xref: /openbmc/qemu/hw/intc/pnv_xive2.c (revision 64770efd668e61128f30d6d50861c7a85ba12ec5)
1 /*
2  * QEMU PowerPC XIVE2 interrupt controller model  (POWER10)
3  *
4  * Copyright (c) 2019-2022, IBM Corporation.
5  *
6  * This code is licensed under the GPL version 2 or later. See the
7  * COPYING file in the top-level directory.
8  */
9 
10 #include "qemu/osdep.h"
11 #include "qemu/log.h"
12 #include "qapi/error.h"
13 #include "target/ppc/cpu.h"
14 #include "sysemu/cpus.h"
15 #include "sysemu/dma.h"
16 #include "hw/ppc/fdt.h"
17 #include "hw/ppc/pnv.h"
18 #include "hw/ppc/pnv_chip.h"
19 #include "hw/ppc/pnv_core.h"
20 #include "hw/ppc/pnv_xscom.h"
21 #include "hw/ppc/xive2.h"
22 #include "hw/ppc/pnv_xive.h"
23 #include "hw/ppc/xive_regs.h"
24 #include "hw/ppc/xive2_regs.h"
25 #include "hw/ppc/ppc.h"
26 #include "hw/qdev-properties.h"
27 #include "sysemu/reset.h"
28 
29 #include <libfdt.h>
30 
31 #include "pnv_xive2_regs.h"
32 
33 #undef XIVE2_DEBUG
34 
35 /*
36  * Virtual structures table (VST)
37  */
38 #define SBE_PER_BYTE   4
39 
40 typedef struct XiveVstInfo {
41     const char *name;
42     uint32_t    size;
43     uint32_t    max_blocks;
44 } XiveVstInfo;
45 
46 static const XiveVstInfo vst_infos[] = {
47 
48     [VST_EAS]  = { "EAT",  sizeof(Xive2Eas),     16 },
49     [VST_ESB]  = { "ESB",  1,                    16 },
50     [VST_END]  = { "ENDT", sizeof(Xive2End),     16 },
51 
52     [VST_NVP]  = { "NVPT", sizeof(Xive2Nvp),     16 },
53     [VST_NVG]  = { "NVGT", sizeof(Xive2Nvgc),    16 },
54     [VST_NVC]  = { "NVCT", sizeof(Xive2Nvgc),    16 },
55 
56     [VST_IC]  =  { "IC",   1, /* ? */            16 }, /* Topology # */
57     [VST_SYNC] = { "SYNC", 1, /* ? */            16 }, /* Topology # */
58 
59     /*
60      * This table contains the backing store pages for the interrupt
61      * fifos of the VC sub-engine in case of overflow.
62      *
63      * 0 - IPI,
64      * 1 - HWD,
65      * 2 - NxC,
66      * 3 - INT,
67      * 4 - OS-Queue,
68      * 5 - Pool-Queue,
69      * 6 - Hard-Queue
70      */
71     [VST_ERQ]  = { "ERQ",  1,                   VC_QUEUE_COUNT },
72 };
73 
74 #define xive2_error(xive, fmt, ...)                                      \
75     qemu_log_mask(LOG_GUEST_ERROR, "XIVE[%x] - " fmt "\n",              \
76                   (xive)->chip->chip_id, ## __VA_ARGS__);
77 
78 /*
79  * TODO: Document block id override
80  */
81 static uint32_t pnv_xive2_block_id(PnvXive2 *xive)
82 {
83     uint8_t blk = xive->chip->chip_id;
84     uint64_t cfg_val = xive->cq_regs[CQ_XIVE_CFG >> 3];
85 
86     if (cfg_val & CQ_XIVE_CFG_HYP_HARD_BLKID_OVERRIDE) {
87         blk = GETFIELD(CQ_XIVE_CFG_HYP_HARD_BLOCK_ID, cfg_val);
88     }
89 
90     return blk;
91 }
92 
93 /*
94  * Remote access to controllers. HW uses MMIOs. For now, a simple scan
95  * of the chips is good enough.
96  *
97  * TODO: Block scope support
98  */
99 static PnvXive2 *pnv_xive2_get_remote(uint8_t blk)
100 {
101     PnvMachineState *pnv = PNV_MACHINE(qdev_get_machine());
102     int i;
103 
104     for (i = 0; i < pnv->num_chips; i++) {
105         Pnv10Chip *chip10 = PNV10_CHIP(pnv->chips[i]);
106         PnvXive2 *xive = &chip10->xive;
107 
108         if (pnv_xive2_block_id(xive) == blk) {
109             return xive;
110         }
111     }
112     return NULL;
113 }
114 
115 /*
116  * VST accessors for ESB, EAT, ENDT, NVP
117  *
118  * Indirect VST tables are arrays of VSDs pointing to a page (of same
119  * size). Each page is a direct VST table.
120  */
121 
122 #define XIVE_VSD_SIZE 8
123 
124 /* Indirect page size can be 4K, 64K, 2M, 16M. */
125 static uint64_t pnv_xive2_vst_page_size_allowed(uint32_t page_shift)
126 {
127      return page_shift == 12 || page_shift == 16 ||
128          page_shift == 21 || page_shift == 24;
129 }
130 
131 static uint64_t pnv_xive2_vst_addr_direct(PnvXive2 *xive, uint32_t type,
132                                           uint64_t vsd, uint32_t idx)
133 {
134     const XiveVstInfo *info = &vst_infos[type];
135     uint64_t vst_addr = vsd & VSD_ADDRESS_MASK;
136     uint64_t vst_tsize = 1ull << (GETFIELD(VSD_TSIZE, vsd) + 12);
137     uint32_t idx_max;
138 
139     idx_max = vst_tsize / info->size - 1;
140     if (idx > idx_max) {
141 #ifdef XIVE2_DEBUG
142         xive2_error(xive, "VST: %s entry %x out of range [ 0 .. %x ] !?",
143                    info->name, idx, idx_max);
144 #endif
145         return 0;
146     }
147 
148     return vst_addr + idx * info->size;
149 }
150 
151 static uint64_t pnv_xive2_vst_addr_indirect(PnvXive2 *xive, uint32_t type,
152                                             uint64_t vsd, uint32_t idx)
153 {
154     const XiveVstInfo *info = &vst_infos[type];
155     uint64_t vsd_addr;
156     uint32_t vsd_idx;
157     uint32_t page_shift;
158     uint32_t vst_per_page;
159 
160     /* Get the page size of the indirect table. */
161     vsd_addr = vsd & VSD_ADDRESS_MASK;
162     ldq_be_dma(&address_space_memory, vsd_addr, &vsd, MEMTXATTRS_UNSPECIFIED);
163 
164     if (!(vsd & VSD_ADDRESS_MASK)) {
165 #ifdef XIVE2_DEBUG
166         xive2_error(xive, "VST: invalid %s entry %x !?", info->name, idx);
167 #endif
168         return 0;
169     }
170 
171     page_shift = GETFIELD(VSD_TSIZE, vsd) + 12;
172 
173     if (!pnv_xive2_vst_page_size_allowed(page_shift)) {
174         xive2_error(xive, "VST: invalid %s page shift %d", info->name,
175                    page_shift);
176         return 0;
177     }
178 
179     vst_per_page = (1ull << page_shift) / info->size;
180     vsd_idx = idx / vst_per_page;
181 
182     /* Load the VSD we are looking for, if not already done */
183     if (vsd_idx) {
184         vsd_addr = vsd_addr + vsd_idx * XIVE_VSD_SIZE;
185         ldq_be_dma(&address_space_memory, vsd_addr, &vsd,
186                    MEMTXATTRS_UNSPECIFIED);
187 
188         if (!(vsd & VSD_ADDRESS_MASK)) {
189 #ifdef XIVE2_DEBUG
190             xive2_error(xive, "VST: invalid %s entry %x !?", info->name, idx);
191 #endif
192             return 0;
193         }
194 
195         /*
196          * Check that the pages have a consistent size across the
197          * indirect table
198          */
199         if (page_shift != GETFIELD(VSD_TSIZE, vsd) + 12) {
200             xive2_error(xive, "VST: %s entry %x indirect page size differ !?",
201                        info->name, idx);
202             return 0;
203         }
204     }
205 
206     return pnv_xive2_vst_addr_direct(xive, type, vsd, (idx % vst_per_page));
207 }
208 
209 static uint64_t pnv_xive2_vst_addr(PnvXive2 *xive, uint32_t type, uint8_t blk,
210                                    uint32_t idx)
211 {
212     const XiveVstInfo *info = &vst_infos[type];
213     uint64_t vsd;
214 
215     if (blk >= info->max_blocks) {
216         xive2_error(xive, "VST: invalid block id %d for VST %s %d !?",
217                    blk, info->name, idx);
218         return 0;
219     }
220 
221     vsd = xive->vsds[type][blk];
222 
223     /* Remote VST access */
224     if (GETFIELD(VSD_MODE, vsd) == VSD_MODE_FORWARD) {
225         xive = pnv_xive2_get_remote(blk);
226 
227         return xive ? pnv_xive2_vst_addr(xive, type, blk, idx) : 0;
228     }
229 
230     if (VSD_INDIRECT & vsd) {
231         return pnv_xive2_vst_addr_indirect(xive, type, vsd, idx);
232     }
233 
234     return pnv_xive2_vst_addr_direct(xive, type, vsd, idx);
235 }
236 
237 static int pnv_xive2_vst_read(PnvXive2 *xive, uint32_t type, uint8_t blk,
238                              uint32_t idx, void *data)
239 {
240     const XiveVstInfo *info = &vst_infos[type];
241     uint64_t addr = pnv_xive2_vst_addr(xive, type, blk, idx);
242     MemTxResult result;
243 
244     if (!addr) {
245         return -1;
246     }
247 
248     result = address_space_read(&address_space_memory, addr,
249                                 MEMTXATTRS_UNSPECIFIED, data,
250                                 info->size);
251     if (result != MEMTX_OK) {
252         xive2_error(xive, "VST: read failed at @0x%" HWADDR_PRIx
253                    " for VST %s %x/%x\n", addr, info->name, blk, idx);
254         return -1;
255     }
256     return 0;
257 }
258 
259 #define XIVE_VST_WORD_ALL -1
260 
261 static int pnv_xive2_vst_write(PnvXive2 *xive, uint32_t type, uint8_t blk,
262                                uint32_t idx, void *data, uint32_t word_number)
263 {
264     const XiveVstInfo *info = &vst_infos[type];
265     uint64_t addr = pnv_xive2_vst_addr(xive, type, blk, idx);
266     MemTxResult result;
267 
268     if (!addr) {
269         return -1;
270     }
271 
272     if (word_number == XIVE_VST_WORD_ALL) {
273         result = address_space_write(&address_space_memory, addr,
274                                      MEMTXATTRS_UNSPECIFIED, data,
275                                      info->size);
276     } else {
277         result = address_space_write(&address_space_memory,
278                                      addr + word_number * 4,
279                                      MEMTXATTRS_UNSPECIFIED,
280                                      data + word_number * 4, 4);
281     }
282 
283     if (result != MEMTX_OK) {
284         xive2_error(xive, "VST: write failed at @0x%" HWADDR_PRIx
285                    "for VST %s %x/%x\n", addr, info->name, blk, idx);
286         return -1;
287     }
288     return 0;
289 }
290 
291 static int pnv_xive2_get_pq(Xive2Router *xrtr, uint8_t blk, uint32_t idx,
292                              uint8_t *pq)
293 {
294     PnvXive2 *xive = PNV_XIVE2(xrtr);
295 
296     if (pnv_xive2_block_id(xive) != blk) {
297         xive2_error(xive, "VST: EAS %x is remote !?", XIVE_EAS(blk, idx));
298         return -1;
299     }
300 
301     *pq = xive_source_esb_get(&xive->ipi_source, idx);
