xref: /openbmc/qemu/hw/intc/pnv_xive2.c (revision 576830428eea6ebfc85792851a343214b834e401)
1 /*
2  * QEMU PowerPC XIVE2 interrupt controller model  (POWER10)
3  *
4  * Copyright (c) 2019-2024, IBM Corporation.
5  *
6  * SPDX-License-Identifier: GPL-2.0-or-later
7  */
8 
9 #include "qemu/osdep.h"
10 #include "qemu/log.h"
11 #include "qapi/error.h"
12 #include "target/ppc/cpu.h"
13 #include "system/cpus.h"
14 #include "system/dma.h"
15 #include "hw/ppc/fdt.h"
16 #include "hw/ppc/pnv.h"
17 #include "hw/ppc/pnv_chip.h"
18 #include "hw/ppc/pnv_core.h"
19 #include "hw/ppc/pnv_xscom.h"
20 #include "hw/ppc/xive2.h"
21 #include "hw/ppc/pnv_xive.h"
22 #include "hw/ppc/xive_regs.h"
23 #include "hw/ppc/xive2_regs.h"
24 #include "hw/ppc/ppc.h"
25 #include "hw/qdev-properties.h"
26 #include "system/reset.h"
27 #include "system/qtest.h"
28 
29 #include <libfdt.h>
30 
31 #include "pnv_xive2_regs.h"
32 
33 #undef XIVE2_DEBUG
34 
35 /* XIVE Sync or Flush Notification Block */
36 typedef struct XiveSfnBlock {
37     uint8_t bytes[32];
38 } XiveSfnBlock;
39 
40 /* XIVE Thread Sync or Flush Notification Area */
41 typedef struct XiveThreadNA {
42     XiveSfnBlock topo[16];
43 } XiveThreadNA;
44 
45 /*
46  * Virtual structures table (VST)
47  */
48 #define SBE_PER_BYTE   4
49 
50 typedef struct XiveVstInfo {
51     const char *name;
52     uint32_t    size;
53     uint32_t    max_blocks;
54 } XiveVstInfo;
55 
56 static const XiveVstInfo vst_infos[] = {
57 
58     [VST_EAS]  = { "EAT",  sizeof(Xive2Eas),     16 },
59     [VST_ESB]  = { "ESB",  1,                    16 },
60     [VST_END]  = { "ENDT", sizeof(Xive2End),     16 },
61 
62     [VST_NVP]  = { "NVPT", sizeof(Xive2Nvp),     16 },
63     [VST_NVG]  = { "NVGT", sizeof(Xive2Nvgc),    16 },
64     [VST_NVC]  = { "NVCT", sizeof(Xive2Nvgc),    16 },
65 
66     [VST_IC]  =  { "IC",   1, /* ? */            16 }, /* Topology # */
67     [VST_SYNC] = { "SYNC", sizeof(XiveThreadNA), 16 }, /* Topology # */
68 
69     /*
70      * This table contains the backing store pages for the interrupt
71      * fifos of the VC sub-engine in case of overflow.
72      *
73      * 0 - IPI,
74      * 1 - HWD,
75      * 2 - NxC,
76      * 3 - INT,
77      * 4 - OS-Queue,
78      * 5 - Pool-Queue,
79      * 6 - Hard-Queue
80      */
81     [VST_ERQ]  = { "ERQ",  1,                   VC_QUEUE_COUNT },
82 };
83 
84 #define xive2_error(xive, fmt, ...)                                      \
85     qemu_log_mask(LOG_GUEST_ERROR, "XIVE[%x] - " fmt "\n",              \
86                   (xive)->chip->chip_id, ## __VA_ARGS__);
87 
88 /*
89  * TODO: Document block id override
90  */
91 static uint32_t pnv_xive2_block_id(PnvXive2 *xive)
92 {
93     uint8_t blk = xive->chip->chip_id;
94     uint64_t cfg_val = xive->cq_regs[CQ_XIVE_CFG >> 3];
95 
96     if (cfg_val & CQ_XIVE_CFG_HYP_HARD_BLKID_OVERRIDE) {
97         blk = GETFIELD(CQ_XIVE_CFG_HYP_HARD_BLOCK_ID, cfg_val);
98     }
99 
100     return blk;
101 }
102 
103 /*
104  * Remote access to INT controllers. HW uses MMIOs(?). For now, a simple
105  * scan of all the chips INT controller is good enough.
106  */
107 static PnvXive2 *pnv_xive2_get_remote(uint32_t vsd_type, hwaddr fwd_addr)
108 {
109     PnvMachineState *pnv = PNV_MACHINE(qdev_get_machine());
110     int i;
111 
112     for (i = 0; i < pnv->num_chips; i++) {
113         Pnv10Chip *chip10 = PNV10_CHIP(pnv->chips[i]);
114         PnvXive2 *xive = &chip10->xive;
115 
116         /*
117          * Is this the XIVE matching the forwarded VSD address is for this
118          * VSD type
119          */
120         if ((vsd_type == VST_ESB   && fwd_addr == xive->esb_base) ||
121             (vsd_type == VST_END   && fwd_addr == xive->end_base)  ||
122             ((vsd_type == VST_NVP ||
123               vsd_type == VST_NVG) && fwd_addr == xive->nvpg_base) ||
124             (vsd_type == VST_NVC   && fwd_addr == xive->nvc_base)) {
125             return xive;
126         }
127     }
128 
129     qemu_log_mask(LOG_GUEST_ERROR,
130                  "XIVE: >>>>> %s vsd_type %u  fwd_addr 0x%"HWADDR_PRIx
131                   " NOT FOUND\n",
132                   __func__, vsd_type, fwd_addr);
133     return NULL;
134 }
135 
136 /*
137  * VST accessors for ESB, EAT, ENDT, NVP
138  *
139  * Indirect VST tables are arrays of VSDs pointing to a page (of same
140  * size). Each page is a direct VST table.
141  */
142 
143 #define XIVE_VSD_SIZE 8
144 
145 /* Indirect page size can be 4K, 64K, 2M, 16M. */
146 static uint64_t pnv_xive2_vst_page_size_allowed(uint32_t page_shift)
147 {
148      return page_shift == 12 || page_shift == 16 ||
149          page_shift == 21 || page_shift == 24;
150 }
151 
152 static uint64_t pnv_xive2_vst_addr_direct(PnvXive2 *xive, uint32_t type,
153                                           uint64_t vsd, uint32_t idx)
154 {
155     const XiveVstInfo *info = &vst_infos[type];
156     uint64_t vst_addr = vsd & VSD_ADDRESS_MASK;
157     uint64_t vst_tsize = 1ull << (GETFIELD(VSD_TSIZE, vsd) + 12);
158     uint32_t idx_max;
159 
160     idx_max = vst_tsize / info->size - 1;
161     if (idx > idx_max) {
162 #ifdef XIVE2_DEBUG
163         xive2_error(xive, "VST: %s entry %x out of range [ 0 .. %x ] !?",
164                    info->name, idx, idx_max);
165 #endif
166         return 0;
167     }
168 
169     return vst_addr + idx * info->size;
170 }
171 
172 static uint64_t pnv_xive2_vst_addr_indirect(PnvXive2 *xive, uint32_t type,
173                                             uint64_t vsd, uint32_t idx)
174 {
175     const XiveVstInfo *info = &vst_infos[type];
176     uint64_t vsd_addr;
177     uint32_t vsd_idx;
178     uint32_t page_shift;
179     uint32_t vst_per_page;
180 
181     /* Get the page size of the indirect table. */
182     vsd_addr = vsd & VSD_ADDRESS_MASK;
183     ldq_be_dma(&address_space_memory, vsd_addr, &vsd, MEMTXATTRS_UNSPECIFIED);
184 
185     if (!(vsd & VSD_ADDRESS_MASK)) {
186 #ifdef XIVE2_DEBUG
187         xive2_error(xive, "VST: invalid %s entry %x !?", info->name, idx);
188 #endif
189         return 0;
190     }
191 
192     page_shift = GETFIELD(VSD_TSIZE, vsd) + 12;
193 
194     if (!pnv_xive2_vst_page_size_allowed(page_shift)) {
195         xive2_error(xive, "VST: invalid %s page shift %d", info->name,
196                    page_shift);
197         return 0;
198     }
199 
200     vst_per_page = (1ull << page_shift) / info->size;
201     vsd_idx = idx / vst_per_page;
202 
203     /* Load the VSD we are looking for, if not already done */
204     if (vsd_idx) {
205         vsd_addr = vsd_addr + vsd_idx * XIVE_VSD_SIZE;
206         ldq_be_dma(&address_space_memory, vsd_addr, &vsd,
207                    MEMTXATTRS_UNSPECIFIED);
208 
209         if (!(vsd & VSD_ADDRESS_MASK)) {
210 #ifdef XIVE2_DEBUG
211             xive2_error(xive, "VST: invalid %s entry %x !?", info->name, idx);
212 #endif
213             return 0;
214         }
215 
216         /*
217          * Check that the pages have a consistent size across the
218          * indirect table
219          */
220         if (page_shift != GETFIELD(VSD_TSIZE, vsd) + 12) {
221             xive2_error(xive, "VST: %s entry %x indirect page size differ !?",
222                        info->name, idx);
223             return 0;
224         }
225     }
226 
227     return pnv_xive2_vst_addr_direct(xive, type, vsd, (idx % vst_per_page));
228 }
229 
230 static uint8_t pnv_xive2_nvc_table_compress_shift(PnvXive2 *xive)
231 {
232     uint8_t shift =  GETFIELD(PC_NXC_PROC_CONFIG_NVC_TABLE_COMPRESS,
233                               xive->pc_regs[PC_NXC_PROC_CONFIG >> 3]);
234     return shift > 8 ? 0 : shift;
235 }
236 
237 static uint8_t pnv_xive2_nvg_table_compress_shift(PnvXive2 *xive)
238 {
239     uint8_t shift = GETFIELD(PC_NXC_PROC_CONFIG_NVG_TABLE_COMPRESS,
240                              xive->pc_regs[PC_NXC_PROC_CONFIG >> 3]);
241     return shift > 8 ? 0 : shift;
242 }
243 
244 static uint64_t pnv_xive2_vst_addr(PnvXive2 *xive, uint32_t type, uint8_t blk,
245                                    uint32_t idx)
246 {
247     const XiveVstInfo *info = &vst_infos[type];
248     uint64_t vsd;
249 
250     if (blk >= info->max_blocks) {
251         xive2_error(xive, "VST: invalid block id %d for VST %s %d !?",
252                    blk, info->name, idx);
253         return 0;
254     }
255 
256     vsd = xive->vsds[type][blk];
257     if (vsd == 0) {
258         xive2_error(xive, "VST: vsd == 0 block id %d for VST %s %d !?",
259                    blk, info->name, idx);
260         return 0;
261     }
262 
263     /* Remote VST access */
264     if (GETFIELD(VSD_MODE, vsd) == VSD_MODE_FORWARD) {
265         xive = pnv_xive2_get_remote(type, (vsd & VSD_ADDRESS_MASK));
266         return xive ? pnv_xive2_vst_addr(xive, type, blk, idx) : 0;
267     }
268 
269     if (type == VST_NVG) {
270         idx >>= pnv_xive2_nvg_table_compress_shift(xive);
271     } else if (type == VST_NVC) {
272         idx >>= pnv_xive2_nvc_table_compress_shift(xive);
273     }
274 
275     if (VSD_INDIRECT & vsd) {
276         return pnv_xive2_vst_addr_indirect(xive, type, vsd, idx);
277     }
278 
279     return pnv_xive2_vst_addr_direct(xive, type, vsd, idx);
280 }
281 
282 static int pnv_xive2_vst_read(PnvXive2 *xive, uint32_t type, uint8_t blk,
283                              uint32_t idx, void *data)
284 {
285     const XiveVstInfo *info = &vst_infos[type];
286     uint64_t addr = pnv_xive2_vst_addr(xive, type, blk, idx);
287     MemTxResult result;
288 
289     if (!addr) {
290         return -1;
291     }
292 
293     result = address_space_read(&address_space_memory, addr,
294                                 MEMTXATTRS_UNSPECIFIED, data,
295                                 info->size);
296     if (result != MEMTX_OK) {
297         xive2_error(xive, "VST: read failed at @0x%" HWADDR_PRIx
298                    " for VST %s %x/%x\n", addr, info->name, blk, idx);
299         return -1;
300     }
301     return 0;
302 }
303 
304 #define XIVE_VST_WORD_ALL -1
305 
306 static int pnv_xive2_vst_write(PnvXive2 *xive, uint32_t type, uint8_t blk,
307                                uint32_t idx, void *data, uint32_t word_number)
308 {
309     const XiveVstInfo *info = &vst_infos[type];
310     uint64_t addr = pnv_xive2_vst_addr(xive, type, blk, idx);
311     MemTxResult result;
312 
313     if (!addr) {
314         return -1;
315     }
316 
317     if (word_number == XIVE_VST_WORD_ALL) {
318         result = address_space_write(&address_space_memory, addr,
319                                      MEMTXATTRS_UNSPECIFIED, data,
320                                      info->size);
321     } else {
322         result = address_space_write(&address_space_memory,
323                                      addr + word_number * 4,
324                                      MEMTXATTRS_UNSPECIFIED,
325                                      data + word_number * 4, 4);
326     }
327 
328     if (result != MEMTX_OK) {
329         xive2_error(xive, "VST: write failed at @0x%" HWADDR_PRIx
330                    "for VST %s %x/%x\n", addr, info->name, blk, idx);
331         return -1;
332     }
333     return 0;
334 }
335 
336 static int pnv_xive2_get_pq(Xive2Router *xrtr, uint8_t blk, uint32_t idx,
337                              uint8_t *pq)
338 {
339     PnvXive2 *xive = PNV_XIVE2(xrtr);
340 
341     if (pnv_xive2_block_id(xive) != blk) {
342         xive2_error(xive, "VST: EAS %x is remote !?", XIVE_EAS(blk, idx));
343         return -1;
344     }
345 
346     *pq = xive_source_esb_get(&xive->ipi_source, idx);
347     return 0;
348 }
349 
350 static int pnv_xive2_set_pq(Xive2Router *xrtr, uint8_t blk, uint32_t idx,
351                              uint8_t *pq)
352 {
353     PnvXive2 *xive = PNV_XIVE2(xrtr);
354 
355     if (pnv_xive2_block_id(xive) != blk) {
356         xive2_error(xive, "VST: EAS %x is remote !?", XIVE_EAS(blk, idx));
357         return -1;
358     }
359 
360     *pq = xive_source_esb_set(&xive->ipi_source, idx, *pq);
361     return 0;
362 }
363 
364 static int pnv_xive2_get_end(Xive2Router *xrtr, uint8_t blk, uint32_t idx,
365                              Xive2End *end)
366 {
367     return pnv_xive2_vst_read(PNV_XIVE2(xrtr), VST_END, blk, idx, end);
368 }
369 
370 static int pnv_xive2_write_end(Xive2Router *xrtr, uint8_t blk, uint32_t idx,
371                                Xive2End *end, uint8_t word_number)
372 {
373     return pnv_xive2_vst_write(PNV_XIVE2(xrtr), VST_END, blk, idx, end,
374                               word_number);
375 }
376 
377 static inline int pnv_xive2_get_current_pir(PnvXive2 *xive)
378 {
379     if (!qtest_enabled()) {
380         PowerPCCPU *cpu = POWERPC_CPU(current_cpu);
381         return ppc_cpu_pir(cpu);
382     }
383     return 0;
384 }
385 
386 /*
387  * After SW injects a Queue Sync or Cache Flush operation, HW will notify
388  * SW of the completion of the operation by writing a byte of all 1's (0xff)
389  * to a specific memory location.  The memory location is calculated by first
390  * looking up a base address in the SYNC VSD using the Topology ID of the
391  * originating thread as the "block" number.  This points to a
392  * 64k block of memory that is further divided into 128 512 byte chunks of
393  * memory, which is indexed by the thread id of the requesting thread.
