xref: /openbmc/qemu/hw/pci-host/pnv_phb4.c (revision 6fdc5bc1)
1 /*
2  * QEMU PowerPC PowerNV (POWER9) PHB4 model
3  *
4  * Copyright (c) 2018-2020, IBM Corporation.
5  *
6  * This code is licensed under the GPL version 2 or later. See the
7  * COPYING file in the top-level directory.
8  */
9 #include "qemu/osdep.h"
10 #include "qemu/log.h"
11 #include "qapi/visitor.h"
12 #include "qapi/error.h"
13 #include "target/ppc/cpu.h"
14 #include "hw/pci-host/pnv_phb4_regs.h"
15 #include "hw/pci-host/pnv_phb4.h"
16 #include "hw/pci/pcie_host.h"
17 #include "hw/pci/pcie_port.h"
18 #include "hw/ppc/pnv.h"
19 #include "hw/ppc/pnv_xscom.h"
20 #include "hw/irq.h"
21 #include "hw/qdev-properties.h"
22 #include "qom/object.h"
23 #include "trace.h"
24 
25 #define phb_error(phb, fmt, ...)                                        \
26     qemu_log_mask(LOG_GUEST_ERROR, "phb4[%d:%d]: " fmt "\n",            \
27                   (phb)->chip_id, (phb)->phb_id, ## __VA_ARGS__)
28 
29 #define phb_pec_error(pec, fmt, ...)                                    \
30     qemu_log_mask(LOG_GUEST_ERROR, "phb4_pec[%d:%d]: " fmt "\n",        \
31                   (pec)->chip_id, (pec)->index, ## __VA_ARGS__)
32 
33 static PCIDevice *pnv_phb4_find_cfg_dev(PnvPHB4 *phb)
34 {
35     PCIHostState *pci = PCI_HOST_BRIDGE(phb->phb_base);
36     uint64_t addr = phb->regs[PHB_CONFIG_ADDRESS >> 3];
37     uint8_t bus, devfn;
38 
39     if (!(addr >> 63)) {
40         return NULL;
41     }
42     bus = (addr >> 52) & 0xff;
43     devfn = (addr >> 44) & 0xff;
44 
45     /* We don't access the root complex this way */
46     if (bus == 0 && devfn == 0) {
47         return NULL;
48     }
49     return pci_find_device(pci->bus, bus, devfn);
50 }
51 
52 /*
53  * The CONFIG_DATA register expects little endian accesses, but as the
54  * region is big endian, we have to swap the value.
55  */
56 static void pnv_phb4_config_write(PnvPHB4 *phb, unsigned off,
57                                   unsigned size, uint64_t val)
58 {
59     uint32_t cfg_addr, limit;
60     PCIDevice *pdev;
61 
62     pdev = pnv_phb4_find_cfg_dev(phb);
63     if (!pdev) {
64         return;
65     }
66     cfg_addr = (phb->regs[PHB_CONFIG_ADDRESS >> 3] >> 32) & 0xffc;
67     cfg_addr |= off;
68     limit = pci_config_size(pdev);
69     if (limit <= cfg_addr) {
70         /*
71          * conventional pci device can be behind pcie-to-pci bridge.
72          * 256 <= addr < 4K has no effects.
73          */
74         return;
75     }
76     switch (size) {
77     case 1:
78         break;
79     case 2:
80         val = bswap16(val);
81         break;
82     case 4:
83         val = bswap32(val);
84         break;
85     default:
86         g_assert_not_reached();
87     }
88     pci_host_config_write_common(pdev, cfg_addr, limit, val, size);
89 }
90 
91 static uint64_t pnv_phb4_config_read(PnvPHB4 *phb, unsigned off,
92                                      unsigned size)
93 {
94     uint32_t cfg_addr, limit;
95     PCIDevice *pdev;
96     uint64_t val;
97 
98     pdev = pnv_phb4_find_cfg_dev(phb);
99     if (!pdev) {
100         return ~0ull;
101     }
102     cfg_addr = (phb->regs[PHB_CONFIG_ADDRESS >> 3] >> 32) & 0xffc;
103     cfg_addr |= off;
104     limit = pci_config_size(pdev);
105     if (limit <= cfg_addr) {
106         /*
107          * conventional pci device can be behind pcie-to-pci bridge.
108          * 256 <= addr < 4K has no effects.
109          */
110         return ~0ull;
111     }
112     val = pci_host_config_read_common(pdev, cfg_addr, limit, size);
113     switch (size) {
114     case 1:
115         return val;
116     case 2:
117         return bswap16(val);
118     case 4:
119         return bswap32(val);
120     default:
121         g_assert_not_reached();
122     }
123 }
124 
125 /*
126  * Root complex register accesses are memory mapped.
127  */
128 static void pnv_phb4_rc_config_write(PnvPHB4 *phb, unsigned off,
129                                      unsigned size, uint64_t val)
130 {
131     PCIHostState *pci = PCI_HOST_BRIDGE(phb->phb_base);
132     PCIDevice *pdev;
133 
134     if (size != 4) {
135         phb_error(phb, "rc_config_write invalid size %d", size);
136         return;
137     }
138 
139     pdev = pci_find_device(pci->bus, 0, 0);
140     if (!pdev) {
141         phb_error(phb, "rc_config_write device not found");
142         return;
143     }
144 
145     pci_host_config_write_common(pdev, off, PHB_RC_CONFIG_SIZE,
146                                  bswap32(val), 4);
147 }
148 
149 static uint64_t pnv_phb4_rc_config_read(PnvPHB4 *phb, unsigned off,
150                                         unsigned size)
151 {
152     PCIHostState *pci = PCI_HOST_BRIDGE(phb->phb_base);
153     PCIDevice *pdev;
154     uint64_t val;
155 
156     if (size != 4) {
157         phb_error(phb, "rc_config_read invalid size %d", size);
158         return ~0ull;
159     }
160 
161     pdev = pci_find_device(pci->bus, 0, 0);
162     if (!pdev) {
163         phb_error(phb, "rc_config_read device not found");
164         return ~0ull;
165     }
166 
167     val = pci_host_config_read_common(pdev, off, PHB_RC_CONFIG_SIZE, 4);
168     return bswap32(val);
169 }
170 
171 static void pnv_phb4_check_mbt(PnvPHB4 *phb, uint32_t index)
172 {
173     uint64_t base, start, size, mbe0, mbe1;
174     MemoryRegion *parent;
175     char name[64];
176 
177     /* Unmap first */
178     if (memory_region_is_mapped(&phb->mr_mmio[index])) {
179         /* Should we destroy it in RCU friendly way... ? */
180         memory_region_del_subregion(phb->mr_mmio[index].container,
181                                     &phb->mr_mmio[index]);
182     }
183 
184     /* Get table entry */
185     mbe0 = phb->ioda_MBT[(index << 1)];
186     mbe1 = phb->ioda_MBT[(index << 1) + 1];
187 
188     if (!(mbe0 & IODA3_MBT0_ENABLE)) {
189         return;
190     }
191 
192     /* Grab geometry from registers */
193     base = GETFIELD(IODA3_MBT0_BASE_ADDR, mbe0) << 12;
194     size = GETFIELD(IODA3_MBT1_MASK, mbe1) << 12;
195     size |= 0xff00000000000000ull;
196     size = ~size + 1;
197 
198     /* Calculate PCI side start address based on M32/M64 window type */
199     if (mbe0 & IODA3_MBT0_TYPE_M32) {
200         start = phb->regs[PHB_M32_START_ADDR >> 3];
201         if ((start + size) > 0x100000000ull) {
202             phb_error(phb, "M32 set beyond 4GB boundary !");
203             size = 0x100000000 - start;
204         }
205     } else {
206         start = base | (phb->regs[PHB_M64_UPPER_BITS >> 3]);
207     }
208 
209     /* TODO: Figure out how to implement/decode AOMASK */
210 
211     /* Check if it matches an enabled MMIO region in the PEC stack */
212     if (memory_region_is_mapped(&phb->mmbar0) &&
213         base >= phb->mmio0_base &&
214         (base + size) <= (phb->mmio0_base + phb->mmio0_size)) {
215         parent = &phb->mmbar0;
216         base -= phb->mmio0_base;
217     } else if (memory_region_is_mapped(&phb->mmbar1) &&
218         base >= phb->mmio1_base &&
219         (base + size) <= (phb->mmio1_base + phb->mmio1_size)) {
220         parent = &phb->mmbar1;
221         base -= phb->mmio1_base;
222     } else {
223         phb_error(phb, "PHB MBAR %d out of parent bounds", index);
224         return;
225     }
226 
227     /* Create alias (better name ?) */
228     snprintf(name, sizeof(name), "phb4-mbar%d", index);
229     memory_region_init_alias(&phb->mr_mmio[index], OBJECT(phb), name,
230                              &phb->pci_mmio, start, size);
231     memory_region_add_subregion(parent, base, &phb->mr_mmio[index]);
232 }
233 
234 static void pnv_phb4_check_all_mbt(PnvPHB4 *phb)
235 {
236     uint64_t i;
237     uint32_t num_windows = phb->big_phb ? PNV_PHB4_MAX_MMIO_WINDOWS :
