xref: /openbmc/qemu/hw/pci-host/pnv_phb4.c (revision 3f4c369ea63e846f1dd3a83229b9300350b44025)
1 /*
2  * QEMU PowerPC PowerNV (POWER9) PHB4 model
3  *
4  * Copyright (c) 2018-2020, IBM Corporation.
5  *
6  * This code is licensed under the GPL version 2 or later. See the
7  * COPYING file in the top-level directory.
8  */
9 #include "qemu/osdep.h"
10 #include "qemu/log.h"
11 #include "qapi/visitor.h"
12 #include "qapi/error.h"
13 #include "qemu-common.h"
14 #include "monitor/monitor.h"
15 #include "target/ppc/cpu.h"
16 #include "hw/pci-host/pnv_phb4_regs.h"
17 #include "hw/pci-host/pnv_phb4.h"
18 #include "hw/pci/pcie_host.h"
19 #include "hw/pci/pcie_port.h"
20 #include "hw/ppc/pnv.h"
21 #include "hw/ppc/pnv_xscom.h"
22 #include "hw/irq.h"
23 #include "hw/qdev-properties.h"
24 #include "qom/object.h"
25 #include "sysemu/sysemu.h"
26 #include "trace.h"
27 
28 #define phb_error(phb, fmt, ...)                                        \
29     qemu_log_mask(LOG_GUEST_ERROR, "phb4[%d:%d]: " fmt "\n",            \
30                   (phb)->chip_id, (phb)->phb_id, ## __VA_ARGS__)
31 
32 #define phb_pec_error(pec, fmt, ...)                                    \
33     qemu_log_mask(LOG_GUEST_ERROR, "phb4_pec[%d:%d]: " fmt "\n",        \
34                   (pec)->chip_id, (pec)->index, ## __VA_ARGS__)
35 
36 /*
37  * QEMU version of the GETFIELD/SETFIELD macros
38  *
39  * These are common with the PnvXive model.
40  */
41 static inline uint64_t GETFIELD(uint64_t mask, uint64_t word)
42 {
43     return (word & mask) >> ctz64(mask);
44 }
45 
46 static inline uint64_t SETFIELD(uint64_t mask, uint64_t word,
47                                 uint64_t value)
48 {
49     return (word & ~mask) | ((value << ctz64(mask)) & mask);
50 }
51 
52 static PCIDevice *pnv_phb4_find_cfg_dev(PnvPHB4 *phb)
53 {
54     PCIHostState *pci = PCI_HOST_BRIDGE(phb);
55     uint64_t addr = phb->regs[PHB_CONFIG_ADDRESS >> 3];
56     uint8_t bus, devfn;
57 
58     if (!(addr >> 63)) {
59         return NULL;
60     }
61     bus = (addr >> 52) & 0xff;
62     devfn = (addr >> 44) & 0xff;
63 
64     /* We don't access the root complex this way */
65     if (bus == 0 && devfn == 0) {
66         return NULL;
67     }
68     return pci_find_device(pci->bus, bus, devfn);
69 }
70 
71 /*
72  * The CONFIG_DATA register expects little endian accesses, but as the
73  * region is big endian, we have to swap the value.
74  */
75 static void pnv_phb4_config_write(PnvPHB4 *phb, unsigned off,
76                                   unsigned size, uint64_t val)
77 {
78     uint32_t cfg_addr, limit;
79     PCIDevice *pdev;
80 
81     pdev = pnv_phb4_find_cfg_dev(phb);
82     if (!pdev) {
83         return;
84     }
85     cfg_addr = (phb->regs[PHB_CONFIG_ADDRESS >> 3] >> 32) & 0xffc;
86     cfg_addr |= off;
87     limit = pci_config_size(pdev);
88     if (limit <= cfg_addr) {
89         /*
90          * conventional pci device can be behind pcie-to-pci bridge.
91          * 256 <= addr < 4K has no effects.
92          */
93         return;
94     }
95     switch (size) {
96     case 1:
97         break;
98     case 2:
99         val = bswap16(val);
100         break;
101     case 4:
102         val = bswap32(val);
103         break;
104     default:
105         g_assert_not_reached();
106     }
107     pci_host_config_write_common(pdev, cfg_addr, limit, val, size);
108 }
109 
110 static uint64_t pnv_phb4_config_read(PnvPHB4 *phb, unsigned off,
111                                      unsigned size)
112 {
113     uint32_t cfg_addr, limit;
114     PCIDevice *pdev;
115     uint64_t val;
116 
117     pdev = pnv_phb4_find_cfg_dev(phb);
118     if (!pdev) {
119         return ~0ull;
120     }
121     cfg_addr = (phb->regs[PHB_CONFIG_ADDRESS >> 3] >> 32) & 0xffc;
122     cfg_addr |= off;
123     limit = pci_config_size(pdev);
124     if (limit <= cfg_addr) {
125         /*
126          * conventional pci device can be behind pcie-to-pci bridge.
127          * 256 <= addr < 4K has no effects.
128          */
129         return ~0ull;
130     }
131     val = pci_host_config_read_common(pdev, cfg_addr, limit, size);
132     switch (size) {
133     case 1:
134         return val;
135     case 2:
136         return bswap16(val);
137     case 4:
138         return bswap32(val);
139     default:
140         g_assert_not_reached();
141     }
142 }
143 
144 /*
145  * Root complex register accesses are memory mapped.
146  */
147 static void pnv_phb4_rc_config_write(PnvPHB4 *phb, unsigned off,
148                                      unsigned size, uint64_t val)
149 {
150     PCIHostState *pci = PCI_HOST_BRIDGE(phb);
151     PCIDevice *pdev;
152 
153     if (size != 4) {
154         phb_error(phb, "rc_config_write invalid size %d\n", size);
155         return;
156     }
157 
158     pdev = pci_find_device(pci->bus, 0, 0);
159     if (!pdev) {
160         phb_error(phb, "rc_config_write device not found\n");
161         return;
162     }
163 
164     pci_host_config_write_common(pdev, off, PHB_RC_CONFIG_SIZE,
165                                  bswap32(val), 4);
166 }
167 
168 static uint64_t pnv_phb4_rc_config_read(PnvPHB4 *phb, unsigned off,
169                                         unsigned size)
170 {
171     PCIHostState *pci = PCI_HOST_BRIDGE(phb);
172     PCIDevice *pdev;
173     uint64_t val;
174 
175     if (size != 4) {
176         phb_error(phb, "rc_config_read invalid size %d\n", size);
177         return ~0ull;
178     }
179 
180     pdev = pci_find_device(pci->bus, 0, 0);
181     if (!pdev) {
182         phb_error(phb, "rc_config_read device not found\n");
183         return ~0ull;
184     }
185 
186     val = pci_host_config_read_common(pdev, off, PHB_RC_CONFIG_SIZE, 4);
187     return bswap32(val);
188 }
189 
190 static void pnv_phb4_check_mbt(PnvPHB4 *phb, uint32_t index)
191 {
192     uint64_t base, start, size, mbe0, mbe1;
193     MemoryRegion *parent;
194     char name[64];
195 
196     /* Unmap first */
197     if (memory_region_is_mapped(&phb->mr_mmio[index])) {
198         /* Should we destroy it in RCU friendly way... ? */
199         memory_region_del_subregion(phb->mr_mmio[index].container,
200                                     &phb->mr_mmio[index]);
201     }
202 
203     /* Get table entry */
204     mbe0 = phb->ioda_MBT[(index << 1)];
205     mbe1 = phb->ioda_MBT[(index << 1) + 1];
206 
207     if (!(mbe0 & IODA3_MBT0_ENABLE)) {
208         return;
209     }
210 
211     /* Grab geometry from registers */
212     base = GETFIELD(IODA3_MBT0_BASE_ADDR, mbe0) << 12;
213     size = GETFIELD(IODA3_MBT1_MASK, mbe1) << 12;
214     size |= 0xff00000000000000ull;
215     size = ~size + 1;
216 
217     /* Calculate PCI side start address based on M32/M64 window type */
218     if (mbe0 & IODA3_MBT0_TYPE_M32) {
219         start = phb->regs[PHB_M32_START_ADDR >> 3];
220         if ((start + size) > 0x100000000ull) {
221             phb_error(phb, "M32 set beyond 4GB boundary !");
222             size = 0x100000000 - start;
223         }
224     } else {
225         start = base | (phb->regs[PHB_M64_UPPER_BITS >> 3]);
226     }
227 
228     /* TODO: Figure out how to implemet/decode AOMASK */
229 
230     /* Check if it matches an enabled MMIO region in the PEC stack */
231     if (memory_region_is_mapped(&phb->mmbar0) &&
232         base >= phb->mmio0_base &&
233         (base + size) <= (phb->mmio0_base + phb->mmio0_size)) {
234         parent = &phb->mmbar0;
235         base -= phb->mmio0_base;
236     } else if (memory_region_is_mapped(&phb->mmbar1) &&
237         base >= phb->mmio1_base &&
238         (base + size) <= (phb->mmio1_base + phb->mmio1_size)) {
239         parent = &phb->mmbar1;
240         base -= phb->mmio1_base;
241     } else {
242         phb_error(phb, "PHB MBAR %d out of parent bounds", index);
243         return;
244     }
245 
246     /* Create alias (better name ?) */
247     snprintf(name, sizeof(name), "phb4-mbar%d", index);
248     memory_region_init_alias(&phb->mr_mmio[index], OBJECT(phb), name,
249                              &phb->pci_mmio, start, size);
250     memory_region_add_subregion(parent, base, &phb->mr_mmio[index]);
