hw/pci-host/pnv_phb4.c

   1 /*
   2  * QEMU PowerPC PowerNV (POWER9) PHB4 model
   3  *
   4  * Copyright (c) 2018-2020, IBM Corporation.
   5  *
   6  * This code is licensed under the GPL version 2 or later. See the
   7  * COPYING file in the top-level directory.
   8  */
   9 #include "qemu/osdep.h"
  10 #include "qemu/log.h"
  11 #include "qapi/visitor.h"
  12 #include "qapi/error.h"
  13 #include "monitor/monitor.h"
  14 #include "target/ppc/cpu.h"
  15 #include "hw/pci-host/pnv_phb4_regs.h"
  16 #include "hw/pci-host/pnv_phb4.h"
  17 #include "hw/pci/pcie_host.h"
  18 #include "hw/pci/pcie_port.h"
  19 #include "hw/ppc/pnv.h"
  20 #include "hw/ppc/pnv_xscom.h"
  21 #include "hw/irq.h"
  22 #include "hw/qdev-properties.h"
  23 #include "qom/object.h"
  24 #include "trace.h"
  25
  26 #define phb_error(phb, fmt, ...)                                        \
  27     qemu_log_mask(LOG_GUEST_ERROR, "phb4[%d:%d]: " fmt "\n",            \
  28                   (phb)->chip_id, (phb)->phb_id, ## __VA_ARGS__)
  29
  30 #define phb_pec_error(pec, fmt, ...)                                    \
  31     qemu_log_mask(LOG_GUEST_ERROR, "phb4_pec[%d:%d]: " fmt "\n",        \
  32                   (pec)->chip_id, (pec)->index, ## __VA_ARGS__)
  33
  34 static PCIDevice *pnv_phb4_find_cfg_dev(PnvPHB4 *phb)
  35 {
  36     PCIHostState *pci = PCI_HOST_BRIDGE(phb->phb_base);
  37     uint64_t addr = phb->regs[PHB_CONFIG_ADDRESS >> 3];
  38     uint8_t bus, devfn;
  39
  40     if (!(addr >> 63)) {
  41         return NULL;
  42     }
  43     bus = (addr >> 52) & 0xff;
  44     devfn = (addr >> 44) & 0xff;
  45
  46     /* We don't access the root complex this way */
  47     if (bus == 0 && devfn == 0) {
  48         return NULL;
  49     }
  50     return pci_find_device(pci->bus, bus, devfn);
  51 }
  52
  53 /*
  54  * The CONFIG_DATA register expects little endian accesses, but as the
  55  * region is big endian, we have to swap the value.
  56  */
  57 static void pnv_phb4_config_write(PnvPHB4 *phb, unsigned off,
  58                                   unsigned size, uint64_t val)
  59 {
  60     uint32_t cfg_addr, limit;
  61     PCIDevice *pdev;
  62
  63     pdev = pnv_phb4_find_cfg_dev(phb);
  64     if (!pdev) {
  65         return;
  66     }
  67     cfg_addr = (phb->regs[PHB_CONFIG_ADDRESS >> 3] >> 32) & 0xffc;
  68     cfg_addr |= off;
  69     limit = pci_config_size(pdev);
  70     if (limit <= cfg_addr) {
  71         /*
  72          * conventional pci device can be behind pcie-to-pci bridge.
  73          * 256 <= addr < 4K has no effects.
  74          */
  75         return;
  76     }
  77     switch (size) {
  78     case 1:
  79         break;
  80     case 2:
  81         val = bswap16(val);
  82         break;
  83     case 4:
  84         val = bswap32(val);
  85         break;
  86     default:
  87         g_assert_not_reached();
  88     }
  89     pci_host_config_write_common(pdev, cfg_addr, limit, val, size);
  90 }
  91
  92 static uint64_t pnv_phb4_config_read(PnvPHB4 *phb, unsigned off,
  93                                      unsigned size)
  94 {
  95     uint32_t cfg_addr, limit;
  96     PCIDevice *pdev;
  97     uint64_t val;
  98
  99     pdev = pnv_phb4_find_cfg_dev(phb);
 100     if (!pdev) {
 101         return ~0ull;
 102     }
 103     cfg_addr = (phb->regs[PHB_CONFIG_ADDRESS >> 3] >> 32) & 0xffc;
 104     cfg_addr |= off;
 105     limit = pci_config_size(pdev);
 106     if (limit <= cfg_addr) {
 107         /*
 108          * conventional pci device can be behind pcie-to-pci bridge.
 109          * 256 <= addr < 4K has no effects.
 110          */
 111         return ~0ull;
 112     }
 113     val = pci_host_config_read_common(pdev, cfg_addr, limit, size);
 114     switch (size) {
 115     case 1:
 116         return val;
 117     case 2:
 118         return bswap16(val);
 119     case 4:
 120         return bswap32(val);
 121     default:
 122         g_assert_not_reached();
 123     }
 124 }
 125
 126 /*
 127  * Root complex register accesses are memory mapped.
 128  */
 129 static void pnv_phb4_rc_config_write(PnvPHB4 *phb, unsigned off,
 130                                      unsigned size, uint64_t val)
 131 {
 132     PCIHostState *pci = PCI_HOST_BRIDGE(phb->phb_base);
 133     PCIDevice *pdev;
 134
 135     if (size != 4) {
 136         phb_error(phb, "rc_config_write invalid size %d\n", size);
 137         return;
 138     }
 139
 140     pdev = pci_find_device(pci->bus, 0, 0);
 141     if (!pdev) {
 142         phb_error(phb, "rc_config_write device not found\n");
 143         return;
 144     }
 145
 146     pci_host_config_write_common(pdev, off, PHB_RC_CONFIG_SIZE,
 147                                  bswap32(val), 4);
 148 }
 149
 150 static uint64_t pnv_phb4_rc_config_read(PnvPHB4 *phb, unsigned off,
 151                                         unsigned size)
 152 {
 153     PCIHostState *pci = PCI_HOST_BRIDGE(phb->phb_base);
 154     PCIDevice *pdev;
 155     uint64_t val;
 156
 157     if (size != 4) {
 158         phb_error(phb, "rc_config_read invalid size %d\n", size);
 159         return ~0ull;
 160     }
 161
 162     pdev = pci_find_device(pci->bus, 0, 0);
 163     if (!pdev) {
 164         phb_error(phb, "rc_config_read device not found\n");
 165         return ~0ull;
 166     }
 167
 168     val = pci_host_config_read_common(pdev, off, PHB_RC_CONFIG_SIZE, 4);
 169     return bswap32(val);
 170 }
 171
 172 static void pnv_phb4_check_mbt(PnvPHB4 *phb, uint32_t index)
 173 {
 174     uint64_t base, start, size, mbe0, mbe1;
 175     MemoryRegion *parent;
 176     char name[64];
 177
 178     /* Unmap first */
 179     if (memory_region_is_mapped(&phb->mr_mmio[index])) {
 180         /* Should we destroy it in RCU friendly way... ? */
 181         memory_region_del_subregion(phb->mr_mmio[index].container,
 182                                     &phb->mr_mmio[index]);
 183     }
 184
 185     /* Get table entry */
 186     mbe0 = phb->ioda_MBT[(index << 1)];
 187     mbe1 = phb->ioda_MBT[(index << 1) + 1];
 188
 189     if (!(mbe0 & IODA3_MBT0_ENABLE)) {
 190         return;
 191     }
 192
 193     /* Grab geometry from registers */
 194     base = GETFIELD(IODA3_MBT0_BASE_ADDR, mbe0) << 12;
 195     size = GETFIELD(IODA3_MBT1_MASK, mbe1) << 12;
 196     size |= 0xff00000000000000ull;
 197     size = ~size + 1;
 198
 199     /* Calculate PCI side start address based on M32/M64 window type */
 200     if (mbe0 & IODA3_MBT0_TYPE_M32) {
 201         start = phb->regs[PHB_M32_START_ADDR >> 3];
 202         if ((start + size) > 0x100000000ull) {
 203             phb_error(phb, "M32 set beyond 4GB boundary !");
 204             size = 0x100000000 - start;
 205         }
 206     } else {
 207         start = base | (phb->regs[PHB_M64_UPPER_BITS >> 3]);
 208     }
 209
 210     /* TODO: Figure out how to implemet/decode AOMASK */
 211
 212     /* Check if it matches an enabled MMIO region in the PEC stack */
 213     if (memory_region_is_mapped(&phb->mmbar0) &&
 214         base >= phb->mmio0_base &&
 215         (base + size) <= (phb->mmio0_base + phb->mmio0_size)) {
 216         parent = &phb->mmbar0;
 217         base -= phb->mmio0_base;
 218     } else if (memory_region_is_mapped(&phb->mmbar1) &&
 219         base >= phb->mmio1_base &&
 220         (base + size) <= (phb->mmio1_base + phb->mmio1_size)) {
 221         parent = &phb->mmbar1;
 222         base -= phb->mmio1_base;
 223     } else {
 224         phb_error(phb, "PHB MBAR %d out of parent bounds", index);
 225         return;
 226     }
 227
 228     /* Create alias (better name ?) */
 229     snprintf(name, sizeof(name), "phb4-mbar%d", index);
 230     memory_region_init_alias(&phb->mr_mmio[index], OBJECT(phb), name,
 231                              &phb->pci_mmio, start, size);
 232     memory_region_add_subregion(parent, base, &phb->mr_mmio[index]);
 233 }
 234
 235 static void pnv_phb4_check_all_mbt(PnvPHB4 *phb)
 236 {
 237     uint64_t i;
