Linux Audio

Check our new training course

Loading...
v6.8
   1/*
   2 * OpenPIC emulation
   3 *
   4 * Copyright (c) 2004 Jocelyn Mayer
   5 *               2011 Alexander Graf
   6 *
   7 * Permission is hereby granted, free of charge, to any person obtaining a copy
   8 * of this software and associated documentation files (the "Software"), to deal
   9 * in the Software without restriction, including without limitation the rights
  10 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  11 * copies of the Software, and to permit persons to whom the Software is
  12 * furnished to do so, subject to the following conditions:
  13 *
  14 * The above copyright notice and this permission notice shall be included in
  15 * all copies or substantial portions of the Software.
  16 *
  17 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  18 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  19 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
  20 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  21 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  22 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  23 * THE SOFTWARE.
  24 */
  25
  26#include <linux/slab.h>
  27#include <linux/mutex.h>
  28#include <linux/kvm_host.h>
  29#include <linux/errno.h>
  30#include <linux/fs.h>
  31#include <linux/anon_inodes.h>
  32#include <linux/uaccess.h>
  33#include <asm/mpic.h>
  34#include <asm/kvm_para.h>
 
  35#include <asm/kvm_ppc.h>
  36#include <kvm/iodev.h>
  37
  38#define MAX_CPU     32
  39#define MAX_SRC     256
  40#define MAX_TMR     4
  41#define MAX_IPI     4
  42#define MAX_MSI     8
  43#define MAX_IRQ     (MAX_SRC + MAX_IPI + MAX_TMR)
  44#define VID         0x03	/* MPIC version ID */
  45
  46/* OpenPIC capability flags */
  47#define OPENPIC_FLAG_IDR_CRIT     (1 << 0)
  48#define OPENPIC_FLAG_ILR          (2 << 0)
  49
  50/* OpenPIC address map */
  51#define OPENPIC_REG_SIZE             0x40000
  52#define OPENPIC_GLB_REG_START        0x0
  53#define OPENPIC_GLB_REG_SIZE         0x10F0
  54#define OPENPIC_TMR_REG_START        0x10F0
  55#define OPENPIC_TMR_REG_SIZE         0x220
  56#define OPENPIC_MSI_REG_START        0x1600
  57#define OPENPIC_MSI_REG_SIZE         0x200
  58#define OPENPIC_SUMMARY_REG_START    0x3800
  59#define OPENPIC_SUMMARY_REG_SIZE     0x800
  60#define OPENPIC_SRC_REG_START        0x10000
  61#define OPENPIC_SRC_REG_SIZE         (MAX_SRC * 0x20)
  62#define OPENPIC_CPU_REG_START        0x20000
  63#define OPENPIC_CPU_REG_SIZE         (0x100 + ((MAX_CPU - 1) * 0x1000))
  64
  65struct fsl_mpic_info {
  66	int max_ext;
  67};
  68
  69static struct fsl_mpic_info fsl_mpic_20 = {
  70	.max_ext = 12,
  71};
  72
  73static struct fsl_mpic_info fsl_mpic_42 = {
  74	.max_ext = 12,
  75};
  76
  77#define FRR_NIRQ_SHIFT    16
  78#define FRR_NCPU_SHIFT     8
  79#define FRR_VID_SHIFT      0
  80
  81#define VID_REVISION_1_2   2
  82#define VID_REVISION_1_3   3
  83
  84#define VIR_GENERIC      0x00000000	/* Generic Vendor ID */
  85
  86#define GCR_RESET        0x80000000
  87#define GCR_MODE_PASS    0x00000000
  88#define GCR_MODE_MIXED   0x20000000
  89#define GCR_MODE_PROXY   0x60000000
  90
  91#define TBCR_CI           0x80000000	/* count inhibit */
  92#define TCCR_TOG          0x80000000	/* toggles when decrement to zero */
  93
  94#define IDR_EP_SHIFT      31
  95#define IDR_EP_MASK       (1 << IDR_EP_SHIFT)
  96#define IDR_CI0_SHIFT     30
  97#define IDR_CI1_SHIFT     29
  98#define IDR_P1_SHIFT      1
  99#define IDR_P0_SHIFT      0
 100
 101#define ILR_INTTGT_MASK   0x000000ff
 102#define ILR_INTTGT_INT    0x00
 103#define ILR_INTTGT_CINT   0x01	/* critical */
 104#define ILR_INTTGT_MCP    0x02	/* machine check */
 105#define NUM_OUTPUTS       3
 106
 107#define MSIIR_OFFSET       0x140
 108#define MSIIR_SRS_SHIFT    29
 109#define MSIIR_SRS_MASK     (0x7 << MSIIR_SRS_SHIFT)
 110#define MSIIR_IBS_SHIFT    24
 111#define MSIIR_IBS_MASK     (0x1f << MSIIR_IBS_SHIFT)
 112
 113static int get_current_cpu(void)
 114{
 115#if defined(CONFIG_KVM) && defined(CONFIG_BOOKE)
 116	struct kvm_vcpu *vcpu = current->thread.kvm_vcpu;
 117	return vcpu ? vcpu->arch.irq_cpu_id : -1;
 118#else
 119	/* XXX */
 120	return -1;
 121#endif
 122}
 123
 124static int openpic_cpu_write_internal(void *opaque, gpa_t addr,
 125				      u32 val, int idx);
 126static int openpic_cpu_read_internal(void *opaque, gpa_t addr,
 127				     u32 *ptr, int idx);
 128static inline void write_IRQreg_idr(struct openpic *opp, int n_IRQ,
 129				    uint32_t val);
 130
 131enum irq_type {
 132	IRQ_TYPE_NORMAL = 0,
 133	IRQ_TYPE_FSLINT,	/* FSL internal interrupt -- level only */
 134	IRQ_TYPE_FSLSPECIAL,	/* FSL timer/IPI interrupt, edge, no polarity */
 135};
 136
 137struct irq_queue {
 138	/* Round up to the nearest 64 IRQs so that the queue length
 139	 * won't change when moving between 32 and 64 bit hosts.
 140	 */
 141	unsigned long queue[BITS_TO_LONGS((MAX_IRQ + 63) & ~63)];
 142	int next;
 143	int priority;
 144};
 145
 146struct irq_source {
 147	uint32_t ivpr;		/* IRQ vector/priority register */
 148	uint32_t idr;		/* IRQ destination register */
 149	uint32_t destmask;	/* bitmap of CPU destinations */
 150	int last_cpu;
 151	int output;		/* IRQ level, e.g. ILR_INTTGT_INT */
 152	int pending;		/* TRUE if IRQ is pending */
 153	enum irq_type type;
 154	bool level:1;		/* level-triggered */
 155	bool nomask:1;	/* critical interrupts ignore mask on some FSL MPICs */
 156};
 157
 158#define IVPR_MASK_SHIFT       31
 159#define IVPR_MASK_MASK        (1 << IVPR_MASK_SHIFT)
 160#define IVPR_ACTIVITY_SHIFT   30
 161#define IVPR_ACTIVITY_MASK    (1 << IVPR_ACTIVITY_SHIFT)
 162#define IVPR_MODE_SHIFT       29
 163#define IVPR_MODE_MASK        (1 << IVPR_MODE_SHIFT)
 164#define IVPR_POLARITY_SHIFT   23
 165#define IVPR_POLARITY_MASK    (1 << IVPR_POLARITY_SHIFT)
 166#define IVPR_SENSE_SHIFT      22
 167#define IVPR_SENSE_MASK       (1 << IVPR_SENSE_SHIFT)
 168
 169#define IVPR_PRIORITY_MASK     (0xF << 16)
 170#define IVPR_PRIORITY(_ivprr_) ((int)(((_ivprr_) & IVPR_PRIORITY_MASK) >> 16))
 171#define IVPR_VECTOR(opp, _ivprr_) ((_ivprr_) & (opp)->vector_mask)
 172
 173/* IDR[EP/CI] are only for FSL MPIC prior to v4.0 */
 174#define IDR_EP      0x80000000	/* external pin */
 175#define IDR_CI      0x40000000	/* critical interrupt */
 176
 177struct irq_dest {
 178	struct kvm_vcpu *vcpu;
 179
 180	int32_t ctpr;		/* CPU current task priority */
 181	struct irq_queue raised;
 182	struct irq_queue servicing;
 183
 184	/* Count of IRQ sources asserting on non-INT outputs */
 185	uint32_t outputs_active[NUM_OUTPUTS];
 186};
 187
 188#define MAX_MMIO_REGIONS 10
 189
 190struct openpic {
 191	struct kvm *kvm;
 192	struct kvm_device *dev;
 193	struct kvm_io_device mmio;
 194	const struct mem_reg *mmio_regions[MAX_MMIO_REGIONS];
 195	int num_mmio_regions;
 196
 197	gpa_t reg_base;
 198	spinlock_t lock;
 199
 200	/* Behavior control */
 201	struct fsl_mpic_info *fsl;
 202	uint32_t model;
 203	uint32_t flags;
 204	uint32_t nb_irqs;
 205	uint32_t vid;
 206	uint32_t vir;		/* Vendor identification register */
 207	uint32_t vector_mask;
 208	uint32_t tfrr_reset;
 209	uint32_t ivpr_reset;
 210	uint32_t idr_reset;
 211	uint32_t brr1;
 212	uint32_t mpic_mode_mask;
 213
 214	/* Global registers */
 215	uint32_t frr;		/* Feature reporting register */
 216	uint32_t gcr;		/* Global configuration register  */
 217	uint32_t pir;		/* Processor initialization register */
 218	uint32_t spve;		/* Spurious vector register */
 219	uint32_t tfrr;		/* Timer frequency reporting register */
 220	/* Source registers */
 221	struct irq_source src[MAX_IRQ];
 222	/* Local registers per output pin */
 223	struct irq_dest dst[MAX_CPU];
 224	uint32_t nb_cpus;
 225	/* Timer registers */
 226	struct {
 227		uint32_t tccr;	/* Global timer current count register */
 228		uint32_t tbcr;	/* Global timer base count register */
 229	} timers[MAX_TMR];
 230	/* Shared MSI registers */
 231	struct {
 232		uint32_t msir;	/* Shared Message Signaled Interrupt Register */
 233	} msi[MAX_MSI];
 234	uint32_t max_irq;
 235	uint32_t irq_ipi0;
 236	uint32_t irq_tim0;
 237	uint32_t irq_msi;
 238};
 239
 240
 241static void mpic_irq_raise(struct openpic *opp, struct irq_dest *dst,
 242			   int output)
 243{
 244	struct kvm_interrupt irq = {
 245		.irq = KVM_INTERRUPT_SET_LEVEL,
 246	};
 247
 248	if (!dst->vcpu) {
 249		pr_debug("%s: destination cpu %d does not exist\n",
 250			 __func__, (int)(dst - &opp->dst[0]));
 251		return;
 252	}
 253
 254	pr_debug("%s: cpu %d output %d\n", __func__, dst->vcpu->arch.irq_cpu_id,
 255		output);
 256
 257	if (output != ILR_INTTGT_INT)	/* TODO */
 258		return;
 259
 260	kvm_vcpu_ioctl_interrupt(dst->vcpu, &irq);
 261}
 262
 263static void mpic_irq_lower(struct openpic *opp, struct irq_dest *dst,
 264			   int output)
 265{
 266	if (!dst->vcpu) {
 267		pr_debug("%s: destination cpu %d does not exist\n",
 268			 __func__, (int)(dst - &opp->dst[0]));
 269		return;
 270	}
 271
 272	pr_debug("%s: cpu %d output %d\n", __func__, dst->vcpu->arch.irq_cpu_id,
 273		output);
 274
 275	if (output != ILR_INTTGT_INT)	/* TODO */
 276		return;
 277
 278	kvmppc_core_dequeue_external(dst->vcpu);
 279}
 280
 281static inline void IRQ_setbit(struct irq_queue *q, int n_IRQ)
 282{
 283	set_bit(n_IRQ, q->queue);
 284}
 285
 286static inline void IRQ_resetbit(struct irq_queue *q, int n_IRQ)
 287{
 288	clear_bit(n_IRQ, q->queue);
 289}
 290
 291static void IRQ_check(struct openpic *opp, struct irq_queue *q)
 292{
 293	int irq = -1;
 294	int next = -1;
 295	int priority = -1;
 296
 297	for (;;) {
 298		irq = find_next_bit(q->queue, opp->max_irq, irq + 1);
 299		if (irq == opp->max_irq)
 300			break;
 301
 302		pr_debug("IRQ_check: irq %d set ivpr_pr=%d pr=%d\n",
 303			irq, IVPR_PRIORITY(opp->src[irq].ivpr), priority);
 304
 305		if (IVPR_PRIORITY(opp->src[irq].ivpr) > priority) {
 306			next = irq;
 307			priority = IVPR_PRIORITY(opp->src[irq].ivpr);
 308		}
 309	}
 310
 311	q->next = next;
 312	q->priority = priority;
 313}
 314
 315static int IRQ_get_next(struct openpic *opp, struct irq_queue *q)
 316{
 317	/* XXX: optimize */
 318	IRQ_check(opp, q);
 319
 320	return q->next;
 321}
 322
 323static void IRQ_local_pipe(struct openpic *opp, int n_CPU, int n_IRQ,
 324			   bool active, bool was_active)
 325{
 326	struct irq_dest *dst;
 327	struct irq_source *src;
 328	int priority;
 329
 330	dst = &opp->dst[n_CPU];
 331	src = &opp->src[n_IRQ];
 332
 333	pr_debug("%s: IRQ %d active %d was %d\n",
 334		__func__, n_IRQ, active, was_active);
 335
 336	if (src->output != ILR_INTTGT_INT) {
 337		pr_debug("%s: output %d irq %d active %d was %d count %d\n",
 338			__func__, src->output, n_IRQ, active, was_active,
 339			dst->outputs_active[src->output]);
 340
 341		/* On Freescale MPIC, critical interrupts ignore priority,
 342		 * IACK, EOI, etc.  Before MPIC v4.1 they also ignore
 343		 * masking.
 344		 */
 345		if (active) {
 346			if (!was_active &&
 347			    dst->outputs_active[src->output]++ == 0) {
 348				pr_debug("%s: Raise OpenPIC output %d cpu %d irq %d\n",
 349					__func__, src->output, n_CPU, n_IRQ);
 350				mpic_irq_raise(opp, dst, src->output);
 351			}
 352		} else {
 353			if (was_active &&
 354			    --dst->outputs_active[src->output] == 0) {
 355				pr_debug("%s: Lower OpenPIC output %d cpu %d irq %d\n",
 356					__func__, src->output, n_CPU, n_IRQ);
 357				mpic_irq_lower(opp, dst, src->output);
 358			}
 359		}
 360
 361		return;
 362	}
 363
 364	priority = IVPR_PRIORITY(src->ivpr);
 365
 366	/* Even if the interrupt doesn't have enough priority,
 367	 * it is still raised, in case ctpr is lowered later.
 368	 */
 369	if (active)
 370		IRQ_setbit(&dst->raised, n_IRQ);
 371	else
 372		IRQ_resetbit(&dst->raised, n_IRQ);
 373
 374	IRQ_check(opp, &dst->raised);
 375
 376	if (active && priority <= dst->ctpr) {
 377		pr_debug("%s: IRQ %d priority %d too low for ctpr %d on CPU %d\n",
 378			__func__, n_IRQ, priority, dst->ctpr, n_CPU);
 379		active = 0;
 380	}
 381
 382	if (active) {
 383		if (IRQ_get_next(opp, &dst->servicing) >= 0 &&
 384		    priority <= dst->servicing.priority) {
 385			pr_debug("%s: IRQ %d is hidden by servicing IRQ %d on CPU %d\n",
 386				__func__, n_IRQ, dst->servicing.next, n_CPU);
 387		} else {
 388			pr_debug("%s: Raise OpenPIC INT output cpu %d irq %d/%d\n",
 389				__func__, n_CPU, n_IRQ, dst->raised.next);
 390			mpic_irq_raise(opp, dst, ILR_INTTGT_INT);
 391		}
 392	} else {
 393		IRQ_get_next(opp, &dst->servicing);
 394		if (dst->raised.priority > dst->ctpr &&
 395		    dst->raised.priority > dst->servicing.priority) {
 396			pr_debug("%s: IRQ %d inactive, IRQ %d prio %d above %d/%d, CPU %d\n",
 397				__func__, n_IRQ, dst->raised.next,
 398				dst->raised.priority, dst->ctpr,
 399				dst->servicing.priority, n_CPU);
 400			/* IRQ line stays asserted */
 401		} else {
 402			pr_debug("%s: IRQ %d inactive, current prio %d/%d, CPU %d\n",
 403				__func__, n_IRQ, dst->ctpr,
 404				dst->servicing.priority, n_CPU);
 405			mpic_irq_lower(opp, dst, ILR_INTTGT_INT);
 406		}
 407	}
 408}
 409
 410/* update pic state because registers for n_IRQ have changed value */
 411static void openpic_update_irq(struct openpic *opp, int n_IRQ)
 412{
 413	struct irq_source *src;
 414	bool active, was_active;
 415	int i;
 416
 417	src = &opp->src[n_IRQ];
 418	active = src->pending;
 419
 420	if ((src->ivpr & IVPR_MASK_MASK) && !src->nomask) {
 421		/* Interrupt source is disabled */
 422		pr_debug("%s: IRQ %d is disabled\n", __func__, n_IRQ);
 423		active = false;
 424	}
 425
 426	was_active = !!(src->ivpr & IVPR_ACTIVITY_MASK);
 427
 428	/*
 429	 * We don't have a similar check for already-active because
 430	 * ctpr may have changed and we need to withdraw the interrupt.
