xref: /openbmc/qemu/hw/intc/xive.c (revision d16214ed2c57a31b5de7e2c115c65b831170a60e)
1 /*
2  * QEMU PowerPC XIVE interrupt controller model
3  *
4  * Copyright (c) 2017-2018, IBM Corporation.
5  *
6  * SPDX-License-Identifier: GPL-2.0-or-later
7  */
8 
9 #include "qemu/osdep.h"
10 #include "qemu/log.h"
11 #include "qemu/module.h"
12 #include "qapi/error.h"
13 #include "target/ppc/cpu.h"
14 #include "system/cpus.h"
15 #include "system/dma.h"
16 #include "system/reset.h"
17 #include "hw/qdev-properties.h"
18 #include "migration/vmstate.h"
19 #include "hw/irq.h"
20 #include "hw/ppc/xive.h"
21 #include "hw/ppc/xive2.h"
22 #include "hw/ppc/xive_regs.h"
23 #include "trace.h"
24 
25 /*
26  * XIVE Thread Interrupt Management context
27  */
28 bool xive_nsr_indicates_exception(uint8_t ring, uint8_t nsr)
29 {
30     switch (ring) {
31     case TM_QW1_OS:
32         return !!(nsr & TM_QW1_NSR_EO);
33     case TM_QW2_HV_POOL:
34     case TM_QW3_HV_PHYS:
35         return !!(nsr & TM_QW3_NSR_HE);
36     default:
37         g_assert_not_reached();
38     }
39 }
40 
41 bool xive_nsr_indicates_group_exception(uint8_t ring, uint8_t nsr)
42 {
43     if ((nsr & TM_NSR_GRP_LVL) > 0) {
44         g_assert(xive_nsr_indicates_exception(ring, nsr));
45         return true;
46     }
47     return false;
48 }
49 
50 uint8_t xive_nsr_exception_ring(uint8_t ring, uint8_t nsr)
51 {
52     /* NSR determines if pool/phys ring is for phys or pool interrupt */
53     if ((ring == TM_QW3_HV_PHYS) || (ring == TM_QW2_HV_POOL)) {
54         uint8_t he = (nsr & TM_QW3_NSR_HE) >> 6;
55 
56         if (he == TM_QW3_NSR_HE_PHYS) {
57             return TM_QW3_HV_PHYS;
58         } else if (he == TM_QW3_NSR_HE_POOL) {
59             return TM_QW2_HV_POOL;
60         } else {
61             /* Don't support LSI mode */
62             g_assert_not_reached();
63         }
64     }
65     return ring;
66 }
67 
68 static qemu_irq xive_tctx_output(XiveTCTX *tctx, uint8_t ring)
69 {
70         switch (ring) {
71         case TM_QW0_USER:
72                 return 0; /* Not supported */
73         case TM_QW1_OS:
74                 return tctx->os_output;
75         case TM_QW2_HV_POOL:
76         case TM_QW3_HV_PHYS:
77                 return tctx->hv_output;
78         default:
79                 return 0;
80         }
81 }
82 
83 uint64_t xive_tctx_accept(XiveTCTX *tctx, uint8_t ring)
84 {
85     uint8_t *regs = &tctx->regs[ring];
86     uint8_t nsr = regs[TM_NSR];
87 
88     qemu_irq_lower(xive_tctx_output(tctx, ring));
89 
90     if (xive_nsr_indicates_exception(ring, nsr)) {
91         uint8_t cppr = regs[TM_PIPR];
92         uint8_t alt_ring;
93         uint8_t *alt_regs;
94 
95         alt_ring = xive_nsr_exception_ring(ring, nsr);
96         alt_regs = &tctx->regs[alt_ring];
97 
98         regs[TM_CPPR] = cppr;
99 
100         /*
101          * If the interrupt was for a specific VP, reset the pending
102          * buffer bit, otherwise clear the logical server indicator
103          */
104         if (!xive_nsr_indicates_group_exception(ring, nsr)) {
105             alt_regs[TM_IPB] &= ~xive_priority_to_ipb(cppr);
106         }
107 
108         /* Clear the exception from NSR */
109         regs[TM_NSR] = 0;
110 
111         trace_xive_tctx_accept(tctx->cs->cpu_index, alt_ring,
112                                alt_regs[TM_IPB], regs[TM_PIPR],
113                                regs[TM_CPPR], regs[TM_NSR]);
114     }
115 
116     return ((uint64_t)nsr << 8) | regs[TM_CPPR];
117 }
118 
119 void xive_tctx_notify(XiveTCTX *tctx, uint8_t ring, uint8_t group_level)
120 {
121     /* HV_POOL ring uses HV_PHYS NSR, CPPR and PIPR registers */
122     uint8_t alt_ring = (ring == TM_QW2_HV_POOL) ? TM_QW3_HV_PHYS : ring;
123     uint8_t *alt_regs = &tctx->regs[alt_ring];
124     uint8_t *regs = &tctx->regs[ring];
125 
126     if (alt_regs[TM_PIPR] < alt_regs[TM_CPPR]) {
127         switch (ring) {
128         case TM_QW1_OS:
129             regs[TM_NSR] = TM_QW1_NSR_EO | (group_level & 0x3F);
130             break;
131         case TM_QW2_HV_POOL:
132             alt_regs[TM_NSR] = (TM_QW3_NSR_HE_POOL << 6) | (group_level & 0x3F);
133             break;
134         case TM_QW3_HV_PHYS:
135             regs[TM_NSR] = (TM_QW3_NSR_HE_PHYS << 6) | (group_level & 0x3F);
136             break;
137         default:
138             g_assert_not_reached();
139         }
140         trace_xive_tctx_notify(tctx->cs->cpu_index, ring,
141                                regs[TM_IPB], alt_regs[TM_PIPR],
142                                alt_regs[TM_CPPR], alt_regs[TM_NSR]);
143         qemu_irq_raise(xive_tctx_output(tctx, ring));
144     } else {
145         alt_regs[TM_NSR] = 0;
146         qemu_irq_lower(xive_tctx_output(tctx, ring));
147     }
148 }
149 
150 void xive_tctx_reset_signal(XiveTCTX *tctx, uint8_t ring)
151 {
152     /*
153      * Lower the External interrupt. Used when pulling a context. It is
154      * necessary to avoid catching it in the higher privilege context. It
155      * should be raised again when re-pushing the lower privilege context.
156      */
157     qemu_irq_lower(xive_tctx_output(tctx, ring));
158 }
159 
160 static void xive_tctx_set_cppr(XiveTCTX *tctx, uint8_t ring, uint8_t cppr)
161 {
162     uint8_t *regs = &tctx->regs[ring];
163     uint8_t pipr_min;
164     uint8_t ring_min;
165 
166     trace_xive_tctx_set_cppr(tctx->cs->cpu_index, ring,
167                              regs[TM_IPB], regs[TM_PIPR],
168                              cppr, regs[TM_NSR]);
169 
170     if (cppr > XIVE_PRIORITY_MAX) {
171         cppr = 0xff;
172     }
173 
174     tctx->regs[ring + TM_CPPR] = cppr;
175 
176     /*
177      * Recompute the PIPR based on local pending interrupts.  The PHYS
178      * ring must take the minimum of both the PHYS and POOL PIPR values.
179      */
180     pipr_min = xive_ipb_to_pipr(regs[TM_IPB]);
181     ring_min = ring;
182 
183     /* PHYS updates also depend on POOL values */
184     if (ring == TM_QW3_HV_PHYS) {
185         uint8_t *pool_regs = &tctx->regs[TM_QW2_HV_POOL];
186 
187         /* POOL values only matter if POOL ctx is valid */
188         if (pool_regs[TM_WORD2] & 0x80) {
189 
190             uint8_t pool_pipr = xive_ipb_to_pipr(pool_regs[TM_IPB]);
191 
192             /*
193              * Determine highest priority interrupt and
194              * remember which ring has it.
195              */
196             if (pool_pipr < pipr_min) {
197                 pipr_min = pool_pipr;
198                 ring_min = TM_QW2_HV_POOL;
199             }
200         }
201     }
202 
203     regs[TM_PIPR] = pipr_min;
204 
205     /* CPPR has changed, check if we need to raise a pending exception */
206     xive_tctx_notify(tctx, ring_min, 0);
207 }
208 
209 void xive_tctx_pipr_update(XiveTCTX *tctx, uint8_t ring, uint8_t priority,
210                            uint8_t group_level)
211  {
212     /* HV_POOL ring uses HV_PHYS NSR, CPPR and PIPR registers */
213     uint8_t alt_ring = (ring == TM_QW2_HV_POOL) ? TM_QW3_HV_PHYS : ring;
214     uint8_t *alt_regs = &tctx->regs[alt_ring];
215     uint8_t *regs = &tctx->regs[ring];
216 
217     if (group_level == 0) {
218         /* VP-specific */
219         regs[TM_IPB] |= xive_priority_to_ipb(priority);
220         alt_regs[TM_PIPR] = xive_ipb_to_pipr(regs[TM_IPB]);
221     } else {
222         /* VP-group */
223         alt_regs[TM_PIPR] = xive_priority_to_pipr(priority);
224     }
225     xive_tctx_notify(tctx, ring, group_level);
226  }
227 
228 void xive_tctx_pipr_present(XiveTCTX *tctx, uint8_t ring, uint8_t priority,
229                             uint8_t group_level)
230 {
231     xive_tctx_pipr_update(tctx, ring, priority, group_level);
232 }
233 
234 /*
235  * XIVE Thread Interrupt Management Area (TIMA)
236  */
237 
238 static void xive_tm_set_hv_cppr(XivePresenter *xptr, XiveTCTX *tctx,
239                                 hwaddr offset, uint64_t value, unsigned size)
240 {
241     xive_tctx_set_cppr(tctx, TM_QW3_HV_PHYS, value & 0xff);
242 }
243 
244 static uint64_t xive_tm_ack_hv_reg(XivePresenter *xptr, XiveTCTX *tctx,
245                                    hwaddr offset, unsigned size)
246 {
247     return xive_tctx_accept(tctx, TM_QW3_HV_PHYS);
248 }
249 
250 static void xive_pool_cam_decode(uint32_t cam, uint8_t *nvt_blk,
251                                  uint32_t *nvt_idx, bool *vp)
252 {
253     if (nvt_blk) {
254         *nvt_blk = xive_nvt_blk(cam);
255     }
256     if (nvt_idx) {
257         *nvt_idx = xive_nvt_idx(cam);
258     }
259     if (vp) {
260         *vp = !!(cam & TM_QW2W2_VP);
261     }
262 }
263 
264 static uint32_t xive_tctx_get_pool_cam(XiveTCTX *tctx, uint8_t *nvt_blk,
265                                        uint32_t *nvt_idx, bool *vp)
266 {
267     uint32_t qw2w2 = xive_tctx_word2(&tctx->regs[TM_QW2_HV_POOL]);
268     uint32_t cam = be32_to_cpu(qw2w2);
269 
270     xive_pool_cam_decode(cam, nvt_blk, nvt_idx, vp);
271     return qw2w2;
272 }
273 
274 static void xive_tctx_set_pool_cam(XiveTCTX *tctx, uint32_t qw2w2)
275 {
276     memcpy(&tctx->regs[TM_QW2_HV_POOL + TM_WORD2], &qw2w2, 4);
277 }
278 
279 static uint64_t xive_tm_pull_pool_ctx(XivePresenter *xptr, XiveTCTX *tctx,
280                                       hwaddr offset, unsigned size)
281 {
282     uint32_t qw2w2;
283     uint32_t qw2w2_new;
284     uint8_t nvt_blk;
285     uint32_t nvt_idx;
286     bool vp;
287 
288     qw2w2 = xive_tctx_get_pool_cam(tctx, &nvt_blk, &nvt_idx, &vp);
289 
290     if (!vp) {
291         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: pull invalid POOL NVT %x/%x !?\n",
292                       nvt_blk, nvt_idx);
293     }
294 
295     /* Invalidate CAM line */
296     qw2w2_new = xive_set_field32(TM_QW2W2_VP, qw2w2, 0);
297     xive_tctx_set_pool_cam(tctx, qw2w2_new);
298 
299     xive_tctx_reset_signal(tctx, TM_QW1_OS);
300     xive_tctx_reset_signal(tctx, TM_QW2_HV_POOL);
301     return qw2w2;
302 }
303 
304 static uint64_t xive_tm_pull_phys_ctx(XivePresenter *xptr, XiveTCTX *tctx,
305                                       hwaddr offset, unsigned size)
306 {
307     uint8_t qw3b8 = tctx->regs[TM_QW3_HV_PHYS + TM_WORD2];
308     uint8_t qw3b8_new;
309 
310     qw3b8 = tctx->regs[TM_QW3_HV_PHYS + TM_WORD2];