394  * Finally, this 512 byte chunk of memory is divided into 16 32 byte
395  * chunks which are indexed by the topology id of the targeted IC's chip.
396  * The values below are the offsets into that 32 byte chunk of memory for
397  * each type of cache flush or queue sync operation.
398  */
399 #define PNV_XIVE2_QUEUE_IPI              0x00
400 #define PNV_XIVE2_QUEUE_HW               0x01
401 #define PNV_XIVE2_QUEUE_NXC              0x02
402 #define PNV_XIVE2_QUEUE_INT              0x03
403 #define PNV_XIVE2_QUEUE_OS               0x04
404 #define PNV_XIVE2_QUEUE_POOL             0x05
405 #define PNV_XIVE2_QUEUE_HARD             0x06
406 #define PNV_XIVE2_CACHE_ENDC             0x08
407 #define PNV_XIVE2_CACHE_ESBC             0x09
408 #define PNV_XIVE2_CACHE_EASC             0x0a
409 #define PNV_XIVE2_QUEUE_NXC_LD_LCL_NCO   0x10
410 #define PNV_XIVE2_QUEUE_NXC_LD_LCL_CO    0x11
411 #define PNV_XIVE2_QUEUE_NXC_ST_LCL_NCI   0x12
412 #define PNV_XIVE2_QUEUE_NXC_ST_LCL_CI    0x13
413 #define PNV_XIVE2_QUEUE_NXC_ST_RMT_NCI   0x14
414 #define PNV_XIVE2_QUEUE_NXC_ST_RMT_CI    0x15
415 #define PNV_XIVE2_CACHE_NXC              0x18
416 
417 static int pnv_xive2_inject_notify(PnvXive2 *xive, int type)
418 {
419     uint64_t addr;
420     int pir = pnv_xive2_get_current_pir(xive);
421     int thread_nr = PNV10_PIR2THREAD(pir);
422     int thread_topo_id = PNV10_PIR2CHIP(pir);
423     int ic_topo_id = xive->chip->chip_id;
424     uint64_t offset = ic_topo_id * sizeof(XiveSfnBlock);
425     uint8_t byte = 0xff;
426     MemTxResult result;
427 
428     /* Retrieve the address of requesting thread's notification area */
429     addr = pnv_xive2_vst_addr(xive, VST_SYNC, thread_topo_id, thread_nr);
430 
431     if (!addr) {
432         xive2_error(xive, "VST: no SYNC entry %x/%x !?",
433                     thread_topo_id, thread_nr);
434         return -1;
435     }
436 
437     address_space_stb(&address_space_memory, addr + offset + type, byte,
438                       MEMTXATTRS_UNSPECIFIED, &result);
439     assert(result == MEMTX_OK);
440 
441     return 0;
442 }
443 
444 static int pnv_xive2_end_update(PnvXive2 *xive, uint8_t watch_engine)
445 {
446     uint8_t  blk;
447     uint32_t idx;
448     int i, spec_reg, data_reg;
449     uint64_t endc_watch[4];
450 
451     assert(watch_engine < ARRAY_SIZE(endc_watch));
452 
453     spec_reg = (VC_ENDC_WATCH0_SPEC + watch_engine * 0x40) >> 3;
454     data_reg = (VC_ENDC_WATCH0_DATA0 + watch_engine * 0x40) >> 3;
455     blk = GETFIELD(VC_ENDC_WATCH_BLOCK_ID, xive->vc_regs[spec_reg]);
456     idx = GETFIELD(VC_ENDC_WATCH_INDEX, xive->vc_regs[spec_reg]);
457 
458     for (i = 0; i < ARRAY_SIZE(endc_watch); i++) {
459         endc_watch[i] = cpu_to_be64(xive->vc_regs[data_reg + i]);
460     }
461 
462     return pnv_xive2_vst_write(xive, VST_END, blk, idx, endc_watch,
463                               XIVE_VST_WORD_ALL);
464 }
465 
466 static void pnv_xive2_end_cache_load(PnvXive2 *xive, uint8_t watch_engine)
467 {
468     uint8_t  blk;
469     uint32_t idx;
470     uint64_t endc_watch[4] = { 0 };
471     int i, spec_reg, data_reg;
472 
473     assert(watch_engine < ARRAY_SIZE(endc_watch));
474 
475     spec_reg = (VC_ENDC_WATCH0_SPEC + watch_engine * 0x40) >> 3;
476     data_reg = (VC_ENDC_WATCH0_DATA0 + watch_engine * 0x40) >> 3;
477     blk = GETFIELD(VC_ENDC_WATCH_BLOCK_ID, xive->vc_regs[spec_reg]);
478     idx = GETFIELD(VC_ENDC_WATCH_INDEX, xive->vc_regs[spec_reg]);
479 
480     if (pnv_xive2_vst_read(xive, VST_END, blk, idx, endc_watch)) {
481         xive2_error(xive, "VST: no END entry %x/%x !?", blk, idx);
482     }
483 
484     for (i = 0; i < ARRAY_SIZE(endc_watch); i++) {
485         xive->vc_regs[data_reg + i] = be64_to_cpu(endc_watch[i]);
486     }
487 }
488 
489 static int pnv_xive2_get_nvp(Xive2Router *xrtr, uint8_t blk, uint32_t idx,
490                              Xive2Nvp *nvp)
491 {
492     return pnv_xive2_vst_read(PNV_XIVE2(xrtr), VST_NVP, blk, idx, nvp);
493 }
494 
495 static int pnv_xive2_write_nvp(Xive2Router *xrtr, uint8_t blk, uint32_t idx,
496                                Xive2Nvp *nvp, uint8_t word_number)
497 {
498     return pnv_xive2_vst_write(PNV_XIVE2(xrtr), VST_NVP, blk, idx, nvp,
499                               word_number);
500 }
501 
502 static int pnv_xive2_get_nvgc(Xive2Router *xrtr, bool crowd,
503                               uint8_t blk, uint32_t idx,
504                               Xive2Nvgc *nvgc)
505 {
506     return pnv_xive2_vst_read(PNV_XIVE2(xrtr), crowd ? VST_NVC : VST_NVG,
507                               blk, idx, nvgc);
508 }
509 
510 static int pnv_xive2_write_nvgc(Xive2Router *xrtr, bool crowd,
511                                 uint8_t blk, uint32_t idx,
512                                 Xive2Nvgc *nvgc)
513 {
514     return pnv_xive2_vst_write(PNV_XIVE2(xrtr), crowd ? VST_NVC : VST_NVG,
515                                blk, idx, nvgc,
516                                XIVE_VST_WORD_ALL);
517 }
518 
519 static int pnv_xive2_nxc_to_table_type(uint8_t nxc_type, uint32_t *table_type)
520 {
521     switch (nxc_type) {
522     case PC_NXC_WATCH_NXC_NVP:
523         *table_type = VST_NVP;
524         break;
525     case PC_NXC_WATCH_NXC_NVG:
526         *table_type = VST_NVG;
527         break;
528     case PC_NXC_WATCH_NXC_NVC:
529         *table_type = VST_NVC;
530         break;
531     default:
532         qemu_log_mask(LOG_GUEST_ERROR,
533                       "XIVE: invalid table type for nxc operation\n");
534         return -1;
535     }
536     return 0;
537 }
538 
539 static int pnv_xive2_nxc_update(PnvXive2 *xive, uint8_t watch_engine)
540 {
541     uint8_t  blk, nxc_type;
542     uint32_t idx, table_type = -1;
543     int i, spec_reg, data_reg;
544     uint64_t nxc_watch[4];
545 
546     assert(watch_engine < ARRAY_SIZE(nxc_watch));
547 
548     spec_reg = (PC_NXC_WATCH0_SPEC + watch_engine * 0x40) >> 3;
549     data_reg = (PC_NXC_WATCH0_DATA0 + watch_engine * 0x40) >> 3;
550     nxc_type = GETFIELD(PC_NXC_WATCH_NXC_TYPE, xive->pc_regs[spec_reg]);
551     blk = GETFIELD(PC_NXC_WATCH_BLOCK_ID, xive->pc_regs[spec_reg]);
552     idx = GETFIELD(PC_NXC_WATCH_INDEX, xive->pc_regs[spec_reg]);
553 
554     assert(!pnv_xive2_nxc_to_table_type(nxc_type, &table_type));
555 
556     for (i = 0; i < ARRAY_SIZE(nxc_watch); i++) {
557         nxc_watch[i] = cpu_to_be64(xive->pc_regs[data_reg + i]);
558     }
559 
560     return pnv_xive2_vst_write(xive, table_type, blk, idx, nxc_watch,
561                               XIVE_VST_WORD_ALL);
562 }
563 
564 static void pnv_xive2_nxc_cache_load(PnvXive2 *xive, uint8_t watch_engine)
565 {
566     uint8_t  blk, nxc_type;
567     uint32_t idx, table_type = -1;
568     uint64_t nxc_watch[4] = { 0 };
569     int i, spec_reg, data_reg;
570 
571     assert(watch_engine < ARRAY_SIZE(nxc_watch));
572 
573     spec_reg = (PC_NXC_WATCH0_SPEC + watch_engine * 0x40) >> 3;
574     data_reg = (PC_NXC_WATCH0_DATA0 + watch_engine * 0x40) >> 3;
575     nxc_type = GETFIELD(PC_NXC_WATCH_NXC_TYPE, xive->pc_regs[spec_reg]);
576     blk = GETFIELD(PC_NXC_WATCH_BLOCK_ID, xive->pc_regs[spec_reg]);
577     idx = GETFIELD(PC_NXC_WATCH_INDEX, xive->pc_regs[spec_reg]);
578 
579     assert(!pnv_xive2_nxc_to_table_type(nxc_type, &table_type));
580 
581     if (pnv_xive2_vst_read(xive, table_type, blk, idx, nxc_watch)) {
582         xive2_error(xive, "VST: no NXC entry %x/%x in %s table!?",
583                     blk, idx, vst_infos[table_type].name);
584     }
585 
586     for (i = 0; i < ARRAY_SIZE(nxc_watch); i++) {
587         xive->pc_regs[data_reg + i] = be64_to_cpu(nxc_watch[i]);
588     }
589 }
590 
591 static int pnv_xive2_get_eas(Xive2Router *xrtr, uint8_t blk, uint32_t idx,
592                             Xive2Eas *eas)
593 {
594     PnvXive2 *xive = PNV_XIVE2(xrtr);
595 
596     if (pnv_xive2_block_id(xive) != blk) {
597         xive2_error(xive, "VST: EAS %x is remote !?", XIVE_EAS(blk, idx));
598         return -1;
599     }
600 
601     return pnv_xive2_vst_read(xive, VST_EAS, blk, idx, eas);
602 }
603 
604 static uint32_t pnv_xive2_get_config(Xive2Router *xrtr)
605 {
606     PnvXive2 *xive = PNV_XIVE2(xrtr);
607     uint32_t cfg = 0;
608 
609     if (xive->cq_regs[CQ_XIVE_CFG >> 3] & CQ_XIVE_CFG_GEN1_TIMA_OS) {
610         cfg |= XIVE2_GEN1_TIMA_OS;
611     }
612 
613     if (xive->cq_regs[CQ_XIVE_CFG >> 3] & CQ_XIVE_CFG_EN_VP_SAVE_RESTORE) {
614         cfg |= XIVE2_VP_SAVE_RESTORE;
615     }
616 
617     if (GETFIELD(CQ_XIVE_CFG_HYP_HARD_RANGE,
618               xive->cq_regs[CQ_XIVE_CFG >> 3]) == CQ_XIVE_CFG_THREADID_8BITS) {
619         cfg |= XIVE2_THREADID_8BITS;
620     }
621 
622     return cfg;
623 }
624 
625 static bool pnv_xive2_is_cpu_enabled(PnvXive2 *xive, PowerPCCPU *cpu)
626 {
627     int pir = ppc_cpu_pir(cpu);
628     uint32_t fc = PNV10_PIR2FUSEDCORE(pir);
629     uint64_t reg = fc < 8 ? TCTXT_EN0 : TCTXT_EN1;
630     uint32_t bit = pir & 0x3f;
631 
632     return xive->tctxt_regs[reg >> 3] & PPC_BIT(bit);
633 }
634 
635 static int pnv_xive2_match_nvt(XivePresenter *xptr, uint8_t format,
636                                uint8_t nvt_blk, uint32_t nvt_idx,
637                                bool crowd, bool cam_ignore, uint8_t priority,
638                                uint32_t logic_serv, XiveTCTXMatch *match)
639 {
640     PnvXive2 *xive = PNV_XIVE2(xptr);
641     PnvChip *chip = xive->chip;
642     int count = 0;
643     int i, j;
644     bool gen1_tima_os =
645         xive->cq_regs[CQ_XIVE_CFG >> 3] & CQ_XIVE_CFG_GEN1_TIMA_OS;
646 
647     for (i = 0; i < chip->nr_cores; i++) {
648         PnvCore *pc = chip->cores[i];
649         CPUCore *cc = CPU_CORE(pc);
650 
651         for (j = 0; j < cc->nr_threads; j++) {
652             PowerPCCPU *cpu = pc->threads[j];
653             XiveTCTX *tctx;
654             int ring;
655 
656             if (!pnv_xive2_is_cpu_enabled(xive, cpu)) {
657                 continue;
658             }
659 
660             tctx = XIVE_TCTX(pnv_cpu_state(cpu)->intc);
661 
662             if (gen1_tima_os) {
663                 ring = xive_presenter_tctx_match(xptr, tctx, format, nvt_blk,
664                                                  nvt_idx, cam_ignore,
665                                                  logic_serv);
666             } else {
667                 ring = xive2_presenter_tctx_match(xptr, tctx, format, nvt_blk,
668                                                   nvt_idx, crowd, cam_ignore,
669                                                   logic_serv);
670             }
671 
672             if (ring != -1) {
673                 /*
674                  * For VP-specific match, finding more than one is a
675                  * problem. For group notification, it's possible.