 431	 */
 432	if (!active && !was_active) {
 433		pr_debug("%s: IRQ %d is already inactive\n", __func__, n_IRQ);
 434		return;
 435	}
 436
 437	if (active)
 438		src->ivpr |= IVPR_ACTIVITY_MASK;
 439	else
 440		src->ivpr &= ~IVPR_ACTIVITY_MASK;
 441
 442	if (src->destmask == 0) {
 443		/* No target */
 444		pr_debug("%s: IRQ %d has no target\n", __func__, n_IRQ);
 445		return;
 446	}
 447
 448	if (src->destmask == (1 << src->last_cpu)) {
 449		/* Only one CPU is allowed to receive this IRQ */
 450		IRQ_local_pipe(opp, src->last_cpu, n_IRQ, active, was_active);
 451	} else if (!(src->ivpr & IVPR_MODE_MASK)) {
 452		/* Directed delivery mode */
 453		for (i = 0; i < opp->nb_cpus; i++) {
 454			if (src->destmask & (1 << i)) {
 455				IRQ_local_pipe(opp, i, n_IRQ, active,
 456					       was_active);
 457			}
 458		}
 459	} else {
 460		/* Distributed delivery mode */
 461		for (i = src->last_cpu + 1; i != src->last_cpu; i++) {
 462			if (i == opp->nb_cpus)
 463				i = 0;
 464
 465			if (src->destmask & (1 << i)) {
 466				IRQ_local_pipe(opp, i, n_IRQ, active,
 467					       was_active);
 468				src->last_cpu = i;
 469				break;
 470			}
 471		}
 472	}
 473}
 474
 475static void openpic_set_irq(void *opaque, int n_IRQ, int level)
 476{
 477	struct openpic *opp = opaque;
 478	struct irq_source *src;
 479
 480	if (n_IRQ >= MAX_IRQ) {
 481		WARN_ONCE(1, "%s: IRQ %d out of range\n", __func__, n_IRQ);
 482		return;
 483	}
 484
 485	src = &opp->src[n_IRQ];
 486	pr_debug("openpic: set irq %d = %d ivpr=0x%08x\n",
 487		n_IRQ, level, src->ivpr);
 488	if (src->level) {
 489		/* level-sensitive irq */
 490		src->pending = level;
 491		openpic_update_irq(opp, n_IRQ);
 492	} else {
 493		/* edge-sensitive irq */
 494		if (level) {
 495			src->pending = 1;
 496			openpic_update_irq(opp, n_IRQ);
 497		}
 498
 499		if (src->output != ILR_INTTGT_INT) {
 500			/* Edge-triggered interrupts shouldn't be used
 501			 * with non-INT delivery, but just in case,
 502			 * try to make it do something sane rather than
 503			 * cause an interrupt storm.  This is close to
 504			 * what you'd probably see happen in real hardware.
 505			 */
 506			src->pending = 0;
 507			openpic_update_irq(opp, n_IRQ);
 508		}
 509	}
 510}
 511
 512static void openpic_reset(struct openpic *opp)
 513{
 514	int i;
 515
 516	opp->gcr = GCR_RESET;
 517	/* Initialise controller registers */
 518	opp->frr = ((opp->nb_irqs - 1) << FRR_NIRQ_SHIFT) |
 519	    (opp->vid << FRR_VID_SHIFT);
 520
 521	opp->pir = 0;
 522	opp->spve = -1 & opp->vector_mask;
 523	opp->tfrr = opp->tfrr_reset;
 524	/* Initialise IRQ sources */
 525	for (i = 0; i < opp->max_irq; i++) {
 526		opp->src[i].ivpr = opp->ivpr_reset;
 527
 528		switch (opp->src[i].type) {
 529		case IRQ_TYPE_NORMAL:
 530			opp->src[i].level =
 531			    !!(opp->ivpr_reset & IVPR_SENSE_MASK);
 532			break;
 533
 534		case IRQ_TYPE_FSLINT:
 535			opp->src[i].ivpr |= IVPR_POLARITY_MASK;
 536			break;
 537
 538		case IRQ_TYPE_FSLSPECIAL:
 539			break;
 540		}
 541
 542		write_IRQreg_idr(opp, i, opp->idr_reset);
 543	}
 544	/* Initialise IRQ destinations */
 545	for (i = 0; i < MAX_CPU; i++) {
 546		opp->dst[i].ctpr = 15;
 547		memset(&opp->dst[i].raised, 0, sizeof(struct irq_queue));
 548		opp->dst[i].raised.next = -1;
 549		memset(&opp->dst[i].servicing, 0, sizeof(struct irq_queue));
 550		opp->dst[i].servicing.next = -1;
 551	}
 552	/* Initialise timers */
 553	for (i = 0; i < MAX_TMR; i++) {
 554		opp->timers[i].tccr = 0;
 555		opp->timers[i].tbcr = TBCR_CI;
 556	}
 557	/* Go out of RESET state */
 558	opp->gcr = 0;
 559}
 560
 561static inline uint32_t read_IRQreg_idr(struct openpic *opp, int n_IRQ)
 562{
 563	return opp->src[n_IRQ].idr;
 564}
 565
 566static inline uint32_t read_IRQreg_ilr(struct openpic *opp, int n_IRQ)
 567{
 568	if (opp->flags & OPENPIC_FLAG_ILR)
 569		return opp->src[n_IRQ].output;
 570
 571	return 0xffffffff;
 572}
 573
 574static inline uint32_t read_IRQreg_ivpr(struct openpic *opp, int n_IRQ)
 575{
 576	return opp->src[n_IRQ].ivpr;
 577}
 578
 579static inline void write_IRQreg_idr(struct openpic *opp, int n_IRQ,
 580				    uint32_t val)
 581{
 582	struct irq_source *src = &opp->src[n_IRQ];
 583	uint32_t normal_mask = (1UL << opp->nb_cpus) - 1;
 584	uint32_t crit_mask = 0;
 585	uint32_t mask = normal_mask;
 586	int crit_shift = IDR_EP_SHIFT - opp->nb_cpus;
 587	int i;
 588
 589	if (opp->flags & OPENPIC_FLAG_IDR_CRIT) {
 590		crit_mask = mask << crit_shift;
 591		mask |= crit_mask | IDR_EP;
 592	}
 593
 594	src->idr = val & mask;
 595	pr_debug("Set IDR %d to 0x%08x\n", n_IRQ, src->idr);
 596
 597	if (opp->flags & OPENPIC_FLAG_IDR_CRIT) {
 598		if (src->idr & crit_mask) {
 599			if (src->idr & normal_mask) {
 600				pr_debug("%s: IRQ configured for multiple output types, using critical\n",
 601					__func__);
 602			}
 603
 604			src->output = ILR_INTTGT_CINT;
 605			src->nomask = true;
 606			src->destmask = 0;
 607
 608			for (i = 0; i < opp->nb_cpus; i++) {
 609				int n_ci = IDR_CI0_SHIFT - i;
 610
 611				if (src->idr & (1UL << n_ci))
 612					src->destmask |= 1UL << i;
 613			}
 614		} else {
 615			src->output = ILR_INTTGT_INT;
 616			src->nomask = false;
 617			src->destmask = src->idr & normal_mask;
 618		}
 619	} else {
 620		src->destmask = src->idr;
 621	}
 622}
 623
 624static inline void write_IRQreg_ilr(struct openpic *opp, int n_IRQ,
 625				    uint32_t val)
 626{
 627	if (opp->flags & OPENPIC_FLAG_ILR) {
 628		struct irq_source *src = &opp->src[n_IRQ];
 629
 630		src->output = val & ILR_INTTGT_MASK;
 631		pr_debug("Set ILR %d to 0x%08x, output %d\n", n_IRQ, src->idr,
 632			src->output);
 633
 634		/* TODO: on MPIC v4.0 only, set nomask for non-INT */
 635	}
 636}
 637
 638static inline void write_IRQreg_ivpr(struct openpic *opp, int n_IRQ,
 639				     uint32_t val)
 640{
 641	uint32_t mask;
 642
 643	/* NOTE when implementing newer FSL MPIC models: starting with v4.0,
 644	 * the polarity bit is read-only on internal interrupts.
 645	 */
 646	mask = IVPR_MASK_MASK | IVPR_PRIORITY_MASK | IVPR_SENSE_MASK |
 647	    IVPR_POLARITY_MASK | opp->vector_mask;
 648
 649	/* ACTIVITY bit is read-only */
 650	opp->src[n_IRQ].ivpr =
 651	    (opp->src[n_IRQ].ivpr & IVPR_ACTIVITY_MASK) | (val & mask);
 652
 653	/* For FSL internal interrupts, The sense bit is reserved and zero,
 654	 * and the interrupt is always level-triggered.  Timers and IPIs
 655	 * have no sense or polarity bits, and are edge-triggered.
 656	 */
 657	switch (opp->src[n_IRQ].type) {
 658	case IRQ_TYPE_NORMAL:
 659		opp->src[n_IRQ].level =
 660		    !!(opp->src[n_IRQ].ivpr & IVPR_SENSE_MASK);
 661		break;
 662
 663	case IRQ_TYPE_FSLINT:
 664		opp->src[n_IRQ].ivpr &= ~IVPR_SENSE_MASK;
 665		break;
 666
 667	case IRQ_TYPE_FSLSPECIAL:
 668		opp->src[n_IRQ].ivpr &= ~(IVPR_POLARITY_MASK | IVPR_SENSE_MASK);
 669		break;
 670	}
 671
 672	openpic_update_irq(opp, n_IRQ);
 673	pr_debug("Set IVPR %d to 0x%08x -> 0x%08x\n", n_IRQ, val,
 674		opp->src[n_IRQ].ivpr);
 675}
 676
 677static void openpic_gcr_write(struct openpic *opp, uint64_t val)
 678{
 679	if (val & GCR_RESET) {
 680		openpic_reset(opp);
 681		return;
 682	}
 683
 684	opp->gcr &= ~opp->mpic_mode_mask;
 685	opp->gcr |= val & opp->mpic_mode_mask;
 686}
 687
 688static int openpic_gbl_write(void *opaque, gpa_t addr, u32 val)
 689{
 690	struct openpic *opp = opaque;
 691	int err = 0;
 692
 693	pr_debug("%s: addr %#llx <= %08x\n", __func__, addr, val);
 694	if (addr & 0xF)
 695		return 0;
 696
 697	switch (addr) {
 698	case 0x00:	/* Block Revision Register1 (BRR1) is Readonly */
 699		break;
 700	case 0x40:
 701	case 0x50:
 702	case 0x60:
 703	case 0x70:
 704	case 0x80:
 705	case 0x90:
 706	case 0xA0:
 707	case 0xB0:
 708		err = openpic_cpu_write_internal(opp, addr, val,
 709						 get_current_cpu());
 710		break;
 711	case 0x1000:		/* FRR */
 712		break;
 713	case 0x1020:		/* GCR */
 714		openpic_gcr_write(opp, val);
 715		break;
 716	case 0x1080:		/* VIR */
 717		break;
 718	case 0x1090:		/* PIR */
 719		/*
 720		 * This register is used to reset a CPU core --
 721		 * let userspace handle it.
 722		 */
 723		err = -ENXIO;
 724		break;
 725	case 0x10A0:		/* IPI_IVPR */
 726	case 0x10B0:
 727	case 0x10C0:
 728	case 0x10D0: {
 729		int idx;
 730		idx = (addr - 0x10A0) >> 4;
 731		write_IRQreg_ivpr(opp, opp->irq_ipi0 + idx, val);
 732		break;
 733	}
 734	case 0x10E0:		/* SPVE */
 735		opp->spve = val & opp->vector_mask;
 736		break;
 737	default:
 738		break;
 739	}
 740
 741	return err;
 742}
 743
 744static int openpic_gbl_read(void *opaque, gpa_t addr, u32 *ptr)
 745{
 746	struct openpic *opp = opaque;
 747	u32 retval;
 748	int err = 0;
 749
 750	pr_debug("%s: addr %#llx\n", __func__, addr);
 751	retval = 0xFFFFFFFF;
 752	if (addr & 0xF)
 753		goto out;
 754
 755	switch (addr) {
 756	case 0x1000:		/* FRR */
 757		retval = opp->frr;
 758		retval |= (opp->nb_cpus - 1) << FRR_NCPU_SHIFT;
 759		break;
 760	case 0x1020:		/* GCR */
 761		retval = opp->gcr;
 762		break;
 763	case 0x1080:		/* VIR */
 764		retval = opp->vir;
 765		break;
 766	case 0x1090:		/* PIR */
 767		retval = 0x00000000;
 768		break;
 769	case 0x00:		/* Block Revision Register1 (BRR1) */
 770		retval = opp->brr1;
 771		break;
 772	case 0x40:
 773	case 0x50:
 774	case 0x60:
 775	case 0x70:
 776	case 0x80:
 777	case 0x90:
 778	case 0xA0:
 779	case 0xB0:
 780		err = openpic_cpu_read_internal(opp, addr,
 781			&retval, get_current_cpu());
 782		break;
 783	case 0x10A0:		/* IPI_IVPR */
 784	case 0x10B0:
 785	case 0x10C0:
 786	case 0x10D0:
 787		{
 788			int idx;
 789			idx = (addr - 0x10A0) >> 4;
 790			retval = read_IRQreg_ivpr(opp, opp->irq_ipi0 + idx);
 791		}
 792		break;
 793	case 0x10E0:		/* SPVE */
 794		retval = opp->spve;
 795		break;
 796	default:
 797		break;
 798	}
 799
 800out:
 801	pr_debug("%s: => 0x%08x\n", __func__, retval);
 802	*ptr = retval;
 803	return err;
 804}
 805
 806static int openpic_tmr_write(void *opaque, gpa_t addr, u32 val)
 807{
 808	struct openpic *opp = opaque;
 809	int idx;
 810
 811	addr += 0x10f0;
 812
 813	pr_debug("%s: addr %#llx <= %08x\n", __func__, addr, val);
 814	if (addr & 0xF)
 815		return 0;
 816
 817	if (addr == 0x10f0) {
 818		/* TFRR */
 819		opp->tfrr = val;
 820		return 0;
 821	}
 822
 823	idx = (addr >> 6) & 0x3;
 824	addr = addr & 0x30;
 825
 826	switch (addr & 0x30) {
 827	case 0x00:		/* TCCR */
 828		break;
 829	case 0x10:		/* TBCR */
 830		if ((opp->timers[idx].tccr & TCCR_TOG) != 0 &&
 831		    (val & TBCR_CI) == 0 &&
 832		    (opp->timers[idx].tbcr & TBCR_CI) != 0)
 833			opp->timers[idx].tccr &= ~TCCR_TOG;
 834
 835		opp->timers[idx].tbcr = val;
 836		break;
 837	case 0x20:		/* TVPR */
 838		write_IRQreg_ivpr(opp, opp->irq_tim0 + idx, val);
 839		break;
 840	case 0x30:		/* TDR */
 841		write_IRQreg_idr(opp, opp->irq_tim0 + idx, val);
 842		break;
 843	}
 844
 845	return 0;
 846}
 847
 848static int openpic_tmr_read(void *opaque, gpa_t addr, u32 *ptr)
 849{
 850	struct openpic *opp = opaque;
 851	uint32_t retval = -1;
 852	int idx;
 853
 854	pr_debug("%s: addr %#llx\n", __func__, addr);
 855	if (addr & 0xF)
 856		goto out;
 857
 858	idx = (addr >> 6) & 0x3;
 859	if (addr == 0x0) {
 860		/* TFRR */
 861		retval = opp->tfrr;
 862		goto out;
 863	}
 864
 865	switch (addr & 0x30) {
 866	case 0x00:		/* TCCR */
 867		retval = opp->timers[idx].tccr;
 868		break;
 869	case 0x10:		/* TBCR */
 870		retval = opp->timers[idx].tbcr;
 871		break;
 872	case 0x20:		/* TIPV */
 873		retval = read_IRQreg_ivpr(opp, opp->irq_tim0 + idx);
 874		break;
 875	case 0x30:		/* TIDE (TIDR) */
 876		retval = read_IRQreg_idr(opp, opp->irq_tim0 + idx);
 877		break;
 878	}
 879
 880out:
 881	pr_debug("%s: => 0x%08x\n", __func__, retval);
 882	*ptr = retval;
 883	return 0;
 884}
 885
 886static int openpic_src_write(void *opaque, gpa_t addr, u32 val)
 887{
 888	struct openpic *opp = opaque;
 889	int idx;
 890
 891	pr_debug("%s: addr %#llx <= %08x\n", __func__, addr, val);
 892
 893	addr = addr & 0xffff;
 894	idx = addr >> 5;
 895
 896	switch (addr & 0x1f) {
 897	case 0x00:
 898		write_IRQreg_ivpr(opp, idx, val);
 899		break;
 900	case 0x10:
 901		write_IRQreg_idr(opp, idx, val);
 902		break;
 903	case 0x18:
 904		write_IRQreg_ilr(opp, idx, val);
 905		break;
 906	}
 907
 908	return 0;
 909}
 910
 911static int openpic_src_read(void *opaque, gpa_t addr, u32 *ptr)
 912{
 913	struct openpic *opp = opaque;
 914	uint32_t retval;
 915	int idx;
 916
 917	pr_debug("%s: addr %#llx\n", __func__, addr);
