xref: /qemu/hw/intc/riscv_aplic.c (revision 3228d311ab1882f75b04d080d33a71fc7a0bcac5)
1 /*
2  * RISC-V APLIC (Advanced Platform Level Interrupt Controller)
3  *
4  * Copyright (c) 2021 Western Digital Corporation or its affiliates.
5  *
6  * This program is free software; you can redistribute it and/or modify it
7  * under the terms and conditions of the GNU General Public License,
8  * version 2 or later, as published by the Free Software Foundation.
9  *
10  * This program is distributed in the hope it will be useful, but WITHOUT
11  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
12  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
13  * more details.
14  *
15  * You should have received a copy of the GNU General Public License along with
16  * this program.  If not, see <http://www.gnu.org/licenses/>.
17  */
18 
19 #include "qemu/osdep.h"
20 #include "qapi/error.h"
21 #include "qemu/log.h"
22 #include "qemu/module.h"
23 #include "qemu/error-report.h"
24 #include "qemu/bswap.h"
25 #include "exec/address-spaces.h"
26 #include "hw/sysbus.h"
27 #include "hw/pci/msi.h"
28 #include "hw/boards.h"
29 #include "hw/qdev-properties.h"
30 #include "hw/intc/riscv_aplic.h"
31 #include "hw/irq.h"
32 #include "target/riscv/cpu.h"
33 #include "system/system.h"
34 #include "system/kvm.h"
35 #include "system/tcg.h"
36 #include "kvm/kvm_riscv.h"
37 #include "migration/vmstate.h"
38 
39 #define APLIC_MAX_IDC                  (1UL << 14)
40 #define APLIC_MAX_SOURCE               1024
41 #define APLIC_MIN_IPRIO_BITS           1
42 #define APLIC_MAX_IPRIO_BITS           8
43 #define APLIC_MAX_CHILDREN             1024
44 
45 #define APLIC_DOMAINCFG                0x0000
46 #define APLIC_DOMAINCFG_RDONLY         0x80000000
47 #define APLIC_DOMAINCFG_IE             (1 << 8)
48 #define APLIC_DOMAINCFG_DM             (1 << 2)
49 #define APLIC_DOMAINCFG_BE             (1 << 0)
50 
51 #define APLIC_SOURCECFG_BASE           0x0004
52 #define APLIC_SOURCECFG_D              (1 << 10)
53 #define APLIC_SOURCECFG_CHILDIDX_MASK  0x000003ff
54 #define APLIC_SOURCECFG_SM_MASK        0x00000007
55 #define APLIC_SOURCECFG_SM_INACTIVE    0x0
56 #define APLIC_SOURCECFG_SM_DETACH      0x1
57 #define APLIC_SOURCECFG_SM_EDGE_RISE   0x4
58 #define APLIC_SOURCECFG_SM_EDGE_FALL   0x5
59 #define APLIC_SOURCECFG_SM_LEVEL_HIGH  0x6
60 #define APLIC_SOURCECFG_SM_LEVEL_LOW   0x7
61 
62 #define APLIC_MMSICFGADDR              0x1bc0
63 #define APLIC_MMSICFGADDRH             0x1bc4
64 #define APLIC_SMSICFGADDR              0x1bc8
65 #define APLIC_SMSICFGADDRH             0x1bcc
66 
67 #define APLIC_xMSICFGADDRH_L           (1UL << 31)
68 #define APLIC_xMSICFGADDRH_HHXS_MASK   0x1f
69 #define APLIC_xMSICFGADDRH_HHXS_SHIFT  24
70 #define APLIC_xMSICFGADDRH_LHXS_MASK   0x7
71 #define APLIC_xMSICFGADDRH_LHXS_SHIFT  20
72 #define APLIC_xMSICFGADDRH_HHXW_MASK   0x7
73 #define APLIC_xMSICFGADDRH_HHXW_SHIFT  16
74 #define APLIC_xMSICFGADDRH_LHXW_MASK   0xf
75 #define APLIC_xMSICFGADDRH_LHXW_SHIFT  12
76 #define APLIC_xMSICFGADDRH_BAPPN_MASK  0xfff
77 
78 #define APLIC_xMSICFGADDR_PPN_SHIFT    12
79 
80 #define APLIC_xMSICFGADDR_PPN_HART(__lhxs) \
81     ((1UL << (__lhxs)) - 1)
82 
83 #define APLIC_xMSICFGADDR_PPN_LHX_MASK(__lhxw) \
84     ((1UL << (__lhxw)) - 1)
85 #define APLIC_xMSICFGADDR_PPN_LHX_SHIFT(__lhxs) \
86     ((__lhxs))
87 #define APLIC_xMSICFGADDR_PPN_LHX(__lhxw, __lhxs) \
88     (APLIC_xMSICFGADDR_PPN_LHX_MASK(__lhxw) << \
89      APLIC_xMSICFGADDR_PPN_LHX_SHIFT(__lhxs))
90 
91 #define APLIC_xMSICFGADDR_PPN_HHX_MASK(__hhxw) \
92     ((1UL << (__hhxw)) - 1)
93 #define APLIC_xMSICFGADDR_PPN_HHX_SHIFT(__hhxs) \
94     ((__hhxs) + APLIC_xMSICFGADDR_PPN_SHIFT)
95 #define APLIC_xMSICFGADDR_PPN_HHX(__hhxw, __hhxs) \
96     (APLIC_xMSICFGADDR_PPN_HHX_MASK(__hhxw) << \
97      APLIC_xMSICFGADDR_PPN_HHX_SHIFT(__hhxs))
98 
99 #define APLIC_xMSICFGADDRH_VALID_MASK   \
100     (APLIC_xMSICFGADDRH_L | \
101      (APLIC_xMSICFGADDRH_HHXS_MASK << APLIC_xMSICFGADDRH_HHXS_SHIFT) | \
102      (APLIC_xMSICFGADDRH_LHXS_MASK << APLIC_xMSICFGADDRH_LHXS_SHIFT) | \
103      (APLIC_xMSICFGADDRH_HHXW_MASK << APLIC_xMSICFGADDRH_HHXW_SHIFT) | \
104      (APLIC_xMSICFGADDRH_LHXW_MASK << APLIC_xMSICFGADDRH_LHXW_SHIFT) | \
105      APLIC_xMSICFGADDRH_BAPPN_MASK)
106 
107 #define APLIC_SETIP_BASE               0x1c00
108 #define APLIC_SETIPNUM                 0x1cdc
109 
110 #define APLIC_CLRIP_BASE               0x1d00
111 #define APLIC_CLRIPNUM                 0x1ddc
112 
113 #define APLIC_SETIE_BASE               0x1e00
114 #define APLIC_SETIENUM                 0x1edc
115 
116 #define APLIC_CLRIE_BASE               0x1f00
117 #define APLIC_CLRIENUM                 0x1fdc
118 
119 #define APLIC_SETIPNUM_LE              0x2000
120 #define APLIC_SETIPNUM_BE              0x2004
121 
122 #define APLIC_ISTATE_PENDING           (1U << 0)
123 #define APLIC_ISTATE_ENABLED           (1U << 1)
124 #define APLIC_ISTATE_ENPEND            (APLIC_ISTATE_ENABLED | \
125                                         APLIC_ISTATE_PENDING)
126 #define APLIC_ISTATE_INPUT             (1U << 8)
127 
128 #define APLIC_GENMSI                   0x3000
129 
130 #define APLIC_TARGET_BASE              0x3004
