xref: /openbmc/qemu/hw/intc/pnv_xive2.c (revision 795eaa62)
1 /*
2  * QEMU PowerPC XIVE2 interrupt controller model  (POWER10)
3  *
4  * Copyright (c) 2019-2022, IBM Corporation.
5  *
6  * This code is licensed under the GPL version 2 or later. See the
7  * COPYING file in the top-level directory.
8  */
9 
10 #include "qemu/osdep.h"
11 #include "qemu/log.h"
12 #include "qapi/error.h"
13 #include "target/ppc/cpu.h"
14 #include "sysemu/cpus.h"
15 #include "sysemu/dma.h"
16 #include "hw/ppc/fdt.h"
17 #include "hw/ppc/pnv.h"
18 #include "hw/ppc/pnv_chip.h"
19 #include "hw/ppc/pnv_core.h"
20 #include "hw/ppc/pnv_xscom.h"
21 #include "hw/ppc/xive2.h"
22 #include "hw/ppc/pnv_xive.h"
23 #include "hw/ppc/xive_regs.h"
24 #include "hw/ppc/xive2_regs.h"
25 #include "hw/ppc/ppc.h"
26 #include "hw/qdev-properties.h"
27 #include "sysemu/reset.h"
28 
29 #include <libfdt.h>
30 
31 #include "pnv_xive2_regs.h"
32 
33 #undef XIVE2_DEBUG
34 
35 /*
36  * Virtual structures table (VST)
37  */
38 #define SBE_PER_BYTE   4
39 
40 typedef struct XiveVstInfo {
41     const char *name;
42     uint32_t    size;
43     uint32_t    max_blocks;
44 } XiveVstInfo;
45 
46 static const XiveVstInfo vst_infos[] = {
47 
48     [VST_EAS]  = { "EAT",  sizeof(Xive2Eas),  16 },
49     [VST_ESB]  = { "ESB",  1,                  16 },
50     [VST_END]  = { "ENDT", sizeof(Xive2End),  16 },
51 
52     [VST_NVP]  = { "NVPT", sizeof(Xive2Nvp),  16 },
53     [VST_NVG]  = { "NVGT", sizeof(Xive2Nvgc), 16 },
54     [VST_NVC]  = { "NVCT", sizeof(Xive2Nvgc), 16 },
55 
56     [VST_IC]  =  { "IC",   1 /* ? */         , 16 }, /* Topology # */
57     [VST_SYNC] = { "SYNC", 1 /* ? */         , 16 }, /* Topology # */
58 
59     /*
60      * This table contains the backing store pages for the interrupt
61      * fifos of the VC sub-engine in case of overflow.
62      *
63      * 0 - IPI,
64      * 1 - HWD,
65      * 2 - NxC,
66      * 3 - INT,
67      * 4 - OS-Queue,
68      * 5 - Pool-Queue,
69      * 6 - Hard-Queue
70      */
71     [VST_ERQ]  = { "ERQ",  1,                   VC_QUEUE_COUNT },
72 };
73 
74 #define xive2_error(xive, fmt, ...)                                      \
75     qemu_log_mask(LOG_GUEST_ERROR, "XIVE[%x] - " fmt "\n",              \
76                   (xive)->chip->chip_id, ## __VA_ARGS__);
77 
78 /*
79  * TODO: Document block id override
80  */
81 static uint32_t pnv_xive2_block_id(PnvXive2 *xive)
82 {
83     uint8_t blk = xive->chip->chip_id;
84     uint64_t cfg_val = xive->cq_regs[CQ_XIVE_CFG >> 3];
85 
86     if (cfg_val & CQ_XIVE_CFG_HYP_HARD_BLKID_OVERRIDE) {
87         blk = GETFIELD(CQ_XIVE_CFG_HYP_HARD_BLOCK_ID, cfg_val);
88     }
89 
90     return blk;
91 }
92 
93 /*
94  * Remote access to controllers. HW uses MMIOs. For now, a simple scan
95  * of the chips is good enough.
96  *
97  * TODO: Block scope support
98  */
99 static PnvXive2 *pnv_xive2_get_remote(uint8_t blk)
100 {
101     PnvMachineState *pnv = PNV_MACHINE(qdev_get_machine());
102     int i;
103 
104     for (i = 0; i < pnv->num_chips; i++) {
105         Pnv10Chip *chip10 = PNV10_CHIP(pnv->chips[i]);
106         PnvXive2 *xive = &chip10->xive;
107 
108         if (pnv_xive2_block_id(xive) == blk) {
109             return xive;
110         }
111     }
112     return NULL;
113 }
114 
115 /*
116  * VST accessors for ESB, EAT, ENDT, NVP
117  *
118  * Indirect VST tables are arrays of VSDs pointing to a page (of same
119  * size). Each page is a direct VST table.
120  */
121 
122 #define XIVE_VSD_SIZE 8
123 
124 /* Indirect page size can be 4K, 64K, 2M, 16M. */
125 static uint64_t pnv_xive2_vst_page_size_allowed(uint32_t page_shift)
126 {
127      return page_shift == 12 || page_shift == 16 ||
128          page_shift == 21 || page_shift == 24;
129 }
130 
131 static uint64_t pnv_xive2_vst_addr_direct(PnvXive2 *xive, uint32_t type,
132                                           uint64_t vsd, uint32_t idx)
133 {
134     const XiveVstInfo *info = &vst_infos[type];
135     uint64_t vst_addr = vsd & VSD_ADDRESS_MASK;
136     uint64_t vst_tsize = 1ull << (GETFIELD(VSD_TSIZE, vsd) + 12);
137     uint32_t idx_max;
138 
139     idx_max = vst_tsize / info->size - 1;
140     if (idx > idx_max) {
141 #ifdef XIVE2_DEBUG
142         xive2_error(xive, "VST: %s entry %x out of range [ 0 .. %x ] !?",
143                    info->name, idx, idx_max);
144 #endif
145         return 0;
146     }
147 
148     return vst_addr + idx * info->size;
149 }
150 
151 static uint64_t pnv_xive2_vst_addr_indirect(PnvXive2 *xive, uint32_t type,
152                                             uint64_t vsd, uint32_t idx)
153 {
154     const XiveVstInfo *info = &vst_infos[type];
155     uint64_t vsd_addr;
156     uint32_t vsd_idx;
157     uint32_t page_shift;
158     uint32_t vst_per_page;
159 
160     /* Get the page size of the indirect table. */
161     vsd_addr = vsd & VSD_ADDRESS_MASK;
162     ldq_be_dma(&address_space_memory, vsd_addr, &vsd, MEMTXATTRS_UNSPECIFIED);
163 
164     if (!(vsd & VSD_ADDRESS_MASK)) {
165 #ifdef XIVE2_DEBUG
166         xive2_error(xive, "VST: invalid %s entry %x !?", info->name, idx);
167 #endif
168         return 0;
169     }
170 
171     page_shift = GETFIELD(VSD_TSIZE, vsd) + 12;
172 
173     if (!pnv_xive2_vst_page_size_allowed(page_shift)) {
174         xive2_error(xive, "VST: invalid %s page shift %d", info->name,
175                    page_shift);
176         return 0;
177     }
178 
179     vst_per_page = (1ull << page_shift) / info->size;
180     vsd_idx = idx / vst_per_page;
181 
182     /* Load the VSD we are looking for, if not already done */
183     if (vsd_idx) {
184         vsd_addr = vsd_addr + vsd_idx * XIVE_VSD_SIZE;
185         ldq_be_dma(&address_space_memory, vsd_addr, &vsd,
186                    MEMTXATTRS_UNSPECIFIED);
187 
188         if (!(vsd & VSD_ADDRESS_MASK)) {
189 #ifdef XIVE2_DEBUG
190             xive2_error(xive, "VST: invalid %s entry %x !?", info->name, idx);
191 #endif
192             return 0;
193         }
194 
195         /*
196          * Check that the pages have a consistent size across the
197          * indirect table
198          */
199         if (page_shift != GETFIELD(VSD_TSIZE, vsd) + 12) {
200             xive2_error(xive, "VST: %s entry %x indirect page size differ !?",
201                        info->name, idx);
202             return 0;
203         }
204     }
205 
206     return pnv_xive2_vst_addr_direct(xive, type, vsd, (idx % vst_per_page));
207 }
208 
209 static uint64_t pnv_xive2_vst_addr(PnvXive2 *xive, uint32_t type, uint8_t blk,
210                                    uint32_t idx)
211 {
212     const XiveVstInfo *info = &vst_infos[type];
213     uint64_t vsd;
214 
215     if (blk >= info->max_blocks) {
216         xive2_error(xive, "VST: invalid block id %d for VST %s %d !?",
217                    blk, info->name, idx);
218         return 0;
219     }
220 
221     vsd = xive->vsds[type][blk];
222 
223     /* Remote VST access */
224     if (GETFIELD(VSD_MODE, vsd) == VSD_MODE_FORWARD) {
225         xive = pnv_xive2_get_remote(blk);
226 
227         return xive ? pnv_xive2_vst_addr(xive, type, blk, idx) : 0;
228     }
229 
230     if (VSD_INDIRECT & vsd) {
231         return pnv_xive2_vst_addr_indirect(xive, type, vsd, idx);
232     }
233 
234     return pnv_xive2_vst_addr_direct(xive, type, vsd, idx);
235 }
236 
237 static int pnv_xive2_vst_read(PnvXive2 *xive, uint32_t type, uint8_t blk,
238                              uint32_t idx, void *data)
239 {
240     const XiveVstInfo *info = &vst_infos[type];
241     uint64_t addr = pnv_xive2_vst_addr(xive, type, blk, idx);
242     MemTxResult result;
243 
244     if (!addr) {
245         return -1;
246     }
247 
248     result = address_space_read(&address_space_memory, addr,
249                                 MEMTXATTRS_UNSPECIFIED, data,
250                                 info->size);
251     if (result != MEMTX_OK) {
252         xive2_error(xive, "VST: read failed at @0x%" HWADDR_PRIx
253                    " for VST %s %x/%x\n", addr, info->name, blk, idx);
254         return -1;
255     }
256     return 0;
257 }
258 
259 #define XIVE_VST_WORD_ALL -1
260 
261 static int pnv_xive2_vst_write(PnvXive2 *xive, uint32_t type, uint8_t blk,
262                                uint32_t idx, void *data, uint32_t word_number)
263 {
264     const XiveVstInfo *info = &vst_infos[type];
265     uint64_t addr = pnv_xive2_vst_addr(xive, type, blk, idx);
266     MemTxResult result;
267 
268     if (!addr) {
269         return -1;
270     }
271 
272     if (word_number == XIVE_VST_WORD_ALL) {
273         result = address_space_write(&address_space_memory, addr,
274                                      MEMTXATTRS_UNSPECIFIED, data,
275                                      info->size);
276     } else {
277         result = address_space_write(&address_space_memory,
278                                      addr + word_number * 4,
279                                      MEMTXATTRS_UNSPECIFIED,
280                                      data + word_number * 4, 4);
281     }
282 
283     if (result != MEMTX_OK) {
