hw/intc/xive.c

   1 /*
   2  * QEMU PowerPC XIVE interrupt controller model
   3  *
   4  * Copyright (c) 2017-2018, IBM Corporation.
   5  *
   6  * This code is licensed under the GPL version 2 or later. See the
   7  * COPYING file in the top-level directory.
   8  */
   9
  10 #include "qemu/osdep.h"
  11 #include "qemu/log.h"
  12 #include "qapi/error.h"
  13 #include "target/ppc/cpu.h"
  14 #include "sysemu/cpus.h"
  15 #include "sysemu/dma.h"
  16 #include "hw/qdev-properties.h"
  17 #include "monitor/monitor.h"
  18 #include "hw/ppc/xive.h"
  19
  20 /*
  21  * XIVE ESB helpers
  22  */
  23
  24 static uint8_t xive_esb_set(uint8_t *pq, uint8_t value)
  25 {
  26     uint8_t old_pq = *pq & 0x3;
  27
  28     *pq &= ~0x3;
  29     *pq |= value & 0x3;
  30
  31     return old_pq;
  32 }
  33
  34 static bool xive_esb_trigger(uint8_t *pq)
  35 {
  36     uint8_t old_pq = *pq & 0x3;
  37
  38     switch (old_pq) {
  39     case XIVE_ESB_RESET:
  40         xive_esb_set(pq, XIVE_ESB_PENDING);
  41         return true;
  42     case XIVE_ESB_PENDING:
  43     case XIVE_ESB_QUEUED:
  44         xive_esb_set(pq, XIVE_ESB_QUEUED);
  45         return false;
  46     case XIVE_ESB_OFF:
  47         xive_esb_set(pq, XIVE_ESB_OFF);
  48         return false;
  49     default:
  50          g_assert_not_reached();
  51     }
  52 }
  53
  54 static bool xive_esb_eoi(uint8_t *pq)
  55 {
  56     uint8_t old_pq = *pq & 0x3;
  57
  58     switch (old_pq) {
  59     case XIVE_ESB_RESET:
  60     case XIVE_ESB_PENDING:
  61         xive_esb_set(pq, XIVE_ESB_RESET);
  62         return false;
  63     case XIVE_ESB_QUEUED:
  64         xive_esb_set(pq, XIVE_ESB_PENDING);
  65         return true;
  66     case XIVE_ESB_OFF:
  67         xive_esb_set(pq, XIVE_ESB_OFF);
  68         return false;
  69     default:
  70          g_assert_not_reached();
  71     }
  72 }
  73
  74 /*
  75  * XIVE Interrupt Source (or IVSE)
  76  */
  77
  78 uint8_t xive_source_esb_get(XiveSource *xsrc, uint32_t srcno)
  79 {
  80     assert(srcno < xsrc->nr_irqs);
  81
  82     return xsrc->status[srcno] & 0x3;
  83 }
  84
  85 uint8_t xive_source_esb_set(XiveSource *xsrc, uint32_t srcno, uint8_t pq)
  86 {
  87     assert(srcno < xsrc->nr_irqs);
  88
  89     return xive_esb_set(&xsrc->status[srcno], pq);
  90 }
  91
  92 /*
  93  * Returns whether the event notification should be forwarded.
  94  */
  95 static bool xive_source_lsi_trigger(XiveSource *xsrc, uint32_t srcno)
  96 {
  97     uint8_t old_pq = xive_source_esb_get(xsrc, srcno);
  98
  99     xsrc->status[srcno] |= XIVE_STATUS_ASSERTED;
 100
 101     switch (old_pq) {
 102     case XIVE_ESB_RESET:
 103         xive_source_esb_set(xsrc, srcno, XIVE_ESB_PENDING);
 104         return true;
 105     default:
 106         return false;
 107     }
 108 }
 109
 110 /*
 111  * Returns whether the event notification should be forwarded.
 112  */
 113 static bool xive_source_esb_trigger(XiveSource *xsrc, uint32_t srcno)
 114 {
 115     bool ret;
 116
 117     assert(srcno < xsrc->nr_irqs);
 118
 119     ret = xive_esb_trigger(&xsrc->status[srcno]);
 120
 121     if (xive_source_irq_is_lsi(xsrc, srcno) &&
 122         xive_source_esb_get(xsrc, srcno) == XIVE_ESB_QUEUED) {
 123         qemu_log_mask(LOG_GUEST_ERROR,
 124                       "XIVE: queued an event on LSI IRQ %d\n", srcno);
 125     }
 126
 127     return ret;
 128 }
 129
 130 /*
 131  * Returns whether the event notification should be forwarded.
