xref: /qemu/hw/pci-host/pnv_phb4.c (revision ef17dd6a)
1 /*
2  * QEMU PowerPC PowerNV (POWER9) PHB4 model
3  *
4  * Copyright (c) 2018-2020, IBM Corporation.
5  *
6  * This code is licensed under the GPL version 2 or later. See the
7  * COPYING file in the top-level directory.
8  */
9 #include "qemu/osdep.h"
10 #include "qemu/log.h"
11 #include "qapi/visitor.h"
12 #include "qapi/error.h"
13 #include "qemu-common.h"
14 #include "monitor/monitor.h"
15 #include "target/ppc/cpu.h"
16 #include "hw/pci-host/pnv_phb4_regs.h"
17 #include "hw/pci-host/pnv_phb4.h"
18 #include "hw/pci/pcie_host.h"
19 #include "hw/pci/pcie_port.h"
20 #include "hw/ppc/pnv.h"
21 #include "hw/ppc/pnv_xscom.h"
22 #include "hw/irq.h"
23 #include "hw/qdev-properties.h"
24 #include "qom/object.h"
25 #include "trace.h"
26 
27 #define phb_error(phb, fmt, ...)                                        \
28     qemu_log_mask(LOG_GUEST_ERROR, "phb4[%d:%d]: " fmt "\n",            \
29                   (phb)->chip_id, (phb)->phb_id, ## __VA_ARGS__)
30 
31 #define phb_pec_error(pec, fmt, ...)                                    \
32     qemu_log_mask(LOG_GUEST_ERROR, "phb4_pec[%d:%d]: " fmt "\n",        \
33                   (pec)->chip_id, (pec)->index, ## __VA_ARGS__)
34 
35 /*
36  * QEMU version of the GETFIELD/SETFIELD macros
37  *
38  * These are common with the PnvXive model.
39  */
40 static inline uint64_t GETFIELD(uint64_t mask, uint64_t word)
41 {
42     return (word & mask) >> ctz64(mask);
43 }
44 
45 static inline uint64_t SETFIELD(uint64_t mask, uint64_t word,
46                                 uint64_t value)
47 {
48     return (word & ~mask) | ((value << ctz64(mask)) & mask);
49 }
50 
51 static PCIDevice *pnv_phb4_find_cfg_dev(PnvPHB4 *phb)
52 {
53     PCIHostState *pci = PCI_HOST_BRIDGE(phb);
54     uint64_t addr = phb->regs[PHB_CONFIG_ADDRESS >> 3];
55     uint8_t bus, devfn;
56 
57     if (!(addr >> 63)) {
58         return NULL;
59     }
60     bus = (addr >> 52) & 0xff;
61     devfn = (addr >> 44) & 0xff;
62 
63     /* We don't access the root complex this way */
64     if (bus == 0 && devfn == 0) {
65         return NULL;
66     }
67     return pci_find_device(pci->bus, bus, devfn);
68 }
69 
70 /*
71  * The CONFIG_DATA register expects little endian accesses, but as the
72  * region is big endian, we have to swap the value.
73  */
74 static void pnv_phb4_config_write(PnvPHB4 *phb, unsigned off,
75                                   unsigned size, uint64_t val)
76 {
77     uint32_t cfg_addr, limit;
78     PCIDevice *pdev;
79 
80     pdev = pnv_phb4_find_cfg_dev(phb);
81     if (!pdev) {
82         return;
83     }
84     cfg_addr = (phb->regs[PHB_CONFIG_ADDRESS >> 3] >> 32) & 0xffc;
85     cfg_addr |= off;
86     limit = pci_config_size(pdev);
87     if (limit <= cfg_addr) {
88         /*
89          * conventional pci device can be behind pcie-to-pci bridge.
90          * 256 <= addr < 4K has no effects.
91          */
92         return;
93     }
94     switch (size) {
95     case 1:
96         break;
97     case 2:
98         val = bswap16(val);
99         break;
100     case 4:
101         val = bswap32(val);
102         break;
103     default:
104         g_assert_not_reached();
105     }
106     pci_host_config_write_common(pdev, cfg_addr, limit, val, size);
107 }
108 
109 static uint64_t pnv_phb4_config_read(PnvPHB4 *phb, unsigned off,
110                                      unsigned size)
111 {
112     uint32_t cfg_addr, limit;
113     PCIDevice *pdev;
114     uint64_t val;
115 
116     pdev = pnv_phb4_find_cfg_dev(phb);
117     if (!pdev) {
118         return ~0ull;
119     }
120     cfg_addr = (phb->regs[PHB_CONFIG_ADDRESS >> 3] >> 32) & 0xffc;
121     cfg_addr |= off;
122     limit = pci_config_size(pdev);
123     if (limit <= cfg_addr) {
124         /*
125          * conventional pci device can be behind pcie-to-pci bridge.
126          * 256 <= addr < 4K has no effects.
127          */
128         return ~0ull;
129     }
130     val = pci_host_config_read_common(pdev, cfg_addr, limit, size);
131     switch (size) {
132     case 1:
133         return val;
134     case 2:
135         return bswap16(val);
136     case 4:
137         return bswap32(val);
138     default:
139         g_assert_not_reached();
140     }
141 }
142 
143 /*
144  * Root complex register accesses are memory mapped.
145  */
146 static void pnv_phb4_rc_config_write(PnvPHB4 *phb, unsigned off,
147                                      unsigned size, uint64_t val)
148 {
149     PCIHostState *pci = PCI_HOST_BRIDGE(phb);
150     PCIDevice *pdev;
151 
152     if (size != 4) {
153         phb_error(phb, "rc_config_write invalid size %d\n", size);
154         return;
155     }
156 
157     pdev = pci_find_device(pci->bus, 0, 0);
158     if (!pdev) {
159         phb_error(phb, "rc_config_write device not found\n");
160         return;
161     }
162 
163     pci_host_config_write_common(pdev, off, PHB_RC_CONFIG_SIZE,
164                                  bswap32(val), 4);
165 }
166 
167 static uint64_t pnv_phb4_rc_config_read(PnvPHB4 *phb, unsigned off,
168                                         unsigned size)
169 {
170     PCIHostState *pci = PCI_HOST_BRIDGE(phb);
171     PCIDevice *pdev;
172     uint64_t val;
173 
174     if (size != 4) {
175         phb_error(phb, "rc_config_read invalid size %d\n", size);
176         return ~0ull;
177     }
178 
179     pdev = pci_find_device(pci->bus, 0, 0);
180     if (!pdev) {
181         phb_error(phb, "rc_config_read device not found\n");
182         return ~0ull;
183     }
184 
185     val = pci_host_config_read_common(pdev, off, PHB_RC_CONFIG_SIZE, 4);
186     return bswap32(val);
187 }
188 
189 static void pnv_phb4_check_mbt(PnvPHB4 *phb, uint32_t index)
190 {
191     uint64_t base, start, size, mbe0, mbe1;
192     MemoryRegion *parent;
193     char name[64];
194 
195     /* Unmap first */
196     if (memory_region_is_mapped(&phb->mr_mmio[index])) {
197         /* Should we destroy it in RCU friendly way... ? */
198         memory_region_del_subregion(phb->mr_mmio[index].container,
199                                     &phb->mr_mmio[index]);
200     }
201 
202     /* Get table entry */
203     mbe0 = phb->ioda_MBT[(index << 1)];
204     mbe1 = phb->ioda_MBT[(index << 1) + 1];
205 
206     if (!(mbe0 & IODA3_MBT0_ENABLE)) {
207         return;
208     }
209 
210     /* Grab geometry from registers */
211     base = GETFIELD(IODA3_MBT0_BASE_ADDR, mbe0) << 12;
212     size = GETFIELD(IODA3_MBT1_MASK, mbe1) << 12;
213     size |= 0xff00000000000000ull;
214     size = ~size + 1;
215 
216     /* Calculate PCI side start address based on M32/M64 window type */
217     if (mbe0 & IODA3_MBT0_TYPE_M32) {
218         start = phb->regs[PHB_M32_START_ADDR >> 3];
219         if ((start + size) > 0x100000000ull) {
220             phb_error(phb, "M32 set beyond 4GB boundary !");
221             size = 0x100000000 - start;
222         }
223     } else {
224         start = base | (phb->regs[PHB_M64_UPPER_BITS >> 3]);
225     }
226 
227     /* TODO: Figure out how to implemet/decode AOMASK */
228 
229     /* Check if it matches an enabled MMIO region in the PEC stack */
230     if (memory_region_is_mapped(&phb->mmbar0) &&