251 }
252 
253 static void pnv_phb4_check_all_mbt(PnvPHB4 *phb)
254 {
255     uint64_t i;
256     uint32_t num_windows = phb->big_phb ? PNV_PHB4_MAX_MMIO_WINDOWS :
257         PNV_PHB4_MIN_MMIO_WINDOWS;
258 
259     for (i = 0; i < num_windows; i++) {
260         pnv_phb4_check_mbt(phb, i);
261     }
262 }
263 
264 static uint64_t *pnv_phb4_ioda_access(PnvPHB4 *phb,
265                                       unsigned *out_table, unsigned *out_idx)
266 {
267     uint64_t adreg = phb->regs[PHB_IODA_ADDR >> 3];
268     unsigned int index = GETFIELD(PHB_IODA_AD_TADR, adreg);
269     unsigned int table = GETFIELD(PHB_IODA_AD_TSEL, adreg);
270     unsigned int mask;
271     uint64_t *tptr = NULL;
272 
273     switch (table) {
274     case IODA3_TBL_LIST:
275         tptr = phb->ioda_LIST;
276         mask = 7;
277         break;
278     case IODA3_TBL_MIST:
279         tptr = phb->ioda_MIST;
280         mask = phb->big_phb ? PNV_PHB4_MAX_MIST : (PNV_PHB4_MAX_MIST >> 1);
281         mask -= 1;
282         break;
283     case IODA3_TBL_RCAM:
284         mask = phb->big_phb ? 127 : 63;
285         break;
286     case IODA3_TBL_MRT:
287         mask = phb->big_phb ? 15 : 7;
288         break;
289     case IODA3_TBL_PESTA:
290     case IODA3_TBL_PESTB:
291         mask = phb->big_phb ? PNV_PHB4_MAX_PEs : (PNV_PHB4_MAX_PEs >> 1);
292         mask -= 1;
293         break;
294     case IODA3_TBL_TVT:
295         tptr = phb->ioda_TVT;
296         mask = phb->big_phb ? PNV_PHB4_MAX_TVEs : (PNV_PHB4_MAX_TVEs >> 1);
297         mask -= 1;
298         break;
299     case IODA3_TBL_TCR:
300     case IODA3_TBL_TDR:
301         mask = phb->big_phb ? 1023 : 511;
302         break;
303     case IODA3_TBL_MBT:
304         tptr = phb->ioda_MBT;
305         mask = phb->big_phb ? PNV_PHB4_MAX_MBEs : (PNV_PHB4_MAX_MBEs >> 1);
306         mask -= 1;
307         break;
308     case IODA3_TBL_MDT:
309         tptr = phb->ioda_MDT;
310         mask = phb->big_phb ? PNV_PHB4_MAX_PEs : (PNV_PHB4_MAX_PEs >> 1);
311         mask -= 1;
312         break;
313     case IODA3_TBL_PEEV:
314         tptr = phb->ioda_PEEV;
315         mask = phb->big_phb ? PNV_PHB4_MAX_PEEVs : (PNV_PHB4_MAX_PEEVs >> 1);
316         mask -= 1;
317         break;
318     default:
319         phb_error(phb, "invalid IODA table %d", table);
320         return NULL;
321     }
322     index &= mask;
323     if (out_idx) {
324         *out_idx = index;
325     }
326     if (out_table) {
327         *out_table = table;
328     }
329     if (tptr) {
330         tptr += index;
331     }
332     if (adreg & PHB_IODA_AD_AUTOINC) {
333         index = (index + 1) & mask;
334         adreg = SETFIELD(PHB_IODA_AD_TADR, adreg, index);
335     }
336 
337     phb->regs[PHB_IODA_ADDR >> 3] = adreg;
338     return tptr;
339 }
340 
341 static uint64_t pnv_phb4_ioda_read(PnvPHB4 *phb)
342 {
343     unsigned table, idx;
344     uint64_t *tptr;
345 
346     tptr = pnv_phb4_ioda_access(phb, &table, &idx);
347     if (!tptr) {
348         /* Special PESTA case */
349         if (table == IODA3_TBL_PESTA) {
350             return ((uint64_t)(phb->ioda_PEST_AB[idx] & 1)) << 63;
351         } else if (table == IODA3_TBL_PESTB) {
352             return ((uint64_t)(phb->ioda_PEST_AB[idx] & 2)) << 62;
353         }
354         /* Return 0 on unsupported tables, not ff's */
355         return 0;
356     }
357     return *tptr;
358 }
359 
360 static void pnv_phb4_ioda_write(PnvPHB4 *phb, uint64_t val)
361 {
362     unsigned table, idx;
363     uint64_t *tptr;
364 
365     tptr = pnv_phb4_ioda_access(phb, &table, &idx);
366     if (!tptr) {
367         /* Special PESTA case */
368         if (table == IODA3_TBL_PESTA) {
369             phb->ioda_PEST_AB[idx] &= ~1;
370             phb->ioda_PEST_AB[idx] |= (val >> 63) & 1;
371         } else if (table == IODA3_TBL_PESTB) {
372             phb->ioda_PEST_AB[idx] &= ~2;
373             phb->ioda_PEST_AB[idx] |= (val >> 62) & 2;
374         }
375         return;
376     }
377 
378     /* Handle side effects */
379     switch (table) {
380     case IODA3_TBL_LIST:
381         break;
382     case IODA3_TBL_MIST: {
383         /* Special mask for MIST partial write */
384         uint64_t adreg = phb->regs[PHB_IODA_ADDR >> 3];
385         uint32_t mmask = GETFIELD(PHB_IODA_AD_MIST_PWV, adreg);
386         uint64_t v = *tptr;
387         if (mmask == 0) {
388             mmask = 0xf;
389         }
390         if (mmask & 8) {
391             v &= 0x0000ffffffffffffull;
392             v |= 0xcfff000000000000ull & val;
393         }
394         if (mmask & 4) {
395             v &= 0xffff0000ffffffffull;
396             v |= 0x0000cfff00000000ull & val;
397         }
398         if (mmask & 2) {
399             v &= 0xffffffff0000ffffull;
400             v |= 0x00000000cfff0000ull & val;
401         }
402         if (mmask & 1) {
403             v &= 0xffffffffffff0000ull;
404             v |= 0x000000000000cfffull & val;
405         }
406         *tptr = v;
407         break;
408     }
409     case IODA3_TBL_MBT:
410         *tptr = val;
411 
412         /* Copy accross the valid bit to the other half */
413         phb->ioda_MBT[idx ^ 1] &= 0x7fffffffffffffffull;
414         phb->ioda_MBT[idx ^ 1] |= 0x8000000000000000ull & val;
415 
416         /* Update mappings */
417         pnv_phb4_check_mbt(phb, idx >> 1);
418         break;
419     default:
420         *tptr = val;
421     }
422 }
423 
424 static void pnv_phb4_rtc_invalidate(PnvPHB4 *phb, uint64_t val)
425 {
426     PnvPhb4DMASpace *ds;
427 
428     /* Always invalidate all for now ... */
429     QLIST_FOREACH(ds, &phb->dma_spaces, list) {
430         ds->pe_num = PHB_INVALID_PE;
431     }
432 }
433 
434 static void pnv_phb4_update_msi_regions(PnvPhb4DMASpace *ds)
435 {
436     uint64_t cfg = ds->phb->regs[PHB_PHB4_CONFIG >> 3];
437 
438     if (cfg & PHB_PHB4C_32BIT_MSI_EN) {
439         if (!memory_region_is_mapped(MEMORY_REGION(&ds->msi32_mr))) {
440             memory_region_add_subregion(MEMORY_REGION(&ds->dma_mr),
441                                         0xffff0000, &ds->msi32_mr);
442         }
443     } else {
444         if (memory_region_is_mapped(MEMORY_REGION(&ds->msi32_mr))) {
445             memory_region_del_subregion(MEMORY_REGION(&ds->dma_mr),
446                                         &ds->msi32_mr);
447         }
448     }
449 
450     if (cfg & PHB_PHB4C_64BIT_MSI_EN) {
451         if (!memory_region_is_mapped(MEMORY_REGION(&ds->msi64_mr))) {
452             memory_region_add_subregion(MEMORY_REGION(&ds->dma_mr),
453                                         (1ull << 60), &ds->msi64_mr);
454         }
455     } else {
456         if (memory_region_is_mapped(MEMORY_REGION(&ds->msi64_mr))) {
457             memory_region_del_subregion(MEMORY_REGION(&ds->dma_mr),
458                                         &ds->msi64_mr);
459         }
460     }
461 }
462 
463 static void pnv_phb4_update_all_msi_regions(PnvPHB4 *phb)
464 {
465     PnvPhb4DMASpace *ds;
466 
467     QLIST_FOREACH(ds, &phb->dma_spaces, list) {
468         pnv_phb4_update_msi_regions(ds);
469     }
470 }
471 
472 static void pnv_phb4_update_xsrc(PnvPHB4 *phb)
473 {
474     int shift, flags, i, lsi_base;
475     XiveSource *xsrc = &phb->xsrc;
476 
477     /* The XIVE source characteristics can be set at run time */
478     if (phb->regs[PHB_CTRLR >> 3] & PHB_CTRLR_IRQ_PGSZ_64K) {
479         shift = XIVE_ESB_64K;
480     } else {
481         shift = XIVE_ESB_4K;
482     }
483     if (phb->regs[PHB_CTRLR >> 3] & PHB_CTRLR_IRQ_STORE_EOI) {
484         flags = XIVE_SRC_STORE_EOI;
485     } else {
486         flags = 0;
487     }
488 
489     phb->xsrc.esb_shift = shift;
490     phb->xsrc.esb_flags = flags;
491 
492     lsi_base = GETFIELD(PHB_LSI_SRC_ID, phb->regs[PHB_LSI_SOURCE_ID >> 3]);
493     lsi_base <<= 3;
494 
495     /* TODO: handle reset values of PHB_LSI_SRC_ID */
496     if (!lsi_base) {
497         return;
498     }
499 
500     /* TODO: need a xive_source_irq_reset_lsi() */
501     bitmap_zero(xsrc->lsi_map, xsrc->nr_irqs);
502 
503     for (i = 0; i < xsrc->nr_irqs; i++) {
