xref: /openbmc/qemu/hw/intc/xive.c (revision 9d49b1c9edf829e571093088ddff0b73db3110c6)
1  /*
2   * QEMU PowerPC XIVE interrupt controller model
3   *
4   * Copyright (c) 2017-2018, IBM Corporation.
5   *
6   * This code is licensed under the GPL version 2 or later. See the
7   * COPYING file in the top-level directory.
8   */
9  
10  #include "qemu/osdep.h"
11  #include "qemu/log.h"
12  #include "qemu/module.h"
13  #include "qapi/error.h"
14  #include "target/ppc/cpu.h"
15  #include "sysemu/cpus.h"
16  #include "sysemu/dma.h"
17  #include "sysemu/reset.h"
18  #include "hw/qdev-properties.h"
19  #include "migration/vmstate.h"
20  #include "hw/irq.h"
21  #include "hw/ppc/xive.h"
22  #include "hw/ppc/xive2.h"
23  #include "hw/ppc/xive_regs.h"
24  #include "trace.h"
25  
26  /*
27   * XIVE Thread Interrupt Management context
28   */
29  
30  /*
31   * Convert an Interrupt Pending Buffer (IPB) register to a Pending
32   * Interrupt Priority Register (PIPR), which contains the priority of
33   * the most favored pending notification.
34   */
35  static uint8_t ipb_to_pipr(uint8_t ibp)
36  {
37      return ibp ? clz32((uint32_t)ibp << 24) : 0xff;
38  }
39  
40  static uint8_t exception_mask(uint8_t ring)
41  {
42      switch (ring) {
43      case TM_QW1_OS:
44          return TM_QW1_NSR_EO;
45      case TM_QW3_HV_PHYS:
46          return TM_QW3_NSR_HE;
47      default:
48          g_assert_not_reached();
49      }
50  }
51  
52  static qemu_irq xive_tctx_output(XiveTCTX *tctx, uint8_t ring)
53  {
54          switch (ring) {
55          case TM_QW0_USER:
56                  return 0; /* Not supported */
57          case TM_QW1_OS:
58                  return tctx->os_output;
59          case TM_QW2_HV_POOL:
60          case TM_QW3_HV_PHYS:
61                  return tctx->hv_output;
62          default:
63                  return 0;
64          }
65  }
66  
67  static uint64_t xive_tctx_accept(XiveTCTX *tctx, uint8_t ring)
68  {
69      uint8_t *regs = &tctx->regs[ring];
70      uint8_t nsr = regs[TM_NSR];
71      uint8_t mask = exception_mask(ring);
72  
73      qemu_irq_lower(xive_tctx_output(tctx, ring));
74  
75      if (regs[TM_NSR] & mask) {
76          uint8_t cppr = regs[TM_PIPR];
77  
78          regs[TM_CPPR] = cppr;
79  
80          /* Reset the pending buffer bit */
81          regs[TM_IPB] &= ~xive_priority_to_ipb(cppr);
82          regs[TM_PIPR] = ipb_to_pipr(regs[TM_IPB]);
83  
84          /* Drop Exception bit */
85          regs[TM_NSR] &= ~mask;
86  
87          trace_xive_tctx_accept(tctx->cs->cpu_index, ring,
88                                 regs[TM_IPB], regs[TM_PIPR],
89                                 regs[TM_CPPR], regs[TM_NSR]);
90      }
91  
92      return (nsr << 8) | regs[TM_CPPR];
93  }
94  
95  static void xive_tctx_notify(XiveTCTX *tctx, uint8_t ring)
96  {
97      uint8_t *regs = &tctx->regs[ring];
98  
99      if (regs[TM_PIPR] < regs[TM_CPPR]) {
100          switch (ring) {
101          case TM_QW1_OS:
102              regs[TM_NSR] |= TM_QW1_NSR_EO;
103              break;
104          case TM_QW3_HV_PHYS:
105              regs[TM_NSR] |= (TM_QW3_NSR_HE_PHYS << 6);
106              break;
107          default:
108              g_assert_not_reached();
109          }
110          trace_xive_tctx_notify(tctx->cs->cpu_index, ring,
111                                 regs[TM_IPB], regs[TM_PIPR],
112                                 regs[TM_CPPR], regs[TM_NSR]);
113          qemu_irq_raise(xive_tctx_output(tctx, ring));
114      }
115  }
116  
117  void xive_tctx_reset_os_signal(XiveTCTX *tctx)
118  {
119      /*
120       * Lower the External interrupt. Used when pulling an OS
121       * context. It is necessary to avoid catching it in the hypervisor
122       * context. It should be raised again when re-pushing the OS
123       * context.
124       */
125      qemu_irq_lower(xive_tctx_output(tctx, TM_QW1_OS));
126  }
127  
128  static void xive_tctx_set_cppr(XiveTCTX *tctx, uint8_t ring, uint8_t cppr)
129  {
130      uint8_t *regs = &tctx->regs[ring];
131  
132      trace_xive_tctx_set_cppr(tctx->cs->cpu_index, ring,
133                               regs[TM_IPB], regs[TM_PIPR],
134                               cppr, regs[TM_NSR]);
135  
136      if (cppr > XIVE_PRIORITY_MAX) {
137          cppr = 0xff;
138      }
139  
140      tctx->regs[ring + TM_CPPR] = cppr;
141  
142      /* CPPR has changed, check if we need to raise a pending exception */
143      xive_tctx_notify(tctx, ring);
144  }
145  
146  void xive_tctx_ipb_update(XiveTCTX *tctx, uint8_t ring, uint8_t ipb)
147  {
148      uint8_t *regs = &tctx->regs[ring];
149  
150      regs[TM_IPB] |= ipb;
151      regs[TM_PIPR] = ipb_to_pipr(regs[TM_IPB]);
152      xive_tctx_notify(tctx, ring);
153  }
154  
155  /*
156   * XIVE Thread Interrupt Management Area (TIMA)
157   */
158  
159  static void xive_tm_set_hv_cppr(XivePresenter *xptr, XiveTCTX *tctx,
160                                  hwaddr offset, uint64_t value, unsigned size)
161  {
162      xive_tctx_set_cppr(tctx, TM_QW3_HV_PHYS, value & 0xff);
163  }
164  
165  static uint64_t xive_tm_ack_hv_reg(XivePresenter *xptr, XiveTCTX *tctx,
166                                     hwaddr offset, unsigned size)
167  {
168      return xive_tctx_accept(tctx, TM_QW3_HV_PHYS);
169  }
170  
171  static uint64_t xive_tm_pull_pool_ctx(XivePresenter *xptr, XiveTCTX *tctx,
172                                        hwaddr offset, unsigned size)
173  {
174      uint32_t qw2w2_prev = xive_tctx_word2(&tctx->regs[TM_QW2_HV_POOL]);
175      uint32_t qw2w2;
176  
177      qw2w2 = xive_set_field32(TM_QW2W2_VP, qw2w2_prev, 0);
178      memcpy(&tctx->regs[TM_QW2_HV_POOL + TM_WORD2], &qw2w2, 4);
179      return qw2w2;
180  }
181  
182  static void xive_tm_vt_push(XivePresenter *xptr, XiveTCTX *tctx, hwaddr offset,
183                              uint64_t value, unsigned size)
184  {
185      tctx->regs[TM_QW3_HV_PHYS + TM_WORD2] = value & 0xff;
186  }
187  
188  static uint64_t xive_tm_vt_poll(XivePresenter *xptr, XiveTCTX *tctx,
189                                  hwaddr offset, unsigned size)
190  {
191      return tctx->regs[TM_QW3_HV_PHYS + TM_WORD2] & 0xff;
192  }
193  
194  /*
195   * Define an access map for each page of the TIMA that we will use in
196   * the memory region ops to filter values when doing loads and stores
197   * of raw registers values
198   *
199   * Registers accessibility bits :
200   *
201   *    0x0 - no access
202   *    0x1 - write only
203   *    0x2 - read only
204   *    0x3 - read/write
205   */
206  
207  static const uint8_t xive_tm_hw_view[] = {
208      3, 0, 0, 0,   0, 0, 0, 0,   3, 3, 3, 3,   0, 0, 0, 0, /* QW-0 User */
209      3, 3, 3, 3,   3, 3, 0, 2,   3, 3, 3, 3,   0, 0, 0, 0, /* QW-1 OS   */
210      0, 0, 3, 3,   0, 0, 0, 0,   3, 3, 3, 3,   0, 0, 0, 0, /* QW-2 POOL */
211      3, 3, 3, 3,   0, 3, 0, 2,   3, 0, 0, 3,   3, 3, 3, 0, /* QW-3 PHYS */
212  };
213  
214  static const uint8_t xive_tm_hv_view[] = {
215      3, 0, 0, 0,   0, 0, 0, 0,   3, 3, 3, 3,   0, 0, 0, 0, /* QW-0 User */
216      3, 3, 3, 3,   3, 3, 0, 2,   3, 3, 3, 3,   0, 0, 0, 0, /* QW-1 OS   */
217      0, 0, 3, 3,   0, 0, 0, 0,   0, 3, 3, 3,   0, 0, 0, 0, /* QW-2 POOL */
218      3, 3, 3, 3,   0, 3, 0, 2,   3, 0, 0, 3,   0, 0, 0, 0, /* QW-3 PHYS */
219  };
220  
221  static const uint8_t xive_tm_os_view[] = {
222      3, 0, 0, 0,   0, 0, 0, 0,   3, 3, 3, 3,   0, 0, 0, 0, /* QW-0 User */
223      2, 3, 2, 2,   2, 2, 0, 2,   0, 0, 0, 0,   0, 0, 0, 0, /* QW-1 OS   */
224      0, 0, 0, 0,   0, 0, 0, 0,   0, 0, 0, 0,   0, 0, 0, 0, /* QW-2 POOL */
225      0, 0, 0, 0,   0, 0, 0, 0,   0, 0, 0, 0,   0, 0, 0, 0, /* QW-3 PHYS */
226  };
227  
228  static const uint8_t xive_tm_user_view[] = {
229      3, 0, 0, 0,   0, 0, 0, 0,   0, 0, 0, 0,   0, 0, 0, 0, /* QW-0 User */
230      0, 0, 0, 0,   0, 0, 0, 0,   0, 0, 0, 0,   0, 0, 0, 0, /* QW-1 OS   */
231      0, 0, 0, 0,   0, 0, 0, 0,   0, 0, 0, 0,   0, 0, 0, 0, /* QW-2 POOL */
232      0, 0, 0, 0,   0, 0, 0, 0,   0, 0, 0, 0,   0, 0, 0, 0, /* QW-3 PHYS */
233  };
234  
235  /*
236   * Overall TIMA access map for the thread interrupt management context
237   * registers
238   */
239  static const uint8_t *xive_tm_views[] = {
240      [XIVE_TM_HW_PAGE]   = xive_tm_hw_view,
241      [XIVE_TM_HV_PAGE]   = xive_tm_hv_view,
242      [XIVE_TM_OS_PAGE]   = xive_tm_os_view,
243      [XIVE_TM_USER_PAGE] = xive_tm_user_view,
244  };
245  
246  /*
247   * Computes a register access mask for a given offset in the TIMA
248   */
249  static uint64_t xive_tm_mask(hwaddr offset, unsigned size, bool write)
250  {
251      uint8_t page_offset = (offset >> TM_SHIFT) & 0x3;
252      uint8_t reg_offset = offset & TM_REG_OFFSET;
253      uint8_t reg_mask = write ? 0x1 : 0x2;
254      uint64_t mask = 0x0;
255      int i;
256  
257      for (i = 0; i < size; i++) {
258          if (xive_tm_views[page_offset][reg_offset + i] & reg_mask) {
259              mask |= (uint64_t) 0xff << (8 * (size - i - 1));
260          }
261      }
262  
263      return mask;
264  }
265  
266  static void xive_tm_raw_write(XiveTCTX *tctx, hwaddr offset, uint64_t value,
267                                unsigned size)
268  {
269      uint8_t ring_offset = offset & TM_RING_OFFSET;
270      uint8_t reg_offset = offset & TM_REG_OFFSET;
271      uint64_t mask = xive_tm_mask(offset, size, true);
272      int i;
273  
274      /*
275       * Only 4 or 8 bytes stores are allowed and the User ring is
276       * excluded
277       */
278      if (size < 4 || !mask || ring_offset == TM_QW0_USER) {
279          qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid write access at TIMA @%"
280                        HWADDR_PRIx"\n", offset);
281          return;
282      }
283  
284      /*
285       * Use the register offset for the raw values and filter out
286       * reserved values
287       */
288      for (i = 0; i < size; i++) {
289          uint8_t byte_mask = (mask >> (8 * (size - i - 1)));
290          if (byte_mask) {
291              tctx->regs[reg_offset + i] = (value >> (8 * (size - i - 1))) &
292                  byte_mask;
293          }
294      }
295  }
296  
297  static uint64_t xive_tm_raw_read(XiveTCTX *tctx, hwaddr offset, unsigned size)
298  {
299      uint8_t ring_offset = offset & TM_RING_OFFSET;
300      uint8_t reg_offset = offset & TM_REG_OFFSET;
301      uint64_t mask = xive_tm_mask(offset, size, false);
302      uint64_t ret;
303      int i;
304  
305      /*
306       * Only 4 or 8 bytes loads are allowed and the User ring is
307       * excluded
308       */
309      if (size < 4 || !mask || ring_offset == TM_QW0_USER) {
310          qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid read access at TIMA @%"
311                        HWADDR_PRIx"\n", offset);
312          return -1;
313      }
314  
315      /* Use the register offset for the raw values */
316      ret = 0;
317      for (i = 0; i < size; i++) {
318          ret |= (uint64_t) tctx->regs[reg_offset + i] << (8 * (size - i - 1));
319      }
320  
321      /* filter out reserved values */
322      return ret & mask;
323  }
324  
325  /*
326   * The TM context is mapped twice within each page. Stores and loads
327   * to the first mapping below 2K write and read the specified values
328   * without modification. The second mapping above 2K performs specific
329   * state changes (side effects) in addition to setting/returning the
330   * interrupt management area context of the processor thread.