231         base >= phb->mmio0_base &&
232         (base + size) <= (phb->mmio0_base + phb->mmio0_size)) {
233         parent = &phb->mmbar0;
234         base -= phb->mmio0_base;
235     } else if (memory_region_is_mapped(&phb->mmbar1) &&
236         base >= phb->mmio1_base &&
237         (base + size) <= (phb->mmio1_base + phb->mmio1_size)) {
238         parent = &phb->mmbar1;
239         base -= phb->mmio1_base;
240     } else {
241         phb_error(phb, "PHB MBAR %d out of parent bounds", index);
242         return;
243     }
244 
245     /* Create alias (better name ?) */
246     snprintf(name, sizeof(name), "phb4-mbar%d", index);
247     memory_region_init_alias(&phb->mr_mmio[index], OBJECT(phb), name,
248                              &phb->pci_mmio, start, size);
249     memory_region_add_subregion(parent, base, &phb->mr_mmio[index]);
250 }
251 
252 static void pnv_phb4_check_all_mbt(PnvPHB4 *phb)
253 {
254     uint64_t i;
255     uint32_t num_windows = phb->big_phb ? PNV_PHB4_MAX_MMIO_WINDOWS :
256         PNV_PHB4_MIN_MMIO_WINDOWS;
257 
258     for (i = 0; i < num_windows; i++) {
259         pnv_phb4_check_mbt(phb, i);
260     }
261 }
262 
263 static uint64_t *pnv_phb4_ioda_access(PnvPHB4 *phb,
264                                       unsigned *out_table, unsigned *out_idx)
265 {
266     uint64_t adreg = phb->regs[PHB_IODA_ADDR >> 3];
267     unsigned int index = GETFIELD(PHB_IODA_AD_TADR, adreg);
268     unsigned int table = GETFIELD(PHB_IODA_AD_TSEL, adreg);
269     unsigned int mask;
270     uint64_t *tptr = NULL;
271 
272     switch (table) {
273     case IODA3_TBL_LIST:
274         tptr = phb->ioda_LIST;
275         mask = 7;
276         break;
277     case IODA3_TBL_MIST:
278         tptr = phb->ioda_MIST;
279         mask = phb->big_phb ? PNV_PHB4_MAX_MIST : (PNV_PHB4_MAX_MIST >> 1);
280         mask -= 1;
281         break;
282     case IODA3_TBL_RCAM:
283         mask = phb->big_phb ? 127 : 63;
284         break;
285     case IODA3_TBL_MRT:
286         mask = phb->big_phb ? 15 : 7;
287         break;
288     case IODA3_TBL_PESTA:
289     case IODA3_TBL_PESTB:
290         mask = phb->big_phb ? PNV_PHB4_MAX_PEs : (PNV_PHB4_MAX_PEs >> 1);
291         mask -= 1;
292         break;
293     case IODA3_TBL_TVT:
294         tptr = phb->ioda_TVT;
295         mask = phb->big_phb ? PNV_PHB4_MAX_TVEs : (PNV_PHB4_MAX_TVEs >> 1);
296         mask -= 1;
297         break;
298     case IODA3_TBL_TCR:
299     case IODA3_TBL_TDR:
300         mask = phb->big_phb ? 1023 : 511;
301         break;
302     case IODA3_TBL_MBT:
303         tptr = phb->ioda_MBT;
304         mask = phb->big_phb ? PNV_PHB4_MAX_MBEs : (PNV_PHB4_MAX_MBEs >> 1);
305         mask -= 1;
306         break;
307     case IODA3_TBL_MDT:
308         tptr = phb->ioda_MDT;
309         mask = phb->big_phb ? PNV_PHB4_MAX_PEs : (PNV_PHB4_MAX_PEs >> 1);
310         mask -= 1;
311         break;
312     case IODA3_TBL_PEEV:
313         tptr = phb->ioda_PEEV;
314         mask = phb->big_phb ? PNV_PHB4_MAX_PEEVs : (PNV_PHB4_MAX_PEEVs >> 1);
315         mask -= 1;
316         break;
317     default:
318         phb_error(phb, "invalid IODA table %d", table);
319         return NULL;
320     }
321     index &= mask;
322     if (out_idx) {
323         *out_idx = index;
324     }
325     if (out_table) {
326         *out_table = table;
327     }
328     if (tptr) {
329         tptr += index;
330     }
331     if (adreg & PHB_IODA_AD_AUTOINC) {
332         index = (index + 1) & mask;
333         adreg = SETFIELD(PHB_IODA_AD_TADR, adreg, index);
334     }
335 
336     phb->regs[PHB_IODA_ADDR >> 3] = adreg;
337     return tptr;
338 }
339 
340 static uint64_t pnv_phb4_ioda_read(PnvPHB4 *phb)
341 {
342     unsigned table, idx;
343     uint64_t *tptr;
344 
345     tptr = pnv_phb4_ioda_access(phb, &table, &idx);
346     if (!tptr) {
347         /* Special PESTA case */
348         if (table == IODA3_TBL_PESTA) {
349             return ((uint64_t)(phb->ioda_PEST_AB[idx] & 1)) << 63;
350         } else if (table == IODA3_TBL_PESTB) {
351             return ((uint64_t)(phb->ioda_PEST_AB[idx] & 2)) << 62;
352         }
353         /* Return 0 on unsupported tables, not ff's */
354         return 0;
355     }
356     return *tptr;
357 }
358 
359 static void pnv_phb4_ioda_write(PnvPHB4 *phb, uint64_t val)
360 {
361     unsigned table, idx;
362     uint64_t *tptr;
363 
364     tptr = pnv_phb4_ioda_access(phb, &table, &idx);
365     if (!tptr) {
366         /* Special PESTA case */
367         if (table == IODA3_TBL_PESTA) {
368             phb->ioda_PEST_AB[idx] &= ~1;
369             phb->ioda_PEST_AB[idx] |= (val >> 63) & 1;
370         } else if (table == IODA3_TBL_PESTB) {
371             phb->ioda_PEST_AB[idx] &= ~2;
372             phb->ioda_PEST_AB[idx] |= (val >> 62) & 2;
373         }
374         return;
375     }
376 
377     /* Handle side effects */
378     switch (table) {
379     case IODA3_TBL_LIST:
380         break;
381     case IODA3_TBL_MIST: {
382         /* Special mask for MIST partial write */
383         uint64_t adreg = phb->regs[PHB_IODA_ADDR >> 3];
384         uint32_t mmask = GETFIELD(PHB_IODA_AD_MIST_PWV, adreg);
385         uint64_t v = *tptr;
386         if (mmask == 0) {
387             mmask = 0xf;
388         }
389         if (mmask & 8) {
390             v &= 0x0000ffffffffffffull;
391             v |= 0xcfff000000000000ull & val;
392         }
393         if (mmask & 4) {
394             v &= 0xffff0000ffffffffull;
395             v |= 0x0000cfff00000000ull & val;
396         }
397         if (mmask & 2) {
398             v &= 0xffffffff0000ffffull;
399             v |= 0x00000000cfff0000ull & val;
400         }
401         if (mmask & 1) {
402             v &= 0xffffffffffff0000ull;
403             v |= 0x000000000000cfffull & val;
404         }
405         *tptr = v;
406         break;
407     }
408     case IODA3_TBL_MBT:
409         *tptr = val;
410 
411         /* Copy accross the valid bit to the other half */
412         phb->ioda_MBT[idx ^ 1] &= 0x7fffffffffffffffull;
413         phb->ioda_MBT[idx ^ 1] |= 0x8000000000000000ull & val;
414 
415         /* Update mappings */
416         pnv_phb4_check_mbt(phb, idx >> 1);
417         break;
418     default:
419         *tptr = val;
420     }
421 }
422 
423 static void pnv_phb4_rtc_invalidate(PnvPHB4 *phb, uint64_t val)
424 {
425     PnvPhb4DMASpace *ds;
426 
427     /* Always invalidate all for now ... */
428     QLIST_FOREACH(ds, &phb->dma_spaces, list) {
429         ds->pe_num = PHB_INVALID_PE;
430     }
431 }
432 
433 static void pnv_phb4_update_msi_regions(PnvPhb4DMASpace *ds)
434 {
435     uint64_t cfg = ds->phb->regs[PHB_PHB4_CONFIG >> 3];
436 
437     if (cfg & PHB_PHB4C_32BIT_MSI_EN) {
438         if (!memory_region_is_mapped(MEMORY_REGION(&ds->msi32_mr))) {
439             memory_region_add_subregion(MEMORY_REGION(&ds->dma_mr),
440                                         0xffff0000, &ds->msi32_mr);
441         }
442     } else {
443         if (memory_region_is_mapped(MEMORY_REGION(&ds->msi32_mr))) {
444             memory_region_del_subregion(MEMORY_REGION(&ds->dma_mr),
445                                         &ds->msi32_mr);
446         }
447     }
448 