504         bool msi = (i < lsi_base || i >= (lsi_base + 8));
505         if (!msi) {
506             xive_source_irq_set_lsi(xsrc, i);
507         }
508     }
509 }
510 
511 static void pnv_phb4_reg_write(void *opaque, hwaddr off, uint64_t val,
512                                unsigned size)
513 {
514     PnvPHB4 *phb = PNV_PHB4(opaque);
515     bool changed;
516 
517     /* Special case outbound configuration data */
518     if ((off & 0xfffc) == PHB_CONFIG_DATA) {
519         pnv_phb4_config_write(phb, off & 0x3, size, val);
520         return;
521     }
522 
523     /* Special case RC configuration space */
524     if ((off & 0xf800) == PHB_RC_CONFIG_BASE) {
525         pnv_phb4_rc_config_write(phb, off & 0x7ff, size, val);
526         return;
527     }
528 
529     /* Other registers are 64-bit only */
530     if (size != 8 || off & 0x7) {
531         phb_error(phb, "Invalid register access, offset: 0x%"PRIx64" size: %d",
532                    off, size);
533         return;
534     }
535 
536     /* Handle masking */
537     switch (off) {
538     case PHB_LSI_SOURCE_ID:
539         val &= PHB_LSI_SRC_ID;
540         break;
541     case PHB_M64_UPPER_BITS:
542         val &= 0xff00000000000000ull;
543         break;
544     /* TCE Kill */
545     case PHB_TCE_KILL:
546         /* Clear top 3 bits which HW does to indicate successful queuing */
547         val &= ~(PHB_TCE_KILL_ALL | PHB_TCE_KILL_PE | PHB_TCE_KILL_ONE);
548         break;
549     case PHB_Q_DMA_R:
550         /*
551          * This is enough logic to make SW happy but we aren't
552          * actually quiescing the DMAs
553          */
554         if (val & PHB_Q_DMA_R_AUTORESET) {
555             val = 0;
556         } else {
557             val &= PHB_Q_DMA_R_QUIESCE_DMA;
558         }
559         break;
560     /* LEM stuff */
561     case PHB_LEM_FIR_AND_MASK:
562         phb->regs[PHB_LEM_FIR_ACCUM >> 3] &= val;
563         return;
564     case PHB_LEM_FIR_OR_MASK:
565         phb->regs[PHB_LEM_FIR_ACCUM >> 3] |= val;
566         return;
567     case PHB_LEM_ERROR_AND_MASK:
568         phb->regs[PHB_LEM_ERROR_MASK >> 3] &= val;
569         return;
570     case PHB_LEM_ERROR_OR_MASK:
571         phb->regs[PHB_LEM_ERROR_MASK >> 3] |= val;
572         return;
573     case PHB_LEM_WOF:
574         val = 0;
575         break;
576     /* TODO: More regs ..., maybe create a table with masks... */
577 
578     /* Read only registers */
579     case PHB_CPU_LOADSTORE_STATUS:
580     case PHB_ETU_ERR_SUMMARY:
581     case PHB_PHB4_GEN_CAP:
582     case PHB_PHB4_TCE_CAP:
583     case PHB_PHB4_IRQ_CAP:
584     case PHB_PHB4_EEH_CAP:
585         return;
586     }
587 
588     /* Record whether it changed */
589     changed = phb->regs[off >> 3] != val;
590 
591     /* Store in register cache first */
592     phb->regs[off >> 3] = val;
593 
594     /* Handle side effects */
595     switch (off) {
596     case PHB_PHB4_CONFIG:
597         if (changed) {
598             pnv_phb4_update_all_msi_regions(phb);
599         }
600         break;
601     case PHB_M32_START_ADDR:
602     case PHB_M64_UPPER_BITS:
603         if (changed) {
604             pnv_phb4_check_all_mbt(phb);
605         }
606         break;
607 
608     /* IODA table accesses */
609     case PHB_IODA_DATA0:
610         pnv_phb4_ioda_write(phb, val);
611         break;
612 
613     /* RTC invalidation */
614     case PHB_RTC_INVALIDATE:
615         pnv_phb4_rtc_invalidate(phb, val);
616         break;
617 
618     /* PHB Control (Affects XIVE source) */
619     case PHB_CTRLR:
620     case PHB_LSI_SOURCE_ID:
621         pnv_phb4_update_xsrc(phb);
622         break;
623 
624     /* Silent simple writes */
625     case PHB_ASN_CMPM:
626     case PHB_CONFIG_ADDRESS:
627     case PHB_IODA_ADDR:
628     case PHB_TCE_KILL:
629     case PHB_TCE_SPEC_CTL:
630     case PHB_PEST_BAR:
631     case PHB_PELTV_BAR:
632     case PHB_RTT_BAR:
633     case PHB_LEM_FIR_ACCUM:
634     case PHB_LEM_ERROR_MASK:
635     case PHB_LEM_ACTION0:
636     case PHB_LEM_ACTION1:
637     case PHB_TCE_TAG_ENABLE:
638     case PHB_INT_NOTIFY_ADDR:
639     case PHB_INT_NOTIFY_INDEX:
640     case PHB_DMARD_SYNC:
641        break;
642 
643     /* Noise on anything else */
644     default:
645         qemu_log_mask(LOG_UNIMP, "phb4: reg_write 0x%"PRIx64"=%"PRIx64"\n",
646                       off, val);
647     }
648 }
649 
650 static uint64_t pnv_phb4_reg_read(void *opaque, hwaddr off, unsigned size)
651 {
652     PnvPHB4 *phb = PNV_PHB4(opaque);
653     uint64_t val;
654 
655     if ((off & 0xfffc) == PHB_CONFIG_DATA) {
656         return pnv_phb4_config_read(phb, off & 0x3, size);
657     }
658 
659     /* Special case RC configuration space */
660     if ((off & 0xf800) == PHB_RC_CONFIG_BASE) {
661         return pnv_phb4_rc_config_read(phb, off & 0x7ff, size);
662     }
663 
664     /* Other registers are 64-bit only */
665     if (size != 8 || off & 0x7) {
666         phb_error(phb, "Invalid register access, offset: 0x%"PRIx64" size: %d",
667                    off, size);
668         return ~0ull;
669     }
670 
671     /* Default read from cache */
672     val = phb->regs[off >> 3];
673 
674     switch (off) {
675     case PHB_VERSION:
676         return phb->version;
677 
678         /* Read-only */
679     case PHB_PHB4_GEN_CAP:
680         return 0xe4b8000000000000ull;
681     case PHB_PHB4_TCE_CAP:
682         return phb->big_phb ? 0x4008440000000400ull : 0x2008440000000200ull;
683     case PHB_PHB4_IRQ_CAP:
684         return phb->big_phb ? 0x0800000000001000ull : 0x0800000000000800ull;
685     case PHB_PHB4_EEH_CAP:
686         return phb->big_phb ? 0x2000000000000000ull : 0x1000000000000000ull;
687 
688     /* IODA table accesses */
689     case PHB_IODA_DATA0:
690         return pnv_phb4_ioda_read(phb);
691 
692     /* Link training always appears trained */
693     case PHB_PCIE_DLP_TRAIN_CTL:
694         /* TODO: Do something sensible with speed ? */
695         return PHB_PCIE_DLP_INBAND_PRESENCE | PHB_PCIE_DLP_TL_LINKACT;
696 
697     /* DMA read sync: make it look like it's complete */
698     case PHB_DMARD_SYNC:
699         return PHB_DMARD_SYNC_COMPLETE;
700 
701     /* Silent simple reads */
702     case PHB_LSI_SOURCE_ID:
703     case PHB_CPU_LOADSTORE_STATUS:
704     case PHB_ASN_CMPM:
705     case PHB_PHB4_CONFIG:
706     case PHB_M32_START_ADDR:
707     case PHB_CONFIG_ADDRESS:
708     case PHB_IODA_ADDR:
709     case PHB_RTC_INVALIDATE:
710     case PHB_TCE_KILL:
711     case PHB_TCE_SPEC_CTL:
712     case PHB_PEST_BAR:
713     case PHB_PELTV_BAR:
714     case PHB_RTT_BAR:
715     case PHB_M64_UPPER_BITS:
716     case PHB_CTRLR:
717     case PHB_LEM_FIR_ACCUM:
718     case PHB_LEM_ERROR_MASK:
719     case PHB_LEM_ACTION0:
720     case PHB_LEM_ACTION1:
721     case PHB_TCE_TAG_ENABLE:
722     case PHB_INT_NOTIFY_ADDR:
723     case PHB_INT_NOTIFY_INDEX:
724     case PHB_Q_DMA_R:
725     case PHB_ETU_ERR_SUMMARY:
726         break;
727 
728     /* Noise on anything else */
729     default:
730         qemu_log_mask(LOG_UNIMP, "phb4: reg_read 0x%"PRIx64"=%"PRIx64"\n",
731                       off, val);
732     }
733     return val;
734 }
735 
736 static const MemoryRegionOps pnv_phb4_reg_ops = {
737     .read = pnv_phb4_reg_read,
738     .write = pnv_phb4_reg_write,
739     .valid.min_access_size = 1,
740     .valid.max_access_size = 8,
741     .impl.min_access_size = 1,
742     .impl.max_access_size = 8,
743     .endianness = DEVICE_BIG_ENDIAN,
744 };
745 
746 static uint64_t pnv_phb4_xscom_read(void *opaque, hwaddr addr, unsigned size)
747 {
748     PnvPHB4 *phb = PNV_PHB4(opaque);
749     uint32_t reg = addr >> 3;
750     uint64_t val;
751     hwaddr offset;
752 
753     switch (reg) {
754     case PHB_SCOM_HV_IND_ADDR:
755         return phb->scom_hv_ind_addr_reg;
756 
757     case PHB_SCOM_HV_IND_DATA:
758         if (!(phb->scom_hv_ind_addr_reg & PHB_SCOM_HV_IND_ADDR_VALID)) {
759             phb_error(phb, "Invalid indirect address");
760             return ~0ull;
761         }
762         size = (phb->scom_hv_ind_addr_reg & PHB_SCOM_HV_IND_ADDR_4B) ? 4 : 8;