 132  */
 133 static bool xive_source_esb_eoi(XiveSource *xsrc, uint32_t srcno)
 134 {
 135     bool ret;
 136
 137     assert(srcno < xsrc->nr_irqs);
 138
 139     ret = xive_esb_eoi(&xsrc->status[srcno]);
 140
 141     /*
 142      * LSI sources do not set the Q bit but they can still be
 143      * asserted, in which case we should forward a new event
 144      * notification
 145      */
 146     if (xive_source_irq_is_lsi(xsrc, srcno) &&
 147         xsrc->status[srcno] & XIVE_STATUS_ASSERTED) {
 148         ret = xive_source_lsi_trigger(xsrc, srcno);
 149     }
 150
 151     return ret;
 152 }
 153
 154 /*
 155  * Forward the source event notification to the Router
 156  */
 157 static void xive_source_notify(XiveSource *xsrc, int srcno)
 158 {
 159     XiveNotifierClass *xnc = XIVE_NOTIFIER_GET_CLASS(xsrc->xive);
 160
 161     if (xnc->notify) {
 162         xnc->notify(xsrc->xive, srcno);
 163     }
 164 }
 165
 166 /*
 167  * In a two pages ESB MMIO setting, even page is the trigger page, odd
 168  * page is for management
 169  */
 170 static inline bool addr_is_even(hwaddr addr, uint32_t shift)
 171 {
 172     return !((addr >> shift) & 1);
 173 }
 174
 175 static inline bool xive_source_is_trigger_page(XiveSource *xsrc, hwaddr addr)
 176 {
 177     return xive_source_esb_has_2page(xsrc) &&
 178         addr_is_even(addr, xsrc->esb_shift - 1);
 179 }
 180
 181 /*
 182  * ESB MMIO loads
 183  *                      Trigger page    Management/EOI page
 184  *
 185  * ESB MMIO setting     2 pages         1 or 2 pages
 186  *
 187  * 0x000 .. 0x3FF       -1              EOI and return 0|1
 188  * 0x400 .. 0x7FF       -1              EOI and return 0|1
 189  * 0x800 .. 0xBFF       -1              return PQ
 190  * 0xC00 .. 0xCFF       -1              return PQ and atomically PQ=00
 191  * 0xD00 .. 0xDFF       -1              return PQ and atomically PQ=01
 192  * 0xE00 .. 0xDFF       -1              return PQ and atomically PQ=10
 193  * 0xF00 .. 0xDFF       -1              return PQ and atomically PQ=11
 194  */
 195 static uint64_t xive_source_esb_read(void *opaque, hwaddr addr, unsigned size)
 196 {
 197     XiveSource *xsrc = XIVE_SOURCE(opaque);
 198     uint32_t offset = addr & 0xFFF;
 199     uint32_t srcno = addr >> xsrc->esb_shift;
 200     uint64_t ret = -1;
 201
 202     /* In a two pages ESB MMIO setting, trigger page should not be read */
 203     if (xive_source_is_trigger_page(xsrc, addr)) {
 204         qemu_log_mask(LOG_GUEST_ERROR,
 205                       "XIVE: invalid load on IRQ %d trigger page at "
 206                       "0x%"HWADDR_PRIx"\n", srcno, addr);
 207         return -1;
 208     }
 209
 210     switch (offset) {
 211     case XIVE_ESB_LOAD_EOI ... XIVE_ESB_LOAD_EOI + 0x7FF:
 212         ret = xive_source_esb_eoi(xsrc, srcno);
 213
 214         /* Forward the source event notification for routing */
 215         if (ret) {
 216             xive_source_notify(xsrc, srcno);
 217         }
 218         break;
 219
 220     case XIVE_ESB_GET ... XIVE_ESB_GET + 0x3FF:
 221         ret = xive_source_esb_get(xsrc, srcno);
 222         break;
 223
 224     case XIVE_ESB_SET_PQ_00 ... XIVE_ESB_SET_PQ_00 + 0x0FF:
 225     case XIVE_ESB_SET_PQ_01 ... XIVE_ESB_SET_PQ_01 + 0x0FF:
 226     case XIVE_ESB_SET_PQ_10 ... XIVE_ESB_SET_PQ_10 + 0x0FF:
