xref: /openbmc/qemu/hw/pci-host/pnv_phb4.c (revision 95a40c44)
1 /*
2  * QEMU PowerPC PowerNV (POWER9) PHB4 model
3  *
4  * Copyright (c) 2018-2020, IBM Corporation.
5  *
6  * This code is licensed under the GPL version 2 or later. See the
7  * COPYING file in the top-level directory.
8  */
9 #include "qemu/osdep.h"
10 #include "qemu/log.h"
11 #include "qapi/visitor.h"
12 #include "qapi/error.h"
13 #include "monitor/monitor.h"
14 #include "target/ppc/cpu.h"
15 #include "hw/pci-host/pnv_phb4_regs.h"
16 #include "hw/pci-host/pnv_phb4.h"
17 #include "hw/pci/pcie_host.h"
18 #include "hw/pci/pcie_port.h"
19 #include "hw/ppc/pnv.h"
20 #include "hw/ppc/pnv_xscom.h"
21 #include "hw/irq.h"
22 #include "hw/qdev-properties.h"
23 #include "qom/object.h"
24 #include "trace.h"
25 
26 #define phb_error(phb, fmt, ...)                                        \
27     qemu_log_mask(LOG_GUEST_ERROR, "phb4[%d:%d]: " fmt "\n",            \
28                   (phb)->chip_id, (phb)->phb_id, ## __VA_ARGS__)
29 
30 #define phb_pec_error(pec, fmt, ...)                                    \
31     qemu_log_mask(LOG_GUEST_ERROR, "phb4_pec[%d:%d]: " fmt "\n",        \
32                   (pec)->chip_id, (pec)->index, ## __VA_ARGS__)
33 
34 static PCIDevice *pnv_phb4_find_cfg_dev(PnvPHB4 *phb)
35 {
36     PCIHostState *pci = PCI_HOST_BRIDGE(phb->phb_base);
37     uint64_t addr = phb->regs[PHB_CONFIG_ADDRESS >> 3];
38     uint8_t bus, devfn;
39 
40     if (!(addr >> 63)) {
41         return NULL;
42     }
43     bus = (addr >> 52) & 0xff;
44     devfn = (addr >> 44) & 0xff;
45 
46     /* We don't access the root complex this way */
47     if (bus == 0 && devfn == 0) {
48         return NULL;
49     }
50     return pci_find_device(pci->bus, bus, devfn);
51 }
52 
53 /*
54  * The CONFIG_DATA register expects little endian accesses, but as the
55  * region is big endian, we have to swap the value.
56  */
57 static void pnv_phb4_config_write(PnvPHB4 *phb, unsigned off,
58                                   unsigned size, uint64_t val)
59 {
60     uint32_t cfg_addr, limit;
61     PCIDevice *pdev;
62 
63     pdev = pnv_phb4_find_cfg_dev(phb);
64     if (!pdev) {
65         return;
66     }
67     cfg_addr = (phb->regs[PHB_CONFIG_ADDRESS >> 3] >> 32) & 0xffc;
68     cfg_addr |= off;
69     limit = pci_config_size(pdev);
70     if (limit <= cfg_addr) {
71         /*
72          * conventional pci device can be behind pcie-to-pci bridge.
73          * 256 <= addr < 4K has no effects.
74          */
75         return;
76     }
77     switch (size) {
78     case 1:
79         break;
80     case 2:
81         val = bswap16(val);
82         break;
83     case 4:
84         val = bswap32(val);
85         break;
86     default:
87         g_assert_not_reached();
88     }
89     pci_host_config_write_common(pdev, cfg_addr, limit, val, size);
90 }
91 
92 static uint64_t pnv_phb4_config_read(PnvPHB4 *phb, unsigned off,
93                                      unsigned size)
94 {
95     uint32_t cfg_addr, limit;
96     PCIDevice *pdev;
97     uint64_t val;
98 
99     pdev = pnv_phb4_find_cfg_dev(phb);
100     if (!pdev) {
101         return ~0ull;
102     }
103     cfg_addr = (phb->regs[PHB_CONFIG_ADDRESS >> 3] >> 32) & 0xffc;
104     cfg_addr |= off;
105     limit = pci_config_size(pdev);
106     if (limit <= cfg_addr) {
107         /*
108          * conventional pci device can be behind pcie-to-pci bridge.
109          * 256 <= addr < 4K has no effects.
110          */
111         return ~0ull;
112     }
113     val = pci_host_config_read_common(pdev, cfg_addr, limit, size);
114     switch (size) {
115     case 1:
116         return val;
117     case 2:
118         return bswap16(val);
119     case 4:
120         return bswap32(val);
121     default:
122         g_assert_not_reached();
123     }
124 }
125 
126 /*
127  * Root complex register accesses are memory mapped.
128  */
129 static void pnv_phb4_rc_config_write(PnvPHB4 *phb, unsigned off,
130                                      unsigned size, uint64_t val)
131 {
132     PCIHostState *pci = PCI_HOST_BRIDGE(phb->phb_base);
133     PCIDevice *pdev;
134 
135     if (size != 4) {
136         phb_error(phb, "rc_config_write invalid size %d", size);
137         return;
138     }
139 
140     pdev = pci_find_device(pci->bus, 0, 0);
141     if (!pdev) {
142         phb_error(phb, "rc_config_write device not found");
143         return;
144     }
145 
146     pci_host_config_write_common(pdev, off, PHB_RC_CONFIG_SIZE,
147                                  bswap32(val), 4);
148 }
149 
150 static uint64_t pnv_phb4_rc_config_read(PnvPHB4 *phb, unsigned off,
151                                         unsigned size)
152 {
153     PCIHostState *pci = PCI_HOST_BRIDGE(phb->phb_base);
154     PCIDevice *pdev;
155     uint64_t val;
156 
157     if (size != 4) {
158         phb_error(phb, "rc_config_read invalid size %d", size);
159         return ~0ull;
160     }
161 
162     pdev = pci_find_device(pci->bus, 0, 0);
163     if (!pdev) {
164         phb_error(phb, "rc_config_read device not found");
165         return ~0ull;
166     }
167 
168     val = pci_host_config_read_common(pdev, off, PHB_RC_CONFIG_SIZE, 4);
169     return bswap32(val);
170 }
171 
172 static void pnv_phb4_check_mbt(PnvPHB4 *phb, uint32_t index)
173 {
174     uint64_t base, start, size, mbe0, mbe1;
175     MemoryRegion *parent;
176     char name[64];
177 
178     /* Unmap first */
179     if (memory_region_is_mapped(&phb->mr_mmio[index])) {
180         /* Should we destroy it in RCU friendly way... ? */
181         memory_region_del_subregion(phb->mr_mmio[index].container,
182                                     &phb->mr_mmio[index]);
183     }
184 
185     /* Get table entry */
186     mbe0 = phb->ioda_MBT[(index << 1)];
187     mbe1 = phb->ioda_MBT[(index << 1) + 1];
188 
189     if (!(mbe0 & IODA3_MBT0_ENABLE)) {
190         return;
191     }
192 
193     /* Grab geometry from registers */
194     base = GETFIELD(IODA3_MBT0_BASE_ADDR, mbe0) << 12;
195     size = GETFIELD(IODA3_MBT1_MASK, mbe1) << 12;
196     size |= 0xff00000000000000ull;
197     size = ~size + 1;
198 
199     /* Calculate PCI side start address based on M32/M64 window type */
200     if (mbe0 & IODA3_MBT0_TYPE_M32) {
201         start = phb->regs[PHB_M32_START_ADDR >> 3];
202         if ((start + size) > 0x100000000ull) {
203             phb_error(phb, "M32 set beyond 4GB boundary !");
204             size = 0x100000000 - start;
205         }
206     } else {
207         start = base | (phb->regs[PHB_M64_UPPER_BITS >> 3]);
208     }
209 
210     /* TODO: Figure out how to implement/decode AOMASK */
211 
212     /* Check if it matches an enabled MMIO region in the PEC stack */
213     if (memory_region_is_mapped(&phb->mmbar0) &&
214         base >= phb->mmio0_base &&
215         (base + size) <= (phb->mmio0_base + phb->mmio0_size)) {
216         parent = &phb->mmbar0;
217         base -= phb->mmio0_base;
218     } else if (memory_region_is_mapped(&phb->mmbar1) &&
219         base >= phb->mmio1_base &&
220         (base + size) <= (phb->mmio1_base + phb->mmio1_size)) {
221         parent = &phb->mmbar1;
222         base -= phb->mmio1_base;
223     } else {
224         phb_error(phb, "PHB MBAR %d out of parent bounds", index);
225         return;
226     }
227 
228     /* Create alias (better name ?) */
229     snprintf(name, sizeof(name), "phb4-mbar%d", index);
230     memory_region_init_alias(&phb->mr_mmio[index], OBJECT(phb), name,
231                              &phb->pci_mmio, start, size);
232     memory_region_add_subregion(parent, base, &phb->mr_mmio[index]);
233 }
234 
235 static void pnv_phb4_check_all_mbt(PnvPHB4 *phb)
236 {
237     uint64_t i;