449     if (cfg & PHB_PHB4C_64BIT_MSI_EN) {
450         if (!memory_region_is_mapped(MEMORY_REGION(&ds->msi64_mr))) {
451             memory_region_add_subregion(MEMORY_REGION(&ds->dma_mr),
452                                         (1ull << 60), &ds->msi64_mr);
453         }
454     } else {
455         if (memory_region_is_mapped(MEMORY_REGION(&ds->msi64_mr))) {
456             memory_region_del_subregion(MEMORY_REGION(&ds->dma_mr),
457                                         &ds->msi64_mr);
458         }
459     }
460 }
461 
462 static void pnv_phb4_update_all_msi_regions(PnvPHB4 *phb)
463 {
464     PnvPhb4DMASpace *ds;
465 
466     QLIST_FOREACH(ds, &phb->dma_spaces, list) {
467         pnv_phb4_update_msi_regions(ds);
468     }
469 }
470 
471 static void pnv_phb4_update_xsrc(PnvPHB4 *phb)
472 {
473     int shift, flags, i, lsi_base;
474     XiveSource *xsrc = &phb->xsrc;
475 
476     /* The XIVE source characteristics can be set at run time */
477     if (phb->regs[PHB_CTRLR >> 3] & PHB_CTRLR_IRQ_PGSZ_64K) {
478         shift = XIVE_ESB_64K;
479     } else {
480         shift = XIVE_ESB_4K;
481     }
482     if (phb->regs[PHB_CTRLR >> 3] & PHB_CTRLR_IRQ_STORE_EOI) {
483         flags = XIVE_SRC_STORE_EOI;
484     } else {
485         flags = 0;
486     }
487 
488     phb->xsrc.esb_shift = shift;
489     phb->xsrc.esb_flags = flags;
490 
491     lsi_base = GETFIELD(PHB_LSI_SRC_ID, phb->regs[PHB_LSI_SOURCE_ID >> 3]);
492     lsi_base <<= 3;
493 
494     /* TODO: handle reset values of PHB_LSI_SRC_ID */
495     if (!lsi_base) {
496         return;
497     }
498 
499     /* TODO: need a xive_source_irq_reset_lsi() */
500     bitmap_zero(xsrc->lsi_map, xsrc->nr_irqs);
501 
502     for (i = 0; i < xsrc->nr_irqs; i++) {
503         bool msi = (i < lsi_base || i >= (lsi_base + 8));
504         if (!msi) {
505             xive_source_irq_set_lsi(xsrc, i);
506         }
507     }
508 }
509 
510 static void pnv_phb4_reg_write(void *opaque, hwaddr off, uint64_t val,
511                                unsigned size)
512 {
513     PnvPHB4 *phb = PNV_PHB4(opaque);
514     bool changed;
515 
516     /* Special case outbound configuration data */
517     if ((off & 0xfffc) == PHB_CONFIG_DATA) {
518         pnv_phb4_config_write(phb, off & 0x3, size, val);
519         return;
520     }
521 
522     /* Special case RC configuration space */
523     if ((off & 0xf800) == PHB_RC_CONFIG_BASE) {
524         pnv_phb4_rc_config_write(phb, off & 0x7ff, size, val);
525         return;
526     }
527 
528     /* Other registers are 64-bit only */
529     if (size != 8 || off & 0x7) {
530         phb_error(phb, "Invalid register access, offset: 0x%"PRIx64" size: %d",
531                    off, size);
532         return;
533     }
534 
535     /* Handle masking */
536     switch (off) {
537     case PHB_LSI_SOURCE_ID:
538         val &= PHB_LSI_SRC_ID;
539         break;
540     case PHB_M64_UPPER_BITS:
541         val &= 0xff00000000000000ull;
542         break;
543     /* TCE Kill */
544     case PHB_TCE_KILL:
545         /* Clear top 3 bits which HW does to indicate successful queuing */
546         val &= ~(PHB_TCE_KILL_ALL | PHB_TCE_KILL_PE | PHB_TCE_KILL_ONE);
547         break;
548     case PHB_Q_DMA_R:
549         /*
550          * This is enough logic to make SW happy but we aren't
551          * actually quiescing the DMAs
552          */
553         if (val & PHB_Q_DMA_R_AUTORESET) {
554             val = 0;
555         } else {
556             val &= PHB_Q_DMA_R_QUIESCE_DMA;
557         }
558         break;
559     /* LEM stuff */
560     case PHB_LEM_FIR_AND_MASK:
561         phb->regs[PHB_LEM_FIR_ACCUM >> 3] &= val;
562         return;
563     case PHB_LEM_FIR_OR_MASK:
564         phb->regs[PHB_LEM_FIR_ACCUM >> 3] |= val;
565         return;
566     case PHB_LEM_ERROR_AND_MASK:
567         phb->regs[PHB_LEM_ERROR_MASK >> 3] &= val;
568         return;
569     case PHB_LEM_ERROR_OR_MASK:
570         phb->regs[PHB_LEM_ERROR_MASK >> 3] |= val;
571         return;
572     case PHB_LEM_WOF:
573         val = 0;
574         break;
575     /* TODO: More regs ..., maybe create a table with masks... */
576 
577     /* Read only registers */
578     case PHB_CPU_LOADSTORE_STATUS:
579     case PHB_ETU_ERR_SUMMARY:
580     case PHB_PHB4_GEN_CAP:
581     case PHB_PHB4_TCE_CAP:
582     case PHB_PHB4_IRQ_CAP:
583     case PHB_PHB4_EEH_CAP:
584         return;
585     }
586 
587     /* Record whether it changed */
588     changed = phb->regs[off >> 3] != val;
589 
590     /* Store in register cache first */
591     phb->regs[off >> 3] = val;
592 
593     /* Handle side effects */
594     switch (off) {
595     case PHB_PHB4_CONFIG:
596         if (changed) {
597             pnv_phb4_update_all_msi_regions(phb);
598         }
599         break;
600     case PHB_M32_START_ADDR:
601     case PHB_M64_UPPER_BITS:
602         if (changed) {
603             pnv_phb4_check_all_mbt(phb);
604         }
605         break;
606 
607     /* IODA table accesses */
608     case PHB_IODA_DATA0:
609         pnv_phb4_ioda_write(phb, val);
610         break;
611 
612     /* RTC invalidation */
613     case PHB_RTC_INVALIDATE:
614         pnv_phb4_rtc_invalidate(phb, val);
615         break;
616 
617     /* PHB Control (Affects XIVE source) */
618     case PHB_CTRLR:
619     case PHB_LSI_SOURCE_ID:
620         pnv_phb4_update_xsrc(phb);
621         break;
622 
623     /* Silent simple writes */
624     case PHB_ASN_CMPM:
625     case PHB_CONFIG_ADDRESS:
626     case PHB_IODA_ADDR:
627     case PHB_TCE_KILL:
628     case PHB_TCE_SPEC_CTL:
629     case PHB_PEST_BAR:
630     case PHB_PELTV_BAR:
631     case PHB_RTT_BAR:
632     case PHB_LEM_FIR_ACCUM:
633     case PHB_LEM_ERROR_MASK:
634     case PHB_LEM_ACTION0:
635     case PHB_LEM_ACTION1:
636     case PHB_TCE_TAG_ENABLE:
637     case PHB_INT_NOTIFY_ADDR:
638     case PHB_INT_NOTIFY_INDEX:
639     case PHB_DMARD_SYNC:
640        break;
641 
642     /* Noise on anything else */
643     default:
644         qemu_log_mask(LOG_UNIMP, "phb4: reg_write 0x%"PRIx64"=%"PRIx64"\n",
645                       off, val);
646     }
647 }
648 
649 static uint64_t pnv_phb4_reg_read(void *opaque, hwaddr off, unsigned size)
650 {
651     PnvPHB4 *phb = PNV_PHB4(opaque);
652     uint64_t val;
653 
654     if ((off & 0xfffc) == PHB_CONFIG_DATA) {
655         return pnv_phb4_config_read(phb, off & 0x3, size);
656     }
657 
658     /* Special case RC configuration space */
659     if ((off & 0xf800) == PHB_RC_CONFIG_BASE) {
660         return pnv_phb4_rc_config_read(phb, off & 0x7ff, size);
661     }
662 
663     /* Other registers are 64-bit only */
664     if (size != 8 || off & 0x7) {
665         phb_error(phb, "Invalid register access, offset: 0x%"PRIx64" size: %d",
666                    off, size);
667         return ~0ull;
668     }
669 
670     /* Default read from cache */
671     val = phb->regs[off >> 3];
672 
673     switch (off) {
674     case PHB_VERSION:
675         return PNV_PHB4_PEC_GET_CLASS(phb->pec)->version;
676 
677         /* Read-only */
678     case PHB_PHB4_GEN_CAP:
679         return 0xe4b8000000000000ull;
680     case PHB_PHB4_TCE_CAP:
681         return phb->big_phb ? 0x4008440000000400ull : 0x2008440000000200ull;