238         PNV_PHB4_MIN_MMIO_WINDOWS;
239 
240     for (i = 0; i < num_windows; i++) {
241         pnv_phb4_check_mbt(phb, i);
242     }
243 }
244 
245 static uint64_t *pnv_phb4_ioda_access(PnvPHB4 *phb,
246                                       unsigned *out_table, unsigned *out_idx)
247 {
248     uint64_t adreg = phb->regs[PHB_IODA_ADDR >> 3];
249     unsigned int index = GETFIELD(PHB_IODA_AD_TADR, adreg);
250     unsigned int table = GETFIELD(PHB_IODA_AD_TSEL, adreg);
251     unsigned int mask;
252     uint64_t *tptr = NULL;
253 
254     switch (table) {
255     case IODA3_TBL_LIST:
256         tptr = phb->ioda_LIST;
257         mask = 7;
258         break;
259     case IODA3_TBL_MIST:
260         tptr = phb->ioda_MIST;
261         mask = phb->big_phb ? PNV_PHB4_MAX_MIST : (PNV_PHB4_MAX_MIST >> 1);
262         mask -= 1;
263         break;
264     case IODA3_TBL_RCAM:
265         mask = phb->big_phb ? 127 : 63;
266         break;
267     case IODA3_TBL_MRT:
268         mask = phb->big_phb ? 15 : 7;
269         break;
270     case IODA3_TBL_PESTA:
271     case IODA3_TBL_PESTB:
272         mask = phb->big_phb ? PNV_PHB4_MAX_PEs : (PNV_PHB4_MAX_PEs >> 1);
273         mask -= 1;
274         break;
275     case IODA3_TBL_TVT:
276         tptr = phb->ioda_TVT;
277         mask = phb->big_phb ? PNV_PHB4_MAX_TVEs : (PNV_PHB4_MAX_TVEs >> 1);
278         mask -= 1;
279         break;
280     case IODA3_TBL_TCR:
281     case IODA3_TBL_TDR:
282         mask = phb->big_phb ? 1023 : 511;
283         break;
284     case IODA3_TBL_MBT:
285         tptr = phb->ioda_MBT;
286         mask = phb->big_phb ? PNV_PHB4_MAX_MBEs : (PNV_PHB4_MAX_MBEs >> 1);
287         mask -= 1;
288         break;
289     case IODA3_TBL_MDT:
290         tptr = phb->ioda_MDT;
291         mask = phb->big_phb ? PNV_PHB4_MAX_PEs : (PNV_PHB4_MAX_PEs >> 1);
292         mask -= 1;
293         break;
294     case IODA3_TBL_PEEV:
295         tptr = phb->ioda_PEEV;
296         mask = phb->big_phb ? PNV_PHB4_MAX_PEEVs : (PNV_PHB4_MAX_PEEVs >> 1);
297         mask -= 1;
298         break;
299     default:
300         phb_error(phb, "invalid IODA table %d", table);
301         return NULL;
302     }
303     index &= mask;
304     if (out_idx) {
305         *out_idx = index;
306     }
307     if (out_table) {
308         *out_table = table;
309     }
310     if (tptr) {
311         tptr += index;
312     }
313     if (adreg & PHB_IODA_AD_AUTOINC) {
314         index = (index + 1) & mask;
315         adreg = SETFIELD(PHB_IODA_AD_TADR, adreg, index);
316     }
317 
318     phb->regs[PHB_IODA_ADDR >> 3] = adreg;
319     return tptr;
320 }
321 
322 static uint64_t pnv_phb4_ioda_read(PnvPHB4 *phb)
323 {
324     unsigned table, idx;
325     uint64_t *tptr;
326 
327     tptr = pnv_phb4_ioda_access(phb, &table, &idx);
328     if (!tptr) {
329         /* Special PESTA case */
330         if (table == IODA3_TBL_PESTA) {
331             return ((uint64_t)(phb->ioda_PEST_AB[idx] & 1)) << 63;
332         } else if (table == IODA3_TBL_PESTB) {
333             return ((uint64_t)(phb->ioda_PEST_AB[idx] & 2)) << 62;
334         }
335         /* Return 0 on unsupported tables, not ff's */
336         return 0;
337     }
338     return *tptr;
339 }
340 
341 static void pnv_phb4_ioda_write(PnvPHB4 *phb, uint64_t val)
342 {
343     unsigned table, idx;
344     uint64_t *tptr;
345 
346     tptr = pnv_phb4_ioda_access(phb, &table, &idx);
347     if (!tptr) {
348         /* Special PESTA case */
349         if (table == IODA3_TBL_PESTA) {
350             phb->ioda_PEST_AB[idx] &= ~1;
351             phb->ioda_PEST_AB[idx] |= (val >> 63) & 1;
352         } else if (table == IODA3_TBL_PESTB) {
353             phb->ioda_PEST_AB[idx] &= ~2;
354             phb->ioda_PEST_AB[idx] |= (val >> 62) & 2;
355         }
356         return;
357     }
358 
359     /* Handle side effects */
360     switch (table) {
361     case IODA3_TBL_LIST:
362         break;
363     case IODA3_TBL_MIST: {
364         /* Special mask for MIST partial write */
365         uint64_t adreg = phb->regs[PHB_IODA_ADDR >> 3];
366         uint32_t mmask = GETFIELD(PHB_IODA_AD_MIST_PWV, adreg);
367         uint64_t v = *tptr;
368         if (mmask == 0) {
369             mmask = 0xf;
370         }
371         if (mmask & 8) {
372             v &= 0x0000ffffffffffffull;
373             v |= 0xcfff000000000000ull & val;
374         }
375         if (mmask & 4) {
376             v &= 0xffff0000ffffffffull;
377             v |= 0x0000cfff00000000ull & val;
378         }
379         if (mmask & 2) {
380             v &= 0xffffffff0000ffffull;
381             v |= 0x00000000cfff0000ull & val;
382         }
383         if (mmask & 1) {
384             v &= 0xffffffffffff0000ull;
385             v |= 0x000000000000cfffull & val;
386         }
387         *tptr = v;
388         break;
389     }
390     case IODA3_TBL_MBT:
391         *tptr = val;
392 
393         /* Copy across the valid bit to the other half */
394         phb->ioda_MBT[idx ^ 1] &= 0x7fffffffffffffffull;
395         phb->ioda_MBT[idx ^ 1] |= 0x8000000000000000ull & val;
396 
397         /* Update mappings */
398         pnv_phb4_check_mbt(phb, idx >> 1);
399         break;
400     default:
401         *tptr = val;
402     }
403 }
404 
405 static void pnv_phb4_rtc_invalidate(PnvPHB4 *phb, uint64_t val)
406 {
407     PnvPhb4DMASpace *ds;
408 
409     /* Always invalidate all for now ... */
410     QLIST_FOREACH(ds, &phb->dma_spaces, list) {
411         ds->pe_num = PHB_INVALID_PE;
412     }
413 }
414 
415 static void pnv_phb4_update_msi_regions(PnvPhb4DMASpace *ds)
416 {
417     uint64_t cfg = ds->phb->regs[PHB_PHB4_CONFIG >> 3];
418 
419     if (cfg & PHB_PHB4C_32BIT_MSI_EN) {
420         if (!memory_region_is_mapped(MEMORY_REGION(&ds->msi32_mr))) {
421             memory_region_add_subregion(MEMORY_REGION(&ds->dma_mr),
422                                         0xffff0000, &ds->msi32_mr);
423         }
424     } else {
425         if (memory_region_is_mapped(MEMORY_REGION(&ds->msi32_mr))) {
426             memory_region_del_subregion(MEMORY_REGION(&ds->dma_mr),
427                                         &ds->msi32_mr);
428         }
429     }
430 
431     if (cfg & PHB_PHB4C_64BIT_MSI_EN) {
432         if (!memory_region_is_mapped(MEMORY_REGION(&ds->msi64_mr))) {
433             memory_region_add_subregion(MEMORY_REGION(&ds->dma_mr),
434                                         (1ull << 60), &ds->msi64_mr);
435         }
436     } else {
437         if (memory_region_is_mapped(MEMORY_REGION(&ds->msi64_mr))) {
438             memory_region_del_subregion(MEMORY_REGION(&ds->dma_mr),
439                                         &ds->msi64_mr);
440         }
441     }
442 }
443 
444 static void pnv_phb4_update_all_msi_regions(PnvPHB4 *phb)
445 {
446     PnvPhb4DMASpace *ds;
447 
448     QLIST_FOREACH(ds, &phb->dma_spaces, list) {
449         pnv_phb4_update_msi_regions(ds);
450     }
451 }
452 
453 static void pnv_phb4_update_xsrc(PnvPHB4 *phb)
454 {
455     int shift, flags, i, lsi_base;
456     XiveSource *xsrc = &phb->xsrc;
457 
458     /* The XIVE source characteristics can be set at run time */
459     if (phb->regs[PHB_CTRLR >> 3] & PHB_CTRLR_IRQ_PGSZ_64K) {
460         shift = XIVE_ESB_64K;
461     } else {
462         shift = XIVE_ESB_4K;
463     }
464     if (phb->regs[PHB_CTRLR >> 3] & PHB_CTRLR_IRQ_STORE_EOI) {
465         flags = XIVE_SRC_STORE_EOI;
466     } else {
467         flags = 0;
468     }
469 
470     /*
471      * When the PQ disable configuration bit is set, the check on the
472      * PQ state bits is disabled on the PHB side (for MSI only) and it
473      * is performed on the IC side instead.
