
336  *    0x1 - write only
337  *    0x2 - read only
338  *    0x3 - read/write
339  */
340 
341 static const uint8_t xive_tm_hw_view[] = {
342     3, 0, 0, 0,   0, 0, 0, 0,   3, 3, 3, 3,   0, 0, 0, 0, /* QW-0 User */
343     3, 3, 3, 3,   3, 3, 0, 2,   3, 3, 3, 3,   0, 0, 0, 0, /* QW-1 OS   */
344     0, 0, 3, 3,   0, 3, 3, 0,   3, 3, 3, 3,   0, 0, 0, 0, /* QW-2 POOL */
345     3, 3, 3, 3,   0, 3, 0, 2,   3, 0, 0, 3,   3, 3, 3, 0, /* QW-3 PHYS */
346 };
347 
348 static const uint8_t xive_tm_hv_view[] = {
349     3, 0, 0, 0,   0, 0, 0, 0,   3, 3, 3, 3,   0, 0, 0, 0, /* QW-0 User */
350     3, 3, 3, 3,   3, 3, 0, 2,   3, 3, 3, 3,   0, 0, 0, 0, /* QW-1 OS   */
351     0, 0, 3, 3,   0, 3, 3, 0,   0, 3, 3, 3,   0, 0, 0, 0, /* QW-2 POOL */
352     3, 3, 3, 3,   0, 3, 0, 2,   3, 0, 0, 3,   0, 0, 0, 0, /* QW-3 PHYS */
353 };
354 
355 static const uint8_t xive_tm_os_view[] = {
356     3, 0, 0, 0,   0, 0, 0, 0,   3, 3, 3, 3,   0, 0, 0, 0, /* QW-0 User */
357     2, 3, 2, 2,   2, 2, 0, 2,   0, 0, 0, 0,   0, 0, 0, 0, /* QW-1 OS   */
358     0, 0, 0, 0,   0, 0, 0, 0,   0, 0, 0, 0,   0, 0, 0, 0, /* QW-2 POOL */
359     0, 0, 0, 0,   0, 0, 0, 0,   0, 0, 0, 0,   0, 0, 0, 0, /* QW-3 PHYS */
360 };
361 
362 static const uint8_t xive_tm_user_view[] = {
363     3, 0, 0, 0,   0, 0, 0, 0,   0, 0, 0, 0,   0, 0, 0, 0, /* QW-0 User */
364     0, 0, 0, 0,   0, 0, 0, 0,   0, 0, 0, 0,   0, 0, 0, 0, /* QW-1 OS   */
365     0, 0, 0, 0,   0, 0, 0, 0,   0, 0, 0, 0,   0, 0, 0, 0, /* QW-2 POOL */
366     0, 0, 0, 0,   0, 0, 0, 0,   0, 0, 0, 0,   0, 0, 0, 0, /* QW-3 PHYS */
367 };
368 
369 /*
370  * Overall TIMA access map for the thread interrupt management context
371  * registers
372  */
373 static const uint8_t *xive_tm_views[] = {
374     [XIVE_TM_HW_PAGE]   = xive_tm_hw_view,
375     [XIVE_TM_HV_PAGE]   = xive_tm_hv_view,
376     [XIVE_TM_OS_PAGE]   = xive_tm_os_view,
377     [XIVE_TM_USER_PAGE] = xive_tm_user_view,
378 };
379 
380 /*
381  * Computes a register access mask for a given offset in the TIMA
382  */
383 static uint64_t xive_tm_mask(hwaddr offset, unsigned size, bool write)
384 {
385     uint8_t page_offset = (offset >> TM_SHIFT) & 0x3;
386     uint8_t reg_offset = offset & TM_REG_OFFSET;
387     uint8_t reg_mask = write ? 0x1 : 0x2;
388     uint64_t mask = 0x0;
389     int i;
390 
391     for (i = 0; i < size; i++) {
392         if (xive_tm_views[page_offset][reg_offset + i] & reg_mask) {
393             mask |= (uint64_t) 0xff << (8 * (size - i - 1));
394         }
395     }
396 
397     return mask;
398 }
399 
400 static void xive_tm_raw_write(XiveTCTX *tctx, hwaddr offset, uint64_t value,
401                               unsigned size)
402 {
403     uint8_t ring_offset = offset & TM_RING_OFFSET;
404     uint8_t reg_offset = offset & TM_REG_OFFSET;
405     uint64_t mask = xive_tm_mask(offset, size, true);
406     int i;
407 
408     /*
409      * Only 4 or 8 bytes stores are allowed and the User ring is
410      * excluded
411      */
412     if (size < 4 || !mask || ring_offset == TM_QW0_USER) {
413         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid write access at TIMA @%"
414                       HWADDR_PRIx" size %d\n", offset, size);
415         return;
416     }
417 
418     /*
419      * Use the register offset for the raw values and filter out
420      * reserved values
421      */
422     for (i = 0; i < size; i++) {
423         uint8_t byte_mask = (mask >> (8 * (size - i - 1)));
424         if (byte_mask) {
425             tctx->regs[reg_offset + i] = (value >> (8 * (size - i - 1))) &
426                 byte_mask;
427         }
428     }
429 }
430 
431 static uint64_t xive_tm_raw_read(XiveTCTX *tctx, hwaddr offset, unsigned size)
432 {
433     uint8_t ring_offset = offset & TM_RING_OFFSET;
434     uint8_t reg_offset = offset & TM_REG_OFFSET;
435     uint64_t mask = xive_tm_mask(offset, size, false);
436     uint64_t ret;
437     int i;
438 
439     /*
440      * Only 4 or 8 bytes loads are allowed and the User ring is
441      * excluded
442      */
443     if (size < 4 || !mask || ring_offset == TM_QW0_USER) {
444         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid read access at TIMA @%"
445                       HWADDR_PRIx" size %d\n", offset, size);
446         return -1;
447     }
448 
449     /* Use the register offset for the raw values */
450     ret = 0;
451     for (i = 0; i < size; i++) {
452         ret |= (uint64_t) tctx->regs[reg_offset + i] << (8 * (size - i - 1));
453     }
454 
455     /* filter out reserved values */
456     return ret & mask;
457 }
458 
459 /*
460  * The TM context is mapped twice within each page. Stores and loads
461  * to the first mapping below 2K write and read the specified values
462  * without modification. The second mapping above 2K performs specific
463  * state changes (side effects) in addition to setting/returning the
464  * interrupt management area context of the processor thread.
465  */
466 static uint64_t xive_tm_ack_os_reg(XivePresenter *xptr, XiveTCTX *tctx,
467                                    hwaddr offset, unsigned size)
468 {
469     return xive_tctx_accept(tctx, TM_QW1_OS);
470 }
471 
472 static void xive_tm_set_os_cppr(XivePresenter *xptr, XiveTCTX *tctx,
473                                 hwaddr offset, uint64_t value, unsigned size)
474 {
475     xive_tctx_set_cppr(tctx, TM_QW1_OS, value & 0xff);
476 }
477 
478 static void xive_tctx_set_lgs(XiveTCTX *tctx, uint8_t ring, uint8_t lgs)
479 {
480     uint8_t *regs = &tctx->regs[ring];
481 
482     regs[TM_LGS] = lgs;
483 }
484 
485 static void xive_tm_set_os_lgs(XivePresenter *xptr, XiveTCTX *tctx,
486                           hwaddr offset, uint64_t value, unsigned size)
487 {
488     xive_tctx_set_lgs(tctx, TM_QW1_OS, value & 0xff);
489 }
490 
491 /*
492  * Adjust the PIPR to allow a CPU to process event queues of other
493  * priorities during one physical interrupt cycle.
494  */
495 static void xive_tm_set_os_pending(XivePresenter *xptr, XiveTCTX *tctx,
496                                    hwaddr offset, uint64_t value, unsigned size)
497 {
498     xive_tctx_pipr_update(tctx, TM_QW1_OS, value & 0xff, 0);
499 }
500 
501 static void xive_os_cam_decode(uint32_t cam, uint8_t *nvt_blk,
502                                uint32_t *nvt_idx, bool *vo)
503 {
504     if (nvt_blk) {
505         *nvt_blk = xive_nvt_blk(cam);
506     }
507     if (nvt_idx) {
508         *nvt_idx = xive_nvt_idx(cam);
509     }
510     if (vo) {
511         *vo = !!(cam & TM_QW1W2_VO);
512     }
513 }
514 
515 static uint32_t xive_tctx_get_os_cam(XiveTCTX *tctx, uint8_t *nvt_blk,
516                                      uint32_t *nvt_idx, bool *vo)
517 {
518     uint32_t qw1w2 = xive_tctx_word2(&tctx->regs[TM_QW1_OS]);
519     uint32_t cam = be32_to_cpu(qw1w2);
520 
521     xive_os_cam_decode(cam, nvt_blk, nvt_idx, vo);
522     return qw1w2;
523 }
524 
525 static void xive_tctx_set_os_cam(XiveTCTX *tctx, uint32_t qw1w2)
526 {
527     memcpy(&tctx->regs[TM_QW1_OS + TM_WORD2], &qw1w2, 4);
528 }
529 
530 static uint64_t xive_tm_pull_os_ctx(XivePresenter *xptr, XiveTCTX *tctx,
531                                     hwaddr offset, unsigned size)
532 {
533     uint32_t qw1w2;
534     uint32_t qw1w2_new;
535     uint8_t nvt_blk;
536     uint32_t nvt_idx;
537     bool vo;
538 
539     qw1w2 = xive_tctx_get_os_cam(tctx, &nvt_blk, &nvt_idx, &vo);
540 
541     if (!vo) {
542         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: pull invalid OS NVT %x/%x !?\n",
543                       nvt_blk, nvt_idx);
544     }
545 
546     /* Invalidate CAM line */
547     qw1w2_new = xive_set_field32(TM_QW1W2_VO, qw1w2, 0);
548     xive_tctx_set_os_cam(tctx, qw1w2_new);
549 
550     xive_tctx_reset_signal(tctx, TM_QW1_OS);
551     return qw1w2;
552 }
553 
554 static void xive_tctx_need_resend(XiveRouter *xrtr, XiveTCTX *tctx,
555                                   uint8_t nvt_blk, uint32_t nvt_idx)
556 {
557     XiveNVT nvt;
558     uint8_t ipb;
559 
560     /*
561      * Grab the associated NVT to pull the pending bits, and merge
562      * them with the IPB of the thread interrupt context registers
563      */
564     if (xive_router_get_nvt(xrtr, nvt_blk, nvt_idx, &nvt)) {
565         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid NVT %x/%x\n",
566                           nvt_blk, nvt_idx);
567         return;
568     }
569 
570     ipb = xive_get_field32(NVT_W4_IPB, nvt.w4);
571 
572     if (ipb) {
573         /* Reset the NVT value */
574         nvt.w4 = xive_set_field32(NVT_W4_IPB, nvt.w4, 0);
575         xive_router_write_nvt(xrtr, nvt_blk, nvt_idx, &nvt, 4);
576 
577         uint8_t *regs = &tctx->regs[TM_QW1_OS];
578         regs[TM_IPB] |= ipb;
579     }
580 
581     /*
582      * Always call xive_tctx_pipr_update(). Even if there were no
583      * escalation triggered, there could be a pending interrupt which
584      * was saved when the context was pulled and that we need to take
585      * into account by recalculating the PIPR (which is not
586      * saved/restored).
