xref: /openbmc/qemu/hw/intc/pnv_xive2.c (revision 9898cc80306588eb6a1c44b7ba38f207ca8bdcfa)
1 /*
2  * QEMU PowerPC XIVE2 interrupt controller model  (POWER10)
3  *
4  * Copyright (c) 2019-2024, IBM Corporation.
5  *
6  * SPDX-License-Identifier: GPL-2.0-or-later
7  */
8 
9 #include "qemu/osdep.h"
10 #include "qemu/log.h"
11 #include "qapi/error.h"
12 #include "target/ppc/cpu.h"
13 #include "system/cpus.h"
14 #include "system/dma.h"
15 #include "hw/ppc/fdt.h"
16 #include "hw/ppc/pnv.h"
17 #include "hw/ppc/pnv_chip.h"
18 #include "hw/ppc/pnv_core.h"
19 #include "hw/ppc/pnv_xscom.h"
20 #include "hw/ppc/xive2.h"
21 #include "hw/ppc/pnv_xive.h"
22 #include "hw/ppc/xive_regs.h"
23 #include "hw/ppc/xive2_regs.h"
24 #include "hw/ppc/ppc.h"
25 #include "hw/qdev-properties.h"
26 #include "system/reset.h"
27 #include "system/qtest.h"
28 
29 #include <libfdt.h>
30 
31 #include "pnv_xive2_regs.h"
32 
33 #undef XIVE2_DEBUG
34 
35 /* XIVE Sync or Flush Notification Block */
36 typedef struct XiveSfnBlock {
37     uint8_t bytes[32];
38 } XiveSfnBlock;
39 
40 /* XIVE Thread Sync or Flush Notification Area */
41 typedef struct XiveThreadNA {
42     XiveSfnBlock topo[16];
43 } XiveThreadNA;
44 
45 /*
46  * Virtual structures table (VST)
47  */
48 #define SBE_PER_BYTE   4
49 
50 typedef struct XiveVstInfo {
51     const char *name;
52     uint32_t    size;
53     uint32_t    max_blocks;
54 } XiveVstInfo;
55 
56 static const XiveVstInfo vst_infos[] = {
57 
58     [VST_EAS]  = { "EAT",  sizeof(Xive2Eas),     16 },
59     [VST_ESB]  = { "ESB",  1,                    16 },
60     [VST_END]  = { "ENDT", sizeof(Xive2End),     16 },
61 
62     [VST_NVP]  = { "NVPT", sizeof(Xive2Nvp),     16 },
63     [VST_NVG]  = { "NVGT", sizeof(Xive2Nvgc),    16 },
64     [VST_NVC]  = { "NVCT", sizeof(Xive2Nvgc),    16 },
65 
66     [VST_IC]  =  { "IC",   1, /* ? */            16 }, /* Topology # */
67     [VST_SYNC] = { "SYNC", sizeof(XiveThreadNA), 16 }, /* Topology # */
68 
69     /*
70      * This table contains the backing store pages for the interrupt
71      * fifos of the VC sub-engine in case of overflow.
72      *
73      * 0 - IPI,
74      * 1 - HWD,
75      * 2 - NxC,
76      * 3 - INT,
77      * 4 - OS-Queue,
78      * 5 - Pool-Queue,
79      * 6 - Hard-Queue
80      */
81     [VST_ERQ]  = { "ERQ",  1,                   VC_QUEUE_COUNT },
82 };
83 
84 #define xive2_error(xive, fmt, ...)                                      \
85     qemu_log_mask(LOG_GUEST_ERROR, "XIVE[%x] - " fmt "\n",              \
86                   (xive)->chip->chip_id, ## __VA_ARGS__);
87 
88 /*
89  * TODO: Document block id override
90  */
91 static uint32_t pnv_xive2_block_id(PnvXive2 *xive)
92 {
93     uint8_t blk = xive->chip->chip_id;
94     uint64_t cfg_val = xive->cq_regs[CQ_XIVE_CFG >> 3];
95 
96     if (cfg_val & CQ_XIVE_CFG_HYP_HARD_BLKID_OVERRIDE) {
97         blk = GETFIELD(CQ_XIVE_CFG_HYP_HARD_BLOCK_ID, cfg_val);
98     }
99 
100     return blk;
101 }
102 
103 /*
104  * Remote access to INT controllers. HW uses MMIOs(?). For now, a simple
105  * scan of all the chips INT controller is good enough.
106  */
107 static PnvXive2 *pnv_xive2_get_remote(uint32_t vsd_type, hwaddr fwd_addr)
108 {
109     PnvMachineState *pnv = PNV_MACHINE(qdev_get_machine());
110     int i;
111 
112     for (i = 0; i < pnv->num_chips; i++) {
113         Pnv10Chip *chip10 = PNV10_CHIP(pnv->chips[i]);
114         PnvXive2 *xive = &chip10->xive;
115 
116         /*
117          * Is this the XIVE matching the forwarded VSD address is for this
118          * VSD type
119          */
120         if ((vsd_type == VST_ESB   && fwd_addr == xive->esb_base) ||
121             (vsd_type == VST_END   && fwd_addr == xive->end_base)  ||
122             ((vsd_type == VST_NVP ||
123               vsd_type == VST_NVG) && fwd_addr == xive->nvpg_base) ||
124             (vsd_type == VST_NVC   && fwd_addr == xive->nvc_base)) {
125             return xive;
126         }
127     }
128 
129     qemu_log_mask(LOG_GUEST_ERROR,
130                  "XIVE: >>>>> %s vsd_type %u  fwd_addr 0x%"HWADDR_PRIx
131                   " NOT FOUND\n",
132                   __func__, vsd_type, fwd_addr);
133     return NULL;
134 }
135 
136 /*
137  * VST accessors for ESB, EAT, ENDT, NVP
138  *
139  * Indirect VST tables are arrays of VSDs pointing to a page (of same
140  * size). Each page is a direct VST table.
141  */
142 
143 #define XIVE_VSD_SIZE 8
144 
145 /* Indirect page size can be 4K, 64K, 2M, 16M. */
146 static uint64_t pnv_xive2_vst_page_size_allowed(uint32_t page_shift)
147 {
148      return page_shift == 12 || page_shift == 16 ||
149          page_shift == 21 || page_shift == 24;
150 }
151 
152 static uint64_t pnv_xive2_vst_addr_direct(PnvXive2 *xive, uint32_t type,
153                                           uint64_t vsd, uint32_t idx)
154 {
155     const XiveVstInfo *info = &vst_infos[type];
156     uint64_t vst_addr = vsd & VSD_ADDRESS_MASK;
157     uint64_t vst_tsize = 1ull << (GETFIELD(VSD_TSIZE, vsd) + 12);
158     uint32_t idx_max;
159 
160     idx_max = vst_tsize / info->size - 1;
161     if (idx > idx_max) {
162 #ifdef XIVE2_DEBUG
163         xive2_error(xive, "VST: %s entry %x out of range [ 0 .. %x ] !?",
164                    info->name, idx, idx_max);
165 #endif
166         return 0;
167     }
168 
169     return vst_addr + idx * info->size;
170 }
171 
172 static uint64_t pnv_xive2_vst_addr_indirect(PnvXive2 *xive, uint32_t type,
173                                             uint64_t vsd, uint32_t idx)
174 {
175     const XiveVstInfo *info = &vst_infos[type];
176     uint64_t vsd_addr;
177     uint32_t vsd_idx;
178     uint32_t page_shift;
179     uint32_t vst_per_page;
180 
181     /* Get the page size of the indirect table. */
182     vsd_addr = vsd & VSD_ADDRESS_MASK;
183     ldq_be_dma(&address_space_memory, vsd_addr, &vsd, MEMTXATTRS_UNSPECIFIED);
184 
185     if (!(vsd & VSD_ADDRESS_MASK)) {
186 #ifdef XIVE2_DEBUG
187         xive2_error(xive, "VST: invalid %s entry %x !?", info->name, idx);
188 #endif
189         return 0;
190     }
191 
192     page_shift = GETFIELD(VSD_TSIZE, vsd) + 12;
193 
194     if (!pnv_xive2_vst_page_size_allowed(page_shift)) {
195         xive2_error(xive, "VST: invalid %s page shift %d", info->name,
196                    page_shift);
197         return 0;
198     }
199 
200     vst_per_page = (1ull << page_shift) / info->size;
201     vsd_idx = idx / vst_per_page;
202 
203     /* Load the VSD we are looking for, if not already done */
204     if (vsd_idx) {
205         vsd_addr = vsd_addr + vsd_idx * XIVE_VSD_SIZE;
206         ldq_be_dma(&address_space_memory, vsd_addr, &vsd,
207                    MEMTXATTRS_UNSPECIFIED);
208 
209         if (!(vsd & VSD_ADDRESS_MASK)) {
210 #ifdef XIVE2_DEBUG
211             xive2_error(xive, "VST: invalid %s entry %x !?", info->name, idx);
212 #endif
213             return 0;
214         }
215 
216         /*
217          * Check that the pages have a consistent size across the
218          * indirect table
219          */
220         if (page_shift != GETFIELD(VSD_TSIZE, vsd) + 12) {
221             xive2_error(xive, "VST: %s entry %x indirect page size differ !?",
222                        info->name, idx);
223             return 0;
224         }
225     }
226 
227     return pnv_xive2_vst_addr_direct(xive, type, vsd, (idx % vst_per_page));
228 }
229 
230 static uint8_t pnv_xive2_nvc_table_compress_shift(PnvXive2 *xive)
231 {
232     uint8_t shift =  GETFIELD(PC_NXC_PROC_CONFIG_NVC_TABLE_COMPRESS,
233                               xive->pc_regs[PC_NXC_PROC_CONFIG >> 3]);
234     return shift > 8 ? 0 : shift;
235 }
236 
237 static uint8_t pnv_xive2_nvg_table_compress_shift(PnvXive2 *xive)
238 {
239     uint8_t shift = GETFIELD(PC_NXC_PROC_CONFIG_NVG_TABLE_COMPRESS,
240                              xive->pc_regs[PC_NXC_PROC_CONFIG >> 3]);
241     return shift > 8 ? 0 : shift;
242 }
243 
244 static uint64_t pnv_xive2_vst_addr(PnvXive2 *xive, uint32_t type, uint8_t blk,
245                                    uint32_t idx)
246 {
247     const XiveVstInfo *info = &vst_infos[type];
248     uint64_t vsd;
249 
250     if (blk >= info->max_blocks) {
251         xive2_error(xive, "VST: invalid block id %d for VST %s %d !?",
252                    blk, info->name, idx);
253         return 0;
254     }
255 
256     vsd = xive->vsds[type][blk];
257     if (vsd == 0) {
258         xive2_error(xive, "VST: vsd == 0 block id %d for VST %s %d !?",
259                    blk, info->name, idx);
260         return 0;
261     }
262 
263     /* Remote VST access */
264     if (GETFIELD(VSD_MODE, vsd) == VSD_MODE_FORWARD) {
265         xive = pnv_xive2_get_remote(type, (vsd & VSD_ADDRESS_MASK));
266         return xive ? pnv_xive2_vst_addr(xive, type, blk, idx) : 0;
267     }
268 
269     if (type == VST_NVG) {
270         idx >>= pnv_xive2_nvg_table_compress_shift(xive);
271     } else if (type == VST_NVC) {
272         idx >>= pnv_xive2_nvc_table_compress_shift(xive);
273     }
274 
275     if (VSD_INDIRECT & vsd) {
276         return pnv_xive2_vst_addr_indirect(xive, type, vsd, idx);
277     }
278 
279     return pnv_xive2_vst_addr_direct(xive, type, vsd, idx);
280 }
281 
282 static int pnv_xive2_vst_read(PnvXive2 *xive, uint32_t type, uint8_t blk,
283                              uint32_t idx, void *data)
284 {
285     const XiveVstInfo *info = &vst_infos[type];
286     uint64_t addr = pnv_xive2_vst_addr(xive, type, blk, idx);
287     MemTxResult result;
288 
289     if (!addr) {
290         return -1;
291     }
292 
293     result = address_space_read(&address_space_memory, addr,
294                                 MEMTXATTRS_UNSPECIFIED, data,
295                                 info->size);
296     if (result != MEMTX_OK) {
297         xive2_error(xive, "VST: read failed at @0x%" HWADDR_PRIx
298                    " for VST %s %x/%x\n", addr, info->name, blk, idx);
299         return -1;
300     }
301     return 0;
302 }
303 
304 #define XIVE_VST_WORD_ALL -1
305 
306 static int pnv_xive2_vst_write(PnvXive2 *xive, uint32_t type, uint8_t blk,
307                                uint32_t idx, void *data, uint32_t word_number)
308 {
309     const XiveVstInfo *info = &vst_infos[type];
310     uint64_t addr = pnv_xive2_vst_addr(xive, type, blk, idx);
311     MemTxResult result;
312 
313     if (!addr) {
314         return -1;
315     }
316 
317     if (word_number == XIVE_VST_WORD_ALL) {
318         result = address_space_write(&address_space_memory, addr,
319                                      MEMTXATTRS_UNSPECIFIED, data,
320                                      info->size);
321     } else {
322         result = address_space_write(&address_space_memory,
323                                      addr + word_number * 4,
324                                      MEMTXATTRS_UNSPECIFIED,
325                                      data + word_number * 4, 4);
326     }
327 
328     if (result != MEMTX_OK) {
329         xive2_error(xive, "VST: write failed at @0x%" HWADDR_PRIx
330                    "for VST %s %x/%x\n", addr, info->name, blk, idx);
331         return -1;
332     }
333     return 0;
334 }
335 
336 static int pnv_xive2_get_pq(Xive2Router *xrtr, uint8_t blk, uint32_t idx,
337                              uint8_t *pq)
338 {
339     PnvXive2 *xive = PNV_XIVE2(xrtr);
340 
341     if (pnv_xive2_block_id(xive) != blk) {
342         xive2_error(xive, "VST: EAS %x is remote !?", XIVE_EAS(blk, idx));
343         return -1;
344     }
345 
346     *pq = xive_source_esb_get(&xive->ipi_source, idx);
347     return 0;
348 }
349 
350 static int pnv_xive2_set_pq(Xive2Router *xrtr, uint8_t blk, uint32_t idx,
351                              uint8_t *pq)
352 {
353     PnvXive2 *xive = PNV_XIVE2(xrtr);
354 
355     if (pnv_xive2_block_id(xive) != blk) {
356         xive2_error(xive, "VST: EAS %x is remote !?", XIVE_EAS(blk, idx));
357         return -1;
358     }
359 
360     *pq = xive_source_esb_set(&xive->ipi_source, idx, *pq);
361     return 0;
362 }
363 
364 static int pnv_xive2_get_end(Xive2Router *xrtr, uint8_t blk, uint32_t idx,
365                              Xive2End *end)
366 {
367     return pnv_xive2_vst_read(PNV_XIVE2(xrtr), VST_END, blk, idx, end);
368 }
369 
370 static int pnv_xive2_write_end(Xive2Router *xrtr, uint8_t blk, uint32_t idx,
371                                Xive2End *end, uint8_t word_number)
372 {
373     return pnv_xive2_vst_write(PNV_XIVE2(xrtr), VST_END, blk, idx, end,
374                               word_number);
375 }
376 
377 static inline int pnv_xive2_get_current_pir(PnvXive2 *xive)
378 {
379     if (!qtest_enabled()) {
380         PowerPCCPU *cpu = POWERPC_CPU(current_cpu);
381         return ppc_cpu_pir(cpu);
382     }
383     return 0;
384 }
385 
386 /*
387  * After SW injects a Queue Sync or Cache Flush operation, HW will notify
388  * SW of the completion of the operation by writing a byte of all 1's (0xff)
389  * to a specific memory location.  The memory location is calculated by first
390  * looking up a base address in the SYNC VSD using the Topology ID of the
391  * originating thread as the "block" number.  This points to a
392  * 64k block of memory that is further divided into 128 512 byte chunks of
393  * memory, which is indexed by the thread id of the requesting thread.