 918	retval = 0xFFFFFFFF;
 919
 920	addr = addr & 0xffff;
 921	idx = addr >> 5;
 922
 923	switch (addr & 0x1f) {
 924	case 0x00:
 925		retval = read_IRQreg_ivpr(opp, idx);
 926		break;
 927	case 0x10:
 928		retval = read_IRQreg_idr(opp, idx);
 929		break;
 930	case 0x18:
 931		retval = read_IRQreg_ilr(opp, idx);
 932		break;
 933	}
 934
 935	pr_debug("%s: => 0x%08x\n", __func__, retval);
 936	*ptr = retval;
 937	return 0;
 938}
 939
 940static int openpic_msi_write(void *opaque, gpa_t addr, u32 val)
 941{
 942	struct openpic *opp = opaque;
 943	int idx = opp->irq_msi;
 944	int srs, ibs;
 945
 946	pr_debug("%s: addr %#llx <= 0x%08x\n", __func__, addr, val);
 947	if (addr & 0xF)
 948		return 0;
 949
 950	switch (addr) {
 951	case MSIIR_OFFSET:
 952		srs = val >> MSIIR_SRS_SHIFT;
 953		idx += srs;
 954		ibs = (val & MSIIR_IBS_MASK) >> MSIIR_IBS_SHIFT;
 955		opp->msi[srs].msir |= 1 << ibs;
 956		openpic_set_irq(opp, idx, 1);
 957		break;
 958	default:
 959		/* most registers are read-only, thus ignored */
 960		break;
 961	}
 962
 963	return 0;
 964}
 965
 966static int openpic_msi_read(void *opaque, gpa_t addr, u32 *ptr)
 967{
 968	struct openpic *opp = opaque;
 969	uint32_t r = 0;
 970	int i, srs;
 971
 972	pr_debug("%s: addr %#llx\n", __func__, addr);
 973	if (addr & 0xF)
 974		return -ENXIO;
 975
 976	srs = addr >> 4;
 977
 978	switch (addr) {
 979	case 0x00:
 980	case 0x10:
 981	case 0x20:
 982	case 0x30:
 983	case 0x40:
 984	case 0x50:
 985	case 0x60:
 986	case 0x70:		/* MSIRs */
 987		r = opp->msi[srs].msir;
 988		/* Clear on read */
 989		opp->msi[srs].msir = 0;
 990		openpic_set_irq(opp, opp->irq_msi + srs, 0);
 991		break;
 992	case 0x120:		/* MSISR */
 993		for (i = 0; i < MAX_MSI; i++)
 994			r |= (opp->msi[i].msir ? 1 : 0) << i;
 995		break;
 996	}
 997
 998	pr_debug("%s: => 0x%08x\n", __func__, r);
 999	*ptr = r;
1000	return 0;
1001}
1002
1003static int openpic_summary_read(void *opaque, gpa_t addr, u32 *ptr)
1004{
1005	uint32_t r = 0;
1006
1007	pr_debug("%s: addr %#llx\n", __func__, addr);
1008
1009	/* TODO: EISR/EIMR */
1010
1011	*ptr = r;
1012	return 0;
1013}
1014
1015static int openpic_summary_write(void *opaque, gpa_t addr, u32 val)
1016{
1017	pr_debug("%s: addr %#llx <= 0x%08x\n", __func__, addr, val);
1018
1019	/* TODO: EISR/EIMR */
1020	return 0;
1021}
1022
1023static int openpic_cpu_write_internal(void *opaque, gpa_t addr,
1024				      u32 val, int idx)
1025{
1026	struct openpic *opp = opaque;
1027	struct irq_source *src;
1028	struct irq_dest *dst;
1029	int s_IRQ, n_IRQ;
1030
1031	pr_debug("%s: cpu %d addr %#llx <= 0x%08x\n", __func__, idx,
1032		addr, val);
1033
1034	if (idx < 0)
1035		return 0;
1036
1037	if (addr & 0xF)
1038		return 0;
1039
1040	dst = &opp->dst[idx];
1041	addr &= 0xFF0;
1042	switch (addr) {
1043	case 0x40:		/* IPIDR */
1044	case 0x50:
1045	case 0x60:
1046	case 0x70:
1047		idx = (addr - 0x40) >> 4;
1048		/* we use IDE as mask which CPUs to deliver the IPI to still. */
1049		opp->src[opp->irq_ipi0 + idx].destmask |= val;
1050		openpic_set_irq(opp, opp->irq_ipi0 + idx, 1);
1051		openpic_set_irq(opp, opp->irq_ipi0 + idx, 0);
1052		break;
1053	case 0x80:		/* CTPR */
1054		dst->ctpr = val & 0x0000000F;
1055
1056		pr_debug("%s: set CPU %d ctpr to %d, raised %d servicing %d\n",
1057			__func__, idx, dst->ctpr, dst->raised.priority,
1058			dst->servicing.priority);
1059
1060		if (dst->raised.priority <= dst->ctpr) {
1061			pr_debug("%s: Lower OpenPIC INT output cpu %d due to ctpr\n",
1062				__func__, idx);
1063			mpic_irq_lower(opp, dst, ILR_INTTGT_INT);
1064		} else if (dst->raised.priority > dst->servicing.priority) {
1065			pr_debug("%s: Raise OpenPIC INT output cpu %d irq %d\n",
1066				__func__, idx, dst->raised.next);
1067			mpic_irq_raise(opp, dst, ILR_INTTGT_INT);
1068		}
1069
1070		break;
1071	case 0x90:		/* WHOAMI */
1072		/* Read-only register */
1073		break;
1074	case 0xA0:		/* IACK */
1075		/* Read-only register */
1076		break;
1077	case 0xB0: {		/* EOI */
1078		int notify_eoi;
1079
1080		pr_debug("EOI\n");
1081		s_IRQ = IRQ_get_next(opp, &dst->servicing);
1082
1083		if (s_IRQ < 0) {
1084			pr_debug("%s: EOI with no interrupt in service\n",
1085				__func__);
1086			break;
1087		}
1088
1089		IRQ_resetbit(&dst->servicing, s_IRQ);
1090		/* Notify listeners that the IRQ is over */
1091		notify_eoi = s_IRQ;
1092		/* Set up next servicing IRQ */
1093		s_IRQ = IRQ_get_next(opp, &dst->servicing);
1094		/* Check queued interrupts. */
1095		n_IRQ = IRQ_get_next(opp, &dst->raised);
1096		src = &opp->src[n_IRQ];
1097		if (n_IRQ != -1 &&
1098		    (s_IRQ == -1 ||
1099		     IVPR_PRIORITY(src->ivpr) > dst->servicing.priority)) {
1100			pr_debug("Raise OpenPIC INT output cpu %d irq %d\n",
1101				idx, n_IRQ);
1102			mpic_irq_raise(opp, dst, ILR_INTTGT_INT);
1103		}
1104
1105		spin_unlock(&opp->lock);
1106		kvm_notify_acked_irq(opp->kvm, 0, notify_eoi);
1107		spin_lock(&opp->lock);
1108
1109		break;
1110	}
1111	default:
1112		break;
1113	}
1114
1115	return 0;
1116}
1117
1118static int openpic_cpu_write(void *opaque, gpa_t addr, u32 val)
1119{
1120	struct openpic *opp = opaque;
1121
1122	return openpic_cpu_write_internal(opp, addr, val,
1123					 (addr & 0x1f000) >> 12);
1124}
1125
1126static uint32_t openpic_iack(struct openpic *opp, struct irq_dest *dst,
1127			     int cpu)
1128{
1129	struct irq_source *src;
1130	int retval, irq;
1131
1132	pr_debug("Lower OpenPIC INT output\n");
1133	mpic_irq_lower(opp, dst, ILR_INTTGT_INT);
1134
1135	irq = IRQ_get_next(opp, &dst->raised);
1136	pr_debug("IACK: irq=%d\n", irq);
1137
1138	if (irq == -1)
1139		/* No more interrupt pending */
1140		return opp->spve;
1141
1142	src = &opp->src[irq];
1143	if (!(src->ivpr & IVPR_ACTIVITY_MASK) ||
1144	    !(IVPR_PRIORITY(src->ivpr) > dst->ctpr)) {
1145		pr_err("%s: bad raised IRQ %d ctpr %d ivpr 0x%08x\n",
1146			__func__, irq, dst->ctpr, src->ivpr);
1147		openpic_update_irq(opp, irq);
1148		retval = opp->spve;
1149	} else {
1150		/* IRQ enter servicing state */
1151		IRQ_setbit(&dst->servicing, irq);
1152		retval = IVPR_VECTOR(opp, src->ivpr);
1153	}
1154
1155	if (!src->level) {
1156		/* edge-sensitive IRQ */
1157		src->ivpr &= ~IVPR_ACTIVITY_MASK;
1158		src->pending = 0;
1159		IRQ_resetbit(&dst->raised, irq);
1160	}
1161
1162	if ((irq >= opp->irq_ipi0) && (irq < (opp->irq_ipi0 + MAX_IPI))) {
1163		src->destmask &= ~(1 << cpu);
1164		if (src->destmask && !src->level) {
1165			/* trigger on CPUs that didn't know about it yet */
1166			openpic_set_irq(opp, irq, 1);
1167			openpic_set_irq(opp, irq, 0);
1168			/* if all CPUs knew about it, set active bit again */
1169			src->ivpr |= IVPR_ACTIVITY_MASK;
1170		}
1171	}
1172
1173	return retval;
1174}
1175
1176void kvmppc_mpic_set_epr(struct kvm_vcpu *vcpu)
1177{
1178	struct openpic *opp = vcpu->arch.mpic;
1179	int cpu = vcpu->arch.irq_cpu_id;
1180	unsigned long flags;
1181
1182	spin_lock_irqsave(&opp->lock, flags);
1183
1184	if ((opp->gcr & opp->mpic_mode_mask) == GCR_MODE_PROXY)
1185		kvmppc_set_epr(vcpu, openpic_iack(opp, &opp->dst[cpu], cpu));
1186
1187	spin_unlock_irqrestore(&opp->lock, flags);
1188}
1189
1190static int openpic_cpu_read_internal(void *opaque, gpa_t addr,
1191				     u32 *ptr, int idx)
1192{
1193	struct openpic *opp = opaque;
1194	struct irq_dest *dst;
1195	uint32_t retval;
1196
1197	pr_debug("%s: cpu %d addr %#llx\n", __func__, idx, addr);
1198	retval = 0xFFFFFFFF;
1199
1200	if (idx < 0)
1201		goto out;
1202
1203	if (addr & 0xF)
1204		goto out;
1205
1206	dst = &opp->dst[idx];
1207	addr &= 0xFF0;
1208	switch (addr) {
1209	case 0x80:		/* CTPR */
1210		retval = dst->ctpr;
1211		break;
1212	case 0x90:		/* WHOAMI */
1213		retval = idx;
1214		break;
1215	case 0xA0:		/* IACK */
1216		retval = openpic_iack(opp, dst, idx);
1217		break;
1218	case 0xB0:		/* EOI */
1219		retval = 0;
1220		break;
1221	default:
1222		break;
1223	}
1224	pr_debug("%s: => 0x%08x\n", __func__, retval);
1225
1226out:
1227	*ptr = retval;
1228	return 0;
1229}
1230
1231static int openpic_cpu_read(void *opaque, gpa_t addr, u32 *ptr)
1232{
1233	struct openpic *opp = opaque;
1234
1235	return openpic_cpu_read_internal(opp, addr, ptr,
1236					 (addr & 0x1f000) >> 12);
1237}
1238
1239struct mem_reg {
1240	int (*read)(void *opaque, gpa_t addr, u32 *ptr);
1241	int (*write)(void *opaque, gpa_t addr, u32 val);
1242	gpa_t start_addr;
1243	int size;
1244};
1245
1246static const struct mem_reg openpic_gbl_mmio = {
1247	.write = openpic_gbl_write,
1248	.read = openpic_gbl_read,
1249	.start_addr = OPENPIC_GLB_REG_START,
1250	.size = OPENPIC_GLB_REG_SIZE,
1251};
1252
1253static const struct mem_reg openpic_tmr_mmio = {
1254	.write = openpic_tmr_write,
1255	.read = openpic_tmr_read,
1256	.start_addr = OPENPIC_TMR_REG_START,
1257	.size = OPENPIC_TMR_REG_SIZE,
1258};
1259
1260static const struct mem_reg openpic_cpu_mmio = {
1261	.write = openpic_cpu_write,
1262	.read = openpic_cpu_read,
1263	.start_addr = OPENPIC_CPU_REG_START,
1264	.size = OPENPIC_CPU_REG_SIZE,
1265};
1266
1267static const struct mem_reg openpic_src_mmio = {
1268	.write = openpic_src_write,
1269	.read = openpic_src_read,
1270	.start_addr = OPENPIC_SRC_REG_START,
1271	.size = OPENPIC_SRC_REG_SIZE,
1272};
1273
1274static const struct mem_reg openpic_msi_mmio = {
1275	.read = openpic_msi_read,
1276	.write = openpic_msi_write,
1277	.start_addr = OPENPIC_MSI_REG_START,
1278	.size = OPENPIC_MSI_REG_SIZE,
1279};
1280
1281static const struct mem_reg openpic_summary_mmio = {
1282	.read = openpic_summary_read,
1283	.write = openpic_summary_write,
1284	.start_addr = OPENPIC_SUMMARY_REG_START,
1285	.size = OPENPIC_SUMMARY_REG_SIZE,
1286};
1287
1288static void add_mmio_region(struct openpic *opp, const struct mem_reg *mr)
1289{
1290	if (opp->num_mmio_regions >= MAX_MMIO_REGIONS) {
1291		WARN(1, "kvm mpic: too many mmio regions\n");
1292		return;
1293	}
1294
1295	opp->mmio_regions[opp->num_mmio_regions++] = mr;
1296}
1297
1298static void fsl_common_init(struct openpic *opp)
1299{
1300	int i;
1301	int virq = MAX_SRC;
1302
1303	add_mmio_region(opp, &openpic_msi_mmio);
1304	add_mmio_region(opp, &openpic_summary_mmio);
1305
1306	opp->vid = VID_REVISION_1_2;
1307	opp->vir = VIR_GENERIC;
1308	opp->vector_mask = 0xFFFF;
1309	opp->tfrr_reset = 0;
1310	opp->ivpr_reset = IVPR_MASK_MASK;
1311	opp->idr_reset = 1 << 0;
1312	opp->max_irq = MAX_IRQ;
1313
1314	opp->irq_ipi0 = virq;
1315	virq += MAX_IPI;
1316	opp->irq_tim0 = virq;
1317	virq += MAX_TMR;
1318
1319	BUG_ON(virq > MAX_IRQ);
1320
1321	opp->irq_msi = 224;
1322
1323	for (i = 0; i < opp->fsl->max_ext; i++)
1324		opp->src[i].level = false;
1325
1326	/* Internal interrupts, including message and MSI */
1327	for (i = 16; i < MAX_SRC; i++) {
1328		opp->src[i].type = IRQ_TYPE_FSLINT;
1329		opp->src[i].level = true;
1330	}
1331
1332	/* timers and IPIs */
1333	for (i = MAX_SRC; i < virq; i++) {
1334		opp->src[i].type = IRQ_TYPE_FSLSPECIAL;
1335		opp->src[i].level = false;
1336	}
1337}
1338
1339static int kvm_mpic_read_internal(struct openpic *opp, gpa_t addr, u32 *ptr)
1340{
1341	int i;
1342
1343	for (i = 0; i < opp->num_mmio_regions; i++) {
1344		const struct mem_reg *mr = opp->mmio_regions[i];
1345
1346		if (mr->start_addr > addr || addr >= mr->start_addr + mr->size)
1347			continue;
1348
1349		return mr->read(opp, addr - mr->start_addr, ptr);
1350	}
1351
1352	return -ENXIO;
1353}
1354
1355static int kvm_mpic_write_internal(struct openpic *opp, gpa_t addr, u32 val)
1356{
1357	int i;
1358
1359	for (i = 0; i < opp->num_mmio_regions; i++) {
1360		const struct mem_reg *mr = opp->mmio_regions[i];
1361
1362		if (mr->start_addr > addr || addr >= mr->start_addr + mr->size)
1363			continue;
1364
1365		return mr->write(opp, addr - mr->start_addr, val);
1366	}
1367
1368	return -ENXIO;
1369}
1370
1371static int kvm_mpic_read(struct kvm_vcpu *vcpu,
1372			 struct kvm_io_device *this,
1373			 gpa_t addr, int len, void *ptr)
1374{
1375	struct openpic *opp = container_of(this, struct openpic, mmio);
1376	int ret;
1377	union {
1378		u32 val;
1379		u8 bytes[4];
1380	} u;
1381
1382	if (addr & (len - 1)) {
1383		pr_debug("%s: bad alignment %llx/%d\n",
1384			 __func__, addr, len);
1385		return -EINVAL;
1386	}
1387
1388	spin_lock_irq(&opp->lock);
1389	ret = kvm_mpic_read_internal(opp, addr - opp->reg_base, &u.val);
1390	spin_unlock_irq(&opp->lock);
1391
1392	/*
1393	 * Technically only 32-bit accesses are allowed, but be nice to
1394	 * people dumping registers a byte at a time -- it works in real
1395	 * hardware (reads only, not writes).