474      */
475     if (phb->regs[PHB_CTRLR >> 3] & PHB_CTRLR_IRQ_PQ_DISABLE) {
476         flags |= XIVE_SRC_PQ_DISABLE;
477     }
478 
479     phb->xsrc.esb_shift = shift;
480     phb->xsrc.esb_flags = flags;
481 
482     lsi_base = GETFIELD(PHB_LSI_SRC_ID, phb->regs[PHB_LSI_SOURCE_ID >> 3]);
483     lsi_base <<= 3;
484 
485     /* TODO: handle reset values of PHB_LSI_SRC_ID */
486     if (!lsi_base) {
487         return;
488     }
489 
490     /* TODO: need a xive_source_irq_reset_lsi() */
491     bitmap_zero(xsrc->lsi_map, xsrc->nr_irqs);
492 
493     for (i = 0; i < xsrc->nr_irqs; i++) {
494         bool msi = (i < lsi_base || i >= (lsi_base + 8));
495         if (!msi) {
496             xive_source_irq_set_lsi(xsrc, i);
497         }
498     }
499 }
500 
501 static void pnv_phb4_reg_write(void *opaque, hwaddr off, uint64_t val,
502                                unsigned size)
503 {
504     PnvPHB4 *phb = PNV_PHB4(opaque);
505     bool changed;
506 
507     /* Special case outbound configuration data */
508     if ((off & 0xfffc) == PHB_CONFIG_DATA) {
509         pnv_phb4_config_write(phb, off & 0x3, size, val);
510         return;
511     }
512 
513     /* Special case RC configuration space */
514     if ((off & 0xf800) == PHB_RC_CONFIG_BASE) {
515         pnv_phb4_rc_config_write(phb, off & 0x7ff, size, val);
516         return;
517     }
518 
519     /* Other registers are 64-bit only */
520     if (size != 8 || off & 0x7) {
521         phb_error(phb, "Invalid register access, offset: 0x%"PRIx64" size: %d",
522                    off, size);
523         return;
524     }
525 
526     /* Handle masking */
527     switch (off) {
528     case PHB_LSI_SOURCE_ID:
529         val &= PHB_LSI_SRC_ID;
530         break;
531     case PHB_M64_UPPER_BITS:
532         val &= 0xff00000000000000ull;
533         break;
534     /* TCE Kill */
535     case PHB_TCE_KILL:
536         /* Clear top 3 bits which HW does to indicate successful queuing */
537         val &= ~(PHB_TCE_KILL_ALL | PHB_TCE_KILL_PE | PHB_TCE_KILL_ONE);
538         break;
539     case PHB_Q_DMA_R:
540         /*
541          * This is enough logic to make SW happy but we aren't
542          * actually quiescing the DMAs
543          */
544         if (val & PHB_Q_DMA_R_AUTORESET) {
545             val = 0;
546         } else {
547             val &= PHB_Q_DMA_R_QUIESCE_DMA;
548         }
549         break;
550     /* LEM stuff */
551     case PHB_LEM_FIR_AND_MASK:
552         phb->regs[PHB_LEM_FIR_ACCUM >> 3] &= val;
553         return;
554     case PHB_LEM_FIR_OR_MASK:
555         phb->regs[PHB_LEM_FIR_ACCUM >> 3] |= val;
556         return;
557     case PHB_LEM_ERROR_AND_MASK:
558         phb->regs[PHB_LEM_ERROR_MASK >> 3] &= val;
559         return;
560     case PHB_LEM_ERROR_OR_MASK:
561         phb->regs[PHB_LEM_ERROR_MASK >> 3] |= val;
562         return;
563     case PHB_LEM_WOF:
564         val = 0;
565         break;
566     /* TODO: More regs ..., maybe create a table with masks... */
567 
568     /* Read only registers */
569     case PHB_CPU_LOADSTORE_STATUS:
570     case PHB_ETU_ERR_SUMMARY:
571     case PHB_PHB4_GEN_CAP:
572     case PHB_PHB4_TCE_CAP:
573     case PHB_PHB4_IRQ_CAP:
574     case PHB_PHB4_EEH_CAP:
575         return;
576     }
577 
578     /* Record whether it changed */
579     changed = phb->regs[off >> 3] != val;
580 
581     /* Store in register cache first */
582     phb->regs[off >> 3] = val;
583 
584     /* Handle side effects */
585     switch (off) {
586     case PHB_PHB4_CONFIG:
587         if (changed) {
588             pnv_phb4_update_all_msi_regions(phb);
589         }
590         break;
591     case PHB_M32_START_ADDR:
592     case PHB_M64_UPPER_BITS:
593         if (changed) {
594             pnv_phb4_check_all_mbt(phb);
595         }
596         break;
597 
598     /* IODA table accesses */
599     case PHB_IODA_DATA0:
600         pnv_phb4_ioda_write(phb, val);
601         break;
602 
603     /* RTC invalidation */
604     case PHB_RTC_INVALIDATE:
605         pnv_phb4_rtc_invalidate(phb, val);
606         break;
607 
608     /* PHB Control (Affects XIVE source) */
609     case PHB_CTRLR:
610     case PHB_LSI_SOURCE_ID:
611         pnv_phb4_update_xsrc(phb);
612         break;
613 
614     /* Silent simple writes */
615     case PHB_ASN_CMPM:
616     case PHB_CONFIG_ADDRESS:
617     case PHB_IODA_ADDR:
618     case PHB_TCE_KILL:
619     case PHB_TCE_SPEC_CTL:
620     case PHB_PEST_BAR:
621     case PHB_PELTV_BAR:
622     case PHB_RTT_BAR:
623     case PHB_LEM_FIR_ACCUM:
624     case PHB_LEM_ERROR_MASK:
625     case PHB_LEM_ACTION0:
626     case PHB_LEM_ACTION1:
627     case PHB_TCE_TAG_ENABLE:
628     case PHB_INT_NOTIFY_ADDR:
629     case PHB_INT_NOTIFY_INDEX:
630     case PHB_DMARD_SYNC:
631        break;
632 
633     /* Noise on anything else */
634     default:
635         qemu_log_mask(LOG_UNIMP, "phb4: reg_write 0x%"PRIx64"=%"PRIx64"\n",
636                       off, val);
637     }
638 }
639 
640 static uint64_t pnv_phb4_reg_read(void *opaque, hwaddr off, unsigned size)
641 {
642     PnvPHB4 *phb = PNV_PHB4(opaque);
643     uint64_t val;
644 
645     if ((off & 0xfffc) == PHB_CONFIG_DATA) {
646         return pnv_phb4_config_read(phb, off & 0x3, size);
647     }
648 
649     /* Special case RC configuration space */
650     if ((off & 0xf800) == PHB_RC_CONFIG_BASE) {
651         return pnv_phb4_rc_config_read(phb, off & 0x7ff, size);
652     }
653 
654     /* Other registers are 64-bit only */
655     if (size != 8 || off & 0x7) {
656         phb_error(phb, "Invalid register access, offset: 0x%"PRIx64" size: %d",
657                    off, size);
658         return ~0ull;
659     }
660 
661     /* Default read from cache */
662     val = phb->regs[off >> 3];
663 
664     switch (off) {
665     case PHB_VERSION:
666         return PNV_PHB4_PEC_GET_CLASS(phb->pec)->version;
667 
668         /* Read-only */
669     case PHB_PHB4_GEN_CAP:
670         return 0xe4b8000000000000ull;
671     case PHB_PHB4_TCE_CAP:
672         return phb->big_phb ? 0x4008440000000400ull : 0x2008440000000200ull;
673     case PHB_PHB4_IRQ_CAP:
674         return phb->big_phb ? 0x0800000000001000ull : 0x0800000000000800ull;
675     case PHB_PHB4_EEH_CAP:
676         return phb->big_phb ? 0x2000000000000000ull : 0x1000000000000000ull;
677 
678     /* IODA table accesses */
679     case PHB_IODA_DATA0:
680         return pnv_phb4_ioda_read(phb);
681 
682     /* Link training always appears trained */
683     case PHB_PCIE_DLP_TRAIN_CTL:
684         /* TODO: Do something sensible with speed ? */
685         return PHB_PCIE_DLP_INBAND_PRESENCE | PHB_PCIE_DLP_TL_LINKACT;
686 
687     /* DMA read sync: make it look like it's complete */
688     case PHB_DMARD_SYNC:
689         return PHB_DMARD_SYNC_COMPLETE;
690 
691     /* Silent simple reads */
692     case PHB_LSI_SOURCE_ID:
693     case PHB_CPU_LOADSTORE_STATUS:
694     case PHB_ASN_CMPM:
695     case PHB_PHB4_CONFIG:
696     case PHB_M32_START_ADDR:
697     case PHB_CONFIG_ADDRESS:
698     case PHB_IODA_ADDR:
699     case PHB_RTC_INVALIDATE:
700     case PHB_TCE_KILL:
701     case PHB_TCE_SPEC_CTL:
702     case PHB_PEST_BAR:
703     case PHB_PELTV_BAR:
704     case PHB_RTT_BAR:
705     case PHB_M64_UPPER_BITS:
706     case PHB_CTRLR:
707     case PHB_LEM_FIR_ACCUM:
708     case PHB_LEM_ERROR_MASK:
709     case PHB_LEM_ACTION0:
710     case PHB_LEM_ACTION1:
711     case PHB_TCE_TAG_ENABLE:
712     case PHB_INT_NOTIFY_ADDR:
713     case PHB_INT_NOTIFY_INDEX:
714     case PHB_Q_DMA_R:
715     case PHB_ETU_ERR_SUMMARY:
716         break;
717 
718     /* Noise on anything else */
719     default:
720         qemu_log_mask(LOG_UNIMP, "phb4: reg_read 0x%"PRIx64"=%"PRIx64"\n",
721                       off, val);
722     }
723     return val;
724 }
725 
726 static const MemoryRegionOps pnv_phb4_reg_ops = {
727     .read = pnv_phb4_reg_read,
728     .write = pnv_phb4_reg_write,
729     .valid.min_access_size = 1,
730     .valid.max_access_size = 8,
731     .impl.min_access_size = 1,
732     .impl.max_access_size = 8,
733     .endianness = DEVICE_BIG_ENDIAN,
734 };
735 
736 static uint64_t pnv_phb4_xscom_read(void *opaque, hwaddr addr, unsigned size)
737 {
738     PnvPHB4 *phb = PNV_PHB4(opaque);
739     uint32_t reg = addr >> 3;
740     uint64_t val;
741     hwaddr offset;
742 