284         xive2_error(xive, "VST: write failed at @0x%" HWADDR_PRIx
285                    "for VST %s %x/%x\n", addr, info->name, blk, idx);
286         return -1;
287     }
288     return 0;
289 }
290 
291 static int pnv_xive2_get_pq(Xive2Router *xrtr, uint8_t blk, uint32_t idx,
292                              uint8_t *pq)
293 {
294     PnvXive2 *xive = PNV_XIVE2(xrtr);
295 
296     if (pnv_xive2_block_id(xive) != blk) {
297         xive2_error(xive, "VST: EAS %x is remote !?", XIVE_EAS(blk, idx));
298         return -1;
299     }
300 
301     *pq = xive_source_esb_get(&xive->ipi_source, idx);
302     return 0;
303 }
304 
305 static int pnv_xive2_set_pq(Xive2Router *xrtr, uint8_t blk, uint32_t idx,
306                              uint8_t *pq)
307 {
308     PnvXive2 *xive = PNV_XIVE2(xrtr);
309 
310     if (pnv_xive2_block_id(xive) != blk) {
311         xive2_error(xive, "VST: EAS %x is remote !?", XIVE_EAS(blk, idx));
312         return -1;
313     }
314 
315     *pq = xive_source_esb_set(&xive->ipi_source, idx, *pq);
316     return 0;
317 }
318 
319 static int pnv_xive2_get_end(Xive2Router *xrtr, uint8_t blk, uint32_t idx,
320                              Xive2End *end)
321 {
322     return pnv_xive2_vst_read(PNV_XIVE2(xrtr), VST_END, blk, idx, end);
323 }
324 
325 static int pnv_xive2_write_end(Xive2Router *xrtr, uint8_t blk, uint32_t idx,
326                                Xive2End *end, uint8_t word_number)
327 {
328     return pnv_xive2_vst_write(PNV_XIVE2(xrtr), VST_END, blk, idx, end,
329                               word_number);
330 }
331 
332 static int pnv_xive2_end_update(PnvXive2 *xive)
333 {
334     uint8_t  blk = GETFIELD(VC_ENDC_WATCH_BLOCK_ID,
335                            xive->vc_regs[(VC_ENDC_WATCH0_SPEC >> 3)]);
336     uint32_t idx = GETFIELD(VC_ENDC_WATCH_INDEX,
337                            xive->vc_regs[(VC_ENDC_WATCH0_SPEC >> 3)]);
338     int i;
339     uint64_t endc_watch[4];
340 
341     for (i = 0; i < ARRAY_SIZE(endc_watch); i++) {
342         endc_watch[i] =
343             cpu_to_be64(xive->vc_regs[(VC_ENDC_WATCH0_DATA0 >> 3) + i]);
344     }
345 
346     return pnv_xive2_vst_write(xive, VST_END, blk, idx, endc_watch,
347                               XIVE_VST_WORD_ALL);
348 }
349 
350 static void pnv_xive2_end_cache_load(PnvXive2 *xive)
351 {
352     uint8_t  blk = GETFIELD(VC_ENDC_WATCH_BLOCK_ID,
353                            xive->vc_regs[(VC_ENDC_WATCH0_SPEC >> 3)]);
354     uint32_t idx = GETFIELD(VC_ENDC_WATCH_INDEX,
355                            xive->vc_regs[(VC_ENDC_WATCH0_SPEC >> 3)]);
356     uint64_t endc_watch[4] = { 0 };
357     int i;
358 
359     if (pnv_xive2_vst_read(xive, VST_END, blk, idx, endc_watch)) {
360         xive2_error(xive, "VST: no END entry %x/%x !?", blk, idx);
361     }
362 
363     for (i = 0; i < ARRAY_SIZE(endc_watch); i++) {
364         xive->vc_regs[(VC_ENDC_WATCH0_DATA0 >> 3) + i] =
365             be64_to_cpu(endc_watch[i]);
366     }
367 }
368 
369 static int pnv_xive2_get_nvp(Xive2Router *xrtr, uint8_t blk, uint32_t idx,
370                              Xive2Nvp *nvp)
371 {
372     return pnv_xive2_vst_read(PNV_XIVE2(xrtr), VST_NVP, blk, idx, nvp);
373 }
374 
375 static int pnv_xive2_write_nvp(Xive2Router *xrtr, uint8_t blk, uint32_t idx,
376                                Xive2Nvp *nvp, uint8_t word_number)
377 {
378     return pnv_xive2_vst_write(PNV_XIVE2(xrtr), VST_NVP, blk, idx, nvp,
379                               word_number);
380 }
381 
382 static int pnv_xive2_nvp_update(PnvXive2 *xive)
383 {
384     uint8_t  blk = GETFIELD(PC_NXC_WATCH_BLOCK_ID,
385                             xive->pc_regs[(PC_NXC_WATCH0_SPEC >> 3)]);
386     uint32_t idx = GETFIELD(PC_NXC_WATCH_INDEX,
387                             xive->pc_regs[(PC_NXC_WATCH0_SPEC >> 3)]);
388     int i;
389     uint64_t nxc_watch[4];
390 
391     for (i = 0; i < ARRAY_SIZE(nxc_watch); i++) {
392         nxc_watch[i] =
393             cpu_to_be64(xive->pc_regs[(PC_NXC_WATCH0_DATA0 >> 3) + i]);
394     }
395 
396     return pnv_xive2_vst_write(xive, VST_NVP, blk, idx, nxc_watch,
397                               XIVE_VST_WORD_ALL);
398 }
399 
400 static void pnv_xive2_nvp_cache_load(PnvXive2 *xive)
401 {
402     uint8_t  blk = GETFIELD(PC_NXC_WATCH_BLOCK_ID,
403                            xive->pc_regs[(PC_NXC_WATCH0_SPEC >> 3)]);
404     uint32_t idx = GETFIELD(PC_NXC_WATCH_INDEX,
405                            xive->pc_regs[(PC_NXC_WATCH0_SPEC >> 3)]);
406     uint64_t nxc_watch[4] = { 0 };
407     int i;
408 
409     if (pnv_xive2_vst_read(xive, VST_NVP, blk, idx, nxc_watch)) {
410         xive2_error(xive, "VST: no NVP entry %x/%x !?", blk, idx);
411     }
412 
413     for (i = 0; i < ARRAY_SIZE(nxc_watch); i++) {
414         xive->pc_regs[(PC_NXC_WATCH0_DATA0 >> 3) + i] =
415             be64_to_cpu(nxc_watch[i]);
416     }
417 }
418 
419 static int pnv_xive2_get_eas(Xive2Router *xrtr, uint8_t blk, uint32_t idx,
420                             Xive2Eas *eas)
421 {
422     PnvXive2 *xive = PNV_XIVE2(xrtr);
423 
424     if (pnv_xive2_block_id(xive) != blk) {
425         xive2_error(xive, "VST: EAS %x is remote !?", XIVE_EAS(blk, idx));
426         return -1;
427     }
428 
429     return pnv_xive2_vst_read(xive, VST_EAS, blk, idx, eas);
430 }
431 
432 static uint32_t pnv_xive2_get_config(Xive2Router *xrtr)
433 {
434     PnvXive2 *xive = PNV_XIVE2(xrtr);
435     uint32_t cfg = 0;
436 
437     if (xive->cq_regs[CQ_XIVE_CFG >> 3] & CQ_XIVE_CFG_GEN1_TIMA_OS) {
438         cfg |= XIVE2_GEN1_TIMA_OS;
439     }
440 
441     if (xive->cq_regs[CQ_XIVE_CFG >> 3] & CQ_XIVE_CFG_EN_VP_SAVE_RESTORE) {
442         cfg |= XIVE2_VP_SAVE_RESTORE;
443     }
444 
445     if (GETFIELD(CQ_XIVE_CFG_HYP_HARD_RANGE,
446               xive->cq_regs[CQ_XIVE_CFG >> 3]) == CQ_XIVE_CFG_THREADID_8BITS) {
447         cfg |= XIVE2_THREADID_8BITS;
448     }
449 
450     return cfg;
451 }
452 
453 static bool pnv_xive2_is_cpu_enabled(PnvXive2 *xive, PowerPCCPU *cpu)
454 {
455     int pir = ppc_cpu_pir(cpu);
456     uint32_t fc = PNV10_PIR2FUSEDCORE(pir);
457     uint64_t reg = fc < 8 ? TCTXT_EN0 : TCTXT_EN1;
458     uint32_t bit = pir & 0x3f;
459 
460     return xive->tctxt_regs[reg >> 3] & PPC_BIT(bit);
461 }
462 
463 static int pnv_xive2_match_nvt(XivePresenter *xptr, uint8_t format,
464                                uint8_t nvt_blk, uint32_t nvt_idx,
465                                bool cam_ignore, uint8_t priority,
466                                uint32_t logic_serv, XiveTCTXMatch *match)
467 {
468     PnvXive2 *xive = PNV_XIVE2(xptr);
469     PnvChip *chip = xive->chip;
470     int count = 0;
471     int i, j;
472     bool gen1_tima_os =
473         xive->cq_regs[CQ_XIVE_CFG >> 3] & CQ_XIVE_CFG_GEN1_TIMA_OS;
474 
475     for (i = 0; i < chip->nr_cores; i++) {
476         PnvCore *pc = chip->cores[i];
477         CPUCore *cc = CPU_CORE(pc);
478 
479         for (j = 0; j < cc->nr_threads; j++) {
480             PowerPCCPU *cpu = pc->threads[j];
481             XiveTCTX *tctx;
482             int ring;
483 
484             if (!pnv_xive2_is_cpu_enabled(xive, cpu)) {
485                 continue;
486             }
487 
488             tctx = XIVE_TCTX(pnv_cpu_state(cpu)->intc);
489 
490             if (gen1_tima_os) {
491                 ring = xive_presenter_tctx_match(xptr, tctx, format, nvt_blk,
492                                                  nvt_idx, cam_ignore,
493                                                  logic_serv);
494             } else {
495                 ring = xive2_presenter_tctx_match(xptr, tctx, format, nvt_blk,
496                                                    nvt_idx, cam_ignore,
497                                                    logic_serv);
498             }
499 
500             /*
501              * Save the context and follow on to catch duplicates,
502              * that we don't support yet.
503              */
504             if (ring != -1) {
505                 if (match->tctx) {
506                     qemu_log_mask(LOG_GUEST_ERROR, "XIVE: already found a "
507                                   "thread context NVT %x/%x\n",
508                                   nvt_blk, nvt_idx);
509                     return false;
510                 }
511 
512                 match->ring = ring;
513                 match->tctx = tctx;
514                 count++;
515             }
516         }
517     }
518 
519     return count;
520 }
521 
522 static uint32_t pnv_xive2_presenter_get_config(XivePresenter *xptr)
523 {
524     PnvXive2 *xive = PNV_XIVE2(xptr);
525     uint32_t cfg = 0;
526 
527     if (xive->cq_regs[CQ_XIVE_CFG >> 3] & CQ_XIVE_CFG_GEN1_TIMA_OS) {
528         cfg |= XIVE_PRESENTER_GEN1_TIMA_OS;
529     }
530     return cfg;
531 }
532 
533 static uint8_t pnv_xive2_get_block_id(Xive2Router *xrtr)
534 {
535     return pnv_xive2_block_id(PNV_XIVE2(xrtr));
536 }
537 
538 /*
539  * The TIMA MMIO space is shared among the chips and to identify the
540  * chip from which the access is being done, we extract the chip id
541  * from the PIR.