587      * It will also raise the External interrupt signal if needed.
588      */
589     xive_tctx_pipr_update(tctx, TM_QW1_OS, 0xFF, 0); /* fxb */
590 }
591 
592 /*
593  * Updating the OS CAM line can trigger a resend of interrupt
594  */
595 static void xive_tm_push_os_ctx(XivePresenter *xptr, XiveTCTX *tctx,
596                                 hwaddr offset, uint64_t value, unsigned size)
597 {
598     uint32_t cam = value;
599     uint32_t qw1w2 = cpu_to_be32(cam);
600     uint8_t nvt_blk;
601     uint32_t nvt_idx;
602     bool vo;
603 
604     xive_os_cam_decode(cam, &nvt_blk, &nvt_idx, &vo);
605 
606     /* First update the registers */
607     xive_tctx_set_os_cam(tctx, qw1w2);
608 
609     /* Check the interrupt pending bits */
610     if (vo) {
611         xive_tctx_need_resend(XIVE_ROUTER(xptr), tctx, nvt_blk, nvt_idx);
612     }
613 }
614 
615 static uint32_t xive_presenter_get_config(XivePresenter *xptr)
616 {
617     XivePresenterClass *xpc = XIVE_PRESENTER_GET_CLASS(xptr);
618 
619     return xpc->get_config(xptr);
620 }
621 
622 /*
623  * Define a mapping of "special" operations depending on the TIMA page
624  * offset and the size of the operation.
625  */
626 typedef struct XiveTmOp {
627     uint8_t  page_offset;
628     uint32_t op_offset;
629     unsigned size;
630     void     (*write_handler)(XivePresenter *xptr, XiveTCTX *tctx,
631                               hwaddr offset,
632                               uint64_t value, unsigned size);
633     uint64_t (*read_handler)(XivePresenter *xptr, XiveTCTX *tctx, hwaddr offset,
634                              unsigned size);
635 } XiveTmOp;
636 
637 static const XiveTmOp xive_tm_operations[] = {
638     /*
639      * MMIOs below 2K : raw values and special operations without side
640      * effects
641      */
642     { XIVE_TM_OS_PAGE, TM_QW1_OS + TM_CPPR,       1, xive_tm_set_os_cppr,
643                                                      NULL },
644     { XIVE_TM_HV_PAGE, TM_QW1_OS + TM_WORD2,      4, xive_tm_push_os_ctx,
645                                                      NULL },
646     { XIVE_TM_HV_PAGE, TM_QW3_HV_PHYS + TM_CPPR,  1, xive_tm_set_hv_cppr,
647                                                      NULL },
648     { XIVE_TM_HV_PAGE, TM_QW3_HV_PHYS + TM_WORD2, 1, xive_tm_vt_push,
649                                                      NULL },
650     { XIVE_TM_HV_PAGE, TM_QW3_HV_PHYS + TM_WORD2, 1, NULL,
651                                                      xive_tm_vt_poll },
652 
653     /* MMIOs above 2K : special operations with side effects */
654     { XIVE_TM_OS_PAGE, TM_SPC_ACK_OS_REG,         2, NULL,
655                                                      xive_tm_ack_os_reg },
656     { XIVE_TM_OS_PAGE, TM_SPC_SET_OS_PENDING,     1, xive_tm_set_os_pending,
657                                                      NULL },
658     { XIVE_TM_HV_PAGE, TM_SPC_PULL_OS_CTX,        4, NULL,
659                                                      xive_tm_pull_os_ctx },
660     { XIVE_TM_HV_PAGE, TM_SPC_PULL_OS_CTX,        8, NULL,
661                                                      xive_tm_pull_os_ctx },
662     { XIVE_TM_HV_PAGE, TM_SPC_ACK_HV_REG,         2, NULL,
663                                                      xive_tm_ack_hv_reg },
664     { XIVE_TM_HV_PAGE, TM_SPC_PULL_POOL_CTX,      4, NULL,
665                                                      xive_tm_pull_pool_ctx },
666     { XIVE_TM_HV_PAGE, TM_SPC_PULL_POOL_CTX,      8, NULL,
667                                                      xive_tm_pull_pool_ctx },
668     { XIVE_TM_HV_PAGE, TM_SPC_PULL_PHYS_CTX,      1, NULL,
669                                                      xive_tm_pull_phys_ctx },
670 };
671 
672 static const XiveTmOp xive2_tm_operations[] = {
673     /*
674      * MMIOs below 2K : raw values and special operations without side
675      * effects
676      */
677     { XIVE_TM_OS_PAGE, TM_QW1_OS + TM_CPPR,       1, xive2_tm_set_os_cppr,
678                                                      NULL },
679     { XIVE_TM_HV_PAGE, TM_QW1_OS + TM_WORD2,      4, xive2_tm_push_os_ctx,
680                                                      NULL },
681     { XIVE_TM_HV_PAGE, TM_QW1_OS + TM_WORD2,      8, xive2_tm_push_os_ctx,
682                                                      NULL },
683     { XIVE_TM_OS_PAGE, TM_QW1_OS + TM_LGS,        1, xive_tm_set_os_lgs,
684                                                      NULL },
685     { XIVE_TM_HV_PAGE, TM_QW3_HV_PHYS + TM_CPPR,  1, xive2_tm_set_hv_cppr,
686                                                      NULL },
687     { XIVE_TM_HV_PAGE, TM_QW3_HV_PHYS + TM_WORD2, 1, xive_tm_vt_push,
688                                                      NULL },
689     { XIVE_TM_HV_PAGE, TM_QW3_HV_PHYS + TM_WORD2, 1, NULL,
690                                                      xive_tm_vt_poll },
691     { XIVE_TM_HV_PAGE, TM_QW3_HV_PHYS + TM_T,     1, xive2_tm_set_hv_target,
692                                                      NULL },
693 
694     /* MMIOs above 2K : special operations with side effects */
695     { XIVE_TM_OS_PAGE, TM_SPC_ACK_OS_REG,         2, NULL,
696                                                      xive_tm_ack_os_reg },
697     { XIVE_TM_OS_PAGE, TM_SPC_SET_OS_PENDING,     1, xive_tm_set_os_pending,
698                                                      NULL },
699     { XIVE_TM_HV_PAGE, TM_SPC_PULL_OS_CTX_G2,     4, NULL,
700                                                      xive2_tm_pull_os_ctx },
701     { XIVE_TM_HV_PAGE, TM_SPC_PULL_OS_CTX,        4, NULL,
702                                                      xive2_tm_pull_os_ctx },
703     { XIVE_TM_HV_PAGE, TM_SPC_PULL_OS_CTX,        8, NULL,
704                                                      xive2_tm_pull_os_ctx },
705     { XIVE_TM_HV_PAGE, TM_SPC_ACK_HV_REG,         2, NULL,
706                                                      xive_tm_ack_hv_reg },
707     { XIVE_TM_HV_PAGE, TM_SPC_PULL_POOL_CTX_G2,   4, NULL,
708                                                      xive_tm_pull_pool_ctx },
709     { XIVE_TM_HV_PAGE, TM_SPC_PULL_POOL_CTX,      4, NULL,
710                                                      xive_tm_pull_pool_ctx },
711     { XIVE_TM_HV_PAGE, TM_SPC_PULL_POOL_CTX,      8, NULL,
712                                                      xive_tm_pull_pool_ctx },
713     { XIVE_TM_HV_PAGE, TM_SPC_PULL_OS_CTX_OL,     1, xive2_tm_pull_os_ctx_ol,
714                                                      NULL },
715     { XIVE_TM_HV_PAGE, TM_SPC_PULL_PHYS_CTX_G2,   4, NULL,
716                                                      xive_tm_pull_phys_ctx },
717     { XIVE_TM_HV_PAGE, TM_SPC_PULL_PHYS_CTX,      1, NULL,
718                                                      xive_tm_pull_phys_ctx },
719     { XIVE_TM_HV_PAGE, TM_SPC_PULL_PHYS_CTX_OL,   1, xive2_tm_pull_phys_ctx_ol,
720                                                      NULL },
721 };
722 
723 static const XiveTmOp *xive_tm_find_op(XivePresenter *xptr, hwaddr offset,
724                                        unsigned size, bool write)
725 {
726     uint8_t page_offset = (offset >> TM_SHIFT) & 0x3;
727     uint32_t op_offset = offset & TM_ADDRESS_MASK;
728     const XiveTmOp *tm_ops;
729     int i, tm_ops_count;
730     uint32_t cfg;
731 
732     cfg = xive_presenter_get_config(xptr);
733     if (cfg & XIVE_PRESENTER_GEN1_TIMA_OS) {
734         tm_ops = xive_tm_operations;
735         tm_ops_count = ARRAY_SIZE(xive_tm_operations);
736     } else {
737         tm_ops = xive2_tm_operations;
738         tm_ops_count = ARRAY_SIZE(xive2_tm_operations);
739     }
740 
741     for (i = 0; i < tm_ops_count; i++) {
742         const XiveTmOp *xto = &tm_ops[i];
743 
744         /* Accesses done from a more privileged TIMA page is allowed */
745         if (xto->page_offset >= page_offset &&
746             xto->op_offset == op_offset &&
747             xto->size == size &&
748             ((write && xto->write_handler) || (!write && xto->read_handler))) {
749             return xto;
750         }
751     }
752     return NULL;
753 }
754 
755 /*
756  * TIMA MMIO handlers
757  */
758 void xive_tctx_tm_write(XivePresenter *xptr, XiveTCTX *tctx, hwaddr offset,
759                         uint64_t value, unsigned size)
760 {
761     const XiveTmOp *xto;
762 
763     trace_xive_tctx_tm_write(tctx->cs->cpu_index, offset, size, value);
764 
765     /*
766      * TODO: check V bit in Q[0-3]W2
767      */
768 
769     /*
770      * First, check for special operations in the 2K region
771      */
772     if (offset & TM_SPECIAL_OP) {
773         xto = xive_tm_find_op(tctx->xptr, offset, size, true);
774         if (!xto) {
775             qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid write access at TIMA "
776                           "@%"HWADDR_PRIx" size %d\n", offset, size);
777         } else {
778             xto->write_handler(xptr, tctx, offset, value, size);
779         }
780         return;
781     }
782 
783     /*
784      * Then, for special operations in the region below 2K.