676                  */
677                 if (!cam_ignore && match->tctx) {
678                     qemu_log_mask(LOG_GUEST_ERROR, "XIVE: already found a "
679                                   "thread context NVT %x/%x\n",
680                                   nvt_blk, nvt_idx);
681                     /* Should set a FIR if we ever model it */
682                     return -1;
683                 }
684                 /*
685                  * For a group notification, we need to know if the
686                  * match is precluded first by checking the current
687                  * thread priority. If the interrupt can be delivered,
688                  * we always notify the first match (for now).
689                  */
690                 if (cam_ignore &&
691                     xive2_tm_irq_precluded(tctx, ring, priority)) {
692                         match->precluded = true;
693                 } else {
694                     if (!match->tctx) {
695                         match->ring = ring;
696                         match->tctx = tctx;
697                     }
698                     count++;
699                 }
700             }
701         }
702     }
703 
704     return count;
705 }
706 
707 static uint32_t pnv_xive2_presenter_get_config(XivePresenter *xptr)
708 {
709     PnvXive2 *xive = PNV_XIVE2(xptr);
710     uint32_t cfg = 0;
711 
712     if (xive->cq_regs[CQ_XIVE_CFG >> 3] & CQ_XIVE_CFG_GEN1_TIMA_OS) {
713         cfg |= XIVE_PRESENTER_GEN1_TIMA_OS;
714     }
715     return cfg;
716 }
717 
718 static int pnv_xive2_broadcast(XivePresenter *xptr,
719                                uint8_t nvt_blk, uint32_t nvt_idx,
720                                bool crowd, bool ignore, uint8_t priority)
721 {
722     PnvXive2 *xive = PNV_XIVE2(xptr);
723     PnvChip *chip = xive->chip;
724     int i, j;
725     bool gen1_tima_os =
726         xive->cq_regs[CQ_XIVE_CFG >> 3] & CQ_XIVE_CFG_GEN1_TIMA_OS;
727 
728     for (i = 0; i < chip->nr_cores; i++) {
729         PnvCore *pc = chip->cores[i];
730         CPUCore *cc = CPU_CORE(pc);
731 
732         for (j = 0; j < cc->nr_threads; j++) {
733             PowerPCCPU *cpu = pc->threads[j];
734             XiveTCTX *tctx;
735             int ring;
736 
737             if (!pnv_xive2_is_cpu_enabled(xive, cpu)) {
738                 continue;
739             }
740 
741             tctx = XIVE_TCTX(pnv_cpu_state(cpu)->intc);
742 
743             if (gen1_tima_os) {
744                 ring = xive_presenter_tctx_match(xptr, tctx, 0, nvt_blk,
745                                                  nvt_idx, ignore, 0);
746             } else {
747                 ring = xive2_presenter_tctx_match(xptr, tctx, 0, nvt_blk,
748                                                   nvt_idx, crowd, ignore, 0);
749             }
750 
751             if (ring != -1) {
752                 xive2_tm_set_lsmfb(tctx, ring, priority);
753             }
754         }
755     }
756     return 0;
757 }
758 
759 static uint8_t pnv_xive2_get_block_id(Xive2Router *xrtr)
760 {
761     return pnv_xive2_block_id(PNV_XIVE2(xrtr));
762 }
763 
764 /*
765  * The TIMA MMIO space is shared among the chips and to identify the
766  * chip from which the access is being done, we extract the chip id
767  * from the PIR.
768  */
769 static PnvXive2 *pnv_xive2_tm_get_xive(PowerPCCPU *cpu)
770 {
771     int pir = ppc_cpu_pir(cpu);
772     XivePresenter *xptr = XIVE_TCTX(pnv_cpu_state(cpu)->intc)->xptr;
773     PnvXive2 *xive = PNV_XIVE2(xptr);
774 
775     if (!pnv_xive2_is_cpu_enabled(xive, cpu)) {
776         xive2_error(xive, "IC: CPU %x is not enabled", pir);
777     }
778     return xive;
779 }
780 
781 /*
782  * The internal sources of the interrupt controller have no knowledge
783  * of the XIVE2 chip on which they reside. Encode the block id in the
784  * source interrupt number before forwarding the source event
785  * notification to the Router. This is required on a multichip system.
786  */
787 static void pnv_xive2_notify(XiveNotifier *xn, uint32_t srcno, bool pq_checked)
788 {
789     PnvXive2 *xive = PNV_XIVE2(xn);
790     uint8_t blk = pnv_xive2_block_id(xive);
791 
792     xive2_router_notify(xn, XIVE_EAS(blk, srcno), pq_checked);
793 }
794 
795 /*
796  * Set Translation Tables
797  *
798  * TODO add support for multiple sets
799  */
800 static int pnv_xive2_stt_set_data(PnvXive2 *xive, uint64_t val)
801 {
802     uint8_t tsel = GETFIELD(CQ_TAR_SELECT, xive->cq_regs[CQ_TAR >> 3]);
803     uint8_t entry = GETFIELD(CQ_TAR_ENTRY_SELECT,
804                                   xive->cq_regs[CQ_TAR >> 3]);
805 
806     switch (tsel) {
807     case CQ_TAR_NVPG:
808     case CQ_TAR_ESB:
809     case CQ_TAR_END:
810     case CQ_TAR_NVC:
811         xive->tables[tsel][entry] = val;
812         break;
813     default:
814         xive2_error(xive, "IC: unsupported table %d", tsel);
815         return -1;
816     }
817 
818     if (xive->cq_regs[CQ_TAR >> 3] & CQ_TAR_AUTOINC) {
819         xive->cq_regs[CQ_TAR >> 3] = SETFIELD(CQ_TAR_ENTRY_SELECT,
820                      xive->cq_regs[CQ_TAR >> 3], ++entry);
821     }
822 
823     return 0;
824 }
825 /*
826  * Virtual Structure Tables (VST) configuration
827  */
828 static void pnv_xive2_vst_set_exclusive(PnvXive2 *xive, uint8_t type,
829                                         uint8_t blk, uint64_t vsd)
830 {
831     Xive2EndSource *end_xsrc = &xive->end_source;
832     XiveSource *xsrc = &xive->ipi_source;
833     const XiveVstInfo *info = &vst_infos[type];
834     uint32_t page_shift = GETFIELD(VSD_TSIZE, vsd) + 12;
835     uint64_t vst_tsize = 1ull << page_shift;
836     uint64_t vst_addr = vsd & VSD_ADDRESS_MASK;
837 
838     /* Basic checks */
839 
840     if (VSD_INDIRECT & vsd) {
841         if (!pnv_xive2_vst_page_size_allowed(page_shift)) {
842             xive2_error(xive, "VST: invalid %s page shift %d", info->name,
843                        page_shift);
844             return;
845         }
846     }
847 
848     if (!QEMU_IS_ALIGNED(vst_addr, 1ull << page_shift)) {
849         xive2_error(xive, "VST: %s table address 0x%"PRIx64
850                     " is not aligned with page shift %d",
851                     info->name, vst_addr, page_shift);
852         return;
853     }
854 
855     /* Record the table configuration (in SRAM on HW) */
856     xive->vsds[type][blk] = vsd;
857 
858     /* Now tune the models with the configuration provided by the FW */
859 
860     switch (type) {
861     case VST_ESB:
862         /*
863          * Backing store pages for the source PQ bits. The model does
864          * not use these PQ bits backed in RAM because the XiveSource
865          * model has its own.
866          *
867          * If the table is direct, we can compute the number of PQ
868          * entries provisioned by FW (such as skiboot) and resize the
869          * ESB window accordingly.
870          */
871         if (memory_region_is_mapped(&xsrc->esb_mmio)) {
872             memory_region_del_subregion(&xive->esb_mmio, &xsrc->esb_mmio);
873         }
874         if (!(VSD_INDIRECT & vsd)) {
875             memory_region_set_size(&xsrc->esb_mmio, vst_tsize * SBE_PER_BYTE
876                                    * (1ull << xsrc->esb_shift));
877         }
878 
879         memory_region_add_subregion(&xive->esb_mmio, 0, &xsrc->esb_mmio);
880         break;
881 
882     case VST_EAS:  /* Nothing to be done */
883         break;
884 
885     case VST_END:
886         /*
887          * Backing store pages for the END.
888          */
889         if (memory_region_is_mapped(&end_xsrc->esb_mmio)) {
890             memory_region_del_subregion(&xive->end_mmio, &end_xsrc->esb_mmio);
891         }
892         if (!(VSD_INDIRECT & vsd)) {
893             memory_region_set_size(&end_xsrc->esb_mmio, (vst_tsize / info->size)
894                                    * (1ull << end_xsrc->esb_shift));
895         }
896         memory_region_add_subregion(&xive->end_mmio, 0, &end_xsrc->esb_mmio);
897         break;
898 
899     case VST_NVP:  /* Not modeled */
900     case VST_NVG:  /* Not modeled */
901     case VST_NVC:  /* Not modeled */
902     case VST_IC:   /* Not modeled */
903     case VST_SYNC: /* Not modeled */
904     case VST_ERQ:  /* Not modeled */
905         break;
906 
907     default:
908         g_assert_not_reached();
909     }
910 }
911 
912 /*
913  * Both PC and VC sub-engines are configured as each use the Virtual
914  * Structure Tables
915  */
916 static void pnv_xive2_vst_set_data(PnvXive2 *xive, uint64_t vsd,
917                                    uint8_t type, uint8_t blk)
918 {
919     uint8_t mode = GETFIELD(VSD_MODE, vsd);
920     uint64_t vst_addr = vsd & VSD_ADDRESS_MASK;
921 
922     if (type > VST_ERQ) {
923         xive2_error(xive, "VST: invalid table type %d", type);
924         return;
925     }
926 
927     if (blk >= vst_infos[type].max_blocks) {
928         xive2_error(xive, "VST: invalid block id %d for"
929                       " %s table", blk, vst_infos[type].name);
930         return;
931     }
932 
933     if (!vst_addr) {
934         xive2_error(xive, "VST: invalid %s table address",
935                    vst_infos[type].name);
936         return;
937     }
938 
939     switch (mode) {
940     case VSD_MODE_FORWARD:
941         xive->vsds[type][blk] = vsd;
942         break;
943 
944     case VSD_MODE_EXCLUSIVE:
945         pnv_xive2_vst_set_exclusive(xive, type, blk, vsd);
946         break;
947 
948     default:
949         xive2_error(xive, "VST: unsupported table mode %d", mode);
950         return;
951     }
952 }
953 
954 static void pnv_xive2_vc_vst_set_data(PnvXive2 *xive, uint64_t vsd)
955 {
956     uint8_t type = GETFIELD(VC_VSD_TABLE_SELECT,
957                             xive->vc_regs[VC_VSD_TABLE_ADDR >> 3]);
958     uint8_t blk = GETFIELD(VC_VSD_TABLE_ADDRESS,
959                            xive->vc_regs[VC_VSD_TABLE_ADDR >> 3]);
960 
961     pnv_xive2_vst_set_data(xive, vsd, type, blk);
962 }
963 
964 /*
965  * MMIO handlers
966  */
967 
968 
969 /*
970  * IC BAR layout
971  *
972  * Page 0: Internal CQ register accesses (reads & writes)
973  * Page 1: Internal PC register accesses (reads & writes)
974  * Page 2: Internal VC register accesses (reads & writes)
975  * Page 3: Internal TCTXT (TIMA) reg accesses (read & writes)
976  * Page 4: Notify Port page (writes only, w/data),
977  * Page 5: Reserved
978  * Page 6: Sync Poll page (writes only, dataless)
979  * Page 7: Sync Inject page (writes only, dataless)
980  * Page 8: LSI Trigger page (writes only, dataless)
981  * Page 9: LSI SB Management page (reads & writes dataless)
982  * Pages 10-255: Reserved
983  * Pages 256-383: Direct mapped Thread Context Area (reads & writes)
984  *                covering the 128 threads in P10.
