xref: /openbmc/qemu/hw/intc/pnv_xive2.c (revision 9cb7f6ebed60739ff6e5f09e8ce85c9602d33f2a)
1 /*
2  * QEMU PowerPC XIVE2 interrupt controller model  (POWER10)
3  *
4  * Copyright (c) 2019-2024, IBM Corporation.
5  *
6  * SPDX-License-Identifier: GPL-2.0-or-later
7  */
8 
9 #include "qemu/osdep.h"
10 #include "qemu/log.h"
11 #include "qapi/error.h"
12 #include "target/ppc/cpu.h"
13 #include "system/cpus.h"
14 #include "system/dma.h"
15 #include "hw/ppc/fdt.h"
16 #include "hw/ppc/pnv.h"
17 #include "hw/ppc/pnv_chip.h"
18 #include "hw/ppc/pnv_core.h"
19 #include "hw/ppc/pnv_xscom.h"
20 #include "hw/ppc/xive2.h"
21 #include "hw/ppc/pnv_xive.h"
22 #include "hw/ppc/xive_regs.h"
23 #include "hw/ppc/xive2_regs.h"
24 #include "hw/ppc/ppc.h"
25 #include "hw/qdev-properties.h"
26 #include "system/reset.h"
27 #include "system/qtest.h"
28 
29 #include <libfdt.h>
30 
31 #include "pnv_xive2_regs.h"
32 
33 #undef XIVE2_DEBUG
34 
35 /* XIVE Sync or Flush Notification Block */
36 typedef struct XiveSfnBlock {
37     uint8_t bytes[32];
38 } XiveSfnBlock;
39 
40 /* XIVE Thread Sync or Flush Notification Area */
41 typedef struct XiveThreadNA {
42     XiveSfnBlock topo[16];
43 } XiveThreadNA;
44 
45 /*
46  * Virtual structures table (VST)
47  */
48 #define SBE_PER_BYTE   4
49 
50 typedef struct XiveVstInfo {
51     const char *name;
52     uint32_t    size;
53     uint32_t    max_blocks;
54 } XiveVstInfo;
55 
56 static const XiveVstInfo vst_infos[] = {
57 
58     [VST_EAS]  = { "EAT",  sizeof(Xive2Eas),     16 },
59     [VST_ESB]  = { "ESB",  1,                    16 },
60     [VST_END]  = { "ENDT", sizeof(Xive2End),     16 },
61 
62     [VST_NVP]  = { "NVPT", sizeof(Xive2Nvp),     16 },
63     [VST_NVG]  = { "NVGT", sizeof(Xive2Nvgc),    16 },
64     [VST_NVC]  = { "NVCT", sizeof(Xive2Nvgc),    16 },
65 
66     [VST_IC]  =  { "IC",   1, /* ? */            16 }, /* Topology # */
67     [VST_SYNC] = { "SYNC", sizeof(XiveThreadNA), 16 }, /* Topology # */
68 
69     /*
70      * This table contains the backing store pages for the interrupt
71      * fifos of the VC sub-engine in case of overflow.
72      *
73      * 0 - IPI,
74      * 1 - HWD,
75      * 2 - NxC,
76      * 3 - INT,
77      * 4 - OS-Queue,
78      * 5 - Pool-Queue,
79      * 6 - Hard-Queue
80      */
81     [VST_ERQ]  = { "ERQ",  1,                   VC_QUEUE_COUNT },
82 };
83 
84 #define xive2_error(xive, fmt, ...)                                      \
85     qemu_log_mask(LOG_GUEST_ERROR, "XIVE[%x] - " fmt "\n",              \
86                   (xive)->chip->chip_id, ## __VA_ARGS__);
87 
88 /*
89  * TODO: Document block id override
90  */
91 static uint32_t pnv_xive2_block_id(PnvXive2 *xive)
92 {
93     uint8_t blk = xive->chip->chip_id;
94     uint64_t cfg_val = xive->cq_regs[CQ_XIVE_CFG >> 3];
95 
96     if (cfg_val & CQ_XIVE_CFG_HYP_HARD_BLKID_OVERRIDE) {
97         blk = GETFIELD(CQ_XIVE_CFG_HYP_HARD_BLOCK_ID, cfg_val);
98     }
99 
100     return blk;
101 }
102 
103 /*
104  * Remote access to controllers. HW uses MMIOs. For now, a simple scan
105  * of the chips is good enough.
106  *
107  * TODO: Block scope support
108  */
109 static PnvXive2 *pnv_xive2_get_remote(uint8_t blk)
110 {
111     PnvMachineState *pnv = PNV_MACHINE(qdev_get_machine());
112     int i;
113 
114     for (i = 0; i < pnv->num_chips; i++) {
115         Pnv10Chip *chip10 = PNV10_CHIP(pnv->chips[i]);
116         PnvXive2 *xive = &chip10->xive;
117 
118         if (pnv_xive2_block_id(xive) == blk) {
119             return xive;
120         }
121     }
122     return NULL;
123 }
124 
125 /*
126  * VST accessors for ESB, EAT, ENDT, NVP
127  *
128  * Indirect VST tables are arrays of VSDs pointing to a page (of same
129  * size). Each page is a direct VST table.
130  */
131 
132 #define XIVE_VSD_SIZE 8
133 
134 /* Indirect page size can be 4K, 64K, 2M, 16M. */
135 static uint64_t pnv_xive2_vst_page_size_allowed(uint32_t page_shift)
136 {
137      return page_shift == 12 || page_shift == 16 ||
138          page_shift == 21 || page_shift == 24;
139 }
140 
141 static uint64_t pnv_xive2_vst_addr_direct(PnvXive2 *xive, uint32_t type,
142                                           uint64_t vsd, uint32_t idx)
143 {
144     const XiveVstInfo *info = &vst_infos[type];
145     uint64_t vst_addr = vsd & VSD_ADDRESS_MASK;
146     uint64_t vst_tsize = 1ull << (GETFIELD(VSD_TSIZE, vsd) + 12);
147     uint32_t idx_max;
148 
149     idx_max = vst_tsize / info->size - 1;
150     if (idx > idx_max) {
151 #ifdef XIVE2_DEBUG
152         xive2_error(xive, "VST: %s entry %x out of range [ 0 .. %x ] !?",
153                    info->name, idx, idx_max);
154 #endif
155         return 0;
156     }
157 
158     return vst_addr + idx * info->size;
159 }
160 
161 static uint64_t pnv_xive2_vst_addr_indirect(PnvXive2 *xive, uint32_t type,
162                                             uint64_t vsd, uint32_t idx)
163 {
164     const XiveVstInfo *info = &vst_infos[type];
165     uint64_t vsd_addr;
166     uint32_t vsd_idx;
167     uint32_t page_shift;
168     uint32_t vst_per_page;
169 
170     /* Get the page size of the indirect table. */
171     vsd_addr = vsd & VSD_ADDRESS_MASK;
172     ldq_be_dma(&address_space_memory, vsd_addr, &vsd, MEMTXATTRS_UNSPECIFIED);
173 
174     if (!(vsd & VSD_ADDRESS_MASK)) {
175 #ifdef XIVE2_DEBUG
176         xive2_error(xive, "VST: invalid %s entry %x !?", info->name, idx);
177 #endif
178         return 0;
179     }
180 
181     page_shift = GETFIELD(VSD_TSIZE, vsd) + 12;
182 
183     if (!pnv_xive2_vst_page_size_allowed(page_shift)) {
184         xive2_error(xive, "VST: invalid %s page shift %d", info->name,
185                    page_shift);
186         return 0;
187     }
188 
189     vst_per_page = (1ull << page_shift) / info->size;
190     vsd_idx = idx / vst_per_page;
191 
192     /* Load the VSD we are looking for, if not already done */
193     if (vsd_idx) {
194         vsd_addr = vsd_addr + vsd_idx * XIVE_VSD_SIZE;
195         ldq_be_dma(&address_space_memory, vsd_addr, &vsd,
196                    MEMTXATTRS_UNSPECIFIED);
197 
198         if (!(vsd & VSD_ADDRESS_MASK)) {
199 #ifdef XIVE2_DEBUG
200             xive2_error(xive, "VST: invalid %s entry %x !?", info->name, idx);
201 #endif
202             return 0;
203         }
204 
205         /*
206          * Check that the pages have a consistent size across the
207          * indirect table
208          */
209         if (page_shift != GETFIELD(VSD_TSIZE, vsd) + 12) {
210             xive2_error(xive, "VST: %s entry %x indirect page size differ !?",
211                        info->name, idx);
212             return 0;
213         }
214     }
215 
216     return pnv_xive2_vst_addr_direct(xive, type, vsd, (idx % vst_per_page));
217 }
218 
219 static uint8_t pnv_xive2_nvc_table_compress_shift(PnvXive2 *xive)
220 {
221     uint8_t shift =  GETFIELD(PC_NXC_PROC_CONFIG_NVC_TABLE_COMPRESS,
222                               xive->pc_regs[PC_NXC_PROC_CONFIG >> 3]);
223     return shift > 8 ? 0 : shift;
224 }
225 
226 static uint8_t pnv_xive2_nvg_table_compress_shift(PnvXive2 *xive)
227 {
228     uint8_t shift = GETFIELD(PC_NXC_PROC_CONFIG_NVG_TABLE_COMPRESS,
229                              xive->pc_regs[PC_NXC_PROC_CONFIG >> 3]);
230     return shift > 8 ? 0 : shift;
231 }
232 
233 static uint64_t pnv_xive2_vst_addr(PnvXive2 *xive, uint32_t type, uint8_t blk,
234                                    uint32_t idx)
235 {
236     const XiveVstInfo *info = &vst_infos[type];
237     uint64_t vsd;
238 
239     if (blk >= info->max_blocks) {
240         xive2_error(xive, "VST: invalid block id %d for VST %s %d !?",
241                    blk, info->name, idx);
242         return 0;
243     }
244 
245     vsd = xive->vsds[type][blk];
246     if (vsd == 0) {
247         xive2_error(xive, "VST: vsd == 0 block id %d for VST %s %d !?",
248                    blk, info->name, idx);
249         return 0;
250     }
251 
252     /* Remote VST access */
253     if (GETFIELD(VSD_MODE, vsd) == VSD_MODE_FORWARD) {
254         xive = pnv_xive2_get_remote(blk);
255 
256         return xive ? pnv_xive2_vst_addr(xive, type, blk, idx) : 0;
257     }
258 
259     if (type == VST_NVG) {
260         idx >>= pnv_xive2_nvg_table_compress_shift(xive);
261     } else if (type == VST_NVC) {
262         idx >>= pnv_xive2_nvc_table_compress_shift(xive);
263     }
264 
265     if (VSD_INDIRECT & vsd) {
266         return pnv_xive2_vst_addr_indirect(xive, type, vsd, idx);
267     }
268 
269     return pnv_xive2_vst_addr_direct(xive, type, vsd, idx);
270 }
271 
272 static int pnv_xive2_vst_read(PnvXive2 *xive, uint32_t type, uint8_t blk,
273                              uint32_t idx, void *data)
274 {
275     const XiveVstInfo *info = &vst_infos[type];
276     uint64_t addr = pnv_xive2_vst_addr(xive, type, blk, idx);
277     MemTxResult result;
278 
279     if (!addr) {
280         return -1;
281     }
282 
283     result = address_space_read(&address_space_memory, addr,
284                                 MEMTXATTRS_UNSPECIFIED, data,
285                                 info->size);
286     if (result != MEMTX_OK) {
287         xive2_error(xive, "VST: read failed at @0x%" HWADDR_PRIx
288                    " for VST %s %x/%x\n", addr, info->name, blk, idx);
289         return -1;
290     }
291     return 0;
292 }
293 
294 #define XIVE_VST_WORD_ALL -1
295 
296 static int pnv_xive2_vst_write(PnvXive2 *xive, uint32_t type, uint8_t blk,
297                                uint32_t idx, void *data, uint32_t word_number)
298 {
299     const XiveVstInfo *info = &vst_infos[type];
300     uint64_t addr = pnv_xive2_vst_addr(xive, type, blk, idx);
301     MemTxResult result;
302 
303     if (!addr) {
304         return -1;
305     }
306 
307     if (word_number == XIVE_VST_WORD_ALL) {
308         result = address_space_write(&address_space_memory, addr,
309                                      MEMTXATTRS_UNSPECIFIED, data,
310                                      info->size);
311     } else {
312         result = address_space_write(&address_space_memory,
313                                      addr + word_number * 4,
314                                      MEMTXATTRS_UNSPECIFIED,
315                                      data + word_number * 4, 4);
316     }
317 
318     if (result != MEMTX_OK) {
319         xive2_error(xive, "VST: write failed at @0x%" HWADDR_PRIx
320                    "for VST %s %x/%x\n", addr, info->name, blk, idx);
321         return -1;
322     }
323     return 0;
324 }
325 
326 static int pnv_xive2_get_pq(Xive2Router *xrtr, uint8_t blk, uint32_t idx,
327                              uint8_t *pq)
328 {
329     PnvXive2 *xive = PNV_XIVE2(xrtr);
330 
331     if (pnv_xive2_block_id(xive) != blk) {
332         xive2_error(xive, "VST: EAS %x is remote !?", XIVE_EAS(blk, idx));
333         return -1;
334     }
335 
336     *pq = xive_source_esb_get(&xive->ipi_source, idx);
337     return 0;
338 }
339 
340 static int pnv_xive2_set_pq(Xive2Router *xrtr, uint8_t blk, uint32_t idx,
341                              uint8_t *pq)
342 {
343     PnvXive2 *xive = PNV_XIVE2(xrtr);
344 
345     if (pnv_xive2_block_id(xive) != blk) {
346         xive2_error(xive, "VST: EAS %x is remote !?", XIVE_EAS(blk, idx));
347         return -1;
348     }
349 
350     *pq = xive_source_esb_set(&xive->ipi_source, idx, *pq);
351     return 0;
352 }
353 
354 static int pnv_xive2_get_end(Xive2Router *xrtr, uint8_t blk, uint32_t idx,
355                              Xive2End *end)
356 {
357     return pnv_xive2_vst_read(PNV_XIVE2(xrtr), VST_END, blk, idx, end);
358 }
359 
360 static int pnv_xive2_write_end(Xive2Router *xrtr, uint8_t blk, uint32_t idx,
361                                Xive2End *end, uint8_t word_number)
362 {
363     return pnv_xive2_vst_write(PNV_XIVE2(xrtr), VST_END, blk, idx, end,
364                               word_number);
365 }
366 
367 static inline int pnv_xive2_get_current_pir(PnvXive2 *xive)
368 {
369     if (!qtest_enabled()) {
370         PowerPCCPU *cpu = POWERPC_CPU(current_cpu);
371         return ppc_cpu_pir(cpu);
372     }
373     return 0;
374 }
375 
376 /*
377  * After SW injects a Queue Sync or Cache Flush operation, HW will notify
378  * SW of the completion of the operation by writing a byte of all 1's (0xff)
379  * to a specific memory location.  The memory location is calculated by first
380  * looking up a base address in the SYNC VSD using the Topology ID of the
381  * originating thread as the "block" number.  This points to a
382  * 64k block of memory that is further divided into 128 512 byte chunks of
383  * memory, which is indexed by the thread id of the requesting thread.
