xref: /openbmc/qemu/hw/intc/xive2.c (revision 96a2132ce95dab3e61002412839a118aecca0be0)
1 /*
2  * QEMU PowerPC XIVE2 interrupt controller model (POWER10)
3  *
4  * Copyright (c) 2019-2024, IBM Corporation..
5  *
6  * SPDX-License-Identifier: GPL-2.0-or-later
7  */
8 
9 #include "qemu/osdep.h"
10 #include "qemu/log.h"
11 #include "qemu/module.h"
12 #include "qapi/error.h"
13 #include "target/ppc/cpu.h"
14 #include "system/cpus.h"
15 #include "system/dma.h"
16 #include "hw/qdev-properties.h"
17 #include "hw/ppc/xive.h"
18 #include "hw/ppc/xive2.h"
19 #include "hw/ppc/xive2_regs.h"
20 #include "trace.h"
21 
22 uint32_t xive2_router_get_config(Xive2Router *xrtr)
23 {
24     Xive2RouterClass *xrc = XIVE2_ROUTER_GET_CLASS(xrtr);
25 
26     return xrc->get_config(xrtr);
27 }
28 
29 static int xive2_router_get_block_id(Xive2Router *xrtr)
30 {
31    Xive2RouterClass *xrc = XIVE2_ROUTER_GET_CLASS(xrtr);
32 
33    return xrc->get_block_id(xrtr);
34 }
35 
36 static uint64_t xive2_nvp_reporting_addr(Xive2Nvp *nvp)
37 {
38     uint64_t cache_addr;
39 
40     cache_addr = xive_get_field32(NVP2_W6_REPORTING_LINE, nvp->w6) << 24 |
41         xive_get_field32(NVP2_W7_REPORTING_LINE, nvp->w7);
42     cache_addr <<= 8; /* aligned on a cache line pair */
43     return cache_addr;
44 }
45 
46 static uint32_t xive2_nvgc_get_backlog(Xive2Nvgc *nvgc, uint8_t priority)
47 {
48     uint32_t val = 0;
49     uint8_t *ptr, i;
50 
51     if (priority > 7) {
52         return 0;
53     }
54 
55     /*
56      * The per-priority backlog counters are 24-bit and the structure
57      * is stored in big endian. NVGC is 32-bytes long, so 24-bytes from
58      * w2, which fits 8 priorities * 24-bits per priority.
59      */
60     ptr = (uint8_t *)&nvgc->w2 + priority * 3;
61     for (i = 0; i < 3; i++, ptr++) {
62         val = (val << 8) + *ptr;
63     }
64     return val;
65 }
66 
67 static void xive2_nvgc_set_backlog(Xive2Nvgc *nvgc, uint8_t priority,
68                                    uint32_t val)
69 {
70     uint8_t *ptr, i;
71     uint32_t shift;
72 
73     if (priority > 7) {
74         return;
75     }
76 
77     if (val > 0xFFFFFF) {
78         val = 0xFFFFFF;
79     }
80     /*
81      * The per-priority backlog counters are 24-bit and the structure
82      * is stored in big endian
83      */
84     ptr = (uint8_t *)&nvgc->w2 + priority * 3;
85     for (i = 0; i < 3; i++, ptr++) {
86         shift = 8 * (2 - i);
87         *ptr = (val >> shift) & 0xFF;
88     }
89 }
90 
91 uint64_t xive2_presenter_nvgc_backlog_op(XivePresenter *xptr,
92                                          bool crowd,
93                                          uint8_t blk, uint32_t idx,
94                                          uint16_t offset, uint16_t val)
95 {
96     Xive2Router *xrtr = XIVE2_ROUTER(xptr);
97     uint8_t priority = GETFIELD(NVx_BACKLOG_PRIO, offset);
98     uint8_t op = GETFIELD(NVx_BACKLOG_OP, offset);
99     Xive2Nvgc nvgc;
100     uint32_t count, old_count;
101 
102     if (xive2_router_get_nvgc(xrtr, crowd, blk, idx, &nvgc)) {
103         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: No %s %x/%x\n",
104                       crowd ? "NVC" : "NVG", blk, idx);
105         return -1;
106     }
107     if (!xive2_nvgc_is_valid(&nvgc)) {
108         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: Invalid NVG %x/%x\n", blk, idx);
109         return -1;
110     }
111 
112     old_count = xive2_nvgc_get_backlog(&nvgc, priority);
113     count = old_count;
114     /*
115      * op:
116      * 0b00 => increment
117      * 0b01 => decrement
118      * 0b1- => read
119      */
120     if (op == 0b00 || op == 0b01) {
121         if (op == 0b00) {
122             count += val;
123         } else {
124             if (count > val) {
125                 count -= val;
126             } else {
127                 count = 0;
128             }
129         }
130         xive2_nvgc_set_backlog(&nvgc, priority, count);
131         xive2_router_write_nvgc(xrtr, crowd, blk, idx, &nvgc);
132     }
133     trace_xive_nvgc_backlog_op(crowd, blk, idx, op, priority, old_count);
134     return old_count;
135 }
136 
137 uint64_t xive2_presenter_nvp_backlog_op(XivePresenter *xptr,
138                                         uint8_t blk, uint32_t idx,
139                                         uint16_t offset)
140 {
141     Xive2Router *xrtr = XIVE2_ROUTER(xptr);
142     uint8_t priority = GETFIELD(NVx_BACKLOG_PRIO, offset);
143     uint8_t op = GETFIELD(NVx_BACKLOG_OP, offset);
144     Xive2Nvp nvp;
145     uint8_t ipb, old_ipb, rc;
146 
147     if (xive2_router_get_nvp(xrtr, blk, idx, &nvp)) {
148         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: No NVP %x/%x\n", blk, idx);
149         return -1;
150     }
151     if (!xive2_nvp_is_valid(&nvp)) {
152         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: Invalid NVP %x/%x\n", blk, idx);
153         return -1;
154     }
155 
156     old_ipb = xive_get_field32(NVP2_W2_IPB, nvp.w2);
157     ipb = old_ipb;
158     /*
159      * op:
160      * 0b00 => set priority bit
161      * 0b01 => reset priority bit
162      * 0b1- => read
163      */
164     if (op == 0b00 || op == 0b01) {
165         if (op == 0b00) {
166             ipb |= xive_priority_to_ipb(priority);
167         } else {
168             ipb &= ~xive_priority_to_ipb(priority);
169         }
170         nvp.w2 = xive_set_field32(NVP2_W2_IPB, nvp.w2, ipb);
171         xive2_router_write_nvp(xrtr, blk, idx, &nvp, 2);
172     }
173     rc = !!(old_ipb & xive_priority_to_ipb(priority));
174     trace_xive_nvp_backlog_op(blk, idx, op, priority, rc);
175     return rc;
176 }
177 
178 void xive2_eas_pic_print_info(Xive2Eas *eas, uint32_t lisn, GString *buf)
179 {
180     if (!xive2_eas_is_valid(eas)) {
181         return;
182     }
183 
184     g_string_append_printf(buf, "  %08x %s end:%02x/%04x data:%08x\n",
185                            lisn, xive2_eas_is_masked(eas) ? "M" : " ",
186                            (uint8_t)  xive_get_field64(EAS2_END_BLOCK, eas->w),
187                            (uint32_t) xive_get_field64(EAS2_END_INDEX, eas->w),
188                            (uint32_t) xive_get_field64(EAS2_END_DATA, eas->w));
189 }
190 
191 void xive2_end_queue_pic_print_info(Xive2End *end, uint32_t width, GString *buf)
192 {
193     uint64_t qaddr_base = xive2_end_qaddr(end);
194     uint32_t qsize = xive_get_field32(END2_W3_QSIZE, end->w3);
195     uint32_t qindex = xive_get_field32(END2_W1_PAGE_OFF, end->w1);
196     uint32_t qentries = 1 << (qsize + 10);
197     int i;
198 
199     /*
200      * print out the [ (qindex - (width - 1)) .. (qindex + 1)] window
201      */
202     g_string_append_printf(buf, " [ ");
203     qindex = (qindex - (width - 1)) & (qentries - 1);
204     for (i = 0; i < width; i++) {
205         uint64_t qaddr = qaddr_base + (qindex << 2);
206         uint32_t qdata = -1;
207 
208         if (dma_memory_read(&address_space_memory, qaddr, &qdata,
209                             sizeof(qdata), MEMTXATTRS_UNSPECIFIED)) {