985  * Pages 384-511: Reserved
986  */
987 typedef struct PnvXive2Region {
988     const char *name;
989     uint32_t pgoff;
990     uint32_t pgsize;
991     const MemoryRegionOps *ops;
992 } PnvXive2Region;
993 
994 static const MemoryRegionOps pnv_xive2_ic_cq_ops;
995 static const MemoryRegionOps pnv_xive2_ic_pc_ops;
996 static const MemoryRegionOps pnv_xive2_ic_vc_ops;
997 static const MemoryRegionOps pnv_xive2_ic_tctxt_ops;
998 static const MemoryRegionOps pnv_xive2_ic_notify_ops;
999 static const MemoryRegionOps pnv_xive2_ic_sync_ops;
1000 static const MemoryRegionOps pnv_xive2_ic_lsi_ops;
1001 static const MemoryRegionOps pnv_xive2_ic_tm_indirect_ops;
1002 
1003 /* 512 pages. 4K: 2M range, 64K: 32M range */
1004 static const PnvXive2Region pnv_xive2_ic_regions[] = {
1005     { "xive-ic-cq",        0,   1,   &pnv_xive2_ic_cq_ops     },
1006     { "xive-ic-vc",        1,   1,   &pnv_xive2_ic_vc_ops     },
1007     { "xive-ic-pc",        2,   1,   &pnv_xive2_ic_pc_ops     },
1008     { "xive-ic-tctxt",     3,   1,   &pnv_xive2_ic_tctxt_ops  },
1009     { "xive-ic-notify",    4,   1,   &pnv_xive2_ic_notify_ops },
1010     /* page 5 reserved */
1011     { "xive-ic-sync",      6,   2,   &pnv_xive2_ic_sync_ops   },
1012     { "xive-ic-lsi",       8,   2,   &pnv_xive2_ic_lsi_ops    },
1013     /* pages 10-255 reserved */
1014     { "xive-ic-tm-indirect", 256, 128, &pnv_xive2_ic_tm_indirect_ops  },
1015     /* pages 384-511 reserved */
1016 };
1017 
1018 /*
1019  * CQ operations
1020  */
1021 
1022 static uint64_t pnv_xive2_ic_cq_read(void *opaque, hwaddr offset,
1023                                         unsigned size)
1024 {
1025     PnvXive2 *xive = PNV_XIVE2(opaque);
1026     uint32_t reg = offset >> 3;
1027     uint64_t val = 0;
1028 
1029     switch (offset) {
1030     case CQ_XIVE_CAP: /* Set at reset */
1031     case CQ_XIVE_CFG:
1032         val = xive->cq_regs[reg];
1033         break;
1034     case CQ_MSGSND: /* TODO check the #cores of the machine */
1035         val = 0xffffffff00000000;
1036         break;
1037     case CQ_CFG_PB_GEN:
1038         val = CQ_CFG_PB_GEN_PB_INIT; /* TODO: fix CQ_CFG_PB_GEN default value */
1039         break;
1040     default:
1041         xive2_error(xive, "CQ: invalid read @%"HWADDR_PRIx, offset);
1042     }
1043 
1044     return val;
1045 }
1046 
1047 static uint64_t pnv_xive2_bar_size(uint64_t val)
1048 {
1049     return 1ull << (GETFIELD(CQ_BAR_RANGE, val) + 24);
1050 }
1051 
1052 static void pnv_xive2_ic_cq_write(void *opaque, hwaddr offset,
1053                                   uint64_t val, unsigned size)
1054 {
1055     PnvXive2 *xive = PNV_XIVE2(opaque);
1056     MemoryRegion *sysmem = get_system_memory();
1057     uint32_t reg = offset >> 3;
1058     int i;
1059 
1060     switch (offset) {
1061     case CQ_XIVE_CFG:
1062     case CQ_RST_CTL: /* TODO: reset all BARs */
1063         break;
1064 
1065     case CQ_IC_BAR:
1066         xive->ic_shift = val & CQ_IC_BAR_64K ? 16 : 12;
1067         if (!(val & CQ_IC_BAR_VALID)) {
1068             xive->ic_base = 0;
1069             if (xive->cq_regs[reg] & CQ_IC_BAR_VALID) {
1070                 for (i = 0; i < ARRAY_SIZE(xive->ic_mmios); i++) {
1071                     memory_region_del_subregion(&xive->ic_mmio,
1072                                                 &xive->ic_mmios[i]);
1073                 }
1074                 memory_region_del_subregion(sysmem, &xive->ic_mmio);
1075             }
1076         } else {
1077             xive->ic_base = val & ~(CQ_IC_BAR_VALID | CQ_IC_BAR_64K);
1078             if (!(xive->cq_regs[reg] & CQ_IC_BAR_VALID)) {
1079                 for (i = 0; i < ARRAY_SIZE(xive->ic_mmios); i++) {
1080                     memory_region_add_subregion(&xive->ic_mmio,
1081                                pnv_xive2_ic_regions[i].pgoff << xive->ic_shift,
1082                                &xive->ic_mmios[i]);
1083                 }
1084                 memory_region_add_subregion(sysmem, xive->ic_base,
1085                                             &xive->ic_mmio);
1086             }
1087         }
1088         break;
1089 
1090     case CQ_TM_BAR:
1091         xive->tm_shift = val & CQ_TM_BAR_64K ? 16 : 12;
1092         if (!(val & CQ_TM_BAR_VALID)) {
1093             xive->tm_base = 0;
1094             if (xive->cq_regs[reg] & CQ_TM_BAR_VALID) {
1095                 memory_region_del_subregion(sysmem, &xive->tm_mmio);
1096             }
1097         } else {
1098             xive->tm_base = val & ~(CQ_TM_BAR_VALID | CQ_TM_BAR_64K);
1099             if (!(xive->cq_regs[reg] & CQ_TM_BAR_VALID)) {
1100                 memory_region_add_subregion(sysmem, xive->tm_base,
1101                                             &xive->tm_mmio);
1102             }
1103         }
1104         break;
1105 
1106     case CQ_ESB_BAR:
1107         xive->esb_shift = val & CQ_BAR_64K ? 16 : 12;
1108         if (!(val & CQ_BAR_VALID)) {
1109             xive->esb_base = 0;
1110             if (xive->cq_regs[reg] & CQ_BAR_VALID) {
1111                 memory_region_del_subregion(sysmem, &xive->esb_mmio);
1112             }
1113         } else {
1114             xive->esb_base = val & CQ_BAR_ADDR;
1115             if (!(xive->cq_regs[reg] & CQ_BAR_VALID)) {
1116                 memory_region_set_size(&xive->esb_mmio,
1117                                        pnv_xive2_bar_size(val));
1118                 memory_region_add_subregion(sysmem, xive->esb_base,
1119                                             &xive->esb_mmio);
1120             }
1121         }
1122         break;
1123 
1124     case CQ_END_BAR:
1125         xive->end_shift = val & CQ_BAR_64K ? 16 : 12;
1126         if (!(val & CQ_BAR_VALID)) {
1127             xive->end_base = 0;
1128             if (xive->cq_regs[reg] & CQ_BAR_VALID) {
1129                 memory_region_del_subregion(sysmem, &xive->end_mmio);
1130             }
1131         } else {
1132             xive->end_base = val & CQ_BAR_ADDR;
1133             if (!(xive->cq_regs[reg] & CQ_BAR_VALID)) {
1134                 memory_region_set_size(&xive->end_mmio,
1135                                        pnv_xive2_bar_size(val));
1136                 memory_region_add_subregion(sysmem, xive->end_base,
1137                                             &xive->end_mmio);
1138             }
1139         }
1140         break;
1141 
1142     case CQ_NVC_BAR:
1143         xive->nvc_shift = val & CQ_BAR_64K ? 16 : 12;
1144         if (!(val & CQ_BAR_VALID)) {
1145             xive->nvc_base = 0;
1146             if (xive->cq_regs[reg] & CQ_BAR_VALID) {
1147                 memory_region_del_subregion(sysmem, &xive->nvc_mmio);
1148             }
1149         } else {
1150             xive->nvc_base = val & CQ_BAR_ADDR;
1151             if (!(xive->cq_regs[reg] & CQ_BAR_VALID)) {
1152                 memory_region_set_size(&xive->nvc_mmio,
1153                                        pnv_xive2_bar_size(val));
1154                 memory_region_add_subregion(sysmem, xive->nvc_base,
1155                                             &xive->nvc_mmio);
1156             }
1157         }
1158         break;
1159 
1160     case CQ_NVPG_BAR:
1161         xive->nvpg_shift = val & CQ_BAR_64K ? 16 : 12;
1162         if (!(val & CQ_BAR_VALID)) {
1163             xive->nvpg_base = 0;
1164             if (xive->cq_regs[reg] & CQ_BAR_VALID) {
1165                 memory_region_del_subregion(sysmem, &xive->nvpg_mmio);
1166             }
1167         } else {
1168             xive->nvpg_base = val & CQ_BAR_ADDR;
1169             if (!(xive->cq_regs[reg] & CQ_BAR_VALID)) {
1170                 memory_region_set_size(&xive->nvpg_mmio,
1171                                        pnv_xive2_bar_size(val));
1172                 memory_region_add_subregion(sysmem, xive->nvpg_base,
1173                                             &xive->nvpg_mmio);
1174             }
1175         }
1176         break;
1177 
1178     case CQ_TAR: /* Set Translation Table Address */
1179         break;
1180     case CQ_TDR: /* Set Translation Table Data */
1181         pnv_xive2_stt_set_data(xive, val);
1182         break;
1183     case CQ_FIRMASK_OR: /* FIR error reporting */
1184         break;
1185     default:
1186         xive2_error(xive, "CQ: invalid write 0x%"HWADDR_PRIx, offset);
1187         return;
1188     }
1189 
1190     xive->cq_regs[reg] = val;
1191 }
1192 
1193 static const MemoryRegionOps pnv_xive2_ic_cq_ops = {
1194     .read = pnv_xive2_ic_cq_read,
1195     .write = pnv_xive2_ic_cq_write,
1196     .endianness = DEVICE_BIG_ENDIAN,
1197     .valid = {
1198         .min_access_size = 8,
1199         .max_access_size = 8,
1200     },
1201     .impl = {
1202         .min_access_size = 8,
1203         .max_access_size = 8,
1204     },
1205 };
1206 
1207 static uint8_t pnv_xive2_cache_watch_assign(uint64_t engine_mask,
1208                                             uint64_t *state)
1209 {
1210     uint8_t val = 0xFF;
1211     int i;
1212 
1213     for (i = 3; i >= 0; i--) {
1214         if (BIT(i) & engine_mask) {
1215             if (!(BIT(i) & *state)) {
1216                 *state |= BIT(i);
1217                 val = 3 - i;
1218                 break;
1219             }
1220         }
1221     }
1222     return val;
1223 }
1224 
1225 static void pnv_xive2_cache_watch_release(uint64_t *state, uint8_t watch_engine)
1226 {
1227     uint8_t engine_bit = 3 - watch_engine;
1228 
1229     if (*state & BIT(engine_bit)) {
1230         *state &= ~BIT(engine_bit);
1231     }
1232 }
1233 
1234 static uint8_t pnv_xive2_endc_cache_watch_assign(PnvXive2 *xive)
1235 {
1236     uint64_t engine_mask = GETFIELD(VC_ENDC_CFG_CACHE_WATCH_ASSIGN,
1237                                     xive->vc_regs[VC_ENDC_CFG >> 3]);
1238     uint64_t state = xive->vc_regs[VC_ENDC_WATCH_ASSIGN >> 3];
1239     uint8_t val;
1240 
1241     /*
1242      * We keep track of which engines are currently busy in the
1243      * VC_ENDC_WATCH_ASSIGN register directly. When the firmware reads
1244      * the register, we don't return its value but the ID of an engine
1245      * it can use.
1246      * There are 4 engines. 0xFF means no engine is available.
1247      */
1248     val = pnv_xive2_cache_watch_assign(engine_mask, &state);
1249     if (val != 0xFF) {
1250         xive->vc_regs[VC_ENDC_WATCH_ASSIGN >> 3] = state;
1251     }
1252     return val;
1253 }
1254 
1255 static void pnv_xive2_endc_cache_watch_release(PnvXive2 *xive,
1256                                                uint8_t watch_engine)
1257 {
1258     uint64_t state = xive->vc_regs[VC_ENDC_WATCH_ASSIGN >> 3];
1259 
1260     pnv_xive2_cache_watch_release(&state, watch_engine);
1261     xive->vc_regs[VC_ENDC_WATCH_ASSIGN >> 3] = state;
1262 }
1263 
1264 static uint64_t pnv_xive2_ic_vc_read(void *opaque, hwaddr offset,
1265                                      unsigned size)
1266 {
1267     PnvXive2 *xive = PNV_XIVE2(opaque);
1268     uint64_t val = 0;
1269     uint32_t reg = offset >> 3;
1270     uint8_t watch_engine;
1271 
1272     switch (offset) {
1273     /*
1274      * VSD table settings.
1275      */
1276     case VC_VSD_TABLE_ADDR:
1277     case VC_VSD_TABLE_DATA:
1278         val = xive->vc_regs[reg];
1279         break;
1280 
1281     /*
1282      * ESB cache updates (not modeled)
1283      */
1284     case VC_ESBC_FLUSH_CTRL:
1285         xive->vc_regs[reg] &= ~VC_ESBC_FLUSH_CTRL_POLL_VALID;
1286         val = xive->vc_regs[reg];
1287         break;
1288 
1289     case VC_ESBC_CFG:
1290         val = xive->vc_regs[reg];
1291         break;
1292 
1293     /*
1294      * EAS cache updates (not modeled)
1295      */
1296     case VC_EASC_FLUSH_CTRL:
1297         xive->vc_regs[reg] &= ~VC_EASC_FLUSH_CTRL_POLL_VALID;
1298         val = xive->vc_regs[reg];
1299         break;
1300 
1301     case VC_ENDC_WATCH_ASSIGN:
1302         val = pnv_xive2_endc_cache_watch_assign(xive);
1303         break;
1304 
1305     case VC_ENDC_CFG:
1306         val = xive->vc_regs[reg];
1307         break;
1308 
1309     /*
1310      * END cache updates
1311      */
1312     case VC_ENDC_WATCH0_SPEC:
1313     case VC_ENDC_WATCH1_SPEC:
1314     case VC_ENDC_WATCH2_SPEC:
1315     case VC_ENDC_WATCH3_SPEC:
1316         watch_engine = (offset - VC_ENDC_WATCH0_SPEC) >> 6;
1317         xive->vc_regs[reg] &= ~(VC_ENDC_WATCH_FULL | VC_ENDC_WATCH_CONFLICT);
1318         pnv_xive2_endc_cache_watch_release(xive, watch_engine);
1319         val = xive->vc_regs[reg];
1320         break;
1321 
1322     case VC_ENDC_WATCH0_DATA0:
1323     case VC_ENDC_WATCH1_DATA0:
1324     case VC_ENDC_WATCH2_DATA0:
1325     case VC_ENDC_WATCH3_DATA0:
1326         /*
1327          * Load DATA registers from cache with data requested by the
1328          * SPEC register.  Clear gen_flipped bit in word 1.
1329          */
1330         watch_engine = (offset - VC_ENDC_WATCH0_DATA0) >> 6;
1331         pnv_xive2_end_cache_load(xive, watch_engine);
1332         xive->vc_regs[reg] &= ~(uint64_t)END2_W1_GEN_FLIPPED;
1333         val = xive->vc_regs[reg];
1334         break;
1335 
1336     case VC_ENDC_WATCH0_DATA1 ... VC_ENDC_WATCH0_DATA3:
1337     case VC_ENDC_WATCH1_DATA1 ... VC_ENDC_WATCH1_DATA3:
1338     case VC_ENDC_WATCH2_DATA1 ... VC_ENDC_WATCH2_DATA3:
1339     case VC_ENDC_WATCH3_DATA1 ... VC_ENDC_WATCH3_DATA3:
1340         val = xive->vc_regs[reg];
1341         break;
1342 
1343     case VC_ENDC_FLUSH_CTRL:
1344         xive->vc_regs[reg] &= ~VC_ENDC_FLUSH_CTRL_POLL_VALID;
1345         val = xive->vc_regs[reg];
1346         break;
1347 
1348     /*
1349      * Indirect invalidation
1350      */
1351     case VC_AT_MACRO_KILL_MASK:
1352         val = xive->vc_regs[reg];
1353         break;
1354 
1355     case VC_AT_MACRO_KILL:
1356         xive->vc_regs[reg] &= ~VC_AT_MACRO_KILL_VALID;
1357         val = xive->vc_regs[reg];
1358         break;
1359 
1360     /*
1361      * Interrupt fifo overflow in memory backing store (Not modeled)
1362      */
1363     case VC_QUEUES_CFG_REM0 ... VC_QUEUES_CFG_REM6:
1364         val = xive->vc_regs[reg];
1365         break;
1366 
1367     /*
1368      * Synchronisation
1369      */
1370     case VC_ENDC_SYNC_DONE:
1371         val = VC_ENDC_SYNC_POLL_DONE;
1372         break;
1373     default:
1374         xive2_error(xive, "VC: invalid read @%"HWADDR_PRIx, offset);
1375     }
1376 
1377     return val;
1378 }
1379 
1380 static void pnv_xive2_ic_vc_write(void *opaque, hwaddr offset,
1381                                   uint64_t val, unsigned size)
1382 {
1383     PnvXive2 *xive = PNV_XIVE2(opaque);
1384     uint32_t reg = offset >> 3;
1385     uint8_t watch_engine;
1386 
1387     switch (offset) {
1388     /*
1389      * VSD table settings.