384  * Finally, this 512 byte chunk of memory is divided into 16 32 byte
385  * chunks which are indexed by the topology id of the targeted IC's chip.
386  * The values below are the offsets into that 32 byte chunk of memory for
387  * each type of cache flush or queue sync operation.
388  */
389 #define PNV_XIVE2_QUEUE_IPI              0x00
390 #define PNV_XIVE2_QUEUE_HW               0x01
391 #define PNV_XIVE2_QUEUE_NXC              0x02
392 #define PNV_XIVE2_QUEUE_INT              0x03
393 #define PNV_XIVE2_QUEUE_OS               0x04
394 #define PNV_XIVE2_QUEUE_POOL             0x05
395 #define PNV_XIVE2_QUEUE_HARD             0x06
396 #define PNV_XIVE2_CACHE_ENDC             0x08
397 #define PNV_XIVE2_CACHE_ESBC             0x09
398 #define PNV_XIVE2_CACHE_EASC             0x0a
399 #define PNV_XIVE2_QUEUE_NXC_LD_LCL_NCO   0x10
400 #define PNV_XIVE2_QUEUE_NXC_LD_LCL_CO    0x11
401 #define PNV_XIVE2_QUEUE_NXC_ST_LCL_NCI   0x12
402 #define PNV_XIVE2_QUEUE_NXC_ST_LCL_CI    0x13
403 #define PNV_XIVE2_QUEUE_NXC_ST_RMT_NCI   0x14
404 #define PNV_XIVE2_QUEUE_NXC_ST_RMT_CI    0x15
405 #define PNV_XIVE2_CACHE_NXC              0x18
406 
407 static int pnv_xive2_inject_notify(PnvXive2 *xive, int type)
408 {
409     uint64_t addr;
410     int pir = pnv_xive2_get_current_pir(xive);
411     int thread_nr = PNV10_PIR2THREAD(pir);
412     int thread_topo_id = PNV10_PIR2CHIP(pir);
413     int ic_topo_id = xive->chip->chip_id;
414     uint64_t offset = ic_topo_id * sizeof(XiveSfnBlock);
415     uint8_t byte = 0xff;
416     MemTxResult result;
417 
418     /* Retrieve the address of requesting thread's notification area */
419     addr = pnv_xive2_vst_addr(xive, VST_SYNC, thread_topo_id, thread_nr);
420 
421     if (!addr) {
422         xive2_error(xive, "VST: no SYNC entry %x/%x !?",
423                     thread_topo_id, thread_nr);
424         return -1;
425     }
426 
427     address_space_stb(&address_space_memory, addr + offset + type, byte,
428                       MEMTXATTRS_UNSPECIFIED, &result);
429     assert(result == MEMTX_OK);
430 
431     return 0;
432 }
433 
434 static int pnv_xive2_end_update(PnvXive2 *xive, uint8_t watch_engine)
435 {
436     uint8_t  blk;
437     uint32_t idx;
438     int i, spec_reg, data_reg;
439     uint64_t endc_watch[4];
440 
441     assert(watch_engine < ARRAY_SIZE(endc_watch));
442 
443     spec_reg = (VC_ENDC_WATCH0_SPEC + watch_engine * 0x40) >> 3;
444     data_reg = (VC_ENDC_WATCH0_DATA0 + watch_engine * 0x40) >> 3;
445     blk = GETFIELD(VC_ENDC_WATCH_BLOCK_ID, xive->vc_regs[spec_reg]);
446     idx = GETFIELD(VC_ENDC_WATCH_INDEX, xive->vc_regs[spec_reg]);
447 
448     for (i = 0; i < ARRAY_SIZE(endc_watch); i++) {
449         endc_watch[i] = cpu_to_be64(xive->vc_regs[data_reg + i]);
450     }
451 
452     return pnv_xive2_vst_write(xive, VST_END, blk, idx, endc_watch,
453                               XIVE_VST_WORD_ALL);
454 }
455 
456 static void pnv_xive2_end_cache_load(PnvXive2 *xive, uint8_t watch_engine)
457 {
458     uint8_t  blk;
459     uint32_t idx;
460     uint64_t endc_watch[4] = { 0 };
461     int i, spec_reg, data_reg;
462 
463     assert(watch_engine < ARRAY_SIZE(endc_watch));
464 
465     spec_reg = (VC_ENDC_WATCH0_SPEC + watch_engine * 0x40) >> 3;
466     data_reg = (VC_ENDC_WATCH0_DATA0 + watch_engine * 0x40) >> 3;
467     blk = GETFIELD(VC_ENDC_WATCH_BLOCK_ID, xive->vc_regs[spec_reg]);
468     idx = GETFIELD(VC_ENDC_WATCH_INDEX, xive->vc_regs[spec_reg]);
469 
470     if (pnv_xive2_vst_read(xive, VST_END, blk, idx, endc_watch)) {
471         xive2_error(xive, "VST: no END entry %x/%x !?", blk, idx);
472     }
473 
474     for (i = 0; i < ARRAY_SIZE(endc_watch); i++) {
475         xive->vc_regs[data_reg + i] = be64_to_cpu(endc_watch[i]);
476     }
477 }
478 
479 static int pnv_xive2_get_nvp(Xive2Router *xrtr, uint8_t blk, uint32_t idx,
480                              Xive2Nvp *nvp)
481 {
482     return pnv_xive2_vst_read(PNV_XIVE2(xrtr), VST_NVP, blk, idx, nvp);
483 }
484 
485 static int pnv_xive2_write_nvp(Xive2Router *xrtr, uint8_t blk, uint32_t idx,
486                                Xive2Nvp *nvp, uint8_t word_number)
487 {
488     return pnv_xive2_vst_write(PNV_XIVE2(xrtr), VST_NVP, blk, idx, nvp,
489                               word_number);
490 }
491 
492 static int pnv_xive2_get_nvgc(Xive2Router *xrtr, bool crowd,
493                               uint8_t blk, uint32_t idx,
494                               Xive2Nvgc *nvgc)
495 {
496     return pnv_xive2_vst_read(PNV_XIVE2(xrtr), crowd ? VST_NVC : VST_NVG,
497                               blk, idx, nvgc);
498 }
499 
500 static int pnv_xive2_write_nvgc(Xive2Router *xrtr, bool crowd,
501                                 uint8_t blk, uint32_t idx,
502                                 Xive2Nvgc *nvgc)
503 {
504     return pnv_xive2_vst_write(PNV_XIVE2(xrtr), crowd ? VST_NVC : VST_NVG,
505                                blk, idx, nvgc,
506                                XIVE_VST_WORD_ALL);
507 }
508 
509 static int pnv_xive2_nxc_to_table_type(uint8_t nxc_type, uint32_t *table_type)
510 {
511     switch (nxc_type) {
512     case PC_NXC_WATCH_NXC_NVP:
513         *table_type = VST_NVP;
514         break;
515     case PC_NXC_WATCH_NXC_NVG:
516         *table_type = VST_NVG;
517         break;
518     case PC_NXC_WATCH_NXC_NVC:
519         *table_type = VST_NVC;
520         break;
521     default:
522         qemu_log_mask(LOG_GUEST_ERROR,
523                       "XIVE: invalid table type for nxc operation\n");
524         return -1;
525     }
526     return 0;
527 }
528 
529 static int pnv_xive2_nxc_update(PnvXive2 *xive, uint8_t watch_engine)
530 {
531     uint8_t  blk, nxc_type;
532     uint32_t idx, table_type = -1;
533     int i, spec_reg, data_reg;
534     uint64_t nxc_watch[4];
535 
536     assert(watch_engine < ARRAY_SIZE(nxc_watch));
537 
538     spec_reg = (PC_NXC_WATCH0_SPEC + watch_engine * 0x40) >> 3;
539     data_reg = (PC_NXC_WATCH0_DATA0 + watch_engine * 0x40) >> 3;
540     nxc_type = GETFIELD(PC_NXC_WATCH_NXC_TYPE, xive->pc_regs[spec_reg]);
541     blk = GETFIELD(PC_NXC_WATCH_BLOCK_ID, xive->pc_regs[spec_reg]);
542     idx = GETFIELD(PC_NXC_WATCH_INDEX, xive->pc_regs[spec_reg]);
543 
544     assert(!pnv_xive2_nxc_to_table_type(nxc_type, &table_type));
545 
546     for (i = 0; i < ARRAY_SIZE(nxc_watch); i++) {
547         nxc_watch[i] = cpu_to_be64(xive->pc_regs[data_reg + i]);
548     }
549 
550     return pnv_xive2_vst_write(xive, table_type, blk, idx, nxc_watch,
551                               XIVE_VST_WORD_ALL);
552 }
553 
554 static void pnv_xive2_nxc_cache_load(PnvXive2 *xive, uint8_t watch_engine)
555 {
556     uint8_t  blk, nxc_type;
557     uint32_t idx, table_type = -1;
558     uint64_t nxc_watch[4] = { 0 };
559     int i, spec_reg, data_reg;
560 
561     assert(watch_engine < ARRAY_SIZE(nxc_watch));
562 
563     spec_reg = (PC_NXC_WATCH0_SPEC + watch_engine * 0x40) >> 3;
564     data_reg = (PC_NXC_WATCH0_DATA0 + watch_engine * 0x40) >> 3;
565     nxc_type = GETFIELD(PC_NXC_WATCH_NXC_TYPE, xive->pc_regs[spec_reg]);
566     blk = GETFIELD(PC_NXC_WATCH_BLOCK_ID, xive->pc_regs[spec_reg]);
567     idx = GETFIELD(PC_NXC_WATCH_INDEX, xive->pc_regs[spec_reg]);
568 
569     assert(!pnv_xive2_nxc_to_table_type(nxc_type, &table_type));
570 
571     if (pnv_xive2_vst_read(xive, table_type, blk, idx, nxc_watch)) {
572         xive2_error(xive, "VST: no NXC entry %x/%x in %s table!?",
573                     blk, idx, vst_infos[table_type].name);
574     }
575 
576     for (i = 0; i < ARRAY_SIZE(nxc_watch); i++) {
577         xive->pc_regs[data_reg + i] = be64_to_cpu(nxc_watch[i]);
578     }
579 }
580 
581 static int pnv_xive2_get_eas(Xive2Router *xrtr, uint8_t blk, uint32_t idx,
582                             Xive2Eas *eas)
583 {
584     PnvXive2 *xive = PNV_XIVE2(xrtr);
585 
586     if (pnv_xive2_block_id(xive) != blk) {
587         xive2_error(xive, "VST: EAS %x is remote !?", XIVE_EAS(blk, idx));
588         return -1;
589     }
590 
591     return pnv_xive2_vst_read(xive, VST_EAS, blk, idx, eas);
592 }
593 
594 static uint32_t pnv_xive2_get_config(Xive2Router *xrtr)
595 {
596     PnvXive2 *xive = PNV_XIVE2(xrtr);
597     uint32_t cfg = 0;
598 
599     if (xive->cq_regs[CQ_XIVE_CFG >> 3] & CQ_XIVE_CFG_GEN1_TIMA_OS) {
600         cfg |= XIVE2_GEN1_TIMA_OS;
601     }
602 
603     if (xive->cq_regs[CQ_XIVE_CFG >> 3] & CQ_XIVE_CFG_EN_VP_SAVE_RESTORE) {
604         cfg |= XIVE2_VP_SAVE_RESTORE;
605     }
606 
607     if (GETFIELD(CQ_XIVE_CFG_HYP_HARD_RANGE,
608               xive->cq_regs[CQ_XIVE_CFG >> 3]) == CQ_XIVE_CFG_THREADID_8BITS) {
609         cfg |= XIVE2_THREADID_8BITS;
610     }
611 
612     return cfg;
613 }
614 
615 static bool pnv_xive2_is_cpu_enabled(PnvXive2 *xive, PowerPCCPU *cpu)
616 {
617     int pir = ppc_cpu_pir(cpu);
618     uint32_t fc = PNV10_PIR2FUSEDCORE(pir);
619     uint64_t reg = fc < 8 ? TCTXT_EN0 : TCTXT_EN1;
620     uint32_t bit = pir & 0x3f;
621 
622     return xive->tctxt_regs[reg >> 3] & PPC_BIT(bit);
623 }
624 
625 static int pnv_xive2_match_nvt(XivePresenter *xptr, uint8_t format,
626                                uint8_t nvt_blk, uint32_t nvt_idx,
627                                bool cam_ignore, uint8_t priority,
628                                uint32_t logic_serv, XiveTCTXMatch *match)
629 {
630     PnvXive2 *xive = PNV_XIVE2(xptr);
631     PnvChip *chip = xive->chip;
632     int count = 0;
633     int i, j;
634     bool gen1_tima_os =
635         xive->cq_regs[CQ_XIVE_CFG >> 3] & CQ_XIVE_CFG_GEN1_TIMA_OS;
636 
637     for (i = 0; i < chip->nr_cores; i++) {
638         PnvCore *pc = chip->cores[i];
639         CPUCore *cc = CPU_CORE(pc);
640 
641         for (j = 0; j < cc->nr_threads; j++) {
642             PowerPCCPU *cpu = pc->threads[j];
643             XiveTCTX *tctx;
644             int ring;
645 
646             if (!pnv_xive2_is_cpu_enabled(xive, cpu)) {
647                 continue;
648             }
649 
650             tctx = XIVE_TCTX(pnv_cpu_state(cpu)->intc);
651 
652             if (gen1_tima_os) {
653                 ring = xive_presenter_tctx_match(xptr, tctx, format, nvt_blk,
654                                                  nvt_idx, cam_ignore,
655                                                  logic_serv);
656             } else {
657                 ring = xive2_presenter_tctx_match(xptr, tctx, format, nvt_blk,
658                                                    nvt_idx, cam_ignore,
659                                                    logic_serv);
660             }
661 
662             if (ring != -1) {
663                 /*
664                  * For VP-specific match, finding more than one is a
665                  * problem. For group notification, it's possible.