210             qemu_log_mask(LOG_GUEST_ERROR, "XIVE: failed to read EQ @0x%"
211                           HWADDR_PRIx "\n", qaddr);
212             return;
213         }
214         g_string_append_printf(buf, "%s%08x ", i == width - 1 ? "^" : "",
215                                be32_to_cpu(qdata));
216         qindex = (qindex + 1) & (qentries - 1);
217     }
218     g_string_append_printf(buf, "]");
219 }
220 
221 void xive2_end_pic_print_info(Xive2End *end, uint32_t end_idx, GString *buf)
222 {
223     uint64_t qaddr_base = xive2_end_qaddr(end);
224     uint32_t qindex = xive_get_field32(END2_W1_PAGE_OFF, end->w1);
225     uint32_t qgen = xive_get_field32(END2_W1_GENERATION, end->w1);
226     uint32_t qsize = xive_get_field32(END2_W3_QSIZE, end->w3);
227     uint32_t qentries = 1 << (qsize + 10);
228 
229     uint32_t nvp_blk = xive_get_field32(END2_W6_VP_BLOCK, end->w6);
230     uint32_t nvp_idx = xive_get_field32(END2_W6_VP_OFFSET, end->w6);
231     uint8_t priority = xive_get_field32(END2_W7_F0_PRIORITY, end->w7);
232     uint8_t pq;
233 
234     if (!xive2_end_is_valid(end)) {
235         return;
236     }
237 
238     pq = xive_get_field32(END2_W1_ESn, end->w1);
239 
240     g_string_append_printf(buf,
241                            "  %08x %c%c %c%c%c%c%c%c%c%c%c%c%c %c%c "
242                            "prio:%d nvp:%02x/%04x",
243                            end_idx,
244                            pq & XIVE_ESB_VAL_P ? 'P' : '-',
245                            pq & XIVE_ESB_VAL_Q ? 'Q' : '-',
246                            xive2_end_is_valid(end)    ? 'v' : '-',
247                            xive2_end_is_enqueue(end)  ? 'q' : '-',
248                            xive2_end_is_notify(end)   ? 'n' : '-',
249                            xive2_end_is_backlog(end)  ? 'b' : '-',
250                            xive2_end_is_precluded_escalation(end) ? 'p' : '-',
251                            xive2_end_is_escalate(end) ? 'e' : '-',
252                            xive2_end_is_escalate_end(end) ? 'N' : '-',
253                            xive2_end_is_uncond_escalation(end)   ? 'u' : '-',
254                            xive2_end_is_silent_escalation(end)   ? 's' : '-',
255                            xive2_end_is_firmware1(end)   ? 'f' : '-',
256                            xive2_end_is_firmware2(end)   ? 'F' : '-',
257                            xive2_end_is_ignore(end) ? 'i' : '-',
258                            xive2_end_is_crowd(end)  ? 'c' : '-',
259                            priority, nvp_blk, nvp_idx);
260 
261     if (qaddr_base) {
262         g_string_append_printf(buf, " eq:@%08"PRIx64"% 6d/%5d ^%d",
263                                qaddr_base, qindex, qentries, qgen);
264         xive2_end_queue_pic_print_info(end, 6, buf);
265     }
266     g_string_append_c(buf, '\n');
267 }
268 
269 void xive2_end_eas_pic_print_info(Xive2End *end, uint32_t end_idx,
270                                   GString *buf)
271 {
272     Xive2Eas *eas = (Xive2Eas *) &end->w4;
273     uint8_t pq;
274 
275     if (!xive2_end_is_escalate(end)) {
276         return;
277     }
278 
279     pq = xive_get_field32(END2_W1_ESe, end->w1);
280 
281     g_string_append_printf(buf, "  %08x %c%c %c%c end:%02x/%04x data:%08x\n",
282                            end_idx,
283                            pq & XIVE_ESB_VAL_P ? 'P' : '-',
284                            pq & XIVE_ESB_VAL_Q ? 'Q' : '-',
285                            xive2_eas_is_valid(eas) ? 'v' : ' ',
286                            xive2_eas_is_masked(eas) ? 'M' : ' ',
287                            (uint8_t)  xive_get_field64(EAS2_END_BLOCK, eas->w),
288                            (uint32_t) xive_get_field64(EAS2_END_INDEX, eas->w),
289                            (uint32_t) xive_get_field64(EAS2_END_DATA, eas->w));
290 }
291 
292 void xive2_nvp_pic_print_info(Xive2Nvp *nvp, uint32_t nvp_idx, GString *buf)
293 {
294     uint8_t  eq_blk = xive_get_field32(NVP2_W5_VP_END_BLOCK, nvp->w5);
295     uint32_t eq_idx = xive_get_field32(NVP2_W5_VP_END_INDEX, nvp->w5);
296     uint64_t cache_line = xive2_nvp_reporting_addr(nvp);
297 
298     if (!xive2_nvp_is_valid(nvp)) {
299         return;
300     }
301 
302     g_string_append_printf(buf, "  %08x end:%02x/%04x IPB:%02x PGoFirst:%02x",
303                            nvp_idx, eq_blk, eq_idx,
304                            xive_get_field32(NVP2_W2_IPB, nvp->w2),
305                            xive_get_field32(NVP2_W0_PGOFIRST, nvp->w0));
306     if (cache_line) {
307         g_string_append_printf(buf, "  reporting CL:%016"PRIx64, cache_line);
308     }
309 
310     /*
311      * When the NVP is HW controlled, more fields are updated
312      */
313     if (xive2_nvp_is_hw(nvp)) {
314         g_string_append_printf(buf, " CPPR:%02x",
315                                xive_get_field32(NVP2_W2_CPPR, nvp->w2));
316         if (xive2_nvp_is_co(nvp)) {
317             g_string_append_printf(buf, " CO:%04x",
318                                    xive_get_field32(NVP2_W1_CO_THRID, nvp->w1));
319         }
320     }
321     g_string_append_c(buf, '\n');
322 }
323 
324 void xive2_nvgc_pic_print_info(Xive2Nvgc *nvgc, uint32_t nvgc_idx, GString *buf)
325 {
326     uint8_t i;
327 
328     if (!xive2_nvgc_is_valid(nvgc)) {
329         return;
330     }
331 
332     g_string_append_printf(buf, "  %08x PGoNext:%02x bklog: ", nvgc_idx,
333                            xive_get_field32(NVGC2_W0_PGONEXT, nvgc->w0));
334     for (i = 0; i <= XIVE_PRIORITY_MAX; i++) {
335         g_string_append_printf(buf, "[%d]=0x%x ",
336                                i, xive2_nvgc_get_backlog(nvgc, i));
337     }
338     g_string_append_printf(buf, "\n");
339 }
340 
341 static void xive2_end_enqueue(Xive2End *end, uint32_t data)
342 {
343     uint64_t qaddr_base = xive2_end_qaddr(end);
344     uint32_t qsize = xive_get_field32(END2_W3_QSIZE, end->w3);
345     uint32_t qindex = xive_get_field32(END2_W1_PAGE_OFF, end->w1);
346     uint32_t qgen = xive_get_field32(END2_W1_GENERATION, end->w1);
347 
348     uint64_t qaddr = qaddr_base + (qindex << 2);
349     uint32_t qdata = cpu_to_be32((qgen << 31) | (data & 0x7fffffff));
350     uint32_t qentries = 1 << (qsize + 10);
351 
352     if (dma_memory_write(&address_space_memory, qaddr, &qdata, sizeof(qdata),
353                          MEMTXATTRS_UNSPECIFIED)) {
354         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: failed to write END data @0x%"
355                       HWADDR_PRIx "\n", qaddr);
356         return;
357     }
358 
359     qindex = (qindex + 1) & (qentries - 1);
360     if (qindex == 0) {
361         qgen ^= 1;
362         end->w1 = xive_set_field32(END2_W1_GENERATION, end->w1, qgen);
363 
364         /* TODO(PowerNV): reset GF bit on a cache watch operation */
365         end->w1 = xive_set_field32(END2_W1_GEN_FLIPPED, end->w1, qgen);
366     }
367     end->w1 = xive_set_field32(END2_W1_PAGE_OFF, end->w1, qindex);
368 }
369 
370 /*
371  * Scan the group chain and return the highest priority and group
372  * level of pending group interrupts.