 238     uint32_t num_windows = phb->big_phb ? PNV_PHB4_MAX_MMIO_WINDOWS :
 239         PNV_PHB4_MIN_MMIO_WINDOWS;
 240
 241     for (i = 0; i < num_windows; i++) {
 242         pnv_phb4_check_mbt(phb, i);
 243     }
 244 }
 245
 246 static uint64_t *pnv_phb4_ioda_access(PnvPHB4 *phb,
 247                                       unsigned *out_table, unsigned *out_idx)
 248 {
 249     uint64_t adreg = phb->regs[PHB_IODA_ADDR >> 3];
 250     unsigned int index = GETFIELD(PHB_IODA_AD_TADR, adreg);
 251     unsigned int table = GETFIELD(PHB_IODA_AD_TSEL, adreg);
 252     unsigned int mask;
 253     uint64_t *tptr = NULL;
 254
 255     switch (table) {
 256     case IODA3_TBL_LIST:
 257         tptr = phb->ioda_LIST;
 258         mask = 7;
 259         break;
 260     case IODA3_TBL_MIST:
 261         tptr = phb->ioda_MIST;
 262         mask = phb->big_phb ? PNV_PHB4_MAX_MIST : (PNV_PHB4_MAX_MIST >> 1);
 263         mask -= 1;
 264         break;
 265     case IODA3_TBL_RCAM:
 266         mask = phb->big_phb ? 127 : 63;
 267         break;
 268     case IODA3_TBL_MRT:
 269         mask = phb->big_phb ? 15 : 7;
 270         break;
 271     case IODA3_TBL_PESTA:
 272     case IODA3_TBL_PESTB:
 273         mask = phb->big_phb ? PNV_PHB4_MAX_PEs : (PNV_PHB4_MAX_PEs >> 1);
 274         mask -= 1;
 275         break;
 276     case IODA3_TBL_TVT:
 277         tptr = phb->ioda_TVT;
 278         mask = phb->big_phb ? PNV_PHB4_MAX_TVEs : (PNV_PHB4_MAX_TVEs >> 1);
 279         mask -= 1;
 280         break;
 281     case IODA3_TBL_TCR:
 282     case IODA3_TBL_TDR:
 283         mask = phb->big_phb ? 1023 : 511;
 284         break;
 285     case IODA3_TBL_MBT:
 286         tptr = phb->ioda_MBT;
 287         mask = phb->big_phb ? PNV_PHB4_MAX_MBEs : (PNV_PHB4_MAX_MBEs >> 1);
 288         mask -= 1;
 289         break;
 290     case IODA3_TBL_MDT:
 291         tptr = phb->ioda_MDT;
 292         mask = phb->big_phb ? PNV_PHB4_MAX_PEs : (PNV_PHB4_MAX_PEs >> 1);
 293         mask -= 1;
 294         break;
 295     case IODA3_TBL_PEEV:
 296         tptr = phb->ioda_PEEV;
 297         mask = phb->big_phb ? PNV_PHB4_MAX_PEEVs : (PNV_PHB4_MAX_PEEVs >> 1);
 298         mask -= 1;
 299         break;
 300     default:
 301         phb_error(phb, "invalid IODA table %d", table);
 302         return NULL;
 303     }
 304     index &= mask;
 305     if (out_idx) {
 306         *out_idx = index;
 307     }
 308     if (out_table) {
 309         *out_table = table;
 310     }
 311     if (tptr) {
 312         tptr += index;
 313     }
 314     if (adreg & PHB_IODA_AD_AUTOINC) {
 315         index = (index + 1) & mask;
 316         adreg = SETFIELD(PHB_IODA_AD_TADR, adreg, index);
 317     }
 318
 319     phb->regs[PHB_IODA_ADDR >> 3] = adreg;
 320     return tptr;
 321 }
 322
 323 static uint64_t pnv_phb4_ioda_read(PnvPHB4 *phb)
 324 {
 325     unsigned table, idx;
 326     uint64_t *tptr;
 327
 328     tptr = pnv_phb4_ioda_access(phb, &table, &idx);
 329     if (!tptr) {
 330         /* Special PESTA case */
 331         if (table == IODA3_TBL_PESTA) {
 332             return ((uint64_t)(phb->ioda_PEST_AB[idx] & 1)) << 63;
 333         } else if (table == IODA3_TBL_PESTB) {
 334             return ((uint64_t)(phb->ioda_PEST_AB[idx] & 2)) << 62;
 335         }
 336         /* Return 0 on unsupported tables, not ff's */
 337         return 0;
 338     }
 339     return *tptr;
 340 }
 341
 342 static void pnv_phb4_ioda_write(PnvPHB4 *phb, uint64_t val)
 343 {
 344     unsigned table, idx;
 345     uint64_t *tptr;
 346
 347     tptr = pnv_phb4_ioda_access(phb, &table, &idx);
 348     if (!tptr) {
 349         /* Special PESTA case */
 350         if (table == IODA3_TBL_PESTA) {
 351             phb->ioda_PEST_AB[idx] &= ~1;
 352             phb->ioda_PEST_AB[idx] |= (val >> 63) & 1;
 353         } else if (table == IODA3_TBL_PESTB) {
 354             phb->ioda_PEST_AB[idx] &= ~2;
 355             phb->ioda_PEST_AB[idx] |= (val >> 62) & 2;
 356         }
 357         return;
 358     }
 359
 360     /* Handle side effects */
 361     switch (table) {
 362     case IODA3_TBL_LIST:
 363         break;
 364     case IODA3_TBL_MIST: {
 365         /* Special mask for MIST partial write */
 366         uint64_t adreg = phb->regs[PHB_IODA_ADDR >> 3];
 367         uint32_t mmask = GETFIELD(PHB_IODA_AD_MIST_PWV, adreg);
 368         uint64_t v = *tptr;
 369         if (mmask == 0) {
 370             mmask = 0xf;
 371         }
 372         if (mmask & 8) {
 373             v &= 0x0000ffffffffffffull;
 374             v |= 0xcfff000000000000ull & val;
 375         }
 376         if (mmask & 4) {
 377             v &= 0xffff0000ffffffffull;
 378             v |= 0x0000cfff00000000ull & val;
 379         }
 380         if (mmask & 2) {
 381             v &= 0xffffffff0000ffffull;
 382             v |= 0x00000000cfff0000ull & val;
 383         }
 384         if (mmask & 1) {
 385             v &= 0xffffffffffff0000ull;
 386             v |= 0x000000000000cfffull & val;
 387         }
 388         *tptr = v;
 389         break;
 390     }
 391     case IODA3_TBL_MBT:
 392         *tptr = val;
 393
 394         /* Copy accross the valid bit to the other half */
 395         phb->ioda_MBT[idx ^ 1] &= 0x7fffffffffffffffull;
 396         phb->ioda_MBT[idx ^ 1] |= 0x8000000000000000ull & val;
 397
 398         /* Update mappings */
 399         pnv_phb4_check_mbt(phb, idx >> 1);
 400         break;
 401     default:
 402         *tptr = val;
 403     }
 404 }
 405
 406 static void pnv_phb4_rtc_invalidate(PnvPHB4 *phb, uint64_t val)
 407 {
 408     PnvPhb4DMASpace *ds;
 409
 410     /* Always invalidate all for now ... */
 411     QLIST_FOREACH(ds, &phb->dma_spaces, list) {
 412         ds->pe_num = PHB_INVALID_PE;
 413     }
 414 }
 415
 416 static void pnv_phb4_update_msi_regions(PnvPhb4DMASpace *ds)
 417 {
 418     uint64_t cfg = ds->phb->regs[PHB_PHB4_CONFIG >> 3];
 419
 420     if (cfg & PHB_PHB4C_32BIT_MSI_EN) {
 421         if (!memory_region_is_mapped(MEMORY_REGION(&ds->msi32_mr))) {
 422             memory_region_add_subregion(MEMORY_REGION(&ds->dma_mr),
 423                                         0xffff0000, &ds->msi32_mr);
 424         }
 425     } else {
 426         if (memory_region_is_mapped(MEMORY_REGION(&ds->msi32_mr))) {
 427             memory_region_del_subregion(MEMORY_REGION(&ds->dma_mr),
 428                                         &ds->msi32_mr);
 429         }
 430     }
 431
 432     if (cfg & PHB_PHB4C_64BIT_MSI_EN) {
 433         if (!memory_region_is_mapped(MEMORY_REGION(&ds->msi64_mr))) {
 434             memory_region_add_subregion(MEMORY_REGION(&ds->dma_mr),
 435                                         (1ull << 60), &ds->msi64_mr);
 436         }
 437     } else {
 438         if (memory_region_is_mapped(MEMORY_REGION(&ds->msi64_mr))) {
 439             memory_region_del_subregion(MEMORY_REGION(&ds->dma_mr),
 440                                         &ds->msi64_mr);
 441         }
 442     }
 443 }
 444
 445 static void pnv_phb4_update_all_msi_regions(PnvPHB4 *phb)
 446 {
 447     PnvPhb4DMASpace *ds;
 448
 449     QLIST_FOREACH(ds, &phb->dma_spaces, list) {
 450         pnv_phb4_update_msi_regions(ds);
 451     }
 452 }
 453
 454 static void pnv_phb4_update_xsrc(PnvPHB4 *phb)
 455 {
 456     int shift, flags, i, lsi_base;
 457     XiveSource *xsrc = &phb->xsrc;
 458
 459     /* The XIVE source characteristics can be set at run time */
 460     if (phb->regs[PHB_CTRLR >> 3] & PHB_CTRLR_IRQ_PGSZ_64K) {
 461         shift = XIVE_ESB_64K;
 462     } else {
 463         shift = XIVE_ESB_4K;
 464     }
 465     if (phb->regs[PHB_CTRLR >> 3] & PHB_CTRLR_IRQ_STORE_EOI) {
 466         flags = XIVE_SRC_STORE_EOI;
 467     } else {
 468         flags = 0;
 469     }
 470
 471     /*
 472      * When the PQ disable configuration bit is set, the check on the
 473      * PQ state bits is disabled on the PHB side (for MSI only) and it
 474      * is performed on the IC side instead.