666                  */
667                 if (!cam_ignore && match->tctx) {
668                     qemu_log_mask(LOG_GUEST_ERROR, "XIVE: already found a "
669                                   "thread context NVT %x/%x\n",
670                                   nvt_blk, nvt_idx);
671                     /* Should set a FIR if we ever model it */
672                     return -1;
673                 }
674                 /*
675                  * For a group notification, we need to know if the
676                  * match is precluded first by checking the current
677                  * thread priority. If the interrupt can be delivered,
678                  * we always notify the first match (for now).
679                  */
680                 if (cam_ignore &&
681                     xive2_tm_irq_precluded(tctx, ring, priority)) {
682                         match->precluded = true;
683                 } else {
684                     if (!match->tctx) {
685                         match->ring = ring;
686                         match->tctx = tctx;
687                     }
688                     count++;
689                 }
690             }
691         }
692     }
693 
694     return count;
695 }
696 
697 static uint32_t pnv_xive2_presenter_get_config(XivePresenter *xptr)
698 {
699     PnvXive2 *xive = PNV_XIVE2(xptr);
700     uint32_t cfg = 0;
701 
702     if (xive->cq_regs[CQ_XIVE_CFG >> 3] & CQ_XIVE_CFG_GEN1_TIMA_OS) {
703         cfg |= XIVE_PRESENTER_GEN1_TIMA_OS;
704     }
705     return cfg;
706 }
707 
708 static uint8_t pnv_xive2_get_block_id(Xive2Router *xrtr)
709 {
710     return pnv_xive2_block_id(PNV_XIVE2(xrtr));
711 }
712 
713 /*
714  * The TIMA MMIO space is shared among the chips and to identify the
715  * chip from which the access is being done, we extract the chip id
716  * from the PIR.
717  */
718 static PnvXive2 *pnv_xive2_tm_get_xive(PowerPCCPU *cpu)
719 {
720     int pir = ppc_cpu_pir(cpu);
721     XivePresenter *xptr = XIVE_TCTX(pnv_cpu_state(cpu)->intc)->xptr;
722     PnvXive2 *xive = PNV_XIVE2(xptr);
723 
724     if (!pnv_xive2_is_cpu_enabled(xive, cpu)) {
725         xive2_error(xive, "IC: CPU %x is not enabled", pir);
726     }
727     return xive;
728 }
729 
730 /*
731  * The internal sources of the interrupt controller have no knowledge
732  * of the XIVE2 chip on which they reside. Encode the block id in the
733  * source interrupt number before forwarding the source event
734  * notification to the Router. This is required on a multichip system.
735  */
736 static void pnv_xive2_notify(XiveNotifier *xn, uint32_t srcno, bool pq_checked)
737 {
738     PnvXive2 *xive = PNV_XIVE2(xn);
739     uint8_t blk = pnv_xive2_block_id(xive);
740 
741     xive2_router_notify(xn, XIVE_EAS(blk, srcno), pq_checked);
742 }
743 
744 /*
745  * Set Translation Tables
746  *
747  * TODO add support for multiple sets
748  */
749 static int pnv_xive2_stt_set_data(PnvXive2 *xive, uint64_t val)
750 {
751     uint8_t tsel = GETFIELD(CQ_TAR_SELECT, xive->cq_regs[CQ_TAR >> 3]);
752     uint8_t entry = GETFIELD(CQ_TAR_ENTRY_SELECT,
753                                   xive->cq_regs[CQ_TAR >> 3]);
754 
755     switch (tsel) {
756     case CQ_TAR_NVPG:
757     case CQ_TAR_ESB:
758     case CQ_TAR_END:
759     case CQ_TAR_NVC:
760         xive->tables[tsel][entry] = val;
761         break;
762     default:
763         xive2_error(xive, "IC: unsupported table %d", tsel);
764         return -1;
765     }
766 
767     if (xive->cq_regs[CQ_TAR >> 3] & CQ_TAR_AUTOINC) {
768         xive->cq_regs[CQ_TAR >> 3] = SETFIELD(CQ_TAR_ENTRY_SELECT,
769                      xive->cq_regs[CQ_TAR >> 3], ++entry);
770     }
771 
772     return 0;
773 }
774 /*
775  * Virtual Structure Tables (VST) configuration
776  */
777 static void pnv_xive2_vst_set_exclusive(PnvXive2 *xive, uint8_t type,
778                                         uint8_t blk, uint64_t vsd)
779 {
780     Xive2EndSource *end_xsrc = &xive->end_source;
781     XiveSource *xsrc = &xive->ipi_source;
782     const XiveVstInfo *info = &vst_infos[type];
783     uint32_t page_shift = GETFIELD(VSD_TSIZE, vsd) + 12;
784     uint64_t vst_tsize = 1ull << page_shift;
785     uint64_t vst_addr = vsd & VSD_ADDRESS_MASK;
786 
787     /* Basic checks */
788 
789     if (VSD_INDIRECT & vsd) {
790         if (!pnv_xive2_vst_page_size_allowed(page_shift)) {
791             xive2_error(xive, "VST: invalid %s page shift %d", info->name,
792                        page_shift);
793             return;
794         }
795     }
796 
797     if (!QEMU_IS_ALIGNED(vst_addr, 1ull << page_shift)) {
798         xive2_error(xive, "VST: %s table address 0x%"PRIx64
799                     " is not aligned with page shift %d",
800                     info->name, vst_addr, page_shift);
801         return;
802     }
803 
804     /* Record the table configuration (in SRAM on HW) */
805     xive->vsds[type][blk] = vsd;
806 
807     /* Now tune the models with the configuration provided by the FW */
808 
809     switch (type) {
810     case VST_ESB:
811         /*
812          * Backing store pages for the source PQ bits. The model does
813          * not use these PQ bits backed in RAM because the XiveSource
814          * model has its own.
815          *
816          * If the table is direct, we can compute the number of PQ
817          * entries provisioned by FW (such as skiboot) and resize the
818          * ESB window accordingly.
819          */
820         if (memory_region_is_mapped(&xsrc->esb_mmio)) {
821             memory_region_del_subregion(&xive->esb_mmio, &xsrc->esb_mmio);
822         }
823         if (!(VSD_INDIRECT & vsd)) {
824             memory_region_set_size(&xsrc->esb_mmio, vst_tsize * SBE_PER_BYTE
825                                    * (1ull << xsrc->esb_shift));
826         }
827 
828         memory_region_add_subregion(&xive->esb_mmio, 0, &xsrc->esb_mmio);
829         break;
830 
831     case VST_EAS:  /* Nothing to be done */
832         break;
833 
834     case VST_END:
835         /*
836          * Backing store pages for the END.
837          */
838         if (memory_region_is_mapped(&end_xsrc->esb_mmio)) {
839             memory_region_del_subregion(&xive->end_mmio, &end_xsrc->esb_mmio);
840         }
841         if (!(VSD_INDIRECT & vsd)) {
842             memory_region_set_size(&end_xsrc->esb_mmio, (vst_tsize / info->size)
843                                    * (1ull << end_xsrc->esb_shift));
844         }
845         memory_region_add_subregion(&xive->end_mmio, 0, &end_xsrc->esb_mmio);
846         break;
847 
848     case VST_NVP:  /* Not modeled */
849     case VST_NVG:  /* Not modeled */
850     case VST_NVC:  /* Not modeled */
851     case VST_IC:   /* Not modeled */
852     case VST_SYNC: /* Not modeled */
853     case VST_ERQ:  /* Not modeled */
854         break;
855 
856     default:
857         g_assert_not_reached();
858     }
859 }
860 
861 /*
862  * Both PC and VC sub-engines are configured as each use the Virtual
863  * Structure Tables
864  */
865 static void pnv_xive2_vst_set_data(PnvXive2 *xive, uint64_t vsd,
866                                    uint8_t type, uint8_t blk)
867 {
868     uint8_t mode = GETFIELD(VSD_MODE, vsd);
869     uint64_t vst_addr = vsd & VSD_ADDRESS_MASK;
870 
871     if (type > VST_ERQ) {
872         xive2_error(xive, "VST: invalid table type %d", type);
873         return;
874     }
875 
876     if (blk >= vst_infos[type].max_blocks) {
877         xive2_error(xive, "VST: invalid block id %d for"
878                       " %s table", blk, vst_infos[type].name);
879         return;
880     }
881 
882     if (!vst_addr) {
883         xive2_error(xive, "VST: invalid %s table address",
884                    vst_infos[type].name);
885         return;
886     }
887 
888     switch (mode) {
889     case VSD_MODE_FORWARD:
890         xive->vsds[type][blk] = vsd;
891         break;
892 
893     case VSD_MODE_EXCLUSIVE:
894         pnv_xive2_vst_set_exclusive(xive, type, blk, vsd);
895         break;
896 
897     default:
898         xive2_error(xive, "VST: unsupported table mode %d", mode);
899         return;
900     }
901 }
902 
903 static void pnv_xive2_vc_vst_set_data(PnvXive2 *xive, uint64_t vsd)
904 {
905     uint8_t type = GETFIELD(VC_VSD_TABLE_SELECT,
906                             xive->vc_regs[VC_VSD_TABLE_ADDR >> 3]);
907     uint8_t blk = GETFIELD(VC_VSD_TABLE_ADDRESS,
908                            xive->vc_regs[VC_VSD_TABLE_ADDR >> 3]);
909 
910     pnv_xive2_vst_set_data(xive, vsd, type, blk);
911 }
912 
913 /*
914  * MMIO handlers
915  */
916 
917 
918 /*
919  * IC BAR layout
920  *
921  * Page 0: Internal CQ register accesses (reads & writes)
922  * Page 1: Internal PC register accesses (reads & writes)
923  * Page 2: Internal VC register accesses (reads & writes)
924  * Page 3: Internal TCTXT (TIMA) reg accesses (read & writes)
925  * Page 4: Notify Port page (writes only, w/data),
926  * Page 5: Reserved
927  * Page 6: Sync Poll page (writes only, dataless)
928  * Page 7: Sync Inject page (writes only, dataless)
929  * Page 8: LSI Trigger page (writes only, dataless)
930  * Page 9: LSI SB Management page (reads & writes dataless)
931  * Pages 10-255: Reserved
932  * Pages 256-383: Direct mapped Thread Context Area (reads & writes)
933  *                covering the 128 threads in P10.
