cachepc-qemu

Fork of AMDESE/qemu with changes for cachepc side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-qemu
Log | Files | Refs | Submodules | LICENSE | sfeed.txt

xive.h (18237B)


      1/*
      2 * QEMU PowerPC XIVE interrupt controller model
      3 *
      4 *
      5 * The POWER9 processor comes with a new interrupt controller, called
      6 * XIVE as "eXternal Interrupt Virtualization Engine".
      7 *
      8 * = Overall architecture
      9 *
     10 *
     11 *              XIVE Interrupt Controller
     12 *              +------------------------------------+      IPIs
     13 *              | +---------+ +---------+ +--------+ |    +-------+
     14 *              | |VC       | |CQ       | |PC      |----> | CORES |
     15 *              | |     esb | |         | |        |----> |       |
     16 *              | |     eas | |  Bridge | |   tctx |----> |       |
     17 *              | |SC   end | |         | |    nvt | |    |       |
     18 *  +------+    | +---------+ +----+----+ +--------+ |    +-+-+-+-+
     19 *  | RAM  |    +------------------|-----------------+      | | |
     20 *  |      |                       |                        | | |
     21 *  |      |                       |                        | | |
     22 *  |      |  +--------------------v------------------------v-v-v--+    other
     23 *  |      <--+                     Power Bus                      +--> chips
     24 *  |  esb |  +---------+-----------------------+------------------+
     25 *  |  eas |            |                       |
     26 *  |  end |         +--|------+                |
     27 *  |  nvt |       +----+----+ |           +----+----+
     28 *  +------+       |SC       | |           |SC       |
     29 *                 |         | |           |         |
     30 *                 | PQ-bits | |           | PQ-bits |
     31 *                 | local   |-+           |  in VC  |
     32 *                 +---------+             +---------+
     33 *                    PCIe                 NX,NPU,CAPI
     34 *
     35 *                   SC: Source Controller (aka. IVSE)
     36 *                   VC: Virtualization Controller (aka. IVRE)
     37 *                   PC: Presentation Controller (aka. IVPE)
     38 *                   CQ: Common Queue (Bridge)
     39 *
     40 *              PQ-bits: 2 bits source state machine (P:pending Q:queued)
     41 *                  esb: Event State Buffer (Array of PQ bits in an IVSE)
     42 *                  eas: Event Assignment Structure
     43 *                  end: Event Notification Descriptor
     44 *                  nvt: Notification Virtual Target
     45 *                 tctx: Thread interrupt Context
     46 *
     47 *
     48 * The XIVE IC is composed of three sub-engines :
     49 *
     50 * - Interrupt Virtualization Source Engine (IVSE), or Source
     51 *   Controller (SC). These are found in PCI PHBs, in the PSI host
     52 *   bridge controller, but also inside the main controller for the
     53 *   core IPIs and other sub-chips (NX, CAP, NPU) of the
     54 *   chip/processor. They are configured to feed the IVRE with events.
     55 *
     56 * - Interrupt Virtualization Routing Engine (IVRE) or Virtualization
     57 *   Controller (VC). Its job is to match an event source with an
     58 *   Event Notification Descriptor (END).
     59 *
     60 * - Interrupt Virtualization Presentation Engine (IVPE) or
     61 *   Presentation Controller (PC). It maintains the interrupt context
     62 *   state of each thread and handles the delivery of the external
     63 *   exception to the thread.
     64 *
     65 * In XIVE 1.0, the sub-engines used to be referred as:
     66 *
     67 *   SC     Source Controller
     68 *   VC     Virtualization Controller
     69 *   PC     Presentation Controller
     70 *   CQ     Common Queue (PowerBUS Bridge)
     71 *
     72 *
     73 * = XIVE internal tables
     74 *
     75 * Each of the sub-engines uses a set of tables to redirect exceptions
     76 * from event sources to CPU threads.