743     switch (reg) {
744     case PHB_SCOM_HV_IND_ADDR:
745         return phb->scom_hv_ind_addr_reg;
746 
747     case PHB_SCOM_HV_IND_DATA:
748         if (!(phb->scom_hv_ind_addr_reg & PHB_SCOM_HV_IND_ADDR_VALID)) {
749             phb_error(phb, "Invalid indirect address");
750             return ~0ull;
751         }
752         size = (phb->scom_hv_ind_addr_reg & PHB_SCOM_HV_IND_ADDR_4B) ? 4 : 8;
753         offset = GETFIELD(PHB_SCOM_HV_IND_ADDR_ADDR, phb->scom_hv_ind_addr_reg);
754         val = pnv_phb4_reg_read(phb, offset, size);
755         if (phb->scom_hv_ind_addr_reg & PHB_SCOM_HV_IND_ADDR_AUTOINC) {
756             offset += size;
757             offset &= 0x3fff;
758             phb->scom_hv_ind_addr_reg = SETFIELD(PHB_SCOM_HV_IND_ADDR_ADDR,
759                                                  phb->scom_hv_ind_addr_reg,
760                                                  offset);
761         }
762         return val;
763     case PHB_SCOM_ETU_LEM_FIR:
764     case PHB_SCOM_ETU_LEM_FIR_AND:
765     case PHB_SCOM_ETU_LEM_FIR_OR:
766     case PHB_SCOM_ETU_LEM_FIR_MSK:
767     case PHB_SCOM_ETU_LEM_ERR_MSK_AND:
768     case PHB_SCOM_ETU_LEM_ERR_MSK_OR:
769     case PHB_SCOM_ETU_LEM_ACT0:
770     case PHB_SCOM_ETU_LEM_ACT1:
771     case PHB_SCOM_ETU_LEM_WOF:
772         offset = ((reg - PHB_SCOM_ETU_LEM_FIR) << 3) + PHB_LEM_FIR_ACCUM;
773         return pnv_phb4_reg_read(phb, offset, size);
774     case PHB_SCOM_ETU_PMON_CONFIG:
775     case PHB_SCOM_ETU_PMON_CTR0:
776     case PHB_SCOM_ETU_PMON_CTR1:
777     case PHB_SCOM_ETU_PMON_CTR2:
778     case PHB_SCOM_ETU_PMON_CTR3:
779         offset = ((reg - PHB_SCOM_ETU_PMON_CONFIG) << 3) + PHB_PERFMON_CONFIG;
780         return pnv_phb4_reg_read(phb, offset, size);
781 
782     default:
783         qemu_log_mask(LOG_UNIMP, "phb4: xscom_read 0x%"HWADDR_PRIx"\n", addr);
784         return ~0ull;
785     }
786 }
787 
788 static void pnv_phb4_xscom_write(void *opaque, hwaddr addr,
789                                  uint64_t val, unsigned size)
790 {
791     PnvPHB4 *phb = PNV_PHB4(opaque);
792     uint32_t reg = addr >> 3;
793     hwaddr offset;
794 
795     switch (reg) {
796     case PHB_SCOM_HV_IND_ADDR:
797         phb->scom_hv_ind_addr_reg = val & 0xe000000000001fff;
798         break;
799     case PHB_SCOM_HV_IND_DATA:
800         if (!(phb->scom_hv_ind_addr_reg & PHB_SCOM_HV_IND_ADDR_VALID)) {
801             phb_error(phb, "Invalid indirect address");
802             break;
803         }
804         size = (phb->scom_hv_ind_addr_reg & PHB_SCOM_HV_IND_ADDR_4B) ? 4 : 8;
805         offset = GETFIELD(PHB_SCOM_HV_IND_ADDR_ADDR, phb->scom_hv_ind_addr_reg);
806         pnv_phb4_reg_write(phb, offset, val, size);
807         if (phb->scom_hv_ind_addr_reg & PHB_SCOM_HV_IND_ADDR_AUTOINC) {
808             offset += size;
809             offset &= 0x3fff;
810             phb->scom_hv_ind_addr_reg = SETFIELD(PHB_SCOM_HV_IND_ADDR_ADDR,
811                                                  phb->scom_hv_ind_addr_reg,
812                                                  offset);
813         }
814         break;
815     case PHB_SCOM_ETU_LEM_FIR:
816     case PHB_SCOM_ETU_LEM_FIR_AND:
817     case PHB_SCOM_ETU_LEM_FIR_OR:
818     case PHB_SCOM_ETU_LEM_FIR_MSK:
819     case PHB_SCOM_ETU_LEM_ERR_MSK_AND:
820     case PHB_SCOM_ETU_LEM_ERR_MSK_OR:
821     case PHB_SCOM_ETU_LEM_ACT0:
822     case PHB_SCOM_ETU_LEM_ACT1:
823     case PHB_SCOM_ETU_LEM_WOF:
824         offset = ((reg - PHB_SCOM_ETU_LEM_FIR) << 3) + PHB_LEM_FIR_ACCUM;
825         pnv_phb4_reg_write(phb, offset, val, size);
826         break;
827     case PHB_SCOM_ETU_PMON_CONFIG:
828     case PHB_SCOM_ETU_PMON_CTR0:
829     case PHB_SCOM_ETU_PMON_CTR1:
830     case PHB_SCOM_ETU_PMON_CTR2:
831     case PHB_SCOM_ETU_PMON_CTR3:
832         offset = ((reg - PHB_SCOM_ETU_PMON_CONFIG) << 3) + PHB_PERFMON_CONFIG;
833         pnv_phb4_reg_write(phb, offset, val, size);
834         break;
835     default:
836         qemu_log_mask(LOG_UNIMP, "phb4: xscom_write 0x%"HWADDR_PRIx
837                       "=%"PRIx64"\n", addr, val);
838     }
839 }
840 
841 const MemoryRegionOps pnv_phb4_xscom_ops = {
842     .read = pnv_phb4_xscom_read,
843     .write = pnv_phb4_xscom_write,
844     .valid.min_access_size = 8,
845     .valid.max_access_size = 8,
846     .impl.min_access_size = 8,
847     .impl.max_access_size = 8,
848     .endianness = DEVICE_BIG_ENDIAN,
849 };
850 
851 static uint64_t pnv_pec_stk_nest_xscom_read(void *opaque, hwaddr addr,
852                                             unsigned size)
853 {
854     PnvPHB4 *phb = PNV_PHB4(opaque);
855     uint32_t reg = addr >> 3;
856 
857     /* All registers are read-able */
858     return phb->nest_regs[reg];
859 }
860 
861 /*
862  * Return the 'stack_no' of a PHB4. 'stack_no' is the order
863  * the PHB4 occupies in the PEC. This is the reverse of what
864  * pnv_phb4_pec_get_phb_id() does.
865  *
866  * E.g. a phb with phb_id = 4 and pec->index = 1 (PEC1) will
867  * be the second phb (stack_no = 1) of the PEC.
868  */
869 static int pnv_phb4_get_phb_stack_no(PnvPHB4 *phb)
870 {
871     PnvPhb4PecState *pec = phb->pec;
872     PnvPhb4PecClass *pecc = PNV_PHB4_PEC_GET_CLASS(pec);
873     int index = pec->index;
874     int stack_no = phb->phb_id;
875 
876     while (index--) {
877         stack_no -= pecc->num_phbs[index];
878     }
879 
880     return stack_no;
881 }
882 
883 static void pnv_phb4_update_regions(PnvPHB4 *phb)
884 {
885     /* Unmap first always */
886     if (memory_region_is_mapped(&phb->mr_regs)) {
887         memory_region_del_subregion(&phb->phbbar, &phb->mr_regs);
888     }
889     if (memory_region_is_mapped(&phb->xsrc.esb_mmio)) {
890         memory_region_del_subregion(&phb->intbar, &phb->xsrc.esb_mmio);
891     }
892 
893     /* Map registers if enabled */
894     if (memory_region_is_mapped(&phb->phbbar)) {
895         memory_region_add_subregion(&phb->phbbar, 0, &phb->mr_regs);
896     }
897 
898     /* Map ESB if enabled */
899     if (memory_region_is_mapped(&phb->intbar)) {
900         memory_region_add_subregion(&phb->intbar, 0, &phb->xsrc.esb_mmio);
901     }
902 
903     /* Check/update m32 */
904     pnv_phb4_check_all_mbt(phb);
905 }
906 
907 static void pnv_pec_phb_update_map(PnvPHB4 *phb)
908 {
909     PnvPhb4PecState *pec = phb->pec;
910     MemoryRegion *sysmem = get_system_memory();
911     uint64_t bar_en = phb->nest_regs[PEC_NEST_STK_BAR_EN];
912     int stack_no = pnv_phb4_get_phb_stack_no(phb);
913     uint64_t bar, mask, size;
914     char name[64];
915 
916     /*
917      * NOTE: This will really not work well if those are remapped
918      * after the PHB has created its sub regions. We could do better
919      * if we had a way to resize regions but we don't really care
920      * that much in practice as the stuff below really only happens
921      * once early during boot
922      */
923 
924     /* Handle unmaps */
925     if (memory_region_is_mapped(&phb->mmbar0) &&
926         !(bar_en & PEC_NEST_STK_BAR_EN_MMIO0)) {
927         memory_region_del_subregion(sysmem, &phb->mmbar0);
928     }
929     if (memory_region_is_mapped(&phb->mmbar1) &&
930         !(bar_en & PEC_NEST_STK_BAR_EN_MMIO1)) {
931         memory_region_del_subregion(sysmem, &phb->mmbar1);
932     }
933     if (memory_region_is_mapped(&phb->phbbar) &&
934         !(bar_en & PEC_NEST_STK_BAR_EN_PHB)) {
935         memory_region_del_subregion(sysmem, &phb->phbbar);
936     }
937     if (memory_region_is_mapped(&phb->intbar) &&
938         !(bar_en & PEC_NEST_STK_BAR_EN_INT)) {
939         memory_region_del_subregion(sysmem, &phb->intbar);
940     }
941 
942     /* Update PHB */
943     pnv_phb4_update_regions(phb);
944 
945     /* Handle maps */
946     if (!memory_region_is_mapped(&phb->mmbar0) &&
947         (bar_en & PEC_NEST_STK_BAR_EN_MMIO0)) {
948         bar = phb->nest_regs[PEC_NEST_STK_MMIO_BAR0] >> 8;
949         mask = phb->nest_regs[PEC_NEST_STK_MMIO_BAR0_MASK];
950         size = ((~mask) >> 8) + 1;
951         snprintf(name, sizeof(name), "pec-%d.%d-phb-%d-mmio0",
952                  pec->chip_id, pec->index, stack_no);
953         memory_region_init(&phb->mmbar0, OBJECT(phb), name, size);
954         memory_region_add_subregion(sysmem, bar, &phb->mmbar0);
955         phb->mmio0_base = bar;
956         phb->mmio0_size = size;
957     }