934  * Pages 384-511: Reserved
935  */
936 typedef struct PnvXive2Region {
937     const char *name;
938     uint32_t pgoff;
939     uint32_t pgsize;
940     const MemoryRegionOps *ops;
941 } PnvXive2Region;
942 
943 static const MemoryRegionOps pnv_xive2_ic_cq_ops;
944 static const MemoryRegionOps pnv_xive2_ic_pc_ops;
945 static const MemoryRegionOps pnv_xive2_ic_vc_ops;
946 static const MemoryRegionOps pnv_xive2_ic_tctxt_ops;
947 static const MemoryRegionOps pnv_xive2_ic_notify_ops;
948 static const MemoryRegionOps pnv_xive2_ic_sync_ops;
949 static const MemoryRegionOps pnv_xive2_ic_lsi_ops;
950 static const MemoryRegionOps pnv_xive2_ic_tm_indirect_ops;
951 
952 /* 512 pages. 4K: 2M range, 64K: 32M range */
953 static const PnvXive2Region pnv_xive2_ic_regions[] = {
954     { "xive-ic-cq",        0,   1,   &pnv_xive2_ic_cq_ops     },
955     { "xive-ic-vc",        1,   1,   &pnv_xive2_ic_vc_ops     },
956     { "xive-ic-pc",        2,   1,   &pnv_xive2_ic_pc_ops     },
957     { "xive-ic-tctxt",     3,   1,   &pnv_xive2_ic_tctxt_ops  },
958     { "xive-ic-notify",    4,   1,   &pnv_xive2_ic_notify_ops },
959     /* page 5 reserved */
960     { "xive-ic-sync",      6,   2,   &pnv_xive2_ic_sync_ops   },
961     { "xive-ic-lsi",       8,   2,   &pnv_xive2_ic_lsi_ops    },
962     /* pages 10-255 reserved */
963     { "xive-ic-tm-indirect", 256, 128, &pnv_xive2_ic_tm_indirect_ops  },
964     /* pages 384-511 reserved */
965 };
966 
967 /*
968  * CQ operations
969  */
970 
971 static uint64_t pnv_xive2_ic_cq_read(void *opaque, hwaddr offset,
972                                         unsigned size)
973 {
974     PnvXive2 *xive = PNV_XIVE2(opaque);
975     uint32_t reg = offset >> 3;
976     uint64_t val = 0;
977 
978     switch (offset) {
979     case CQ_XIVE_CAP: /* Set at reset */
980     case CQ_XIVE_CFG:
981         val = xive->cq_regs[reg];
982         break;
983     case CQ_MSGSND: /* TODO check the #cores of the machine */
984         val = 0xffffffff00000000;
985         break;
986     case CQ_CFG_PB_GEN:
987         val = CQ_CFG_PB_GEN_PB_INIT; /* TODO: fix CQ_CFG_PB_GEN default value */
988         break;
989     default:
990         xive2_error(xive, "CQ: invalid read @%"HWADDR_PRIx, offset);
991     }
992 
993     return val;
994 }
995 
996 static uint64_t pnv_xive2_bar_size(uint64_t val)
997 {
998     return 1ull << (GETFIELD(CQ_BAR_RANGE, val) + 24);
999 }
1000 
1001 static void pnv_xive2_ic_cq_write(void *opaque, hwaddr offset,
1002                                   uint64_t val, unsigned size)
1003 {
1004     PnvXive2 *xive = PNV_XIVE2(opaque);
1005     MemoryRegion *sysmem = get_system_memory();
1006     uint32_t reg = offset >> 3;
1007     int i;
1008 
1009     switch (offset) {
1010     case CQ_XIVE_CFG:
1011     case CQ_RST_CTL: /* TODO: reset all BARs */
1012         break;
1013 
1014     case CQ_IC_BAR:
1015         xive->ic_shift = val & CQ_IC_BAR_64K ? 16 : 12;
1016         if (!(val & CQ_IC_BAR_VALID)) {
1017             xive->ic_base = 0;
1018             if (xive->cq_regs[reg] & CQ_IC_BAR_VALID) {
1019                 for (i = 0; i < ARRAY_SIZE(xive->ic_mmios); i++) {
1020                     memory_region_del_subregion(&xive->ic_mmio,
1021                                                 &xive->ic_mmios[i]);
1022                 }
1023                 memory_region_del_subregion(sysmem, &xive->ic_mmio);
1024             }
1025         } else {
1026             xive->ic_base = val & ~(CQ_IC_BAR_VALID | CQ_IC_BAR_64K);
1027             if (!(xive->cq_regs[reg] & CQ_IC_BAR_VALID)) {
1028                 for (i = 0; i < ARRAY_SIZE(xive->ic_mmios); i++) {
1029                     memory_region_add_subregion(&xive->ic_mmio,
1030                                pnv_xive2_ic_regions[i].pgoff << xive->ic_shift,
1031                                &xive->ic_mmios[i]);
1032                 }
1033                 memory_region_add_subregion(sysmem, xive->ic_base,
1034                                             &xive->ic_mmio);
1035             }
1036         }
1037         break;
1038 
1039     case CQ_TM_BAR:
1040         xive->tm_shift = val & CQ_TM_BAR_64K ? 16 : 12;
1041         if (!(val & CQ_TM_BAR_VALID)) {
1042             xive->tm_base = 0;
1043             if (xive->cq_regs[reg] & CQ_TM_BAR_VALID) {
1044                 memory_region_del_subregion(sysmem, &xive->tm_mmio);
1045             }
1046         } else {
1047             xive->tm_base = val & ~(CQ_TM_BAR_VALID | CQ_TM_BAR_64K);
1048             if (!(xive->cq_regs[reg] & CQ_TM_BAR_VALID)) {
1049                 memory_region_add_subregion(sysmem, xive->tm_base,
1050                                             &xive->tm_mmio);
1051             }
1052         }
1053         break;
1054 
1055     case CQ_ESB_BAR:
1056         xive->esb_shift = val & CQ_BAR_64K ? 16 : 12;
1057         if (!(val & CQ_BAR_VALID)) {
1058             xive->esb_base = 0;
1059             if (xive->cq_regs[reg] & CQ_BAR_VALID) {
1060                 memory_region_del_subregion(sysmem, &xive->esb_mmio);
1061             }
1062         } else {
1063             xive->esb_base = val & CQ_BAR_ADDR;
1064             if (!(xive->cq_regs[reg] & CQ_BAR_VALID)) {
1065                 memory_region_set_size(&xive->esb_mmio,
1066                                        pnv_xive2_bar_size(val));
1067                 memory_region_add_subregion(sysmem, xive->esb_base,
1068                                             &xive->esb_mmio);
1069             }
1070         }
1071         break;
1072 
1073     case CQ_END_BAR:
1074         xive->end_shift = val & CQ_BAR_64K ? 16 : 12;
1075         if (!(val & CQ_BAR_VALID)) {
1076             xive->end_base = 0;
1077             if (xive->cq_regs[reg] & CQ_BAR_VALID) {
1078                 memory_region_del_subregion(sysmem, &xive->end_mmio);
1079             }
1080         } else {
1081             xive->end_base = val & CQ_BAR_ADDR;
1082             if (!(xive->cq_regs[reg] & CQ_BAR_VALID)) {
1083                 memory_region_set_size(&xive->end_mmio,
1084                                        pnv_xive2_bar_size(val));
1085                 memory_region_add_subregion(sysmem, xive->end_base,
1086                                             &xive->end_mmio);
1087             }
1088         }
1089         break;
1090 
1091     case CQ_NVC_BAR:
1092         xive->nvc_shift = val & CQ_BAR_64K ? 16 : 12;
1093         if (!(val & CQ_BAR_VALID)) {
1094             xive->nvc_base = 0;
1095             if (xive->cq_regs[reg] & CQ_BAR_VALID) {
1096                 memory_region_del_subregion(sysmem, &xive->nvc_mmio);
1097             }
1098         } else {
1099             xive->nvc_base = val & CQ_BAR_ADDR;
1100             if (!(xive->cq_regs[reg] & CQ_BAR_VALID)) {
1101                 memory_region_set_size(&xive->nvc_mmio,
1102                                        pnv_xive2_bar_size(val));
1103                 memory_region_add_subregion(sysmem, xive->nvc_base,
1104                                             &xive->nvc_mmio);
1105             }
1106         }
1107         break;
1108 
1109     case CQ_NVPG_BAR:
1110         xive->nvpg_shift = val & CQ_BAR_64K ? 16 : 12;
1111         if (!(val & CQ_BAR_VALID)) {
1112             xive->nvpg_base = 0;
1113             if (xive->cq_regs[reg] & CQ_BAR_VALID) {
1114                 memory_region_del_subregion(sysmem, &xive->nvpg_mmio);
1115             }
1116         } else {
1117             xive->nvpg_base = val & CQ_BAR_ADDR;
1118             if (!(xive->cq_regs[reg] & CQ_BAR_VALID)) {
1119                 memory_region_set_size(&xive->nvpg_mmio,
1120                                        pnv_xive2_bar_size(val));
1121                 memory_region_add_subregion(sysmem, xive->nvpg_base,
1122                                             &xive->nvpg_mmio);
1123             }
1124         }
1125         break;
1126 
1127     case CQ_TAR: /* Set Translation Table Address */
1128         break;
1129     case CQ_TDR: /* Set Translation Table Data */
1130         pnv_xive2_stt_set_data(xive, val);
1131         break;
1132     case CQ_FIRMASK_OR: /* FIR error reporting */
1133         break;
1134     default:
1135         xive2_error(xive, "CQ: invalid write 0x%"HWADDR_PRIx, offset);
1136         return;
1137     }
1138 
1139     xive->cq_regs[reg] = val;
1140 }
1141 
1142 static const MemoryRegionOps pnv_xive2_ic_cq_ops = {
1143     .read = pnv_xive2_ic_cq_read,
1144     .write = pnv_xive2_ic_cq_write,
1145     .endianness = DEVICE_BIG_ENDIAN,
1146     .valid = {
1147         .min_access_size = 8,
1148         .max_access_size = 8,
1149     },
1150     .impl = {
1151         .min_access_size = 8,
1152         .max_access_size = 8,
1153     },
1154 };
1155 
1156 static uint8_t pnv_xive2_cache_watch_assign(uint64_t engine_mask,
1157                                             uint64_t *state)
1158 {
1159     uint8_t val = 0xFF;
1160     int i;
1161 
1162     for (i = 3; i >= 0; i--) {
1163         if (BIT(i) & engine_mask) {
1164             if (!(BIT(i) & *state)) {
1165                 *state |= BIT(i);
1166                 val = 3 - i;
1167                 break;
1168             }
1169         }
1170     }
1171     return val;
1172 }
1173 
1174 static void pnv_xive2_cache_watch_release(uint64_t *state, uint8_t watch_engine)
1175 {
1176     uint8_t engine_bit = 3 - watch_engine;
1177 
1178     if (*state & BIT(engine_bit)) {
1179         *state &= ~BIT(engine_bit);
1180     }
1181 }
1182 
1183 static uint8_t pnv_xive2_endc_cache_watch_assign(PnvXive2 *xive)
1184 {
1185     uint64_t engine_mask = GETFIELD(VC_ENDC_CFG_CACHE_WATCH_ASSIGN,
1186                                     xive->vc_regs[VC_ENDC_CFG >> 3]);
1187     uint64_t state = xive->vc_regs[VC_ENDC_WATCH_ASSIGN >> 3];
1188     uint8_t val;
1189 
1190     /*
1191      * We keep track of which engines are currently busy in the
1192      * VC_ENDC_WATCH_ASSIGN register directly. When the firmware reads
1193      * the register, we don't return its value but the ID of an engine
1194      * it can use.
1195      * There are 4 engines. 0xFF means no engine is available.
1196      */
1197     val = pnv_xive2_cache_watch_assign(engine_mask, &state);
1198     if (val != 0xFF) {
1199         xive->vc_regs[VC_ENDC_WATCH_ASSIGN >> 3] = state;
1200     }
1201     return val;
1202 }
1203 
1204 static void pnv_xive2_endc_cache_watch_release(PnvXive2 *xive,
1205                                                uint8_t watch_engine)
1206 {
1207     uint64_t state = xive->vc_regs[VC_ENDC_WATCH_ASSIGN >> 3];
1208 
1209     pnv_xive2_cache_watch_release(&state, watch_engine);
1210     xive->vc_regs[VC_ENDC_WATCH_ASSIGN >> 3] = state;
1211 }
1212 
1213 static uint64_t pnv_xive2_ic_vc_read(void *opaque, hwaddr offset,
1214                                      unsigned size)
1215 {
1216     PnvXive2 *xive = PNV_XIVE2(opaque);
1217     uint64_t val = 0;
1218     uint32_t reg = offset >> 3;
1219     uint8_t watch_engine;
1220 
1221     switch (offset) {
1222     /*
1223      * VSD table settings.
1224      */
1225     case VC_VSD_TABLE_ADDR:
1226     case VC_VSD_TABLE_DATA:
1227         val = xive->vc_regs[reg];
1228         break;
1229 
1230     /*
1231      * ESB cache updates (not modeled)
1232      */
1233     case VC_ESBC_FLUSH_CTRL:
1234         xive->vc_regs[reg] &= ~VC_ESBC_FLUSH_CTRL_POLL_VALID;
1235         val = xive->vc_regs[reg];
1236         break;
1237 
1238     case VC_ESBC_CFG:
1239         val = xive->vc_regs[reg];
1240         break;
1241 
1242     /*
1243      * EAS cache updates (not modeled)
1244      */
1245     case VC_EASC_FLUSH_CTRL:
1246         xive->vc_regs[reg] &= ~VC_EASC_FLUSH_CTRL_POLL_VALID;
1247         val = xive->vc_regs[reg];
1248         break;
1249 
1250     case VC_ENDC_WATCH_ASSIGN:
1251         val = pnv_xive2_endc_cache_watch_assign(xive);
1252         break;
1253 
1254     case VC_ENDC_CFG:
1255         val = xive->vc_regs[reg];
1256         break;
1257 
1258     /*
1259      * END cache updates
1260      */
1261     case VC_ENDC_WATCH0_SPEC:
1262     case VC_ENDC_WATCH1_SPEC:
1263     case VC_ENDC_WATCH2_SPEC:
1264     case VC_ENDC_WATCH3_SPEC:
1265         watch_engine = (offset - VC_ENDC_WATCH0_SPEC) >> 6;
1266         xive->vc_regs[reg] &= ~(VC_ENDC_WATCH_FULL | VC_ENDC_WATCH_CONFLICT);
1267         pnv_xive2_endc_cache_watch_release(xive, watch_engine);
1268         val = xive->vc_regs[reg];
1269         break;
1270 
1271     case VC_ENDC_WATCH0_DATA0:
1272     case VC_ENDC_WATCH1_DATA0:
1273     case VC_ENDC_WATCH2_DATA0:
1274     case VC_ENDC_WATCH3_DATA0:
1275         /*
1276          * Load DATA registers from cache with data requested by the
1277          * SPEC register
1278          */
1279         watch_engine = (offset - VC_ENDC_WATCH0_DATA0) >> 6;
1280         pnv_xive2_end_cache_load(xive, watch_engine);
1281         val = xive->vc_regs[reg];
1282         break;
1283 
1284     case VC_ENDC_WATCH0_DATA1 ... VC_ENDC_WATCH0_DATA3:
1285     case VC_ENDC_WATCH1_DATA1 ... VC_ENDC_WATCH1_DATA3:
1286     case VC_ENDC_WATCH2_DATA1 ... VC_ENDC_WATCH2_DATA3:
1287     case VC_ENDC_WATCH3_DATA1 ... VC_ENDC_WATCH3_DATA3:
1288         val = xive->vc_regs[reg];
1289         break;
1290 
1291     case VC_ENDC_FLUSH_CTRL:
1292         xive->vc_regs[reg] &= ~VC_ENDC_FLUSH_CTRL_POLL_VALID;
1293         val = xive->vc_regs[reg];
1294         break;
1295 
1296     /*
1297      * Indirect invalidation
1298      */
1299     case VC_AT_MACRO_KILL_MASK:
1300         val = xive->vc_regs[reg];
1301         break;
1302 
1303     case VC_AT_MACRO_KILL:
1304         xive->vc_regs[reg] &= ~VC_AT_MACRO_KILL_VALID;
1305         val = xive->vc_regs[reg];
1306         break;
1307 
1308     /*
1309      * Interrupt fifo overflow in memory backing store (Not modeled)
1310      */
1311     case VC_QUEUES_CFG_REM0 ... VC_QUEUES_CFG_REM6:
1312         val = xive->vc_regs[reg];
1313         break;
1314 
1315     /*
1316      * Synchronisation
1317      */
1318     case VC_ENDC_SYNC_DONE:
1319         val = VC_ENDC_SYNC_POLL_DONE;
1320         break;
1321     default:
1322         xive2_error(xive, "VC: invalid read @%"HWADDR_PRIx, offset);
1323     }
1324 
1325     return val;
1326 }
1327 
1328 static void pnv_xive2_ic_vc_write(void *opaque, hwaddr offset,
1329                                   uint64_t val, unsigned size)
1330 {
1331     PnvXive2 *xive = PNV_XIVE2(opaque);
1332     uint32_t reg = offset >> 3;
1333     uint8_t watch_engine;
1334 
1335     switch (offset) {
1336     /*
1337      * VSD table settings.