542  */
543 static PnvXive2 *pnv_xive2_tm_get_xive(PowerPCCPU *cpu)
544 {
545     int pir = ppc_cpu_pir(cpu);
546     XivePresenter *xptr = XIVE_TCTX(pnv_cpu_state(cpu)->intc)->xptr;
547     PnvXive2 *xive = PNV_XIVE2(xptr);
548 
549     if (!pnv_xive2_is_cpu_enabled(xive, cpu)) {
550         xive2_error(xive, "IC: CPU %x is not enabled", pir);
551     }
552     return xive;
553 }
554 
555 /*
556  * The internal sources of the interrupt controller have no knowledge
557  * of the XIVE2 chip on which they reside. Encode the block id in the
558  * source interrupt number before forwarding the source event
559  * notification to the Router. This is required on a multichip system.
560  */
561 static void pnv_xive2_notify(XiveNotifier *xn, uint32_t srcno, bool pq_checked)
562 {
563     PnvXive2 *xive = PNV_XIVE2(xn);
564     uint8_t blk = pnv_xive2_block_id(xive);
565 
566     xive2_router_notify(xn, XIVE_EAS(blk, srcno), pq_checked);
567 }
568 
569 /*
570  * Set Translation Tables
571  *
572  * TODO add support for multiple sets
573  */
574 static int pnv_xive2_stt_set_data(PnvXive2 *xive, uint64_t val)
575 {
576     uint8_t tsel = GETFIELD(CQ_TAR_SELECT, xive->cq_regs[CQ_TAR >> 3]);
577     uint8_t entry = GETFIELD(CQ_TAR_ENTRY_SELECT,
578                                   xive->cq_regs[CQ_TAR >> 3]);
579 
580     switch (tsel) {
581     case CQ_TAR_NVPG:
582     case CQ_TAR_ESB:
583     case CQ_TAR_END:
584         xive->tables[tsel][entry] = val;
585         break;
586     default:
587         xive2_error(xive, "IC: unsupported table %d", tsel);
588         return -1;
589     }
590 
591     if (xive->cq_regs[CQ_TAR >> 3] & CQ_TAR_AUTOINC) {
592         xive->cq_regs[CQ_TAR >> 3] = SETFIELD(CQ_TAR_ENTRY_SELECT,
593                      xive->cq_regs[CQ_TAR >> 3], ++entry);
594     }
595 
596     return 0;
597 }
598 /*
599  * Virtual Structure Tables (VST) configuration
600  */
601 static void pnv_xive2_vst_set_exclusive(PnvXive2 *xive, uint8_t type,
602                                         uint8_t blk, uint64_t vsd)
603 {
604     Xive2EndSource *end_xsrc = &xive->end_source;
605     XiveSource *xsrc = &xive->ipi_source;
606     const XiveVstInfo *info = &vst_infos[type];
607     uint32_t page_shift = GETFIELD(VSD_TSIZE, vsd) + 12;
608     uint64_t vst_tsize = 1ull << page_shift;
609     uint64_t vst_addr = vsd & VSD_ADDRESS_MASK;
610 
611     /* Basic checks */
612 
613     if (VSD_INDIRECT & vsd) {
614         if (!pnv_xive2_vst_page_size_allowed(page_shift)) {
615             xive2_error(xive, "VST: invalid %s page shift %d", info->name,
616                        page_shift);
617             return;
618         }
619     }
620 
621     if (!QEMU_IS_ALIGNED(vst_addr, 1ull << page_shift)) {
622         xive2_error(xive, "VST: %s table address 0x%"PRIx64
623                     " is not aligned with page shift %d",
624                     info->name, vst_addr, page_shift);
625         return;
626     }
627 
628     /* Record the table configuration (in SRAM on HW) */
629     xive->vsds[type][blk] = vsd;
630 
631     /* Now tune the models with the configuration provided by the FW */
632 
633     switch (type) {
634     case VST_ESB:
635         /*
636          * Backing store pages for the source PQ bits. The model does
637          * not use these PQ bits backed in RAM because the XiveSource
638          * model has its own.
639          *
640          * If the table is direct, we can compute the number of PQ
641          * entries provisioned by FW (such as skiboot) and resize the
642          * ESB window accordingly.
643          */
644         if (!(VSD_INDIRECT & vsd)) {
645             memory_region_set_size(&xsrc->esb_mmio, vst_tsize * SBE_PER_BYTE
646                                    * (1ull << xsrc->esb_shift));
647         }
648 
649         memory_region_add_subregion(&xive->esb_mmio, 0, &xsrc->esb_mmio);
650         break;
651 
652     case VST_EAS:  /* Nothing to be done */
653         break;
654 
655     case VST_END:
656         /*
657          * Backing store pages for the END.
658          */
659         if (!(VSD_INDIRECT & vsd)) {
660             memory_region_set_size(&end_xsrc->esb_mmio, (vst_tsize / info->size)
661                                    * (1ull << end_xsrc->esb_shift));
662         }
663         memory_region_add_subregion(&xive->end_mmio, 0, &end_xsrc->esb_mmio);
664         break;
665 
666     case VST_NVP:  /* Not modeled */
667     case VST_NVG:  /* Not modeled */
668     case VST_NVC:  /* Not modeled */
669     case VST_IC:   /* Not modeled */
670     case VST_SYNC: /* Not modeled */
671     case VST_ERQ:  /* Not modeled */
672         break;
673 
674     default:
675         g_assert_not_reached();
676     }
677 }
678 
679 /*
680  * Both PC and VC sub-engines are configured as each use the Virtual
681  * Structure Tables
682  */
683 static void pnv_xive2_vst_set_data(PnvXive2 *xive, uint64_t vsd)
684 {
685     uint8_t mode = GETFIELD(VSD_MODE, vsd);
686     uint8_t type = GETFIELD(VC_VSD_TABLE_SELECT,
687                             xive->vc_regs[VC_VSD_TABLE_ADDR >> 3]);
688     uint8_t blk = GETFIELD(VC_VSD_TABLE_ADDRESS,
689                            xive->vc_regs[VC_VSD_TABLE_ADDR >> 3]);
690     uint64_t vst_addr = vsd & VSD_ADDRESS_MASK;
691 
692     if (type > VST_ERQ) {
693         xive2_error(xive, "VST: invalid table type %d", type);
694         return;
695     }
696 
697     if (blk >= vst_infos[type].max_blocks) {
698         xive2_error(xive, "VST: invalid block id %d for"
699                       " %s table", blk, vst_infos[type].name);
700         return;
701     }
702 
703     if (!vst_addr) {
704         xive2_error(xive, "VST: invalid %s table address",
705                    vst_infos[type].name);
706         return;
707     }
708 
709     switch (mode) {
710     case VSD_MODE_FORWARD:
711         xive->vsds[type][blk] = vsd;
712         break;
713 
714     case VSD_MODE_EXCLUSIVE:
715         pnv_xive2_vst_set_exclusive(xive, type, blk, vsd);
716         break;
717 
718     default:
719         xive2_error(xive, "VST: unsupported table mode %d", mode);
720         return;
721     }
722 }
723 
724 /*
725  * MMIO handlers
726  */
727 
728 
729 /*
730  * IC BAR layout
731  *
732  * Page 0: Internal CQ register accesses (reads & writes)
733  * Page 1: Internal PC register accesses (reads & writes)
734  * Page 2: Internal VC register accesses (reads & writes)
735  * Page 3: Internal TCTXT (TIMA) reg accesses (read & writes)
736  * Page 4: Notify Port page (writes only, w/data),
737  * Page 5: Reserved
738  * Page 6: Sync Poll page (writes only, dataless)
739  * Page 7: Sync Inject page (writes only, dataless)
740  * Page 8: LSI Trigger page (writes only, dataless)
741  * Page 9: LSI SB Management page (reads & writes dataless)
742  * Pages 10-255: Reserved
743  * Pages 256-383: Direct mapped Thread Context Area (reads & writes)
744  *                covering the 128 threads in P10.