302     return 0;
303 }
304 
305 static int pnv_xive2_set_pq(Xive2Router *xrtr, uint8_t blk, uint32_t idx,
306                              uint8_t *pq)
307 {
308     PnvXive2 *xive = PNV_XIVE2(xrtr);
309 
310     if (pnv_xive2_block_id(xive) != blk) {
311         xive2_error(xive, "VST: EAS %x is remote !?", XIVE_EAS(blk, idx));
312         return -1;
313     }
314 
315     *pq = xive_source_esb_set(&xive->ipi_source, idx, *pq);
316     return 0;
317 }
318 
319 static int pnv_xive2_get_end(Xive2Router *xrtr, uint8_t blk, uint32_t idx,
320                              Xive2End *end)
321 {
322     return pnv_xive2_vst_read(PNV_XIVE2(xrtr), VST_END, blk, idx, end);
323 }
324 
325 static int pnv_xive2_write_end(Xive2Router *xrtr, uint8_t blk, uint32_t idx,
326                                Xive2End *end, uint8_t word_number)
327 {
328     return pnv_xive2_vst_write(PNV_XIVE2(xrtr), VST_END, blk, idx, end,
329                               word_number);
330 }
331 
332 static int pnv_xive2_end_update(PnvXive2 *xive, uint8_t watch_engine)
333 {
334     uint8_t  blk;
335     uint32_t idx;
336     int i, spec_reg, data_reg;
337     uint64_t endc_watch[4];
338 
339     assert(watch_engine < ARRAY_SIZE(endc_watch));
340 
341     spec_reg = (VC_ENDC_WATCH0_SPEC + watch_engine * 0x40) >> 3;
342     data_reg = (VC_ENDC_WATCH0_DATA0 + watch_engine * 0x40) >> 3;
343     blk = GETFIELD(VC_ENDC_WATCH_BLOCK_ID, xive->vc_regs[spec_reg]);
344     idx = GETFIELD(VC_ENDC_WATCH_INDEX, xive->vc_regs[spec_reg]);
345 
346     for (i = 0; i < ARRAY_SIZE(endc_watch); i++) {
347         endc_watch[i] = cpu_to_be64(xive->vc_regs[data_reg + i]);
348     }
349 
350     return pnv_xive2_vst_write(xive, VST_END, blk, idx, endc_watch,
351                               XIVE_VST_WORD_ALL);
352 }
353 
354 static void pnv_xive2_end_cache_load(PnvXive2 *xive, uint8_t watch_engine)
355 {
356     uint8_t  blk;
357     uint32_t idx;
358     uint64_t endc_watch[4] = { 0 };
359     int i, spec_reg, data_reg;
360 
361     assert(watch_engine < ARRAY_SIZE(endc_watch));
362 
363     spec_reg = (VC_ENDC_WATCH0_SPEC + watch_engine * 0x40) >> 3;
364     data_reg = (VC_ENDC_WATCH0_DATA0 + watch_engine * 0x40) >> 3;
365     blk = GETFIELD(VC_ENDC_WATCH_BLOCK_ID, xive->vc_regs[spec_reg]);
366     idx = GETFIELD(VC_ENDC_WATCH_INDEX, xive->vc_regs[spec_reg]);
367 
368     if (pnv_xive2_vst_read(xive, VST_END, blk, idx, endc_watch)) {
369         xive2_error(xive, "VST: no END entry %x/%x !?", blk, idx);
370     }
371 
372     for (i = 0; i < ARRAY_SIZE(endc_watch); i++) {
373         xive->vc_regs[data_reg + i] = be64_to_cpu(endc_watch[i]);
374     }
375 }
376 
377 static int pnv_xive2_get_nvp(Xive2Router *xrtr, uint8_t blk, uint32_t idx,
378                              Xive2Nvp *nvp)
379 {
380     return pnv_xive2_vst_read(PNV_XIVE2(xrtr), VST_NVP, blk, idx, nvp);
381 }
382 
383 static int pnv_xive2_write_nvp(Xive2Router *xrtr, uint8_t blk, uint32_t idx,
384                                Xive2Nvp *nvp, uint8_t word_number)
385 {
386     return pnv_xive2_vst_write(PNV_XIVE2(xrtr), VST_NVP, blk, idx, nvp,
387                               word_number);
388 }
389 
390 static int pnv_xive2_nvp_update(PnvXive2 *xive, uint8_t watch_engine)
391 {
392     uint8_t  blk;
393     uint32_t idx;
394     int i, spec_reg, data_reg;
395     uint64_t nxc_watch[4];
396 
397     assert(watch_engine < ARRAY_SIZE(nxc_watch));
398 
399     spec_reg = (PC_NXC_WATCH0_SPEC + watch_engine * 0x40) >> 3;
400     data_reg = (PC_NXC_WATCH0_DATA0 + watch_engine * 0x40) >> 3;
401     blk = GETFIELD(PC_NXC_WATCH_BLOCK_ID, xive->pc_regs[spec_reg]);
402     idx = GETFIELD(PC_NXC_WATCH_INDEX, xive->pc_regs[spec_reg]);
403 
404     for (i = 0; i < ARRAY_SIZE(nxc_watch); i++) {
405         nxc_watch[i] = cpu_to_be64(xive->pc_regs[data_reg + i]);
406     }
407 
408     return pnv_xive2_vst_write(xive, VST_NVP, blk, idx, nxc_watch,
409                               XIVE_VST_WORD_ALL);
410 }
411 
412 static void pnv_xive2_nvp_cache_load(PnvXive2 *xive, uint8_t watch_engine)
413 {
414     uint8_t  blk;
415     uint32_t idx;
416     uint64_t nxc_watch[4] = { 0 };
417     int i, spec_reg, data_reg;
418 
419     assert(watch_engine < ARRAY_SIZE(nxc_watch));
420 
421     spec_reg = (PC_NXC_WATCH0_SPEC + watch_engine * 0x40) >> 3;
422     data_reg = (PC_NXC_WATCH0_DATA0 + watch_engine * 0x40) >> 3;
423     blk = GETFIELD(PC_NXC_WATCH_BLOCK_ID, xive->pc_regs[spec_reg]);
424     idx = GETFIELD(PC_NXC_WATCH_INDEX, xive->pc_regs[spec_reg]);
425 
426     if (pnv_xive2_vst_read(xive, VST_NVP, blk, idx, nxc_watch)) {
427         xive2_error(xive, "VST: no NVP entry %x/%x !?", blk, idx);
428     }
429 
430     for (i = 0; i < ARRAY_SIZE(nxc_watch); i++) {
431         xive->pc_regs[data_reg + i] = be64_to_cpu(nxc_watch[i]);
432     }
433 }
434 
435 static int pnv_xive2_get_eas(Xive2Router *xrtr, uint8_t blk, uint32_t idx,
436                             Xive2Eas *eas)
437 {
438     PnvXive2 *xive = PNV_XIVE2(xrtr);
439 
440     if (pnv_xive2_block_id(xive) != blk) {
441         xive2_error(xive, "VST: EAS %x is remote !?", XIVE_EAS(blk, idx));
442         return -1;
443     }
444 
445     return pnv_xive2_vst_read(xive, VST_EAS, blk, idx, eas);
446 }
447 
448 static uint32_t pnv_xive2_get_config(Xive2Router *xrtr)
449 {
450     PnvXive2 *xive = PNV_XIVE2(xrtr);
451     uint32_t cfg = 0;
452 
453     if (xive->cq_regs[CQ_XIVE_CFG >> 3] & CQ_XIVE_CFG_GEN1_TIMA_OS) {
454         cfg |= XIVE2_GEN1_TIMA_OS;
455     }
456 
457     if (xive->cq_regs[CQ_XIVE_CFG >> 3] & CQ_XIVE_CFG_EN_VP_SAVE_RESTORE) {
458         cfg |= XIVE2_VP_SAVE_RESTORE;
459     }
460 
461     if (GETFIELD(CQ_XIVE_CFG_HYP_HARD_RANGE,
462               xive->cq_regs[CQ_XIVE_CFG >> 3]) == CQ_XIVE_CFG_THREADID_8BITS) {
463         cfg |= XIVE2_THREADID_8BITS;
464     }
465 
466     return cfg;
467 }
468 
469 static bool pnv_xive2_is_cpu_enabled(PnvXive2 *xive, PowerPCCPU *cpu)
470 {
471     int pir = ppc_cpu_pir(cpu);
472     uint32_t fc = PNV10_PIR2FUSEDCORE(pir);
473     uint64_t reg = fc < 8 ? TCTXT_EN0 : TCTXT_EN1;
474     uint32_t bit = pir & 0x3f;
475 
476     return xive->tctxt_regs[reg >> 3] & PPC_BIT(bit);
477 }
478 
479 static int pnv_xive2_match_nvt(XivePresenter *xptr, uint8_t format,
480                                uint8_t nvt_blk, uint32_t nvt_idx,
481                                bool cam_ignore, uint8_t priority,
482                                uint32_t logic_serv, XiveTCTXMatch *match)
483 {
484     PnvXive2 *xive = PNV_XIVE2(xptr);
485     PnvChip *chip = xive->chip;
486     int count = 0;
487     int i, j;
488     bool gen1_tima_os =
489         xive->cq_regs[CQ_XIVE_CFG >> 3] & CQ_XIVE_CFG_GEN1_TIMA_OS;
490 
491     for (i = 0; i < chip->nr_cores; i++) {
492         PnvCore *pc = chip->cores[i];
493         CPUCore *cc = CPU_CORE(pc);
494 
495         for (j = 0; j < cc->nr_threads; j++) {
496             PowerPCCPU *cpu = pc->threads[j];
497             XiveTCTX *tctx;
498             int ring;
499 
500             if (!pnv_xive2_is_cpu_enabled(xive, cpu)) {
501                 continue;
502             }
503 
504             tctx = XIVE_TCTX(pnv_cpu_state(cpu)->intc);
505 
506             if (gen1_tima_os) {
507                 ring = xive_presenter_tctx_match(xptr, tctx, format, nvt_blk,
508                                                  nvt_idx, cam_ignore,
509                                                  logic_serv);
510             } else {
511                 ring = xive2_presenter_tctx_match(xptr, tctx, format, nvt_blk,
512                                                    nvt_idx, cam_ignore,
513                                                    logic_serv);
514             }
515 
516             /*
517              * Save the context and follow on to catch duplicates,
518              * that we don't support yet.
519              */
520             if (ring != -1) {
521                 if (match->tctx) {
522                     qemu_log_mask(LOG_GUEST_ERROR, "XIVE: already found a "
523                                   "thread context NVT %x/%x\n",
524                                   nvt_blk, nvt_idx);
525                     return false;
526                 }
527 
528                 match->ring = ring;
529                 match->tctx = tctx;
530                 count++;
531             }
532         }
533     }
534 
535     return count;
536 }
537 
538 static uint32_t pnv_xive2_presenter_get_config(XivePresenter *xptr)
539 {
540     PnvXive2 *xive = PNV_XIVE2(xptr);
541     uint32_t cfg = 0;
542 
543     if (xive->cq_regs[CQ_XIVE_CFG >> 3] & CQ_XIVE_CFG_GEN1_TIMA_OS) {
544         cfg |= XIVE_PRESENTER_GEN1_TIMA_OS;
545     }
546     return cfg;
547 }
548 
549 static uint8_t pnv_xive2_get_block_id(Xive2Router *xrtr)
550 {
551     return pnv_xive2_block_id(PNV_XIVE2(xrtr));
552 }
553 
554 /*
555  * The TIMA MMIO space is shared among the chips and to identify the
556  * chip from which the access is being done, we extract the chip id
557  * from the PIR.
558  */
559 static PnvXive2 *pnv_xive2_tm_get_xive(PowerPCCPU *cpu)
560 {
561     int pir = ppc_cpu_pir(cpu);
562     XivePresenter *xptr = XIVE_TCTX(pnv_cpu_state(cpu)->intc)->xptr;
563     PnvXive2 *xive = PNV_XIVE2(xptr);
564 
565     if (!pnv_xive2_is_cpu_enabled(xive, cpu)) {
566         xive2_error(xive, "IC: CPU %x is not enabled", pir);
567     }
568     return xive;
569 }
570 
571 /*
572  * The internal sources of the interrupt controller have no knowledge
573  * of the XIVE2 chip on which they reside. Encode the block id in the
574  * source interrupt number before forwarding the source event
575  * notification to the Router. This is required on a multichip system.