 475      */
 476     if (phb->regs[PHB_CTRLR >> 3] & PHB_CTRLR_IRQ_PQ_DISABLE) {
 477         flags |= XIVE_SRC_PQ_DISABLE;
 478     }
 479
 480     phb->xsrc.esb_shift = shift;
 481     phb->xsrc.esb_flags = flags;
 482
 483     lsi_base = GETFIELD(PHB_LSI_SRC_ID, phb->regs[PHB_LSI_SOURCE_ID >> 3]);
 484     lsi_base <<= 3;
 485
 486     /* TODO: handle reset values of PHB_LSI_SRC_ID */
 487     if (!lsi_base) {
 488         return;
 489     }
 490
 491     /* TODO: need a xive_source_irq_reset_lsi() */
 492     bitmap_zero(xsrc->lsi_map, xsrc->nr_irqs);
 493
 494     for (i = 0; i < xsrc->nr_irqs; i++) {
 495         bool msi = (i < lsi_base || i >= (lsi_base + 8));
 496         if (!msi) {
 497             xive_source_irq_set_lsi(xsrc, i);
 498         }
 499     }
 500 }
 501
 502 static void pnv_phb4_reg_write(void *opaque, hwaddr off, uint64_t val,
 503                                unsigned size)
 504 {
 505     PnvPHB4 *phb = PNV_PHB4(opaque);
 506     bool changed;
 507
 508     /* Special case outbound configuration data */
 509     if ((off & 0xfffc) == PHB_CONFIG_DATA) {
 510         pnv_phb4_config_write(phb, off & 0x3, size, val);
 511         return;
 512     }
 513
 514     /* Special case RC configuration space */
 515     if ((off & 0xf800) == PHB_RC_CONFIG_BASE) {
 516         pnv_phb4_rc_config_write(phb, off & 0x7ff, size, val);
 517         return;
 518     }
 519
 520     /* Other registers are 64-bit only */
 521     if (size != 8 || off & 0x7) {
 522         phb_error(phb, "Invalid register access, offset: 0x%"PRIx64" size: %d",
 523                    off, size);
 524         return;
 525     }
 526
 527     /* Handle masking */
 528     switch (off) {
 529     case PHB_LSI_SOURCE_ID:
 530         val &= PHB_LSI_SRC_ID;
 531         break;
 532     case PHB_M64_UPPER_BITS:
 533         val &= 0xff00000000000000ull;
 534         break;
 535     /* TCE Kill */
 536     case PHB_TCE_KILL:
 537         /* Clear top 3 bits which HW does to indicate successful queuing */
 538         val &= ~(PHB_TCE_KILL_ALL | PHB_TCE_KILL_PE | PHB_TCE_KILL_ONE);
 539         break;
 540     case PHB_Q_DMA_R:
 541         /*
 542          * This is enough logic to make SW happy but we aren't
 543          * actually quiescing the DMAs
 544          */
 545         if (val & PHB_Q_DMA_R_AUTORESET) {
 546             val = 0;
 547         } else {
 548             val &= PHB_Q_DMA_R_QUIESCE_DMA;
 549         }
 550         break;
 551     /* LEM stuff */
 552     case PHB_LEM_FIR_AND_MASK:
 553         phb->regs[PHB_LEM_FIR_ACCUM >> 3] &= val;
 554         return;
 555     case PHB_LEM_FIR_OR_MASK:
 556         phb->regs[PHB_LEM_FIR_ACCUM >> 3] |= val;
 557         return;
 558     case PHB_LEM_ERROR_AND_MASK:
 559         phb->regs[PHB_LEM_ERROR_MASK >> 3] &= val;
 560         return;
 561     case PHB_LEM_ERROR_OR_MASK:
 562         phb->regs[PHB_LEM_ERROR_MASK >> 3] |= val;
 563         return;
 564     case PHB_LEM_WOF:
 565         val = 0;
 566         break;
 567     /* TODO: More regs ..., maybe create a table with masks... */
 568
 569     /* Read only registers */
 570     case PHB_CPU_LOADSTORE_STATUS:
 571     case PHB_ETU_ERR_SUMMARY:
 572     case PHB_PHB4_GEN_CAP:
 573     case PHB_PHB4_TCE_CAP:
 574     case PHB_PHB4_IRQ_CAP:
 575     case PHB_PHB4_EEH_CAP:
 576         return;
 577     }
 578
 579     /* Record whether it changed */
 580     changed = phb->regs[off >> 3] != val;
 581
 582     /* Store in register cache first */
 583     phb->regs[off >> 3] = val;
 584
 585     /* Handle side effects */
 586     switch (off) {
 587     case PHB_PHB4_CONFIG:
 588         if (changed) {
 589             pnv_phb4_update_all_msi_regions(phb);
 590         }
 591         break;
 592     case PHB_M32_START_ADDR:
 593     case PHB_M64_UPPER_BITS:
 594         if (changed) {
 595             pnv_phb4_check_all_mbt(phb);
 596         }
 597         break;
 598
 599     /* IODA table accesses */
 600     case PHB_IODA_DATA0:
 601         pnv_phb4_ioda_write(phb, val);
 602         break;
 603
 604     /* RTC invalidation */
 605     case PHB_RTC_INVALIDATE:
 606         pnv_phb4_rtc_invalidate(phb, val);
 607         break;
 608
 609     /* PHB Control (Affects XIVE source) */
 610     case PHB_CTRLR:
 611     case PHB_LSI_SOURCE_ID:
 612         pnv_phb4_update_xsrc(phb);
 613         break;
 614
 615     /* Silent simple writes */
 616     case PHB_ASN_CMPM:
 617     case PHB_CONFIG_ADDRESS:
 618     case PHB_IODA_ADDR:
 619     case PHB_TCE_KILL:
 620     case PHB_TCE_SPEC_CTL:
 621     case PHB_PEST_BAR:
 622     case PHB_PELTV_BAR:
 623     case PHB_RTT_BAR:
 624     case PHB_LEM_FIR_ACCUM:
 625     case PHB_LEM_ERROR_MASK:
 626     case PHB_LEM_ACTION0:
 627     case PHB_LEM_ACTION1:
 628     case PHB_TCE_TAG_ENABLE:
 629     case PHB_INT_NOTIFY_ADDR:
 630     case PHB_INT_NOTIFY_INDEX:
 631     case PHB_DMARD_SYNC:
 632        break;
 633
 634     /* Noise on anything else */
 635     default:
 636         qemu_log_mask(LOG_UNIMP, "phb4: reg_write 0x%"PRIx64"=%"PRIx64"\n",
 637                       off, val);
 638     }
 639 }
 640
 641 static uint64_t pnv_phb4_reg_read(void *opaque, hwaddr off, unsigned size)
 642 {
 643     PnvPHB4 *phb = PNV_PHB4(opaque);
 644     uint64_t val;
 645
 646     if ((off & 0xfffc) == PHB_CONFIG_DATA) {
 647         return pnv_phb4_config_read(phb, off & 0x3, size);
 648     }
 649
 650     /* Special case RC configuration space */
 651     if ((off & 0xf800) == PHB_RC_CONFIG_BASE) {
 652         return pnv_phb4_rc_config_read(phb, off & 0x7ff, size);
 653     }
 654
 655     /* Other registers are 64-bit only */
 656     if (size != 8 || off & 0x7) {
 657         phb_error(phb, "Invalid register access, offset: 0x%"PRIx64" size: %d",
 658                    off, size);
 659         return ~0ull;
 660     }
 661
 662     /* Default read from cache */
 663     val = phb->regs[off >> 3];
 664
 665     switch (off) {
 666     case PHB_VERSION:
 667         return PNV_PHB4_PEC_GET_CLASS(phb->pec)->version;
 668
 669         /* Read-only */
 670     case PHB_PHB4_GEN_CAP:
 671         return 0xe4b8000000000000ull;
 672     case PHB_PHB4_TCE_CAP:
 673         return phb->big_phb ? 0x4008440000000400ull : 0x2008440000000200ull;
 674     case PHB_PHB4_IRQ_CAP:
 675         return phb->big_phb ? 0x0800000000001000ull : 0x0800000000000800ull;
 676     case PHB_PHB4_EEH_CAP:
 677         return phb->big_phb ? 0x2000000000000000ull : 0x1000000000000000ull;
 678
 679     /* IODA table accesses */
 680     case PHB_IODA_DATA0:
 681         return pnv_phb4_ioda_read(phb);
 682
 683     /* Link training always appears trained */
 684     case PHB_PCIE_DLP_TRAIN_CTL:
 685         /* TODO: Do something sensible with speed ? */
 686         return PHB_PCIE_DLP_INBAND_PRESENCE | PHB_PCIE_DLP_TL_LINKACT;
 687
 688     /* DMA read sync: make it look like it's complete */