311     if (!(qw3b8 & TM_QW3B8_VT)) {
312         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: pulling invalid PHYS thread!?\n");
313     }
314     qw3b8_new = qw3b8 & ~TM_QW3B8_VT;
315     tctx->regs[TM_QW3_HV_PHYS + TM_WORD2] = qw3b8_new;
316 
317     xive_tctx_reset_signal(tctx, TM_QW1_OS);
318     xive_tctx_reset_signal(tctx, TM_QW3_HV_PHYS);
319     return qw3b8;
320 }
321 
322 static void xive_tm_vt_push(XivePresenter *xptr, XiveTCTX *tctx, hwaddr offset,
323                             uint64_t value, unsigned size)
324 {
325     tctx->regs[TM_QW3_HV_PHYS + TM_WORD2] = value & 0xff;
326 }
327 
328 static uint64_t xive_tm_vt_poll(XivePresenter *xptr, XiveTCTX *tctx,
329                                 hwaddr offset, unsigned size)
330 {
331     return tctx->regs[TM_QW3_HV_PHYS + TM_WORD2] & 0xff;
332 }
333 
334 /*
335  * Define an access map for each page of the TIMA that we will use in
336  * the memory region ops to filter values when doing loads and stores
337  * of raw registers values
338  *
339  * Registers accessibility bits :
340  *
341  *    0x0 - no access
342  *    0x1 - write only
343  *    0x2 - read only
344  *    0x3 - read/write
345  */
346 
347 static const uint8_t xive_tm_hw_view[] = {
348     3, 0, 0, 0,   0, 0, 0, 0,   3, 3, 3, 3,   0, 0, 0, 0, /* QW-0 User */
349     3, 3, 3, 3,   3, 3, 0, 2,   3, 3, 3, 3,   0, 0, 0, 3, /* QW-1 OS   */
350     0, 0, 3, 3,   0, 3, 3, 0,   3, 3, 3, 3,   0, 0, 0, 0, /* QW-2 POOL */
351     3, 3, 3, 3,   0, 3, 0, 2,   3, 0, 0, 3,   3, 3, 3, 0, /* QW-3 PHYS */
352 };
353 
354 static const uint8_t xive_tm_hv_view[] = {
355     3, 0, 0, 0,   0, 0, 0, 0,   3, 3, 3, 3,   0, 0, 0, 0, /* QW-0 User */
356     3, 3, 3, 3,   3, 3, 0, 2,   3, 3, 3, 3,   0, 0, 0, 3, /* QW-1 OS   */
357     0, 0, 3, 3,   0, 3, 3, 0,   0, 3, 3, 3,   0, 0, 0, 0, /* QW-2 POOL */
358     3, 3, 3, 3,   0, 3, 0, 2,   3, 0, 0, 3,   0, 0, 0, 0, /* QW-3 PHYS */
359 };
360 
361 static const uint8_t xive_tm_os_view[] = {
362     3, 0, 0, 0,   0, 0, 0, 0,   3, 3, 3, 3,   0, 0, 0, 0, /* QW-0 User */
363     2, 3, 2, 2,   2, 2, 0, 2,   0, 0, 0, 0,   0, 0, 0, 0, /* QW-1 OS   */
364     0, 0, 0, 0,   0, 0, 0, 0,   0, 0, 0, 0,   0, 0, 0, 0, /* QW-2 POOL */
365     0, 0, 0, 0,   0, 0, 0, 0,   0, 0, 0, 0,   0, 0, 0, 0, /* QW-3 PHYS */
366 };
367 
368 static const uint8_t xive_tm_user_view[] = {
369     3, 0, 0, 0,   0, 0, 0, 0,   0, 0, 0, 0,   0, 0, 0, 0, /* QW-0 User */
370     0, 0, 0, 0,   0, 0, 0, 0,   0, 0, 0, 0,   0, 0, 0, 0, /* QW-1 OS   */
371     0, 0, 0, 0,   0, 0, 0, 0,   0, 0, 0, 0,   0, 0, 0, 0, /* QW-2 POOL */
372     0, 0, 0, 0,   0, 0, 0, 0,   0, 0, 0, 0,   0, 0, 0, 0, /* QW-3 PHYS */
373 };
374 
375 /*
376  * Overall TIMA access map for the thread interrupt management context
377  * registers
378  */
379 static const uint8_t *xive_tm_views[] = {
380     [XIVE_TM_HW_PAGE]   = xive_tm_hw_view,
381     [XIVE_TM_HV_PAGE]   = xive_tm_hv_view,
382     [XIVE_TM_OS_PAGE]   = xive_tm_os_view,
383     [XIVE_TM_USER_PAGE] = xive_tm_user_view,
384 };
385 
386 /*
387  * Computes a register access mask for a given offset in the TIMA
388  */
389 static uint64_t xive_tm_mask(hwaddr offset, unsigned size, bool write)
390 {
391     uint8_t page_offset = (offset >> TM_SHIFT) & 0x3;
392     uint8_t reg_offset = offset & TM_REG_OFFSET;
393     uint8_t reg_mask = write ? 0x1 : 0x2;
394     uint64_t mask = 0x0;
395     int i;
396 
397     for (i = 0; i < size; i++) {
398         if (xive_tm_views[page_offset][reg_offset + i] & reg_mask) {
399             mask |= (uint64_t) 0xff << (8 * (size - i - 1));
400         }
401     }
402 
403     return mask;
404 }
405 
406 static void xive_tm_raw_write(XiveTCTX *tctx, hwaddr offset, uint64_t value,
407                               unsigned size)
408 {
409     uint8_t ring_offset = offset & TM_RING_OFFSET;
410     uint8_t reg_offset = offset & TM_REG_OFFSET;
411     uint64_t mask = xive_tm_mask(offset, size, true);
412     int i;
413 
414     /*
415      * Only 4 or 8 bytes stores are allowed and the User ring is
416      * excluded
417      */
418     if (size < 4 || !mask || ring_offset == TM_QW0_USER) {
419         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid write access at TIMA @%"
420                       HWADDR_PRIx" size %d\n", offset, size);
421         return;
422     }
423 
424     /*
425      * Use the register offset for the raw values and filter out
426      * reserved values
427      */
428     for (i = 0; i < size; i++) {
429         uint8_t byte_mask = (mask >> (8 * (size - i - 1)));
430         if (byte_mask) {
431             tctx->regs[reg_offset + i] = (value >> (8 * (size - i - 1))) &
432                 byte_mask;
433         }
434     }
435 }
436 
437 static uint64_t xive_tm_raw_read(XiveTCTX *tctx, hwaddr offset, unsigned size)
438 {
439     uint8_t ring_offset = offset & TM_RING_OFFSET;
440     uint8_t reg_offset = offset & TM_REG_OFFSET;
441     uint64_t mask = xive_tm_mask(offset, size, false);
442     uint64_t ret;
443     int i;
444 
445     /*
446      * Only 4 or 8 bytes loads are allowed and the User ring is
447      * excluded
448      */
449     if (size < 4 || !mask || ring_offset == TM_QW0_USER) {
450         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid read access at TIMA @%"
451                       HWADDR_PRIx" size %d\n", offset, size);
452         return -1;
453     }
454 
455     /* Use the register offset for the raw values */
456     ret = 0;
457     for (i = 0; i < size; i++) {
458         ret |= (uint64_t) tctx->regs[reg_offset + i] << (8 * (size - i - 1));
459     }
460 
461     /* filter out reserved values */
462     return ret & mask;
463 }
464 
465 /*
466  * The TM context is mapped twice within each page. Stores and loads
467  * to the first mapping below 2K write and read the specified values
468  * without modification. The second mapping above 2K performs specific
469  * state changes (side effects) in addition to setting/returning the
470  * interrupt management area context of the processor thread.
471  */
472 static uint64_t xive_tm_ack_os_reg(XivePresenter *xptr, XiveTCTX *tctx,
473                                    hwaddr offset, unsigned size)
474 {
475     return xive_tctx_accept(tctx, TM_QW1_OS);
476 }
477 
478 static void xive_tm_set_os_cppr(XivePresenter *xptr, XiveTCTX *tctx,
479                                 hwaddr offset, uint64_t value, unsigned size)
480 {
481     xive_tctx_set_cppr(tctx, TM_QW1_OS, value & 0xff);
482 }
483 
484 static void xive_tctx_set_lgs(XiveTCTX *tctx, uint8_t ring, uint8_t lgs)
485 {
486     uint8_t *regs = &tctx->regs[ring];
487 
488     regs[TM_LGS] = lgs;
489 }
490 
491 static void xive_tm_set_os_lgs(XivePresenter *xptr, XiveTCTX *tctx,
492                           hwaddr offset, uint64_t value, unsigned size)
493 {
494     xive_tctx_set_lgs(tctx, TM_QW1_OS, value & 0xff);
495 }
496 
497 /*
498  * Adjust the PIPR to allow a CPU to process event queues of other
499  * priorities during one physical interrupt cycle.
500  */
501 static void xive_tm_set_os_pending(XivePresenter *xptr, XiveTCTX *tctx,
502                                    hwaddr offset, uint64_t value, unsigned size)
503 {
504     xive_tctx_pipr_update(tctx, TM_QW1_OS, value & 0xff, 0);
505 }
506 
507 static void xive_os_cam_decode(uint32_t cam, uint8_t *nvt_blk,
508                                uint32_t *nvt_idx, bool *vo)
509 {
510     if (nvt_blk) {
511         *nvt_blk = xive_nvt_blk(cam);
512     }
513     if (nvt_idx) {
514         *nvt_idx = xive_nvt_idx(cam);
515     }
516     if (vo) {
517         *vo = !!(cam & TM_QW1W2_VO);
518     }
519 }
520 
521 static uint32_t xive_tctx_get_os_cam(XiveTCTX *tctx, uint8_t *nvt_blk,
522                                      uint32_t *nvt_idx, bool *vo)
523 {
524     uint32_t qw1w2 = xive_tctx_word2(&tctx->regs[TM_QW1_OS]);
525     uint32_t cam = be32_to_cpu(qw1w2);
526 
527     xive_os_cam_decode(cam, nvt_blk, nvt_idx, vo);
528     return qw1w2;
529 }
530 
531 static void xive_tctx_set_os_cam(XiveTCTX *tctx, uint32_t qw1w2)
532 {
533     memcpy(&tctx->regs[TM_QW1_OS + TM_WORD2], &qw1w2, 4);
534 }
535 
536 static uint64_t xive_tm_pull_os_ctx(XivePresenter *xptr, XiveTCTX *tctx,
537                                     hwaddr offset, unsigned size)
538 {
539     uint32_t qw1w2;
540     uint32_t qw1w2_new;
541     uint8_t nvt_blk;
542     uint32_t nvt_idx;
543     bool vo;
544 
545     qw1w2 = xive_tctx_get_os_cam(tctx, &nvt_blk, &nvt_idx, &vo);
546 
547     if (!vo) {
548         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: pull invalid OS NVT %x/%x !?\n",
549                       nvt_blk, nvt_idx);
550     }
551 
552     /* Invalidate CAM line */
553     qw1w2_new = xive_set_field32(TM_QW1W2_VO, qw1w2, 0);
554     xive_tctx_set_os_cam(tctx, qw1w2_new);
555 
556     xive_tctx_reset_signal(tctx, TM_QW1_OS);
557     return qw1w2;
558 }
559 
560 static void xive_tctx_need_resend(XiveRouter *xrtr, XiveTCTX *tctx,
561                                   uint8_t nvt_blk, uint32_t nvt_idx)
562 {
563     XiveNVT nvt;
564     uint8_t ipb;
565 
566     /*
567      * Grab the associated NVT to pull the pending bits, and merge
568      * them with the IPB of the thread interrupt context registers
569      */
570     if (xive_router_get_nvt(xrtr, nvt_blk, nvt_idx, &nvt)) {
571         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid NVT %x/%x\n",
572                           nvt_blk, nvt_idx);
573         return;
574     }
575 
576     ipb = xive_get_field32(NVT_W4_IPB, nvt.w4);
577 
578     if (ipb) {
579         /* Reset the NVT value */
580         nvt.w4 = xive_set_field32(NVT_W4_IPB, nvt.w4, 0);
581         xive_router_write_nvt(xrtr, nvt_blk, nvt_idx, &nvt, 4);
582 
583         uint8_t *regs = &tctx->regs[TM_QW1_OS];
584         regs[TM_IPB] |= ipb;
585     }
586 
587     /*
588      * Always call xive_tctx_pipr_update(). Even if there were no
589      * escalation triggered, there could be a pending interrupt which
590      * was saved when the context was pulled and that we need to take
591      * into account by recalculating the PIPR (which is not
592      * saved/restored).
593      * It will also raise the External interrupt signal if needed.