373  */
374 static uint8_t xive2_presenter_backlog_scan(XivePresenter *xptr,
375                                             uint8_t nvp_blk, uint32_t nvp_idx,
376                                             uint8_t first_group,
377                                             uint8_t *out_level)
378 {
379     Xive2Router *xrtr = XIVE2_ROUTER(xptr);
380     uint32_t nvgc_idx, mask;
381     uint32_t current_level, count;
382     uint8_t prio;
383     Xive2Nvgc nvgc;
384 
385     for (prio = 0; prio <= XIVE_PRIORITY_MAX; prio++) {
386         current_level = first_group & 0xF;
387 
388         while (current_level) {
389             mask = (1 << current_level) - 1;
390             nvgc_idx = nvp_idx & ~mask;
391             nvgc_idx |= mask >> 1;
392             qemu_log("fxb %s checking backlog for prio %d group idx %x\n",
393                      __func__, prio, nvgc_idx);
394 
395             if (xive2_router_get_nvgc(xrtr, false, nvp_blk, nvgc_idx, &nvgc)) {
396                 qemu_log_mask(LOG_GUEST_ERROR, "XIVE: No NVG %x/%x\n",
397                               nvp_blk, nvgc_idx);
398                 return 0xFF;
399             }
400             if (!xive2_nvgc_is_valid(&nvgc)) {
401                 qemu_log_mask(LOG_GUEST_ERROR, "XIVE: Invalid NVG %x/%x\n",
402                               nvp_blk, nvgc_idx);
403                 return 0xFF;
404             }
405 
406             count = xive2_nvgc_get_backlog(&nvgc, prio);
407             if (count) {
408                 *out_level = current_level;
409                 return prio;
410             }
411             current_level = xive_get_field32(NVGC2_W0_PGONEXT, nvgc.w0) & 0xF;
412         }
413     }
414     return 0xFF;
415 }
416 
417 static void xive2_presenter_backlog_decr(XivePresenter *xptr,
418                                          uint8_t nvp_blk, uint32_t nvp_idx,
419                                          uint8_t group_prio,
420                                          uint8_t group_level)
421 {
422     Xive2Router *xrtr = XIVE2_ROUTER(xptr);
423     uint32_t nvgc_idx, mask, count;
424     Xive2Nvgc nvgc;
425 
426     group_level &= 0xF;
427     mask = (1 << group_level) - 1;
428     nvgc_idx = nvp_idx & ~mask;
429     nvgc_idx |= mask >> 1;
430 
431     if (xive2_router_get_nvgc(xrtr, false, nvp_blk, nvgc_idx, &nvgc)) {
432         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: No NVG %x/%x\n",
433                       nvp_blk, nvgc_idx);
434         return;
435     }
436     if (!xive2_nvgc_is_valid(&nvgc)) {
437         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: Invalid NVG %x/%x\n",
438                       nvp_blk, nvgc_idx);
439         return;
440     }
441     count = xive2_nvgc_get_backlog(&nvgc, group_prio);
442     if (!count) {
443         return;
444     }
445     xive2_nvgc_set_backlog(&nvgc, group_prio, count - 1);
446     xive2_router_write_nvgc(xrtr, false, nvp_blk, nvgc_idx, &nvgc);
447 }
448 
449 /*
450  * XIVE Thread Interrupt Management Area (TIMA) - Gen2 mode
451  *
452  * TIMA Gen2 VP “save & restore” (S&R) indicated by H bit next to V bit
453  *
454  *   - if a context is enabled with the H bit set, the VP context
455  *     information is retrieved from the NVP structure (“check out”)
456  *     and stored back on a context pull (“check in”), the SW receives
457  *     the same context pull information as on P9
458  *
459  *   - the H bit cannot be changed while the V bit is set, i.e. a
460  *     context cannot be set up in the TIMA and then be “pushed” into
461  *     the NVP by changing the H bit while the context is enabled
462  */
463 
464 static void xive2_tctx_save_ctx(Xive2Router *xrtr, XiveTCTX *tctx,
465                                 uint8_t nvp_blk, uint32_t nvp_idx,
466                                 uint8_t ring)
467 {
468     CPUPPCState *env = &POWERPC_CPU(tctx->cs)->env;
469     uint32_t pir = env->spr_cb[SPR_PIR].default_value;
470     Xive2Nvp nvp;
471     uint8_t *regs = &tctx->regs[ring];
472 
473     if (xive2_router_get_nvp(xrtr, nvp_blk, nvp_idx, &nvp)) {
474         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: No NVP %x/%x\n",
475                           nvp_blk, nvp_idx);
476         return;
477     }
478 
479     if (!xive2_nvp_is_valid(&nvp)) {
480         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid NVP %x/%x\n",
481                       nvp_blk, nvp_idx);
482         return;
483     }
484 
485     if (!xive2_nvp_is_hw(&nvp)) {
486         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: NVP %x/%x is not HW owned\n",
487                       nvp_blk, nvp_idx);
488         return;
489     }
490 
491     if (!xive2_nvp_is_co(&nvp)) {
492         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: NVP %x/%x is not checkout\n",
493                       nvp_blk, nvp_idx);
494         return;
495     }
496 
497     if (xive_get_field32(NVP2_W1_CO_THRID_VALID, nvp.w1) &&
498         xive_get_field32(NVP2_W1_CO_THRID, nvp.w1) != pir) {
499         qemu_log_mask(LOG_GUEST_ERROR,
500                       "XIVE: NVP %x/%x invalid checkout Thread %x\n",
501                       nvp_blk, nvp_idx, pir);
502         return;
503     }
504 
505     nvp.w2 = xive_set_field32(NVP2_W2_IPB, nvp.w2, regs[TM_IPB]);
506     nvp.w2 = xive_set_field32(NVP2_W2_CPPR, nvp.w2, regs[TM_CPPR]);
507     if (nvp.w0 & NVP2_W0_L) {
508         /*
509          * Typically not used. If LSMFB is restored with 0, it will
510          * force a backlog rescan
511          */
512         nvp.w2 = xive_set_field32(NVP2_W2_LSMFB, nvp.w2, regs[TM_LSMFB]);
513     }
514     if (nvp.w0 & NVP2_W0_G) {
515         nvp.w2 = xive_set_field32(NVP2_W2_LGS, nvp.w2, regs[TM_LGS]);
516     }
517     if (nvp.w0 & NVP2_W0_T) {
518         nvp.w2 = xive_set_field32(NVP2_W2_T, nvp.w2, regs[TM_T]);
519     }
520     xive2_router_write_nvp(xrtr, nvp_blk, nvp_idx, &nvp, 2);
521 
522     nvp.w1 = xive_set_field32(NVP2_W1_CO, nvp.w1, 0);
523     /* NVP2_W1_CO_THRID_VALID only set once */
524     nvp.w1 = xive_set_field32(NVP2_W1_CO_THRID, nvp.w1, 0xFFFF);
525     xive2_router_write_nvp(xrtr, nvp_blk, nvp_idx, &nvp, 1);
526 }
527 
528 static void xive2_cam_decode(uint32_t cam, uint8_t *nvp_blk,
529                              uint32_t *nvp_idx, bool *valid, bool *hw)
530 {
531     *nvp_blk = xive2_nvp_blk(cam);
532     *nvp_idx = xive2_nvp_idx(cam);
533     *valid = !!(cam & TM2_W2_VALID);
534     *hw = !!(cam & TM2_W2_HW);
535 }
536 
537 /*
538  * Encode the HW CAM line with 7bit or 8bit thread id. The thread id
539  * width and block id width is configurable at the IC level.
540  *
541  *    chipid << 24 | 0000 0000 0000 0000 1 threadid (7Bit)
542  *    chipid << 24 | 0000 0000 0000 0001 threadid   (8Bit)
543  */
544 static uint32_t xive2_tctx_hw_cam_line(XivePresenter *xptr, XiveTCTX *tctx)
545 {
546     Xive2Router *xrtr = XIVE2_ROUTER(xptr);
547     CPUPPCState *env = &POWERPC_CPU(tctx->cs)->env;
548     uint32_t pir = env->spr_cb[SPR_PIR].default_value;
549     uint8_t blk = xive2_router_get_block_id(xrtr);
550     uint8_t tid_shift =
551         xive2_router_get_config(xrtr) & XIVE2_THREADID_8BITS ? 8 : 7;
552     uint8_t tid_mask = (1 << tid_shift) - 1;
553 
554     return xive2_nvp_cam_line(blk, 1 << tid_shift | (pir & tid_mask));
555 }
556 
557 static uint64_t xive2_tm_pull_ctx(XivePresenter *xptr, XiveTCTX *tctx,
558                                   hwaddr offset, unsigned size, uint8_t ring)
559 {
560     Xive2Router *xrtr = XIVE2_ROUTER(xptr);
561     uint32_t target_ringw2 = xive_tctx_word2(&tctx->regs[ring]);
562     uint32_t cam = be32_to_cpu(target_ringw2);
563     uint8_t nvp_blk;
564     uint32_t nvp_idx;
565     uint8_t cur_ring;
566     bool valid;
567     bool do_save;
568 
569     xive2_cam_decode(cam, &nvp_blk, &nvp_idx, &valid, &do_save);
570 
571     if (!valid) {
572         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: pulling invalid NVP %x/%x !?\n",
573                       nvp_blk, nvp_idx);
574     }
575 
576     /* Invalidate CAM line of requested ring and all lower rings */
577     for (cur_ring = TM_QW0_USER; cur_ring <= ring;
578          cur_ring += XIVE_TM_RING_SIZE) {
579         uint32_t ringw2 = xive_tctx_word2(&tctx->regs[cur_ring]);
580         uint32_t ringw2_new = xive_set_field32(TM2_QW1W2_VO, ringw2, 0);
581         memcpy(&tctx->regs[cur_ring + TM_WORD2], &ringw2_new, 4);
582     }
583 
584     if (xive2_router_get_config(xrtr) & XIVE2_VP_SAVE_RESTORE && do_save) {
585         xive2_tctx_save_ctx(xrtr, tctx, nvp_blk, nvp_idx, ring);
586     }
587 
588     /*
589      * Lower external interrupt line of requested ring and below except for
590      * USER, which doesn't exist.
591      */
592     for (cur_ring = TM_QW1_OS; cur_ring <= ring;
593          cur_ring += XIVE_TM_RING_SIZE) {
594         xive_tctx_reset_signal(tctx, cur_ring);
595     }
596     return target_ringw2;
597 }
598 
599 uint64_t xive2_tm_pull_os_ctx(XivePresenter *xptr, XiveTCTX *tctx,
600                               hwaddr offset, unsigned size)
601 {
602     return xive2_tm_pull_ctx(xptr, tctx, offset, size, TM_QW1_OS);
603 }
604 
605 #define REPORT_LINE_GEN1_SIZE       16
606 
607 static void xive2_tm_report_line_gen1(XiveTCTX *tctx, uint8_t *data,
608                                       uint8_t size)
609 {
610     uint8_t *regs = tctx->regs;
611 
612     g_assert(size == REPORT_LINE_GEN1_SIZE);
613     memset(data, 0, size);
614     /*
615      * See xive architecture for description of what is saved. It is
616      * hand-picked information to fit in 16 bytes.