745  * Pages 384-511: Reserved
746  */
747 typedef struct PnvXive2Region {
748     const char *name;
749     uint32_t pgoff;
750     uint32_t pgsize;
751     const MemoryRegionOps *ops;
752 } PnvXive2Region;
753 
754 static const MemoryRegionOps pnv_xive2_ic_cq_ops;
755 static const MemoryRegionOps pnv_xive2_ic_pc_ops;
756 static const MemoryRegionOps pnv_xive2_ic_vc_ops;
757 static const MemoryRegionOps pnv_xive2_ic_tctxt_ops;
758 static const MemoryRegionOps pnv_xive2_ic_notify_ops;
759 static const MemoryRegionOps pnv_xive2_ic_sync_ops;
760 static const MemoryRegionOps pnv_xive2_ic_lsi_ops;
761 static const MemoryRegionOps pnv_xive2_ic_tm_indirect_ops;
762 
763 /* 512 pages. 4K: 2M range, 64K: 32M range */
764 static const PnvXive2Region pnv_xive2_ic_regions[] = {
765     { "xive-ic-cq",        0,   1,   &pnv_xive2_ic_cq_ops     },
766     { "xive-ic-vc",        1,   1,   &pnv_xive2_ic_vc_ops     },
767     { "xive-ic-pc",        2,   1,   &pnv_xive2_ic_pc_ops     },
768     { "xive-ic-tctxt",     3,   1,   &pnv_xive2_ic_tctxt_ops  },
769     { "xive-ic-notify",    4,   1,   &pnv_xive2_ic_notify_ops },
770     /* page 5 reserved */
771     { "xive-ic-sync",      6,   2,   &pnv_xive2_ic_sync_ops   },
772     { "xive-ic-lsi",       8,   2,   &pnv_xive2_ic_lsi_ops    },
773     /* pages 10-255 reserved */
774     { "xive-ic-tm-indirect", 256, 128, &pnv_xive2_ic_tm_indirect_ops  },
775     /* pages 384-511 reserved */
776 };
777 
778 /*
779  * CQ operations
780  */
781 
782 static uint64_t pnv_xive2_ic_cq_read(void *opaque, hwaddr offset,
783                                         unsigned size)
784 {
785     PnvXive2 *xive = PNV_XIVE2(opaque);
786     uint32_t reg = offset >> 3;
787     uint64_t val = 0;
788 
789     switch (offset) {
790     case CQ_XIVE_CAP: /* Set at reset */
791     case CQ_XIVE_CFG:
792         val = xive->cq_regs[reg];
793         break;
794     case CQ_MSGSND: /* TODO check the #cores of the machine */
795         val = 0xffffffff00000000;
796         break;
797     case CQ_CFG_PB_GEN:
798         val = CQ_CFG_PB_GEN_PB_INIT; /* TODO: fix CQ_CFG_PB_GEN default value */
799         break;
800     default:
801         xive2_error(xive, "CQ: invalid read @%"HWADDR_PRIx, offset);
802     }
803 
804     return val;
805 }
806 
807 static uint64_t pnv_xive2_bar_size(uint64_t val)
808 {
809     return 1ull << (GETFIELD(CQ_BAR_RANGE, val) + 24);
810 }
811 
812 static void pnv_xive2_ic_cq_write(void *opaque, hwaddr offset,
813                                   uint64_t val, unsigned size)
814 {
815     PnvXive2 *xive = PNV_XIVE2(opaque);
816     MemoryRegion *sysmem = get_system_memory();
817     uint32_t reg = offset >> 3;
818     int i;
819 
820     switch (offset) {
821     case CQ_XIVE_CFG:
822     case CQ_RST_CTL: /* TODO: reset all BARs */
823         break;
824 
825     case CQ_IC_BAR:
826         xive->ic_shift = val & CQ_IC_BAR_64K ? 16 : 12;
827         if (!(val & CQ_IC_BAR_VALID)) {
828             xive->ic_base = 0;
829             if (xive->cq_regs[reg] & CQ_IC_BAR_VALID) {
830                 for (i = 0; i < ARRAY_SIZE(xive->ic_mmios); i++) {
831                     memory_region_del_subregion(&xive->ic_mmio,
832                                                 &xive->ic_mmios[i]);
833                 }
834                 memory_region_del_subregion(sysmem, &xive->ic_mmio);
835             }
836         } else {
837             xive->ic_base = val & ~(CQ_IC_BAR_VALID | CQ_IC_BAR_64K);
838             if (!(xive->cq_regs[reg] & CQ_IC_BAR_VALID)) {
839                 for (i = 0; i < ARRAY_SIZE(xive->ic_mmios); i++) {
840                     memory_region_add_subregion(&xive->ic_mmio,
841                                pnv_xive2_ic_regions[i].pgoff << xive->ic_shift,
842                                &xive->ic_mmios[i]);
843                 }
844                 memory_region_add_subregion(sysmem, xive->ic_base,
845                                             &xive->ic_mmio);
846             }
847         }
848         break;
849 
850     case CQ_TM_BAR:
851         xive->tm_shift = val & CQ_TM_BAR_64K ? 16 : 12;
852         if (!(val & CQ_TM_BAR_VALID)) {
853             xive->tm_base = 0;
854             if (xive->cq_regs[reg] & CQ_TM_BAR_VALID) {
855                 memory_region_del_subregion(sysmem, &xive->tm_mmio);
856             }
857         } else {
858             xive->tm_base = val & ~(CQ_TM_BAR_VALID | CQ_TM_BAR_64K);
859             if (!(xive->cq_regs[reg] & CQ_TM_BAR_VALID)) {
860                 memory_region_add_subregion(sysmem, xive->tm_base,
861                                             &xive->tm_mmio);
862             }
863         }
864         break;
865 
866     case CQ_ESB_BAR:
867         xive->esb_shift = val & CQ_BAR_64K ? 16 : 12;
868         if (!(val & CQ_BAR_VALID)) {
869             xive->esb_base = 0;
870             if (xive->cq_regs[reg] & CQ_BAR_VALID) {
871                 memory_region_del_subregion(sysmem, &xive->esb_mmio);
872             }
873         } else {
874             xive->esb_base = val & CQ_BAR_ADDR;
875             if (!(xive->cq_regs[reg] & CQ_BAR_VALID)) {
876                 memory_region_set_size(&xive->esb_mmio,
877                                        pnv_xive2_bar_size(val));
878                 memory_region_add_subregion(sysmem, xive->esb_base,
879                                             &xive->esb_mmio);
880             }
881         }
882         break;
883 
884     case CQ_END_BAR:
885         xive->end_shift = val & CQ_BAR_64K ? 16 : 12;
886         if (!(val & CQ_BAR_VALID)) {
887             xive->end_base = 0;
888             if (xive->cq_regs[reg] & CQ_BAR_VALID) {
889                 memory_region_del_subregion(sysmem, &xive->end_mmio);
890             }
891         } else {
892             xive->end_base = val & CQ_BAR_ADDR;
893             if (!(xive->cq_regs[reg] & CQ_BAR_VALID)) {
894                 memory_region_set_size(&xive->end_mmio,
895                                        pnv_xive2_bar_size(val));
896                 memory_region_add_subregion(sysmem, xive->end_base,
897                                             &xive->end_mmio);
898             }
899         }
900         break;
901 
902     case CQ_NVC_BAR:
903         xive->nvc_shift = val & CQ_BAR_64K ? 16 : 12;
904         if (!(val & CQ_BAR_VALID)) {
905             xive->nvc_base = 0;
906             if (xive->cq_regs[reg] & CQ_BAR_VALID) {
907                 memory_region_del_subregion(sysmem, &xive->nvc_mmio);
908             }
909         } else {
910             xive->nvc_base = val & CQ_BAR_ADDR;
911             if (!(xive->cq_regs[reg] & CQ_BAR_VALID)) {
912                 memory_region_set_size(&xive->nvc_mmio,
913                                        pnv_xive2_bar_size(val));
914                 memory_region_add_subregion(sysmem, xive->nvc_base,
915                                             &xive->nvc_mmio);
916             }
917         }
918         break;
919 
920     case CQ_NVPG_BAR:
921         xive->nvpg_shift = val & CQ_BAR_64K ? 16 : 12;
922         if (!(val & CQ_BAR_VALID)) {
923             xive->nvpg_base = 0;
924             if (xive->cq_regs[reg] & CQ_BAR_VALID) {
925                 memory_region_del_subregion(sysmem, &xive->nvpg_mmio);
926             }
927         } else {
928             xive->nvpg_base = val & CQ_BAR_ADDR;
929             if (!(xive->cq_regs[reg] & CQ_BAR_VALID)) {
930                 memory_region_set_size(&xive->nvpg_mmio,
931                                        pnv_xive2_bar_size(val));
932                 memory_region_add_subregion(sysmem, xive->nvpg_base,
933                                             &xive->nvpg_mmio);
934             }
935         }
936         break;
937 
938     case CQ_TAR: /* Set Translation Table Address */
939         break;
940     case CQ_TDR: /* Set Translation Table Data */
941         pnv_xive2_stt_set_data(xive, val);
942         break;
943     case CQ_FIRMASK_OR: /* FIR error reporting */
944         break;
945     default:
946         xive2_error(xive, "CQ: invalid write 0x%"HWADDR_PRIx, offset);
947         return;
948     }
949 
950     xive->cq_regs[reg] = val;
951 }
952 
953 static const MemoryRegionOps pnv_xive2_ic_cq_ops = {
954     .read = pnv_xive2_ic_cq_read,
955     .write = pnv_xive2_ic_cq_write,
956     .endianness = DEVICE_BIG_ENDIAN,
957     .valid = {
958         .min_access_size = 8,
959         .max_access_size = 8,
960     },
961     .impl = {
962         .min_access_size = 8,
963         .max_access_size = 8,
964     },
965 };
966 
967 static uint64_t pnv_xive2_ic_vc_read(void *opaque, hwaddr offset,
968                                      unsigned size)
969 {
970     PnvXive2 *xive = PNV_XIVE2(opaque);
971     uint64_t val = 0;
972     uint32_t reg = offset >> 3;
973 
974     switch (offset) {
975     /*
976      * VSD table settings.
977      */
978     case VC_VSD_TABLE_ADDR:
979     case VC_VSD_TABLE_DATA:
980         val = xive->vc_regs[reg];
981         break;
982 
983     /*
984      * ESB cache updates (not modeled)
985      */
986     case VC_ESBC_FLUSH_CTRL:
987         xive->vc_regs[reg] &= ~VC_ESBC_FLUSH_CTRL_POLL_VALID;
988         val = xive->vc_regs[reg];
989         break;
990 
991     case VC_ESBC_CFG:
992         val = xive->vc_regs[reg];
993         break;
994 
995     /*
996      * EAS cache updates (not modeled)
997      */
998     case VC_EASC_FLUSH_CTRL:
999         xive->vc_regs[reg] &= ~VC_EASC_FLUSH_CTRL_POLL_VALID;
1000         val = xive->vc_regs[reg];
1001         break;
1002 
1003     /*
1004      * END cache updates
1005      */
1006     case VC_ENDC_WATCH0_SPEC:
1007         xive->vc_regs[reg] &= ~(VC_ENDC_WATCH_FULL | VC_ENDC_WATCH_CONFLICT);
1008         val = xive->vc_regs[reg];
1009         break;
1010 
1011     case VC_ENDC_WATCH0_DATA0:
1012         /*
1013          * Load DATA registers from cache with data requested by the
1014          * SPEC register
1015          */
1016         pnv_xive2_end_cache_load(xive);
1017         val = xive->vc_regs[reg];
1018         break;
1019 
1020     case VC_ENDC_WATCH0_DATA1 ... VC_ENDC_WATCH0_DATA3:
1021         val = xive->vc_regs[reg];
1022         break;
1023 
1024     case VC_ENDC_FLUSH_CTRL:
1025         xive->vc_regs[reg] &= ~VC_ENDC_FLUSH_CTRL_POLL_VALID;
1026         val = xive->vc_regs[reg];
1027         break;
1028 
1029     /*
1030      * Indirect invalidation
1031      */
1032     case VC_AT_MACRO_KILL_MASK:
1033         val = xive->vc_regs[reg];
1034         break;
1035 
1036     case VC_AT_MACRO_KILL:
1037         xive->vc_regs[reg] &= ~VC_AT_MACRO_KILL_VALID;
1038         val = xive->vc_regs[reg];
1039         break;
1040 
1041     /*
1042      * Interrupt fifo overflow in memory backing store (Not modeled)
1043      */
1044     case VC_QUEUES_CFG_REM0 ... VC_QUEUES_CFG_REM6:
1045         val = xive->vc_regs[reg];
1046         break;
1047 
1048     /*
1049      * Synchronisation
1050      */
1051     case VC_ENDC_SYNC_DONE:
1052         val = VC_ENDC_SYNC_POLL_DONE;
1053         break;
1054     default:
1055         xive2_error(xive, "VC: invalid read @%"HWADDR_PRIx, offset);
1056     }
1057 
1058     return val;
1059 }
1060 
1061 static void pnv_xive2_ic_vc_write(void *opaque, hwaddr offset,
1062                                   uint64_t val, unsigned size)
1063 {
1064     PnvXive2 *xive = PNV_XIVE2(opaque);
1065     uint32_t reg = offset >> 3;
1066 
1067     switch (offset) {
1068     /*
1069      * VSD table settings.