1396	 */
1397	if (len == 4) {
1398		*(u32 *)ptr = u.val;
1399		pr_debug("%s: addr %llx ret %d len 4 val %x\n",
1400			 __func__, addr, ret, u.val);
1401	} else if (len == 1) {
1402		*(u8 *)ptr = u.bytes[addr & 3];
1403		pr_debug("%s: addr %llx ret %d len 1 val %x\n",
1404			 __func__, addr, ret, u.bytes[addr & 3]);
1405	} else {
1406		pr_debug("%s: bad length %d\n", __func__, len);
1407		return -EINVAL;
1408	}
1409
1410	return ret;
1411}
1412
1413static int kvm_mpic_write(struct kvm_vcpu *vcpu,
1414			  struct kvm_io_device *this,
1415			  gpa_t addr, int len, const void *ptr)
1416{
1417	struct openpic *opp = container_of(this, struct openpic, mmio);
1418	int ret;
1419
1420	if (len != 4) {
1421		pr_debug("%s: bad length %d\n", __func__, len);
1422		return -EOPNOTSUPP;
1423	}
1424	if (addr & 3) {
1425		pr_debug("%s: bad alignment %llx/%d\n", __func__, addr, len);
1426		return -EOPNOTSUPP;
1427	}
1428
1429	spin_lock_irq(&opp->lock);
1430	ret = kvm_mpic_write_internal(opp, addr - opp->reg_base,
1431				      *(const u32 *)ptr);
1432	spin_unlock_irq(&opp->lock);
1433
1434	pr_debug("%s: addr %llx ret %d val %x\n",
1435		 __func__, addr, ret, *(const u32 *)ptr);
1436
1437	return ret;
1438}
1439
1440static const struct kvm_io_device_ops mpic_mmio_ops = {
1441	.read = kvm_mpic_read,
1442	.write = kvm_mpic_write,
1443};
1444
1445static void map_mmio(struct openpic *opp)
1446{
1447	kvm_iodevice_init(&opp->mmio, &mpic_mmio_ops);
1448
1449	kvm_io_bus_register_dev(opp->kvm, KVM_MMIO_BUS,
1450				opp->reg_base, OPENPIC_REG_SIZE,
1451				&opp->mmio);
1452}
1453
1454static void unmap_mmio(struct openpic *opp)
1455{
1456	kvm_io_bus_unregister_dev(opp->kvm, KVM_MMIO_BUS, &opp->mmio);
1457}
1458
1459static int set_base_addr(struct openpic *opp, struct kvm_device_attr *attr)
1460{
1461	u64 base;
1462
1463	if (copy_from_user(&base, (u64 __user *)(long)attr->addr, sizeof(u64)))
1464		return -EFAULT;
1465
1466	if (base & 0x3ffff) {
1467		pr_debug("kvm mpic %s: KVM_DEV_MPIC_BASE_ADDR %08llx not aligned\n",
1468			 __func__, base);
1469		return -EINVAL;
1470	}
1471
1472	if (base == opp->reg_base)
1473		return 0;
1474
1475	mutex_lock(&opp->kvm->slots_lock);
1476
1477	unmap_mmio(opp);
1478	opp->reg_base = base;
1479
1480	pr_debug("kvm mpic %s: KVM_DEV_MPIC_BASE_ADDR %08llx\n",
1481		 __func__, base);
1482
1483	if (base == 0)
1484		goto out;
1485
1486	map_mmio(opp);
1487
1488out:
1489	mutex_unlock(&opp->kvm->slots_lock);
1490	return 0;
1491}
1492
1493#define ATTR_SET		0
1494#define ATTR_GET		1
1495
1496static int access_reg(struct openpic *opp, gpa_t addr, u32 *val, int type)
1497{
1498	int ret;
1499
1500	if (addr & 3)
1501		return -ENXIO;
1502
1503	spin_lock_irq(&opp->lock);
1504
1505	if (type == ATTR_SET)
1506		ret = kvm_mpic_write_internal(opp, addr, *val);
1507	else
1508		ret = kvm_mpic_read_internal(opp, addr, val);
1509
1510	spin_unlock_irq(&opp->lock);
1511
1512	pr_debug("%s: type %d addr %llx val %x\n", __func__, type, addr, *val);
1513
1514	return ret;
1515}
1516
1517static int mpic_set_attr(struct kvm_device *dev, struct kvm_device_attr *attr)
1518{
1519	struct openpic *opp = dev->private;
1520	u32 attr32;
1521
1522	switch (attr->group) {
1523	case KVM_DEV_MPIC_GRP_MISC:
1524		switch (attr->attr) {
1525		case KVM_DEV_MPIC_BASE_ADDR:
1526			return set_base_addr(opp, attr);
1527		}
1528
1529		break;
1530
1531	case KVM_DEV_MPIC_GRP_REGISTER:
1532		if (get_user(attr32, (u32 __user *)(long)attr->addr))
1533			return -EFAULT;
1534
1535		return access_reg(opp, attr->attr, &attr32, ATTR_SET);
1536
1537	case KVM_DEV_MPIC_GRP_IRQ_ACTIVE:
1538		if (attr->attr > MAX_SRC)
1539			return -EINVAL;
1540
1541		if (get_user(attr32, (u32 __user *)(long)attr->addr))
1542			return -EFAULT;
1543
1544		if (attr32 != 0 && attr32 != 1)
1545			return -EINVAL;
1546
1547		spin_lock_irq(&opp->lock);
1548		openpic_set_irq(opp, attr->attr, attr32);
1549		spin_unlock_irq(&opp->lock);
1550		return 0;
1551	}
1552
1553	return -ENXIO;
1554}
1555
1556static int mpic_get_attr(struct kvm_device *dev, struct kvm_device_attr *attr)
1557{
1558	struct openpic *opp = dev->private;
1559	u64 attr64;
1560	u32 attr32;
1561	int ret;
1562
1563	switch (attr->group) {
1564	case KVM_DEV_MPIC_GRP_MISC:
1565		switch (attr->attr) {
1566		case KVM_DEV_MPIC_BASE_ADDR:
1567			mutex_lock(&opp->kvm->slots_lock);
1568			attr64 = opp->reg_base;
1569			mutex_unlock(&opp->kvm->slots_lock);
1570
1571			if (copy_to_user((u64 __user *)(long)attr->addr,
1572					 &attr64, sizeof(u64)))
1573				return -EFAULT;
1574
1575			return 0;
1576		}
1577
1578		break;
1579
1580	case KVM_DEV_MPIC_GRP_REGISTER:
1581		ret = access_reg(opp, attr->attr, &attr32, ATTR_GET);
1582		if (ret)
1583			return ret;
1584
1585		if (put_user(attr32, (u32 __user *)(long)attr->addr))
1586			return -EFAULT;
1587
1588		return 0;
1589
1590	case KVM_DEV_MPIC_GRP_IRQ_ACTIVE:
1591		if (attr->attr > MAX_SRC)
1592			return -EINVAL;
1593
1594		spin_lock_irq(&opp->lock);
1595		attr32 = opp->src[attr->attr].pending;
1596		spin_unlock_irq(&opp->lock);
1597
1598		if (put_user(attr32, (u32 __user *)(long)attr->addr))
1599			return -EFAULT;
1600
1601		return 0;
1602	}
1603
1604	return -ENXIO;
1605}
1606
1607static int mpic_has_attr(struct kvm_device *dev, struct kvm_device_attr *attr)
1608{
1609	switch (attr->group) {
1610	case KVM_DEV_MPIC_GRP_MISC:
1611		switch (attr->attr) {
1612		case KVM_DEV_MPIC_BASE_ADDR:
1613			return 0;
1614		}
1615
1616		break;
1617
1618	case KVM_DEV_MPIC_GRP_REGISTER:
1619		return 0;
1620
1621	case KVM_DEV_MPIC_GRP_IRQ_ACTIVE:
1622		if (attr->attr > MAX_SRC)
1623			break;
1624
1625		return 0;
1626	}
1627
1628	return -ENXIO;
1629}
1630
1631static void mpic_destroy(struct kvm_device *dev)
1632{
1633	struct openpic *opp = dev->private;
1634
1635	dev->kvm->arch.mpic = NULL;
1636	kfree(opp);
1637	kfree(dev);
1638}
1639
1640static int mpic_set_default_irq_routing(struct openpic *opp)
1641{
1642	struct kvm_irq_routing_entry *routing;
1643
1644	/* Create a nop default map, so that dereferencing it still works */
1645	routing = kzalloc((sizeof(*routing)), GFP_KERNEL);
1646	if (!routing)
1647		return -ENOMEM;
1648
1649	kvm_set_irq_routing(opp->kvm, routing, 0, 0);
1650
1651	kfree(routing);
1652	return 0;
1653}
1654
1655static int mpic_create(struct kvm_device *dev, u32 type)
1656{
1657	struct openpic *opp;
1658	int ret;
1659
1660	/* We only support one MPIC at a time for now */
1661	if (dev->kvm->arch.mpic)
1662		return -EINVAL;
1663
1664	opp = kzalloc(sizeof(struct openpic), GFP_KERNEL);
1665	if (!opp)
1666		return -ENOMEM;
1667
1668	dev->private = opp;
1669	opp->kvm = dev->kvm;
1670	opp->dev = dev;
1671	opp->model = type;
1672	spin_lock_init(&opp->lock);
1673
1674	add_mmio_region(opp, &openpic_gbl_mmio);
1675	add_mmio_region(opp, &openpic_tmr_mmio);
1676	add_mmio_region(opp, &openpic_src_mmio);
1677	add_mmio_region(opp, &openpic_cpu_mmio);
1678
1679	switch (opp->model) {
1680	case KVM_DEV_TYPE_FSL_MPIC_20:
1681		opp->fsl = &fsl_mpic_20;
1682		opp->brr1 = 0x00400200;
1683		opp->flags |= OPENPIC_FLAG_IDR_CRIT;
1684		opp->nb_irqs = 80;
1685		opp->mpic_mode_mask = GCR_MODE_MIXED;
1686
1687		fsl_common_init(opp);
1688
1689		break;
1690
1691	case KVM_DEV_TYPE_FSL_MPIC_42:
1692		opp->fsl = &fsl_mpic_42;
1693		opp->brr1 = 0x00400402;
1694		opp->flags |= OPENPIC_FLAG_ILR;
1695		opp->nb_irqs = 196;
1696		opp->mpic_mode_mask = GCR_MODE_PROXY;
1697
1698		fsl_common_init(opp);
1699
1700		break;
1701
1702	default:
1703		ret = -ENODEV;
1704		goto err;
1705	}
1706
1707	ret = mpic_set_default_irq_routing(opp);
1708	if (ret)
1709		goto err;
1710
1711	openpic_reset(opp);
1712
1713	smp_wmb();
1714	dev->kvm->arch.mpic = opp;
1715
1716	return 0;
1717
1718err:
1719	kfree(opp);
1720	return ret;
1721}
1722
1723struct kvm_device_ops kvm_mpic_ops = {
1724	.name = "kvm-mpic",
1725	.create = mpic_create,
1726	.destroy = mpic_destroy,
1727	.set_attr = mpic_set_attr,
1728	.get_attr = mpic_get_attr,
1729	.has_attr = mpic_has_attr,
1730};
1731
1732int kvmppc_mpic_connect_vcpu(struct kvm_device *dev, struct kvm_vcpu *vcpu,
1733			     u32 cpu)
1734{
1735	struct openpic *opp = dev->private;
1736	int ret = 0;
1737
1738	if (dev->ops != &kvm_mpic_ops)
1739		return -EPERM;
1740	if (opp->kvm != vcpu->kvm)
1741		return -EPERM;
1742	if (cpu < 0 || cpu >= MAX_CPU)
1743		return -EPERM;
1744
1745	spin_lock_irq(&opp->lock);
1746
1747	if (opp->dst[cpu].vcpu) {
1748		ret = -EEXIST;
1749		goto out;
1750	}
1751	if (vcpu->arch.irq_type) {
1752		ret = -EBUSY;
1753		goto out;
1754	}
1755
1756	opp->dst[cpu].vcpu = vcpu;
1757	opp->nb_cpus = max(opp->nb_cpus, cpu + 1);
1758
1759	vcpu->arch.mpic = opp;
1760	vcpu->arch.irq_cpu_id = cpu;
1761	vcpu->arch.irq_type = KVMPPC_IRQ_MPIC;
1762
1763	/* This might need to be changed if GCR gets extended */
1764	if (opp->mpic_mode_mask == GCR_MODE_PROXY)
1765		vcpu->arch.epr_flags |= KVMPPC_EPR_KERNEL;
1766
1767out:
1768	spin_unlock_irq(&opp->lock);
1769	return ret;
1770}
1771
1772/*
1773 * This should only happen immediately before the mpic is destroyed,
1774 * so we shouldn't need to worry about anything still trying to
1775 * access the vcpu pointer.
1776 */
1777void kvmppc_mpic_disconnect_vcpu(struct openpic *opp, struct kvm_vcpu *vcpu)
1778{
1779	BUG_ON(!opp->dst[vcpu->arch.irq_cpu_id].vcpu);
1780
1781	opp->dst[vcpu->arch.irq_cpu_id].vcpu = NULL;
1782}
1783
1784/*
1785 * Return value:
1786 *  < 0   Interrupt was ignored (masked or not delivered for other reasons)
1787 *  = 0   Interrupt was coalesced (previous irq is still pending)
1788 *  > 0   Number of CPUs interrupt was delivered to
1789 */
1790static int mpic_set_irq(struct kvm_kernel_irq_routing_entry *e,
1791			struct kvm *kvm, int irq_source_id, int level,
1792			bool line_status)
1793{
1794	u32 irq = e->irqchip.pin;
1795	struct openpic *opp = kvm->arch.mpic;
1796	unsigned long flags;
1797
1798	spin_lock_irqsave(&opp->lock, flags);
1799	openpic_set_irq(opp, irq, level);
1800	spin_unlock_irqrestore(&opp->lock, flags);
1801
1802	/* All code paths we care about don't check for the return value */
1803	return 0;
1804}
1805
1806int kvm_set_msi(struct kvm_kernel_irq_routing_entry *e,
1807		struct kvm *kvm, int irq_source_id, int level, bool line_status)
1808{
1809	struct openpic *opp = kvm->arch.mpic;
1810	unsigned long flags;
1811
1812	spin_lock_irqsave(&opp->lock, flags);
1813
1814	/*
1815	 * XXX We ignore the target address for now, as we only support
1816	 *     a single MSI bank.
1817	 */
1818	openpic_msi_write(kvm->arch.mpic, MSIIR_OFFSET, e->msi.data);
1819	spin_unlock_irqrestore(&opp->lock, flags);
1820
1821	/* All code paths we care about don't check for the return value */
1822	return 0;
1823}
1824
1825int kvm_set_routing_entry(struct kvm *kvm,
1826			  struct kvm_kernel_irq_routing_entry *e,
1827			  const struct kvm_irq_routing_entry *ue)
1828{
1829	int r = -EINVAL;
1830
1831	switch (ue->type) {
1832	case KVM_IRQ_ROUTING_IRQCHIP:
1833		e->set = mpic_set_irq;
1834		e->irqchip.irqchip = ue->u.irqchip.irqchip;
1835		e->irqchip.pin = ue->u.irqchip.pin;
1836		if (e->irqchip.pin >= KVM_IRQCHIP_NUM_PINS)
1837			goto out;
1838		break;
1839	case KVM_IRQ_ROUTING_MSI:
1840		e->set = kvm_set_msi;
1841		e->msi.address_lo = ue->u.msi.address_lo;
1842		e->msi.address_hi = ue->u.msi.address_hi;
1843		e->msi.data = ue->u.msi.data;
1844		break;
1845	default:
1846		goto out;
1847	}
1848
1849	r = 0;
1850out:
1851	return r;
1852}
v5.4
   1/*
   2 * OpenPIC emulation
   3 *
   4 * Copyright (c) 2004 Jocelyn Mayer
   5 *               2011 Alexander Graf
   6 *
   7 * Permission is hereby granted, free of charge, to any person obtaining a copy
   8 * of this software and associated documentation files (the "Software"), to deal
   9 * in the Software without restriction, including without limitation the rights
  10 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  11 * copies of the Software, and to permit persons to whom the Software is
  12 * furnished to do so, subject to the following conditions:
  13 *
  14 * The above copyright notice and this permission notice shall be included in
  15 * all copies or substantial portions of the Software.