 689     case PHB_DMARD_SYNC:
 690         return PHB_DMARD_SYNC_COMPLETE;
 691
 692     /* Silent simple reads */
 693     case PHB_LSI_SOURCE_ID:
 694     case PHB_CPU_LOADSTORE_STATUS:
 695     case PHB_ASN_CMPM:
 696     case PHB_PHB4_CONFIG:
 697     case PHB_M32_START_ADDR:
 698     case PHB_CONFIG_ADDRESS:
 699     case PHB_IODA_ADDR:
 700     case PHB_RTC_INVALIDATE:
 701     case PHB_TCE_KILL:
 702     case PHB_TCE_SPEC_CTL:
 703     case PHB_PEST_BAR:
 704     case PHB_PELTV_BAR:
 705     case PHB_RTT_BAR:
 706     case PHB_M64_UPPER_BITS:
 707     case PHB_CTRLR:
 708     case PHB_LEM_FIR_ACCUM:
 709     case PHB_LEM_ERROR_MASK:
 710     case PHB_LEM_ACTION0:
 711     case PHB_LEM_ACTION1:
 712     case PHB_TCE_TAG_ENABLE:
 713     case PHB_INT_NOTIFY_ADDR:
 714     case PHB_INT_NOTIFY_INDEX:
 715     case PHB_Q_DMA_R:
 716     case PHB_ETU_ERR_SUMMARY:
 717         break;
 718
 719     /* Noise on anything else */
 720     default:
 721         qemu_log_mask(LOG_UNIMP, "phb4: reg_read 0x%"PRIx64"=%"PRIx64"\n",
 722                       off, val);
 723     }
 724     return val;
 725 }
 726
 727 static const MemoryRegionOps pnv_phb4_reg_ops = {
 728     .read = pnv_phb4_reg_read,
 729     .write = pnv_phb4_reg_write,
 730     .valid.min_access_size = 1,
 731     .valid.max_access_size = 8,
 732     .impl.min_access_size = 1,
 733     .impl.max_access_size = 8,
 734     .endianness = DEVICE_BIG_ENDIAN,
 735 };
 736
 737 static uint64_t pnv_phb4_xscom_read(void *opaque, hwaddr addr, unsigned size)
 738 {
 739     PnvPHB4 *phb = PNV_PHB4(opaque);
 740     uint32_t reg = addr >> 3;
 741     uint64_t val;
 742     hwaddr offset;
 743
 744     switch (reg) {
 745     case PHB_SCOM_HV_IND_ADDR:
 746         return phb->scom_hv_ind_addr_reg;
 747
 748     case PHB_SCOM_HV_IND_DATA:
 749         if (!(phb->scom_hv_ind_addr_reg & PHB_SCOM_HV_IND_ADDR_VALID)) {
 750             phb_error(phb, "Invalid indirect address");
 751             return ~0ull;
 752         }
 753         size = (phb->scom_hv_ind_addr_reg & PHB_SCOM_HV_IND_ADDR_4B) ? 4 : 8;
 754         offset = GETFIELD(PHB_SCOM_HV_IND_ADDR_ADDR, phb->scom_hv_ind_addr_reg);
 755         val = pnv_phb4_reg_read(phb, offset, size);
 756         if (phb->scom_hv_ind_addr_reg & PHB_SCOM_HV_IND_ADDR_AUTOINC) {
 757             offset += size;
 758             offset &= 0x3fff;
 759             phb->scom_hv_ind_addr_reg = SETFIELD(PHB_SCOM_HV_IND_ADDR_ADDR,
 760                                                  phb->scom_hv_ind_addr_reg,
 761                                                  offset);
 762         }
 763         return val;
 764     case PHB_SCOM_ETU_LEM_FIR:
 765     case PHB_SCOM_ETU_LEM_FIR_AND:
 766     case PHB_SCOM_ETU_LEM_FIR_OR:
 767     case PHB_SCOM_ETU_LEM_FIR_MSK:
 768     case PHB_SCOM_ETU_LEM_ERR_MSK_AND:
 769     case PHB_SCOM_ETU_LEM_ERR_MSK_OR:
 770     case PHB_SCOM_ETU_LEM_ACT0:
 771     case PHB_SCOM_ETU_LEM_ACT1:
 772     case PHB_SCOM_ETU_LEM_WOF:
 773         offset = ((reg - PHB_SCOM_ETU_LEM_FIR) << 3) + PHB_LEM_FIR_ACCUM;
 774         return pnv_phb4_reg_read(phb, offset, size);
 775     case PHB_SCOM_ETU_PMON_CONFIG:
 776     case PHB_SCOM_ETU_PMON_CTR0:
 777     case PHB_SCOM_ETU_PMON_CTR1:
 778     case PHB_SCOM_ETU_PMON_CTR2:
 779     case PHB_SCOM_ETU_PMON_CTR3:
 780         offset = ((reg - PHB_SCOM_ETU_PMON_CONFIG) << 3) + PHB_PERFMON_CONFIG;
 781         return pnv_phb4_reg_read(phb, offset, size);
 782
 783     default:
 784         qemu_log_mask(LOG_UNIMP, "phb4: xscom_read 0x%"HWADDR_PRIx"\n", addr);
 785         return ~0ull;
 786     }
 787 }
 788
 789 static void pnv_phb4_xscom_write(void *opaque, hwaddr addr,
 790                                  uint64_t val, unsigned size)
 791 {
 792     PnvPHB4 *phb = PNV_PHB4(opaque);
 793     uint32_t reg = addr >> 3;
 794     hwaddr offset;
 795
 796     switch (reg) {
 797     case PHB_SCOM_HV_IND_ADDR:
 798         phb->scom_hv_ind_addr_reg = val & 0xe000000000001fff;
 799         break;
 800     case PHB_SCOM_HV_IND_DATA:
 801         if (!(phb->scom_hv_ind_addr_reg & PHB_SCOM_HV_IND_ADDR_VALID)) {
 802             phb_error(phb, "Invalid indirect address");
 803             break;
 804         }
 805         size = (phb->scom_hv_ind_addr_reg & PHB_SCOM_HV_IND_ADDR_4B) ? 4 : 8;
 806         offset = GETFIELD(PHB_SCOM_HV_IND_ADDR_ADDR, phb->scom_hv_ind_addr_reg);
 807         pnv_phb4_reg_write(phb, offset, val, size);
 808         if (phb->scom_hv_ind_addr_reg & PHB_SCOM_HV_IND_ADDR_AUTOINC) {
 809             offset += size;
 810             offset &= 0x3fff;
 811             phb->scom_hv_ind_addr_reg = SETFIELD(PHB_SCOM_HV_IND_ADDR_ADDR,
 812                                                  phb->scom_hv_ind_addr_reg,
 813                                                  offset);
 814         }
 815         break;
 816     case PHB_SCOM_ETU_LEM_FIR:
 817     case PHB_SCOM_ETU_LEM_FIR_AND:
 818     case PHB_SCOM_ETU_LEM_FIR_OR:
 819     case PHB_SCOM_ETU_LEM_FIR_MSK:
 820     case PHB_SCOM_ETU_LEM_ERR_MSK_AND:
 821     case PHB_SCOM_ETU_LEM_ERR_MSK_OR:
 822     case PHB_SCOM_ETU_LEM_ACT0:
 823     case PHB_SCOM_ETU_LEM_ACT1:
 824     case PHB_SCOM_ETU_LEM_WOF:
 825         offset = ((reg - PHB_SCOM_ETU_LEM_FIR) << 3) + PHB_LEM_FIR_ACCUM;
 826         pnv_phb4_reg_write(phb, offset, val, size);
 827         break;
 828     case PHB_SCOM_ETU_PMON_CONFIG:
 829     case PHB_SCOM_ETU_PMON_CTR0:
 830     case PHB_SCOM_ETU_PMON_CTR1:
 831     case PHB_SCOM_ETU_PMON_CTR2:
 832     case PHB_SCOM_ETU_PMON_CTR3:
 833         offset = ((reg - PHB_SCOM_ETU_PMON_CONFIG) << 3) + PHB_PERFMON_CONFIG;
 834         pnv_phb4_reg_write(phb, offset, val, size);
 835         break;
 836     default:
 837         qemu_log_mask(LOG_UNIMP, "phb4: xscom_write 0x%"HWADDR_PRIx
 838                       "=%"PRIx64"\n", addr, val);
 839     }
 840 }
 841
 842 const MemoryRegionOps pnv_phb4_xscom_ops = {
 843     .read = pnv_phb4_xscom_read,
 844     .write = pnv_phb4_xscom_write,
 845     .valid.min_access_size = 8,
 846     .valid.max_access_size = 8,
 847     .impl.min_access_size = 8,
 848     .impl.max_access_size = 8,
 849     .endianness = DEVICE_BIG_ENDIAN,
 850 };
 851
 852 static uint64_t pnv_pec_stk_nest_xscom_read(void *opaque, hwaddr addr,
 853                                             unsigned size)
 854 {
 855     PnvPHB4 *phb = PNV_PHB4(opaque);
 856     uint32_t reg = addr >> 3;
 857
 858     /* TODO: add list of allowed registers and error out if not */
 859     return phb->nest_regs[reg];
 860 }
 861
 862 /*
 863  * Return the 'stack_no' of a PHB4. 'stack_no' is the order
 864  * the PHB4 occupies in the PEC. This is the reverse of what
 865  * pnv_phb4_pec_get_phb_id() does.
 866  *
 867  * E.g. a phb with phb_id = 4 and pec->index = 1 (PEC1) will
 868  * be the second phb (stack_no = 1) of the PEC.