1070      */
1071     case VC_VSD_TABLE_ADDR:
1072        break;
1073     case VC_VSD_TABLE_DATA:
1074         pnv_xive2_vst_set_data(xive, val);
1075         break;
1076 
1077     /*
1078      * ESB cache updates (not modeled)
1079      */
1080     /* case VC_ESBC_FLUSH_CTRL: */
1081     case VC_ESBC_FLUSH_POLL:
1082         xive->vc_regs[VC_ESBC_FLUSH_CTRL >> 3] |= VC_ESBC_FLUSH_CTRL_POLL_VALID;
1083         /* ESB update */
1084         break;
1085 
1086     case VC_ESBC_CFG:
1087         break;
1088 
1089     /*
1090      * EAS cache updates (not modeled)
1091      */
1092     /* case VC_EASC_FLUSH_CTRL: */
1093     case VC_EASC_FLUSH_POLL:
1094         xive->vc_regs[VC_EASC_FLUSH_CTRL >> 3] |= VC_EASC_FLUSH_CTRL_POLL_VALID;
1095         /* EAS update */
1096         break;
1097 
1098     /*
1099      * END cache updates
1100      */
1101     case VC_ENDC_WATCH0_SPEC:
1102          val &= ~VC_ENDC_WATCH_CONFLICT; /* HW will set this bit */
1103         break;
1104 
1105     case VC_ENDC_WATCH0_DATA1 ... VC_ENDC_WATCH0_DATA3:
1106         break;
1107     case VC_ENDC_WATCH0_DATA0:
1108         /* writing to DATA0 triggers the cache write */
1109         xive->vc_regs[reg] = val;
1110         pnv_xive2_end_update(xive);
1111         break;
1112 
1113 
1114     /* case VC_ENDC_FLUSH_CTRL: */
1115     case VC_ENDC_FLUSH_POLL:
1116         xive->vc_regs[VC_ENDC_FLUSH_CTRL >> 3] |= VC_ENDC_FLUSH_CTRL_POLL_VALID;
1117         break;
1118 
1119     /*
1120      * Indirect invalidation
1121      */
1122     case VC_AT_MACRO_KILL:
1123     case VC_AT_MACRO_KILL_MASK:
1124         break;
1125 
1126     /*
1127      * Interrupt fifo overflow in memory backing store (Not modeled)
1128      */
1129     case VC_QUEUES_CFG_REM0 ... VC_QUEUES_CFG_REM6:
1130         break;
1131 
1132     /*
1133      * Synchronisation
1134      */
1135     case VC_ENDC_SYNC_DONE:
1136         break;
1137 
1138     default:
1139         xive2_error(xive, "VC: invalid write @%"HWADDR_PRIx, offset);
1140         return;
1141     }
1142 
1143     xive->vc_regs[reg] = val;
1144 }
1145 
1146 static const MemoryRegionOps pnv_xive2_ic_vc_ops = {
1147     .read = pnv_xive2_ic_vc_read,
1148     .write = pnv_xive2_ic_vc_write,
1149     .endianness = DEVICE_BIG_ENDIAN,
1150     .valid = {
1151         .min_access_size = 8,
1152         .max_access_size = 8,
1153     },
1154     .impl = {
1155         .min_access_size = 8,
1156         .max_access_size = 8,
1157     },
1158 };
1159 
1160 static uint64_t pnv_xive2_ic_pc_read(void *opaque, hwaddr offset,
1161                                      unsigned size)
1162 {
1163     PnvXive2 *xive = PNV_XIVE2(opaque);
1164     uint64_t val = -1;
1165     uint32_t reg = offset >> 3;
1166 
1167     switch (offset) {
1168     /*
1169      * VSD table settings.
1170      */
1171     case PC_VSD_TABLE_ADDR:
1172     case PC_VSD_TABLE_DATA:
1173         val = xive->pc_regs[reg];
1174         break;
1175 
1176     /*
1177      * cache updates
1178      */
1179     case PC_NXC_WATCH0_SPEC:
1180         xive->pc_regs[reg] &= ~(PC_NXC_WATCH_FULL | PC_NXC_WATCH_CONFLICT);
1181         val = xive->pc_regs[reg];
1182         break;
1183 
1184     case PC_NXC_WATCH0_DATA0:
1185        /*
1186         * Load DATA registers from cache with data requested by the
1187         * SPEC register
1188         */
1189         pnv_xive2_nvp_cache_load(xive);
1190         val = xive->pc_regs[reg];
1191         break;
1192 
1193     case PC_NXC_WATCH0_DATA1 ... PC_NXC_WATCH0_DATA3:
1194         val = xive->pc_regs[reg];
1195         break;
1196 
1197     case PC_NXC_FLUSH_CTRL:
1198         xive->pc_regs[reg] &= ~PC_NXC_FLUSH_CTRL_POLL_VALID;
1199         val = xive->pc_regs[reg];
1200         break;
1201 
1202     /*
1203      * Indirect invalidation
1204      */
1205     case PC_AT_KILL:
1206         xive->pc_regs[reg] &= ~PC_AT_KILL_VALID;
1207         val = xive->pc_regs[reg];
1208         break;
1209 
1210     default:
1211         xive2_error(xive, "PC: invalid read @%"HWADDR_PRIx, offset);
1212     }
1213 
1214     return val;
1215 }
1216 
1217 static void pnv_xive2_ic_pc_write(void *opaque, hwaddr offset,
1218                                   uint64_t val, unsigned size)
1219 {
1220     PnvXive2 *xive = PNV_XIVE2(opaque);
1221     uint32_t reg = offset >> 3;
1222 
1223     switch (offset) {
1224 
1225     /*
1226      * VSD table settings. Only taken into account in the VC
1227      * sub-engine because the Xive2Router model combines both VC and PC
1228      * sub-engines
1229      */
1230     case PC_VSD_TABLE_ADDR:
1231     case PC_VSD_TABLE_DATA:
1232         break;
1233 
1234     /*
1235      * cache updates
1236      */
1237     case PC_NXC_WATCH0_SPEC:
1238         val &= ~PC_NXC_WATCH_CONFLICT; /* HW will set this bit */
1239         break;
1240 
1241     case PC_NXC_WATCH0_DATA1 ... PC_NXC_WATCH0_DATA3:
1242         break;
1243     case PC_NXC_WATCH0_DATA0:
1244         /* writing to DATA0 triggers the cache write */
1245         xive->pc_regs[reg] = val;
1246         pnv_xive2_nvp_update(xive);
1247         break;
1248 
1249    /* case PC_NXC_FLUSH_CTRL: */
1250     case PC_NXC_FLUSH_POLL:
1251         xive->pc_regs[PC_NXC_FLUSH_CTRL >> 3] |= PC_NXC_FLUSH_CTRL_POLL_VALID;
1252         break;
1253 
1254     /*
1255      * Indirect invalidation
1256      */
1257     case PC_AT_KILL:
1258     case PC_AT_KILL_MASK:
1259         break;
1260 
1261     default:
1262         xive2_error(xive, "PC: invalid write @%"HWADDR_PRIx, offset);
1263         return;
1264     }
1265 
1266     xive->pc_regs[reg] = val;
1267 }
1268 
1269 static const MemoryRegionOps pnv_xive2_ic_pc_ops = {
1270     .read = pnv_xive2_ic_pc_read,
1271     .write = pnv_xive2_ic_pc_write,
1272     .endianness = DEVICE_BIG_ENDIAN,
1273     .valid = {
1274         .min_access_size = 8,
1275         .max_access_size = 8,
1276     },
1277     .impl = {
1278         .min_access_size = 8,
1279         .max_access_size = 8,
1280     },
1281 };
1282 
1283 
1284 static uint64_t pnv_xive2_ic_tctxt_read(void *opaque, hwaddr offset,
1285                                         unsigned size)
1286 {
1287     PnvXive2 *xive = PNV_XIVE2(opaque);
1288     uint64_t val = -1;
1289     uint32_t reg = offset >> 3;
1290 
1291     switch (offset) {
1292     /*
1293      * XIVE2 hardware thread enablement
1294      */
1295     case TCTXT_EN0:
1296     case TCTXT_EN1:
1297         val = xive->tctxt_regs[reg];
1298         break;
1299 
1300     case TCTXT_EN0_SET:
1301     case TCTXT_EN0_RESET:
1302         val = xive->tctxt_regs[TCTXT_EN0 >> 3];
1303         break;
1304     case TCTXT_EN1_SET:
1305     case TCTXT_EN1_RESET:
1306         val = xive->tctxt_regs[TCTXT_EN1 >> 3];
1307         break;
1308     case TCTXT_CFG:
1309         val = xive->tctxt_regs[reg];
1310         break;
1311     default:
1312         xive2_error(xive, "TCTXT: invalid read @%"HWADDR_PRIx, offset);
1313     }
1314 
1315     return val;
1316 }
1317 
1318 static void pnv_xive2_ic_tctxt_write(void *opaque, hwaddr offset,
1319                                      uint64_t val, unsigned size)
1320 {
1321     PnvXive2 *xive = PNV_XIVE2(opaque);
1322     uint32_t reg = offset >> 3;
1323 
1324     switch (offset) {
1325     /*
1326      * XIVE2 hardware thread enablement
1327      */
1328     case TCTXT_EN0: /* Physical Thread Enable */
1329     case TCTXT_EN1: /* Physical Thread Enable (fused core) */
1330         xive->tctxt_regs[reg] = val;
1331         break;
1332 
1333     case TCTXT_EN0_SET:
1334         xive->tctxt_regs[TCTXT_EN0 >> 3] |= val;
1335         break;
1336     case TCTXT_EN1_SET:
1337         xive->tctxt_regs[TCTXT_EN1 >> 3] |= val;
1338         break;
1339     case TCTXT_EN0_RESET:
1340         xive->tctxt_regs[TCTXT_EN0 >> 3] &= ~val;
1341         break;
1342     case TCTXT_EN1_RESET:
1343         xive->tctxt_regs[TCTXT_EN1 >> 3] &= ~val;
1344         break;
1345     case TCTXT_CFG:
1346         xive->tctxt_regs[reg] = val;
1347         break;
1348     default:
1349         xive2_error(xive, "TCTXT: invalid write @%"HWADDR_PRIx, offset);
1350         return;
1351     }
1352 }
1353 
1354 static const MemoryRegionOps pnv_xive2_ic_tctxt_ops = {
1355     .read = pnv_xive2_ic_tctxt_read,
1356     .write = pnv_xive2_ic_tctxt_write,
1357     .endianness = DEVICE_BIG_ENDIAN,
1358     .valid = {
1359         .min_access_size = 8,
1360         .max_access_size = 8,
1361     },
1362     .impl = {
1363         .min_access_size = 8,
1364         .max_access_size = 8,
1365     },
1366 };
1367 
1368 /*
1369  * Redirect XSCOM to MMIO handlers
1370  */
1371 static uint64_t pnv_xive2_xscom_read(void *opaque, hwaddr offset,
1372                                      unsigned size)
1373 {
1374     PnvXive2 *xive = PNV_XIVE2(opaque);
1375     uint64_t val = -1;
1376     uint32_t xscom_reg = offset >> 3;
1377     uint32_t mmio_offset = (xscom_reg & 0xFF) << 3;
1378 
1379     switch (xscom_reg) {
1380     case 0x000 ... 0x0FF:
1381         val = pnv_xive2_ic_cq_read(opaque, mmio_offset, size);
1382         break;
1383     case 0x100 ... 0x1FF:
1384         val = pnv_xive2_ic_vc_read(opaque, mmio_offset, size);
1385         break;
1386     case 0x200 ... 0x2FF:
1387         val = pnv_xive2_ic_pc_read(opaque, mmio_offset, size);
1388         break;
1389     case 0x300 ... 0x3FF:
1390         val = pnv_xive2_ic_tctxt_read(opaque, mmio_offset, size);
1391         break;
1392     default:
1393         xive2_error(xive, "XSCOM: invalid read @%"HWADDR_PRIx, offset);
1394     }
1395 
1396     return val;
1397 }
1398 
1399 static void pnv_xive2_xscom_write(void *opaque, hwaddr offset,
1400                                   uint64_t val, unsigned size)
1401 {
1402     PnvXive2 *xive = PNV_XIVE2(opaque);
1403     uint32_t xscom_reg = offset >> 3;
1404     uint32_t mmio_offset = (xscom_reg & 0xFF) << 3;
1405 
1406     switch (xscom_reg) {
1407     case 0x000 ... 0x0FF:
1408         pnv_xive2_ic_cq_write(opaque, mmio_offset, val, size);
1409         break;
1410     case 0x100 ... 0x1FF:
1411         pnv_xive2_ic_vc_write(opaque, mmio_offset, val, size);
1412         break;
1413     case 0x200 ... 0x2FF:
1414         pnv_xive2_ic_pc_write(opaque, mmio_offset, val, size);
1415         break;
1416     case 0x300 ... 0x3FF:
1417         pnv_xive2_ic_tctxt_write(opaque, mmio_offset, val, size);
1418         break;
1419     default:
1420         xive2_error(xive, "XSCOM: invalid write @%"HWADDR_PRIx, offset);
1421     }
1422 }
1423 
1424 static const MemoryRegionOps pnv_xive2_xscom_ops = {
1425     .read = pnv_xive2_xscom_read,
1426     .write = pnv_xive2_xscom_write,
1427     .endianness = DEVICE_BIG_ENDIAN,
1428     .valid = {
1429         .min_access_size = 8,
1430         .max_access_size = 8,
1431     },
1432     .impl = {
1433         .min_access_size = 8,
1434         .max_access_size = 8,
1435     },
1436 };
1437 
1438 /*
1439  * Notify port page. The layout is compatible between 4K and 64K pages :
1440  *
1441  * Page 1           Notify page (writes only)
1442  *  0x000 - 0x7FF   IPI interrupt (NPU)
1443  *  0x800 - 0xFFF   HW interrupt triggers (PSI, PHB)
1444  */
1445 
1446 static void pnv_xive2_ic_hw_trigger(PnvXive2 *xive, hwaddr addr,
1447                                     uint64_t val)
1448 {
1449     uint8_t blk;
1450     uint32_t idx;
1451 
1452     if (val & XIVE_TRIGGER_END) {
1453         xive2_error(xive, "IC: END trigger at @0x%"HWADDR_PRIx" data 0x%"PRIx64,
1454                    addr, val);
1455         return;
1456     }
1457 
1458     /*
1459      * Forward the source event notification directly to the Router.