331   */
332  static uint64_t xive_tm_ack_os_reg(XivePresenter *xptr, XiveTCTX *tctx,
333                                     hwaddr offset, unsigned size)
334  {
335      return xive_tctx_accept(tctx, TM_QW1_OS);
336  }
337  
338  static void xive_tm_set_os_cppr(XivePresenter *xptr, XiveTCTX *tctx,
339                                  hwaddr offset, uint64_t value, unsigned size)
340  {
341      xive_tctx_set_cppr(tctx, TM_QW1_OS, value & 0xff);
342  }
343  
344  /*
345   * Adjust the IPB to allow a CPU to process event queues of other
346   * priorities during one physical interrupt cycle.
347   */
348  static void xive_tm_set_os_pending(XivePresenter *xptr, XiveTCTX *tctx,
349                                     hwaddr offset, uint64_t value, unsigned size)
350  {
351      xive_tctx_ipb_update(tctx, TM_QW1_OS, xive_priority_to_ipb(value & 0xff));
352  }
353  
354  static void xive_os_cam_decode(uint32_t cam, uint8_t *nvt_blk,
355                                 uint32_t *nvt_idx, bool *vo)
356  {
357      if (nvt_blk) {
358          *nvt_blk = xive_nvt_blk(cam);
359      }
360      if (nvt_idx) {
361          *nvt_idx = xive_nvt_idx(cam);
362      }
363      if (vo) {
364          *vo = !!(cam & TM_QW1W2_VO);
365      }
366  }
367  
368  static uint32_t xive_tctx_get_os_cam(XiveTCTX *tctx, uint8_t *nvt_blk,
369                                       uint32_t *nvt_idx, bool *vo)
370  {
371      uint32_t qw1w2 = xive_tctx_word2(&tctx->regs[TM_QW1_OS]);
372      uint32_t cam = be32_to_cpu(qw1w2);
373  
374      xive_os_cam_decode(cam, nvt_blk, nvt_idx, vo);
375      return qw1w2;
376  }
377  
378  static void xive_tctx_set_os_cam(XiveTCTX *tctx, uint32_t qw1w2)
379  {
380      memcpy(&tctx->regs[TM_QW1_OS + TM_WORD2], &qw1w2, 4);
381  }
382  
383  static uint64_t xive_tm_pull_os_ctx(XivePresenter *xptr, XiveTCTX *tctx,
384                                      hwaddr offset, unsigned size)
385  {
386      uint32_t qw1w2;
387      uint32_t qw1w2_new;
388      uint8_t nvt_blk;
389      uint32_t nvt_idx;
390      bool vo;
391  
392      qw1w2 = xive_tctx_get_os_cam(tctx, &nvt_blk, &nvt_idx, &vo);
393  
394      if (!vo) {
395          qemu_log_mask(LOG_GUEST_ERROR, "XIVE: pulling invalid NVT %x/%x !?\n",
396                        nvt_blk, nvt_idx);
397      }
398  
399      /* Invalidate CAM line */
400      qw1w2_new = xive_set_field32(TM_QW1W2_VO, qw1w2, 0);
401      xive_tctx_set_os_cam(tctx, qw1w2_new);
402  
403      xive_tctx_reset_os_signal(tctx);
404      return qw1w2;
405  }
406  
407  static void xive_tctx_need_resend(XiveRouter *xrtr, XiveTCTX *tctx,
408                                    uint8_t nvt_blk, uint32_t nvt_idx)
409  {
410      XiveNVT nvt;
411      uint8_t ipb;
412  
413      /*
414       * Grab the associated NVT to pull the pending bits, and merge
415       * them with the IPB of the thread interrupt context registers
416       */
417      if (xive_router_get_nvt(xrtr, nvt_blk, nvt_idx, &nvt)) {
418          qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid NVT %x/%x\n",
419                            nvt_blk, nvt_idx);
420          return;
421      }
422  
423      ipb = xive_get_field32(NVT_W4_IPB, nvt.w4);
424  
425      if (ipb) {
426          /* Reset the NVT value */
427          nvt.w4 = xive_set_field32(NVT_W4_IPB, nvt.w4, 0);
428          xive_router_write_nvt(xrtr, nvt_blk, nvt_idx, &nvt, 4);
429      }
430      /*
431       * Always call xive_tctx_ipb_update(). Even if there were no
432       * escalation triggered, there could be a pending interrupt which
433       * was saved when the context was pulled and that we need to take
434       * into account by recalculating the PIPR (which is not
435       * saved/restored).
436       * It will also raise the External interrupt signal if needed.
437       */
438      xive_tctx_ipb_update(tctx, TM_QW1_OS, ipb);
439  }
440  
441  /*
442   * Updating the OS CAM line can trigger a resend of interrupt
443   */
444  static void xive_tm_push_os_ctx(XivePresenter *xptr, XiveTCTX *tctx,
445                                  hwaddr offset, uint64_t value, unsigned size)
446  {
447      uint32_t cam = value;
448      uint32_t qw1w2 = cpu_to_be32(cam);
449      uint8_t nvt_blk;
450      uint32_t nvt_idx;
451      bool vo;
452  
453      xive_os_cam_decode(cam, &nvt_blk, &nvt_idx, &vo);
454  
455      /* First update the registers */
456      xive_tctx_set_os_cam(tctx, qw1w2);
457  
458      /* Check the interrupt pending bits */
459      if (vo) {
460          xive_tctx_need_resend(XIVE_ROUTER(xptr), tctx, nvt_blk, nvt_idx);
461      }
462  }
463  
464  static uint32_t xive_presenter_get_config(XivePresenter *xptr)
465  {
466      XivePresenterClass *xpc = XIVE_PRESENTER_GET_CLASS(xptr);
467  
468      return xpc->get_config(xptr);
469  }
470  
471  /*
472   * Define a mapping of "special" operations depending on the TIMA page
473   * offset and the size of the operation.