131 #define APLIC_TARGET_HART_IDX_SHIFT    18
132 #define APLIC_TARGET_HART_IDX_MASK     0x3fff
133 #define APLIC_TARGET_GUEST_IDX_SHIFT   12
134 #define APLIC_TARGET_GUEST_IDX_MASK    0x3f
135 #define APLIC_TARGET_IPRIO_MASK        0xff
136 #define APLIC_TARGET_EIID_MASK         0x7ff
137 
138 #define APLIC_IDC_BASE                 0x4000
139 #define APLIC_IDC_SIZE                 32
140 
141 #define APLIC_IDC_IDELIVERY            0x00
142 
143 #define APLIC_IDC_IFORCE               0x04
144 
145 #define APLIC_IDC_ITHRESHOLD           0x08
146 
147 #define APLIC_IDC_TOPI                 0x18
148 #define APLIC_IDC_TOPI_ID_SHIFT        16
149 #define APLIC_IDC_TOPI_ID_MASK         0x3ff
150 #define APLIC_IDC_TOPI_PRIO_MASK       0xff
151 
152 #define APLIC_IDC_CLAIMI               0x1c
153 
154 /*
155  * KVM AIA only supports APLIC MSI, fallback to QEMU emulation if we want to use
156  * APLIC Wired.
157  */
158 bool riscv_is_kvm_aia_aplic_imsic(bool msimode)
159 {
160     return kvm_irqchip_in_kernel() && msimode;
161 }
162 
163 bool riscv_use_emulated_aplic(bool msimode)
164 {
165 #ifdef CONFIG_KVM
166     if (tcg_enabled()) {
167         return true;
168     }
169 
170     if (!riscv_is_kvm_aia_aplic_imsic(msimode)) {
171         return true;
172     }
173 
174     return kvm_kernel_irqchip_split();
175 #else
176     return true;
177 #endif
178 }
179 
180 void riscv_aplic_set_kvm_msicfgaddr(RISCVAPLICState *aplic, hwaddr addr)
181 {
182 #ifdef CONFIG_KVM
183     if (riscv_use_emulated_aplic(aplic->msimode)) {
184         addr >>= APLIC_xMSICFGADDR_PPN_SHIFT;
185         aplic->kvm_msicfgaddr = extract64(addr, 0, 32);
186         aplic->kvm_msicfgaddrH = extract64(addr, 32, 32) &
187                                  APLIC_xMSICFGADDRH_VALID_MASK;
188     }
189 #endif
190 }
191 
192 static bool riscv_aplic_irq_rectified_val(RISCVAPLICState *aplic,
193                                           uint32_t irq)
194 {
195     uint32_t sourcecfg, sm, raw_input, irq_inverted;
196 
197     if (!irq || aplic->num_irqs <= irq) {
198         return false;
199     }
200 
201     sourcecfg = aplic->sourcecfg[irq];
202     if (sourcecfg & APLIC_SOURCECFG_D) {
203         return false;
204     }
205 
206     sm = sourcecfg & APLIC_SOURCECFG_SM_MASK;
207     if (sm == APLIC_SOURCECFG_SM_INACTIVE) {
208         return false;
209     }
210 
211     raw_input = (aplic->state[irq] & APLIC_ISTATE_INPUT) ? 1 : 0;
212     irq_inverted = (sm == APLIC_SOURCECFG_SM_LEVEL_LOW ||
213                     sm == APLIC_SOURCECFG_SM_EDGE_FALL) ? 1 : 0;
214 
215     return !!(raw_input ^ irq_inverted);
216 }
217 
218 static uint32_t riscv_aplic_read_input_word(RISCVAPLICState *aplic,
219                                             uint32_t word)
220 {
221     uint32_t i, irq, rectified_val, ret = 0;
222 
223     for (i = 0; i < 32; i++) {
224         irq = word * 32 + i;
225 
226         rectified_val = riscv_aplic_irq_rectified_val(aplic, irq);
227         ret |= rectified_val << i;
228     }
229 
230     return ret;
231 }
232 
233 static uint32_t riscv_aplic_read_pending_word(RISCVAPLICState *aplic,
234                                               uint32_t word)
235 {
236     uint32_t i, irq, ret = 0;
237 
238     for (i = 0; i < 32; i++) {
239         irq = word * 32 + i;
240         if (!irq || aplic->num_irqs <= irq) {
241             continue;
242         }
243 
244         ret |= ((aplic->state[irq] & APLIC_ISTATE_PENDING) ? 1 : 0) << i;
245     }
246 
247     return ret;
248 }
249 
250 static void riscv_aplic_set_pending_raw(RISCVAPLICState *aplic,
251                                         uint32_t irq, bool pending)
252 {
253     if (pending) {
254         aplic->state[irq] |= APLIC_ISTATE_PENDING;
255     } else {
256         aplic->state[irq] &= ~APLIC_ISTATE_PENDING;
257     }
258 }
259 
260 static void riscv_aplic_set_pending(RISCVAPLICState *aplic,
261                                     uint32_t irq, bool pending)
262 {
263     uint32_t sourcecfg, sm;
264 
265     if ((irq <= 0) || (aplic->num_irqs <= irq)) {
266         return;
267     }
268 
269     sourcecfg = aplic->sourcecfg[irq];
270     if (sourcecfg & APLIC_SOURCECFG_D) {
271         return;
272     }
273 
274     sm = sourcecfg & APLIC_SOURCECFG_SM_MASK;
275     if (sm == APLIC_SOURCECFG_SM_INACTIVE) {
276         return;
277     }
278 
279     if ((sm == APLIC_SOURCECFG_SM_LEVEL_HIGH) ||
280         (sm == APLIC_SOURCECFG_SM_LEVEL_LOW)) {
281         if (!aplic->msimode) {
282             return;
283         }
284         if (aplic->msimode && !pending) {
285             goto noskip_write_pending;
286         }
287         if ((aplic->state[irq] & APLIC_ISTATE_INPUT) &&
288             (sm == APLIC_SOURCECFG_SM_LEVEL_LOW)) {
289             return;
290         }
291         if (!(aplic->state[irq] & APLIC_ISTATE_INPUT) &&
292             (sm == APLIC_SOURCECFG_SM_LEVEL_HIGH)) {
293             return;
294         }
295     }
296 
297 noskip_write_pending:
298     riscv_aplic_set_pending_raw(aplic, irq, pending);
299 }
300 
301 static void riscv_aplic_set_pending_word(RISCVAPLICState *aplic,
302                                          uint32_t word, uint32_t value,