785      */
786     xto = xive_tm_find_op(tctx->xptr, offset, size, true);
787     if (xto) {
788         xto->write_handler(xptr, tctx, offset, value, size);
789         return;
790     }
791 
792     /*
793      * Finish with raw access to the register values
794      */
795     xive_tm_raw_write(tctx, offset, value, size);
796 }
797 
798 uint64_t xive_tctx_tm_read(XivePresenter *xptr, XiveTCTX *tctx, hwaddr offset,
799                            unsigned size)
800 {
801     const XiveTmOp *xto;
802     uint64_t ret;
803 
804     /*
805      * TODO: check V bit in Q[0-3]W2
806      */
807 
808     /*
809      * First, check for special operations in the 2K region
810      */
811     if (offset & TM_SPECIAL_OP) {
812         xto = xive_tm_find_op(tctx->xptr, offset, size, false);
813         if (!xto) {
814             qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid read access to TIMA"
815                           "@%"HWADDR_PRIx" size %d\n", offset, size);
816             return -1;
817         }
818         ret = xto->read_handler(xptr, tctx, offset, size);
819         goto out;
820     }
821 
822     /*
823      * Then, for special operations in the region below 2K.
824      */
825     xto = xive_tm_find_op(tctx->xptr, offset, size, false);
826     if (xto) {
827         ret = xto->read_handler(xptr, tctx, offset, size);
828         goto out;
829     }
830 
831     /*
832      * Finish with raw access to the register values
833      */
834     ret = xive_tm_raw_read(tctx, offset, size);
835 out:
836     trace_xive_tctx_tm_read(tctx->cs->cpu_index, offset, size, ret);
837     return ret;
838 }
839 
840 static char *xive_tctx_ring_print(uint8_t *ring)
841 {
842     uint32_t w2 = xive_tctx_word2(ring);
843 
844     return g_strdup_printf("%02x   %02x  %02x    %02x   %02x  "
845                    "%02x  %02x   %02x  %08x",
846                    ring[TM_NSR], ring[TM_CPPR], ring[TM_IPB], ring[TM_LSMFB],
847                    ring[TM_ACK_CNT], ring[TM_INC], ring[TM_AGE], ring[TM_PIPR],
848                    be32_to_cpu(w2));
849 }
850 
851 static const char * const xive_tctx_ring_names[] = {
852     "USER", "OS", "POOL", "PHYS",
853 };
854 
855 /*
856  * kvm_irqchip_in_kernel() will cause the compiler to turn this
857  * info a nop if CONFIG_KVM isn't defined.
858  */
859 #define xive_in_kernel(xptr)                                            \
860     (kvm_irqchip_in_kernel() &&                                         \
861      ({                                                                 \
862          XivePresenterClass *xpc = XIVE_PRESENTER_GET_CLASS(xptr);      \
863          xpc->in_kernel ? xpc->in_kernel(xptr) : false;                 \
864      }))
865 
866 void xive_tctx_pic_print_info(XiveTCTX *tctx, GString *buf)
867 {
868     int cpu_index;
869     int i;
870 
871     /* Skip partially initialized vCPUs. This can happen on sPAPR when vCPUs
872      * are hot plugged or unplugged.
873      */
874     if (!tctx) {
875         return;
876     }
877 
878     cpu_index = tctx->cs ? tctx->cs->cpu_index : -1;
879 
880     if (xive_in_kernel(tctx->xptr)) {
881         Error *local_err = NULL;
882 
883         kvmppc_xive_cpu_synchronize_state(tctx, &local_err);
884         if (local_err) {
885             error_report_err(local_err);
886             return;
887         }
888     }
889 
890     if (xive_presenter_get_config(tctx->xptr) & XIVE_PRESENTER_GEN1_TIMA_OS) {
891         g_string_append_printf(buf, "CPU[%04x]:   "
892                                "QW   NSR CPPR IPB LSMFB ACK# INC AGE PIPR"
893                                "  W2\n", cpu_index);
894     } else {
895         g_string_append_printf(buf, "CPU[%04x]:   "
896                                "QW   NSR CPPR IPB LSMFB   -  LGS  T  PIPR"
897                                "  W2\n", cpu_index);
898     }
899 
900     for (i = 0; i < XIVE_TM_RING_COUNT; i++) {
901         char *s = xive_tctx_ring_print(&tctx->regs[i * XIVE_TM_RING_SIZE]);
902         g_string_append_printf(buf, "CPU[%04x]: %4s    %s\n",
903                                cpu_index, xive_tctx_ring_names[i], s);
904         g_free(s);
905     }
906 }
907 
908 void xive_tctx_reset(XiveTCTX *tctx)
909 {
910     memset(tctx->regs, 0, sizeof(tctx->regs));
911 
912     /* Set some defaults */
913     tctx->regs[TM_QW1_OS + TM_LSMFB] = 0xFF;
914     tctx->regs[TM_QW1_OS + TM_ACK_CNT] = 0xFF;
915     tctx->regs[TM_QW1_OS + TM_AGE] = 0xFF;
916     if (!(xive_presenter_get_config(tctx->xptr) &
917           XIVE_PRESENTER_GEN1_TIMA_OS)) {
918         tctx->regs[TM_QW1_OS + TM_OGEN] = 2;
919     }
920 
921     /*
922      * Initialize PIPR to 0xFF to avoid phantom interrupts when the
923      * CPPR is first set.
924      */
925     tctx->regs[TM_QW1_OS + TM_PIPR] =
926         xive_ipb_to_pipr(tctx->regs[TM_QW1_OS + TM_IPB]);
927     tctx->regs[TM_QW3_HV_PHYS + TM_PIPR] =
928         xive_ipb_to_pipr(tctx->regs[TM_QW3_HV_PHYS + TM_IPB]);
929 }
930 
931 static void xive_tctx_realize(DeviceState *dev, Error **errp)
932 {
933     XiveTCTX *tctx = XIVE_TCTX(dev);
934     PowerPCCPU *cpu;
935     CPUPPCState *env;
936 
937     assert(tctx->cs);
938     assert(tctx->xptr);
939 
940     cpu = POWERPC_CPU(tctx->cs);
941     env = &cpu->env;
942     switch (PPC_INPUT(env)) {
943     case PPC_FLAGS_INPUT_POWER9:
944         tctx->hv_output = qdev_get_gpio_in(DEVICE(cpu), POWER9_INPUT_HINT);
945         tctx->os_output = qdev_get_gpio_in(DEVICE(cpu), POWER9_INPUT_INT);
946         break;
947 
948     default:
949         error_setg(errp, "XIVE interrupt controller does not support "
950                    "this CPU bus model");
951         return;
952     }
953 
954     /* Connect the presenter to the VCPU (required for CPU hotplug) */
955     if (xive_in_kernel(tctx->xptr)) {
956         if (kvmppc_xive_cpu_connect(tctx, errp) < 0) {
957             return;
958         }
959     }
960 }
961 
962 static int vmstate_xive_tctx_pre_save(void *opaque)
963 {
964     XiveTCTX *tctx = XIVE_TCTX(opaque);
965     Error *local_err = NULL;
966     int ret;
967 
968     if (xive_in_kernel(tctx->xptr)) {
969         ret = kvmppc_xive_cpu_get_state(tctx, &local_err);
970         if (ret < 0) {
971             error_report_err(local_err);
972             return ret;
973         }
974     }
975 
976     return 0;
977 }
978 
979 static int vmstate_xive_tctx_post_load(void *opaque, int version_id)
980 {
981     XiveTCTX *tctx = XIVE_TCTX(opaque);
982     Error *local_err = NULL;
983     int ret;
984 
985     if (xive_in_kernel(tctx->xptr)) {
986         /*
987          * Required for hotplugged CPU, for which the state comes
988          * after all states of the machine.
989          */
990         ret = kvmppc_xive_cpu_set_state(tctx, &local_err);
991         if (ret < 0) {
992             error_report_err(local_err);
993             return ret;
994         }
995     }
996 
997     return 0;
998 }
999 
1000 static const VMStateDescription vmstate_xive_tctx = {
1001     .name = TYPE_XIVE_TCTX,
1002     .version_id = 1,
1003     .minimum_version_id = 1,
1004     .pre_save = vmstate_xive_tctx_pre_save,
1005     .post_load = vmstate_xive_tctx_post_load,
1006     .fields = (const VMStateField[]) {
1007         VMSTATE_BUFFER(regs, XiveTCTX),
1008         VMSTATE_END_OF_LIST()
1009     },
1010 };
1011 
1012 static const Property xive_tctx_properties[] = {
1013     DEFINE_PROP_LINK("cpu", XiveTCTX, cs, TYPE_CPU, CPUState *),
1014     DEFINE_PROP_LINK("presenter", XiveTCTX, xptr, TYPE_XIVE_PRESENTER,
1015                      XivePresenter *),
1016 };
1017 
1018 static void xive_tctx_class_init(ObjectClass *klass, const void *data)
1019 {
1020     DeviceClass *dc = DEVICE_CLASS(klass);
1021 
1022     dc->desc = "XIVE Interrupt Thread Context";
1023     dc->realize = xive_tctx_realize;
1024     dc->vmsd = &vmstate_xive_tctx;
1025     device_class_set_props(dc, xive_tctx_properties);
1026     /*
1027      * Reason: part of XIVE interrupt controller, needs to be wired up
1028      * by xive_tctx_create().
1029      */
1030     dc->user_creatable = false;
1031 }
1032 
1033 static const TypeInfo xive_tctx_info = {
1034     .name          = TYPE_XIVE_TCTX,
1035     .parent        = TYPE_DEVICE,
1036     .instance_size = sizeof(XiveTCTX),
1037     .class_init    = xive_tctx_class_init,
1038 };
1039 
1040 Object *xive_tctx_create(Object *cpu, XivePresenter *xptr, Error **errp)
1041 {
1042     Object *obj;
1043 
1044     obj = object_new(TYPE_XIVE_TCTX);
1045     object_property_add_child(cpu, TYPE_XIVE_TCTX, obj);
1046     object_unref(obj);
1047     object_property_set_link(obj, "cpu", cpu, &error_abort);
1048     object_property_set_link(obj, "presenter", OBJECT(xptr), &error_abort);
1049     if (!qdev_realize(DEVICE(obj), NULL, errp)) {
1050         object_unparent(obj);
1051         return NULL;
1052     }
1053     return obj;
1054 }
1055 
1056 void xive_tctx_destroy(XiveTCTX *tctx)
1057 {
1058     Object *obj = OBJECT(tctx);
1059 
1060     object_unparent(obj);
1061 }
1062 
1063 /*
1064  * XIVE ESB helpers
1065  */
1066 
1067 uint8_t xive_esb_set(uint8_t *pq, uint8_t value)
1068 {
1069     uint8_t old_pq = *pq & 0x3;
1070 
1071     *pq &= ~0x3;
1072     *pq |= value & 0x3;
1073 
1074     return old_pq;
1075 }
1076 
1077 bool xive_esb_trigger(uint8_t *pq)
1078 {
1079     uint8_t old_pq = *pq & 0x3;
1080 
1081     switch (old_pq) {
1082     case XIVE_ESB_RESET:
1083         xive_esb_set(pq, XIVE_ESB_PENDING);
1084         return true;
1085     case XIVE_ESB_PENDING:
1086     case XIVE_ESB_QUEUED:
1087         xive_esb_set(pq, XIVE_ESB_QUEUED);
1088         return false;
1089     case XIVE_ESB_OFF:
1090         xive_esb_set(pq, XIVE_ESB_OFF);
1091         return false;
1092     default:
1093          g_assert_not_reached();
1094     }
1095 }
1096 
1097 bool xive_esb_eoi(uint8_t *pq)
1098 {
1099     uint8_t old_pq = *pq & 0x3;
1100 
1101     switch (old_pq) {
1102     case XIVE_ESB_RESET:
1103     case XIVE_ESB_PENDING:
1104         xive_esb_set(pq, XIVE_ESB_RESET);
1105         return false;
1106     case XIVE_ESB_QUEUED:
1107         xive_esb_set(pq, XIVE_ESB_PENDING);
1108         return true;
1109     case XIVE_ESB_OFF:
1110         xive_esb_set(pq, XIVE_ESB_OFF);
1111         return false;
1112     default:
1113          g_assert_not_reached();
1114     }
1115 }
1116 
1117 /*
1118  * XIVE Interrupt Source (or IVSE)
1119  */
1120 
1121 uint8_t xive_source_esb_get(XiveSource *xsrc, uint32_t srcno)
1122 {
1123     assert(srcno < xsrc->nr_irqs);
1124 
1125     return xsrc->status[srcno] & 0x3;
1126 }
1127 
1128 uint8_t xive_source_esb_set(XiveSource *xsrc, uint32_t srcno, uint8_t pq)
1129 {
1130     assert(srcno < xsrc->nr_irqs);
1131 
1132     return xive_esb_set(&xsrc->status[srcno], pq);
1133 }
1134 
1135 /*
1136  * Returns whether the event notification should be forwarded.