1390      */
1391     case VC_VSD_TABLE_ADDR:
1392        break;
1393     case VC_VSD_TABLE_DATA:
1394         pnv_xive2_vc_vst_set_data(xive, val);
1395         break;
1396 
1397     /*
1398      * ESB cache updates (not modeled)
1399      */
1400     /* case VC_ESBC_FLUSH_CTRL: */
1401     case VC_ESBC_FLUSH_POLL:
1402         xive->vc_regs[VC_ESBC_FLUSH_CTRL >> 3] |= VC_ESBC_FLUSH_CTRL_POLL_VALID;
1403         /* ESB update */
1404         break;
1405 
1406     case VC_ESBC_FLUSH_INJECT:
1407         pnv_xive2_inject_notify(xive, PNV_XIVE2_CACHE_ESBC);
1408         break;
1409 
1410     case VC_ESBC_CFG:
1411         break;
1412 
1413     /*
1414      * EAS cache updates (not modeled)
1415      */
1416     /* case VC_EASC_FLUSH_CTRL: */
1417     case VC_EASC_FLUSH_POLL:
1418         xive->vc_regs[VC_EASC_FLUSH_CTRL >> 3] |= VC_EASC_FLUSH_CTRL_POLL_VALID;
1419         /* EAS update */
1420         break;
1421 
1422     case VC_EASC_FLUSH_INJECT:
1423         pnv_xive2_inject_notify(xive, PNV_XIVE2_CACHE_EASC);
1424         break;
1425 
1426     case VC_ENDC_CFG:
1427         break;
1428 
1429     /*
1430      * END cache updates
1431      */
1432     case VC_ENDC_WATCH0_SPEC:
1433     case VC_ENDC_WATCH1_SPEC:
1434     case VC_ENDC_WATCH2_SPEC:
1435     case VC_ENDC_WATCH3_SPEC:
1436          val &= ~VC_ENDC_WATCH_CONFLICT; /* HW will set this bit */
1437         break;
1438 
1439     case VC_ENDC_WATCH0_DATA1 ... VC_ENDC_WATCH0_DATA3:
1440     case VC_ENDC_WATCH1_DATA1 ... VC_ENDC_WATCH1_DATA3:
1441     case VC_ENDC_WATCH2_DATA1 ... VC_ENDC_WATCH2_DATA3:
1442     case VC_ENDC_WATCH3_DATA1 ... VC_ENDC_WATCH3_DATA3:
1443         break;
1444     case VC_ENDC_WATCH0_DATA0:
1445     case VC_ENDC_WATCH1_DATA0:
1446     case VC_ENDC_WATCH2_DATA0:
1447     case VC_ENDC_WATCH3_DATA0:
1448         /* writing to DATA0 triggers the cache write */
1449         watch_engine = (offset - VC_ENDC_WATCH0_DATA0) >> 6;
1450         xive->vc_regs[reg] = val;
1451         pnv_xive2_end_update(xive, watch_engine);
1452         break;
1453 
1454 
1455     /* case VC_ENDC_FLUSH_CTRL: */
1456     case VC_ENDC_FLUSH_POLL:
1457         xive->vc_regs[VC_ENDC_FLUSH_CTRL >> 3] |= VC_ENDC_FLUSH_CTRL_POLL_VALID;
1458         break;
1459 
1460     case VC_ENDC_FLUSH_INJECT:
1461         pnv_xive2_inject_notify(xive, PNV_XIVE2_CACHE_ENDC);
1462         break;
1463 
1464     /*
1465      * Indirect invalidation
1466      */
1467     case VC_AT_MACRO_KILL:
1468     case VC_AT_MACRO_KILL_MASK:
1469         break;
1470 
1471     /*
1472      * Interrupt fifo overflow in memory backing store (Not modeled)
1473      */
1474     case VC_QUEUES_CFG_REM0 ... VC_QUEUES_CFG_REM6:
1475         break;
1476 
1477     /*
1478      * Synchronisation
1479      */
1480     case VC_ENDC_SYNC_DONE:
1481         break;
1482 
1483     default:
1484         xive2_error(xive, "VC: invalid write @%"HWADDR_PRIx, offset);
1485         return;
1486     }
1487 
1488     xive->vc_regs[reg] = val;
1489 }
1490 
1491 static const MemoryRegionOps pnv_xive2_ic_vc_ops = {
1492     .read = pnv_xive2_ic_vc_read,
1493     .write = pnv_xive2_ic_vc_write,
1494     .endianness = DEVICE_BIG_ENDIAN,
1495     .valid = {
1496         .min_access_size = 8,
1497         .max_access_size = 8,
1498     },
1499     .impl = {
1500         .min_access_size = 8,
1501         .max_access_size = 8,
1502     },
1503 };
1504 
1505 static uint8_t pnv_xive2_nxc_cache_watch_assign(PnvXive2 *xive)
1506 {
1507     uint64_t engine_mask = GETFIELD(PC_NXC_PROC_CONFIG_WATCH_ASSIGN,
1508                                     xive->pc_regs[PC_NXC_PROC_CONFIG >> 3]);
1509     uint64_t state = xive->pc_regs[PC_NXC_WATCH_ASSIGN >> 3];
1510     uint8_t val;
1511 
1512     /*
1513      * We keep track of which engines are currently busy in the
1514      * PC_NXC_WATCH_ASSIGN register directly. When the firmware reads
1515      * the register, we don't return its value but the ID of an engine
1516      * it can use.
1517      * There are 4 engines. 0xFF means no engine is available.
1518      */
1519     val = pnv_xive2_cache_watch_assign(engine_mask, &state);
1520     if (val != 0xFF) {
1521         xive->pc_regs[PC_NXC_WATCH_ASSIGN >> 3] = state;
1522     }
1523     return val;
1524 }
1525 
1526 static void pnv_xive2_nxc_cache_watch_release(PnvXive2 *xive,
1527                                               uint8_t watch_engine)
1528 {
1529     uint64_t state = xive->pc_regs[PC_NXC_WATCH_ASSIGN >> 3];
1530 
1531     pnv_xive2_cache_watch_release(&state, watch_engine);
1532     xive->pc_regs[PC_NXC_WATCH_ASSIGN >> 3] = state;
1533 }
1534 
1535 static uint64_t pnv_xive2_ic_pc_read(void *opaque, hwaddr offset,
1536                                      unsigned size)
1537 {
1538     PnvXive2 *xive = PNV_XIVE2(opaque);
1539     uint64_t val = -1;
1540     uint32_t reg = offset >> 3;
1541     uint8_t watch_engine;
1542 
1543     switch (offset) {
1544     /*
1545      * VSD table settings.
1546      */
1547     case PC_VSD_TABLE_ADDR:
1548     case PC_VSD_TABLE_DATA:
1549         val = xive->pc_regs[reg];
1550         break;
1551 
1552     case PC_NXC_WATCH_ASSIGN:
1553         val = pnv_xive2_nxc_cache_watch_assign(xive);
1554         break;
1555 
1556     case PC_NXC_PROC_CONFIG:
1557         val = xive->pc_regs[reg];
1558         break;
1559 
1560     /*
1561      * cache updates
1562      */
1563     case PC_NXC_WATCH0_SPEC:
1564     case PC_NXC_WATCH1_SPEC:
1565     case PC_NXC_WATCH2_SPEC:
1566     case PC_NXC_WATCH3_SPEC:
1567         watch_engine = (offset - PC_NXC_WATCH0_SPEC) >> 6;
1568         xive->pc_regs[reg] &= ~(PC_NXC_WATCH_FULL | PC_NXC_WATCH_CONFLICT);
1569         pnv_xive2_nxc_cache_watch_release(xive, watch_engine);
1570         val = xive->pc_regs[reg];
1571         break;
1572 
1573     case PC_NXC_WATCH0_DATA0:
1574     case PC_NXC_WATCH1_DATA0:
1575     case PC_NXC_WATCH2_DATA0:
1576     case PC_NXC_WATCH3_DATA0:
1577        /*
1578         * Load DATA registers from cache with data requested by the
1579         * SPEC register
1580         */
1581         watch_engine = (offset - PC_NXC_WATCH0_DATA0) >> 6;
1582         pnv_xive2_nxc_cache_load(xive, watch_engine);
1583         val = xive->pc_regs[reg];
1584         break;
1585 
1586     case PC_NXC_WATCH0_DATA1 ... PC_NXC_WATCH0_DATA3:
1587     case PC_NXC_WATCH1_DATA1 ... PC_NXC_WATCH1_DATA3:
1588     case PC_NXC_WATCH2_DATA1 ... PC_NXC_WATCH2_DATA3:
1589     case PC_NXC_WATCH3_DATA1 ... PC_NXC_WATCH3_DATA3:
1590         val = xive->pc_regs[reg];
1591         break;
1592 
1593     case PC_NXC_FLUSH_CTRL:
1594         xive->pc_regs[reg] &= ~PC_NXC_FLUSH_CTRL_POLL_VALID;
1595         val = xive->pc_regs[reg];
1596         break;
1597 
1598     /*
1599      * Indirect invalidation
1600      */
1601     case PC_AT_KILL:
1602         xive->pc_regs[reg] &= ~PC_AT_KILL_VALID;
1603         val = xive->pc_regs[reg];
1604         break;
1605 
1606     default:
1607         xive2_error(xive, "PC: invalid read @%"HWADDR_PRIx, offset);
1608     }
1609 
1610     return val;
1611 }
1612 
1613 static void pnv_xive2_pc_vst_set_data(PnvXive2 *xive, uint64_t vsd)
1614 {
1615     uint8_t type = GETFIELD(PC_VSD_TABLE_SELECT,
1616                             xive->pc_regs[PC_VSD_TABLE_ADDR >> 3]);
1617     uint8_t blk = GETFIELD(PC_VSD_TABLE_ADDRESS,
1618                            xive->pc_regs[PC_VSD_TABLE_ADDR >> 3]);
1619 
1620     pnv_xive2_vst_set_data(xive, vsd, type, blk);
1621 }
1622 
1623 static void pnv_xive2_ic_pc_write(void *opaque, hwaddr offset,
1624                                   uint64_t val, unsigned size)
1625 {
1626     PnvXive2 *xive = PNV_XIVE2(opaque);
1627     uint32_t reg = offset >> 3;
1628     uint8_t watch_engine;
1629 
1630     switch (offset) {
1631 
1632     /*
1633      * VSD table settings.
1634      * The Xive2Router model combines both VC and PC sub-engines. We
1635      * allow to configure the tables through both, for the rare cases
1636      * where a table only really needs to be configured for one of
1637      * them (e.g. the NVG table for the presenter). It assumes that
1638      * firmware passes the same address to the VC and PC when tables
1639      * are defined for both, which seems acceptable.