303                                          bool pending)
304 {
305     uint32_t i, irq;
306 
307     for (i = 0; i < 32; i++) {
308         irq = word * 32 + i;
309         if (!irq || aplic->num_irqs <= irq) {
310             continue;
311         }
312 
313         if (value & (1U << i)) {
314             riscv_aplic_set_pending(aplic, irq, pending);
315         }
316     }
317 }
318 
319 static uint32_t riscv_aplic_read_enabled_word(RISCVAPLICState *aplic,
320                                               int word)
321 {
322     uint32_t i, irq, ret = 0;
323 
324     for (i = 0; i < 32; i++) {
325         irq = word * 32 + i;
326         if (!irq || aplic->num_irqs <= irq) {
327             continue;
328         }
329 
330         ret |= ((aplic->state[irq] & APLIC_ISTATE_ENABLED) ? 1 : 0) << i;
331     }
332 
333     return ret;
334 }
335 
336 static void riscv_aplic_set_enabled_raw(RISCVAPLICState *aplic,
337                                         uint32_t irq, bool enabled)
338 {
339     if (enabled) {
340         aplic->state[irq] |= APLIC_ISTATE_ENABLED;
341     } else {
342         aplic->state[irq] &= ~APLIC_ISTATE_ENABLED;
343     }
344 }
345 
346 static void riscv_aplic_set_enabled(RISCVAPLICState *aplic,
347                                     uint32_t irq, bool enabled)
348 {
349     uint32_t sourcecfg, sm;
350 
351     if ((irq <= 0) || (aplic->num_irqs <= irq)) {
352         return;
353     }
354 
355     sourcecfg = aplic->sourcecfg[irq];
356     if (sourcecfg & APLIC_SOURCECFG_D) {
357         return;
358     }
359 
360     sm = sourcecfg & APLIC_SOURCECFG_SM_MASK;
361     if (sm == APLIC_SOURCECFG_SM_INACTIVE) {
362         return;
363     }
364 
365     riscv_aplic_set_enabled_raw(aplic, irq, enabled);
366 }
367 
368 static void riscv_aplic_set_enabled_word(RISCVAPLICState *aplic,
369                                          uint32_t word, uint32_t value,
370                                          bool enabled)
371 {
372     uint32_t i, irq;
373 
374     for (i = 0; i < 32; i++) {
375         irq = word * 32 + i;
376         if (!irq || aplic->num_irqs <= irq) {
377             continue;
378         }
379 
380         if (value & (1U << i)) {
381             riscv_aplic_set_enabled(aplic, irq, enabled);
382         }
383     }
384 }
385 
386 static void riscv_aplic_msi_send(RISCVAPLICState *aplic,
387                                  uint32_t hart_idx, uint32_t guest_idx,
388                                  uint32_t eiid)
389 {
390     uint64_t addr;
391     MemTxResult result;
392     RISCVAPLICState *aplic_m;
393     uint32_t lhxs, lhxw, hhxs, hhxw, group_idx, msicfgaddr, msicfgaddrH;
394 
395     aplic_m = aplic;
396 
397     if (!aplic->kvm_splitmode) {
398         while (aplic_m && !aplic_m->mmode) {
399             aplic_m = aplic_m->parent;
400         }
401         if (!aplic_m) {
402             qemu_log_mask(LOG_GUEST_ERROR, "%s: m-level APLIC not found\n",
403                           __func__);
404             return;
405         }
406     }
407 
408     if (aplic->kvm_splitmode) {
409         msicfgaddr = aplic->kvm_msicfgaddr;
410         msicfgaddrH = ((uint64_t)aplic->kvm_msicfgaddrH << 32);
411     } else {
412         if (aplic->mmode) {
413             msicfgaddr = aplic_m->mmsicfgaddr;
414             msicfgaddrH = aplic_m->mmsicfgaddrH;
415         } else {
416             msicfgaddr = aplic_m->smsicfgaddr;
417             msicfgaddrH = aplic_m->smsicfgaddrH;
418         }
419     }
420 
421     lhxs = (msicfgaddrH >> APLIC_xMSICFGADDRH_LHXS_SHIFT) &
422             APLIC_xMSICFGADDRH_LHXS_MASK;
423     lhxw = (msicfgaddrH >> APLIC_xMSICFGADDRH_LHXW_SHIFT) &
424             APLIC_xMSICFGADDRH_LHXW_MASK;
425     hhxs = (msicfgaddrH >> APLIC_xMSICFGADDRH_HHXS_SHIFT) &
426             APLIC_xMSICFGADDRH_HHXS_MASK;
427     hhxw = (msicfgaddrH >> APLIC_xMSICFGADDRH_HHXW_SHIFT) &
428             APLIC_xMSICFGADDRH_HHXW_MASK;
429 
430     group_idx = hart_idx >> lhxw;
431 
432     addr = msicfgaddr;
433     addr |= ((uint64_t)(msicfgaddrH & APLIC_xMSICFGADDRH_BAPPN_MASK)) << 32;
434     addr |= ((uint64_t)(group_idx & APLIC_xMSICFGADDR_PPN_HHX_MASK(hhxw))) <<
435              APLIC_xMSICFGADDR_PPN_HHX_SHIFT(hhxs);
436     addr |= ((uint64_t)(hart_idx & APLIC_xMSICFGADDR_PPN_LHX_MASK(lhxw))) <<
437              APLIC_xMSICFGADDR_PPN_LHX_SHIFT(lhxs);
438     addr |= (uint64_t)(guest_idx & APLIC_xMSICFGADDR_PPN_HART(lhxs));
439     addr <<= APLIC_xMSICFGADDR_PPN_SHIFT;
440 
441     address_space_stl_le(&address_space_memory, addr,
442                          eiid, MEMTXATTRS_UNSPECIFIED, &result);
443     if (result != MEMTX_OK) {
444         qemu_log_mask(LOG_GUEST_ERROR, "%s: MSI write failed for "
445                       "hart_index=%d guest_index=%d eiid=%d\n",
446                       __func__, hart_idx, guest_idx, eiid);
447     }
448 }
449 
450 static void riscv_aplic_msi_irq_update(RISCVAPLICState *aplic, uint32_t irq)
451 {
452     uint32_t hart_idx, guest_idx, eiid;
453 
454     if (!aplic->msimode || (aplic->num_irqs <= irq) ||
455         !(aplic->domaincfg & APLIC_DOMAINCFG_IE)) {
456         return;