     77 *
     78 *                                           +-------+
     79 *   User or OS                              |  EQ   |
     80 *       or                          +------>|entries|
     81 *   Hypervisor                      |       |  ..   |
     82 *     Memory                        |       +-------+
     83 *                                   |           ^
     84 *                                   |           |
     85 *              +-------------------------------------------------+
     86 *                                   |           |
     87 *   Hypervisor      +------+    +---+--+    +---+--+   +------+
     88 *     Memory        | ESB  |    | EAT  |    | ENDT |   | NVTT |
     89 *    (skiboot)      +----+-+    +----+-+    +----+-+   +------+
     90 *                     ^  |        ^  |        ^  |       ^
     91 *                     |  |        |  |        |  |       |
     92 *              +-------------------------------------------------+
     93 *                     |  |        |  |        |  |       |
     94 *                     |  |        |  |        |  |       |
     95 *                +----|--|--------|--|--------|--|-+   +-|-----+    +------+
     96 *                |    |  |        |  |        |  | |   | | tctx|    |Thread|
     97 *   IPI or   --> |    +  v        +  v        +  v |---| +  .. |----->     |
     98 *  HW events --> |                                 |   |       |    |      |
     99 *    IVSE        |             IVRE                |   | IVPE  |    +------+
    100 *                +---------------------------------+   +-------+
    101 *
    102 *
    103 *
    104 * The IVSE have a 2-bits state machine, P for pending and Q for queued,
    105 * for each source that allows events to be triggered. They are stored in
    106 * an Event State Buffer (ESB) array and can be controlled by MMIOs.
    107 *
    108 * If the event is let through, the IVRE looks up in the Event Assignment
    109 * Structure (EAS) table for an Event Notification Descriptor (END)
    110 * configured for the source. Each Event Notification Descriptor defines
    111 * a notification path to a CPU and an in-memory Event Queue, in which
    112 * will be enqueued an EQ data for the OS to pull.
    113 *
    114 * The IVPE determines if a Notification Virtual Target (NVT) can
    115 * handle the event by scanning the thread contexts of the VCPUs
    116 * dispatched on the processor HW threads. It maintains the state of
    117 * the thread interrupt context (TCTX) of each thread in a NVT table.
    118 *
    119 * = Acronyms
    120 *
    121 *          Description                     In XIVE 1.0, used to be referred as
    122 *
    123 *   EAS    Event Assignment Structure      IVE   Interrupt Virt. Entry
    124 *   EAT    Event Assignment Table          IVT   Interrupt Virt. Table
    125 *   ENDT   Event Notif. Descriptor Table   EQDT  Event Queue Desc. Table
    126 *   EQ     Event Queue                     same
    127 *   ESB    Event State Buffer              SBE   State Bit Entry
    128 *   NVT    Notif. Virtual Target           VPD   Virtual Processor Desc.
    129 *   NVTT   Notif. Virtual Target Table     VPDT  Virtual Processor Desc. Table
    130 *   TCTX   Thread interrupt Context
    131 *
    132 *
    133 * Copyright (c) 2017-2018, IBM Corporation.
    134 *
    135 * This code is licensed under the GPL version 2 or later. See the
    136 * COPYING file in the top-level directory.
    137 *
    138 */
    139
    140#ifndef PPC_XIVE_H
    141#define PPC_XIVE_H
    142
    143#include "sysemu/kvm.h"
    144#include "hw/sysbus.h"
    145#include "hw/ppc/xive_regs.h"
    146#include "qom/object.h"
    147
    148/*
    149 * XIVE Notifier (Interface between Source and Router)
    150 */
    151
    152typedef struct XiveNotifier XiveNotifier;
    153
    154#define TYPE_XIVE_NOTIFIER "xive-notifier"
    155#define XIVE_NOTIFIER(obj)                                     \
    156    INTERFACE_CHECK(XiveNotifier, (obj), TYPE_XIVE_NOTIFIER)
    157typedef struct XiveNotifierClass XiveNotifierClass;
    158DECLARE_CLASS_CHECKERS(XiveNotifierClass, XIVE_NOTIFIER,
    159                       TYPE_XIVE_NOTIFIER)
    160
    161struct XiveNotifierClass {
    162    InterfaceClass parent;
    163    void (*notify)(XiveNotifier *xn, uint32_t lisn);
    164};
    165
    166/*
    167 * XIVE Interrupt Source
    168 */
    169
    170#define TYPE_XIVE_SOURCE "xive-source"
    171OBJECT_DECLARE_SIMPLE_TYPE(XiveSource, XIVE_SOURCE)
    172
    173/*
    174 * XIVE Interrupt Source characteristics, which define how the ESB are
    175 * controlled.
