[Qemu-devel] [PATCH] pseries iommu: h_put_tce split to support more IOMMUs

[Qemu-devel] [PATCH] pseries iommu: h_put_tce split to support more IOMMUs

[Alexey Kardashevskiy]

sPAPR IOMMU RTAS handler is split to common h_put_tce() part and
emulated IOMMU implementation called put_tce_emu().

Further patches will extend h_put_tce() with put_tce_vfio() in
order to support other types of IOMMU such as VFIO.

Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
---
 hw/spapr_iommu.c |   25 +++++++++++++++----------
 1 file changed, 15 insertions(+), 10 deletions(-)

diff --git a/hw/spapr_iommu.c b/hw/spapr_iommu.c
index 388ffa4..3021bfe 100644
--- a/hw/spapr_iommu.c
+++ b/hw/spapr_iommu.c
@@ -162,21 +162,25 @@ void spapr_tce_free(DMAContext *dma)
     }
 }
 
-static target_ulong put_tce_emu(sPAPRTCETable *tcet, target_ulong ioba,
-                                target_ulong tce)
+static int put_tce_emu(target_ulong liobn, target_ulong ioba, target_ulong tce)
 {
+    sPAPRTCETable *tcet = spapr_tce_find_by_liobn(liobn);
     sPAPRTCE *tcep;
 
+    if (!tcet) {
+        return 1;
+    }
+
     if (ioba >= tcet->window_size) {
         hcall_dprintf("spapr_vio_put_tce on out-of-boards IOBA 0x"
                       TARGET_FMT_lx "\n", ioba);
-        return H_PARAMETER;
+        return -1;
     }
 
     tcep = tcet->table + (ioba >> SPAPR_TCE_PAGE_SHIFT);
     tcep->tce = tce;
 
-    return H_SUCCESS;
+    return 0;
 }
 
 static target_ulong h_put_tce(CPUPPCState *env, sPAPREnvironment *spapr,
@@ -185,7 +189,7 @@ static target_ulong h_put_tce(CPUPPCState *env, sPAPREnvironment *spapr,
     target_ulong liobn = args[0];
     target_ulong ioba = args[1];
     target_ulong tce = args[2];
-    sPAPRTCETable *tcet = spapr_tce_find_by_liobn(liobn);
+    int ret;
 
     if (liobn & 0xFFFFFFFF00000000ULL) {
         hcall_dprintf("spapr_vio_put_tce on out-of-boundsw LIOBN "
@@ -195,13 +199,14 @@ static target_ulong h_put_tce(CPUPPCState *env, sPAPREnvironment *spapr,
 
     ioba &= ~(SPAPR_TCE_PAGE_SIZE - 1);
 
-    if (tcet) {
-        return put_tce_emu(tcet, ioba, tce);
+    ret = put_tce_emu(liobn, ioba, tce);
+    if (0 >= ret) {
+        return ret ? H_PARAMETER : H_SUCCESS;
     }
 #ifdef DEBUG_TCE
-    fprintf(stderr, "%s on liobn=" TARGET_FMT_lx /*%s*/
-            "  ioba 0x" TARGET_FMT_lx "  TCE 0x" TARGET_FMT_lx "\n",
-            __func__, liobn, /*dev->qdev.id, */ioba, tce);
+    fprintf(stderr, "%s on liobn=" TARGET_FMT_lx
+            "  ioba 0x" TARGET_FMT_lx "  TCE 0x" TARGET_FMT_lx " ret=%d\n",
+            __func__, liobn, ioba, tce, ret);
 #endif
 
     return H_PARAMETER;
-- 
1.7.10

[Qemu-devel] [PATCH] pseries pci: removed cached qemu_irq from PCI host bus

[Alexey Kardashevskiy]

As it is a very quick operation to resolve qirq from IRQ number,
it makes no sense to cache it anywhere but its original source i.e. XICS.

Also, the upcoming support for MSIX is going to add much more IRQs per
PHB. So we will have to cache them as well for consistency, and for that
we will have to create an array of qemu_irq pointers.

So it is simplier to keep only IRQ numbers (one per INTx line) and the first
MSI IRQ number with vectors number (will be added later).

Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
---
 hw/spapr_pci.c |   14 +++++---------
 hw/spapr_pci.h |    1 -
 2 files changed, 5 insertions(+), 10 deletions(-)

diff --git a/hw/spapr_pci.c b/hw/spapr_pci.c
index b3032d2..1318390 100644
--- a/hw/spapr_pci.c
+++ b/hw/spapr_pci.c
@@ -223,7 +223,9 @@ static void pci_spapr_set_irq(void *opaque, int irq_num, int level)
      */
     sPAPRPHBState *phb = opaque;
 
-    qemu_set_irq(phb->lsi_table[irq_num].qirq, level);
+    qemu_set_irq(xics_assign_irq(spapr->icp,
+                                 phb->lsi_table[irq_num].dt_irq, XICS_LSI),
+                 level);
 }
 
 static uint64_t spapr_io_read(void *opaque, target_phys_addr_t addr,
@@ -329,16 +331,10 @@ static int spapr_phb_init(SysBusDevice *s)
 
     /* Initialize the LSI table */
     for (i = 0; i < PCI_NUM_PINS; i++) {
-        qemu_irq qirq;
-        uint32_t num;
-
-        qirq = spapr_allocate_lsi(0, &num);
-        if (!qirq) {
+        if (!spapr_allocate_lsi(0, &phb->lsi_table[i].dt_irq)) {
+            fprintf(stderr, "Failed to allocate LSI IRQ pin %u\n", i);
             return -1;
         }
-
-        phb->lsi_table[i].dt_irq = num;
-        phb->lsi_table[i].qirq = qirq;
     }
 
     return 0;
diff --git a/hw/spapr_pci.h b/hw/spapr_pci.h
index dd66f4b..11c3ee1 100644
--- a/hw/spapr_pci.h
+++ b/hw/spapr_pci.h
@@ -41,7 +41,6 @@ typedef struct sPAPRPHBState {
 
     struct {
         uint32_t dt_irq;
-        qemu_irq qirq;
     } lsi_table[PCI_NUM_PINS];
 
     QLIST_ENTRY(sPAPRPHBState) list;
-- 
1.7.10

[Qemu-devel] [PATCH] pseries: added allocator for a block of IRQs

[Alexey Kardashevskiy]

The patch adds a simple helper which allocates a consecutive sequence
of IRQs calling spapr_allocate_irq for each and checks that allocated
IRQs go consequently.

The patch is required for upcoming support of MSI/MSIX on POWER.

Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
---
 hw/spapr.c |   20 ++++++++++++++++++++
 hw/spapr.h |    1 +
 2 files changed, 21 insertions(+)

diff --git a/hw/spapr.c b/hw/spapr.c
index 6a9a7ca..f47c109 100644
--- a/hw/spapr.c
+++ b/hw/spapr.c
@@ -113,6 +113,26 @@ qemu_irq spapr_allocate_irq(uint32_t hint, uint32_t *irq_num,
     return qirq;
 }
 
+/* Allocate block of consequtive IRQs, returns a number of the first */
+int spapr_allocate_irq_block(uint32_t num, enum xics_irq_type type)
+{
+    int i, ret;
+    uint32_t irq = -1;
+
+    for (i = 0; i < num; ++i) {
+        if (!spapr_allocate_irq(0, &irq, type)) {
+            return -1;
+        }
+        if (0 == i) {
+            ret = irq;
+        }
+        if (ret + i != irq) {
+            return -1;
+        }
+    }
+    return ret;
+}
+
 static int spapr_fixup_cpu_dt(void *fdt, sPAPREnvironment *spapr)
 {
     int ret = 0, offset;
diff --git a/hw/spapr.h b/hw/spapr.h
index d0c1749..4a3520f 100644
--- a/hw/spapr.h
+++ b/hw/spapr.h
@@ -289,6 +289,7 @@ target_ulong spapr_hypercall(CPUPPCState *env, target_ulong opcode,
 
 qemu_irq spapr_allocate_irq(uint32_t hint, uint32_t *irq_num,
                             enum xics_irq_type type);
+int spapr_allocate_irq_block(uint32_t num, enum xics_irq_type type);
 
 static inline qemu_irq spapr_allocate_msi(uint32_t hint, uint32_t *irq_num)
 {
-- 
1.7.10

[Qemu-devel] [PATCH] pseries pci: enable debugging with disabled emulated PCI bus

[Alexey Kardashevskiy]

Sometime when debugging PCI buses other than default emulated bus
it helps to disable emulated PCI. To disable it by commenting out
spapr_create_phb(SPAPR_PCI_BUID) call, this patch is submitted.