457     }
458 
459     if ((aplic->state[irq] & APLIC_ISTATE_ENPEND) != APLIC_ISTATE_ENPEND) {
460         return;
461     }
462 
463     riscv_aplic_set_pending_raw(aplic, irq, false);
464 
465     hart_idx = aplic->target[irq] >> APLIC_TARGET_HART_IDX_SHIFT;
466     hart_idx &= APLIC_TARGET_HART_IDX_MASK;
467     if (aplic->mmode) {
468         /* M-level APLIC ignores guest_index */
469         guest_idx = 0;
470     } else {
471         guest_idx = aplic->target[irq] >> APLIC_TARGET_GUEST_IDX_SHIFT;
472         guest_idx &= APLIC_TARGET_GUEST_IDX_MASK;
473     }
474     eiid = aplic->target[irq] & APLIC_TARGET_EIID_MASK;
475     riscv_aplic_msi_send(aplic, hart_idx, guest_idx, eiid);
476 }
477 
478 static uint32_t riscv_aplic_idc_topi(RISCVAPLICState *aplic, uint32_t idc)
479 {
480     uint32_t best_irq, best_iprio;
481     uint32_t irq, iprio, ihartidx, ithres;
482 
483     if (aplic->num_harts <= idc) {
484         return 0;
485     }
486 
487     ithres = aplic->ithreshold[idc];
488     best_irq = best_iprio = UINT32_MAX;
489     for (irq = 1; irq < aplic->num_irqs; irq++) {
490         if ((aplic->state[irq] & APLIC_ISTATE_ENPEND) !=
491             APLIC_ISTATE_ENPEND) {
492             continue;
493         }
494 
495         ihartidx = aplic->target[irq] >> APLIC_TARGET_HART_IDX_SHIFT;
496         ihartidx &= APLIC_TARGET_HART_IDX_MASK;
497         if (ihartidx != idc) {
498             continue;
499         }
500 
501         iprio = aplic->target[irq] & aplic->iprio_mask;
502         if (ithres && iprio >= ithres) {
503             continue;
504         }
505 
506         if (iprio < best_iprio) {
507             best_irq = irq;
508             best_iprio = iprio;
509         }
510     }
511 
512     if (best_irq < aplic->num_irqs && best_iprio <= aplic->iprio_mask) {
513         return (best_irq << APLIC_IDC_TOPI_ID_SHIFT) | best_iprio;
514     }
515 
516     return 0;
517 }
518 
519 static void riscv_aplic_idc_update(RISCVAPLICState *aplic, uint32_t idc)
520 {
521     uint32_t topi;
522 
523     if (aplic->msimode || aplic->num_harts <= idc) {
524         return;
525     }
526 
527     topi = riscv_aplic_idc_topi(aplic, idc);
528     if ((aplic->domaincfg & APLIC_DOMAINCFG_IE) &&
529         aplic->idelivery[idc] &&
530         (aplic->iforce[idc] || topi)) {
531         qemu_irq_raise(aplic->external_irqs[idc]);
532     } else {
533         qemu_irq_lower(aplic->external_irqs[idc]);
534     }
535 }
536 
537 static uint32_t riscv_aplic_idc_claimi(RISCVAPLICState *aplic, uint32_t idc)
538 {
539     uint32_t irq, state, sm, topi = riscv_aplic_idc_topi(aplic, idc);
540 
541     if (!topi) {
542         aplic->iforce[idc] = 0;
543         riscv_aplic_idc_update(aplic, idc);
544         return 0;
545     }
546 
547     irq = (topi >> APLIC_IDC_TOPI_ID_SHIFT) & APLIC_IDC_TOPI_ID_MASK;
548     sm = aplic->sourcecfg[irq] & APLIC_SOURCECFG_SM_MASK;
549     state = aplic->state[irq];
550     riscv_aplic_set_pending_raw(aplic, irq, false);
551     if ((sm == APLIC_SOURCECFG_SM_LEVEL_HIGH) &&
552         (state & APLIC_ISTATE_INPUT)) {
553         riscv_aplic_set_pending_raw(aplic, irq, true);
554     } else if ((sm == APLIC_SOURCECFG_SM_LEVEL_LOW) &&
555                !(state & APLIC_ISTATE_INPUT)) {
556         riscv_aplic_set_pending_raw(aplic, irq, true);
557     }
558     riscv_aplic_idc_update(aplic, idc);
559 
560     return topi;
561 }
562 
563 static void riscv_aplic_request(void *opaque, int irq, int level)
564 {
565     bool update = false;
566     RISCVAPLICState *aplic = opaque;
567     uint32_t sourcecfg, childidx, state, idc;
568 
569     assert((0 < irq) && (irq < aplic->num_irqs));
570 
571     sourcecfg = aplic->sourcecfg[irq];
572     if (sourcecfg & APLIC_SOURCECFG_D) {
573         childidx = sourcecfg & APLIC_SOURCECFG_CHILDIDX_MASK;
574         if (childidx < aplic->num_children) {
575             riscv_aplic_request(aplic->children[childidx], irq, level);
576         }
577         return;
578     }
579 
580     state = aplic->state[irq];
581     switch (sourcecfg & APLIC_SOURCECFG_SM_MASK) {
582     case APLIC_SOURCECFG_SM_EDGE_RISE:
583         if ((level > 0) && !(state & APLIC_ISTATE_INPUT) &&
584             !(state & APLIC_ISTATE_PENDING)) {
585             riscv_aplic_set_pending_raw(aplic, irq, true);
586             update = true;
587         }
588         break;
589     case APLIC_SOURCECFG_SM_EDGE_FALL:
590         if ((level <= 0) && (state & APLIC_ISTATE_INPUT) &&
591             !(state & APLIC_ISTATE_PENDING)) {
592             riscv_aplic_set_pending_raw(aplic, irq, true);
593             update = true;
594         }
595         break;
596     case APLIC_SOURCECFG_SM_LEVEL_HIGH:
597         if ((level > 0) && !(state & APLIC_ISTATE_PENDING)) {
598             riscv_aplic_set_pending_raw(aplic, irq, true);
599             update = true;
600         }
601         break;
602     case APLIC_SOURCECFG_SM_LEVEL_LOW:
603         if ((level <= 0) && !(state & APLIC_ISTATE_PENDING)) {
604             riscv_aplic_set_pending_raw(aplic, irq, true);
605             update = true;
606         }
607         break;
608     default:
609         break;
610     }
611 