238     uint32_t num_windows = phb->big_phb ? PNV_PHB4_MAX_MMIO_WINDOWS :
239         PNV_PHB4_MIN_MMIO_WINDOWS;
240 
241     for (i = 0; i < num_windows; i++) {
242         pnv_phb4_check_mbt(phb, i);
243     }
244 }
245 
246 static uint64_t *pnv_phb4_ioda_access(PnvPHB4 *phb,
247                                       unsigned *out_table, unsigned *out_idx)
248 {
249     uint64_t adreg = phb->regs[PHB_IODA_ADDR >> 3];
250     unsigned int index = GETFIELD(PHB_IODA_AD_TADR, adreg);
251     unsigned int table = GETFIELD(PHB_IODA_AD_TSEL, adreg);
252     unsigned int mask;
253     uint64_t *tptr = NULL;
254 
255     switch (table) {
256     case IODA3_TBL_LIST:
257         tptr = phb->ioda_LIST;
258         mask = 7;
259         break;
260     case IODA3_TBL_MIST:
261         tptr = phb->ioda_MIST;
262         mask = phb->big_phb ? PNV_PHB4_MAX_MIST : (PNV_PHB4_MAX_MIST >> 1);
263         mask -= 1;
264         break;
265     case IODA3_TBL_RCAM:
266         mask = phb->big_phb ? 127 : 63;
267         break;
268     case IODA3_TBL_MRT:
269         mask = phb->big_phb ? 15 : 7;
270         break;
271     case IODA3_TBL_PESTA:
272     case IODA3_TBL_PESTB:
273         mask = phb->big_phb ? PNV_PHB4_MAX_PEs : (PNV_PHB4_MAX_PEs >> 1);
274         mask -= 1;
275         break;
276     case IODA3_TBL_TVT:
277         tptr = phb->ioda_TVT;
278         mask = phb->big_phb ? PNV_PHB4_MAX_TVEs : (PNV_PHB4_MAX_TVEs >> 1);
279         mask -= 1;
280         break;
281     case IODA3_TBL_TCR:
282     case IODA3_TBL_TDR:
283         mask = phb->big_phb ? 1023 : 511;
284         break;
285     case IODA3_TBL_MBT:
286         tptr = phb->ioda_MBT;
287         mask = phb->big_phb ? PNV_PHB4_MAX_MBEs : (PNV_PHB4_MAX_MBEs >> 1);
288         mask -= 1;
289         break;
290     case IODA3_TBL_MDT:
291         tptr = phb->ioda_MDT;
292         mask = phb->big_phb ? PNV_PHB4_MAX_PEs : (PNV_PHB4_MAX_PEs >> 1);
293         mask -= 1;
294         break;
295     case IODA3_TBL_PEEV:
296         tptr = phb->ioda_PEEV;
297         mask = phb->big_phb ? PNV_PHB4_MAX_PEEVs : (PNV_PHB4_MAX_PEEVs >> 1);
298         mask -= 1;
299         break;
300     default:
301         phb_error(phb, "invalid IODA table %d", table);
302         return NULL;
303     }
304     index &= mask;
305     if (out_idx) {
306         *out_idx = index;
307     }
308     if (out_table) {
309         *out_table = table;
310     }
311     if (tptr) {
312         tptr += index;
313     }
314     if (adreg & PHB_IODA_AD_AUTOINC) {
315         index = (index + 1) & mask;
316         adreg = SETFIELD(PHB_IODA_AD_TADR, adreg, index);
317     }
318 
319     phb->regs[PHB_IODA_ADDR >> 3] = adreg;
320     return tptr;
321 }
322 
323 static uint64_t pnv_phb4_ioda_read(PnvPHB4 *phb)
324 {
325     unsigned table, idx;
326     uint64_t *tptr;
327 
328     tptr = pnv_phb4_ioda_access(phb, &table, &idx);
329     if (!tptr) {
330         /* Special PESTA case */
331         if (table == IODA3_TBL_PESTA) {
332             return ((uint64_t)(phb->ioda_PEST_AB[idx] & 1)) << 63;
333         } else if (table == IODA3_TBL_PESTB) {
334             return ((uint64_t)(phb->ioda_PEST_AB[idx] & 2)) << 62;
335         }
336         /* Return 0 on unsupported tables, not ff's */
337         return 0;
338     }
339     return *tptr;
340 }
341 
342 static void pnv_phb4_ioda_write(PnvPHB4 *phb, uint64_t val)
343 {
344     unsigned table, idx;
345     uint64_t *tptr;
346 
347     tptr = pnv_phb4_ioda_access(phb, &table, &idx);
348     if (!tptr) {
349         /* Special PESTA case */
350         if (table == IODA3_TBL_PESTA) {
351             phb->ioda_PEST_AB[idx] &= ~1;
352             phb->ioda_PEST_AB[idx] |= (val >> 63) & 1;
353         } else if (table == IODA3_TBL_PESTB) {
354             phb->ioda_PEST_AB[idx] &= ~2;
355             phb->ioda_PEST_AB[idx] |= (val >> 62) & 2;
356         }
357         return;
358     }
359 
360     /* Handle side effects */
361     switch (table) {
362     case IODA3_TBL_LIST:
363         break;
364     case IODA3_TBL_MIST: {
365         /* Special mask for MIST partial write */
366         uint64_t adreg = phb->regs[PHB_IODA_ADDR >> 3];
367         uint32_t mmask = GETFIELD(PHB_IODA_AD_MIST_PWV, adreg);
368         uint64_t v = *tptr;
369         if (mmask == 0) {
370             mmask = 0xf;
371         }
372         if (mmask & 8) {
373             v &= 0x0000ffffffffffffull;
374             v |= 0xcfff000000000000ull & val;
375         }
376         if (mmask & 4) {
377             v &= 0xffff0000ffffffffull;
378             v |= 0x0000cfff00000000ull & val;
379         }
380         if (mmask & 2) {
381             v &= 0xffffffff0000ffffull;
382             v |= 0x00000000cfff0000ull & val;
383         }
384         if (mmask & 1) {
385             v &= 0xffffffffffff0000ull;
386             v |= 0x000000000000cfffull & val;
387         }
388         *tptr = v;
389         break;
390     }
391     case IODA3_TBL_MBT:
392         *tptr = val;
393 
394         /* Copy across the valid bit to the other half */
395         phb->ioda_MBT[idx ^ 1] &= 0x7fffffffffffffffull;
396         phb->ioda_MBT[idx ^ 1] |= 0x8000000000000000ull & val;
397 
398         /* Update mappings */
399         pnv_phb4_check_mbt(phb, idx >> 1);
400         break;
401     default:
402         *tptr = val;
403     }
404 }
405 
406 static void pnv_phb4_rtc_invalidate(PnvPHB4 *phb, uint64_t val)
407 {
408     PnvPhb4DMASpace *ds;
409 
410     /* Always invalidate all for now ... */
411     QLIST_FOREACH(ds, &phb->dma_spaces, list) {
412         ds->pe_num = PHB_INVALID_PE;
413     }
414 }
415 
416 static void pnv_phb4_update_msi_regions(PnvPhb4DMASpace *ds)
417 {
418     uint64_t cfg = ds->phb->regs[PHB_PHB4_CONFIG >> 3];
419 
420     if (cfg & PHB_PHB4C_32BIT_MSI_EN) {
421         if (!memory_region_is_mapped(MEMORY_REGION(&ds->msi32_mr))) {
422             memory_region_add_subregion(MEMORY_REGION(&ds->dma_mr),
423                                         0xffff0000, &ds->msi32_mr);
424         }
425     } else {
426         if (memory_region_is_mapped(MEMORY_REGION(&ds->msi32_mr))) {
427             memory_region_del_subregion(MEMORY_REGION(&ds->dma_mr),
428                                         &ds->msi32_mr);
429         }
430     }
431 
432     if (cfg & PHB_PHB4C_64BIT_MSI_EN) {
433         if (!memory_region_is_mapped(MEMORY_REGION(&ds->msi64_mr))) {
434             memory_region_add_subregion(MEMORY_REGION(&ds->dma_mr),
435                                         (1ull << 60), &ds->msi64_mr);
436         }
437     } else {
438         if (memory_region_is_mapped(MEMORY_REGION(&ds->msi64_mr))) {
439             memory_region_del_subregion(MEMORY_REGION(&ds->dma_mr),
440                                         &ds->msi64_mr);
441         }
442     }
443 }
444 
445 static void pnv_phb4_update_all_msi_regions(PnvPHB4 *phb)
446 {
447     PnvPhb4DMASpace *ds;
448 
449     QLIST_FOREACH(ds, &phb->dma_spaces, list) {
450         pnv_phb4_update_msi_regions(ds);
451     }
452 }
453 
454 static void pnv_phb4_update_xsrc(PnvPHB4 *phb)
455 {
456     int shift, flags, i, lsi_base;
457     XiveSource *xsrc = &phb->xsrc;
458 
459     /* The XIVE source characteristics can be set at run time */
460     if (phb->regs[PHB_CTRLR >> 3] & PHB_CTRLR_IRQ_PGSZ_64K) {
461         shift = XIVE_ESB_64K;
462     } else {
463         shift = XIVE_ESB_4K;
464     }
465     if (phb->regs[PHB_CTRLR >> 3] & PHB_CTRLR_IRQ_STORE_EOI) {
466         flags = XIVE_SRC_STORE_EOI;
467     } else {
468         flags = 0;
469     }
470 
471     /*
472      * When the PQ disable configuration bit is set, the check on the
473      * PQ state bits is disabled on the PHB side (for MSI only) and it
474      * is performed on the IC side instead.