594      */
595     xive_tctx_pipr_update(tctx, TM_QW1_OS, 0xFF, 0); /* fxb */
596 }
597 
598 /*
599  * Updating the OS CAM line can trigger a resend of interrupt
600  */
601 static void xive_tm_push_os_ctx(XivePresenter *xptr, XiveTCTX *tctx,
602                                 hwaddr offset, uint64_t value, unsigned size)
603 {
604     uint32_t cam = value;
605     uint32_t qw1w2 = cpu_to_be32(cam);
606     uint8_t nvt_blk;
607     uint32_t nvt_idx;
608     bool vo;
609 
610     xive_os_cam_decode(cam, &nvt_blk, &nvt_idx, &vo);
611 
612     /* First update the registers */
613     xive_tctx_set_os_cam(tctx, qw1w2);
614 
615     /* Check the interrupt pending bits */
616     if (vo) {
617         xive_tctx_need_resend(XIVE_ROUTER(xptr), tctx, nvt_blk, nvt_idx);
618     }
619 }
620 
621 static uint32_t xive_presenter_get_config(XivePresenter *xptr)
622 {
623     XivePresenterClass *xpc = XIVE_PRESENTER_GET_CLASS(xptr);
624 
625     return xpc->get_config(xptr);
626 }
627 
628 /*
629  * Define a mapping of "special" operations depending on the TIMA page
630  * offset and the size of the operation.
631  */
632 typedef struct XiveTmOp {
633     uint8_t  page_offset;
634     uint32_t op_offset;
635     unsigned size;
636     void     (*write_handler)(XivePresenter *xptr, XiveTCTX *tctx,
637                               hwaddr offset,
638                               uint64_t value, unsigned size);
639     uint64_t (*read_handler)(XivePresenter *xptr, XiveTCTX *tctx, hwaddr offset,
640                              unsigned size);
641 } XiveTmOp;
642 
643 static const XiveTmOp xive_tm_operations[] = {
644     /*
645      * MMIOs below 2K : raw values and special operations without side
646      * effects
647      */
648     { XIVE_TM_OS_PAGE, TM_QW1_OS + TM_CPPR,       1, xive_tm_set_os_cppr,
649                                                      NULL },
650     { XIVE_TM_HV_PAGE, TM_QW1_OS + TM_WORD2,      4, xive_tm_push_os_ctx,
651                                                      NULL },
652     { XIVE_TM_HV_PAGE, TM_QW3_HV_PHYS + TM_CPPR,  1, xive_tm_set_hv_cppr,
653                                                      NULL },
654     { XIVE_TM_HV_PAGE, TM_QW3_HV_PHYS + TM_WORD2, 1, xive_tm_vt_push,
655                                                      NULL },
656     { XIVE_TM_HV_PAGE, TM_QW3_HV_PHYS + TM_WORD2, 1, NULL,
657                                                      xive_tm_vt_poll },
658 
659     /* MMIOs above 2K : special operations with side effects */
660     { XIVE_TM_OS_PAGE, TM_SPC_ACK_OS_REG,         2, NULL,
661                                                      xive_tm_ack_os_reg },
662     { XIVE_TM_OS_PAGE, TM_SPC_SET_OS_PENDING,     1, xive_tm_set_os_pending,
663                                                      NULL },
664     { XIVE_TM_HV_PAGE, TM_SPC_PULL_OS_CTX,        4, NULL,
665                                                      xive_tm_pull_os_ctx },
666     { XIVE_TM_HV_PAGE, TM_SPC_PULL_OS_CTX,        8, NULL,
667                                                      xive_tm_pull_os_ctx },
668     { XIVE_TM_HV_PAGE, TM_SPC_ACK_HV_REG,         2, NULL,
669                                                      xive_tm_ack_hv_reg },
670     { XIVE_TM_HV_PAGE, TM_SPC_PULL_POOL_CTX,      4, NULL,
671                                                      xive_tm_pull_pool_ctx },
672     { XIVE_TM_HV_PAGE, TM_SPC_PULL_POOL_CTX,      8, NULL,
673                                                      xive_tm_pull_pool_ctx },
674     { XIVE_TM_HV_PAGE, TM_SPC_PULL_PHYS_CTX,      1, NULL,
675                                                      xive_tm_pull_phys_ctx },
676 };
677 
678 static const XiveTmOp xive2_tm_operations[] = {
679     /*
680      * MMIOs below 2K : raw values and special operations without side
681      * effects
682      */
683     { XIVE_TM_OS_PAGE, TM_QW1_OS + TM_CPPR,       1, xive2_tm_set_os_cppr,
684                                                      NULL },
685     { XIVE_TM_HV_PAGE, TM_QW1_OS + TM_WORD2,      4, xive2_tm_push_os_ctx,
686                                                      NULL },
687     { XIVE_TM_HV_PAGE, TM_QW1_OS + TM_WORD2,      8, xive2_tm_push_os_ctx,
688                                                      NULL },
689     { XIVE_TM_OS_PAGE, TM_QW1_OS + TM_LGS,        1, xive_tm_set_os_lgs,
690                                                      NULL },
691     { XIVE_TM_HV_PAGE, TM_QW3_HV_PHYS + TM_CPPR,  1, xive2_tm_set_hv_cppr,
692                                                      NULL },
693     { XIVE_TM_HV_PAGE, TM_QW3_HV_PHYS + TM_WORD2, 1, xive_tm_vt_push,
694                                                      NULL },
695     { XIVE_TM_HV_PAGE, TM_QW3_HV_PHYS + TM_WORD2, 1, NULL,
696                                                      xive_tm_vt_poll },
697     { XIVE_TM_HV_PAGE, TM_QW3_HV_PHYS + TM_T,     1, xive2_tm_set_hv_target,
698                                                      NULL },
699 
700     /* MMIOs above 2K : special operations with side effects */
701     { XIVE_TM_OS_PAGE, TM_SPC_ACK_OS_REG,         2, NULL,
702                                                    xive_tm_ack_os_reg },
703     { XIVE_TM_OS_PAGE, TM_SPC_SET_OS_PENDING,     1, xive_tm_set_os_pending,
704                                                      NULL },
705     { XIVE_TM_HV_PAGE, TM_SPC_PULL_OS_CTX_G2,     4, NULL,
706                                                      xive2_tm_pull_os_ctx },
707     { XIVE_TM_HV_PAGE, TM_SPC_PULL_OS_CTX,        4, NULL,
708                                                      xive2_tm_pull_os_ctx },
709     { XIVE_TM_HV_PAGE, TM_SPC_PULL_OS_CTX,        8, NULL,
710                                                      xive2_tm_pull_os_ctx },
711     { XIVE_TM_HV_PAGE, TM_SPC_ACK_HV_REG,         2, NULL,
712                                                      xive_tm_ack_hv_reg },
713     { XIVE_TM_HV_PAGE, TM_SPC_PULL_POOL_CTX_G2,   4, NULL,
714                                                      xive2_tm_pull_pool_ctx },
715     { XIVE_TM_HV_PAGE, TM_SPC_PULL_POOL_CTX,      4, NULL,
716                                                      xive2_tm_pull_pool_ctx },
717     { XIVE_TM_HV_PAGE, TM_SPC_PULL_POOL_CTX,      8, NULL,
718                                                      xive2_tm_pull_pool_ctx },
719     { XIVE_TM_HV_PAGE, TM_SPC_PULL_OS_CTX_OL,     1, xive2_tm_pull_os_ctx_ol,
720                                                      NULL },
721     { XIVE_TM_HV_PAGE, TM_SPC_PULL_PHYS_CTX_G2,   4, NULL,
722                                                      xive2_tm_pull_phys_ctx },
723     { XIVE_TM_HV_PAGE, TM_SPC_PULL_PHYS_CTX,      1, NULL,
724                                                      xive2_tm_pull_phys_ctx },
725     { XIVE_TM_HV_PAGE, TM_SPC_PULL_PHYS_CTX_OL,   1, xive2_tm_pull_phys_ctx_ol,
726                                                      NULL },
727     { XIVE_TM_OS_PAGE, TM_SPC_ACK_OS_EL,          1, xive2_tm_ack_os_el,
728                                                      NULL },
729 };
730 
731 static const XiveTmOp *xive_tm_find_op(XivePresenter *xptr, hwaddr offset,
732                                        unsigned size, bool write)
733 {
734     uint8_t page_offset = (offset >> TM_SHIFT) & 0x3;
735     uint32_t op_offset = offset & TM_ADDRESS_MASK;
736     const XiveTmOp *tm_ops;
737     int i, tm_ops_count;
738     uint32_t cfg;
739 
740     cfg = xive_presenter_get_config(xptr);
741     if (cfg & XIVE_PRESENTER_GEN1_TIMA_OS) {
742         tm_ops = xive_tm_operations;
743         tm_ops_count = ARRAY_SIZE(xive_tm_operations);
744     } else {
745         tm_ops = xive2_tm_operations;
746         tm_ops_count = ARRAY_SIZE(xive2_tm_operations);
747     }
748 
749     for (i = 0; i < tm_ops_count; i++) {
750         const XiveTmOp *xto = &tm_ops[i];
751 
752         /* Accesses done from a more privileged TIMA page is allowed */
753         if (xto->page_offset >= page_offset &&
754             xto->op_offset == op_offset &&
755             xto->size == size &&
756             ((write && xto->write_handler) || (!write && xto->read_handler))) {
757             return xto;
758         }
759     }
760     return NULL;
761 }
762 
763 /*
764  * TIMA MMIO handlers
765  */
766 void xive_tctx_tm_write(XivePresenter *xptr, XiveTCTX *tctx, hwaddr offset,
767                         uint64_t value, unsigned size)
768 {
769     const XiveTmOp *xto;
770 
771     trace_xive_tctx_tm_write(tctx->cs->cpu_index, offset, size, value);
772 
773     /*
774      * TODO: check V bit in Q[0-3]W2
775      */
776 
777     /*
778      * First, check for special operations in the 2K region
779      */
780     if (offset & TM_SPECIAL_OP) {
781         xto = xive_tm_find_op(tctx->xptr, offset, size, true);
782         if (!xto) {
783             qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid write access at TIMA "
784                           "@%"HWADDR_PRIx" size %d\n", offset, size);
785         } else {
786             xto->write_handler(xptr, tctx, offset, value, size);
787         }
788         return;
789     }
790 
791     /*
792      * Then, for special operations in the region below 2K.
793      */
794     xto = xive_tm_find_op(tctx->xptr, offset, size, true);
795     if (xto) {
796         xto->write_handler(xptr, tctx, offset, value, size);
797         return;
798     }
799 
800     /*
801      * Finish with raw access to the register values
802      */
803     xive_tm_raw_write(tctx, offset, value, size);
804 }
805 
806 uint64_t xive_tctx_tm_read(XivePresenter *xptr, XiveTCTX *tctx, hwaddr offset,
807                            unsigned size)
808 {
809     const XiveTmOp *xto;
810     uint64_t ret;
811 
812     /*
813      * TODO: check V bit in Q[0-3]W2
814      */
815 
816     /*
817      * First, check for special operations in the 2K region
818      */
819     if (offset & TM_SPECIAL_OP) {
820         xto = xive_tm_find_op(tctx->xptr, offset, size, false);
821         if (!xto) {
822             qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid read access to TIMA"
823                           "@%"HWADDR_PRIx" size %d\n", offset, size);
824             return -1;
825         }
826         ret = xto->read_handler(xptr, tctx, offset, size);
827         goto out;
828     }
829 
830     /*
831      * Then, for special operations in the region below 2K.
832      */
833     xto = xive_tm_find_op(tctx->xptr, offset, size, false);
834     if (xto) {
835         ret = xto->read_handler(xptr, tctx, offset, size);
836         goto out;
837     }
838 
839     /*
840      * Finish with raw access to the register values
841      */
842     ret = xive_tm_raw_read(tctx, offset, size);
843 out:
844     trace_xive_tctx_tm_read(tctx->cs->cpu_index, offset, size, ret);
845     return ret;
846 }
847 
848 static char *xive_tctx_ring_print(uint8_t *ring)
849 {
850     uint32_t w2 = xive_tctx_word2(ring);
851 
852     return g_strdup_printf("%02x   %02x  %02x    %02x   %02x  "
853                    "%02x  %02x   %02x  %08x",
854                    ring[TM_NSR], ring[TM_CPPR], ring[TM_IPB], ring[TM_LSMFB],
855                    ring[TM_ACK_CNT], ring[TM_INC], ring[TM_AGE], ring[TM_PIPR],
856                    be32_to_cpu(w2));
857 }
858 
859 static const char * const xive_tctx_ring_names[] = {
860     "USER", "OS", "POOL", "PHYS",
861 };
862 
863 /*
864  * kvm_irqchip_in_kernel() will cause the compiler to turn this
865  * info a nop if CONFIG_KVM isn't defined.