617      */
618     data[0x0] = regs[TM_QW3_HV_PHYS + TM_NSR];
619     data[0x1] = regs[TM_QW3_HV_PHYS + TM_CPPR];
620     data[0x2] = regs[TM_QW3_HV_PHYS + TM_IPB];
621     data[0x3] = regs[TM_QW2_HV_POOL + TM_IPB];
622     data[0x4] = regs[TM_QW1_OS + TM_ACK_CNT];
623     data[0x5] = regs[TM_QW3_HV_PHYS + TM_LGS];
624     data[0x6] = 0xFF;
625     data[0x7] = regs[TM_QW3_HV_PHYS + TM_WORD2] & 0x80;
626     data[0x7] |= (regs[TM_QW2_HV_POOL + TM_WORD2] & 0x80) >> 1;
627     data[0x7] |= (regs[TM_QW1_OS + TM_WORD2] & 0x80) >> 2;
628     data[0x7] |= (regs[TM_QW3_HV_PHYS + TM_WORD2] & 0x3);
629     data[0x8] = regs[TM_QW1_OS + TM_NSR];
630     data[0x9] = regs[TM_QW1_OS + TM_CPPR];
631     data[0xA] = regs[TM_QW1_OS + TM_IPB];
632     data[0xB] = regs[TM_QW1_OS + TM_LGS];
633     if (regs[TM_QW0_USER + TM_WORD2] & 0x80) {
634         /*
635          * Logical server extension, except VU bit replaced by EB bit
636          * from NSR
637          */
638         data[0xC] = regs[TM_QW0_USER + TM_WORD2];
639         data[0xC] &= ~0x80;
640         data[0xC] |= regs[TM_QW0_USER + TM_NSR] & 0x80;
641         data[0xD] = regs[TM_QW0_USER + TM_WORD2 + 1];
642         data[0xE] = regs[TM_QW0_USER + TM_WORD2 + 2];
643         data[0xF] = regs[TM_QW0_USER + TM_WORD2 + 3];
644     }
645 }
646 
647 static void xive2_tm_pull_ctx_ol(XivePresenter *xptr, XiveTCTX *tctx,
648                                  hwaddr offset, uint64_t value,
649                                  unsigned size, uint8_t ring)
650 {
651     Xive2Router *xrtr = XIVE2_ROUTER(xptr);
652     uint32_t hw_cam, nvp_idx, xive2_cfg, reserved;
653     uint8_t nvp_blk;
654     Xive2Nvp nvp;
655     uint64_t phys_addr;
656     MemTxResult result;
657 
658     hw_cam = xive2_tctx_hw_cam_line(xptr, tctx);
659     nvp_blk = xive2_nvp_blk(hw_cam);
660     nvp_idx = xive2_nvp_idx(hw_cam);
661 
662     if (xive2_router_get_nvp(xrtr, nvp_blk, nvp_idx, &nvp)) {
663         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: No NVP %x/%x\n",
664                       nvp_blk, nvp_idx);
665         return;
666     }
667 
668     if (!xive2_nvp_is_valid(&nvp)) {
669         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid NVP %x/%x\n",
670                       nvp_blk, nvp_idx);
671         return;
672     }
673 
674     xive2_cfg = xive2_router_get_config(xrtr);
675 
676     phys_addr = xive2_nvp_reporting_addr(&nvp) + 0x80; /* odd line */
677     if (xive2_cfg & XIVE2_GEN1_TIMA_OS) {
678         uint8_t pull_ctxt[REPORT_LINE_GEN1_SIZE];
679 
680         xive2_tm_report_line_gen1(tctx, pull_ctxt, REPORT_LINE_GEN1_SIZE);
681         result = dma_memory_write(&address_space_memory, phys_addr,
682                                   pull_ctxt, REPORT_LINE_GEN1_SIZE,
683                                   MEMTXATTRS_UNSPECIFIED);
684         assert(result == MEMTX_OK);
685     } else {
686         result = dma_memory_write(&address_space_memory, phys_addr,
687                                   &tctx->regs, sizeof(tctx->regs),
688                                   MEMTXATTRS_UNSPECIFIED);
689         assert(result == MEMTX_OK);
690         reserved = 0xFFFFFFFF;
691         result = dma_memory_write(&address_space_memory, phys_addr + 12,
692                                   &reserved, sizeof(reserved),
693                                   MEMTXATTRS_UNSPECIFIED);
694         assert(result == MEMTX_OK);
695     }
696 
697     /* the rest is similar to pull context to registers */
698     xive2_tm_pull_ctx(xptr, tctx, offset, size, ring);
699 }
700 
701 void xive2_tm_pull_os_ctx_ol(XivePresenter *xptr, XiveTCTX *tctx,
702                              hwaddr offset, uint64_t value, unsigned size)
703 {
704     xive2_tm_pull_ctx_ol(xptr, tctx, offset, value, size, TM_QW1_OS);
705 }
706 
707 
708 void xive2_tm_pull_phys_ctx_ol(XivePresenter *xptr, XiveTCTX *tctx,
709                                hwaddr offset, uint64_t value, unsigned size)
710 {
711     xive2_tm_pull_ctx_ol(xptr, tctx, offset, value, size, TM_QW3_HV_PHYS);
712 }
713 
714 static uint8_t xive2_tctx_restore_os_ctx(Xive2Router *xrtr, XiveTCTX *tctx,
715                                         uint8_t nvp_blk, uint32_t nvp_idx,
716                                         Xive2Nvp *nvp)
717 {
718     CPUPPCState *env = &POWERPC_CPU(tctx->cs)->env;
719     uint32_t pir = env->spr_cb[SPR_PIR].default_value;
720     uint8_t cppr;
721 
722     if (!xive2_nvp_is_hw(nvp)) {
723         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: NVP %x/%x is not HW owned\n",
724                       nvp_blk, nvp_idx);
725         return 0;
726     }
727 
728     cppr = xive_get_field32(NVP2_W2_CPPR, nvp->w2);
729     nvp->w2 = xive_set_field32(NVP2_W2_CPPR, nvp->w2, 0);
730     xive2_router_write_nvp(xrtr, nvp_blk, nvp_idx, nvp, 2);
731 
732     tctx->regs[TM_QW1_OS + TM_CPPR] = cppr;
733     tctx->regs[TM_QW1_OS + TM_LSMFB] = xive_get_field32(NVP2_W2_LSMFB, nvp->w2);
734     tctx->regs[TM_QW1_OS + TM_LGS] = xive_get_field32(NVP2_W2_LGS, nvp->w2);
735     tctx->regs[TM_QW1_OS + TM_T] = xive_get_field32(NVP2_W2_T, nvp->w2);
736 
737     nvp->w1 = xive_set_field32(NVP2_W1_CO, nvp->w1, 1);
738     nvp->w1 = xive_set_field32(NVP2_W1_CO_THRID_VALID, nvp->w1, 1);
739     nvp->w1 = xive_set_field32(NVP2_W1_CO_THRID, nvp->w1, pir);
740 
741     /*
742      * Checkout privilege: 0:OS, 1:Pool, 2:Hard
743      *
744      * TODO: we only support OS push/pull
745      */
746     nvp->w1 = xive_set_field32(NVP2_W1_CO_PRIV, nvp->w1, 0);
747 
748     xive2_router_write_nvp(xrtr, nvp_blk, nvp_idx, nvp, 1);
749 
750     /* return restored CPPR to generate a CPU exception if needed */
751     return cppr;
752 }
753 
754 static void xive2_tctx_need_resend(Xive2Router *xrtr, XiveTCTX *tctx,
755                                    uint8_t nvp_blk, uint32_t nvp_idx,
756                                    bool do_restore)
757 {
758     XivePresenter *xptr = XIVE_PRESENTER(xrtr);
759     uint8_t ipb;
760     uint8_t backlog_level;
761     uint8_t group_level;
762     uint8_t first_group;
763     uint8_t backlog_prio;
764     uint8_t group_prio;
765     uint8_t *regs = &tctx->regs[TM_QW1_OS];
766     Xive2Nvp nvp;
767 
768     /*
769      * Grab the associated thread interrupt context registers in the
770      * associated NVP
771      */
772     if (xive2_router_get_nvp(xrtr, nvp_blk, nvp_idx, &nvp)) {
773         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: No NVP %x/%x\n",
774                       nvp_blk, nvp_idx);
775         return;
776     }
777 
778     if (!xive2_nvp_is_valid(&nvp)) {
779         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid NVP %x/%x\n",
780                       nvp_blk, nvp_idx);
781         return;
782     }
783 
784     /* Automatically restore thread context registers */
785     if (xive2_router_get_config(xrtr) & XIVE2_VP_SAVE_RESTORE &&
786         do_restore) {
787         xive2_tctx_restore_os_ctx(xrtr, tctx, nvp_blk, nvp_idx, &nvp);
788     }
789 
790     ipb = xive_get_field32(NVP2_W2_IPB, nvp.w2);
791     if (ipb) {
792         nvp.w2 = xive_set_field32(NVP2_W2_IPB, nvp.w2, 0);
793         xive2_router_write_nvp(xrtr, nvp_blk, nvp_idx, &nvp, 2);
794     }
795     regs[TM_IPB] |= ipb;
796     backlog_prio = xive_ipb_to_pipr(ipb);
797     backlog_level = 0;
798 
799     first_group = xive_get_field32(NVP2_W0_PGOFIRST, nvp.w0);
800     if (first_group && regs[TM_LSMFB] < backlog_prio) {
801         group_prio = xive2_presenter_backlog_scan(xptr, nvp_blk, nvp_idx,
802                                                   first_group, &group_level);
803         regs[TM_LSMFB] = group_prio;
804         if (regs[TM_LGS] && group_prio < backlog_prio) {
805             /* VP can take a group interrupt */
806             xive2_presenter_backlog_decr(xptr, nvp_blk, nvp_idx,
807                                          group_prio, group_level);
808             backlog_prio = group_prio;
809             backlog_level = group_level;
810         }
811     }
812 
813     /*
814      * Compute the PIPR based on the restored state.
815      * It will raise the External interrupt signal if needed.