The patch does 2 things:
1. adds a check to init the emulated VGA only if the emulated PCI
bus has been created.

2. moves RTAS PCI config space access hooks out of the emulated
PCI bus init code.

Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
---
 hw/spapr.c     |    4 +++-
 hw/spapr_pci.c |   13 ++++++++-----
 hw/spapr_pci.h |    2 ++
 3 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/hw/spapr.c b/hw/spapr.c
index f47c109..af3f479 100644
--- a/hw/spapr.c
+++ b/hw/spapr.c
@@ -764,6 +764,7 @@ static void ppc_spapr_init(ram_addr_t ram_size,
     }
 
     /* Set up PCI */
+    pci_common_init();
     spapr_create_phb(spapr, "pci", SPAPR_PCI_BUID,
                      SPAPR_PCI_MEM_WIN_ADDR,
                      SPAPR_PCI_MEM_WIN_SIZE,
@@ -788,7 +789,8 @@ static void ppc_spapr_init(ram_addr_t ram_size,
     }
 
     /* Graphics */
-    if (spapr_vga_init(QLIST_FIRST(&spapr->phbs)->host_state.bus)) {
+    if (QLIST_FIRST(&spapr->phbs) &&
+        spapr_vga_init(QLIST_FIRST(&spapr->phbs)->host_state.bus)) {
         spapr_has_graphics = 1;
         usb_enabled = 1;
     }
diff --git a/hw/spapr_pci.c b/hw/spapr_pci.c
index 1318390..7a17d54 100644
--- a/hw/spapr_pci.c
+++ b/hw/spapr_pci.c
@@ -357,11 +357,6 @@ static void spapr_phb_class_init(ObjectClass *klass, void *data)
 
     sdc->init = spapr_phb_init;
     dc->props = spapr_phb_properties;
-
-    spapr_rtas_register("read-pci-config", rtas_read_pci_config);
-    spapr_rtas_register("write-pci-config", rtas_write_pci_config);
-    spapr_rtas_register("ibm,read-pci-config", rtas_ibm_read_pci_config);
-    spapr_rtas_register("ibm,write-pci-config", rtas_ibm_write_pci_config);
 }
 
 static TypeInfo spapr_phb_info = {
@@ -486,6 +481,14 @@ int spapr_populate_pci_dt(sPAPRPHBState *phb,
     return 0;
 }
 
+void pci_common_init(void)
+{
+    spapr_rtas_register("read-pci-config", rtas_read_pci_config);
+    spapr_rtas_register("write-pci-config", rtas_write_pci_config);
+    spapr_rtas_register("ibm,read-pci-config", rtas_ibm_read_pci_config);
+    spapr_rtas_register("ibm,write-pci-config", rtas_ibm_write_pci_config);
+}
+
 static void register_types(void)
 {
     type_register_static(&spapr_phb_info);
diff --git a/hw/spapr_pci.h b/hw/spapr_pci.h
index 11c3ee1..05447b4 100644
--- a/hw/spapr_pci.h
+++ b/hw/spapr_pci.h
@@ -58,4 +58,6 @@ int spapr_populate_pci_dt(sPAPRPHBState *phb,
                           uint32_t xics_phandle,
                           void *fdt);
 
+void pci_common_init(void);
+
 #endif /* __HW_SPAPR_PCI_H__ */
-- 
1.7.10

[Qemu-devel] [PATCH] xics: added end-of-interrupt (EOI) handlers

[Alexey Kardashevskiy]

Normally when the host driver gets called via interrupt, it disables IRQ
first, then handles it and enables back. In the case of PCI pass through,
the actual handling is done by the guest so the host driver needs to know
when to enable IRQ back.

The patch introduces add/remove callback API and EOI initialization for
the XICS interrupt controller.

Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
---
 hw/xics.c |   18 ++++++++++++++++++
 hw/xics.h |    5 +++++
 2 files changed, 23 insertions(+)

diff --git a/hw/xics.c b/hw/xics.c
index 668a0d6..de7833e 100644
--- a/hw/xics.c
+++ b/hw/xics.c
@@ -170,6 +170,7 @@ struct ics_irq_state {
     int sent:1;
     int rejected:1;
     int masked_pending:1;
+    NotifierList eoi_notifier;
 };
 
 struct ics_state {
@@ -309,6 +310,8 @@ static void ics_eoi(struct ics_state *ics, int nr)
     if (irq->type == XICS_LSI) {
         irq->sent = 0;
     }
+
+    notifier_list_notify(&irq->eoi_notifier, NULL);
 }
 