1338      */
1339     case VC_VSD_TABLE_ADDR:
1340        break;
1341     case VC_VSD_TABLE_DATA:
1342         pnv_xive2_vc_vst_set_data(xive, val);
1343         break;
1344 
1345     /*
1346      * ESB cache updates (not modeled)
1347      */
1348     /* case VC_ESBC_FLUSH_CTRL: */
1349     case VC_ESBC_FLUSH_POLL:
1350         xive->vc_regs[VC_ESBC_FLUSH_CTRL >> 3] |= VC_ESBC_FLUSH_CTRL_POLL_VALID;
1351         /* ESB update */
1352         break;
1353 
1354     case VC_ESBC_FLUSH_INJECT:
1355         pnv_xive2_inject_notify(xive, PNV_XIVE2_CACHE_ESBC);
1356         break;
1357 
1358     case VC_ESBC_CFG:
1359         break;
1360 
1361     /*
1362      * EAS cache updates (not modeled)
1363      */
1364     /* case VC_EASC_FLUSH_CTRL: */
1365     case VC_EASC_FLUSH_POLL:
1366         xive->vc_regs[VC_EASC_FLUSH_CTRL >> 3] |= VC_EASC_FLUSH_CTRL_POLL_VALID;
1367         /* EAS update */
1368         break;
1369 
1370     case VC_EASC_FLUSH_INJECT:
1371         pnv_xive2_inject_notify(xive, PNV_XIVE2_CACHE_EASC);
1372         break;
1373 
1374     case VC_ENDC_CFG:
1375         break;
1376 
1377     /*
1378      * END cache updates
1379      */
1380     case VC_ENDC_WATCH0_SPEC:
1381     case VC_ENDC_WATCH1_SPEC:
1382     case VC_ENDC_WATCH2_SPEC:
1383     case VC_ENDC_WATCH3_SPEC:
1384          val &= ~VC_ENDC_WATCH_CONFLICT; /* HW will set this bit */
1385         break;
1386 
1387     case VC_ENDC_WATCH0_DATA1 ... VC_ENDC_WATCH0_DATA3:
1388     case VC_ENDC_WATCH1_DATA1 ... VC_ENDC_WATCH1_DATA3:
1389     case VC_ENDC_WATCH2_DATA1 ... VC_ENDC_WATCH2_DATA3:
1390     case VC_ENDC_WATCH3_DATA1 ... VC_ENDC_WATCH3_DATA3:
1391         break;
1392     case VC_ENDC_WATCH0_DATA0:
1393     case VC_ENDC_WATCH1_DATA0:
1394     case VC_ENDC_WATCH2_DATA0:
1395     case VC_ENDC_WATCH3_DATA0:
1396         /* writing to DATA0 triggers the cache write */
1397         watch_engine = (offset - VC_ENDC_WATCH0_DATA0) >> 6;
1398         xive->vc_regs[reg] = val;
1399         pnv_xive2_end_update(xive, watch_engine);
1400         break;
1401 
1402 
1403     /* case VC_ENDC_FLUSH_CTRL: */
1404     case VC_ENDC_FLUSH_POLL:
1405         xive->vc_regs[VC_ENDC_FLUSH_CTRL >> 3] |= VC_ENDC_FLUSH_CTRL_POLL_VALID;
1406         break;
1407 
1408     case VC_ENDC_FLUSH_INJECT:
1409         pnv_xive2_inject_notify(xive, PNV_XIVE2_CACHE_ENDC);
1410         break;
1411 
1412     /*
1413      * Indirect invalidation
1414      */
1415     case VC_AT_MACRO_KILL:
1416     case VC_AT_MACRO_KILL_MASK:
1417         break;
1418 
1419     /*
1420      * Interrupt fifo overflow in memory backing store (Not modeled)
1421      */
1422     case VC_QUEUES_CFG_REM0 ... VC_QUEUES_CFG_REM6:
1423         break;
1424 
1425     /*
1426      * Synchronisation
1427      */
1428     case VC_ENDC_SYNC_DONE:
1429         break;
1430 
1431     default:
1432         xive2_error(xive, "VC: invalid write @%"HWADDR_PRIx, offset);
1433         return;
1434     }
1435 
1436     xive->vc_regs[reg] = val;
1437 }
1438 
1439 static const MemoryRegionOps pnv_xive2_ic_vc_ops = {
1440     .read = pnv_xive2_ic_vc_read,
1441     .write = pnv_xive2_ic_vc_write,
1442     .endianness = DEVICE_BIG_ENDIAN,
1443     .valid = {
1444         .min_access_size = 8,
1445         .max_access_size = 8,
1446     },
1447     .impl = {
1448         .min_access_size = 8,
1449         .max_access_size = 8,
1450     },
1451 };
1452 
1453 static uint8_t pnv_xive2_nxc_cache_watch_assign(PnvXive2 *xive)
1454 {
1455     uint64_t engine_mask = GETFIELD(PC_NXC_PROC_CONFIG_WATCH_ASSIGN,
1456                                     xive->pc_regs[PC_NXC_PROC_CONFIG >> 3]);
1457     uint64_t state = xive->pc_regs[PC_NXC_WATCH_ASSIGN >> 3];
1458     uint8_t val;
1459 
1460     /*
1461      * We keep track of which engines are currently busy in the
1462      * PC_NXC_WATCH_ASSIGN register directly. When the firmware reads
1463      * the register, we don't return its value but the ID of an engine
1464      * it can use.
1465      * There are 4 engines. 0xFF means no engine is available.
1466      */
1467     val = pnv_xive2_cache_watch_assign(engine_mask, &state);
1468     if (val != 0xFF) {
1469         xive->pc_regs[PC_NXC_WATCH_ASSIGN >> 3] = state;
1470     }
1471     return val;
1472 }
1473 
1474 static void pnv_xive2_nxc_cache_watch_release(PnvXive2 *xive,
1475                                               uint8_t watch_engine)
1476 {
1477     uint64_t state = xive->pc_regs[PC_NXC_WATCH_ASSIGN >> 3];
1478 
1479     pnv_xive2_cache_watch_release(&state, watch_engine);
1480     xive->pc_regs[PC_NXC_WATCH_ASSIGN >> 3] = state;
1481 }
1482 
1483 static uint64_t pnv_xive2_ic_pc_read(void *opaque, hwaddr offset,
1484                                      unsigned size)
1485 {
1486     PnvXive2 *xive = PNV_XIVE2(opaque);
1487     uint64_t val = -1;
1488     uint32_t reg = offset >> 3;
1489     uint8_t watch_engine;
1490 
1491     switch (offset) {
1492     /*
1493      * VSD table settings.
1494      */
1495     case PC_VSD_TABLE_ADDR:
1496     case PC_VSD_TABLE_DATA:
1497         val = xive->pc_regs[reg];
1498         break;
1499 
1500     case PC_NXC_WATCH_ASSIGN:
1501         val = pnv_xive2_nxc_cache_watch_assign(xive);
1502         break;
1503 
1504     case PC_NXC_PROC_CONFIG:
1505         val = xive->pc_regs[reg];
1506         break;
1507 
1508     /*
1509      * cache updates
1510      */
1511     case PC_NXC_WATCH0_SPEC:
1512     case PC_NXC_WATCH1_SPEC:
1513     case PC_NXC_WATCH2_SPEC:
1514     case PC_NXC_WATCH3_SPEC:
1515         watch_engine = (offset - PC_NXC_WATCH0_SPEC) >> 6;
1516         xive->pc_regs[reg] &= ~(PC_NXC_WATCH_FULL | PC_NXC_WATCH_CONFLICT);
1517         pnv_xive2_nxc_cache_watch_release(xive, watch_engine);
1518         val = xive->pc_regs[reg];
1519         break;
1520 
1521     case PC_NXC_WATCH0_DATA0:
1522     case PC_NXC_WATCH1_DATA0:
1523     case PC_NXC_WATCH2_DATA0:
1524     case PC_NXC_WATCH3_DATA0:
1525        /*
1526         * Load DATA registers from cache with data requested by the
1527         * SPEC register
1528         */
1529         watch_engine = (offset - PC_NXC_WATCH0_DATA0) >> 6;
1530         pnv_xive2_nxc_cache_load(xive, watch_engine);
1531         val = xive->pc_regs[reg];
1532         break;
1533 
1534     case PC_NXC_WATCH0_DATA1 ... PC_NXC_WATCH0_DATA3:
1535     case PC_NXC_WATCH1_DATA1 ... PC_NXC_WATCH1_DATA3:
1536     case PC_NXC_WATCH2_DATA1 ... PC_NXC_WATCH2_DATA3:
1537     case PC_NXC_WATCH3_DATA1 ... PC_NXC_WATCH3_DATA3:
1538         val = xive->pc_regs[reg];
1539         break;
1540 
1541     case PC_NXC_FLUSH_CTRL:
1542         xive->pc_regs[reg] &= ~PC_NXC_FLUSH_CTRL_POLL_VALID;
1543         val = xive->pc_regs[reg];
1544         break;
1545 
1546     /*
1547      * Indirect invalidation
1548      */
1549     case PC_AT_KILL:
1550         xive->pc_regs[reg] &= ~PC_AT_KILL_VALID;
1551         val = xive->pc_regs[reg];
1552         break;
1553 
1554     default:
1555         xive2_error(xive, "PC: invalid read @%"HWADDR_PRIx, offset);
1556     }
1557 
1558     return val;
1559 }
1560 
1561 static void pnv_xive2_pc_vst_set_data(PnvXive2 *xive, uint64_t vsd)
1562 {
1563     uint8_t type = GETFIELD(PC_VSD_TABLE_SELECT,
1564                             xive->pc_regs[PC_VSD_TABLE_ADDR >> 3]);
1565     uint8_t blk = GETFIELD(PC_VSD_TABLE_ADDRESS,
1566                            xive->pc_regs[PC_VSD_TABLE_ADDR >> 3]);
1567 
1568     pnv_xive2_vst_set_data(xive, vsd, type, blk);
1569 }
1570 
1571 static void pnv_xive2_ic_pc_write(void *opaque, hwaddr offset,
1572                                   uint64_t val, unsigned size)
1573 {
1574     PnvXive2 *xive = PNV_XIVE2(opaque);
1575     uint32_t reg = offset >> 3;
1576     uint8_t watch_engine;
1577 
1578     switch (offset) {
1579 
1580     /*
1581      * VSD table settings.
1582      * The Xive2Router model combines both VC and PC sub-engines. We
1583      * allow to configure the tables through both, for the rare cases
1584      * where a table only really needs to be configured for one of
1585      * them (e.g. the NVG table for the presenter). It assumes that
1586      * firmware passes the same address to the VC and PC when tables
1587      * are defined for both, which seems acceptable.