816      */
817     xive_tctx_pipr_update(tctx, TM_QW1_OS, backlog_prio, backlog_level);
818 }
819 
820 /*
821  * Updating the OS CAM line can trigger a resend of interrupt
822  */
823 void xive2_tm_push_os_ctx(XivePresenter *xptr, XiveTCTX *tctx,
824                           hwaddr offset, uint64_t value, unsigned size)
825 {
826     uint32_t cam;
827     uint32_t qw1w2;
828     uint64_t qw1dw1;
829     uint8_t nvp_blk;
830     uint32_t nvp_idx;
831     bool vo;
832     bool do_restore;
833 
834     /* First update the thead context */
835     switch (size) {
836     case 4:
837         cam = value;
838         qw1w2 = cpu_to_be32(cam);
839         memcpy(&tctx->regs[TM_QW1_OS + TM_WORD2], &qw1w2, 4);
840         break;
841     case 8:
842         cam = value >> 32;
843         qw1dw1 = cpu_to_be64(value);
844         memcpy(&tctx->regs[TM_QW1_OS + TM_WORD2], &qw1dw1, 8);
845         break;
846     default:
847         g_assert_not_reached();
848     }
849 
850     xive2_cam_decode(cam, &nvp_blk, &nvp_idx, &vo, &do_restore);
851 
852     /* Check the interrupt pending bits */
853     if (vo) {
854         xive2_tctx_need_resend(XIVE2_ROUTER(xptr), tctx, nvp_blk, nvp_idx,
855                                do_restore);
856     }
857 }
858 
859 static int xive2_tctx_get_nvp_indexes(XiveTCTX *tctx, uint8_t ring,
860                                       uint32_t *nvp_blk, uint32_t *nvp_idx)
861 {
862     uint32_t w2, cam;
863 
864     w2 = xive_tctx_word2(&tctx->regs[ring]);
865     switch (ring) {
866     case TM_QW1_OS:
867         if (!(be32_to_cpu(w2) & TM2_QW1W2_VO)) {
868             return -1;
869         }
870         cam = xive_get_field32(TM2_QW1W2_OS_CAM, w2);
871         break;
872     case TM_QW2_HV_POOL:
873         if (!(be32_to_cpu(w2) & TM2_QW2W2_VP)) {
874             return -1;
875         }
876         cam = xive_get_field32(TM2_QW2W2_POOL_CAM, w2);
877         break;
878     case TM_QW3_HV_PHYS:
879         if (!(be32_to_cpu(w2) & TM2_QW3W2_VT)) {
880             return -1;
881         }
882         cam = xive2_tctx_hw_cam_line(tctx->xptr, tctx);
883         break;
884     default:
885         return -1;
886     }
887     *nvp_blk = xive2_nvp_blk(cam);
888     *nvp_idx = xive2_nvp_idx(cam);
889     return 0;
890 }
891 
892 static void xive2_tctx_set_cppr(XiveTCTX *tctx, uint8_t ring, uint8_t cppr)
893 {
894     uint8_t *regs = &tctx->regs[ring];
895     Xive2Router *xrtr = XIVE2_ROUTER(tctx->xptr);
896     uint8_t old_cppr, backlog_prio, first_group, group_level = 0;
897     uint8_t pipr_min, lsmfb_min, ring_min;
898     bool group_enabled;
899     uint32_t nvp_blk, nvp_idx;
900     Xive2Nvp nvp;
901     int rc;
902 
903     trace_xive_tctx_set_cppr(tctx->cs->cpu_index, ring,
904                              regs[TM_IPB], regs[TM_PIPR],
905                              cppr, regs[TM_NSR]);
906 
907     if (cppr > XIVE_PRIORITY_MAX) {
908         cppr = 0xff;
909     }
910 
911     old_cppr = regs[TM_CPPR];
912     regs[TM_CPPR] = cppr;
913 
914     /*
915      * Recompute the PIPR based on local pending interrupts. It will
916      * be adjusted below if needed in case of pending group interrupts.
917      */
918     pipr_min = xive_ipb_to_pipr(regs[TM_IPB]);
919     group_enabled = !!regs[TM_LGS];
920     lsmfb_min = (group_enabled) ? regs[TM_LSMFB] : 0xff;
921     ring_min = ring;
922 
923     /* PHYS updates also depend on POOL values */
924     if (ring == TM_QW3_HV_PHYS) {
925         uint8_t *pregs = &tctx->regs[TM_QW2_HV_POOL];
926 
927         /* POOL values only matter if POOL ctx is valid */
928         if (pregs[TM_WORD2] & 0x80) {
929 
930             uint8_t pool_pipr = xive_ipb_to_pipr(pregs[TM_IPB]);
931             uint8_t pool_lsmfb = pregs[TM_LSMFB];
932 
933             /*
934              * Determine highest priority interrupt and
935              * remember which ring has it.
936              */
937             if (pool_pipr < pipr_min) {
938                 pipr_min = pool_pipr;
939                 if (pool_pipr < lsmfb_min) {
940                     ring_min = TM_QW2_HV_POOL;
941                 }
942             }
943 
944             /* Values needed for group priority calculation */
945             if (pregs[TM_LGS] && (pool_lsmfb < lsmfb_min)) {
946                 group_enabled = true;
947                 lsmfb_min = pool_lsmfb;
948                 if (lsmfb_min < pipr_min) {
949                     ring_min = TM_QW2_HV_POOL;
950                 }
951             }
952         }
953     }
954     regs[TM_PIPR] = pipr_min;
955 
956     rc = xive2_tctx_get_nvp_indexes(tctx, ring_min, &nvp_blk, &nvp_idx);
957     if (rc) {
958         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: set CPPR on invalid context\n");
959         return;
960     }
961 
962     if (cppr < old_cppr) {
963         /*
964          * FIXME: check if there's a group interrupt being presented
965          * and if the new cppr prevents it. If so, then the group
966          * interrupt needs to be re-added to the backlog and
967          * re-triggered (see re-trigger END info in the NVGC
968          * structure)
969          */
970     }
971 
972     if (group_enabled &&
973         lsmfb_min < cppr &&
974         lsmfb_min < regs[TM_PIPR]) {
975         /*
976          * Thread has seen a group interrupt with a higher priority
977          * than the new cppr or pending local interrupt. Check the
978          * backlog
979          */
980         if (xive2_router_get_nvp(xrtr, nvp_blk, nvp_idx, &nvp)) {
981             qemu_log_mask(LOG_GUEST_ERROR, "XIVE: No NVP %x/%x\n",
982                           nvp_blk, nvp_idx);
983             return;
984         }
985 
986         if (!xive2_nvp_is_valid(&nvp)) {
987             qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid NVP %x/%x\n",
988                           nvp_blk, nvp_idx);
989             return;
990         }
991 
992         first_group = xive_get_field32(NVP2_W0_PGOFIRST, nvp.w0);
993         if (!first_group) {
994             qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid NVP %x/%x\n",
995                           nvp_blk, nvp_idx);
996             return;
997         }
998 
999         backlog_prio = xive2_presenter_backlog_scan(tctx->xptr,
1000                                                     nvp_blk, nvp_idx,
1001                                                     first_group, &group_level);
1002         tctx->regs[ring_min + TM_LSMFB] = backlog_prio;
1003         if (backlog_prio != 0xFF) {
1004             xive2_presenter_backlog_decr(tctx->xptr, nvp_blk, nvp_idx,
1005                                          backlog_prio, group_level);
1006             regs[TM_PIPR] = backlog_prio;
1007         }
1008     }
1009     /* CPPR has changed, check if we need to raise a pending exception */
1010     xive_tctx_notify(tctx, ring_min, group_level);
1011 }
1012 
1013 void xive2_tm_set_hv_cppr(XivePresenter *xptr, XiveTCTX *tctx,
1014                           hwaddr offset, uint64_t value, unsigned size)
1015 {
1016     xive2_tctx_set_cppr(tctx, TM_QW3_HV_PHYS, value & 0xff);
1017 }
1018 
1019 void xive2_tm_set_os_cppr(XivePresenter *xptr, XiveTCTX *tctx,
1020                           hwaddr offset, uint64_t value, unsigned size)
1021 {
1022     xive2_tctx_set_cppr(tctx, TM_QW1_OS, value & 0xff);
1023 }
1024 
1025 static void xive2_tctx_set_target(XiveTCTX *tctx, uint8_t ring, uint8_t target)
1026 {
1027     uint8_t *regs = &tctx->regs[ring];
1028 
1029     regs[TM_T] = target;
1030 }
1031 
1032 void xive2_tm_set_hv_target(XivePresenter *xptr, XiveTCTX *tctx,
1033                             hwaddr offset, uint64_t value, unsigned size)
1034 {
1035     xive2_tctx_set_target(tctx, TM_QW3_HV_PHYS, value & 0xff);
1036 }
1037 
1038 /*
1039  * XIVE Router (aka. Virtualization Controller or IVRE)
1040  */
1041 
1042 int xive2_router_get_eas(Xive2Router *xrtr, uint8_t eas_blk, uint32_t eas_idx,
1043                          Xive2Eas *eas)
1044 {