 /*
@@ -536,6 +539,7 @@ struct icp_state *xics_system_init(int nr_irqs)
     for (i = 0; i < nr_irqs; i++) {
         ics->irqs[i].priority = 0xff;
         ics->irqs[i].saved_priority = 0xff;
+        notifier_list_init(&ics->irqs[i].eoi_notifier);
     }
 
     ics->qirqs = qemu_allocate_irqs(ics_set_irq, ics, nr_irqs);
@@ -552,3 +556,17 @@ struct icp_state *xics_system_init(int nr_irqs)
 
     return icp;
 }
+
+void xics_add_eoi_notifier(Notifier *notify, uint32_t srcno)
+{
+    struct ics_state *ics = spapr->icp->ics;
+    struct ics_irq_state *irq = &ics->irqs[srcno - ics->offset];
+
+    notifier_list_add(&irq->eoi_notifier, notify);
+}
+
+void xics_remove_eoi_notifier(Notifier *notify)
+{
+    notifier_remove(notify);
+}
+
diff --git a/hw/xics.h b/hw/xics.h
index 2080159..762243c 100644
--- a/hw/xics.h
+++ b/hw/xics.h
@@ -27,6 +27,8 @@
 #if !defined(__XICS_H__)
 #define __XICS_H__
 
+#include "notify.h"
+
 #define XICS_IPI        0x2
 
 struct icp_state;
@@ -41,4 +43,7 @@ qemu_irq xics_assign_irq(struct icp_state *icp, int irq,
 
 struct icp_state *xics_system_init(int nr_irqs);
 
+void xics_add_eoi_notifier(Notifier *notify, uint32_t srcno);
+void xics_remove_eoi_notifier(Notifier *notify);
+
 #endif /* __XICS_H__ */
-- 
1.7.10

[Qemu-devel] [PATCH] pseries dma: DMA window params added to PHB and DT population changed

[Alexey Kardashevskiy]

Previously the only PCI bus supported was the emulated PCI bus with
fixed DMA window with start at 0 and size 1GB. As we are going to support
PCI pass through which DMA window properties are set by the host
kernel, we have to support DMA windows with parameters other than default.

This patch adds:

1. DMA window properties to sPAPRPHBState: LIOBN (bus id), start,
size of the window.

2. An additional function spapr_dma_dt() to populate DMA window
properties in the device tree which simply accepts all the parameters
and does not try to guess what kind of IOMMU is given to it.
The original spapr_dma_dt() is renamed to spapr_tcet_dma_dt().

Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
---
 hw/spapr.h       |    4 +++-
 hw/spapr_iommu.c |   58 ++++++++++++++++++++++++++++++++++--------------------
 hw/spapr_pci.c   |   11 +++++++----
 hw/spapr_pci.h   |    6 ++++++
 hw/spapr_vio.c   |    2 +-
 5 files changed, 54 insertions(+), 27 deletions(-)

diff --git a/hw/spapr.h b/hw/spapr.h
index 4a3520f..b37f337 100644
--- a/hw/spapr.h
+++ b/hw/spapr.h
@@ -336,6 +336,8 @@ void spapr_iommu_init(void);
 DMAContext *spapr_tce_new_dma_context(uint32_t liobn, size_t window_size);
 void spapr_tce_free(DMAContext *dma);
 int spapr_dma_dt(void *fdt, int node_off, const char *propname,
-                 DMAContext *dma);
+                 uint32_t liobn, uint64_t window, uint32_t size);
+int spapr_tcet_dma_dt(void *fdt, int node_off, const char *propname,
+                      DMAContext *dma);
 
 #endif /* !defined (__HW_SPAPR_H__) */
diff --git a/hw/spapr_iommu.c b/hw/spapr_iommu.c
index 3021bfe..50c288d 100644
--- a/hw/spapr_iommu.c
+++ b/hw/spapr_iommu.c
@@ -221,31 +221,47 @@ void spapr_iommu_init(void)
 }
 
 int spapr_dma_dt(void *fdt, int node_off, const char *propname,
-                 DMAContext *dma)
+                 uint32_t liobn, uint64_t window, uint32_t size)
 {
-    if (dma) {
-        sPAPRTCETable *tcet = DO_UPCAST(sPAPRTCETable, dma, dma);
-        uint32_t dma_prop[] = {cpu_to_be32(tcet->liobn),
-                               0, 0,
-                               0, cpu_to_be32(tcet->window_size)};
-        int ret;
-
-        ret = fdt_setprop_cell(fdt, node_off, "ibm,#dma-address-cells", 2);
-        if (ret < 0) {
-            return ret;
-        }
+    uint32_t dma_prop[5];
+    int ret;
 