763         offset = GETFIELD(PHB_SCOM_HV_IND_ADDR_ADDR, phb->scom_hv_ind_addr_reg);
764         val = pnv_phb4_reg_read(phb, offset, size);
765         if (phb->scom_hv_ind_addr_reg & PHB_SCOM_HV_IND_ADDR_AUTOINC) {
766             offset += size;
767             offset &= 0x3fff;
768             phb->scom_hv_ind_addr_reg = SETFIELD(PHB_SCOM_HV_IND_ADDR_ADDR,
769                                                  phb->scom_hv_ind_addr_reg,
770                                                  offset);
771         }
772         return val;
773     case PHB_SCOM_ETU_LEM_FIR:
774     case PHB_SCOM_ETU_LEM_FIR_AND:
775     case PHB_SCOM_ETU_LEM_FIR_OR:
776     case PHB_SCOM_ETU_LEM_FIR_MSK:
777     case PHB_SCOM_ETU_LEM_ERR_MSK_AND:
778     case PHB_SCOM_ETU_LEM_ERR_MSK_OR:
779     case PHB_SCOM_ETU_LEM_ACT0:
780     case PHB_SCOM_ETU_LEM_ACT1:
781     case PHB_SCOM_ETU_LEM_WOF:
782         offset = ((reg - PHB_SCOM_ETU_LEM_FIR) << 3) + PHB_LEM_FIR_ACCUM;
783         return pnv_phb4_reg_read(phb, offset, size);
784     case PHB_SCOM_ETU_PMON_CONFIG:
785     case PHB_SCOM_ETU_PMON_CTR0:
786     case PHB_SCOM_ETU_PMON_CTR1:
787     case PHB_SCOM_ETU_PMON_CTR2:
788     case PHB_SCOM_ETU_PMON_CTR3:
789         offset = ((reg - PHB_SCOM_ETU_PMON_CONFIG) << 3) + PHB_PERFMON_CONFIG;
790         return pnv_phb4_reg_read(phb, offset, size);
791 
792     default:
793         qemu_log_mask(LOG_UNIMP, "phb4: xscom_read 0x%"HWADDR_PRIx"\n", addr);
794         return ~0ull;
795     }
796 }
797 
798 static void pnv_phb4_xscom_write(void *opaque, hwaddr addr,
799                                  uint64_t val, unsigned size)
800 {
801     PnvPHB4 *phb = PNV_PHB4(opaque);
802     uint32_t reg = addr >> 3;
803     hwaddr offset;
804 
805     switch (reg) {
806     case PHB_SCOM_HV_IND_ADDR:
807         phb->scom_hv_ind_addr_reg = val & 0xe000000000001fff;
808         break;
809     case PHB_SCOM_HV_IND_DATA:
810         if (!(phb->scom_hv_ind_addr_reg & PHB_SCOM_HV_IND_ADDR_VALID)) {
811             phb_error(phb, "Invalid indirect address");
812             break;
813         }
814         size = (phb->scom_hv_ind_addr_reg & PHB_SCOM_HV_IND_ADDR_4B) ? 4 : 8;
815         offset = GETFIELD(PHB_SCOM_HV_IND_ADDR_ADDR, phb->scom_hv_ind_addr_reg);
816         pnv_phb4_reg_write(phb, offset, val, size);
817         if (phb->scom_hv_ind_addr_reg & PHB_SCOM_HV_IND_ADDR_AUTOINC) {
818             offset += size;
819             offset &= 0x3fff;
820             phb->scom_hv_ind_addr_reg = SETFIELD(PHB_SCOM_HV_IND_ADDR_ADDR,
821                                                  phb->scom_hv_ind_addr_reg,
822                                                  offset);
823         }
824         break;
825     case PHB_SCOM_ETU_LEM_FIR:
826     case PHB_SCOM_ETU_LEM_FIR_AND:
827     case PHB_SCOM_ETU_LEM_FIR_OR:
828     case PHB_SCOM_ETU_LEM_FIR_MSK:
829     case PHB_SCOM_ETU_LEM_ERR_MSK_AND:
830     case PHB_SCOM_ETU_LEM_ERR_MSK_OR:
831     case PHB_SCOM_ETU_LEM_ACT0:
832     case PHB_SCOM_ETU_LEM_ACT1:
833     case PHB_SCOM_ETU_LEM_WOF:
834         offset = ((reg - PHB_SCOM_ETU_LEM_FIR) << 3) + PHB_LEM_FIR_ACCUM;
835         pnv_phb4_reg_write(phb, offset, val, size);
836         break;
837     case PHB_SCOM_ETU_PMON_CONFIG:
838     case PHB_SCOM_ETU_PMON_CTR0:
839     case PHB_SCOM_ETU_PMON_CTR1:
840     case PHB_SCOM_ETU_PMON_CTR2:
841     case PHB_SCOM_ETU_PMON_CTR3:
842         offset = ((reg - PHB_SCOM_ETU_PMON_CONFIG) << 3) + PHB_PERFMON_CONFIG;
843         pnv_phb4_reg_write(phb, offset, val, size);
844         break;
845     default:
846         qemu_log_mask(LOG_UNIMP, "phb4: xscom_write 0x%"HWADDR_PRIx
847                       "=%"PRIx64"\n", addr, val);
848     }
849 }
850 
851 const MemoryRegionOps pnv_phb4_xscom_ops = {
852     .read = pnv_phb4_xscom_read,
853     .write = pnv_phb4_xscom_write,
854     .valid.min_access_size = 8,
855     .valid.max_access_size = 8,
856     .impl.min_access_size = 8,
857     .impl.max_access_size = 8,
858     .endianness = DEVICE_BIG_ENDIAN,
859 };
860 
861 static uint64_t pnv_pec_stk_nest_xscom_read(void *opaque, hwaddr addr,
862                                             unsigned size)
863 {
864     PnvPHB4 *phb = PNV_PHB4(opaque);
865     uint32_t reg = addr >> 3;
866 
867     /* TODO: add list of allowed registers and error out if not */
868     return phb->nest_regs[reg];
869 }
870 
871 /*
872  * Return the 'stack_no' of a PHB4. 'stack_no' is the order
873  * the PHB4 occupies in the PEC. This is the reverse of what
874  * pnv_phb4_pec_get_phb_id() does.
875  *
876  * E.g. a phb with phb_id = 4 and pec->index = 1 (PEC1) will
877  * be the second phb (stack_no = 1) of the PEC.
878  */
879 static int pnv_phb4_get_phb_stack_no(PnvPHB4 *phb)
880 {
881     PnvPhb4PecState *pec = phb->pec;
882     PnvPhb4PecClass *pecc = PNV_PHB4_PEC_GET_CLASS(pec);
883     int index = pec->index;
884     int stack_no = phb->phb_id;
885 
886     while (index--) {
887         stack_no -= pecc->num_phbs[index];
888     }
889 
890     return stack_no;
891 }
892 
893 static void pnv_phb4_update_regions(PnvPHB4 *phb)
894 {
895     /* Unmap first always */
896     if (memory_region_is_mapped(&phb->mr_regs)) {
897         memory_region_del_subregion(&phb->phbbar, &phb->mr_regs);
898     }
899     if (memory_region_is_mapped(&phb->xsrc.esb_mmio)) {
900         memory_region_del_subregion(&phb->intbar, &phb->xsrc.esb_mmio);
901     }
902 
903     /* Map registers if enabled */
904     if (memory_region_is_mapped(&phb->phbbar)) {
905         memory_region_add_subregion(&phb->phbbar, 0, &phb->mr_regs);
906     }
907 
908     /* Map ESB if enabled */
909     if (memory_region_is_mapped(&phb->intbar)) {
910         memory_region_add_subregion(&phb->intbar, 0, &phb->xsrc.esb_mmio);
911     }
912 
913     /* Check/update m32 */
914     pnv_phb4_check_all_mbt(phb);
915 }
916 
917 static void pnv_pec_stk_update_map(PnvPHB4 *phb)
918 {
919     PnvPhb4PecState *pec = phb->pec;
920     MemoryRegion *sysmem = get_system_memory();
921     uint64_t bar_en = phb->nest_regs[PEC_NEST_STK_BAR_EN];
922     int stack_no = pnv_phb4_get_phb_stack_no(phb);
923     uint64_t bar, mask, size;
924     char name[64];
925 
926     /*
927      * NOTE: This will really not work well if those are remapped
928      * after the PHB has created its sub regions. We could do better
929      * if we had a way to resize regions but we don't really care
930      * that much in practice as the stuff below really only happens
931      * once early during boot
932      */
933 
934     /* Handle unmaps */
935     if (memory_region_is_mapped(&phb->mmbar0) &&
936         !(bar_en & PEC_NEST_STK_BAR_EN_MMIO0)) {
937         memory_region_del_subregion(sysmem, &phb->mmbar0);
938     }
939     if (memory_region_is_mapped(&phb->mmbar1) &&
940         !(bar_en & PEC_NEST_STK_BAR_EN_MMIO1)) {
941         memory_region_del_subregion(sysmem, &phb->mmbar1);
942     }
943     if (memory_region_is_mapped(&phb->phbbar) &&
944         !(bar_en & PEC_NEST_STK_BAR_EN_PHB)) {
945         memory_region_del_subregion(sysmem, &phb->phbbar);
946     }
947     if (memory_region_is_mapped(&phb->intbar) &&
948         !(bar_en & PEC_NEST_STK_BAR_EN_INT)) {
949         memory_region_del_subregion(sysmem, &phb->intbar);
950     }
951 
952     /* Update PHB */
953     pnv_phb4_update_regions(phb);
954 
955     /* Handle maps */
956     if (!memory_region_is_mapped(&phb->mmbar0) &&
957         (bar_en & PEC_NEST_STK_BAR_EN_MMIO0)) {
958         bar = phb->nest_regs[PEC_NEST_STK_MMIO_BAR0] >> 8;
959         mask = phb->nest_regs[PEC_NEST_STK_MMIO_BAR0_MASK];
960         size = ((~mask) >> 8) + 1;
961         snprintf(name, sizeof(name), "pec-%d.%d-phb-%d-mmio0",
962                  pec->chip_id, pec->index, stack_no);
963         memory_region_init(&phb->mmbar0, OBJECT(phb), name, size);
964         memory_region_add_subregion(sysmem, bar, &phb->mmbar0);
965         phb->mmio0_base = bar;
966         phb->mmio0_size = size;
967     }
968     if (!memory_region_is_mapped(&phb->mmbar1) &&
969         (bar_en & PEC_NEST_STK_BAR_EN_MMIO1)) {
970         bar = phb->nest_regs[PEC_NEST_STK_MMIO_BAR1] >> 8;