  16 *
  17 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  18 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  19 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
  20 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  21 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  22 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  23 * THE SOFTWARE.
  24 */
  25
  26#include <linux/slab.h>
  27#include <linux/mutex.h>
  28#include <linux/kvm_host.h>
  29#include <linux/errno.h>
  30#include <linux/fs.h>
  31#include <linux/anon_inodes.h>
  32#include <linux/uaccess.h>
  33#include <asm/mpic.h>
  34#include <asm/kvm_para.h>
  35#include <asm/kvm_host.h>
  36#include <asm/kvm_ppc.h>
  37#include <kvm/iodev.h>
  38
  39#define MAX_CPU     32
  40#define MAX_SRC     256
  41#define MAX_TMR     4
  42#define MAX_IPI     4
  43#define MAX_MSI     8
  44#define MAX_IRQ     (MAX_SRC + MAX_IPI + MAX_TMR)
  45#define VID         0x03	/* MPIC version ID */
  46
  47/* OpenPIC capability flags */
  48#define OPENPIC_FLAG_IDR_CRIT     (1 << 0)
  49#define OPENPIC_FLAG_ILR          (2 << 0)
  50
  51/* OpenPIC address map */
  52#define OPENPIC_REG_SIZE             0x40000
  53#define OPENPIC_GLB_REG_START        0x0
  54#define OPENPIC_GLB_REG_SIZE         0x10F0
  55#define OPENPIC_TMR_REG_START        0x10F0
  56#define OPENPIC_TMR_REG_SIZE         0x220
  57#define OPENPIC_MSI_REG_START        0x1600
  58#define OPENPIC_MSI_REG_SIZE         0x200
  59#define OPENPIC_SUMMARY_REG_START    0x3800
  60#define OPENPIC_SUMMARY_REG_SIZE     0x800
  61#define OPENPIC_SRC_REG_START        0x10000
  62#define OPENPIC_SRC_REG_SIZE         (MAX_SRC * 0x20)
  63#define OPENPIC_CPU_REG_START        0x20000
  64#define OPENPIC_CPU_REG_SIZE         (0x100 + ((MAX_CPU - 1) * 0x1000))
  65
  66struct fsl_mpic_info {
  67	int max_ext;
  68};
  69
  70static struct fsl_mpic_info fsl_mpic_20 = {
  71	.max_ext = 12,
  72};
  73
  74static struct fsl_mpic_info fsl_mpic_42 = {
  75	.max_ext = 12,
  76};
  77
  78#define FRR_NIRQ_SHIFT    16
  79#define FRR_NCPU_SHIFT     8
  80#define FRR_VID_SHIFT      0
  81
  82#define VID_REVISION_1_2   2
  83#define VID_REVISION_1_3   3
  84
  85#define VIR_GENERIC      0x00000000	/* Generic Vendor ID */
  86
  87#define GCR_RESET        0x80000000
  88#define GCR_MODE_PASS    0x00000000
  89#define GCR_MODE_MIXED   0x20000000
  90#define GCR_MODE_PROXY   0x60000000
  91
  92#define TBCR_CI           0x80000000	/* count inhibit */
  93#define TCCR_TOG          0x80000000	/* toggles when decrement to zero */
  94
  95#define IDR_EP_SHIFT      31
  96#define IDR_EP_MASK       (1 << IDR_EP_SHIFT)
  97#define IDR_CI0_SHIFT     30
  98#define IDR_CI1_SHIFT     29
  99#define IDR_P1_SHIFT      1
 100#define IDR_P0_SHIFT      0
 101
 102#define ILR_INTTGT_MASK   0x000000ff
 103#define ILR_INTTGT_INT    0x00
 104#define ILR_INTTGT_CINT   0x01	/* critical */
 105#define ILR_INTTGT_MCP    0x02	/* machine check */
 106#define NUM_OUTPUTS       3
 107
 108#define MSIIR_OFFSET       0x140
 109#define MSIIR_SRS_SHIFT    29
 110#define MSIIR_SRS_MASK     (0x7 << MSIIR_SRS_SHIFT)
 111#define MSIIR_IBS_SHIFT    24
 112#define MSIIR_IBS_MASK     (0x1f << MSIIR_IBS_SHIFT)
 113
 114static int get_current_cpu(void)
 115{
 116#if defined(CONFIG_KVM) && defined(CONFIG_BOOKE)
 117	struct kvm_vcpu *vcpu = current->thread.kvm_vcpu;
 118	return vcpu ? vcpu->arch.irq_cpu_id : -1;
 119#else
 120	/* XXX */
 121	return -1;
 122#endif
 123}
 124
 125static int openpic_cpu_write_internal(void *opaque, gpa_t addr,
 126				      u32 val, int idx);
 127static int openpic_cpu_read_internal(void *opaque, gpa_t addr,
 128				     u32 *ptr, int idx);
 129static inline void write_IRQreg_idr(struct openpic *opp, int n_IRQ,
 130				    uint32_t val);
 131
 132enum irq_type {
 133	IRQ_TYPE_NORMAL = 0,
 134	IRQ_TYPE_FSLINT,	/* FSL internal interrupt -- level only */
 135	IRQ_TYPE_FSLSPECIAL,	/* FSL timer/IPI interrupt, edge, no polarity */
 136};
 137
 138struct irq_queue {
 139	/* Round up to the nearest 64 IRQs so that the queue length
 140	 * won't change when moving between 32 and 64 bit hosts.
 141	 */
 142	unsigned long queue[BITS_TO_LONGS((MAX_IRQ + 63) & ~63)];
 143	int next;
 144	int priority;
 145};
 146
 147struct irq_source {
 148	uint32_t ivpr;		/* IRQ vector/priority register */
 149	uint32_t idr;		/* IRQ destination register */
 150	uint32_t destmask;	/* bitmap of CPU destinations */
 151	int last_cpu;
 152	int output;		/* IRQ level, e.g. ILR_INTTGT_INT */
 153	int pending;		/* TRUE if IRQ is pending */
 154	enum irq_type type;
 155	bool level:1;		/* level-triggered */
 156	bool nomask:1;	/* critical interrupts ignore mask on some FSL MPICs */
 157};
 158
 159#define IVPR_MASK_SHIFT       31
 160#define IVPR_MASK_MASK        (1 << IVPR_MASK_SHIFT)
 161#define IVPR_ACTIVITY_SHIFT   30
 162#define IVPR_ACTIVITY_MASK    (1 << IVPR_ACTIVITY_SHIFT)
 163#define IVPR_MODE_SHIFT       29
 164#define IVPR_MODE_MASK        (1 << IVPR_MODE_SHIFT)
 165#define IVPR_POLARITY_SHIFT   23
 166#define IVPR_POLARITY_MASK    (1 << IVPR_POLARITY_SHIFT)
 167#define IVPR_SENSE_SHIFT      22
 168#define IVPR_SENSE_MASK       (1 << IVPR_SENSE_SHIFT)
 169
 170#define IVPR_PRIORITY_MASK     (0xF << 16)
 171#define IVPR_PRIORITY(_ivprr_) ((int)(((_ivprr_) & IVPR_PRIORITY_MASK) >> 16))
 172#define IVPR_VECTOR(opp, _ivprr_) ((_ivprr_) & (opp)->vector_mask)
 173
 174/* IDR[EP/CI] are only for FSL MPIC prior to v4.0 */
 175#define IDR_EP      0x80000000	/* external pin */
 176#define IDR_CI      0x40000000	/* critical interrupt */
 177
 178struct irq_dest {
 179	struct kvm_vcpu *vcpu;
 180
 181	int32_t ctpr;		/* CPU current task priority */
 182	struct irq_queue raised;
 183	struct irq_queue servicing;
 184
 185	/* Count of IRQ sources asserting on non-INT outputs */
 186	uint32_t outputs_active[NUM_OUTPUTS];
 187};
 188
 189#define MAX_MMIO_REGIONS 10
 190
 191struct openpic {
 192	struct kvm *kvm;
 193	struct kvm_device *dev;
 194	struct kvm_io_device mmio;
 195	const struct mem_reg *mmio_regions[MAX_MMIO_REGIONS];
 196	int num_mmio_regions;
 197
 198	gpa_t reg_base;
 199	spinlock_t lock;
 200
 201	/* Behavior control */
 202	struct fsl_mpic_info *fsl;
 203	uint32_t model;
 204	uint32_t flags;
 205	uint32_t nb_irqs;
 206	uint32_t vid;
 207	uint32_t vir;		/* Vendor identification register */
 208	uint32_t vector_mask;
 209	uint32_t tfrr_reset;
 210	uint32_t ivpr_reset;
 211	uint32_t idr_reset;
 212	uint32_t brr1;
 213	uint32_t mpic_mode_mask;
 214
 215	/* Global registers */
 216	uint32_t frr;		/* Feature reporting register */
 217	uint32_t gcr;		/* Global configuration register  */
 218	uint32_t pir;		/* Processor initialization register */
 219	uint32_t spve;		/* Spurious vector register */
 220	uint32_t tfrr;		/* Timer frequency reporting register */
 221	/* Source registers */
 222	struct irq_source src[MAX_IRQ];
 223	/* Local registers per output pin */
 224	struct irq_dest dst[MAX_CPU];
 225	uint32_t nb_cpus;
 226	/* Timer registers */
 227	struct {
 228		uint32_t tccr;	/* Global timer current count register */
 229		uint32_t tbcr;	/* Global timer base count register */
 230	} timers[MAX_TMR];
 231	/* Shared MSI registers */
 232	struct {
 233		uint32_t msir;	/* Shared Message Signaled Interrupt Register */
 234	} msi[MAX_MSI];
 235	uint32_t max_irq;
 236	uint32_t irq_ipi0;
 237	uint32_t irq_tim0;
 238	uint32_t irq_msi;
 239};
 240
 241
 242static void mpic_irq_raise(struct openpic *opp, struct irq_dest *dst,
 243			   int output)
 244{
 245	struct kvm_interrupt irq = {
 246		.irq = KVM_INTERRUPT_SET_LEVEL,
 247	};
 248
 249	if (!dst->vcpu) {
 250		pr_debug("%s: destination cpu %d does not exist\n",
 251			 __func__, (int)(dst - &opp->dst[0]));
 252		return;
 253	}
 254
 255	pr_debug("%s: cpu %d output %d\n", __func__, dst->vcpu->arch.irq_cpu_id,
 256		output);
 257
 258	if (output != ILR_INTTGT_INT)	/* TODO */
 259		return;
 260
 261	kvm_vcpu_ioctl_interrupt(dst->vcpu, &irq);
 262}
 263
 264static void mpic_irq_lower(struct openpic *opp, struct irq_dest *dst,
 265			   int output)
 266{
 267	if (!dst->vcpu) {
 268		pr_debug("%s: destination cpu %d does not exist\n",
 269			 __func__, (int)(dst - &opp->dst[0]));
 270		return;
 271	}
 272
 273	pr_debug("%s: cpu %d output %d\n", __func__, dst->vcpu->arch.irq_cpu_id,
 274		output);
 275
 276	if (output != ILR_INTTGT_INT)	/* TODO */
 277		return;
 278
 279	kvmppc_core_dequeue_external(dst->vcpu);
 280}
 281
 282static inline void IRQ_setbit(struct irq_queue *q, int n_IRQ)
 283{
 284	set_bit(n_IRQ, q->queue);
 285}
 286
 287static inline void IRQ_resetbit(struct irq_queue *q, int n_IRQ)
 288{
 289	clear_bit(n_IRQ, q->queue);
 290}
 291
 292static void IRQ_check(struct openpic *opp, struct irq_queue *q)
 293{
 294	int irq = -1;
 295	int next = -1;
 296	int priority = -1;
 297
 298	for (;;) {
 299		irq = find_next_bit(q->queue, opp->max_irq, irq + 1);
 300		if (irq == opp->max_irq)
 301			break;
 302
 303		pr_debug("IRQ_check: irq %d set ivpr_pr=%d pr=%d\n",
 304			irq, IVPR_PRIORITY(opp->src[irq].ivpr), priority);
 305
 306		if (IVPR_PRIORITY(opp->src[irq].ivpr) > priority) {
 307			next = irq;
 308			priority = IVPR_PRIORITY(opp->src[irq].ivpr);
 309		}
 310	}
 311
 312	q->next = next;
 313	q->priority = priority;
 314}
 315
 316static int IRQ_get_next(struct openpic *opp, struct irq_queue *q)
 317{
 318	/* XXX: optimize */
 319	IRQ_check(opp, q);
 320
 321	return q->next;
 322}
 323
 324static void IRQ_local_pipe(struct openpic *opp, int n_CPU, int n_IRQ,
 325			   bool active, bool was_active)
 326{
 327	struct irq_dest *dst;
 328	struct irq_source *src;
 329	int priority;
 330
 331	dst = &opp->dst[n_CPU];
 332	src = &opp->src[n_IRQ];
 333
 334	pr_debug("%s: IRQ %d active %d was %d\n",
 335		__func__, n_IRQ, active, was_active);
 336
 337	if (src->output != ILR_INTTGT_INT) {
 338		pr_debug("%s: output %d irq %d active %d was %d count %d\n",
 339			__func__, src->output, n_IRQ, active, was_active,
 340			dst->outputs_active[src->output]);
 341
 342		/* On Freescale MPIC, critical interrupts ignore priority,
 343		 * IACK, EOI, etc.  Before MPIC v4.1 they also ignore
 344		 * masking.
 345		 */
 346		if (active) {
 347			if (!was_active &&
 348			    dst->outputs_active[src->output]++ == 0) {
 349				pr_debug("%s: Raise OpenPIC output %d cpu %d irq %d\n",
 350					__func__, src->output, n_CPU, n_IRQ);
 351				mpic_irq_raise(opp, dst, src->output);
 352			}
 353		} else {
 354			if (was_active &&
 355			    --dst->outputs_active[src->output] == 0) {
 356				pr_debug("%s: Lower OpenPIC output %d cpu %d irq %d\n",
 357					__func__, src->output, n_CPU, n_IRQ);
 358				mpic_irq_lower(opp, dst, src->output);
 359			}
 360		}
 361
 362		return;
 363	}
 364
 365	priority = IVPR_PRIORITY(src->ivpr);
 366
 367	/* Even if the interrupt doesn't have enough priority,
 368	 * it is still raised, in case ctpr is lowered later.
 369	 */
 370	if (active)
 371		IRQ_setbit(&dst->raised, n_IRQ);
 372	else
 373		IRQ_resetbit(&dst->raised, n_IRQ);
 374
 375	IRQ_check(opp, &dst->raised);
 376
 377	if (active && priority <= dst->ctpr) {
 378		pr_debug("%s: IRQ %d priority %d too low for ctpr %d on CPU %d\n",
 379			__func__, n_IRQ, priority, dst->ctpr, n_CPU);
 380		active = 0;
 381	}
 382
 383	if (active) {
 384		if (IRQ_get_next(opp, &dst->servicing) >= 0 &&
 385		    priority <= dst->servicing.priority) {
 386			pr_debug("%s: IRQ %d is hidden by servicing IRQ %d on CPU %d\n",
 387				__func__, n_IRQ, dst->servicing.next, n_CPU);
 388		} else {
 389			pr_debug("%s: Raise OpenPIC INT output cpu %d irq %d/%d\n",
 390				__func__, n_CPU, n_IRQ, dst->raised.next);
 391			mpic_irq_raise(opp, dst, ILR_INTTGT_INT);
 392		}
 393	} else {
 394		IRQ_get_next(opp, &dst->servicing);
 395		if (dst->raised.priority > dst->ctpr &&
 396		    dst->raised.priority > dst->servicing.priority) {
 397			pr_debug("%s: IRQ %d inactive, IRQ %d prio %d above %d/%d, CPU %d\n",
 398				__func__, n_IRQ, dst->raised.next,
 399				dst->raised.priority, dst->ctpr,
 400				dst->servicing.priority, n_CPU);
 401			/* IRQ line stays asserted */
 402		} else {
 403			pr_debug("%s: IRQ %d inactive, current prio %d/%d, CPU %d\n",
 404				__func__, n_IRQ, dst->ctpr,
 405				dst->servicing.priority, n_CPU);
 406			mpic_irq_lower(opp, dst, ILR_INTTGT_INT);
 407		}
 408	}
 409}
 410
 411/* update pic state because registers for n_IRQ have changed value */
 412static void openpic_update_irq(struct openpic *opp, int n_IRQ)
 413{
 414	struct irq_source *src;
 415	bool active, was_active;
 416	int i;
 417
 418	src = &opp->src[n_IRQ];
 419	active = src->pending;
 420
 421	if ((src->ivpr & IVPR_MASK_MASK) && !src->nomask) {
 422		/* Interrupt source is disabled */
 423		pr_debug("%s: IRQ %d is disabled\n", __func__, n_IRQ);
 424		active = false;
 425	}
 426
 427	was_active = !!(src->ivpr & IVPR_ACTIVITY_MASK);
 428
 429	/*
 430	 * We don't have a similar check for already-active because
 431	 * ctpr may have changed and we need to withdraw the interrupt.