475      */
476     if (phb->regs[PHB_CTRLR >> 3] & PHB_CTRLR_IRQ_PQ_DISABLE) {
477         flags |= XIVE_SRC_PQ_DISABLE;
478     }
479 
480     phb->xsrc.esb_shift = shift;
481     phb->xsrc.esb_flags = flags;
482 
483     lsi_base = GETFIELD(PHB_LSI_SRC_ID, phb->regs[PHB_LSI_SOURCE_ID >> 3]);
484     lsi_base <<= 3;
485 
486     /* TODO: handle reset values of PHB_LSI_SRC_ID */
487     if (!lsi_base) {
488         return;
489     }
490 
491     /* TODO: need a xive_source_irq_reset_lsi() */
492     bitmap_zero(xsrc->lsi_map, xsrc->nr_irqs);
493 
494     for (i = 0; i < xsrc->nr_irqs; i++) {
495         bool msi = (i < lsi_base || i >= (lsi_base + 8));
496         if (!msi) {
497             xive_source_irq_set_lsi(xsrc, i);
498         }
499     }
500 }
501 
502 static void pnv_phb4_reg_write(void *opaque, hwaddr off, uint64_t val,
503                                unsigned size)
504 {
505     PnvPHB4 *phb = PNV_PHB4(opaque);
506     bool changed;
507 
508     /* Special case outbound configuration data */
509     if ((off & 0xfffc) == PHB_CONFIG_DATA) {
510         pnv_phb4_config_write(phb, off & 0x3, size, val);
511         return;
512     }
513 
514     /* Special case RC configuration space */
515     if ((off & 0xf800) == PHB_RC_CONFIG_BASE) {
516         pnv_phb4_rc_config_write(phb, off & 0x7ff, size, val);
517         return;
518     }
519 
520     /* Other registers are 64-bit only */
521     if (size != 8 || off & 0x7) {
522         phb_error(phb, "Invalid register access, offset: 0x%"PRIx64" size: %d",
523                    off, size);
524         return;
525     }
526 
527     /* Handle masking */
528     switch (off) {
529     case PHB_LSI_SOURCE_ID:
530         val &= PHB_LSI_SRC_ID;
531         break;
532     case PHB_M64_UPPER_BITS:
533         val &= 0xff00000000000000ull;
534         break;
535     /* TCE Kill */
536     case PHB_TCE_KILL:
537         /* Clear top 3 bits which HW does to indicate successful queuing */
538         val &= ~(PHB_TCE_KILL_ALL | PHB_TCE_KILL_PE | PHB_TCE_KILL_ONE);
539         break;
540     case PHB_Q_DMA_R:
541         /*
542          * This is enough logic to make SW happy but we aren't
543          * actually quiescing the DMAs
544          */
545         if (val & PHB_Q_DMA_R_AUTORESET) {
546             val = 0;
547         } else {
548             val &= PHB_Q_DMA_R_QUIESCE_DMA;
549         }
550         break;
551     /* LEM stuff */
552     case PHB_LEM_FIR_AND_MASK:
553         phb->regs[PHB_LEM_FIR_ACCUM >> 3] &= val;
554         return;
555     case PHB_LEM_FIR_OR_MASK:
556         phb->regs[PHB_LEM_FIR_ACCUM >> 3] |= val;
557         return;
558     case PHB_LEM_ERROR_AND_MASK:
559         phb->regs[PHB_LEM_ERROR_MASK >> 3] &= val;
560         return;
561     case PHB_LEM_ERROR_OR_MASK:
562         phb->regs[PHB_LEM_ERROR_MASK >> 3] |= val;
563         return;
564     case PHB_LEM_WOF:
565         val = 0;
566         break;
567     /* TODO: More regs ..., maybe create a table with masks... */
568 
569     /* Read only registers */
570     case PHB_CPU_LOADSTORE_STATUS:
571     case PHB_ETU_ERR_SUMMARY:
572     case PHB_PHB4_GEN_CAP:
573     case PHB_PHB4_TCE_CAP:
574     case PHB_PHB4_IRQ_CAP:
575     case PHB_PHB4_EEH_CAP:
576         return;
577     }
578 
579     /* Record whether it changed */
580     changed = phb->regs[off >> 3] != val;
581 
582     /* Store in register cache first */
583     phb->regs[off >> 3] = val;
584 
585     /* Handle side effects */
586     switch (off) {
587     case PHB_PHB4_CONFIG:
588         if (changed) {
589             pnv_phb4_update_all_msi_regions(phb);
590         }
591         break;
592     case PHB_M32_START_ADDR:
593     case PHB_M64_UPPER_BITS:
594         if (changed) {
595             pnv_phb4_check_all_mbt(phb);
596         }
597         break;
598 
599     /* IODA table accesses */
600     case PHB_IODA_DATA0:
601         pnv_phb4_ioda_write(phb, val);
602         break;
603 
604     /* RTC invalidation */
605     case PHB_RTC_INVALIDATE:
606         pnv_phb4_rtc_invalidate(phb, val);
607         break;
608 
609     /* PHB Control (Affects XIVE source) */
610     case PHB_CTRLR:
611     case PHB_LSI_SOURCE_ID:
612         pnv_phb4_update_xsrc(phb);
613         break;
614 
615     /* Silent simple writes */
616     case PHB_ASN_CMPM:
617     case PHB_CONFIG_ADDRESS:
618     case PHB_IODA_ADDR:
619     case PHB_TCE_KILL:
620     case PHB_TCE_SPEC_CTL:
621     case PHB_PEST_BAR:
622     case PHB_PELTV_BAR:
623     case PHB_RTT_BAR:
624     case PHB_LEM_FIR_ACCUM:
625     case PHB_LEM_ERROR_MASK:
626     case PHB_LEM_ACTION0:
627     case PHB_LEM_ACTION1:
628     case PHB_TCE_TAG_ENABLE:
629     case PHB_INT_NOTIFY_ADDR:
630     case PHB_INT_NOTIFY_INDEX:
631     case PHB_DMARD_SYNC:
632        break;
633 
634     /* Noise on anything else */
635     default:
636         qemu_log_mask(LOG_UNIMP, "phb4: reg_write 0x%"PRIx64"=%"PRIx64"\n",
637                       off, val);
638     }
639 }
640 
641 static uint64_t pnv_phb4_reg_read(void *opaque, hwaddr off, unsigned size)
642 {
643     PnvPHB4 *phb = PNV_PHB4(opaque);
644     uint64_t val;
645 
646     if ((off & 0xfffc) == PHB_CONFIG_DATA) {
647         return pnv_phb4_config_read(phb, off & 0x3, size);
648     }
649 
650     /* Special case RC configuration space */
651     if ((off & 0xf800) == PHB_RC_CONFIG_BASE) {
652         return pnv_phb4_rc_config_read(phb, off & 0x7ff, size);
653     }
654 
655     /* Other registers are 64-bit only */
656     if (size != 8 || off & 0x7) {
657         phb_error(phb, "Invalid register access, offset: 0x%"PRIx64" size: %d",
658                    off, size);
659         return ~0ull;
660     }
661 
662     /* Default read from cache */
663     val = phb->regs[off >> 3];
664 
665     switch (off) {
666     case PHB_VERSION:
667         return PNV_PHB4_PEC_GET_CLASS(phb->pec)->version;
668 
669         /* Read-only */
670     case PHB_PHB4_GEN_CAP:
671         return 0xe4b8000000000000ull;
672     case PHB_PHB4_TCE_CAP:
673         return phb->big_phb ? 0x4008440000000400ull : 0x2008440000000200ull;
674     case PHB_PHB4_IRQ_CAP:
675         return phb->big_phb ? 0x0800000000001000ull : 0x0800000000000800ull;
676     case PHB_PHB4_EEH_CAP:
677         return phb->big_phb ? 0x2000000000000000ull : 0x1000000000000000ull;
678 
679     /* IODA table accesses */
680     case PHB_IODA_DATA0:
681         return pnv_phb4_ioda_read(phb);
682 
683     /* Link training always appears trained */
684     case PHB_PCIE_DLP_TRAIN_CTL:
685         /* TODO: Do something sensible with speed ? */
686         return PHB_PCIE_DLP_INBAND_PRESENCE | PHB_PCIE_DLP_TL_LINKACT;
687 
688     /* DMA read sync: make it look like it's complete */
689     case PHB_DMARD_SYNC:
690         return PHB_DMARD_SYNC_COMPLETE;
691 
692     /* Silent simple reads */
693     case PHB_LSI_SOURCE_ID:
694     case PHB_CPU_LOADSTORE_STATUS:
695     case PHB_ASN_CMPM:
696     case PHB_PHB4_CONFIG:
697     case PHB_M32_START_ADDR:
698     case PHB_CONFIG_ADDRESS:
699     case PHB_IODA_ADDR:
700     case PHB_RTC_INVALIDATE:
701     case PHB_TCE_KILL:
702     case PHB_TCE_SPEC_CTL:
703     case PHB_PEST_BAR:
704     case PHB_PELTV_BAR:
705     case PHB_RTT_BAR:
706     case PHB_M64_UPPER_BITS:
707     case PHB_CTRLR:
708     case PHB_LEM_FIR_ACCUM:
709     case PHB_LEM_ERROR_MASK:
710     case PHB_LEM_ACTION0:
711     case PHB_LEM_ACTION1:
712     case PHB_TCE_TAG_ENABLE:
713     case PHB_INT_NOTIFY_ADDR:
714     case PHB_INT_NOTIFY_INDEX:
715     case PHB_Q_DMA_R:
716     case PHB_ETU_ERR_SUMMARY:
717         break;
718 
719     /* Noise on anything else */
720     default:
721         qemu_log_mask(LOG_UNIMP, "phb4: reg_read 0x%"PRIx64"=%"PRIx64"\n",
722                       off, val);
723     }
724     return val;
725 }
726 
727 static const MemoryRegionOps pnv_phb4_reg_ops = {
728     .read = pnv_phb4_reg_read,
729     .write = pnv_phb4_reg_write,
730     .valid.min_access_size = 1,
731     .valid.max_access_size = 8,
732     .impl.min_access_size = 1,
733     .impl.max_access_size = 8,
734     .endianness = DEVICE_BIG_ENDIAN,
735 };
736 
737 static uint64_t pnv_phb4_xscom_read(void *opaque, hwaddr addr, unsigned size)