1460      * The source interrupt number should already be correctly encoded
1461      * with the chip block id by the sending device (PHB, PSI).
1462      */
1463     blk = XIVE_EAS_BLOCK(val);
1464     idx = XIVE_EAS_INDEX(val);
1465 
1466     xive2_router_notify(XIVE_NOTIFIER(xive), XIVE_EAS(blk, idx),
1467                          !!(val & XIVE_TRIGGER_PQ));
1468 }
1469 
1470 static void pnv_xive2_ic_notify_write(void *opaque, hwaddr offset,
1471                                       uint64_t val, unsigned size)
1472 {
1473     PnvXive2 *xive = PNV_XIVE2(opaque);
1474 
1475     /* VC: IPI triggers */
1476     switch (offset) {
1477     case 0x000 ... 0x7FF:
1478         /* TODO: check IPI notify sub-page routing */
1479         pnv_xive2_ic_hw_trigger(opaque, offset, val);
1480         break;
1481 
1482     /* VC: HW triggers */
1483     case 0x800 ... 0xFFF:
1484         pnv_xive2_ic_hw_trigger(opaque, offset, val);
1485         break;
1486 
1487     default:
1488         xive2_error(xive, "NOTIFY: invalid write @%"HWADDR_PRIx, offset);
1489     }
1490 }
1491 
1492 static uint64_t pnv_xive2_ic_notify_read(void *opaque, hwaddr offset,
1493                                          unsigned size)
1494 {
1495     PnvXive2 *xive = PNV_XIVE2(opaque);
1496 
1497    /* loads are invalid */
1498     xive2_error(xive, "NOTIFY: invalid read @%"HWADDR_PRIx, offset);
1499     return -1;
1500 }
1501 
1502 static const MemoryRegionOps pnv_xive2_ic_notify_ops = {
1503     .read = pnv_xive2_ic_notify_read,
1504     .write = pnv_xive2_ic_notify_write,
1505     .endianness = DEVICE_BIG_ENDIAN,
1506     .valid = {
1507         .min_access_size = 8,
1508         .max_access_size = 8,
1509     },
1510     .impl = {
1511         .min_access_size = 8,
1512         .max_access_size = 8,
1513     },
1514 };
1515 
1516 static uint64_t pnv_xive2_ic_lsi_read(void *opaque, hwaddr offset,
1517                                       unsigned size)
1518 {
1519     PnvXive2 *xive = PNV_XIVE2(opaque);
1520 
1521     xive2_error(xive, "LSI: invalid read @%"HWADDR_PRIx, offset);
1522     return -1;
1523 }
1524 
1525 static void pnv_xive2_ic_lsi_write(void *opaque, hwaddr offset,
1526                                    uint64_t val, unsigned size)
1527 {
1528     PnvXive2 *xive = PNV_XIVE2(opaque);
1529 
1530     xive2_error(xive, "LSI: invalid write @%"HWADDR_PRIx, offset);
1531 }
1532 
1533 static const MemoryRegionOps pnv_xive2_ic_lsi_ops = {
1534     .read = pnv_xive2_ic_lsi_read,
1535     .write = pnv_xive2_ic_lsi_write,
1536     .endianness = DEVICE_BIG_ENDIAN,
1537     .valid = {
1538         .min_access_size = 8,
1539         .max_access_size = 8,
1540     },
1541     .impl = {
1542         .min_access_size = 8,
1543         .max_access_size = 8,
1544     },
1545 };
1546 
1547 /*
1548  * Sync MMIO page (write only)
1549  */
1550 #define PNV_XIVE2_SYNC_IPI      0x000
1551 #define PNV_XIVE2_SYNC_HW       0x080
1552 #define PNV_XIVE2_SYNC_NxC      0x100
1553 #define PNV_XIVE2_SYNC_INT      0x180
1554 #define PNV_XIVE2_SYNC_OS_ESC   0x200
1555 #define PNV_XIVE2_SYNC_POOL_ESC 0x280
1556 #define PNV_XIVE2_SYNC_HARD_ESC 0x300
1557 
1558 static uint64_t pnv_xive2_ic_sync_read(void *opaque, hwaddr offset,
1559                                        unsigned size)
1560 {
1561     PnvXive2 *xive = PNV_XIVE2(opaque);
1562 
1563     /* loads are invalid */
1564     xive2_error(xive, "SYNC: invalid read @%"HWADDR_PRIx, offset);
1565     return -1;
1566 }
1567 
1568 static void pnv_xive2_ic_sync_write(void *opaque, hwaddr offset,
1569                                     uint64_t val, unsigned size)
1570 {
1571     PnvXive2 *xive = PNV_XIVE2(opaque);
1572 
1573     switch (offset) {
1574     case PNV_XIVE2_SYNC_IPI:
1575     case PNV_XIVE2_SYNC_HW:
1576     case PNV_XIVE2_SYNC_NxC:
1577     case PNV_XIVE2_SYNC_INT:
1578     case PNV_XIVE2_SYNC_OS_ESC:
1579     case PNV_XIVE2_SYNC_POOL_ESC:
1580     case PNV_XIVE2_SYNC_HARD_ESC:
1581         break;
1582     default:
1583         xive2_error(xive, "SYNC: invalid write @%"HWADDR_PRIx, offset);
1584     }
1585 }
1586 
1587 static const MemoryRegionOps pnv_xive2_ic_sync_ops = {
1588     .read = pnv_xive2_ic_sync_read,
1589     .write = pnv_xive2_ic_sync_write,
1590     .endianness = DEVICE_BIG_ENDIAN,
1591     .valid = {
1592         .min_access_size = 8,
1593         .max_access_size = 8,
1594     },
1595     .impl = {
1596         .min_access_size = 8,
1597         .max_access_size = 8,
1598     },
1599 };
1600 
1601 /*
1602  * When the TM direct pages of the IC controller are accessed, the
1603  * target HW thread is deduced from the page offset.
1604  */
1605 static uint32_t pnv_xive2_ic_tm_get_pir(PnvXive2 *xive, hwaddr offset)
1606 {
1607     /* On P10, the node ID shift in the PIR register is 8 bits */
1608     return xive->chip->chip_id << 8 | offset >> xive->ic_shift;
1609 }
1610 
1611 static uint32_t pnv_xive2_ic_tm_get_hw_page_offset(PnvXive2 *xive,
1612                                                    hwaddr offset)
1613 {
1614     /*
1615      * Indirect TIMA accesses are similar to direct accesses for
1616      * privilege ring 0. So remove any traces of the hw thread ID from
1617      * the offset in the IC BAR as it could be interpreted as the ring
1618      * privilege when calling the underlying direct access functions.