1640      */
1641     case PC_VSD_TABLE_ADDR:
1642         break;
1643     case PC_VSD_TABLE_DATA:
1644         pnv_xive2_pc_vst_set_data(xive, val);
1645         break;
1646 
1647     case PC_NXC_PROC_CONFIG:
1648         break;
1649 
1650     /*
1651      * cache updates
1652      */
1653     case PC_NXC_WATCH0_SPEC:
1654     case PC_NXC_WATCH1_SPEC:
1655     case PC_NXC_WATCH2_SPEC:
1656     case PC_NXC_WATCH3_SPEC:
1657         val &= ~PC_NXC_WATCH_CONFLICT; /* HW will set this bit */
1658         break;
1659 
1660     case PC_NXC_WATCH0_DATA1 ... PC_NXC_WATCH0_DATA3:
1661     case PC_NXC_WATCH1_DATA1 ... PC_NXC_WATCH1_DATA3:
1662     case PC_NXC_WATCH2_DATA1 ... PC_NXC_WATCH2_DATA3:
1663     case PC_NXC_WATCH3_DATA1 ... PC_NXC_WATCH3_DATA3:
1664         break;
1665     case PC_NXC_WATCH0_DATA0:
1666     case PC_NXC_WATCH1_DATA0:
1667     case PC_NXC_WATCH2_DATA0:
1668     case PC_NXC_WATCH3_DATA0:
1669         /* writing to DATA0 triggers the cache write */
1670         watch_engine = (offset - PC_NXC_WATCH0_DATA0) >> 6;
1671         xive->pc_regs[reg] = val;
1672         pnv_xive2_nxc_update(xive, watch_engine);
1673         break;
1674 
1675    /* case PC_NXC_FLUSH_CTRL: */
1676     case PC_NXC_FLUSH_POLL:
1677         xive->pc_regs[PC_NXC_FLUSH_CTRL >> 3] |= PC_NXC_FLUSH_CTRL_POLL_VALID;
1678         break;
1679 
1680     case PC_NXC_FLUSH_INJECT:
1681         pnv_xive2_inject_notify(xive, PNV_XIVE2_CACHE_NXC);
1682         break;
1683 
1684     /*
1685      * Indirect invalidation
1686      */
1687     case PC_AT_KILL:
1688     case PC_AT_KILL_MASK:
1689         break;
1690 
1691     default:
1692         xive2_error(xive, "PC: invalid write @%"HWADDR_PRIx, offset);
1693         return;
1694     }
1695 
1696     xive->pc_regs[reg] = val;
1697 }
1698 
1699 static const MemoryRegionOps pnv_xive2_ic_pc_ops = {
1700     .read = pnv_xive2_ic_pc_read,
1701     .write = pnv_xive2_ic_pc_write,
1702     .endianness = DEVICE_BIG_ENDIAN,
1703     .valid = {
1704         .min_access_size = 8,
1705         .max_access_size = 8,
1706     },
1707     .impl = {
1708         .min_access_size = 8,
1709         .max_access_size = 8,
1710     },
1711 };
1712 
1713 
1714 static uint64_t pnv_xive2_ic_tctxt_read(void *opaque, hwaddr offset,
1715                                         unsigned size)
1716 {
1717     PnvXive2 *xive = PNV_XIVE2(opaque);
1718     uint64_t val = -1;
1719     uint32_t reg = offset >> 3;
1720 
1721     switch (offset) {
1722     /*
1723      * XIVE2 hardware thread enablement
1724      */
1725     case TCTXT_EN0:
1726     case TCTXT_EN1:
1727         val = xive->tctxt_regs[reg];
1728         break;
1729 
1730     case TCTXT_EN0_SET:
1731     case TCTXT_EN0_RESET:
1732         val = xive->tctxt_regs[TCTXT_EN0 >> 3];
1733         break;
1734     case TCTXT_EN1_SET:
1735     case TCTXT_EN1_RESET:
1736         val = xive->tctxt_regs[TCTXT_EN1 >> 3];
1737         break;
1738     case TCTXT_CFG:
1739         val = xive->tctxt_regs[reg];
1740         break;
1741     default:
1742         xive2_error(xive, "TCTXT: invalid read @%"HWADDR_PRIx, offset);
1743     }
1744 
1745     return val;
1746 }
1747 
1748 static void pnv_xive2_ic_tctxt_write(void *opaque, hwaddr offset,
1749                                      uint64_t val, unsigned size)
1750 {
1751     PnvXive2 *xive = PNV_XIVE2(opaque);
1752     uint32_t reg = offset >> 3;
1753 
1754     switch (offset) {
1755     /*
1756      * XIVE2 hardware thread enablement
1757      */
1758     case TCTXT_EN0: /* Physical Thread Enable */
1759     case TCTXT_EN1: /* Physical Thread Enable (fused core) */
1760         xive->tctxt_regs[reg] = val;
1761         break;
1762 
1763     case TCTXT_EN0_SET:
1764         xive->tctxt_regs[TCTXT_EN0 >> 3] |= val;
1765         break;
1766     case TCTXT_EN1_SET:
1767         xive->tctxt_regs[TCTXT_EN1 >> 3] |= val;
1768         break;
1769     case TCTXT_EN0_RESET:
1770         xive->tctxt_regs[TCTXT_EN0 >> 3] &= ~val;
1771         break;
1772     case TCTXT_EN1_RESET:
1773         xive->tctxt_regs[TCTXT_EN1 >> 3] &= ~val;
1774         break;
1775     case TCTXT_CFG:
1776         xive->tctxt_regs[reg] = val;
1777         break;
1778     default:
1779         xive2_error(xive, "TCTXT: invalid write @%"HWADDR_PRIx, offset);
1780         return;
1781     }
1782 }
1783 
1784 static const MemoryRegionOps pnv_xive2_ic_tctxt_ops = {
1785     .read = pnv_xive2_ic_tctxt_read,
1786     .write = pnv_xive2_ic_tctxt_write,
1787     .endianness = DEVICE_BIG_ENDIAN,
1788     .valid = {
1789         .min_access_size = 8,
1790         .max_access_size = 8,
1791     },
1792     .impl = {
1793         .min_access_size = 8,
1794         .max_access_size = 8,
1795     },
1796 };
1797 
1798 /*
1799  * Redirect XSCOM to MMIO handlers
1800  */
1801 static uint64_t pnv_xive2_xscom_read(void *opaque, hwaddr offset,
1802                                      unsigned size)
1803 {
1804     PnvXive2 *xive = PNV_XIVE2(opaque);
1805     uint64_t val = -1;
1806     uint32_t xscom_reg = offset >> 3;
1807     uint32_t mmio_offset = (xscom_reg & 0xFF) << 3;
1808 
1809     switch (xscom_reg) {
1810     case 0x000 ... 0x0FF:
1811         val = pnv_xive2_ic_cq_read(opaque, mmio_offset, size);
1812         break;
1813     case 0x100 ... 0x1FF:
1814         val = pnv_xive2_ic_vc_read(opaque, mmio_offset, size);
1815         break;
1816     case 0x200 ... 0x2FF:
1817         val = pnv_xive2_ic_pc_read(opaque, mmio_offset, size);
1818         break;
1819     case 0x300 ... 0x3FF:
1820         val = pnv_xive2_ic_tctxt_read(opaque, mmio_offset, size);
1821         break;
1822     default:
1823         xive2_error(xive, "XSCOM: invalid read @%"HWADDR_PRIx, offset);
1824     }
1825 
1826     return val;
1827 }
1828 
1829 static void pnv_xive2_xscom_write(void *opaque, hwaddr offset,
1830                                   uint64_t val, unsigned size)
1831 {
1832     PnvXive2 *xive = PNV_XIVE2(opaque);
1833     uint32_t xscom_reg = offset >> 3;
1834     uint32_t mmio_offset = (xscom_reg & 0xFF) << 3;
1835 
1836     switch (xscom_reg) {
1837     case 0x000 ... 0x0FF:
1838         pnv_xive2_ic_cq_write(opaque, mmio_offset, val, size);
1839         break;
1840     case 0x100 ... 0x1FF:
1841         pnv_xive2_ic_vc_write(opaque, mmio_offset, val, size);
1842         break;
1843     case 0x200 ... 0x2FF:
1844         pnv_xive2_ic_pc_write(opaque, mmio_offset, val, size);
1845         break;
1846     case 0x300 ... 0x3FF:
1847         pnv_xive2_ic_tctxt_write(opaque, mmio_offset, val, size);
1848         break;
1849     default:
1850         xive2_error(xive, "XSCOM: invalid write @%"HWADDR_PRIx, offset);
1851     }
1852 }
1853 
1854 static const MemoryRegionOps pnv_xive2_xscom_ops = {
1855     .read = pnv_xive2_xscom_read,
1856     .write = pnv_xive2_xscom_write,
1857     .endianness = DEVICE_BIG_ENDIAN,
1858     .valid = {
1859         .min_access_size = 8,
1860         .max_access_size = 8,
1861     },
1862     .impl = {
1863         .min_access_size = 8,
1864         .max_access_size = 8,
1865     },
1866 };
1867 
1868 /*
1869  * Notify port page. The layout is compatible between 4K and 64K pages :
1870  *
1871  * Page 1           Notify page (writes only)
1872  *  0x000 - 0x7FF   IPI interrupt (NPU)
1873  *  0x800 - 0xFFF   HW interrupt triggers (PSI, PHB)
1874  */
1875 
1876 static void pnv_xive2_ic_hw_trigger(PnvXive2 *xive, hwaddr addr,
1877                                     uint64_t val)
1878 {
1879     uint8_t blk;
1880     uint32_t idx;
1881 
1882     if (val & XIVE_TRIGGER_END) {
1883         xive2_error(xive, "IC: END trigger at @0x%"HWADDR_PRIx" data 0x%"PRIx64,
1884                    addr, val);
1885         return;
1886     }
1887 
1888     /*
1889      * Forward the source event notification directly to the Router.
1890      * The source interrupt number should already be correctly encoded
1891      * with the chip block id by the sending device (PHB, PSI).
1892      */
1893     blk = XIVE_EAS_BLOCK(val);
1894     idx = XIVE_EAS_INDEX(val);
1895 
1896     xive2_router_notify(XIVE_NOTIFIER(xive), XIVE_EAS(blk, idx),
1897                          !!(val & XIVE_TRIGGER_PQ));
1898 }
1899 
1900 static void pnv_xive2_ic_notify_write(void *opaque, hwaddr offset,
1901                                       uint64_t val, unsigned size)
1902 {
1903     PnvXive2 *xive = PNV_XIVE2(opaque);
1904 
1905     /* VC: IPI triggers */
1906     switch (offset) {
1907     case 0x000 ... 0x7FF:
1908         /* TODO: check IPI notify sub-page routing */
1909         pnv_xive2_ic_hw_trigger(opaque, offset, val);
1910         break;
1911 
1912     /* VC: HW triggers */
1913     case 0x800 ... 0xFFF:
1914         pnv_xive2_ic_hw_trigger(opaque, offset, val);
1915         break;
1916 
1917     default:
1918         xive2_error(xive, "NOTIFY: invalid write @%"HWADDR_PRIx, offset);
1919     }
1920 }
1921 
1922 static uint64_t pnv_xive2_ic_notify_read(void *opaque, hwaddr offset,
1923                                          unsigned size)
1924 {
1925     PnvXive2 *xive = PNV_XIVE2(opaque);
1926 
1927    /* loads are invalid */
1928     xive2_error(xive, "NOTIFY: invalid read @%"HWADDR_PRIx, offset);
1929     return -1;
1930 }
1931 
1932 static const MemoryRegionOps pnv_xive2_ic_notify_ops = {
1933     .read = pnv_xive2_ic_notify_read,
1934     .write = pnv_xive2_ic_notify_write,
1935     .endianness = DEVICE_BIG_ENDIAN,
1936     .valid = {
1937         .min_access_size = 8,
1938         .max_access_size = 8,
1939     },
1940     .impl = {
1941         .min_access_size = 8,
1942         .max_access_size = 8,
1943     },
1944 };
1945 
1946 static uint64_t pnv_xive2_ic_lsi_read(void *opaque, hwaddr offset,
1947                                       unsigned size)
1948 {
1949     PnvXive2 *xive = PNV_XIVE2(opaque);
1950 
1951     xive2_error(xive, "LSI: invalid read @%"HWADDR_PRIx, offset);
1952     return -1;
1953 }
1954 
1955 static void pnv_xive2_ic_lsi_write(void *opaque, hwaddr offset,
1956                                    uint64_t val, unsigned size)
1957 {
1958     PnvXive2 *xive = PNV_XIVE2(opaque);
1959 
1960     xive2_error(xive, "LSI: invalid write @%"HWADDR_PRIx, offset);
1961 }
1962 
1963 static const MemoryRegionOps pnv_xive2_ic_lsi_ops = {
1964     .read = pnv_xive2_ic_lsi_read,
1965     .write = pnv_xive2_ic_lsi_write,
1966     .endianness = DEVICE_BIG_ENDIAN,
1967     .valid = {
1968         .min_access_size = 8,
1969         .max_access_size = 8,
1970     },
1971     .impl = {
1972         .min_access_size = 8,
1973         .max_access_size = 8,
1974     },
1975 };
1976 
1977 /*
1978  * Sync MMIO page (write only)
1979  */
1980 #define PNV_XIVE2_SYNC_IPI              0x000
1981 #define PNV_XIVE2_SYNC_HW               0x080
1982 #define PNV_XIVE2_SYNC_NxC              0x100
1983 #define PNV_XIVE2_SYNC_INT              0x180
1984 #define PNV_XIVE2_SYNC_OS_ESC           0x200
1985 #define PNV_XIVE2_SYNC_POOL_ESC         0x280
1986 #define PNV_XIVE2_SYNC_HARD_ESC         0x300
1987 #define PNV_XIVE2_SYNC_NXC_LD_LCL_NCO   0x800
1988 #define PNV_XIVE2_SYNC_NXC_LD_LCL_CO    0x880
1989 #define PNV_XIVE2_SYNC_NXC_ST_LCL_NCI   0x900
1990 #define PNV_XIVE2_SYNC_NXC_ST_LCL_CI    0x980
1991 #define PNV_XIVE2_SYNC_NXC_ST_RMT_NCI   0xA00
1992 #define PNV_XIVE2_SYNC_NXC_ST_RMT_CI    0xA80
1993 
1994 static uint64_t pnv_xive2_ic_sync_read(void *opaque, hwaddr offset,
1995                                        unsigned size)
1996 {
1997     PnvXive2 *xive = PNV_XIVE2(opaque);
1998 
1999     /* loads are invalid */
2000     xive2_error(xive, "SYNC: invalid read @%"HWADDR_PRIx, offset);
2001     return -1;
2002 }
2003 
2004 /*
2005  * The sync MMIO space spans two pages.  The lower page is use for
2006  * queue sync "poll" requests while the upper page is used for queue
2007  * sync "inject" requests.  Inject requests require the HW to write
2008  * a byte of all 1's to a predetermined location in memory in order
2009  * to signal completion of the request.  Both pages have the same
2010  * layout, so it is easiest to handle both with a single function.
2011  */
2012 static void pnv_xive2_ic_sync_write(void *opaque, hwaddr offset,
2013                                     uint64_t val, unsigned size)
2014 {
2015     PnvXive2 *xive = PNV_XIVE2(opaque);
2016     int inject_type;
2017     hwaddr pg_offset_mask = (1ull << xive->ic_shift) - 1;
2018 
2019     /* adjust offset for inject page */
2020     hwaddr adj_offset = offset & pg_offset_mask;
2021 
2022     switch (adj_offset) {
2023     case PNV_XIVE2_SYNC_IPI:
2024         inject_type = PNV_XIVE2_QUEUE_IPI;
2025         break;
2026     case PNV_XIVE2_SYNC_HW:
2027         inject_type = PNV_XIVE2_QUEUE_HW;
2028         break;
2029     case PNV_XIVE2_SYNC_NxC:
2030         inject_type = PNV_XIVE2_QUEUE_NXC;
2031         break;
2032     case PNV_XIVE2_SYNC_INT:
2033         inject_type = PNV_XIVE2_QUEUE_INT;
2034         break;
2035     case PNV_XIVE2_SYNC_OS_ESC:
2036         inject_type = PNV_XIVE2_QUEUE_OS;
2037         break;
2038     case PNV_XIVE2_SYNC_POOL_ESC:
2039         inject_type = PNV_XIVE2_QUEUE_POOL;
2040         break;
2041     case PNV_XIVE2_SYNC_HARD_ESC:
2042         inject_type = PNV_XIVE2_QUEUE_HARD;
2043         break;
2044     case PNV_XIVE2_SYNC_NXC_LD_LCL_NCO:
2045         inject_type = PNV_XIVE2_QUEUE_NXC_LD_LCL_NCO;
2046         break;
2047     case PNV_XIVE2_SYNC_NXC_LD_LCL_CO:
2048         inject_type = PNV_XIVE2_QUEUE_NXC_LD_LCL_CO;
2049         break;
2050     case PNV_XIVE2_SYNC_NXC_ST_LCL_NCI:
2051         inject_type = PNV_XIVE2_QUEUE_NXC_ST_LCL_NCI;
2052         break;
2053     case PNV_XIVE2_SYNC_NXC_ST_LCL_CI:
2054         inject_type = PNV_XIVE2_QUEUE_NXC_ST_LCL_CI;
2055         break;
2056     case PNV_XIVE2_SYNC_NXC_ST_RMT_NCI:
2057         inject_type = PNV_XIVE2_QUEUE_NXC_ST_RMT_NCI;
2058         break;
2059     case PNV_XIVE2_SYNC_NXC_ST_RMT_CI:
2060         inject_type = PNV_XIVE2_QUEUE_NXC_ST_RMT_CI;
2061         break;
2062     default:
2063         xive2_error(xive, "SYNC: invalid write @%"HWADDR_PRIx, offset);
2064         return;
2065     }
2066 
2067     /* Write Queue Sync notification byte if writing to sync inject page */
2068     if ((offset & ~pg_offset_mask) != 0) {
2069         pnv_xive2_inject_notify(xive, inject_type);
2070     }
2071 }
2072 
2073 static const MemoryRegionOps pnv_xive2_ic_sync_ops = {
2074     .read = pnv_xive2_ic_sync_read,
2075     .write = pnv_xive2_ic_sync_write,
2076     .endianness = DEVICE_BIG_ENDIAN,
2077     .valid = {
2078         .min_access_size = 8,
2079         .max_access_size = 8,
2080     },
2081     .impl = {
2082         .min_access_size = 8,
2083         .max_access_size = 8,
2084     },
2085 };
2086 
2087 /*
2088  * When the TM direct pages of the IC controller are accessed, the
2089  * target HW thread is deduced from the page offset.