 432	 */
 433	if (!active && !was_active) {
 434		pr_debug("%s: IRQ %d is already inactive\n", __func__, n_IRQ);
 435		return;
 436	}
 437
 438	if (active)
 439		src->ivpr |= IVPR_ACTIVITY_MASK;
 440	else
 441		src->ivpr &= ~IVPR_ACTIVITY_MASK;
 442
 443	if (src->destmask == 0) {
 444		/* No target */
 445		pr_debug("%s: IRQ %d has no target\n", __func__, n_IRQ);
 446		return;
 447	}
 448
 449	if (src->destmask == (1 << src->last_cpu)) {
 450		/* Only one CPU is allowed to receive this IRQ */
 451		IRQ_local_pipe(opp, src->last_cpu, n_IRQ, active, was_active);
 452	} else if (!(src->ivpr & IVPR_MODE_MASK)) {
 453		/* Directed delivery mode */
 454		for (i = 0; i < opp->nb_cpus; i++) {
 455			if (src->destmask & (1 << i)) {
 456				IRQ_local_pipe(opp, i, n_IRQ, active,
 457					       was_active);
 458			}
 459		}
 460	} else {
 461		/* Distributed delivery mode */
 462		for (i = src->last_cpu + 1; i != src->last_cpu; i++) {
 463			if (i == opp->nb_cpus)
 464				i = 0;
 465
 466			if (src->destmask & (1 << i)) {
 467				IRQ_local_pipe(opp, i, n_IRQ, active,
 468					       was_active);
 469				src->last_cpu = i;
 470				break;
 471			}
 472		}
 473	}
 474}
 475
 476static void openpic_set_irq(void *opaque, int n_IRQ, int level)
 477{
 478	struct openpic *opp = opaque;
 479	struct irq_source *src;
 480
 481	if (n_IRQ >= MAX_IRQ) {
 482		WARN_ONCE(1, "%s: IRQ %d out of range\n", __func__, n_IRQ);
 483		return;
 484	}
 485
 486	src = &opp->src[n_IRQ];
 487	pr_debug("openpic: set irq %d = %d ivpr=0x%08x\n",
 488		n_IRQ, level, src->ivpr);
 489	if (src->level) {
 490		/* level-sensitive irq */
 491		src->pending = level;
 492		openpic_update_irq(opp, n_IRQ);
 493	} else {
 494		/* edge-sensitive irq */
 495		if (level) {
 496			src->pending = 1;
 497			openpic_update_irq(opp, n_IRQ);
 498		}
 499
 500		if (src->output != ILR_INTTGT_INT) {
 501			/* Edge-triggered interrupts shouldn't be used
 502			 * with non-INT delivery, but just in case,
 503			 * try to make it do something sane rather than
 504			 * cause an interrupt storm.  This is close to
 505			 * what you'd probably see happen in real hardware.
 506			 */
 507			src->pending = 0;
 508			openpic_update_irq(opp, n_IRQ);
 509		}
 510	}
 511}
 512
 513static void openpic_reset(struct openpic *opp)
 514{
 515	int i;
 516
 517	opp->gcr = GCR_RESET;
 518	/* Initialise controller registers */
 519	opp->frr = ((opp->nb_irqs - 1) << FRR_NIRQ_SHIFT) |
 520	    (opp->vid << FRR_VID_SHIFT);
 521
 522	opp->pir = 0;
 523	opp->spve = -1 & opp->vector_mask;
 524	opp->tfrr = opp->tfrr_reset;
 525	/* Initialise IRQ sources */
 526	for (i = 0; i < opp->max_irq; i++) {
 527		opp->src[i].ivpr = opp->ivpr_reset;
 528
 529		switch (opp->src[i].type) {
 530		case IRQ_TYPE_NORMAL:
 531			opp->src[i].level =
 532			    !!(opp->ivpr_reset & IVPR_SENSE_MASK);
 533			break;
 534
 535		case IRQ_TYPE_FSLINT:
 536			opp->src[i].ivpr |= IVPR_POLARITY_MASK;
 537			break;
 538
 539		case IRQ_TYPE_FSLSPECIAL:
 540			break;
 541		}
 542
 543		write_IRQreg_idr(opp, i, opp->idr_reset);
 544	}
 545	/* Initialise IRQ destinations */
 546	for (i = 0; i < MAX_CPU; i++) {
 547		opp->dst[i].ctpr = 15;
 548		memset(&opp->dst[i].raised, 0, sizeof(struct irq_queue));
 549		opp->dst[i].raised.next = -1;
 550		memset(&opp->dst[i].servicing, 0, sizeof(struct irq_queue));
 551		opp->dst[i].servicing.next = -1;
 552	}
 553	/* Initialise timers */
 554	for (i = 0; i < MAX_TMR; i++) {
 555		opp->timers[i].tccr = 0;
 556		opp->timers[i].tbcr = TBCR_CI;
 557	}
 558	/* Go out of RESET state */
 559	opp->gcr = 0;
 560}
 561
 562static inline uint32_t read_IRQreg_idr(struct openpic *opp, int n_IRQ)
 563{
 564	return opp->src[n_IRQ].idr;
 565}
 566
 567static inline uint32_t read_IRQreg_ilr(struct openpic *opp, int n_IRQ)
 568{
 569	if (opp->flags & OPENPIC_FLAG_ILR)
 570		return opp->src[n_IRQ].output;
 571
 572	return 0xffffffff;
 573}
 574
 575static inline uint32_t read_IRQreg_ivpr(struct openpic *opp, int n_IRQ)
 576{
 577	return opp->src[n_IRQ].ivpr;
 578}
 579
 580static inline void write_IRQreg_idr(struct openpic *opp, int n_IRQ,
 581				    uint32_t val)
 582{
 583	struct irq_source *src = &opp->src[n_IRQ];
 584	uint32_t normal_mask = (1UL << opp->nb_cpus) - 1;
 585	uint32_t crit_mask = 0;
 586	uint32_t mask = normal_mask;
 587	int crit_shift = IDR_EP_SHIFT - opp->nb_cpus;
 588	int i;
 589
 590	if (opp->flags & OPENPIC_FLAG_IDR_CRIT) {
 591		crit_mask = mask << crit_shift;
 592		mask |= crit_mask | IDR_EP;
 593	}
 594
 595	src->idr = val & mask;
 596	pr_debug("Set IDR %d to 0x%08x\n", n_IRQ, src->idr);
 597
 598	if (opp->flags & OPENPIC_FLAG_IDR_CRIT) {
 599		if (src->idr & crit_mask) {
 600			if (src->idr & normal_mask) {
 601				pr_debug("%s: IRQ configured for multiple output types, using critical\n",
 602					__func__);
 603			}
 604
 605			src->output = ILR_INTTGT_CINT;
 606			src->nomask = true;
 607			src->destmask = 0;
 608
 609			for (i = 0; i < opp->nb_cpus; i++) {
 610				int n_ci = IDR_CI0_SHIFT - i;
 611
 612				if (src->idr & (1UL << n_ci))
 613					src->destmask |= 1UL << i;
 614			}
 615		} else {
 616			src->output = ILR_INTTGT_INT;
 617			src->nomask = false;
 618			src->destmask = src->idr & normal_mask;
 619		}
 620	} else {
 621		src->destmask = src->idr;
 622	}
 623}
 624
 625static inline void write_IRQreg_ilr(struct openpic *opp, int n_IRQ,
 626				    uint32_t val)
 627{
 628	if (opp->flags & OPENPIC_FLAG_ILR) {
 629		struct irq_source *src = &opp->src[n_IRQ];
 630
 631		src->output = val & ILR_INTTGT_MASK;
 632		pr_debug("Set ILR %d to 0x%08x, output %d\n", n_IRQ, src->idr,
 633			src->output);
 634
 635		/* TODO: on MPIC v4.0 only, set nomask for non-INT */
 636	}
 637}
 638
 639static inline void write_IRQreg_ivpr(struct openpic *opp, int n_IRQ,
 640				     uint32_t val)
 641{
 642	uint32_t mask;
 643
 644	/* NOTE when implementing newer FSL MPIC models: starting with v4.0,
 645	 * the polarity bit is read-only on internal interrupts.
 646	 */
 647	mask = IVPR_MASK_MASK | IVPR_PRIORITY_MASK | IVPR_SENSE_MASK |
 648	    IVPR_POLARITY_MASK | opp->vector_mask;
 649
 650	/* ACTIVITY bit is read-only */
 651	opp->src[n_IRQ].ivpr =
 652	    (opp->src[n_IRQ].ivpr & IVPR_ACTIVITY_MASK) | (val & mask);
 653
 654	/* For FSL internal interrupts, The sense bit is reserved and zero,
 655	 * and the interrupt is always level-triggered.  Timers and IPIs
 656	 * have no sense or polarity bits, and are edge-triggered.
 657	 */
 658	switch (opp->src[n_IRQ].type) {
 659	case IRQ_TYPE_NORMAL:
 660		opp->src[n_IRQ].level =
 661		    !!(opp->src[n_IRQ].ivpr & IVPR_SENSE_MASK);
 662		break;
 663
 664	case IRQ_TYPE_FSLINT:
 665		opp->src[n_IRQ].ivpr &= ~IVPR_SENSE_MASK;
 666		break;
 667
 668	case IRQ_TYPE_FSLSPECIAL:
 669		opp->src[n_IRQ].ivpr &= ~(IVPR_POLARITY_MASK | IVPR_SENSE_MASK);
 670		break;
 671	}
 672
 673	openpic_update_irq(opp, n_IRQ);
 674	pr_debug("Set IVPR %d to 0x%08x -> 0x%08x\n", n_IRQ, val,
 675		opp->src[n_IRQ].ivpr);
 676}
 677
 678static void openpic_gcr_write(struct openpic *opp, uint64_t val)
 679{
 680	if (val & GCR_RESET) {
 681		openpic_reset(opp);
 682		return;
 683	}
 684
 685	opp->gcr &= ~opp->mpic_mode_mask;
 686	opp->gcr |= val & opp->mpic_mode_mask;
 687}
 688
 689static int openpic_gbl_write(void *opaque, gpa_t addr, u32 val)
 690{
 691	struct openpic *opp = opaque;
 692	int err = 0;
 693
 694	pr_debug("%s: addr %#llx <= %08x\n", __func__, addr, val);
 695	if (addr & 0xF)
 696		return 0;
 697
 698	switch (addr) {
 699	case 0x00:	/* Block Revision Register1 (BRR1) is Readonly */
 700		break;
 701	case 0x40:
 702	case 0x50:
 703	case 0x60:
 704	case 0x70:
 705	case 0x80:
 706	case 0x90:
 707	case 0xA0:
 708	case 0xB0:
 709		err = openpic_cpu_write_internal(opp, addr, val,
 710						 get_current_cpu());
 711		break;
 712	case 0x1000:		/* FRR */
 713		break;
 714	case 0x1020:		/* GCR */
 715		openpic_gcr_write(opp, val);
 716		break;
 717	case 0x1080:		/* VIR */
 718		break;
 719	case 0x1090:		/* PIR */
 720		/*
 721		 * This register is used to reset a CPU core --
 722		 * let userspace handle it.
 723		 */
 724		err = -ENXIO;
 725		break;
 726	case 0x10A0:		/* IPI_IVPR */
 727	case 0x10B0:
 728	case 0x10C0:
 729	case 0x10D0: {
 730		int idx;
 731		idx = (addr - 0x10A0) >> 4;
 732		write_IRQreg_ivpr(opp, opp->irq_ipi0 + idx, val);
 733		break;
 734	}
 735	case 0x10E0:		/* SPVE */
 736		opp->spve = val & opp->vector_mask;
 737		break;
 738	default:
 739		break;
 740	}
 741
 742	return err;
 743}
 744
 745static int openpic_gbl_read(void *opaque, gpa_t addr, u32 *ptr)
 746{
 747	struct openpic *opp = opaque;
 748	u32 retval;
 749	int err = 0;
 750
 751	pr_debug("%s: addr %#llx\n", __func__, addr);
 752	retval = 0xFFFFFFFF;
 753	if (addr & 0xF)
 754		goto out;
 755
 756	switch (addr) {
 757	case 0x1000:		/* FRR */
 758		retval = opp->frr;
 759		retval |= (opp->nb_cpus - 1) << FRR_NCPU_SHIFT;
 760		break;
 761	case 0x1020:		/* GCR */
 762		retval = opp->gcr;
 763		break;
 764	case 0x1080:		/* VIR */
 765		retval = opp->vir;
 766		break;
 767	case 0x1090:		/* PIR */
 768		retval = 0x00000000;
 769		break;
 770	case 0x00:		/* Block Revision Register1 (BRR1) */
 771		retval = opp->brr1;
 772		break;
 773	case 0x40:
 774	case 0x50:
 775	case 0x60:
 776	case 0x70:
 777	case 0x80:
 778	case 0x90:
 779	case 0xA0:
 780	case 0xB0:
 781		err = openpic_cpu_read_internal(opp, addr,
 782			&retval, get_current_cpu());
 783		break;
 784	case 0x10A0:		/* IPI_IVPR */
 785	case 0x10B0:
 786	case 0x10C0:
 787	case 0x10D0:
 788		{
 789			int idx;
 790			idx = (addr - 0x10A0) >> 4;
 791			retval = read_IRQreg_ivpr(opp, opp->irq_ipi0 + idx);
 792		}
 793		break;
 794	case 0x10E0:		/* SPVE */
 795		retval = opp->spve;
 796		break;
 797	default:
 798		break;
 799	}
 800
 801out:
 802	pr_debug("%s: => 0x%08x\n", __func__, retval);
 803	*ptr = retval;
 804	return err;
 805}
 806
 807static int openpic_tmr_write(void *opaque, gpa_t addr, u32 val)
 808{
 809	struct openpic *opp = opaque;
 810	int idx;
 811
 812	addr += 0x10f0;
 813
 814	pr_debug("%s: addr %#llx <= %08x\n", __func__, addr, val);
 815	if (addr & 0xF)
 816		return 0;
 817
 818	if (addr == 0x10f0) {
 819		/* TFRR */
 820		opp->tfrr = val;
 821		return 0;
 822	}
 823
 824	idx = (addr >> 6) & 0x3;
 825	addr = addr & 0x30;
 826
 827	switch (addr & 0x30) {
 828	case 0x00:		/* TCCR */
 829		break;
 830	case 0x10:		/* TBCR */
 831		if ((opp->timers[idx].tccr & TCCR_TOG) != 0 &&
 832		    (val & TBCR_CI) == 0 &&
 833		    (opp->timers[idx].tbcr & TBCR_CI) != 0)
 834			opp->timers[idx].tccr &= ~TCCR_TOG;
 835
 836		opp->timers[idx].tbcr = val;
 837		break;
 838	case 0x20:		/* TVPR */
 839		write_IRQreg_ivpr(opp, opp->irq_tim0 + idx, val);
 840		break;
 841	case 0x30:		/* TDR */
 842		write_IRQreg_idr(opp, opp->irq_tim0 + idx, val);
 843		break;
 844	}
 845
 846	return 0;
 847}
 848
 849static int openpic_tmr_read(void *opaque, gpa_t addr, u32 *ptr)
 850{
 851	struct openpic *opp = opaque;
 852	uint32_t retval = -1;
 853	int idx;
 854
 855	pr_debug("%s: addr %#llx\n", __func__, addr);
 856	if (addr & 0xF)
 857		goto out;
 858
 859	idx = (addr >> 6) & 0x3;
 860	if (addr == 0x0) {
 861		/* TFRR */
 862		retval = opp->tfrr;
 863		goto out;
 864	}
 865
 866	switch (addr & 0x30) {
 867	case 0x00:		/* TCCR */
 868		retval = opp->timers[idx].tccr;
 869		break;
 870	case 0x10:		/* TBCR */
 871		retval = opp->timers[idx].tbcr;
 872		break;
 873	case 0x20:		/* TIPV */
 874		retval = read_IRQreg_ivpr(opp, opp->irq_tim0 + idx);
 875		break;
 876	case 0x30:		/* TIDE (TIDR) */
 877		retval = read_IRQreg_idr(opp, opp->irq_tim0 + idx);
 878		break;
 879	}
 880
 881out:
 882	pr_debug("%s: => 0x%08x\n", __func__, retval);
 883	*ptr = retval;
 884	return 0;
 885}
 886
 887static int openpic_src_write(void *opaque, gpa_t addr, u32 val)
 888{
 889	struct openpic *opp = opaque;
 890	int idx;
 891
 892	pr_debug("%s: addr %#llx <= %08x\n", __func__, addr, val);
 893
 894	addr = addr & 0xffff;
 895	idx = addr >> 5;
 896
 897	switch (addr & 0x1f) {
 898	case 0x00:
 899		write_IRQreg_ivpr(opp, idx, val);
 900		break;
 901	case 0x10:
 902		write_IRQreg_idr(opp, idx, val);
 903		break;
 904	case 0x18:
 905		write_IRQreg_ilr(opp, idx, val);
 906		break;
 907	}
 908
 909	return 0;
 910}
 911
 912static int openpic_src_read(void *opaque, gpa_t addr, u32 *ptr)
 913{
 914	struct openpic *opp = opaque;
 915	uint32_t retval;
 916	int idx;
 917
 918	pr_debug("%s: addr %#llx\n", __func__, addr);