682     case PHB_PHB4_IRQ_CAP:
683         return phb->big_phb ? 0x0800000000001000ull : 0x0800000000000800ull;
684     case PHB_PHB4_EEH_CAP:
685         return phb->big_phb ? 0x2000000000000000ull : 0x1000000000000000ull;
686 
687     /* IODA table accesses */
688     case PHB_IODA_DATA0:
689         return pnv_phb4_ioda_read(phb);
690 
691     /* Link training always appears trained */
692     case PHB_PCIE_DLP_TRAIN_CTL:
693         /* TODO: Do something sensible with speed ? */
694         return PHB_PCIE_DLP_INBAND_PRESENCE | PHB_PCIE_DLP_TL_LINKACT;
695 
696     /* DMA read sync: make it look like it's complete */
697     case PHB_DMARD_SYNC:
698         return PHB_DMARD_SYNC_COMPLETE;
699 
700     /* Silent simple reads */
701     case PHB_LSI_SOURCE_ID:
702     case PHB_CPU_LOADSTORE_STATUS:
703     case PHB_ASN_CMPM:
704     case PHB_PHB4_CONFIG:
705     case PHB_M32_START_ADDR:
706     case PHB_CONFIG_ADDRESS:
707     case PHB_IODA_ADDR:
708     case PHB_RTC_INVALIDATE:
709     case PHB_TCE_KILL:
710     case PHB_TCE_SPEC_CTL:
711     case PHB_PEST_BAR:
712     case PHB_PELTV_BAR:
713     case PHB_RTT_BAR:
714     case PHB_M64_UPPER_BITS:
715     case PHB_CTRLR:
716     case PHB_LEM_FIR_ACCUM:
717     case PHB_LEM_ERROR_MASK:
718     case PHB_LEM_ACTION0:
719     case PHB_LEM_ACTION1:
720     case PHB_TCE_TAG_ENABLE:
721     case PHB_INT_NOTIFY_ADDR:
722     case PHB_INT_NOTIFY_INDEX:
723     case PHB_Q_DMA_R:
724     case PHB_ETU_ERR_SUMMARY:
725         break;
726 
727     /* Noise on anything else */
728     default:
729         qemu_log_mask(LOG_UNIMP, "phb4: reg_read 0x%"PRIx64"=%"PRIx64"\n",
730                       off, val);
731     }
732     return val;
733 }
734 
735 static const MemoryRegionOps pnv_phb4_reg_ops = {
736     .read = pnv_phb4_reg_read,
737     .write = pnv_phb4_reg_write,
738     .valid.min_access_size = 1,
739     .valid.max_access_size = 8,
740     .impl.min_access_size = 1,
741     .impl.max_access_size = 8,
742     .endianness = DEVICE_BIG_ENDIAN,
743 };
744 
745 static uint64_t pnv_phb4_xscom_read(void *opaque, hwaddr addr, unsigned size)
746 {
747     PnvPHB4 *phb = PNV_PHB4(opaque);
748     uint32_t reg = addr >> 3;
749     uint64_t val;
750     hwaddr offset;
751 
752     switch (reg) {
753     case PHB_SCOM_HV_IND_ADDR:
754         return phb->scom_hv_ind_addr_reg;
755 
756     case PHB_SCOM_HV_IND_DATA:
757         if (!(phb->scom_hv_ind_addr_reg & PHB_SCOM_HV_IND_ADDR_VALID)) {
758             phb_error(phb, "Invalid indirect address");
759             return ~0ull;
760         }
761         size = (phb->scom_hv_ind_addr_reg & PHB_SCOM_HV_IND_ADDR_4B) ? 4 : 8;
762         offset = GETFIELD(PHB_SCOM_HV_IND_ADDR_ADDR, phb->scom_hv_ind_addr_reg);
763         val = pnv_phb4_reg_read(phb, offset, size);
764         if (phb->scom_hv_ind_addr_reg & PHB_SCOM_HV_IND_ADDR_AUTOINC) {
765             offset += size;
766             offset &= 0x3fff;
767             phb->scom_hv_ind_addr_reg = SETFIELD(PHB_SCOM_HV_IND_ADDR_ADDR,
768                                                  phb->scom_hv_ind_addr_reg,
769                                                  offset);
770         }
771         return val;
772     case PHB_SCOM_ETU_LEM_FIR:
773     case PHB_SCOM_ETU_LEM_FIR_AND:
774     case PHB_SCOM_ETU_LEM_FIR_OR:
775     case PHB_SCOM_ETU_LEM_FIR_MSK:
776     case PHB_SCOM_ETU_LEM_ERR_MSK_AND:
777     case PHB_SCOM_ETU_LEM_ERR_MSK_OR:
778     case PHB_SCOM_ETU_LEM_ACT0:
779     case PHB_SCOM_ETU_LEM_ACT1:
780     case PHB_SCOM_ETU_LEM_WOF:
781         offset = ((reg - PHB_SCOM_ETU_LEM_FIR) << 3) + PHB_LEM_FIR_ACCUM;
782         return pnv_phb4_reg_read(phb, offset, size);
783     case PHB_SCOM_ETU_PMON_CONFIG:
784     case PHB_SCOM_ETU_PMON_CTR0:
785     case PHB_SCOM_ETU_PMON_CTR1:
786     case PHB_SCOM_ETU_PMON_CTR2:
787     case PHB_SCOM_ETU_PMON_CTR3:
788         offset = ((reg - PHB_SCOM_ETU_PMON_CONFIG) << 3) + PHB_PERFMON_CONFIG;
789         return pnv_phb4_reg_read(phb, offset, size);
790 
791     default:
792         qemu_log_mask(LOG_UNIMP, "phb4: xscom_read 0x%"HWADDR_PRIx"\n", addr);
793         return ~0ull;
794     }
795 }
796 
797 static void pnv_phb4_xscom_write(void *opaque, hwaddr addr,
798                                  uint64_t val, unsigned size)
799 {
800     PnvPHB4 *phb = PNV_PHB4(opaque);
801     uint32_t reg = addr >> 3;
802     hwaddr offset;
803 
804     switch (reg) {
805     case PHB_SCOM_HV_IND_ADDR:
806         phb->scom_hv_ind_addr_reg = val & 0xe000000000001fff;
807         break;
808     case PHB_SCOM_HV_IND_DATA:
809         if (!(phb->scom_hv_ind_addr_reg & PHB_SCOM_HV_IND_ADDR_VALID)) {
810             phb_error(phb, "Invalid indirect address");
811             break;
812         }
813         size = (phb->scom_hv_ind_addr_reg & PHB_SCOM_HV_IND_ADDR_4B) ? 4 : 8;
814         offset = GETFIELD(PHB_SCOM_HV_IND_ADDR_ADDR, phb->scom_hv_ind_addr_reg);
815         pnv_phb4_reg_write(phb, offset, val, size);
816         if (phb->scom_hv_ind_addr_reg & PHB_SCOM_HV_IND_ADDR_AUTOINC) {
817             offset += size;
818             offset &= 0x3fff;
819             phb->scom_hv_ind_addr_reg = SETFIELD(PHB_SCOM_HV_IND_ADDR_ADDR,
820                                                  phb->scom_hv_ind_addr_reg,
821                                                  offset);
822         }
823         break;
824     case PHB_SCOM_ETU_LEM_FIR:
825     case PHB_SCOM_ETU_LEM_FIR_AND:
826     case PHB_SCOM_ETU_LEM_FIR_OR:
827     case PHB_SCOM_ETU_LEM_FIR_MSK:
828     case PHB_SCOM_ETU_LEM_ERR_MSK_AND:
829     case PHB_SCOM_ETU_LEM_ERR_MSK_OR:
830     case PHB_SCOM_ETU_LEM_ACT0:
831     case PHB_SCOM_ETU_LEM_ACT1:
832     case PHB_SCOM_ETU_LEM_WOF:
833         offset = ((reg - PHB_SCOM_ETU_LEM_FIR) << 3) + PHB_LEM_FIR_ACCUM;
834         pnv_phb4_reg_write(phb, offset, val, size);
835         break;
836     case PHB_SCOM_ETU_PMON_CONFIG:
837     case PHB_SCOM_ETU_PMON_CTR0:
838     case PHB_SCOM_ETU_PMON_CTR1:
839     case PHB_SCOM_ETU_PMON_CTR2:
840     case PHB_SCOM_ETU_PMON_CTR3:
841         offset = ((reg - PHB_SCOM_ETU_PMON_CONFIG) << 3) + PHB_PERFMON_CONFIG;
842         pnv_phb4_reg_write(phb, offset, val, size);
843         break;
844     default:
845         qemu_log_mask(LOG_UNIMP, "phb4: xscom_write 0x%"HWADDR_PRIx
846                       "=%"PRIx64"\n", addr, val);
847     }
848 }
849 
850 const MemoryRegionOps pnv_phb4_xscom_ops = {
851     .read = pnv_phb4_xscom_read,
852     .write = pnv_phb4_xscom_write,
853     .valid.min_access_size = 8,
854     .valid.max_access_size = 8,
855     .impl.min_access_size = 8,
856     .impl.max_access_size = 8,
857     .endianness = DEVICE_BIG_ENDIAN,
858 };
859 
860 static uint64_t pnv_pec_stk_nest_xscom_read(void *opaque, hwaddr addr,
861                                             unsigned size)
862 {
863     PnvPHB4 *phb = PNV_PHB4(opaque);
864     uint32_t reg = addr >> 3;
865 
866     /* TODO: add list of allowed registers and error out if not */
867     return phb->nest_regs[reg];
868 }
869 
870 /*
871  * Return the 'stack_no' of a PHB4. 'stack_no' is the order
872  * the PHB4 occupies in the PEC. This is the reverse of what
873  * pnv_phb4_pec_get_phb_id() does.