576  */
577 static void pnv_xive2_notify(XiveNotifier *xn, uint32_t srcno, bool pq_checked)
578 {
579     PnvXive2 *xive = PNV_XIVE2(xn);
580     uint8_t blk = pnv_xive2_block_id(xive);
581 
582     xive2_router_notify(xn, XIVE_EAS(blk, srcno), pq_checked);
583 }
584 
585 /*
586  * Set Translation Tables
587  *
588  * TODO add support for multiple sets
589  */
590 static int pnv_xive2_stt_set_data(PnvXive2 *xive, uint64_t val)
591 {
592     uint8_t tsel = GETFIELD(CQ_TAR_SELECT, xive->cq_regs[CQ_TAR >> 3]);
593     uint8_t entry = GETFIELD(CQ_TAR_ENTRY_SELECT,
594                                   xive->cq_regs[CQ_TAR >> 3]);
595 
596     switch (tsel) {
597     case CQ_TAR_NVPG:
598     case CQ_TAR_ESB:
599     case CQ_TAR_END:
600         xive->tables[tsel][entry] = val;
601         break;
602     default:
603         xive2_error(xive, "IC: unsupported table %d", tsel);
604         return -1;
605     }
606 
607     if (xive->cq_regs[CQ_TAR >> 3] & CQ_TAR_AUTOINC) {
608         xive->cq_regs[CQ_TAR >> 3] = SETFIELD(CQ_TAR_ENTRY_SELECT,
609                      xive->cq_regs[CQ_TAR >> 3], ++entry);
610     }
611 
612     return 0;
613 }
614 /*
615  * Virtual Structure Tables (VST) configuration
616  */
617 static void pnv_xive2_vst_set_exclusive(PnvXive2 *xive, uint8_t type,
618                                         uint8_t blk, uint64_t vsd)
619 {
620     Xive2EndSource *end_xsrc = &xive->end_source;
621     XiveSource *xsrc = &xive->ipi_source;
622     const XiveVstInfo *info = &vst_infos[type];
623     uint32_t page_shift = GETFIELD(VSD_TSIZE, vsd) + 12;
624     uint64_t vst_tsize = 1ull << page_shift;
625     uint64_t vst_addr = vsd & VSD_ADDRESS_MASK;
626 
627     /* Basic checks */
628 
629     if (VSD_INDIRECT & vsd) {
630         if (!pnv_xive2_vst_page_size_allowed(page_shift)) {
631             xive2_error(xive, "VST: invalid %s page shift %d", info->name,
632                        page_shift);
633             return;
634         }
635     }
636 
637     if (!QEMU_IS_ALIGNED(vst_addr, 1ull << page_shift)) {
638         xive2_error(xive, "VST: %s table address 0x%"PRIx64
639                     " is not aligned with page shift %d",
640                     info->name, vst_addr, page_shift);
641         return;
642     }
643 
644     /* Record the table configuration (in SRAM on HW) */
645     xive->vsds[type][blk] = vsd;
646 
647     /* Now tune the models with the configuration provided by the FW */
648 
649     switch (type) {
650     case VST_ESB:
651         /*
652          * Backing store pages for the source PQ bits. The model does
653          * not use these PQ bits backed in RAM because the XiveSource
654          * model has its own.
655          *
656          * If the table is direct, we can compute the number of PQ
657          * entries provisioned by FW (such as skiboot) and resize the
658          * ESB window accordingly.
659          */
660         if (!(VSD_INDIRECT & vsd)) {
661             memory_region_set_size(&xsrc->esb_mmio, vst_tsize * SBE_PER_BYTE
662                                    * (1ull << xsrc->esb_shift));
663         }
664 
665         memory_region_add_subregion(&xive->esb_mmio, 0, &xsrc->esb_mmio);
666         break;
667 
668     case VST_EAS:  /* Nothing to be done */
669         break;
670 
671     case VST_END:
672         /*
673          * Backing store pages for the END.
674          */
675         if (!(VSD_INDIRECT & vsd)) {
676             memory_region_set_size(&end_xsrc->esb_mmio, (vst_tsize / info->size)
677                                    * (1ull << end_xsrc->esb_shift));
678         }
679         memory_region_add_subregion(&xive->end_mmio, 0, &end_xsrc->esb_mmio);
680         break;
681 
682     case VST_NVP:  /* Not modeled */
683     case VST_NVG:  /* Not modeled */
684     case VST_NVC:  /* Not modeled */
685     case VST_IC:   /* Not modeled */
686     case VST_SYNC: /* Not modeled */
687     case VST_ERQ:  /* Not modeled */
688         break;
689 
690     default:
691         g_assert_not_reached();
692     }
693 }
694 
695 /*
696  * Both PC and VC sub-engines are configured as each use the Virtual
697  * Structure Tables
698  */
699 static void pnv_xive2_vst_set_data(PnvXive2 *xive, uint64_t vsd)
700 {
701     uint8_t mode = GETFIELD(VSD_MODE, vsd);
702     uint8_t type = GETFIELD(VC_VSD_TABLE_SELECT,
703                             xive->vc_regs[VC_VSD_TABLE_ADDR >> 3]);
704     uint8_t blk = GETFIELD(VC_VSD_TABLE_ADDRESS,
705                            xive->vc_regs[VC_VSD_TABLE_ADDR >> 3]);
706     uint64_t vst_addr = vsd & VSD_ADDRESS_MASK;
707 
708     if (type > VST_ERQ) {
709         xive2_error(xive, "VST: invalid table type %d", type);
710         return;
711     }
712 
713     if (blk >= vst_infos[type].max_blocks) {
714         xive2_error(xive, "VST: invalid block id %d for"
715                       " %s table", blk, vst_infos[type].name);
716         return;
717     }
718 
719     if (!vst_addr) {
720         xive2_error(xive, "VST: invalid %s table address",
721                    vst_infos[type].name);
722         return;
723     }
724 
725     switch (mode) {
726     case VSD_MODE_FORWARD:
727         xive->vsds[type][blk] = vsd;
728         break;
729 
730     case VSD_MODE_EXCLUSIVE:
731         pnv_xive2_vst_set_exclusive(xive, type, blk, vsd);
732         break;
733 
734     default:
735         xive2_error(xive, "VST: unsupported table mode %d", mode);
736         return;
737     }
738 }
739 
740 /*
741  * MMIO handlers
742  */
743 
744 
745 /*
746  * IC BAR layout
747  *
748  * Page 0: Internal CQ register accesses (reads & writes)
749  * Page 1: Internal PC register accesses (reads & writes)
750  * Page 2: Internal VC register accesses (reads & writes)
751  * Page 3: Internal TCTXT (TIMA) reg accesses (read & writes)
752  * Page 4: Notify Port page (writes only, w/data),
753  * Page 5: Reserved
754  * Page 6: Sync Poll page (writes only, dataless)
755  * Page 7: Sync Inject page (writes only, dataless)
756  * Page 8: LSI Trigger page (writes only, dataless)
757  * Page 9: LSI SB Management page (reads & writes dataless)
758  * Pages 10-255: Reserved
759  * Pages 256-383: Direct mapped Thread Context Area (reads & writes)
760  *                covering the 128 threads in P10.
761  * Pages 384-511: Reserved
762  */
763 typedef struct PnvXive2Region {
764     const char *name;
765     uint32_t pgoff;
766     uint32_t pgsize;
767     const MemoryRegionOps *ops;
768 } PnvXive2Region;
769 
770 static const MemoryRegionOps pnv_xive2_ic_cq_ops;
771 static const MemoryRegionOps pnv_xive2_ic_pc_ops;
772 static const MemoryRegionOps pnv_xive2_ic_vc_ops;
773 static const MemoryRegionOps pnv_xive2_ic_tctxt_ops;
774 static const MemoryRegionOps pnv_xive2_ic_notify_ops;
775 static const MemoryRegionOps pnv_xive2_ic_sync_ops;
776 static const MemoryRegionOps pnv_xive2_ic_lsi_ops;
777 static const MemoryRegionOps pnv_xive2_ic_tm_indirect_ops;
778 
779 /* 512 pages. 4K: 2M range, 64K: 32M range */
780 static const PnvXive2Region pnv_xive2_ic_regions[] = {
781     { "xive-ic-cq",        0,   1,   &pnv_xive2_ic_cq_ops     },
782     { "xive-ic-vc",        1,   1,   &pnv_xive2_ic_vc_ops     },
783     { "xive-ic-pc",        2,   1,   &pnv_xive2_ic_pc_ops     },
784     { "xive-ic-tctxt",     3,   1,   &pnv_xive2_ic_tctxt_ops  },
785     { "xive-ic-notify",    4,   1,   &pnv_xive2_ic_notify_ops },
786     /* page 5 reserved */
787     { "xive-ic-sync",      6,   2,   &pnv_xive2_ic_sync_ops   },
788     { "xive-ic-lsi",       8,   2,   &pnv_xive2_ic_lsi_ops    },
789     /* pages 10-255 reserved */
790     { "xive-ic-tm-indirect", 256, 128, &pnv_xive2_ic_tm_indirect_ops  },
791     /* pages 384-511 reserved */
792 };
793 
794 /*
795  * CQ operations
796  */
797 
798 static uint64_t pnv_xive2_ic_cq_read(void *opaque, hwaddr offset,
799                                         unsigned size)
800 {
801     PnvXive2 *xive = PNV_XIVE2(opaque);
802     uint32_t reg = offset >> 3;
803     uint64_t val = 0;
804 
805     switch (offset) {
806     case CQ_XIVE_CAP: /* Set at reset */
807     case CQ_XIVE_CFG:
808         val = xive->cq_regs[reg];
809         break;
810     case CQ_MSGSND: /* TODO check the #cores of the machine */
811         val = 0xffffffff00000000;
812         break;
813     case CQ_CFG_PB_GEN:
814         val = CQ_CFG_PB_GEN_PB_INIT; /* TODO: fix CQ_CFG_PB_GEN default value */
815         break;
816     default:
817         xive2_error(xive, "CQ: invalid read @%"HWADDR_PRIx, offset);
818     }
819 
820     return val;
821 }
822 
823 static uint64_t pnv_xive2_bar_size(uint64_t val)
824 {
825     return 1ull << (GETFIELD(CQ_BAR_RANGE, val) + 24);
826 }
827 
828 static void pnv_xive2_ic_cq_write(void *opaque, hwaddr offset,
829                                   uint64_t val, unsigned size)
830 {
831     PnvXive2 *xive = PNV_XIVE2(opaque);
832     MemoryRegion *sysmem = get_system_memory();
833     uint32_t reg = offset >> 3;
834     int i;
835 
836     switch (offset) {
837     case CQ_XIVE_CFG:
838     case CQ_RST_CTL: /* TODO: reset all BARs */
839         break;
840 
841     case CQ_IC_BAR:
842         xive->ic_shift = val & CQ_IC_BAR_64K ? 16 : 12;
843         if (!(val & CQ_IC_BAR_VALID)) {
844             xive->ic_base = 0;
845             if (xive->cq_regs[reg] & CQ_IC_BAR_VALID) {
846                 for (i = 0; i < ARRAY_SIZE(xive->ic_mmios); i++) {
847                     memory_region_del_subregion(&xive->ic_mmio,
848                                                 &xive->ic_mmios[i]);
849                 }
850                 memory_region_del_subregion(sysmem, &xive->ic_mmio);
851             }
852         } else {
853             xive->ic_base = val & ~(CQ_IC_BAR_VALID | CQ_IC_BAR_64K);
854             if (!(xive->cq_regs[reg] & CQ_IC_BAR_VALID)) {
855                 for (i = 0; i < ARRAY_SIZE(xive->ic_mmios); i++) {
856                     memory_region_add_subregion(&xive->ic_mmio,
857                                pnv_xive2_ic_regions[i].pgoff << xive->ic_shift,
858                                &xive->ic_mmios[i]);
859                 }
860                 memory_region_add_subregion(sysmem, xive->ic_base,
861                                             &xive->ic_mmio);
862             }
863         }
864         break;
865 
866     case CQ_TM_BAR:
867         xive->tm_shift = val & CQ_TM_BAR_64K ? 16 : 12;
868         if (!(val & CQ_TM_BAR_VALID)) {
869             xive->tm_base = 0;
870             if (xive->cq_regs[reg] & CQ_TM_BAR_VALID) {
871                 memory_region_del_subregion(sysmem, &xive->tm_mmio);
872             }
873         } else {
874             xive->tm_base = val & ~(CQ_TM_BAR_VALID | CQ_TM_BAR_64K);
875             if (!(xive->cq_regs[reg] & CQ_TM_BAR_VALID)) {
876                 memory_region_add_subregion(sysmem, xive->tm_base,
877                                             &xive->tm_mmio);
878             }
879         }
880         break;
881 
882     case CQ_ESB_BAR:
883         xive->esb_shift = val & CQ_BAR_64K ? 16 : 12;
884         if (!(val & CQ_BAR_VALID)) {
885             xive->esb_base = 0;
886             if (xive->cq_regs[reg] & CQ_BAR_VALID) {
887                 memory_region_del_subregion(sysmem, &xive->esb_mmio);
888             }
889         } else {
890             xive->esb_base = val & CQ_BAR_ADDR;
891             if (!(xive->cq_regs[reg] & CQ_BAR_VALID)) {
892                 memory_region_set_size(&xive->esb_mmio,
893                                        pnv_xive2_bar_size(val));
894                 memory_region_add_subregion(sysmem, xive->esb_base,
895                                             &xive->esb_mmio);
896             }
897         }
898         break;
899 
900     case CQ_END_BAR:
901         xive->end_shift = val & CQ_BAR_64K ? 16 : 12;
902         if (!(val & CQ_BAR_VALID)) {
903             xive->end_base = 0;
904             if (xive->cq_regs[reg] & CQ_BAR_VALID) {
905                 memory_region_del_subregion(sysmem, &xive->end_mmio);
906             }
907         } else {
908             xive->end_base = val & CQ_BAR_ADDR;
909             if (!(xive->cq_regs[reg] & CQ_BAR_VALID)) {
910                 memory_region_set_size(&xive->end_mmio,
911                                        pnv_xive2_bar_size(val));
912                 memory_region_add_subregion(sysmem, xive->end_base,
913                                             &xive->end_mmio);
914             }
915         }
916         break;
917 
918     case CQ_NVC_BAR:
919         xive->nvc_shift = val & CQ_BAR_64K ? 16 : 12;
920         if (!(val & CQ_BAR_VALID)) {
921             xive->nvc_base = 0;
922             if (xive->cq_regs[reg] & CQ_BAR_VALID) {
923                 memory_region_del_subregion(sysmem, &xive->nvc_mmio);
924             }
925         } else {
926             xive->nvc_base = val & CQ_BAR_ADDR;
927             if (!(xive->cq_regs[reg] & CQ_BAR_VALID)) {
928                 memory_region_set_size(&xive->nvc_mmio,
929                                        pnv_xive2_bar_size(val));
930                 memory_region_add_subregion(sysmem, xive->nvc_base,
931                                             &xive->nvc_mmio);
932             }
933         }
934         break;
935 
936     case CQ_NVPG_BAR:
937         xive->nvpg_shift = val & CQ_BAR_64K ? 16 : 12;
938         if (!(val & CQ_BAR_VALID)) {
939             xive->nvpg_base = 0;
940             if (xive->cq_regs[reg] & CQ_BAR_VALID) {
941                 memory_region_del_subregion(sysmem, &xive->nvpg_mmio);
942             }
943         } else {
944             xive->nvpg_base = val & CQ_BAR_ADDR;
945             if (!(xive->cq_regs[reg] & CQ_BAR_VALID)) {
946                 memory_region_set_size(&xive->nvpg_mmio,
947                                        pnv_xive2_bar_size(val));
948                 memory_region_add_subregion(sysmem, xive->nvpg_base,
949                                             &xive->nvpg_mmio);
950             }
951         }
952         break;
953 
954     case CQ_TAR: /* Set Translation Table Address */
955         break;
956     case CQ_TDR: /* Set Translation Table Data */
957         pnv_xive2_stt_set_data(xive, val);
958         break;
959     case CQ_FIRMASK_OR: /* FIR error reporting */
960         break;
961     default:
962         xive2_error(xive, "CQ: invalid write 0x%"HWADDR_PRIx, offset);
963         return;
964     }
965 
966     xive->cq_regs[reg] = val;
967 }
968 
969 static const MemoryRegionOps pnv_xive2_ic_cq_ops = {
970     .read = pnv_xive2_ic_cq_read,
971     .write = pnv_xive2_ic_cq_write,
972     .endianness = DEVICE_BIG_ENDIAN,
973     .valid = {
974         .min_access_size = 8,
975         .max_access_size = 8,
976     },
977     .impl = {
978         .min_access_size = 8,
979         .max_access_size = 8,
980     },
981 };
982 
983 static uint8_t pnv_xive2_cache_watch_assign(uint64_t engine_mask,
984                                             uint64_t *state)
985 {
986     uint8_t val = 0xFF;
987     int i;
988 
989     for (i = 3; i >= 0; i--) {
990         if (BIT(i) & engine_mask) {
991             if (!(BIT(i) & *state)) {
992                 *state |= BIT(i);
993                 val = 3 - i;
994                 break;
995             }
996         }
997     }
998     return val;
999 }
1000 
1001 static void pnv_xive2_cache_watch_release(uint64_t *state, uint8_t watch_engine)
1002 {
1003     uint8_t engine_bit = 3 - watch_engine;
1004 
1005     if (*state & BIT(engine_bit)) {
1006         *state &= ~BIT(engine_bit);
1007     }
1008 }
1009 
1010 static uint8_t pnv_xive2_endc_cache_watch_assign(PnvXive2 *xive)
1011 {
1012     uint64_t engine_mask = GETFIELD(VC_ENDC_CFG_CACHE_WATCH_ASSIGN,
1013                                     xive->vc_regs[VC_ENDC_CFG >> 3]);
1014     uint64_t state = xive->vc_regs[VC_ENDC_WATCH_ASSIGN >> 3];
1015     uint8_t val;
1016 
1017     /*
1018      * We keep track of which engines are currently busy in the
1019      * VC_ENDC_WATCH_ASSIGN register directly. When the firmware reads
1020      * the register, we don't return its value but the ID of an engine
1021      * it can use.
1022      * There are 4 engines. 0xFF means no engine is available.
1023      */
1024     val = pnv_xive2_cache_watch_assign(engine_mask, &state);
1025     if (val != 0xFF) {
1026         xive->vc_regs[VC_ENDC_WATCH_ASSIGN >> 3] = state;
1027     }
1028     return val;
1029 }
1030 
1031 static void pnv_xive2_endc_cache_watch_release(PnvXive2 *xive,
1032                                                uint8_t watch_engine)
1033 {
1034     uint64_t state = xive->vc_regs[VC_ENDC_WATCH_ASSIGN >> 3];
1035 
1036     pnv_xive2_cache_watch_release(&state, watch_engine);
1037     xive->vc_regs[VC_ENDC_WATCH_ASSIGN >> 3] = state;
1038 }
1039 
1040 static uint64_t pnv_xive2_ic_vc_read(void *opaque, hwaddr offset,
1041                                      unsigned size)
1042 {
1043     PnvXive2 *xive = PNV_XIVE2(opaque);
1044     uint64_t val = 0;
1045     uint32_t reg = offset >> 3;
1046     uint8_t watch_engine;
1047 
1048     switch (offset) {
1049     /*
1050      * VSD table settings.
1051      */
1052     case VC_VSD_TABLE_ADDR:
1053     case VC_VSD_TABLE_DATA:
1054         val = xive->vc_regs[reg];
1055         break;
1056 
1057     /*
1058      * ESB cache updates (not modeled)
1059      */
1060     case VC_ESBC_FLUSH_CTRL:
1061         xive->vc_regs[reg] &= ~VC_ESBC_FLUSH_CTRL_POLL_VALID;
1062         val = xive->vc_regs[reg];
1063         break;
1064 
1065     case VC_ESBC_CFG:
1066         val = xive->vc_regs[reg];
1067         break;
1068 
1069     /*
1070      * EAS cache updates (not modeled)
1071      */
1072     case VC_EASC_FLUSH_CTRL:
1073         xive->vc_regs[reg] &= ~VC_EASC_FLUSH_CTRL_POLL_VALID;
1074         val = xive->vc_regs[reg];
1075         break;
1076 
1077     case VC_ENDC_WATCH_ASSIGN:
1078         val = pnv_xive2_endc_cache_watch_assign(xive);
1079         break;
1080 
1081     case VC_ENDC_CFG:
1082         val = xive->vc_regs[reg];
1083         break;
1084 
1085     /*
1086      * END cache updates
1087      */
1088     case VC_ENDC_WATCH0_SPEC:
1089     case VC_ENDC_WATCH1_SPEC:
1090     case VC_ENDC_WATCH2_SPEC:
1091     case VC_ENDC_WATCH3_SPEC:
1092         watch_engine = (offset - VC_ENDC_WATCH0_SPEC) >> 6;
1093         xive->vc_regs[reg] &= ~(VC_ENDC_WATCH_FULL | VC_ENDC_WATCH_CONFLICT);
1094         pnv_xive2_endc_cache_watch_release(xive, watch_engine);
1095         val = xive->vc_regs[reg];
1096         break;
1097 
1098     case VC_ENDC_WATCH0_DATA0:
1099     case VC_ENDC_WATCH1_DATA0:
1100     case VC_ENDC_WATCH2_DATA0:
1101     case VC_ENDC_WATCH3_DATA0:
1102         /*
1103          * Load DATA registers from cache with data requested by the
1104          * SPEC register
1105          */
1106         watch_engine = (offset - VC_ENDC_WATCH0_DATA0) >> 6;
1107         pnv_xive2_end_cache_load(xive, watch_engine);
1108         val = xive->vc_regs[reg];
1109         break;
1110 
1111     case VC_ENDC_WATCH0_DATA1 ... VC_ENDC_WATCH0_DATA3:
1112     case VC_ENDC_WATCH1_DATA1 ... VC_ENDC_WATCH1_DATA3:
1113     case VC_ENDC_WATCH2_DATA1 ... VC_ENDC_WATCH2_DATA3:
1114     case VC_ENDC_WATCH3_DATA1 ... VC_ENDC_WATCH3_DATA3:
1115         val = xive->vc_regs[reg];
1116         break;
1117 
1118     case VC_ENDC_FLUSH_CTRL:
1119         xive->vc_regs[reg] &= ~VC_ENDC_FLUSH_CTRL_POLL_VALID;
1120         val = xive->vc_regs[reg];
1121         break;
1122 
1123     /*
1124      * Indirect invalidation
1125      */
1126     case VC_AT_MACRO_KILL_MASK:
1127         val = xive->vc_regs[reg];
1128         break;
1129 
1130     case VC_AT_MACRO_KILL:
1131         xive->vc_regs[reg] &= ~VC_AT_MACRO_KILL_VALID;
1132         val = xive->vc_regs[reg];
1133         break;
1134 
1135     /*
1136      * Interrupt fifo overflow in memory backing store (Not modeled)
1137      */
1138     case VC_QUEUES_CFG_REM0 ... VC_QUEUES_CFG_REM6:
1139         val = xive->vc_regs[reg];
1140         break;
1141 
1142     /*
1143      * Synchronisation
1144      */
1145     case VC_ENDC_SYNC_DONE:
1146         val = VC_ENDC_SYNC_POLL_DONE;
1147         break;
1148     default:
1149         xive2_error(xive, "VC: invalid read @%"HWADDR_PRIx, offset);
1150     }
1151 
1152     return val;
1153 }
1154 
1155 static void pnv_xive2_ic_vc_write(void *opaque, hwaddr offset,
1156                                   uint64_t val, unsigned size)
1157 {
1158     PnvXive2 *xive = PNV_XIVE2(opaque);
1159     uint32_t reg = offset >> 3;
1160     uint8_t watch_engine;
1161 
1162     switch (offset) {
1163     /*
1164      * VSD table settings.