394  * Finally, this 512 byte chunk of memory is divided into 16 32 byte
395  * chunks which are indexed by the topology id of the targeted IC's chip.
396  * The values below are the offsets into that 32 byte chunk of memory for
397  * each type of cache flush or queue sync operation.
398  */
399 #define PNV_XIVE2_QUEUE_IPI              0x00
400 #define PNV_XIVE2_QUEUE_HW               0x01
401 #define PNV_XIVE2_QUEUE_NXC              0x02
402 #define PNV_XIVE2_QUEUE_INT              0x03
403 #define PNV_XIVE2_QUEUE_OS               0x04
404 #define PNV_XIVE2_QUEUE_POOL             0x05
405 #define PNV_XIVE2_QUEUE_HARD             0x06
406 #define PNV_XIVE2_CACHE_ENDC             0x08
407 #define PNV_XIVE2_CACHE_ESBC             0x09
408 #define PNV_XIVE2_CACHE_EASC             0x0a
409 #define PNV_XIVE2_QUEUE_NXC_LD_LCL_NCO   0x10
410 #define PNV_XIVE2_QUEUE_NXC_LD_LCL_CO    0x11
411 #define PNV_XIVE2_QUEUE_NXC_ST_LCL_NCI   0x12
412 #define PNV_XIVE2_QUEUE_NXC_ST_LCL_CI    0x13
413 #define PNV_XIVE2_QUEUE_NXC_ST_RMT_NCI   0x14
414 #define PNV_XIVE2_QUEUE_NXC_ST_RMT_CI    0x15
415 #define PNV_XIVE2_CACHE_NXC              0x18
416 
417 static int pnv_xive2_inject_notify(PnvXive2 *xive, int type)
418 {
419     uint64_t addr;
420     int pir = pnv_xive2_get_current_pir(xive);
421     int thread_nr = PNV10_PIR2THREAD(pir);
422     int thread_topo_id = PNV10_PIR2CHIP(pir);
423     int ic_topo_id = xive->chip->chip_id;
424     uint64_t offset = ic_topo_id * sizeof(XiveSfnBlock);
425     uint8_t byte = 0xff;
426     MemTxResult result;
427 
428     /* Retrieve the address of requesting thread's notification area */
429     addr = pnv_xive2_vst_addr(xive, VST_SYNC, thread_topo_id, thread_nr);
430 
431     if (!addr) {
432         xive2_error(xive, "VST: no SYNC entry %x/%x !?",
433                     thread_topo_id, thread_nr);
434         return -1;
435     }
436 
437     address_space_stb(&address_space_memory, addr + offset + type, byte,
438                       MEMTXATTRS_UNSPECIFIED, &result);
439     assert(result == MEMTX_OK);
440 
441     return 0;
442 }
443 
444 static int pnv_xive2_end_update(PnvXive2 *xive, uint8_t watch_engine)
445 {
446     uint8_t  blk;
447     uint32_t idx;
448     int i, spec_reg, data_reg;
449     uint64_t endc_watch[4];
450 
451     assert(watch_engine < ARRAY_SIZE(endc_watch));
452 
453     spec_reg = (VC_ENDC_WATCH0_SPEC + watch_engine * 0x40) >> 3;
454     data_reg = (VC_ENDC_WATCH0_DATA0 + watch_engine * 0x40) >> 3;
455     blk = GETFIELD(VC_ENDC_WATCH_BLOCK_ID, xive->vc_regs[spec_reg]);
456     idx = GETFIELD(VC_ENDC_WATCH_INDEX, xive->vc_regs[spec_reg]);
457 
458     for (i = 0; i < ARRAY_SIZE(endc_watch); i++) {
459         endc_watch[i] = cpu_to_be64(xive->vc_regs[data_reg + i]);
460     }
461 
462     return pnv_xive2_vst_write(xive, VST_END, blk, idx, endc_watch,
463                               XIVE_VST_WORD_ALL);
464 }
465 
466 static void pnv_xive2_end_cache_load(PnvXive2 *xive, uint8_t watch_engine)
467 {
468     uint8_t  blk;
469     uint32_t idx;
470     uint64_t endc_watch[4] = { 0 };
471     int i, spec_reg, data_reg;
472 
473     assert(watch_engine < ARRAY_SIZE(endc_watch));
474 
475     spec_reg = (VC_ENDC_WATCH0_SPEC + watch_engine * 0x40) >> 3;
476     data_reg = (VC_ENDC_WATCH0_DATA0 + watch_engine * 0x40) >> 3;
477     blk = GETFIELD(VC_ENDC_WATCH_BLOCK_ID, xive->vc_regs[spec_reg]);
478     idx = GETFIELD(VC_ENDC_WATCH_INDEX, xive->vc_regs[spec_reg]);
479 
480     if (pnv_xive2_vst_read(xive, VST_END, blk, idx, endc_watch)) {
481         xive2_error(xive, "VST: no END entry %x/%x !?", blk, idx);
482     }
483 
484     for (i = 0; i < ARRAY_SIZE(endc_watch); i++) {
485         xive->vc_regs[data_reg + i] = be64_to_cpu(endc_watch[i]);
486     }
487 }
488 
489 static int pnv_xive2_get_nvp(Xive2Router *xrtr, uint8_t blk, uint32_t idx,
490                              Xive2Nvp *nvp)
491 {
492     return pnv_xive2_vst_read(PNV_XIVE2(xrtr), VST_NVP, blk, idx, nvp);
493 }
494 
495 static int pnv_xive2_write_nvp(Xive2Router *xrtr, uint8_t blk, uint32_t idx,
496                                Xive2Nvp *nvp, uint8_t word_number)
497 {
498     return pnv_xive2_vst_write(PNV_XIVE2(xrtr), VST_NVP, blk, idx, nvp,
499                               word_number);
500 }
501 
502 static int pnv_xive2_get_nvgc(Xive2Router *xrtr, bool crowd,
503                               uint8_t blk, uint32_t idx,
504                               Xive2Nvgc *nvgc)
505 {
506     return pnv_xive2_vst_read(PNV_XIVE2(xrtr), crowd ? VST_NVC : VST_NVG,
507                               blk, idx, nvgc);
508 }
509 
510 static int pnv_xive2_write_nvgc(Xive2Router *xrtr, bool crowd,
511                                 uint8_t blk, uint32_t idx,
512                                 Xive2Nvgc *nvgc)
513 {
514     return pnv_xive2_vst_write(PNV_XIVE2(xrtr), crowd ? VST_NVC : VST_NVG,
515                                blk, idx, nvgc,
516                                XIVE_VST_WORD_ALL);
517 }
518 
519 static int pnv_xive2_nxc_to_table_type(uint8_t nxc_type, uint32_t *table_type)
520 {
521     switch (nxc_type) {
522     case PC_NXC_WATCH_NXC_NVP:
523         *table_type = VST_NVP;
524         break;
525     case PC_NXC_WATCH_NXC_NVG:
526         *table_type = VST_NVG;
527         break;
528     case PC_NXC_WATCH_NXC_NVC:
529         *table_type = VST_NVC;
530         break;
531     default:
532         qemu_log_mask(LOG_GUEST_ERROR,
533                       "XIVE: invalid table type for nxc operation\n");
534         return -1;
535     }
536     return 0;
537 }
538 
539 static int pnv_xive2_nxc_update(PnvXive2 *xive, uint8_t watch_engine)
540 {
541     uint8_t  blk, nxc_type;
542     uint32_t idx, table_type = -1;
543     int i, spec_reg, data_reg;
544     uint64_t nxc_watch[4];
545 
546     assert(watch_engine < ARRAY_SIZE(nxc_watch));
547 
548     spec_reg = (PC_NXC_WATCH0_SPEC + watch_engine * 0x40) >> 3;
549     data_reg = (PC_NXC_WATCH0_DATA0 + watch_engine * 0x40) >> 3;
550     nxc_type = GETFIELD(PC_NXC_WATCH_NXC_TYPE, xive->pc_regs[spec_reg]);
551     blk = GETFIELD(PC_NXC_WATCH_BLOCK_ID, xive->pc_regs[spec_reg]);
552     idx = GETFIELD(PC_NXC_WATCH_INDEX, xive->pc_regs[spec_reg]);
553 
554     assert(!pnv_xive2_nxc_to_table_type(nxc_type, &table_type));
555 
556     for (i = 0; i < ARRAY_SIZE(nxc_watch); i++) {
557         nxc_watch[i] = cpu_to_be64(xive->pc_regs[data_reg + i]);
558     }
559 
560     return pnv_xive2_vst_write(xive, table_type, blk, idx, nxc_watch,
561                               XIVE_VST_WORD_ALL);
562 }
563 
564 static void pnv_xive2_nxc_cache_load(PnvXive2 *xive, uint8_t watch_engine)
565 {
566     uint8_t  blk, nxc_type;
567     uint32_t idx, table_type = -1;
568     uint64_t nxc_watch[4] = { 0 };
569     int i, spec_reg, data_reg;
570 
571     assert(watch_engine < ARRAY_SIZE(nxc_watch));
572 
573     spec_reg = (PC_NXC_WATCH0_SPEC + watch_engine * 0x40) >> 3;
574     data_reg = (PC_NXC_WATCH0_DATA0 + watch_engine * 0x40) >> 3;
575     nxc_type = GETFIELD(PC_NXC_WATCH_NXC_TYPE, xive->pc_regs[spec_reg]);
576     blk = GETFIELD(PC_NXC_WATCH_BLOCK_ID, xive->pc_regs[spec_reg]);
577     idx = GETFIELD(PC_NXC_WATCH_INDEX, xive->pc_regs[spec_reg]);
578 
579     assert(!pnv_xive2_nxc_to_table_type(nxc_type, &table_type));
580 
581     if (pnv_xive2_vst_read(xive, table_type, blk, idx, nxc_watch)) {
582         xive2_error(xive, "VST: no NXC entry %x/%x in %s table!?",
583                     blk, idx, vst_infos[table_type].name);
584     }
585 
586     for (i = 0; i < ARRAY_SIZE(nxc_watch); i++) {
587         xive->pc_regs[data_reg + i] = be64_to_cpu(nxc_watch[i]);
588     }
589 }
590 
591 static int pnv_xive2_get_eas(Xive2Router *xrtr, uint8_t blk, uint32_t idx,
592                             Xive2Eas *eas)
593 {
594     PnvXive2 *xive = PNV_XIVE2(xrtr);
595 
596     if (pnv_xive2_block_id(xive) != blk) {
597         xive2_error(xive, "VST: EAS %x is remote !?", XIVE_EAS(blk, idx));
598         return -1;
599     }
600 
601     return pnv_xive2_vst_read(xive, VST_EAS, blk, idx, eas);
602 }
603 
604 static uint32_t pnv_xive2_get_config(Xive2Router *xrtr)
605 {
606     PnvXive2 *xive = PNV_XIVE2(xrtr);
607     uint32_t cfg = 0;
608 
609     if (xive->cq_regs[CQ_XIVE_CFG >> 3] & CQ_XIVE_CFG_GEN1_TIMA_OS) {
610         cfg |= XIVE2_GEN1_TIMA_OS;
611     }
612 
613     if (xive->cq_regs[CQ_XIVE_CFG >> 3] & CQ_XIVE_CFG_EN_VP_SAVE_RESTORE) {
614         cfg |= XIVE2_VP_SAVE_RESTORE;
615     }
616 
617     if (GETFIELD(CQ_XIVE_CFG_HYP_HARD_RANGE,
618               xive->cq_regs[CQ_XIVE_CFG >> 3]) == CQ_XIVE_CFG_THREADID_8BITS) {
619         cfg |= XIVE2_THREADID_8BITS;
620     }
621 
622     return cfg;
623 }
624 
625 static bool pnv_xive2_is_cpu_enabled(PnvXive2 *xive, PowerPCCPU *cpu)
626 {
627     int pir = ppc_cpu_pir(cpu);
628     uint32_t fc = PNV10_PIR2FUSEDCORE(pir);
629     uint64_t reg = fc < 8 ? TCTXT_EN0 : TCTXT_EN1;
630     uint32_t bit = pir & 0x3f;
631 
632     return xive->tctxt_regs[reg >> 3] & PPC_BIT(bit);
633 }
634 
635 static int pnv_xive2_match_nvt(XivePresenter *xptr, uint8_t format,
636                                uint8_t nvt_blk, uint32_t nvt_idx,
637                                bool crowd, bool cam_ignore, uint8_t priority,
638                                uint32_t logic_serv, XiveTCTXMatch *match)
639 {
640     PnvXive2 *xive = PNV_XIVE2(xptr);
641     PnvChip *chip = xive->chip;
642     int count = 0;
643     int i, j;
644     bool gen1_tima_os =
645         xive->cq_regs[CQ_XIVE_CFG >> 3] & CQ_XIVE_CFG_GEN1_TIMA_OS;
646     static int next_start_core;
647     static int next_start_thread;
648     int start_core = next_start_core;
649     int start_thread = next_start_thread;
650 
651     for (i = 0; i < chip->nr_cores; i++) {
652         PnvCore *pc = chip->cores[(i + start_core) % chip->nr_cores];
653         CPUCore *cc = CPU_CORE(pc);
654 
655         for (j = 0; j < cc->nr_threads; j++) {
656             /* Start search for match with different thread each call */
657             PowerPCCPU *cpu = pc->threads[(j + start_thread) % cc->nr_threads];
658             XiveTCTX *tctx;
659             int ring;
660 
661             if (!pnv_xive2_is_cpu_enabled(xive, cpu)) {
662                 continue;
663             }
664 
665             tctx = XIVE_TCTX(pnv_cpu_state(cpu)->intc);
666 
667             if (gen1_tima_os) {
668                 ring = xive_presenter_tctx_match(xptr, tctx, format, nvt_blk,
669                                                  nvt_idx, cam_ignore,
670                                                  logic_serv);
671             } else {
672                 ring = xive2_presenter_tctx_match(xptr, tctx, format, nvt_blk,
673                                                   nvt_idx, crowd, cam_ignore,
674                                                   logic_serv);
675             }
676 
677             if (ring != -1) {
678                 /*
679                  * For VP-specific match, finding more than one is a
680                  * problem. For group notification, it's possible.