1137  */
1138 static bool xive_source_lsi_trigger(XiveSource *xsrc, uint32_t srcno)
1139 {
1140     uint8_t old_pq = xive_source_esb_get(xsrc, srcno);
1141 
1142     xive_source_set_asserted(xsrc, srcno, true);
1143 
1144     switch (old_pq) {
1145     case XIVE_ESB_RESET:
1146         xive_source_esb_set(xsrc, srcno, XIVE_ESB_PENDING);
1147         return true;
1148     default:
1149         return false;
1150     }
1151 }
1152 
1153 /*
1154  * Sources can be configured with PQ offloading in which case the check
1155  * on the PQ state bits of MSIs is disabled
1156  */
1157 static bool xive_source_esb_disabled(XiveSource *xsrc, uint32_t srcno)
1158 {
1159     return (xsrc->esb_flags & XIVE_SRC_PQ_DISABLE) &&
1160         !xive_source_irq_is_lsi(xsrc, srcno);
1161 }
1162 
1163 /*
1164  * Returns whether the event notification should be forwarded.
1165  */
1166 static bool xive_source_esb_trigger(XiveSource *xsrc, uint32_t srcno)
1167 {
1168     bool ret;
1169 
1170     assert(srcno < xsrc->nr_irqs);
1171 
1172     if (xive_source_esb_disabled(xsrc, srcno)) {
1173         return true;
1174     }
1175 
1176     ret = xive_esb_trigger(&xsrc->status[srcno]);
1177 
1178     if (xive_source_irq_is_lsi(xsrc, srcno) &&
1179         xive_source_esb_get(xsrc, srcno) == XIVE_ESB_QUEUED) {
1180         qemu_log_mask(LOG_GUEST_ERROR,
1181                       "XIVE: queued an event on LSI IRQ %d\n", srcno);
1182     }
1183 
1184     return ret;
1185 }
1186 
1187 /*
1188  * Returns whether the event notification should be forwarded.
1189  */
1190 static bool xive_source_esb_eoi(XiveSource *xsrc, uint32_t srcno)
1191 {
1192     bool ret;
1193 
1194     assert(srcno < xsrc->nr_irqs);
1195 
1196     if (xive_source_esb_disabled(xsrc, srcno)) {
1197         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid EOI for IRQ %d\n", srcno);
1198         return false;
1199     }
1200 
1201     ret = xive_esb_eoi(&xsrc->status[srcno]);
1202 
1203     /*
1204      * LSI sources do not set the Q bit but they can still be
1205      * asserted, in which case we should forward a new event
1206      * notification
1207      */
1208     if (xive_source_irq_is_lsi(xsrc, srcno) &&
1209         xive_source_is_asserted(xsrc, srcno)) {
1210         ret = xive_source_lsi_trigger(xsrc, srcno);
1211     }
1212 
1213     return ret;
1214 }
1215 
1216 /*
1217  * Forward the source event notification to the Router
1218  */
1219 static void xive_source_notify(XiveSource *xsrc, int srcno)
1220 {
1221     XiveNotifierClass *xnc = XIVE_NOTIFIER_GET_CLASS(xsrc->xive);
1222     bool pq_checked = !xive_source_esb_disabled(xsrc, srcno);
1223 
1224     if (xnc->notify) {
1225         xnc->notify(xsrc->xive, srcno, pq_checked);
1226     }
1227 }
1228 
1229 /*
1230  * In a two pages ESB MMIO setting, even page is the trigger page, odd
1231  * page is for management
1232  */
1233 static inline bool addr_is_even(hwaddr addr, uint32_t shift)
1234 {
1235     return !((addr >> shift) & 1);
1236 }
1237 
1238 static inline bool xive_source_is_trigger_page(XiveSource *xsrc, hwaddr addr)
1239 {
1240     return xive_source_esb_has_2page(xsrc) &&
1241         addr_is_even(addr, xsrc->esb_shift - 1);
1242 }
1243 
1244 /*
1245  * ESB MMIO loads
1246  *                      Trigger page    Management/EOI page
1247  *
1248  * ESB MMIO setting     2 pages         1 or 2 pages
1249  *
1250  * 0x000 .. 0x3FF       -1              EOI and return 0|1
1251  * 0x400 .. 0x7FF       -1              EOI and return 0|1
1252  * 0x800 .. 0xBFF       -1              return PQ
1253  * 0xC00 .. 0xCFF       -1              return PQ and atomically PQ=00
1254  * 0xD00 .. 0xDFF       -1              return PQ and atomically PQ=01
1255  * 0xE00 .. 0xDFF       -1              return PQ and atomically PQ=10
1256  * 0xF00 .. 0xDFF       -1              return PQ and atomically PQ=11
1257  */
1258 static uint64_t xive_source_esb_read(void *opaque, hwaddr addr, unsigned size)
1259 {
1260     XiveSource *xsrc = XIVE_SOURCE(opaque);
1261     uint32_t offset = addr & 0xFFF;
1262     uint32_t srcno = addr >> xsrc->esb_shift;
1263     uint64_t ret = -1;
1264 
1265     /* In a two pages ESB MMIO setting, trigger page should not be read */
1266     if (xive_source_is_trigger_page(xsrc, addr)) {
1267         qemu_log_mask(LOG_GUEST_ERROR,
1268                       "XIVE: invalid load on IRQ %d trigger page at "
1269                       "0x%"HWADDR_PRIx"\n", srcno, addr);
1270         return -1;
1271     }
1272 
1273     switch (offset) {
1274     case XIVE_ESB_LOAD_EOI ... XIVE_ESB_LOAD_EOI + 0x7FF:
1275         ret = xive_source_esb_eoi(xsrc, srcno);
1276 
1277         /* Forward the source event notification for routing */
1278         if (ret) {
1279             trace_xive_source_notify(srcno);
1280             xive_source_notify(xsrc, srcno);
1281         }
1282         break;
1283 
1284     case XIVE_ESB_GET ... XIVE_ESB_GET + 0x3FF:
1285         ret = xive_source_esb_get(xsrc, srcno);
1286         break;
1287 
1288     case XIVE_ESB_SET_PQ_00 ... XIVE_ESB_SET_PQ_00 + 0x0FF:
1289     case XIVE_ESB_SET_PQ_01 ... XIVE_ESB_SET_PQ_01 + 0x0FF:
1290     case XIVE_ESB_SET_PQ_10 ... XIVE_ESB_SET_PQ_10 + 0x0FF:
1291     case XIVE_ESB_SET_PQ_11 ... XIVE_ESB_SET_PQ_11 + 0x0FF:
1292         ret = xive_source_esb_set(xsrc, srcno, (offset >> 8) & 0x3);
1293         break;
1294     default:
1295         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid ESB load addr %x\n",
1296                       offset);
1297     }
1298 
1299     trace_xive_source_esb_read(addr, srcno, ret);
1300 
1301     return ret;
1302 }
1303 
1304 /*
1305  * ESB MMIO stores
1306  *                      Trigger page    Management/EOI page
1307  *
1308  * ESB MMIO setting     2 pages         1 or 2 pages
1309  *
1310  * 0x000 .. 0x3FF       Trigger         Trigger
1311  * 0x400 .. 0x7FF       Trigger         EOI
1312  * 0x800 .. 0xBFF       Trigger         undefined
1313  * 0xC00 .. 0xCFF       Trigger         PQ=00
1314  * 0xD00 .. 0xDFF       Trigger         PQ=01
1315  * 0xE00 .. 0xDFF       Trigger         PQ=10
1316  * 0xF00 .. 0xDFF       Trigger         PQ=11
1317  */
1318 static void xive_source_esb_write(void *opaque, hwaddr addr,
1319                                   uint64_t value, unsigned size)
1320 {
1321     XiveSource *xsrc = XIVE_SOURCE(opaque);
1322     uint32_t offset = addr & 0xFFF;
1323     uint32_t srcno = addr >> xsrc->esb_shift;
1324     bool notify = false;
1325 
1326     trace_xive_source_esb_write(addr, srcno, value);
1327 
1328     /* In a two pages ESB MMIO setting, trigger page only triggers */
1329     if (xive_source_is_trigger_page(xsrc, addr)) {
1330         notify = xive_source_esb_trigger(xsrc, srcno);
1331         goto out;
1332     }
1333 
1334     switch (offset) {
1335     case 0 ... 0x3FF:
1336         notify = xive_source_esb_trigger(xsrc, srcno);
1337         break;
1338 
1339     case XIVE_ESB_STORE_EOI ... XIVE_ESB_STORE_EOI + 0x3FF:
1340         if (!(xsrc->esb_flags & XIVE_SRC_STORE_EOI)) {
1341             qemu_log_mask(LOG_GUEST_ERROR,
1342                           "XIVE: invalid Store EOI for IRQ %d\n", srcno);
1343             return;
1344         }
1345 
1346         notify = xive_source_esb_eoi(xsrc, srcno);
1347         break;
1348 
1349     /*
1350      * This is an internal offset used to inject triggers when the PQ
1351      * state bits are not controlled locally. Such as for LSIs when
1352      * under ABT mode.