1165      */
1166     case VC_VSD_TABLE_ADDR:
1167        break;
1168     case VC_VSD_TABLE_DATA:
1169         pnv_xive2_vst_set_data(xive, val);
1170         break;
1171 
1172     /*
1173      * ESB cache updates (not modeled)
1174      */
1175     /* case VC_ESBC_FLUSH_CTRL: */
1176     case VC_ESBC_FLUSH_POLL:
1177         xive->vc_regs[VC_ESBC_FLUSH_CTRL >> 3] |= VC_ESBC_FLUSH_CTRL_POLL_VALID;
1178         /* ESB update */
1179         break;
1180 
1181     case VC_ESBC_CFG:
1182         break;
1183 
1184     /*
1185      * EAS cache updates (not modeled)
1186      */
1187     /* case VC_EASC_FLUSH_CTRL: */
1188     case VC_EASC_FLUSH_POLL:
1189         xive->vc_regs[VC_EASC_FLUSH_CTRL >> 3] |= VC_EASC_FLUSH_CTRL_POLL_VALID;
1190         /* EAS update */
1191         break;
1192 
1193     case VC_ENDC_CFG:
1194         break;
1195 
1196     /*
1197      * END cache updates
1198      */
1199     case VC_ENDC_WATCH0_SPEC:
1200     case VC_ENDC_WATCH1_SPEC:
1201     case VC_ENDC_WATCH2_SPEC:
1202     case VC_ENDC_WATCH3_SPEC:
1203          val &= ~VC_ENDC_WATCH_CONFLICT; /* HW will set this bit */
1204         break;
1205 
1206     case VC_ENDC_WATCH0_DATA1 ... VC_ENDC_WATCH0_DATA3:
1207     case VC_ENDC_WATCH1_DATA1 ... VC_ENDC_WATCH1_DATA3:
1208     case VC_ENDC_WATCH2_DATA1 ... VC_ENDC_WATCH2_DATA3:
1209     case VC_ENDC_WATCH3_DATA1 ... VC_ENDC_WATCH3_DATA3:
1210         break;
1211     case VC_ENDC_WATCH0_DATA0:
1212     case VC_ENDC_WATCH1_DATA0:
1213     case VC_ENDC_WATCH2_DATA0:
1214     case VC_ENDC_WATCH3_DATA0:
1215         /* writing to DATA0 triggers the cache write */
1216         watch_engine = (offset - VC_ENDC_WATCH0_DATA0) >> 6;
1217         xive->vc_regs[reg] = val;
1218         pnv_xive2_end_update(xive, watch_engine);
1219         break;
1220 
1221 
1222     /* case VC_ENDC_FLUSH_CTRL: */
1223     case VC_ENDC_FLUSH_POLL:
1224         xive->vc_regs[VC_ENDC_FLUSH_CTRL >> 3] |= VC_ENDC_FLUSH_CTRL_POLL_VALID;
1225         break;
1226 
1227     /*
1228      * Indirect invalidation
1229      */
1230     case VC_AT_MACRO_KILL:
1231     case VC_AT_MACRO_KILL_MASK:
1232         break;
1233 
1234     /*
1235      * Interrupt fifo overflow in memory backing store (Not modeled)
1236      */
1237     case VC_QUEUES_CFG_REM0 ... VC_QUEUES_CFG_REM6:
1238         break;
1239 
1240     /*
1241      * Synchronisation
1242      */
1243     case VC_ENDC_SYNC_DONE:
1244         break;
1245 
1246     default:
1247         xive2_error(xive, "VC: invalid write @%"HWADDR_PRIx, offset);
1248         return;
1249     }
1250 
1251     xive->vc_regs[reg] = val;
1252 }
1253 
1254 static const MemoryRegionOps pnv_xive2_ic_vc_ops = {
1255     .read = pnv_xive2_ic_vc_read,
1256     .write = pnv_xive2_ic_vc_write,
1257     .endianness = DEVICE_BIG_ENDIAN,
1258     .valid = {
1259         .min_access_size = 8,
1260         .max_access_size = 8,
1261     },
1262     .impl = {
1263         .min_access_size = 8,
1264         .max_access_size = 8,
1265     },
1266 };
1267 
1268 static uint8_t pnv_xive2_nxc_cache_watch_assign(PnvXive2 *xive)
1269 {
1270     uint64_t engine_mask = GETFIELD(PC_NXC_PROC_CONFIG_WATCH_ASSIGN,
1271                                     xive->pc_regs[PC_NXC_PROC_CONFIG >> 3]);
1272     uint64_t state = xive->pc_regs[PC_NXC_WATCH_ASSIGN >> 3];
1273     uint8_t val;
1274 
1275     /*
1276      * We keep track of which engines are currently busy in the
1277      * PC_NXC_WATCH_ASSIGN register directly. When the firmware reads
1278      * the register, we don't return its value but the ID of an engine
1279      * it can use.
1280      * There are 4 engines. 0xFF means no engine is available.
1281      */
1282     val = pnv_xive2_cache_watch_assign(engine_mask, &state);
1283     if (val != 0xFF) {
1284         xive->pc_regs[PC_NXC_WATCH_ASSIGN >> 3] = state;
1285     }
1286     return val;
1287 }
1288 
1289 static void pnv_xive2_nxc_cache_watch_release(PnvXive2 *xive,
1290                                               uint8_t watch_engine)
1291 {
1292     uint64_t state = xive->pc_regs[PC_NXC_WATCH_ASSIGN >> 3];
1293 
1294     pnv_xive2_cache_watch_release(&state, watch_engine);
1295     xive->pc_regs[PC_NXC_WATCH_ASSIGN >> 3] = state;
1296 }
1297 
1298 static uint64_t pnv_xive2_ic_pc_read(void *opaque, hwaddr offset,
1299                                      unsigned size)
1300 {
1301     PnvXive2 *xive = PNV_XIVE2(opaque);
1302     uint64_t val = -1;
1303     uint32_t reg = offset >> 3;
1304     uint8_t watch_engine;
1305 
1306     switch (offset) {
1307     /*
1308      * VSD table settings.
1309      */
1310     case PC_VSD_TABLE_ADDR:
1311     case PC_VSD_TABLE_DATA:
1312         val = xive->pc_regs[reg];
1313         break;
1314 
1315     case PC_NXC_WATCH_ASSIGN:
1316         val = pnv_xive2_nxc_cache_watch_assign(xive);
1317         break;
1318 
1319     case PC_NXC_PROC_CONFIG:
1320         val = xive->pc_regs[reg];
1321         break;
1322 
1323     /*
1324      * cache updates
1325      */
1326     case PC_NXC_WATCH0_SPEC:
1327     case PC_NXC_WATCH1_SPEC:
1328     case PC_NXC_WATCH2_SPEC:
1329     case PC_NXC_WATCH3_SPEC:
1330         watch_engine = (offset - PC_NXC_WATCH0_SPEC) >> 6;
1331         xive->pc_regs[reg] &= ~(PC_NXC_WATCH_FULL | PC_NXC_WATCH_CONFLICT);
1332         pnv_xive2_nxc_cache_watch_release(xive, watch_engine);
1333         val = xive->pc_regs[reg];
1334         break;
1335 
1336     case PC_NXC_WATCH0_DATA0:
1337     case PC_NXC_WATCH1_DATA0:
1338     case PC_NXC_WATCH2_DATA0:
1339     case PC_NXC_WATCH3_DATA0:
1340        /*
1341         * Load DATA registers from cache with data requested by the
1342         * SPEC register
1343         */
1344         watch_engine = (offset - PC_NXC_WATCH0_DATA0) >> 6;
1345         pnv_xive2_nvp_cache_load(xive, watch_engine);
1346         val = xive->pc_regs[reg];
1347         break;
1348 
1349     case PC_NXC_WATCH0_DATA1 ... PC_NXC_WATCH0_DATA3:
1350     case PC_NXC_WATCH1_DATA1 ... PC_NXC_WATCH1_DATA3:
1351     case PC_NXC_WATCH2_DATA1 ... PC_NXC_WATCH2_DATA3:
1352     case PC_NXC_WATCH3_DATA1 ... PC_NXC_WATCH3_DATA3:
1353         val = xive->pc_regs[reg];
1354         break;
1355 
1356     case PC_NXC_FLUSH_CTRL:
1357         xive->pc_regs[reg] &= ~PC_NXC_FLUSH_CTRL_POLL_VALID;
1358         val = xive->pc_regs[reg];
1359         break;
1360 
1361     /*
1362      * Indirect invalidation
1363      */
1364     case PC_AT_KILL:
1365         xive->pc_regs[reg] &= ~PC_AT_KILL_VALID;
1366         val = xive->pc_regs[reg];
1367         break;
1368 
1369     default:
1370         xive2_error(xive, "PC: invalid read @%"HWADDR_PRIx, offset);
1371     }
1372 
1373     return val;
1374 }
1375 
1376 static void pnv_xive2_ic_pc_write(void *opaque, hwaddr offset,
1377                                   uint64_t val, unsigned size)
1378 {
1379     PnvXive2 *xive = PNV_XIVE2(opaque);
1380     uint32_t reg = offset >> 3;
1381     uint8_t watch_engine;
1382 
1383     switch (offset) {
1384 
1385     /*
1386      * VSD table settings. Only taken into account in the VC
1387      * sub-engine because the Xive2Router model combines both VC and PC
1388      * sub-engines
1389      */
1390     case PC_VSD_TABLE_ADDR:
1391     case PC_VSD_TABLE_DATA:
1392         break;
1393 
1394     case PC_NXC_PROC_CONFIG:
1395         break;
1396 
1397     /*
1398      * cache updates
1399      */
1400     case PC_NXC_WATCH0_SPEC:
1401     case PC_NXC_WATCH1_SPEC:
1402     case PC_NXC_WATCH2_SPEC:
1403     case PC_NXC_WATCH3_SPEC:
1404         val &= ~PC_NXC_WATCH_CONFLICT; /* HW will set this bit */
1405         break;
1406 
1407     case PC_NXC_WATCH0_DATA1 ... PC_NXC_WATCH0_DATA3:
1408     case PC_NXC_WATCH1_DATA1 ... PC_NXC_WATCH1_DATA3:
1409     case PC_NXC_WATCH2_DATA1 ... PC_NXC_WATCH2_DATA3:
1410     case PC_NXC_WATCH3_DATA1 ... PC_NXC_WATCH3_DATA3:
1411         break;
1412     case PC_NXC_WATCH0_DATA0:
1413     case PC_NXC_WATCH1_DATA0:
1414     case PC_NXC_WATCH2_DATA0:
1415     case PC_NXC_WATCH3_DATA0:
1416         /* writing to DATA0 triggers the cache write */
1417         watch_engine = (offset - PC_NXC_WATCH0_DATA0) >> 6;
1418         xive->pc_regs[reg] = val;
1419         pnv_xive2_nvp_update(xive, watch_engine);
1420         break;
1421 
1422    /* case PC_NXC_FLUSH_CTRL: */
1423     case PC_NXC_FLUSH_POLL:
1424         xive->pc_regs[PC_NXC_FLUSH_CTRL >> 3] |= PC_NXC_FLUSH_CTRL_POLL_VALID;
1425         break;
1426 
1427     /*
1428      * Indirect invalidation
1429      */
1430     case PC_AT_KILL:
1431     case PC_AT_KILL_MASK:
1432         break;
1433 
1434     default:
1435         xive2_error(xive, "PC: invalid write @%"HWADDR_PRIx, offset);
1436         return;
1437     }
1438 
1439     xive->pc_regs[reg] = val;
1440 }
1441 
1442 static const MemoryRegionOps pnv_xive2_ic_pc_ops = {
1443     .read = pnv_xive2_ic_pc_read,
1444     .write = pnv_xive2_ic_pc_write,
1445     .endianness = DEVICE_BIG_ENDIAN,
1446     .valid = {
1447         .min_access_size = 8,
1448         .max_access_size = 8,
1449     },
1450     .impl = {
1451         .min_access_size = 8,
1452         .max_access_size = 8,
1453     },
1454 };
1455 
1456 
1457 static uint64_t pnv_xive2_ic_tctxt_read(void *opaque, hwaddr offset,
1458                                         unsigned size)
1459 {
1460     PnvXive2 *xive = PNV_XIVE2(opaque);
1461     uint64_t val = -1;
1462     uint32_t reg = offset >> 3;
1463 
1464     switch (offset) {
1465     /*
1466      * XIVE2 hardware thread enablement
1467      */
1468     case TCTXT_EN0:
1469     case TCTXT_EN1:
1470         val = xive->tctxt_regs[reg];
1471         break;
1472 
1473     case TCTXT_EN0_SET:
1474     case TCTXT_EN0_RESET:
1475         val = xive->tctxt_regs[TCTXT_EN0 >> 3];
1476         break;
1477     case TCTXT_EN1_SET:
1478     case TCTXT_EN1_RESET:
1479         val = xive->tctxt_regs[TCTXT_EN1 >> 3];
1480         break;
1481     case TCTXT_CFG:
1482         val = xive->tctxt_regs[reg];
1483         break;
1484     default:
1485         xive2_error(xive, "TCTXT: invalid read @%"HWADDR_PRIx, offset);
1486     }