958     if (!memory_region_is_mapped(&phb->mmbar1) &&
959         (bar_en & PEC_NEST_STK_BAR_EN_MMIO1)) {
960         bar = phb->nest_regs[PEC_NEST_STK_MMIO_BAR1] >> 8;
961         mask = phb->nest_regs[PEC_NEST_STK_MMIO_BAR1_MASK];
962         size = ((~mask) >> 8) + 1;
963         snprintf(name, sizeof(name), "pec-%d.%d-phb-%d-mmio1",
964                  pec->chip_id, pec->index, stack_no);
965         memory_region_init(&phb->mmbar1, OBJECT(phb), name, size);
966         memory_region_add_subregion(sysmem, bar, &phb->mmbar1);
967         phb->mmio1_base = bar;
968         phb->mmio1_size = size;
969     }
970     if (!memory_region_is_mapped(&phb->phbbar) &&
971         (bar_en & PEC_NEST_STK_BAR_EN_PHB)) {
972         bar = phb->nest_regs[PEC_NEST_STK_PHB_REGS_BAR] >> 8;
973         size = PNV_PHB4_NUM_REGS << 3;
974         snprintf(name, sizeof(name), "pec-%d.%d-phb-%d",
975                  pec->chip_id, pec->index, stack_no);
976         memory_region_init(&phb->phbbar, OBJECT(phb), name, size);
977         memory_region_add_subregion(sysmem, bar, &phb->phbbar);
978     }
979     if (!memory_region_is_mapped(&phb->intbar) &&
980         (bar_en & PEC_NEST_STK_BAR_EN_INT)) {
981         bar = phb->nest_regs[PEC_NEST_STK_INT_BAR] >> 8;
982         size = PNV_PHB4_MAX_INTs << 16;
983         snprintf(name, sizeof(name), "pec-%d.%d-phb-%d-int",
984                  phb->pec->chip_id, phb->pec->index, stack_no);
985         memory_region_init(&phb->intbar, OBJECT(phb), name, size);
986         memory_region_add_subregion(sysmem, bar, &phb->intbar);
987     }
988 
989     /* Update PHB */
990     pnv_phb4_update_regions(phb);
991 }
992 
993 static void pnv_pec_stk_nest_xscom_write(void *opaque, hwaddr addr,
994                                          uint64_t val, unsigned size)
995 {
996     PnvPHB4 *phb = PNV_PHB4(opaque);
997     PnvPhb4PecState *pec = phb->pec;
998     uint32_t reg = addr >> 3;
999 
1000     switch (reg) {
1001     case PEC_NEST_STK_PCI_NEST_FIR:
1002         phb->nest_regs[PEC_NEST_STK_PCI_NEST_FIR] = val & PPC_BITMASK(0, 27);
1003         break;
1004     case PEC_NEST_STK_PCI_NEST_FIR_CLR:
1005         phb->nest_regs[PEC_NEST_STK_PCI_NEST_FIR] &= val;
1006         break;
1007     case PEC_NEST_STK_PCI_NEST_FIR_SET:
1008         phb->nest_regs[PEC_NEST_STK_PCI_NEST_FIR] |= val;
1009         break;
1010     case PEC_NEST_STK_PCI_NEST_FIR_MSK:
1011         phb->nest_regs[PEC_NEST_STK_PCI_NEST_FIR_MSK] = val &
1012                                                         PPC_BITMASK(0, 27);
1013         break;
1014     case PEC_NEST_STK_PCI_NEST_FIR_MSKC:
1015         phb->nest_regs[PEC_NEST_STK_PCI_NEST_FIR_MSK] &= val;
1016         break;
1017     case PEC_NEST_STK_PCI_NEST_FIR_MSKS:
1018         phb->nest_regs[PEC_NEST_STK_PCI_NEST_FIR_MSK] |= val;
1019         break;
1020     case PEC_NEST_STK_PCI_NEST_FIR_ACT0:
1021     case PEC_NEST_STK_PCI_NEST_FIR_ACT1:
1022         phb->nest_regs[reg] = val & PPC_BITMASK(0, 27);
1023         break;
1024     case PEC_NEST_STK_PCI_NEST_FIR_WOF:
1025         phb->nest_regs[reg] = 0;
1026         break;
1027     case PEC_NEST_STK_ERR_REPORT_0:
1028     case PEC_NEST_STK_ERR_REPORT_1:
1029     case PEC_NEST_STK_PBCQ_GNRL_STATUS:
1030         /* Flag error ? */
1031         break;
1032     case PEC_NEST_STK_PBCQ_MODE:
1033         phb->nest_regs[reg] = val & PPC_BITMASK(0, 7);
1034         break;
1035     case PEC_NEST_STK_MMIO_BAR0:
1036     case PEC_NEST_STK_MMIO_BAR0_MASK:
1037     case PEC_NEST_STK_MMIO_BAR1:
1038     case PEC_NEST_STK_MMIO_BAR1_MASK:
1039         if (phb->nest_regs[PEC_NEST_STK_BAR_EN] &
1040             (PEC_NEST_STK_BAR_EN_MMIO0 |
1041              PEC_NEST_STK_BAR_EN_MMIO1)) {
1042             phb_pec_error(pec, "Changing enabled BAR unsupported");
1043         }
1044         phb->nest_regs[reg] = val & PPC_BITMASK(0, 39);
1045         break;
1046     case PEC_NEST_STK_PHB_REGS_BAR:
1047         if (phb->nest_regs[PEC_NEST_STK_BAR_EN] & PEC_NEST_STK_BAR_EN_PHB) {
1048             phb_pec_error(pec, "Changing enabled BAR unsupported");
1049         }
1050         phb->nest_regs[reg] = val & PPC_BITMASK(0, 41);
1051         break;
1052     case PEC_NEST_STK_INT_BAR:
1053         if (phb->nest_regs[PEC_NEST_STK_BAR_EN] & PEC_NEST_STK_BAR_EN_INT) {
1054             phb_pec_error(pec, "Changing enabled BAR unsupported");
1055         }
1056         phb->nest_regs[reg] = val & PPC_BITMASK(0, 27);
1057         break;
1058     case PEC_NEST_STK_BAR_EN:
1059         phb->nest_regs[reg] = val & PPC_BITMASK(0, 3);
1060         pnv_pec_phb_update_map(phb);
1061         break;
1062     case PEC_NEST_STK_DATA_FRZ_TYPE:
1063         /* Not used for now */
1064         phb->nest_regs[reg] = val & PPC_BITMASK(0, 27);
1065         break;
1066     case PEC_NEST_STK_PBCQ_SPARSE_PAGE:
1067         phb->nest_regs[reg] = val & PPC_BITMASK(3, 5);
1068         break;
1069     case PEC_NEST_STK_PBCQ_CACHE_INJ:
1070         phb->nest_regs[reg] = val & PPC_BITMASK(0, 7);
1071         break;
1072     default:
1073         qemu_log_mask(LOG_UNIMP, "phb4_pec: nest_xscom_write 0x%"HWADDR_PRIx
1074                       "=%"PRIx64"\n", addr, val);
1075     }
1076 }
1077 
1078 static const MemoryRegionOps pnv_pec_stk_nest_xscom_ops = {
1079     .read = pnv_pec_stk_nest_xscom_read,
1080     .write = pnv_pec_stk_nest_xscom_write,
1081     .valid.min_access_size = 8,
1082     .valid.max_access_size = 8,
1083     .impl.min_access_size = 8,
1084     .impl.max_access_size = 8,
1085     .endianness = DEVICE_BIG_ENDIAN,
1086 };
1087 
1088 static uint64_t pnv_pec_stk_pci_xscom_read(void *opaque, hwaddr addr,
1089                                            unsigned size)
1090 {
1091     PnvPHB4 *phb = PNV_PHB4(opaque);
1092     uint32_t reg = addr >> 3;
1093 
1094     /* All registers are read-able */
1095     return phb->pci_regs[reg];
1096 }
1097 
1098 static void pnv_pec_stk_pci_xscom_write(void *opaque, hwaddr addr,
1099                                         uint64_t val, unsigned size)
1100 {
1101     PnvPHB4 *phb = PNV_PHB4(opaque);
1102     uint32_t reg = addr >> 3;
1103     switch (reg) {
1104     case PEC_PCI_STK_PCI_FIR:
1105         phb->pci_regs[reg] = val & PPC_BITMASK(0, 5);
1106         break;
1107     case PEC_PCI_STK_PCI_FIR_CLR:
1108         phb->pci_regs[PEC_PCI_STK_PCI_FIR] &= val;
1109         break;
1110     case PEC_PCI_STK_PCI_FIR_SET:
1111         phb->pci_regs[PEC_PCI_STK_PCI_FIR] |= val;
1112         break;
1113     case PEC_PCI_STK_PCI_FIR_MSK:
1114         phb->pci_regs[reg] = val & PPC_BITMASK(0, 5);
1115         break;
1116     case PEC_PCI_STK_PCI_FIR_MSKC:
1117         phb->pci_regs[PEC_PCI_STK_PCI_FIR_MSK] &= val;
1118         break;
1119     case PEC_PCI_STK_PCI_FIR_MSKS:
1120         phb->pci_regs[PEC_PCI_STK_PCI_FIR_MSK] |= val;
1121         break;
1122     case PEC_PCI_STK_PCI_FIR_ACT0:
1123     case PEC_PCI_STK_PCI_FIR_ACT1:
1124         phb->pci_regs[reg] = val & PPC_BITMASK(0, 5);
1125         break;
1126     case PEC_PCI_STK_PCI_FIR_WOF:
1127         phb->pci_regs[reg] = 0;
1128         break;
1129     case PEC_PCI_STK_ETU_RESET:
1130         phb->pci_regs[reg] = val & PPC_BIT(0);
1131         /* TODO: Implement reset */
1132         break;
1133     case PEC_PCI_STK_PBAIB_ERR_REPORT:
1134         break;
1135     case PEC_PCI_STK_PBAIB_TX_CMD_CRED:
1136         phb->pci_regs[reg] = val &
1137                                  ((PPC_BITMASK(0, 2) | PPC_BITMASK(10, 18)
1138                                    | PPC_BITMASK(26, 34) | PPC_BITMASK(41, 50)
1139                                    | PPC_BITMASK(58, 63)));
1140         break;
1141     case PEC_PCI_STK_PBAIB_TX_DAT_CRED:
1142         phb->pci_regs[reg] = val & (PPC_BITMASK(33, 34) | PPC_BITMASK(44, 47));
1143         break;
1144     default:
1145         qemu_log_mask(LOG_UNIMP, "phb4_pec_stk: pci_xscom_write 0x%"HWADDR_PRIx
1146                       "=%"PRIx64"\n", addr, val);
1147     }
1148 }
1149 
1150 static const MemoryRegionOps pnv_pec_stk_pci_xscom_ops = {
1151     .read = pnv_pec_stk_pci_xscom_read,
1152     .write = pnv_pec_stk_pci_xscom_write,
1153     .valid.min_access_size = 8,
1154     .valid.max_access_size = 8,
1155     .impl.min_access_size = 8,
1156     .impl.max_access_size = 8,
1157     .endianness = DEVICE_BIG_ENDIAN,
1158 };
1159 