 227     case XIVE_ESB_SET_PQ_11 ... XIVE_ESB_SET_PQ_11 + 0x0FF:
 228         ret = xive_source_esb_set(xsrc, srcno, (offset >> 8) & 0x3);
 229         break;
 230     default:
 231         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid ESB load addr %x\n",
 232                       offset);
 233     }
 234
 235     return ret;
 236 }
 237
 238 /*
 239  * ESB MMIO stores
 240  *                      Trigger page    Management/EOI page
 241  *
 242  * ESB MMIO setting     2 pages         1 or 2 pages
 243  *
 244  * 0x000 .. 0x3FF       Trigger         Trigger
 245  * 0x400 .. 0x7FF       Trigger         EOI
 246  * 0x800 .. 0xBFF       Trigger         undefined
 247  * 0xC00 .. 0xCFF       Trigger         PQ=00
 248  * 0xD00 .. 0xDFF       Trigger         PQ=01
 249  * 0xE00 .. 0xDFF       Trigger         PQ=10
 250  * 0xF00 .. 0xDFF       Trigger         PQ=11
 251  */
 252 static void xive_source_esb_write(void *opaque, hwaddr addr,
 253                                   uint64_t value, unsigned size)
 254 {
 255     XiveSource *xsrc = XIVE_SOURCE(opaque);
 256     uint32_t offset = addr & 0xFFF;
 257     uint32_t srcno = addr >> xsrc->esb_shift;
 258     bool notify = false;
 259
 260     /* In a two pages ESB MMIO setting, trigger page only triggers */
 261     if (xive_source_is_trigger_page(xsrc, addr)) {
 262         notify = xive_source_esb_trigger(xsrc, srcno);
 263         goto out;
 264     }
 265
 266     switch (offset) {
 267     case 0 ... 0x3FF:
 268         notify = xive_source_esb_trigger(xsrc, srcno);
 269         break;
 270
 271     case XIVE_ESB_STORE_EOI ... XIVE_ESB_STORE_EOI + 0x3FF:
 272         if (!(xsrc->esb_flags & XIVE_SRC_STORE_EOI)) {
 273             qemu_log_mask(LOG_GUEST_ERROR,
 274                           "XIVE: invalid Store EOI for IRQ %d\n", srcno);
 275             return;
 276         }
 277
 278         notify = xive_source_esb_eoi(xsrc, srcno);
 279         break;
 280
 281     case XIVE_ESB_SET_PQ_00 ... XIVE_ESB_SET_PQ_00 + 0x0FF:
 282     case XIVE_ESB_SET_PQ_01 ... XIVE_ESB_SET_PQ_01 + 0x0FF:
 283     case XIVE_ESB_SET_PQ_10 ... XIVE_ESB_SET_PQ_10 + 0x0FF:
 284     case XIVE_ESB_SET_PQ_11 ... XIVE_ESB_SET_PQ_11 + 0x0FF:
 285         xive_source_esb_set(xsrc, srcno, (offset >> 8) & 0x3);
 286         break;
 287
 288     default:
 289         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid ESB write addr %x\n",
 290                       offset);
 291         return;
 292     }
 293
 294 out:
 295     /* Forward the source event notification for routing */
 296     if (notify) {
 297         xive_source_notify(xsrc, srcno);
 298     }
 299 }
 300
 301 static const MemoryRegionOps xive_source_esb_ops = {
 302     .read = xive_source_esb_read,
 303     .write = xive_source_esb_write,
 304     .endianness = DEVICE_BIG_ENDIAN,
 305     .valid = {
 306         .min_access_size = 8,
 307         .max_access_size = 8,
 308     },
 309     .impl = {
 310         .min_access_size = 8,
 311         .max_access_size = 8,
 312     },
 313 };
 314
 315 static void xive_source_set_irq(void *opaque, int srcno, int val)
 316 {
 317     XiveSource *xsrc = XIVE_SOURCE(opaque);
 318     bool notify = false;
 319
 320     if (xive_source_irq_is_lsi(xsrc, srcno)) {
 321         if (val) {
 322             notify = xive_source_lsi_trigger(xsrc, srcno);