1588      */
1589     case PC_VSD_TABLE_ADDR:
1590         break;
1591     case PC_VSD_TABLE_DATA:
1592         pnv_xive2_pc_vst_set_data(xive, val);
1593         break;
1594 
1595     case PC_NXC_PROC_CONFIG:
1596         break;
1597 
1598     /*
1599      * cache updates
1600      */
1601     case PC_NXC_WATCH0_SPEC:
1602     case PC_NXC_WATCH1_SPEC:
1603     case PC_NXC_WATCH2_SPEC:
1604     case PC_NXC_WATCH3_SPEC:
1605         val &= ~PC_NXC_WATCH_CONFLICT; /* HW will set this bit */
1606         break;
1607 
1608     case PC_NXC_WATCH0_DATA1 ... PC_NXC_WATCH0_DATA3:
1609     case PC_NXC_WATCH1_DATA1 ... PC_NXC_WATCH1_DATA3:
1610     case PC_NXC_WATCH2_DATA1 ... PC_NXC_WATCH2_DATA3:
1611     case PC_NXC_WATCH3_DATA1 ... PC_NXC_WATCH3_DATA3:
1612         break;
1613     case PC_NXC_WATCH0_DATA0:
1614     case PC_NXC_WATCH1_DATA0:
1615     case PC_NXC_WATCH2_DATA0:
1616     case PC_NXC_WATCH3_DATA0:
1617         /* writing to DATA0 triggers the cache write */
1618         watch_engine = (offset - PC_NXC_WATCH0_DATA0) >> 6;
1619         xive->pc_regs[reg] = val;
1620         pnv_xive2_nxc_update(xive, watch_engine);
1621         break;
1622 
1623    /* case PC_NXC_FLUSH_CTRL: */
1624     case PC_NXC_FLUSH_POLL:
1625         xive->pc_regs[PC_NXC_FLUSH_CTRL >> 3] |= PC_NXC_FLUSH_CTRL_POLL_VALID;
1626         break;
1627 
1628     case PC_NXC_FLUSH_INJECT:
1629         pnv_xive2_inject_notify(xive, PNV_XIVE2_CACHE_NXC);
1630         break;
1631 
1632     /*
1633      * Indirect invalidation
1634      */
1635     case PC_AT_KILL:
1636     case PC_AT_KILL_MASK:
1637         break;
1638 
1639     default:
1640         xive2_error(xive, "PC: invalid write @%"HWADDR_PRIx, offset);
1641         return;
1642     }
1643 
1644     xive->pc_regs[reg] = val;
1645 }
1646 
1647 static const MemoryRegionOps pnv_xive2_ic_pc_ops = {
1648     .read = pnv_xive2_ic_pc_read,
1649     .write = pnv_xive2_ic_pc_write,
1650     .endianness = DEVICE_BIG_ENDIAN,
1651     .valid = {
1652         .min_access_size = 8,
1653         .max_access_size = 8,
1654     },
1655     .impl = {
1656         .min_access_size = 8,
1657         .max_access_size = 8,
1658     },
1659 };
1660 
1661 
1662 static uint64_t pnv_xive2_ic_tctxt_read(void *opaque, hwaddr offset,
1663                                         unsigned size)
1664 {
1665     PnvXive2 *xive = PNV_XIVE2(opaque);
1666     uint64_t val = -1;
1667     uint32_t reg = offset >> 3;
1668 
1669     switch (offset) {
1670     /*
1671      * XIVE2 hardware thread enablement
1672      */
1673     case TCTXT_EN0:
1674     case TCTXT_EN1:
1675         val = xive->tctxt_regs[reg];
1676         break;
1677 
1678     case TCTXT_EN0_SET:
1679     case TCTXT_EN0_RESET:
1680         val = xive->tctxt_regs[TCTXT_EN0 >> 3];
1681         break;
1682     case TCTXT_EN1_SET:
1683     case TCTXT_EN1_RESET:
1684         val = xive->tctxt_regs[TCTXT_EN1 >> 3];
1685         break;
1686     case TCTXT_CFG:
1687         val = xive->tctxt_regs[reg];
1688         break;
1689     default:
1690         xive2_error(xive, "TCTXT: invalid read @%"HWADDR_PRIx, offset);
1691     }
1692 
1693     return val;
1694 }
1695 
1696 static void pnv_xive2_ic_tctxt_write(void *opaque, hwaddr offset,
1697                                      uint64_t val, unsigned size)
1698 {
1699     PnvXive2 *xive = PNV_XIVE2(opaque);
1700     uint32_t reg = offset >> 3;
1701 
1702     switch (offset) {
1703     /*
1704      * XIVE2 hardware thread enablement
1705      */
1706     case TCTXT_EN0: /* Physical Thread Enable */
1707     case TCTXT_EN1: /* Physical Thread Enable (fused core) */
1708         xive->tctxt_regs[reg] = val;
1709         break;
1710 
1711     case TCTXT_EN0_SET:
1712         xive->tctxt_regs[TCTXT_EN0 >> 3] |= val;
1713         break;
1714     case TCTXT_EN1_SET:
1715         xive->tctxt_regs[TCTXT_EN1 >> 3] |= val;
1716         break;
1717     case TCTXT_EN0_RESET:
1718         xive->tctxt_regs[TCTXT_EN0 >> 3] &= ~val;
1719         break;
1720     case TCTXT_EN1_RESET:
1721         xive->tctxt_regs[TCTXT_EN1 >> 3] &= ~val;
1722         break;
1723     case TCTXT_CFG:
1724         xive->tctxt_regs[reg] = val;
1725         break;
1726     default:
1727         xive2_error(xive, "TCTXT: invalid write @%"HWADDR_PRIx, offset);
1728         return;
1729     }
1730 }
1731 
1732 static const MemoryRegionOps pnv_xive2_ic_tctxt_ops = {
1733     .read = pnv_xive2_ic_tctxt_read,
1734     .write = pnv_xive2_ic_tctxt_write,
1735     .endianness = DEVICE_BIG_ENDIAN,
1736     .valid = {
1737         .min_access_size = 8,
1738         .max_access_size = 8,
1739     },
1740     .impl = {
1741         .min_access_size = 8,
1742         .max_access_size = 8,
1743     },
1744 };
1745 
1746 /*
1747  * Redirect XSCOM to MMIO handlers
1748  */
1749 static uint64_t pnv_xive2_xscom_read(void *opaque, hwaddr offset,
1750                                      unsigned size)
1751 {
1752     PnvXive2 *xive = PNV_XIVE2(opaque);
1753     uint64_t val = -1;
1754     uint32_t xscom_reg = offset >> 3;
1755     uint32_t mmio_offset = (xscom_reg & 0xFF) << 3;
1756 
1757     switch (xscom_reg) {
1758     case 0x000 ... 0x0FF:
1759         val = pnv_xive2_ic_cq_read(opaque, mmio_offset, size);
1760         break;
1761     case 0x100 ... 0x1FF:
1762         val = pnv_xive2_ic_vc_read(opaque, mmio_offset, size);
1763         break;
1764     case 0x200 ... 0x2FF:
1765         val = pnv_xive2_ic_pc_read(opaque, mmio_offset, size);
1766         break;
1767     case 0x300 ... 0x3FF:
1768         val = pnv_xive2_ic_tctxt_read(opaque, mmio_offset, size);
1769         break;
1770     default:
1771         xive2_error(xive, "XSCOM: invalid read @%"HWADDR_PRIx, offset);
1772     }
1773 
1774     return val;
1775 }
1776 
1777 static void pnv_xive2_xscom_write(void *opaque, hwaddr offset,
1778                                   uint64_t val, unsigned size)
1779 {
1780     PnvXive2 *xive = PNV_XIVE2(opaque);
1781     uint32_t xscom_reg = offset >> 3;
1782     uint32_t mmio_offset = (xscom_reg & 0xFF) << 3;
1783 
1784     switch (xscom_reg) {
1785     case 0x000 ... 0x0FF:
1786         pnv_xive2_ic_cq_write(opaque, mmio_offset, val, size);
1787         break;
1788     case 0x100 ... 0x1FF:
1789         pnv_xive2_ic_vc_write(opaque, mmio_offset, val, size);
1790         break;
1791     case 0x200 ... 0x2FF:
1792         pnv_xive2_ic_pc_write(opaque, mmio_offset, val, size);
1793         break;
1794     case 0x300 ... 0x3FF:
1795         pnv_xive2_ic_tctxt_write(opaque, mmio_offset, val, size);
1796         break;
1797     default:
1798         xive2_error(xive, "XSCOM: invalid write @%"HWADDR_PRIx, offset);
1799     }
1800 }
1801 
1802 static const MemoryRegionOps pnv_xive2_xscom_ops = {
1803     .read = pnv_xive2_xscom_read,
1804     .write = pnv_xive2_xscom_write,
1805     .endianness = DEVICE_BIG_ENDIAN,
1806     .valid = {
1807         .min_access_size = 8,
1808         .max_access_size = 8,
1809     },
1810     .impl = {
1811         .min_access_size = 8,
1812         .max_access_size = 8,
1813     },
1814 };
1815 
1816 /*
1817  * Notify port page. The layout is compatible between 4K and 64K pages :
1818  *
1819  * Page 1           Notify page (writes only)
1820  *  0x000 - 0x7FF   IPI interrupt (NPU)
1821  *  0x800 - 0xFFF   HW interrupt triggers (PSI, PHB)
1822  */
1823 
1824 static void pnv_xive2_ic_hw_trigger(PnvXive2 *xive, hwaddr addr,
1825                                     uint64_t val)
1826 {
1827     uint8_t blk;
1828     uint32_t idx;
1829 
1830     if (val & XIVE_TRIGGER_END) {
1831         xive2_error(xive, "IC: END trigger at @0x%"HWADDR_PRIx" data 0x%"PRIx64,
1832                    addr, val);
1833         return;
1834     }
1835 
1836     /*
1837      * Forward the source event notification directly to the Router.
1838      * The source interrupt number should already be correctly encoded
1839      * with the chip block id by the sending device (PHB, PSI).
1840      */
1841     blk = XIVE_EAS_BLOCK(val);
1842     idx = XIVE_EAS_INDEX(val);
1843 
1844     xive2_router_notify(XIVE_NOTIFIER(xive), XIVE_EAS(blk, idx),
1845                          !!(val & XIVE_TRIGGER_PQ));
1846 }
1847 
1848 static void pnv_xive2_ic_notify_write(void *opaque, hwaddr offset,
1849                                       uint64_t val, unsigned size)
1850 {
1851     PnvXive2 *xive = PNV_XIVE2(opaque);
1852 
1853     /* VC: IPI triggers */
1854     switch (offset) {
1855     case 0x000 ... 0x7FF:
1856         /* TODO: check IPI notify sub-page routing */
1857         pnv_xive2_ic_hw_trigger(opaque, offset, val);
1858         break;
1859 
1860     /* VC: HW triggers */
1861     case 0x800 ... 0xFFF:
1862         pnv_xive2_ic_hw_trigger(opaque, offset, val);
1863         break;
1864 
1865     default:
1866         xive2_error(xive, "NOTIFY: invalid write @%"HWADDR_PRIx, offset);
1867     }
1868 }
1869 
1870 static uint64_t pnv_xive2_ic_notify_read(void *opaque, hwaddr offset,
1871                                          unsigned size)
1872 {
1873     PnvXive2 *xive = PNV_XIVE2(opaque);
1874 
1875    /* loads are invalid */
1876     xive2_error(xive, "NOTIFY: invalid read @%"HWADDR_PRIx, offset);
1877     return -1;
1878 }
1879 
1880 static const MemoryRegionOps pnv_xive2_ic_notify_ops = {
1881     .read = pnv_xive2_ic_notify_read,
1882     .write = pnv_xive2_ic_notify_write,
1883     .endianness = DEVICE_BIG_ENDIAN,
1884     .valid = {
1885         .min_access_size = 8,
1886         .max_access_size = 8,
1887     },
1888     .impl = {
1889         .min_access_size = 8,
1890         .max_access_size = 8,
1891     },
1892 };
1893 
1894 static uint64_t pnv_xive2_ic_lsi_read(void *opaque, hwaddr offset,
1895                                       unsigned size)
1896 {
1897     PnvXive2 *xive = PNV_XIVE2(opaque);
1898 
1899     xive2_error(xive, "LSI: invalid read @%"HWADDR_PRIx, offset);
1900     return -1;
1901 }
1902 
1903 static void pnv_xive2_ic_lsi_write(void *opaque, hwaddr offset,
1904                                    uint64_t val, unsigned size)
1905 {
1906     PnvXive2 *xive = PNV_XIVE2(opaque);
1907 
1908     xive2_error(xive, "LSI: invalid write @%"HWADDR_PRIx, offset);
1909 }
1910 
1911 static const MemoryRegionOps pnv_xive2_ic_lsi_ops = {
1912     .read = pnv_xive2_ic_lsi_read,
1913     .write = pnv_xive2_ic_lsi_write,
1914     .endianness = DEVICE_BIG_ENDIAN,
1915     .valid = {
1916         .min_access_size = 8,
1917         .max_access_size = 8,
1918     },
1919     .impl = {
1920         .min_access_size = 8,
1921         .max_access_size = 8,
1922     },
1923 };
1924 
1925 /*
1926  * Sync MMIO page (write only)
1927  */
1928 #define PNV_XIVE2_SYNC_IPI              0x000
1929 #define PNV_XIVE2_SYNC_HW               0x080
1930 #define PNV_XIVE2_SYNC_NxC              0x100
1931 #define PNV_XIVE2_SYNC_INT              0x180
1932 #define PNV_XIVE2_SYNC_OS_ESC           0x200
1933 #define PNV_XIVE2_SYNC_POOL_ESC         0x280
1934 #define PNV_XIVE2_SYNC_HARD_ESC         0x300
1935 #define PNV_XIVE2_SYNC_NXC_LD_LCL_NCO   0x800
1936 #define PNV_XIVE2_SYNC_NXC_LD_LCL_CO    0x880
1937 #define PNV_XIVE2_SYNC_NXC_ST_LCL_NCI   0x900
1938 #define PNV_XIVE2_SYNC_NXC_ST_LCL_CI    0x980
1939 #define PNV_XIVE2_SYNC_NXC_ST_RMT_NCI   0xA00
1940 #define PNV_XIVE2_SYNC_NXC_ST_RMT_CI    0xA80
1941 
1942 static uint64_t pnv_xive2_ic_sync_read(void *opaque, hwaddr offset,
1943                                        unsigned size)
1944 {
1945     PnvXive2 *xive = PNV_XIVE2(opaque);
1946 
1947     /* loads are invalid */
1948     xive2_error(xive, "SYNC: invalid read @%"HWADDR_PRIx, offset);
1949     return -1;
1950 }
1951 
1952 /*
1953  * The sync MMIO space spans two pages.  The lower page is use for
1954  * queue sync "poll" requests while the upper page is used for queue
1955  * sync "inject" requests.  Inject requests require the HW to write
1956  * a byte of all 1's to a predetermined location in memory in order
1957  * to signal completion of the request.  Both pages have the same
1958  * layout, so it is easiest to handle both with a single function.