1619      */
1620     return offset & ((1ull << xive->ic_shift) - 1);
1621 }
1622 
1623 static XiveTCTX *pnv_xive2_get_indirect_tctx(PnvXive2 *xive, uint32_t pir)
1624 {
1625     PnvChip *chip = xive->chip;
1626     PowerPCCPU *cpu = NULL;
1627 
1628     cpu = pnv_chip_find_cpu(chip, pir);
1629     if (!cpu) {
1630         xive2_error(xive, "IC: invalid PIR %x for indirect access", pir);
1631         return NULL;
1632     }
1633 
1634     if (!pnv_xive2_is_cpu_enabled(xive, cpu)) {
1635         xive2_error(xive, "IC: CPU %x is not enabled", pir);
1636     }
1637 
1638     return XIVE_TCTX(pnv_cpu_state(cpu)->intc);
1639 }
1640 
1641 static uint64_t pnv_xive2_ic_tm_indirect_read(void *opaque, hwaddr offset,
1642                                               unsigned size)
1643 {
1644     PnvXive2 *xive = PNV_XIVE2(opaque);
1645     XivePresenter *xptr = XIVE_PRESENTER(xive);
1646     hwaddr hw_page_offset;
1647     uint32_t pir;
1648     XiveTCTX *tctx;
1649     uint64_t val = -1;
1650 
1651     pir = pnv_xive2_ic_tm_get_pir(xive, offset);
1652     hw_page_offset = pnv_xive2_ic_tm_get_hw_page_offset(xive, offset);
1653     tctx = pnv_xive2_get_indirect_tctx(xive, pir);
1654     if (tctx) {
1655         val = xive_tctx_tm_read(xptr, tctx, hw_page_offset, size);
1656     }
1657 
1658     return val;
1659 }
1660 
1661 static void pnv_xive2_ic_tm_indirect_write(void *opaque, hwaddr offset,
1662                                            uint64_t val, unsigned size)
1663 {
1664     PnvXive2 *xive = PNV_XIVE2(opaque);
1665     XivePresenter *xptr = XIVE_PRESENTER(xive);
1666     hwaddr hw_page_offset;
1667     uint32_t pir;
1668     XiveTCTX *tctx;
1669 
1670     pir = pnv_xive2_ic_tm_get_pir(xive, offset);
1671     hw_page_offset = pnv_xive2_ic_tm_get_hw_page_offset(xive, offset);
1672     tctx = pnv_xive2_get_indirect_tctx(xive, pir);
1673     if (tctx) {
1674         xive_tctx_tm_write(xptr, tctx, hw_page_offset, val, size);
1675     }
1676 }
1677 
1678 static const MemoryRegionOps pnv_xive2_ic_tm_indirect_ops = {
1679     .read = pnv_xive2_ic_tm_indirect_read,
1680     .write = pnv_xive2_ic_tm_indirect_write,
1681     .endianness = DEVICE_BIG_ENDIAN,
1682     .valid = {
1683         .min_access_size = 1,
1684         .max_access_size = 8,
1685     },
1686     .impl = {
1687         .min_access_size = 1,
1688         .max_access_size = 8,
1689     },
1690 };
1691 
1692 /*
1693  * TIMA ops
1694  */
1695 static void pnv_xive2_tm_write(void *opaque, hwaddr offset,
1696                                uint64_t value, unsigned size)
1697 {
1698     PowerPCCPU *cpu = POWERPC_CPU(current_cpu);
1699     PnvXive2 *xive = pnv_xive2_tm_get_xive(cpu);
1700     XiveTCTX *tctx = XIVE_TCTX(pnv_cpu_state(cpu)->intc);
1701     XivePresenter *xptr = XIVE_PRESENTER(xive);
1702 
1703     xive_tctx_tm_write(xptr, tctx, offset, value, size);
1704 }
1705 
1706 static uint64_t pnv_xive2_tm_read(void *opaque, hwaddr offset, unsigned size)
1707 {
1708     PowerPCCPU *cpu = POWERPC_CPU(current_cpu);
1709     PnvXive2 *xive = pnv_xive2_tm_get_xive(cpu);
1710     XiveTCTX *tctx = XIVE_TCTX(pnv_cpu_state(cpu)->intc);
1711     XivePresenter *xptr = XIVE_PRESENTER(xive);
1712 
1713     return xive_tctx_tm_read(xptr, tctx, offset, size);
1714 }
1715 
1716 static const MemoryRegionOps pnv_xive2_tm_ops = {
1717     .read = pnv_xive2_tm_read,
1718     .write = pnv_xive2_tm_write,
1719     .endianness = DEVICE_BIG_ENDIAN,
1720     .valid = {
1721         .min_access_size = 1,
1722         .max_access_size = 8,
1723     },
1724     .impl = {
1725         .min_access_size = 1,
1726         .max_access_size = 8,
1727     },
1728 };
1729 
1730 static uint64_t pnv_xive2_nvc_read(void *opaque, hwaddr offset,
1731                                    unsigned size)
1732 {
1733     PnvXive2 *xive = PNV_XIVE2(opaque);
1734 
1735     xive2_error(xive, "NVC: invalid read @%"HWADDR_PRIx, offset);
1736     return -1;
1737 }
1738 
1739 static void pnv_xive2_nvc_write(void *opaque, hwaddr offset,
1740                                 uint64_t val, unsigned size)
1741 {
1742     PnvXive2 *xive = PNV_XIVE2(opaque);
1743 
1744     xive2_error(xive, "NVC: invalid write @%"HWADDR_PRIx, offset);
1745 }
1746 
1747 static const MemoryRegionOps pnv_xive2_nvc_ops = {
1748     .read = pnv_xive2_nvc_read,
1749     .write = pnv_xive2_nvc_write,
1750     .endianness = DEVICE_BIG_ENDIAN,
1751     .valid = {
1752         .min_access_size = 8,
1753         .max_access_size = 8,
1754     },
1755     .impl = {
1756         .min_access_size = 8,
1757         .max_access_size = 8,
1758     },
1759 };
1760 
1761 static uint64_t pnv_xive2_nvpg_read(void *opaque, hwaddr offset,
1762                                     unsigned size)
1763 {
1764     PnvXive2 *xive = PNV_XIVE2(opaque);
1765 
1766     xive2_error(xive, "NVPG: invalid read @%"HWADDR_PRIx, offset);
1767     return -1;
1768 }
1769 
1770 static void pnv_xive2_nvpg_write(void *opaque, hwaddr offset,
1771                                  uint64_t val, unsigned size)
1772 {
1773     PnvXive2 *xive = PNV_XIVE2(opaque);
1774 
1775     xive2_error(xive, "NVPG: invalid write @%"HWADDR_PRIx, offset);
1776 }
1777 
1778 static const MemoryRegionOps pnv_xive2_nvpg_ops = {
1779     .read = pnv_xive2_nvpg_read,
1780     .write = pnv_xive2_nvpg_write,
1781     .endianness = DEVICE_BIG_ENDIAN,
1782     .valid = {
1783         .min_access_size = 8,
1784         .max_access_size = 8,
1785     },
1786     .impl = {
1787         .min_access_size = 8,
1788         .max_access_size = 8,
1789     },
1790 };
1791 
1792 /*
1793  * POWER10 default capabilities: 0x2000120076f000FC
1794  */
1795 #define PNV_XIVE2_CAPABILITIES  0x2000120076f000FC
1796 
1797 /*
1798  * POWER10 default configuration: 0x0030000033000000
1799  *
1800  * 8bits thread id was dropped for P10
1801  */
1802 #define PNV_XIVE2_CONFIGURATION 0x0030000033000000
1803 
1804 static void pnv_xive2_reset(void *dev)
1805 {
1806     PnvXive2 *xive = PNV_XIVE2(dev);
1807     XiveSource *xsrc = &xive->ipi_source;
1808     Xive2EndSource *end_xsrc = &xive->end_source;
1809 
1810     xive->cq_regs[CQ_XIVE_CAP >> 3] = xive->capabilities;
1811     xive->cq_regs[CQ_XIVE_CFG >> 3] = xive->config;
1812 
1813     /* HW hardwires the #Topology of the chip in the block field */
1814     xive->cq_regs[CQ_XIVE_CFG >> 3] |=
1815         SETFIELD(CQ_XIVE_CFG_HYP_HARD_BLOCK_ID, 0ull, xive->chip->chip_id);
1816 
1817     /* Set default page size to 64k */
1818     xive->ic_shift = xive->esb_shift = xive->end_shift = 16;
1819     xive->nvc_shift = xive->nvpg_shift = xive->tm_shift = 16;
1820 
1821     /* Clear source MMIOs */
1822     if (memory_region_is_mapped(&xsrc->esb_mmio)) {
1823         memory_region_del_subregion(&xive->esb_mmio, &xsrc->esb_mmio);
1824     }
1825 
1826     if (memory_region_is_mapped(&end_xsrc->esb_mmio)) {
1827         memory_region_del_subregion(&xive->end_mmio, &end_xsrc->esb_mmio);
1828     }
1829 }
1830 
1831 /*
1832  *  Maximum number of IRQs and ENDs supported by HW. Will be tuned by
1833  *  software.
1834  */
1835 #define PNV_XIVE2_NR_IRQS (PNV10_XIVE2_ESB_SIZE / (1ull << XIVE_ESB_64K_2PAGE))
1836 #define PNV_XIVE2_NR_ENDS (PNV10_XIVE2_END_SIZE / (1ull << XIVE_ESB_64K_2PAGE))
1837 
1838 static void pnv_xive2_realize(DeviceState *dev, Error **errp)
1839 {
1840     PnvXive2 *xive = PNV_XIVE2(dev);
1841     PnvXive2Class *pxc = PNV_XIVE2_GET_CLASS(dev);
1842     XiveSource *xsrc = &xive->ipi_source;
1843     Xive2EndSource *end_xsrc = &xive->end_source;
1844     Error *local_err = NULL;
1845     int i;
1846 
1847     pxc->parent_realize(dev, &local_err);
1848     if (local_err) {
1849         error_propagate(errp, local_err);
1850         return;
1851     }
1852 
1853     assert(xive->chip);
1854 
1855     /*
1856      * The XiveSource and Xive2EndSource objects are realized with the
1857      * maximum allowed HW configuration. The ESB MMIO regions will be
1858      * resized dynamically when the controller is configured by the FW
1859      * to limit accesses to resources not provisioned.
1860      */
1861     object_property_set_int(OBJECT(xsrc), "flags", XIVE_SRC_STORE_EOI,
1862                             &error_fatal);
1863     object_property_set_int(OBJECT(xsrc), "nr-irqs", PNV_XIVE2_NR_IRQS,
1864                             &error_fatal);
1865     object_property_set_link(OBJECT(xsrc), "xive", OBJECT(xive),
1866                              &error_fatal);
1867     qdev_realize(DEVICE(xsrc), NULL, &local_err);
1868     if (local_err) {
1869         error_propagate(errp, local_err);
1870         return;
1871     }
1872 
1873     object_property_set_int(OBJECT(end_xsrc), "nr-ends", PNV_XIVE2_NR_ENDS,
1874                             &error_fatal);
1875     object_property_set_link(OBJECT(end_xsrc), "xive", OBJECT(xive),
1876                              &error_abort);
1877     qdev_realize(DEVICE(end_xsrc), NULL, &local_err);
1878     if (local_err) {
1879         error_propagate(errp, local_err);
1880         return;
1881     }
1882 
1883     /* XSCOM region, used for initial configuration of the BARs */
1884     memory_region_init_io(&xive->xscom_regs, OBJECT(dev),
1885                           &pnv_xive2_xscom_ops, xive, "xscom-xive",
1886                           PNV10_XSCOM_XIVE2_SIZE << 3);
1887 
1888     /* Interrupt controller MMIO regions */
1889     xive->ic_shift = 16;
1890     memory_region_init(&xive->ic_mmio, OBJECT(dev), "xive-ic",
1891                        PNV10_XIVE2_IC_SIZE);
1892 
1893     for (i = 0; i < ARRAY_SIZE(xive->ic_mmios); i++) {
1894         memory_region_init_io(&xive->ic_mmios[i], OBJECT(dev),
1895                          pnv_xive2_ic_regions[i].ops, xive,
1896                          pnv_xive2_ic_regions[i].name,
1897                          pnv_xive2_ic_regions[i].pgsize << xive->ic_shift);
1898     }
1899 
1900     /*
1901      * VC MMIO regions.