 323         } else {
 324             xsrc->status[srcno] &= ~XIVE_STATUS_ASSERTED;
 325         }
 326     } else {
 327         if (val) {
 328             notify = xive_source_esb_trigger(xsrc, srcno);
 329         }
 330     }
 331
 332     /* Forward the source event notification for routing */
 333     if (notify) {
 334         xive_source_notify(xsrc, srcno);
 335     }
 336 }
 337
 338 void xive_source_pic_print_info(XiveSource *xsrc, uint32_t offset, Monitor *mon)
 339 {
 340     int i;
 341
 342     for (i = 0; i < xsrc->nr_irqs; i++) {
 343         uint8_t pq = xive_source_esb_get(xsrc, i);
 344
 345         if (pq == XIVE_ESB_OFF) {
 346             continue;
 347         }
 348
 349         monitor_printf(mon, "  %08x %s %c%c%c\n", i + offset,
 350                        xive_source_irq_is_lsi(xsrc, i) ? "LSI" : "MSI",
 351                        pq & XIVE_ESB_VAL_P ? 'P' : '-',
 352                        pq & XIVE_ESB_VAL_Q ? 'Q' : '-',
 353                        xsrc->status[i] & XIVE_STATUS_ASSERTED ? 'A' : ' ');
 354     }
 355 }
 356
 357 static void xive_source_reset(void *dev)
 358 {
 359     XiveSource *xsrc = XIVE_SOURCE(dev);
 360
 361     /* Do not clear the LSI bitmap */
 362
 363     /* PQs are initialized to 0b01 (Q=1) which corresponds to "ints off" */
 364     memset(xsrc->status, XIVE_ESB_OFF, xsrc->nr_irqs);
 365 }
 366
 367 static void xive_source_realize(DeviceState *dev, Error **errp)
 368 {
 369     XiveSource *xsrc = XIVE_SOURCE(dev);
 370     Object *obj;
 371     Error *local_err = NULL;
 372
 373     obj = object_property_get_link(OBJECT(dev), "xive", &local_err);
 374     if (!obj) {
 375         error_propagate(errp, local_err);
 376         error_prepend(errp, "required link 'xive' not found: ");
 377         return;
 378     }
 379
 380     xsrc->xive = XIVE_NOTIFIER(obj);
 381
 382     if (!xsrc->nr_irqs) {
 383         error_setg(errp, "Number of interrupt needs to be greater than 0");
 384         return;
 385     }
 386
 387     if (xsrc->esb_shift != XIVE_ESB_4K &&
 388         xsrc->esb_shift != XIVE_ESB_4K_2PAGE &&
 389         xsrc->esb_shift != XIVE_ESB_64K &&
 390         xsrc->esb_shift != XIVE_ESB_64K_2PAGE) {
 391         error_setg(errp, "Invalid ESB shift setting");
 392         return;
 393     }
 394
 395     xsrc->status = g_malloc0(xsrc->nr_irqs);
 396     xsrc->lsi_map = bitmap_new(xsrc->nr_irqs);
 397
 398     memory_region_init_io(&xsrc->esb_mmio, OBJECT(xsrc),
 399                           &xive_source_esb_ops, xsrc, "xive.esb",
 400                           (1ull << xsrc->esb_shift) * xsrc->nr_irqs);
 401
 402     xsrc->qirqs = qemu_allocate_irqs(xive_source_set_irq, xsrc,
 403                                      xsrc->nr_irqs);
 404
 405     qemu_register_reset(xive_source_reset, dev);
 406 }
 407
 408 static const VMStateDescription vmstate_xive_source = {
 409     .name = TYPE_XIVE_SOURCE,
 410     .version_id = 1,
 411     .minimum_version_id = 1,
 412     .fields = (VMStateField[]) {
 413         VMSTATE_UINT32_EQUAL(nr_irqs, XiveSource, NULL),
 414         VMSTATE_VBUFFER_UINT32(status, XiveSource, 1, NULL, nr_irqs),
 415         VMSTATE_END_OF_LIST()
 416     },
 417 };
 418
 419 /*
 420  * The default XIVE interrupt source setting for the ESB MMIOs is two
 421  * 64k pages without Store EOI, to be in sync with KVM.