866  */
867 #define xive_in_kernel(xptr)                                            \
868     (kvm_irqchip_in_kernel() &&                                         \
869      ({                                                                 \
870          XivePresenterClass *xpc = XIVE_PRESENTER_GET_CLASS(xptr);      \
871          xpc->in_kernel ? xpc->in_kernel(xptr) : false;                 \
872      }))
873 
874 void xive_tctx_pic_print_info(XiveTCTX *tctx, GString *buf)
875 {
876     int cpu_index;
877     int i;
878 
879     /* Skip partially initialized vCPUs. This can happen on sPAPR when vCPUs
880      * are hot plugged or unplugged.
881      */
882     if (!tctx) {
883         return;
884     }
885 
886     cpu_index = tctx->cs ? tctx->cs->cpu_index : -1;
887 
888     if (xive_in_kernel(tctx->xptr)) {
889         Error *local_err = NULL;
890 
891         kvmppc_xive_cpu_synchronize_state(tctx, &local_err);
892         if (local_err) {
893             error_report_err(local_err);
894             return;
895         }
896     }
897 
898     if (xive_presenter_get_config(tctx->xptr) & XIVE_PRESENTER_GEN1_TIMA_OS) {
899         g_string_append_printf(buf, "CPU[%04x]:   "
900                                "QW   NSR CPPR IPB LSMFB ACK# INC AGE PIPR"
901                                "  W2\n", cpu_index);
902     } else {
903         g_string_append_printf(buf, "CPU[%04x]:   "
904                                "QW   NSR CPPR IPB LSMFB   -  LGS  T  PIPR"
905                                "  W2\n", cpu_index);
906     }
907 
908     for (i = 0; i < XIVE_TM_RING_COUNT; i++) {
909         char *s = xive_tctx_ring_print(&tctx->regs[i * XIVE_TM_RING_SIZE]);
910         g_string_append_printf(buf, "CPU[%04x]: %4s    %s\n",
911                                cpu_index, xive_tctx_ring_names[i], s);
912         g_free(s);
913     }
914 }
915 
916 void xive_tctx_reset(XiveTCTX *tctx)
917 {
918     memset(tctx->regs, 0, sizeof(tctx->regs));
919 
920     /* Set some defaults */
921     tctx->regs[TM_QW1_OS + TM_LSMFB] = 0xFF;
922     tctx->regs[TM_QW1_OS + TM_ACK_CNT] = 0xFF;
923     tctx->regs[TM_QW1_OS + TM_AGE] = 0xFF;
924     if (!(xive_presenter_get_config(tctx->xptr) &
925           XIVE_PRESENTER_GEN1_TIMA_OS)) {
926         tctx->regs[TM_QW1_OS + TM_OGEN] = 2;
927     }
928 
929     /*
930      * Initialize PIPR to 0xFF to avoid phantom interrupts when the
931      * CPPR is first set.
932      */
933     tctx->regs[TM_QW1_OS + TM_PIPR] =
934         xive_ipb_to_pipr(tctx->regs[TM_QW1_OS + TM_IPB]);
935     tctx->regs[TM_QW3_HV_PHYS + TM_PIPR] =
936         xive_ipb_to_pipr(tctx->regs[TM_QW3_HV_PHYS + TM_IPB]);
937 }
938 
939 static void xive_tctx_realize(DeviceState *dev, Error **errp)
940 {
941     XiveTCTX *tctx = XIVE_TCTX(dev);
942     PowerPCCPU *cpu;
943     CPUPPCState *env;
944 
945     assert(tctx->cs);
946     assert(tctx->xptr);
947 
948     cpu = POWERPC_CPU(tctx->cs);
949     env = &cpu->env;
950     switch (PPC_INPUT(env)) {
951     case PPC_FLAGS_INPUT_POWER9:
952         tctx->hv_output = qdev_get_gpio_in(DEVICE(cpu), POWER9_INPUT_HINT);
953         tctx->os_output = qdev_get_gpio_in(DEVICE(cpu), POWER9_INPUT_INT);
954         break;
955 
956     default:
957         error_setg(errp, "XIVE interrupt controller does not support "
958                    "this CPU bus model");
959         return;
960     }
961 
962     /* Connect the presenter to the VCPU (required for CPU hotplug) */
963     if (xive_in_kernel(tctx->xptr)) {
964         if (kvmppc_xive_cpu_connect(tctx, errp) < 0) {
965             return;
966         }
967     }
968 }
969 
970 static int vmstate_xive_tctx_pre_save(void *opaque)
971 {
972     XiveTCTX *tctx = XIVE_TCTX(opaque);
973     Error *local_err = NULL;
974     int ret;
975 
976     if (xive_in_kernel(tctx->xptr)) {
977         ret = kvmppc_xive_cpu_get_state(tctx, &local_err);
978         if (ret < 0) {
979             error_report_err(local_err);
980             return ret;
981         }
982     }
983 
984     return 0;
985 }
986 
987 static int vmstate_xive_tctx_post_load(void *opaque, int version_id)
988 {
989     XiveTCTX *tctx = XIVE_TCTX(opaque);
990     Error *local_err = NULL;
991     int ret;
992 
993     if (xive_in_kernel(tctx->xptr)) {
994         /*
995          * Required for hotplugged CPU, for which the state comes
996          * after all states of the machine.
997          */
998         ret = kvmppc_xive_cpu_set_state(tctx, &local_err);
999         if (ret < 0) {
1000             error_report_err(local_err);
1001             return ret;
1002         }
1003     }
1004 
1005     return 0;
1006 }
1007 
1008 static const VMStateDescription vmstate_xive_tctx = {
1009     .name = TYPE_XIVE_TCTX,
1010     .version_id = 1,
1011     .minimum_version_id = 1,
1012     .pre_save = vmstate_xive_tctx_pre_save,
1013     .post_load = vmstate_xive_tctx_post_load,
1014     .fields = (const VMStateField[]) {
1015         VMSTATE_BUFFER(regs, XiveTCTX),
1016         VMSTATE_END_OF_LIST()
1017     },
1018 };
1019 
1020 static const Property xive_tctx_properties[] = {
1021     DEFINE_PROP_LINK("cpu", XiveTCTX, cs, TYPE_CPU, CPUState *),
1022     DEFINE_PROP_LINK("presenter", XiveTCTX, xptr, TYPE_XIVE_PRESENTER,
1023                      XivePresenter *),
1024 };
1025 
1026 static void xive_tctx_class_init(ObjectClass *klass, const void *data)
1027 {
1028     DeviceClass *dc = DEVICE_CLASS(klass);
1029 
1030     dc->desc = "XIVE Interrupt Thread Context";
1031     dc->realize = xive_tctx_realize;
1032     dc->vmsd = &vmstate_xive_tctx;
1033     device_class_set_props(dc, xive_tctx_properties);
1034     /*
1035      * Reason: part of XIVE interrupt controller, needs to be wired up
1036      * by xive_tctx_create().
1037      */
1038     dc->user_creatable = false;
1039 }
1040 
1041 static const TypeInfo xive_tctx_info = {
1042     .name          = TYPE_XIVE_TCTX,
1043     .parent        = TYPE_DEVICE,
1044     .instance_size = sizeof(XiveTCTX),
1045     .class_init    = xive_tctx_class_init,
1046 };
1047 
1048 Object *xive_tctx_create(Object *cpu, XivePresenter *xptr, Error **errp)
1049 {
1050     Object *obj;
1051 
1052     obj = object_new(TYPE_XIVE_TCTX);
1053     object_property_add_child(cpu, TYPE_XIVE_TCTX, obj);
1054     object_unref(obj);
1055     object_property_set_link(obj, "cpu", cpu, &error_abort);
1056     object_property_set_link(obj, "presenter", OBJECT(xptr), &error_abort);
1057     if (!qdev_realize(DEVICE(obj), NULL, errp)) {
1058         object_unparent(obj);
1059         return NULL;
1060     }
1061     return obj;
1062 }
1063 
1064 void xive_tctx_destroy(XiveTCTX *tctx)
1065 {
1066     Object *obj = OBJECT(tctx);
1067 
1068     object_unparent(obj);
1069 }
1070 
1071 /*
1072  * XIVE ESB helpers
1073  */
1074 
1075 uint8_t xive_esb_set(uint8_t *pq, uint8_t value)
1076 {
1077     uint8_t old_pq = *pq & 0x3;
1078 
1079     *pq &= ~0x3;
1080     *pq |= value & 0x3;
1081 
1082     return old_pq;
1083 }
1084 
1085 bool xive_esb_trigger(uint8_t *pq)
1086 {
1087     uint8_t old_pq = *pq & 0x3;
1088 
1089     switch (old_pq) {
1090     case XIVE_ESB_RESET:
1091         xive_esb_set(pq, XIVE_ESB_PENDING);
1092         return true;
1093     case XIVE_ESB_PENDING:
1094     case XIVE_ESB_QUEUED:
1095         xive_esb_set(pq, XIVE_ESB_QUEUED);
1096         return false;
1097     case XIVE_ESB_OFF:
1098         xive_esb_set(pq, XIVE_ESB_OFF);
1099         return false;
1100     default:
1101          g_assert_not_reached();
1102     }
1103 }
1104 
1105 bool xive_esb_eoi(uint8_t *pq)
1106 {
1107     uint8_t old_pq = *pq & 0x3;
1108 
1109     switch (old_pq) {
1110     case XIVE_ESB_RESET:
1111     case XIVE_ESB_PENDING:
1112         xive_esb_set(pq, XIVE_ESB_RESET);
1113         return false;
1114     case XIVE_ESB_QUEUED:
1115         xive_esb_set(pq, XIVE_ESB_PENDING);
1116         return true;
1117     case XIVE_ESB_OFF:
1118         xive_esb_set(pq, XIVE_ESB_OFF);
1119         return false;
1120     default:
1121          g_assert_not_reached();
1122     }
1123 }
1124 
1125 /*
1126  * XIVE Interrupt Source (or IVSE)
1127  */
1128 
1129 uint8_t xive_source_esb_get(XiveSource *xsrc, uint32_t srcno)
1130 {
1131     assert(srcno < xsrc->nr_irqs);
1132 
1133     return xsrc->status[srcno] & 0x3;
1134 }
1135 
1136 uint8_t xive_source_esb_set(XiveSource *xsrc, uint32_t srcno, uint8_t pq)
1137 {
1138     assert(srcno < xsrc->nr_irqs);
1139 
1140     return xive_esb_set(&xsrc->status[srcno], pq);
1141 }
1142 
1143 /*
1144  * Returns whether the event notification should be forwarded.
1145  */
1146 static bool xive_source_lsi_trigger(XiveSource *xsrc, uint32_t srcno)
1147 {
1148     uint8_t old_pq = xive_source_esb_get(xsrc, srcno);
1149 
1150     xive_source_set_asserted(xsrc, srcno, true);
1151 
1152     switch (old_pq) {
1153     case XIVE_ESB_RESET:
1154         xive_source_esb_set(xsrc, srcno, XIVE_ESB_PENDING);
1155         return true;
1156     default:
1157         return false;
1158     }
1159 }
1160 
1161 /*
1162  * Sources can be configured with PQ offloading in which case the check
1163  * on the PQ state bits of MSIs is disabled
1164  */
1165 static bool xive_source_esb_disabled(XiveSource *xsrc, uint32_t srcno)
1166 {
1167     return (xsrc->esb_flags & XIVE_SRC_PQ_DISABLE) &&
1168         !xive_source_irq_is_lsi(xsrc, srcno);
1169 }
1170 
1171 /*
1172  * Returns whether the event notification should be forwarded.
1173  */
1174 static bool xive_source_esb_trigger(XiveSource *xsrc, uint32_t srcno)
1175 {
1176     bool ret;
1177 
1178     assert(srcno < xsrc->nr_irqs);
1179 
1180     if (xive_source_esb_disabled(xsrc, srcno)) {
1181         return true;
1182     }
1183 
1184     ret = xive_esb_trigger(&xsrc->status[srcno]);
1185 
1186     if (xive_source_irq_is_lsi(xsrc, srcno) &&
1187         xive_source_esb_get(xsrc, srcno) == XIVE_ESB_QUEUED) {
1188         qemu_log_mask(LOG_GUEST_ERROR,
1189                       "XIVE: queued an event on LSI IRQ %d\n", srcno);
1190     }
1191 
1192     return ret;
1193 }
1194 
1195 /*
1196  * Returns whether the event notification should be forwarded.