738 {
739     PnvPHB4 *phb = PNV_PHB4(opaque);
740     uint32_t reg = addr >> 3;
741     uint64_t val;
742     hwaddr offset;
743 
744     switch (reg) {
745     case PHB_SCOM_HV_IND_ADDR:
746         return phb->scom_hv_ind_addr_reg;
747 
748     case PHB_SCOM_HV_IND_DATA:
749         if (!(phb->scom_hv_ind_addr_reg & PHB_SCOM_HV_IND_ADDR_VALID)) {
750             phb_error(phb, "Invalid indirect address");
751             return ~0ull;
752         }
753         size = (phb->scom_hv_ind_addr_reg & PHB_SCOM_HV_IND_ADDR_4B) ? 4 : 8;
754         offset = GETFIELD(PHB_SCOM_HV_IND_ADDR_ADDR, phb->scom_hv_ind_addr_reg);
755         val = pnv_phb4_reg_read(phb, offset, size);
756         if (phb->scom_hv_ind_addr_reg & PHB_SCOM_HV_IND_ADDR_AUTOINC) {
757             offset += size;
758             offset &= 0x3fff;
759             phb->scom_hv_ind_addr_reg = SETFIELD(PHB_SCOM_HV_IND_ADDR_ADDR,
760                                                  phb->scom_hv_ind_addr_reg,
761                                                  offset);
762         }
763         return val;
764     case PHB_SCOM_ETU_LEM_FIR:
765     case PHB_SCOM_ETU_LEM_FIR_AND:
766     case PHB_SCOM_ETU_LEM_FIR_OR:
767     case PHB_SCOM_ETU_LEM_FIR_MSK:
768     case PHB_SCOM_ETU_LEM_ERR_MSK_AND:
769     case PHB_SCOM_ETU_LEM_ERR_MSK_OR:
770     case PHB_SCOM_ETU_LEM_ACT0:
771     case PHB_SCOM_ETU_LEM_ACT1:
772     case PHB_SCOM_ETU_LEM_WOF:
773         offset = ((reg - PHB_SCOM_ETU_LEM_FIR) << 3) + PHB_LEM_FIR_ACCUM;
774         return pnv_phb4_reg_read(phb, offset, size);
775     case PHB_SCOM_ETU_PMON_CONFIG:
776     case PHB_SCOM_ETU_PMON_CTR0:
777     case PHB_SCOM_ETU_PMON_CTR1:
778     case PHB_SCOM_ETU_PMON_CTR2:
779     case PHB_SCOM_ETU_PMON_CTR3:
780         offset = ((reg - PHB_SCOM_ETU_PMON_CONFIG) << 3) + PHB_PERFMON_CONFIG;
781         return pnv_phb4_reg_read(phb, offset, size);
782 
783     default:
784         qemu_log_mask(LOG_UNIMP, "phb4: xscom_read 0x%"HWADDR_PRIx"\n", addr);
785         return ~0ull;
786     }
787 }
788 
789 static void pnv_phb4_xscom_write(void *opaque, hwaddr addr,
790                                  uint64_t val, unsigned size)
791 {
792     PnvPHB4 *phb = PNV_PHB4(opaque);
793     uint32_t reg = addr >> 3;
794     hwaddr offset;
795 
796     switch (reg) {
797     case PHB_SCOM_HV_IND_ADDR:
798         phb->scom_hv_ind_addr_reg = val & 0xe000000000001fff;
799         break;
800     case PHB_SCOM_HV_IND_DATA:
801         if (!(phb->scom_hv_ind_addr_reg & PHB_SCOM_HV_IND_ADDR_VALID)) {
802             phb_error(phb, "Invalid indirect address");
803             break;
804         }
805         size = (phb->scom_hv_ind_addr_reg & PHB_SCOM_HV_IND_ADDR_4B) ? 4 : 8;
806         offset = GETFIELD(PHB_SCOM_HV_IND_ADDR_ADDR, phb->scom_hv_ind_addr_reg);
807         pnv_phb4_reg_write(phb, offset, val, size);
808         if (phb->scom_hv_ind_addr_reg & PHB_SCOM_HV_IND_ADDR_AUTOINC) {
809             offset += size;
810             offset &= 0x3fff;
811             phb->scom_hv_ind_addr_reg = SETFIELD(PHB_SCOM_HV_IND_ADDR_ADDR,
812                                                  phb->scom_hv_ind_addr_reg,
813                                                  offset);
814         }
815         break;
816     case PHB_SCOM_ETU_LEM_FIR:
817     case PHB_SCOM_ETU_LEM_FIR_AND:
818     case PHB_SCOM_ETU_LEM_FIR_OR:
819     case PHB_SCOM_ETU_LEM_FIR_MSK:
820     case PHB_SCOM_ETU_LEM_ERR_MSK_AND:
821     case PHB_SCOM_ETU_LEM_ERR_MSK_OR:
822     case PHB_SCOM_ETU_LEM_ACT0:
823     case PHB_SCOM_ETU_LEM_ACT1:
824     case PHB_SCOM_ETU_LEM_WOF:
825         offset = ((reg - PHB_SCOM_ETU_LEM_FIR) << 3) + PHB_LEM_FIR_ACCUM;
826         pnv_phb4_reg_write(phb, offset, val, size);
827         break;
828     case PHB_SCOM_ETU_PMON_CONFIG:
829     case PHB_SCOM_ETU_PMON_CTR0:
830     case PHB_SCOM_ETU_PMON_CTR1:
831     case PHB_SCOM_ETU_PMON_CTR2:
832     case PHB_SCOM_ETU_PMON_CTR3:
833         offset = ((reg - PHB_SCOM_ETU_PMON_CONFIG) << 3) + PHB_PERFMON_CONFIG;
834         pnv_phb4_reg_write(phb, offset, val, size);
835         break;
836     default:
837         qemu_log_mask(LOG_UNIMP, "phb4: xscom_write 0x%"HWADDR_PRIx
838                       "=%"PRIx64"\n", addr, val);
839     }
840 }
841 
842 const MemoryRegionOps pnv_phb4_xscom_ops = {
843     .read = pnv_phb4_xscom_read,
844     .write = pnv_phb4_xscom_write,
845     .valid.min_access_size = 8,
846     .valid.max_access_size = 8,
847     .impl.min_access_size = 8,
848     .impl.max_access_size = 8,
849     .endianness = DEVICE_BIG_ENDIAN,
850 };
851 
852 static uint64_t pnv_pec_stk_nest_xscom_read(void *opaque, hwaddr addr,
853                                             unsigned size)
854 {
855     PnvPHB4 *phb = PNV_PHB4(opaque);
856     uint32_t reg = addr >> 3;
857 
858     /* TODO: add list of allowed registers and error out if not */
859     return phb->nest_regs[reg];
860 }
861 
862 /*
863  * Return the 'stack_no' of a PHB4. 'stack_no' is the order
864  * the PHB4 occupies in the PEC. This is the reverse of what
865  * pnv_phb4_pec_get_phb_id() does.
866  *
867  * E.g. a phb with phb_id = 4 and pec->index = 1 (PEC1) will
868  * be the second phb (stack_no = 1) of the PEC.
869  */
870 static int pnv_phb4_get_phb_stack_no(PnvPHB4 *phb)
871 {
872     PnvPhb4PecState *pec = phb->pec;
873     PnvPhb4PecClass *pecc = PNV_PHB4_PEC_GET_CLASS(pec);
874     int index = pec->index;
875     int stack_no = phb->phb_id;
876 
877     while (index--) {
878         stack_no -= pecc->num_phbs[index];
879     }
880 
881     return stack_no;
882 }
883 
884 static void pnv_phb4_update_regions(PnvPHB4 *phb)
885 {
886     /* Unmap first always */
887     if (memory_region_is_mapped(&phb->mr_regs)) {
888         memory_region_del_subregion(&phb->phbbar, &phb->mr_regs);
889     }
890     if (memory_region_is_mapped(&phb->xsrc.esb_mmio)) {
891         memory_region_del_subregion(&phb->intbar, &phb->xsrc.esb_mmio);
892     }
893 
894     /* Map registers if enabled */
895     if (memory_region_is_mapped(&phb->phbbar)) {
896         memory_region_add_subregion(&phb->phbbar, 0, &phb->mr_regs);
897     }
898 
899     /* Map ESB if enabled */
900     if (memory_region_is_mapped(&phb->intbar)) {
901         memory_region_add_subregion(&phb->intbar, 0, &phb->xsrc.esb_mmio);
902     }
903 
904     /* Check/update m32 */
905     pnv_phb4_check_all_mbt(phb);
906 }
907 
908 static void pnv_pec_phb_update_map(PnvPHB4 *phb)
909 {
910     PnvPhb4PecState *pec = phb->pec;
911     MemoryRegion *sysmem = get_system_memory();
912     uint64_t bar_en = phb->nest_regs[PEC_NEST_STK_BAR_EN];
913     int stack_no = pnv_phb4_get_phb_stack_no(phb);
914     uint64_t bar, mask, size;
915     char name[64];
916 
917     /*
918      * NOTE: This will really not work well if those are remapped
919      * after the PHB has created its sub regions. We could do better
920      * if we had a way to resize regions but we don't really care
921      * that much in practice as the stuff below really only happens
922      * once early during boot
923      */
924 
925     /* Handle unmaps */
926     if (memory_region_is_mapped(&phb->mmbar0) &&
927         !(bar_en & PEC_NEST_STK_BAR_EN_MMIO0)) {
928         memory_region_del_subregion(sysmem, &phb->mmbar0);
929     }
930     if (memory_region_is_mapped(&phb->mmbar1) &&
931         !(bar_en & PEC_NEST_STK_BAR_EN_MMIO1)) {
932         memory_region_del_subregion(sysmem, &phb->mmbar1);
933     }
934     if (memory_region_is_mapped(&phb->phbbar) &&
935         !(bar_en & PEC_NEST_STK_BAR_EN_PHB)) {
936         memory_region_del_subregion(sysmem, &phb->phbbar);
937     }
938     if (memory_region_is_mapped(&phb->intbar) &&
939         !(bar_en & PEC_NEST_STK_BAR_EN_INT)) {
940         memory_region_del_subregion(sysmem, &phb->intbar);
941     }
942 
943     /* Update PHB */
944     pnv_phb4_update_regions(phb);
945 
946     /* Handle maps */
947     if (!memory_region_is_mapped(&phb->mmbar0) &&
948         (bar_en & PEC_NEST_STK_BAR_EN_MMIO0)) {
949         bar = phb->nest_regs[PEC_NEST_STK_MMIO_BAR0] >> 8;
950         mask = phb->nest_regs[PEC_NEST_STK_MMIO_BAR0_MASK];
951         size = ((~mask) >> 8) + 1;