874  *
875  * E.g. a phb with phb_id = 4 and pec->index = 1 (PEC1) will
876  * be the second phb (stack_no = 1) of the PEC.
877  */
878 static int pnv_phb4_get_phb_stack_no(PnvPHB4 *phb)
879 {
880     PnvPhb4PecState *pec = phb->pec;
881     PnvPhb4PecClass *pecc = PNV_PHB4_PEC_GET_CLASS(pec);
882     int index = pec->index;
883     int stack_no = phb->phb_id;
884 
885     while (index--) {
886         stack_no -= pecc->num_phbs[index];
887     }
888 
889     return stack_no;
890 }
891 
892 static void pnv_phb4_update_regions(PnvPHB4 *phb)
893 {
894     /* Unmap first always */
895     if (memory_region_is_mapped(&phb->mr_regs)) {
896         memory_region_del_subregion(&phb->phbbar, &phb->mr_regs);
897     }
898     if (memory_region_is_mapped(&phb->xsrc.esb_mmio)) {
899         memory_region_del_subregion(&phb->intbar, &phb->xsrc.esb_mmio);
900     }
901 
902     /* Map registers if enabled */
903     if (memory_region_is_mapped(&phb->phbbar)) {
904         memory_region_add_subregion(&phb->phbbar, 0, &phb->mr_regs);
905     }
906 
907     /* Map ESB if enabled */
908     if (memory_region_is_mapped(&phb->intbar)) {
909         memory_region_add_subregion(&phb->intbar, 0, &phb->xsrc.esb_mmio);
910     }
911 
912     /* Check/update m32 */
913     pnv_phb4_check_all_mbt(phb);
914 }
915 
916 static void pnv_pec_phb_update_map(PnvPHB4 *phb)
917 {
918     PnvPhb4PecState *pec = phb->pec;
919     MemoryRegion *sysmem = get_system_memory();
920     uint64_t bar_en = phb->nest_regs[PEC_NEST_STK_BAR_EN];
921     int stack_no = pnv_phb4_get_phb_stack_no(phb);
922     uint64_t bar, mask, size;
923     char name[64];
924 
925     /*
926      * NOTE: This will really not work well if those are remapped
927      * after the PHB has created its sub regions. We could do better
928      * if we had a way to resize regions but we don't really care
929      * that much in practice as the stuff below really only happens
930      * once early during boot
931      */
932 
933     /* Handle unmaps */
934     if (memory_region_is_mapped(&phb->mmbar0) &&
935         !(bar_en & PEC_NEST_STK_BAR_EN_MMIO0)) {
936         memory_region_del_subregion(sysmem, &phb->mmbar0);
937     }
938     if (memory_region_is_mapped(&phb->mmbar1) &&
939         !(bar_en & PEC_NEST_STK_BAR_EN_MMIO1)) {
940         memory_region_del_subregion(sysmem, &phb->mmbar1);
941     }
942     if (memory_region_is_mapped(&phb->phbbar) &&
943         !(bar_en & PEC_NEST_STK_BAR_EN_PHB)) {
944         memory_region_del_subregion(sysmem, &phb->phbbar);
945     }
946     if (memory_region_is_mapped(&phb->intbar) &&
947         !(bar_en & PEC_NEST_STK_BAR_EN_INT)) {
948         memory_region_del_subregion(sysmem, &phb->intbar);
949     }
950 
951     /* Update PHB */
952     pnv_phb4_update_regions(phb);
953 
954     /* Handle maps */
955     if (!memory_region_is_mapped(&phb->mmbar0) &&
956         (bar_en & PEC_NEST_STK_BAR_EN_MMIO0)) {
957         bar = phb->nest_regs[PEC_NEST_STK_MMIO_BAR0] >> 8;
958         mask = phb->nest_regs[PEC_NEST_STK_MMIO_BAR0_MASK];
959         size = ((~mask) >> 8) + 1;
960         snprintf(name, sizeof(name), "pec-%d.%d-phb-%d-mmio0",
961                  pec->chip_id, pec->index, stack_no);
962         memory_region_init(&phb->mmbar0, OBJECT(phb), name, size);
963         memory_region_add_subregion(sysmem, bar, &phb->mmbar0);
964         phb->mmio0_base = bar;
965         phb->mmio0_size = size;
966     }
967     if (!memory_region_is_mapped(&phb->mmbar1) &&
968         (bar_en & PEC_NEST_STK_BAR_EN_MMIO1)) {
969         bar = phb->nest_regs[PEC_NEST_STK_MMIO_BAR1] >> 8;
970         mask = phb->nest_regs[PEC_NEST_STK_MMIO_BAR1_MASK];
971         size = ((~mask) >> 8) + 1;
972         snprintf(name, sizeof(name), "pec-%d.%d-phb-%d-mmio1",
973                  pec->chip_id, pec->index, stack_no);
974         memory_region_init(&phb->mmbar1, OBJECT(phb), name, size);
975         memory_region_add_subregion(sysmem, bar, &phb->mmbar1);
976         phb->mmio1_base = bar;
977         phb->mmio1_size = size;
978     }
979     if (!memory_region_is_mapped(&phb->phbbar) &&
980         (bar_en & PEC_NEST_STK_BAR_EN_PHB)) {
981         bar = phb->nest_regs[PEC_NEST_STK_PHB_REGS_BAR] >> 8;
982         size = PNV_PHB4_NUM_REGS << 3;
983         snprintf(name, sizeof(name), "pec-%d.%d-phb-%d",
984                  pec->chip_id, pec->index, stack_no);
985         memory_region_init(&phb->phbbar, OBJECT(phb), name, size);
986         memory_region_add_subregion(sysmem, bar, &phb->phbbar);
987     }
988     if (!memory_region_is_mapped(&phb->intbar) &&
989         (bar_en & PEC_NEST_STK_BAR_EN_INT)) {
990         bar = phb->nest_regs[PEC_NEST_STK_INT_BAR] >> 8;
991         size = PNV_PHB4_MAX_INTs << 16;
992         snprintf(name, sizeof(name), "pec-%d.%d-phb-%d-int",
993                  phb->pec->chip_id, phb->pec->index, stack_no);
994         memory_region_init(&phb->intbar, OBJECT(phb), name, size);
995         memory_region_add_subregion(sysmem, bar, &phb->intbar);
996     }
997 
998     /* Update PHB */
999     pnv_phb4_update_regions(phb);
1000 }
1001 
1002 static void pnv_pec_stk_nest_xscom_write(void *opaque, hwaddr addr,
1003                                          uint64_t val, unsigned size)
1004 {
1005     PnvPHB4 *phb = PNV_PHB4(opaque);
1006     PnvPhb4PecState *pec = phb->pec;
1007     uint32_t reg = addr >> 3;
1008 
1009     switch (reg) {
1010     case PEC_NEST_STK_PCI_NEST_FIR:
1011         phb->nest_regs[PEC_NEST_STK_PCI_NEST_FIR] = val;
1012         break;
1013     case PEC_NEST_STK_PCI_NEST_FIR_CLR:
1014         phb->nest_regs[PEC_NEST_STK_PCI_NEST_FIR] &= val;
1015         break;
1016     case PEC_NEST_STK_PCI_NEST_FIR_SET:
1017         phb->nest_regs[PEC_NEST_STK_PCI_NEST_FIR] |= val;
1018         break;
1019     case PEC_NEST_STK_PCI_NEST_FIR_MSK:
1020         phb->nest_regs[PEC_NEST_STK_PCI_NEST_FIR_MSK] = val;
1021         break;
1022     case PEC_NEST_STK_PCI_NEST_FIR_MSKC:
1023         phb->nest_regs[PEC_NEST_STK_PCI_NEST_FIR_MSK] &= val;
1024         break;
1025     case PEC_NEST_STK_PCI_NEST_FIR_MSKS:
1026         phb->nest_regs[PEC_NEST_STK_PCI_NEST_FIR_MSK] |= val;
1027         break;
1028     case PEC_NEST_STK_PCI_NEST_FIR_ACT0:
1029     case PEC_NEST_STK_PCI_NEST_FIR_ACT1:
1030         phb->nest_regs[reg] = val;
1031         break;
1032     case PEC_NEST_STK_PCI_NEST_FIR_WOF:
1033         phb->nest_regs[reg] = 0;
1034         break;
1035     case PEC_NEST_STK_ERR_REPORT_0:
1036     case PEC_NEST_STK_ERR_REPORT_1:
1037     case PEC_NEST_STK_PBCQ_GNRL_STATUS:
1038         /* Flag error ? */
1039         break;
1040     case PEC_NEST_STK_PBCQ_MODE:
1041         phb->nest_regs[reg] = val & 0xff00000000000000ull;
1042         break;
1043     case PEC_NEST_STK_MMIO_BAR0:
1044     case PEC_NEST_STK_MMIO_BAR0_MASK:
1045     case PEC_NEST_STK_MMIO_BAR1:
1046     case PEC_NEST_STK_MMIO_BAR1_MASK:
1047         if (phb->nest_regs[PEC_NEST_STK_BAR_EN] &
1048             (PEC_NEST_STK_BAR_EN_MMIO0 |
1049              PEC_NEST_STK_BAR_EN_MMIO1)) {
1050             phb_pec_error(pec, "Changing enabled BAR unsupported\n");
1051         }
1052         phb->nest_regs[reg] = val & 0xffffffffff000000ull;
1053         break;
1054     case PEC_NEST_STK_PHB_REGS_BAR:
1055         if (phb->nest_regs[PEC_NEST_STK_BAR_EN] & PEC_NEST_STK_BAR_EN_PHB) {
1056             phb_pec_error(pec, "Changing enabled BAR unsupported\n");
1057         }
1058         phb->nest_regs[reg] = val & 0xffffffffffc00000ull;
1059         break;
1060     case PEC_NEST_STK_INT_BAR:
1061         if (phb->nest_regs[PEC_NEST_STK_BAR_EN] & PEC_NEST_STK_BAR_EN_INT) {
1062             phb_pec_error(pec, "Changing enabled BAR unsupported\n");
1063         }
1064         phb->nest_regs[reg] = val & 0xfffffff000000000ull;
1065         break;
1066     case PEC_NEST_STK_BAR_EN:
1067         phb->nest_regs[reg] = val & 0xf000000000000000ull;
1068         pnv_pec_phb_update_map(phb);
1069         break;
1070     case PEC_NEST_STK_DATA_FRZ_TYPE:
1071     case PEC_NEST_STK_PBCQ_TUN_BAR:
1072         /* Not used for now */
1073         phb->nest_regs[reg] = val;
1074         break;
1075     default:
1076         qemu_log_mask(LOG_UNIMP, "phb4_pec: nest_xscom_write 0x%"HWADDR_PRIx
1077                       "=%"PRIx64"\n", addr, val);
1078     }
1079 }
1080 
1081 static const MemoryRegionOps pnv_pec_stk_nest_xscom_ops = {
1082     .read = pnv_pec_stk_nest_xscom_read,
1083     .write = pnv_pec_stk_nest_xscom_write,
1084     .valid.min_access_size = 8,
1085     .valid.max_access_size = 8,
1086     .impl.min_access_size = 8,
1087     .impl.max_access_size = 8,
1088     .endianness = DEVICE_BIG_ENDIAN,
1089 };
1090 
1091 static uint64_t pnv_pec_stk_pci_xscom_read(void *opaque, hwaddr addr,
1092                                            unsigned size)
1093 {
1094     PnvPHB4 *phb = PNV_PHB4(opaque);
1095     uint32_t reg = addr >> 3;
1096 
1097     /* TODO: add list of allowed registers and error out if not */
1098     return phb->pci_regs[reg];
1099 }
1100 
1101 static void pnv_pec_stk_pci_xscom_write(void *opaque, hwaddr addr,
1102                                         uint64_t val, unsigned size)
1103 {
1104     PnvPHB4 *phb = PNV_PHB4(opaque);
1105     uint32_t reg = addr >> 3;
1106 
1107     switch (reg) {
1108     case PEC_PCI_STK_PCI_FIR:
1109         phb->pci_regs[reg] = val;
1110         break;
1111     case PEC_PCI_STK_PCI_FIR_CLR:
1112         phb->pci_regs[PEC_PCI_STK_PCI_FIR] &= val;
1113         break;
1114     case PEC_PCI_STK_PCI_FIR_SET:
1115         phb->pci_regs[PEC_PCI_STK_PCI_FIR] |= val;
1116         break;
1117     case PEC_PCI_STK_PCI_FIR_MSK:
1118         phb->pci_regs[reg] = val;
1119         break;
1120     case PEC_PCI_STK_PCI_FIR_MSKC:
1121         phb->pci_regs[PEC_PCI_STK_PCI_FIR_MSK] &= val;
1122         break;
1123     case PEC_PCI_STK_PCI_FIR_MSKS:
1124         phb->pci_regs[PEC_PCI_STK_PCI_FIR_MSK] |= val;
1125         break;
1126     case PEC_PCI_STK_PCI_FIR_ACT0:
1127     case PEC_PCI_STK_PCI_FIR_ACT1:
1128         phb->pci_regs[reg] = val;
1129         break;
1130     case PEC_PCI_STK_PCI_FIR_WOF:
1131         phb->pci_regs[reg] = 0;
1132         break;
1133     case PEC_PCI_STK_ETU_RESET:
1134         phb->pci_regs[reg] = val & 0x8000000000000000ull;
1135         /* TODO: Implement reset */
1136         break;
1137     case PEC_PCI_STK_PBAIB_ERR_REPORT:
1138         break;
1139     case PEC_PCI_STK_PBAIB_TX_CMD_CRED:
1140     case PEC_PCI_STK_PBAIB_TX_DAT_CRED:
1141         phb->pci_regs[reg] = val;
1142         break;
1143     default:
1144         qemu_log_mask(LOG_UNIMP, "phb4_pec_stk: pci_xscom_write 0x%"HWADDR_PRIx
1145                       "=%"PRIx64"\n", addr, val);
1146     }
1147 }
1148 
1149 static const MemoryRegionOps pnv_pec_stk_pci_xscom_ops = {
1150     .read = pnv_pec_stk_pci_xscom_read,
1151     .write = pnv_pec_stk_pci_xscom_write,
1152     .valid.min_access_size = 8,
1153     .valid.max_access_size = 8,
1154     .impl.min_access_size = 8,
1155     .impl.max_access_size = 8,
1156     .endianness = DEVICE_BIG_ENDIAN,
1157 };
1158 
1159 static int pnv_phb4_map_irq(PCIDevice *pci_dev, int irq_num)
1160 {
1161     /* Check that out properly ... */
1162     return irq_num & 3;
1163 }
1164 
1165 static void pnv_phb4_set_irq(void *opaque, int irq_num, int level)
1166 {
1167     PnvPHB4 *phb = PNV_PHB4(opaque);
1168     uint32_t lsi_base;
1169 
1170     /* LSI only ... */
1171     if (irq_num > 3) {
1172         phb_error(phb, "IRQ %x is not an LSI", irq_num);
1173     }
1174     lsi_base = GETFIELD(PHB_LSI_SRC_ID, phb->regs[PHB_LSI_SOURCE_ID >> 3]);
1175     lsi_base <<= 3;
1176     qemu_set_irq(phb->qirqs[lsi_base + irq_num], level);
1177 }
1178 
1179 static bool pnv_phb4_resolve_pe(PnvPhb4DMASpace *ds)
1180 {
1181     uint64_t rtt, addr;
1182     uint16_t rte;
1183     int bus_num;
1184     int num_PEs;
1185 
1186     /* Already resolved ? */
1187     if (ds->pe_num != PHB_INVALID_PE) {
1188         return true;
1189     }
1190 
1191     /* We need to lookup the RTT */
1192     rtt = ds->phb->regs[PHB_RTT_BAR >> 3];
1193     if (!(rtt & PHB_RTT_BAR_ENABLE)) {
1194         phb_error(ds->phb, "DMA with RTT BAR disabled !");
1195         /* Set error bits ? fence ? ... */
1196         return false;
1197     }
1198 
1199     /* Read RTE */
1200     bus_num = pci_bus_num(ds->bus);
1201     addr = rtt & PHB_RTT_BASE_ADDRESS_MASK;
1202     addr += 2 * PCI_BUILD_BDF(bus_num, ds->devfn);
1203     if (dma_memory_read(&address_space_memory, addr, &rte,
1204                         sizeof(rte), MEMTXATTRS_UNSPECIFIED)) {
1205         phb_error(ds->phb, "Failed to read RTT entry at 0x%"PRIx64, addr);
1206         /* Set error bits ? fence ? ... */
1207         return false;
1208     }
1209     rte = be16_to_cpu(rte);
1210 
1211     /* Fail upon reading of invalid PE# */
1212     num_PEs = ds->phb->big_phb ? PNV_PHB4_MAX_PEs : (PNV_PHB4_MAX_PEs >> 1);
1213     if (rte >= num_PEs) {
1214         phb_error(ds->phb, "RTE for RID 0x%x invalid (%04x", ds->devfn, rte);
1215         rte &= num_PEs - 1;
1216     }
1217     ds->pe_num = rte;
1218     return true;
1219 }
1220 
1221 static void pnv_phb4_translate_tve(PnvPhb4DMASpace *ds, hwaddr addr,
1222                                    bool is_write, uint64_t tve,