971         mask = phb->nest_regs[PEC_NEST_STK_MMIO_BAR1_MASK];
972         size = ((~mask) >> 8) + 1;
973         snprintf(name, sizeof(name), "pec-%d.%d-phb-%d-mmio1",
974                  pec->chip_id, pec->index, stack_no);
975         memory_region_init(&phb->mmbar1, OBJECT(phb), name, size);
976         memory_region_add_subregion(sysmem, bar, &phb->mmbar1);
977         phb->mmio1_base = bar;
978         phb->mmio1_size = size;
979     }
980     if (!memory_region_is_mapped(&phb->phbbar) &&
981         (bar_en & PEC_NEST_STK_BAR_EN_PHB)) {
982         bar = phb->nest_regs[PEC_NEST_STK_PHB_REGS_BAR] >> 8;
983         size = PNV_PHB4_NUM_REGS << 3;
984         snprintf(name, sizeof(name), "pec-%d.%d-phb-%d",
985                  pec->chip_id, pec->index, stack_no);
986         memory_region_init(&phb->phbbar, OBJECT(phb), name, size);
987         memory_region_add_subregion(sysmem, bar, &phb->phbbar);
988     }
989     if (!memory_region_is_mapped(&phb->intbar) &&
990         (bar_en & PEC_NEST_STK_BAR_EN_INT)) {
991         bar = phb->nest_regs[PEC_NEST_STK_INT_BAR] >> 8;
992         size = PNV_PHB4_MAX_INTs << 16;
993         snprintf(name, sizeof(name), "pec-%d.%d-phb-%d-int",
994                  phb->pec->chip_id, phb->pec->index, stack_no);
995         memory_region_init(&phb->intbar, OBJECT(phb), name, size);
996         memory_region_add_subregion(sysmem, bar, &phb->intbar);
997     }
998 
999     /* Update PHB */
1000     pnv_phb4_update_regions(phb);
1001 }
1002 
1003 static void pnv_pec_stk_nest_xscom_write(void *opaque, hwaddr addr,
1004                                          uint64_t val, unsigned size)
1005 {
1006     PnvPHB4 *phb = PNV_PHB4(opaque);
1007     PnvPhb4PecState *pec = phb->pec;
1008     uint32_t reg = addr >> 3;
1009 
1010     switch (reg) {
1011     case PEC_NEST_STK_PCI_NEST_FIR:
1012         phb->nest_regs[PEC_NEST_STK_PCI_NEST_FIR] = val;
1013         break;
1014     case PEC_NEST_STK_PCI_NEST_FIR_CLR:
1015         phb->nest_regs[PEC_NEST_STK_PCI_NEST_FIR] &= val;
1016         break;
1017     case PEC_NEST_STK_PCI_NEST_FIR_SET:
1018         phb->nest_regs[PEC_NEST_STK_PCI_NEST_FIR] |= val;
1019         break;
1020     case PEC_NEST_STK_PCI_NEST_FIR_MSK:
1021         phb->nest_regs[PEC_NEST_STK_PCI_NEST_FIR_MSK] = val;
1022         break;
1023     case PEC_NEST_STK_PCI_NEST_FIR_MSKC:
1024         phb->nest_regs[PEC_NEST_STK_PCI_NEST_FIR_MSK] &= val;
1025         break;
1026     case PEC_NEST_STK_PCI_NEST_FIR_MSKS:
1027         phb->nest_regs[PEC_NEST_STK_PCI_NEST_FIR_MSK] |= val;
1028         break;
1029     case PEC_NEST_STK_PCI_NEST_FIR_ACT0:
1030     case PEC_NEST_STK_PCI_NEST_FIR_ACT1:
1031         phb->nest_regs[reg] = val;
1032         break;
1033     case PEC_NEST_STK_PCI_NEST_FIR_WOF:
1034         phb->nest_regs[reg] = 0;
1035         break;
1036     case PEC_NEST_STK_ERR_REPORT_0:
1037     case PEC_NEST_STK_ERR_REPORT_1:
1038     case PEC_NEST_STK_PBCQ_GNRL_STATUS:
1039         /* Flag error ? */
1040         break;
1041     case PEC_NEST_STK_PBCQ_MODE:
1042         phb->nest_regs[reg] = val & 0xff00000000000000ull;
1043         break;
1044     case PEC_NEST_STK_MMIO_BAR0:
1045     case PEC_NEST_STK_MMIO_BAR0_MASK:
1046     case PEC_NEST_STK_MMIO_BAR1:
1047     case PEC_NEST_STK_MMIO_BAR1_MASK:
1048         if (phb->nest_regs[PEC_NEST_STK_BAR_EN] &
1049             (PEC_NEST_STK_BAR_EN_MMIO0 |
1050              PEC_NEST_STK_BAR_EN_MMIO1)) {
1051             phb_pec_error(pec, "Changing enabled BAR unsupported\n");
1052         }
1053         phb->nest_regs[reg] = val & 0xffffffffff000000ull;
1054         break;
1055     case PEC_NEST_STK_PHB_REGS_BAR:
1056         if (phb->nest_regs[PEC_NEST_STK_BAR_EN] & PEC_NEST_STK_BAR_EN_PHB) {
1057             phb_pec_error(pec, "Changing enabled BAR unsupported\n");
1058         }
1059         phb->nest_regs[reg] = val & 0xffffffffffc00000ull;
1060         break;
1061     case PEC_NEST_STK_INT_BAR:
1062         if (phb->nest_regs[PEC_NEST_STK_BAR_EN] & PEC_NEST_STK_BAR_EN_INT) {
1063             phb_pec_error(pec, "Changing enabled BAR unsupported\n");
1064         }
1065         phb->nest_regs[reg] = val & 0xfffffff000000000ull;
1066         break;
1067     case PEC_NEST_STK_BAR_EN:
1068         phb->nest_regs[reg] = val & 0xf000000000000000ull;
1069         pnv_pec_stk_update_map(phb);
1070         break;
1071     case PEC_NEST_STK_DATA_FRZ_TYPE:
1072     case PEC_NEST_STK_PBCQ_TUN_BAR:
1073         /* Not used for now */
1074         phb->nest_regs[reg] = val;
1075         break;
1076     default:
1077         qemu_log_mask(LOG_UNIMP, "phb4_pec: nest_xscom_write 0x%"HWADDR_PRIx
1078                       "=%"PRIx64"\n", addr, val);
1079     }
1080 }
1081 
1082 static const MemoryRegionOps pnv_pec_stk_nest_xscom_ops = {
1083     .read = pnv_pec_stk_nest_xscom_read,
1084     .write = pnv_pec_stk_nest_xscom_write,
1085     .valid.min_access_size = 8,
1086     .valid.max_access_size = 8,
1087     .impl.min_access_size = 8,
1088     .impl.max_access_size = 8,
1089     .endianness = DEVICE_BIG_ENDIAN,
1090 };
1091 
1092 static uint64_t pnv_pec_stk_pci_xscom_read(void *opaque, hwaddr addr,
1093                                            unsigned size)
1094 {
1095     PnvPHB4 *phb = PNV_PHB4(opaque);
1096     uint32_t reg = addr >> 3;
1097 
1098     /* TODO: add list of allowed registers and error out if not */
1099     return phb->pci_regs[reg];
1100 }
1101 
1102 static void pnv_pec_stk_pci_xscom_write(void *opaque, hwaddr addr,
1103                                         uint64_t val, unsigned size)
1104 {
1105     PnvPHB4 *phb = PNV_PHB4(opaque);
1106     uint32_t reg = addr >> 3;
1107 
1108     switch (reg) {
1109     case PEC_PCI_STK_PCI_FIR:
1110         phb->pci_regs[reg] = val;
1111         break;
1112     case PEC_PCI_STK_PCI_FIR_CLR:
1113         phb->pci_regs[PEC_PCI_STK_PCI_FIR] &= val;
1114         break;
1115     case PEC_PCI_STK_PCI_FIR_SET:
1116         phb->pci_regs[PEC_PCI_STK_PCI_FIR] |= val;
1117         break;
1118     case PEC_PCI_STK_PCI_FIR_MSK:
1119         phb->pci_regs[reg] = val;
1120         break;
1121     case PEC_PCI_STK_PCI_FIR_MSKC:
1122         phb->pci_regs[PEC_PCI_STK_PCI_FIR_MSK] &= val;
1123         break;
1124     case PEC_PCI_STK_PCI_FIR_MSKS:
1125         phb->pci_regs[PEC_PCI_STK_PCI_FIR_MSK] |= val;
1126         break;
1127     case PEC_PCI_STK_PCI_FIR_ACT0:
1128     case PEC_PCI_STK_PCI_FIR_ACT1:
1129         phb->pci_regs[reg] = val;
1130         break;
1131     case PEC_PCI_STK_PCI_FIR_WOF:
1132         phb->pci_regs[reg] = 0;
1133         break;
1134     case PEC_PCI_STK_ETU_RESET:
1135         phb->pci_regs[reg] = val & 0x8000000000000000ull;
1136         /* TODO: Implement reset */
1137         break;
1138     case PEC_PCI_STK_PBAIB_ERR_REPORT:
1139         break;
1140     case PEC_PCI_STK_PBAIB_TX_CMD_CRED:
1141     case PEC_PCI_STK_PBAIB_TX_DAT_CRED:
1142         phb->pci_regs[reg] = val;
1143         break;
1144     default:
1145         qemu_log_mask(LOG_UNIMP, "phb4_pec_stk: pci_xscom_write 0x%"HWADDR_PRIx
1146                       "=%"PRIx64"\n", addr, val);
1147     }
1148 }
1149 
1150 static const MemoryRegionOps pnv_pec_stk_pci_xscom_ops = {
1151     .read = pnv_pec_stk_pci_xscom_read,
1152     .write = pnv_pec_stk_pci_xscom_write,
1153     .valid.min_access_size = 8,
1154     .valid.max_access_size = 8,
1155     .impl.min_access_size = 8,
1156     .impl.max_access_size = 8,
1157     .endianness = DEVICE_BIG_ENDIAN,
1158 };
1159 
1160 static int pnv_phb4_map_irq(PCIDevice *pci_dev, int irq_num)
1161 {
1162     /* Check that out properly ... */
1163     return irq_num & 3;
1164 }
1165 
1166 static void pnv_phb4_set_irq(void *opaque, int irq_num, int level)
1167 {
1168     PnvPHB4 *phb = PNV_PHB4(opaque);
1169     uint32_t lsi_base;
1170 
1171     /* LSI only ... */
1172     if (irq_num > 3) {
1173         phb_error(phb, "IRQ %x is not an LSI", irq_num);
1174     }
1175     lsi_base = GETFIELD(PHB_LSI_SRC_ID, phb->regs[PHB_LSI_SOURCE_ID >> 3]);
1176     lsi_base <<= 3;
1177     qemu_set_irq(phb->qirqs[lsi_base + irq_num], level);
1178 }
1179 
1180 static bool pnv_phb4_resolve_pe(PnvPhb4DMASpace *ds)