1487 
1488     return val;
1489 }
1490 
1491 static void pnv_xive2_ic_tctxt_write(void *opaque, hwaddr offset,
1492                                      uint64_t val, unsigned size)
1493 {
1494     PnvXive2 *xive = PNV_XIVE2(opaque);
1495     uint32_t reg = offset >> 3;
1496 
1497     switch (offset) {
1498     /*
1499      * XIVE2 hardware thread enablement
1500      */
1501     case TCTXT_EN0: /* Physical Thread Enable */
1502     case TCTXT_EN1: /* Physical Thread Enable (fused core) */
1503         xive->tctxt_regs[reg] = val;
1504         break;
1505 
1506     case TCTXT_EN0_SET:
1507         xive->tctxt_regs[TCTXT_EN0 >> 3] |= val;
1508         break;
1509     case TCTXT_EN1_SET:
1510         xive->tctxt_regs[TCTXT_EN1 >> 3] |= val;
1511         break;
1512     case TCTXT_EN0_RESET:
1513         xive->tctxt_regs[TCTXT_EN0 >> 3] &= ~val;
1514         break;
1515     case TCTXT_EN1_RESET:
1516         xive->tctxt_regs[TCTXT_EN1 >> 3] &= ~val;
1517         break;
1518     case TCTXT_CFG:
1519         xive->tctxt_regs[reg] = val;
1520         break;
1521     default:
1522         xive2_error(xive, "TCTXT: invalid write @%"HWADDR_PRIx, offset);
1523         return;
1524     }
1525 }
1526 
1527 static const MemoryRegionOps pnv_xive2_ic_tctxt_ops = {
1528     .read = pnv_xive2_ic_tctxt_read,
1529     .write = pnv_xive2_ic_tctxt_write,
1530     .endianness = DEVICE_BIG_ENDIAN,
1531     .valid = {
1532         .min_access_size = 8,
1533         .max_access_size = 8,
1534     },
1535     .impl = {
1536         .min_access_size = 8,
1537         .max_access_size = 8,
1538     },
1539 };
1540 
1541 /*
1542  * Redirect XSCOM to MMIO handlers
1543  */
1544 static uint64_t pnv_xive2_xscom_read(void *opaque, hwaddr offset,
1545                                      unsigned size)
1546 {
1547     PnvXive2 *xive = PNV_XIVE2(opaque);
1548     uint64_t val = -1;
1549     uint32_t xscom_reg = offset >> 3;
1550     uint32_t mmio_offset = (xscom_reg & 0xFF) << 3;
1551 
1552     switch (xscom_reg) {
1553     case 0x000 ... 0x0FF:
1554         val = pnv_xive2_ic_cq_read(opaque, mmio_offset, size);
1555         break;
1556     case 0x100 ... 0x1FF:
1557         val = pnv_xive2_ic_vc_read(opaque, mmio_offset, size);
1558         break;
1559     case 0x200 ... 0x2FF:
1560         val = pnv_xive2_ic_pc_read(opaque, mmio_offset, size);
1561         break;
1562     case 0x300 ... 0x3FF:
1563         val = pnv_xive2_ic_tctxt_read(opaque, mmio_offset, size);
1564         break;
1565     default:
1566         xive2_error(xive, "XSCOM: invalid read @%"HWADDR_PRIx, offset);
1567     }
1568 
1569     return val;
1570 }
1571 
1572 static void pnv_xive2_xscom_write(void *opaque, hwaddr offset,
1573                                   uint64_t val, unsigned size)
1574 {
1575     PnvXive2 *xive = PNV_XIVE2(opaque);
1576     uint32_t xscom_reg = offset >> 3;
1577     uint32_t mmio_offset = (xscom_reg & 0xFF) << 3;
1578 
1579     switch (xscom_reg) {
1580     case 0x000 ... 0x0FF:
1581         pnv_xive2_ic_cq_write(opaque, mmio_offset, val, size);
1582         break;
1583     case 0x100 ... 0x1FF:
1584         pnv_xive2_ic_vc_write(opaque, mmio_offset, val, size);
1585         break;
1586     case 0x200 ... 0x2FF:
1587         pnv_xive2_ic_pc_write(opaque, mmio_offset, val, size);
1588         break;
1589     case 0x300 ... 0x3FF:
1590         pnv_xive2_ic_tctxt_write(opaque, mmio_offset, val, size);
1591         break;
1592     default:
1593         xive2_error(xive, "XSCOM: invalid write @%"HWADDR_PRIx, offset);
1594     }
1595 }
1596 
1597 static const MemoryRegionOps pnv_xive2_xscom_ops = {
1598     .read = pnv_xive2_xscom_read,
1599     .write = pnv_xive2_xscom_write,
1600     .endianness = DEVICE_BIG_ENDIAN,
1601     .valid = {
1602         .min_access_size = 8,
1603         .max_access_size = 8,
1604     },
1605     .impl = {
1606         .min_access_size = 8,
1607         .max_access_size = 8,
1608     },
1609 };
1610 
1611 /*
1612  * Notify port page. The layout is compatible between 4K and 64K pages :
1613  *
1614  * Page 1           Notify page (writes only)
1615  *  0x000 - 0x7FF   IPI interrupt (NPU)
1616  *  0x800 - 0xFFF   HW interrupt triggers (PSI, PHB)
1617  */
1618 
1619 static void pnv_xive2_ic_hw_trigger(PnvXive2 *xive, hwaddr addr,
1620                                     uint64_t val)
1621 {
1622     uint8_t blk;
1623     uint32_t idx;
1624 
1625     if (val & XIVE_TRIGGER_END) {
1626         xive2_error(xive, "IC: END trigger at @0x%"HWADDR_PRIx" data 0x%"PRIx64,
1627                    addr, val);
1628         return;
1629     }
1630 
1631     /*
1632      * Forward the source event notification directly to the Router.
1633      * The source interrupt number should already be correctly encoded
1634      * with the chip block id by the sending device (PHB, PSI).
1635      */
1636     blk = XIVE_EAS_BLOCK(val);
1637     idx = XIVE_EAS_INDEX(val);
1638 
1639     xive2_router_notify(XIVE_NOTIFIER(xive), XIVE_EAS(blk, idx),
1640                          !!(val & XIVE_TRIGGER_PQ));
1641 }
1642 
1643 static void pnv_xive2_ic_notify_write(void *opaque, hwaddr offset,
1644                                       uint64_t val, unsigned size)
1645 {
1646     PnvXive2 *xive = PNV_XIVE2(opaque);
1647 
1648     /* VC: IPI triggers */
1649     switch (offset) {
1650     case 0x000 ... 0x7FF:
1651         /* TODO: check IPI notify sub-page routing */
1652         pnv_xive2_ic_hw_trigger(opaque, offset, val);
1653         break;
1654 
1655     /* VC: HW triggers */
1656     case 0x800 ... 0xFFF:
1657         pnv_xive2_ic_hw_trigger(opaque, offset, val);
1658         break;
1659 
1660     default:
1661         xive2_error(xive, "NOTIFY: invalid write @%"HWADDR_PRIx, offset);
1662     }
1663 }
1664 
1665 static uint64_t pnv_xive2_ic_notify_read(void *opaque, hwaddr offset,
1666                                          unsigned size)
1667 {
1668     PnvXive2 *xive = PNV_XIVE2(opaque);
1669 
1670    /* loads are invalid */
1671     xive2_error(xive, "NOTIFY: invalid read @%"HWADDR_PRIx, offset);
1672     return -1;
1673 }
1674 
1675 static const MemoryRegionOps pnv_xive2_ic_notify_ops = {
1676     .read = pnv_xive2_ic_notify_read,
1677     .write = pnv_xive2_ic_notify_write,
1678     .endianness = DEVICE_BIG_ENDIAN,
1679     .valid = {
1680         .min_access_size = 8,
1681         .max_access_size = 8,
1682     },
1683     .impl = {
1684         .min_access_size = 8,
1685         .max_access_size = 8,
1686     },
1687 };
1688 
1689 static uint64_t pnv_xive2_ic_lsi_read(void *opaque, hwaddr offset,
1690                                       unsigned size)
1691 {
1692     PnvXive2 *xive = PNV_XIVE2(opaque);
1693 
1694     xive2_error(xive, "LSI: invalid read @%"HWADDR_PRIx, offset);
1695     return -1;
1696 }
1697 
1698 static void pnv_xive2_ic_lsi_write(void *opaque, hwaddr offset,
1699                                    uint64_t val, unsigned size)
1700 {
1701     PnvXive2 *xive = PNV_XIVE2(opaque);
1702 
1703     xive2_error(xive, "LSI: invalid write @%"HWADDR_PRIx, offset);
1704 }
1705 
1706 static const MemoryRegionOps pnv_xive2_ic_lsi_ops = {
1707     .read = pnv_xive2_ic_lsi_read,
1708     .write = pnv_xive2_ic_lsi_write,
1709     .endianness = DEVICE_BIG_ENDIAN,
1710     .valid = {
1711         .min_access_size = 8,
1712         .max_access_size = 8,
1713     },
1714     .impl = {
1715         .min_access_size = 8,
1716         .max_access_size = 8,
1717     },
1718 };
1719 
1720 /*
1721  * Sync MMIO page (write only)
1722  */
1723 #define PNV_XIVE2_SYNC_IPI              0x000
1724 #define PNV_XIVE2_SYNC_HW               0x080
1725 #define PNV_XIVE2_SYNC_NxC              0x100
1726 #define PNV_XIVE2_SYNC_INT              0x180
1727 #define PNV_XIVE2_SYNC_OS_ESC           0x200
1728 #define PNV_XIVE2_SYNC_POOL_ESC         0x280
1729 #define PNV_XIVE2_SYNC_HARD_ESC         0x300
1730 
1731 static uint64_t pnv_xive2_ic_sync_read(void *opaque, hwaddr offset,
1732                                        unsigned size)
1733 {
1734     PnvXive2 *xive = PNV_XIVE2(opaque);
1735 
1736     /* loads are invalid */
1737     xive2_error(xive, "SYNC: invalid read @%"HWADDR_PRIx, offset);
1738     return -1;
1739 }
1740 
1741 static void pnv_xive2_ic_sync_write(void *opaque, hwaddr offset,
1742                                     uint64_t val, unsigned size)
1743 {
1744     PnvXive2 *xive = PNV_XIVE2(opaque);
1745 
1746     switch (offset) {
1747     case PNV_XIVE2_SYNC_IPI:
1748     case PNV_XIVE2_SYNC_HW:
1749     case PNV_XIVE2_SYNC_NxC:
1750     case PNV_XIVE2_SYNC_INT:
1751     case PNV_XIVE2_SYNC_OS_ESC:
1752     case PNV_XIVE2_SYNC_POOL_ESC:
1753     case PNV_XIVE2_SYNC_HARD_ESC:
1754         break;
1755     default:
1756         xive2_error(xive, "SYNC: invalid write @%"HWADDR_PRIx, offset);
1757     }
1758 }
1759 
1760 static const MemoryRegionOps pnv_xive2_ic_sync_ops = {
1761     .read = pnv_xive2_ic_sync_read,
1762     .write = pnv_xive2_ic_sync_write,
1763     .endianness = DEVICE_BIG_ENDIAN,
1764     .valid = {
1765         .min_access_size = 8,
1766         .max_access_size = 8,
1767     },
1768     .impl = {
1769         .min_access_size = 8,
1770         .max_access_size = 8,
1771     },
1772 };
1773 
1774 /*
1775  * When the TM direct pages of the IC controller are accessed, the
1776  * target HW thread is deduced from the page offset.
1777  */
1778 static uint32_t pnv_xive2_ic_tm_get_pir(PnvXive2 *xive, hwaddr offset)
1779 {
1780     /* On P10, the node ID shift in the PIR register is 8 bits */
1781     return xive->chip->chip_id << 8 | offset >> xive->ic_shift;
1782 }
1783 
1784 static uint32_t pnv_xive2_ic_tm_get_hw_page_offset(PnvXive2 *xive,
1785                                                    hwaddr offset)
1786 {
1787     /*
1788      * Indirect TIMA accesses are similar to direct accesses for
1789      * privilege ring 0. So remove any traces of the hw thread ID from
1790      * the offset in the IC BAR as it could be interpreted as the ring
1791      * privilege when calling the underlying direct access functions.