612     if (level <= 0) {
613         aplic->state[irq] &= ~APLIC_ISTATE_INPUT;
614     } else {
615         aplic->state[irq] |= APLIC_ISTATE_INPUT;
616     }
617 
618     if (update) {
619         if (aplic->msimode) {
620             riscv_aplic_msi_irq_update(aplic, irq);
621         } else {
622             idc = aplic->target[irq] >> APLIC_TARGET_HART_IDX_SHIFT;
623             idc &= APLIC_TARGET_HART_IDX_MASK;
624             riscv_aplic_idc_update(aplic, idc);
625         }
626     }
627 }
628 
629 static uint64_t riscv_aplic_read(void *opaque, hwaddr addr, unsigned size)
630 {
631     uint32_t irq, word, idc;
632     RISCVAPLICState *aplic = opaque;
633 
634     /* Reads must be 4 byte words */
635     if ((addr & 0x3) != 0) {
636         goto err;
637     }
638 
639     if (addr == APLIC_DOMAINCFG) {
640         return APLIC_DOMAINCFG_RDONLY | aplic->domaincfg |
641                (aplic->msimode ? APLIC_DOMAINCFG_DM : 0);
642     } else if ((APLIC_SOURCECFG_BASE <= addr) &&
643             (addr < (APLIC_SOURCECFG_BASE + (aplic->num_irqs - 1) * 4))) {
644         irq  = ((addr - APLIC_SOURCECFG_BASE) >> 2) + 1;
645         return aplic->sourcecfg[irq];
646     } else if (aplic->mmode && aplic->msimode &&
647                (addr == APLIC_MMSICFGADDR)) {
648         return aplic->mmsicfgaddr;
649     } else if (aplic->mmode && aplic->msimode &&
650                (addr == APLIC_MMSICFGADDRH)) {
651         return aplic->mmsicfgaddrH;
652     } else if (aplic->mmode && aplic->msimode &&
653                (addr == APLIC_SMSICFGADDR)) {
654         /*
655          * Registers SMSICFGADDR and SMSICFGADDRH are implemented only if:
656          * (a) the interrupt domain is at machine level
657          * (b) the domain's harts implement supervisor mode
658          * (c) the domain has one or more child supervisor-level domains
659          *     that support MSI delivery mode (domaincfg.DM is not read-
660          *     only zero in at least one of the supervisor-level child
661          * domains).
662          */
663         return (aplic->num_children) ? aplic->smsicfgaddr : 0;
664     } else if (aplic->mmode && aplic->msimode &&
665                (addr == APLIC_SMSICFGADDRH)) {
666         return (aplic->num_children) ? aplic->smsicfgaddrH : 0;
667     } else if ((APLIC_SETIP_BASE <= addr) &&
668             (addr < (APLIC_SETIP_BASE + aplic->bitfield_words * 4))) {
669         word = (addr - APLIC_SETIP_BASE) >> 2;
670         return riscv_aplic_read_pending_word(aplic, word);
671     } else if (addr == APLIC_SETIPNUM) {
672         return 0;
673     } else if ((APLIC_CLRIP_BASE <= addr) &&
674             (addr < (APLIC_CLRIP_BASE + aplic->bitfield_words * 4))) {
675         word = (addr - APLIC_CLRIP_BASE) >> 2;
676         return riscv_aplic_read_input_word(aplic, word);
677     } else if (addr == APLIC_CLRIPNUM) {
678         return 0;
679     } else if ((APLIC_SETIE_BASE <= addr) &&
680             (addr < (APLIC_SETIE_BASE + aplic->bitfield_words * 4))) {
681         word = (addr - APLIC_SETIE_BASE) >> 2;
682         return riscv_aplic_read_enabled_word(aplic, word);
683     } else if (addr == APLIC_SETIENUM) {
684         return 0;
685     } else if ((APLIC_CLRIE_BASE <= addr) &&
686             (addr < (APLIC_CLRIE_BASE + aplic->bitfield_words * 4))) {
687         return 0;
688     } else if (addr == APLIC_CLRIENUM) {
689         return 0;
690     } else if (addr == APLIC_SETIPNUM_LE) {
691         return 0;
692     } else if (addr == APLIC_SETIPNUM_BE) {
693         return 0;
694     } else if (addr == APLIC_GENMSI) {
695         return (aplic->msimode) ? aplic->genmsi : 0;
696     } else if ((APLIC_TARGET_BASE <= addr) &&
697             (addr < (APLIC_TARGET_BASE + (aplic->num_irqs - 1) * 4))) {
698         irq = ((addr - APLIC_TARGET_BASE) >> 2) + 1;
699         return aplic->target[irq];
700     } else if (!aplic->msimode && (APLIC_IDC_BASE <= addr) &&
701             (addr < (APLIC_IDC_BASE + aplic->num_harts * APLIC_IDC_SIZE))) {
702         idc = (addr - APLIC_IDC_BASE) / APLIC_IDC_SIZE;
703         switch (addr - (APLIC_IDC_BASE + idc * APLIC_IDC_SIZE)) {
704         case APLIC_IDC_IDELIVERY:
705             return aplic->idelivery[idc];
706         case APLIC_IDC_IFORCE:
707             return aplic->iforce[idc];
708         case APLIC_IDC_ITHRESHOLD:
709             return aplic->ithreshold[idc];
710         case APLIC_IDC_TOPI:
711             return riscv_aplic_idc_topi(aplic, idc);
712         case APLIC_IDC_CLAIMI:
713             return riscv_aplic_idc_claimi(aplic, idc);
714         default:
715             goto err;
716         };
717     }
718 
719 err:
720     qemu_log_mask(LOG_GUEST_ERROR,
721                   "%s: Invalid register read 0x%" HWADDR_PRIx "\n",
722                   __func__, addr);
723     return 0;
724 }
725 
726 static void riscv_aplic_write(void *opaque, hwaddr addr, uint64_t value,
727         unsigned size)
728 {
729     RISCVAPLICState *aplic = opaque;
730     uint32_t irq, word, idc = UINT32_MAX;
731 
732     /* Writes must be 4 byte words */
733     if ((addr & 0x3) != 0) {
734         goto err;
735     }
736 