 422  */
 423 static Property xive_source_properties[] = {
 424     DEFINE_PROP_UINT64("flags", XiveSource, esb_flags, 0),
 425     DEFINE_PROP_UINT32("nr-irqs", XiveSource, nr_irqs, 0),
 426     DEFINE_PROP_UINT32("shift", XiveSource, esb_shift, XIVE_ESB_64K_2PAGE),
 427     DEFINE_PROP_END_OF_LIST(),
 428 };
 429
 430 static void xive_source_class_init(ObjectClass *klass, void *data)
 431 {
 432     DeviceClass *dc = DEVICE_CLASS(klass);
 433
 434     dc->desc    = "XIVE Interrupt Source";
 435     dc->props   = xive_source_properties;
 436     dc->realize = xive_source_realize;
 437     dc->vmsd    = &vmstate_xive_source;
 438 }
 439
 440 static const TypeInfo xive_source_info = {
 441     .name          = TYPE_XIVE_SOURCE,
 442     .parent        = TYPE_DEVICE,
 443     .instance_size = sizeof(XiveSource),
 444     .class_init    = xive_source_class_init,
 445 };
 446
 447 /*
 448  * XiveEND helpers
 449  */
 450
 451 void xive_end_queue_pic_print_info(XiveEND *end, uint32_t width, Monitor *mon)
 452 {
 453     uint64_t qaddr_base = (uint64_t) be32_to_cpu(end->w2 & 0x0fffffff) << 32
 454         | be32_to_cpu(end->w3);
 455     uint32_t qsize = xive_get_field32(END_W0_QSIZE, end->w0);
 456     uint32_t qindex = xive_get_field32(END_W1_PAGE_OFF, end->w1);
 457     uint32_t qentries = 1 << (qsize + 10);
 458     int i;
 459
 460     /*
 461      * print out the [ (qindex - (width - 1)) .. (qindex + 1)] window
 462      */
 463     monitor_printf(mon, " [ ");
 464     qindex = (qindex - (width - 1)) & (qentries - 1);
 465     for (i = 0; i < width; i++) {
 466         uint64_t qaddr = qaddr_base + (qindex << 2);
 467         uint32_t qdata = -1;
 468
 469         if (dma_memory_read(&address_space_memory, qaddr, &qdata,
 470                             sizeof(qdata))) {
 471             qemu_log_mask(LOG_GUEST_ERROR, "XIVE: failed to read EQ @0x%"
 472                           HWADDR_PRIx "\n", qaddr);
 473             return;
 474         }
 475         monitor_printf(mon, "%s%08x ", i == width - 1 ? "^" : "",
 476                        be32_to_cpu(qdata));
 477         qindex = (qindex + 1) & (qentries - 1);
 478     }
 479 }
 480
 481 void xive_end_pic_print_info(XiveEND *end, uint32_t end_idx, Monitor *mon)
 482 {
 483     uint64_t qaddr_base = (uint64_t) be32_to_cpu(end->w2 & 0x0fffffff) << 32
 484         | be32_to_cpu(end->w3);
 485     uint32_t qindex = xive_get_field32(END_W1_PAGE_OFF, end->w1);
 486     uint32_t qgen = xive_get_field32(END_W1_GENERATION, end->w1);
 487     uint32_t qsize = xive_get_field32(END_W0_QSIZE, end->w0);
 488     uint32_t qentries = 1 << (qsize + 10);
 489
 490     uint32_t nvt = xive_get_field32(END_W6_NVT_INDEX, end->w6);
 491     uint8_t priority = xive_get_field32(END_W7_F0_PRIORITY, end->w7);
 492
 493     if (!xive_end_is_valid(end)) {
 494         return;
 495     }
 496
 497     monitor_printf(mon, "  %08x %c%c%c%c%c prio:%d nvt:%04x eq:@%08"PRIx64
 498                    "% 6d/%5d ^%d", end_idx,
 499                    xive_end_is_valid(end)    ? 'v' : '-',
 500                    xive_end_is_enqueue(end)  ? 'q' : '-',
 501                    xive_end_is_notify(end)   ? 'n' : '-',
 502                    xive_end_is_backlog(end)  ? 'b' : '-',
 503                    xive_end_is_escalate(end) ? 'e' : '-',
 504                    priority, nvt, qaddr_base, qindex, qentries, qgen);
 505
 506     xive_end_queue_pic_print_info(end, 6, mon);
 507     monitor_printf(mon, "]\n");
 508 }
 509
 510 static void xive_end_enqueue(XiveEND *end, uint32_t data)
 511 {
 512     uint64_t qaddr_base = (uint64_t) be32_to_cpu(end->w2 & 0x0fffffff) << 32
 513         | be32_to_cpu(end->w3);
 514     uint32_t qsize = xive_get_field32(END_W0_QSIZE, end->w0);
 515     uint32_t qindex = xive_get_field32(END_W1_PAGE_OFF, end->w1);
 516     uint32_t qgen = xive_get_field32(END_W1_GENERATION, end->w1);
 517
 518     uint64_t qaddr = qaddr_base + (qindex << 2);
 519     uint32_t qdata = cpu_to_be32((qgen << 31) | (data & 0x7fffffff));
 520     uint32_t qentries = 1 << (qsize + 10);
 521
 522     if (dma_memory_write(&address_space_memory, qaddr, &qdata, sizeof(qdata))) {
 523         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: failed to write END data @0x%"
 524                       HWADDR_PRIx "\n", qaddr);
 525         return;
 526     }
 527