1181 {
1182     uint64_t rtt, addr;
1183     uint16_t rte;
1184     int bus_num;
1185     int num_PEs;
1186 
1187     /* Already resolved ? */
1188     if (ds->pe_num != PHB_INVALID_PE) {
1189         return true;
1190     }
1191 
1192     /* We need to lookup the RTT */
1193     rtt = ds->phb->regs[PHB_RTT_BAR >> 3];
1194     if (!(rtt & PHB_RTT_BAR_ENABLE)) {
1195         phb_error(ds->phb, "DMA with RTT BAR disabled !");
1196         /* Set error bits ? fence ? ... */
1197         return false;
1198     }
1199 
1200     /* Read RTE */
1201     bus_num = pci_bus_num(ds->bus);
1202     addr = rtt & PHB_RTT_BASE_ADDRESS_MASK;
1203     addr += 2 * PCI_BUILD_BDF(bus_num, ds->devfn);
1204     if (dma_memory_read(&address_space_memory, addr, &rte,
1205                         sizeof(rte), MEMTXATTRS_UNSPECIFIED)) {
1206         phb_error(ds->phb, "Failed to read RTT entry at 0x%"PRIx64, addr);
1207         /* Set error bits ? fence ? ... */
1208         return false;
1209     }
1210     rte = be16_to_cpu(rte);
1211 
1212     /* Fail upon reading of invalid PE# */
1213     num_PEs = ds->phb->big_phb ? PNV_PHB4_MAX_PEs : (PNV_PHB4_MAX_PEs >> 1);
1214     if (rte >= num_PEs) {
1215         phb_error(ds->phb, "RTE for RID 0x%x invalid (%04x", ds->devfn, rte);
1216         rte &= num_PEs - 1;
1217     }
1218     ds->pe_num = rte;
1219     return true;
1220 }
1221 
1222 static void pnv_phb4_translate_tve(PnvPhb4DMASpace *ds, hwaddr addr,
1223                                    bool is_write, uint64_t tve,
1224                                    IOMMUTLBEntry *tlb)
1225 {
1226     uint64_t tta = GETFIELD(IODA3_TVT_TABLE_ADDR, tve);
1227     int32_t  lev = GETFIELD(IODA3_TVT_NUM_LEVELS, tve);
1228     uint32_t tts = GETFIELD(IODA3_TVT_TCE_TABLE_SIZE, tve);
1229     uint32_t tps = GETFIELD(IODA3_TVT_IO_PSIZE, tve);
1230 
1231     /* Invalid levels */
1232     if (lev > 4) {
1233         phb_error(ds->phb, "Invalid #levels in TVE %d", lev);
1234         return;
1235     }
1236 
1237     /* Invalid entry */
1238     if (tts == 0) {
1239         phb_error(ds->phb, "Access to invalid TVE");
1240         return;
1241     }
1242 
1243     /* IO Page Size of 0 means untranslated, else use TCEs */
1244     if (tps == 0) {
1245         /* TODO: Handle boundaries */
1246 
1247         /* Use 4k pages like q35 ... for now */
1248         tlb->iova = addr & 0xfffffffffffff000ull;
1249         tlb->translated_addr = addr & 0x0003fffffffff000ull;
1250         tlb->addr_mask = 0xfffull;
1251         tlb->perm = IOMMU_RW;
1252     } else {
1253         uint32_t tce_shift, tbl_shift, sh;
1254         uint64_t base, taddr, tce, tce_mask;
1255 
1256         /* Address bits per bottom level TCE entry */
1257         tce_shift = tps + 11;
1258 
1259         /* Address bits per table level */
1260         tbl_shift = tts + 8;
1261 
1262         /* Top level table base address */
1263         base = tta << 12;
1264 
1265         /* Total shift to first level */
1266         sh = tbl_shift * lev + tce_shift;
1267 
1268         /* TODO: Limit to support IO page sizes */
1269 
1270         /* TODO: Multi-level untested */
1271         while ((lev--) >= 0) {
1272             /* Grab the TCE address */
1273             taddr = base | (((addr >> sh) & ((1ul << tbl_shift) - 1)) << 3);
1274             if (dma_memory_read(&address_space_memory, taddr, &tce,
1275                                 sizeof(tce), MEMTXATTRS_UNSPECIFIED)) {
1276                 phb_error(ds->phb, "Failed to read TCE at 0x%"PRIx64, taddr);
1277                 return;
1278             }
1279             tce = be64_to_cpu(tce);
1280 
1281             /* Check permission for indirect TCE */
1282             if ((lev >= 0) && !(tce & 3)) {
1283                 phb_error(ds->phb, "Invalid indirect TCE at 0x%"PRIx64, taddr);
1284                 phb_error(ds->phb, " xlate %"PRIx64":%c TVE=%"PRIx64, addr,
1285                            is_write ? 'W' : 'R', tve);
1286                 phb_error(ds->phb, " tta=%"PRIx64" lev=%d tts=%d tps=%d",
1287                            tta, lev, tts, tps);
1288                 return;
1289             }
1290             sh -= tbl_shift;
1291             base = tce & ~0xfffull;
1292         }
1293 
1294         /* We exit the loop with TCE being the final TCE */
1295         tce_mask = ~((1ull << tce_shift) - 1);
1296         tlb->iova = addr & tce_mask;
1297         tlb->translated_addr = tce & tce_mask;
1298         tlb->addr_mask = ~tce_mask;
1299         tlb->perm = tce & 3;
1300         if ((is_write & !(tce & 2)) || ((!is_write) && !(tce & 1))) {
1301             phb_error(ds->phb, "TCE access fault at 0x%"PRIx64, taddr);
1302             phb_error(ds->phb, " xlate %"PRIx64":%c TVE=%"PRIx64, addr,
1303                        is_write ? 'W' : 'R', tve);
1304             phb_error(ds->phb, " tta=%"PRIx64" lev=%d tts=%d tps=%d",
1305                        tta, lev, tts, tps);
1306         }
1307     }
1308 }
1309 
1310 static IOMMUTLBEntry pnv_phb4_translate_iommu(IOMMUMemoryRegion *iommu,
1311                                               hwaddr addr,
1312                                               IOMMUAccessFlags flag,
1313                                               int iommu_idx)
1314 {
1315     PnvPhb4DMASpace *ds = container_of(iommu, PnvPhb4DMASpace, dma_mr);
1316     int tve_sel;
1317     uint64_t tve, cfg;
1318     IOMMUTLBEntry ret = {
1319         .target_as = &address_space_memory,
1320         .iova = addr,
1321         .translated_addr = 0,
1322         .addr_mask = ~(hwaddr)0,
1323         .perm = IOMMU_NONE,
1324     };
1325 
1326     /* Resolve PE# */
1327     if (!pnv_phb4_resolve_pe(ds)) {
1328         phb_error(ds->phb, "Failed to resolve PE# for bus @%p (%d) devfn 0x%x",
1329                    ds->bus, pci_bus_num(ds->bus), ds->devfn);
1330         return ret;
1331     }
1332 
1333     /* Check top bits */
1334     switch (addr >> 60) {
1335     case 00:
1336         /* DMA or 32-bit MSI ? */
1337         cfg = ds->phb->regs[PHB_PHB4_CONFIG >> 3];
1338         if ((cfg & PHB_PHB4C_32BIT_MSI_EN) &&
1339             ((addr & 0xffffffffffff0000ull) == 0xffff0000ull)) {
1340             phb_error(ds->phb, "xlate on 32-bit MSI region");
1341             return ret;
1342         }
1343         /* Choose TVE XXX Use PHB4 Control Register */
1344         tve_sel = (addr >> 59) & 1;
1345         tve = ds->phb->ioda_TVT[ds->pe_num * 2 + tve_sel];
1346         pnv_phb4_translate_tve(ds, addr, flag & IOMMU_WO, tve, &ret);
1347         break;
1348     case 01:
1349         phb_error(ds->phb, "xlate on 64-bit MSI region");
1350         break;
1351     default:
1352         phb_error(ds->phb, "xlate on unsupported address 0x%"PRIx64, addr);
1353     }
1354     return ret;
1355 }
1356 
1357 #define TYPE_PNV_PHB4_IOMMU_MEMORY_REGION "pnv-phb4-iommu-memory-region"
1358 DECLARE_INSTANCE_CHECKER(IOMMUMemoryRegion, PNV_PHB4_IOMMU_MEMORY_REGION,
1359                          TYPE_PNV_PHB4_IOMMU_MEMORY_REGION)
1360 
1361 static void pnv_phb4_iommu_memory_region_class_init(ObjectClass *klass,
1362                                                     void *data)
1363 {
1364     IOMMUMemoryRegionClass *imrc = IOMMU_MEMORY_REGION_CLASS(klass);
1365 
1366     imrc->translate = pnv_phb4_translate_iommu;
1367 }
1368 
1369 static const TypeInfo pnv_phb4_iommu_memory_region_info = {
1370     .parent = TYPE_IOMMU_MEMORY_REGION,
1371     .name = TYPE_PNV_PHB4_IOMMU_MEMORY_REGION,
1372     .class_init = pnv_phb4_iommu_memory_region_class_init,
1373 };
1374 
1375 /*
1376  * Return the index/phb-id of a PHB4 that belongs to a
1377  * pec->stacks[stack_index] stack.
1378  */
1379 int pnv_phb4_pec_get_phb_id(PnvPhb4PecState *pec, int stack_index)
1380 {
1381     PnvPhb4PecClass *pecc = PNV_PHB4_PEC_GET_CLASS(pec);
1382     int index = pec->index;
1383     int offset = 0;
1384 
1385     while (index--) {
1386         offset += pecc->num_phbs[index];
1387     }
1388 
1389     return offset + stack_index;
1390 }
1391 
1392 /*
1393  * MSI/MSIX memory region implementation.
1394  * The handler handles both MSI and MSIX.