-        ret = fdt_setprop_cell(fdt, node_off, "ibm,#dma-size-cells", 2);
-        if (ret < 0) {
-            return ret;
-        }
+    dma_prop[0] = cpu_to_be32(liobn);
+    dma_prop[1] = cpu_to_be32(window >> 32);
+    dma_prop[2] = cpu_to_be32(window & 0xFFFFFFFF);
+    dma_prop[3] = 0; /* window size is 32 bits */
+    dma_prop[4] = cpu_to_be32(size);
 
-        ret = fdt_setprop(fdt, node_off, propname, dma_prop,
-                          sizeof(dma_prop));
-        if (ret < 0) {
-            return ret;
-        }
+    ret = fdt_setprop_cell(fdt, node_off, "ibm,#dma-address-cells", 2);
+    if (ret < 0) {
+        return ret;
+    }
+
+    ret = fdt_setprop_cell(fdt, node_off, "ibm,#dma-size-cells", 2);
+    if (ret < 0) {
+        return ret;
+    }
+
+    ret = fdt_setprop(fdt, node_off, propname, dma_prop, sizeof(dma_prop));
+    if (ret < 0) {
+        return ret;
     }
 
     return 0;
 }
+
+int spapr_tcet_dma_dt(void *fdt, int node_off, const char *propname,
+                      DMAContext *iommu)
+{
+    if (!iommu) {
+        return 0;
+    }
+
+    if (iommu->translate == spapr_tce_translate) {
+        sPAPRTCETable *tcet = DO_UPCAST(sPAPRTCETable, dma, iommu);
+        return spapr_dma_dt(fdt, node_off, propname,
+                tcet->liobn, 0, tcet->window_size);
+    }
+
+    return -1;
+}
diff --git a/hw/spapr_pci.c b/hw/spapr_pci.c
index 7a17d54..f98cd7e 100644
--- a/hw/spapr_pci.c
+++ b/hw/spapr_pci.c
@@ -282,7 +282,6 @@ static int spapr_phb_init(SysBusDevice *s)
     char *namebuf;
     int i;
     PCIBus *bus;
-    uint32_t liobn;
 
     phb->dtbusname = g_strdup_printf("pci@%" PRIx64, phb->buid);
     namebuf = alloca(strlen(phb->dtbusname) + 32);
@@ -323,8 +322,10 @@ static int spapr_phb_init(SysBusDevice *s)
                            PCI_DEVFN(0, 0), PCI_NUM_PINS);
     phb->host_state.bus = bus;
 
-    liobn = SPAPR_PCI_BASE_LIOBN | (pci_find_domain(bus) << 16);
-    phb->dma = spapr_tce_new_dma_context(liobn, 0x40000000);
+    phb->dma_liobn = SPAPR_PCI_BASE_LIOBN | (pci_find_domain(bus) << 16);
+    phb->dma_window_start = 0;
+    phb->dma_window_size = 0x40000000;
+    phb->dma = spapr_tce_new_dma_context(phb->dma_liobn, phb->dma_window_size);
     pci_setup_iommu(bus, spapr_pci_dma_context_fn, phb);
 
     QLIST_INSERT_HEAD(&spapr->phbs, phb, list);
@@ -476,7 +477,9 @@ int spapr_populate_pci_dt(sPAPRPHBState *phb,
     _FDT(fdt_setprop(fdt, bus_off, "interrupt-map", &interrupt_map,
                      sizeof(interrupt_map)));
 