    176 */
    177#define XIVE_SRC_H_INT_ESB     0x1 /* ESB managed with hcall H_INT_ESB */
    178#define XIVE_SRC_STORE_EOI     0x2 /* Store EOI supported */
    179
    180struct XiveSource {
    181    DeviceState parent;
    182
    183    /* IRQs */
    184    uint32_t        nr_irqs;
    185    unsigned long   *lsi_map;
    186
    187    /* PQ bits and LSI assertion bit */
    188    uint8_t         *status;
    189
    190    /* ESB memory region */
    191    uint64_t        esb_flags;
    192    uint32_t        esb_shift;
    193    MemoryRegion    esb_mmio;
    194    MemoryRegion    esb_mmio_emulated;
    195
    196    /* KVM support */
    197    void            *esb_mmap;
    198    MemoryRegion    esb_mmio_kvm;
    199
    200    XiveNotifier    *xive;
    201};
    202
    203/*
    204 * ESB MMIO setting. Can be one page, for both source triggering and
    205 * source management, or two different pages. See below for magic
    206 * values.
    207 */
    208#define XIVE_ESB_4K          12 /* PSI HB only */
    209#define XIVE_ESB_4K_2PAGE    13
    210#define XIVE_ESB_64K         16
    211#define XIVE_ESB_64K_2PAGE   17
    212
    213static inline bool xive_source_esb_has_2page(XiveSource *xsrc)
    214{
    215    return xsrc->esb_shift == XIVE_ESB_64K_2PAGE ||
    216        xsrc->esb_shift == XIVE_ESB_4K_2PAGE;
    217}
    218
    219static inline size_t xive_source_esb_len(XiveSource *xsrc)
    220{
    221    return (1ull << xsrc->esb_shift) * xsrc->nr_irqs;
    222}
    223
    224/* The trigger page is always the first/even page */
    225static inline hwaddr xive_source_esb_page(XiveSource *xsrc, uint32_t srcno)
    226{
    227    assert(srcno < xsrc->nr_irqs);
    228    return (1ull << xsrc->esb_shift) * srcno;
    229}
    230
    231/* In a two pages ESB MMIO setting, the odd page is for management */
    232static inline hwaddr xive_source_esb_mgmt(XiveSource *xsrc, int srcno)
    233{
    234    hwaddr addr = xive_source_esb_page(xsrc, srcno);
    235
    236    if (xive_source_esb_has_2page(xsrc)) {
    237        addr += (1 << (xsrc->esb_shift - 1));
    238    }
    239
    240    return addr;
    241}
    242
    243/*
    244 * Each interrupt source has a 2-bit state machine which can be
    245 * controlled by MMIO. P indicates that an interrupt is pending (has
    246 * been sent to a queue and is waiting for an EOI). Q indicates that
    247 * the interrupt has been triggered while pending.
    248 *
    249 * This acts as a coalescing mechanism in order to guarantee that a
    250 * given interrupt only occurs at most once in a queue.
    251 *
    252 * When doing an EOI, the Q bit will indicate if the interrupt
    253 * needs to be re-triggered.