1395  */
1396 static void pnv_phb4_msi_write(void *opaque, hwaddr addr,
1397                                uint64_t data, unsigned size)
1398 {
1399     PnvPhb4DMASpace *ds = opaque;
1400     PnvPHB4 *phb = ds->phb;
1401 
1402     uint32_t src = ((addr >> 4) & 0xffff) | (data & 0x1f);
1403 
1404     /* Resolve PE# */
1405     if (!pnv_phb4_resolve_pe(ds)) {
1406         phb_error(phb, "Failed to resolve PE# for bus @%p (%d) devfn 0x%x",
1407                    ds->bus, pci_bus_num(ds->bus), ds->devfn);
1408         return;
1409     }
1410 
1411     /* TODO: Check it doesn't collide with LSIs */
1412     if (src >= phb->xsrc.nr_irqs) {
1413         phb_error(phb, "MSI %d out of bounds", src);
1414         return;
1415     }
1416 
1417     /* TODO: check PE/MSI assignement */
1418 
1419     qemu_irq_pulse(phb->qirqs[src]);
1420 }
1421 
1422 /* There is no .read as the read result is undefined by PCI spec */
1423 static uint64_t pnv_phb4_msi_read(void *opaque, hwaddr addr, unsigned size)
1424 {
1425     PnvPhb4DMASpace *ds = opaque;
1426 
1427     phb_error(ds->phb, "Invalid MSI read @ 0x%" HWADDR_PRIx, addr);
1428     return -1;
1429 }
1430 
1431 static const MemoryRegionOps pnv_phb4_msi_ops = {
1432     .read = pnv_phb4_msi_read,
1433     .write = pnv_phb4_msi_write,
1434     .endianness = DEVICE_LITTLE_ENDIAN
1435 };
1436 
1437 static PnvPhb4DMASpace *pnv_phb4_dma_find(PnvPHB4 *phb, PCIBus *bus, int devfn)
1438 {
1439     PnvPhb4DMASpace *ds;
1440 
1441     QLIST_FOREACH(ds, &phb->dma_spaces, list) {
1442         if (ds->bus == bus && ds->devfn == devfn) {
1443             break;
1444         }
1445     }
1446     return ds;
1447 }
1448 
1449 static AddressSpace *pnv_phb4_dma_iommu(PCIBus *bus, void *opaque, int devfn)
1450 {
1451     PnvPHB4 *phb = opaque;
1452     PnvPhb4DMASpace *ds;
1453     char name[32];
1454 
1455     ds = pnv_phb4_dma_find(phb, bus, devfn);
1456 
1457     if (ds == NULL) {
1458         ds = g_malloc0(sizeof(PnvPhb4DMASpace));
1459         ds->bus = bus;
1460         ds->devfn = devfn;
1461         ds->pe_num = PHB_INVALID_PE;
1462         ds->phb = phb;
1463         snprintf(name, sizeof(name), "phb4-%d.%d-iommu", phb->chip_id,
1464                  phb->phb_id);
1465         memory_region_init_iommu(&ds->dma_mr, sizeof(ds->dma_mr),
1466                                  TYPE_PNV_PHB4_IOMMU_MEMORY_REGION,
1467                                  OBJECT(phb), name, UINT64_MAX);
1468         address_space_init(&ds->dma_as, MEMORY_REGION(&ds->dma_mr),
1469                            name);
1470         memory_region_init_io(&ds->msi32_mr, OBJECT(phb), &pnv_phb4_msi_ops,
1471                               ds, "msi32", 0x10000);
1472         memory_region_init_io(&ds->msi64_mr, OBJECT(phb), &pnv_phb4_msi_ops,
1473                               ds, "msi64", 0x100000);
1474         pnv_phb4_update_msi_regions(ds);
1475 
1476         QLIST_INSERT_HEAD(&phb->dma_spaces, ds, list);
1477     }
1478     return &ds->dma_as;
1479 }
1480 
1481 static void pnv_phb4_xscom_realize(PnvPHB4 *phb)
1482 {
1483     PnvPhb4PecState *pec = phb->pec;
1484     PnvPhb4PecClass *pecc = PNV_PHB4_PEC_GET_CLASS(pec);
1485     int stack_no = pnv_phb4_get_phb_stack_no(phb);
1486     uint32_t pec_nest_base;
1487     uint32_t pec_pci_base;
1488     char name[64];
1489 
1490     assert(pec);
1491 
1492     /* Initialize the XSCOM regions for the stack registers */
1493     snprintf(name, sizeof(name), "xscom-pec-%d.%d-nest-phb-%d",
1494              pec->chip_id, pec->index, stack_no);
1495     pnv_xscom_region_init(&phb->nest_regs_mr, OBJECT(phb),
1496                           &pnv_pec_stk_nest_xscom_ops, phb, name,
1497                           PHB4_PEC_NEST_STK_REGS_COUNT);
1498 
1499     snprintf(name, sizeof(name), "xscom-pec-%d.%d-pci-phb-%d",
1500              pec->chip_id, pec->index, stack_no);
1501     pnv_xscom_region_init(&phb->pci_regs_mr, OBJECT(phb),
1502                           &pnv_pec_stk_pci_xscom_ops, phb, name,
1503                           PHB4_PEC_PCI_STK_REGS_COUNT);
1504 
1505     /* PHB pass-through */
1506     snprintf(name, sizeof(name), "xscom-pec-%d.%d-pci-phb-%d",
1507              pec->chip_id, pec->index, stack_no);
1508     pnv_xscom_region_init(&phb->phb_regs_mr, OBJECT(phb),
1509                           &pnv_phb4_xscom_ops, phb, name, 0x40);
1510 
1511     pec_nest_base = pecc->xscom_nest_base(pec);
1512     pec_pci_base = pecc->xscom_pci_base(pec);
1513 
1514     /* Populate the XSCOM address space. */
1515     pnv_xscom_add_subregion(pec->chip,
1516                             pec_nest_base + 0x40 * (stack_no + 1),
1517                             &phb->nest_regs_mr);
1518     pnv_xscom_add_subregion(pec->chip,
1519                             pec_pci_base + 0x40 * (stack_no + 1),
1520                             &phb->pci_regs_mr);
1521     pnv_xscom_add_subregion(pec->chip,
1522                             pec_pci_base + PNV9_XSCOM_PEC_PCI_STK0 +
1523                             0x40 * stack_no,
1524                             &phb->phb_regs_mr);
1525 }
1526 
1527 static void pnv_phb4_instance_init(Object *obj)
1528 {
1529     PnvPHB4 *phb = PNV_PHB4(obj);
1530 
1531     QLIST_INIT(&phb->dma_spaces);
1532 
1533     /* XIVE interrupt source object */
1534     object_initialize_child(obj, "source", &phb->xsrc, TYPE_XIVE_SOURCE);
1535 }
1536 
1537 static PnvPhb4PecState *pnv_phb4_get_pec(PnvChip *chip, PnvPHB4 *phb,
1538                                          Error **errp)
1539 {
1540     Pnv9Chip *chip9 = PNV9_CHIP(chip);
1541     int chip_id = phb->chip_id;
1542     int index = phb->phb_id;
1543     int i, j;
1544 
1545     for (i = 0; i < chip->num_pecs; i++) {
1546         /*
1547          * For each PEC, check the amount of phbs it supports
1548          * and see if the given phb4 index matches an index.
1549          */
1550         PnvPhb4PecState *pec = &chip9->pecs[i];
1551 
1552         for (j = 0; j < pec->num_phbs; j++) {
1553             if (index == pnv_phb4_pec_get_phb_id(pec, j)) {
1554                 return pec;
1555             }
1556         }
1557     }
1558 
1559     error_setg(errp,
1560                "pnv-phb4 chip-id %d index %d didn't match any existing PEC",
1561                chip_id, index);
1562 
1563     return NULL;
1564 }
1565 
1566 static void pnv_phb4_realize(DeviceState *dev, Error **errp)
1567 {
1568     PnvPHB4 *phb = PNV_PHB4(dev);
1569     PCIHostState *pci = PCI_HOST_BRIDGE(dev);
1570     XiveSource *xsrc = &phb->xsrc;
1571     Error *local_err = NULL;
1572     int nr_irqs;
1573     char name[32];
1574 
1575     /* User created PHB */
1576     if (!phb->pec) {
1577         PnvMachineState *pnv = PNV_MACHINE(qdev_get_machine());
1578         PnvChip *chip = pnv_get_chip(pnv, phb->chip_id);
1579         PnvPhb4PecClass *pecc;
1580         BusState *s;
1581 
1582         if (!chip) {
1583             error_setg(errp, "invalid chip id: %d", phb->chip_id);
1584             return;
1585         }
1586 
1587         phb->pec = pnv_phb4_get_pec(chip, phb, &local_err);
1588         if (local_err) {
1589             error_propagate(errp, local_err);
1590             return;
1591         }
1592 
1593         /* All other phb properties are already set */
1594         pecc = PNV_PHB4_PEC_GET_CLASS(phb->pec);
1595         object_property_set_int(OBJECT(phb), "version", pecc->version,
1596                                 &error_fatal);
1597 
1598         /*
1599          * Reparent user created devices to the chip to build
1600          * correctly the device tree.