681                  */
682                 if (!cam_ignore && match->tctx) {
683                     qemu_log_mask(LOG_GUEST_ERROR, "XIVE: already found a "
684                                   "thread context NVT %x/%x\n",
685                                   nvt_blk, nvt_idx);
686                     /* Should set a FIR if we ever model it */
687                     return -1;
688                 }
689                 /*
690                  * For a group notification, we need to know if the
691                  * match is precluded first by checking the current
692                  * thread priority. If the interrupt can be delivered,
693                  * we always notify the first match (for now).
694                  */
695                 if (cam_ignore &&
696                     xive2_tm_irq_precluded(tctx, ring, priority)) {
697                         match->precluded = true;
698                 } else {
699                     if (!match->tctx) {
700                         match->ring = ring;
701                         match->tctx = tctx;
702 
703                         next_start_thread = j + start_thread + 1;
704                         if (next_start_thread >= cc->nr_threads) {
705                             next_start_thread = 0;
706                             next_start_core = i + start_core + 1;
707                             if (next_start_core >= chip->nr_cores) {
708                                 next_start_core = 0;
709                             }
710                         }
711                     }
712                     count++;
713                 }
714             }
715         }
716     }
717 
718     return count;
719 }
720 
721 static uint32_t pnv_xive2_presenter_get_config(XivePresenter *xptr)
722 {
723     PnvXive2 *xive = PNV_XIVE2(xptr);
724     uint32_t cfg = 0;
725 
726     if (xive->cq_regs[CQ_XIVE_CFG >> 3] & CQ_XIVE_CFG_GEN1_TIMA_OS) {
727         cfg |= XIVE_PRESENTER_GEN1_TIMA_OS;
728     }
729     return cfg;
730 }
731 
732 static int pnv_xive2_broadcast(XivePresenter *xptr,
733                                uint8_t nvt_blk, uint32_t nvt_idx,
734                                bool crowd, bool ignore, uint8_t priority)
735 {
736     PnvXive2 *xive = PNV_XIVE2(xptr);
737     PnvChip *chip = xive->chip;
738     int i, j;
739     bool gen1_tima_os =
740         xive->cq_regs[CQ_XIVE_CFG >> 3] & CQ_XIVE_CFG_GEN1_TIMA_OS;
741 
742     for (i = 0; i < chip->nr_cores; i++) {
743         PnvCore *pc = chip->cores[i];
744         CPUCore *cc = CPU_CORE(pc);
745 
746         for (j = 0; j < cc->nr_threads; j++) {
747             PowerPCCPU *cpu = pc->threads[j];
748             XiveTCTX *tctx;
749             int ring;
750 
751             if (!pnv_xive2_is_cpu_enabled(xive, cpu)) {
752                 continue;
753             }
754 
755             tctx = XIVE_TCTX(pnv_cpu_state(cpu)->intc);
756 
757             if (gen1_tima_os) {
758                 ring = xive_presenter_tctx_match(xptr, tctx, 0, nvt_blk,
759                                                  nvt_idx, ignore, 0);
760             } else {
761                 ring = xive2_presenter_tctx_match(xptr, tctx, 0, nvt_blk,
762                                                   nvt_idx, crowd, ignore, 0);
763             }
764 
765             if (ring != -1) {
766                 xive2_tm_set_lsmfb(tctx, ring, priority);
767             }
768         }
769     }
770     return 0;
771 }
772 
773 static uint8_t pnv_xive2_get_block_id(Xive2Router *xrtr)
774 {
775     return pnv_xive2_block_id(PNV_XIVE2(xrtr));
776 }
777 
778 /*
779  * The TIMA MMIO space is shared among the chips and to identify the
780  * chip from which the access is being done, we extract the chip id
781  * from the PIR.
782  */
783 static PnvXive2 *pnv_xive2_tm_get_xive(PowerPCCPU *cpu)
784 {
785     int pir = ppc_cpu_pir(cpu);
786     XivePresenter *xptr = XIVE_TCTX(pnv_cpu_state(cpu)->intc)->xptr;
787     PnvXive2 *xive = PNV_XIVE2(xptr);
788 
789     if (!pnv_xive2_is_cpu_enabled(xive, cpu)) {
790         xive2_error(xive, "IC: CPU %x is not enabled", pir);
791     }
792     return xive;
793 }
794 
795 /*
796  * The internal sources of the interrupt controller have no knowledge
797  * of the XIVE2 chip on which they reside. Encode the block id in the
798  * source interrupt number before forwarding the source event
799  * notification to the Router. This is required on a multichip system.
800  */
801 static void pnv_xive2_notify(XiveNotifier *xn, uint32_t srcno, bool pq_checked)
802 {
803     PnvXive2 *xive = PNV_XIVE2(xn);
804     uint8_t blk = pnv_xive2_block_id(xive);
805 
806     xive2_router_notify(xn, XIVE_EAS(blk, srcno), pq_checked);
807 }
808 
809 /*
810  * Set Translation Tables
811  *
812  * TODO add support for multiple sets
813  */
814 static int pnv_xive2_stt_set_data(PnvXive2 *xive, uint64_t val)
815 {
816     uint8_t tsel = GETFIELD(CQ_TAR_SELECT, xive->cq_regs[CQ_TAR >> 3]);
817     uint8_t entry = GETFIELD(CQ_TAR_ENTRY_SELECT,
818                                   xive->cq_regs[CQ_TAR >> 3]);
819 
820     switch (tsel) {
821     case CQ_TAR_NVPG:
822     case CQ_TAR_ESB:
823     case CQ_TAR_END:
824     case CQ_TAR_NVC:
825         xive->tables[tsel][entry] = val;
826         break;
827     default:
828         xive2_error(xive, "IC: unsupported table %d", tsel);
829         return -1;
830     }
831 
832     if (xive->cq_regs[CQ_TAR >> 3] & CQ_TAR_AUTOINC) {
833         xive->cq_regs[CQ_TAR >> 3] = SETFIELD(CQ_TAR_ENTRY_SELECT,
834                      xive->cq_regs[CQ_TAR >> 3], ++entry);
835     }
836 
837     return 0;
838 }
839 /*
840  * Virtual Structure Tables (VST) configuration
841  */
842 static void pnv_xive2_vst_set_exclusive(PnvXive2 *xive, uint8_t type,
843                                         uint8_t blk, uint64_t vsd)
844 {
845     Xive2EndSource *end_xsrc = &xive->end_source;
846     XiveSource *xsrc = &xive->ipi_source;
847     const XiveVstInfo *info = &vst_infos[type];
848     uint32_t page_shift = GETFIELD(VSD_TSIZE, vsd) + 12;
849     uint64_t vst_tsize = 1ull << page_shift;
850     uint64_t vst_addr = vsd & VSD_ADDRESS_MASK;
851 
852     /* Basic checks */
853 
854     if (VSD_INDIRECT & vsd) {
855         if (!pnv_xive2_vst_page_size_allowed(page_shift)) {
856             xive2_error(xive, "VST: invalid %s page shift %d", info->name,
857                        page_shift);
858             return;
859         }
860     }
861 
862     if (!QEMU_IS_ALIGNED(vst_addr, 1ull << page_shift)) {
863         xive2_error(xive, "VST: %s table address 0x%"PRIx64
864                     " is not aligned with page shift %d",
865                     info->name, vst_addr, page_shift);
866         return;
867     }
868 
869     /* Record the table configuration (in SRAM on HW) */
870     xive->vsds[type][blk] = vsd;
871 
872     /* Now tune the models with the configuration provided by the FW */
873 
874     switch (type) {
875     case VST_ESB:
876         /*
877          * Backing store pages for the source PQ bits. The model does
878          * not use these PQ bits backed in RAM because the XiveSource
879          * model has its own.
880          *
881          * If the table is direct, we can compute the number of PQ
882          * entries provisioned by FW (such as skiboot) and resize the
883          * ESB window accordingly.
884          */
885         if (memory_region_is_mapped(&xsrc->esb_mmio)) {
886             memory_region_del_subregion(&xive->esb_mmio, &xsrc->esb_mmio);
887         }
888         if (!(VSD_INDIRECT & vsd)) {
889             memory_region_set_size(&xsrc->esb_mmio, vst_tsize * SBE_PER_BYTE
890                                    * (1ull << xsrc->esb_shift));
891         }
892 
893         memory_region_add_subregion(&xive->esb_mmio, 0, &xsrc->esb_mmio);
894         break;
895 
896     case VST_EAS:  /* Nothing to be done */
897         break;
898 
899     case VST_END:
900         /*
901          * Backing store pages for the END.
902          */
903         if (memory_region_is_mapped(&end_xsrc->esb_mmio)) {
904             memory_region_del_subregion(&xive->end_mmio, &end_xsrc->esb_mmio);
905         }
906         if (!(VSD_INDIRECT & vsd)) {
907             memory_region_set_size(&end_xsrc->esb_mmio, (vst_tsize / info->size)
908                                    * (1ull << end_xsrc->esb_shift));
909         }
910         memory_region_add_subregion(&xive->end_mmio, 0, &end_xsrc->esb_mmio);
911         break;
912 
913     case VST_NVP:  /* Not modeled */
914     case VST_NVG:  /* Not modeled */
915     case VST_NVC:  /* Not modeled */
916     case VST_IC:   /* Not modeled */
917     case VST_SYNC: /* Not modeled */
918     case VST_ERQ:  /* Not modeled */
919         break;
920 
921     default:
922         g_assert_not_reached();
923     }
924 }
925 
926 /*
927  * Both PC and VC sub-engines are configured as each use the Virtual
928  * Structure Tables
929  */
930 static void pnv_xive2_vst_set_data(PnvXive2 *xive, uint64_t vsd,
931                                    uint8_t type, uint8_t blk)
932 {
933     uint8_t mode = GETFIELD(VSD_MODE, vsd);
934     uint64_t vst_addr = vsd & VSD_ADDRESS_MASK;
935 
936     if (type > VST_ERQ) {
937         xive2_error(xive, "VST: invalid table type %d", type);
938         return;
939     }
940 
941     if (blk >= vst_infos[type].max_blocks) {
942         xive2_error(xive, "VST: invalid block id %d for"
943                       " %s table", blk, vst_infos[type].name);
944         return;
945     }
946 
947     if (!vst_addr) {
948         xive2_error(xive, "VST: invalid %s table address",
949                    vst_infos[type].name);
950         return;
951     }
952 
953     switch (mode) {
954     case VSD_MODE_FORWARD:
955         xive->vsds[type][blk] = vsd;
956         break;
957 
958     case VSD_MODE_EXCLUSIVE:
959         pnv_xive2_vst_set_exclusive(xive, type, blk, vsd);
960         break;
961 
962     default:
963         xive2_error(xive, "VST: unsupported table mode %d", mode);
964         return;
965     }
966 }
967 
968 static void pnv_xive2_vc_vst_set_data(PnvXive2 *xive, uint64_t vsd)
969 {
970     uint8_t type = GETFIELD(VC_VSD_TABLE_SELECT,
971                             xive->vc_regs[VC_VSD_TABLE_ADDR >> 3]);
972     uint8_t blk = GETFIELD(VC_VSD_TABLE_ADDRESS,
973                            xive->vc_regs[VC_VSD_TABLE_ADDR >> 3]);
974 
975     pnv_xive2_vst_set_data(xive, vsd, type, blk);
976 }
977 
978 /*
979  * MMIO handlers
980  */
981 
982 
983 /*
984  * IC BAR layout
985  *
986  * Page 0: Internal CQ register accesses (reads & writes)
987  * Page 1: Internal PC register accesses (reads & writes)
988  * Page 2: Internal VC register accesses (reads & writes)
989  * Page 3: Internal TCTXT (TIMA) reg accesses (read & writes)
990  * Page 4: Notify Port page (writes only, w/data),
991  * Page 5: Reserved
992  * Page 6: Sync Poll page (writes only, dataless)
993  * Page 7: Sync Inject page (writes only, dataless)
994  * Page 8: LSI Trigger page (writes only, dataless)
995  * Page 9: LSI SB Management page (reads & writes dataless)
996  * Pages 10-255: Reserved
997  * Pages 256-383: Direct mapped Thread Context Area (reads & writes)
998  *                covering the 128 threads in P10.