1792      */
1793     return offset & ((1ull << xive->ic_shift) - 1);
1794 }
1795 
1796 static XiveTCTX *pnv_xive2_get_indirect_tctx(PnvXive2 *xive, uint32_t pir)
1797 {
1798     PnvChip *chip = xive->chip;
1799     PowerPCCPU *cpu = NULL;
1800 
1801     cpu = pnv_chip_find_cpu(chip, pir);
1802     if (!cpu) {
1803         xive2_error(xive, "IC: invalid PIR %x for indirect access", pir);
1804         return NULL;
1805     }
1806 
1807     if (!pnv_xive2_is_cpu_enabled(xive, cpu)) {
1808         xive2_error(xive, "IC: CPU %x is not enabled", pir);
1809     }
1810 
1811     return XIVE_TCTX(pnv_cpu_state(cpu)->intc);
1812 }
1813 
1814 static uint64_t pnv_xive2_ic_tm_indirect_read(void *opaque, hwaddr offset,
1815                                               unsigned size)
1816 {
1817     PnvXive2 *xive = PNV_XIVE2(opaque);
1818     XivePresenter *xptr = XIVE_PRESENTER(xive);
1819     hwaddr hw_page_offset;
1820     uint32_t pir;
1821     XiveTCTX *tctx;
1822     uint64_t val = -1;
1823 
1824     pir = pnv_xive2_ic_tm_get_pir(xive, offset);
1825     hw_page_offset = pnv_xive2_ic_tm_get_hw_page_offset(xive, offset);
1826     tctx = pnv_xive2_get_indirect_tctx(xive, pir);
1827     if (tctx) {
1828         val = xive_tctx_tm_read(xptr, tctx, hw_page_offset, size);
1829     }
1830 
1831     return val;
1832 }
1833 
1834 static void pnv_xive2_ic_tm_indirect_write(void *opaque, hwaddr offset,
1835                                            uint64_t val, unsigned size)
1836 {
1837     PnvXive2 *xive = PNV_XIVE2(opaque);
1838     XivePresenter *xptr = XIVE_PRESENTER(xive);
1839     hwaddr hw_page_offset;
1840     uint32_t pir;
1841     XiveTCTX *tctx;
1842 
1843     pir = pnv_xive2_ic_tm_get_pir(xive, offset);
1844     hw_page_offset = pnv_xive2_ic_tm_get_hw_page_offset(xive, offset);
1845     tctx = pnv_xive2_get_indirect_tctx(xive, pir);
1846     if (tctx) {
1847         xive_tctx_tm_write(xptr, tctx, hw_page_offset, val, size);
1848     }
1849 }
1850 
1851 static const MemoryRegionOps pnv_xive2_ic_tm_indirect_ops = {
1852     .read = pnv_xive2_ic_tm_indirect_read,
1853     .write = pnv_xive2_ic_tm_indirect_write,
1854     .endianness = DEVICE_BIG_ENDIAN,
1855     .valid = {
1856         .min_access_size = 1,
1857         .max_access_size = 8,
1858     },
1859     .impl = {
1860         .min_access_size = 1,
1861         .max_access_size = 8,
1862     },
1863 };
1864 
1865 /*
1866  * TIMA ops
1867  */
1868 static void pnv_xive2_tm_write(void *opaque, hwaddr offset,
1869                                uint64_t value, unsigned size)
1870 {
1871     PowerPCCPU *cpu = POWERPC_CPU(current_cpu);
1872     PnvXive2 *xive = pnv_xive2_tm_get_xive(cpu);
1873     XiveTCTX *tctx = XIVE_TCTX(pnv_cpu_state(cpu)->intc);
1874     XivePresenter *xptr = XIVE_PRESENTER(xive);
1875 
1876     xive_tctx_tm_write(xptr, tctx, offset, value, size);
1877 }
1878 
1879 static uint64_t pnv_xive2_tm_read(void *opaque, hwaddr offset, unsigned size)
1880 {
1881     PowerPCCPU *cpu = POWERPC_CPU(current_cpu);
1882     PnvXive2 *xive = pnv_xive2_tm_get_xive(cpu);
1883     XiveTCTX *tctx = XIVE_TCTX(pnv_cpu_state(cpu)->intc);
1884     XivePresenter *xptr = XIVE_PRESENTER(xive);
1885 
1886     return xive_tctx_tm_read(xptr, tctx, offset, size);
1887 }
1888 
1889 static const MemoryRegionOps pnv_xive2_tm_ops = {
1890     .read = pnv_xive2_tm_read,
1891     .write = pnv_xive2_tm_write,
1892     .endianness = DEVICE_BIG_ENDIAN,
1893     .valid = {
1894         .min_access_size = 1,
1895         .max_access_size = 8,
1896     },
1897     .impl = {
1898         .min_access_size = 1,
1899         .max_access_size = 8,
1900     },
1901 };
1902 
1903 static uint64_t pnv_xive2_nvc_read(void *opaque, hwaddr offset,
1904                                    unsigned size)
1905 {
1906     PnvXive2 *xive = PNV_XIVE2(opaque);
1907 
1908     xive2_error(xive, "NVC: invalid read @%"HWADDR_PRIx, offset);
1909     return -1;
1910 }
1911 
1912 static void pnv_xive2_nvc_write(void *opaque, hwaddr offset,
1913                                 uint64_t val, unsigned size)
1914 {
1915     PnvXive2 *xive = PNV_XIVE2(opaque);
1916 
1917     xive2_error(xive, "NVC: invalid write @%"HWADDR_PRIx, offset);
1918 }
1919 
1920 static const MemoryRegionOps pnv_xive2_nvc_ops = {
1921     .read = pnv_xive2_nvc_read,
1922     .write = pnv_xive2_nvc_write,
1923     .endianness = DEVICE_BIG_ENDIAN,
1924     .valid = {
1925         .min_access_size = 8,
1926         .max_access_size = 8,
1927     },
1928     .impl = {
1929         .min_access_size = 8,
1930         .max_access_size = 8,
1931     },
1932 };
1933 
1934 static uint64_t pnv_xive2_nvpg_read(void *opaque, hwaddr offset,
1935                                     unsigned size)
1936 {
1937     PnvXive2 *xive = PNV_XIVE2(opaque);
1938 
1939     xive2_error(xive, "NVPG: invalid read @%"HWADDR_PRIx, offset);
1940     return -1;
1941 }
1942 
1943 static void pnv_xive2_nvpg_write(void *opaque, hwaddr offset,
1944                                  uint64_t val, unsigned size)
1945 {
1946     PnvXive2 *xive = PNV_XIVE2(opaque);
1947 
1948     xive2_error(xive, "NVPG: invalid write @%"HWADDR_PRIx, offset);
1949 }
1950 
1951 static const MemoryRegionOps pnv_xive2_nvpg_ops = {
1952     .read = pnv_xive2_nvpg_read,
1953     .write = pnv_xive2_nvpg_write,
1954     .endianness = DEVICE_BIG_ENDIAN,
1955     .valid = {
1956         .min_access_size = 8,
1957         .max_access_size = 8,
1958     },
1959     .impl = {
1960         .min_access_size = 8,
1961         .max_access_size = 8,
1962     },
1963 };
1964 
1965 /*
1966  * POWER10 default capabilities: 0x2000120076f000FC
1967  */
1968 #define PNV_XIVE2_CAPABILITIES  0x2000120076f000FC
1969 
1970 /*
1971  * POWER10 default configuration: 0x0030000033000000
1972  *
1973  * 8bits thread id was dropped for P10
1974  */
1975 #define PNV_XIVE2_CONFIGURATION 0x0030000033000000
1976 
1977 static void pnv_xive2_reset(void *dev)
1978 {
1979     PnvXive2 *xive = PNV_XIVE2(dev);
1980     XiveSource *xsrc = &xive->ipi_source;
1981     Xive2EndSource *end_xsrc = &xive->end_source;
1982 
1983     xive->cq_regs[CQ_XIVE_CAP >> 3] = xive->capabilities;
1984     xive->cq_regs[CQ_XIVE_CFG >> 3] = xive->config;
1985 
1986     /* HW hardwires the #Topology of the chip in the block field */
1987     xive->cq_regs[CQ_XIVE_CFG >> 3] |=
1988         SETFIELD(CQ_XIVE_CFG_HYP_HARD_BLOCK_ID, 0ull, xive->chip->chip_id);
1989 
1990     /* VC and PC cache watch assign mechanism */
1991     xive->vc_regs[VC_ENDC_CFG >> 3] =
1992         SETFIELD(VC_ENDC_CFG_CACHE_WATCH_ASSIGN, 0ull, 0b0111);
1993     xive->pc_regs[PC_NXC_PROC_CONFIG >> 3] =
1994         SETFIELD(PC_NXC_PROC_CONFIG_WATCH_ASSIGN, 0ull, 0b0111);
1995 
1996     /* Set default page size to 64k */
1997     xive->ic_shift = xive->esb_shift = xive->end_shift = 16;
1998     xive->nvc_shift = xive->nvpg_shift = xive->tm_shift = 16;
1999 
2000     /* Clear source MMIOs */
2001     if (memory_region_is_mapped(&xsrc->esb_mmio)) {
2002         memory_region_del_subregion(&xive->esb_mmio, &xsrc->esb_mmio);
2003     }
2004 
2005     if (memory_region_is_mapped(&end_xsrc->esb_mmio)) {
2006         memory_region_del_subregion(&xive->end_mmio, &end_xsrc->esb_mmio);
2007     }
2008 }
2009 
2010 /*
2011  *  Maximum number of IRQs and ENDs supported by HW. Will be tuned by
2012  *  software.
2013  */
2014 #define PNV_XIVE2_NR_IRQS (PNV10_XIVE2_ESB_SIZE / (1ull << XIVE_ESB_64K_2PAGE))
2015 #define PNV_XIVE2_NR_ENDS (PNV10_XIVE2_END_SIZE / (1ull << XIVE_ESB_64K_2PAGE))
2016 
2017 static void pnv_xive2_realize(DeviceState *dev, Error **errp)
2018 {
2019     PnvXive2 *xive = PNV_XIVE2(dev);
2020     PnvXive2Class *pxc = PNV_XIVE2_GET_CLASS(dev);
2021     XiveSource *xsrc = &xive->ipi_source;
2022     Xive2EndSource *end_xsrc = &xive->end_source;
2023     Error *local_err = NULL;
2024     int i;
2025 
2026     pxc->parent_realize(dev, &local_err);
2027     if (local_err) {
2028         error_propagate(errp, local_err);
2029         return;
2030     }
2031 
2032     assert(xive->chip);
2033 
2034     /*
2035      * The XiveSource and Xive2EndSource objects are realized with the
2036      * maximum allowed HW configuration. The ESB MMIO regions will be
2037      * resized dynamically when the controller is configured by the FW
2038      * to limit accesses to resources not provisioned.
2039      */
2040     object_property_set_int(OBJECT(xsrc), "flags", XIVE_SRC_STORE_EOI,
2041                             &error_fatal);
2042     object_property_set_int(OBJECT(xsrc), "nr-irqs", PNV_XIVE2_NR_IRQS,
2043                             &error_fatal);
2044     object_property_set_link(OBJECT(xsrc), "xive", OBJECT(xive),
2045                              &error_fatal);
2046     qdev_realize(DEVICE(xsrc), NULL, &local_err);
2047     if (local_err) {
2048         error_propagate(errp, local_err);
2049         return;
2050     }
2051 
2052     object_property_set_int(OBJECT(end_xsrc), "nr-ends", PNV_XIVE2_NR_ENDS,
2053                             &error_fatal);
2054     object_property_set_link(OBJECT(end_xsrc), "xive", OBJECT(xive),
2055                              &error_abort);
2056     qdev_realize(DEVICE(end_xsrc), NULL, &local_err);
2057     if (local_err) {
2058         error_propagate(errp, local_err);
2059         return;
2060     }
2061 
2062     /* XSCOM region, used for initial configuration of the BARs */
2063     memory_region_init_io(&xive->xscom_regs, OBJECT(dev),
2064                           &pnv_xive2_xscom_ops, xive, "xscom-xive",
2065                           PNV10_XSCOM_XIVE2_SIZE << 3);
2066 
2067     /* Interrupt controller MMIO regions */
2068     xive->ic_shift = 16;
2069     memory_region_init(&xive->ic_mmio, OBJECT(dev), "xive-ic",
2070                        PNV10_XIVE2_IC_SIZE);
2071 
2072     for (i = 0; i < ARRAY_SIZE(xive->ic_mmios); i++) {
2073         memory_region_init_io(&xive->ic_mmios[i], OBJECT(dev),
2074                          pnv_xive2_ic_regions[i].ops, xive,
2075                          pnv_xive2_ic_regions[i].name,
2076                          pnv_xive2_ic_regions[i].pgsize << xive->ic_shift);
2077     }
2078 
2079     /*
2080      * VC MMIO regions.