1223                                    IOMMUTLBEntry *tlb)
1224 {
1225     uint64_t tta = GETFIELD(IODA3_TVT_TABLE_ADDR, tve);
1226     int32_t  lev = GETFIELD(IODA3_TVT_NUM_LEVELS, tve);
1227     uint32_t tts = GETFIELD(IODA3_TVT_TCE_TABLE_SIZE, tve);
1228     uint32_t tps = GETFIELD(IODA3_TVT_IO_PSIZE, tve);
1229 
1230     /* Invalid levels */
1231     if (lev > 4) {
1232         phb_error(ds->phb, "Invalid #levels in TVE %d", lev);
1233         return;
1234     }
1235 
1236     /* Invalid entry */
1237     if (tts == 0) {
1238         phb_error(ds->phb, "Access to invalid TVE");
1239         return;
1240     }
1241 
1242     /* IO Page Size of 0 means untranslated, else use TCEs */
1243     if (tps == 0) {
1244         /* TODO: Handle boundaries */
1245 
1246         /* Use 4k pages like q35 ... for now */
1247         tlb->iova = addr & 0xfffffffffffff000ull;
1248         tlb->translated_addr = addr & 0x0003fffffffff000ull;
1249         tlb->addr_mask = 0xfffull;
1250         tlb->perm = IOMMU_RW;
1251     } else {
1252         uint32_t tce_shift, tbl_shift, sh;
1253         uint64_t base, taddr, tce, tce_mask;
1254 
1255         /* Address bits per bottom level TCE entry */
1256         tce_shift = tps + 11;
1257 
1258         /* Address bits per table level */
1259         tbl_shift = tts + 8;
1260 
1261         /* Top level table base address */
1262         base = tta << 12;
1263 
1264         /* Total shift to first level */
1265         sh = tbl_shift * lev + tce_shift;
1266 
1267         /* TODO: Limit to support IO page sizes */
1268 
1269         /* TODO: Multi-level untested */
1270         do {
1271             lev--;
1272 
1273             /* Grab the TCE address */
1274             taddr = base | (((addr >> sh) & ((1ul << tbl_shift) - 1)) << 3);
1275             if (dma_memory_read(&address_space_memory, taddr, &tce,
1276                                 sizeof(tce), MEMTXATTRS_UNSPECIFIED)) {
1277                 phb_error(ds->phb, "Failed to read TCE at 0x%"PRIx64, taddr);
1278                 return;
1279             }
1280             tce = be64_to_cpu(tce);
1281 
1282             /* Check permission for indirect TCE */
1283             if ((lev >= 0) && !(tce & 3)) {
1284                 phb_error(ds->phb, "Invalid indirect TCE at 0x%"PRIx64, taddr);
1285                 phb_error(ds->phb, " xlate %"PRIx64":%c TVE=%"PRIx64, addr,
1286                            is_write ? 'W' : 'R', tve);
1287                 phb_error(ds->phb, " tta=%"PRIx64" lev=%d tts=%d tps=%d",
1288                            tta, lev, tts, tps);
1289                 return;
1290             }
1291             sh -= tbl_shift;
1292             base = tce & ~0xfffull;
1293         } while (lev >= 0);
1294 
1295         /* We exit the loop with TCE being the final TCE */
1296         if ((is_write & !(tce & 2)) || ((!is_write) && !(tce & 1))) {
1297             phb_error(ds->phb, "TCE access fault at 0x%"PRIx64, taddr);
1298             phb_error(ds->phb, " xlate %"PRIx64":%c TVE=%"PRIx64, addr,
1299                        is_write ? 'W' : 'R', tve);
1300             phb_error(ds->phb, " tta=%"PRIx64" lev=%d tts=%d tps=%d",
1301                        tta, lev, tts, tps);
1302             return;
1303         }
1304         tce_mask = ~((1ull << tce_shift) - 1);
1305         tlb->iova = addr & tce_mask;
1306         tlb->translated_addr = tce & tce_mask;
1307         tlb->addr_mask = ~tce_mask;
1308         tlb->perm = tce & 3;
1309     }
1310 }
1311 
1312 static IOMMUTLBEntry pnv_phb4_translate_iommu(IOMMUMemoryRegion *iommu,
1313                                               hwaddr addr,
1314                                               IOMMUAccessFlags flag,
1315                                               int iommu_idx)
1316 {
1317     PnvPhb4DMASpace *ds = container_of(iommu, PnvPhb4DMASpace, dma_mr);
1318     int tve_sel;
1319     uint64_t tve, cfg;
1320     IOMMUTLBEntry ret = {
1321         .target_as = &address_space_memory,
1322         .iova = addr,
1323         .translated_addr = 0,
1324         .addr_mask = ~(hwaddr)0,
1325         .perm = IOMMU_NONE,
1326     };
1327 
1328     /* Resolve PE# */
1329     if (!pnv_phb4_resolve_pe(ds)) {
1330         phb_error(ds->phb, "Failed to resolve PE# for bus @%p (%d) devfn 0x%x",
1331                    ds->bus, pci_bus_num(ds->bus), ds->devfn);
1332         return ret;
1333     }
1334 
1335     /* Check top bits */
1336     switch (addr >> 60) {
1337     case 00:
1338         /* DMA or 32-bit MSI ? */
1339         cfg = ds->phb->regs[PHB_PHB4_CONFIG >> 3];
1340         if ((cfg & PHB_PHB4C_32BIT_MSI_EN) &&
1341             ((addr & 0xffffffffffff0000ull) == 0xffff0000ull)) {
1342             phb_error(ds->phb, "xlate on 32-bit MSI region");
1343             return ret;
1344         }
1345         /* Choose TVE XXX Use PHB4 Control Register */
1346         tve_sel = (addr >> 59) & 1;
1347         tve = ds->phb->ioda_TVT[ds->pe_num * 2 + tve_sel];
1348         pnv_phb4_translate_tve(ds, addr, flag & IOMMU_WO, tve, &ret);
1349         break;
1350     case 01:
1351         phb_error(ds->phb, "xlate on 64-bit MSI region");
1352         break;
1353     default:
1354         phb_error(ds->phb, "xlate on unsupported address 0x%"PRIx64, addr);
1355     }
1356     return ret;
1357 }
1358 
1359 #define TYPE_PNV_PHB4_IOMMU_MEMORY_REGION "pnv-phb4-iommu-memory-region"
1360 DECLARE_INSTANCE_CHECKER(IOMMUMemoryRegion, PNV_PHB4_IOMMU_MEMORY_REGION,
1361                          TYPE_PNV_PHB4_IOMMU_MEMORY_REGION)
1362 
1363 static void pnv_phb4_iommu_memory_region_class_init(ObjectClass *klass,
1364                                                     void *data)
1365 {
1366     IOMMUMemoryRegionClass *imrc = IOMMU_MEMORY_REGION_CLASS(klass);
1367 
1368     imrc->translate = pnv_phb4_translate_iommu;
1369 }
1370 
1371 static const TypeInfo pnv_phb4_iommu_memory_region_info = {
1372     .parent = TYPE_IOMMU_MEMORY_REGION,
1373     .name = TYPE_PNV_PHB4_IOMMU_MEMORY_REGION,
1374     .class_init = pnv_phb4_iommu_memory_region_class_init,
1375 };
1376 
1377 /*
1378  * Return the index/phb-id of a PHB4 that belongs to a
1379  * pec->stacks[stack_index] stack.
1380  */
1381 int pnv_phb4_pec_get_phb_id(PnvPhb4PecState *pec, int stack_index)
1382 {
1383     PnvPhb4PecClass *pecc = PNV_PHB4_PEC_GET_CLASS(pec);
1384     int index = pec->index;
1385     int offset = 0;
1386 
1387     while (index--) {
1388         offset += pecc->num_phbs[index];
1389     }
1390 
1391     return offset + stack_index;
1392 }
1393 
1394 /*
1395  * MSI/MSIX memory region implementation.
1396  * The handler handles both MSI and MSIX.