999  * Pages 384-511: Reserved
1000  */
1001 typedef struct PnvXive2Region {
1002     const char *name;
1003     uint32_t pgoff;
1004     uint32_t pgsize;
1005     const MemoryRegionOps *ops;
1006 } PnvXive2Region;
1007 
1008 static const MemoryRegionOps pnv_xive2_ic_cq_ops;
1009 static const MemoryRegionOps pnv_xive2_ic_pc_ops;
1010 static const MemoryRegionOps pnv_xive2_ic_vc_ops;
1011 static const MemoryRegionOps pnv_xive2_ic_tctxt_ops;
1012 static const MemoryRegionOps pnv_xive2_ic_notify_ops;
1013 static const MemoryRegionOps pnv_xive2_ic_sync_ops;
1014 static const MemoryRegionOps pnv_xive2_ic_lsi_ops;
1015 static const MemoryRegionOps pnv_xive2_ic_tm_indirect_ops;
1016 
1017 /* 512 pages. 4K: 2M range, 64K: 32M range */
1018 static const PnvXive2Region pnv_xive2_ic_regions[] = {
1019     { "xive-ic-cq",        0,   1,   &pnv_xive2_ic_cq_ops     },
1020     { "xive-ic-vc",        1,   1,   &pnv_xive2_ic_vc_ops     },
1021     { "xive-ic-pc",        2,   1,   &pnv_xive2_ic_pc_ops     },
1022     { "xive-ic-tctxt",     3,   1,   &pnv_xive2_ic_tctxt_ops  },
1023     { "xive-ic-notify",    4,   1,   &pnv_xive2_ic_notify_ops },
1024     /* page 5 reserved */
1025     { "xive-ic-sync",      6,   2,   &pnv_xive2_ic_sync_ops   },
1026     { "xive-ic-lsi",       8,   2,   &pnv_xive2_ic_lsi_ops    },
1027     /* pages 10-255 reserved */
1028     { "xive-ic-tm-indirect", 256, 128, &pnv_xive2_ic_tm_indirect_ops  },
1029     /* pages 384-511 reserved */
1030 };
1031 
1032 /*
1033  * CQ operations
1034  */
1035 
1036 static uint64_t pnv_xive2_ic_cq_read(void *opaque, hwaddr offset,
1037                                         unsigned size)
1038 {
1039     PnvXive2 *xive = PNV_XIVE2(opaque);
1040     uint32_t reg = offset >> 3;
1041     uint64_t val = 0;
1042 
1043     switch (offset) {
1044     case CQ_XIVE_CAP: /* Set at reset */
1045     case CQ_XIVE_CFG:
1046         val = xive->cq_regs[reg];
1047         break;
1048     case CQ_MSGSND: /* TODO check the #cores of the machine */
1049         val = 0xffffffff00000000;
1050         break;
1051     case CQ_CFG_PB_GEN:
1052         val = CQ_CFG_PB_GEN_PB_INIT; /* TODO: fix CQ_CFG_PB_GEN default value */
1053         break;
1054     default:
1055         xive2_error(xive, "CQ: invalid read @%"HWADDR_PRIx, offset);
1056     }
1057 
1058     return val;
1059 }
1060 
1061 static uint64_t pnv_xive2_bar_size(uint64_t val)
1062 {
1063     return 1ull << (GETFIELD(CQ_BAR_RANGE, val) + 24);
1064 }
1065 
1066 static void pnv_xive2_ic_cq_write(void *opaque, hwaddr offset,
1067                                   uint64_t val, unsigned size)
1068 {
1069     PnvXive2 *xive = PNV_XIVE2(opaque);
1070     MemoryRegion *sysmem = get_system_memory();
1071     uint32_t reg = offset >> 3;
1072     int i;
1073 
1074     switch (offset) {
1075     case CQ_XIVE_CFG:
1076     case CQ_RST_CTL: /* TODO: reset all BARs */
1077         break;
1078 
1079     case CQ_IC_BAR:
1080         xive->ic_shift = val & CQ_IC_BAR_64K ? 16 : 12;
1081         if (!(val & CQ_IC_BAR_VALID)) {
1082             xive->ic_base = 0;
1083             if (xive->cq_regs[reg] & CQ_IC_BAR_VALID) {
1084                 for (i = 0; i < ARRAY_SIZE(xive->ic_mmios); i++) {
1085                     memory_region_del_subregion(&xive->ic_mmio,
1086                                                 &xive->ic_mmios[i]);
1087                 }
1088                 memory_region_del_subregion(sysmem, &xive->ic_mmio);
1089             }
1090         } else {
1091             xive->ic_base = val & ~(CQ_IC_BAR_VALID | CQ_IC_BAR_64K);
1092             if (!(xive->cq_regs[reg] & CQ_IC_BAR_VALID)) {
1093                 for (i = 0; i < ARRAY_SIZE(xive->ic_mmios); i++) {
1094                     memory_region_add_subregion(&xive->ic_mmio,
1095                                pnv_xive2_ic_regions[i].pgoff << xive->ic_shift,
1096                                &xive->ic_mmios[i]);
1097                 }
1098                 memory_region_add_subregion(sysmem, xive->ic_base,
1099                                             &xive->ic_mmio);
1100             }
1101         }
1102         break;
1103 
1104     case CQ_TM_BAR:
1105         xive->tm_shift = val & CQ_TM_BAR_64K ? 16 : 12;
1106         if (!(val & CQ_TM_BAR_VALID)) {
1107             xive->tm_base = 0;
1108             if (xive->cq_regs[reg] & CQ_TM_BAR_VALID) {
1109                 memory_region_del_subregion(sysmem, &xive->tm_mmio);
1110             }
1111         } else {
1112             xive->tm_base = val & ~(CQ_TM_BAR_VALID | CQ_TM_BAR_64K);
1113             if (!(xive->cq_regs[reg] & CQ_TM_BAR_VALID)) {
1114                 memory_region_add_subregion(sysmem, xive->tm_base,
1115                                             &xive->tm_mmio);
1116             }
1117         }
1118         break;
1119 
1120     case CQ_ESB_BAR:
1121         xive->esb_shift = val & CQ_BAR_64K ? 16 : 12;
1122         if (!(val & CQ_BAR_VALID)) {
1123             xive->esb_base = 0;
1124             if (xive->cq_regs[reg] & CQ_BAR_VALID) {
1125                 memory_region_del_subregion(sysmem, &xive->esb_mmio);
1126             }
1127         } else {
1128             xive->esb_base = val & CQ_BAR_ADDR;
1129             if (!(xive->cq_regs[reg] & CQ_BAR_VALID)) {
1130                 memory_region_set_size(&xive->esb_mmio,
1131                                        pnv_xive2_bar_size(val));
1132                 memory_region_add_subregion(sysmem, xive->esb_base,
1133                                             &xive->esb_mmio);
1134             }
1135         }
1136         break;
1137 
1138     case CQ_END_BAR:
1139         xive->end_shift = val & CQ_BAR_64K ? 16 : 12;
1140         if (!(val & CQ_BAR_VALID)) {
1141             xive->end_base = 0;
1142             if (xive->cq_regs[reg] & CQ_BAR_VALID) {
1143                 memory_region_del_subregion(sysmem, &xive->end_mmio);
1144             }
1145         } else {
1146             xive->end_base = val & CQ_BAR_ADDR;
1147             if (!(xive->cq_regs[reg] & CQ_BAR_VALID)) {
1148                 memory_region_set_size(&xive->end_mmio,
1149                                        pnv_xive2_bar_size(val));
1150                 memory_region_add_subregion(sysmem, xive->end_base,
1151                                             &xive->end_mmio);
1152             }
1153         }
1154         break;
1155 
1156     case CQ_NVC_BAR:
1157         xive->nvc_shift = val & CQ_BAR_64K ? 16 : 12;
1158         if (!(val & CQ_BAR_VALID)) {
1159             xive->nvc_base = 0;
1160             if (xive->cq_regs[reg] & CQ_BAR_VALID) {
1161                 memory_region_del_subregion(sysmem, &xive->nvc_mmio);
1162             }
1163         } else {
1164             xive->nvc_base = val & CQ_BAR_ADDR;
1165             if (!(xive->cq_regs[reg] & CQ_BAR_VALID)) {
1166                 memory_region_set_size(&xive->nvc_mmio,
1167                                        pnv_xive2_bar_size(val));
1168                 memory_region_add_subregion(sysmem, xive->nvc_base,
1169                                             &xive->nvc_mmio);
1170             }
1171         }
1172         break;
1173 
1174     case CQ_NVPG_BAR:
1175         xive->nvpg_shift = val & CQ_BAR_64K ? 16 : 12;
1176         if (!(val & CQ_BAR_VALID)) {
1177             xive->nvpg_base = 0;
1178             if (xive->cq_regs[reg] & CQ_BAR_VALID) {
1179                 memory_region_del_subregion(sysmem, &xive->nvpg_mmio);
1180             }
1181         } else {
1182             xive->nvpg_base = val & CQ_BAR_ADDR;
1183             if (!(xive->cq_regs[reg] & CQ_BAR_VALID)) {
1184                 memory_region_set_size(&xive->nvpg_mmio,
1185                                        pnv_xive2_bar_size(val));
1186                 memory_region_add_subregion(sysmem, xive->nvpg_base,
1187                                             &xive->nvpg_mmio);
1188             }
1189         }
1190         break;
1191 
1192     case CQ_TAR: /* Set Translation Table Address */
1193         break;
1194     case CQ_TDR: /* Set Translation Table Data */
1195         pnv_xive2_stt_set_data(xive, val);
1196         break;
1197     case CQ_FIRMASK_OR: /* FIR error reporting */
1198         break;
1199     default:
1200         xive2_error(xive, "CQ: invalid write 0x%"HWADDR_PRIx" value 0x%"PRIx64,
1201                     offset, val);
1202         return;
1203     }
1204 
1205     xive->cq_regs[reg] = val;
1206 }
1207 
1208 static const MemoryRegionOps pnv_xive2_ic_cq_ops = {
1209     .read = pnv_xive2_ic_cq_read,
1210     .write = pnv_xive2_ic_cq_write,
1211     .endianness = DEVICE_BIG_ENDIAN,
1212     .valid = {
1213         .min_access_size = 8,
1214         .max_access_size = 8,
1215     },
1216     .impl = {
1217         .min_access_size = 8,
1218         .max_access_size = 8,
1219     },
1220 };
1221 
1222 static uint8_t pnv_xive2_cache_watch_assign(uint64_t engine_mask,
1223                                             uint64_t *state)
1224 {
1225     uint8_t val = 0xFF;
1226     int i;
1227 
1228     for (i = 3; i >= 0; i--) {
1229         if (BIT(i) & engine_mask) {
1230             if (!(BIT(i) & *state)) {
1231                 *state |= BIT(i);
1232                 val = 3 - i;
1233                 break;
1234             }
1235         }
1236     }
1237     return val;
1238 }
1239 
1240 static void pnv_xive2_cache_watch_release(uint64_t *state, uint8_t watch_engine)
1241 {
1242     uint8_t engine_bit = 3 - watch_engine;
1243 
1244     if (*state & BIT(engine_bit)) {
1245         *state &= ~BIT(engine_bit);
1246     }
1247 }
1248 
1249 static uint8_t pnv_xive2_endc_cache_watch_assign(PnvXive2 *xive)
1250 {
1251     uint64_t engine_mask = GETFIELD(VC_ENDC_CFG_CACHE_WATCH_ASSIGN,
1252                                     xive->vc_regs[VC_ENDC_CFG >> 3]);
1253     uint64_t state = xive->vc_regs[VC_ENDC_WATCH_ASSIGN >> 3];
1254     uint8_t val;
1255 
1256     /*
1257      * We keep track of which engines are currently busy in the
1258      * VC_ENDC_WATCH_ASSIGN register directly. When the firmware reads
1259      * the register, we don't return its value but the ID of an engine
1260      * it can use.
1261      * There are 4 engines. 0xFF means no engine is available.
1262      */
1263     val = pnv_xive2_cache_watch_assign(engine_mask, &state);
1264     if (val != 0xFF) {
1265         xive->vc_regs[VC_ENDC_WATCH_ASSIGN >> 3] = state;
1266     }
1267     return val;
1268 }
1269 
1270 static void pnv_xive2_endc_cache_watch_release(PnvXive2 *xive,
1271                                                uint8_t watch_engine)
1272 {
1273     uint64_t state = xive->vc_regs[VC_ENDC_WATCH_ASSIGN >> 3];
1274 
1275     pnv_xive2_cache_watch_release(&state, watch_engine);
1276     xive->vc_regs[VC_ENDC_WATCH_ASSIGN >> 3] = state;
1277 }
1278 
1279 static uint64_t pnv_xive2_ic_vc_read(void *opaque, hwaddr offset,
1280                                      unsigned size)
1281 {
1282     PnvXive2 *xive = PNV_XIVE2(opaque);
1283     uint64_t val = 0;
1284     uint32_t reg = offset >> 3;
1285     uint8_t watch_engine;
1286 
1287     switch (offset) {
1288     /*
1289      * VSD table settings.
1290      */
1291     case VC_VSD_TABLE_ADDR:
1292     case VC_VSD_TABLE_DATA:
1293         val = xive->vc_regs[reg];
1294         break;
1295 
1296     /*
1297      * ESB cache updates (not modeled)
1298      */
1299     case VC_ESBC_FLUSH_CTRL:
1300         xive->vc_regs[reg] &= ~VC_ESBC_FLUSH_CTRL_POLL_VALID;
1301         val = xive->vc_regs[reg];
1302         break;
1303 
1304     case VC_ESBC_CFG:
1305         val = xive->vc_regs[reg];
1306         break;
1307 
1308     /*
1309      * EAS cache updates (not modeled)
1310      */
1311     case VC_EASC_FLUSH_CTRL:
1312         xive->vc_regs[reg] &= ~VC_EASC_FLUSH_CTRL_POLL_VALID;
1313         val = xive->vc_regs[reg];
1314         break;
1315 
1316     case VC_ENDC_WATCH_ASSIGN:
1317         val = pnv_xive2_endc_cache_watch_assign(xive);
1318         break;
1319 
1320     case VC_ENDC_CFG:
1321         val = xive->vc_regs[reg];
1322         break;
1323 
1324     /*
1325      * END cache updates
1326      */
1327     case VC_ENDC_WATCH0_SPEC:
1328     case VC_ENDC_WATCH1_SPEC:
1329     case VC_ENDC_WATCH2_SPEC:
1330     case VC_ENDC_WATCH3_SPEC:
1331         watch_engine = (offset - VC_ENDC_WATCH0_SPEC) >> 6;
1332         pnv_xive2_endc_cache_watch_release(xive, watch_engine);
1333         val = xive->vc_regs[reg];
1334         break;
1335 
1336     case VC_ENDC_WATCH0_DATA0:
1337     case VC_ENDC_WATCH1_DATA0:
1338     case VC_ENDC_WATCH2_DATA0:
1339     case VC_ENDC_WATCH3_DATA0:
1340         /*
1341          * Load DATA registers from cache with data requested by the
1342          * SPEC register.  Clear gen_flipped bit in word 1.
1343          */
1344         watch_engine = (offset - VC_ENDC_WATCH0_DATA0) >> 6;
1345         pnv_xive2_end_cache_load(xive, watch_engine);
1346         xive->vc_regs[reg] &= ~(uint64_t)END2_W1_GEN_FLIPPED;
1347         val = xive->vc_regs[reg];
1348         break;
1349 
1350     case VC_ENDC_WATCH0_DATA1 ... VC_ENDC_WATCH0_DATA3:
1351     case VC_ENDC_WATCH1_DATA1 ... VC_ENDC_WATCH1_DATA3:
1352     case VC_ENDC_WATCH2_DATA1 ... VC_ENDC_WATCH2_DATA3:
1353     case VC_ENDC_WATCH3_DATA1 ... VC_ENDC_WATCH3_DATA3:
1354         val = xive->vc_regs[reg];
1355         break;
1356 
1357     case VC_ENDC_FLUSH_CTRL:
1358         xive->vc_regs[reg] &= ~VC_ENDC_FLUSH_CTRL_POLL_VALID;
1359         val = xive->vc_regs[reg];
1360         break;
1361 
1362     /*
1363      * Indirect invalidation
1364      */
1365     case VC_AT_MACRO_KILL_MASK:
1366         val = xive->vc_regs[reg];
1367         break;
1368 
1369     case VC_AT_MACRO_KILL:
1370         xive->vc_regs[reg] &= ~VC_AT_MACRO_KILL_VALID;
1371         val = xive->vc_regs[reg];
1372         break;
1373 
1374     /*
1375      * Interrupt fifo overflow in memory backing store (Not modeled)
1376      */
1377     case VC_QUEUES_CFG_REM0 ... VC_QUEUES_CFG_REM6:
1378         val = xive->vc_regs[reg];
1379         break;
1380 
1381     /*
1382      * Synchronisation
1383      */
1384     case VC_ENDC_SYNC_DONE:
1385         val = VC_ENDC_SYNC_POLL_DONE;
1386         break;
1387     default:
1388         xive2_error(xive, "VC: invalid read @%"HWADDR_PRIx, offset);
1389     }
1390 
1391     return val;
1392 }
1393 
1394 static void pnv_xive2_ic_vc_write(void *opaque, hwaddr offset,
1395                                   uint64_t val, unsigned size)
1396 {
1397     PnvXive2 *xive = PNV_XIVE2(opaque);
1398     uint32_t reg = offset >> 3;
1399     uint8_t watch_engine;
1400 
1401     switch (offset) {
1402     /*
1403      * VSD table settings.