474   */
475  typedef struct XiveTmOp {
476      uint8_t  page_offset;
477      uint32_t op_offset;
478      unsigned size;
479      void     (*write_handler)(XivePresenter *xptr, XiveTCTX *tctx,
480                                hwaddr offset,
481                                uint64_t value, unsigned size);
482      uint64_t (*read_handler)(XivePresenter *xptr, XiveTCTX *tctx, hwaddr offset,
483                               unsigned size);
484  } XiveTmOp;
485  
486  static const XiveTmOp xive_tm_operations[] = {
487      /*
488       * MMIOs below 2K : raw values and special operations without side
489       * effects
490       */
491      { XIVE_TM_OS_PAGE, TM_QW1_OS + TM_CPPR,   1, xive_tm_set_os_cppr, NULL },
492      { XIVE_TM_HV_PAGE, TM_QW1_OS + TM_WORD2,     4, xive_tm_push_os_ctx, NULL },
493      { XIVE_TM_HV_PAGE, TM_QW3_HV_PHYS + TM_CPPR, 1, xive_tm_set_hv_cppr, NULL },
494      { XIVE_TM_HV_PAGE, TM_QW3_HV_PHYS + TM_WORD2, 1, xive_tm_vt_push, NULL },
495      { XIVE_TM_HV_PAGE, TM_QW3_HV_PHYS + TM_WORD2, 1, NULL, xive_tm_vt_poll },
496  
497      /* MMIOs above 2K : special operations with side effects */
498      { XIVE_TM_OS_PAGE, TM_SPC_ACK_OS_REG,     2, NULL, xive_tm_ack_os_reg },
499      { XIVE_TM_OS_PAGE, TM_SPC_SET_OS_PENDING, 1, xive_tm_set_os_pending, NULL },
500      { XIVE_TM_HV_PAGE, TM_SPC_PULL_OS_CTX,    4, NULL, xive_tm_pull_os_ctx },
501      { XIVE_TM_HV_PAGE, TM_SPC_PULL_OS_CTX,    8, NULL, xive_tm_pull_os_ctx },
502      { XIVE_TM_HV_PAGE, TM_SPC_ACK_HV_REG,     2, NULL, xive_tm_ack_hv_reg },
503      { XIVE_TM_HV_PAGE, TM_SPC_PULL_POOL_CTX,  4, NULL, xive_tm_pull_pool_ctx },
504      { XIVE_TM_HV_PAGE, TM_SPC_PULL_POOL_CTX,  8, NULL, xive_tm_pull_pool_ctx },
505  };
506  
507  static const XiveTmOp xive2_tm_operations[] = {
508      /*
509       * MMIOs below 2K : raw values and special operations without side
510       * effects
511       */
512      { XIVE_TM_OS_PAGE, TM_QW1_OS + TM_CPPR,   1, xive_tm_set_os_cppr, NULL },
513      { XIVE_TM_HV_PAGE, TM_QW1_OS + TM_WORD2,  4, xive2_tm_push_os_ctx, NULL },
514      { XIVE_TM_HV_PAGE, TM_QW3_HV_PHYS + TM_CPPR, 1, xive_tm_set_hv_cppr, NULL },
515      { XIVE_TM_HV_PAGE, TM_QW3_HV_PHYS + TM_WORD2, 1, xive_tm_vt_push, NULL },
516      { XIVE_TM_HV_PAGE, TM_QW3_HV_PHYS + TM_WORD2, 1, NULL, xive_tm_vt_poll },
517  
518      /* MMIOs above 2K : special operations with side effects */
519      { XIVE_TM_OS_PAGE, TM_SPC_ACK_OS_REG,     2, NULL, xive_tm_ack_os_reg },
520      { XIVE_TM_OS_PAGE, TM_SPC_SET_OS_PENDING, 1, xive_tm_set_os_pending, NULL },
521      { XIVE_TM_HV_PAGE, TM_SPC_PULL_OS_CTX,    4, NULL, xive2_tm_pull_os_ctx },
522      { XIVE_TM_HV_PAGE, TM_SPC_PULL_OS_CTX,    8, NULL, xive2_tm_pull_os_ctx },
523      { XIVE_TM_HV_PAGE, TM_SPC_ACK_HV_REG,     2, NULL, xive_tm_ack_hv_reg },
524      { XIVE_TM_HV_PAGE, TM_SPC_PULL_POOL_CTX,  4, NULL, xive_tm_pull_pool_ctx },
525      { XIVE_TM_HV_PAGE, TM_SPC_PULL_POOL_CTX,  8, NULL, xive_tm_pull_pool_ctx },
526  };
527  
528  static const XiveTmOp *xive_tm_find_op(XivePresenter *xptr, hwaddr offset,
529                                         unsigned size, bool write)
530  {
531      uint8_t page_offset = (offset >> TM_SHIFT) & 0x3;
532      uint32_t op_offset = offset & TM_ADDRESS_MASK;
533      const XiveTmOp *tm_ops;
534      int i, tm_ops_count;
535      uint32_t cfg;
536  
537      cfg = xive_presenter_get_config(xptr);
538      if (cfg & XIVE_PRESENTER_GEN1_TIMA_OS) {
539          tm_ops = xive_tm_operations;
540          tm_ops_count = ARRAY_SIZE(xive_tm_operations);
541      } else {
542          tm_ops = xive2_tm_operations;
543          tm_ops_count = ARRAY_SIZE(xive2_tm_operations);
544      }
545  
546      for (i = 0; i < tm_ops_count; i++) {
547          const XiveTmOp *xto = &tm_ops[i];
548  
549          /* Accesses done from a more privileged TIMA page is allowed */
550          if (xto->page_offset >= page_offset &&
551              xto->op_offset == op_offset &&
552              xto->size == size &&
553              ((write && xto->write_handler) || (!write && xto->read_handler))) {
554              return xto;
555          }
556      }
557      return NULL;
558  }
559  
560  /*
561   * TIMA MMIO handlers
562   */
563  void xive_tctx_tm_write(XivePresenter *xptr, XiveTCTX *tctx, hwaddr offset,
564                          uint64_t value, unsigned size)
565  {
566      const XiveTmOp *xto;
567  
568      trace_xive_tctx_tm_write(tctx->cs->cpu_index, offset, size, value);
569  
570      /*
571       * TODO: check V bit in Q[0-3]W2
572       */
573  
574      /*
575       * First, check for special operations in the 2K region
576       */
577      if (offset & TM_SPECIAL_OP) {
578          xto = xive_tm_find_op(tctx->xptr, offset, size, true);
579          if (!xto) {
580              qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid write access at TIMA "
581                            "@%"HWADDR_PRIx"\n", offset);
582          } else {
583              xto->write_handler(xptr, tctx, offset, value, size);
584          }
585          return;
586      }
587  
588      /*
589       * Then, for special operations in the region below 2K.
590       */
591      xto = xive_tm_find_op(tctx->xptr, offset, size, true);
592      if (xto) {
593          xto->write_handler(xptr, tctx, offset, value, size);
594          return;
595      }
596  
597      /*
598       * Finish with raw access to the register values
599       */
600      xive_tm_raw_write(tctx, offset, value, size);
601  }
602  
603  uint64_t xive_tctx_tm_read(XivePresenter *xptr, XiveTCTX *tctx, hwaddr offset,
604                             unsigned size)
605  {
606      const XiveTmOp *xto;
607      uint64_t ret;
608  
609      /*
610       * TODO: check V bit in Q[0-3]W2
611       */
612  
613      /*
614       * First, check for special operations in the 2K region
615       */
616      if (offset & TM_SPECIAL_OP) {
617          xto = xive_tm_find_op(tctx->xptr, offset, size, false);
618          if (!xto) {
619              qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid read access to TIMA"
620                            "@%"HWADDR_PRIx"\n", offset);
621              return -1;
622          }
623          ret = xto->read_handler(xptr, tctx, offset, size);
624          goto out;
625      }
626  
627      /*
628       * Then, for special operations in the region below 2K.
629       */
630      xto = xive_tm_find_op(tctx->xptr, offset, size, false);
631      if (xto) {
632          ret = xto->read_handler(xptr, tctx, offset, size);
633          goto out;
634      }
635  
636      /*
637       * Finish with raw access to the register values
638       */
639      ret = xive_tm_raw_read(tctx, offset, size);
640  out:
641      trace_xive_tctx_tm_read(tctx->cs->cpu_index, offset, size, ret);
642      return ret;
643  }
644  
645  static char *xive_tctx_ring_print(uint8_t *ring)
646  {
647      uint32_t w2 = xive_tctx_word2(ring);
648  
649      return g_strdup_printf("%02x   %02x  %02x    %02x   %02x  "
650                     "%02x  %02x   %02x  %08x",
651                     ring[TM_NSR], ring[TM_CPPR], ring[TM_IPB], ring[TM_LSMFB],
652                     ring[TM_ACK_CNT], ring[TM_INC], ring[TM_AGE], ring[TM_PIPR],
653                     be32_to_cpu(w2));
654  }
655  
656  static const char * const xive_tctx_ring_names[] = {
657      "USER", "OS", "POOL", "PHYS",
658  };
659  
660  /*
661   * kvm_irqchip_in_kernel() will cause the compiler to turn this
662   * info a nop if CONFIG_KVM isn't defined.
663   */
664  #define xive_in_kernel(xptr)                                            \
665      (kvm_irqchip_in_kernel() &&                                         \
666       ({                                                                 \
667           XivePresenterClass *xpc = XIVE_PRESENTER_GET_CLASS(xptr);      \
668           xpc->in_kernel ? xpc->in_kernel(xptr) : false;                 \
669       }))
670  
671  void xive_tctx_pic_print_info(XiveTCTX *tctx, GString *buf)
672  {
673      int cpu_index;
674      int i;
675  
676      /* Skip partially initialized vCPUs. This can happen on sPAPR when vCPUs
677       * are hot plugged or unplugged.
678       */
679      if (!tctx) {
680          return;
681      }
682  
683      cpu_index = tctx->cs ? tctx->cs->cpu_index : -1;
684  
685      if (xive_in_kernel(tctx->xptr)) {
686          Error *local_err = NULL;
687  
688          kvmppc_xive_cpu_synchronize_state(tctx, &local_err);
689          if (local_err) {
690              error_report_err(local_err);
691              return;
692          }
693      }
694  
695      if (xive_presenter_get_config(tctx->xptr) & XIVE_PRESENTER_GEN1_TIMA_OS) {
696          g_string_append_printf(buf, "CPU[%04x]:   "
697                                 "QW   NSR CPPR IPB LSMFB ACK# INC AGE PIPR"
698                                 "  W2\n", cpu_index);
699      } else {
700          g_string_append_printf(buf, "CPU[%04x]:   "
701                                 "QW   NSR CPPR IPB LSMFB   -  LGS  T  PIPR"
702                                 "  W2\n", cpu_index);
703      }
704  
705      for (i = 0; i < XIVE_TM_RING_COUNT; i++) {
706          char *s = xive_tctx_ring_print(&tctx->regs[i * XIVE_TM_RING_SIZE]);
707          g_string_append_printf(buf, "CPU[%04x]: %4s    %s\n",
708                                 cpu_index, xive_tctx_ring_names[i], s);
709          g_free(s);
710      }
711  }
712  
713  void xive_tctx_reset(XiveTCTX *tctx)
714  {
715      memset(tctx->regs, 0, sizeof(tctx->regs));
716  
717      /* Set some defaults */
718      tctx->regs[TM_QW1_OS + TM_LSMFB] = 0xFF;
719      tctx->regs[TM_QW1_OS + TM_ACK_CNT] = 0xFF;
720      tctx->regs[TM_QW1_OS + TM_AGE] = 0xFF;
721  
722      /*
723       * Initialize PIPR to 0xFF to avoid phantom interrupts when the
724       * CPPR is first set.
725       */
726      tctx->regs[TM_QW1_OS + TM_PIPR] =
727          ipb_to_pipr(tctx->regs[TM_QW1_OS + TM_IPB]);
728      tctx->regs[TM_QW3_HV_PHYS + TM_PIPR] =
729          ipb_to_pipr(tctx->regs[TM_QW3_HV_PHYS + TM_IPB]);
730  }
731  
732  static void xive_tctx_realize(DeviceState *dev, Error **errp)
733  {
734      XiveTCTX *tctx = XIVE_TCTX(dev);
735      PowerPCCPU *cpu;
736      CPUPPCState *env;
737  
738      assert(tctx->cs);
739      assert(tctx->xptr);
740  
741      cpu = POWERPC_CPU(tctx->cs);
742      env = &cpu->env;
743      switch (PPC_INPUT(env)) {
744      case PPC_FLAGS_INPUT_POWER9:
745          tctx->hv_output = qdev_get_gpio_in(DEVICE(cpu), POWER9_INPUT_HINT);
746          tctx->os_output = qdev_get_gpio_in(DEVICE(cpu), POWER9_INPUT_INT);
747          break;
748  
749      default:
750          error_setg(errp, "XIVE interrupt controller does not support "
751                     "this CPU bus model");
752          return;
753      }
754  
755      /* Connect the presenter to the VCPU (required for CPU hotplug) */
756      if (xive_in_kernel(tctx->xptr)) {
757          if (kvmppc_xive_cpu_connect(tctx, errp) < 0) {
758              return;
759          }
760      }
761  }
762  
763  static int vmstate_xive_tctx_pre_save(void *opaque)
764  {
765      XiveTCTX *tctx = XIVE_TCTX(opaque);
766      Error *local_err = NULL;
767      int ret;
768  
769      if (xive_in_kernel(tctx->xptr)) {
770          ret = kvmppc_xive_cpu_get_state(tctx, &local_err);
771          if (ret < 0) {
772              error_report_err(local_err);
773              return ret;
774          }
775      }
776  
777      return 0;
778  }
779  
780  static int vmstate_xive_tctx_post_load(void *opaque, int version_id)
781  {
782      XiveTCTX *tctx = XIVE_TCTX(opaque);
783      Error *local_err = NULL;
784      int ret;
785  
786      if (xive_in_kernel(tctx->xptr)) {
787          /*
788           * Required for hotplugged CPU, for which the state comes
789           * after all states of the machine.