 528     qindex = (qindex + 1) & (qentries - 1);
 529     if (qindex == 0) {
 530         qgen ^= 1;
 531         end->w1 = xive_set_field32(END_W1_GENERATION, end->w1, qgen);
 532     }
 533     end->w1 = xive_set_field32(END_W1_PAGE_OFF, end->w1, qindex);
 534 }
 535
 536 /*
 537  * XIVE Router (aka. Virtualization Controller or IVRE)
 538  */
 539
 540 int xive_router_get_eas(XiveRouter *xrtr, uint8_t eas_blk, uint32_t eas_idx,
 541                         XiveEAS *eas)
 542 {
 543     XiveRouterClass *xrc = XIVE_ROUTER_GET_CLASS(xrtr);
 544
 545     return xrc->get_eas(xrtr, eas_blk, eas_idx, eas);
 546 }
 547
 548 int xive_router_get_end(XiveRouter *xrtr, uint8_t end_blk, uint32_t end_idx,
 549                         XiveEND *end)
 550 {
 551    XiveRouterClass *xrc = XIVE_ROUTER_GET_CLASS(xrtr);
 552
 553    return xrc->get_end(xrtr, end_blk, end_idx, end);
 554 }
 555
 556 int xive_router_write_end(XiveRouter *xrtr, uint8_t end_blk, uint32_t end_idx,
 557                           XiveEND *end, uint8_t word_number)
 558 {
 559    XiveRouterClass *xrc = XIVE_ROUTER_GET_CLASS(xrtr);
 560
 561    return xrc->write_end(xrtr, end_blk, end_idx, end, word_number);
 562 }
 563
 564 /*
 565  * An END trigger can come from an event trigger (IPI or HW) or from
 566  * another chip. We don't model the PowerBus but the END trigger
 567  * message has the same parameters than in the function below.
 568  */
 569 static void xive_router_end_notify(XiveRouter *xrtr, uint8_t end_blk,
 570                                    uint32_t end_idx, uint32_t end_data)
 571 {
 572     XiveEND end;
 573     uint8_t priority;
 574     uint8_t format;
 575
 576     /* END cache lookup */
 577     if (xive_router_get_end(xrtr, end_blk, end_idx, &end)) {
 578         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: No END %x/%x\n", end_blk,
 579                       end_idx);
 580         return;
 581     }
 582
 583     if (!xive_end_is_valid(&end)) {
 584         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: END %x/%x is invalid\n",
 585                       end_blk, end_idx);
 586         return;
 587     }
 588
 589     if (xive_end_is_enqueue(&end)) {
 590         xive_end_enqueue(&end, end_data);
 591         /* Enqueuing event data modifies the EQ toggle and index */
 592         xive_router_write_end(xrtr, end_blk, end_idx, &end, 1);
 593     }
 594
 595     /*
 596      * The W7 format depends on the F bit in W6. It defines the type
 597      * of the notification :
 598      *
 599      *   F=0 : single or multiple NVT notification
 600      *   F=1 : User level Event-Based Branch (EBB) notification, no
 601      *         priority
 602      */
 603     format = xive_get_field32(END_W6_FORMAT_BIT, end.w6);
 604     priority = xive_get_field32(END_W7_F0_PRIORITY, end.w7);
 605
 606     /* The END is masked */
 607     if (format == 0 && priority == 0xff) {
 608         return;
 609     }
 610
 611     /*
 612      * Check the END ESn (Event State Buffer for notification) for
 613      * even futher coalescing in the Router
 614      */
 615     if (!xive_end_is_notify(&end)) {
 616         uint8_t pq = xive_get_field32(END_W1_ESn, end.w1);
 617         bool notify = xive_esb_trigger(&pq);
 618
 619         if (pq != xive_get_field32(END_W1_ESn, end.w1)) {
 620             end.w1 = xive_set_field32(END_W1_ESn, end.w1, pq);
 621             xive_router_write_end(xrtr, end_blk, end_idx, &end, 1);
 622         }
 623
 624         /* ESn[Q]=1 : end of notification */
 625         if (!notify) {
 626             return;
 627         }
 628     }
 629
 630     /*
 631      * Follows IVPE notification
 632      */
 633 }
 634
 635 static void xive_router_notify(XiveNotifier *xn, uint32_t lisn)
 636 {
 637     XiveRouter *xrtr = XIVE_ROUTER(xn);
 638     uint8_t eas_blk = XIVE_SRCNO_BLOCK(lisn);
 639     uint32_t eas_idx = XIVE_SRCNO_INDEX(lisn);
 640     XiveEAS eas;
 641
 642     /* EAS cache lookup */
 643     if (xive_router_get_eas(xrtr, eas_blk, eas_idx, &eas)) {
 644         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: Unknown LISN %x\n", lisn);
 645         return;
 646     }
 647
 648     /*
 649      * The IVRE checks the State Bit Cache at this point. We skip the
 650      * SBC lookup because the state bits of the sources are modeled
 651      * internally in QEMU.