1404      */
1405     case VC_VSD_TABLE_ADDR:
1406        break;
1407     case VC_VSD_TABLE_DATA:
1408         pnv_xive2_vc_vst_set_data(xive, val);
1409         break;
1410 
1411     /*
1412      * ESB cache updates (not modeled)
1413      */
1414     case VC_ESBC_FLUSH_CTRL:
1415         if (val & VC_ESBC_FLUSH_CTRL_WANT_CACHE_DISABLE) {
1416             xive2_error(xive, "VC: unsupported write @0x%"HWADDR_PRIx
1417                         " value 0x%"PRIx64" bit[2] poll_want_cache_disable",
1418                         offset, val);
1419             return;
1420         }
1421         break;
1422     case VC_ESBC_FLUSH_POLL:
1423         xive->vc_regs[VC_ESBC_FLUSH_CTRL >> 3] |= VC_ESBC_FLUSH_CTRL_POLL_VALID;
1424         /* ESB update */
1425         break;
1426 
1427     case VC_ESBC_FLUSH_INJECT:
1428         pnv_xive2_inject_notify(xive, PNV_XIVE2_CACHE_ESBC);
1429         break;
1430 
1431     case VC_ESBC_CFG:
1432         break;
1433 
1434     /*
1435      * EAS cache updates (not modeled)
1436      */
1437     case VC_EASC_FLUSH_CTRL:
1438         if (val & VC_EASC_FLUSH_CTRL_WANT_CACHE_DISABLE) {
1439             xive2_error(xive, "VC: unsupported write @0x%"HWADDR_PRIx
1440                         " value 0x%"PRIx64" bit[2] poll_want_cache_disable",
1441                         offset, val);
1442             return;
1443         }
1444         break;
1445     case VC_EASC_FLUSH_POLL:
1446         xive->vc_regs[VC_EASC_FLUSH_CTRL >> 3] |= VC_EASC_FLUSH_CTRL_POLL_VALID;
1447         /* EAS update */
1448         break;
1449 
1450     case VC_EASC_FLUSH_INJECT:
1451         pnv_xive2_inject_notify(xive, PNV_XIVE2_CACHE_EASC);
1452         break;
1453 
1454     case VC_ENDC_CFG:
1455         break;
1456 
1457     /*
1458      * END cache updates
1459      */
1460     case VC_ENDC_WATCH0_SPEC:
1461     case VC_ENDC_WATCH1_SPEC:
1462     case VC_ENDC_WATCH2_SPEC:
1463     case VC_ENDC_WATCH3_SPEC:
1464          val &= ~VC_ENDC_WATCH_CONFLICT; /* HW will set this bit */
1465         break;
1466 
1467     case VC_ENDC_WATCH0_DATA1 ... VC_ENDC_WATCH0_DATA3:
1468     case VC_ENDC_WATCH1_DATA1 ... VC_ENDC_WATCH1_DATA3:
1469     case VC_ENDC_WATCH2_DATA1 ... VC_ENDC_WATCH2_DATA3:
1470     case VC_ENDC_WATCH3_DATA1 ... VC_ENDC_WATCH3_DATA3:
1471         break;
1472     case VC_ENDC_WATCH0_DATA0:
1473     case VC_ENDC_WATCH1_DATA0:
1474     case VC_ENDC_WATCH2_DATA0:
1475     case VC_ENDC_WATCH3_DATA0:
1476         /* writing to DATA0 triggers the cache write */
1477         watch_engine = (offset - VC_ENDC_WATCH0_DATA0) >> 6;
1478         xive->vc_regs[reg] = val;
1479         pnv_xive2_end_update(xive, watch_engine);
1480         break;
1481 
1482 
1483     case VC_ENDC_FLUSH_CTRL:
1484         if (val & VC_ENDC_FLUSH_CTRL_WANT_CACHE_DISABLE) {
1485             xive2_error(xive, "VC: unsupported write @0x%"HWADDR_PRIx
1486                         " value 0x%"PRIx64" bit[2] poll_want_cache_disable",
1487                         offset, val);
1488             return;
1489         }
1490         break;
1491     case VC_ENDC_FLUSH_POLL:
1492         xive->vc_regs[VC_ENDC_FLUSH_CTRL >> 3] |= VC_ENDC_FLUSH_CTRL_POLL_VALID;
1493         break;
1494 
1495     case VC_ENDC_FLUSH_INJECT:
1496         pnv_xive2_inject_notify(xive, PNV_XIVE2_CACHE_ENDC);
1497         break;
1498 
1499     /*
1500      * Indirect invalidation
1501      */
1502     case VC_AT_MACRO_KILL:
1503     case VC_AT_MACRO_KILL_MASK:
1504         break;
1505 
1506     /*
1507      * Interrupt fifo overflow in memory backing store (Not modeled)
1508      */
1509     case VC_QUEUES_CFG_REM0 ... VC_QUEUES_CFG_REM6:
1510         break;
1511 
1512     /*
1513      * Synchronisation
1514      */
1515     case VC_ENDC_SYNC_DONE:
1516         break;
1517 
1518     default:
1519         xive2_error(xive, "VC: invalid write @0x%"HWADDR_PRIx" value 0x%"PRIx64,
1520                     offset, val);
1521         return;
1522     }
1523 
1524     xive->vc_regs[reg] = val;
1525 }
1526 
1527 static const MemoryRegionOps pnv_xive2_ic_vc_ops = {
1528     .read = pnv_xive2_ic_vc_read,
1529     .write = pnv_xive2_ic_vc_write,
1530     .endianness = DEVICE_BIG_ENDIAN,
1531     .valid = {
1532         .min_access_size = 8,
1533         .max_access_size = 8,
1534     },
1535     .impl = {
1536         .min_access_size = 8,
1537         .max_access_size = 8,
1538     },
1539 };
1540 
1541 static uint8_t pnv_xive2_nxc_cache_watch_assign(PnvXive2 *xive)
1542 {
1543     uint64_t engine_mask = GETFIELD(PC_NXC_PROC_CONFIG_WATCH_ASSIGN,
1544                                     xive->pc_regs[PC_NXC_PROC_CONFIG >> 3]);
1545     uint64_t state = xive->pc_regs[PC_NXC_WATCH_ASSIGN >> 3];
1546     uint8_t val;
1547 
1548     /*
1549      * We keep track of which engines are currently busy in the
1550      * PC_NXC_WATCH_ASSIGN register directly. When the firmware reads
1551      * the register, we don't return its value but the ID of an engine
1552      * it can use.
1553      * There are 4 engines. 0xFF means no engine is available.
1554      */
1555     val = pnv_xive2_cache_watch_assign(engine_mask, &state);
1556     if (val != 0xFF) {
1557         xive->pc_regs[PC_NXC_WATCH_ASSIGN >> 3] = state;
1558     }
1559     return val;
1560 }
1561 
1562 static void pnv_xive2_nxc_cache_watch_release(PnvXive2 *xive,
1563                                               uint8_t watch_engine)
1564 {
1565     uint64_t state = xive->pc_regs[PC_NXC_WATCH_ASSIGN >> 3];
1566 
1567     pnv_xive2_cache_watch_release(&state, watch_engine);
1568     xive->pc_regs[PC_NXC_WATCH_ASSIGN >> 3] = state;
1569 }
1570 
1571 static uint64_t pnv_xive2_ic_pc_read(void *opaque, hwaddr offset,
1572                                      unsigned size)
1573 {
1574     PnvXive2 *xive = PNV_XIVE2(opaque);
1575     uint64_t val = -1;
1576     uint32_t reg = offset >> 3;
1577     uint8_t watch_engine;
1578 
1579     switch (offset) {
1580     /*
1581      * VSD table settings.
1582      */
1583     case PC_VSD_TABLE_ADDR:
1584     case PC_VSD_TABLE_DATA:
1585         val = xive->pc_regs[reg];
1586         break;
1587 
1588     case PC_NXC_WATCH_ASSIGN:
1589         val = pnv_xive2_nxc_cache_watch_assign(xive);
1590         break;
1591 
1592     case PC_NXC_PROC_CONFIG:
1593         val = xive->pc_regs[reg];
1594         break;
1595 
1596     /*
1597      * cache updates
1598      */
1599     case PC_NXC_WATCH0_SPEC:
1600     case PC_NXC_WATCH1_SPEC:
1601     case PC_NXC_WATCH2_SPEC:
1602     case PC_NXC_WATCH3_SPEC:
1603         watch_engine = (offset - PC_NXC_WATCH0_SPEC) >> 6;
1604         xive->pc_regs[reg] &= ~(PC_NXC_WATCH_FULL | PC_NXC_WATCH_CONFLICT);
1605         pnv_xive2_nxc_cache_watch_release(xive, watch_engine);
1606         val = xive->pc_regs[reg];
1607         break;
1608 
1609     case PC_NXC_WATCH0_DATA0:
1610     case PC_NXC_WATCH1_DATA0:
1611     case PC_NXC_WATCH2_DATA0:
1612     case PC_NXC_WATCH3_DATA0:
1613        /*
1614         * Load DATA registers from cache with data requested by the
1615         * SPEC register
1616         */
1617         watch_engine = (offset - PC_NXC_WATCH0_DATA0) >> 6;
1618         pnv_xive2_nxc_cache_load(xive, watch_engine);
1619         val = xive->pc_regs[reg];
1620         break;
1621 
1622     case PC_NXC_WATCH0_DATA1 ... PC_NXC_WATCH0_DATA3:
1623     case PC_NXC_WATCH1_DATA1 ... PC_NXC_WATCH1_DATA3:
1624     case PC_NXC_WATCH2_DATA1 ... PC_NXC_WATCH2_DATA3:
1625     case PC_NXC_WATCH3_DATA1 ... PC_NXC_WATCH3_DATA3:
1626         val = xive->pc_regs[reg];
1627         break;
1628 
1629     case PC_NXC_FLUSH_CTRL:
1630         xive->pc_regs[reg] &= ~PC_NXC_FLUSH_CTRL_POLL_VALID;
1631         val = xive->pc_regs[reg];
1632         break;
1633 
1634     /*
1635      * Indirect invalidation
1636      */
1637     case PC_AT_KILL:
1638         xive->pc_regs[reg] &= ~PC_AT_KILL_VALID;
1639         val = xive->pc_regs[reg];
1640         break;
1641 
1642     default:
1643         xive2_error(xive, "PC: invalid read @%"HWADDR_PRIx, offset);
1644     }
1645 
1646     return val;
1647 }
1648 
1649 static void pnv_xive2_pc_vst_set_data(PnvXive2 *xive, uint64_t vsd)
1650 {
1651     uint8_t type = GETFIELD(PC_VSD_TABLE_SELECT,
1652                             xive->pc_regs[PC_VSD_TABLE_ADDR >> 3]);
1653     uint8_t blk = GETFIELD(PC_VSD_TABLE_ADDRESS,
1654                            xive->pc_regs[PC_VSD_TABLE_ADDR >> 3]);
1655 
1656     pnv_xive2_vst_set_data(xive, vsd, type, blk);
1657 }
1658 
1659 static void pnv_xive2_ic_pc_write(void *opaque, hwaddr offset,
1660                                   uint64_t val, unsigned size)
1661 {
1662     PnvXive2 *xive = PNV_XIVE2(opaque);
1663     uint32_t reg = offset >> 3;
1664     uint8_t watch_engine;
1665 
1666     switch (offset) {
1667 
1668     /*
1669      * VSD table settings.
1670      * The Xive2Router model combines both VC and PC sub-engines. We
1671      * allow to configure the tables through both, for the rare cases
1672      * where a table only really needs to be configured for one of
1673      * them (e.g. the NVG table for the presenter). It assumes that
1674      * firmware passes the same address to the VC and PC when tables
1675      * are defined for both, which seems acceptable.