737     if (addr == APLIC_DOMAINCFG) {
738         /* Only IE bit writable at the moment */
739         value &= APLIC_DOMAINCFG_IE;
740         aplic->domaincfg = value;
741     } else if ((APLIC_SOURCECFG_BASE <= addr) &&
742             (addr < (APLIC_SOURCECFG_BASE + (aplic->num_irqs - 1) * 4))) {
743         irq  = ((addr - APLIC_SOURCECFG_BASE) >> 2) + 1;
744         if (!aplic->num_children && (value & APLIC_SOURCECFG_D)) {
745             value = 0;
746         }
747         if (value & APLIC_SOURCECFG_D) {
748             value &= (APLIC_SOURCECFG_D | APLIC_SOURCECFG_CHILDIDX_MASK);
749         } else {
750             value &= (APLIC_SOURCECFG_D | APLIC_SOURCECFG_SM_MASK);
751         }
752         aplic->sourcecfg[irq] = value;
753         if ((aplic->sourcecfg[irq] & APLIC_SOURCECFG_D) ||
754             (aplic->sourcecfg[irq] == 0)) {
755             riscv_aplic_set_pending_raw(aplic, irq, false);
756             riscv_aplic_set_enabled_raw(aplic, irq, false);
757         } else {
758             if (riscv_aplic_irq_rectified_val(aplic, irq)) {
759                 riscv_aplic_set_pending_raw(aplic, irq, true);
760             }
761         }
762     } else if (aplic->mmode && aplic->msimode &&
763                (addr == APLIC_MMSICFGADDR)) {
764         if (!(aplic->mmsicfgaddrH & APLIC_xMSICFGADDRH_L)) {
765             aplic->mmsicfgaddr = value;
766         }
767     } else if (aplic->mmode && aplic->msimode &&
768                (addr == APLIC_MMSICFGADDRH)) {
769         if (!(aplic->mmsicfgaddrH & APLIC_xMSICFGADDRH_L)) {
770             aplic->mmsicfgaddrH = value & APLIC_xMSICFGADDRH_VALID_MASK;
771         }
772     } else if (aplic->mmode && aplic->msimode &&
773                (addr == APLIC_SMSICFGADDR)) {
774         /*
775          * Registers SMSICFGADDR and SMSICFGADDRH are implemented only if:
776          * (a) the interrupt domain is at machine level
777          * (b) the domain's harts implement supervisor mode
778          * (c) the domain has one or more child supervisor-level domains
779          *     that support MSI delivery mode (domaincfg.DM is not read-
780          *     only zero in at least one of the supervisor-level child
781          * domains).
782          */
783         if (aplic->num_children &&
784             !(aplic->mmsicfgaddrH & APLIC_xMSICFGADDRH_L)) {
785             aplic->smsicfgaddr = value;
786         }
787     } else if (aplic->mmode && aplic->msimode &&
788                (addr == APLIC_SMSICFGADDRH)) {
789         if (aplic->num_children &&
790             !(aplic->mmsicfgaddrH & APLIC_xMSICFGADDRH_L)) {
791             aplic->smsicfgaddrH = value & APLIC_xMSICFGADDRH_VALID_MASK;
792         }
793     } else if ((APLIC_SETIP_BASE <= addr) &&
794             (addr < (APLIC_SETIP_BASE + aplic->bitfield_words * 4))) {
795         word = (addr - APLIC_SETIP_BASE) >> 2;
796         riscv_aplic_set_pending_word(aplic, word, value, true);
797     } else if (addr == APLIC_SETIPNUM) {
798         riscv_aplic_set_pending(aplic, value, true);
799     } else if ((APLIC_CLRIP_BASE <= addr) &&
800             (addr < (APLIC_CLRIP_BASE + aplic->bitfield_words * 4))) {
801         word = (addr - APLIC_CLRIP_BASE) >> 2;
802         riscv_aplic_set_pending_word(aplic, word, value, false);
803     } else if (addr == APLIC_CLRIPNUM) {
804         riscv_aplic_set_pending(aplic, value, false);
805     } else if ((APLIC_SETIE_BASE <= addr) &&
806             (addr < (APLIC_SETIE_BASE + aplic->bitfield_words * 4))) {
807         word = (addr - APLIC_SETIE_BASE) >> 2;
808         riscv_aplic_set_enabled_word(aplic, word, value, true);
809     } else if (addr == APLIC_SETIENUM) {
810         riscv_aplic_set_enabled(aplic, value, true);
811     } else if ((APLIC_CLRIE_BASE <= addr) &&
812             (addr < (APLIC_CLRIE_BASE + aplic->bitfield_words * 4))) {
813         word = (addr - APLIC_CLRIE_BASE) >> 2;
814         riscv_aplic_set_enabled_word(aplic, word, value, false);
815     } else if (addr == APLIC_CLRIENUM) {
816         riscv_aplic_set_enabled(aplic, value, false);
817     } else if (addr == APLIC_SETIPNUM_LE) {
818         riscv_aplic_set_pending(aplic, value, true);
819     } else if (addr == APLIC_SETIPNUM_BE) {
820         riscv_aplic_set_pending(aplic, bswap32(value), true);
821     } else if (addr == APLIC_GENMSI) {
822         if (aplic->msimode) {
823             aplic->genmsi = value & ~(APLIC_TARGET_GUEST_IDX_MASK <<
824                                       APLIC_TARGET_GUEST_IDX_SHIFT);
825             riscv_aplic_msi_send(aplic,
826                                  value >> APLIC_TARGET_HART_IDX_SHIFT,
827                                  0,
828                                  value & APLIC_TARGET_EIID_MASK);
829         }
830     } else if ((APLIC_TARGET_BASE <= addr) &&
831             (addr < (APLIC_TARGET_BASE + (aplic->num_irqs - 1) * 4))) {
832         irq = ((addr - APLIC_TARGET_BASE) >> 2) + 1;
833         if (aplic->msimode) {
834             aplic->target[irq] = value;
835         } else {
836             aplic->target[irq] = (value & ~APLIC_TARGET_IPRIO_MASK) |
837                                  ((value & aplic->iprio_mask) ?