1353      */
1354     case XIVE_ESB_INJECT ... XIVE_ESB_INJECT + 0x3FF:
1355         notify = true;
1356         break;
1357 
1358     case XIVE_ESB_SET_PQ_00 ... XIVE_ESB_SET_PQ_00 + 0x0FF:
1359     case XIVE_ESB_SET_PQ_01 ... XIVE_ESB_SET_PQ_01 + 0x0FF:
1360     case XIVE_ESB_SET_PQ_10 ... XIVE_ESB_SET_PQ_10 + 0x0FF:
1361     case XIVE_ESB_SET_PQ_11 ... XIVE_ESB_SET_PQ_11 + 0x0FF:
1362         xive_source_esb_set(xsrc, srcno, (offset >> 8) & 0x3);
1363         break;
1364 
1365     default:
1366         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid ESB write addr %x\n",
1367                       offset);
1368         return;
1369     }
1370 
1371 out:
1372     /* Forward the source event notification for routing */
1373     if (notify) {
1374         xive_source_notify(xsrc, srcno);
1375     } else {
1376         trace_xive_source_blocked(srcno);
1377     }
1378 }
1379 
1380 static const MemoryRegionOps xive_source_esb_ops = {
1381     .read = xive_source_esb_read,
1382     .write = xive_source_esb_write,
1383     .endianness = DEVICE_BIG_ENDIAN,
1384     .valid = {
1385         .min_access_size = 1,
1386         .max_access_size = 8,
1387     },
1388     .impl = {
1389         .min_access_size = 1,
1390         .max_access_size = 8,
1391     },
1392 };
1393 
1394 void xive_source_set_irq(void *opaque, int srcno, int val)
1395 {
1396     XiveSource *xsrc = XIVE_SOURCE(opaque);
1397     bool notify = false;
1398 
1399     if (xive_source_irq_is_lsi(xsrc, srcno)) {
1400         if (val) {
1401             notify = xive_source_lsi_trigger(xsrc, srcno);
1402         } else {
1403             xive_source_set_asserted(xsrc, srcno, false);
1404         }
1405     } else {
1406         if (val) {
1407             notify = xive_source_esb_trigger(xsrc, srcno);
1408         }
1409     }
1410 
1411     /* Forward the source event notification for routing */
1412     if (notify) {
1413         xive_source_notify(xsrc, srcno);
1414     }
1415 }
1416 
1417 void xive_source_pic_print_info(XiveSource *xsrc, uint32_t offset, GString *buf)
1418 {
1419     for (unsigned i = 0; i < xsrc->nr_irqs; i++) {
1420         uint8_t pq = xive_source_esb_get(xsrc, i);
1421 
1422         if (pq == XIVE_ESB_OFF) {
1423             continue;
1424         }
1425 
1426         g_string_append_printf(buf, "  %08x %s %c%c%c\n", i + offset,
1427                                xive_source_irq_is_lsi(xsrc, i) ? "LSI" : "MSI",
1428                                pq & XIVE_ESB_VAL_P ? 'P' : '-',
1429                                pq & XIVE_ESB_VAL_Q ? 'Q' : '-',
1430                                xive_source_is_asserted(xsrc, i) ? 'A' : ' ');
1431     }
1432 }
1433 
1434 static void xive_source_reset(void *dev)
1435 {
1436     XiveSource *xsrc = XIVE_SOURCE(dev);
1437 
1438     /* Do not clear the LSI bitmap */
1439 
1440     memset(xsrc->status, xsrc->reset_pq, xsrc->nr_irqs);
1441 }
1442 
1443 static void xive_source_realize(DeviceState *dev, Error **errp)
1444 {
1445     XiveSource *xsrc = XIVE_SOURCE(dev);
1446     uint64_t esb_len = xive_source_esb_len(xsrc);
1447 
1448     assert(xsrc->xive);
1449 
1450     if (!xsrc->nr_irqs) {
1451         error_setg(errp, "Number of interrupt needs to be greater than 0");
1452         return;
1453     }
1454 
1455     if (xsrc->esb_shift != XIVE_ESB_4K &&
1456         xsrc->esb_shift != XIVE_ESB_4K_2PAGE &&
1457         xsrc->esb_shift != XIVE_ESB_64K &&
1458         xsrc->esb_shift != XIVE_ESB_64K_2PAGE) {
1459         error_setg(errp, "Invalid ESB shift setting");
1460         return;
1461     }
1462 
1463     xsrc->status = g_malloc0(xsrc->nr_irqs);
1464     xsrc->lsi_map = bitmap_new(xsrc->nr_irqs);
1465 
1466     memory_region_init(&xsrc->esb_mmio, OBJECT(xsrc), "xive.esb", esb_len);
1467     memory_region_init_io(&xsrc->esb_mmio_emulated, OBJECT(xsrc),
1468                           &xive_source_esb_ops, xsrc, "xive.esb-emulated",
1469                           esb_len);
1470     memory_region_add_subregion(&xsrc->esb_mmio, 0, &xsrc->esb_mmio_emulated);
1471 
1472     qemu_register_reset(xive_source_reset, dev);
1473 }
1474 
1475 static const VMStateDescription vmstate_xive_source = {
1476     .name = TYPE_XIVE_SOURCE,
1477     .version_id = 1,
1478     .minimum_version_id = 1,
1479     .fields = (const VMStateField[]) {
1480         VMSTATE_UINT32_EQUAL(nr_irqs, XiveSource, NULL),
1481         VMSTATE_VBUFFER_UINT32(status, XiveSource, 1, NULL, nr_irqs),
1482         VMSTATE_END_OF_LIST()
1483     },
1484 };
1485 
1486 /*
1487  * The default XIVE interrupt source setting for the ESB MMIOs is two
1488  * 64k pages without Store EOI, to be in sync with KVM.
1489  */
1490 static const Property xive_source_properties[] = {
1491     DEFINE_PROP_UINT64("flags", XiveSource, esb_flags, 0),
1492     DEFINE_PROP_UINT32("nr-irqs", XiveSource, nr_irqs, 0),
1493     DEFINE_PROP_UINT32("shift", XiveSource, esb_shift, XIVE_ESB_64K_2PAGE),
1494     /*
1495      * By default, PQs are initialized to 0b01 (Q=1) which corresponds
1496      * to "ints off"
1497      */
1498     DEFINE_PROP_UINT8("reset-pq", XiveSource, reset_pq, XIVE_ESB_OFF),
1499     DEFINE_PROP_LINK("xive", XiveSource, xive, TYPE_XIVE_NOTIFIER,
1500                      XiveNotifier *),
1501 };
1502 
1503 static void xive_source_class_init(ObjectClass *klass, const void *data)
1504 {
1505     DeviceClass *dc = DEVICE_CLASS(klass);
1506 
1507     dc->desc    = "XIVE Interrupt Source";
1508     device_class_set_props(dc, xive_source_properties);
1509     dc->realize = xive_source_realize;
1510     dc->vmsd    = &vmstate_xive_source;
1511     /*
1512      * Reason: part of XIVE interrupt controller, needs to be wired up,
1513      * e.g. by spapr_xive_instance_init().
1514      */
1515     dc->user_creatable = false;
1516 }
1517 
1518 static const TypeInfo xive_source_info = {
1519     .name          = TYPE_XIVE_SOURCE,
1520     .parent        = TYPE_DEVICE,
1521     .instance_size = sizeof(XiveSource),
1522     .class_init    = xive_source_class_init,
1523 };
1524 
1525 /*
1526  * XiveEND helpers
1527  */
1528 
1529 void xive_end_queue_pic_print_info(XiveEND *end, uint32_t width, GString *buf)
1530 {
1531     uint64_t qaddr_base = xive_end_qaddr(end);
1532     uint32_t qsize = xive_get_field32(END_W0_QSIZE, end->w0);
1533     uint32_t qindex = xive_get_field32(END_W1_PAGE_OFF, end->w1);
1534     uint32_t qentries = 1 << (qsize + 10);
1535     int i;
1536 
1537     /*
1538      * print out the [ (qindex - (width - 1)) .. (qindex + 1)] window
1539      */
1540     g_string_append_printf(buf, " [ ");
1541     qindex = (qindex - (width - 1)) & (qentries - 1);
1542     for (i = 0; i < width; i++) {
1543         uint64_t qaddr = qaddr_base + (qindex << 2);
1544         uint32_t qdata = -1;
1545 
1546         if (dma_memory_read(&address_space_memory, qaddr,
1547                             &qdata, sizeof(qdata), MEMTXATTRS_UNSPECIFIED)) {
1548             qemu_log_mask(LOG_GUEST_ERROR, "XIVE: failed to read EQ @0x%"
1549                           HWADDR_PRIx "\n", qaddr);
1550             return;
1551         }
1552         g_string_append_printf(buf, "%s%08x ", i == width - 1 ? "^" : "",
1553                                be32_to_cpu(qdata));
1554         qindex = (qindex + 1) & (qentries - 1);
1555     }
1556     g_string_append_c(buf, ']');
1557 }
1558 
1559 void xive_end_pic_print_info(XiveEND *end, uint32_t end_idx, GString *buf)
1560 {
1561     uint64_t qaddr_base = xive_end_qaddr(end);
1562     uint32_t qindex = xive_get_field32(END_W1_PAGE_OFF, end->w1);
1563     uint32_t qgen = xive_get_field32(END_W1_GENERATION, end->w1);
1564     uint32_t qsize = xive_get_field32(END_W0_QSIZE, end->w0);
1565     uint32_t qentries = 1 << (qsize + 10);
1566 
1567     uint32_t nvt_blk = xive_get_field32(END_W6_NVT_BLOCK, end->w6);
1568     uint32_t nvt_idx = xive_get_field32(END_W6_NVT_INDEX, end->w6);
1569     uint8_t priority = xive_get_field32(END_W7_F0_PRIORITY, end->w7);
1570     uint8_t pq;
1571 
1572     if (!xive_end_is_valid(end)) {
1573         return;
1574     }
1575 
1576     pq = xive_get_field32(END_W1_ESn, end->w1);
1577 
1578     g_string_append_printf(buf,
1579                            "  %08x %c%c %c%c%c%c%c%c%c%c prio:%d nvt:%02x/%04x",
1580                            end_idx,
1581                            pq & XIVE_ESB_VAL_P ? 'P' : '-',
1582                            pq & XIVE_ESB_VAL_Q ? 'Q' : '-',
1583                            xive_end_is_valid(end)    ? 'v' : '-',
1584                            xive_end_is_enqueue(end)  ? 'q' : '-',
1585                            xive_end_is_notify(end)   ? 'n' : '-',
1586                            xive_end_is_backlog(end)  ? 'b' : '-',
1587                            xive_end_is_escalate(end) ? 'e' : '-',
1588                            xive_end_is_uncond_escalation(end)   ? 'u' : '-',
1589                            xive_end_is_silent_escalation(end)   ? 's' : '-',
1590                            xive_end_is_firmware(end)   ? 'f' : '-',
1591                            priority, nvt_blk, nvt_idx);
1592 
1593     if (qaddr_base) {
1594         g_string_append_printf(buf, " eq:@%08"PRIx64"% 6d/%5d ^%d",
1595                                qaddr_base, qindex, qentries, qgen);
1596         xive_end_queue_pic_print_info(end, 6, buf);
1597     }
1598     g_string_append_c(buf, '\n');
1599 }
1600 
1601 static void xive_end_enqueue(XiveEND *end, uint32_t data)
1602 {
1603     uint64_t qaddr_base = xive_end_qaddr(end);
1604     uint32_t qsize = xive_get_field32(END_W0_QSIZE, end->w0);
1605     uint32_t qindex = xive_get_field32(END_W1_PAGE_OFF, end->w1);
1606     uint32_t qgen = xive_get_field32(END_W1_GENERATION, end->w1);