1676      */
1677     case PC_VSD_TABLE_ADDR:
1678         break;
1679     case PC_VSD_TABLE_DATA:
1680         pnv_xive2_pc_vst_set_data(xive, val);
1681         break;
1682 
1683     case PC_NXC_PROC_CONFIG:
1684         break;
1685 
1686     /*
1687      * cache updates
1688      */
1689     case PC_NXC_WATCH0_SPEC:
1690     case PC_NXC_WATCH1_SPEC:
1691     case PC_NXC_WATCH2_SPEC:
1692     case PC_NXC_WATCH3_SPEC:
1693         val &= ~PC_NXC_WATCH_CONFLICT; /* HW will set this bit */
1694         break;
1695 
1696     case PC_NXC_WATCH0_DATA1 ... PC_NXC_WATCH0_DATA3:
1697     case PC_NXC_WATCH1_DATA1 ... PC_NXC_WATCH1_DATA3:
1698     case PC_NXC_WATCH2_DATA1 ... PC_NXC_WATCH2_DATA3:
1699     case PC_NXC_WATCH3_DATA1 ... PC_NXC_WATCH3_DATA3:
1700         break;
1701     case PC_NXC_WATCH0_DATA0:
1702     case PC_NXC_WATCH1_DATA0:
1703     case PC_NXC_WATCH2_DATA0:
1704     case PC_NXC_WATCH3_DATA0:
1705         /* writing to DATA0 triggers the cache write */
1706         watch_engine = (offset - PC_NXC_WATCH0_DATA0) >> 6;
1707         xive->pc_regs[reg] = val;
1708         pnv_xive2_nxc_update(xive, watch_engine);
1709         break;
1710 
1711     case PC_NXC_FLUSH_CTRL:
1712         if (val & PC_NXC_FLUSH_CTRL_WANT_CACHE_DISABLE) {
1713             xive2_error(xive, "VC: unsupported write @0x%"HWADDR_PRIx
1714                         " value 0x%"PRIx64" bit[2] poll_want_cache_disable",
1715                         offset, val);
1716             return;
1717         }
1718         break;
1719     case PC_NXC_FLUSH_POLL:
1720         xive->pc_regs[PC_NXC_FLUSH_CTRL >> 3] |= PC_NXC_FLUSH_CTRL_POLL_VALID;
1721         break;
1722 
1723     case PC_NXC_FLUSH_INJECT:
1724         pnv_xive2_inject_notify(xive, PNV_XIVE2_CACHE_NXC);
1725         break;
1726 
1727     /*
1728      * Indirect invalidation
1729      */
1730     case PC_AT_KILL:
1731     case PC_AT_KILL_MASK:
1732         break;
1733 
1734     default:
1735         xive2_error(xive, "PC: invalid write @0x%"HWADDR_PRIx" value 0x%"PRIx64,
1736                     offset, val);
1737         return;
1738     }
1739 
1740     xive->pc_regs[reg] = val;
1741 }
1742 
1743 static const MemoryRegionOps pnv_xive2_ic_pc_ops = {
1744     .read = pnv_xive2_ic_pc_read,
1745     .write = pnv_xive2_ic_pc_write,
1746     .endianness = DEVICE_BIG_ENDIAN,
1747     .valid = {
1748         .min_access_size = 8,
1749         .max_access_size = 8,
1750     },
1751     .impl = {
1752         .min_access_size = 8,
1753         .max_access_size = 8,
1754     },
1755 };
1756 
1757 
1758 static uint64_t pnv_xive2_ic_tctxt_read(void *opaque, hwaddr offset,
1759                                         unsigned size)
1760 {
1761     PnvXive2 *xive = PNV_XIVE2(opaque);
1762     uint64_t val = -1;
1763     uint32_t reg = offset >> 3;
1764 
1765     switch (offset) {
1766     /*
1767      * XIVE2 hardware thread enablement
1768      */
1769     case TCTXT_EN0:
1770     case TCTXT_EN1:
1771         val = xive->tctxt_regs[reg];
1772         break;
1773 
1774     case TCTXT_EN0_SET:
1775     case TCTXT_EN0_RESET:
1776         val = xive->tctxt_regs[TCTXT_EN0 >> 3];
1777         break;
1778     case TCTXT_EN1_SET:
1779     case TCTXT_EN1_RESET:
1780         val = xive->tctxt_regs[TCTXT_EN1 >> 3];
1781         break;
1782     case TCTXT_CFG:
1783         val = xive->tctxt_regs[reg];
1784         break;
1785     default:
1786         xive2_error(xive, "TCTXT: invalid read @%"HWADDR_PRIx, offset);
1787     }
1788 
1789     return val;
1790 }
1791 
1792 static void pnv_xive2_ic_tctxt_write(void *opaque, hwaddr offset,
1793                                      uint64_t val, unsigned size)
1794 {
1795     PnvXive2 *xive = PNV_XIVE2(opaque);
1796     uint32_t reg = offset >> 3;
1797 
1798     switch (offset) {
1799     /*
1800      * XIVE2 hardware thread enablement
1801      */
1802     case TCTXT_EN0: /* Physical Thread Enable */
1803     case TCTXT_EN1: /* Physical Thread Enable (fused core) */
1804         xive->tctxt_regs[reg] = val;
1805         break;
1806 
1807     case TCTXT_EN0_SET:
1808         xive->tctxt_regs[TCTXT_EN0 >> 3] |= val;
1809         break;
1810     case TCTXT_EN1_SET:
1811         xive->tctxt_regs[TCTXT_EN1 >> 3] |= val;
1812         break;
1813     case TCTXT_EN0_RESET:
1814         xive->tctxt_regs[TCTXT_EN0 >> 3] &= ~val;
1815         break;
1816     case TCTXT_EN1_RESET:
1817         xive->tctxt_regs[TCTXT_EN1 >> 3] &= ~val;
1818         break;
1819     case TCTXT_CFG:
1820         xive->tctxt_regs[reg] = val;
1821         break;
1822     default:
1823         xive2_error(xive, "TCTXT: invalid write @0x%"HWADDR_PRIx
1824                     " data 0x%"PRIx64, offset, val);
1825         return;
1826     }
1827 }
1828 
1829 static const MemoryRegionOps pnv_xive2_ic_tctxt_ops = {
1830     .read = pnv_xive2_ic_tctxt_read,
1831     .write = pnv_xive2_ic_tctxt_write,
1832     .endianness = DEVICE_BIG_ENDIAN,
1833     .valid = {
1834         .min_access_size = 8,
1835         .max_access_size = 8,
1836     },
1837     .impl = {
1838         .min_access_size = 8,
1839         .max_access_size = 8,
1840     },
1841 };
1842 
1843 /*
1844  * Redirect XSCOM to MMIO handlers
1845  */
1846 static uint64_t pnv_xive2_xscom_read(void *opaque, hwaddr offset,
1847                                      unsigned size)
1848 {
1849     PnvXive2 *xive = PNV_XIVE2(opaque);
1850     uint64_t val = -1;
1851     uint32_t xscom_reg = offset >> 3;
1852     uint32_t mmio_offset = (xscom_reg & 0xFF) << 3;
1853 
1854     switch (xscom_reg) {
1855     case 0x000 ... 0x0FF:
1856         val = pnv_xive2_ic_cq_read(opaque, mmio_offset, size);
1857         break;
1858     case 0x100 ... 0x1FF:
1859         val = pnv_xive2_ic_vc_read(opaque, mmio_offset, size);
1860         break;
1861     case 0x200 ... 0x2FF:
1862         val = pnv_xive2_ic_pc_read(opaque, mmio_offset, size);
1863         break;
1864     case 0x300 ... 0x3FF:
1865         val = pnv_xive2_ic_tctxt_read(opaque, mmio_offset, size);
1866         break;
1867     default:
1868         xive2_error(xive, "XSCOM: invalid read @%"HWADDR_PRIx, offset);
1869     }
1870 
1871     return val;
1872 }
1873 
1874 static void pnv_xive2_xscom_write(void *opaque, hwaddr offset,
1875                                   uint64_t val, unsigned size)
1876 {
1877     PnvXive2 *xive = PNV_XIVE2(opaque);
1878     uint32_t xscom_reg = offset >> 3;
1879     uint32_t mmio_offset = (xscom_reg & 0xFF) << 3;
1880 
1881     switch (xscom_reg) {
1882     case 0x000 ... 0x0FF:
1883         pnv_xive2_ic_cq_write(opaque, mmio_offset, val, size);
1884         break;
1885     case 0x100 ... 0x1FF:
1886         pnv_xive2_ic_vc_write(opaque, mmio_offset, val, size);
1887         break;
1888     case 0x200 ... 0x2FF:
1889         pnv_xive2_ic_pc_write(opaque, mmio_offset, val, size);
1890         break;
1891     case 0x300 ... 0x3FF:
1892         pnv_xive2_ic_tctxt_write(opaque, mmio_offset, val, size);
1893         break;
1894     default:
1895         xive2_error(xive, "XSCOM: invalid write @%"HWADDR_PRIx
1896                     " value 0x%"PRIx64, offset, val);
1897     }
1898 }
1899 
1900 static const MemoryRegionOps pnv_xive2_xscom_ops = {
1901     .read = pnv_xive2_xscom_read,
1902     .write = pnv_xive2_xscom_write,
1903     .endianness = DEVICE_BIG_ENDIAN,
1904     .valid = {
1905         .min_access_size = 8,
1906         .max_access_size = 8,
1907     },
1908     .impl = {
1909         .min_access_size = 8,
1910         .max_access_size = 8,
1911     },
1912 };
1913 
1914 /*
1915  * Notify port page. The layout is compatible between 4K and 64K pages :
1916  *
1917  * Page 1           Notify page (writes only)
1918  *  0x000 - 0x7FF   IPI interrupt (NPU)
1919  *  0x800 - 0xFFF   HW interrupt triggers (PSI, PHB)
1920  */
1921 
1922 static void pnv_xive2_ic_hw_trigger(PnvXive2 *xive, hwaddr addr,
1923                                     uint64_t val)
1924 {
1925     uint8_t blk;
1926     uint32_t idx;
1927 
1928     if (val & XIVE_TRIGGER_END) {
1929         xive2_error(xive, "IC: END trigger at @0x%"HWADDR_PRIx" data 0x%"PRIx64,
1930                    addr, val);
1931         return;
1932     }
1933 
1934     /*
1935      * Forward the source event notification directly to the Router.
1936      * The source interrupt number should already be correctly encoded
1937      * with the chip block id by the sending device (PHB, PSI).
1938      */
1939     blk = XIVE_EAS_BLOCK(val);
1940     idx = XIVE_EAS_INDEX(val);
1941 
1942     xive2_router_notify(XIVE_NOTIFIER(xive), XIVE_EAS(blk, idx),
1943                          !!(val & XIVE_TRIGGER_PQ));
1944 }
1945 
1946 static void pnv_xive2_ic_notify_write(void *opaque, hwaddr offset,
1947                                       uint64_t val, unsigned size)
1948 {
1949     PnvXive2 *xive = PNV_XIVE2(opaque);
1950 
1951     /* VC: IPI triggers */
1952     switch (offset) {
1953     case 0x000 ... 0x7FF:
1954         /* TODO: check IPI notify sub-page routing */
1955         pnv_xive2_ic_hw_trigger(opaque, offset, val);
1956         break;
1957 
1958     /* VC: HW triggers */
1959     case 0x800 ... 0xFFF:
1960         pnv_xive2_ic_hw_trigger(opaque, offset, val);
1961         break;
1962 
1963     default:
1964         xive2_error(xive, "NOTIFY: invalid write @%"HWADDR_PRIx
1965                     " value 0x%"PRIx64, offset, val);
1966     }
1967 }
1968 
1969 static uint64_t pnv_xive2_ic_notify_read(void *opaque, hwaddr offset,
1970                                          unsigned size)
1971 {
1972     PnvXive2 *xive = PNV_XIVE2(opaque);
1973 
1974    /* loads are invalid */
1975     xive2_error(xive, "NOTIFY: invalid read @%"HWADDR_PRIx, offset);
1976     return -1;
1977 }
1978 
1979 static const MemoryRegionOps pnv_xive2_ic_notify_ops = {
1980     .read = pnv_xive2_ic_notify_read,
1981     .write = pnv_xive2_ic_notify_write,
1982     .endianness = DEVICE_BIG_ENDIAN,
1983     .valid = {
1984         .min_access_size = 8,
1985         .max_access_size = 8,
1986     },
1987     .impl = {
1988         .min_access_size = 8,
1989         .max_access_size = 8,
1990     },
1991 };
1992 
1993 static uint64_t pnv_xive2_ic_lsi_read(void *opaque, hwaddr offset,
1994                                       unsigned size)
1995 {
1996     PnvXive2 *xive = PNV_XIVE2(opaque);
1997 
1998     xive2_error(xive, "LSI: invalid read @%"HWADDR_PRIx, offset);
1999     return -1;
2000 }
2001 
2002 static void pnv_xive2_ic_lsi_write(void *opaque, hwaddr offset,
2003                                    uint64_t val, unsigned size)
2004 {
2005     PnvXive2 *xive = PNV_XIVE2(opaque);
2006 
2007     xive2_error(xive, "LSI: invalid write @%"HWADDR_PRIx" value 0x%"PRIx64,
2008                 offset, val);
2009 }
2010 
2011 static const MemoryRegionOps pnv_xive2_ic_lsi_ops = {
2012     .read = pnv_xive2_ic_lsi_read,
2013     .write = pnv_xive2_ic_lsi_write,
2014     .endianness = DEVICE_BIG_ENDIAN,
2015     .valid = {
2016         .min_access_size = 8,
2017         .max_access_size = 8,
2018     },
2019     .impl = {
2020         .min_access_size = 8,
2021         .max_access_size = 8,
2022     },
2023 };
2024 
2025 /*
2026  * Sync MMIO page (write only)
2027  */
2028 #define PNV_XIVE2_SYNC_IPI              0x000
2029 #define PNV_XIVE2_SYNC_HW               0x080
2030 #define PNV_XIVE2_SYNC_NxC              0x100
2031 #define PNV_XIVE2_SYNC_INT              0x180
2032 #define PNV_XIVE2_SYNC_OS_ESC           0x200
2033 #define PNV_XIVE2_SYNC_POOL_ESC         0x280
2034 #define PNV_XIVE2_SYNC_HARD_ESC         0x300
2035 #define PNV_XIVE2_SYNC_NXC_LD_LCL_NCO   0x800
2036 #define PNV_XIVE2_SYNC_NXC_LD_LCL_CO    0x880
2037 #define PNV_XIVE2_SYNC_NXC_ST_LCL_NCI   0x900
2038 #define PNV_XIVE2_SYNC_NXC_ST_LCL_CI    0x980
2039 #define PNV_XIVE2_SYNC_NXC_ST_RMT_NCI   0xA00
2040 #define PNV_XIVE2_SYNC_NXC_ST_RMT_CI    0xA80
2041 
2042 static uint64_t pnv_xive2_ic_sync_read(void *opaque, hwaddr offset,
2043                                        unsigned size)
2044 {
2045     PnvXive2 *xive = PNV_XIVE2(opaque);
2046 
2047     /* loads are invalid */
2048     xive2_error(xive, "SYNC: invalid read @%"HWADDR_PRIx, offset);
2049     return -1;
2050 }
2051 
2052 /*
2053  * The sync MMIO space spans two pages.  The lower page is use for
2054  * queue sync "poll" requests while the upper page is used for queue
2055  * sync "inject" requests.  Inject requests require the HW to write
2056  * a byte of all 1's to a predetermined location in memory in order
2057  * to signal completion of the request.  Both pages have the same
2058  * layout, so it is easiest to handle both with a single function.
2059  */
2060 static void pnv_xive2_ic_sync_write(void *opaque, hwaddr offset,
2061                                     uint64_t val, unsigned size)
2062 {
2063     PnvXive2 *xive = PNV_XIVE2(opaque);
2064     int inject_type;
2065     hwaddr pg_offset_mask = (1ull << xive->ic_shift) - 1;
2066 
2067     /* adjust offset for inject page */
2068     hwaddr adj_offset = offset & pg_offset_mask;
2069 
2070     switch (adj_offset) {
2071     case PNV_XIVE2_SYNC_IPI:
2072         inject_type = PNV_XIVE2_QUEUE_IPI;
2073         break;
2074     case PNV_XIVE2_SYNC_HW:
2075         inject_type = PNV_XIVE2_QUEUE_HW;
2076         break;
2077     case PNV_XIVE2_SYNC_NxC:
2078         inject_type = PNV_XIVE2_QUEUE_NXC;
2079         break;
2080     case PNV_XIVE2_SYNC_INT:
2081         inject_type = PNV_XIVE2_QUEUE_INT;
2082         break;
2083     case PNV_XIVE2_SYNC_OS_ESC:
2084         inject_type = PNV_XIVE2_QUEUE_OS;
2085         break;
2086     case PNV_XIVE2_SYNC_POOL_ESC:
2087         inject_type = PNV_XIVE2_QUEUE_POOL;
2088         break;
2089     case PNV_XIVE2_SYNC_HARD_ESC:
2090         inject_type = PNV_XIVE2_QUEUE_HARD;
2091         break;
2092     case PNV_XIVE2_SYNC_NXC_LD_LCL_NCO:
2093         inject_type = PNV_XIVE2_QUEUE_NXC_LD_LCL_NCO;
2094         break;
2095     case PNV_XIVE2_SYNC_NXC_LD_LCL_CO:
2096         inject_type = PNV_XIVE2_QUEUE_NXC_LD_LCL_CO;
2097         break;
2098     case PNV_XIVE2_SYNC_NXC_ST_LCL_NCI:
2099         inject_type = PNV_XIVE2_QUEUE_NXC_ST_LCL_NCI;
2100         break;
2101     case PNV_XIVE2_SYNC_NXC_ST_LCL_CI:
2102         inject_type = PNV_XIVE2_QUEUE_NXC_ST_LCL_CI;
2103         break;
2104     case PNV_XIVE2_SYNC_NXC_ST_RMT_NCI:
2105         inject_type = PNV_XIVE2_QUEUE_NXC_ST_RMT_NCI;
2106         break;
2107     case PNV_XIVE2_SYNC_NXC_ST_RMT_CI:
2108         inject_type = PNV_XIVE2_QUEUE_NXC_ST_RMT_CI;
2109         break;
2110     default:
2111         xive2_error(xive, "SYNC: invalid write @%"HWADDR_PRIx" value 0x%"PRIx64,
2112                     offset, val);
2113         return;
2114     }
2115 
2116     /* Write Queue Sync notification byte if writing to sync inject page */
2117     if ((offset & ~pg_offset_mask) != 0) {
2118         pnv_xive2_inject_notify(xive, inject_type);
2119     }
2120 }
2121 
2122 static const MemoryRegionOps pnv_xive2_ic_sync_ops = {
2123     .read = pnv_xive2_ic_sync_read,
2124     .write = pnv_xive2_ic_sync_write,
2125     .endianness = DEVICE_BIG_ENDIAN,
2126     .valid = {
2127         .min_access_size = 8,
2128         .max_access_size = 8,
2129     },
2130     .impl = {
2131         .min_access_size = 8,
2132         .max_access_size = 8,
2133     },
2134 };
2135 
2136 /*
2137  * When the TM direct pages of the IC controller are accessed, the
2138  * target HW thread is deduced from the page offset.