 919	retval = 0xFFFFFFFF;
 920
 921	addr = addr & 0xffff;
 922	idx = addr >> 5;
 923
 924	switch (addr & 0x1f) {
 925	case 0x00:
 926		retval = read_IRQreg_ivpr(opp, idx);
 927		break;
 928	case 0x10:
 929		retval = read_IRQreg_idr(opp, idx);
 930		break;
 931	case 0x18:
 932		retval = read_IRQreg_ilr(opp, idx);
 933		break;
 934	}
 935
 936	pr_debug("%s: => 0x%08x\n", __func__, retval);
 937	*ptr = retval;
 938	return 0;
 939}
 940
 941static int openpic_msi_write(void *opaque, gpa_t addr, u32 val)
 942{
 943	struct openpic *opp = opaque;
 944	int idx = opp->irq_msi;
 945	int srs, ibs;
 946
 947	pr_debug("%s: addr %#llx <= 0x%08x\n", __func__, addr, val);
 948	if (addr & 0xF)
 949		return 0;
 950
 951	switch (addr) {
 952	case MSIIR_OFFSET:
 953		srs = val >> MSIIR_SRS_SHIFT;
 954		idx += srs;
 955		ibs = (val & MSIIR_IBS_MASK) >> MSIIR_IBS_SHIFT;
 956		opp->msi[srs].msir |= 1 << ibs;
 957		openpic_set_irq(opp, idx, 1);
 958		break;
 959	default:
 960		/* most registers are read-only, thus ignored */
 961		break;
 962	}
 963
 964	return 0;
 965}
 966
 967static int openpic_msi_read(void *opaque, gpa_t addr, u32 *ptr)
 968{
 969	struct openpic *opp = opaque;
 970	uint32_t r = 0;
 971	int i, srs;
 972
 973	pr_debug("%s: addr %#llx\n", __func__, addr);
 974	if (addr & 0xF)
 975		return -ENXIO;
 976
 977	srs = addr >> 4;
 978
 979	switch (addr) {
 980	case 0x00:
 981	case 0x10:
 982	case 0x20:
 983	case 0x30:
 984	case 0x40:
 985	case 0x50:
 986	case 0x60:
 987	case 0x70:		/* MSIRs */
 988		r = opp->msi[srs].msir;
 989		/* Clear on read */
 990		opp->msi[srs].msir = 0;
 991		openpic_set_irq(opp, opp->irq_msi + srs, 0);
 992		break;
 993	case 0x120:		/* MSISR */
 994		for (i = 0; i < MAX_MSI; i++)
 995			r |= (opp->msi[i].msir ? 1 : 0) << i;
 996		break;
 997	}
 998
 999	pr_debug("%s: => 0x%08x\n", __func__, r);
1000	*ptr = r;
1001	return 0;
1002}
1003
1004static int openpic_summary_read(void *opaque, gpa_t addr, u32 *ptr)
1005{
1006	uint32_t r = 0;
1007
1008	pr_debug("%s: addr %#llx\n", __func__, addr);
1009
1010	/* TODO: EISR/EIMR */
1011
1012	*ptr = r;
1013	return 0;
1014}
1015
1016static int openpic_summary_write(void *opaque, gpa_t addr, u32 val)
1017{
1018	pr_debug("%s: addr %#llx <= 0x%08x\n", __func__, addr, val);
1019
1020	/* TODO: EISR/EIMR */
1021	return 0;
1022}
1023
1024static int openpic_cpu_write_internal(void *opaque, gpa_t addr,
1025				      u32 val, int idx)
1026{
1027	struct openpic *opp = opaque;
1028	struct irq_source *src;
1029	struct irq_dest *dst;
1030	int s_IRQ, n_IRQ;
1031
1032	pr_debug("%s: cpu %d addr %#llx <= 0x%08x\n", __func__, idx,
1033		addr, val);
1034
1035	if (idx < 0)
1036		return 0;
1037
1038	if (addr & 0xF)
1039		return 0;
1040
1041	dst = &opp->dst[idx];
1042	addr &= 0xFF0;
1043	switch (addr) {
1044	case 0x40:		/* IPIDR */
1045	case 0x50:
1046	case 0x60:
1047	case 0x70:
1048		idx = (addr - 0x40) >> 4;
1049		/* we use IDE as mask which CPUs to deliver the IPI to still. */
1050		opp->src[opp->irq_ipi0 + idx].destmask |= val;
1051		openpic_set_irq(opp, opp->irq_ipi0 + idx, 1);
1052		openpic_set_irq(opp, opp->irq_ipi0 + idx, 0);
1053		break;
1054	case 0x80:		/* CTPR */
1055		dst->ctpr = val & 0x0000000F;
1056
1057		pr_debug("%s: set CPU %d ctpr to %d, raised %d servicing %d\n",
1058			__func__, idx, dst->ctpr, dst->raised.priority,
1059			dst->servicing.priority);
1060
1061		if (dst->raised.priority <= dst->ctpr) {
1062			pr_debug("%s: Lower OpenPIC INT output cpu %d due to ctpr\n",
1063				__func__, idx);
1064			mpic_irq_lower(opp, dst, ILR_INTTGT_INT);
1065		} else if (dst->raised.priority > dst->servicing.priority) {
1066			pr_debug("%s: Raise OpenPIC INT output cpu %d irq %d\n",
1067				__func__, idx, dst->raised.next);
1068			mpic_irq_raise(opp, dst, ILR_INTTGT_INT);
1069		}
1070
1071		break;
1072	case 0x90:		/* WHOAMI */
1073		/* Read-only register */
1074		break;
1075	case 0xA0:		/* IACK */
1076		/* Read-only register */
1077		break;
1078	case 0xB0: {		/* EOI */
1079		int notify_eoi;
1080
1081		pr_debug("EOI\n");
1082		s_IRQ = IRQ_get_next(opp, &dst->servicing);
1083
1084		if (s_IRQ < 0) {
1085			pr_debug("%s: EOI with no interrupt in service\n",
1086				__func__);
1087			break;
1088		}
1089
1090		IRQ_resetbit(&dst->servicing, s_IRQ);
1091		/* Notify listeners that the IRQ is over */
1092		notify_eoi = s_IRQ;
1093		/* Set up next servicing IRQ */
1094		s_IRQ = IRQ_get_next(opp, &dst->servicing);
1095		/* Check queued interrupts. */
1096		n_IRQ = IRQ_get_next(opp, &dst->raised);
1097		src = &opp->src[n_IRQ];
1098		if (n_IRQ != -1 &&
1099		    (s_IRQ == -1 ||
1100		     IVPR_PRIORITY(src->ivpr) > dst->servicing.priority)) {
1101			pr_debug("Raise OpenPIC INT output cpu %d irq %d\n",
1102				idx, n_IRQ);
1103			mpic_irq_raise(opp, dst, ILR_INTTGT_INT);
1104		}
1105
1106		spin_unlock(&opp->lock);
1107		kvm_notify_acked_irq(opp->kvm, 0, notify_eoi);
1108		spin_lock(&opp->lock);
1109
1110		break;
1111	}
1112	default:
1113		break;
1114	}
1115
1116	return 0;
1117}
1118
1119static int openpic_cpu_write(void *opaque, gpa_t addr, u32 val)
1120{
1121	struct openpic *opp = opaque;
1122
1123	return openpic_cpu_write_internal(opp, addr, val,
1124					 (addr & 0x1f000) >> 12);
1125}
1126
1127static uint32_t openpic_iack(struct openpic *opp, struct irq_dest *dst,
1128			     int cpu)
1129{
1130	struct irq_source *src;
1131	int retval, irq;
1132
1133	pr_debug("Lower OpenPIC INT output\n");
1134	mpic_irq_lower(opp, dst, ILR_INTTGT_INT);
1135
1136	irq = IRQ_get_next(opp, &dst->raised);
1137	pr_debug("IACK: irq=%d\n", irq);
1138
1139	if (irq == -1)
1140		/* No more interrupt pending */
1141		return opp->spve;
1142
1143	src = &opp->src[irq];
1144	if (!(src->ivpr & IVPR_ACTIVITY_MASK) ||
1145	    !(IVPR_PRIORITY(src->ivpr) > dst->ctpr)) {
1146		pr_err("%s: bad raised IRQ %d ctpr %d ivpr 0x%08x\n",
1147			__func__, irq, dst->ctpr, src->ivpr);
1148		openpic_update_irq(opp, irq);
1149		retval = opp->spve;
1150	} else {
1151		/* IRQ enter servicing state */
1152		IRQ_setbit(&dst->servicing, irq);
1153		retval = IVPR_VECTOR(opp, src->ivpr);
1154	}
1155
1156	if (!src->level) {
1157		/* edge-sensitive IRQ */
1158		src->ivpr &= ~IVPR_ACTIVITY_MASK;
1159		src->pending = 0;
1160		IRQ_resetbit(&dst->raised, irq);
1161	}
1162
1163	if ((irq >= opp->irq_ipi0) && (irq < (opp->irq_ipi0 + MAX_IPI))) {
1164		src->destmask &= ~(1 << cpu);
1165		if (src->destmask && !src->level) {
1166			/* trigger on CPUs that didn't know about it yet */
1167			openpic_set_irq(opp, irq, 1);
1168			openpic_set_irq(opp, irq, 0);
1169			/* if all CPUs knew about it, set active bit again */
1170			src->ivpr |= IVPR_ACTIVITY_MASK;
1171		}
1172	}
1173
1174	return retval;
1175}
1176
1177void kvmppc_mpic_set_epr(struct kvm_vcpu *vcpu)
1178{
1179	struct openpic *opp = vcpu->arch.mpic;
1180	int cpu = vcpu->arch.irq_cpu_id;
1181	unsigned long flags;
1182
1183	spin_lock_irqsave(&opp->lock, flags);
1184
1185	if ((opp->gcr & opp->mpic_mode_mask) == GCR_MODE_PROXY)
1186		kvmppc_set_epr(vcpu, openpic_iack(opp, &opp->dst[cpu], cpu));
1187
1188	spin_unlock_irqrestore(&opp->lock, flags);
1189}
1190
1191static int openpic_cpu_read_internal(void *opaque, gpa_t addr,
1192				     u32 *ptr, int idx)
1193{
1194	struct openpic *opp = opaque;
1195	struct irq_dest *dst;
1196	uint32_t retval;
1197
1198	pr_debug("%s: cpu %d addr %#llx\n", __func__, idx, addr);
1199	retval = 0xFFFFFFFF;
1200
1201	if (idx < 0)
1202		goto out;
1203
1204	if (addr & 0xF)
1205		goto out;
1206
1207	dst = &opp->dst[idx];
1208	addr &= 0xFF0;
1209	switch (addr) {
1210	case 0x80:		/* CTPR */
1211		retval = dst->ctpr;
1212		break;
1213	case 0x90:		/* WHOAMI */
1214		retval = idx;
1215		break;
1216	case 0xA0:		/* IACK */
1217		retval = openpic_iack(opp, dst, idx);
1218		break;
1219	case 0xB0:		/* EOI */
1220		retval = 0;
1221		break;
1222	default:
1223		break;
1224	}
1225	pr_debug("%s: => 0x%08x\n", __func__, retval);
1226
1227out:
1228	*ptr = retval;
1229	return 0;
1230}
1231
1232static int openpic_cpu_read(void *opaque, gpa_t addr, u32 *ptr)
1233{
1234	struct openpic *opp = opaque;
1235
1236	return openpic_cpu_read_internal(opp, addr, ptr,
1237					 (addr & 0x1f000) >> 12);
1238}
1239
1240struct mem_reg {
1241	int (*read)(void *opaque, gpa_t addr, u32 *ptr);
1242	int (*write)(void *opaque, gpa_t addr, u32 val);
1243	gpa_t start_addr;
1244	int size;
1245};
1246
1247static const struct mem_reg openpic_gbl_mmio = {
1248	.write = openpic_gbl_write,
1249	.read = openpic_gbl_read,
1250	.start_addr = OPENPIC_GLB_REG_START,
1251	.size = OPENPIC_GLB_REG_SIZE,
1252};
1253
1254static const struct mem_reg openpic_tmr_mmio = {
1255	.write = openpic_tmr_write,
1256	.read = openpic_tmr_read,
1257	.start_addr = OPENPIC_TMR_REG_START,
1258	.size = OPENPIC_TMR_REG_SIZE,
1259};
1260
1261static const struct mem_reg openpic_cpu_mmio = {
1262	.write = openpic_cpu_write,
1263	.read = openpic_cpu_read,
1264	.start_addr = OPENPIC_CPU_REG_START,
1265	.size = OPENPIC_CPU_REG_SIZE,
1266};
1267
1268static const struct mem_reg openpic_src_mmio = {
1269	.write = openpic_src_write,
1270	.read = openpic_src_read,
1271	.start_addr = OPENPIC_SRC_REG_START,
1272	.size = OPENPIC_SRC_REG_SIZE,
1273};
1274
1275static const struct mem_reg openpic_msi_mmio = {
1276	.read = openpic_msi_read,
1277	.write = openpic_msi_write,
1278	.start_addr = OPENPIC_MSI_REG_START,
1279	.size = OPENPIC_MSI_REG_SIZE,
1280};
1281
1282static const struct mem_reg openpic_summary_mmio = {
1283	.read = openpic_summary_read,
1284	.write = openpic_summary_write,
1285	.start_addr = OPENPIC_SUMMARY_REG_START,
1286	.size = OPENPIC_SUMMARY_REG_SIZE,
1287};
1288
1289static void add_mmio_region(struct openpic *opp, const struct mem_reg *mr)
1290{
1291	if (opp->num_mmio_regions >= MAX_MMIO_REGIONS) {
1292		WARN(1, "kvm mpic: too many mmio regions\n");
1293		return;
1294	}
1295
1296	opp->mmio_regions[opp->num_mmio_regions++] = mr;
1297}
1298
1299static void fsl_common_init(struct openpic *opp)
1300{
1301	int i;
1302	int virq = MAX_SRC;
1303
1304	add_mmio_region(opp, &openpic_msi_mmio);
1305	add_mmio_region(opp, &openpic_summary_mmio);
1306
1307	opp->vid = VID_REVISION_1_2;
1308	opp->vir = VIR_GENERIC;
1309	opp->vector_mask = 0xFFFF;
1310	opp->tfrr_reset = 0;
1311	opp->ivpr_reset = IVPR_MASK_MASK;
1312	opp->idr_reset = 1 << 0;
1313	opp->max_irq = MAX_IRQ;
1314
1315	opp->irq_ipi0 = virq;
1316	virq += MAX_IPI;
1317	opp->irq_tim0 = virq;
1318	virq += MAX_TMR;
1319
1320	BUG_ON(virq > MAX_IRQ);
1321
1322	opp->irq_msi = 224;
1323
1324	for (i = 0; i < opp->fsl->max_ext; i++)
1325		opp->src[i].level = false;
1326
1327	/* Internal interrupts, including message and MSI */
1328	for (i = 16; i < MAX_SRC; i++) {
1329		opp->src[i].type = IRQ_TYPE_FSLINT;
1330		opp->src[i].level = true;
1331	}
1332
1333	/* timers and IPIs */
1334	for (i = MAX_SRC; i < virq; i++) {
1335		opp->src[i].type = IRQ_TYPE_FSLSPECIAL;
1336		opp->src[i].level = false;
1337	}
1338}
1339
1340static int kvm_mpic_read_internal(struct openpic *opp, gpa_t addr, u32 *ptr)
1341{
1342	int i;
1343
1344	for (i = 0; i < opp->num_mmio_regions; i++) {
1345		const struct mem_reg *mr = opp->mmio_regions[i];
1346
1347		if (mr->start_addr > addr || addr >= mr->start_addr + mr->size)
1348			continue;
1349
1350		return mr->read(opp, addr - mr->start_addr, ptr);
1351	}
1352
1353	return -ENXIO;
1354}
1355
1356static int kvm_mpic_write_internal(struct openpic *opp, gpa_t addr, u32 val)
1357{
1358	int i;
1359
1360	for (i = 0; i < opp->num_mmio_regions; i++) {
1361		const struct mem_reg *mr = opp->mmio_regions[i];
1362
1363		if (mr->start_addr > addr || addr >= mr->start_addr + mr->size)
1364			continue;
1365
1366		return mr->write(opp, addr - mr->start_addr, val);
1367	}
1368
1369	return -ENXIO;
1370}
1371
1372static int kvm_mpic_read(struct kvm_vcpu *vcpu,
1373			 struct kvm_io_device *this,
1374			 gpa_t addr, int len, void *ptr)
1375{
1376	struct openpic *opp = container_of(this, struct openpic, mmio);
1377	int ret;
1378	union {
1379		u32 val;
1380		u8 bytes[4];
1381	} u;
1382
1383	if (addr & (len - 1)) {
1384		pr_debug("%s: bad alignment %llx/%d\n",
1385			 __func__, addr, len);
1386		return -EINVAL;
1387	}
1388
1389	spin_lock_irq(&opp->lock);
1390	ret = kvm_mpic_read_internal(opp, addr - opp->reg_base, &u.val);
1391	spin_unlock_irq(&opp->lock);
1392
1393	/*
1394	 * Technically only 32-bit accesses are allowed, but be nice to
1395	 * people dumping registers a byte at a time -- it works in real
1396	 * hardware (reads only, not writes).