790           */
791          ret = kvmppc_xive_cpu_set_state(tctx, &local_err);
792          if (ret < 0) {
793              error_report_err(local_err);
794              return ret;
795          }
796      }
797  
798      return 0;
799  }
800  
801  static const VMStateDescription vmstate_xive_tctx = {
802      .name = TYPE_XIVE_TCTX,
803      .version_id = 1,
804      .minimum_version_id = 1,
805      .pre_save = vmstate_xive_tctx_pre_save,
806      .post_load = vmstate_xive_tctx_post_load,
807      .fields = (const VMStateField[]) {
808          VMSTATE_BUFFER(regs, XiveTCTX),
809          VMSTATE_END_OF_LIST()
810      },
811  };
812  
813  static Property xive_tctx_properties[] = {
814      DEFINE_PROP_LINK("cpu", XiveTCTX, cs, TYPE_CPU, CPUState *),
815      DEFINE_PROP_LINK("presenter", XiveTCTX, xptr, TYPE_XIVE_PRESENTER,
816                       XivePresenter *),
817      DEFINE_PROP_END_OF_LIST(),
818  };
819  
820  static void xive_tctx_class_init(ObjectClass *klass, void *data)
821  {
822      DeviceClass *dc = DEVICE_CLASS(klass);
823  
824      dc->desc = "XIVE Interrupt Thread Context";
825      dc->realize = xive_tctx_realize;
826      dc->vmsd = &vmstate_xive_tctx;
827      device_class_set_props(dc, xive_tctx_properties);
828      /*
829       * Reason: part of XIVE interrupt controller, needs to be wired up
830       * by xive_tctx_create().
831       */
832      dc->user_creatable = false;
833  }
834  
835  static const TypeInfo xive_tctx_info = {
836      .name          = TYPE_XIVE_TCTX,
837      .parent        = TYPE_DEVICE,
838      .instance_size = sizeof(XiveTCTX),
839      .class_init    = xive_tctx_class_init,
840  };
841  
842  Object *xive_tctx_create(Object *cpu, XivePresenter *xptr, Error **errp)
843  {
844      Object *obj;
845  
846      obj = object_new(TYPE_XIVE_TCTX);
847      object_property_add_child(cpu, TYPE_XIVE_TCTX, obj);
848      object_unref(obj);
849      object_property_set_link(obj, "cpu", cpu, &error_abort);
850      object_property_set_link(obj, "presenter", OBJECT(xptr), &error_abort);
851      if (!qdev_realize(DEVICE(obj), NULL, errp)) {
852          object_unparent(obj);
853          return NULL;
854      }
855      return obj;
856  }
857  
858  void xive_tctx_destroy(XiveTCTX *tctx)
859  {
860      Object *obj = OBJECT(tctx);
861  
862      object_unparent(obj);
863  }
864  
865  /*
866   * XIVE ESB helpers
867   */
868  
869  uint8_t xive_esb_set(uint8_t *pq, uint8_t value)
870  {
871      uint8_t old_pq = *pq & 0x3;
872  
873      *pq &= ~0x3;
874      *pq |= value & 0x3;
875  
876      return old_pq;
877  }
878  
879  bool xive_esb_trigger(uint8_t *pq)
880  {
881      uint8_t old_pq = *pq & 0x3;
882  
883      switch (old_pq) {
884      case XIVE_ESB_RESET:
885          xive_esb_set(pq, XIVE_ESB_PENDING);
886          return true;
887      case XIVE_ESB_PENDING:
888      case XIVE_ESB_QUEUED:
889          xive_esb_set(pq, XIVE_ESB_QUEUED);
890          return false;
891      case XIVE_ESB_OFF:
892          xive_esb_set(pq, XIVE_ESB_OFF);
893          return false;
894      default:
895           g_assert_not_reached();
896      }
897  }
898  
899  bool xive_esb_eoi(uint8_t *pq)
900  {
901      uint8_t old_pq = *pq & 0x3;
902  
903      switch (old_pq) {
904      case XIVE_ESB_RESET:
905      case XIVE_ESB_PENDING:
906          xive_esb_set(pq, XIVE_ESB_RESET);
907          return false;
908      case XIVE_ESB_QUEUED:
909          xive_esb_set(pq, XIVE_ESB_PENDING);
910          return true;
911      case XIVE_ESB_OFF:
912          xive_esb_set(pq, XIVE_ESB_OFF);
913          return false;
914      default:
915           g_assert_not_reached();
916      }
917  }
918  
919  /*
920   * XIVE Interrupt Source (or IVSE)
921   */
922  
923  uint8_t xive_source_esb_get(XiveSource *xsrc, uint32_t srcno)
924  {
925      assert(srcno < xsrc->nr_irqs);
926  
927      return xsrc->status[srcno] & 0x3;
928  }
929  
930  uint8_t xive_source_esb_set(XiveSource *xsrc, uint32_t srcno, uint8_t pq)
931  {
932      assert(srcno < xsrc->nr_irqs);
933  
934      return xive_esb_set(&xsrc->status[srcno], pq);
935  }
936  
937  /*
938   * Returns whether the event notification should be forwarded.
939   */
940  static bool xive_source_lsi_trigger(XiveSource *xsrc, uint32_t srcno)
941  {
942      uint8_t old_pq = xive_source_esb_get(xsrc, srcno);
943  
944      xive_source_set_asserted(xsrc, srcno, true);
945  
946      switch (old_pq) {
947      case XIVE_ESB_RESET:
948          xive_source_esb_set(xsrc, srcno, XIVE_ESB_PENDING);
949          return true;
950      default:
951          return false;
952      }
953  }
954  
955  /*
956   * Sources can be configured with PQ offloading in which case the check
957   * on the PQ state bits of MSIs is disabled
958   */
959  static bool xive_source_esb_disabled(XiveSource *xsrc, uint32_t srcno)
960  {
961      return (xsrc->esb_flags & XIVE_SRC_PQ_DISABLE) &&
962          !xive_source_irq_is_lsi(xsrc, srcno);
963  }
964  
965  /*
966   * Returns whether the event notification should be forwarded.
967   */
968  static bool xive_source_esb_trigger(XiveSource *xsrc, uint32_t srcno)
969  {
970      bool ret;
971  
972      assert(srcno < xsrc->nr_irqs);
973  
974      if (xive_source_esb_disabled(xsrc, srcno)) {
975          return true;
976      }
977  
978      ret = xive_esb_trigger(&xsrc->status[srcno]);
979  
980      if (xive_source_irq_is_lsi(xsrc, srcno) &&
981          xive_source_esb_get(xsrc, srcno) == XIVE_ESB_QUEUED) {
982          qemu_log_mask(LOG_GUEST_ERROR,
983                        "XIVE: queued an event on LSI IRQ %d\n", srcno);
984      }
985  
986      return ret;
987  }
988  
989  /*
990   * Returns whether the event notification should be forwarded.
991   */
992  static bool xive_source_esb_eoi(XiveSource *xsrc, uint32_t srcno)
993  {
994      bool ret;
995  
996      assert(srcno < xsrc->nr_irqs);
997  
998      if (xive_source_esb_disabled(xsrc, srcno)) {
999          qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid EOI for IRQ %d\n", srcno);
1000          return false;
1001      }
1002  
1003      ret = xive_esb_eoi(&xsrc->status[srcno]);
1004  
1005      /*
1006       * LSI sources do not set the Q bit but they can still be
1007       * asserted, in which case we should forward a new event
1008       * notification
1009       */
1010      if (xive_source_irq_is_lsi(xsrc, srcno) &&
1011          xive_source_is_asserted(xsrc, srcno)) {
1012          ret = xive_source_lsi_trigger(xsrc, srcno);
1013      }
1014  
1015      return ret;
1016  }
1017  
1018  /*
1019   * Forward the source event notification to the Router
1020   */
1021  static void xive_source_notify(XiveSource *xsrc, int srcno)
1022  {
1023      XiveNotifierClass *xnc = XIVE_NOTIFIER_GET_CLASS(xsrc->xive);
1024      bool pq_checked = !xive_source_esb_disabled(xsrc, srcno);
1025  
1026      if (xnc->notify) {
1027          xnc->notify(xsrc->xive, srcno, pq_checked);
1028      }
1029  }
1030  
1031  /*
1032   * In a two pages ESB MMIO setting, even page is the trigger page, odd
1033   * page is for management
1034   */
1035  static inline bool addr_is_even(hwaddr addr, uint32_t shift)
1036  {
1037      return !((addr >> shift) & 1);
1038  }
1039  
1040  static inline bool xive_source_is_trigger_page(XiveSource *xsrc, hwaddr addr)
1041  {
1042      return xive_source_esb_has_2page(xsrc) &&
1043          addr_is_even(addr, xsrc->esb_shift - 1);
1044  }
1045  
1046  /*
1047   * ESB MMIO loads
1048   *                      Trigger page    Management/EOI page
1049   *
1050   * ESB MMIO setting     2 pages         1 or 2 pages
1051   *
1052   * 0x000 .. 0x3FF       -1              EOI and return 0|1
1053   * 0x400 .. 0x7FF       -1              EOI and return 0|1
1054   * 0x800 .. 0xBFF       -1              return PQ
1055   * 0xC00 .. 0xCFF       -1              return PQ and atomically PQ=00
1056   * 0xD00 .. 0xDFF       -1              return PQ and atomically PQ=01
1057   * 0xE00 .. 0xDFF       -1              return PQ and atomically PQ=10
1058   * 0xF00 .. 0xDFF       -1              return PQ and atomically PQ=11
1059   */
1060  static uint64_t xive_source_esb_read(void *opaque, hwaddr addr, unsigned size)
1061  {
1062      XiveSource *xsrc = XIVE_SOURCE(opaque);
1063      uint32_t offset = addr & 0xFFF;
1064      uint32_t srcno = addr >> xsrc->esb_shift;
1065      uint64_t ret = -1;
1066  
1067      /* In a two pages ESB MMIO setting, trigger page should not be read */
1068      if (xive_source_is_trigger_page(xsrc, addr)) {
1069          qemu_log_mask(LOG_GUEST_ERROR,
1070                        "XIVE: invalid load on IRQ %d trigger page at "
1071                        "0x%"HWADDR_PRIx"\n", srcno, addr);
1072          return -1;
1073      }
1074  
1075      switch (offset) {
1076      case XIVE_ESB_LOAD_EOI ... XIVE_ESB_LOAD_EOI + 0x7FF:
1077          ret = xive_source_esb_eoi(xsrc, srcno);
1078  
1079          /* Forward the source event notification for routing */
1080          if (ret) {
1081              xive_source_notify(xsrc, srcno);
1082          }
1083          break;
1084  
1085      case XIVE_ESB_GET ... XIVE_ESB_GET + 0x3FF:
1086          ret = xive_source_esb_get(xsrc, srcno);
1087          break;
1088  
1089      case XIVE_ESB_SET_PQ_00 ... XIVE_ESB_SET_PQ_00 + 0x0FF:
1090      case XIVE_ESB_SET_PQ_01 ... XIVE_ESB_SET_PQ_01 + 0x0FF:
1091      case XIVE_ESB_SET_PQ_10 ... XIVE_ESB_SET_PQ_10 + 0x0FF:
1092      case XIVE_ESB_SET_PQ_11 ... XIVE_ESB_SET_PQ_11 + 0x0FF:
1093          ret = xive_source_esb_set(xsrc, srcno, (offset >> 8) & 0x3);
1094          break;
1095      default:
1096          qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid ESB load addr %x\n",
1097                        offset);
1098      }
1099  
1100      trace_xive_source_esb_read(addr, srcno, ret);
1101  
1102      return ret;
1103  }
1104  
1105  /*
1106   * ESB MMIO stores
1107   *                      Trigger page    Management/EOI page
1108   *
1109   * ESB MMIO setting     2 pages         1 or 2 pages
1110   *
1111   * 0x000 .. 0x3FF       Trigger         Trigger
1112   * 0x400 .. 0x7FF       Trigger         EOI
1113   * 0x800 .. 0xBFF       Trigger         undefined
1114   * 0xC00 .. 0xCFF       Trigger         PQ=00
1115   * 0xD00 .. 0xDFF       Trigger         PQ=01
1116   * 0xE00 .. 0xDFF       Trigger         PQ=10
1117   * 0xF00 .. 0xDFF       Trigger         PQ=11
1118   */
1119  static void xive_source_esb_write(void *opaque, hwaddr addr,
1120                                    uint64_t value, unsigned size)
1121  {
1122      XiveSource *xsrc = XIVE_SOURCE(opaque);
1123      uint32_t offset = addr & 0xFFF;
1124      uint32_t srcno = addr >> xsrc->esb_shift;
1125      bool notify = false;
1126  
1127      trace_xive_source_esb_write(addr, srcno, value);
1128  
1129      /* In a two pages ESB MMIO setting, trigger page only triggers */
1130      if (xive_source_is_trigger_page(xsrc, addr)) {
1131          notify = xive_source_esb_trigger(xsrc, srcno);
1132          goto out;
1133      }
1134  
1135      switch (offset) {
1136      case 0 ... 0x3FF:
1137          notify = xive_source_esb_trigger(xsrc, srcno);
1138          break;
1139  
1140      case XIVE_ESB_STORE_EOI ... XIVE_ESB_STORE_EOI + 0x3FF:
1141          if (!(xsrc->esb_flags & XIVE_SRC_STORE_EOI)) {
1142              qemu_log_mask(LOG_GUEST_ERROR,
1143                            "XIVE: invalid Store EOI for IRQ %d\n", srcno);
1144              return;
1145          }
1146  
1147          notify = xive_source_esb_eoi(xsrc, srcno);
1148          break;
1149  
1150      /*
1151       * This is an internal offset used to inject triggers when the PQ
1152       * state bits are not controlled locally. Such as for LSIs when
1153       * under ABT mode.