952         snprintf(name, sizeof(name), "pec-%d.%d-phb-%d-mmio0",
953                  pec->chip_id, pec->index, stack_no);
954         memory_region_init(&phb->mmbar0, OBJECT(phb), name, size);
955         memory_region_add_subregion(sysmem, bar, &phb->mmbar0);
956         phb->mmio0_base = bar;
957         phb->mmio0_size = size;
958     }
959     if (!memory_region_is_mapped(&phb->mmbar1) &&
960         (bar_en & PEC_NEST_STK_BAR_EN_MMIO1)) {
961         bar = phb->nest_regs[PEC_NEST_STK_MMIO_BAR1] >> 8;
962         mask = phb->nest_regs[PEC_NEST_STK_MMIO_BAR1_MASK];
963         size = ((~mask) >> 8) + 1;
964         snprintf(name, sizeof(name), "pec-%d.%d-phb-%d-mmio1",
965                  pec->chip_id, pec->index, stack_no);
966         memory_region_init(&phb->mmbar1, OBJECT(phb), name, size);
967         memory_region_add_subregion(sysmem, bar, &phb->mmbar1);
968         phb->mmio1_base = bar;
969         phb->mmio1_size = size;
970     }
971     if (!memory_region_is_mapped(&phb->phbbar) &&
972         (bar_en & PEC_NEST_STK_BAR_EN_PHB)) {
973         bar = phb->nest_regs[PEC_NEST_STK_PHB_REGS_BAR] >> 8;
974         size = PNV_PHB4_NUM_REGS << 3;
975         snprintf(name, sizeof(name), "pec-%d.%d-phb-%d",
976                  pec->chip_id, pec->index, stack_no);
977         memory_region_init(&phb->phbbar, OBJECT(phb), name, size);
978         memory_region_add_subregion(sysmem, bar, &phb->phbbar);
979     }
980     if (!memory_region_is_mapped(&phb->intbar) &&
981         (bar_en & PEC_NEST_STK_BAR_EN_INT)) {
982         bar = phb->nest_regs[PEC_NEST_STK_INT_BAR] >> 8;
983         size = PNV_PHB4_MAX_INTs << 16;
984         snprintf(name, sizeof(name), "pec-%d.%d-phb-%d-int",
985                  phb->pec->chip_id, phb->pec->index, stack_no);
986         memory_region_init(&phb->intbar, OBJECT(phb), name, size);
987         memory_region_add_subregion(sysmem, bar, &phb->intbar);
988     }
989 
990     /* Update PHB */
991     pnv_phb4_update_regions(phb);
992 }
993 
994 static void pnv_pec_stk_nest_xscom_write(void *opaque, hwaddr addr,
995                                          uint64_t val, unsigned size)
996 {
997     PnvPHB4 *phb = PNV_PHB4(opaque);
998     PnvPhb4PecState *pec = phb->pec;
999     uint32_t reg = addr >> 3;
1000 
1001     switch (reg) {
1002     case PEC_NEST_STK_PCI_NEST_FIR:
1003         phb->nest_regs[PEC_NEST_STK_PCI_NEST_FIR] = val;
1004         break;
1005     case PEC_NEST_STK_PCI_NEST_FIR_CLR:
1006         phb->nest_regs[PEC_NEST_STK_PCI_NEST_FIR] &= val;
1007         break;
1008     case PEC_NEST_STK_PCI_NEST_FIR_SET:
1009         phb->nest_regs[PEC_NEST_STK_PCI_NEST_FIR] |= val;
1010         break;
1011     case PEC_NEST_STK_PCI_NEST_FIR_MSK:
1012         phb->nest_regs[PEC_NEST_STK_PCI_NEST_FIR_MSK] = val;
1013         break;
1014     case PEC_NEST_STK_PCI_NEST_FIR_MSKC:
1015         phb->nest_regs[PEC_NEST_STK_PCI_NEST_FIR_MSK] &= val;
1016         break;
1017     case PEC_NEST_STK_PCI_NEST_FIR_MSKS:
1018         phb->nest_regs[PEC_NEST_STK_PCI_NEST_FIR_MSK] |= val;
1019         break;
1020     case PEC_NEST_STK_PCI_NEST_FIR_ACT0:
1021     case PEC_NEST_STK_PCI_NEST_FIR_ACT1:
1022         phb->nest_regs[reg] = val;
1023         break;
1024     case PEC_NEST_STK_PCI_NEST_FIR_WOF:
1025         phb->nest_regs[reg] = 0;
1026         break;
1027     case PEC_NEST_STK_ERR_REPORT_0:
1028     case PEC_NEST_STK_ERR_REPORT_1:
1029     case PEC_NEST_STK_PBCQ_GNRL_STATUS:
1030         /* Flag error ? */
1031         break;
1032     case PEC_NEST_STK_PBCQ_MODE:
1033         phb->nest_regs[reg] = val & 0xff00000000000000ull;
1034         break;
1035     case PEC_NEST_STK_MMIO_BAR0:
1036     case PEC_NEST_STK_MMIO_BAR0_MASK:
1037     case PEC_NEST_STK_MMIO_BAR1:
1038     case PEC_NEST_STK_MMIO_BAR1_MASK:
1039         if (phb->nest_regs[PEC_NEST_STK_BAR_EN] &
1040             (PEC_NEST_STK_BAR_EN_MMIO0 |
1041              PEC_NEST_STK_BAR_EN_MMIO1)) {
1042             phb_pec_error(pec, "Changing enabled BAR unsupported");
1043         }
1044         phb->nest_regs[reg] = val & 0xffffffffff000000ull;
1045         break;
1046     case PEC_NEST_STK_PHB_REGS_BAR:
1047         if (phb->nest_regs[PEC_NEST_STK_BAR_EN] & PEC_NEST_STK_BAR_EN_PHB) {
1048             phb_pec_error(pec, "Changing enabled BAR unsupported");
1049         }
1050         phb->nest_regs[reg] = val & 0xffffffffffc00000ull;
1051         break;
1052     case PEC_NEST_STK_INT_BAR:
1053         if (phb->nest_regs[PEC_NEST_STK_BAR_EN] & PEC_NEST_STK_BAR_EN_INT) {
1054             phb_pec_error(pec, "Changing enabled BAR unsupported");
1055         }
1056         phb->nest_regs[reg] = val & 0xfffffff000000000ull;
1057         break;
1058     case PEC_NEST_STK_BAR_EN:
1059         phb->nest_regs[reg] = val & 0xf000000000000000ull;
1060         pnv_pec_phb_update_map(phb);
1061         break;
1062     case PEC_NEST_STK_DATA_FRZ_TYPE:
1063     case PEC_NEST_STK_PBCQ_TUN_BAR:
1064         /* Not used for now */
1065         phb->nest_regs[reg] = val;
1066         break;
1067     default:
1068         qemu_log_mask(LOG_UNIMP, "phb4_pec: nest_xscom_write 0x%"HWADDR_PRIx
1069                       "=%"PRIx64"\n", addr, val);
1070     }
1071 }
1072 
1073 static const MemoryRegionOps pnv_pec_stk_nest_xscom_ops = {
1074     .read = pnv_pec_stk_nest_xscom_read,
1075     .write = pnv_pec_stk_nest_xscom_write,
1076     .valid.min_access_size = 8,
1077     .valid.max_access_size = 8,
1078     .impl.min_access_size = 8,
1079     .impl.max_access_size = 8,
1080     .endianness = DEVICE_BIG_ENDIAN,
1081 };
1082 
1083 static uint64_t pnv_pec_stk_pci_xscom_read(void *opaque, hwaddr addr,
1084                                            unsigned size)
1085 {
1086     PnvPHB4 *phb = PNV_PHB4(opaque);
1087     uint32_t reg = addr >> 3;
1088 
1089     /* TODO: add list of allowed registers and error out if not */
1090     return phb->pci_regs[reg];
1091 }
1092 
1093 static void pnv_pec_stk_pci_xscom_write(void *opaque, hwaddr addr,
1094                                         uint64_t val, unsigned size)
1095 {
1096     PnvPHB4 *phb = PNV_PHB4(opaque);
1097     uint32_t reg = addr >> 3;
1098 
1099     switch (reg) {
1100     case PEC_PCI_STK_PCI_FIR:
1101         phb->pci_regs[reg] = val;
1102         break;
1103     case PEC_PCI_STK_PCI_FIR_CLR:
1104         phb->pci_regs[PEC_PCI_STK_PCI_FIR] &= val;
1105         break;
1106     case PEC_PCI_STK_PCI_FIR_SET:
1107         phb->pci_regs[PEC_PCI_STK_PCI_FIR] |= val;
1108         break;
1109     case PEC_PCI_STK_PCI_FIR_MSK:
1110         phb->pci_regs[reg] = val;
1111         break;
1112     case PEC_PCI_STK_PCI_FIR_MSKC:
1113         phb->pci_regs[PEC_PCI_STK_PCI_FIR_MSK] &= val;
1114         break;
1115     case PEC_PCI_STK_PCI_FIR_MSKS:
1116         phb->pci_regs[PEC_PCI_STK_PCI_FIR_MSK] |= val;
1117         break;
1118     case PEC_PCI_STK_PCI_FIR_ACT0:
1119     case PEC_PCI_STK_PCI_FIR_ACT1:
1120         phb->pci_regs[reg] = val;
1121         break;
1122     case PEC_PCI_STK_PCI_FIR_WOF:
1123         phb->pci_regs[reg] = 0;
1124         break;
1125     case PEC_PCI_STK_ETU_RESET:
1126         phb->pci_regs[reg] = val & 0x8000000000000000ull;
1127         /* TODO: Implement reset */
1128         break;
1129     case PEC_PCI_STK_PBAIB_ERR_REPORT:
1130         break;
1131     case PEC_PCI_STK_PBAIB_TX_CMD_CRED:
1132     case PEC_PCI_STK_PBAIB_TX_DAT_CRED:
1133         phb->pci_regs[reg] = val;
1134         break;
1135     default:
1136         qemu_log_mask(LOG_UNIMP, "phb4_pec_stk: pci_xscom_write 0x%"HWADDR_PRIx
1137                       "=%"PRIx64"\n", addr, val);
1138     }
1139 }
1140 
1141 static const MemoryRegionOps pnv_pec_stk_pci_xscom_ops = {
1142     .read = pnv_pec_stk_pci_xscom_read,
1143     .write = pnv_pec_stk_pci_xscom_write,
1144     .valid.min_access_size = 8,
1145     .valid.max_access_size = 8,
1146     .impl.min_access_size = 8,
1147     .impl.max_access_size = 8,
1148     .endianness = DEVICE_BIG_ENDIAN,
1149 };
1150 
1151 static int pnv_phb4_map_irq(PCIDevice *pci_dev, int irq_num)
1152 {
1153     /* Check that out properly ... */
1154     return irq_num & 3;
1155 }
1156 