1197  */
1198 static bool xive_source_esb_eoi(XiveSource *xsrc, uint32_t srcno)
1199 {
1200     bool ret;
1201 
1202     assert(srcno < xsrc->nr_irqs);
1203 
1204     if (xive_source_esb_disabled(xsrc, srcno)) {
1205         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid EOI for IRQ %d\n", srcno);
1206         return false;
1207     }
1208 
1209     ret = xive_esb_eoi(&xsrc->status[srcno]);
1210 
1211     /*
1212      * LSI sources do not set the Q bit but they can still be
1213      * asserted, in which case we should forward a new event
1214      * notification
1215      */
1216     if (xive_source_irq_is_lsi(xsrc, srcno) &&
1217         xive_source_is_asserted(xsrc, srcno)) {
1218         ret = xive_source_lsi_trigger(xsrc, srcno);
1219     }
1220 
1221     return ret;
1222 }
1223 
1224 /*
1225  * Forward the source event notification to the Router
1226  */
1227 static void xive_source_notify(XiveSource *xsrc, int srcno)
1228 {
1229     XiveNotifierClass *xnc = XIVE_NOTIFIER_GET_CLASS(xsrc->xive);
1230     bool pq_checked = !xive_source_esb_disabled(xsrc, srcno);
1231 
1232     if (xnc->notify) {
1233         xnc->notify(xsrc->xive, srcno, pq_checked);
1234     }
1235 }
1236 
1237 /*
1238  * In a two pages ESB MMIO setting, even page is the trigger page, odd
1239  * page is for management
1240  */
1241 static inline bool addr_is_even(hwaddr addr, uint32_t shift)
1242 {
1243     return !((addr >> shift) & 1);
1244 }
1245 
1246 static inline bool xive_source_is_trigger_page(XiveSource *xsrc, hwaddr addr)
1247 {
1248     return xive_source_esb_has_2page(xsrc) &&
1249         addr_is_even(addr, xsrc->esb_shift - 1);
1250 }
1251 
1252 /*
1253  * ESB MMIO loads
1254  *                      Trigger page    Management/EOI page
1255  *
1256  * ESB MMIO setting     2 pages         1 or 2 pages
1257  *
1258  * 0x000 .. 0x3FF       -1              EOI and return 0|1
1259  * 0x400 .. 0x7FF       -1              EOI and return 0|1
1260  * 0x800 .. 0xBFF       -1              return PQ
1261  * 0xC00 .. 0xCFF       -1              return PQ and atomically PQ=00
1262  * 0xD00 .. 0xDFF       -1              return PQ and atomically PQ=01
1263  * 0xE00 .. 0xDFF       -1              return PQ and atomically PQ=10
1264  * 0xF00 .. 0xDFF       -1              return PQ and atomically PQ=11
1265  */
1266 static uint64_t xive_source_esb_read(void *opaque, hwaddr addr, unsigned size)
1267 {
1268     XiveSource *xsrc = XIVE_SOURCE(opaque);
1269     uint32_t offset = addr & 0xFFF;
1270     uint32_t srcno = addr >> xsrc->esb_shift;
1271     uint64_t ret = -1;
1272 
1273     /* In a two pages ESB MMIO setting, trigger page should not be read */
1274     if (xive_source_is_trigger_page(xsrc, addr)) {
1275         qemu_log_mask(LOG_GUEST_ERROR,
1276                       "XIVE: invalid load on IRQ %d trigger page at "
1277                       "0x%"HWADDR_PRIx"\n", srcno, addr);
1278         return -1;
1279     }
1280 
1281     switch (offset) {
1282     case XIVE_ESB_LOAD_EOI ... XIVE_ESB_LOAD_EOI + 0x7FF:
1283         ret = xive_source_esb_eoi(xsrc, srcno);
1284 
1285         /* Forward the source event notification for routing */
1286         if (ret) {
1287             trace_xive_source_notify(srcno);
1288             xive_source_notify(xsrc, srcno);
1289         }
1290         break;
1291 
1292     case XIVE_ESB_GET ... XIVE_ESB_GET + 0x3FF:
1293         ret = xive_source_esb_get(xsrc, srcno);
1294         break;
1295 
1296     case XIVE_ESB_SET_PQ_00 ... XIVE_ESB_SET_PQ_00 + 0x0FF:
1297     case XIVE_ESB_SET_PQ_01 ... XIVE_ESB_SET_PQ_01 + 0x0FF:
1298     case XIVE_ESB_SET_PQ_10 ... XIVE_ESB_SET_PQ_10 + 0x0FF:
1299     case XIVE_ESB_SET_PQ_11 ... XIVE_ESB_SET_PQ_11 + 0x0FF:
1300         ret = xive_source_esb_set(xsrc, srcno, (offset >> 8) & 0x3);
1301         break;
1302     default:
1303         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid ESB load addr %x\n",
1304                       offset);
1305     }
1306 
1307     trace_xive_source_esb_read(addr, srcno, ret);
1308 
1309     return ret;
1310 }
1311 
1312 /*
1313  * ESB MMIO stores
1314  *                      Trigger page    Management/EOI page
1315  *
1316  * ESB MMIO setting     2 pages         1 or 2 pages
1317  *
1318  * 0x000 .. 0x3FF       Trigger         Trigger
1319  * 0x400 .. 0x7FF       Trigger         EOI
1320  * 0x800 .. 0xBFF       Trigger         undefined
1321  * 0xC00 .. 0xCFF       Trigger         PQ=00
1322  * 0xD00 .. 0xDFF       Trigger         PQ=01
1323  * 0xE00 .. 0xDFF       Trigger         PQ=10
1324  * 0xF00 .. 0xDFF       Trigger         PQ=11
1325  */
1326 static void xive_source_esb_write(void *opaque, hwaddr addr,
1327                                   uint64_t value, unsigned size)
1328 {
1329     XiveSource *xsrc = XIVE_SOURCE(opaque);
1330     uint32_t offset = addr & 0xFFF;
1331     uint32_t srcno = addr >> xsrc->esb_shift;
1332     bool notify = false;
1333 
1334     trace_xive_source_esb_write(addr, srcno, value);
1335 
1336     /* In a two pages ESB MMIO setting, trigger page only triggers */
1337     if (xive_source_is_trigger_page(xsrc, addr)) {
1338         notify = xive_source_esb_trigger(xsrc, srcno);
1339         goto out;
1340     }
1341 
1342     switch (offset) {
1343     case 0 ... 0x3FF:
1344         notify = xive_source_esb_trigger(xsrc, srcno);
1345         break;
1346 
1347     case XIVE_ESB_STORE_EOI ... XIVE_ESB_STORE_EOI + 0x3FF:
1348         if (!(xsrc->esb_flags & XIVE_SRC_STORE_EOI)) {
1349             qemu_log_mask(LOG_GUEST_ERROR,
1350                           "XIVE: invalid Store EOI for IRQ %d\n", srcno);
1351             return;
1352         }
1353 
1354         notify = xive_source_esb_eoi(xsrc, srcno);
1355         break;
1356 
1357     /*
1358      * This is an internal offset used to inject triggers when the PQ
1359      * state bits are not controlled locally. Such as for LSIs when
1360      * under ABT mode.
1361      */
1362     case XIVE_ESB_INJECT ... XIVE_ESB_INJECT + 0x3FF:
1363         notify = true;
1364         break;
1365 
1366     case XIVE_ESB_SET_PQ_00 ... XIVE_ESB_SET_PQ_00 + 0x0FF:
1367     case XIVE_ESB_SET_PQ_01 ... XIVE_ESB_SET_PQ_01 + 0x0FF:
1368     case XIVE_ESB_SET_PQ_10 ... XIVE_ESB_SET_PQ_10 + 0x0FF:
1369     case XIVE_ESB_SET_PQ_11 ... XIVE_ESB_SET_PQ_11 + 0x0FF:
1370         xive_source_esb_set(xsrc, srcno, (offset >> 8) & 0x3);
1371         break;
1372 
1373     default:
1374         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid ESB write addr %x\n",
1375                       offset);
1376         return;
1377     }
1378 
1379 out:
1380     /* Forward the source event notification for routing */
1381     if (notify) {
1382         xive_source_notify(xsrc, srcno);
1383     } else {
1384         trace_xive_source_blocked(srcno);
1385     }
1386 }
1387 
1388 static const MemoryRegionOps xive_source_esb_ops = {
1389     .read = xive_source_esb_read,
1390     .write = xive_source_esb_write,
1391     .endianness = DEVICE_BIG_ENDIAN,
1392     .valid = {
1393         .min_access_size = 1,
1394         .max_access_size = 8,
1395     },
1396     .impl = {
1397         .min_access_size = 1,
1398         .max_access_size = 8,
1399     },
1400 };
1401 
1402 void xive_source_set_irq(void *opaque, int srcno, int val)
1403 {
1404     XiveSource *xsrc = XIVE_SOURCE(opaque);
1405     bool notify = false;
1406 
1407     if (xive_source_irq_is_lsi(xsrc, srcno)) {
1408         if (val) {
1409             notify = xive_source_lsi_trigger(xsrc, srcno);
1410         } else {
1411             xive_source_set_asserted(xsrc, srcno, false);
1412         }
1413     } else {
1414         if (val) {
1415             notify = xive_source_esb_trigger(xsrc, srcno);
1416         }
1417     }
1418 
1419     /* Forward the source event notification for routing */
1420     if (notify) {
1421         xive_source_notify(xsrc, srcno);
1422     }
1423 }
1424 
1425 void xive_source_pic_print_info(XiveSource *xsrc, uint32_t offset, GString *buf)
1426 {
1427     for (unsigned i = 0; i < xsrc->nr_irqs; i++) {
1428         uint8_t pq = xive_source_esb_get(xsrc, i);
1429 
1430         if (pq == XIVE_ESB_OFF) {
1431             continue;
1432         }
1433 
1434         g_string_append_printf(buf, "  %08x %s %c%c%c\n", i + offset,
1435                                xive_source_irq_is_lsi(xsrc, i) ? "LSI" : "MSI",
1436                                pq & XIVE_ESB_VAL_P ? 'P' : '-',
1437                                pq & XIVE_ESB_VAL_Q ? 'Q' : '-',
1438                                xive_source_is_asserted(xsrc, i) ? 'A' : ' ');
1439     }
1440 }
1441 
1442 static void xive_source_reset(void *dev)
1443 {
1444     XiveSource *xsrc = XIVE_SOURCE(dev);
1445 
1446     /* Do not clear the LSI bitmap */
1447 
1448     memset(xsrc->status, xsrc->reset_pq, xsrc->nr_irqs);
1449 }
1450 
1451 static void xive_source_realize(DeviceState *dev, Error **errp)
1452 {
1453     XiveSource *xsrc = XIVE_SOURCE(dev);
1454     uint64_t esb_len = xive_source_esb_len(xsrc);
1455 
1456     assert(xsrc->xive);
1457 
1458     if (!xsrc->nr_irqs) {
1459         error_setg(errp, "Number of interrupt needs to be greater than 0");
1460         return;
1461     }
1462 
1463     if (xsrc->esb_shift != XIVE_ESB_4K &&
1464         xsrc->esb_shift != XIVE_ESB_4K_2PAGE &&
1465         xsrc->esb_shift != XIVE_ESB_64K &&
1466         xsrc->esb_shift != XIVE_ESB_64K_2PAGE) {
1467         error_setg(errp, "Invalid ESB shift setting");
1468         return;
1469     }
1470 
1471     xsrc->status = g_malloc0(xsrc->nr_irqs);
1472     xsrc->lsi_map = bitmap_new(xsrc->nr_irqs);
1473 
1474     memory_region_init(&xsrc->esb_mmio, OBJECT(xsrc), "xive.esb", esb_len);
1475     memory_region_init_io(&xsrc->esb_mmio_emulated, OBJECT(xsrc),
1476                           &xive_source_esb_ops, xsrc, "xive.esb-emulated",
1477                           esb_len);
1478     memory_region_add_subregion(&xsrc->esb_mmio, 0, &xsrc->esb_mmio_emulated);
1479 
1480     qemu_register_reset(xive_source_reset, dev);
1481 }
1482 
1483 static const VMStateDescription vmstate_xive_source = {
1484     .name = TYPE_XIVE_SOURCE,
1485     .version_id = 1,
1486     .minimum_version_id = 1,
1487     .fields = (const VMStateField[]) {
1488         VMSTATE_UINT32_EQUAL(nr_irqs, XiveSource, NULL),
1489         VMSTATE_VBUFFER_UINT32(status, XiveSource, 1, NULL, nr_irqs),
1490         VMSTATE_END_OF_LIST()
1491     },
1492 };
1493 
1494 /*
1495  * The default XIVE interrupt source setting for the ESB MMIOs is two
1496  * 64k pages without Store EOI, to be in sync with KVM.