1154       */
1155      case XIVE_ESB_INJECT ... XIVE_ESB_INJECT + 0x3FF:
1156          notify = true;
1157          break;
1158  
1159      case XIVE_ESB_SET_PQ_00 ... XIVE_ESB_SET_PQ_00 + 0x0FF:
1160      case XIVE_ESB_SET_PQ_01 ... XIVE_ESB_SET_PQ_01 + 0x0FF:
1161      case XIVE_ESB_SET_PQ_10 ... XIVE_ESB_SET_PQ_10 + 0x0FF:
1162      case XIVE_ESB_SET_PQ_11 ... XIVE_ESB_SET_PQ_11 + 0x0FF:
1163          xive_source_esb_set(xsrc, srcno, (offset >> 8) & 0x3);
1164          break;
1165  
1166      default:
1167          qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid ESB write addr %x\n",
1168                        offset);
1169          return;
1170      }
1171  
1172  out:
1173      /* Forward the source event notification for routing */
1174      if (notify) {
1175          xive_source_notify(xsrc, srcno);
1176      }
1177  }
1178  
1179  static const MemoryRegionOps xive_source_esb_ops = {
1180      .read = xive_source_esb_read,
1181      .write = xive_source_esb_write,
1182      .endianness = DEVICE_BIG_ENDIAN,
1183      .valid = {
1184          .min_access_size = 1,
1185          .max_access_size = 8,
1186      },
1187      .impl = {
1188          .min_access_size = 1,
1189          .max_access_size = 8,
1190      },
1191  };
1192  
1193  void xive_source_set_irq(void *opaque, int srcno, int val)
1194  {
1195      XiveSource *xsrc = XIVE_SOURCE(opaque);
1196      bool notify = false;
1197  
1198      if (xive_source_irq_is_lsi(xsrc, srcno)) {
1199          if (val) {
1200              notify = xive_source_lsi_trigger(xsrc, srcno);
1201          } else {
1202              xive_source_set_asserted(xsrc, srcno, false);
1203          }
1204      } else {
1205          if (val) {
1206              notify = xive_source_esb_trigger(xsrc, srcno);
1207          }
1208      }
1209  
1210      /* Forward the source event notification for routing */
1211      if (notify) {
1212          xive_source_notify(xsrc, srcno);
1213      }
1214  }
1215  
1216  void xive_source_pic_print_info(XiveSource *xsrc, uint32_t offset, GString *buf)
1217  {
1218      for (unsigned i = 0; i < xsrc->nr_irqs; i++) {
1219          uint8_t pq = xive_source_esb_get(xsrc, i);
1220  
1221          if (pq == XIVE_ESB_OFF) {
1222              continue;
1223          }
1224  
1225          g_string_append_printf(buf, "  %08x %s %c%c%c\n", i + offset,
1226                                 xive_source_irq_is_lsi(xsrc, i) ? "LSI" : "MSI",
1227                                 pq & XIVE_ESB_VAL_P ? 'P' : '-',
1228                                 pq & XIVE_ESB_VAL_Q ? 'Q' : '-',
1229                                 xive_source_is_asserted(xsrc, i) ? 'A' : ' ');
1230      }
1231  }
1232  
1233  static void xive_source_reset(void *dev)
1234  {
1235      XiveSource *xsrc = XIVE_SOURCE(dev);
1236  
1237      /* Do not clear the LSI bitmap */
1238  
1239      memset(xsrc->status, xsrc->reset_pq, xsrc->nr_irqs);
1240  }
1241  
1242  static void xive_source_realize(DeviceState *dev, Error **errp)
1243  {
1244      XiveSource *xsrc = XIVE_SOURCE(dev);
1245      size_t esb_len = xive_source_esb_len(xsrc);
1246  
1247      assert(xsrc->xive);
1248  
1249      if (!xsrc->nr_irqs) {
1250          error_setg(errp, "Number of interrupt needs to be greater than 0");
1251          return;
1252      }
1253  
1254      if (xsrc->esb_shift != XIVE_ESB_4K &&
1255          xsrc->esb_shift != XIVE_ESB_4K_2PAGE &&
1256          xsrc->esb_shift != XIVE_ESB_64K &&
1257          xsrc->esb_shift != XIVE_ESB_64K_2PAGE) {
1258          error_setg(errp, "Invalid ESB shift setting");
1259          return;
1260      }
1261  
1262      xsrc->status = g_malloc0(xsrc->nr_irqs);
1263      xsrc->lsi_map = bitmap_new(xsrc->nr_irqs);
1264  
1265      memory_region_init(&xsrc->esb_mmio, OBJECT(xsrc), "xive.esb", esb_len);
1266      memory_region_init_io(&xsrc->esb_mmio_emulated, OBJECT(xsrc),
1267                            &xive_source_esb_ops, xsrc, "xive.esb-emulated",
1268                            esb_len);
1269      memory_region_add_subregion(&xsrc->esb_mmio, 0, &xsrc->esb_mmio_emulated);
1270  
1271      qemu_register_reset(xive_source_reset, dev);
1272  }
1273  
1274  static const VMStateDescription vmstate_xive_source = {
1275      .name = TYPE_XIVE_SOURCE,
1276      .version_id = 1,
1277      .minimum_version_id = 1,
1278      .fields = (const VMStateField[]) {
1279          VMSTATE_UINT32_EQUAL(nr_irqs, XiveSource, NULL),
1280          VMSTATE_VBUFFER_UINT32(status, XiveSource, 1, NULL, nr_irqs),
1281          VMSTATE_END_OF_LIST()
1282      },
1283  };
1284  
1285  /*
1286   * The default XIVE interrupt source setting for the ESB MMIOs is two
1287   * 64k pages without Store EOI, to be in sync with KVM.
1288   */
1289  static Property xive_source_properties[] = {
1290      DEFINE_PROP_UINT64("flags", XiveSource, esb_flags, 0),
1291      DEFINE_PROP_UINT32("nr-irqs", XiveSource, nr_irqs, 0),
1292      DEFINE_PROP_UINT32("shift", XiveSource, esb_shift, XIVE_ESB_64K_2PAGE),
1293      /*
1294       * By default, PQs are initialized to 0b01 (Q=1) which corresponds
1295       * to "ints off"
1296       */
1297      DEFINE_PROP_UINT8("reset-pq", XiveSource, reset_pq, XIVE_ESB_OFF),
1298      DEFINE_PROP_LINK("xive", XiveSource, xive, TYPE_XIVE_NOTIFIER,
1299                       XiveNotifier *),
1300      DEFINE_PROP_END_OF_LIST(),
1301  };
1302  
1303  static void xive_source_class_init(ObjectClass *klass, void *data)
1304  {
1305      DeviceClass *dc = DEVICE_CLASS(klass);
1306  
1307      dc->desc    = "XIVE Interrupt Source";
1308      device_class_set_props(dc, xive_source_properties);
1309      dc->realize = xive_source_realize;
1310      dc->vmsd    = &vmstate_xive_source;
1311      /*
1312       * Reason: part of XIVE interrupt controller, needs to be wired up,
1313       * e.g. by spapr_xive_instance_init().