2090  */
2091 static uint32_t pnv_xive2_ic_tm_get_pir(PnvXive2 *xive, hwaddr offset)
2092 {
2093     /* On P10, the node ID shift in the PIR register is 8 bits */
2094     return xive->chip->chip_id << 8 | offset >> xive->ic_shift;
2095 }
2096 
2097 static uint32_t pnv_xive2_ic_tm_get_hw_page_offset(PnvXive2 *xive,
2098                                                    hwaddr offset)
2099 {
2100     /*
2101      * Indirect TIMA accesses are similar to direct accesses for
2102      * privilege ring 0. So remove any traces of the hw thread ID from
2103      * the offset in the IC BAR as it could be interpreted as the ring
2104      * privilege when calling the underlying direct access functions.
2105      */
2106     return offset & ((1ull << xive->ic_shift) - 1);
2107 }
2108 
2109 static XiveTCTX *pnv_xive2_get_indirect_tctx(PnvXive2 *xive, uint32_t pir)
2110 {
2111     PnvChip *chip = xive->chip;
2112     PowerPCCPU *cpu = NULL;
2113 
2114     cpu = pnv_chip_find_cpu(chip, pir);
2115     if (!cpu) {
2116         xive2_error(xive, "IC: invalid PIR %x for indirect access", pir);
2117         return NULL;
2118     }
2119 
2120     if (!pnv_xive2_is_cpu_enabled(xive, cpu)) {
2121         xive2_error(xive, "IC: CPU %x is not enabled", pir);
2122     }
2123 
2124     return XIVE_TCTX(pnv_cpu_state(cpu)->intc);
2125 }
2126 
2127 static uint64_t pnv_xive2_ic_tm_indirect_read(void *opaque, hwaddr offset,
2128                                               unsigned size)
2129 {
2130     PnvXive2 *xive = PNV_XIVE2(opaque);
2131     XivePresenter *xptr = XIVE_PRESENTER(xive);
2132     hwaddr hw_page_offset;
2133     uint32_t pir;
2134     XiveTCTX *tctx;
2135     uint64_t val = -1;
2136 
2137     pir = pnv_xive2_ic_tm_get_pir(xive, offset);
2138     hw_page_offset = pnv_xive2_ic_tm_get_hw_page_offset(xive, offset);
2139     tctx = pnv_xive2_get_indirect_tctx(xive, pir);
2140     if (tctx) {
2141         val = xive_tctx_tm_read(xptr, tctx, hw_page_offset, size);
2142     }
2143 
2144     return val;
2145 }
2146 
2147 static void pnv_xive2_ic_tm_indirect_write(void *opaque, hwaddr offset,
2148                                            uint64_t val, unsigned size)
2149 {
2150     PnvXive2 *xive = PNV_XIVE2(opaque);
2151     XivePresenter *xptr = XIVE_PRESENTER(xive);
2152     hwaddr hw_page_offset;
2153     uint32_t pir;
2154     XiveTCTX *tctx;
2155 
2156     pir = pnv_xive2_ic_tm_get_pir(xive, offset);
2157     hw_page_offset = pnv_xive2_ic_tm_get_hw_page_offset(xive, offset);
2158     tctx = pnv_xive2_get_indirect_tctx(xive, pir);
2159     if (tctx) {
2160         xive_tctx_tm_write(xptr, tctx, hw_page_offset, val, size);
2161     }
2162 }
2163 
2164 static const MemoryRegionOps pnv_xive2_ic_tm_indirect_ops = {
2165     .read = pnv_xive2_ic_tm_indirect_read,
2166     .write = pnv_xive2_ic_tm_indirect_write,
2167     .endianness = DEVICE_BIG_ENDIAN,
2168     .valid = {
2169         .min_access_size = 1,
2170         .max_access_size = 8,
2171     },
2172     .impl = {
2173         .min_access_size = 1,
2174         .max_access_size = 8,
2175     },
2176 };
2177 
2178 /*
2179  * TIMA ops
2180  */
2181 static void pnv_xive2_tm_write(void *opaque, hwaddr offset,
2182                                uint64_t value, unsigned size)
2183 {
2184     PowerPCCPU *cpu = POWERPC_CPU(current_cpu);
2185     PnvXive2 *xive = pnv_xive2_tm_get_xive(cpu);
2186     XiveTCTX *tctx = XIVE_TCTX(pnv_cpu_state(cpu)->intc);
2187     XivePresenter *xptr = XIVE_PRESENTER(xive);
2188 
2189     xive_tctx_tm_write(xptr, tctx, offset, value, size);
2190 }
2191 
2192 static uint64_t pnv_xive2_tm_read(void *opaque, hwaddr offset, unsigned size)
2193 {
2194     PowerPCCPU *cpu = POWERPC_CPU(current_cpu);
2195     PnvXive2 *xive = pnv_xive2_tm_get_xive(cpu);
2196     XiveTCTX *tctx = XIVE_TCTX(pnv_cpu_state(cpu)->intc);
2197     XivePresenter *xptr = XIVE_PRESENTER(xive);
2198 
2199     return xive_tctx_tm_read(xptr, tctx, offset, size);
2200 }
2201 
2202 static const MemoryRegionOps pnv_xive2_tm_ops = {
2203     .read = pnv_xive2_tm_read,
2204     .write = pnv_xive2_tm_write,
2205     .endianness = DEVICE_BIG_ENDIAN,
2206     .valid = {
2207         .min_access_size = 1,
2208         .max_access_size = 8,
2209     },
2210     .impl = {
2211         .min_access_size = 1,
2212         .max_access_size = 8,
2213     },
2214 };
2215 
2216 static uint64_t pnv_xive2_nvc_read(void *opaque, hwaddr addr,
2217                                    unsigned size)
2218 {
2219     PnvXive2 *xive = PNV_XIVE2(opaque);
2220     XivePresenter *xptr = XIVE_PRESENTER(xive);
2221     uint32_t page = addr >> xive->nvpg_shift;
2222     uint16_t op = addr & 0xFFF;
2223     uint8_t blk = pnv_xive2_block_id(xive);
2224 
2225     if (size != 2) {
2226         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid nvc load size %d\n",
2227                       size);
2228         return -1;
2229     }
2230 
2231     return xive2_presenter_nvgc_backlog_op(xptr, true, blk, page, op, 1);
2232 }
2233 
2234 static void pnv_xive2_nvc_write(void *opaque, hwaddr addr,
2235                                 uint64_t val, unsigned size)
2236 {
2237     PnvXive2 *xive = PNV_XIVE2(opaque);
2238     XivePresenter *xptr = XIVE_PRESENTER(xive);
2239     uint32_t page = addr >> xive->nvc_shift;
2240     uint16_t op = addr & 0xFFF;
2241     uint8_t blk = pnv_xive2_block_id(xive);
2242 
2243     if (size != 1) {
2244         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid nvc write size %d\n",
2245                       size);
2246         return;
2247     }
2248 
2249     (void)xive2_presenter_nvgc_backlog_op(xptr, true, blk, page, op, val);
2250 }
2251 
2252 static const MemoryRegionOps pnv_xive2_nvc_ops = {
2253     .read = pnv_xive2_nvc_read,
2254     .write = pnv_xive2_nvc_write,
2255     .endianness = DEVICE_BIG_ENDIAN,
2256     .valid = {
2257         .min_access_size = 1,
2258         .max_access_size = 8,
2259     },
2260     .impl = {
2261         .min_access_size = 1,
2262         .max_access_size = 8,
2263     },
2264 };
2265 
2266 static uint64_t pnv_xive2_nvpg_read(void *opaque, hwaddr addr,
2267                                     unsigned size)
2268 {
2269     PnvXive2 *xive = PNV_XIVE2(opaque);
2270     XivePresenter *xptr = XIVE_PRESENTER(xive);
2271     uint32_t page = addr >> xive->nvpg_shift;
2272     uint16_t op = addr & 0xFFF;
2273     uint32_t index = page >> 1;
2274     uint8_t blk = pnv_xive2_block_id(xive);
2275 
2276     if (size != 2) {
2277         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid nvpg load size %d\n",
2278                       size);
2279         return -1;
2280     }
2281 
2282     if (page % 2) {
2283         /* odd page - NVG */
2284         return xive2_presenter_nvgc_backlog_op(xptr, false, blk, index, op, 1);
2285     } else {
2286         /* even page - NVP */
2287         return xive2_presenter_nvp_backlog_op(xptr, blk, index, op);
2288     }
2289 }
2290 
2291 static void pnv_xive2_nvpg_write(void *opaque, hwaddr addr,
2292                                  uint64_t val, unsigned size)
2293 {
2294     PnvXive2 *xive = PNV_XIVE2(opaque);
2295     XivePresenter *xptr = XIVE_PRESENTER(xive);
2296     uint32_t page = addr >> xive->nvpg_shift;
2297     uint16_t op = addr & 0xFFF;
2298     uint32_t index = page >> 1;
2299     uint8_t blk = pnv_xive2_block_id(xive);
2300 
2301     if (size != 1) {
2302         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid nvpg write size %d\n",
2303                       size);
2304         return;
2305     }
2306 
2307     if (page % 2) {
2308         /* odd page - NVG */
2309         (void)xive2_presenter_nvgc_backlog_op(xptr, false, blk, index, op, val);
2310     } else {
2311         /* even page - NVP */
2312         (void)xive2_presenter_nvp_backlog_op(xptr, blk, index, op);
2313     }
2314 }
2315 
2316 static const MemoryRegionOps pnv_xive2_nvpg_ops = {
2317     .read = pnv_xive2_nvpg_read,
2318     .write = pnv_xive2_nvpg_write,
2319     .endianness = DEVICE_BIG_ENDIAN,
2320     .valid = {
2321         .min_access_size = 1,
2322         .max_access_size = 8,
2323     },
2324     .impl = {
2325         .min_access_size = 1,
2326         .max_access_size = 8,
2327     },
2328 };
2329 
2330 /*
2331  * POWER10 default capabilities: 0x2000120076f000FC
2332  */
2333 #define PNV_XIVE2_CAPABILITIES  0x2000120076f000FC
2334 
2335 /*
2336  * POWER10 default configuration: 0x0030000033000000
2337  *
2338  * 8bits thread id was dropped for P10
2339  */
2340 #define PNV_XIVE2_CONFIGURATION 0x0030000033000000
2341 
2342 static void pnv_xive2_reset(void *dev)
2343 {
2344     PnvXive2 *xive = PNV_XIVE2(dev);
2345     XiveSource *xsrc = &xive->ipi_source;
2346     Xive2EndSource *end_xsrc = &xive->end_source;
2347 
2348     xive->cq_regs[CQ_XIVE_CAP >> 3] = xive->capabilities;
2349     xive->cq_regs[CQ_XIVE_CFG >> 3] = xive->config;
2350 
2351     /* HW hardwires the #Topology of the chip in the block field */
2352     xive->cq_regs[CQ_XIVE_CFG >> 3] |=
2353         SETFIELD(CQ_XIVE_CFG_HYP_HARD_BLOCK_ID, 0ull, xive->chip->chip_id);
2354 
2355     /* VC and PC cache watch assign mechanism */
2356     xive->vc_regs[VC_ENDC_CFG >> 3] =
2357         SETFIELD(VC_ENDC_CFG_CACHE_WATCH_ASSIGN, 0ull, 0b0111);
2358     xive->pc_regs[PC_NXC_PROC_CONFIG >> 3] =
2359         SETFIELD(PC_NXC_PROC_CONFIG_WATCH_ASSIGN, 0ull, 0b0111);
2360 
2361     /* Set default page size to 64k */
2362     xive->ic_shift = xive->esb_shift = xive->end_shift = 16;
2363     xive->nvc_shift = xive->nvpg_shift = xive->tm_shift = 16;
2364 
2365     /* Clear source MMIOs */
2366     if (memory_region_is_mapped(&xsrc->esb_mmio)) {
2367         memory_region_del_subregion(&xive->esb_mmio, &xsrc->esb_mmio);
2368     }
2369 
2370     if (memory_region_is_mapped(&end_xsrc->esb_mmio)) {
2371         memory_region_del_subregion(&xive->end_mmio, &end_xsrc->esb_mmio);
2372     }
2373 }
2374 
2375 /*
2376  *  Maximum number of IRQs and ENDs supported by HW. Will be tuned by
2377  *  software.
2378  */
2379 #define PNV_XIVE2_NR_IRQS (PNV10_XIVE2_ESB_SIZE / (1ull << XIVE_ESB_64K_2PAGE))
2380 #define PNV_XIVE2_NR_ENDS (PNV10_XIVE2_END_SIZE / (1ull << XIVE_ESB_64K_2PAGE))
2381 
2382 static void pnv_xive2_realize(DeviceState *dev, Error **errp)
2383 {
2384     PnvXive2 *xive = PNV_XIVE2(dev);
2385     PnvXive2Class *pxc = PNV_XIVE2_GET_CLASS(dev);
2386     XiveSource *xsrc = &xive->ipi_source;
2387     Xive2EndSource *end_xsrc = &xive->end_source;
2388     Error *local_err = NULL;
2389     int i;
2390 
2391     pxc->parent_realize(dev, &local_err);
2392     if (local_err) {
2393         error_propagate(errp, local_err);
2394         return;
2395     }
2396 
2397     assert(xive->chip);
2398 
2399     /*
2400      * The XiveSource and Xive2EndSource objects are realized with the
2401      * maximum allowed HW configuration. The ESB MMIO regions will be
2402      * resized dynamically when the controller is configured by the FW
2403      * to limit accesses to resources not provisioned.