1160 static int pnv_phb4_map_irq(PCIDevice *pci_dev, int irq_num)
1161 {
1162     /* Check that out properly ... */
1163     return irq_num & 3;
1164 }
1165 
1166 static void pnv_phb4_set_irq(void *opaque, int irq_num, int level)
1167 {
1168     PnvPHB4 *phb = PNV_PHB4(opaque);
1169     uint32_t lsi_base;
1170 
1171     /* LSI only ... */
1172     if (irq_num > 3) {
1173         phb_error(phb, "IRQ %x is not an LSI", irq_num);
1174     }
1175     lsi_base = GETFIELD(PHB_LSI_SRC_ID, phb->regs[PHB_LSI_SOURCE_ID >> 3]);
1176     lsi_base <<= 3;
1177     qemu_set_irq(phb->qirqs[lsi_base + irq_num], level);
1178 }
1179 
1180 static bool pnv_phb4_resolve_pe(PnvPhb4DMASpace *ds)
1181 {
1182     uint64_t rtt, addr;
1183     uint16_t rte;
1184     int bus_num;
1185     int num_PEs;
1186 
1187     /* Already resolved ? */
1188     if (ds->pe_num != PHB_INVALID_PE) {
1189         return true;
1190     }
1191 
1192     /* We need to lookup the RTT */
1193     rtt = ds->phb->regs[PHB_RTT_BAR >> 3];
1194     if (!(rtt & PHB_RTT_BAR_ENABLE)) {
1195         phb_error(ds->phb, "DMA with RTT BAR disabled !");
1196         /* Set error bits ? fence ? ... */
1197         return false;
1198     }
1199 
1200     /* Read RTE */
1201     bus_num = pci_bus_num(ds->bus);
1202     addr = rtt & PHB_RTT_BASE_ADDRESS_MASK;
1203     addr += 2 * PCI_BUILD_BDF(bus_num, ds->devfn);
1204     if (dma_memory_read(&address_space_memory, addr, &rte,
1205                         sizeof(rte), MEMTXATTRS_UNSPECIFIED)) {
1206         phb_error(ds->phb, "Failed to read RTT entry at 0x%"PRIx64, addr);
1207         /* Set error bits ? fence ? ... */
1208         return false;
1209     }
1210     rte = be16_to_cpu(rte);
1211 
1212     /* Fail upon reading of invalid PE# */
1213     num_PEs = ds->phb->big_phb ? PNV_PHB4_MAX_PEs : (PNV_PHB4_MAX_PEs >> 1);
1214     if (rte >= num_PEs) {
1215         phb_error(ds->phb, "RTE for RID 0x%x invalid (%04x", ds->devfn, rte);
1216         rte &= num_PEs - 1;
1217     }
1218     ds->pe_num = rte;
1219     return true;
1220 }
1221 
1222 static void pnv_phb4_translate_tve(PnvPhb4DMASpace *ds, hwaddr addr,
1223                                    bool is_write, uint64_t tve,
1224                                    IOMMUTLBEntry *tlb)
1225 {
1226     uint64_t tta = GETFIELD(IODA3_TVT_TABLE_ADDR, tve);
1227     int32_t  lev = GETFIELD(IODA3_TVT_NUM_LEVELS, tve);
1228     uint32_t tts = GETFIELD(IODA3_TVT_TCE_TABLE_SIZE, tve);
1229     uint32_t tps = GETFIELD(IODA3_TVT_IO_PSIZE, tve);
1230 
1231     /* Invalid levels */
1232     if (lev > 4) {
1233         phb_error(ds->phb, "Invalid #levels in TVE %d", lev);
1234         return;
1235     }
1236 
1237     /* Invalid entry */
1238     if (tts == 0) {
1239         phb_error(ds->phb, "Access to invalid TVE");
1240         return;
1241     }
1242 
1243     /* IO Page Size of 0 means untranslated, else use TCEs */
1244     if (tps == 0) {
1245         /* TODO: Handle boundaries */
1246 
1247         /* Use 4k pages like q35 ... for now */
1248         tlb->iova = addr & 0xfffffffffffff000ull;
1249         tlb->translated_addr = addr & 0x0003fffffffff000ull;
1250         tlb->addr_mask = 0xfffull;
1251         tlb->perm = IOMMU_RW;
1252     } else {
1253         uint32_t tce_shift, tbl_shift, sh;
1254         uint64_t base, taddr, tce, tce_mask;
1255 
1256         /* Address bits per bottom level TCE entry */
1257         tce_shift = tps + 11;
1258 
1259         /* Address bits per table level */
1260         tbl_shift = tts + 8;
1261 
1262         /* Top level table base address */
1263         base = tta << 12;
1264 
1265         /* Total shift to first level */
1266         sh = tbl_shift * lev + tce_shift;
1267 
1268         /* TODO: Limit to support IO page sizes */
1269 
1270         /* TODO: Multi-level untested */
1271         do {
1272             lev--;
1273 
1274             /* Grab the TCE address */
1275             taddr = base | (((addr >> sh) & ((1ul << tbl_shift) - 1)) << 3);
1276             if (dma_memory_read(&address_space_memory, taddr, &tce,
1277                                 sizeof(tce), MEMTXATTRS_UNSPECIFIED)) {
1278                 phb_error(ds->phb, "Failed to read TCE at 0x%"PRIx64, taddr);
1279                 return;
1280             }
1281             tce = be64_to_cpu(tce);
1282 
1283             /* Check permission for indirect TCE */
1284             if ((lev >= 0) && !(tce & 3)) {
1285                 phb_error(ds->phb, "Invalid indirect TCE at 0x%"PRIx64, taddr);
1286                 phb_error(ds->phb, " xlate %"PRIx64":%c TVE=%"PRIx64, addr,
1287                            is_write ? 'W' : 'R', tve);
1288                 phb_error(ds->phb, " tta=%"PRIx64" lev=%d tts=%d tps=%d",
1289                            tta, lev, tts, tps);
1290                 return;
1291             }
1292             sh -= tbl_shift;
1293             base = tce & ~0xfffull;
1294         } while (lev >= 0);
1295 
1296         /* We exit the loop with TCE being the final TCE */
1297         if ((is_write & !(tce & 2)) || ((!is_write) && !(tce & 1))) {
1298             phb_error(ds->phb, "TCE access fault at 0x%"PRIx64, taddr);
1299             phb_error(ds->phb, " xlate %"PRIx64":%c TVE=%"PRIx64, addr,
1300                        is_write ? 'W' : 'R', tve);
1301             phb_error(ds->phb, " tta=%"PRIx64" lev=%d tts=%d tps=%d",
1302                        tta, lev, tts, tps);
1303             return;
1304         }
1305         tce_mask = ~((1ull << tce_shift) - 1);
1306         tlb->iova = addr & tce_mask;
1307         tlb->translated_addr = tce & tce_mask;
1308         tlb->addr_mask = ~tce_mask;
1309         tlb->perm = tce & 3;
1310     }
1311 }
1312 
1313 static IOMMUTLBEntry pnv_phb4_translate_iommu(IOMMUMemoryRegion *iommu,
1314                                               hwaddr addr,
1315                                               IOMMUAccessFlags flag,
1316                                               int iommu_idx)
1317 {
1318     PnvPhb4DMASpace *ds = container_of(iommu, PnvPhb4DMASpace, dma_mr);
1319     int tve_sel;
1320     uint64_t tve, cfg;
1321     IOMMUTLBEntry ret = {
1322         .target_as = &address_space_memory,
1323         .iova = addr,
1324         .translated_addr = 0,
1325         .addr_mask = ~(hwaddr)0,
1326         .perm = IOMMU_NONE,
1327     };
1328 
1329     /* Resolve PE# */
1330     if (!pnv_phb4_resolve_pe(ds)) {
1331         phb_error(ds->phb, "Failed to resolve PE# for bus @%p (%d) devfn 0x%x",
1332                    ds->bus, pci_bus_num(ds->bus), ds->devfn);
1333         return ret;
1334     }
1335 
1336     /* Check top bits */
1337     switch (addr >> 60) {
1338     case 00:
1339         /* DMA or 32-bit MSI ? */
1340         cfg = ds->phb->regs[PHB_PHB4_CONFIG >> 3];
1341         if ((cfg & PHB_PHB4C_32BIT_MSI_EN) &&
1342             ((addr & 0xffffffffffff0000ull) == 0xffff0000ull)) {
1343             phb_error(ds->phb, "xlate on 32-bit MSI region");
1344             return ret;
1345         }
1346         /* Choose TVE XXX Use PHB4 Control Register */
1347         tve_sel = (addr >> 59) & 1;
1348         tve = ds->phb->ioda_TVT[ds->pe_num * 2 + tve_sel];
1349         pnv_phb4_translate_tve(ds, addr, flag & IOMMU_WO, tve, &ret);
1350         break;
1351     case 01:
1352         phb_error(ds->phb, "xlate on 64-bit MSI region");
1353         break;
1354     default:
1355         phb_error(ds->phb, "xlate on unsupported address 0x%"PRIx64, addr);
1356     }
1357     return ret;
1358 }
1359 
1360 #define TYPE_PNV_PHB4_IOMMU_MEMORY_REGION "pnv-phb4-iommu-memory-region"
1361 DECLARE_INSTANCE_CHECKER(IOMMUMemoryRegion, PNV_PHB4_IOMMU_MEMORY_REGION,
1362                          TYPE_PNV_PHB4_IOMMU_MEMORY_REGION)
1363 
1364 static void pnv_phb4_iommu_memory_region_class_init(ObjectClass *klass,
1365                                                     void *data)
1366 {
1367     IOMMUMemoryRegionClass *imrc = IOMMU_MEMORY_REGION_CLASS(klass);
1368 
1369     imrc->translate = pnv_phb4_translate_iommu;
1370 }
1371 
1372 static const TypeInfo pnv_phb4_iommu_memory_region_info = {
1373     .parent = TYPE_IOMMU_MEMORY_REGION,
1374     .name = TYPE_PNV_PHB4_IOMMU_MEMORY_REGION,
1375     .class_init = pnv_phb4_iommu_memory_region_class_init,
1376 };
1377 
1378 /*
1379  * Return the index/phb-id of a PHB4 that belongs to a
1380  * pec->stacks[stack_index] stack.