1497  */
1498 static const Property xive_source_properties[] = {
1499     DEFINE_PROP_UINT64("flags", XiveSource, esb_flags, 0),
1500     DEFINE_PROP_UINT32("nr-irqs", XiveSource, nr_irqs, 0),
1501     DEFINE_PROP_UINT32("shift", XiveSource, esb_shift, XIVE_ESB_64K_2PAGE),
1502     /*
1503      * By default, PQs are initialized to 0b01 (Q=1) which corresponds
1504      * to "ints off"
1505      */
1506     DEFINE_PROP_UINT8("reset-pq", XiveSource, reset_pq, XIVE_ESB_OFF),
1507     DEFINE_PROP_LINK("xive", XiveSource, xive, TYPE_XIVE_NOTIFIER,
1508                      XiveNotifier *),
1509 };
1510 
1511 static void xive_source_class_init(ObjectClass *klass, const void *data)
1512 {
1513     DeviceClass *dc = DEVICE_CLASS(klass);
1514 
1515     dc->desc    = "XIVE Interrupt Source";
1516     device_class_set_props(dc, xive_source_properties);
1517     dc->realize = xive_source_realize;
1518     dc->vmsd    = &vmstate_xive_source;
1519     /*
1520      * Reason: part of XIVE interrupt controller, needs to be wired up,
1521      * e.g. by spapr_xive_instance_init().
1522      */
1523     dc->user_creatable = false;
1524 }
1525 
1526 static const TypeInfo xive_source_info = {
1527     .name          = TYPE_XIVE_SOURCE,
1528     .parent        = TYPE_DEVICE,
1529     .instance_size = sizeof(XiveSource),
1530     .class_init    = xive_source_class_init,
1531 };
1532 
1533 /*
1534  * XiveEND helpers
1535  */
1536 
1537 void xive_end_queue_pic_print_info(XiveEND *end, uint32_t width, GString *buf)
1538 {
1539     uint64_t qaddr_base = xive_end_qaddr(end);
1540     uint32_t qsize = xive_get_field32(END_W0_QSIZE, end->w0);
1541     uint32_t qindex = xive_get_field32(END_W1_PAGE_OFF, end->w1);
1542     uint32_t qentries = 1 << (qsize + 10);
1543     int i;
1544 
1545     /*
1546      * print out the [ (qindex - (width - 1)) .. (qindex + 1)] window
1547      */
1548     g_string_append_printf(buf, " [ ");
1549     qindex = (qindex - (width - 1)) & (qentries - 1);
1550     for (i = 0; i < width; i++) {
1551         uint64_t qaddr = qaddr_base + (qindex << 2);
1552         uint32_t qdata = -1;
1553 
1554         if (dma_memory_read(&address_space_memory, qaddr,
1555                             &qdata, sizeof(qdata), MEMTXATTRS_UNSPECIFIED)) {
1556             qemu_log_mask(LOG_GUEST_ERROR, "XIVE: failed to read EQ @0x%"
1557                           HWADDR_PRIx "\n", qaddr);
1558             return;
1559         }
1560         g_string_append_printf(buf, "%s%08x ", i == width - 1 ? "^" : "",
1561                                be32_to_cpu(qdata));
1562         qindex = (qindex + 1) & (qentries - 1);
1563     }
1564     g_string_append_c(buf, ']');
1565 }
1566 
1567 void xive_end_pic_print_info(XiveEND *end, uint32_t end_idx, GString *buf)
1568 {
1569     uint64_t qaddr_base = xive_end_qaddr(end);
1570     uint32_t qindex = xive_get_field32(END_W1_PAGE_OFF, end->w1);
1571     uint32_t qgen = xive_get_field32(END_W1_GENERATION, end->w1);
1572     uint32_t qsize = xive_get_field32(END_W0_QSIZE, end->w0);
1573     uint32_t qentries = 1 << (qsize + 10);
1574 
1575     uint32_t nvt_blk = xive_get_field32(END_W6_NVT_BLOCK, end->w6);
1576     uint32_t nvt_idx = xive_get_field32(END_W6_NVT_INDEX, end->w6);
1577     uint8_t priority = xive_get_field32(END_W7_F0_PRIORITY, end->w7);
1578     uint8_t pq;
1579 
1580     if (!xive_end_is_valid(end)) {
1581         return;
1582     }
1583 
1584     pq = xive_get_field32(END_W1_ESn, end->w1);
1585 
1586     g_string_append_printf(buf,
1587                            "  %08x %c%c %c%c%c%c%c%c%c%c prio:%d nvt:%02x/%04x",
1588                            end_idx,
1589                            pq & XIVE_ESB_VAL_P ? 'P' : '-',
1590                            pq & XIVE_ESB_VAL_Q ? 'Q' : '-',
1591                            xive_end_is_valid(end)    ? 'v' : '-',
1592                            xive_end_is_enqueue(end)  ? 'q' : '-',
1593                            xive_end_is_notify(end)   ? 'n' : '-',
1594                            xive_end_is_backlog(end)  ? 'b' : '-',
1595                            xive_end_is_escalate(end) ? 'e' : '-',
1596                            xive_end_is_uncond_escalation(end)   ? 'u' : '-',
1597                            xive_end_is_silent_escalation(end)   ? 's' : '-',
1598                            xive_end_is_firmware(end)   ? 'f' : '-',
1599                            priority, nvt_blk, nvt_idx);
1600 
1601     if (qaddr_base) {
1602         g_string_append_printf(buf, " eq:@%08"PRIx64"% 6d/%5d ^%d",
1603                                qaddr_base, qindex, qentries, qgen);
1604         xive_end_queue_pic_print_info(end, 6, buf);
1605     }
1606     g_string_append_c(buf, '\n');
1607 }
1608 
1609 static void xive_end_enqueue(XiveEND *end, uint32_t data)
1610 {
1611     uint64_t qaddr_base = xive_end_qaddr(end);
1612     uint32_t qsize = xive_get_field32(END_W0_QSIZE, end->w0);
1613     uint32_t qindex = xive_get_field32(END_W1_PAGE_OFF, end->w1);
1614     uint32_t qgen = xive_get_field32(END_W1_GENERATION, end->w1);
1615 
1616     uint64_t qaddr = qaddr_base + (qindex << 2);
1617     uint32_t qdata = cpu_to_be32((qgen << 31) | (data & 0x7fffffff));
1618     uint32_t qentries = 1 << (qsize + 10);
1619 
1620     if (dma_memory_write(&address_space_memory, qaddr,
1621                          &qdata, sizeof(qdata), MEMTXATTRS_UNSPECIFIED)) {
1622         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: failed to write END data @0x%"
1623                       HWADDR_PRIx "\n", qaddr);
1624         return;
1625     }
1626 
1627     qindex = (qindex + 1) & (qentries - 1);
1628     if (qindex == 0) {
1629         qgen ^= 1;
1630         end->w1 = xive_set_field32(END_W1_GENERATION, end->w1, qgen);
1631     }
1632     end->w1 = xive_set_field32(END_W1_PAGE_OFF, end->w1, qindex);
1633 }
1634 
1635 void xive_end_eas_pic_print_info(XiveEND *end, uint32_t end_idx, GString *buf)
1636 {
1637     XiveEAS *eas = (XiveEAS *) &end->w4;
1638     uint8_t pq;
1639 
1640     if (!xive_end_is_escalate(end)) {
1641         return;
1642     }
1643 
1644     pq = xive_get_field32(END_W1_ESe, end->w1);
1645 
1646     g_string_append_printf(buf, "  %08x %c%c %c%c end:%02x/%04x data:%08x\n",
1647                            end_idx,
1648                            pq & XIVE_ESB_VAL_P ? 'P' : '-',
1649                            pq & XIVE_ESB_VAL_Q ? 'Q' : '-',
1650                            xive_eas_is_valid(eas) ? 'V' : ' ',
1651                            xive_eas_is_masked(eas) ? 'M' : ' ',
1652                            (uint8_t)  xive_get_field64(EAS_END_BLOCK, eas->w),
1653                            (uint32_t) xive_get_field64(EAS_END_INDEX, eas->w),
1654                            (uint32_t) xive_get_field64(EAS_END_DATA, eas->w));
1655 }
1656 
1657 /*
1658  * XIVE Router (aka. Virtualization Controller or IVRE)
1659  */
1660 
1661 int xive_router_get_eas(XiveRouter *xrtr, uint8_t eas_blk, uint32_t eas_idx,
1662                         XiveEAS *eas)
1663 {
1664     XiveRouterClass *xrc = XIVE_ROUTER_GET_CLASS(xrtr);
1665 
1666     return xrc->get_eas(xrtr, eas_blk, eas_idx, eas);
1667 }
1668 
1669 static
1670 int xive_router_get_pq(XiveRouter *xrtr, uint8_t eas_blk, uint32_t eas_idx,
1671                        uint8_t *pq)
1672 {
1673     XiveRouterClass *xrc = XIVE_ROUTER_GET_CLASS(xrtr);
1674 
1675     return xrc->get_pq(xrtr, eas_blk, eas_idx, pq);
1676 }
1677 
1678 static
1679 int xive_router_set_pq(XiveRouter *xrtr, uint8_t eas_blk, uint32_t eas_idx,
1680                        uint8_t *pq)
1681 {
1682     XiveRouterClass *xrc = XIVE_ROUTER_GET_CLASS(xrtr);
1683 
1684     return xrc->set_pq(xrtr, eas_blk, eas_idx, pq);
1685 }
1686 
1687 int xive_router_get_end(XiveRouter *xrtr, uint8_t end_blk, uint32_t end_idx,
1688                         XiveEND *end)
1689 {
1690    XiveRouterClass *xrc = XIVE_ROUTER_GET_CLASS(xrtr);
1691 
1692    return xrc->get_end(xrtr, end_blk, end_idx, end);
1693 }
1694 
1695 int xive_router_write_end(XiveRouter *xrtr, uint8_t end_blk, uint32_t end_idx,
1696                           XiveEND *end, uint8_t word_number)
1697 {
1698    XiveRouterClass *xrc = XIVE_ROUTER_GET_CLASS(xrtr);
1699 
1700    return xrc->write_end(xrtr, end_blk, end_idx, end, word_number);
1701 }
1702 
1703 int xive_router_get_nvt(XiveRouter *xrtr, uint8_t nvt_blk, uint32_t nvt_idx,
1704                         XiveNVT *nvt)
1705 {
1706    XiveRouterClass *xrc = XIVE_ROUTER_GET_CLASS(xrtr);
1707 
1708    return xrc->get_nvt(xrtr, nvt_blk, nvt_idx, nvt);
1709 }
1710 
1711 int xive_router_write_nvt(XiveRouter *xrtr, uint8_t nvt_blk, uint32_t nvt_idx,
1712                         XiveNVT *nvt, uint8_t word_number)
1713 {
1714    XiveRouterClass *xrc = XIVE_ROUTER_GET_CLASS(xrtr);
1715 
1716    return xrc->write_nvt(xrtr, nvt_blk, nvt_idx, nvt, word_number);
1717 }
1718 
1719 static int xive_router_get_block_id(XiveRouter *xrtr)
1720 {
1721    XiveRouterClass *xrc = XIVE_ROUTER_GET_CLASS(xrtr);
1722 
1723    return xrc->get_block_id(xrtr);
1724 }
1725 
1726 static void xive_router_realize(DeviceState *dev, Error **errp)
1727 {
1728     XiveRouter *xrtr = XIVE_ROUTER(dev);
1729 
1730     assert(xrtr->xfb);
1731 }
1732 
1733 static void xive_router_end_notify_handler(XiveRouter *xrtr, XiveEAS *eas)
1734 {
1735     XiveRouterClass *xrc = XIVE_ROUTER_GET_CLASS(xrtr);
1736 
1737     return xrc->end_notify(xrtr, eas);
1738 }
1739 
1740 /*
1741  * Encode the HW CAM line in the block group mode format :
1742  *
1743  *   chip << 19 | 0000000 0 0001 thread (7Bit)
1744  */
1745 static uint32_t xive_tctx_hw_cam_line(XivePresenter *xptr, XiveTCTX *tctx)
1746 {
1747     CPUPPCState *env = &POWERPC_CPU(tctx->cs)->env;
1748     uint32_t pir = env->spr_cb[SPR_PIR].default_value;
1749     uint8_t blk = xive_router_get_block_id(XIVE_ROUTER(xptr));
1750 
1751     return xive_nvt_cam_line(blk, 1 << 7 | (pir & 0x7f));
1752 }
1753 
1754 uint32_t xive_get_vpgroup_size(uint32_t nvp_index)
1755 {
1756     /*
1757      * Group size is a power of 2. The position of the first 0
1758      * (starting with the least significant bits) in the NVP index
1759      * gives the size of the group.