1157 static void pnv_phb4_set_irq(void *opaque, int irq_num, int level)
1158 {
1159     PnvPHB4 *phb = PNV_PHB4(opaque);
1160     uint32_t lsi_base;
1161 
1162     /* LSI only ... */
1163     if (irq_num > 3) {
1164         phb_error(phb, "IRQ %x is not an LSI", irq_num);
1165     }
1166     lsi_base = GETFIELD(PHB_LSI_SRC_ID, phb->regs[PHB_LSI_SOURCE_ID >> 3]);
1167     lsi_base <<= 3;
1168     qemu_set_irq(phb->qirqs[lsi_base + irq_num], level);
1169 }
1170 
1171 static bool pnv_phb4_resolve_pe(PnvPhb4DMASpace *ds)
1172 {
1173     uint64_t rtt, addr;
1174     uint16_t rte;
1175     int bus_num;
1176     int num_PEs;
1177 
1178     /* Already resolved ? */
1179     if (ds->pe_num != PHB_INVALID_PE) {
1180         return true;
1181     }
1182 
1183     /* We need to lookup the RTT */
1184     rtt = ds->phb->regs[PHB_RTT_BAR >> 3];
1185     if (!(rtt & PHB_RTT_BAR_ENABLE)) {
1186         phb_error(ds->phb, "DMA with RTT BAR disabled !");
1187         /* Set error bits ? fence ? ... */
1188         return false;
1189     }
1190 
1191     /* Read RTE */
1192     bus_num = pci_bus_num(ds->bus);
1193     addr = rtt & PHB_RTT_BASE_ADDRESS_MASK;
1194     addr += 2 * PCI_BUILD_BDF(bus_num, ds->devfn);
1195     if (dma_memory_read(&address_space_memory, addr, &rte,
1196                         sizeof(rte), MEMTXATTRS_UNSPECIFIED)) {
1197         phb_error(ds->phb, "Failed to read RTT entry at 0x%"PRIx64, addr);
1198         /* Set error bits ? fence ? ... */
1199         return false;
1200     }
1201     rte = be16_to_cpu(rte);
1202 
1203     /* Fail upon reading of invalid PE# */
1204     num_PEs = ds->phb->big_phb ? PNV_PHB4_MAX_PEs : (PNV_PHB4_MAX_PEs >> 1);
1205     if (rte >= num_PEs) {
1206         phb_error(ds->phb, "RTE for RID 0x%x invalid (%04x", ds->devfn, rte);
1207         rte &= num_PEs - 1;
1208     }
1209     ds->pe_num = rte;
1210     return true;
1211 }
1212 
1213 static void pnv_phb4_translate_tve(PnvPhb4DMASpace *ds, hwaddr addr,
1214                                    bool is_write, uint64_t tve,
1215                                    IOMMUTLBEntry *tlb)
1216 {
1217     uint64_t tta = GETFIELD(IODA3_TVT_TABLE_ADDR, tve);
1218     int32_t  lev = GETFIELD(IODA3_TVT_NUM_LEVELS, tve);
1219     uint32_t tts = GETFIELD(IODA3_TVT_TCE_TABLE_SIZE, tve);
1220     uint32_t tps = GETFIELD(IODA3_TVT_IO_PSIZE, tve);
1221 
1222     /* Invalid levels */
1223     if (lev > 4) {
1224         phb_error(ds->phb, "Invalid #levels in TVE %d", lev);
1225         return;
1226     }
1227 
1228     /* Invalid entry */
1229     if (tts == 0) {
1230         phb_error(ds->phb, "Access to invalid TVE");
1231         return;
1232     }
1233 
1234     /* IO Page Size of 0 means untranslated, else use TCEs */
1235     if (tps == 0) {
1236         /* TODO: Handle boundaries */
1237 
1238         /* Use 4k pages like q35 ... for now */
1239         tlb->iova = addr & 0xfffffffffffff000ull;
1240         tlb->translated_addr = addr & 0x0003fffffffff000ull;
1241         tlb->addr_mask = 0xfffull;
1242         tlb->perm = IOMMU_RW;
1243     } else {
1244         uint32_t tce_shift, tbl_shift, sh;
1245         uint64_t base, taddr, tce, tce_mask;
1246 
1247         /* Address bits per bottom level TCE entry */
1248         tce_shift = tps + 11;
1249 
1250         /* Address bits per table level */
1251         tbl_shift = tts + 8;
1252 
1253         /* Top level table base address */
1254         base = tta << 12;
1255 
1256         /* Total shift to first level */
1257         sh = tbl_shift * lev + tce_shift;
1258 
1259         /* TODO: Limit to support IO page sizes */
1260 
1261         /* TODO: Multi-level untested */
1262         do {
1263             lev--;
1264 
1265             /* Grab the TCE address */
1266             taddr = base | (((addr >> sh) & ((1ul << tbl_shift) - 1)) << 3);
1267             if (dma_memory_read(&address_space_memory, taddr, &tce,
1268                                 sizeof(tce), MEMTXATTRS_UNSPECIFIED)) {
1269                 phb_error(ds->phb, "Failed to read TCE at 0x%"PRIx64, taddr);
1270                 return;
1271             }
1272             tce = be64_to_cpu(tce);
1273 
1274             /* Check permission for indirect TCE */
1275             if ((lev >= 0) && !(tce & 3)) {
1276                 phb_error(ds->phb, "Invalid indirect TCE at 0x%"PRIx64, taddr);
1277                 phb_error(ds->phb, " xlate %"PRIx64":%c TVE=%"PRIx64, addr,
1278                            is_write ? 'W' : 'R', tve);
1279                 phb_error(ds->phb, " tta=%"PRIx64" lev=%d tts=%d tps=%d",
1280                            tta, lev, tts, tps);
1281                 return;
1282             }
1283             sh -= tbl_shift;
1284             base = tce & ~0xfffull;
1285         } while (lev >= 0);
1286 
1287         /* We exit the loop with TCE being the final TCE */
1288         if ((is_write & !(tce & 2)) || ((!is_write) && !(tce & 1))) {
1289             phb_error(ds->phb, "TCE access fault at 0x%"PRIx64, taddr);
1290             phb_error(ds->phb, " xlate %"PRIx64":%c TVE=%"PRIx64, addr,
1291                        is_write ? 'W' : 'R', tve);
1292             phb_error(ds->phb, " tta=%"PRIx64" lev=%d tts=%d tps=%d",
1293                        tta, lev, tts, tps);
1294             return;
1295         }
1296         tce_mask = ~((1ull << tce_shift) - 1);
1297         tlb->iova = addr & tce_mask;
1298         tlb->translated_addr = tce & tce_mask;
1299         tlb->addr_mask = ~tce_mask;
1300         tlb->perm = tce & 3;
1301     }
1302 }
1303 
1304 static IOMMUTLBEntry pnv_phb4_translate_iommu(IOMMUMemoryRegion *iommu,
1305                                               hwaddr addr,
1306                                               IOMMUAccessFlags flag,
1307                                               int iommu_idx)
1308 {
1309     PnvPhb4DMASpace *ds = container_of(iommu, PnvPhb4DMASpace, dma_mr);
1310     int tve_sel;
1311     uint64_t tve, cfg;
1312     IOMMUTLBEntry ret = {
1313         .target_as = &address_space_memory,
1314         .iova = addr,
1315         .translated_addr = 0,
1316         .addr_mask = ~(hwaddr)0,
1317         .perm = IOMMU_NONE,
1318     };
1319 
1320     /* Resolve PE# */
1321     if (!pnv_phb4_resolve_pe(ds)) {
1322         phb_error(ds->phb, "Failed to resolve PE# for bus @%p (%d) devfn 0x%x",
1323                    ds->bus, pci_bus_num(ds->bus), ds->devfn);
1324         return ret;
1325     }
1326 
1327     /* Check top bits */
1328     switch (addr >> 60) {
1329     case 00:
1330         /* DMA or 32-bit MSI ? */
1331         cfg = ds->phb->regs[PHB_PHB4_CONFIG >> 3];
1332         if ((cfg & PHB_PHB4C_32BIT_MSI_EN) &&
1333             ((addr & 0xffffffffffff0000ull) == 0xffff0000ull)) {
1334             phb_error(ds->phb, "xlate on 32-bit MSI region");
1335             return ret;
1336         }
1337         /* Choose TVE XXX Use PHB4 Control Register */
1338         tve_sel = (addr >> 59) & 1;
1339         tve = ds->phb->ioda_TVT[ds->pe_num * 2 + tve_sel];
1340         pnv_phb4_translate_tve(ds, addr, flag & IOMMU_WO, tve, &ret);
1341         break;
1342     case 01:
1343         phb_error(ds->phb, "xlate on 64-bit MSI region");
1344         break;
1345     default:
1346         phb_error(ds->phb, "xlate on unsupported address 0x%"PRIx64, addr);
1347     }
1348     return ret;
1349 }
1350 
1351 #define TYPE_PNV_PHB4_IOMMU_MEMORY_REGION "pnv-phb4-iommu-memory-region"
1352 DECLARE_INSTANCE_CHECKER(IOMMUMemoryRegion, PNV_PHB4_IOMMU_MEMORY_REGION,
1353                          TYPE_PNV_PHB4_IOMMU_MEMORY_REGION)
1354 
1355 static void pnv_phb4_iommu_memory_region_class_init(ObjectClass *klass,
1356                                                     void *data)
1357 {
1358     IOMMUMemoryRegionClass *imrc = IOMMU_MEMORY_REGION_CLASS(klass);
1359 
1360     imrc->translate = pnv_phb4_translate_iommu;
1361 }
1362 
1363 static const TypeInfo pnv_phb4_iommu_memory_region_info = {
1364     .parent = TYPE_IOMMU_MEMORY_REGION,
1365     .name = TYPE_PNV_PHB4_IOMMU_MEMORY_REGION,
1366     .class_init = pnv_phb4_iommu_memory_region_class_init,
1367 };
1368 
1369 /*
1370  * Return the index/phb-id of a PHB4 that belongs to a
1371  * pec->stacks[stack_index] stack.