1959  */
1960 static void pnv_xive2_ic_sync_write(void *opaque, hwaddr offset,
1961                                     uint64_t val, unsigned size)
1962 {
1963     PnvXive2 *xive = PNV_XIVE2(opaque);
1964     int inject_type;
1965     hwaddr pg_offset_mask = (1ull << xive->ic_shift) - 1;
1966 
1967     /* adjust offset for inject page */
1968     hwaddr adj_offset = offset & pg_offset_mask;
1969 
1970     switch (adj_offset) {
1971     case PNV_XIVE2_SYNC_IPI:
1972         inject_type = PNV_XIVE2_QUEUE_IPI;
1973         break;
1974     case PNV_XIVE2_SYNC_HW:
1975         inject_type = PNV_XIVE2_QUEUE_HW;
1976         break;
1977     case PNV_XIVE2_SYNC_NxC:
1978         inject_type = PNV_XIVE2_QUEUE_NXC;
1979         break;
1980     case PNV_XIVE2_SYNC_INT:
1981         inject_type = PNV_XIVE2_QUEUE_INT;
1982         break;
1983     case PNV_XIVE2_SYNC_OS_ESC:
1984         inject_type = PNV_XIVE2_QUEUE_OS;
1985         break;
1986     case PNV_XIVE2_SYNC_POOL_ESC:
1987         inject_type = PNV_XIVE2_QUEUE_POOL;
1988         break;
1989     case PNV_XIVE2_SYNC_HARD_ESC:
1990         inject_type = PNV_XIVE2_QUEUE_HARD;
1991         break;
1992     case PNV_XIVE2_SYNC_NXC_LD_LCL_NCO:
1993         inject_type = PNV_XIVE2_QUEUE_NXC_LD_LCL_NCO;
1994         break;
1995     case PNV_XIVE2_SYNC_NXC_LD_LCL_CO:
1996         inject_type = PNV_XIVE2_QUEUE_NXC_LD_LCL_CO;
1997         break;
1998     case PNV_XIVE2_SYNC_NXC_ST_LCL_NCI:
1999         inject_type = PNV_XIVE2_QUEUE_NXC_ST_LCL_NCI;
2000         break;
2001     case PNV_XIVE2_SYNC_NXC_ST_LCL_CI:
2002         inject_type = PNV_XIVE2_QUEUE_NXC_ST_LCL_CI;
2003         break;
2004     case PNV_XIVE2_SYNC_NXC_ST_RMT_NCI:
2005         inject_type = PNV_XIVE2_QUEUE_NXC_ST_RMT_NCI;
2006         break;
2007     case PNV_XIVE2_SYNC_NXC_ST_RMT_CI:
2008         inject_type = PNV_XIVE2_QUEUE_NXC_ST_RMT_CI;
2009         break;
2010     default:
2011         xive2_error(xive, "SYNC: invalid write @%"HWADDR_PRIx, offset);
2012         return;
2013     }
2014 
2015     /* Write Queue Sync notification byte if writing to sync inject page */
2016     if ((offset & ~pg_offset_mask) != 0) {
2017         pnv_xive2_inject_notify(xive, inject_type);
2018     }
2019 }
2020 
2021 static const MemoryRegionOps pnv_xive2_ic_sync_ops = {
2022     .read = pnv_xive2_ic_sync_read,
2023     .write = pnv_xive2_ic_sync_write,
2024     .endianness = DEVICE_BIG_ENDIAN,
2025     .valid = {
2026         .min_access_size = 8,
2027         .max_access_size = 8,
2028     },
2029     .impl = {
2030         .min_access_size = 8,
2031         .max_access_size = 8,
2032     },
2033 };
2034 
2035 /*
2036  * When the TM direct pages of the IC controller are accessed, the
2037  * target HW thread is deduced from the page offset.
2038  */
2039 static uint32_t pnv_xive2_ic_tm_get_pir(PnvXive2 *xive, hwaddr offset)
2040 {
2041     /* On P10, the node ID shift in the PIR register is 8 bits */
2042     return xive->chip->chip_id << 8 | offset >> xive->ic_shift;
2043 }
2044 
2045 static uint32_t pnv_xive2_ic_tm_get_hw_page_offset(PnvXive2 *xive,
2046                                                    hwaddr offset)
2047 {
2048     /*
2049      * Indirect TIMA accesses are similar to direct accesses for
2050      * privilege ring 0. So remove any traces of the hw thread ID from
2051      * the offset in the IC BAR as it could be interpreted as the ring
2052      * privilege when calling the underlying direct access functions.
2053      */
2054     return offset & ((1ull << xive->ic_shift) - 1);
2055 }
2056 
2057 static XiveTCTX *pnv_xive2_get_indirect_tctx(PnvXive2 *xive, uint32_t pir)
2058 {
2059     PnvChip *chip = xive->chip;
2060     PowerPCCPU *cpu = NULL;
2061 
2062     cpu = pnv_chip_find_cpu(chip, pir);
2063     if (!cpu) {
2064         xive2_error(xive, "IC: invalid PIR %x for indirect access", pir);
2065         return NULL;
2066     }
2067 
2068     if (!pnv_xive2_is_cpu_enabled(xive, cpu)) {
2069         xive2_error(xive, "IC: CPU %x is not enabled", pir);
2070     }
2071 
2072     return XIVE_TCTX(pnv_cpu_state(cpu)->intc);
2073 }
2074 
2075 static uint64_t pnv_xive2_ic_tm_indirect_read(void *opaque, hwaddr offset,
2076                                               unsigned size)
2077 {
2078     PnvXive2 *xive = PNV_XIVE2(opaque);
2079     XivePresenter *xptr = XIVE_PRESENTER(xive);
2080     hwaddr hw_page_offset;
2081     uint32_t pir;
2082     XiveTCTX *tctx;
2083     uint64_t val = -1;
2084 
2085     pir = pnv_xive2_ic_tm_get_pir(xive, offset);
2086     hw_page_offset = pnv_xive2_ic_tm_get_hw_page_offset(xive, offset);
2087     tctx = pnv_xive2_get_indirect_tctx(xive, pir);
2088     if (tctx) {
2089         val = xive_tctx_tm_read(xptr, tctx, hw_page_offset, size);
2090     }
2091 
2092     return val;
2093 }
2094 
2095 static void pnv_xive2_ic_tm_indirect_write(void *opaque, hwaddr offset,
2096                                            uint64_t val, unsigned size)
2097 {
2098     PnvXive2 *xive = PNV_XIVE2(opaque);
2099     XivePresenter *xptr = XIVE_PRESENTER(xive);
2100     hwaddr hw_page_offset;
2101     uint32_t pir;
2102     XiveTCTX *tctx;
2103 
2104     pir = pnv_xive2_ic_tm_get_pir(xive, offset);
2105     hw_page_offset = pnv_xive2_ic_tm_get_hw_page_offset(xive, offset);
2106     tctx = pnv_xive2_get_indirect_tctx(xive, pir);
2107     if (tctx) {
2108         xive_tctx_tm_write(xptr, tctx, hw_page_offset, val, size);
2109     }
2110 }
2111 
2112 static const MemoryRegionOps pnv_xive2_ic_tm_indirect_ops = {
2113     .read = pnv_xive2_ic_tm_indirect_read,
2114     .write = pnv_xive2_ic_tm_indirect_write,
2115     .endianness = DEVICE_BIG_ENDIAN,
2116     .valid = {
2117         .min_access_size = 1,
2118         .max_access_size = 8,
2119     },
2120     .impl = {
2121         .min_access_size = 1,
2122         .max_access_size = 8,
2123     },
2124 };
2125 
2126 /*
2127  * TIMA ops
2128  */
2129 static void pnv_xive2_tm_write(void *opaque, hwaddr offset,
2130                                uint64_t value, unsigned size)
2131 {
2132     PowerPCCPU *cpu = POWERPC_CPU(current_cpu);
2133     PnvXive2 *xive = pnv_xive2_tm_get_xive(cpu);
2134     XiveTCTX *tctx = XIVE_TCTX(pnv_cpu_state(cpu)->intc);
2135     XivePresenter *xptr = XIVE_PRESENTER(xive);
2136 
2137     xive_tctx_tm_write(xptr, tctx, offset, value, size);
2138 }
2139 
2140 static uint64_t pnv_xive2_tm_read(void *opaque, hwaddr offset, unsigned size)
2141 {
2142     PowerPCCPU *cpu = POWERPC_CPU(current_cpu);
2143     PnvXive2 *xive = pnv_xive2_tm_get_xive(cpu);
2144     XiveTCTX *tctx = XIVE_TCTX(pnv_cpu_state(cpu)->intc);
2145     XivePresenter *xptr = XIVE_PRESENTER(xive);
2146 
2147     return xive_tctx_tm_read(xptr, tctx, offset, size);
2148 }
2149 
2150 static const MemoryRegionOps pnv_xive2_tm_ops = {
2151     .read = pnv_xive2_tm_read,
2152     .write = pnv_xive2_tm_write,
2153     .endianness = DEVICE_BIG_ENDIAN,
2154     .valid = {
2155         .min_access_size = 1,
2156         .max_access_size = 8,
2157     },
2158     .impl = {
2159         .min_access_size = 1,
2160         .max_access_size = 8,
2161     },
2162 };
2163 
2164 static uint64_t pnv_xive2_nvc_read(void *opaque, hwaddr offset,
2165                                    unsigned size)
2166 {
2167     PnvXive2 *xive = PNV_XIVE2(opaque);
2168 
2169     xive2_error(xive, "NVC: invalid read @%"HWADDR_PRIx, offset);
2170     return -1;
2171 }
2172 
2173 static void pnv_xive2_nvc_write(void *opaque, hwaddr offset,
2174                                 uint64_t val, unsigned size)
2175 {
2176     PnvXive2 *xive = PNV_XIVE2(opaque);
2177 
2178     xive2_error(xive, "NVC: invalid write @%"HWADDR_PRIx, offset);
2179 }
2180 
2181 static const MemoryRegionOps pnv_xive2_nvc_ops = {
2182     .read = pnv_xive2_nvc_read,
2183     .write = pnv_xive2_nvc_write,
2184     .endianness = DEVICE_BIG_ENDIAN,
2185     .valid = {
2186         .min_access_size = 8,
2187         .max_access_size = 8,
2188     },
2189     .impl = {
2190         .min_access_size = 8,
2191         .max_access_size = 8,
2192     },
2193 };
2194 
2195 static uint64_t pnv_xive2_nvpg_read(void *opaque, hwaddr offset,
2196                                     unsigned size)
2197 {
2198     PnvXive2 *xive = PNV_XIVE2(opaque);
2199 
2200     xive2_error(xive, "NVPG: invalid read @%"HWADDR_PRIx, offset);
2201     return -1;
2202 }
2203 
2204 static void pnv_xive2_nvpg_write(void *opaque, hwaddr offset,
2205                                  uint64_t val, unsigned size)
2206 {
2207     PnvXive2 *xive = PNV_XIVE2(opaque);
2208 
2209     xive2_error(xive, "NVPG: invalid write @%"HWADDR_PRIx, offset);
2210 }
2211 
2212 static const MemoryRegionOps pnv_xive2_nvpg_ops = {
2213     .read = pnv_xive2_nvpg_read,
2214     .write = pnv_xive2_nvpg_write,
2215     .endianness = DEVICE_BIG_ENDIAN,
2216     .valid = {
2217         .min_access_size = 8,
2218         .max_access_size = 8,
2219     },
2220     .impl = {
2221         .min_access_size = 8,
2222         .max_access_size = 8,
2223     },
2224 };
2225 
2226 /*
2227  * POWER10 default capabilities: 0x2000120076f000FC
2228  */
2229 #define PNV_XIVE2_CAPABILITIES  0x2000120076f000FC
2230 
2231 /*
2232  * POWER10 default configuration: 0x0030000033000000
2233  *
2234  * 8bits thread id was dropped for P10
2235  */
2236 #define PNV_XIVE2_CONFIGURATION 0x0030000033000000
2237 
2238 static void pnv_xive2_reset(void *dev)
2239 {
2240     PnvXive2 *xive = PNV_XIVE2(dev);
2241     XiveSource *xsrc = &xive->ipi_source;
2242     Xive2EndSource *end_xsrc = &xive->end_source;
2243 
2244     xive->cq_regs[CQ_XIVE_CAP >> 3] = xive->capabilities;
2245     xive->cq_regs[CQ_XIVE_CFG >> 3] = xive->config;
2246 
2247     /* HW hardwires the #Topology of the chip in the block field */
2248     xive->cq_regs[CQ_XIVE_CFG >> 3] |=
2249         SETFIELD(CQ_XIVE_CFG_HYP_HARD_BLOCK_ID, 0ull, xive->chip->chip_id);
2250 
2251     /* VC and PC cache watch assign mechanism */
2252     xive->vc_regs[VC_ENDC_CFG >> 3] =
2253         SETFIELD(VC_ENDC_CFG_CACHE_WATCH_ASSIGN, 0ull, 0b0111);
2254     xive->pc_regs[PC_NXC_PROC_CONFIG >> 3] =
2255         SETFIELD(PC_NXC_PROC_CONFIG_WATCH_ASSIGN, 0ull, 0b0111);
2256 
2257     /* Set default page size to 64k */
2258     xive->ic_shift = xive->esb_shift = xive->end_shift = 16;
2259     xive->nvc_shift = xive->nvpg_shift = xive->tm_shift = 16;
2260 
2261     /* Clear source MMIOs */
2262     if (memory_region_is_mapped(&xsrc->esb_mmio)) {
2263         memory_region_del_subregion(&xive->esb_mmio, &xsrc->esb_mmio);
2264     }
2265 
2266     if (memory_region_is_mapped(&end_xsrc->esb_mmio)) {
2267         memory_region_del_subregion(&xive->end_mmio, &end_xsrc->esb_mmio);
2268     }
2269 }
2270 
2271 /*
2272  *  Maximum number of IRQs and ENDs supported by HW. Will be tuned by
2273  *  software.
2274  */
2275 #define PNV_XIVE2_NR_IRQS (PNV10_XIVE2_ESB_SIZE / (1ull << XIVE_ESB_64K_2PAGE))
2276 #define PNV_XIVE2_NR_ENDS (PNV10_XIVE2_END_SIZE / (1ull << XIVE_ESB_64K_2PAGE))
2277 
2278 static void pnv_xive2_realize(DeviceState *dev, Error **errp)
2279 {
2280     PnvXive2 *xive = PNV_XIVE2(dev);
2281     PnvXive2Class *pxc = PNV_XIVE2_GET_CLASS(dev);
2282     XiveSource *xsrc = &xive->ipi_source;
2283     Xive2EndSource *end_xsrc = &xive->end_source;
2284     Error *local_err = NULL;
2285     int i;
2286 
2287     pxc->parent_realize(dev, &local_err);
2288     if (local_err) {
2289         error_propagate(errp, local_err);
2290         return;
2291     }
2292 
2293     assert(xive->chip);
2294 
2295     /*
2296      * The XiveSource and Xive2EndSource objects are realized with the
2297      * maximum allowed HW configuration. The ESB MMIO regions will be
2298      * resized dynamically when the controller is configured by the FW
2299      * to limit accesses to resources not provisioned.