2081      */
2082     xive->esb_shift = 16;
2083     xive->end_shift = 16;
2084     memory_region_init(&xive->esb_mmio, OBJECT(xive), "xive-esb",
2085                        PNV10_XIVE2_ESB_SIZE);
2086     memory_region_init(&xive->end_mmio, OBJECT(xive), "xive-end",
2087                        PNV10_XIVE2_END_SIZE);
2088 
2089     /* Presenter Controller MMIO region (not modeled) */
2090     xive->nvc_shift = 16;
2091     xive->nvpg_shift = 16;
2092     memory_region_init_io(&xive->nvc_mmio, OBJECT(dev),
2093                           &pnv_xive2_nvc_ops, xive,
2094                           "xive-nvc", PNV10_XIVE2_NVC_SIZE);
2095 
2096     memory_region_init_io(&xive->nvpg_mmio, OBJECT(dev),
2097                           &pnv_xive2_nvpg_ops, xive,
2098                           "xive-nvpg", PNV10_XIVE2_NVPG_SIZE);
2099 
2100     /* Thread Interrupt Management Area (Direct) */
2101     xive->tm_shift = 16;
2102     memory_region_init_io(&xive->tm_mmio, OBJECT(dev), &pnv_xive2_tm_ops,
2103                           xive, "xive-tima", PNV10_XIVE2_TM_SIZE);
2104 
2105     qemu_register_reset(pnv_xive2_reset, dev);
2106 }
2107 
2108 static Property pnv_xive2_properties[] = {
2109     DEFINE_PROP_UINT64("ic-bar", PnvXive2, ic_base, 0),
2110     DEFINE_PROP_UINT64("esb-bar", PnvXive2, esb_base, 0),
2111     DEFINE_PROP_UINT64("end-bar", PnvXive2, end_base, 0),
2112     DEFINE_PROP_UINT64("nvc-bar", PnvXive2, nvc_base, 0),
2113     DEFINE_PROP_UINT64("nvpg-bar", PnvXive2, nvpg_base, 0),
2114     DEFINE_PROP_UINT64("tm-bar", PnvXive2, tm_base, 0),
2115     DEFINE_PROP_UINT64("capabilities", PnvXive2, capabilities,
2116                        PNV_XIVE2_CAPABILITIES),
2117     DEFINE_PROP_UINT64("config", PnvXive2, config,
2118                        PNV_XIVE2_CONFIGURATION),
2119     DEFINE_PROP_LINK("chip", PnvXive2, chip, TYPE_PNV_CHIP, PnvChip *),
2120     DEFINE_PROP_END_OF_LIST(),
2121 };
2122 
2123 static void pnv_xive2_instance_init(Object *obj)
2124 {
2125     PnvXive2 *xive = PNV_XIVE2(obj);
2126 
2127     object_initialize_child(obj, "ipi_source", &xive->ipi_source,
2128                             TYPE_XIVE_SOURCE);
2129     object_initialize_child(obj, "end_source", &xive->end_source,
2130                             TYPE_XIVE2_END_SOURCE);
2131 }
2132 
2133 static int pnv_xive2_dt_xscom(PnvXScomInterface *dev, void *fdt,
2134                               int xscom_offset)
2135 {
2136     const char compat_p10[] = "ibm,power10-xive-x";
2137     char *name;
2138     int offset;
2139     uint32_t reg[] = {
2140         cpu_to_be32(PNV10_XSCOM_XIVE2_BASE),
2141         cpu_to_be32(PNV10_XSCOM_XIVE2_SIZE)
2142     };
2143 
2144     name = g_strdup_printf("xive@%x", PNV10_XSCOM_XIVE2_BASE);
2145     offset = fdt_add_subnode(fdt, xscom_offset, name);
2146     _FDT(offset);
2147     g_free(name);
2148 
2149     _FDT((fdt_setprop(fdt, offset, "reg", reg, sizeof(reg))));
2150     _FDT(fdt_setprop(fdt, offset, "compatible", compat_p10,
2151                      sizeof(compat_p10)));
2152     return 0;
2153 }
2154 
2155 static void pnv_xive2_class_init(ObjectClass *klass, void *data)
2156 {
2157     DeviceClass *dc = DEVICE_CLASS(klass);
2158     PnvXScomInterfaceClass *xdc = PNV_XSCOM_INTERFACE_CLASS(klass);
2159     Xive2RouterClass *xrc = XIVE2_ROUTER_CLASS(klass);
2160     XiveNotifierClass *xnc = XIVE_NOTIFIER_CLASS(klass);
2161     XivePresenterClass *xpc = XIVE_PRESENTER_CLASS(klass);
2162     PnvXive2Class *pxc = PNV_XIVE2_CLASS(klass);
2163 
2164     xdc->dt_xscom  = pnv_xive2_dt_xscom;
2165 
2166     dc->desc       = "PowerNV XIVE2 Interrupt Controller (POWER10)";
2167     device_class_set_parent_realize(dc, pnv_xive2_realize,
2168                                     &pxc->parent_realize);
2169     device_class_set_props(dc, pnv_xive2_properties);
2170 
2171     xrc->get_eas   = pnv_xive2_get_eas;
2172     xrc->get_pq    = pnv_xive2_get_pq;
2173     xrc->set_pq    = pnv_xive2_set_pq;
2174     xrc->get_end   = pnv_xive2_get_end;
2175     xrc->write_end = pnv_xive2_write_end;
2176     xrc->get_nvp   = pnv_xive2_get_nvp;
2177     xrc->write_nvp = pnv_xive2_write_nvp;
2178     xrc->get_config  = pnv_xive2_get_config;
2179     xrc->get_block_id = pnv_xive2_get_block_id;
2180 
2181     xnc->notify    = pnv_xive2_notify;
2182 
2183     xpc->match_nvt  = pnv_xive2_match_nvt;
2184     xpc->get_config = pnv_xive2_presenter_get_config;
2185 };
2186 
2187 static const TypeInfo pnv_xive2_info = {
2188     .name          = TYPE_PNV_XIVE2,
2189     .parent        = TYPE_XIVE2_ROUTER,
2190     .instance_init = pnv_xive2_instance_init,
2191     .instance_size = sizeof(PnvXive2),
2192     .class_init    = pnv_xive2_class_init,
2193     .class_size    = sizeof(PnvXive2Class),
2194     .interfaces    = (InterfaceInfo[]) {
2195         { TYPE_PNV_XSCOM_INTERFACE },
2196         { }
2197     }
2198 };
2199 
2200 static void pnv_xive2_register_types(void)
2201 {
2202     type_register_static(&pnv_xive2_info);
2203 }
2204 
2205 type_init(pnv_xive2_register_types)
2206 
2207 static void xive2_nvp_pic_print_info(Xive2Nvp *nvp, uint32_t nvp_idx,
2208                                      GString *buf)
2209 {
2210     uint8_t  eq_blk = xive_get_field32(NVP2_W5_VP_END_BLOCK, nvp->w5);
2211     uint32_t eq_idx = xive_get_field32(NVP2_W5_VP_END_INDEX, nvp->w5);
2212 
2213     if (!xive2_nvp_is_valid(nvp)) {
2214         return;
2215     }
2216 
2217     g_string_append_printf(buf, "  %08x end:%02x/%04x IPB:%02x",
2218                            nvp_idx, eq_blk, eq_idx,
2219                            xive_get_field32(NVP2_W2_IPB, nvp->w2));
2220     /*
2221      * When the NVP is HW controlled, more fields are updated
2222      */
2223     if (xive2_nvp_is_hw(nvp)) {
2224         g_string_append_printf(buf, " CPPR:%02x",
2225                                xive_get_field32(NVP2_W2_CPPR, nvp->w2));
2226         if (xive2_nvp_is_co(nvp)) {
2227             g_string_append_printf(buf, " CO:%04x",
2228                                    xive_get_field32(NVP2_W1_CO_THRID, nvp->w1));
2229         }
2230     }
2231     g_string_append_c(buf, '\n');
2232 }
2233 
2234 /*
2235  * If the table is direct, we can compute the number of PQ entries
2236  * provisioned by FW.
2237  */
2238 static uint32_t pnv_xive2_nr_esbs(PnvXive2 *xive)
2239 {
2240     uint8_t blk = pnv_xive2_block_id(xive);
2241     uint64_t vsd = xive->vsds[VST_ESB][blk];
2242     uint64_t vst_tsize = 1ull << (GETFIELD(VSD_TSIZE, vsd) + 12);
2243 
2244     return VSD_INDIRECT & vsd ? 0 : vst_tsize * SBE_PER_BYTE;
2245 }
2246 
2247 /*
2248  * Compute the number of entries per indirect subpage.
2249  */
2250 static uint64_t pnv_xive2_vst_per_subpage(PnvXive2 *xive, uint32_t type)
2251 {
2252     uint8_t blk = pnv_xive2_block_id(xive);
2253     uint64_t vsd = xive->vsds[type][blk];
2254     const XiveVstInfo *info = &vst_infos[type];
2255     uint64_t vsd_addr;
2256     uint32_t page_shift;
2257 
2258     /* For direct tables, fake a valid value */
2259     if (!(VSD_INDIRECT & vsd)) {
2260         return 1;
2261     }
2262 
2263     /* Get the page size of the indirect table. */
2264     vsd_addr = vsd & VSD_ADDRESS_MASK;
2265     ldq_be_dma(&address_space_memory, vsd_addr, &vsd, MEMTXATTRS_UNSPECIFIED);
2266 
2267     if (!(vsd & VSD_ADDRESS_MASK)) {
2268 #ifdef XIVE2_DEBUG
2269         xive2_error(xive, "VST: invalid %s entry!?", info->name);
2270 #endif
2271         return 0;
2272     }
2273 
2274     page_shift = GETFIELD(VSD_TSIZE, vsd) + 12;
2275 
2276     if (!pnv_xive2_vst_page_size_allowed(page_shift)) {
2277         xive2_error(xive, "VST: invalid %s page shift %d", info->name,
2278                    page_shift);
2279         return 0;
2280     }
2281 
2282     return (1ull << page_shift) / info->size;
2283 }
2284 
2285 void pnv_xive2_pic_print_info(PnvXive2 *xive, GString *buf)
2286 {
2287     Xive2Router *xrtr = XIVE2_ROUTER(xive);
2288     uint8_t blk = pnv_xive2_block_id(xive);
2289     uint8_t chip_id = xive->chip->chip_id;
2290     uint32_t srcno0 = XIVE_EAS(blk, 0);
2291     uint32_t nr_esbs = pnv_xive2_nr_esbs(xive);
2292     Xive2Eas eas;
2293     Xive2End end;
2294     Xive2Nvp nvp;
2295     int i;
2296     uint64_t xive_nvp_per_subpage;
2297 
2298     g_string_append_printf(buf, "XIVE[%x] Source %08x .. %08x\n",
2299                            blk, srcno0, srcno0 + nr_esbs - 1);
2300     xive_source_pic_print_info(&xive->ipi_source, srcno0, buf);
2301 
2302     g_string_append_printf(buf, "XIVE[%x] EAT %08x .. %08x\n",
2303                            blk, srcno0, srcno0 + nr_esbs - 1);
2304     for (i = 0; i < nr_esbs; i++) {
2305         if (xive2_router_get_eas(xrtr, blk, i, &eas)) {
2306             break;
2307         }
2308         if (!xive2_eas_is_masked(&eas)) {
2309             xive2_eas_pic_print_info(&eas, i, buf);
2310         }
2311     }
2312 
2313     g_string_append_printf(buf, "XIVE[%x] #%d END Escalation EAT\n",
2314                            chip_id, blk);
2315     i = 0;
2316     while (!xive2_router_get_end(xrtr, blk, i, &end)) {
2317         xive2_end_eas_pic_print_info(&end, i++, buf);
2318     }
2319 
2320     g_string_append_printf(buf, "XIVE[%x] #%d ENDT\n", chip_id, blk);
2321     i = 0;
2322     while (!xive2_router_get_end(xrtr, blk, i, &end)) {
2323         xive2_end_pic_print_info(&end, i++, buf);
2324     }
2325 
2326     g_string_append_printf(buf, "XIVE[%x] #%d NVPT %08x .. %08x\n",
2327                            chip_id, blk, 0, XIVE2_NVP_COUNT - 1);
2328     xive_nvp_per_subpage = pnv_xive2_vst_per_subpage(xive, VST_NVP);
2329     for (i = 0; i < XIVE2_NVP_COUNT; i += xive_nvp_per_subpage) {
2330         while (!xive2_router_get_nvp(xrtr, blk, i, &nvp)) {
2331             xive2_nvp_pic_print_info(&nvp, i++, buf);
2332         }
2333     }
2334 }
2335