1314       */
1315      dc->user_creatable = false;
1316  }
1317  
1318  static const TypeInfo xive_source_info = {
1319      .name          = TYPE_XIVE_SOURCE,
1320      .parent        = TYPE_DEVICE,
1321      .instance_size = sizeof(XiveSource),
1322      .class_init    = xive_source_class_init,
1323  };
1324  
1325  /*
1326   * XiveEND helpers
1327   */
1328  
1329  void xive_end_queue_pic_print_info(XiveEND *end, uint32_t width, GString *buf)
1330  {
1331      uint64_t qaddr_base = xive_end_qaddr(end);
1332      uint32_t qsize = xive_get_field32(END_W0_QSIZE, end->w0);
1333      uint32_t qindex = xive_get_field32(END_W1_PAGE_OFF, end->w1);
1334      uint32_t qentries = 1 << (qsize + 10);
1335      int i;
1336  
1337      /*
1338       * print out the [ (qindex - (width - 1)) .. (qindex + 1)] window
1339       */
1340      g_string_append_printf(buf, " [ ");
1341      qindex = (qindex - (width - 1)) & (qentries - 1);
1342      for (i = 0; i < width; i++) {
1343          uint64_t qaddr = qaddr_base + (qindex << 2);
1344          uint32_t qdata = -1;
1345  
1346          if (dma_memory_read(&address_space_memory, qaddr,
1347                              &qdata, sizeof(qdata), MEMTXATTRS_UNSPECIFIED)) {
1348              qemu_log_mask(LOG_GUEST_ERROR, "XIVE: failed to read EQ @0x%"
1349                            HWADDR_PRIx "\n", qaddr);
1350              return;
1351          }
1352          g_string_append_printf(buf, "%s%08x ", i == width - 1 ? "^" : "",
1353                                 be32_to_cpu(qdata));
1354          qindex = (qindex + 1) & (qentries - 1);
1355      }
1356      g_string_append_c(buf, ']');
1357  }
1358  
1359  void xive_end_pic_print_info(XiveEND *end, uint32_t end_idx, GString *buf)
1360  {
1361      uint64_t qaddr_base = xive_end_qaddr(end);
1362      uint32_t qindex = xive_get_field32(END_W1_PAGE_OFF, end->w1);
1363      uint32_t qgen = xive_get_field32(END_W1_GENERATION, end->w1);
1364      uint32_t qsize = xive_get_field32(END_W0_QSIZE, end->w0);
1365      uint32_t qentries = 1 << (qsize + 10);
1366  
1367      uint32_t nvt_blk = xive_get_field32(END_W6_NVT_BLOCK, end->w6);
1368      uint32_t nvt_idx = xive_get_field32(END_W6_NVT_INDEX, end->w6);
1369      uint8_t priority = xive_get_field32(END_W7_F0_PRIORITY, end->w7);
1370      uint8_t pq;
1371  
1372      if (!xive_end_is_valid(end)) {
1373          return;
1374      }
1375  
1376      pq = xive_get_field32(END_W1_ESn, end->w1);
1377  
1378      g_string_append_printf(buf,
1379                             "  %08x %c%c %c%c%c%c%c%c%c%c prio:%d nvt:%02x/%04x",
1380                             end_idx,
1381                             pq & XIVE_ESB_VAL_P ? 'P' : '-',
1382                             pq & XIVE_ESB_VAL_Q ? 'Q' : '-',
1383                             xive_end_is_valid(end)    ? 'v' : '-',
1384                             xive_end_is_enqueue(end)  ? 'q' : '-',
1385                             xive_end_is_notify(end)   ? 'n' : '-',
1386                             xive_end_is_backlog(end)  ? 'b' : '-',
1387                             xive_end_is_escalate(end) ? 'e' : '-',
1388                             xive_end_is_uncond_escalation(end)   ? 'u' : '-',
1389                             xive_end_is_silent_escalation(end)   ? 's' : '-',
1390                             xive_end_is_firmware(end)   ? 'f' : '-',
1391                             priority, nvt_blk, nvt_idx);
1392  
1393      if (qaddr_base) {
1394          g_string_append_printf(buf, " eq:@%08"PRIx64"% 6d/%5d ^%d",
1395                                 qaddr_base, qindex, qentries, qgen);
1396          xive_end_queue_pic_print_info(end, 6, buf);
1397      }
1398      g_string_append_c(buf, '\n');
1399  }
1400  
1401  static void xive_end_enqueue(XiveEND *end, uint32_t data)
1402  {
1403      uint64_t qaddr_base = xive_end_qaddr(end);
1404      uint32_t qsize = xive_get_field32(END_W0_QSIZE, end->w0);
1405      uint32_t qindex = xive_get_field32(END_W1_PAGE_OFF, end->w1);
1406      uint32_t qgen = xive_get_field32(END_W1_GENERATION, end->w1);
1407  
1408      uint64_t qaddr = qaddr_base + (qindex << 2);
1409      uint32_t qdata = cpu_to_be32((qgen << 31) | (data & 0x7fffffff));
1410      uint32_t qentries = 1 << (qsize + 10);
1411  
1412      if (dma_memory_write(&address_space_memory, qaddr,
1413                           &qdata, sizeof(qdata), MEMTXATTRS_UNSPECIFIED)) {
1414          qemu_log_mask(LOG_GUEST_ERROR, "XIVE: failed to write END data @0x%"
1415                        HWADDR_PRIx "\n", qaddr);
1416          return;
1417      }
1418  
1419      qindex = (qindex + 1) & (qentries - 1);
1420      if (qindex == 0) {
1421          qgen ^= 1;
1422          end->w1 = xive_set_field32(END_W1_GENERATION, end->w1, qgen);
1423      }
1424      end->w1 = xive_set_field32(END_W1_PAGE_OFF, end->w1, qindex);
1425  }
1426  
1427  void xive_end_eas_pic_print_info(XiveEND *end, uint32_t end_idx, GString *buf)
1428  {
1429      XiveEAS *eas = (XiveEAS *) &end->w4;
1430      uint8_t pq;
1431  
1432      if (!xive_end_is_escalate(end)) {
1433          return;
1434      }
1435  
1436      pq = xive_get_field32(END_W1_ESe, end->w1);
1437  
1438      g_string_append_printf(buf, "  %08x %c%c %c%c end:%02x/%04x data:%08x\n",
1439                             end_idx,
1440                             pq & XIVE_ESB_VAL_P ? 'P' : '-',
1441                             pq & XIVE_ESB_VAL_Q ? 'Q' : '-',
1442                             xive_eas_is_valid(eas) ? 'V' : ' ',
1443                             xive_eas_is_masked(eas) ? 'M' : ' ',
1444                             (uint8_t)  xive_get_field64(EAS_END_BLOCK, eas->w),
1445                             (uint32_t) xive_get_field64(EAS_END_INDEX, eas->w),
1446                             (uint32_t) xive_get_field64(EAS_END_DATA, eas->w));
1447  }
1448  
1449  /*
1450   * XIVE Router (aka. Virtualization Controller or IVRE)
1451   */
1452  
1453  int xive_router_get_eas(XiveRouter *xrtr, uint8_t eas_blk, uint32_t eas_idx,
1454                          XiveEAS *eas)
1455  {
1456      XiveRouterClass *xrc = XIVE_ROUTER_GET_CLASS(xrtr);
1457  
1458      return xrc->get_eas(xrtr, eas_blk, eas_idx, eas);
1459  }
1460  
1461  static
1462  int xive_router_get_pq(XiveRouter *xrtr, uint8_t eas_blk, uint32_t eas_idx,
1463                         uint8_t *pq)
1464  {
1465      XiveRouterClass *xrc = XIVE_ROUTER_GET_CLASS(xrtr);
1466  
1467      return xrc->get_pq(xrtr, eas_blk, eas_idx, pq);
1468  }
1469  
1470  static
1471  int xive_router_set_pq(XiveRouter *xrtr, uint8_t eas_blk, uint32_t eas_idx,
1472                         uint8_t *pq)
1473  {
1474      XiveRouterClass *xrc = XIVE_ROUTER_GET_CLASS(xrtr);
1475  
1476      return xrc->set_pq(xrtr, eas_blk, eas_idx, pq);
1477  }
1478  
1479  int xive_router_get_end(XiveRouter *xrtr, uint8_t end_blk, uint32_t end_idx,
1480                          XiveEND *end)
1481  {
1482     XiveRouterClass *xrc = XIVE_ROUTER_GET_CLASS(xrtr);
1483  
1484     return xrc->get_end(xrtr, end_blk, end_idx, end);
1485  }
1486  
1487  int xive_router_write_end(XiveRouter *xrtr, uint8_t end_blk, uint32_t end_idx,
1488                            XiveEND *end, uint8_t word_number)
1489  {
1490     XiveRouterClass *xrc = XIVE_ROUTER_GET_CLASS(xrtr);
1491  
1492     return xrc->write_end(xrtr, end_blk, end_idx, end, word_number);
1493  }
1494  
1495  int xive_router_get_nvt(XiveRouter *xrtr, uint8_t nvt_blk, uint32_t nvt_idx,
1496                          XiveNVT *nvt)
1497  {
1498     XiveRouterClass *xrc = XIVE_ROUTER_GET_CLASS(xrtr);
1499  
1500     return xrc->get_nvt(xrtr, nvt_blk, nvt_idx, nvt);
1501  }
1502  
1503  int xive_router_write_nvt(XiveRouter *xrtr, uint8_t nvt_blk, uint32_t nvt_idx,
1504                          XiveNVT *nvt, uint8_t word_number)
1505  {
1506     XiveRouterClass *xrc = XIVE_ROUTER_GET_CLASS(xrtr);
1507  
1508     return xrc->write_nvt(xrtr, nvt_blk, nvt_idx, nvt, word_number);
1509  }
1510  
1511  static int xive_router_get_block_id(XiveRouter *xrtr)
1512  {
1513     XiveRouterClass *xrc = XIVE_ROUTER_GET_CLASS(xrtr);
1514  
1515     return xrc->get_block_id(xrtr);
1516  }
1517  
1518  static void xive_router_realize(DeviceState *dev, Error **errp)
1519  {
1520      XiveRouter *xrtr = XIVE_ROUTER(dev);
1521  
1522      assert(xrtr->xfb);
1523  }
1524  
1525  static void xive_router_end_notify_handler(XiveRouter *xrtr, XiveEAS *eas)
1526  {
1527      XiveRouterClass *xrc = XIVE_ROUTER_GET_CLASS(xrtr);
1528  
1529      return xrc->end_notify(xrtr, eas);
1530  }
1531  
1532  /*
1533   * Encode the HW CAM line in the block group mode format :
1534   *
1535   *   chip << 19 | 0000000 0 0001 thread (7Bit)
1536   */
1537  static uint32_t xive_tctx_hw_cam_line(XivePresenter *xptr, XiveTCTX *tctx)
1538  {
1539      CPUPPCState *env = &POWERPC_CPU(tctx->cs)->env;
1540      uint32_t pir = env->spr_cb[SPR_PIR].default_value;
1541      uint8_t blk = xive_router_get_block_id(XIVE_ROUTER(xptr));
1542  
1543      return xive_nvt_cam_line(blk, 1 << 7 | (pir & 0x7f));
1544  }
1545  
1546  /*
1547   * The thread context register words are in big-endian format.
1548   */
1549  int xive_presenter_tctx_match(XivePresenter *xptr, XiveTCTX *tctx,
1550                                uint8_t format,
1551                                uint8_t nvt_blk, uint32_t nvt_idx,
1552                                bool cam_ignore, uint32_t logic_serv)
1553  {
1554      uint32_t cam = xive_nvt_cam_line(nvt_blk, nvt_idx);
1555      uint32_t qw3w2 = xive_tctx_word2(&tctx->regs[TM_QW3_HV_PHYS]);
1556      uint32_t qw2w2 = xive_tctx_word2(&tctx->regs[TM_QW2_HV_POOL]);
1557      uint32_t qw1w2 = xive_tctx_word2(&tctx->regs[TM_QW1_OS]);
1558      uint32_t qw0w2 = xive_tctx_word2(&tctx->regs[TM_QW0_USER]);
1559  
1560      /*
1561       * TODO (PowerNV): ignore mode. The low order bits of the NVT
1562       * identifier are ignored in the "CAM" match.