1381  */
1382 int pnv_phb4_pec_get_phb_id(PnvPhb4PecState *pec, int stack_index)
1383 {
1384     PnvPhb4PecClass *pecc = PNV_PHB4_PEC_GET_CLASS(pec);
1385     int index = pec->index;
1386     int offset = 0;
1387 
1388     while (index--) {
1389         offset += pecc->num_phbs[index];
1390     }
1391 
1392     return offset + stack_index;
1393 }
1394 
1395 /*
1396  * MSI/MSIX memory region implementation.
1397  * The handler handles both MSI and MSIX.
1398  */
1399 static void pnv_phb4_msi_write(void *opaque, hwaddr addr,
1400                                uint64_t data, unsigned size)
1401 {
1402     PnvPhb4DMASpace *ds = opaque;
1403     PnvPHB4 *phb = ds->phb;
1404 
1405     uint32_t src = ((addr >> 4) & 0xffff) | (data & 0x1f);
1406 
1407     /* Resolve PE# */
1408     if (!pnv_phb4_resolve_pe(ds)) {
1409         phb_error(phb, "Failed to resolve PE# for bus @%p (%d) devfn 0x%x",
1410                    ds->bus, pci_bus_num(ds->bus), ds->devfn);
1411         return;
1412     }
1413 
1414     /* TODO: Check it doesn't collide with LSIs */
1415     if (src >= phb->xsrc.nr_irqs) {
1416         phb_error(phb, "MSI %d out of bounds", src);
1417         return;
1418     }
1419 
1420     /* TODO: check PE/MSI assignment */
1421 
1422     qemu_irq_pulse(phb->qirqs[src]);
1423 }
1424 
1425 /* There is no .read as the read result is undefined by PCI spec */
1426 static uint64_t pnv_phb4_msi_read(void *opaque, hwaddr addr, unsigned size)
1427 {
1428     PnvPhb4DMASpace *ds = opaque;
1429 
1430     phb_error(ds->phb, "Invalid MSI read @ 0x%" HWADDR_PRIx, addr);
1431     return -1;
1432 }
1433 
1434 static const MemoryRegionOps pnv_phb4_msi_ops = {
1435     .read = pnv_phb4_msi_read,
1436     .write = pnv_phb4_msi_write,
1437     .endianness = DEVICE_LITTLE_ENDIAN
1438 };
1439 
1440 static PnvPhb4DMASpace *pnv_phb4_dma_find(PnvPHB4 *phb, PCIBus *bus, int devfn)
1441 {
1442     PnvPhb4DMASpace *ds;
1443 
1444     QLIST_FOREACH(ds, &phb->dma_spaces, list) {
1445         if (ds->bus == bus && ds->devfn == devfn) {
1446             break;
1447         }
1448     }
1449     return ds;
1450 }
1451 
1452 static AddressSpace *pnv_phb4_dma_iommu(PCIBus *bus, void *opaque, int devfn)
1453 {
1454     PnvPHB4 *phb = opaque;
1455     PnvPhb4DMASpace *ds;
1456     char name[32];
1457 
1458     ds = pnv_phb4_dma_find(phb, bus, devfn);
1459 
1460     if (ds == NULL) {
1461         ds = g_new0(PnvPhb4DMASpace, 1);
1462         ds->bus = bus;
1463         ds->devfn = devfn;
1464         ds->pe_num = PHB_INVALID_PE;
1465         ds->phb = phb;
1466         snprintf(name, sizeof(name), "phb4-%d.%d-iommu", phb->chip_id,
1467                  phb->phb_id);
1468         memory_region_init_iommu(&ds->dma_mr, sizeof(ds->dma_mr),
1469                                  TYPE_PNV_PHB4_IOMMU_MEMORY_REGION,
1470                                  OBJECT(phb), name, UINT64_MAX);
1471         address_space_init(&ds->dma_as, MEMORY_REGION(&ds->dma_mr),
1472                            name);
1473         memory_region_init_io(&ds->msi32_mr, OBJECT(phb), &pnv_phb4_msi_ops,
1474                               ds, "msi32", 0x10000);
1475         memory_region_init_io(&ds->msi64_mr, OBJECT(phb), &pnv_phb4_msi_ops,
1476                               ds, "msi64", 0x100000);
1477         pnv_phb4_update_msi_regions(ds);
1478 
1479         QLIST_INSERT_HEAD(&phb->dma_spaces, ds, list);
1480     }
1481     return &ds->dma_as;
1482 }
1483 
1484 static void pnv_phb4_xscom_realize(PnvPHB4 *phb)
1485 {
1486     PnvPhb4PecState *pec = phb->pec;
1487     PnvPhb4PecClass *pecc = PNV_PHB4_PEC_GET_CLASS(pec);
1488     int stack_no = pnv_phb4_get_phb_stack_no(phb);
1489     uint32_t pec_nest_base;
1490     uint32_t pec_pci_base;
1491     char name[64];
1492 
1493     assert(pec);
1494 
1495     /* Initialize the XSCOM regions for the stack registers */
1496     snprintf(name, sizeof(name), "xscom-pec-%d.%d-nest-phb-%d",
1497              pec->chip_id, pec->index, stack_no);
1498     pnv_xscom_region_init(&phb->nest_regs_mr, OBJECT(phb),
1499                           &pnv_pec_stk_nest_xscom_ops, phb, name,
1500                           PHB4_PEC_NEST_STK_REGS_COUNT);
1501 
1502     snprintf(name, sizeof(name), "xscom-pec-%d.%d-pci-phb-%d",
1503              pec->chip_id, pec->index, stack_no);
1504     pnv_xscom_region_init(&phb->pci_regs_mr, OBJECT(phb),
1505                           &pnv_pec_stk_pci_xscom_ops, phb, name,
1506                           PHB4_PEC_PCI_STK_REGS_COUNT);
1507 
1508     /* PHB pass-through */
1509     snprintf(name, sizeof(name), "xscom-pec-%d.%d-phb-%d",
1510              pec->chip_id, pec->index, stack_no);
1511     pnv_xscom_region_init(&phb->phb_regs_mr, OBJECT(phb),
1512                           &pnv_phb4_xscom_ops, phb, name, 0x40);
1513 
1514     pec_nest_base = pecc->xscom_nest_base(pec);
1515     pec_pci_base = pecc->xscom_pci_base(pec);
1516 
1517     /* Populate the XSCOM address space. */
1518     pnv_xscom_add_subregion(pec->chip,
1519                             pec_nest_base + 0x40 * (stack_no + 1),
1520                             &phb->nest_regs_mr);
1521     pnv_xscom_add_subregion(pec->chip,
1522                             pec_pci_base + 0x40 * (stack_no + 1),
1523                             &phb->pci_regs_mr);
1524     pnv_xscom_add_subregion(pec->chip,
1525                             pec_pci_base + PNV9_XSCOM_PEC_PCI_STK0 +
1526                             0x40 * stack_no,
1527                             &phb->phb_regs_mr);
1528 }
1529 
1530 static PCIIOMMUOps pnv_phb4_iommu_ops = {
1531     .get_address_space = pnv_phb4_dma_iommu,
1532 };
1533 
1534 static void pnv_phb4_instance_init(Object *obj)
1535 {
1536     PnvPHB4 *phb = PNV_PHB4(obj);
1537 
1538     QLIST_INIT(&phb->dma_spaces);
1539 
1540     /* XIVE interrupt source object */
1541     object_initialize_child(obj, "source", &phb->xsrc, TYPE_XIVE_SOURCE);
1542 }
1543 
1544 void pnv_phb4_bus_init(DeviceState *dev, PnvPHB4 *phb)
1545 {
1546     PCIHostState *pci = PCI_HOST_BRIDGE(dev);
1547     char name[32];
1548 
1549     /*
1550      * PHB4 doesn't support IO space. However, qemu gets very upset if
1551      * we don't have an IO region to anchor IO BARs onto so we just
1552      * initialize one which we never hook up to anything
1553      */
1554     snprintf(name, sizeof(name), "phb4-%d.%d-pci-io", phb->chip_id,
1555              phb->phb_id);
1556     memory_region_init(&phb->pci_io, OBJECT(phb), name, 0x10000);
1557 
1558     snprintf(name, sizeof(name), "phb4-%d.%d-pci-mmio", phb->chip_id,
1559              phb->phb_id);
1560     memory_region_init(&phb->pci_mmio, OBJECT(phb), name,
1561                        PCI_MMIO_TOTAL_SIZE);
1562 
1563     pci->bus = pci_register_root_bus(dev, dev->id ? dev->id : NULL,
1564                                      pnv_phb4_set_irq, pnv_phb4_map_irq, phb,
1565                                      &phb->pci_mmio, &phb->pci_io,
1566                                      0, 4, TYPE_PNV_PHB4_ROOT_BUS);
1567 
1568     object_property_set_int(OBJECT(pci->bus), "phb-id", phb->phb_id,
1569                             &error_abort);
1570     object_property_set_int(OBJECT(pci->bus), "chip-id", phb->chip_id,
1571                             &error_abort);
1572 
1573     pci_setup_iommu(pci->bus, &pnv_phb4_iommu_ops, phb);
1574     pci->bus->flags |= PCI_BUS_EXTENDED_CONFIG_SPACE;
1575 }
1576 
1577 static void pnv_phb4_realize(DeviceState *dev, Error **errp)
1578 {
1579     PnvPHB4 *phb = PNV_PHB4(dev);
1580     XiveSource *xsrc = &phb->xsrc;
1581     int nr_irqs;
1582     char name[32];
1583 
1584     /* Set the "big_phb" flag */
1585     phb->big_phb = phb->phb_id == 0 || phb->phb_id == 3;
1586 
1587     /* Controller Registers */
1588     snprintf(name, sizeof(name), "phb4-%d.%d-regs", phb->chip_id,
1589              phb->phb_id);
1590     memory_region_init_io(&phb->mr_regs, OBJECT(phb), &pnv_phb4_reg_ops, phb,
1591                           name, 0x2000);