1902      */
1903     xive->esb_shift = 16;
1904     xive->end_shift = 16;
1905     memory_region_init(&xive->esb_mmio, OBJECT(xive), "xive-esb",
1906                        PNV10_XIVE2_ESB_SIZE);
1907     memory_region_init(&xive->end_mmio, OBJECT(xive), "xive-end",
1908                        PNV10_XIVE2_END_SIZE);
1909 
1910     /* Presenter Controller MMIO region (not modeled) */
1911     xive->nvc_shift = 16;
1912     xive->nvpg_shift = 16;
1913     memory_region_init_io(&xive->nvc_mmio, OBJECT(dev),
1914                           &pnv_xive2_nvc_ops, xive,
1915                           "xive-nvc", PNV10_XIVE2_NVC_SIZE);
1916 
1917     memory_region_init_io(&xive->nvpg_mmio, OBJECT(dev),
1918                           &pnv_xive2_nvpg_ops, xive,
1919                           "xive-nvpg", PNV10_XIVE2_NVPG_SIZE);
1920 
1921     /* Thread Interrupt Management Area (Direct) */
1922     xive->tm_shift = 16;
1923     memory_region_init_io(&xive->tm_mmio, OBJECT(dev), &pnv_xive2_tm_ops,
1924                           xive, "xive-tima", PNV10_XIVE2_TM_SIZE);
1925 
1926     qemu_register_reset(pnv_xive2_reset, dev);
1927 }
1928 
1929 static Property pnv_xive2_properties[] = {
1930     DEFINE_PROP_UINT64("ic-bar", PnvXive2, ic_base, 0),
1931     DEFINE_PROP_UINT64("esb-bar", PnvXive2, esb_base, 0),
1932     DEFINE_PROP_UINT64("end-bar", PnvXive2, end_base, 0),
1933     DEFINE_PROP_UINT64("nvc-bar", PnvXive2, nvc_base, 0),
1934     DEFINE_PROP_UINT64("nvpg-bar", PnvXive2, nvpg_base, 0),
1935     DEFINE_PROP_UINT64("tm-bar", PnvXive2, tm_base, 0),
1936     DEFINE_PROP_UINT64("capabilities", PnvXive2, capabilities,
1937                        PNV_XIVE2_CAPABILITIES),
1938     DEFINE_PROP_UINT64("config", PnvXive2, config,
1939                        PNV_XIVE2_CONFIGURATION),
1940     DEFINE_PROP_LINK("chip", PnvXive2, chip, TYPE_PNV_CHIP, PnvChip *),
1941     DEFINE_PROP_END_OF_LIST(),
1942 };
1943 
1944 static void pnv_xive2_instance_init(Object *obj)
1945 {
1946     PnvXive2 *xive = PNV_XIVE2(obj);
1947 
1948     object_initialize_child(obj, "ipi_source", &xive->ipi_source,
1949                             TYPE_XIVE_SOURCE);
1950     object_initialize_child(obj, "end_source", &xive->end_source,
1951                             TYPE_XIVE2_END_SOURCE);
1952 }
1953 
1954 static int pnv_xive2_dt_xscom(PnvXScomInterface *dev, void *fdt,
1955                               int xscom_offset)
1956 {
1957     const char compat_p10[] = "ibm,power10-xive-x";
1958     char *name;
1959     int offset;
1960     uint32_t reg[] = {
1961         cpu_to_be32(PNV10_XSCOM_XIVE2_BASE),
1962         cpu_to_be32(PNV10_XSCOM_XIVE2_SIZE)
1963     };
1964 
1965     name = g_strdup_printf("xive@%x", PNV10_XSCOM_XIVE2_BASE);
1966     offset = fdt_add_subnode(fdt, xscom_offset, name);
1967     _FDT(offset);
1968     g_free(name);
1969 
1970     _FDT((fdt_setprop(fdt, offset, "reg", reg, sizeof(reg))));
1971     _FDT(fdt_setprop(fdt, offset, "compatible", compat_p10,
1972                      sizeof(compat_p10)));
1973     return 0;
1974 }
1975 
1976 static void pnv_xive2_class_init(ObjectClass *klass, void *data)
1977 {
1978     DeviceClass *dc = DEVICE_CLASS(klass);
1979     PnvXScomInterfaceClass *xdc = PNV_XSCOM_INTERFACE_CLASS(klass);
1980     Xive2RouterClass *xrc = XIVE2_ROUTER_CLASS(klass);
1981     XiveNotifierClass *xnc = XIVE_NOTIFIER_CLASS(klass);
1982     XivePresenterClass *xpc = XIVE_PRESENTER_CLASS(klass);
1983     PnvXive2Class *pxc = PNV_XIVE2_CLASS(klass);
1984 
1985     xdc->dt_xscom  = pnv_xive2_dt_xscom;
1986 
1987     dc->desc       = "PowerNV XIVE2 Interrupt Controller (POWER10)";
1988     device_class_set_parent_realize(dc, pnv_xive2_realize,
1989                                     &pxc->parent_realize);
1990     device_class_set_props(dc, pnv_xive2_properties);
1991 
1992     xrc->get_eas   = pnv_xive2_get_eas;
1993     xrc->get_pq    = pnv_xive2_get_pq;
1994     xrc->set_pq    = pnv_xive2_set_pq;
1995     xrc->get_end   = pnv_xive2_get_end;
1996     xrc->write_end = pnv_xive2_write_end;
1997     xrc->get_nvp   = pnv_xive2_get_nvp;
1998     xrc->write_nvp = pnv_xive2_write_nvp;
1999     xrc->get_config  = pnv_xive2_get_config;
2000     xrc->get_block_id = pnv_xive2_get_block_id;
2001 
2002     xnc->notify    = pnv_xive2_notify;
2003 
2004     xpc->match_nvt  = pnv_xive2_match_nvt;
2005     xpc->get_config = pnv_xive2_presenter_get_config;
2006 };
2007 
2008 static const TypeInfo pnv_xive2_info = {
2009     .name          = TYPE_PNV_XIVE2,
2010     .parent        = TYPE_XIVE2_ROUTER,
2011     .instance_init = pnv_xive2_instance_init,
2012     .instance_size = sizeof(PnvXive2),
2013     .class_init    = pnv_xive2_class_init,
2014     .class_size    = sizeof(PnvXive2Class),
2015     .interfaces    = (InterfaceInfo[]) {
2016         { TYPE_PNV_XSCOM_INTERFACE },
2017         { }
2018     }
2019 };
2020 
2021 static void pnv_xive2_register_types(void)
2022 {
2023     type_register_static(&pnv_xive2_info);
2024 }
2025 
2026 type_init(pnv_xive2_register_types)
2027 
2028 static void xive2_nvp_pic_print_info(Xive2Nvp *nvp, uint32_t nvp_idx,
2029                                      GString *buf)
2030 {
2031     uint8_t  eq_blk = xive_get_field32(NVP2_W5_VP_END_BLOCK, nvp->w5);
2032     uint32_t eq_idx = xive_get_field32(NVP2_W5_VP_END_INDEX, nvp->w5);
2033 
2034     if (!xive2_nvp_is_valid(nvp)) {
2035         return;
2036     }
2037 
2038     g_string_append_printf(buf, "  %08x end:%02x/%04x IPB:%02x",
2039                            nvp_idx, eq_blk, eq_idx,
2040                            xive_get_field32(NVP2_W2_IPB, nvp->w2));
2041     /*
2042      * When the NVP is HW controlled, more fields are updated
2043      */
2044     if (xive2_nvp_is_hw(nvp)) {
2045         g_string_append_printf(buf, " CPPR:%02x",
2046                                xive_get_field32(NVP2_W2_CPPR, nvp->w2));
2047         if (xive2_nvp_is_co(nvp)) {
2048             g_string_append_printf(buf, " CO:%04x",
2049                                    xive_get_field32(NVP2_W1_CO_THRID, nvp->w1));
2050         }
2051     }
2052     g_string_append_c(buf, '\n');
2053 }
2054 
2055 /*
2056  * If the table is direct, we can compute the number of PQ entries
2057  * provisioned by FW.
2058  */
2059 static uint32_t pnv_xive2_nr_esbs(PnvXive2 *xive)
2060 {
2061     uint8_t blk = pnv_xive2_block_id(xive);
2062     uint64_t vsd = xive->vsds[VST_ESB][blk];
2063     uint64_t vst_tsize = 1ull << (GETFIELD(VSD_TSIZE, vsd) + 12);
2064 
2065     return VSD_INDIRECT & vsd ? 0 : vst_tsize * SBE_PER_BYTE;
2066 }
2067 
2068 /*
2069  * Compute the number of entries per indirect subpage.
2070  */
2071 static uint64_t pnv_xive2_vst_per_subpage(PnvXive2 *xive, uint32_t type)
2072 {
2073     uint8_t blk = pnv_xive2_block_id(xive);
2074     uint64_t vsd = xive->vsds[type][blk];
2075     const XiveVstInfo *info = &vst_infos[type];
2076     uint64_t vsd_addr;
2077     uint32_t page_shift;
2078 
2079     /* For direct tables, fake a valid value */
2080     if (!(VSD_INDIRECT & vsd)) {
2081         return 1;
2082     }
2083 
2084     /* Get the page size of the indirect table. */
2085     vsd_addr = vsd & VSD_ADDRESS_MASK;
2086     ldq_be_dma(&address_space_memory, vsd_addr, &vsd, MEMTXATTRS_UNSPECIFIED);
2087 
2088     if (!(vsd & VSD_ADDRESS_MASK)) {
2089 #ifdef XIVE2_DEBUG
2090         xive2_error(xive, "VST: invalid %s entry!?", info->name);
2091 #endif
2092         return 0;
2093     }
2094 
2095     page_shift = GETFIELD(VSD_TSIZE, vsd) + 12;
2096 
2097     if (!pnv_xive2_vst_page_size_allowed(page_shift)) {
2098         xive2_error(xive, "VST: invalid %s page shift %d", info->name,
2099                    page_shift);
2100         return 0;
2101     }
2102 
2103     return (1ull << page_shift) / info->size;
2104 }
2105 
2106 void pnv_xive2_pic_print_info(PnvXive2 *xive, GString *buf)
2107 {
2108     Xive2Router *xrtr = XIVE2_ROUTER(xive);
2109     uint8_t blk = pnv_xive2_block_id(xive);
2110     uint8_t chip_id = xive->chip->chip_id;
2111     uint32_t srcno0 = XIVE_EAS(blk, 0);
2112     uint32_t nr_esbs = pnv_xive2_nr_esbs(xive);
2113     Xive2Eas eas;
2114     Xive2End end;
2115     Xive2Nvp nvp;
2116     int i;
2117     uint64_t xive_nvp_per_subpage;
2118 
2119     g_string_append_printf(buf, "XIVE[%x] Source %08x .. %08x\n",
2120                            blk, srcno0, srcno0 + nr_esbs - 1);
2121     xive_source_pic_print_info(&xive->ipi_source, srcno0, buf);
2122 
2123     g_string_append_printf(buf, "XIVE[%x] EAT %08x .. %08x\n",
2124                            blk, srcno0, srcno0 + nr_esbs - 1);
2125     for (i = 0; i < nr_esbs; i++) {
2126         if (xive2_router_get_eas(xrtr, blk, i, &eas)) {
2127             break;
2128         }
2129         if (!xive2_eas_is_masked(&eas)) {
2130             xive2_eas_pic_print_info(&eas, i, buf);
2131         }
2132     }
2133 
2134     g_string_append_printf(buf, "XIVE[%x] #%d END Escalation EAT\n",
2135                            chip_id, blk);
2136     i = 0;
2137     while (!xive2_router_get_end(xrtr, blk, i, &end)) {
2138         xive2_end_eas_pic_print_info(&end, i++, buf);
2139     }
2140 
2141     g_string_append_printf(buf, "XIVE[%x] #%d ENDT\n", chip_id, blk);
2142     i = 0;
2143     while (!xive2_router_get_end(xrtr, blk, i, &end)) {
2144         xive2_end_pic_print_info(&end, i++, buf);
2145     }
2146 
2147     g_string_append_printf(buf, "XIVE[%x] #%d NVPT %08x .. %08x\n",
2148                            chip_id, blk, 0, XIVE2_NVP_COUNT - 1);
2149     xive_nvp_per_subpage = pnv_xive2_vst_per_subpage(xive, VST_NVP);
2150     for (i = 0; i < XIVE2_NVP_COUNT; i += xive_nvp_per_subpage) {
2151         while (!xive2_router_get_nvp(xrtr, blk, i, &nvp)) {
2152             xive2_nvp_pic_print_info(&nvp, i++, buf);
2153         }
2154     }
2155 }
2156