2300      */
2301     object_property_set_int(OBJECT(xsrc), "flags", XIVE_SRC_STORE_EOI,
2302                             &error_fatal);
2303     object_property_set_int(OBJECT(xsrc), "nr-irqs", PNV_XIVE2_NR_IRQS,
2304                             &error_fatal);
2305     object_property_set_link(OBJECT(xsrc), "xive", OBJECT(xive),
2306                              &error_fatal);
2307     qdev_realize(DEVICE(xsrc), NULL, &local_err);
2308     if (local_err) {
2309         error_propagate(errp, local_err);
2310         return;
2311     }
2312 
2313     object_property_set_int(OBJECT(end_xsrc), "nr-ends", PNV_XIVE2_NR_ENDS,
2314                             &error_fatal);
2315     object_property_set_link(OBJECT(end_xsrc), "xive", OBJECT(xive),
2316                              &error_abort);
2317     qdev_realize(DEVICE(end_xsrc), NULL, &local_err);
2318     if (local_err) {
2319         error_propagate(errp, local_err);
2320         return;
2321     }
2322 
2323     /* XSCOM region, used for initial configuration of the BARs */
2324     memory_region_init_io(&xive->xscom_regs, OBJECT(dev),
2325                           &pnv_xive2_xscom_ops, xive, "xscom-xive",
2326                           PNV10_XSCOM_XIVE2_SIZE << 3);
2327 
2328     /* Interrupt controller MMIO regions */
2329     xive->ic_shift = 16;
2330     memory_region_init(&xive->ic_mmio, OBJECT(dev), "xive-ic",
2331                        PNV10_XIVE2_IC_SIZE);
2332 
2333     for (i = 0; i < ARRAY_SIZE(xive->ic_mmios); i++) {
2334         memory_region_init_io(&xive->ic_mmios[i], OBJECT(dev),
2335                          pnv_xive2_ic_regions[i].ops, xive,
2336                          pnv_xive2_ic_regions[i].name,
2337                          pnv_xive2_ic_regions[i].pgsize << xive->ic_shift);
2338     }
2339 
2340     /*
2341      * VC MMIO regions.
2342      */
2343     xive->esb_shift = 16;
2344     xive->end_shift = 16;
2345     memory_region_init(&xive->esb_mmio, OBJECT(xive), "xive-esb",
2346                        PNV10_XIVE2_ESB_SIZE);
2347     memory_region_init(&xive->end_mmio, OBJECT(xive), "xive-end",
2348                        PNV10_XIVE2_END_SIZE);
2349 
2350     /* Presenter Controller MMIO region (not modeled) */
2351     xive->nvc_shift = 16;
2352     xive->nvpg_shift = 16;
2353     memory_region_init_io(&xive->nvc_mmio, OBJECT(dev),
2354                           &pnv_xive2_nvc_ops, xive,
2355                           "xive-nvc", PNV10_XIVE2_NVC_SIZE);
2356 
2357     memory_region_init_io(&xive->nvpg_mmio, OBJECT(dev),
2358                           &pnv_xive2_nvpg_ops, xive,
2359                           "xive-nvpg", PNV10_XIVE2_NVPG_SIZE);
2360 
2361     /* Thread Interrupt Management Area (Direct) */
2362     xive->tm_shift = 16;
2363     memory_region_init_io(&xive->tm_mmio, OBJECT(dev), &pnv_xive2_tm_ops,
2364                           xive, "xive-tima", PNV10_XIVE2_TM_SIZE);
2365 
2366     qemu_register_reset(pnv_xive2_reset, dev);
2367 }
2368 
2369 static const Property pnv_xive2_properties[] = {
2370     DEFINE_PROP_UINT64("ic-bar", PnvXive2, ic_base, 0),
2371     DEFINE_PROP_UINT64("esb-bar", PnvXive2, esb_base, 0),
2372     DEFINE_PROP_UINT64("end-bar", PnvXive2, end_base, 0),
2373     DEFINE_PROP_UINT64("nvc-bar", PnvXive2, nvc_base, 0),
2374     DEFINE_PROP_UINT64("nvpg-bar", PnvXive2, nvpg_base, 0),
2375     DEFINE_PROP_UINT64("tm-bar", PnvXive2, tm_base, 0),
2376     DEFINE_PROP_UINT64("capabilities", PnvXive2, capabilities,
2377                        PNV_XIVE2_CAPABILITIES),
2378     DEFINE_PROP_UINT64("config", PnvXive2, config,
2379                        PNV_XIVE2_CONFIGURATION),
2380     DEFINE_PROP_LINK("chip", PnvXive2, chip, TYPE_PNV_CHIP, PnvChip *),
2381 };
2382 
2383 static void pnv_xive2_instance_init(Object *obj)
2384 {
2385     PnvXive2 *xive = PNV_XIVE2(obj);
2386 
2387     object_initialize_child(obj, "ipi_source", &xive->ipi_source,
2388                             TYPE_XIVE_SOURCE);
2389     object_initialize_child(obj, "end_source", &xive->end_source,
2390                             TYPE_XIVE2_END_SOURCE);
2391 }
2392 
2393 static int pnv_xive2_dt_xscom(PnvXScomInterface *dev, void *fdt,
2394                               int xscom_offset)
2395 {
2396     const char compat_p10[] = "ibm,power10-xive-x";
2397     char *name;
2398     int offset;
2399     uint32_t reg[] = {
2400         cpu_to_be32(PNV10_XSCOM_XIVE2_BASE),
2401         cpu_to_be32(PNV10_XSCOM_XIVE2_SIZE)
2402     };
2403 
2404     name = g_strdup_printf("xive@%x", PNV10_XSCOM_XIVE2_BASE);
2405     offset = fdt_add_subnode(fdt, xscom_offset, name);
2406     _FDT(offset);
2407     g_free(name);
2408 
2409     _FDT((fdt_setprop(fdt, offset, "reg", reg, sizeof(reg))));
2410     _FDT(fdt_setprop(fdt, offset, "compatible", compat_p10,
2411                      sizeof(compat_p10)));
2412     return 0;
2413 }
2414 
2415 static void pnv_xive2_class_init(ObjectClass *klass, void *data)
2416 {
2417     DeviceClass *dc = DEVICE_CLASS(klass);
2418     PnvXScomInterfaceClass *xdc = PNV_XSCOM_INTERFACE_CLASS(klass);
2419     Xive2RouterClass *xrc = XIVE2_ROUTER_CLASS(klass);
2420     XiveNotifierClass *xnc = XIVE_NOTIFIER_CLASS(klass);
2421     XivePresenterClass *xpc = XIVE_PRESENTER_CLASS(klass);
2422     PnvXive2Class *pxc = PNV_XIVE2_CLASS(klass);
2423 
2424     xdc->dt_xscom  = pnv_xive2_dt_xscom;
2425 
2426     dc->desc       = "PowerNV XIVE2 Interrupt Controller (POWER10)";
2427     device_class_set_parent_realize(dc, pnv_xive2_realize,
2428                                     &pxc->parent_realize);
2429     device_class_set_props(dc, pnv_xive2_properties);
2430 
2431     xrc->get_eas   = pnv_xive2_get_eas;
2432     xrc->get_pq    = pnv_xive2_get_pq;
2433     xrc->set_pq    = pnv_xive2_set_pq;
2434     xrc->get_end   = pnv_xive2_get_end;
2435     xrc->write_end = pnv_xive2_write_end;
2436     xrc->get_nvp   = pnv_xive2_get_nvp;
2437     xrc->write_nvp = pnv_xive2_write_nvp;
2438     xrc->get_nvgc   = pnv_xive2_get_nvgc;
2439     xrc->write_nvgc = pnv_xive2_write_nvgc;
2440     xrc->get_config  = pnv_xive2_get_config;
2441     xrc->get_block_id = pnv_xive2_get_block_id;
2442 
2443     xnc->notify    = pnv_xive2_notify;
2444 
2445     xpc->match_nvt  = pnv_xive2_match_nvt;
2446     xpc->get_config = pnv_xive2_presenter_get_config;
2447 };
2448 
2449 static const TypeInfo pnv_xive2_info = {
2450     .name          = TYPE_PNV_XIVE2,
2451     .parent        = TYPE_XIVE2_ROUTER,
2452     .instance_init = pnv_xive2_instance_init,
2453     .instance_size = sizeof(PnvXive2),
2454     .class_init    = pnv_xive2_class_init,
2455     .class_size    = sizeof(PnvXive2Class),
2456     .interfaces    = (InterfaceInfo[]) {
2457         { TYPE_PNV_XSCOM_INTERFACE },
2458         { }
2459     }
2460 };
2461 
2462 static void pnv_xive2_register_types(void)
2463 {
2464     type_register_static(&pnv_xive2_info);
2465 }
2466 
2467 type_init(pnv_xive2_register_types)
2468 
2469 /*
2470  * If the table is direct, we can compute the number of PQ entries
2471  * provisioned by FW.
2472  */
2473 static uint32_t pnv_xive2_nr_esbs(PnvXive2 *xive)
2474 {
2475     uint8_t blk = pnv_xive2_block_id(xive);
2476     uint64_t vsd = xive->vsds[VST_ESB][blk];
2477     uint64_t vst_tsize = 1ull << (GETFIELD(VSD_TSIZE, vsd) + 12);
2478 
2479     return VSD_INDIRECT & vsd ? 0 : vst_tsize * SBE_PER_BYTE;
2480 }
2481 
2482 /*
2483  * Compute the number of entries per indirect subpage.
2484  */
2485 static uint64_t pnv_xive2_vst_per_subpage(PnvXive2 *xive, uint32_t type)
2486 {
2487     uint8_t blk = pnv_xive2_block_id(xive);
2488     uint64_t vsd = xive->vsds[type][blk];
2489     const XiveVstInfo *info = &vst_infos[type];
2490     uint64_t vsd_addr;
2491     uint32_t page_shift;
2492 
2493     /* For direct tables, fake a valid value */
2494     if (!(VSD_INDIRECT & vsd)) {
2495         return 1;
2496     }
2497 
2498     /* Get the page size of the indirect table. */
2499     vsd_addr = vsd & VSD_ADDRESS_MASK;
2500     ldq_be_dma(&address_space_memory, vsd_addr, &vsd, MEMTXATTRS_UNSPECIFIED);
2501 
2502     if (!(vsd & VSD_ADDRESS_MASK)) {
2503 #ifdef XIVE2_DEBUG
2504         xive2_error(xive, "VST: invalid %s entry!?", info->name);
2505 #endif
2506         return 0;
2507     }
2508 
2509     page_shift = GETFIELD(VSD_TSIZE, vsd) + 12;
2510 
2511     if (!pnv_xive2_vst_page_size_allowed(page_shift)) {
2512         xive2_error(xive, "VST: invalid %s page shift %d", info->name,
2513                    page_shift);
2514         return 0;
2515     }
2516 
2517     return (1ull << page_shift) / info->size;
2518 }
2519 
2520 void pnv_xive2_pic_print_info(PnvXive2 *xive, GString *buf)
2521 {
2522     Xive2Router *xrtr = XIVE2_ROUTER(xive);
2523     uint8_t blk = pnv_xive2_block_id(xive);
2524     uint8_t chip_id = xive->chip->chip_id;
2525     uint32_t srcno0 = XIVE_EAS(blk, 0);
2526     uint32_t nr_esbs = pnv_xive2_nr_esbs(xive);
2527     Xive2Eas eas;
2528     Xive2End end;
2529     Xive2Nvp nvp;
2530     Xive2Nvgc nvgc;
2531     int i;
2532     uint64_t entries_per_subpage;
2533 
2534     g_string_append_printf(buf, "XIVE[%x] Source %08x .. %08x\n",
2535                            blk, srcno0, srcno0 + nr_esbs - 1);
2536     xive_source_pic_print_info(&xive->ipi_source, srcno0, buf);
2537 
2538     g_string_append_printf(buf, "XIVE[%x] EAT %08x .. %08x\n",
2539                            blk, srcno0, srcno0 + nr_esbs - 1);
2540     for (i = 0; i < nr_esbs; i++) {
2541         if (xive2_router_get_eas(xrtr, blk, i, &eas)) {
2542             break;
2543         }
2544         if (!xive2_eas_is_masked(&eas)) {
2545             xive2_eas_pic_print_info(&eas, i, buf);
2546         }
2547     }
2548 
2549     g_string_append_printf(buf, "XIVE[%x] #%d END Escalation EAT\n",
2550                            chip_id, blk);
2551     i = 0;
2552     while (!xive2_router_get_end(xrtr, blk, i, &end)) {
2553         xive2_end_eas_pic_print_info(&end, i++, buf);
2554     }
2555 
2556     g_string_append_printf(buf, "XIVE[%x] #%d ENDT\n", chip_id, blk);
2557     i = 0;
2558     while (!xive2_router_get_end(xrtr, blk, i, &end)) {
2559         xive2_end_pic_print_info(&end, i++, buf);
2560     }
2561 
2562     g_string_append_printf(buf, "XIVE[%x] #%d NVPT %08x .. %08x\n",
2563                            chip_id, blk, 0, XIVE2_NVP_COUNT - 1);
2564     entries_per_subpage = pnv_xive2_vst_per_subpage(xive, VST_NVP);
2565     for (i = 0; i < XIVE2_NVP_COUNT; i += entries_per_subpage) {
2566         while (!xive2_router_get_nvp(xrtr, blk, i, &nvp)) {
2567             xive2_nvp_pic_print_info(&nvp, i++, buf);
2568         }
2569     }
2570 
2571     g_string_append_printf(buf, "XIVE[%x] #%d NVGT %08x .. %08x\n",
2572                            chip_id, blk, 0, XIVE2_NVP_COUNT - 1);
2573     entries_per_subpage = pnv_xive2_vst_per_subpage(xive, VST_NVG);
2574     for (i = 0; i < XIVE2_NVP_COUNT; i += entries_per_subpage) {
2575         while (!xive2_router_get_nvgc(xrtr, false, blk, i, &nvgc)) {
2576             xive2_nvgc_pic_print_info(&nvgc, i++, buf);
2577         }
2578     }
2579 
2580     g_string_append_printf(buf, "XIVE[%x] #%d NVCT %08x .. %08x\n",
2581                           chip_id, blk, 0, XIVE2_NVP_COUNT - 1);
2582     entries_per_subpage = pnv_xive2_vst_per_subpage(xive, VST_NVC);
2583     for (i = 0; i < XIVE2_NVP_COUNT; i += entries_per_subpage) {
2584         while (!xive2_router_get_nvgc(xrtr, true, blk, i, &nvgc)) {
2585             xive2_nvgc_pic_print_info(&nvgc, i++, buf);
2586         }
2587     }
2588 }
2589