1563       */
1564  
1565      if (format == 0) {
1566          if (cam_ignore == true) {
1567              /*
1568               * F=0 & i=1: Logical server notification (bits ignored at
1569               * the end of the NVT identifier)
1570               */
1571              qemu_log_mask(LOG_UNIMP, "XIVE: no support for LS NVT %x/%x\n",
1572                            nvt_blk, nvt_idx);
1573               return -1;
1574          }
1575  
1576          /* F=0 & i=0: Specific NVT notification */
1577  
1578          /* PHYS ring */
1579          if ((be32_to_cpu(qw3w2) & TM_QW3W2_VT) &&
1580              cam == xive_tctx_hw_cam_line(xptr, tctx)) {
1581              return TM_QW3_HV_PHYS;
1582          }
1583  
1584          /* HV POOL ring */
1585          if ((be32_to_cpu(qw2w2) & TM_QW2W2_VP) &&
1586              cam == xive_get_field32(TM_QW2W2_POOL_CAM, qw2w2)) {
1587              return TM_QW2_HV_POOL;
1588          }
1589  
1590          /* OS ring */
1591          if ((be32_to_cpu(qw1w2) & TM_QW1W2_VO) &&
1592              cam == xive_get_field32(TM_QW1W2_OS_CAM, qw1w2)) {
1593              return TM_QW1_OS;
1594          }
1595      } else {
1596          /* F=1 : User level Event-Based Branch (EBB) notification */
1597  
1598          /* USER ring */
1599          if  ((be32_to_cpu(qw1w2) & TM_QW1W2_VO) &&
1600               (cam == xive_get_field32(TM_QW1W2_OS_CAM, qw1w2)) &&
1601               (be32_to_cpu(qw0w2) & TM_QW0W2_VU) &&
1602               (logic_serv == xive_get_field32(TM_QW0W2_LOGIC_SERV, qw0w2))) {
1603              return TM_QW0_USER;
1604          }
1605      }
1606      return -1;
1607  }
1608  
1609  /*
1610   * This is our simple Xive Presenter Engine model. It is merged in the
1611   * Router as it does not require an extra object.
1612   *
1613   * It receives notification requests sent by the IVRE to find one
1614   * matching NVT (or more) dispatched on the processor threads. In case
1615   * of a single NVT notification, the process is abbreviated and the
1616   * thread is signaled if a match is found. In case of a logical server
1617   * notification (bits ignored at the end of the NVT identifier), the
1618   * IVPE and IVRE select a winning thread using different filters. This
1619   * involves 2 or 3 exchanges on the PowerBus that the model does not
1620   * support.
1621   *
1622   * The parameters represent what is sent on the PowerBus
1623   */
1624  bool xive_presenter_notify(XiveFabric *xfb, uint8_t format,
1625                             uint8_t nvt_blk, uint32_t nvt_idx,
1626                             bool cam_ignore, uint8_t priority,
1627                             uint32_t logic_serv)
1628  {
1629      XiveFabricClass *xfc = XIVE_FABRIC_GET_CLASS(xfb);
1630      XiveTCTXMatch match = { .tctx = NULL, .ring = 0 };
1631      int count;
1632  
1633      /*
1634       * Ask the machine to scan the interrupt controllers for a match
1635       */
1636      count = xfc->match_nvt(xfb, format, nvt_blk, nvt_idx, cam_ignore,
1637                             priority, logic_serv, &match);
1638      if (count < 0) {
1639          return false;
1640      }
1641  
1642      /* handle CPU exception delivery */
1643      if (count) {
1644          trace_xive_presenter_notify(nvt_blk, nvt_idx, match.ring);
1645          xive_tctx_ipb_update(match.tctx, match.ring,
1646                               xive_priority_to_ipb(priority));
1647      }
1648  
1649      return !!count;
1650  }
1651  
1652  /*
1653   * Notification using the END ESe/ESn bit (Event State Buffer for
1654   * escalation and notification). Provide further coalescing in the
1655   * Router.
1656   */
1657  static bool xive_router_end_es_notify(XiveRouter *xrtr, uint8_t end_blk,
1658                                        uint32_t end_idx, XiveEND *end,
1659                                        uint32_t end_esmask)
1660  {
1661      uint8_t pq = xive_get_field32(end_esmask, end->w1);
1662      bool notify = xive_esb_trigger(&pq);
1663  
1664      if (pq != xive_get_field32(end_esmask, end->w1)) {
1665          end->w1 = xive_set_field32(end_esmask, end->w1, pq);
1666          xive_router_write_end(xrtr, end_blk, end_idx, end, 1);
1667      }
1668  
1669      /* ESe/n[Q]=1 : end of notification */
1670      return notify;
1671  }
1672  
1673  /*
1674   * An END trigger can come from an event trigger (IPI or HW) or from
1675   * another chip. We don't model the PowerBus but the END trigger
1676   * message has the same parameters than in the function below.
1677   */
1678  void xive_router_end_notify(XiveRouter *xrtr, XiveEAS *eas)
1679  {
1680      XiveEND end;
1681      uint8_t priority;
1682      uint8_t format;
1683      uint8_t nvt_blk;
1684      uint32_t nvt_idx;
1685      XiveNVT nvt;
1686      bool found;
1687  
1688      uint8_t end_blk = xive_get_field64(EAS_END_BLOCK, eas->w);
1689      uint32_t end_idx = xive_get_field64(EAS_END_INDEX, eas->w);
1690      uint32_t end_data = xive_get_field64(EAS_END_DATA,  eas->w);
1691  
1692      /* END cache lookup */
1693      if (xive_router_get_end(xrtr, end_blk, end_idx, &end)) {
1694          qemu_log_mask(LOG_GUEST_ERROR, "XIVE: No END %x/%x\n", end_blk,
1695                        end_idx);
1696          return;
1697      }
1698  
1699      if (!xive_end_is_valid(&end)) {
1700          trace_xive_router_end_notify(end_blk, end_idx, end_data);
1701          qemu_log_mask(LOG_GUEST_ERROR, "XIVE: END %x/%x is invalid\n",
1702                        end_blk, end_idx);
1703          return;
1704      }
1705  
1706      if (xive_end_is_enqueue(&end)) {
1707          xive_end_enqueue(&end, end_data);
1708          /* Enqueuing event data modifies the EQ toggle and index */
1709          xive_router_write_end(xrtr, end_blk, end_idx, &end, 1);
1710      }
1711  
1712      /*
1713       * When the END is silent, we skip the notification part.
1714       */
1715      if (xive_end_is_silent_escalation(&end)) {
1716          goto do_escalation;
1717      }
1718  
1719      /*
1720       * The W7 format depends on the F bit in W6. It defines the type
1721       * of the notification :
1722       *
1723       *   F=0 : single or multiple NVT notification
1724       *   F=1 : User level Event-Based Branch (EBB) notification, no
1725       *         priority
1726       */
1727      format = xive_get_field32(END_W6_FORMAT_BIT, end.w6);
1728      priority = xive_get_field32(END_W7_F0_PRIORITY, end.w7);
1729  
1730      /* The END is masked */
1731      if (format == 0 && priority == 0xff) {
1732          return;
1733      }
1734  
1735      /*
1736       * Check the END ESn (Event State Buffer for notification) for
1737       * even further coalescing in the Router
1738       */
1739      if (!xive_end_is_notify(&end)) {
1740          /* ESn[Q]=1 : end of notification */
1741          if (!xive_router_end_es_notify(xrtr, end_blk, end_idx,
1742                                         &end, END_W1_ESn)) {
1743              return;
1744          }
1745      }
1746  
1747      /*
1748       * Follows IVPE notification
1749       */
1750      nvt_blk = xive_get_field32(END_W6_NVT_BLOCK, end.w6);
1751      nvt_idx = xive_get_field32(END_W6_NVT_INDEX, end.w6);
1752  
1753      /* NVT cache lookup */
1754      if (xive_router_get_nvt(xrtr, nvt_blk, nvt_idx, &nvt)) {
1755          qemu_log_mask(LOG_GUEST_ERROR, "XIVE: no NVT %x/%x\n",
1756                        nvt_blk, nvt_idx);
1757          return;
1758      }
1759  
1760      if (!xive_nvt_is_valid(&nvt)) {
1761          qemu_log_mask(LOG_GUEST_ERROR, "XIVE: NVT %x/%x is invalid\n",
1762                        nvt_blk, nvt_idx);
1763          return;
1764      }
1765  
1766      found = xive_presenter_notify(xrtr->xfb, format, nvt_blk, nvt_idx,
1767                            xive_get_field32(END_W7_F0_IGNORE, end.w7),
1768                            priority,
1769                            xive_get_field32(END_W7_F1_LOG_SERVER_ID, end.w7));
1770  
1771      /* TODO: Auto EOI. */
1772  
1773      if (found) {
1774          return;
1775      }
1776  
1777      /*
1778       * If no matching NVT is dispatched on a HW thread :
1779       * - specific VP: update the NVT structure if backlog is activated
1780       * - logical server : forward request to IVPE (not supported)
1781       */
1782      if (xive_end_is_backlog(&end)) {
1783          uint8_t ipb;
1784  
1785          if (format == 1) {
1786              qemu_log_mask(LOG_GUEST_ERROR,
1787                            "XIVE: END %x/%x invalid config: F1 & backlog\n",
1788                            end_blk, end_idx);
1789              return;
1790          }
1791          /*
1792           * Record the IPB in the associated NVT structure for later
1793           * use. The presenter will resend the interrupt when the vCPU
1794           * is dispatched again on a HW thread.