2404      */
2405     object_property_set_int(OBJECT(xsrc), "flags", XIVE_SRC_STORE_EOI,
2406                             &error_fatal);
2407     object_property_set_int(OBJECT(xsrc), "nr-irqs", PNV_XIVE2_NR_IRQS,
2408                             &error_fatal);
2409     object_property_set_link(OBJECT(xsrc), "xive", OBJECT(xive),
2410                              &error_fatal);
2411     qdev_realize(DEVICE(xsrc), NULL, &local_err);
2412     if (local_err) {
2413         error_propagate(errp, local_err);
2414         return;
2415     }
2416 
2417     object_property_set_int(OBJECT(end_xsrc), "nr-ends", PNV_XIVE2_NR_ENDS,
2418                             &error_fatal);
2419     object_property_set_link(OBJECT(end_xsrc), "xive", OBJECT(xive),
2420                              &error_abort);
2421     qdev_realize(DEVICE(end_xsrc), NULL, &local_err);
2422     if (local_err) {
2423         error_propagate(errp, local_err);
2424         return;
2425     }
2426 
2427     /* XSCOM region, used for initial configuration of the BARs */
2428     memory_region_init_io(&xive->xscom_regs, OBJECT(dev),
2429                           &pnv_xive2_xscom_ops, xive, "xscom-xive",
2430                           PNV10_XSCOM_XIVE2_SIZE << 3);
2431 
2432     /* Interrupt controller MMIO regions */
2433     xive->ic_shift = 16;
2434     memory_region_init(&xive->ic_mmio, OBJECT(dev), "xive-ic",
2435                        PNV10_XIVE2_IC_SIZE);
2436 
2437     for (i = 0; i < ARRAY_SIZE(xive->ic_mmios); i++) {
2438         memory_region_init_io(&xive->ic_mmios[i], OBJECT(dev),
2439                          pnv_xive2_ic_regions[i].ops, xive,
2440                          pnv_xive2_ic_regions[i].name,
2441                          pnv_xive2_ic_regions[i].pgsize << xive->ic_shift);
2442     }
2443 
2444     /*
2445      * VC MMIO regions.
2446      */
2447     xive->esb_shift = 16;
2448     xive->end_shift = 16;
2449     memory_region_init(&xive->esb_mmio, OBJECT(xive), "xive-esb",
2450                        PNV10_XIVE2_ESB_SIZE);
2451     memory_region_init(&xive->end_mmio, OBJECT(xive), "xive-end",
2452                        PNV10_XIVE2_END_SIZE);
2453 
2454     /* Presenter Controller MMIO region (not modeled) */
2455     xive->nvc_shift = 16;
2456     xive->nvpg_shift = 16;
2457     memory_region_init_io(&xive->nvc_mmio, OBJECT(dev),
2458                           &pnv_xive2_nvc_ops, xive,
2459                           "xive-nvc", PNV10_XIVE2_NVC_SIZE);
2460 
2461     memory_region_init_io(&xive->nvpg_mmio, OBJECT(dev),
2462                           &pnv_xive2_nvpg_ops, xive,
2463                           "xive-nvpg", PNV10_XIVE2_NVPG_SIZE);
2464 
2465     /* Thread Interrupt Management Area (Direct) */
2466     xive->tm_shift = 16;
2467     memory_region_init_io(&xive->tm_mmio, OBJECT(dev), &pnv_xive2_tm_ops,
2468                           xive, "xive-tima", PNV10_XIVE2_TM_SIZE);
2469 
2470     qemu_register_reset(pnv_xive2_reset, dev);
2471 }
2472 
2473 static const Property pnv_xive2_properties[] = {
2474     DEFINE_PROP_UINT64("ic-bar", PnvXive2, ic_base, 0),
2475     DEFINE_PROP_UINT64("esb-bar", PnvXive2, esb_base, 0),
2476     DEFINE_PROP_UINT64("end-bar", PnvXive2, end_base, 0),
2477     DEFINE_PROP_UINT64("nvc-bar", PnvXive2, nvc_base, 0),
2478     DEFINE_PROP_UINT64("nvpg-bar", PnvXive2, nvpg_base, 0),
2479     DEFINE_PROP_UINT64("tm-bar", PnvXive2, tm_base, 0),
2480     DEFINE_PROP_UINT64("capabilities", PnvXive2, capabilities,
2481                        PNV_XIVE2_CAPABILITIES),
2482     DEFINE_PROP_UINT64("config", PnvXive2, config,
2483                        PNV_XIVE2_CONFIGURATION),
2484     DEFINE_PROP_LINK("chip", PnvXive2, chip, TYPE_PNV_CHIP, PnvChip *),
2485 };
2486 
2487 static void pnv_xive2_instance_init(Object *obj)
2488 {
2489     PnvXive2 *xive = PNV_XIVE2(obj);
2490 
2491     object_initialize_child(obj, "ipi_source", &xive->ipi_source,
2492                             TYPE_XIVE_SOURCE);
2493     object_initialize_child(obj, "end_source", &xive->end_source,
2494                             TYPE_XIVE2_END_SOURCE);
2495 }
2496 
2497 static int pnv_xive2_dt_xscom(PnvXScomInterface *dev, void *fdt,
2498                               int xscom_offset)
2499 {
2500     const char compat_p10[] = "ibm,power10-xive-x";
2501     char *name;
2502     int offset;
2503     uint32_t reg[] = {
2504         cpu_to_be32(PNV10_XSCOM_XIVE2_BASE),
2505         cpu_to_be32(PNV10_XSCOM_XIVE2_SIZE)
2506     };
2507 
2508     name = g_strdup_printf("xive@%x", PNV10_XSCOM_XIVE2_BASE);
2509     offset = fdt_add_subnode(fdt, xscom_offset, name);
2510     _FDT(offset);
2511     g_free(name);
2512 
2513     _FDT((fdt_setprop(fdt, offset, "reg", reg, sizeof(reg))));
2514     _FDT(fdt_setprop(fdt, offset, "compatible", compat_p10,
2515                      sizeof(compat_p10)));
2516     return 0;
2517 }
2518 
2519 static void pnv_xive2_class_init(ObjectClass *klass, const void *data)
2520 {
2521     DeviceClass *dc = DEVICE_CLASS(klass);
2522     PnvXScomInterfaceClass *xdc = PNV_XSCOM_INTERFACE_CLASS(klass);
2523     Xive2RouterClass *xrc = XIVE2_ROUTER_CLASS(klass);
2524     XiveNotifierClass *xnc = XIVE_NOTIFIER_CLASS(klass);
2525     XivePresenterClass *xpc = XIVE_PRESENTER_CLASS(klass);
2526     PnvXive2Class *pxc = PNV_XIVE2_CLASS(klass);
2527 
2528     xdc->dt_xscom  = pnv_xive2_dt_xscom;
2529 
2530     dc->desc       = "PowerNV XIVE2 Interrupt Controller (POWER10)";
2531     device_class_set_parent_realize(dc, pnv_xive2_realize,
2532                                     &pxc->parent_realize);
2533     device_class_set_props(dc, pnv_xive2_properties);
2534 
2535     xrc->get_eas   = pnv_xive2_get_eas;
2536     xrc->get_pq    = pnv_xive2_get_pq;
2537     xrc->set_pq    = pnv_xive2_set_pq;
2538     xrc->get_end   = pnv_xive2_get_end;
2539     xrc->write_end = pnv_xive2_write_end;
2540     xrc->get_nvp   = pnv_xive2_get_nvp;
2541     xrc->write_nvp = pnv_xive2_write_nvp;
2542     xrc->get_nvgc   = pnv_xive2_get_nvgc;
2543     xrc->write_nvgc = pnv_xive2_write_nvgc;
2544     xrc->get_config  = pnv_xive2_get_config;
2545     xrc->get_block_id = pnv_xive2_get_block_id;
2546 
2547     xnc->notify    = pnv_xive2_notify;
2548 
2549     xpc->match_nvt  = pnv_xive2_match_nvt;
2550     xpc->get_config = pnv_xive2_presenter_get_config;
2551     xpc->broadcast  = pnv_xive2_broadcast;
2552 };
2553 
2554 static const TypeInfo pnv_xive2_info = {
2555     .name          = TYPE_PNV_XIVE2,
2556     .parent        = TYPE_XIVE2_ROUTER,
2557     .instance_init = pnv_xive2_instance_init,
2558     .instance_size = sizeof(PnvXive2),
2559     .class_init    = pnv_xive2_class_init,
2560     .class_size    = sizeof(PnvXive2Class),
2561     .interfaces    = (const InterfaceInfo[]) {
2562         { TYPE_PNV_XSCOM_INTERFACE },
2563         { }
2564     }
2565 };
2566 
2567 static void pnv_xive2_register_types(void)
2568 {
2569     type_register_static(&pnv_xive2_info);
2570 }
2571 
2572 type_init(pnv_xive2_register_types)
2573 
2574 /*
2575  * If the table is direct, we can compute the number of PQ entries
2576  * provisioned by FW.
2577  */
2578 static uint32_t pnv_xive2_nr_esbs(PnvXive2 *xive)
2579 {
2580     uint8_t blk = pnv_xive2_block_id(xive);
2581     uint64_t vsd = xive->vsds[VST_ESB][blk];
2582     uint64_t vst_tsize = 1ull << (GETFIELD(VSD_TSIZE, vsd) + 12);
2583 
2584     return VSD_INDIRECT & vsd ? 0 : vst_tsize * SBE_PER_BYTE;
2585 }
2586 
2587 /*
2588  * Compute the number of entries per indirect subpage.
2589  */
2590 static uint64_t pnv_xive2_vst_per_subpage(PnvXive2 *xive, uint32_t type)
2591 {
2592     uint8_t blk = pnv_xive2_block_id(xive);
2593     uint64_t vsd = xive->vsds[type][blk];
2594     const XiveVstInfo *info = &vst_infos[type];
2595     uint64_t vsd_addr;
2596     uint32_t page_shift;
2597 
2598     /* For direct tables, fake a valid value */
2599     if (!(VSD_INDIRECT & vsd)) {
2600         return 1;
2601     }
2602 
2603     /* Get the page size of the indirect table. */
2604     vsd_addr = vsd & VSD_ADDRESS_MASK;
2605     ldq_be_dma(&address_space_memory, vsd_addr, &vsd, MEMTXATTRS_UNSPECIFIED);
2606 
2607     if (!(vsd & VSD_ADDRESS_MASK)) {
2608 #ifdef XIVE2_DEBUG
2609         xive2_error(xive, "VST: invalid %s entry!?", info->name);
2610 #endif
2611         return 0;
2612     }
2613 
2614     page_shift = GETFIELD(VSD_TSIZE, vsd) + 12;
2615 
2616     if (!pnv_xive2_vst_page_size_allowed(page_shift)) {
2617         xive2_error(xive, "VST: invalid %s page shift %d", info->name,
2618                    page_shift);
2619         return 0;
2620     }
2621 
2622     return (1ull << page_shift) / info->size;
2623 }
2624 
2625 void pnv_xive2_pic_print_info(PnvXive2 *xive, GString *buf)
2626 {
2627     Xive2Router *xrtr = XIVE2_ROUTER(xive);
2628     uint8_t blk = pnv_xive2_block_id(xive);
2629     uint8_t chip_id = xive->chip->chip_id;
2630     uint32_t srcno0 = XIVE_EAS(blk, 0);
2631     uint32_t nr_esbs = pnv_xive2_nr_esbs(xive);
2632     Xive2Eas eas;
2633     Xive2End end;
2634     Xive2Nvp nvp;
2635     Xive2Nvgc nvgc;
2636     int i;
2637     uint64_t entries_per_subpage;
2638 
2639     g_string_append_printf(buf, "XIVE[%x] Source %08x .. %08x\n",
2640                            blk, srcno0, srcno0 + nr_esbs - 1);
2641     xive_source_pic_print_info(&xive->ipi_source, srcno0, buf);
2642 
2643     g_string_append_printf(buf, "XIVE[%x] EAT %08x .. %08x\n",
2644                            blk, srcno0, srcno0 + nr_esbs - 1);
2645     for (i = 0; i < nr_esbs; i++) {
2646         if (xive2_router_get_eas(xrtr, blk, i, &eas)) {
2647             break;
2648         }
2649         if (!xive2_eas_is_masked(&eas)) {
2650             xive2_eas_pic_print_info(&eas, i, buf);
2651         }
2652     }
2653 
2654     g_string_append_printf(buf, "XIVE[%x] #%d END Escalation EAT\n",
2655                            chip_id, blk);
2656     i = 0;
2657     while (!xive2_router_get_end(xrtr, blk, i, &end)) {
2658         xive2_end_eas_pic_print_info(&end, i++, buf);
2659     }
2660 
2661     g_string_append_printf(buf, "XIVE[%x] #%d ENDT\n", chip_id, blk);
2662     i = 0;
2663     while (!xive2_router_get_end(xrtr, blk, i, &end)) {
2664         xive2_end_pic_print_info(&end, i++, buf);
2665     }
2666 
2667     g_string_append_printf(buf, "XIVE[%x] #%d NVPT %08x .. %08x\n",
2668                            chip_id, blk, 0, XIVE2_NVP_COUNT - 1);
2669     entries_per_subpage = pnv_xive2_vst_per_subpage(xive, VST_NVP);
2670     for (i = 0; i < XIVE2_NVP_COUNT; i += entries_per_subpage) {
2671         while (!xive2_router_get_nvp(xrtr, blk, i, &nvp)) {
2672             xive2_nvp_pic_print_info(&nvp, i++, buf);
2673         }
2674     }
2675 
2676     g_string_append_printf(buf, "XIVE[%x] #%d NVGT %08x .. %08x\n",
2677                            chip_id, blk, 0, XIVE2_NVP_COUNT - 1);
2678     entries_per_subpage = pnv_xive2_vst_per_subpage(xive, VST_NVG);
2679     for (i = 0; i < XIVE2_NVP_COUNT; i += entries_per_subpage) {
2680         while (!xive2_router_get_nvgc(xrtr, false, blk, i, &nvgc)) {
2681             xive2_nvgc_pic_print_info(&nvgc, i++, buf);
2682         }
2683     }
2684 
2685     g_string_append_printf(buf, "XIVE[%x] #%d NVCT %08x .. %08x\n",
2686                           chip_id, blk, 0, XIVE2_NVP_COUNT - 1);
2687     entries_per_subpage = pnv_xive2_vst_per_subpage(xive, VST_NVC);
2688     for (i = 0; i < XIVE2_NVP_COUNT; i += entries_per_subpage) {
2689         while (!xive2_router_get_nvgc(xrtr, true, blk, i, &nvgc)) {
2690             xive2_nvgc_pic_print_info(&nvgc, i++, buf);
2691         }
2692     }
2693 }
2694