1372  */
1373 int pnv_phb4_pec_get_phb_id(PnvPhb4PecState *pec, int stack_index)
1374 {
1375     PnvPhb4PecClass *pecc = PNV_PHB4_PEC_GET_CLASS(pec);
1376     int index = pec->index;
1377     int offset = 0;
1378 
1379     while (index--) {
1380         offset += pecc->num_phbs[index];
1381     }
1382 
1383     return offset + stack_index;
1384 }
1385 
1386 /*
1387  * MSI/MSIX memory region implementation.
1388  * The handler handles both MSI and MSIX.
1389  */
1390 static void pnv_phb4_msi_write(void *opaque, hwaddr addr,
1391                                uint64_t data, unsigned size)
1392 {
1393     PnvPhb4DMASpace *ds = opaque;
1394     PnvPHB4 *phb = ds->phb;
1395 
1396     uint32_t src = ((addr >> 4) & 0xffff) | (data & 0x1f);
1397 
1398     /* Resolve PE# */
1399     if (!pnv_phb4_resolve_pe(ds)) {
1400         phb_error(phb, "Failed to resolve PE# for bus @%p (%d) devfn 0x%x",
1401                    ds->bus, pci_bus_num(ds->bus), ds->devfn);
1402         return;
1403     }
1404 
1405     /* TODO: Check it doesn't collide with LSIs */
1406     if (src >= phb->xsrc.nr_irqs) {
1407         phb_error(phb, "MSI %d out of bounds", src);
1408         return;
1409     }
1410 
1411     /* TODO: check PE/MSI assignment */
1412 
1413     qemu_irq_pulse(phb->qirqs[src]);
1414 }
1415 
1416 /* There is no .read as the read result is undefined by PCI spec */
1417 static uint64_t pnv_phb4_msi_read(void *opaque, hwaddr addr, unsigned size)
1418 {
1419     PnvPhb4DMASpace *ds = opaque;
1420 
1421     phb_error(ds->phb, "Invalid MSI read @ 0x%" HWADDR_PRIx, addr);
1422     return -1;
1423 }
1424 
1425 static const MemoryRegionOps pnv_phb4_msi_ops = {
1426     .read = pnv_phb4_msi_read,
1427     .write = pnv_phb4_msi_write,
1428     .endianness = DEVICE_LITTLE_ENDIAN
1429 };
1430 
1431 static PnvPhb4DMASpace *pnv_phb4_dma_find(PnvPHB4 *phb, PCIBus *bus, int devfn)
1432 {
1433     PnvPhb4DMASpace *ds;
1434 
1435     QLIST_FOREACH(ds, &phb->dma_spaces, list) {
1436         if (ds->bus == bus && ds->devfn == devfn) {
1437             break;
1438         }
1439     }
1440     return ds;
1441 }
1442 
1443 static AddressSpace *pnv_phb4_dma_iommu(PCIBus *bus, void *opaque, int devfn)
1444 {
1445     PnvPHB4 *phb = opaque;
1446     PnvPhb4DMASpace *ds;
1447     char name[32];
1448 
1449     ds = pnv_phb4_dma_find(phb, bus, devfn);
1450 
1451     if (ds == NULL) {
1452         ds = g_new0(PnvPhb4DMASpace, 1);
1453         ds->bus = bus;
1454         ds->devfn = devfn;
1455         ds->pe_num = PHB_INVALID_PE;
1456         ds->phb = phb;
1457         snprintf(name, sizeof(name), "phb4-%d.%d-iommu", phb->chip_id,
1458                  phb->phb_id);
1459         memory_region_init_iommu(&ds->dma_mr, sizeof(ds->dma_mr),
1460                                  TYPE_PNV_PHB4_IOMMU_MEMORY_REGION,
1461                                  OBJECT(phb), name, UINT64_MAX);
1462         address_space_init(&ds->dma_as, MEMORY_REGION(&ds->dma_mr),
1463                            name);
1464         memory_region_init_io(&ds->msi32_mr, OBJECT(phb), &pnv_phb4_msi_ops,
1465                               ds, "msi32", 0x10000);
1466         memory_region_init_io(&ds->msi64_mr, OBJECT(phb), &pnv_phb4_msi_ops,
1467                               ds, "msi64", 0x100000);
1468         pnv_phb4_update_msi_regions(ds);
1469 
1470         QLIST_INSERT_HEAD(&phb->dma_spaces, ds, list);
1471     }
1472     return &ds->dma_as;
1473 }
1474 
1475 static void pnv_phb4_xscom_realize(PnvPHB4 *phb)
1476 {
1477     PnvPhb4PecState *pec = phb->pec;
1478     PnvPhb4PecClass *pecc = PNV_PHB4_PEC_GET_CLASS(pec);
1479     int stack_no = pnv_phb4_get_phb_stack_no(phb);
1480     uint32_t pec_nest_base;
1481     uint32_t pec_pci_base;
1482     char name[64];
1483 
1484     assert(pec);
1485 
1486     /* Initialize the XSCOM regions for the stack registers */
1487     snprintf(name, sizeof(name), "xscom-pec-%d.%d-nest-phb-%d",
1488              pec->chip_id, pec->index, stack_no);
1489     pnv_xscom_region_init(&phb->nest_regs_mr, OBJECT(phb),
1490                           &pnv_pec_stk_nest_xscom_ops, phb, name,
1491                           PHB4_PEC_NEST_STK_REGS_COUNT);
1492 
1493     snprintf(name, sizeof(name), "xscom-pec-%d.%d-pci-phb-%d",
1494              pec->chip_id, pec->index, stack_no);
1495     pnv_xscom_region_init(&phb->pci_regs_mr, OBJECT(phb),
1496                           &pnv_pec_stk_pci_xscom_ops, phb, name,
1497                           PHB4_PEC_PCI_STK_REGS_COUNT);
1498 
1499     /* PHB pass-through */
1500     snprintf(name, sizeof(name), "xscom-pec-%d.%d-phb-%d",
1501              pec->chip_id, pec->index, stack_no);
1502     pnv_xscom_region_init(&phb->phb_regs_mr, OBJECT(phb),
1503                           &pnv_phb4_xscom_ops, phb, name, 0x40);
1504 
1505     pec_nest_base = pecc->xscom_nest_base(pec);
1506     pec_pci_base = pecc->xscom_pci_base(pec);
1507 
1508     /* Populate the XSCOM address space. */
1509     pnv_xscom_add_subregion(pec->chip,
1510                             pec_nest_base + 0x40 * (stack_no + 1),
1511                             &phb->nest_regs_mr);
1512     pnv_xscom_add_subregion(pec->chip,
1513                             pec_pci_base + 0x40 * (stack_no + 1),
1514                             &phb->pci_regs_mr);
1515     pnv_xscom_add_subregion(pec->chip,
1516                             pec_pci_base + PNV9_XSCOM_PEC_PCI_STK0 +
1517                             0x40 * stack_no,
1518                             &phb->phb_regs_mr);
1519 }
1520 
1521 static PCIIOMMUOps pnv_phb4_iommu_ops = {
1522     .get_address_space = pnv_phb4_dma_iommu,
1523 };
1524 
1525 static void pnv_phb4_instance_init(Object *obj)
1526 {
1527     PnvPHB4 *phb = PNV_PHB4(obj);
1528 
1529     QLIST_INIT(&phb->dma_spaces);
1530 
1531     /* XIVE interrupt source object */
1532     object_initialize_child(obj, "source", &phb->xsrc, TYPE_XIVE_SOURCE);
1533 }
1534 
1535 void pnv_phb4_bus_init(DeviceState *dev, PnvPHB4 *phb)
1536 {
1537     PCIHostState *pci = PCI_HOST_BRIDGE(dev);
1538     char name[32];
1539 
1540     /*
1541      * PHB4 doesn't support IO space. However, qemu gets very upset if
1542      * we don't have an IO region to anchor IO BARs onto so we just
1543      * initialize one which we never hook up to anything
1544      */
1545     snprintf(name, sizeof(name), "phb4-%d.%d-pci-io", phb->chip_id,
1546              phb->phb_id);
1547     memory_region_init(&phb->pci_io, OBJECT(phb), name, 0x10000);
1548 
1549     snprintf(name, sizeof(name), "phb4-%d.%d-pci-mmio", phb->chip_id,
1550              phb->phb_id);
1551     memory_region_init(&phb->pci_mmio, OBJECT(phb), name,
1552                        PCI_MMIO_TOTAL_SIZE);
1553 
1554     pci->bus = pci_register_root_bus(dev, dev->id ? dev->id : NULL,
1555                                      pnv_phb4_set_irq, pnv_phb4_map_irq, phb,
1556                                      &phb->pci_mmio, &phb->pci_io,
1557                                      0, 4, TYPE_PNV_PHB4_ROOT_BUS);
1558 
1559     object_property_set_int(OBJECT(pci->bus), "phb-id", phb->phb_id,
1560                             &error_abort);
1561     object_property_set_int(OBJECT(pci->bus), "chip-id", phb->chip_id,
1562                             &error_abort);
1563 
1564     pci_setup_iommu(pci->bus, &pnv_phb4_iommu_ops, phb);
1565     pci->bus->flags |= PCI_BUS_EXTENDED_CONFIG_SPACE;
1566 }
1567 
1568 static void pnv_phb4_realize(DeviceState *dev, Error **errp)
1569 {
1570     PnvPHB4 *phb = PNV_PHB4(dev);
1571     XiveSource *xsrc = &phb->xsrc;
1572     int nr_irqs;
1573     char name[32];
1574 
1575     /* Set the "big_phb" flag */
1576     phb->big_phb = phb->phb_id == 0 || phb->phb_id == 3;
1577 
1578     /* Controller Registers */
1579     snprintf(name, sizeof(name), "phb4-%d.%d-regs", phb->chip_id,
1580              phb->phb_id);
1581     memory_region_init_io(&phb->mr_regs, OBJECT(phb), &pnv_phb4_reg_ops, phb,