1607 
1608     uint64_t qaddr = qaddr_base + (qindex << 2);
1609     uint32_t qdata = cpu_to_be32((qgen << 31) | (data & 0x7fffffff));
1610     uint32_t qentries = 1 << (qsize + 10);
1611 
1612     if (dma_memory_write(&address_space_memory, qaddr,
1613                          &qdata, sizeof(qdata), MEMTXATTRS_UNSPECIFIED)) {
1614         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: failed to write END data @0x%"
1615                       HWADDR_PRIx "\n", qaddr);
1616         return;
1617     }
1618 
1619     qindex = (qindex + 1) & (qentries - 1);
1620     if (qindex == 0) {
1621         qgen ^= 1;
1622         end->w1 = xive_set_field32(END_W1_GENERATION, end->w1, qgen);
1623     }
1624     end->w1 = xive_set_field32(END_W1_PAGE_OFF, end->w1, qindex);
1625 }
1626 
1627 void xive_end_eas_pic_print_info(XiveEND *end, uint32_t end_idx, GString *buf)
1628 {
1629     XiveEAS *eas = (XiveEAS *) &end->w4;
1630     uint8_t pq;
1631 
1632     if (!xive_end_is_escalate(end)) {
1633         return;
1634     }
1635 
1636     pq = xive_get_field32(END_W1_ESe, end->w1);
1637 
1638     g_string_append_printf(buf, "  %08x %c%c %c%c end:%02x/%04x data:%08x\n",
1639                            end_idx,
1640                            pq & XIVE_ESB_VAL_P ? 'P' : '-',
1641                            pq & XIVE_ESB_VAL_Q ? 'Q' : '-',
1642                            xive_eas_is_valid(eas) ? 'V' : ' ',
1643                            xive_eas_is_masked(eas) ? 'M' : ' ',
1644                            (uint8_t)  xive_get_field64(EAS_END_BLOCK, eas->w),
1645                            (uint32_t) xive_get_field64(EAS_END_INDEX, eas->w),
1646                            (uint32_t) xive_get_field64(EAS_END_DATA, eas->w));
1647 }
1648 
1649 /*
1650  * XIVE Router (aka. Virtualization Controller or IVRE)
1651  */
1652 
1653 int xive_router_get_eas(XiveRouter *xrtr, uint8_t eas_blk, uint32_t eas_idx,
1654                         XiveEAS *eas)
1655 {
1656     XiveRouterClass *xrc = XIVE_ROUTER_GET_CLASS(xrtr);
1657 
1658     return xrc->get_eas(xrtr, eas_blk, eas_idx, eas);
1659 }
1660 
1661 static
1662 int xive_router_get_pq(XiveRouter *xrtr, uint8_t eas_blk, uint32_t eas_idx,
1663                        uint8_t *pq)
1664 {
1665     XiveRouterClass *xrc = XIVE_ROUTER_GET_CLASS(xrtr);
1666 
1667     return xrc->get_pq(xrtr, eas_blk, eas_idx, pq);
1668 }
1669 
1670 static
1671 int xive_router_set_pq(XiveRouter *xrtr, uint8_t eas_blk, uint32_t eas_idx,
1672                        uint8_t *pq)
1673 {
1674     XiveRouterClass *xrc = XIVE_ROUTER_GET_CLASS(xrtr);
1675 
1676     return xrc->set_pq(xrtr, eas_blk, eas_idx, pq);
1677 }
1678 
1679 int xive_router_get_end(XiveRouter *xrtr, uint8_t end_blk, uint32_t end_idx,
1680                         XiveEND *end)
1681 {
1682    XiveRouterClass *xrc = XIVE_ROUTER_GET_CLASS(xrtr);
1683 
1684    return xrc->get_end(xrtr, end_blk, end_idx, end);
1685 }
1686 
1687 int xive_router_write_end(XiveRouter *xrtr, uint8_t end_blk, uint32_t end_idx,
1688                           XiveEND *end, uint8_t word_number)
1689 {
1690    XiveRouterClass *xrc = XIVE_ROUTER_GET_CLASS(xrtr);
1691 
1692    return xrc->write_end(xrtr, end_blk, end_idx, end, word_number);
1693 }
1694 
1695 int xive_router_get_nvt(XiveRouter *xrtr, uint8_t nvt_blk, uint32_t nvt_idx,
1696                         XiveNVT *nvt)
1697 {
1698    XiveRouterClass *xrc = XIVE_ROUTER_GET_CLASS(xrtr);
1699 
1700    return xrc->get_nvt(xrtr, nvt_blk, nvt_idx, nvt);
1701 }
1702 
1703 int xive_router_write_nvt(XiveRouter *xrtr, uint8_t nvt_blk, uint32_t nvt_idx,
1704                         XiveNVT *nvt, uint8_t word_number)
1705 {
1706    XiveRouterClass *xrc = XIVE_ROUTER_GET_CLASS(xrtr);
1707 
1708    return xrc->write_nvt(xrtr, nvt_blk, nvt_idx, nvt, word_number);
1709 }
1710 
1711 static int xive_router_get_block_id(XiveRouter *xrtr)
1712 {
1713    XiveRouterClass *xrc = XIVE_ROUTER_GET_CLASS(xrtr);
1714 
1715    return xrc->get_block_id(xrtr);
1716 }
1717 
1718 static void xive_router_realize(DeviceState *dev, Error **errp)
1719 {
1720     XiveRouter *xrtr = XIVE_ROUTER(dev);
1721 
1722     assert(xrtr->xfb);
1723 }
1724 
1725 static void xive_router_end_notify_handler(XiveRouter *xrtr, XiveEAS *eas)
1726 {
1727     XiveRouterClass *xrc = XIVE_ROUTER_GET_CLASS(xrtr);
1728 
1729     return xrc->end_notify(xrtr, eas);
1730 }
1731 
1732 /*
1733  * Encode the HW CAM line in the block group mode format :
1734  *
1735  *   chip << 19 | 0000000 0 0001 thread (7Bit)
1736  */
1737 static uint32_t xive_tctx_hw_cam_line(XivePresenter *xptr, XiveTCTX *tctx)
1738 {
1739     CPUPPCState *env = &POWERPC_CPU(tctx->cs)->env;
1740     uint32_t pir = env->spr_cb[SPR_PIR].default_value;
1741     uint8_t blk = xive_router_get_block_id(XIVE_ROUTER(xptr));
1742 
1743     return xive_nvt_cam_line(blk, 1 << 7 | (pir & 0x7f));
1744 }
1745 
1746 uint32_t xive_get_vpgroup_size(uint32_t nvp_index)
1747 {
1748     /*
1749      * Group size is a power of 2. The position of the first 0
1750      * (starting with the least significant bits) in the NVP index
1751      * gives the size of the group.
1752      */
1753     int first_zero = cto32(nvp_index);
1754     if (first_zero >= 31) {
1755         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: Invalid group index 0x%08x",
1756                                        nvp_index);
1757         return 0;
1758     }
1759 
1760     return 1U << (first_zero + 1);
1761 }
1762 
1763 static uint8_t xive_get_group_level(bool crowd, bool ignore,
1764                                     uint32_t nvp_blk, uint32_t nvp_index)
1765 {
1766     int first_zero;
1767     uint8_t level;
1768 
1769     if (!ignore) {
1770         g_assert(!crowd);
1771         return 0;
1772     }
1773 
1774     first_zero = cto32(nvp_index);
1775     if (first_zero >= 31) {
1776         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: Invalid group index 0x%08x",
1777                                        nvp_index);
1778         return 0;
1779     }
1780 
1781     level = (first_zero + 1) & 0b1111;
1782     if (crowd) {
1783         uint32_t blk;
1784 
1785         /* crowd level is bit position of first 0 from the right in nvp_blk */
1786         first_zero = cto32(nvp_blk);
1787         if (first_zero >= 31) {
1788             qemu_log_mask(LOG_GUEST_ERROR, "XIVE: Invalid crowd block 0x%08x",
1789                                            nvp_blk);
1790             return 0;
1791         }
1792         blk = first_zero + 1;
1793 
1794         /*
1795          * Supported crowd sizes are 2^1, 2^2, and 2^4. 2^3 is not supported.
1796          * HW will encode level 4 as the value 3.  See xive2_pgofnext().
1797          */
1798         switch (blk) {
1799         case 1:
1800         case 2:
1801             break;
1802         case 4:
1803             blk = 3;
1804             break;
1805         default:
1806             g_assert_not_reached();
1807         }
1808 
1809         /* Crowd level bits reside in upper 2 bits of the 6 bit group level */
1810         level |= blk << 4;
1811     }
1812     return level;
1813 }
1814 
1815 /*
1816  * The thread context register words are in big-endian format.
1817  */
1818 int xive_presenter_tctx_match(XivePresenter *xptr, XiveTCTX *tctx,
1819                               uint8_t format,
1820                               uint8_t nvt_blk, uint32_t nvt_idx,
1821                               bool cam_ignore, uint32_t logic_serv)
1822 {
1823     uint32_t cam = xive_nvt_cam_line(nvt_blk, nvt_idx);
1824     uint32_t qw3w2 = xive_tctx_word2(&tctx->regs[TM_QW3_HV_PHYS]);
1825     uint32_t qw2w2 = xive_tctx_word2(&tctx->regs[TM_QW2_HV_POOL]);
1826     uint32_t qw1w2 = xive_tctx_word2(&tctx->regs[TM_QW1_OS]);
1827     uint32_t qw0w2 = xive_tctx_word2(&tctx->regs[TM_QW0_USER]);
1828 
1829     /*
1830      * TODO (PowerNV): ignore mode. The low order bits of the NVT
1831      * identifier are ignored in the "CAM" match.
1832      */
1833 
1834     if (format == 0) {
1835         if (cam_ignore == true) {
1836             /*
1837              * F=0 & i=1: Logical server notification (bits ignored at
1838              * the end of the NVT identifier)
1839              */
1840             qemu_log_mask(LOG_UNIMP, "XIVE: no support for LS NVT %x/%x\n",
1841                           nvt_blk, nvt_idx);
1842              return -1;
1843         }
1844 
1845         /* F=0 & i=0: Specific NVT notification */
1846 
1847         /* PHYS ring */
1848         if ((be32_to_cpu(qw3w2) & TM_QW3W2_VT) &&
1849             cam == xive_tctx_hw_cam_line(xptr, tctx)) {
1850             return TM_QW3_HV_PHYS;
1851         }
1852 
1853         /* HV POOL ring */
1854         if ((be32_to_cpu(qw2w2) & TM_QW2W2_VP) &&
1855             cam == xive_get_field32(TM_QW2W2_POOL_CAM, qw2w2)) {
1856             return TM_QW2_HV_POOL;
1857         }
1858 
1859         /* OS ring */
1860         if ((be32_to_cpu(qw1w2) & TM_QW1W2_VO) &&
1861             cam == xive_get_field32(TM_QW1W2_OS_CAM, qw1w2)) {
1862             return TM_QW1_OS;
1863         }
1864     } else {
1865         /* F=1 : User level Event-Based Branch (EBB) notification */
1866 
1867         /* USER ring */
1868         if  ((be32_to_cpu(qw1w2) & TM_QW1W2_VO) &&
1869              (cam == xive_get_field32(TM_QW1W2_OS_CAM, qw1w2)) &&
1870              (be32_to_cpu(qw0w2) & TM_QW0W2_VU) &&
1871              (logic_serv == xive_get_field32(TM_QW0W2_LOGIC_SERV, qw0w2))) {
1872             return TM_QW0_USER;
1873         }
1874     }
1875     return -1;
1876 }
1877 
1878 /*
1879  * This is our simple Xive Presenter Engine model. It is merged in the
1880  * Router as it does not require an extra object.