    254 */
    255#define XIVE_STATUS_ASSERTED  0x4  /* Extra bit for LSI */
    256#define XIVE_ESB_VAL_P        0x2
    257#define XIVE_ESB_VAL_Q        0x1
    258
    259#define XIVE_ESB_RESET        0x0
    260#define XIVE_ESB_PENDING      XIVE_ESB_VAL_P
    261#define XIVE_ESB_QUEUED       (XIVE_ESB_VAL_P | XIVE_ESB_VAL_Q)
    262#define XIVE_ESB_OFF          XIVE_ESB_VAL_Q
    263
    264bool xive_esb_trigger(uint8_t *pq);
    265bool xive_esb_eoi(uint8_t *pq);
    266uint8_t xive_esb_set(uint8_t *pq, uint8_t value);
    267
    268/*
    269 * "magic" Event State Buffer (ESB) MMIO offsets.
    270 *
    271 * The following offsets into the ESB MMIO allow to read or manipulate
    272 * the PQ bits. They must be used with an 8-byte load instruction.
    273 * They all return the previous state of the interrupt (atomically).
    274 *
    275 * Additionally, some ESB pages support doing an EOI via a store and
    276 * some ESBs support doing a trigger via a separate trigger page.
    277 */
    278#define XIVE_ESB_STORE_EOI      0x400 /* Store */
    279#define XIVE_ESB_LOAD_EOI       0x000 /* Load */
    280#define XIVE_ESB_GET            0x800 /* Load */
    281#define XIVE_ESB_SET_PQ_00      0xc00 /* Load */
    282#define XIVE_ESB_SET_PQ_01      0xd00 /* Load */
    283#define XIVE_ESB_SET_PQ_10      0xe00 /* Load */
    284#define XIVE_ESB_SET_PQ_11      0xf00 /* Load */
    285
    286uint8_t xive_source_esb_get(XiveSource *xsrc, uint32_t srcno);
    287uint8_t xive_source_esb_set(XiveSource *xsrc, uint32_t srcno, uint8_t pq);
    288
    289void xive_source_pic_print_info(XiveSource *xsrc, uint32_t offset,
    290                                Monitor *mon);
    291
    292static inline bool xive_source_irq_is_lsi(XiveSource *xsrc, uint32_t srcno)
    293{
    294    assert(srcno < xsrc->nr_irqs);
    295    return test_bit(srcno, xsrc->lsi_map);
    296}
    297
    298static inline void xive_source_irq_set_lsi(XiveSource *xsrc, uint32_t srcno)
    299{
    300    assert(srcno < xsrc->nr_irqs);
    301    bitmap_set(xsrc->lsi_map, srcno, 1);
    302}
    303
    304void xive_source_set_irq(void *opaque, int srcno, int val);
    305
    306/*
    307 * XIVE Thread interrupt Management (TM) context
    308 */
    309
    310#define TYPE_XIVE_TCTX "xive-tctx"
    311OBJECT_DECLARE_SIMPLE_TYPE(XiveTCTX, XIVE_TCTX)
    312
    313/*
    314 * XIVE Thread interrupt Management register rings :
    315 *
    316 *   QW-0  User       event-based exception state
    317 *   QW-1  O/S        OS context for priority management, interrupt acks
    318 *   QW-2  Pool       hypervisor pool context for virtual processors dispatched
    319 *   QW-3  Physical   physical thread context and security context
    320 */
    321#define XIVE_TM_RING_COUNT      4
    322#define XIVE_TM_RING_SIZE       0x10
    323
    324typedef struct XivePresenter XivePresenter;
    325
    326struct XiveTCTX {
    327    DeviceState parent_obj;
    328
    329    CPUState    *cs;
    330    qemu_irq    hv_output;
    331    qemu_irq    os_output;
    332
    333    uint8_t     regs[XIVE_TM_RING_COUNT * XIVE_TM_RING_SIZE];
    334
    335    XivePresenter *xptr;
    336};
    337
    338static inline uint32_t xive_tctx_word2(uint8_t *ring)
    339{
    340    return *((uint32_t *) &ring[TM_WORD2]);
    341}
    342
    343/*
    344 * XIVE Router
    345 */
    346typedef struct XiveFabric XiveFabric;
    347
    348struct XiveRouter {