1760      */
1761     int first_zero = cto32(nvp_index);
1762     if (first_zero >= 31) {
1763         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: Invalid group index 0x%08x",
1764                                        nvp_index);
1765         return 0;
1766     }
1767 
1768     return 1U << (first_zero + 1);
1769 }
1770 
1771 uint8_t xive_get_group_level(bool crowd, bool ignore,
1772                              uint32_t nvp_blk, uint32_t nvp_index)
1773 {
1774     int first_zero;
1775     uint8_t level;
1776 
1777     if (!ignore) {
1778         g_assert(!crowd);
1779         return 0;
1780     }
1781 
1782     first_zero = cto32(nvp_index);
1783     if (first_zero >= 31) {
1784         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: Invalid group index 0x%08x",
1785                                        nvp_index);
1786         return 0;
1787     }
1788 
1789     level = (first_zero + 1) & 0b1111;
1790     if (crowd) {
1791         uint32_t blk;
1792 
1793         /* crowd level is bit position of first 0 from the right in nvp_blk */
1794         first_zero = cto32(nvp_blk);
1795         if (first_zero >= 31) {
1796             qemu_log_mask(LOG_GUEST_ERROR, "XIVE: Invalid crowd block 0x%08x",
1797                                            nvp_blk);
1798             return 0;
1799         }
1800         blk = first_zero + 1;
1801 
1802         /*
1803          * Supported crowd sizes are 2^1, 2^2, and 2^4. 2^3 is not supported.
1804          * HW will encode level 4 as the value 3.  See xive2_pgofnext().
1805          */
1806         switch (blk) {
1807         case 1:
1808         case 2:
1809             break;
1810         case 4:
1811             blk = 3;
1812             break;
1813         default:
1814             g_assert_not_reached();
1815         }
1816 
1817         /* Crowd level bits reside in upper 2 bits of the 6 bit group level */
1818         level |= blk << 4;
1819     }
1820     return level;
1821 }
1822 
1823 /*
1824  * The thread context register words are in big-endian format.
1825  */
1826 int xive_presenter_tctx_match(XivePresenter *xptr, XiveTCTX *tctx,
1827                               uint8_t format,
1828                               uint8_t nvt_blk, uint32_t nvt_idx,
1829                               bool cam_ignore, uint32_t logic_serv)
1830 {
1831     uint32_t cam = xive_nvt_cam_line(nvt_blk, nvt_idx);
1832     uint32_t qw3w2 = xive_tctx_word2(&tctx->regs[TM_QW3_HV_PHYS]);
1833     uint32_t qw2w2 = xive_tctx_word2(&tctx->regs[TM_QW2_HV_POOL]);
1834     uint32_t qw1w2 = xive_tctx_word2(&tctx->regs[TM_QW1_OS]);
1835     uint32_t qw0w2 = xive_tctx_word2(&tctx->regs[TM_QW0_USER]);
1836 
1837     /*
1838      * TODO (PowerNV): ignore mode. The low order bits of the NVT
1839      * identifier are ignored in the "CAM" match.
1840      */
1841 
1842     if (format == 0) {
1843         if (cam_ignore == true) {
1844             /*
1845              * F=0 & i=1: Logical server notification (bits ignored at
1846              * the end of the NVT identifier)
1847              */
1848             qemu_log_mask(LOG_UNIMP, "XIVE: no support for LS NVT %x/%x\n",
1849                           nvt_blk, nvt_idx);
1850              return -1;
1851         }
1852 
1853         /* F=0 & i=0: Specific NVT notification */
1854 
1855         /* PHYS ring */
1856         if ((be32_to_cpu(qw3w2) & TM_QW3W2_VT) &&
1857             cam == xive_tctx_hw_cam_line(xptr, tctx)) {
1858             return TM_QW3_HV_PHYS;
1859         }
1860 
1861         /* HV POOL ring */
1862         if ((be32_to_cpu(qw2w2) & TM_QW2W2_VP) &&
1863             cam == xive_get_field32(TM_QW2W2_POOL_CAM, qw2w2)) {
1864             return TM_QW2_HV_POOL;
1865         }
1866 
1867         /* OS ring */
1868         if ((be32_to_cpu(qw1w2) & TM_QW1W2_VO) &&
1869             cam == xive_get_field32(TM_QW1W2_OS_CAM, qw1w2)) {
1870             return TM_QW1_OS;
1871         }
1872     } else {
1873         /* F=1 : User level Event-Based Branch (EBB) notification */
1874 
1875         /* USER ring */
1876         if  ((be32_to_cpu(qw1w2) & TM_QW1W2_VO) &&
1877              (cam == xive_get_field32(TM_QW1W2_OS_CAM, qw1w2)) &&
1878              (be32_to_cpu(qw0w2) & TM_QW0W2_VU) &&
1879              (logic_serv == xive_get_field32(TM_QW0W2_LOGIC_SERV, qw0w2))) {
1880             return TM_QW0_USER;
1881         }
1882     }
1883     return -1;
1884 }
1885 
1886 /*
1887  * This is our simple Xive Presenter Engine model. It is merged in the
1888  * Router as it does not require an extra object.
1889  */
1890 bool xive_presenter_match(XiveFabric *xfb, uint8_t format,
1891                            uint8_t nvt_blk, uint32_t nvt_idx,
1892                            bool crowd, bool cam_ignore, uint8_t priority,
1893                            uint32_t logic_serv, XiveTCTXMatch *match)
1894 {
1895     XiveFabricClass *xfc = XIVE_FABRIC_GET_CLASS(xfb);
1896 
1897     memset(match, 0, sizeof(*match));
1898 
1899     /*
1900      * Ask the machine to scan the interrupt controllers for a match.
1901      *
1902      * For VP-specific notification, we expect at most one match and
1903      * one call to the presenters is all we need (abbreviated notify
1904      * sequence documented by the architecture).
1905      *
1906      * For VP-group notification, match_nvt() is the equivalent of the
1907      * "histogram" and "poll" commands sent to the power bus to the
1908      * presenters. 'count' could be more than one, but we always
1909      * select the first match for now. 'precluded' tells if (at least)
1910      * one thread matches but can't take the interrupt now because
1911      * it's running at a more favored priority. We return the
1912      * information to the router so that it can take appropriate
1913      * actions (backlog, escalation, broadcast, etc...)
1914      *
1915      * If we were to implement a better way of dispatching the
1916      * interrupt in case of multiple matches (instead of the first
1917      * match), we would need a heuristic to elect a thread (for
1918      * example, the hardware keeps track of an 'age' in the TIMA) and
1919      * a new command to the presenters (the equivalent of the "assign"
1920      * power bus command in the documented full notify sequence.
1921      */
1922     return xfc->match_nvt(xfb, format, nvt_blk, nvt_idx, crowd, cam_ignore,
1923                           priority, logic_serv, match);
1924 }
1925 
1926 /*
1927  * Notification using the END ESe/ESn bit (Event State Buffer for
1928  * escalation and notification). Provide further coalescing in the
1929  * Router.
1930  */
1931 static bool xive_router_end_es_notify(XiveRouter *xrtr, uint8_t end_blk,
1932                                       uint32_t end_idx, XiveEND *end,
1933                                       uint32_t end_esmask)
1934 {
1935     uint8_t pq = xive_get_field32(end_esmask, end->w1);
1936     bool notify = xive_esb_trigger(&pq);
1937 
1938     if (pq != xive_get_field32(end_esmask, end->w1)) {
1939         end->w1 = xive_set_field32(end_esmask, end->w1, pq);
1940         xive_router_write_end(xrtr, end_blk, end_idx, end, 1);
1941     }
1942 
1943     /* ESe/n[Q]=1 : end of notification */
1944     return notify;
1945 }
1946 
1947 /*
1948  * An END trigger can come from an event trigger (IPI or HW) or from
1949  * another chip. We don't model the PowerBus but the END trigger
1950  * message has the same parameters than in the function below.
1951  */
1952 void xive_router_end_notify(XiveRouter *xrtr, XiveEAS *eas)
1953 {
1954     XiveEND end;
1955     uint8_t priority;
1956     uint8_t format;
1957     uint8_t nvt_blk;
1958     uint32_t nvt_idx;
1959     XiveNVT nvt;
1960     XiveTCTXMatch match;
1961 
1962     uint8_t end_blk = xive_get_field64(EAS_END_BLOCK, eas->w);
1963     uint32_t end_idx = xive_get_field64(EAS_END_INDEX, eas->w);
1964     uint32_t end_data = xive_get_field64(EAS_END_DATA,  eas->w);
1965 
1966     /* END cache lookup */
1967     if (xive_router_get_end(xrtr, end_blk, end_idx, &end)) {
1968         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: No END %x/%x\n", end_blk,
1969                       end_idx);
1970         return;
1971     }
1972 
1973     if (!xive_end_is_valid(&end)) {
1974         trace_xive_router_end_notify(end_blk, end_idx, end_data);
1975         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: END %x/%x is invalid\n",
1976                       end_blk, end_idx);
1977         return;
1978     }
1979 
1980     if (xive_end_is_enqueue(&end)) {
1981         xive_end_enqueue(&end, end_data);
1982         /* Enqueuing event data modifies the EQ toggle and index */
1983         xive_router_write_end(xrtr, end_blk, end_idx, &end, 1);
1984     }
1985 
1986     /*
1987      * When the END is silent, we skip the notification part.
1988      */
1989     if (xive_end_is_silent_escalation(&end)) {
1990         goto do_escalation;
1991     }
1992 
1993     /*
1994      * The W7 format depends on the F bit in W6. It defines the type
1995      * of the notification :
1996      *
1997      *   F=0 : single or multiple NVT notification
1998      *   F=1 : User level Event-Based Branch (EBB) notification, no
1999      *         priority
2000      */
2001     format = xive_get_field32(END_W6_FORMAT_BIT, end.w6);
2002     priority = xive_get_field32(END_W7_F0_PRIORITY, end.w7);
2003 
2004     /* The END is masked */
2005     if (format == 0 && priority == 0xff) {
2006         return;
2007     }
2008 
2009     /*
2010      * Check the END ESn (Event State Buffer for notification) for
2011      * even further coalescing in the Router
2012      */
2013     if (!xive_end_is_notify(&end)) {
2014         /* ESn[Q]=1 : end of notification */
2015         if (!xive_router_end_es_notify(xrtr, end_blk, end_idx,
2016                                        &end, END_W1_ESn)) {
2017             return;
2018         }
2019     }
2020 
2021     /*
2022      * Follows IVPE notification
2023      */
2024     nvt_blk = xive_get_field32(END_W6_NVT_BLOCK, end.w6);
2025     nvt_idx = xive_get_field32(END_W6_NVT_INDEX, end.w6);
2026 
2027     /* NVT cache lookup */
2028     if (xive_router_get_nvt(xrtr, nvt_blk, nvt_idx, &nvt)) {
2029         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: no NVT %x/%x\n",
2030                       nvt_blk, nvt_idx);
2031         return;
2032     }
2033 
2034     if (!xive_nvt_is_valid(&nvt)) {
2035         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: NVT %x/%x is invalid\n",
2036                       nvt_blk, nvt_idx);
2037         return;
2038     }
2039 
2040     /* TODO: Auto EOI. */
2041     /* we don't support VP-group notification on P9, so precluded is not used */
2042     if (xive_presenter_match(xrtr->xfb, format, nvt_blk, nvt_idx,
2043                              false /* crowd */,
2044                              xive_get_field32(END_W7_F0_IGNORE, end.w7),
2045                              priority,
2046                              xive_get_field32(END_W7_F1_LOG_SERVER_ID, end.w7),
2047                              &match)) {
2048         trace_xive_presenter_notify(nvt_blk, nvt_idx, match.ring, 0);
2049         xive_tctx_pipr_present(match.tctx, match.ring, priority, 0);
2050         return;
2051     }
2052 
2053     /*
2054      * If no matching NVT is dispatched on a HW thread :
2055      * - specific VP: update the NVT structure if backlog is activated
2056      * - logical server : forward request to IVPE (not supported)
2057      */
2058     if (xive_end_is_backlog(&end)) {
2059         uint8_t ipb;
2060 
2061         if (format == 1) {
2062             qemu_log_mask(LOG_GUEST_ERROR,
2063                           "XIVE: END %x/%x invalid config: F1 & backlog\n",
2064                           end_blk, end_idx);
2065             return;
2066         }
2067         /*
2068          * Record the IPB in the associated NVT structure for later
2069          * use. The presenter will resend the interrupt when the vCPU
2070          * is dispatched again on a HW thread.