1881  */
1882 bool xive_presenter_notify(XiveFabric *xfb, uint8_t format,
1883                            uint8_t nvt_blk, uint32_t nvt_idx,
1884                            bool crowd, bool cam_ignore, uint8_t priority,
1885                            uint32_t logic_serv, bool *precluded)
1886 {
1887     XiveFabricClass *xfc = XIVE_FABRIC_GET_CLASS(xfb);
1888     XiveTCTXMatch match = { .tctx = NULL, .ring = 0, .precluded = false };
1889     uint8_t group_level;
1890     int count;
1891 
1892     /*
1893      * Ask the machine to scan the interrupt controllers for a match.
1894      *
1895      * For VP-specific notification, we expect at most one match and
1896      * one call to the presenters is all we need (abbreviated notify
1897      * sequence documented by the architecture).
1898      *
1899      * For VP-group notification, match_nvt() is the equivalent of the
1900      * "histogram" and "poll" commands sent to the power bus to the
1901      * presenters. 'count' could be more than one, but we always
1902      * select the first match for now. 'precluded' tells if (at least)
1903      * one thread matches but can't take the interrupt now because
1904      * it's running at a more favored priority. We return the
1905      * information to the router so that it can take appropriate
1906      * actions (backlog, escalation, broadcast, etc...)
1907      *
1908      * If we were to implement a better way of dispatching the
1909      * interrupt in case of multiple matches (instead of the first
1910      * match), we would need a heuristic to elect a thread (for
1911      * example, the hardware keeps track of an 'age' in the TIMA) and
1912      * a new command to the presenters (the equivalent of the "assign"
1913      * power bus command in the documented full notify sequence.
1914      */
1915     count = xfc->match_nvt(xfb, format, nvt_blk, nvt_idx, crowd, cam_ignore,
1916                            priority, logic_serv, &match);
1917     if (count < 0) {
1918         return false;
1919     }
1920 
1921     /* handle CPU exception delivery */
1922     if (count) {
1923         group_level = xive_get_group_level(crowd, cam_ignore, nvt_blk, nvt_idx);
1924         trace_xive_presenter_notify(nvt_blk, nvt_idx, match.ring, group_level);
1925         xive_tctx_pipr_update(match.tctx, match.ring, priority, group_level);
1926     } else {
1927         *precluded = match.precluded;
1928     }
1929 
1930     return !!count;
1931 }
1932 
1933 /*
1934  * Notification using the END ESe/ESn bit (Event State Buffer for
1935  * escalation and notification). Provide further coalescing in the
1936  * Router.
1937  */
1938 static bool xive_router_end_es_notify(XiveRouter *xrtr, uint8_t end_blk,
1939                                       uint32_t end_idx, XiveEND *end,
1940                                       uint32_t end_esmask)
1941 {
1942     uint8_t pq = xive_get_field32(end_esmask, end->w1);
1943     bool notify = xive_esb_trigger(&pq);
1944 
1945     if (pq != xive_get_field32(end_esmask, end->w1)) {
1946         end->w1 = xive_set_field32(end_esmask, end->w1, pq);
1947         xive_router_write_end(xrtr, end_blk, end_idx, end, 1);
1948     }
1949 
1950     /* ESe/n[Q]=1 : end of notification */
1951     return notify;
1952 }
1953 
1954 /*
1955  * An END trigger can come from an event trigger (IPI or HW) or from
1956  * another chip. We don't model the PowerBus but the END trigger
1957  * message has the same parameters than in the function below.
1958  */
1959 void xive_router_end_notify(XiveRouter *xrtr, XiveEAS *eas)
1960 {
1961     XiveEND end;
1962     uint8_t priority;
1963     uint8_t format;
1964     uint8_t nvt_blk;
1965     uint32_t nvt_idx;
1966     XiveNVT nvt;
1967     bool found, precluded;
1968 
1969     uint8_t end_blk = xive_get_field64(EAS_END_BLOCK, eas->w);
1970     uint32_t end_idx = xive_get_field64(EAS_END_INDEX, eas->w);
1971     uint32_t end_data = xive_get_field64(EAS_END_DATA,  eas->w);
1972 
1973     /* END cache lookup */
1974     if (xive_router_get_end(xrtr, end_blk, end_idx, &end)) {
1975         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: No END %x/%x\n", end_blk,
1976                       end_idx);
1977         return;
1978     }
1979 
1980     if (!xive_end_is_valid(&end)) {
1981         trace_xive_router_end_notify(end_blk, end_idx, end_data);
1982         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: END %x/%x is invalid\n",
1983                       end_blk, end_idx);
1984         return;
1985     }
1986 
1987     if (xive_end_is_enqueue(&end)) {
1988         xive_end_enqueue(&end, end_data);
1989         /* Enqueuing event data modifies the EQ toggle and index */
1990         xive_router_write_end(xrtr, end_blk, end_idx, &end, 1);
1991     }
1992 
1993     /*
1994      * When the END is silent, we skip the notification part.
1995      */
1996     if (xive_end_is_silent_escalation(&end)) {
1997         goto do_escalation;
1998     }
1999 
2000     /*
2001      * The W7 format depends on the F bit in W6. It defines the type
2002      * of the notification :
2003      *
2004      *   F=0 : single or multiple NVT notification
2005      *   F=1 : User level Event-Based Branch (EBB) notification, no
2006      *         priority
2007      */
2008     format = xive_get_field32(END_W6_FORMAT_BIT, end.w6);
2009     priority = xive_get_field32(END_W7_F0_PRIORITY, end.w7);
2010 
2011     /* The END is masked */
2012     if (format == 0 && priority == 0xff) {
2013         return;
2014     }
2015 
2016     /*
2017      * Check the END ESn (Event State Buffer for notification) for
2018      * even further coalescing in the Router
2019      */
2020     if (!xive_end_is_notify(&end)) {
2021         /* ESn[Q]=1 : end of notification */
2022         if (!xive_router_end_es_notify(xrtr, end_blk, end_idx,
2023                                        &end, END_W1_ESn)) {
2024             return;
2025         }
2026     }
2027 
2028     /*
2029      * Follows IVPE notification
2030      */
2031     nvt_blk = xive_get_field32(END_W6_NVT_BLOCK, end.w6);
2032     nvt_idx = xive_get_field32(END_W6_NVT_INDEX, end.w6);
2033 
2034     /* NVT cache lookup */
2035     if (xive_router_get_nvt(xrtr, nvt_blk, nvt_idx, &nvt)) {
2036         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: no NVT %x/%x\n",
2037                       nvt_blk, nvt_idx);
2038         return;
2039     }
2040 
2041     if (!xive_nvt_is_valid(&nvt)) {
2042         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: NVT %x/%x is invalid\n",
2043                       nvt_blk, nvt_idx);
2044         return;
2045     }
2046 
2047     found = xive_presenter_notify(xrtr->xfb, format, nvt_blk, nvt_idx,
2048                           false /* crowd */,
2049                           xive_get_field32(END_W7_F0_IGNORE, end.w7),
2050                           priority,
2051                           xive_get_field32(END_W7_F1_LOG_SERVER_ID, end.w7),
2052                           &precluded);
2053     /* we don't support VP-group notification on P9, so precluded is not used */
2054     /* TODO: Auto EOI. */
2055 
2056     if (found) {
2057         return;
2058     }
2059 
2060     /*
2061      * If no matching NVT is dispatched on a HW thread :
2062      * - specific VP: update the NVT structure if backlog is activated
2063      * - logical server : forward request to IVPE (not supported)
2064      */
2065     if (xive_end_is_backlog(&end)) {
2066         uint8_t ipb;
2067 
2068         if (format == 1) {
2069             qemu_log_mask(LOG_GUEST_ERROR,
2070                           "XIVE: END %x/%x invalid config: F1 & backlog\n",
2071                           end_blk, end_idx);
2072             return;
2073         }
2074         /*
2075          * Record the IPB in the associated NVT structure for later
2076          * use. The presenter will resend the interrupt when the vCPU
2077          * is dispatched again on a HW thread.