1582                           name, 0x2000);
1583 
1584     /* Setup XIVE Source */
1585     if (phb->big_phb) {
1586         nr_irqs = PNV_PHB4_MAX_INTs;
1587     } else {
1588         nr_irqs = PNV_PHB4_MAX_INTs >> 1;
1589     }
1590     object_property_set_int(OBJECT(xsrc), "nr-irqs", nr_irqs, &error_fatal);
1591     object_property_set_link(OBJECT(xsrc), "xive", OBJECT(phb), &error_fatal);
1592     if (!qdev_realize(DEVICE(xsrc), NULL, errp)) {
1593         return;
1594     }
1595 
1596     pnv_phb4_update_xsrc(phb);
1597 
1598     phb->qirqs = qemu_allocate_irqs(xive_source_set_irq, xsrc, xsrc->nr_irqs);
1599 
1600     pnv_phb4_xscom_realize(phb);
1601 }
1602 
1603 /*
1604  * Address base trigger mode (POWER10)
1605  *
1606  * Trigger directly the IC ESB page
1607  */
1608 static void pnv_phb4_xive_notify_abt(PnvPHB4 *phb, uint32_t srcno,
1609                                      bool pq_checked)
1610 {
1611     uint64_t notif_port = phb->regs[PHB_INT_NOTIFY_ADDR >> 3];
1612     uint64_t data = 0; /* trigger data : don't care */
1613     hwaddr addr;
1614     MemTxResult result;
1615     int esb_shift;
1616 
1617     if (notif_port & PHB_INT_NOTIFY_ADDR_64K) {
1618         esb_shift = 16;
1619     } else {
1620         esb_shift = 12;
1621     }
1622 
1623     /* Compute the address of the IC ESB management page */
1624     addr = (notif_port & ~PHB_INT_NOTIFY_ADDR_64K);
1625     addr |= (1ull << (esb_shift + 1)) * srcno;
1626     addr |= (1ull << esb_shift);
1627 
1628     /*
1629      * When the PQ state bits are checked on the PHB, the associated
1630      * PQ state bits on the IC should be ignored. Use the unconditional
1631      * trigger offset to inject a trigger on the IC. This is always
1632      * the case for LSIs
1633      */
1634     if (pq_checked) {
1635         addr |= XIVE_ESB_INJECT;
1636     }
1637 
1638     trace_pnv_phb4_xive_notify_ic(addr, data);
1639 
1640     address_space_stq_be(&address_space_memory, addr, data,
1641                          MEMTXATTRS_UNSPECIFIED, &result);
1642     if (result != MEMTX_OK) {
1643         phb_error(phb, "trigger failed @%"HWADDR_PRIx "\n", addr);
1644         return;
1645     }
1646 }
1647 
1648 static void pnv_phb4_xive_notify_ic(PnvPHB4 *phb, uint32_t srcno,
1649                                     bool pq_checked)
1650 {
1651     uint64_t notif_port = phb->regs[PHB_INT_NOTIFY_ADDR >> 3];
1652     uint32_t offset = phb->regs[PHB_INT_NOTIFY_INDEX >> 3];
1653     uint64_t data = offset | srcno;
1654     MemTxResult result;
1655 
1656     if (pq_checked) {
1657         data |= XIVE_TRIGGER_PQ;
1658     }
1659 
1660     trace_pnv_phb4_xive_notify_ic(notif_port, data);
1661 
1662     address_space_stq_be(&address_space_memory, notif_port, data,
1663                          MEMTXATTRS_UNSPECIFIED, &result);
1664     if (result != MEMTX_OK) {
1665         phb_error(phb, "trigger failed @%"HWADDR_PRIx "\n", notif_port);
1666         return;
1667     }
1668 }
1669 
1670 static void pnv_phb4_xive_notify(XiveNotifier *xf, uint32_t srcno,
1671                                  bool pq_checked)
1672 {
1673     PnvPHB4 *phb = PNV_PHB4(xf);
1674 
1675     if (phb->regs[PHB_CTRLR >> 3] & PHB_CTRLR_IRQ_ABT_MODE) {
1676         pnv_phb4_xive_notify_abt(phb, srcno, pq_checked);
1677     } else {
1678         pnv_phb4_xive_notify_ic(phb, srcno, pq_checked);
1679     }
1680 }
1681 
1682 static Property pnv_phb4_properties[] = {
1683     DEFINE_PROP_UINT32("index", PnvPHB4, phb_id, 0),
1684     DEFINE_PROP_UINT32("chip-id", PnvPHB4, chip_id, 0),
1685     DEFINE_PROP_LINK("pec", PnvPHB4, pec, TYPE_PNV_PHB4_PEC,
1686                      PnvPhb4PecState *),
1687     DEFINE_PROP_LINK("phb-base", PnvPHB4, phb_base, TYPE_PNV_PHB, PnvPHB *),
1688     DEFINE_PROP_END_OF_LIST(),
1689 };
1690 
1691 static void pnv_phb4_class_init(ObjectClass *klass, void *data)
1692 {
1693     DeviceClass *dc = DEVICE_CLASS(klass);
1694     XiveNotifierClass *xfc = XIVE_NOTIFIER_CLASS(klass);
1695 
1696     dc->realize         = pnv_phb4_realize;
1697     device_class_set_props(dc, pnv_phb4_properties);
1698     dc->user_creatable  = false;
1699 
1700     xfc->notify         = pnv_phb4_xive_notify;
1701 }
1702 
1703 static const TypeInfo pnv_phb4_type_info = {
1704     .name          = TYPE_PNV_PHB4,
1705     .parent        = TYPE_DEVICE,
1706     .instance_init = pnv_phb4_instance_init,
1707     .instance_size = sizeof(PnvPHB4),
1708     .class_init    = pnv_phb4_class_init,
1709     .interfaces = (InterfaceInfo[]) {
1710             { TYPE_XIVE_NOTIFIER },
1711             { },
1712     }
1713 };
1714 
1715 static const TypeInfo pnv_phb5_type_info = {
1716     .name          = TYPE_PNV_PHB5,
1717     .parent        = TYPE_PNV_PHB4,
1718     .instance_size = sizeof(PnvPHB4),
1719 };
1720 
1721 static void pnv_phb4_root_bus_get_prop(Object *obj, Visitor *v,
1722                                        const char *name,
1723                                        void *opaque, Error **errp)
1724 {
1725     PnvPHB4RootBus *bus = PNV_PHB4_ROOT_BUS(obj);
1726     uint64_t value = 0;
1727 
1728     if (strcmp(name, "phb-id") == 0) {
1729         value = bus->phb_id;
1730     } else {
1731         value = bus->chip_id;
1732     }
1733 
1734     visit_type_size(v, name, &value, errp);
1735 }
1736 
1737 static void pnv_phb4_root_bus_set_prop(Object *obj, Visitor *v,
1738                                        const char *name,
1739                                        void *opaque, Error **errp)
1740 
1741 {
1742     PnvPHB4RootBus *bus = PNV_PHB4_ROOT_BUS(obj);
1743     uint64_t value;
1744 
1745     if (!visit_type_size(v, name, &value, errp)) {
1746         return;
1747     }
1748 
1749     if (strcmp(name, "phb-id") == 0) {
1750         bus->phb_id = value;
1751     } else {
1752         bus->chip_id = value;
1753     }
1754 }
1755 
1756 static void pnv_phb4_root_bus_class_init(ObjectClass *klass, void *data)
1757 {
1758     BusClass *k = BUS_CLASS(klass);
1759 
1760     object_class_property_add(klass, "phb-id", "int",
1761                               pnv_phb4_root_bus_get_prop,
1762                               pnv_phb4_root_bus_set_prop,
1763                               NULL, NULL);
1764 
1765     object_class_property_add(klass, "chip-id", "int",
1766                               pnv_phb4_root_bus_get_prop,
1767                               pnv_phb4_root_bus_set_prop,
1768                               NULL, NULL);
1769 
1770     /*
1771      * PHB4 has only a single root complex. Enforce the limit on the
1772      * parent bus
1773      */
1774     k->max_dev = 1;
1775 }
1776 
1777 static const TypeInfo pnv_phb4_root_bus_info = {
1778     .name = TYPE_PNV_PHB4_ROOT_BUS,
1779     .parent = TYPE_PCIE_BUS,
1780     .instance_size = sizeof(PnvPHB4RootBus),
1781     .class_init = pnv_phb4_root_bus_class_init,
1782 };
1783 
1784 static void pnv_phb4_register_types(void)
1785 {
1786     type_register_static(&pnv_phb4_root_bus_info);
1787     type_register_static(&pnv_phb4_type_info);
1788     type_register_static(&pnv_phb5_type_info);
1789     type_register_static(&pnv_phb4_iommu_memory_region_info);
1790 }
1791 
1792 type_init(pnv_phb4_register_types);
1793 
1794 void pnv_phb4_pic_print_info(PnvPHB4 *phb, Monitor *mon)
1795 {
1796     uint64_t notif_port =
1797         phb->regs[PHB_INT_NOTIFY_ADDR >> 3] & ~PHB_INT_NOTIFY_ADDR_64K;
1798     uint32_t offset = phb->regs[PHB_INT_NOTIFY_INDEX >> 3];
1799     bool abt = !!(phb->regs[PHB_CTRLR >> 3] & PHB_CTRLR_IRQ_ABT_MODE);
1800 
1801     monitor_printf(mon, "PHB4[%x:%x] Source %08x .. %08x %s @%"HWADDR_PRIx"\n",
1802                    phb->chip_id, phb->phb_id,
1803                    offset, offset + phb->xsrc.nr_irqs - 1,
1804                    abt ? "ABT" : "",
1805                    notif_port);
1806     xive_source_pic_print_info(&phb->xsrc, 0, mon);
1807 }
1808