 652      */
 653
 654     if (!xive_eas_is_valid(&eas)) {
 655         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid LISN %x\n", lisn);
 656         return;
 657     }
 658
 659     if (xive_eas_is_masked(&eas)) {
 660         /* Notification completed */
 661         return;
 662     }
 663
 664     /*
 665      * The event trigger becomes an END trigger
 666      */
 667     xive_router_end_notify(xrtr,
 668                            xive_get_field64(EAS_END_BLOCK, eas.w),
 669                            xive_get_field64(EAS_END_INDEX, eas.w),
 670                            xive_get_field64(EAS_END_DATA,  eas.w));
 671 }
 672
 673 static void xive_router_class_init(ObjectClass *klass, void *data)
 674 {
 675     DeviceClass *dc = DEVICE_CLASS(klass);
 676     XiveNotifierClass *xnc = XIVE_NOTIFIER_CLASS(klass);
 677
 678     dc->desc    = "XIVE Router Engine";
 679     xnc->notify = xive_router_notify;
 680 }
 681
 682 static const TypeInfo xive_router_info = {
 683     .name          = TYPE_XIVE_ROUTER,
 684     .parent        = TYPE_SYS_BUS_DEVICE,
 685     .abstract      = true,
 686     .class_size    = sizeof(XiveRouterClass),
 687     .class_init    = xive_router_class_init,
 688     .interfaces    = (InterfaceInfo[]) {
 689         { TYPE_XIVE_NOTIFIER },
 690         { }
 691     }
 692 };
 693
 694 void xive_eas_pic_print_info(XiveEAS *eas, uint32_t lisn, Monitor *mon)
 695 {
 696     if (!xive_eas_is_valid(eas)) {
 697         return;
 698     }
 699
 700     monitor_printf(mon, "  %08x %s end:%02x/%04x data:%08x\n",
 701                    lisn, xive_eas_is_masked(eas) ? "M" : " ",
 702                    (uint8_t)  xive_get_field64(EAS_END_BLOCK, eas->w),
 703                    (uint32_t) xive_get_field64(EAS_END_INDEX, eas->w),
 704                    (uint32_t) xive_get_field64(EAS_END_DATA, eas->w));
 705 }
 706
 707 /*
 708  * END ESB MMIO loads
 709  */
 710 static uint64_t xive_end_source_read(void *opaque, hwaddr addr, unsigned size)
 711 {
 712     XiveENDSource *xsrc = XIVE_END_SOURCE(opaque);
 713     uint32_t offset = addr & 0xFFF;
 714     uint8_t end_blk;
 715     uint32_t end_idx;
 716     XiveEND end;
 717     uint32_t end_esmask;
 718     uint8_t pq;
 719     uint64_t ret = -1;
 720
 721     end_blk = xsrc->block_id;
 722     end_idx = addr >> (xsrc->esb_shift + 1);
 723
 724     if (xive_router_get_end(xsrc->xrtr, end_blk, end_idx, &end)) {
 725         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: No END %x/%x\n", end_blk,
 726                       end_idx);
 727         return -1;
 728     }
 729
 730     if (!xive_end_is_valid(&end)) {
 731         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: END %x/%x is invalid\n",
 732                       end_blk, end_idx);
 733         return -1;
 734     }
 735
 736     end_esmask = addr_is_even(addr, xsrc->esb_shift) ? END_W1_ESn : END_W1_ESe;
 737     pq = xive_get_field32(end_esmask, end.w1);
 738
 739     switch (offset) {
 740     case XIVE_ESB_LOAD_EOI ... XIVE_ESB_LOAD_EOI + 0x7FF:
 741         ret = xive_esb_eoi(&pq);
 742
 743         /* Forward the source event notification for routing ?? */
 744         break;
 745
 746     case XIVE_ESB_GET ... XIVE_ESB_GET + 0x3FF:
 747         ret = pq;
 748         break;
 749
 750     case XIVE_ESB_SET_PQ_00 ... XIVE_ESB_SET_PQ_00 + 0x0FF:
 751     case XIVE_ESB_SET_PQ_01 ... XIVE_ESB_SET_PQ_01 + 0x0FF:
 752     case XIVE_ESB_SET_PQ_10 ... XIVE_ESB_SET_PQ_10 + 0x0FF:
 753     case XIVE_ESB_SET_PQ_11 ... XIVE_ESB_SET_PQ_11 + 0x0FF:
 754         ret = xive_esb_set(&pq, (offset >> 8) & 0x3);
 755         break;
 756     default:
 757         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid END ESB load addr %d\n",