838                                   (value & aplic->iprio_mask) : 1);
839         }
840     } else if (!aplic->msimode && (APLIC_IDC_BASE <= addr) &&
841             (addr < (APLIC_IDC_BASE + aplic->num_harts * APLIC_IDC_SIZE))) {
842         idc = (addr - APLIC_IDC_BASE) / APLIC_IDC_SIZE;
843         switch (addr - (APLIC_IDC_BASE + idc * APLIC_IDC_SIZE)) {
844         case APLIC_IDC_IDELIVERY:
845             aplic->idelivery[idc] = value & 0x1;
846             break;
847         case APLIC_IDC_IFORCE:
848             aplic->iforce[idc] = value & 0x1;
849             break;
850         case APLIC_IDC_ITHRESHOLD:
851             aplic->ithreshold[idc] = value & aplic->iprio_mask;
852             break;
853         default:
854             goto err;
855         };
856     } else {
857         goto err;
858     }
859 
860     if (aplic->msimode) {
861         for (irq = 1; irq < aplic->num_irqs; irq++) {
862             riscv_aplic_msi_irq_update(aplic, irq);
863         }
864     } else {
865         if (idc == UINT32_MAX) {
866             for (idc = 0; idc < aplic->num_harts; idc++) {
867                 riscv_aplic_idc_update(aplic, idc);
868             }
869         } else {
870             riscv_aplic_idc_update(aplic, idc);
871         }
872     }
873 
874     return;
875 
876 err:
877     qemu_log_mask(LOG_GUEST_ERROR,
878                   "%s: Invalid register write 0x%" HWADDR_PRIx "\n",
879                   __func__, addr);
880 }
881 
882 static const MemoryRegionOps riscv_aplic_ops = {
883     .read = riscv_aplic_read,
884     .write = riscv_aplic_write,
885     .endianness = DEVICE_LITTLE_ENDIAN,
886     .valid = {
887         .min_access_size = 4,
888         .max_access_size = 4
889     }
890 };
891 
892 static void riscv_aplic_realize(DeviceState *dev, Error **errp)
893 {
894     uint32_t i;
895     RISCVAPLICState *aplic = RISCV_APLIC(dev);
896 
897     if (riscv_use_emulated_aplic(aplic->msimode)) {
898         /* Create output IRQ lines for non-MSI mode */
899         if (!aplic->msimode) {
900             /* Claim the CPU interrupt to be triggered by this APLIC */
901             for (i = 0; i < aplic->num_harts; i++) {
902                 RISCVCPU *cpu;
903 
904                 cpu = RISCV_CPU(cpu_by_arch_id(aplic->hartid_base + i));
905                 if (riscv_cpu_claim_interrupts(cpu,
906                     (aplic->mmode) ? MIP_MEIP : MIP_SEIP) < 0) {
907                     error_report("%s already claimed",
908                                  (aplic->mmode) ? "MEIP" : "SEIP");
909                     exit(1);
910                 }
911             }
912 
913             aplic->external_irqs = g_malloc(sizeof(qemu_irq) *
914                                             aplic->num_harts);
915             qdev_init_gpio_out(dev, aplic->external_irqs, aplic->num_harts);
916         }
917 
918         aplic->bitfield_words = (aplic->num_irqs + 31) >> 5;
919         aplic->sourcecfg = g_new0(uint32_t, aplic->num_irqs);
920         aplic->state = g_new0(uint32_t, aplic->num_irqs);
921         aplic->target = g_new0(uint32_t, aplic->num_irqs);
922         if (!aplic->msimode) {
923             for (i = 0; i < aplic->num_irqs; i++) {
924                 aplic->target[i] = 1;
925             }
926         }
927         aplic->idelivery = g_new0(uint32_t, aplic->num_harts);
928         aplic->iforce = g_new0(uint32_t, aplic->num_harts);
929         aplic->ithreshold = g_new0(uint32_t, aplic->num_harts);
930 
931         memory_region_init_io(&aplic->mmio, OBJECT(dev), &riscv_aplic_ops,
932                               aplic, TYPE_RISCV_APLIC, aplic->aperture_size);
933         sysbus_init_mmio(SYS_BUS_DEVICE(dev), &aplic->mmio);
934 
935         if (kvm_enabled()) {
936             aplic->kvm_splitmode = true;
937         }
938     }
939 
940     /*
941      * Only root APLICs have hardware IRQ lines. All non-root APLICs
942      * have IRQ lines delegated by their parent APLIC.