 869  */
 870 static int pnv_phb4_get_phb_stack_no(PnvPHB4 *phb)
 871 {
 872     PnvPhb4PecState *pec = phb->pec;
 873     PnvPhb4PecClass *pecc = PNV_PHB4_PEC_GET_CLASS(pec);
 874     int index = pec->index;
 875     int stack_no = phb->phb_id;
 876
 877     while (index--) {
 878         stack_no -= pecc->num_phbs[index];
 879     }
 880
 881     return stack_no;
 882 }
 883
 884 static void pnv_phb4_update_regions(PnvPHB4 *phb)
 885 {
 886     /* Unmap first always */
 887     if (memory_region_is_mapped(&phb->mr_regs)) {
 888         memory_region_del_subregion(&phb->phbbar, &phb->mr_regs);
 889     }
 890     if (memory_region_is_mapped(&phb->xsrc.esb_mmio)) {
 891         memory_region_del_subregion(&phb->intbar, &phb->xsrc.esb_mmio);
 892     }
 893
 894     /* Map registers if enabled */
 895     if (memory_region_is_mapped(&phb->phbbar)) {
 896         memory_region_add_subregion(&phb->phbbar, 0, &phb->mr_regs);
 897     }
 898
 899     /* Map ESB if enabled */
 900     if (memory_region_is_mapped(&phb->intbar)) {
 901         memory_region_add_subregion(&phb->intbar, 0, &phb->xsrc.esb_mmio);
 902     }
 903
 904     /* Check/update m32 */
 905     pnv_phb4_check_all_mbt(phb);
 906 }
 907
 908 static void pnv_pec_phb_update_map(PnvPHB4 *phb)
 909 {
 910     PnvPhb4PecState *pec = phb->pec;
 911     MemoryRegion *sysmem = get_system_memory();
 912     uint64_t bar_en = phb->nest_regs[PEC_NEST_STK_BAR_EN];
 913     int stack_no = pnv_phb4_get_phb_stack_no(phb);
 914     uint64_t bar, mask, size;
 915     char name[64];
 916
 917     /*
 918      * NOTE: This will really not work well if those are remapped
 919      * after the PHB has created its sub regions. We could do better
 920      * if we had a way to resize regions but we don't really care
 921      * that much in practice as the stuff below really only happens
 922      * once early during boot
 923      */
 924
 925     /* Handle unmaps */
 926     if (memory_region_is_mapped(&phb->mmbar0) &&
 927         !(bar_en & PEC_NEST_STK_BAR_EN_MMIO0)) {
 928         memory_region_del_subregion(sysmem, &phb->mmbar0);
 929     }
 930     if (memory_region_is_mapped(&phb->mmbar1) &&
 931         !(bar_en & PEC_NEST_STK_BAR_EN_MMIO1)) {
 932         memory_region_del_subregion(sysmem, &phb->mmbar1);
 933     }
 934     if (memory_region_is_mapped(&phb->phbbar) &&
 935         !(bar_en & PEC_NEST_STK_BAR_EN_PHB)) {
 936         memory_region_del_subregion(sysmem, &phb->phbbar);
 937     }
 938     if (memory_region_is_mapped(&phb->intbar) &&
 939         !(bar_en & PEC_NEST_STK_BAR_EN_INT)) {
 940         memory_region_del_subregion(sysmem, &phb->intbar);
 941     }
 942
 943     /* Update PHB */
 944     pnv_phb4_update_regions(phb);
 945
 946     /* Handle maps */
 947     if (!memory_region_is_mapped(&phb->mmbar0) &&
 948         (bar_en & PEC_NEST_STK_BAR_EN_MMIO0)) {
 949         bar = phb->nest_regs[PEC_NEST_STK_MMIO_BAR0] >> 8;
 950         mask = phb->nest_regs[PEC_NEST_STK_MMIO_BAR0_MASK];
 951         size = ((~mask) >> 8) + 1;
 952         snprintf(name, sizeof(name), "pec-%d.%d-phb-%d-mmio0",
 953                  pec->chip_id, pec->index, stack_no);
 954         memory_region_init(&phb->mmbar0, OBJECT(phb), name, size);
 955         memory_region_add_subregion(sysmem, bar, &phb->mmbar0);
 956         phb->mmio0_base = bar;
 957         phb->mmio0_size = size;
 958     }
 959     if (!memory_region_is_mapped(&phb->mmbar1) &&
 960         (bar_en & PEC_NEST_STK_BAR_EN_MMIO1)) {
 961         bar = phb->nest_regs[PEC_NEST_STK_MMIO_BAR1] >> 8;
 962         mask = phb->nest_regs[PEC_NEST_STK_MMIO_BAR1_MASK];
 963         size = ((~mask) >> 8) + 1;
 964         snprintf(name, sizeof(name), "pec-%d.%d-phb-%d-mmio1",
 965                  pec->chip_id, pec->index, stack_no);
 966         memory_region_init(&phb->mmbar1, OBJECT(phb), name, size);
 967         memory_region_add_subregion(sysmem, bar, &phb->mmbar1);
 968         phb->mmio1_base = bar;
 969         phb->mmio1_size = size;
 970     }
 971     if (!memory_region_is_mapped(&phb->phbbar) &&
 972         (bar_en & PEC_NEST_STK_BAR_EN_PHB)) {
 973         bar = phb->nest_regs[PEC_NEST_STK_PHB_REGS_BAR] >> 8;
 974         size = PNV_PHB4_NUM_REGS << 3;
 975         snprintf(name, sizeof(name), "pec-%d.%d-phb-%d",
 976                  pec->chip_id, pec->index, stack_no);
 977         memory_region_init(&phb->phbbar, OBJECT(phb), name, size);
 978         memory_region_add_subregion(sysmem, bar, &phb->phbbar);
 979     }
 980     if (!memory_region_is_mapped(&phb->intbar) &&
 981         (bar_en & PEC_NEST_STK_BAR_EN_INT)) {
 982         bar = phb->nest_regs[PEC_NEST_STK_INT_BAR] >> 8;
 983         size = PNV_PHB4_MAX_INTs << 16;
 984         snprintf(name, sizeof(name), "pec-%d.%d-phb-%d-int",
 985                  phb->pec->chip_id, phb->pec->index, stack_no);
 986         memory_region_init(&phb->intbar, OBJECT(phb), name, size);
 987         memory_region_add_subregion(sysmem, bar, &phb->intbar);
 988     }
 989
 990     /* Update PHB */
 991     pnv_phb4_update_regions(phb);
 992 }
 993
 994 static void pnv_pec_stk_nest_xscom_write(void *opaque, hwaddr addr,
 995                                          uint64_t val, unsigned size)
 996 {
 997     PnvPHB4 *phb = PNV_PHB4(opaque);
 998     PnvPhb4PecState *pec = phb->pec;
 999     uint32_t reg = addr >> 3;
1000
1001     switch (reg) {
1002     case PEC_NEST_STK_PCI_NEST_FIR:
1003         phb->nest_regs[PEC_NEST_STK_PCI_NEST_FIR] = val;
1004         break;
1005     case PEC_NEST_STK_PCI_NEST_FIR_CLR:
1006         phb->nest_regs[PEC_NEST_STK_PCI_NEST_FIR] &= val;
1007         break;
1008     case PEC_NEST_STK_PCI_NEST_FIR_SET:
1009         phb->nest_regs[PEC_NEST_STK_PCI_NEST_FIR] |= val;
1010         break;
1011     case PEC_NEST_STK_PCI_NEST_FIR_MSK:
1012         phb->nest_regs[PEC_NEST_STK_PCI_NEST_FIR_MSK] = val;
1013         break;
1014     case PEC_NEST_STK_PCI_NEST_FIR_MSKC:
1015         phb->nest_regs[PEC_NEST_STK_PCI_NEST_FIR_MSK] &= val;
1016         break;
1017     case PEC_NEST_STK_PCI_NEST_FIR_MSKS:
1018         phb->nest_regs[PEC_NEST_STK_PCI_NEST_FIR_MSK] |= val;
1019         break;
1020     case PEC_NEST_STK_PCI_NEST_FIR_ACT0:
1021     case PEC_NEST_STK_PCI_NEST_FIR_ACT1:
1022         phb->nest_regs[reg] = val;
1023         break;
1024     case PEC_NEST_STK_PCI_NEST_FIR_WOF:
1025         phb->nest_regs[reg] = 0;
1026         break;
1027     case PEC_NEST_STK_ERR_REPORT_0:
1028     case PEC_NEST_STK_ERR_REPORT_1:
1029     case PEC_NEST_STK_PBCQ_GNRL_STATUS:
1030         /* Flag error ? */
1031         break;
1032     case PEC_NEST_STK_PBCQ_MODE:
1033         phb->nest_regs[reg] = val & 0xff00000000000000ull;
1034         break;
1035     case PEC_NEST_STK_MMIO_BAR0:
1036     case PEC_NEST_STK_MMIO_BAR0_MASK:
1037     case PEC_NEST_STK_MMIO_BAR1:
1038     case PEC_NEST_STK_MMIO_BAR1_MASK:
1039         if (phb->nest_regs[PEC_NEST_STK_BAR_EN] &
1040             (PEC_NEST_STK_BAR_EN_MMIO0 |
1041              PEC_NEST_STK_BAR_EN_MMIO1)) {
1042             phb_pec_error(pec, "Changing enabled BAR unsupported\n");
1043         }
1044         phb->nest_regs[reg] = val & 0xffffffffff000000ull;
1045         break;
1046     case PEC_NEST_STK_PHB_REGS_BAR:
1047         if (phb->nest_regs[PEC_NEST_STK_BAR_EN] & PEC_NEST_STK_BAR_EN_PHB) {
1048             phb_pec_error(pec, "Changing enabled BAR unsupported\n");
1049         }
1050         phb->nest_regs[reg] = val & 0xffffffffffc00000ull;
1051         break;
1052     case PEC_NEST_STK_INT_BAR:
1053         if (phb->nest_regs[PEC_NEST_STK_BAR_EN] & PEC_NEST_STK_BAR_EN_INT) {
1054             phb_pec_error(pec, "Changing enabled BAR unsupported\n");
1055         }
1056         phb->nest_regs[reg] = val & 0xfffffff000000000ull;
1057         break;
1058     case PEC_NEST_STK_BAR_EN:
1059         phb->nest_regs[reg] = val & 0xf000000000000000ull;
1060         pnv_pec_phb_update_map(phb);
1061         break;
1062     case PEC_NEST_STK_DATA_FRZ_TYPE:
1063     case PEC_NEST_STK_PBCQ_TUN_BAR:
1064         /* Not used for now */
1065         phb->nest_regs[reg] = val;
1066         break;
1067     default:
1068         qemu_log_mask(LOG_UNIMP, "phb4_pec: nest_xscom_write 0x%"HWADDR_PRIx
1069                       "=%"PRIx64"\n", addr, val);
1070     }
1071 }
1072
1073 static const MemoryRegionOps pnv_pec_stk_nest_xscom_ops = {
1074     .read = pnv_pec_stk_nest_xscom_read,
1075     .write = pnv_pec_stk_nest_xscom_write,
1076     .valid.min_access_size = 8,
1077     .valid.max_access_size = 8,
1078     .impl.min_access_size = 8,
1079     .impl.max_access_size = 8,
1080     .endianness = DEVICE_BIG_ENDIAN,
1081 };
1082
1083 static uint64_t pnv_pec_stk_pci_xscom_read(void *opaque, hwaddr addr,
1084                                            unsigned size)
1085 {
1086     PnvPHB4 *phb = PNV_PHB4(opaque);
1087     uint32_t reg = addr >> 3;
1088
1089     /* TODO: add list of allowed registers and error out if not */
1090     return phb->pci_regs[reg];
1091 }
1092
1093 static void pnv_pec_stk_pci_xscom_write(void *opaque, hwaddr addr,
1094                                         uint64_t val, unsigned size)
1095 {
1096     PnvPHB4 *phb = PNV_PHB4(opaque);
1097     uint32_t reg = addr >> 3;
1098
1099     switch (reg) {
1100     case PEC_PCI_STK_PCI_FIR:
1101         phb->pci_regs[reg] = val;
1102         break;
1103     case PEC_PCI_STK_PCI_FIR_CLR:
1104         phb->pci_regs[PEC_PCI_STK_PCI_FIR] &= val;
1105         break;
1106     case PEC_PCI_STK_PCI_FIR_SET:
1107         phb->pci_regs[PEC_PCI_STK_PCI_FIR] |= val;
1108         break;
1109     case PEC_PCI_STK_PCI_FIR_MSK:
1110         phb->pci_regs[reg] = val;
1111         break;
1112     case PEC_PCI_STK_PCI_FIR_MSKC:
1113         phb->pci_regs[PEC_PCI_STK_PCI_FIR_MSK] &= val;
1114         break;
1115     case PEC_PCI_STK_PCI_FIR_MSKS:
1116         phb->pci_regs[PEC_PCI_STK_PCI_FIR_MSK] |= val;
1117         break;
1118     case PEC_PCI_STK_PCI_FIR_ACT0:
1119     case PEC_PCI_STK_PCI_FIR_ACT1:
1120         phb->pci_regs[reg] = val;
1121         break;
1122     case PEC_PCI_STK_PCI_FIR_WOF:
1123         phb->pci_regs[reg] = 0;
1124         break;
1125     case PEC_PCI_STK_ETU_RESET:
1126         phb->pci_regs[reg] = val & 0x8000000000000000ull;
1127         /* TODO: Implement reset */
1128         break;
1129     case PEC_PCI_STK_PBAIB_ERR_REPORT:
1130         break;
1131     case PEC_PCI_STK_PBAIB_TX_CMD_CRED:
1132     case PEC_PCI_STK_PBAIB_TX_DAT_CRED:
1133         phb->pci_regs[reg] = val;
1134         break;
1135     default:
1136         qemu_log_mask(LOG_UNIMP, "phb4_pec_stk: pci_xscom_write 0x%"HWADDR_PRIx
1137                       "=%"PRIx64"\n", addr, val);
1138     }
1139 }
1140
1141 static const MemoryRegionOps pnv_pec_stk_pci_xscom_ops = {
1142     .read = pnv_pec_stk_pci_xscom_read,
1143     .write = pnv_pec_stk_pci_xscom_write,
1144     .valid.min_access_size = 8,
1145     .valid.max_access_size = 8,
1146     .impl.min_access_size = 8,
1147     .impl.max_access_size = 8,
1148     .endianness = DEVICE_BIG_ENDIAN,
1149 };
1150
1151 static int pnv_phb4_map_irq(PCIDevice *pci_dev, int irq_num)
1152 {
1153     /* Check that out properly ... */
1154     return irq_num & 3;
1155 }
1156
1157 static void pnv_phb4_set_irq(void *opaque, int irq_num, int level)
1158 {
1159     PnvPHB4 *phb = PNV_PHB4(opaque);
1160     uint32_t lsi_base;
1161
1162     /* LSI only ... */
1163     if (irq_num > 3) {
1164         phb_error(phb, "IRQ %x is not an LSI", irq_num);
1165     }
1166     lsi_base = GETFIELD(PHB_LSI_SRC_ID, phb->regs[PHB_LSI_SOURCE_ID >> 3]);
1167     lsi_base <<= 3;
1168     qemu_set_irq(phb->qirqs[lsi_base + irq_num], level);
1169 }
1170
1171 static bool pnv_phb4_resolve_pe(PnvPhb4DMASpace *ds)
1172 {
1173     uint64_t rtt, addr;
1174     uint16_t rte;
1175     int bus_num;
1176     int num_PEs;
1177
1178     /* Already resolved ? */
1179     if (ds->pe_num != PHB_INVALID_PE) {
1180         return true;
1181     }
1182
1183     /* We need to lookup the RTT */
1184     rtt = ds->phb->regs[PHB_RTT_BAR >> 3];
1185     if (!(rtt & PHB_RTT_BAR_ENABLE)) {
1186         phb_error(ds->phb, "DMA with RTT BAR disabled !");
1187         /* Set error bits ? fence ? ... */
1188         return false;
1189     }
1190
1191     /* Read RTE */
1192     bus_num = pci_bus_num(ds->bus);
1193     addr = rtt & PHB_RTT_BASE_ADDRESS_MASK;
1194     addr += 2 * PCI_BUILD_BDF(bus_num, ds->devfn);
1195     if (dma_memory_read(&address_space_memory, addr, &rte,
1196                         sizeof(rte), MEMTXATTRS_UNSPECIFIED)) {
1197         phb_error(ds->phb, "Failed to read RTT entry at 0x%"PRIx64, addr);
1198         /* Set error bits ? fence ? ... */
1199         return false;
1200     }
1201     rte = be16_to_cpu(rte);
1202
1203     /* Fail upon reading of invalid PE# */
1204     num_PEs = ds->phb->big_phb ? PNV_PHB4_MAX_PEs : (PNV_PHB4_MAX_PEs >> 1);
1205     if (rte >= num_PEs) {
1206         phb_error(ds->phb, "RTE for RID 0x%x invalid (%04x", ds->devfn, rte);
1207         rte &= num_PEs - 1;
1208     }
1209     ds->pe_num = rte;
1210     return true;
1211 }
1212
1213 static void pnv_phb4_translate_tve(PnvPhb4DMASpace *ds, hwaddr addr,
1214                                    bool is_write, uint64_t tve,
1215                                    IOMMUTLBEntry *tlb)
1216 {
1217     uint64_t tta = GETFIELD(IODA3_TVT_TABLE_ADDR, tve);
1218     int32_t  lev = GETFIELD(IODA3_TVT_NUM_LEVELS, tve);
1219     uint32_t tts = GETFIELD(IODA3_TVT_TCE_TABLE_SIZE, tve);
1220     uint32_t tps = GETFIELD(IODA3_TVT_IO_PSIZE, tve);
1221
1222     /* Invalid levels */
1223     if (lev > 4) {
1224         phb_error(ds->phb, "Invalid #levels in TVE %d", lev);
1225         return;
1226     }
1227
1228     /* Invalid entry */
1229     if (tts == 0) {
1230         phb_error(ds->phb, "Access to invalid TVE");
1231         return;
1232     }
1233
1234     /* IO Page Size of 0 means untranslated, else use TCEs */
1235     if (tps == 0) {
1236         /* TODO: Handle boundaries */
1237
1238         /* Use 4k pages like q35 ... for now */
1239         tlb->iova = addr & 0xfffffffffffff000ull;
1240         tlb->translated_addr = addr & 0x0003fffffffff000ull;
1241         tlb->addr_mask = 0xfffull;
1242         tlb->perm = IOMMU_RW;
1243     } else {
1244         uint32_t tce_shift, tbl_shift, sh;
1245         uint64_t base, taddr, tce, tce_mask;
1246
1247         /* Address bits per bottom level TCE entry */
1248         tce_shift = tps + 11;
1249
1250         /* Address bits per table level */
1251         tbl_shift = tts + 8;
1252
1253         /* Top level table base address */
1254         base = tta << 12;
1255
1256         /* Total shift to first level */
1257         sh = tbl_shift * lev + tce_shift;
1258
1259         /* TODO: Limit to support IO page sizes */
1260
1261         /* TODO: Multi-level untested */
1262         do {
1263             lev--;
1264
1265             /* Grab the TCE address */
1266             taddr = base | (((addr >> sh) & ((1ul << tbl_shift) - 1)) << 3);
1267             if (dma_memory_read(&address_space_memory, taddr, &tce,
1268                                 sizeof(tce), MEMTXATTRS_UNSPECIFIED)) {
1269                 phb_error(ds->phb, "Failed to read TCE at 0x%"PRIx64, taddr);
1270                 return;
1271             }
1272             tce = be64_to_cpu(tce);
1273
1274             /* Check permission for indirect TCE */
1275             if ((lev >= 0) && !(tce & 3)) {
1276                 phb_error(ds->phb, "Invalid indirect TCE at 0x%"PRIx64, taddr);
1277                 phb_error(ds->phb, " xlate %"PRIx64":%c TVE=%"PRIx64, addr,
1278                            is_write ? 'W' : 'R', tve);
1279                 phb_error(ds->phb, " tta=%"PRIx64" lev=%d tts=%d tps=%d",
1280                            tta, lev, tts, tps);
1281                 return;
1282             }
1283             sh -= tbl_shift;
1284             base = tce & ~0xfffull;
1285         } while (lev >= 0);
1286
1287         /* We exit the loop with TCE being the final TCE */
1288         if ((is_write & !(tce & 2)) || ((!is_write) && !(tce & 1))) {
1289             phb_error(ds->phb, "TCE access fault at 0x%"PRIx64, taddr);
1290             phb_error(ds->phb, " xlate %"PRIx64":%c TVE=%"PRIx64, addr,
1291                        is_write ? 'W' : 'R', tve);
1292             phb_error(ds->phb, " tta=%"PRIx64" lev=%d tts=%d tps=%d",
1293                        tta, lev, tts, tps);
1294             return;
1295         }
1296         tce_mask = ~((1ull << tce_shift) - 1);
1297         tlb->iova = addr & tce_mask;
1298         tlb->translated_addr = tce & tce_mask;
1299         tlb->addr_mask = ~tce_mask;
1300         tlb->perm = tce & 3;
1301     }
1302 }
1303
1304 static IOMMUTLBEntry pnv_phb4_translate_iommu(IOMMUMemoryRegion *iommu,
1305                                               hwaddr addr,
1306                                               IOMMUAccessFlags flag,
1307                                               int iommu_idx)
1308 {
1309     PnvPhb4DMASpace *ds = container_of(iommu, PnvPhb4DMASpace, dma_mr);
1310     int tve_sel;
1311     uint64_t tve, cfg;
1312     IOMMUTLBEntry ret = {
1313         .target_as = &address_space_memory,
1314         .iova = addr,
1315         .translated_addr = 0,
1316         .addr_mask = ~(hwaddr)0,
1317         .perm = IOMMU_NONE,
1318     };
1319
1320     /* Resolve PE# */
1321     if (!pnv_phb4_resolve_pe(ds)) {
1322         phb_error(ds->phb, "Failed to resolve PE# for bus @%p (%d) devfn 0x%x",
1323                    ds->bus, pci_bus_num(ds->bus), ds->devfn);
1324         return ret;
1325     }
1326
1327     /* Check top bits */
1328     switch (addr >> 60) {
1329     case 00:
1330         /* DMA or 32-bit MSI ? */
1331         cfg = ds->phb->regs[PHB_PHB4_CONFIG >> 3];
1332         if ((cfg & PHB_PHB4C_32BIT_MSI_EN) &&
1333             ((addr & 0xffffffffffff0000ull) == 0xffff0000ull)) {
1334             phb_error(ds->phb, "xlate on 32-bit MSI region");
1335             return ret;
1336         }
1337         /* Choose TVE XXX Use PHB4 Control Register */
1338         tve_sel = (addr >> 59) & 1;
1339         tve = ds->phb->ioda_TVT[ds->pe_num * 2 + tve_sel];
1340         pnv_phb4_translate_tve(ds, addr, flag & IOMMU_WO, tve, &ret);
1341         break;
1342     case 01:
1343         phb_error(ds->phb, "xlate on 64-bit MSI region");
1344         break;
1345     default:
1346         phb_error(ds->phb, "xlate on unsupported address 0x%"PRIx64, addr);
1347     }
1348     return ret;
1349 }
1350
1351 #define TYPE_PNV_PHB4_IOMMU_MEMORY_REGION "pnv-phb4-iommu-memory-region"
1352 DECLARE_INSTANCE_CHECKER(IOMMUMemoryRegion, PNV_PHB4_IOMMU_MEMORY_REGION,
1353                          TYPE_PNV_PHB4_IOMMU_MEMORY_REGION)
1354
1355 static void pnv_phb4_iommu_memory_region_class_init(ObjectClass *klass,
1356                                                     void *data)
1357 {
1358     IOMMUMemoryRegionClass *imrc = IOMMU_MEMORY_REGION_CLASS(klass);
1359
1360     imrc->translate = pnv_phb4_translate_iommu;
1361 }
1362
1363 static const TypeInfo pnv_phb4_iommu_memory_region_info = {
1364     .parent = TYPE_IOMMU_MEMORY_REGION,
1365     .name = TYPE_PNV_PHB4_IOMMU_MEMORY_REGION,
1366     .class_init = pnv_phb4_iommu_memory_region_class_init,
1367 };
1368
1369 /*
1370  * Return the index/phb-id of a PHB4 that belongs to a
1371  * pec->stacks[stack_index] stack.