1795           */
1796          ipb = xive_get_field32(NVT_W4_IPB, nvt.w4) |
1797              xive_priority_to_ipb(priority);
1798          nvt.w4 = xive_set_field32(NVT_W4_IPB, nvt.w4, ipb);
1799          xive_router_write_nvt(xrtr, nvt_blk, nvt_idx, &nvt, 4);
1800  
1801          /*
1802           * On HW, follows a "Broadcast Backlog" to IVPEs
1803           */
1804      }
1805  
1806  do_escalation:
1807      /*
1808       * If activated, escalate notification using the ESe PQ bits and
1809       * the EAS in w4-5
1810       */
1811      if (!xive_end_is_escalate(&end)) {
1812          return;
1813      }
1814  
1815      /*
1816       * Check the END ESe (Event State Buffer for escalation) for even
1817       * further coalescing in the Router
1818       */
1819      if (!xive_end_is_uncond_escalation(&end)) {
1820          /* ESe[Q]=1 : end of notification */
1821          if (!xive_router_end_es_notify(xrtr, end_blk, end_idx,
1822                                         &end, END_W1_ESe)) {
1823              return;
1824          }
1825      }
1826  
1827      trace_xive_router_end_escalate(end_blk, end_idx,
1828             (uint8_t) xive_get_field32(END_W4_ESC_END_BLOCK, end.w4),
1829             (uint32_t) xive_get_field32(END_W4_ESC_END_INDEX, end.w4),
1830             (uint32_t) xive_get_field32(END_W5_ESC_END_DATA,  end.w5));
1831      /*
1832       * The END trigger becomes an Escalation trigger
1833       */
1834      xive_router_end_notify_handler(xrtr, (XiveEAS *) &end.w4);
1835  }
1836  
1837  void xive_router_notify(XiveNotifier *xn, uint32_t lisn, bool pq_checked)
1838  {
1839      XiveRouter *xrtr = XIVE_ROUTER(xn);
1840      uint8_t eas_blk = XIVE_EAS_BLOCK(lisn);
1841      uint32_t eas_idx = XIVE_EAS_INDEX(lisn);
1842      XiveEAS eas;
1843  
1844      /* EAS cache lookup */
1845      if (xive_router_get_eas(xrtr, eas_blk, eas_idx, &eas)) {
1846          qemu_log_mask(LOG_GUEST_ERROR, "XIVE: Unknown LISN %x\n", lisn);
1847          return;
1848      }
1849  
1850      if (!pq_checked) {
1851          bool notify;
1852          uint8_t pq;
1853  
1854          /* PQ cache lookup */
1855          if (xive_router_get_pq(xrtr, eas_blk, eas_idx, &pq)) {
1856              /* Set FIR */
1857              g_assert_not_reached();
1858          }
1859  
1860          notify = xive_esb_trigger(&pq);
1861  
1862          if (xive_router_set_pq(xrtr, eas_blk, eas_idx, &pq)) {
1863              /* Set FIR */
1864              g_assert_not_reached();
1865          }
1866  
1867          if (!notify) {
1868              return;
1869          }
1870      }
1871  
1872      if (!xive_eas_is_valid(&eas)) {
1873          qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid LISN %x\n", lisn);
1874          return;
1875      }
1876  
1877      if (xive_eas_is_masked(&eas)) {
1878          /* Notification completed */
1879          return;
1880      }
1881  
1882      /*
1883       * The event trigger becomes an END trigger
1884       */
1885      xive_router_end_notify_handler(xrtr, &eas);
1886  }
1887  
1888  static Property xive_router_properties[] = {
1889      DEFINE_PROP_LINK("xive-fabric", XiveRouter, xfb,
1890                       TYPE_XIVE_FABRIC, XiveFabric *),
1891      DEFINE_PROP_END_OF_LIST(),
1892  };
1893  
1894  static void xive_router_class_init(ObjectClass *klass, void *data)
1895  {
1896      DeviceClass *dc = DEVICE_CLASS(klass);
1897      XiveNotifierClass *xnc = XIVE_NOTIFIER_CLASS(klass);
1898      XiveRouterClass *xrc = XIVE_ROUTER_CLASS(klass);
1899  
1900      dc->desc    = "XIVE Router Engine";
1901      device_class_set_props(dc, xive_router_properties);
1902      /* Parent is SysBusDeviceClass. No need to call its realize hook */
1903      dc->realize = xive_router_realize;
1904      xnc->notify = xive_router_notify;
1905  
1906      /* By default, the router handles END triggers locally */
1907      xrc->end_notify = xive_router_end_notify;
1908  }
1909  
1910  static const TypeInfo xive_router_info = {
1911      .name          = TYPE_XIVE_ROUTER,
1912      .parent        = TYPE_SYS_BUS_DEVICE,
1913      .abstract      = true,
1914      .instance_size = sizeof(XiveRouter),
1915      .class_size    = sizeof(XiveRouterClass),
1916      .class_init    = xive_router_class_init,
1917      .interfaces    = (InterfaceInfo[]) {
1918          { TYPE_XIVE_NOTIFIER },
1919          { TYPE_XIVE_PRESENTER },
1920          { }
1921      }
1922  };
1923  
1924  void xive_eas_pic_print_info(XiveEAS *eas, uint32_t lisn, GString *buf)
1925  {
1926      if (!xive_eas_is_valid(eas)) {
1927          return;
1928      }
1929  
1930      g_string_append_printf(buf, "  %08x %s end:%02x/%04x data:%08x\n",
1931                             lisn, xive_eas_is_masked(eas) ? "M" : " ",
1932                             (uint8_t)  xive_get_field64(EAS_END_BLOCK, eas->w),
1933                             (uint32_t) xive_get_field64(EAS_END_INDEX, eas->w),
1934                             (uint32_t) xive_get_field64(EAS_END_DATA, eas->w));
1935  }
1936  
1937  /*
1938   * END ESB MMIO loads
1939   */
1940  static uint64_t xive_end_source_read(void *opaque, hwaddr addr, unsigned size)
1941  {
1942      XiveENDSource *xsrc = XIVE_END_SOURCE(opaque);
1943      uint32_t offset = addr & 0xFFF;
1944      uint8_t end_blk;
1945      uint32_t end_idx;
1946      XiveEND end;
1947      uint32_t end_esmask;
1948      uint8_t pq;
1949      uint64_t ret = -1;
1950  
1951      /*
1952       * The block id should be deduced from the load address on the END
1953       * ESB MMIO but our model only supports a single block per XIVE chip.
1954       */
1955      end_blk = xive_router_get_block_id(xsrc->xrtr);
1956      end_idx = addr >> (xsrc->esb_shift + 1);
1957  
1958      trace_xive_end_source_read(end_blk, end_idx, addr);
1959  
1960      if (xive_router_get_end(xsrc->xrtr, end_blk, end_idx, &end)) {
1961          qemu_log_mask(LOG_GUEST_ERROR, "XIVE: No END %x/%x\n", end_blk,
1962                        end_idx);
1963          return -1;
1964      }
1965  
1966      if (!xive_end_is_valid(&end)) {
1967          qemu_log_mask(LOG_GUEST_ERROR, "XIVE: END %x/%x is invalid\n",
1968                        end_blk, end_idx);
1969          return -1;
1970      }
1971  
1972      end_esmask = addr_is_even(addr, xsrc->esb_shift) ? END_W1_ESn : END_W1_ESe;
1973      pq = xive_get_field32(end_esmask, end.w1);
1974  
1975      switch (offset) {
1976      case XIVE_ESB_LOAD_EOI ... XIVE_ESB_LOAD_EOI + 0x7FF:
1977          ret = xive_esb_eoi(&pq);
1978  
1979          /* Forward the source event notification for routing ?? */
1980          break;
1981  
1982      case XIVE_ESB_GET ... XIVE_ESB_GET + 0x3FF:
1983          ret = pq;
1984          break;
1985  
1986      case XIVE_ESB_SET_PQ_00 ... XIVE_ESB_SET_PQ_00 + 0x0FF:
1987      case XIVE_ESB_SET_PQ_01 ... XIVE_ESB_SET_PQ_01 + 0x0FF:
1988      case XIVE_ESB_SET_PQ_10 ... XIVE_ESB_SET_PQ_10 + 0x0FF:
1989      case XIVE_ESB_SET_PQ_11 ... XIVE_ESB_SET_PQ_11 + 0x0FF:
1990          ret = xive_esb_set(&pq, (offset >> 8) & 0x3);
1991          break;
1992      default:
1993          qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid END ESB load addr %d\n",
1994                        offset);
1995          return -1;
1996      }
1997  
1998      if (pq != xive_get_field32(end_esmask, end.w1)) {
1999          end.w1 = xive_set_field32(end_esmask, end.w1, pq);
2000          xive_router_write_end(xsrc->xrtr, end_blk, end_idx, &end, 1);
2001      }
2002  
2003      return ret;
2004  }
2005  
2006  /*
2007   * END ESB MMIO stores are invalid
2008   */
2009  static void xive_end_source_write(void *opaque, hwaddr addr,
2010                                    uint64_t value, unsigned size)
2011  {
2012      qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid ESB write addr 0x%"
2013                    HWADDR_PRIx"\n", addr);
2014  }
2015  
2016  static const MemoryRegionOps xive_end_source_ops = {
2017      .read = xive_end_source_read,
2018      .write = xive_end_source_write,
2019      .endianness = DEVICE_BIG_ENDIAN,
2020      .valid = {
2021          .min_access_size = 1,
2022          .max_access_size = 8,
2023      },
2024      .impl = {
2025          .min_access_size = 1,
2026          .max_access_size = 8,
2027      },
2028  };
2029  
2030  static void xive_end_source_realize(DeviceState *dev, Error **errp)
2031  {
2032      XiveENDSource *xsrc = XIVE_END_SOURCE(dev);
2033  
2034      assert(xsrc->xrtr);
2035  
2036      if (!xsrc->nr_ends) {
2037          error_setg(errp, "Number of interrupt needs to be greater than 0");
2038          return;
2039      }
2040  
2041      if (xsrc->esb_shift != XIVE_ESB_4K &&
2042          xsrc->esb_shift != XIVE_ESB_64K) {
2043          error_setg(errp, "Invalid ESB shift setting");
2044          return;
2045      }
2046  
2047      /*
2048       * Each END is assigned an even/odd pair of MMIO pages, the even page
2049       * manages the ESn field while the odd page manages the ESe field.
2050       */
2051      memory_region_init_io(&xsrc->esb_mmio, OBJECT(xsrc),
2052                            &xive_end_source_ops, xsrc, "xive.end",
2053                            (1ull << (xsrc->esb_shift + 1)) * xsrc->nr_ends);
2054  }
2055  
2056  static Property xive_end_source_properties[] = {
2057      DEFINE_PROP_UINT32("nr-ends", XiveENDSource, nr_ends, 0),
2058      DEFINE_PROP_UINT32("shift", XiveENDSource, esb_shift, XIVE_ESB_64K),
2059      DEFINE_PROP_LINK("xive", XiveENDSource, xrtr, TYPE_XIVE_ROUTER,
2060                       XiveRouter *),
2061      DEFINE_PROP_END_OF_LIST(),
2062  };
2063  
2064  static void xive_end_source_class_init(ObjectClass *klass, void *data)
2065  {
2066      DeviceClass *dc = DEVICE_CLASS(klass);
2067  
2068      dc->desc    = "XIVE END Source";
2069      device_class_set_props(dc, xive_end_source_properties);
2070      dc->realize = xive_end_source_realize;
2071      /*
2072       * Reason: part of XIVE interrupt controller, needs to be wired up,
2073       * e.g. by spapr_xive_instance_init().
2074       */
2075      dc->user_creatable = false;
2076  }
2077  
2078  static const TypeInfo xive_end_source_info = {
2079      .name          = TYPE_XIVE_END_SOURCE,
2080      .parent        = TYPE_DEVICE,
2081      .instance_size = sizeof(XiveENDSource),
2082      .class_init    = xive_end_source_class_init,
2083  };
2084  
2085  /*
2086   * XIVE Notifier
2087   */
2088  static const TypeInfo xive_notifier_info = {
2089      .name = TYPE_XIVE_NOTIFIER,
2090      .parent = TYPE_INTERFACE,
2091      .class_size = sizeof(XiveNotifierClass),
2092  };
2093  
2094  /*
2095   * XIVE Presenter
2096   */
2097  static const TypeInfo xive_presenter_info = {
2098      .name = TYPE_XIVE_PRESENTER,
2099      .parent = TYPE_INTERFACE,
2100      .class_size = sizeof(XivePresenterClass),
2101  };
2102  
2103  /*
2104   * XIVE Fabric
2105   */
2106  static const TypeInfo xive_fabric_info = {
2107      .name = TYPE_XIVE_FABRIC,
2108      .parent = TYPE_INTERFACE,
2109      .class_size = sizeof(XiveFabricClass),
2110  };
2111  
2112  static void xive_register_types(void)
2113  {
2114      type_register_static(&xive_fabric_info);
2115      type_register_static(&xive_source_info);
2116      type_register_static(&xive_notifier_info);
2117      type_register_static(&xive_presenter_info);
2118      type_register_static(&xive_router_info);
2119      type_register_static(&xive_end_source_info);
2120      type_register_static(&xive_tctx_info);
2121  }
2122  
2123  type_init(xive_register_types)
2124