2078          */
2079         ipb = xive_get_field32(NVT_W4_IPB, nvt.w4) |
2080             xive_priority_to_ipb(priority);
2081         nvt.w4 = xive_set_field32(NVT_W4_IPB, nvt.w4, ipb);
2082         xive_router_write_nvt(xrtr, nvt_blk, nvt_idx, &nvt, 4);
2083 
2084         /*
2085          * On HW, follows a "Broadcast Backlog" to IVPEs
2086          */
2087     }
2088 
2089 do_escalation:
2090     /*
2091      * If activated, escalate notification using the ESe PQ bits and
2092      * the EAS in w4-5
2093      */
2094     if (!xive_end_is_escalate(&end)) {
2095         return;
2096     }
2097 
2098     /*
2099      * Check the END ESe (Event State Buffer for escalation) for even
2100      * further coalescing in the Router
2101      */
2102     if (!xive_end_is_uncond_escalation(&end)) {
2103         /* ESe[Q]=1 : end of notification */
2104         if (!xive_router_end_es_notify(xrtr, end_blk, end_idx,
2105                                        &end, END_W1_ESe)) {
2106             return;
2107         }
2108     }
2109 
2110     trace_xive_router_end_escalate(end_blk, end_idx,
2111            (uint8_t) xive_get_field32(END_W4_ESC_END_BLOCK, end.w4),
2112            (uint32_t) xive_get_field32(END_W4_ESC_END_INDEX, end.w4),
2113            (uint32_t) xive_get_field32(END_W5_ESC_END_DATA,  end.w5));
2114     /*
2115      * The END trigger becomes an Escalation trigger
2116      */
2117     xive_router_end_notify_handler(xrtr, (XiveEAS *) &end.w4);
2118 }
2119 
2120 void xive_router_notify(XiveNotifier *xn, uint32_t lisn, bool pq_checked)
2121 {
2122     XiveRouter *xrtr = XIVE_ROUTER(xn);
2123     uint8_t eas_blk = XIVE_EAS_BLOCK(lisn);
2124     uint32_t eas_idx = XIVE_EAS_INDEX(lisn);
2125     XiveEAS eas;
2126 
2127     /* EAS cache lookup */
2128     if (xive_router_get_eas(xrtr, eas_blk, eas_idx, &eas)) {
2129         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: Unknown LISN %x\n", lisn);
2130         return;
2131     }
2132 
2133     if (!pq_checked) {
2134         bool notify;
2135         uint8_t pq;
2136 
2137         /* PQ cache lookup */
2138         if (xive_router_get_pq(xrtr, eas_blk, eas_idx, &pq)) {
2139             /* Set FIR */
2140             g_assert_not_reached();
2141         }
2142 
2143         notify = xive_esb_trigger(&pq);
2144 
2145         if (xive_router_set_pq(xrtr, eas_blk, eas_idx, &pq)) {
2146             /* Set FIR */
2147             g_assert_not_reached();
2148         }
2149 
2150         if (!notify) {
2151             return;
2152         }
2153     }
2154 
2155     if (!xive_eas_is_valid(&eas)) {
2156         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid LISN %x\n", lisn);
2157         return;
2158     }
2159 
2160     if (xive_eas_is_masked(&eas)) {
2161         /* Notification completed */
2162         return;
2163     }
2164 
2165     /*
2166      * The event trigger becomes an END trigger
2167      */
2168     xive_router_end_notify_handler(xrtr, &eas);
2169 }
2170 
2171 static const Property xive_router_properties[] = {
2172     DEFINE_PROP_LINK("xive-fabric", XiveRouter, xfb,
2173                      TYPE_XIVE_FABRIC, XiveFabric *),
2174 };
2175 
2176 static void xive_router_class_init(ObjectClass *klass, const void *data)
2177 {
2178     DeviceClass *dc = DEVICE_CLASS(klass);
2179     XiveNotifierClass *xnc = XIVE_NOTIFIER_CLASS(klass);
2180     XiveRouterClass *xrc = XIVE_ROUTER_CLASS(klass);
2181 
2182     dc->desc    = "XIVE Router Engine";
2183     device_class_set_props(dc, xive_router_properties);
2184     /* Parent is SysBusDeviceClass. No need to call its realize hook */
2185     dc->realize = xive_router_realize;
2186     xnc->notify = xive_router_notify;
2187 
2188     /* By default, the router handles END triggers locally */
2189     xrc->end_notify = xive_router_end_notify;
2190 }
2191 
2192 static const TypeInfo xive_router_info = {
2193     .name          = TYPE_XIVE_ROUTER,
2194     .parent        = TYPE_SYS_BUS_DEVICE,
2195     .abstract      = true,
2196     .instance_size = sizeof(XiveRouter),
2197     .class_size    = sizeof(XiveRouterClass),
2198     .class_init    = xive_router_class_init,
2199     .interfaces    = (const InterfaceInfo[]) {
2200         { TYPE_XIVE_NOTIFIER },
2201         { TYPE_XIVE_PRESENTER },
2202         { }
2203     }
2204 };
2205 
2206 void xive_eas_pic_print_info(XiveEAS *eas, uint32_t lisn, GString *buf)
2207 {
2208     if (!xive_eas_is_valid(eas)) {
2209         return;
2210     }
2211 
2212     g_string_append_printf(buf, "  %08x %s end:%02x/%04x data:%08x\n",
2213                            lisn, xive_eas_is_masked(eas) ? "M" : " ",
2214                            (uint8_t)  xive_get_field64(EAS_END_BLOCK, eas->w),
2215                            (uint32_t) xive_get_field64(EAS_END_INDEX, eas->w),
2216                            (uint32_t) xive_get_field64(EAS_END_DATA, eas->w));
2217 }
2218 
2219 /*
2220  * END ESB MMIO loads
2221  */
2222 static uint64_t xive_end_source_read(void *opaque, hwaddr addr, unsigned size)
2223 {
2224     XiveENDSource *xsrc = XIVE_END_SOURCE(opaque);
2225     uint32_t offset = addr & 0xFFF;
2226     uint8_t end_blk;
2227     uint32_t end_idx;
2228     XiveEND end;
2229     uint32_t end_esmask;
2230     uint8_t pq;
2231     uint64_t ret = -1;
2232 
2233     /*
2234      * The block id should be deduced from the load address on the END
2235      * ESB MMIO but our model only supports a single block per XIVE chip.
2236      */
2237     end_blk = xive_router_get_block_id(xsrc->xrtr);
2238     end_idx = addr >> (xsrc->esb_shift + 1);
2239 
2240     trace_xive_end_source_read(end_blk, end_idx, addr);
2241 
2242     if (xive_router_get_end(xsrc->xrtr, end_blk, end_idx, &end)) {
2243         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: No END %x/%x\n", end_blk,
2244                       end_idx);
2245         return -1;
2246     }
2247 
2248     if (!xive_end_is_valid(&end)) {
2249         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: END %x/%x is invalid\n",
2250                       end_blk, end_idx);
2251         return -1;
2252     }
2253 
2254     end_esmask = addr_is_even(addr, xsrc->esb_shift) ? END_W1_ESn : END_W1_ESe;
2255     pq = xive_get_field32(end_esmask, end.w1);
2256 
2257     switch (offset) {
2258     case XIVE_ESB_LOAD_EOI ... XIVE_ESB_LOAD_EOI + 0x7FF:
2259         ret = xive_esb_eoi(&pq);
2260 
2261         /* Forward the source event notification for routing ?? */
2262         break;
2263 
2264     case XIVE_ESB_GET ... XIVE_ESB_GET + 0x3FF:
2265         ret = pq;
2266         break;
2267 
2268     case XIVE_ESB_SET_PQ_00 ... XIVE_ESB_SET_PQ_00 + 0x0FF:
2269     case XIVE_ESB_SET_PQ_01 ... XIVE_ESB_SET_PQ_01 + 0x0FF:
2270     case XIVE_ESB_SET_PQ_10 ... XIVE_ESB_SET_PQ_10 + 0x0FF:
2271     case XIVE_ESB_SET_PQ_11 ... XIVE_ESB_SET_PQ_11 + 0x0FF:
2272         ret = xive_esb_set(&pq, (offset >> 8) & 0x3);
2273         break;
2274     default:
2275         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid END ESB load addr %d\n",
2276                       offset);
2277         return -1;
2278     }
2279 
2280     if (pq != xive_get_field32(end_esmask, end.w1)) {
2281         end.w1 = xive_set_field32(end_esmask, end.w1, pq);
2282         xive_router_write_end(xsrc->xrtr, end_blk, end_idx, &end, 1);
2283     }
2284 
2285     return ret;
2286 }
2287 
2288 /*
2289  * END ESB MMIO stores are invalid
2290  */
2291 static void xive_end_source_write(void *opaque, hwaddr addr,
2292                                   uint64_t value, unsigned size)
2293 {
2294     qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid ESB write addr 0x%"
2295                   HWADDR_PRIx"\n", addr);
2296 }
2297 
2298 static const MemoryRegionOps xive_end_source_ops = {
2299     .read = xive_end_source_read,
2300     .write = xive_end_source_write,
2301     .endianness = DEVICE_BIG_ENDIAN,
2302     .valid = {
2303         .min_access_size = 1,
2304         .max_access_size = 8,
2305     },
2306     .impl = {
2307         .min_access_size = 1,
2308         .max_access_size = 8,
2309     },
2310 };
2311 
2312 static void xive_end_source_realize(DeviceState *dev, Error **errp)
2313 {
2314     XiveENDSource *xsrc = XIVE_END_SOURCE(dev);
2315 
2316     assert(xsrc->xrtr);
2317 
2318     if (!xsrc->nr_ends) {
2319         error_setg(errp, "Number of interrupt needs to be greater than 0");
2320         return;
2321     }
2322 
2323     if (xsrc->esb_shift != XIVE_ESB_4K &&
2324         xsrc->esb_shift != XIVE_ESB_64K) {
2325         error_setg(errp, "Invalid ESB shift setting");
2326         return;
2327     }
2328 
2329     /*
2330      * Each END is assigned an even/odd pair of MMIO pages, the even page
2331      * manages the ESn field while the odd page manages the ESe field.
2332      */
2333     memory_region_init_io(&xsrc->esb_mmio, OBJECT(xsrc),
2334                           &xive_end_source_ops, xsrc, "xive.end",
2335                           (1ull << (xsrc->esb_shift + 1)) * xsrc->nr_ends);
2336 }
2337 
2338 static const Property xive_end_source_properties[] = {
2339     DEFINE_PROP_UINT32("nr-ends", XiveENDSource, nr_ends, 0),
2340     DEFINE_PROP_UINT32("shift", XiveENDSource, esb_shift, XIVE_ESB_64K),
2341     DEFINE_PROP_LINK("xive", XiveENDSource, xrtr, TYPE_XIVE_ROUTER,
2342                      XiveRouter *),
2343 };
2344 
2345 static void xive_end_source_class_init(ObjectClass *klass, const void *data)
2346 {
2347     DeviceClass *dc = DEVICE_CLASS(klass);
2348 
2349     dc->desc    = "XIVE END Source";
2350     device_class_set_props(dc, xive_end_source_properties);
2351     dc->realize = xive_end_source_realize;
2352     /*
2353      * Reason: part of XIVE interrupt controller, needs to be wired up,
2354      * e.g. by spapr_xive_instance_init().
2355      */
2356     dc->user_creatable = false;
2357 }
2358 
2359 static const TypeInfo xive_end_source_info = {
2360     .name          = TYPE_XIVE_END_SOURCE,
2361     .parent        = TYPE_DEVICE,
2362     .instance_size = sizeof(XiveENDSource),
2363     .class_init    = xive_end_source_class_init,
2364 };
2365 
2366 /*
2367  * XIVE Notifier
2368  */
2369 static const TypeInfo xive_notifier_info = {
2370     .name = TYPE_XIVE_NOTIFIER,
2371     .parent = TYPE_INTERFACE,
2372     .class_size = sizeof(XiveNotifierClass),
2373 };
2374 
2375 /*
2376  * XIVE Presenter
2377  */
2378 static const TypeInfo xive_presenter_info = {
2379     .name = TYPE_XIVE_PRESENTER,
2380     .parent = TYPE_INTERFACE,
2381     .class_size = sizeof(XivePresenterClass),
2382 };
2383 
2384 /*
2385  * XIVE Fabric
2386  */
2387 static const TypeInfo xive_fabric_info = {
2388     .name = TYPE_XIVE_FABRIC,
2389     .parent = TYPE_INTERFACE,
2390     .class_size = sizeof(XiveFabricClass),
2391 };
2392 
2393 static void xive_register_types(void)
2394 {
2395     type_register_static(&xive_fabric_info);
2396     type_register_static(&xive_source_info);
2397     type_register_static(&xive_notifier_info);
2398     type_register_static(&xive_presenter_info);
2399     type_register_static(&xive_router_info);
2400     type_register_static(&xive_end_source_info);
2401     type_register_static(&xive_tctx_info);
2402 }
2403 
2404 type_init(xive_register_types)
2405