 758                       offset);
 759         return -1;
 760     }
 761
 762     if (pq != xive_get_field32(end_esmask, end.w1)) {
 763         end.w1 = xive_set_field32(end_esmask, end.w1, pq);
 764         xive_router_write_end(xsrc->xrtr, end_blk, end_idx, &end, 1);
 765     }
 766
 767     return ret;
 768 }
 769
 770 /*
 771  * END ESB MMIO stores are invalid
 772  */
 773 static void xive_end_source_write(void *opaque, hwaddr addr,
 774                                   uint64_t value, unsigned size)
 775 {
 776     qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid ESB write addr 0x%"
 777                   HWADDR_PRIx"\n", addr);
 778 }
 779
 780 static const MemoryRegionOps xive_end_source_ops = {
 781     .read = xive_end_source_read,
 782     .write = xive_end_source_write,
 783     .endianness = DEVICE_BIG_ENDIAN,
 784     .valid = {
 785         .min_access_size = 8,
 786         .max_access_size = 8,
 787     },
 788     .impl = {
 789         .min_access_size = 8,
 790         .max_access_size = 8,
 791     },
 792 };
 793
 794 static void xive_end_source_realize(DeviceState *dev, Error **errp)
 795 {
 796     XiveENDSource *xsrc = XIVE_END_SOURCE(dev);
 797     Object *obj;
 798     Error *local_err = NULL;
 799
 800     obj = object_property_get_link(OBJECT(dev), "xive", &local_err);
 801     if (!obj) {
 802         error_propagate(errp, local_err);
 803         error_prepend(errp, "required link 'xive' not found: ");
 804         return;
 805     }
 806
 807     xsrc->xrtr = XIVE_ROUTER(obj);
 808
 809     if (!xsrc->nr_ends) {
 810         error_setg(errp, "Number of interrupt needs to be greater than 0");
 811         return;
 812     }
 813
 814     if (xsrc->esb_shift != XIVE_ESB_4K &&
 815         xsrc->esb_shift != XIVE_ESB_64K) {
 816         error_setg(errp, "Invalid ESB shift setting");
 817         return;
 818     }
 819
 820     /*
 821      * Each END is assigned an even/odd pair of MMIO pages, the even page
 822      * manages the ESn field while the odd page manages the ESe field.
 823      */
 824     memory_region_init_io(&xsrc->esb_mmio, OBJECT(xsrc),
 825                           &xive_end_source_ops, xsrc, "xive.end",
 826                           (1ull << (xsrc->esb_shift + 1)) * xsrc->nr_ends);
 827 }
 828
 829 static Property xive_end_source_properties[] = {
 830     DEFINE_PROP_UINT8("block-id", XiveENDSource, block_id, 0),
 831     DEFINE_PROP_UINT32("nr-ends", XiveENDSource, nr_ends, 0),
 832     DEFINE_PROP_UINT32("shift", XiveENDSource, esb_shift, XIVE_ESB_64K),
 833     DEFINE_PROP_END_OF_LIST(),
 834 };
 835
 836 static void xive_end_source_class_init(ObjectClass *klass, void *data)
 837 {
 838     DeviceClass *dc = DEVICE_CLASS(klass);
 839
 840     dc->desc    = "XIVE END Source";
 841     dc->props   = xive_end_source_properties;
 842     dc->realize = xive_end_source_realize;
 843 }
 844
 845 static const TypeInfo xive_end_source_info = {
 846     .name          = TYPE_XIVE_END_SOURCE,
 847     .parent        = TYPE_DEVICE,
 848     .instance_size = sizeof(XiveENDSource),
 849     .class_init    = xive_end_source_class_init,
 850 };
 851
 852 /*
 853  * XIVE Fabric
 854  */
 855 static const TypeInfo xive_fabric_info = {
 856     .name = TYPE_XIVE_NOTIFIER,
 857     .parent = TYPE_INTERFACE,
 858     .class_size = sizeof(XiveNotifierClass),
 859 };
 860
 861 static void xive_register_types(void)
 862 {
 863     type_register_static(&xive_source_info);
 864     type_register_static(&xive_fabric_info);
 865     type_register_static(&xive_router_info);
 866     type_register_static(&xive_end_source_info);
 867 }
 868
 869 type_init(xive_register_types)