2071          */
2072         ipb = xive_get_field32(NVT_W4_IPB, nvt.w4) |
2073             xive_priority_to_ipb(priority);
2074         nvt.w4 = xive_set_field32(NVT_W4_IPB, nvt.w4, ipb);
2075         xive_router_write_nvt(xrtr, nvt_blk, nvt_idx, &nvt, 4);
2076 
2077         /*
2078          * On HW, follows a "Broadcast Backlog" to IVPEs
2079          */
2080     }
2081 
2082 do_escalation:
2083     /*
2084      * If activated, escalate notification using the ESe PQ bits and
2085      * the EAS in w4-5
2086      */
2087     if (!xive_end_is_escalate(&end)) {
2088         return;
2089     }
2090 
2091     /*
2092      * Check the END ESe (Event State Buffer for escalation) for even
2093      * further coalescing in the Router
2094      */
2095     if (!xive_end_is_uncond_escalation(&end)) {
2096         /* ESe[Q]=1 : end of notification */
2097         if (!xive_router_end_es_notify(xrtr, end_blk, end_idx,
2098                                        &end, END_W1_ESe)) {
2099             return;
2100         }
2101     }
2102 
2103     trace_xive_router_end_escalate(end_blk, end_idx,
2104            (uint8_t) xive_get_field32(END_W4_ESC_END_BLOCK, end.w4),
2105            (uint32_t) xive_get_field32(END_W4_ESC_END_INDEX, end.w4),
2106            (uint32_t) xive_get_field32(END_W5_ESC_END_DATA,  end.w5));
2107     /*
2108      * The END trigger becomes an Escalation trigger
2109      */
2110     xive_router_end_notify_handler(xrtr, (XiveEAS *) &end.w4);
2111 }
2112 
2113 void xive_router_notify(XiveNotifier *xn, uint32_t lisn, bool pq_checked)
2114 {
2115     XiveRouter *xrtr = XIVE_ROUTER(xn);
2116     uint8_t eas_blk = XIVE_EAS_BLOCK(lisn);
2117     uint32_t eas_idx = XIVE_EAS_INDEX(lisn);
2118     XiveEAS eas;
2119 
2120     /* EAS cache lookup */
2121     if (xive_router_get_eas(xrtr, eas_blk, eas_idx, &eas)) {
2122         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: Unknown LISN %x\n", lisn);
2123         return;
2124     }
2125 
2126     if (!pq_checked) {
2127         bool notify;
2128         uint8_t pq;
2129 
2130         /* PQ cache lookup */
2131         if (xive_router_get_pq(xrtr, eas_blk, eas_idx, &pq)) {
2132             /* Set FIR */
2133             g_assert_not_reached();
2134         }
2135 
2136         notify = xive_esb_trigger(&pq);
2137 
2138         if (xive_router_set_pq(xrtr, eas_blk, eas_idx, &pq)) {
2139             /* Set FIR */
2140             g_assert_not_reached();
2141         }
2142 
2143         if (!notify) {
2144             return;
2145         }
2146     }
2147 
2148     if (!xive_eas_is_valid(&eas)) {
2149         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid LISN %x\n", lisn);
2150         return;
2151     }
2152 
2153     if (xive_eas_is_masked(&eas)) {
2154         /* Notification completed */
2155         return;
2156     }
2157 
2158     /*
2159      * The event trigger becomes an END trigger
2160      */
2161     xive_router_end_notify_handler(xrtr, &eas);
2162 }
2163 
2164 static const Property xive_router_properties[] = {
2165     DEFINE_PROP_LINK("xive-fabric", XiveRouter, xfb,
2166                      TYPE_XIVE_FABRIC, XiveFabric *),
2167 };
2168 
2169 static void xive_router_class_init(ObjectClass *klass, const void *data)
2170 {
2171     DeviceClass *dc = DEVICE_CLASS(klass);
2172     XiveNotifierClass *xnc = XIVE_NOTIFIER_CLASS(klass);
2173     XiveRouterClass *xrc = XIVE_ROUTER_CLASS(klass);
2174 
2175     dc->desc    = "XIVE Router Engine";
2176     device_class_set_props(dc, xive_router_properties);
2177     /* Parent is SysBusDeviceClass. No need to call its realize hook */
2178     dc->realize = xive_router_realize;
2179     xnc->notify = xive_router_notify;
2180 
2181     /* By default, the router handles END triggers locally */
2182     xrc->end_notify = xive_router_end_notify;
2183 }
2184 
2185 static const TypeInfo xive_router_info = {
2186     .name          = TYPE_XIVE_ROUTER,
2187     .parent        = TYPE_SYS_BUS_DEVICE,
2188     .abstract      = true,
2189     .instance_size = sizeof(XiveRouter),
2190     .class_size    = sizeof(XiveRouterClass),
2191     .class_init    = xive_router_class_init,
2192     .interfaces    = (const InterfaceInfo[]) {
2193         { TYPE_XIVE_NOTIFIER },
2194         { TYPE_XIVE_PRESENTER },
2195         { }
2196     }
2197 };
2198 
2199 void xive_eas_pic_print_info(XiveEAS *eas, uint32_t lisn, GString *buf)
2200 {
2201     if (!xive_eas_is_valid(eas)) {
2202         return;
2203     }
2204 
2205     g_string_append_printf(buf, "  %08x %s end:%02x/%04x data:%08x\n",
2206                            lisn, xive_eas_is_masked(eas) ? "M" : " ",
2207                            (uint8_t)  xive_get_field64(EAS_END_BLOCK, eas->w),
2208                            (uint32_t) xive_get_field64(EAS_END_INDEX, eas->w),
2209                            (uint32_t) xive_get_field64(EAS_END_DATA, eas->w));
2210 }
2211 
2212 /*
2213  * END ESB MMIO loads
2214  */
2215 static uint64_t xive_end_source_read(void *opaque, hwaddr addr, unsigned size)
2216 {
2217     XiveENDSource *xsrc = XIVE_END_SOURCE(opaque);
2218     uint32_t offset = addr & 0xFFF;
2219     uint8_t end_blk;
2220     uint32_t end_idx;
2221     XiveEND end;
2222     uint32_t end_esmask;
2223     uint8_t pq;
2224     uint64_t ret = -1;
2225 
2226     /*
2227      * The block id should be deduced from the load address on the END
2228      * ESB MMIO but our model only supports a single block per XIVE chip.
2229      */
2230     end_blk = xive_router_get_block_id(xsrc->xrtr);
2231     end_idx = addr >> (xsrc->esb_shift + 1);
2232 
2233     trace_xive_end_source_read(end_blk, end_idx, addr);
2234 
2235     if (xive_router_get_end(xsrc->xrtr, end_blk, end_idx, &end)) {
2236         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: No END %x/%x\n", end_blk,
2237                       end_idx);
2238         return -1;
2239     }
2240 
2241     if (!xive_end_is_valid(&end)) {
2242         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: END %x/%x is invalid\n",
2243                       end_blk, end_idx);
2244         return -1;
2245     }
2246 
2247     end_esmask = addr_is_even(addr, xsrc->esb_shift) ? END_W1_ESn : END_W1_ESe;
2248     pq = xive_get_field32(end_esmask, end.w1);
2249 
2250     switch (offset) {
2251     case XIVE_ESB_LOAD_EOI ... XIVE_ESB_LOAD_EOI + 0x7FF:
2252         ret = xive_esb_eoi(&pq);
2253 
2254         /* Forward the source event notification for routing ?? */
2255         break;
2256 
2257     case XIVE_ESB_GET ... XIVE_ESB_GET + 0x3FF:
2258         ret = pq;
2259         break;
2260 
2261     case XIVE_ESB_SET_PQ_00 ... XIVE_ESB_SET_PQ_00 + 0x0FF:
2262     case XIVE_ESB_SET_PQ_01 ... XIVE_ESB_SET_PQ_01 + 0x0FF:
2263     case XIVE_ESB_SET_PQ_10 ... XIVE_ESB_SET_PQ_10 + 0x0FF:
2264     case XIVE_ESB_SET_PQ_11 ... XIVE_ESB_SET_PQ_11 + 0x0FF:
2265         ret = xive_esb_set(&pq, (offset >> 8) & 0x3);
2266         break;
2267     default:
2268         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid END ESB load addr %d\n",
2269                       offset);
2270         return -1;
2271     }
2272 
2273     if (pq != xive_get_field32(end_esmask, end.w1)) {
2274         end.w1 = xive_set_field32(end_esmask, end.w1, pq);
2275         xive_router_write_end(xsrc->xrtr, end_blk, end_idx, &end, 1);
2276     }
2277 
2278     return ret;
2279 }
2280 
2281 /*
2282  * END ESB MMIO stores are invalid
2283  */
2284 static void xive_end_source_write(void *opaque, hwaddr addr,
2285                                   uint64_t value, unsigned size)
2286 {
2287     qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid ESB write addr 0x%"
2288                   HWADDR_PRIx"\n", addr);
2289 }
2290 
2291 static const MemoryRegionOps xive_end_source_ops = {
2292     .read = xive_end_source_read,
2293     .write = xive_end_source_write,
2294     .endianness = DEVICE_BIG_ENDIAN,
2295     .valid = {
2296         .min_access_size = 1,
2297         .max_access_size = 8,
2298     },
2299     .impl = {
2300         .min_access_size = 1,
2301         .max_access_size = 8,
2302     },
2303 };
2304 
2305 static void xive_end_source_realize(DeviceState *dev, Error **errp)
2306 {
2307     XiveENDSource *xsrc = XIVE_END_SOURCE(dev);
2308 
2309     assert(xsrc->xrtr);
2310 
2311     if (!xsrc->nr_ends) {
2312         error_setg(errp, "Number of interrupt needs to be greater than 0");
2313         return;
2314     }
2315 
2316     if (xsrc->esb_shift != XIVE_ESB_4K &&
2317         xsrc->esb_shift != XIVE_ESB_64K) {
2318         error_setg(errp, "Invalid ESB shift setting");
2319         return;
2320     }
2321 
2322     /*
2323      * Each END is assigned an even/odd pair of MMIO pages, the even page
2324      * manages the ESn field while the odd page manages the ESe field.
2325      */
2326     memory_region_init_io(&xsrc->esb_mmio, OBJECT(xsrc),
2327                           &xive_end_source_ops, xsrc, "xive.end",
2328                           (1ull << (xsrc->esb_shift + 1)) * xsrc->nr_ends);
2329 }
2330 
2331 static const Property xive_end_source_properties[] = {
2332     DEFINE_PROP_UINT32("nr-ends", XiveENDSource, nr_ends, 0),
2333     DEFINE_PROP_UINT32("shift", XiveENDSource, esb_shift, XIVE_ESB_64K),
2334     DEFINE_PROP_LINK("xive", XiveENDSource, xrtr, TYPE_XIVE_ROUTER,
2335                      XiveRouter *),
2336 };
2337 
2338 static void xive_end_source_class_init(ObjectClass *klass, const void *data)
2339 {
2340     DeviceClass *dc = DEVICE_CLASS(klass);
2341 
2342     dc->desc    = "XIVE END Source";
2343     device_class_set_props(dc, xive_end_source_properties);
2344     dc->realize = xive_end_source_realize;
2345     /*
2346      * Reason: part of XIVE interrupt controller, needs to be wired up,
2347      * e.g. by spapr_xive_instance_init().
2348      */
2349     dc->user_creatable = false;
2350 }
2351 
2352 static const TypeInfo xive_end_source_info = {
2353     .name          = TYPE_XIVE_END_SOURCE,
2354     .parent        = TYPE_DEVICE,
2355     .instance_size = sizeof(XiveENDSource),
2356     .class_init    = xive_end_source_class_init,
2357 };
2358 
2359 /*
2360  * XIVE Notifier
2361  */
2362 static const TypeInfo xive_notifier_info = {
2363     .name = TYPE_XIVE_NOTIFIER,
2364     .parent = TYPE_INTERFACE,
2365     .class_size = sizeof(XiveNotifierClass),
2366 };
2367 
2368 /*
2369  * XIVE Presenter
2370  */
2371 static const TypeInfo xive_presenter_info = {
2372     .name = TYPE_XIVE_PRESENTER,
2373     .parent = TYPE_INTERFACE,
2374     .class_size = sizeof(XivePresenterClass),
2375 };
2376 
2377 /*
2378  * XIVE Fabric
2379  */
2380 static const TypeInfo xive_fabric_info = {
2381     .name = TYPE_XIVE_FABRIC,
2382     .parent = TYPE_INTERFACE,
2383     .class_size = sizeof(XiveFabricClass),
2384 };
2385 
2386 static void xive_register_types(void)
2387 {
2388     type_register_static(&xive_fabric_info);
2389     type_register_static(&xive_source_info);
2390     type_register_static(&xive_notifier_info);
2391     type_register_static(&xive_presenter_info);
2392     type_register_static(&xive_router_info);
2393     type_register_static(&xive_end_source_info);
2394     type_register_static(&xive_tctx_info);
2395 }
2396 
2397 type_init(xive_register_types)
2398