1045     Xive2RouterClass *xrc = XIVE2_ROUTER_GET_CLASS(xrtr);
1046 
1047     return xrc->get_eas(xrtr, eas_blk, eas_idx, eas);
1048 }
1049 
1050 static
1051 int xive2_router_get_pq(Xive2Router *xrtr, uint8_t eas_blk, uint32_t eas_idx,
1052                        uint8_t *pq)
1053 {
1054     Xive2RouterClass *xrc = XIVE2_ROUTER_GET_CLASS(xrtr);
1055 
1056     return xrc->get_pq(xrtr, eas_blk, eas_idx, pq);
1057 }
1058 
1059 static
1060 int xive2_router_set_pq(Xive2Router *xrtr, uint8_t eas_blk, uint32_t eas_idx,
1061                        uint8_t *pq)
1062 {
1063     Xive2RouterClass *xrc = XIVE2_ROUTER_GET_CLASS(xrtr);
1064 
1065     return xrc->set_pq(xrtr, eas_blk, eas_idx, pq);
1066 }
1067 
1068 int xive2_router_get_end(Xive2Router *xrtr, uint8_t end_blk, uint32_t end_idx,
1069                          Xive2End *end)
1070 {
1071    Xive2RouterClass *xrc = XIVE2_ROUTER_GET_CLASS(xrtr);
1072 
1073    return xrc->get_end(xrtr, end_blk, end_idx, end);
1074 }
1075 
1076 int xive2_router_write_end(Xive2Router *xrtr, uint8_t end_blk, uint32_t end_idx,
1077                            Xive2End *end, uint8_t word_number)
1078 {
1079    Xive2RouterClass *xrc = XIVE2_ROUTER_GET_CLASS(xrtr);
1080 
1081    return xrc->write_end(xrtr, end_blk, end_idx, end, word_number);
1082 }
1083 
1084 int xive2_router_get_nvp(Xive2Router *xrtr, uint8_t nvp_blk, uint32_t nvp_idx,
1085                          Xive2Nvp *nvp)
1086 {
1087    Xive2RouterClass *xrc = XIVE2_ROUTER_GET_CLASS(xrtr);
1088 
1089    return xrc->get_nvp(xrtr, nvp_blk, nvp_idx, nvp);
1090 }
1091 
1092 int xive2_router_write_nvp(Xive2Router *xrtr, uint8_t nvp_blk, uint32_t nvp_idx,
1093                            Xive2Nvp *nvp, uint8_t word_number)
1094 {
1095    Xive2RouterClass *xrc = XIVE2_ROUTER_GET_CLASS(xrtr);
1096 
1097    return xrc->write_nvp(xrtr, nvp_blk, nvp_idx, nvp, word_number);
1098 }
1099 
1100 int xive2_router_get_nvgc(Xive2Router *xrtr, bool crowd,
1101                           uint8_t nvgc_blk, uint32_t nvgc_idx,
1102                           Xive2Nvgc *nvgc)
1103 {
1104    Xive2RouterClass *xrc = XIVE2_ROUTER_GET_CLASS(xrtr);
1105 
1106    return xrc->get_nvgc(xrtr, crowd, nvgc_blk, nvgc_idx, nvgc);
1107 }
1108 
1109 int xive2_router_write_nvgc(Xive2Router *xrtr, bool crowd,
1110                             uint8_t nvgc_blk, uint32_t nvgc_idx,
1111                             Xive2Nvgc *nvgc)
1112 {
1113    Xive2RouterClass *xrc = XIVE2_ROUTER_GET_CLASS(xrtr);
1114 
1115    return xrc->write_nvgc(xrtr, crowd, nvgc_blk, nvgc_idx, nvgc);
1116 }
1117 
1118 static bool xive2_vp_match_mask(uint32_t cam1, uint32_t cam2,
1119                                 uint32_t vp_mask)
1120 {
1121     return (cam1 & vp_mask) == (cam2 & vp_mask);
1122 }
1123 
1124 /*
1125  * The thread context register words are in big-endian format.
1126  */
1127 int xive2_presenter_tctx_match(XivePresenter *xptr, XiveTCTX *tctx,
1128                                uint8_t format,
1129                                uint8_t nvt_blk, uint32_t nvt_idx,
1130                                bool cam_ignore, uint32_t logic_serv)
1131 {
1132     uint32_t cam =   xive2_nvp_cam_line(nvt_blk, nvt_idx);
1133     uint32_t qw3w2 = xive_tctx_word2(&tctx->regs[TM_QW3_HV_PHYS]);
1134     uint32_t qw2w2 = xive_tctx_word2(&tctx->regs[TM_QW2_HV_POOL]);
1135     uint32_t qw1w2 = xive_tctx_word2(&tctx->regs[TM_QW1_OS]);
1136     uint32_t qw0w2 = xive_tctx_word2(&tctx->regs[TM_QW0_USER]);
1137 
1138     uint32_t vp_mask = 0xFFFFFFFF;
1139 
1140     if (format == 0) {
1141         /*
1142          * i=0: Specific NVT notification
1143          * i=1: VP-group notification (bits ignored at the end of the
1144          *      NVT identifier)
1145          */
1146         if (cam_ignore) {
1147             vp_mask = ~(xive_get_vpgroup_size(nvt_idx) - 1);
1148         }
1149 
1150         /* For VP-group notifications, threads with LGS=0 are excluded */
1151 
1152         /* PHYS ring */
1153         if ((be32_to_cpu(qw3w2) & TM2_QW3W2_VT) &&
1154             !(cam_ignore && tctx->regs[TM_QW3_HV_PHYS + TM_LGS] == 0) &&
1155             xive2_vp_match_mask(cam,
1156                                 xive2_tctx_hw_cam_line(xptr, tctx),
1157                                 vp_mask)) {
1158             return TM_QW3_HV_PHYS;
1159         }
1160 
1161         /* HV POOL ring */
1162         if ((be32_to_cpu(qw2w2) & TM2_QW2W2_VP) &&
1163             !(cam_ignore && tctx->regs[TM_QW2_HV_POOL + TM_LGS] == 0) &&
1164             xive2_vp_match_mask(cam,
1165                                 xive_get_field32(TM2_QW2W2_POOL_CAM, qw2w2),
1166                                 vp_mask)) {
1167             return TM_QW2_HV_POOL;
1168         }
1169 
1170         /* OS ring */
1171         if ((be32_to_cpu(qw1w2) & TM2_QW1W2_VO) &&
1172             !(cam_ignore && tctx->regs[TM_QW1_OS + TM_LGS] == 0) &&
1173             xive2_vp_match_mask(cam,
1174                                 xive_get_field32(TM2_QW1W2_OS_CAM, qw1w2),
1175                                 vp_mask)) {
1176             return TM_QW1_OS;
1177         }
1178     } else {
1179         /* F=1 : User level Event-Based Branch (EBB) notification */
1180 
1181         /* FIXME: what if cam_ignore and LGS = 0 ? */
1182         /* USER ring */
1183         if  ((be32_to_cpu(qw1w2) & TM2_QW1W2_VO) &&
1184              (cam == xive_get_field32(TM2_QW1W2_OS_CAM, qw1w2)) &&
1185              (be32_to_cpu(qw0w2) & TM2_QW0W2_VU) &&
1186              (logic_serv == xive_get_field32(TM2_QW0W2_LOGIC_SERV, qw0w2))) {
1187             return TM_QW0_USER;
1188         }
1189     }
1190     return -1;
1191 }
1192 
1193 bool xive2_tm_irq_precluded(XiveTCTX *tctx, int ring, uint8_t priority)
1194 {
1195     /* HV_POOL ring uses HV_PHYS NSR, CPPR and PIPR registers */
1196     uint8_t alt_ring = (ring == TM_QW2_HV_POOL) ? TM_QW3_HV_PHYS : ring;
1197     uint8_t *alt_regs = &tctx->regs[alt_ring];
1198 
1199     /*
1200      * The xive2_presenter_tctx_match() above tells if there's a match
1201      * but for VP-group notification, we still need to look at the
1202      * priority to know if the thread can take the interrupt now or if
1203      * it is precluded.
1204      */
1205     if (priority < alt_regs[TM_CPPR]) {
1206         return false;
1207     }
1208     return true;
1209 }
1210 
1211 void xive2_tm_set_lsmfb(XiveTCTX *tctx, int ring, uint8_t priority)
1212 {
1213     uint8_t *regs = &tctx->regs[ring];
1214 
1215     /*
1216      * Called by the router during a VP-group notification when the
1217      * thread matches but can't take the interrupt because it's
1218      * already running at a more favored priority. It then stores the
1219      * new interrupt priority in the LSMFB field.
1220      */
1221     regs[TM_LSMFB] = priority;
1222 }
1223 
1224 static void xive2_router_realize(DeviceState *dev, Error **errp)
1225 {
1226     Xive2Router *xrtr = XIVE2_ROUTER(dev);
1227 
1228     assert(xrtr->xfb);
1229 }
1230 
1231 /*
1232  * Notification using the END ESe/ESn bit (Event State Buffer for
1233  * escalation and notification). Profide further coalescing in the
1234  * Router.
1235  */
1236 static bool xive2_router_end_es_notify(Xive2Router *xrtr, uint8_t end_blk,
1237                                        uint32_t end_idx, Xive2End *end,
1238                                        uint32_t end_esmask)
1239 {
1240     uint8_t pq = xive_get_field32(end_esmask, end->w1);
1241     bool notify = xive_esb_trigger(&pq);
1242 
1243     if (pq != xive_get_field32(end_esmask, end->w1)) {
1244         end->w1 = xive_set_field32(end_esmask, end->w1, pq);
1245         xive2_router_write_end(xrtr, end_blk, end_idx, end, 1);
1246     }
1247 
1248     /* ESe/n[Q]=1 : end of notification */
1249     return notify;
1250 }
1251 
1252 /*
1253  * An END trigger can come from an event trigger (IPI or HW) or from
1254  * another chip. We don't model the PowerBus but the END trigger
1255  * message has the same parameters than in the function below.