    349    SysBusDevice    parent;
    350
    351    XiveFabric *xfb;
    352};
    353
    354#define TYPE_XIVE_ROUTER "xive-router"
    355OBJECT_DECLARE_TYPE(XiveRouter, XiveRouterClass,
    356                    XIVE_ROUTER)
    357
    358struct XiveRouterClass {
    359    SysBusDeviceClass parent;
    360
    361    /* XIVE table accessors */
    362    int (*get_eas)(XiveRouter *xrtr, uint8_t eas_blk, uint32_t eas_idx,
    363                   XiveEAS *eas);
    364    int (*get_end)(XiveRouter *xrtr, uint8_t end_blk, uint32_t end_idx,
    365                   XiveEND *end);
    366    int (*write_end)(XiveRouter *xrtr, uint8_t end_blk, uint32_t end_idx,
    367                     XiveEND *end, uint8_t word_number);
    368    int (*get_nvt)(XiveRouter *xrtr, uint8_t nvt_blk, uint32_t nvt_idx,
    369                   XiveNVT *nvt);
    370    int (*write_nvt)(XiveRouter *xrtr, uint8_t nvt_blk, uint32_t nvt_idx,
    371                     XiveNVT *nvt, uint8_t word_number);
    372    uint8_t (*get_block_id)(XiveRouter *xrtr);
    373};
    374
    375int xive_router_get_eas(XiveRouter *xrtr, uint8_t eas_blk, uint32_t eas_idx,
    376                        XiveEAS *eas);
    377int xive_router_get_end(XiveRouter *xrtr, uint8_t end_blk, uint32_t end_idx,
    378                        XiveEND *end);
    379int xive_router_write_end(XiveRouter *xrtr, uint8_t end_blk, uint32_t end_idx,
    380                          XiveEND *end, uint8_t word_number);
    381int xive_router_get_nvt(XiveRouter *xrtr, uint8_t nvt_blk, uint32_t nvt_idx,
    382                        XiveNVT *nvt);
    383int xive_router_write_nvt(XiveRouter *xrtr, uint8_t nvt_blk, uint32_t nvt_idx,
    384                          XiveNVT *nvt, uint8_t word_number);
    385void xive_router_notify(XiveNotifier *xn, uint32_t lisn);
    386
    387/*
    388 * XIVE Presenter
    389 */
    390
    391typedef struct XiveTCTXMatch {
    392    XiveTCTX *tctx;
    393    uint8_t ring;
    394} XiveTCTXMatch;
    395
    396#define TYPE_XIVE_PRESENTER "xive-presenter"
    397#define XIVE_PRESENTER(obj)                                     \
    398    INTERFACE_CHECK(XivePresenter, (obj), TYPE_XIVE_PRESENTER)
    399typedef struct XivePresenterClass XivePresenterClass;
    400DECLARE_CLASS_CHECKERS(XivePresenterClass, XIVE_PRESENTER,
    401                       TYPE_XIVE_PRESENTER)
    402
    403struct XivePresenterClass {
    404    InterfaceClass parent;
    405    int (*match_nvt)(XivePresenter *xptr, uint8_t format,
    406                     uint8_t nvt_blk, uint32_t nvt_idx,
    407                     bool cam_ignore, uint8_t priority,
    408                     uint32_t logic_serv, XiveTCTXMatch *match);
    409    bool (*in_kernel)(const XivePresenter *xptr);
    410};
    411
    412int xive_presenter_tctx_match(XivePresenter *xptr, XiveTCTX *tctx,
    413                              uint8_t format,
    414                              uint8_t nvt_blk, uint32_t nvt_idx,
    415                              bool cam_ignore, uint32_t logic_serv);
    416bool xive_presenter_notify(XiveFabric *xfb, uint8_t format,
    417                           uint8_t nvt_blk, uint32_t nvt_idx,
    418                           bool cam_ignore, uint8_t priority,
    419                           uint32_t logic_serv);
    420
    421/*
    422 * XIVE Fabric (Interface between Interrupt Controller and Machine)
    423 */
    424
    425#define TYPE_XIVE_FABRIC "xive-fabric"