1592 
1593     /* Setup XIVE Source */
1594     if (phb->big_phb) {
1595         nr_irqs = PNV_PHB4_MAX_INTs;
1596     } else {
1597         nr_irqs = PNV_PHB4_MAX_INTs >> 1;
1598     }
1599     object_property_set_int(OBJECT(xsrc), "nr-irqs", nr_irqs, &error_fatal);
1600     object_property_set_link(OBJECT(xsrc), "xive", OBJECT(phb), &error_fatal);
1601     if (!qdev_realize(DEVICE(xsrc), NULL, errp)) {
1602         return;
1603     }
1604 
1605     pnv_phb4_update_xsrc(phb);
1606 
1607     phb->qirqs = qemu_allocate_irqs(xive_source_set_irq, xsrc, xsrc->nr_irqs);
1608 
1609     pnv_phb4_xscom_realize(phb);
1610 }
1611 
1612 /*
1613  * Address base trigger mode (POWER10)
1614  *
1615  * Trigger directly the IC ESB page
1616  */
1617 static void pnv_phb4_xive_notify_abt(PnvPHB4 *phb, uint32_t srcno,
1618                                      bool pq_checked)
1619 {
1620     uint64_t notif_port = phb->regs[PHB_INT_NOTIFY_ADDR >> 3];
1621     uint64_t data = 0; /* trigger data : don't care */
1622     hwaddr addr;
1623     MemTxResult result;
1624     int esb_shift;
1625 
1626     if (notif_port & PHB_INT_NOTIFY_ADDR_64K) {
1627         esb_shift = 16;
1628     } else {
1629         esb_shift = 12;
1630     }
1631 
1632     /* Compute the address of the IC ESB management page */
1633     addr = (notif_port & ~PHB_INT_NOTIFY_ADDR_64K);
1634     addr |= (1ull << (esb_shift + 1)) * srcno;
1635     addr |= (1ull << esb_shift);
1636 
1637     /*
1638      * When the PQ state bits are checked on the PHB, the associated
1639      * PQ state bits on the IC should be ignored. Use the unconditional
1640      * trigger offset to inject a trigger on the IC. This is always
1641      * the case for LSIs
1642      */
1643     if (pq_checked) {
1644         addr |= XIVE_ESB_INJECT;
1645     }
1646 
1647     trace_pnv_phb4_xive_notify_ic(addr, data);
1648 
1649     address_space_stq_be(&address_space_memory, addr, data,
1650                          MEMTXATTRS_UNSPECIFIED, &result);
1651     if (result != MEMTX_OK) {
1652         phb_error(phb, "trigger failed @%"HWADDR_PRIx "\n", addr);
1653         return;
1654     }
1655 }
1656 
1657 static void pnv_phb4_xive_notify_ic(PnvPHB4 *phb, uint32_t srcno,
1658                                     bool pq_checked)
1659 {
1660     uint64_t notif_port = phb->regs[PHB_INT_NOTIFY_ADDR >> 3];
1661     uint32_t offset = phb->regs[PHB_INT_NOTIFY_INDEX >> 3];
1662     uint64_t data = offset | srcno;
1663     MemTxResult result;
1664 
1665     if (pq_checked) {
1666         data |= XIVE_TRIGGER_PQ;
1667     }
1668 
1669     trace_pnv_phb4_xive_notify_ic(notif_port, data);
1670 
1671     address_space_stq_be(&address_space_memory, notif_port, data,
1672                          MEMTXATTRS_UNSPECIFIED, &result);
1673     if (result != MEMTX_OK) {
1674         phb_error(phb, "trigger failed @%"HWADDR_PRIx "\n", notif_port);
1675         return;
1676     }
1677 }
1678 
1679 static void pnv_phb4_xive_notify(XiveNotifier *xf, uint32_t srcno,
1680                                  bool pq_checked)
1681 {
1682     PnvPHB4 *phb = PNV_PHB4(xf);
1683 
1684     if (phb->regs[PHB_CTRLR >> 3] & PHB_CTRLR_IRQ_ABT_MODE) {
1685         pnv_phb4_xive_notify_abt(phb, srcno, pq_checked);
1686     } else {
1687         pnv_phb4_xive_notify_ic(phb, srcno, pq_checked);
1688     }
1689 }
1690 
1691 static Property pnv_phb4_properties[] = {
1692     DEFINE_PROP_UINT32("index", PnvPHB4, phb_id, 0),
1693     DEFINE_PROP_UINT32("chip-id", PnvPHB4, chip_id, 0),
1694     DEFINE_PROP_LINK("pec", PnvPHB4, pec, TYPE_PNV_PHB4_PEC,
1695                      PnvPhb4PecState *),
1696     DEFINE_PROP_LINK("phb-base", PnvPHB4, phb_base, TYPE_PNV_PHB, PnvPHB *),
1697     DEFINE_PROP_END_OF_LIST(),
1698 };
1699 
1700 static void pnv_phb4_class_init(ObjectClass *klass, void *data)
1701 {
1702     DeviceClass *dc = DEVICE_CLASS(klass);
1703     XiveNotifierClass *xfc = XIVE_NOTIFIER_CLASS(klass);
1704 
1705     dc->realize         = pnv_phb4_realize;
1706     device_class_set_props(dc, pnv_phb4_properties);
1707     dc->user_creatable  = false;
1708 
1709     xfc->notify         = pnv_phb4_xive_notify;
1710 }
1711 
1712 static const TypeInfo pnv_phb4_type_info = {
1713     .name          = TYPE_PNV_PHB4,
1714     .parent        = TYPE_DEVICE,
1715     .instance_init = pnv_phb4_instance_init,
1716     .instance_size = sizeof(PnvPHB4),
1717     .class_init    = pnv_phb4_class_init,
1718     .interfaces = (InterfaceInfo[]) {
1719             { TYPE_XIVE_NOTIFIER },
1720             { },
1721     }
1722 };
1723 
1724 static const TypeInfo pnv_phb5_type_info = {
1725     .name          = TYPE_PNV_PHB5,
1726     .parent        = TYPE_PNV_PHB4,
1727     .instance_size = sizeof(PnvPHB4),
1728 };
1729 
1730 static void pnv_phb4_root_bus_get_prop(Object *obj, Visitor *v,
1731                                        const char *name,
1732                                        void *opaque, Error **errp)
1733 {
1734     PnvPHB4RootBus *bus = PNV_PHB4_ROOT_BUS(obj);
1735     uint64_t value = 0;
1736 
1737     if (strcmp(name, "phb-id") == 0) {
1738         value = bus->phb_id;
1739     } else {
1740         value = bus->chip_id;
1741     }
1742 
1743     visit_type_size(v, name, &value, errp);
1744 }
1745 
1746 static void pnv_phb4_root_bus_set_prop(Object *obj, Visitor *v,
1747                                        const char *name,
1748                                        void *opaque, Error **errp)
1749 
1750 {
1751     PnvPHB4RootBus *bus = PNV_PHB4_ROOT_BUS(obj);
1752     uint64_t value;
1753 
1754     if (!visit_type_size(v, name, &value, errp)) {
1755         return;
1756     }
1757 
1758     if (strcmp(name, "phb-id") == 0) {
1759         bus->phb_id = value;
1760     } else {
1761         bus->chip_id = value;
1762     }
1763 }
1764 
1765 static void pnv_phb4_root_bus_class_init(ObjectClass *klass, void *data)
1766 {
1767     BusClass *k = BUS_CLASS(klass);
1768 
1769     object_class_property_add(klass, "phb-id", "int",
1770                               pnv_phb4_root_bus_get_prop,
1771                               pnv_phb4_root_bus_set_prop,
1772                               NULL, NULL);
1773 
1774     object_class_property_add(klass, "chip-id", "int",
1775                               pnv_phb4_root_bus_get_prop,
1776                               pnv_phb4_root_bus_set_prop,
1777                               NULL, NULL);
1778 
1779     /*
1780      * PHB4 has only a single root complex. Enforce the limit on the
1781      * parent bus
1782      */
1783     k->max_dev = 1;
1784 }
1785 
1786 static const TypeInfo pnv_phb4_root_bus_info = {
1787     .name = TYPE_PNV_PHB4_ROOT_BUS,
1788     .parent = TYPE_PCIE_BUS,
1789     .instance_size = sizeof(PnvPHB4RootBus),
1790     .class_init = pnv_phb4_root_bus_class_init,
1791 };
1792 
1793 static void pnv_phb4_register_types(void)
1794 {
1795     type_register_static(&pnv_phb4_root_bus_info);
1796     type_register_static(&pnv_phb4_type_info);
1797     type_register_static(&pnv_phb5_type_info);
1798     type_register_static(&pnv_phb4_iommu_memory_region_info);
1799 }
1800 
1801 type_init(pnv_phb4_register_types);
1802 
1803 void pnv_phb4_pic_print_info(PnvPHB4 *phb, GString *buf)
1804 {
1805     uint64_t notif_port =
1806         phb->regs[PHB_INT_NOTIFY_ADDR >> 3] & ~PHB_INT_NOTIFY_ADDR_64K;
1807     uint32_t offset = phb->regs[PHB_INT_NOTIFY_INDEX >> 3];
1808     bool abt = !!(phb->regs[PHB_CTRLR >> 3] & PHB_CTRLR_IRQ_ABT_MODE);
1809 
1810     g_string_append_printf(buf,
1811                            "PHB4[%x:%x] Source %08x .. %08x "
1812                            "%s @%"HWADDR_PRIx"\n",
1813                            phb->chip_id, phb->phb_id,
1814                            offset, offset + phb->xsrc.nr_irqs - 1,
1815                            abt ? "ABT" : "",
1816                            notif_port);
1817     xive_source_pic_print_info(&phb->xsrc, 0, buf);
1818 }
1819