1397	 */
1398	if (len == 4) {
1399		*(u32 *)ptr = u.val;
1400		pr_debug("%s: addr %llx ret %d len 4 val %x\n",
1401			 __func__, addr, ret, u.val);
1402	} else if (len == 1) {
1403		*(u8 *)ptr = u.bytes[addr & 3];
1404		pr_debug("%s: addr %llx ret %d len 1 val %x\n",
1405			 __func__, addr, ret, u.bytes[addr & 3]);
1406	} else {
1407		pr_debug("%s: bad length %d\n", __func__, len);
1408		return -EINVAL;
1409	}
1410
1411	return ret;
1412}
1413
1414static int kvm_mpic_write(struct kvm_vcpu *vcpu,
1415			  struct kvm_io_device *this,
1416			  gpa_t addr, int len, const void *ptr)
1417{
1418	struct openpic *opp = container_of(this, struct openpic, mmio);
1419	int ret;
1420
1421	if (len != 4) {
1422		pr_debug("%s: bad length %d\n", __func__, len);
1423		return -EOPNOTSUPP;
1424	}
1425	if (addr & 3) {
1426		pr_debug("%s: bad alignment %llx/%d\n", __func__, addr, len);
1427		return -EOPNOTSUPP;
1428	}
1429
1430	spin_lock_irq(&opp->lock);
1431	ret = kvm_mpic_write_internal(opp, addr - opp->reg_base,
1432				      *(const u32 *)ptr);
1433	spin_unlock_irq(&opp->lock);
1434
1435	pr_debug("%s: addr %llx ret %d val %x\n",
1436		 __func__, addr, ret, *(const u32 *)ptr);
1437
1438	return ret;
1439}
1440
1441static const struct kvm_io_device_ops mpic_mmio_ops = {
1442	.read = kvm_mpic_read,
1443	.write = kvm_mpic_write,
1444};
1445
1446static void map_mmio(struct openpic *opp)
1447{
1448	kvm_iodevice_init(&opp->mmio, &mpic_mmio_ops);
1449
1450	kvm_io_bus_register_dev(opp->kvm, KVM_MMIO_BUS,
1451				opp->reg_base, OPENPIC_REG_SIZE,
1452				&opp->mmio);
1453}
1454
1455static void unmap_mmio(struct openpic *opp)
1456{
1457	kvm_io_bus_unregister_dev(opp->kvm, KVM_MMIO_BUS, &opp->mmio);
1458}
1459
1460static int set_base_addr(struct openpic *opp, struct kvm_device_attr *attr)
1461{
1462	u64 base;
1463
1464	if (copy_from_user(&base, (u64 __user *)(long)attr->addr, sizeof(u64)))
1465		return -EFAULT;
1466
1467	if (base & 0x3ffff) {
1468		pr_debug("kvm mpic %s: KVM_DEV_MPIC_BASE_ADDR %08llx not aligned\n",
1469			 __func__, base);
1470		return -EINVAL;
1471	}
1472
1473	if (base == opp->reg_base)
1474		return 0;
1475
1476	mutex_lock(&opp->kvm->slots_lock);
1477
1478	unmap_mmio(opp);
1479	opp->reg_base = base;
1480
1481	pr_debug("kvm mpic %s: KVM_DEV_MPIC_BASE_ADDR %08llx\n",
1482		 __func__, base);
1483
1484	if (base == 0)
1485		goto out;
1486
1487	map_mmio(opp);
1488
1489out:
1490	mutex_unlock(&opp->kvm->slots_lock);
1491	return 0;
1492}
1493
1494#define ATTR_SET		0
1495#define ATTR_GET		1
1496
1497static int access_reg(struct openpic *opp, gpa_t addr, u32 *val, int type)
1498{
1499	int ret;
1500
1501	if (addr & 3)
1502		return -ENXIO;
1503
1504	spin_lock_irq(&opp->lock);
1505
1506	if (type == ATTR_SET)
1507		ret = kvm_mpic_write_internal(opp, addr, *val);
1508	else
1509		ret = kvm_mpic_read_internal(opp, addr, val);
1510
1511	spin_unlock_irq(&opp->lock);
1512
1513	pr_debug("%s: type %d addr %llx val %x\n", __func__, type, addr, *val);
1514
1515	return ret;
1516}
1517
1518static int mpic_set_attr(struct kvm_device *dev, struct kvm_device_attr *attr)
1519{
1520	struct openpic *opp = dev->private;
1521	u32 attr32;
1522
1523	switch (attr->group) {
1524	case KVM_DEV_MPIC_GRP_MISC:
1525		switch (attr->attr) {
1526		case KVM_DEV_MPIC_BASE_ADDR:
1527			return set_base_addr(opp, attr);
1528		}
1529
1530		break;
1531
1532	case KVM_DEV_MPIC_GRP_REGISTER:
1533		if (get_user(attr32, (u32 __user *)(long)attr->addr))
1534			return -EFAULT;
1535
1536		return access_reg(opp, attr->attr, &attr32, ATTR_SET);
1537
1538	case KVM_DEV_MPIC_GRP_IRQ_ACTIVE:
1539		if (attr->attr > MAX_SRC)
1540			return -EINVAL;
1541
1542		if (get_user(attr32, (u32 __user *)(long)attr->addr))
1543			return -EFAULT;
1544
1545		if (attr32 != 0 && attr32 != 1)
1546			return -EINVAL;
1547
1548		spin_lock_irq(&opp->lock);
1549		openpic_set_irq(opp, attr->attr, attr32);
1550		spin_unlock_irq(&opp->lock);
1551		return 0;
1552	}
1553
1554	return -ENXIO;
1555}
1556
1557static int mpic_get_attr(struct kvm_device *dev, struct kvm_device_attr *attr)
1558{
1559	struct openpic *opp = dev->private;
1560	u64 attr64;
1561	u32 attr32;
1562	int ret;
1563
1564	switch (attr->group) {
1565	case KVM_DEV_MPIC_GRP_MISC:
1566		switch (attr->attr) {
1567		case KVM_DEV_MPIC_BASE_ADDR:
1568			mutex_lock(&opp->kvm->slots_lock);
1569			attr64 = opp->reg_base;
1570			mutex_unlock(&opp->kvm->slots_lock);
1571
1572			if (copy_to_user((u64 __user *)(long)attr->addr,
1573					 &attr64, sizeof(u64)))
1574				return -EFAULT;
1575
1576			return 0;
1577		}
1578
1579		break;
1580
1581	case KVM_DEV_MPIC_GRP_REGISTER:
1582		ret = access_reg(opp, attr->attr, &attr32, ATTR_GET);
1583		if (ret)
1584			return ret;
1585
1586		if (put_user(attr32, (u32 __user *)(long)attr->addr))
1587			return -EFAULT;
1588
1589		return 0;
1590
1591	case KVM_DEV_MPIC_GRP_IRQ_ACTIVE:
1592		if (attr->attr > MAX_SRC)
1593			return -EINVAL;
1594
1595		spin_lock_irq(&opp->lock);
1596		attr32 = opp->src[attr->attr].pending;
1597		spin_unlock_irq(&opp->lock);
1598
1599		if (put_user(attr32, (u32 __user *)(long)attr->addr))
1600			return -EFAULT;
1601
1602		return 0;
1603	}
1604
1605	return -ENXIO;
1606}
1607
1608static int mpic_has_attr(struct kvm_device *dev, struct kvm_device_attr *attr)
1609{
1610	switch (attr->group) {
1611	case KVM_DEV_MPIC_GRP_MISC:
1612		switch (attr->attr) {
1613		case KVM_DEV_MPIC_BASE_ADDR:
1614			return 0;
1615		}
1616
1617		break;
1618
1619	case KVM_DEV_MPIC_GRP_REGISTER:
1620		return 0;
1621
1622	case KVM_DEV_MPIC_GRP_IRQ_ACTIVE:
1623		if (attr->attr > MAX_SRC)
1624			break;
1625
1626		return 0;
1627	}
1628
1629	return -ENXIO;
1630}
1631
1632static void mpic_destroy(struct kvm_device *dev)
1633{
1634	struct openpic *opp = dev->private;
1635
1636	dev->kvm->arch.mpic = NULL;
1637	kfree(opp);
1638	kfree(dev);
1639}
1640
1641static int mpic_set_default_irq_routing(struct openpic *opp)
1642{
1643	struct kvm_irq_routing_entry *routing;
1644
1645	/* Create a nop default map, so that dereferencing it still works */
1646	routing = kzalloc((sizeof(*routing)), GFP_KERNEL);
1647	if (!routing)
1648		return -ENOMEM;
1649
1650	kvm_set_irq_routing(opp->kvm, routing, 0, 0);
1651
1652	kfree(routing);
1653	return 0;
1654}
1655
1656static int mpic_create(struct kvm_device *dev, u32 type)
1657{
1658	struct openpic *opp;
1659	int ret;
1660
1661	/* We only support one MPIC at a time for now */
1662	if (dev->kvm->arch.mpic)
1663		return -EINVAL;
1664
1665	opp = kzalloc(sizeof(struct openpic), GFP_KERNEL);
1666	if (!opp)
1667		return -ENOMEM;
1668
1669	dev->private = opp;
1670	opp->kvm = dev->kvm;
1671	opp->dev = dev;
1672	opp->model = type;
1673	spin_lock_init(&opp->lock);
1674
1675	add_mmio_region(opp, &openpic_gbl_mmio);
1676	add_mmio_region(opp, &openpic_tmr_mmio);
1677	add_mmio_region(opp, &openpic_src_mmio);
1678	add_mmio_region(opp, &openpic_cpu_mmio);
1679
1680	switch (opp->model) {
1681	case KVM_DEV_TYPE_FSL_MPIC_20:
1682		opp->fsl = &fsl_mpic_20;
1683		opp->brr1 = 0x00400200;
1684		opp->flags |= OPENPIC_FLAG_IDR_CRIT;
1685		opp->nb_irqs = 80;
1686		opp->mpic_mode_mask = GCR_MODE_MIXED;
1687
1688		fsl_common_init(opp);
1689
1690		break;
1691
1692	case KVM_DEV_TYPE_FSL_MPIC_42:
1693		opp->fsl = &fsl_mpic_42;
1694		opp->brr1 = 0x00400402;
1695		opp->flags |= OPENPIC_FLAG_ILR;
1696		opp->nb_irqs = 196;
1697		opp->mpic_mode_mask = GCR_MODE_PROXY;
1698
1699		fsl_common_init(opp);
1700
1701		break;
1702
1703	default:
1704		ret = -ENODEV;
1705		goto err;
1706	}
1707
1708	ret = mpic_set_default_irq_routing(opp);
1709	if (ret)
1710		goto err;
1711
1712	openpic_reset(opp);
1713
1714	smp_wmb();
1715	dev->kvm->arch.mpic = opp;
1716
1717	return 0;
1718
1719err:
1720	kfree(opp);
1721	return ret;
1722}
1723
1724struct kvm_device_ops kvm_mpic_ops = {
1725	.name = "kvm-mpic",
1726	.create = mpic_create,
1727	.destroy = mpic_destroy,
1728	.set_attr = mpic_set_attr,
1729	.get_attr = mpic_get_attr,
1730	.has_attr = mpic_has_attr,
1731};
1732
1733int kvmppc_mpic_connect_vcpu(struct kvm_device *dev, struct kvm_vcpu *vcpu,
1734			     u32 cpu)
1735{
1736	struct openpic *opp = dev->private;
1737	int ret = 0;
1738
1739	if (dev->ops != &kvm_mpic_ops)
1740		return -EPERM;
1741	if (opp->kvm != vcpu->kvm)
1742		return -EPERM;
1743	if (cpu < 0 || cpu >= MAX_CPU)
1744		return -EPERM;
1745
1746	spin_lock_irq(&opp->lock);
1747
1748	if (opp->dst[cpu].vcpu) {
1749		ret = -EEXIST;
1750		goto out;
1751	}
1752	if (vcpu->arch.irq_type) {
1753		ret = -EBUSY;
1754		goto out;
1755	}
1756
1757	opp->dst[cpu].vcpu = vcpu;
1758	opp->nb_cpus = max(opp->nb_cpus, cpu + 1);
1759
1760	vcpu->arch.mpic = opp;
1761	vcpu->arch.irq_cpu_id = cpu;
1762	vcpu->arch.irq_type = KVMPPC_IRQ_MPIC;
1763
1764	/* This might need to be changed if GCR gets extended */
1765	if (opp->mpic_mode_mask == GCR_MODE_PROXY)
1766		vcpu->arch.epr_flags |= KVMPPC_EPR_KERNEL;
1767
1768out:
1769	spin_unlock_irq(&opp->lock);
1770	return ret;
1771}
1772
1773/*
1774 * This should only happen immediately before the mpic is destroyed,
1775 * so we shouldn't need to worry about anything still trying to
1776 * access the vcpu pointer.
1777 */
1778void kvmppc_mpic_disconnect_vcpu(struct openpic *opp, struct kvm_vcpu *vcpu)
1779{
1780	BUG_ON(!opp->dst[vcpu->arch.irq_cpu_id].vcpu);
1781
1782	opp->dst[vcpu->arch.irq_cpu_id].vcpu = NULL;
1783}
1784
1785/*
1786 * Return value:
1787 *  < 0   Interrupt was ignored (masked or not delivered for other reasons)
1788 *  = 0   Interrupt was coalesced (previous irq is still pending)
1789 *  > 0   Number of CPUs interrupt was delivered to
1790 */
1791static int mpic_set_irq(struct kvm_kernel_irq_routing_entry *e,
1792			struct kvm *kvm, int irq_source_id, int level,
1793			bool line_status)
1794{
1795	u32 irq = e->irqchip.pin;
1796	struct openpic *opp = kvm->arch.mpic;
1797	unsigned long flags;
1798
1799	spin_lock_irqsave(&opp->lock, flags);
1800	openpic_set_irq(opp, irq, level);
1801	spin_unlock_irqrestore(&opp->lock, flags);
1802
1803	/* All code paths we care about don't check for the return value */
1804	return 0;
1805}
1806
1807int kvm_set_msi(struct kvm_kernel_irq_routing_entry *e,
1808		struct kvm *kvm, int irq_source_id, int level, bool line_status)
1809{
1810	struct openpic *opp = kvm->arch.mpic;
1811	unsigned long flags;
1812
1813	spin_lock_irqsave(&opp->lock, flags);
1814
1815	/*
1816	 * XXX We ignore the target address for now, as we only support
1817	 *     a single MSI bank.
1818	 */
1819	openpic_msi_write(kvm->arch.mpic, MSIIR_OFFSET, e->msi.data);
1820	spin_unlock_irqrestore(&opp->lock, flags);
1821
1822	/* All code paths we care about don't check for the return value */
1823	return 0;
1824}
1825
1826int kvm_set_routing_entry(struct kvm *kvm,
1827			  struct kvm_kernel_irq_routing_entry *e,
1828			  const struct kvm_irq_routing_entry *ue)
1829{
1830	int r = -EINVAL;
1831
1832	switch (ue->type) {
1833	case KVM_IRQ_ROUTING_IRQCHIP:
1834		e->set = mpic_set_irq;
1835		e->irqchip.irqchip = ue->u.irqchip.irqchip;
1836		e->irqchip.pin = ue->u.irqchip.pin;
1837		if (e->irqchip.pin >= KVM_IRQCHIP_NUM_PINS)
1838			goto out;
1839		break;
1840	case KVM_IRQ_ROUTING_MSI:
1841		e->set = kvm_set_msi;
1842		e->msi.address_lo = ue->u.msi.address_lo;
1843		e->msi.address_hi = ue->u.msi.address_hi;
1844		e->msi.data = ue->u.msi.data;
1845		break;
1846	default:
1847		goto out;
1848	}
1849
1850	r = 0;
1851out:
1852	return r;
1853}