    426#define XIVE_FABRIC(obj)                                     \
    427    INTERFACE_CHECK(XiveFabric, (obj), TYPE_XIVE_FABRIC)
    428typedef struct XiveFabricClass XiveFabricClass;
    429DECLARE_CLASS_CHECKERS(XiveFabricClass, XIVE_FABRIC,
    430                       TYPE_XIVE_FABRIC)
    431
    432struct XiveFabricClass {
    433    InterfaceClass parent;
    434    int (*match_nvt)(XiveFabric *xfb, uint8_t format,
    435                     uint8_t nvt_blk, uint32_t nvt_idx,
    436                     bool cam_ignore, uint8_t priority,
    437                     uint32_t logic_serv, XiveTCTXMatch *match);
    438};
    439
    440/*
    441 * XIVE END ESBs
    442 */
    443
    444#define TYPE_XIVE_END_SOURCE "xive-end-source"
    445OBJECT_DECLARE_SIMPLE_TYPE(XiveENDSource, XIVE_END_SOURCE)
    446
    447struct XiveENDSource {
    448    DeviceState parent;
    449
    450    uint32_t        nr_ends;
    451
    452    /* ESB memory region */
    453    uint32_t        esb_shift;
    454    MemoryRegion    esb_mmio;
    455
    456    XiveRouter      *xrtr;
    457};
    458
    459/*
    460 * For legacy compatibility, the exceptions define up to 256 different
    461 * priorities. P9 implements only 9 levels : 8 active levels [0 - 7]
    462 * and the least favored level 0xFF.
    463 */
    464#define XIVE_PRIORITY_MAX  7
    465
    466/*
    467 * Convert a priority number to an Interrupt Pending Buffer (IPB)
    468 * register, which indicates a pending interrupt at the priority
    469 * corresponding to the bit number
    470 */
    471static inline uint8_t xive_priority_to_ipb(uint8_t priority)
    472{
    473    return priority > XIVE_PRIORITY_MAX ?
    474        0 : 1 << (XIVE_PRIORITY_MAX - priority);
    475}
    476
    477/*
    478 * XIVE Thread Interrupt Management Aera (TIMA)
    479 *
    480 * This region gives access to the registers of the thread interrupt
    481 * management context. It is four page wide, each page providing a
    482 * different view of the registers. The page with the lower offset is
    483 * the most privileged and gives access to the entire context.
    484 */
    485#define XIVE_TM_HW_PAGE         0x0
    486#define XIVE_TM_HV_PAGE         0x1
    487#define XIVE_TM_OS_PAGE         0x2
    488#define XIVE_TM_USER_PAGE       0x3
    489
    490void xive_tctx_tm_write(XivePresenter *xptr, XiveTCTX *tctx, hwaddr offset,
    491                        uint64_t value, unsigned size);
    492uint64_t xive_tctx_tm_read(XivePresenter *xptr, XiveTCTX *tctx, hwaddr offset,
    493                           unsigned size);
    494
    495void xive_tctx_pic_print_info(XiveTCTX *tctx, Monitor *mon);
    496Object *xive_tctx_create(Object *cpu, XivePresenter *xptr, Error **errp);
    497void xive_tctx_reset(XiveTCTX *tctx);
    498void xive_tctx_destroy(XiveTCTX *tctx);
    499void xive_tctx_ipb_update(XiveTCTX *tctx, uint8_t ring, uint8_t ipb);
    500
    501/*
    502 * KVM XIVE device helpers
    503 */
    504
    505int kvmppc_xive_source_reset_one(XiveSource *xsrc, int srcno, Error **errp);
    506void kvmppc_xive_source_set_irq(void *opaque, int srcno, int val);
    507int kvmppc_xive_cpu_connect(XiveTCTX *tctx, Error **errp);
    508int kvmppc_xive_cpu_synchronize_state(XiveTCTX *tctx, Error **errp);
    509int kvmppc_xive_cpu_get_state(XiveTCTX *tctx, Error **errp);
    510int kvmppc_xive_cpu_set_state(XiveTCTX *tctx, Error **errp);
    511
    512#endif /* PPC_XIVE_H */