943      */
944     if (!aplic->parent) {
945         if (kvm_enabled() && !riscv_use_emulated_aplic(aplic->msimode)) {
946             qdev_init_gpio_in(dev, riscv_kvm_aplic_request, aplic->num_irqs);
947         } else {
948             qdev_init_gpio_in(dev, riscv_aplic_request, aplic->num_irqs);
949         }
950     }
951 
952     msi_nonbroken = true;
953 }
954 
955 static const Property riscv_aplic_properties[] = {
956     DEFINE_PROP_UINT32("aperture-size", RISCVAPLICState, aperture_size, 0),
957     DEFINE_PROP_UINT32("hartid-base", RISCVAPLICState, hartid_base, 0),
958     DEFINE_PROP_UINT32("num-harts", RISCVAPLICState, num_harts, 0),
959     DEFINE_PROP_UINT32("iprio-mask", RISCVAPLICState, iprio_mask, 0),
960     DEFINE_PROP_UINT32("num-irqs", RISCVAPLICState, num_irqs, 0),
961     DEFINE_PROP_BOOL("msimode", RISCVAPLICState, msimode, 0),
962     DEFINE_PROP_BOOL("mmode", RISCVAPLICState, mmode, 0),
963 };
964 
965 static const VMStateDescription vmstate_riscv_aplic = {
966     .name = "riscv_aplic",
967     .version_id = 2,
968     .minimum_version_id = 2,
969     .fields = (const VMStateField[]) {
970             VMSTATE_UINT32(domaincfg, RISCVAPLICState),
971             VMSTATE_UINT32(mmsicfgaddr, RISCVAPLICState),
972             VMSTATE_UINT32(mmsicfgaddrH, RISCVAPLICState),
973             VMSTATE_UINT32(smsicfgaddr, RISCVAPLICState),
974             VMSTATE_UINT32(smsicfgaddrH, RISCVAPLICState),
975             VMSTATE_UINT32(genmsi, RISCVAPLICState),
976             VMSTATE_UINT32(kvm_msicfgaddr, RISCVAPLICState),
977             VMSTATE_UINT32(kvm_msicfgaddrH, RISCVAPLICState),
978             VMSTATE_VARRAY_UINT32(sourcecfg, RISCVAPLICState,
979                                   num_irqs, 0,
980                                   vmstate_info_uint32, uint32_t),
981             VMSTATE_VARRAY_UINT32(state, RISCVAPLICState,
982                                   num_irqs, 0,
983                                   vmstate_info_uint32, uint32_t),
984             VMSTATE_VARRAY_UINT32(target, RISCVAPLICState,
985                                   num_irqs, 0,
986                                   vmstate_info_uint32, uint32_t),
987             VMSTATE_VARRAY_UINT32(idelivery, RISCVAPLICState,
988                                   num_harts, 0,
989                                   vmstate_info_uint32, uint32_t),
990             VMSTATE_VARRAY_UINT32(iforce, RISCVAPLICState,
991                                   num_harts, 0,
992                                   vmstate_info_uint32, uint32_t),
993             VMSTATE_VARRAY_UINT32(ithreshold, RISCVAPLICState,
994                                   num_harts, 0,
995                                   vmstate_info_uint32, uint32_t),
996             VMSTATE_END_OF_LIST()
997         }
998 };
999 
1000 static void riscv_aplic_class_init(ObjectClass *klass, void *data)
1001 {
1002     DeviceClass *dc = DEVICE_CLASS(klass);
1003 
1004     device_class_set_props(dc, riscv_aplic_properties);
1005     dc->realize = riscv_aplic_realize;
1006     dc->vmsd = &vmstate_riscv_aplic;
1007 }
1008 
1009 static const TypeInfo riscv_aplic_info = {
1010     .name          = TYPE_RISCV_APLIC,
1011     .parent        = TYPE_SYS_BUS_DEVICE,
1012     .instance_size = sizeof(RISCVAPLICState),
1013     .class_init    = riscv_aplic_class_init,
1014 };
1015 
1016 static void riscv_aplic_register_types(void)
1017 {
1018     type_register_static(&riscv_aplic_info);
1019 }
1020 
1021 type_init(riscv_aplic_register_types)
1022 
1023 /*
1024  * Add a APLIC device to another APLIC device as child for
1025  * interrupt delegation.
1026  */
1027 void riscv_aplic_add_child(DeviceState *parent, DeviceState *child)
1028 {
1029     RISCVAPLICState *caplic, *paplic;
1030 
1031     assert(parent && child);
1032     caplic = RISCV_APLIC(child);
1033     paplic = RISCV_APLIC(parent);
1034 
1035     assert(paplic->num_irqs == caplic->num_irqs);
1036     assert(paplic->num_children <= QEMU_APLIC_MAX_CHILDREN);
1037 
1038     caplic->parent = paplic;
1039     paplic->children[paplic->num_children] = caplic;
1040     paplic->num_children++;
1041 }
1042 
1043 /*
1044  * Create APLIC device.
1045  */
1046 DeviceState *riscv_aplic_create(hwaddr addr, hwaddr size,
1047     uint32_t hartid_base, uint32_t num_harts, uint32_t num_sources,
1048     uint32_t iprio_bits, bool msimode, bool mmode, DeviceState *parent)
1049 {
1050     DeviceState *dev = qdev_new(TYPE_RISCV_APLIC);
1051     uint32_t i;
1052 
1053     assert(num_harts < APLIC_MAX_IDC);
1054     assert((APLIC_IDC_BASE + (num_harts * APLIC_IDC_SIZE)) <= size);
1055     assert(num_sources < APLIC_MAX_SOURCE);
1056     assert(APLIC_MIN_IPRIO_BITS <= iprio_bits);
1057     assert(iprio_bits <= APLIC_MAX_IPRIO_BITS);
1058 
1059     qdev_prop_set_uint32(dev, "aperture-size", size);
1060     qdev_prop_set_uint32(dev, "hartid-base", hartid_base);
1061     qdev_prop_set_uint32(dev, "num-harts", num_harts);
1062     qdev_prop_set_uint32(dev, "iprio-mask", ((1U << iprio_bits) - 1));
1063     qdev_prop_set_uint32(dev, "num-irqs", num_sources + 1);
1064     qdev_prop_set_bit(dev, "msimode", msimode);
1065     qdev_prop_set_bit(dev, "mmode", mmode);
1066 
1067     if (parent) {
1068         riscv_aplic_add_child(parent, dev);
1069     }
1070 
1071     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
1072 
1073     if (riscv_use_emulated_aplic(msimode)) {
1074         sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, addr);
1075 
1076         if (!msimode) {
1077             for (i = 0; i < num_harts; i++) {
1078                 CPUState *cpu = cpu_by_arch_id(hartid_base + i);
1079 
1080                 qdev_connect_gpio_out_named(dev, NULL, i,
1081                                             qdev_get_gpio_in(DEVICE(cpu),
1082                                             (mmode) ? IRQ_M_EXT : IRQ_S_EXT));
1083             }
1084         }
1085     }
1086 
1087     return dev;
1088 }
1089