-    spapr_dma_dt(fdt, bus_off, "ibm,dma-window", phb->dma);
+    spapr_dma_dt(fdt, bus_off, "ibm,dma-window",
+                 phb->dma_liobn, phb->dma_window_start,
+                 phb->dma_window_size);
 
     return 0;
 }
diff --git a/hw/spapr_pci.h b/hw/spapr_pci.h
index 05447b4..e54809a 100644
--- a/hw/spapr_pci.h
+++ b/hw/spapr_pci.h
@@ -37,6 +37,12 @@ typedef struct sPAPRPHBState {
     MemoryRegion memspace, iospace;
     target_phys_addr_t mem_win_addr, mem_win_size, io_win_addr, io_win_size;
     MemoryRegion memwindow, iowindow;
+    target_phys_addr_t msi_win_addr;
+    MemoryRegion msiwindow;
+
+    uint32_t dma_liobn;
+    uint64_t dma_window_start;
+    uint64_t dma_window_size;
     DMAContext *dma;
 
     struct {
diff --git a/hw/spapr_vio.c b/hw/spapr_vio.c
index 05b5503..c734eb4 100644
--- a/hw/spapr_vio.c
+++ b/hw/spapr_vio.c
@@ -142,7 +142,7 @@ static int vio_make_devnode(VIOsPAPRDevice *dev,
         }
     }
 
-    ret = spapr_dma_dt(fdt, node_off, "ibm,my-dma-window", dev->dma);
+    ret = spapr_tcet_dma_dt(fdt, node_off, "ibm,my-dma-window", dev->dma);
     if (ret < 0) {
         return ret;
     }
-- 
1.7.10

Re: [Qemu-devel] [PATCH] xics: added end-of-interrupt (EOI) handlers

[Alexey Kardashevskiy]

Already outdated :)

On 10/07/12 23:46, Alexey Kardashevskiy wrote:
> Normally when the host driver gets called via interrupt, it disables IRQ
> first, then handles it and enables back. In the case of PCI pass through,
> the actual handling is done by the guest so the host driver needs to know
> when to enable IRQ back.
> 
> The patch introduces add/remove callback API and EOI initialization for
> the XICS interrupt controller.
> 
> Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
> ---
>  hw/xics.c |   18 ++++++++++++++++++
>  hw/xics.h |    5 +++++
>  2 files changed, 23 insertions(+)
> 
> diff --git a/hw/xics.c b/hw/xics.c
> index 668a0d6..de7833e 100644
> --- a/hw/xics.c
> +++ b/hw/xics.c
> @@ -170,6 +170,7 @@ struct ics_irq_state {
>      int sent:1;
>      int rejected:1;
>      int masked_pending:1;
> +    NotifierList eoi_notifier;
>  };
>  
>  struct ics_state {
> @@ -309,6 +310,8 @@ static void ics_eoi(struct ics_state *ics, int nr)
>      if (irq->type == XICS_LSI) {
>          irq->sent = 0;
>      }
> +
> +    notifier_list_notify(&irq->eoi_notifier, NULL);
>  }
>  
>  /*
> @@ -536,6 +539,7 @@ struct icp_state *xics_system_init(int nr_irqs)
>      for (i = 0; i < nr_irqs; i++) {
>          ics->irqs[i].priority = 0xff;
>          ics->irqs[i].saved_priority = 0xff;
> +        notifier_list_init(&ics->irqs[i].eoi_notifier);
>      }
>  
>      ics->qirqs = qemu_allocate_irqs(ics_set_irq, ics, nr_irqs);
> @@ -552,3 +556,17 @@ struct icp_state *xics_system_init(int nr_irqs)
>  
>      return icp;
>  }
> +
> +void xics_add_eoi_notifier(Notifier *notify, uint32_t srcno)
> +{
> +    struct ics_state *ics = spapr->icp->ics;
> +    struct ics_irq_state *irq = &ics->irqs[srcno - ics->offset];
> +
> +    notifier_list_add(&irq->eoi_notifier, notify);
> +}
> +
> +void xics_remove_eoi_notifier(Notifier *notify)
> +{
> +    notifier_remove(notify);
> +}
> +
> diff --git a/hw/xics.h b/hw/xics.h
> index 2080159..762243c 100644
> --- a/hw/xics.h
> +++ b/hw/xics.h
> @@ -27,6 +27,8 @@
>  #if !defined(__XICS_H__)
>  #define __XICS_H__
>  
> +#include "notify.h"
> +
>  #define XICS_IPI        0x2
>  
>  struct icp_state;
> @@ -41,4 +43,7 @@ qemu_irq xics_assign_irq(struct icp_state *icp, int irq,
>  
>  struct icp_state *xics_system_init(int nr_irqs);
>  
> +void xics_add_eoi_notifier(Notifier *notify, uint32_t srcno);
> +void xics_remove_eoi_notifier(Notifier *notify);
> +
>  #endif /* __XICS_H__ */
> 


-- 
Alexey