1256  */
1257 static void xive2_router_end_notify(Xive2Router *xrtr, uint8_t end_blk,
1258                                     uint32_t end_idx, uint32_t end_data)
1259 {
1260     Xive2End end;
1261     uint8_t priority;
1262     uint8_t format;
1263     bool found, precluded;
1264     uint8_t nvp_blk;
1265     uint32_t nvp_idx;
1266 
1267     /* END cache lookup */
1268     if (xive2_router_get_end(xrtr, end_blk, end_idx, &end)) {
1269         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: No END %x/%x\n", end_blk,
1270                       end_idx);
1271         return;
1272     }
1273 
1274     if (!xive2_end_is_valid(&end)) {
1275         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: END %x/%x is invalid\n",
1276                       end_blk, end_idx);
1277         return;
1278     }
1279 
1280     if (xive2_end_is_enqueue(&end)) {
1281         xive2_end_enqueue(&end, end_data);
1282         /* Enqueuing event data modifies the EQ toggle and index */
1283         xive2_router_write_end(xrtr, end_blk, end_idx, &end, 1);
1284     }
1285 
1286     /*
1287      * When the END is silent, we skip the notification part.
1288      */
1289     if (xive2_end_is_silent_escalation(&end)) {
1290         goto do_escalation;
1291     }
1292 
1293     /*
1294      * The W7 format depends on the F bit in W6. It defines the type
1295      * of the notification :
1296      *
1297      *   F=0 : single or multiple NVP notification
1298      *   F=1 : User level Event-Based Branch (EBB) notification, no
1299      *         priority
1300      */
1301     format = xive_get_field32(END2_W6_FORMAT_BIT, end.w6);
1302     priority = xive_get_field32(END2_W7_F0_PRIORITY, end.w7);
1303 
1304     /* The END is masked */
1305     if (format == 0 && priority == 0xff) {
1306         return;
1307     }
1308 
1309     /*
1310      * Check the END ESn (Event State Buffer for notification) for
1311      * even further coalescing in the Router
1312      */
1313     if (!xive2_end_is_notify(&end)) {
1314         /* ESn[Q]=1 : end of notification */
1315         if (!xive2_router_end_es_notify(xrtr, end_blk, end_idx,
1316                                        &end, END2_W1_ESn)) {
1317             return;
1318         }
1319     }
1320 
1321     /*
1322      * Follows IVPE notification
1323      */
1324     nvp_blk = xive_get_field32(END2_W6_VP_BLOCK, end.w6);
1325     nvp_idx = xive_get_field32(END2_W6_VP_OFFSET, end.w6);
1326 
1327     found = xive_presenter_notify(xrtr->xfb, format, nvp_blk, nvp_idx,
1328                           xive2_end_is_ignore(&end),
1329                           priority,
1330                           xive_get_field32(END2_W7_F1_LOG_SERVER_ID, end.w7),
1331                           &precluded);
1332 
1333     /* TODO: Auto EOI. */
1334 
1335     if (found) {
1336         return;
1337     }
1338 
1339     /*
1340      * If no matching NVP is dispatched on a HW thread :
1341      * - specific VP: update the NVP structure if backlog is activated
1342      * - VP-group: update the backlog counter for that priority in the NVG
1343      */
1344     if (xive2_end_is_backlog(&end)) {
1345 
1346         if (format == 1) {
1347             qemu_log_mask(LOG_GUEST_ERROR,
1348                           "XIVE: END %x/%x invalid config: F1 & backlog\n",
1349                           end_blk, end_idx);
1350             return;
1351         }
1352 
1353         if (!xive2_end_is_ignore(&end)) {
1354             uint8_t ipb;
1355             Xive2Nvp nvp;
1356 
1357             /* NVP cache lookup */
1358             if (xive2_router_get_nvp(xrtr, nvp_blk, nvp_idx, &nvp)) {
1359                 qemu_log_mask(LOG_GUEST_ERROR, "XIVE: no NVP %x/%x\n",
1360                               nvp_blk, nvp_idx);
1361                 return;
1362             }
1363 
1364             if (!xive2_nvp_is_valid(&nvp)) {
1365                 qemu_log_mask(LOG_GUEST_ERROR, "XIVE: NVP %x/%x is invalid\n",
1366                               nvp_blk, nvp_idx);
1367                 return;
1368             }
1369 
1370             /*
1371              * Record the IPB in the associated NVP structure for later
1372              * use. The presenter will resend the interrupt when the vCPU
1373              * is dispatched again on a HW thread.
1374              */
1375             ipb = xive_get_field32(NVP2_W2_IPB, nvp.w2) |
1376                 xive_priority_to_ipb(priority);
1377             nvp.w2 = xive_set_field32(NVP2_W2_IPB, nvp.w2, ipb);
1378             xive2_router_write_nvp(xrtr, nvp_blk, nvp_idx, &nvp, 2);
1379         } else {
1380             Xive2Nvgc nvg;
1381             uint32_t backlog;
1382 
1383             /* For groups, the per-priority backlog counters are in the NVG */
1384             if (xive2_router_get_nvgc(xrtr, false, nvp_blk, nvp_idx, &nvg)) {
1385                 qemu_log_mask(LOG_GUEST_ERROR, "XIVE: no NVG %x/%x\n",
1386                               nvp_blk, nvp_idx);
1387                 return;
1388             }
1389 
1390             if (!xive2_nvgc_is_valid(&nvg)) {
1391                 qemu_log_mask(LOG_GUEST_ERROR, "XIVE: NVG %x/%x is invalid\n",
1392                               nvp_blk, nvp_idx);
1393                 return;
1394             }
1395 
1396             /*
1397              * Increment the backlog counter for that priority.
1398              * We only call broadcast the first time the counter is
1399              * incremented. broadcast will set the LSMFB field of the TIMA of
1400              * relevant threads so that they know an interrupt is pending.
1401              */
1402             backlog = xive2_nvgc_get_backlog(&nvg, priority) + 1;
1403             xive2_nvgc_set_backlog(&nvg, priority, backlog);
1404             xive2_router_write_nvgc(xrtr, false, nvp_blk, nvp_idx, &nvg);
1405 
1406             if (backlog == 1) {
1407                 XiveFabricClass *xfc = XIVE_FABRIC_GET_CLASS(xrtr->xfb);
1408                 xfc->broadcast(xrtr->xfb, nvp_blk, nvp_idx, priority);
1409 
1410                 if (!xive2_end_is_precluded_escalation(&end)) {
1411                     /*
1412                      * The interrupt will be picked up when the
1413                      * matching thread lowers its priority level
1414                      */
1415                     return;
1416                 }
1417             }
1418         }
1419     }
1420 
1421 do_escalation:
1422     /*
1423      * If activated, escalate notification using the ESe PQ bits and
1424      * the EAS in w4-5
1425      */
1426     if (!xive2_end_is_escalate(&end)) {
1427         return;
1428     }
1429 
1430     /*
1431      * Check the END ESe (Event State Buffer for escalation) for even
1432      * further coalescing in the Router
1433      */
1434     if (!xive2_end_is_uncond_escalation(&end)) {
1435         /* ESe[Q]=1 : end of escalation notification */
1436         if (!xive2_router_end_es_notify(xrtr, end_blk, end_idx,
1437                                        &end, END2_W1_ESe)) {
1438             return;
1439         }
1440     }
1441 
1442     /*
1443      * The END trigger becomes an Escalation trigger
1444      */
1445     xive2_router_end_notify(xrtr,
1446                            xive_get_field32(END2_W4_END_BLOCK,     end.w4),
1447                            xive_get_field32(END2_W4_ESC_END_INDEX, end.w4),
1448                            xive_get_field32(END2_W5_ESC_END_DATA,  end.w5));
1449 }
1450 
1451 void xive2_router_notify(XiveNotifier *xn, uint32_t lisn, bool pq_checked)
1452 {
1453     Xive2Router *xrtr = XIVE2_ROUTER(xn);
1454     uint8_t eas_blk = XIVE_EAS_BLOCK(lisn);
1455     uint32_t eas_idx = XIVE_EAS_INDEX(lisn);
1456     Xive2Eas eas;
1457 
1458     /* EAS cache lookup */
1459     if (xive2_router_get_eas(xrtr, eas_blk, eas_idx, &eas)) {
1460         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: Unknown LISN %x\n", lisn);
1461         return;
1462     }
1463 
1464     if (!pq_checked) {
1465         bool notify;
1466         uint8_t pq;
1467 
1468         /* PQ cache lookup */
1469         if (xive2_router_get_pq(xrtr, eas_blk, eas_idx, &pq)) {
1470             /* Set FIR */
1471             g_assert_not_reached();
1472         }
1473 
1474         notify = xive_esb_trigger(&pq);
1475 
1476         if (xive2_router_set_pq(xrtr, eas_blk, eas_idx, &pq)) {
1477             /* Set FIR */
1478             g_assert_not_reached();
1479         }
1480 
1481         if (!notify) {
1482             return;
1483         }
1484     }
1485 
1486     if (!xive2_eas_is_valid(&eas)) {
1487         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: Invalid LISN %x\n", lisn);
1488         return;
1489     }
1490 
1491     if (xive2_eas_is_masked(&eas)) {
1492         /* Notification completed */
1493         return;
1494     }
1495 
1496     /*
1497      * The event trigger becomes an END trigger
1498      */
1499     xive2_router_end_notify(xrtr,
1500                              xive_get_field64(EAS2_END_BLOCK, eas.w),
1501                              xive_get_field64(EAS2_END_INDEX, eas.w),
1502                              xive_get_field64(EAS2_END_DATA,  eas.w));
1503 }
1504 
1505 static const Property xive2_router_properties[] = {
1506     DEFINE_PROP_LINK("xive-fabric", Xive2Router, xfb,
1507                      TYPE_XIVE_FABRIC, XiveFabric *),
1508 };
1509 
1510 static void xive2_router_class_init(ObjectClass *klass, void *data)
1511 {
1512     DeviceClass *dc = DEVICE_CLASS(klass);
1513     XiveNotifierClass *xnc = XIVE_NOTIFIER_CLASS(klass);
1514 
1515     dc->desc    = "XIVE2 Router Engine";
1516     device_class_set_props(dc, xive2_router_properties);
1517     /* Parent is SysBusDeviceClass. No need to call its realize hook */
1518     dc->realize = xive2_router_realize;
1519     xnc->notify = xive2_router_notify;
1520 }
1521 
1522 static const TypeInfo xive2_router_info = {
1523     .name          = TYPE_XIVE2_ROUTER,
1524     .parent        = TYPE_SYS_BUS_DEVICE,
1525     .abstract      = true,
1526     .instance_size = sizeof(Xive2Router),
1527     .class_size    = sizeof(Xive2RouterClass),
1528     .class_init    = xive2_router_class_init,
1529     .interfaces    = (InterfaceInfo[]) {
1530         { TYPE_XIVE_NOTIFIER },
1531         { TYPE_XIVE_PRESENTER },
1532         { }
1533     }
1534 };
1535 
1536 static inline bool addr_is_even(hwaddr addr, uint32_t shift)
1537 {
1538     return !((addr >> shift) & 1);
1539 }
1540 
1541 static uint64_t xive2_end_source_read(void *opaque, hwaddr addr, unsigned size)
1542 {
1543     Xive2EndSource *xsrc = XIVE2_END_SOURCE(opaque);
1544     uint32_t offset = addr & 0xFFF;
1545     uint8_t end_blk;
1546     uint32_t end_idx;
1547     Xive2End end;
1548     uint32_t end_esmask;
1549     uint8_t pq;
1550     uint64_t ret;
1551 
1552     /*
1553      * The block id should be deduced from the load address on the END
1554      * ESB MMIO but our model only supports a single block per XIVE chip.