1372  */
1373 int pnv_phb4_pec_get_phb_id(PnvPhb4PecState *pec, int stack_index)
1374 {
1375     PnvPhb4PecClass *pecc = PNV_PHB4_PEC_GET_CLASS(pec);
1376     int index = pec->index;
1377     int offset = 0;
1378
1379     while (index--) {
1380         offset += pecc->num_phbs[index];
1381     }
1382
1383     return offset + stack_index;
1384 }
1385
1386 /*
1387  * MSI/MSIX memory region implementation.
1388  * The handler handles both MSI and MSIX.
1389  */
1390 static void pnv_phb4_msi_write(void *opaque, hwaddr addr,
1391                                uint64_t data, unsigned size)
1392 {
1393     PnvPhb4DMASpace *ds = opaque;
1394     PnvPHB4 *phb = ds->phb;
1395
1396     uint32_t src = ((addr >> 4) & 0xffff) | (data & 0x1f);
1397
1398     /* Resolve PE# */
1399     if (!pnv_phb4_resolve_pe(ds)) {
1400         phb_error(phb, "Failed to resolve PE# for bus @%p (%d) devfn 0x%x",
1401                    ds->bus, pci_bus_num(ds->bus), ds->devfn);
1402         return;
1403     }
1404
1405     /* TODO: Check it doesn't collide with LSIs */
1406     if (src >= phb->xsrc.nr_irqs) {
1407         phb_error(phb, "MSI %d out of bounds", src);
1408         return;
1409     }
1410
1411     /* TODO: check PE/MSI assignement */
1412
1413     qemu_irq_pulse(phb->qirqs[src]);
1414 }
1415
1416 /* There is no .read as the read result is undefined by PCI spec */
1417 static uint64_t pnv_phb4_msi_read(void *opaque, hwaddr addr, unsigned size)
1418 {
1419     PnvPhb4DMASpace *ds = opaque;
1420
1421     phb_error(ds->phb, "Invalid MSI read @ 0x%" HWADDR_PRIx, addr);
1422     return -1;
1423 }
1424
1425 static const MemoryRegionOps pnv_phb4_msi_ops = {
1426     .read = pnv_phb4_msi_read,
1427     .write = pnv_phb4_msi_write,
1428     .endianness = DEVICE_LITTLE_ENDIAN
1429 };
1430
1431 static PnvPhb4DMASpace *pnv_phb4_dma_find(PnvPHB4 *phb, PCIBus *bus, int devfn)
1432 {
1433     PnvPhb4DMASpace *ds;
1434
1435     QLIST_FOREACH(ds, &phb->dma_spaces, list) {
1436         if (ds->bus == bus && ds->devfn == devfn) {
1437             break;
1438         }
1439     }
1440     return ds;
1441 }
1442
1443 static AddressSpace *pnv_phb4_dma_iommu(PCIBus *bus, void *opaque, int devfn)
1444 {
1445     PnvPHB4 *phb = opaque;
1446     PnvPhb4DMASpace *ds;
1447     char name[32];
1448
1449     ds = pnv_phb4_dma_find(phb, bus, devfn);
1450
1451     if (ds == NULL) {
1452         ds = g_new0(PnvPhb4DMASpace, 1);
1453         ds->bus = bus;
1454         ds->devfn = devfn;
1455         ds->pe_num = PHB_INVALID_PE;
1456         ds->phb = phb;
1457         snprintf(name, sizeof(name), "phb4-%d.%d-iommu", phb->chip_id,
1458                  phb->phb_id);
1459         memory_region_init_iommu(&ds->dma_mr, sizeof(ds->dma_mr),
1460                                  TYPE_PNV_PHB4_IOMMU_MEMORY_REGION,
1461                                  OBJECT(phb), name, UINT64_MAX);
1462         address_space_init(&ds->dma_as, MEMORY_REGION(&ds->dma_mr),
1463                            name);
1464         memory_region_init_io(&ds->msi32_mr, OBJECT(phb), &pnv_phb4_msi_ops,
1465                               ds, "msi32", 0x10000);
1466         memory_region_init_io(&ds->msi64_mr, OBJECT(phb), &pnv_phb4_msi_ops,
1467                               ds, "msi64", 0x100000);
1468         pnv_phb4_update_msi_regions(ds);
1469
1470         QLIST_INSERT_HEAD(&phb->dma_spaces, ds, list);
1471     }
1472     return &ds->dma_as;
1473 }
1474
1475 static void pnv_phb4_xscom_realize(PnvPHB4 *phb)
1476 {
1477     PnvPhb4PecState *pec = phb->pec;
1478     PnvPhb4PecClass *pecc = PNV_PHB4_PEC_GET_CLASS(pec);
1479     int stack_no = pnv_phb4_get_phb_stack_no(phb);
1480     uint32_t pec_nest_base;
1481     uint32_t pec_pci_base;
1482     char name[64];
1483
1484     assert(pec);
1485
1486     /* Initialize the XSCOM regions for the stack registers */
1487     snprintf(name, sizeof(name), "xscom-pec-%d.%d-nest-phb-%d",
1488              pec->chip_id, pec->index, stack_no);
1489     pnv_xscom_region_init(&phb->nest_regs_mr, OBJECT(phb),
1490                           &pnv_pec_stk_nest_xscom_ops, phb, name,
1491                           PHB4_PEC_NEST_STK_REGS_COUNT);
1492
1493     snprintf(name, sizeof(name), "xscom-pec-%d.%d-pci-phb-%d",
1494              pec->chip_id, pec->index, stack_no);
1495     pnv_xscom_region_init(&phb->pci_regs_mr, OBJECT(phb),
1496                           &pnv_pec_stk_pci_xscom_ops, phb, name,
1497                           PHB4_PEC_PCI_STK_REGS_COUNT);
1498
1499     /* PHB pass-through */
1500     snprintf(name, sizeof(name), "xscom-pec-%d.%d-pci-phb-%d",
1501              pec->chip_id, pec->index, stack_no);
1502     pnv_xscom_region_init(&phb->phb_regs_mr, OBJECT(phb),
1503                           &pnv_phb4_xscom_ops, phb, name, 0x40);
1504
1505     pec_nest_base = pecc->xscom_nest_base(pec);
1506     pec_pci_base = pecc->xscom_pci_base(pec);
1507
1508     /* Populate the XSCOM address space. */
1509     pnv_xscom_add_subregion(pec->chip,
1510                             pec_nest_base + 0x40 * (stack_no + 1),
1511                             &phb->nest_regs_mr);
1512     pnv_xscom_add_subregion(pec->chip,
1513                             pec_pci_base + 0x40 * (stack_no + 1),
1514                             &phb->pci_regs_mr);
1515     pnv_xscom_add_subregion(pec->chip,
1516                             pec_pci_base + PNV9_XSCOM_PEC_PCI_STK0 +
1517                             0x40 * stack_no,
1518                             &phb->phb_regs_mr);
1519 }
1520
1521 static void pnv_phb4_instance_init(Object *obj)
1522 {
1523     PnvPHB4 *phb = PNV_PHB4(obj);
1524
1525     QLIST_INIT(&phb->dma_spaces);
1526
1527     /* XIVE interrupt source object */
1528     object_initialize_child(obj, "source", &phb->xsrc, TYPE_XIVE_SOURCE);
1529 }
1530
1531 void pnv_phb4_bus_init(DeviceState *dev, PnvPHB4 *phb)
1532 {
1533     PCIHostState *pci = PCI_HOST_BRIDGE(dev);
1534     char name[32];
1535
1536     /*
1537      * PHB4 doesn't support IO space. However, qemu gets very upset if
1538      * we don't have an IO region to anchor IO BARs onto so we just
1539      * initialize one which we never hook up to anything
1540      */
1541     snprintf(name, sizeof(name), "phb4-%d.%d-pci-io", phb->chip_id,
1542              phb->phb_id);
1543     memory_region_init(&phb->pci_io, OBJECT(phb), name, 0x10000);
1544
1545     snprintf(name, sizeof(name), "phb4-%d.%d-pci-mmio", phb->chip_id,
1546              phb->phb_id);
1547     memory_region_init(&phb->pci_mmio, OBJECT(phb), name,
1548                        PCI_MMIO_TOTAL_SIZE);
1549
1550     pci->bus = pci_register_root_bus(dev, dev->id ? dev->id : NULL,
1551                                      pnv_phb4_set_irq, pnv_phb4_map_irq, phb,
1552                                      &phb->pci_mmio, &phb->pci_io,
1553                                      0, 4, TYPE_PNV_PHB4_ROOT_BUS);
1554
1555     object_property_set_int(OBJECT(pci->bus), "phb-id", phb->phb_id,
1556                             &error_abort);
1557     object_property_set_int(OBJECT(pci->bus), "chip-id", phb->chip_id,
1558                             &error_abort);
1559
1560     pci_setup_iommu(pci->bus, pnv_phb4_dma_iommu, phb);
1561     pci->bus->flags |= PCI_BUS_EXTENDED_CONFIG_SPACE;
1562 }
1563
1564 static void pnv_phb4_realize(DeviceState *dev, Error **errp)
1565 {
1566     PnvPHB4 *phb = PNV_PHB4(dev);
1567     XiveSource *xsrc = &phb->xsrc;
1568     int nr_irqs;
1569     char name[32];
1570
1571     /* Set the "big_phb" flag */
1572     phb->big_phb = phb->phb_id == 0 || phb->phb_id == 3;
1573
1574     /* Controller Registers */
1575     snprintf(name, sizeof(name), "phb4-%d.%d-regs", phb->chip_id,
1576              phb->phb_id);
1577     memory_region_init_io(&phb->mr_regs, OBJECT(phb), &pnv_phb4_reg_ops, phb,