2139  */
2140 static uint32_t pnv_xive2_ic_tm_get_pir(PnvXive2 *xive, hwaddr offset)
2141 {
2142     /* On P10, the node ID shift in the PIR register is 8 bits */
2143     return xive->chip->chip_id << 8 | offset >> xive->ic_shift;
2144 }
2145 
2146 static uint32_t pnv_xive2_ic_tm_get_hw_page_offset(PnvXive2 *xive,
2147                                                    hwaddr offset)
2148 {
2149     /*
2150      * Indirect TIMA accesses are similar to direct accesses for
2151      * privilege ring 0. So remove any traces of the hw thread ID from
2152      * the offset in the IC BAR as it could be interpreted as the ring
2153      * privilege when calling the underlying direct access functions.
2154      */
2155     return offset & ((1ull << xive->ic_shift) - 1);
2156 }
2157 
2158 static XiveTCTX *pnv_xive2_get_indirect_tctx(PnvXive2 *xive, uint32_t pir)
2159 {
2160     PnvChip *chip = xive->chip;
2161     PowerPCCPU *cpu = NULL;
2162 
2163     cpu = pnv_chip_find_cpu(chip, pir);
2164     if (!cpu) {
2165         xive2_error(xive, "IC: invalid PIR %x for indirect access", pir);
2166         return NULL;
2167     }
2168 
2169     if (!pnv_xive2_is_cpu_enabled(xive, cpu)) {
2170         xive2_error(xive, "IC: CPU %x is not enabled", pir);
2171     }
2172 
2173     return XIVE_TCTX(pnv_cpu_state(cpu)->intc);
2174 }
2175 
2176 static uint64_t pnv_xive2_ic_tm_indirect_read(void *opaque, hwaddr offset,
2177                                               unsigned size)
2178 {
2179     PnvXive2 *xive = PNV_XIVE2(opaque);
2180     XivePresenter *xptr = XIVE_PRESENTER(xive);
2181     hwaddr hw_page_offset;
2182     uint32_t pir;
2183     XiveTCTX *tctx;
2184     uint64_t val = -1;
2185 
2186     pir = pnv_xive2_ic_tm_get_pir(xive, offset);
2187     hw_page_offset = pnv_xive2_ic_tm_get_hw_page_offset(xive, offset);
2188     tctx = pnv_xive2_get_indirect_tctx(xive, pir);
2189     if (tctx) {
2190         val = xive_tctx_tm_read(xptr, tctx, hw_page_offset, size);
2191     }
2192 
2193     return val;
2194 }
2195 
2196 static void pnv_xive2_ic_tm_indirect_write(void *opaque, hwaddr offset,
2197                                            uint64_t val, unsigned size)
2198 {
2199     PnvXive2 *xive = PNV_XIVE2(opaque);
2200     XivePresenter *xptr = XIVE_PRESENTER(xive);
2201     hwaddr hw_page_offset;
2202     uint32_t pir;
2203     XiveTCTX *tctx;
2204 
2205     pir = pnv_xive2_ic_tm_get_pir(xive, offset);
2206     hw_page_offset = pnv_xive2_ic_tm_get_hw_page_offset(xive, offset);
2207     tctx = pnv_xive2_get_indirect_tctx(xive, pir);
2208     if (tctx) {
2209         xive_tctx_tm_write(xptr, tctx, hw_page_offset, val, size);
2210     }
2211 }
2212 
2213 static const MemoryRegionOps pnv_xive2_ic_tm_indirect_ops = {
2214     .read = pnv_xive2_ic_tm_indirect_read,
2215     .write = pnv_xive2_ic_tm_indirect_write,
2216     .endianness = DEVICE_BIG_ENDIAN,
2217     .valid = {
2218         .min_access_size = 1,
2219         .max_access_size = 8,
2220     },
2221     .impl = {
2222         .min_access_size = 1,
2223         .max_access_size = 8,
2224     },
2225 };
2226 
2227 /*
2228  * TIMA ops
2229  */
2230 static void pnv_xive2_tm_write(void *opaque, hwaddr offset,
2231                                uint64_t value, unsigned size)
2232 {
2233     PowerPCCPU *cpu = POWERPC_CPU(current_cpu);
2234     PnvXive2 *xive = pnv_xive2_tm_get_xive(cpu);
2235     XiveTCTX *tctx = XIVE_TCTX(pnv_cpu_state(cpu)->intc);
2236     XivePresenter *xptr = XIVE_PRESENTER(xive);
2237 
2238     xive_tctx_tm_write(xptr, tctx, offset, value, size);
2239 }
2240 
2241 static uint64_t pnv_xive2_tm_read(void *opaque, hwaddr offset, unsigned size)
2242 {
2243     PowerPCCPU *cpu = POWERPC_CPU(current_cpu);
2244     PnvXive2 *xive = pnv_xive2_tm_get_xive(cpu);
2245     XiveTCTX *tctx = XIVE_TCTX(pnv_cpu_state(cpu)->intc);
2246     XivePresenter *xptr = XIVE_PRESENTER(xive);
2247 
2248     return xive_tctx_tm_read(xptr, tctx, offset, size);
2249 }
2250 
2251 static const MemoryRegionOps pnv_xive2_tm_ops = {
2252     .read = pnv_xive2_tm_read,
2253     .write = pnv_xive2_tm_write,
2254     .endianness = DEVICE_BIG_ENDIAN,
2255     .valid = {
2256         .min_access_size = 1,
2257         .max_access_size = 8,
2258     },
2259     .impl = {
2260         .min_access_size = 1,
2261         .max_access_size = 8,
2262     },
2263 };
2264 
2265 static uint64_t pnv_xive2_nvc_read(void *opaque, hwaddr addr,
2266                                    unsigned size)
2267 {
2268     PnvXive2 *xive = PNV_XIVE2(opaque);
2269     XivePresenter *xptr = XIVE_PRESENTER(xive);
2270     uint32_t page = addr >> xive->nvpg_shift;
2271     uint16_t op = addr & 0xFFF;
2272     uint8_t blk = pnv_xive2_block_id(xive);
2273 
2274     if (size != 2) {
2275         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid nvc load size %d\n",
2276                       size);
2277         return -1;
2278     }
2279 
2280     return xive2_presenter_nvgc_backlog_op(xptr, true, blk, page, op, 1);
2281 }
2282 
2283 static void pnv_xive2_nvc_write(void *opaque, hwaddr addr,
2284                                 uint64_t val, unsigned size)
2285 {
2286     PnvXive2 *xive = PNV_XIVE2(opaque);
2287     XivePresenter *xptr = XIVE_PRESENTER(xive);
2288     uint32_t page = addr >> xive->nvc_shift;
2289     uint16_t op = addr & 0xFFF;
2290     uint8_t blk = pnv_xive2_block_id(xive);
2291 
2292     if (size != 1) {
2293         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid nvc write size %d\n",
2294                       size);
2295         return;
2296     }
2297 
2298     (void)xive2_presenter_nvgc_backlog_op(xptr, true, blk, page, op, val);
2299 }
2300 
2301 static const MemoryRegionOps pnv_xive2_nvc_ops = {
2302     .read = pnv_xive2_nvc_read,
2303     .write = pnv_xive2_nvc_write,
2304     .endianness = DEVICE_BIG_ENDIAN,
2305     .valid = {
2306         .min_access_size = 1,
2307         .max_access_size = 8,
2308     },
2309     .impl = {
2310         .min_access_size = 1,
2311         .max_access_size = 8,
2312     },
2313 };
2314 
2315 static uint64_t pnv_xive2_nvpg_read(void *opaque, hwaddr addr,
2316                                     unsigned size)
2317 {
2318     PnvXive2 *xive = PNV_XIVE2(opaque);
2319     XivePresenter *xptr = XIVE_PRESENTER(xive);
2320     uint32_t page = addr >> xive->nvpg_shift;
2321     uint16_t op = addr & 0xFFF;
2322     uint32_t index = page >> 1;
2323     uint8_t blk = pnv_xive2_block_id(xive);
2324 
2325     if (size != 2) {
2326         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid nvpg load size %d\n",
2327                       size);
2328         return -1;
2329     }
2330 
2331     if (page % 2) {
2332         /* odd page - NVG */
2333         return xive2_presenter_nvgc_backlog_op(xptr, false, blk, index, op, 1);
2334     } else {
2335         /* even page - NVP */
2336         return xive2_presenter_nvp_backlog_op(xptr, blk, index, op);
2337     }
2338 }
2339 
2340 static void pnv_xive2_nvpg_write(void *opaque, hwaddr addr,
2341                                  uint64_t val, unsigned size)
2342 {
2343     PnvXive2 *xive = PNV_XIVE2(opaque);
2344     XivePresenter *xptr = XIVE_PRESENTER(xive);
2345     uint32_t page = addr >> xive->nvpg_shift;
2346     uint16_t op = addr & 0xFFF;
2347     uint32_t index = page >> 1;
2348     uint8_t blk = pnv_xive2_block_id(xive);
2349 
2350     if (size != 1) {
2351         qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid nvpg write size %d\n",
2352                       size);
2353         return;
2354     }
2355 
2356     if (page % 2) {
2357         /* odd page - NVG */
2358         (void)xive2_presenter_nvgc_backlog_op(xptr, false, blk, index, op, val);
2359     } else {
2360         /* even page - NVP */
2361         (void)xive2_presenter_nvp_backlog_op(xptr, blk, index, op);
2362     }
2363 }
2364 
2365 static const MemoryRegionOps pnv_xive2_nvpg_ops = {
2366     .read = pnv_xive2_nvpg_read,
2367     .write = pnv_xive2_nvpg_write,
2368     .endianness = DEVICE_BIG_ENDIAN,
2369     .valid = {
2370         .min_access_size = 1,
2371         .max_access_size = 8,
2372     },
2373     .impl = {
2374         .min_access_size = 1,
2375         .max_access_size = 8,
2376     },
2377 };
2378 
2379 /*
2380  * POWER10 default capabilities: 0x2000120076f000FC
2381  */
2382 #define PNV_XIVE2_CAPABILITIES  0x2000120076f000FC
2383 
2384 /*
2385  * POWER10 default configuration: 0x0030000033000000
2386  *
2387  * 8bits thread id was dropped for P10
2388  */
2389 #define PNV_XIVE2_CONFIGURATION 0x0030000033000000
2390 
2391 static void pnv_xive2_reset(void *dev)
2392 {
2393     PnvXive2 *xive = PNV_XIVE2(dev);
2394     XiveSource *xsrc = &xive->ipi_source;
2395     Xive2EndSource *end_xsrc = &xive->end_source;
2396 
2397     xive->cq_regs[CQ_XIVE_CAP >> 3] = xive->capabilities;
2398     xive->cq_regs[CQ_XIVE_CFG >> 3] = xive->config;
2399 
2400     /* HW hardwires the #Topology of the chip in the block field */
2401     xive->cq_regs[CQ_XIVE_CFG >> 3] |=
2402         SETFIELD(CQ_XIVE_CFG_HYP_HARD_BLOCK_ID, 0ull, xive->chip->chip_id);
2403 
2404     /* VC and PC cache watch assign mechanism */
2405     xive->vc_regs[VC_ENDC_CFG >> 3] =
2406         SETFIELD(VC_ENDC_CFG_CACHE_WATCH_ASSIGN, 0ull, 0b0111);
2407     xive->pc_regs[PC_NXC_PROC_CONFIG >> 3] =
2408         SETFIELD(PC_NXC_PROC_CONFIG_WATCH_ASSIGN, 0ull, 0b0111);
2409 
2410     /* Set default page size to 64k */
2411     xive->ic_shift = xive->esb_shift = xive->end_shift = 16;
2412     xive->nvc_shift = xive->nvpg_shift = xive->tm_shift = 16;
2413 
2414     /* Clear source MMIOs */
2415     if (memory_region_is_mapped(&xsrc->esb_mmio)) {
2416         memory_region_del_subregion(&xive->esb_mmio, &xsrc->esb_mmio);
2417     }
2418 
2419     if (memory_region_is_mapped(&end_xsrc->esb_mmio)) {
2420         memory_region_del_subregion(&xive->end_mmio, &end_xsrc->esb_mmio);
2421     }
2422 }
2423 
2424 /*
2425  *  Maximum number of IRQs and ENDs supported by HW. Will be tuned by
2426  *  software.
2427  */
2428 #define PNV_XIVE2_NR_IRQS (PNV10_XIVE2_ESB_SIZE / (1ull << XIVE_ESB_64K_2PAGE))
2429 #define PNV_XIVE2_NR_ENDS (PNV10_XIVE2_END_SIZE / (1ull << XIVE_ESB_64K_2PAGE))
2430 
2431 static void pnv_xive2_realize(DeviceState *dev, Error **errp)
2432 {
2433     PnvXive2 *xive = PNV_XIVE2(dev);
2434     PnvXive2Class *pxc = PNV_XIVE2_GET_CLASS(dev);
2435     XiveSource *xsrc = &xive->ipi_source;
2436     Xive2EndSource *end_xsrc = &xive->end_source;
2437     Error *local_err = NULL;
2438     int i;
2439 
2440     pxc->parent_realize(dev, &local_err);
2441     if (local_err) {
2442         error_propagate(errp, local_err);
2443         return;
2444     }
2445 
2446     assert(xive->chip);
2447 
2448     /*
2449      * The XiveSource and Xive2EndSource objects are realized with the
2450      * maximum allowed HW configuration. The ESB MMIO regions will be
2451      * resized dynamically when the controller is configured by the FW
2452      * to limit accesses to resources not provisioned.