1555      */
1556     end_blk = xive2_router_get_block_id(xsrc->xrtr);
1557     end_idx = addr >> (xsrc->esb_shift + 1);
1558 
1559     if (xive2_router_get_end(xsrc->xrtr, end_blk, end_idx, &end)) {
1560         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: No END %x/%x\n", end_blk,
1561                       end_idx);
1562         return -1;
1563     }
1564 
1565     if (!xive2_end_is_valid(&end)) {
1566         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: END %x/%x is invalid\n",
1567                       end_blk, end_idx);
1568         return -1;
1569     }
1570 
1571     end_esmask = addr_is_even(addr, xsrc->esb_shift) ? END2_W1_ESn :
1572         END2_W1_ESe;
1573     pq = xive_get_field32(end_esmask, end.w1);
1574 
1575     switch (offset) {
1576     case XIVE_ESB_LOAD_EOI ... XIVE_ESB_LOAD_EOI + 0x7FF:
1577         ret = xive_esb_eoi(&pq);
1578 
1579         /* Forward the source event notification for routing ?? */
1580         break;
1581 
1582     case XIVE_ESB_GET ... XIVE_ESB_GET + 0x3FF:
1583         ret = pq;
1584         break;
1585 
1586     case XIVE_ESB_SET_PQ_00 ... XIVE_ESB_SET_PQ_00 + 0x0FF:
1587     case XIVE_ESB_SET_PQ_01 ... XIVE_ESB_SET_PQ_01 + 0x0FF:
1588     case XIVE_ESB_SET_PQ_10 ... XIVE_ESB_SET_PQ_10 + 0x0FF:
1589     case XIVE_ESB_SET_PQ_11 ... XIVE_ESB_SET_PQ_11 + 0x0FF:
1590         ret = xive_esb_set(&pq, (offset >> 8) & 0x3);
1591         break;
1592     default:
1593         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid END ESB load addr %d\n",
1594                       offset);
1595         return -1;
1596     }
1597 
1598     if (pq != xive_get_field32(end_esmask, end.w1)) {
1599         end.w1 = xive_set_field32(end_esmask, end.w1, pq);
1600         xive2_router_write_end(xsrc->xrtr, end_blk, end_idx, &end, 1);
1601     }
1602 
1603     return ret;
1604 }
1605 
1606 static void xive2_end_source_write(void *opaque, hwaddr addr,
1607                                    uint64_t value, unsigned size)
1608 {
1609     Xive2EndSource *xsrc = XIVE2_END_SOURCE(opaque);
1610     uint32_t offset = addr & 0xFFF;
1611     uint8_t end_blk;
1612     uint32_t end_idx;
1613     Xive2End end;
1614     uint32_t end_esmask;
1615     uint8_t pq;
1616     bool notify = false;
1617 
1618     /*
1619      * The block id should be deduced from the load address on the END
1620      * ESB MMIO but our model only supports a single block per XIVE chip.
1621      */
1622     end_blk = xive2_router_get_block_id(xsrc->xrtr);
1623     end_idx = addr >> (xsrc->esb_shift + 1);
1624 
1625     if (xive2_router_get_end(xsrc->xrtr, end_blk, end_idx, &end)) {
1626         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: No END %x/%x\n", end_blk,
1627                       end_idx);
1628         return;
1629     }
1630 
1631     if (!xive2_end_is_valid(&end)) {
1632         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: END %x/%x is invalid\n",
1633                       end_blk, end_idx);
1634         return;
1635     }
1636 
1637     end_esmask = addr_is_even(addr, xsrc->esb_shift) ? END2_W1_ESn :
1638         END2_W1_ESe;
1639     pq = xive_get_field32(end_esmask, end.w1);
1640 
1641     switch (offset) {
1642     case 0 ... 0x3FF:
1643         notify = xive_esb_trigger(&pq);
1644         break;
1645 
1646     case XIVE_ESB_STORE_EOI ... XIVE_ESB_STORE_EOI + 0x3FF:
1647         /* TODO: can we check StoreEOI availability from the router ? */
1648         notify = xive_esb_eoi(&pq);
1649         break;
1650 
1651     case XIVE_ESB_INJECT ... XIVE_ESB_INJECT + 0x3FF:
1652         if (end_esmask == END2_W1_ESe) {
1653             qemu_log_mask(LOG_GUEST_ERROR,
1654                           "XIVE: END %x/%x can not EQ inject on ESe\n",
1655                            end_blk, end_idx);
1656             return;
1657         }
1658         notify = true;
1659         break;
1660 
1661     default:
1662         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid END ESB write addr %d\n",
1663                       offset);
1664         return;
1665     }
1666 
1667     if (pq != xive_get_field32(end_esmask, end.w1)) {
1668         end.w1 = xive_set_field32(end_esmask, end.w1, pq);
1669         xive2_router_write_end(xsrc->xrtr, end_blk, end_idx, &end, 1);
1670     }
1671 
1672     /* TODO: Forward the source event notification for routing */
1673     if (notify) {
1674         ;
1675     }
1676 }
1677 
1678 static const MemoryRegionOps xive2_end_source_ops = {
1679     .read = xive2_end_source_read,
1680     .write = xive2_end_source_write,
1681     .endianness = DEVICE_BIG_ENDIAN,
1682     .valid = {
1683         .min_access_size = 1,
1684         .max_access_size = 8,
1685     },
1686     .impl = {
1687         .min_access_size = 1,
1688         .max_access_size = 8,
1689     },
1690 };
1691 
1692 static void xive2_end_source_realize(DeviceState *dev, Error **errp)
1693 {
1694     Xive2EndSource *xsrc = XIVE2_END_SOURCE(dev);
1695 
1696     assert(xsrc->xrtr);
1697 
1698     if (!xsrc->nr_ends) {
1699         error_setg(errp, "Number of interrupt needs to be greater than 0");
1700         return;
1701     }
1702 
1703     if (xsrc->esb_shift != XIVE_ESB_4K &&
1704         xsrc->esb_shift != XIVE_ESB_64K) {
1705         error_setg(errp, "Invalid ESB shift setting");
1706         return;
1707     }
1708 
1709     /*
1710      * Each END is assigned an even/odd pair of MMIO pages, the even page
1711      * manages the ESn field while the odd page manages the ESe field.
1712      */
1713     memory_region_init_io(&xsrc->esb_mmio, OBJECT(xsrc),
1714                           &xive2_end_source_ops, xsrc, "xive.end",
1715                           (1ull << (xsrc->esb_shift + 1)) * xsrc->nr_ends);
1716 }
1717 
1718 static const Property xive2_end_source_properties[] = {
1719     DEFINE_PROP_UINT32("nr-ends", Xive2EndSource, nr_ends, 0),
1720     DEFINE_PROP_UINT32("shift", Xive2EndSource, esb_shift, XIVE_ESB_64K),
1721     DEFINE_PROP_LINK("xive", Xive2EndSource, xrtr, TYPE_XIVE2_ROUTER,
1722                      Xive2Router *),
1723 };
1724 
1725 static void xive2_end_source_class_init(ObjectClass *klass, void *data)
1726 {
1727     DeviceClass *dc = DEVICE_CLASS(klass);
1728 
1729     dc->desc    = "XIVE END Source";
1730     device_class_set_props(dc, xive2_end_source_properties);
1731     dc->realize = xive2_end_source_realize;
1732     dc->user_creatable = false;
1733 }
1734 
1735 static const TypeInfo xive2_end_source_info = {
1736     .name          = TYPE_XIVE2_END_SOURCE,
1737     .parent        = TYPE_DEVICE,
1738     .instance_size = sizeof(Xive2EndSource),
1739     .class_init    = xive2_end_source_class_init,
1740 };
1741 
1742 static void xive2_register_types(void)
1743 {
1744     type_register_static(&xive2_router_info);
1745     type_register_static(&xive2_end_source_info);
1746 }
1747 
1748 type_init(xive2_register_types)
1749