1578                           name, 0x2000);
1579
1580     /* Setup XIVE Source */
1581     if (phb->big_phb) {
1582         nr_irqs = PNV_PHB4_MAX_INTs;
1583     } else {
1584         nr_irqs = PNV_PHB4_MAX_INTs >> 1;
1585     }
1586     object_property_set_int(OBJECT(xsrc), "nr-irqs", nr_irqs, &error_fatal);
1587     object_property_set_link(OBJECT(xsrc), "xive", OBJECT(phb), &error_fatal);
1588     if (!qdev_realize(DEVICE(xsrc), NULL, errp)) {
1589         return;
1590     }
1591
1592     pnv_phb4_update_xsrc(phb);
1593
1594     phb->qirqs = qemu_allocate_irqs(xive_source_set_irq, xsrc, xsrc->nr_irqs);
1595
1596     pnv_phb4_xscom_realize(phb);
1597 }
1598
1599 /*
1600  * Address base trigger mode (POWER10)
1601  *
1602  * Trigger directly the IC ESB page
1603  */
1604 static void pnv_phb4_xive_notify_abt(PnvPHB4 *phb, uint32_t srcno,
1605                                      bool pq_checked)
1606 {
1607     uint64_t notif_port = phb->regs[PHB_INT_NOTIFY_ADDR >> 3];
1608     uint64_t data = 0; /* trigger data : don't care */
1609     hwaddr addr;
1610     MemTxResult result;
1611     int esb_shift;
1612
1613     if (notif_port & PHB_INT_NOTIFY_ADDR_64K) {
1614         esb_shift = 16;
1615     } else {
1616         esb_shift = 12;
1617     }
1618
1619     /* Compute the address of the IC ESB management page */
1620     addr = (notif_port & ~PHB_INT_NOTIFY_ADDR_64K);
1621     addr |= (1ull << (esb_shift + 1)) * srcno;
1622     addr |= (1ull << esb_shift);
1623
1624     /*
1625      * When the PQ state bits are checked on the PHB, the associated
1626      * PQ state bits on the IC should be ignored. Use the unconditional
1627      * trigger offset to inject a trigger on the IC. This is always
1628      * the case for LSIs
1629      */
1630     if (pq_checked) {
1631         addr |= XIVE_ESB_INJECT;
1632     }
1633
1634     trace_pnv_phb4_xive_notify_ic(addr, data);
1635
1636     address_space_stq_be(&address_space_memory, addr, data,
1637                          MEMTXATTRS_UNSPECIFIED, &result);
1638     if (result != MEMTX_OK) {
1639         phb_error(phb, "trigger failed @%"HWADDR_PRIx "\n", addr);
1640         return;
1641     }
1642 }
1643
1644 static void pnv_phb4_xive_notify_ic(PnvPHB4 *phb, uint32_t srcno,
1645                                     bool pq_checked)
1646 {
1647     uint64_t notif_port = phb->regs[PHB_INT_NOTIFY_ADDR >> 3];
1648     uint32_t offset = phb->regs[PHB_INT_NOTIFY_INDEX >> 3];
1649     uint64_t data = offset | srcno;
1650     MemTxResult result;
1651
1652     if (pq_checked) {
1653         data |= XIVE_TRIGGER_PQ;
1654     }
1655
1656     trace_pnv_phb4_xive_notify_ic(notif_port, data);
1657
1658     address_space_stq_be(&address_space_memory, notif_port, data,
1659                          MEMTXATTRS_UNSPECIFIED, &result);
1660     if (result != MEMTX_OK) {
1661         phb_error(phb, "trigger failed @%"HWADDR_PRIx "\n", notif_port);
1662         return;
1663     }
1664 }
1665
1666 static void pnv_phb4_xive_notify(XiveNotifier *xf, uint32_t srcno,
1667                                  bool pq_checked)
1668 {
1669     PnvPHB4 *phb = PNV_PHB4(xf);
1670
1671     if (phb->regs[PHB_CTRLR >> 3] & PHB_CTRLR_IRQ_ABT_MODE) {
1672         pnv_phb4_xive_notify_abt(phb, srcno, pq_checked);
1673     } else {
1674         pnv_phb4_xive_notify_ic(phb, srcno, pq_checked);
1675     }
1676 }
1677
1678 static Property pnv_phb4_properties[] = {
1679     DEFINE_PROP_UINT32("index", PnvPHB4, phb_id, 0),
1680     DEFINE_PROP_UINT32("chip-id", PnvPHB4, chip_id, 0),
1681     DEFINE_PROP_LINK("pec", PnvPHB4, pec, TYPE_PNV_PHB4_PEC,
1682                      PnvPhb4PecState *),
1683     DEFINE_PROP_LINK("phb-base", PnvPHB4, phb_base, TYPE_PNV_PHB, PnvPHB *),
1684     DEFINE_PROP_END_OF_LIST(),
1685 };
1686
1687 static void pnv_phb4_class_init(ObjectClass *klass, void *data)
1688 {
1689     DeviceClass *dc = DEVICE_CLASS(klass);
1690     XiveNotifierClass *xfc = XIVE_NOTIFIER_CLASS(klass);
1691
1692     dc->realize         = pnv_phb4_realize;
1693     device_class_set_props(dc, pnv_phb4_properties);
1694     dc->user_creatable  = false;
1695
1696     xfc->notify         = pnv_phb4_xive_notify;
1697 }
1698
1699 static const TypeInfo pnv_phb4_type_info = {
1700     .name          = TYPE_PNV_PHB4,
1701     .parent        = TYPE_DEVICE,
1702     .instance_init = pnv_phb4_instance_init,
1703     .instance_size = sizeof(PnvPHB4),
1704     .class_init    = pnv_phb4_class_init,
1705     .interfaces = (InterfaceInfo[]) {
1706             { TYPE_XIVE_NOTIFIER },
1707             { },
1708     }
1709 };
1710
1711 static const TypeInfo pnv_phb5_type_info = {
1712     .name          = TYPE_PNV_PHB5,
1713     .parent        = TYPE_PNV_PHB4,
1714     .instance_size = sizeof(PnvPHB4),
1715 };
1716
1717 static void pnv_phb4_root_bus_get_prop(Object *obj, Visitor *v,
1718                                        const char *name,
1719                                        void *opaque, Error **errp)
1720 {
1721     PnvPHB4RootBus *bus = PNV_PHB4_ROOT_BUS(obj);
1722     uint64_t value = 0;
1723
1724     if (strcmp(name, "phb-id") == 0) {
1725         value = bus->phb_id;
1726     } else {
1727         value = bus->chip_id;
1728     }
1729
1730     visit_type_size(v, name, &value, errp);
1731 }
1732
1733 static void pnv_phb4_root_bus_set_prop(Object *obj, Visitor *v,
1734                                        const char *name,
1735                                        void *opaque, Error **errp)
1736
1737 {
1738     PnvPHB4RootBus *bus = PNV_PHB4_ROOT_BUS(obj);
1739     uint64_t value;
1740
1741     if (!visit_type_size(v, name, &value, errp)) {
1742         return;
1743     }
1744
1745     if (strcmp(name, "phb-id") == 0) {
1746         bus->phb_id = value;
1747     } else {
1748         bus->chip_id = value;
1749     }
1750 }
1751
1752 static void pnv_phb4_root_bus_class_init(ObjectClass *klass, void *data)
1753 {
1754     BusClass *k = BUS_CLASS(klass);
1755
1756     object_class_property_add(klass, "phb-id", "int",
1757                               pnv_phb4_root_bus_get_prop,
1758                               pnv_phb4_root_bus_set_prop,
1759                               NULL, NULL);
1760
1761     object_class_property_add(klass, "chip-id", "int",
1762                               pnv_phb4_root_bus_get_prop,
1763                               pnv_phb4_root_bus_set_prop,
1764                               NULL, NULL);
1765
1766     /*
1767      * PHB4 has only a single root complex. Enforce the limit on the
1768      * parent bus
1769      */
1770     k->max_dev = 1;
1771 }
1772
1773 static const TypeInfo pnv_phb4_root_bus_info = {
1774     .name = TYPE_PNV_PHB4_ROOT_BUS,
1775     .parent = TYPE_PCIE_BUS,
1776     .instance_size = sizeof(PnvPHB4RootBus),
1777     .class_init = pnv_phb4_root_bus_class_init,
1778 };
1779
1780 static void pnv_phb4_register_types(void)
1781 {
1782     type_register_static(&pnv_phb4_root_bus_info);
1783     type_register_static(&pnv_phb4_type_info);
1784     type_register_static(&pnv_phb5_type_info);
1785     type_register_static(&pnv_phb4_iommu_memory_region_info);
1786 }
1787
1788 type_init(pnv_phb4_register_types);
1789
1790 void pnv_phb4_pic_print_info(PnvPHB4 *phb, Monitor *mon)
1791 {
1792     uint64_t notif_port =
1793         phb->regs[PHB_INT_NOTIFY_ADDR >> 3] & ~PHB_INT_NOTIFY_ADDR_64K;
1794     uint32_t offset = phb->regs[PHB_INT_NOTIFY_INDEX >> 3];
1795     bool abt = !!(phb->regs[PHB_CTRLR >> 3] & PHB_CTRLR_IRQ_ABT_MODE);
1796
1797     monitor_printf(mon, "PHB4[%x:%x] Source %08x .. %08x %s @%"HWADDR_PRIx"\n",
1798                    phb->chip_id, phb->phb_id,
1799                    offset, offset + phb->xsrc.nr_irqs - 1,
1800                    abt ? "ABT" : "",
1801                    notif_port);
1802     xive_source_pic_print_info(&phb->xsrc, 0, mon);
1803 }