2453      */
2454     object_property_set_int(OBJECT(xsrc), "flags", XIVE_SRC_STORE_EOI,
2455                             &error_fatal);
2456     object_property_set_int(OBJECT(xsrc), "nr-irqs", PNV_XIVE2_NR_IRQS,
2457                             &error_fatal);
2458     object_property_set_link(OBJECT(xsrc), "xive", OBJECT(xive),
2459                              &error_fatal);
2460     qdev_realize(DEVICE(xsrc), NULL, &local_err);
2461     if (local_err) {
2462         error_propagate(errp, local_err);
2463         return;
2464     }
2465 
2466     object_property_set_int(OBJECT(end_xsrc), "nr-ends", PNV_XIVE2_NR_ENDS,
2467                             &error_fatal);
2468     object_property_set_link(OBJECT(end_xsrc), "xive", OBJECT(xive),
2469                              &error_abort);
2470     qdev_realize(DEVICE(end_xsrc), NULL, &local_err);
2471     if (local_err) {
2472         error_propagate(errp, local_err);
2473         return;
2474     }
2475 
2476     /* XSCOM region, used for initial configuration of the BARs */
2477     memory_region_init_io(&xive->xscom_regs, OBJECT(dev),
2478                           &pnv_xive2_xscom_ops, xive, "xscom-xive",
2479                           PNV10_XSCOM_XIVE2_SIZE << 3);
2480 
2481     /* Interrupt controller MMIO regions */
2482     xive->ic_shift = 16;
2483     memory_region_init(&xive->ic_mmio, OBJECT(dev), "xive-ic",
2484                        PNV10_XIVE2_IC_SIZE);
2485 
2486     for (i = 0; i < ARRAY_SIZE(xive->ic_mmios); i++) {
2487         memory_region_init_io(&xive->ic_mmios[i], OBJECT(dev),
2488                          pnv_xive2_ic_regions[i].ops, xive,
2489                          pnv_xive2_ic_regions[i].name,
2490                          pnv_xive2_ic_regions[i].pgsize << xive->ic_shift);
2491     }
2492 
2493     /*
2494      * VC MMIO regions.
2495      */
2496     xive->esb_shift = 16;
2497     xive->end_shift = 16;
2498     memory_region_init(&xive->esb_mmio, OBJECT(xive), "xive-esb",
2499                        PNV10_XIVE2_ESB_SIZE);
2500     memory_region_init(&xive->end_mmio, OBJECT(xive), "xive-end",
2501                        PNV10_XIVE2_END_SIZE);
2502 
2503     /* Presenter Controller MMIO region (not modeled) */
2504     xive->nvc_shift = 16;
2505     xive->nvpg_shift = 16;
2506     memory_region_init_io(&xive->nvc_mmio, OBJECT(dev),
2507                           &pnv_xive2_nvc_ops, xive,
2508                           "xive-nvc", PNV10_XIVE2_NVC_SIZE);
2509 
2510     memory_region_init_io(&xive->nvpg_mmio, OBJECT(dev),
2511                           &pnv_xive2_nvpg_ops, xive,
2512                           "xive-nvpg", PNV10_XIVE2_NVPG_SIZE);
2513 
2514     /* Thread Interrupt Management Area (Direct) */
2515     xive->tm_shift = 16;
2516     memory_region_init_io(&xive->tm_mmio, OBJECT(dev), &pnv_xive2_tm_ops,
2517                           xive, "xive-tima", PNV10_XIVE2_TM_SIZE);
2518 
2519     qemu_register_reset(pnv_xive2_reset, dev);
2520 }
2521 
2522 static const Property pnv_xive2_properties[] = {
2523     DEFINE_PROP_UINT64("ic-bar", PnvXive2, ic_base, 0),
2524     DEFINE_PROP_UINT64("esb-bar", PnvXive2, esb_base, 0),
2525     DEFINE_PROP_UINT64("end-bar", PnvXive2, end_base, 0),
2526     DEFINE_PROP_UINT64("nvc-bar", PnvXive2, nvc_base, 0),
2527     DEFINE_PROP_UINT64("nvpg-bar", PnvXive2, nvpg_base, 0),
2528     DEFINE_PROP_UINT64("tm-bar", PnvXive2, tm_base, 0),
2529     DEFINE_PROP_UINT64("capabilities", PnvXive2, capabilities,
2530                        PNV_XIVE2_CAPABILITIES),
2531     DEFINE_PROP_UINT64("config", PnvXive2, config,
2532                        PNV_XIVE2_CONFIGURATION),
2533     DEFINE_PROP_LINK("chip", PnvXive2, chip, TYPE_PNV_CHIP, PnvChip *),
2534 };
2535 
2536 static void pnv_xive2_instance_init(Object *obj)
2537 {
2538     PnvXive2 *xive = PNV_XIVE2(obj);
2539 
2540     object_initialize_child(obj, "ipi_source", &xive->ipi_source,
2541                             TYPE_XIVE_SOURCE);
2542     object_initialize_child(obj, "end_source", &xive->end_source,
2543                             TYPE_XIVE2_END_SOURCE);
2544 }
2545 
2546 static int pnv_xive2_dt_xscom(PnvXScomInterface *dev, void *fdt,
2547                               int xscom_offset)
2548 {
2549     const char compat_p10[] = "ibm,power10-xive-x";
2550     char *name;
2551     int offset;
2552     uint32_t reg[] = {
2553         cpu_to_be32(PNV10_XSCOM_XIVE2_BASE),
2554         cpu_to_be32(PNV10_XSCOM_XIVE2_SIZE)
2555     };
2556 
2557     name = g_strdup_printf("xive@%x", PNV10_XSCOM_XIVE2_BASE);
2558     offset = fdt_add_subnode(fdt, xscom_offset, name);
2559     _FDT(offset);
2560     g_free(name);
2561 
2562     _FDT((fdt_setprop(fdt, offset, "reg", reg, sizeof(reg))));
2563     _FDT(fdt_setprop(fdt, offset, "compatible", compat_p10,
2564                      sizeof(compat_p10)));
2565     return 0;
2566 }
2567 
2568 static void pnv_xive2_class_init(ObjectClass *klass, const void *data)
2569 {
2570     DeviceClass *dc = DEVICE_CLASS(klass);
2571     PnvXScomInterfaceClass *xdc = PNV_XSCOM_INTERFACE_CLASS(klass);
2572     Xive2RouterClass *xrc = XIVE2_ROUTER_CLASS(klass);
2573     XiveNotifierClass *xnc = XIVE_NOTIFIER_CLASS(klass);
2574     XivePresenterClass *xpc = XIVE_PRESENTER_CLASS(klass);
2575     PnvXive2Class *pxc = PNV_XIVE2_CLASS(klass);
2576 
2577     xdc->dt_xscom  = pnv_xive2_dt_xscom;
2578 
2579     dc->desc       = "PowerNV XIVE2 Interrupt Controller (POWER10)";
2580     device_class_set_parent_realize(dc, pnv_xive2_realize,
2581                                     &pxc->parent_realize);
2582     device_class_set_props(dc, pnv_xive2_properties);
2583 
2584     xrc->get_eas   = pnv_xive2_get_eas;
2585     xrc->get_pq    = pnv_xive2_get_pq;
2586     xrc->set_pq    = pnv_xive2_set_pq;
2587     xrc->get_end   = pnv_xive2_get_end;
2588     xrc->write_end = pnv_xive2_write_end;
2589     xrc->get_nvp   = pnv_xive2_get_nvp;
2590     xrc->write_nvp = pnv_xive2_write_nvp;
2591     xrc->get_nvgc   = pnv_xive2_get_nvgc;
2592     xrc->write_nvgc = pnv_xive2_write_nvgc;
2593     xrc->get_config  = pnv_xive2_get_config;
2594     xrc->get_block_id = pnv_xive2_get_block_id;
2595 
2596     xnc->notify    = pnv_xive2_notify;
2597 
2598     xpc->match_nvt  = pnv_xive2_match_nvt;
2599     xpc->get_config = pnv_xive2_presenter_get_config;
2600     xpc->broadcast  = pnv_xive2_broadcast;
2601 };
2602 
2603 static const TypeInfo pnv_xive2_info = {
2604     .name          = TYPE_PNV_XIVE2,
2605     .parent        = TYPE_XIVE2_ROUTER,
2606     .instance_init = pnv_xive2_instance_init,
2607     .instance_size = sizeof(PnvXive2),
2608     .class_init    = pnv_xive2_class_init,
2609     .class_size    = sizeof(PnvXive2Class),
2610     .interfaces    = (const InterfaceInfo[]) {
2611         { TYPE_PNV_XSCOM_INTERFACE },
2612         { }
2613     }
2614 };
2615 
2616 static void pnv_xive2_register_types(void)
2617 {
2618     type_register_static(&pnv_xive2_info);
2619 }
2620 
2621 type_init(pnv_xive2_register_types)
2622 
2623 /*
2624  * If the table is direct, we can compute the number of PQ entries
2625  * provisioned by FW.
2626  */
2627 static uint32_t pnv_xive2_nr_esbs(PnvXive2 *xive)
2628 {
2629     uint8_t blk = pnv_xive2_block_id(xive);
2630     uint64_t vsd = xive->vsds[VST_ESB][blk];
2631     uint64_t vst_tsize = 1ull << (GETFIELD(VSD_TSIZE, vsd) + 12);
2632 
2633     return VSD_INDIRECT & vsd ? 0 : vst_tsize * SBE_PER_BYTE;
2634 }
2635 
2636 /*
2637  * Compute the number of entries per indirect subpage.
2638  */
2639 static uint64_t pnv_xive2_vst_per_subpage(PnvXive2 *xive, uint32_t type)
2640 {
2641     uint8_t blk = pnv_xive2_block_id(xive);
2642     uint64_t vsd = xive->vsds[type][blk];
2643     const XiveVstInfo *info = &vst_infos[type];
2644     uint64_t vsd_addr;
2645     uint32_t page_shift;
2646 
2647     /* For direct tables, fake a valid value */
2648     if (!(VSD_INDIRECT & vsd)) {
2649         return 1;
2650     }
2651 
2652     /* Get the page size of the indirect table. */
2653     vsd_addr = vsd & VSD_ADDRESS_MASK;
2654     ldq_be_dma(&address_space_memory, vsd_addr, &vsd, MEMTXATTRS_UNSPECIFIED);
2655 
2656     if (!(vsd & VSD_ADDRESS_MASK)) {
2657 #ifdef XIVE2_DEBUG
2658         xive2_error(xive, "VST: invalid %s entry!?", info->name);
2659 #endif
2660         return 0;
2661     }
2662 
2663     page_shift = GETFIELD(VSD_TSIZE, vsd) + 12;
2664 
2665     if (!pnv_xive2_vst_page_size_allowed(page_shift)) {
2666         xive2_error(xive, "VST: invalid %s page shift %d", info->name,
2667                    page_shift);
2668         return 0;
2669     }
2670 
2671     return (1ull << page_shift) / info->size;
2672 }
2673 
2674 void pnv_xive2_pic_print_info(PnvXive2 *xive, GString *buf)
2675 {
2676     Xive2Router *xrtr = XIVE2_ROUTER(xive);
2677     uint8_t blk = pnv_xive2_block_id(xive);
2678     uint8_t chip_id = xive->chip->chip_id;
2679     uint32_t srcno0 = XIVE_EAS(blk, 0);
2680     uint32_t nr_esbs = pnv_xive2_nr_esbs(xive);
2681     Xive2Eas eas;
2682     Xive2End end;
2683     Xive2Nvp nvp;
2684     Xive2Nvgc nvgc;
2685     int i;
2686     uint64_t entries_per_subpage;
2687 
2688     g_string_append_printf(buf, "XIVE[%x] Source %08x .. %08x\n",
2689                            blk, srcno0, srcno0 + nr_esbs - 1);
2690     xive_source_pic_print_info(&xive->ipi_source, srcno0, buf);
2691 
2692     g_string_append_printf(buf, "XIVE[%x] EAT %08x .. %08x\n",
2693                            blk, srcno0, srcno0 + nr_esbs - 1);
2694     for (i = 0; i < nr_esbs; i++) {
2695         if (xive2_router_get_eas(xrtr, blk, i, &eas)) {
2696             break;
2697         }
2698         if (!xive2_eas_is_masked(&eas)) {
2699             xive2_eas_pic_print_info(&eas, i, buf);
2700         }
2701     }
2702 
2703     g_string_append_printf(buf, "XIVE[%x] #%d END Escalation EAT\n",
2704                            chip_id, blk);
2705     i = 0;
2706     while (!xive2_router_get_end(xrtr, blk, i, &end)) {
2707         xive2_end_eas_pic_print_info(&end, i++, buf);
2708     }
2709 
2710     g_string_append_printf(buf, "XIVE[%x] #%d ENDT\n", chip_id, blk);
2711     i = 0;
2712     while (!xive2_router_get_end(xrtr, blk, i, &end)) {
2713         xive2_end_pic_print_info(&end, i++, buf);
2714     }
2715 
2716     g_string_append_printf(buf, "XIVE[%x] #%d NVPT %08x .. %08x\n",
2717                            chip_id, blk, 0, XIVE2_NVP_COUNT - 1);
2718     entries_per_subpage = pnv_xive2_vst_per_subpage(xive, VST_NVP);
2719     for (i = 0; i < XIVE2_NVP_COUNT; i += entries_per_subpage) {
2720         while (!xive2_router_get_nvp(xrtr, blk, i, &nvp)) {
2721             xive2_nvp_pic_print_info(&nvp, i++, buf);
2722         }
2723     }
2724 
2725     g_string_append_printf(buf, "XIVE[%x] #%d NVGT %08x .. %08x\n",
2726                            chip_id, blk, 0, XIVE2_NVP_COUNT - 1);
2727     entries_per_subpage = pnv_xive2_vst_per_subpage(xive, VST_NVG);
2728     for (i = 0; i < XIVE2_NVP_COUNT; i += entries_per_subpage) {
2729         while (!xive2_router_get_nvgc(xrtr, false, blk, i, &nvgc)) {
2730             xive2_nvgc_pic_print_info(&nvgc, i++, buf);
2731         }
2732     }
2733 
2734     g_string_append_printf(buf, "XIVE[%x] #%d NVCT %08x .. %08x\n",
2735                           chip_id, blk, 0, XIVE2_NVP_COUNT - 1);
2736     entries_per_subpage = pnv_xive2_vst_per_subpage(xive, VST_NVC);
2737     for (i = 0; i < XIVE2_NVP_COUNT; i += entries_per_subpage) {
2738         while (!xive2_router_get_nvgc(xrtr, true, blk, i, &nvgc)) {
2739             xive2_nvgc_pic_print_info(&nvgc, i++, buf);
2740         }
2741     }
2742 }
2743