1601          */
1602         pnv_chip_parent_fixup(chip, OBJECT(phb), phb->phb_id);
1603 
1604         s = qdev_get_parent_bus(DEVICE(chip));
1605         if (!qdev_set_parent_bus(DEVICE(phb), s, &local_err)) {
1606             error_propagate(errp, local_err);
1607             return;
1608         }
1609     }
1610 
1611     /* Set the "big_phb" flag */
1612     phb->big_phb = phb->phb_id == 0 || phb->phb_id == 3;
1613 
1614     /* Controller Registers */
1615     snprintf(name, sizeof(name), "phb4-%d.%d-regs", phb->chip_id,
1616              phb->phb_id);
1617     memory_region_init_io(&phb->mr_regs, OBJECT(phb), &pnv_phb4_reg_ops, phb,
1618                           name, 0x2000);
1619 
1620     /*
1621      * PHB4 doesn't support IO space. However, qemu gets very upset if
1622      * we don't have an IO region to anchor IO BARs onto so we just
1623      * initialize one which we never hook up to anything
1624      */
1625 
1626     snprintf(name, sizeof(name), "phb4-%d.%d-pci-io", phb->chip_id,
1627              phb->phb_id);
1628     memory_region_init(&phb->pci_io, OBJECT(phb), name, 0x10000);
1629 
1630     snprintf(name, sizeof(name), "phb4-%d.%d-pci-mmio", phb->chip_id,
1631              phb->phb_id);
1632     memory_region_init(&phb->pci_mmio, OBJECT(phb), name,
1633                        PCI_MMIO_TOTAL_SIZE);
1634 
1635     pci->bus = pci_register_root_bus(dev, dev->id,
1636                                      pnv_phb4_set_irq, pnv_phb4_map_irq, phb,
1637                                      &phb->pci_mmio, &phb->pci_io,
1638                                      0, 4, TYPE_PNV_PHB4_ROOT_BUS);
1639     pci_setup_iommu(pci->bus, pnv_phb4_dma_iommu, phb);
1640     pci->bus->flags |= PCI_BUS_EXTENDED_CONFIG_SPACE;
1641 
1642     /* Add a single Root port if running with defaults */
1643     if (defaults_enabled()) {
1644         pnv_phb_attach_root_port(PCI_HOST_BRIDGE(phb),
1645                                  TYPE_PNV_PHB4_ROOT_PORT);
1646     }
1647 
1648     /* Setup XIVE Source */
1649     if (phb->big_phb) {
1650         nr_irqs = PNV_PHB4_MAX_INTs;
1651     } else {
1652         nr_irqs = PNV_PHB4_MAX_INTs >> 1;
1653     }
1654     object_property_set_int(OBJECT(xsrc), "nr-irqs", nr_irqs, &error_fatal);
1655     object_property_set_link(OBJECT(xsrc), "xive", OBJECT(phb), &error_fatal);
1656     if (!qdev_realize(DEVICE(xsrc), NULL, errp)) {
1657         return;
1658     }
1659 
1660     pnv_phb4_update_xsrc(phb);
1661 
1662     phb->qirqs = qemu_allocate_irqs(xive_source_set_irq, xsrc, xsrc->nr_irqs);
1663 
1664     pnv_phb4_xscom_realize(phb);
1665 }
1666 
1667 static const char *pnv_phb4_root_bus_path(PCIHostState *host_bridge,
1668                                           PCIBus *rootbus)
1669 {
1670     PnvPHB4 *phb = PNV_PHB4(host_bridge);
1671 
1672     snprintf(phb->bus_path, sizeof(phb->bus_path), "00%02x:%02x",
1673              phb->chip_id, phb->phb_id);
1674     return phb->bus_path;
1675 }
1676 
1677 static void pnv_phb4_xive_notify(XiveNotifier *xf, uint32_t srcno)
1678 {
1679     PnvPHB4 *phb = PNV_PHB4(xf);
1680     uint64_t notif_port = phb->regs[PHB_INT_NOTIFY_ADDR >> 3];
1681     uint32_t offset = phb->regs[PHB_INT_NOTIFY_INDEX >> 3];
1682     uint64_t data = XIVE_TRIGGER_PQ | offset | srcno;
1683     MemTxResult result;
1684 
1685     trace_pnv_phb4_xive_notify(notif_port, data);
1686 
1687     address_space_stq_be(&address_space_memory, notif_port, data,
1688                          MEMTXATTRS_UNSPECIFIED, &result);
1689     if (result != MEMTX_OK) {
1690         phb_error(phb, "trigger failed @%"HWADDR_PRIx "\n", notif_port);
1691         return;
1692     }
1693 }
1694 
1695 static Property pnv_phb4_properties[] = {
1696         DEFINE_PROP_UINT32("index", PnvPHB4, phb_id, 0),
1697         DEFINE_PROP_UINT32("chip-id", PnvPHB4, chip_id, 0),
1698         DEFINE_PROP_UINT64("version", PnvPHB4, version, 0),
1699         DEFINE_PROP_LINK("pec", PnvPHB4, pec, TYPE_PNV_PHB4_PEC,
1700                          PnvPhb4PecState *),
1701         DEFINE_PROP_END_OF_LIST(),
1702 };
1703 
1704 static void pnv_phb4_class_init(ObjectClass *klass, void *data)
1705 {
1706     PCIHostBridgeClass *hc = PCI_HOST_BRIDGE_CLASS(klass);
1707     DeviceClass *dc = DEVICE_CLASS(klass);
1708     XiveNotifierClass *xfc = XIVE_NOTIFIER_CLASS(klass);
1709 
1710     hc->root_bus_path   = pnv_phb4_root_bus_path;
1711     dc->realize         = pnv_phb4_realize;
1712     device_class_set_props(dc, pnv_phb4_properties);
1713     set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
1714     dc->user_creatable  = true;
1715 
1716     xfc->notify         = pnv_phb4_xive_notify;
1717 }
1718 
1719 static const TypeInfo pnv_phb4_type_info = {
1720     .name          = TYPE_PNV_PHB4,
1721     .parent        = TYPE_PCIE_HOST_BRIDGE,
1722     .instance_init = pnv_phb4_instance_init,
1723     .instance_size = sizeof(PnvPHB4),
1724     .class_init    = pnv_phb4_class_init,
1725     .interfaces = (InterfaceInfo[]) {
1726             { TYPE_XIVE_NOTIFIER },
1727             { },
1728     }
1729 };
1730 
1731 static void pnv_phb4_root_bus_class_init(ObjectClass *klass, void *data)
1732 {
1733     BusClass *k = BUS_CLASS(klass);
1734 
1735     /*
1736      * PHB4 has only a single root complex. Enforce the limit on the
1737      * parent bus
1738      */
1739     k->max_dev = 1;
1740 }
1741 
1742 static const TypeInfo pnv_phb4_root_bus_info = {
1743     .name = TYPE_PNV_PHB4_ROOT_BUS,
1744     .parent = TYPE_PCIE_BUS,
1745     .class_init = pnv_phb4_root_bus_class_init,
1746     .interfaces = (InterfaceInfo[]) {
1747         { INTERFACE_PCIE_DEVICE },
1748         { }
1749     },
1750 };
1751 
1752 static void pnv_phb4_root_port_reset(DeviceState *dev)
1753 {
1754     PCIERootPortClass *rpc = PCIE_ROOT_PORT_GET_CLASS(dev);
1755     PCIDevice *d = PCI_DEVICE(dev);
1756     uint8_t *conf = d->config;
1757 
1758     rpc->parent_reset(dev);
1759 
1760     pci_byte_test_and_set_mask(conf + PCI_IO_BASE,
1761                                PCI_IO_RANGE_MASK & 0xff);
1762     pci_byte_test_and_clear_mask(conf + PCI_IO_LIMIT,
1763                                  PCI_IO_RANGE_MASK & 0xff);
1764     pci_set_word(conf + PCI_MEMORY_BASE, 0);
1765     pci_set_word(conf + PCI_MEMORY_LIMIT, 0xfff0);
1766     pci_set_word(conf + PCI_PREF_MEMORY_BASE, 0x1);
1767     pci_set_word(conf + PCI_PREF_MEMORY_LIMIT, 0xfff1);
1768     pci_set_long(conf + PCI_PREF_BASE_UPPER32, 0x1); /* Hack */
1769     pci_set_long(conf + PCI_PREF_LIMIT_UPPER32, 0xffffffff);
1770 }
1771 
1772 static void pnv_phb4_root_port_realize(DeviceState *dev, Error **errp)
1773 {
1774     PCIERootPortClass *rpc = PCIE_ROOT_PORT_GET_CLASS(dev);
1775     PCIDevice *pci = PCI_DEVICE(dev);
1776     PCIBus *bus = pci_get_bus(pci);
1777     PnvPHB4 *phb = NULL;
1778     Error *local_err = NULL;
1779 
1780     phb = (PnvPHB4 *) object_dynamic_cast(OBJECT(bus->qbus.parent),
1781                                           TYPE_PNV_PHB4);
1782 
1783     if (!phb) {
1784         error_setg(errp, "%s must be connected to pnv-phb4 buses", dev->id);
1785         return;
1786     }
1787 
1788     /* Set unique chassis/slot values for the root port */
1789     qdev_prop_set_uint8(&pci->qdev, "chassis", phb->chip_id);
1790     qdev_prop_set_uint16(&pci->qdev, "slot", phb->phb_id);
1791 
1792     rpc->parent_realize(dev, &local_err);
1793     if (local_err) {
1794         error_propagate(errp, local_err);
1795         return;
1796     }
1797 }
1798 
1799 static void pnv_phb4_root_port_class_init(ObjectClass *klass, void *data)
1800 {
1801     DeviceClass *dc = DEVICE_CLASS(klass);
1802     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
1803     PCIERootPortClass *rpc = PCIE_ROOT_PORT_CLASS(klass);
1804 
1805     dc->desc     = "IBM PHB4 PCIE Root Port";
1806     dc->user_creatable = true;
1807 
1808     device_class_set_parent_realize(dc, pnv_phb4_root_port_realize,
1809                                     &rpc->parent_realize);
1810     device_class_set_parent_reset(dc, pnv_phb4_root_port_reset,
1811                                   &rpc->parent_reset);
1812 
1813     k->vendor_id = PCI_VENDOR_ID_IBM;
1814     k->device_id = PNV_PHB4_DEVICE_ID;
1815     k->revision  = 0;
1816 
1817     rpc->exp_offset = 0x48;
1818     rpc->aer_offset = 0x100;
1819 
1820     dc->reset = &pnv_phb4_root_port_reset;
1821 }
1822 
1823 static const TypeInfo pnv_phb4_root_port_info = {
1824     .name          = TYPE_PNV_PHB4_ROOT_PORT,
1825     .parent        = TYPE_PCIE_ROOT_PORT,
1826     .instance_size = sizeof(PnvPHB4RootPort),
1827     .class_init    = pnv_phb4_root_port_class_init,
1828 };
1829 
1830 static void pnv_phb4_register_types(void)
1831 {
1832     type_register_static(&pnv_phb4_root_bus_info);
1833     type_register_static(&pnv_phb4_root_port_info);
1834     type_register_static(&pnv_phb4_type_info);
1835     type_register_static(&pnv_phb4_iommu_memory_region_info);
1836 }
1837 
1838 type_init(pnv_phb4_register_types);
1839 
1840 void pnv_phb4_pic_print_info(PnvPHB4 *phb, Monitor *mon)
1841 {
1842     uint32_t offset = phb->regs[PHB_INT_NOTIFY_INDEX >> 3];
1843 
1844     monitor_printf(mon, "PHB4[%x:%x] Source %08x .. %08x\n",
1845                    phb->chip_id, phb->phb_id,
1846                    offset, offset + phb->xsrc.nr_irqs - 1);
1847     xive_source_pic_print_info(&phb->xsrc, 0, mon);
1848 }
1849