1397  */
1398 static void pnv_phb4_msi_write(void *opaque, hwaddr addr,
1399                                uint64_t data, unsigned size)
1400 {
1401     PnvPhb4DMASpace *ds = opaque;
1402     PnvPHB4 *phb = ds->phb;
1403 
1404     uint32_t src = ((addr >> 4) & 0xffff) | (data & 0x1f);
1405 
1406     /* Resolve PE# */
1407     if (!pnv_phb4_resolve_pe(ds)) {
1408         phb_error(phb, "Failed to resolve PE# for bus @%p (%d) devfn 0x%x",
1409                    ds->bus, pci_bus_num(ds->bus), ds->devfn);
1410         return;
1411     }
1412 
1413     /* TODO: Check it doesn't collide with LSIs */
1414     if (src >= phb->xsrc.nr_irqs) {
1415         phb_error(phb, "MSI %d out of bounds", src);
1416         return;
1417     }
1418 
1419     /* TODO: check PE/MSI assignement */
1420 
1421     qemu_irq_pulse(phb->qirqs[src]);
1422 }
1423 
1424 /* There is no .read as the read result is undefined by PCI spec */
1425 static uint64_t pnv_phb4_msi_read(void *opaque, hwaddr addr, unsigned size)
1426 {
1427     PnvPhb4DMASpace *ds = opaque;
1428 
1429     phb_error(ds->phb, "Invalid MSI read @ 0x%" HWADDR_PRIx, addr);
1430     return -1;
1431 }
1432 
1433 static const MemoryRegionOps pnv_phb4_msi_ops = {
1434     .read = pnv_phb4_msi_read,
1435     .write = pnv_phb4_msi_write,
1436     .endianness = DEVICE_LITTLE_ENDIAN
1437 };
1438 
1439 static PnvPhb4DMASpace *pnv_phb4_dma_find(PnvPHB4 *phb, PCIBus *bus, int devfn)
1440 {
1441     PnvPhb4DMASpace *ds;
1442 
1443     QLIST_FOREACH(ds, &phb->dma_spaces, list) {
1444         if (ds->bus == bus && ds->devfn == devfn) {
1445             break;
1446         }
1447     }
1448     return ds;
1449 }
1450 
1451 static AddressSpace *pnv_phb4_dma_iommu(PCIBus *bus, void *opaque, int devfn)
1452 {
1453     PnvPHB4 *phb = opaque;
1454     PnvPhb4DMASpace *ds;
1455     char name[32];
1456 
1457     ds = pnv_phb4_dma_find(phb, bus, devfn);
1458 
1459     if (ds == NULL) {
1460         ds = g_malloc0(sizeof(PnvPhb4DMASpace));
1461         ds->bus = bus;
1462         ds->devfn = devfn;
1463         ds->pe_num = PHB_INVALID_PE;
1464         ds->phb = phb;
1465         snprintf(name, sizeof(name), "phb4-%d.%d-iommu", phb->chip_id,
1466                  phb->phb_id);
1467         memory_region_init_iommu(&ds->dma_mr, sizeof(ds->dma_mr),
1468                                  TYPE_PNV_PHB4_IOMMU_MEMORY_REGION,
1469                                  OBJECT(phb), name, UINT64_MAX);
1470         address_space_init(&ds->dma_as, MEMORY_REGION(&ds->dma_mr),
1471                            name);
1472         memory_region_init_io(&ds->msi32_mr, OBJECT(phb), &pnv_phb4_msi_ops,
1473                               ds, "msi32", 0x10000);
1474         memory_region_init_io(&ds->msi64_mr, OBJECT(phb), &pnv_phb4_msi_ops,
1475                               ds, "msi64", 0x100000);
1476         pnv_phb4_update_msi_regions(ds);
1477 
1478         QLIST_INSERT_HEAD(&phb->dma_spaces, ds, list);
1479     }
1480     return &ds->dma_as;
1481 }
1482 
1483 static void pnv_phb4_xscom_realize(PnvPHB4 *phb)
1484 {
1485     PnvPhb4PecState *pec = phb->pec;
1486     PnvPhb4PecClass *pecc = PNV_PHB4_PEC_GET_CLASS(pec);
1487     int stack_no = pnv_phb4_get_phb_stack_no(phb);
1488     uint32_t pec_nest_base;
1489     uint32_t pec_pci_base;
1490     char name[64];
1491 
1492     assert(pec);
1493 
1494     /* Initialize the XSCOM regions for the stack registers */
1495     snprintf(name, sizeof(name), "xscom-pec-%d.%d-nest-phb-%d",
1496              pec->chip_id, pec->index, stack_no);
1497     pnv_xscom_region_init(&phb->nest_regs_mr, OBJECT(phb),
1498                           &pnv_pec_stk_nest_xscom_ops, phb, name,
1499                           PHB4_PEC_NEST_STK_REGS_COUNT);
1500 
1501     snprintf(name, sizeof(name), "xscom-pec-%d.%d-pci-phb-%d",
1502              pec->chip_id, pec->index, stack_no);
1503     pnv_xscom_region_init(&phb->pci_regs_mr, OBJECT(phb),
1504                           &pnv_pec_stk_pci_xscom_ops, phb, name,
1505                           PHB4_PEC_PCI_STK_REGS_COUNT);
1506 
1507     /* PHB pass-through */
1508     snprintf(name, sizeof(name), "xscom-pec-%d.%d-pci-phb-%d",
1509              pec->chip_id, pec->index, stack_no);
1510     pnv_xscom_region_init(&phb->phb_regs_mr, OBJECT(phb),
1511                           &pnv_phb4_xscom_ops, phb, name, 0x40);
1512 
1513     pec_nest_base = pecc->xscom_nest_base(pec);
1514     pec_pci_base = pecc->xscom_pci_base(pec);
1515 
1516     /* Populate the XSCOM address space. */
1517     pnv_xscom_add_subregion(pec->chip,
1518                             pec_nest_base + 0x40 * (stack_no + 1),
1519                             &phb->nest_regs_mr);
1520     pnv_xscom_add_subregion(pec->chip,
1521                             pec_pci_base + 0x40 * (stack_no + 1),
1522                             &phb->pci_regs_mr);
1523     pnv_xscom_add_subregion(pec->chip,
1524                             pec_pci_base + PNV9_XSCOM_PEC_PCI_STK0 +
1525                             0x40 * stack_no,
1526                             &phb->phb_regs_mr);
1527 }
1528 
1529 static void pnv_phb4_instance_init(Object *obj)
1530 {
1531     PnvPHB4 *phb = PNV_PHB4(obj);
1532 
1533     QLIST_INIT(&phb->dma_spaces);
1534 
1535     /* XIVE interrupt source object */
1536     object_initialize_child(obj, "source", &phb->xsrc, TYPE_XIVE_SOURCE);
1537 }
1538 
1539 static PnvPhb4PecState *pnv_phb4_get_pec(PnvChip *chip, PnvPHB4 *phb,
1540                                          Error **errp)
1541 {
1542     Pnv9Chip *chip9 = PNV9_CHIP(chip);
1543     int chip_id = phb->chip_id;
1544     int index = phb->phb_id;
1545     int i, j;
1546 
1547     for (i = 0; i < chip->num_pecs; i++) {
1548         /*
1549          * For each PEC, check the amount of phbs it supports
1550          * and see if the given phb4 index matches an index.
1551          */
1552         PnvPhb4PecState *pec = &chip9->pecs[i];
1553 
1554         for (j = 0; j < pec->num_phbs; j++) {
1555             if (index == pnv_phb4_pec_get_phb_id(pec, j)) {
1556                 return pec;
1557             }
1558         }
1559     }
1560 
1561     error_setg(errp,
1562                "pnv-phb4 chip-id %d index %d didn't match any existing PEC",
1563                chip_id, index);
1564 
1565     return NULL;
1566 }
1567 
1568 static void pnv_phb4_realize(DeviceState *dev, Error **errp)
1569 {
1570     PnvPHB4 *phb = PNV_PHB4(dev);
1571     PCIHostState *pci = PCI_HOST_BRIDGE(dev);
1572     XiveSource *xsrc = &phb->xsrc;
1573     Error *local_err = NULL;
1574     int nr_irqs;
1575     char name[32];
1576 
1577     /* User created PHB */
1578     if (!phb->pec) {
1579         PnvMachineState *pnv = PNV_MACHINE(qdev_get_machine());
1580         PnvChip *chip = pnv_get_chip(pnv, phb->chip_id);
1581         BusState *s;
1582 
1583         if (!chip) {
1584             error_setg(errp, "invalid chip id: %d", phb->chip_id);
1585             return;
1586         }
1587 
1588         phb->pec = pnv_phb4_get_pec(chip, phb, &local_err);
1589         if (local_err) {
1590             error_propagate(errp, local_err);
1591             return;
1592         }
1593 
1594         /*
1595          * Reparent user created devices to the chip to build
1596          * correctly the device tree.
1597          */
1598         pnv_chip_parent_fixup(chip, OBJECT(phb), phb->phb_id);
1599 
1600         s = qdev_get_parent_bus(DEVICE(chip));
1601         if (!qdev_set_parent_bus(DEVICE(phb), s, &local_err)) {
1602             error_propagate(errp, local_err);
1603             return;
1604         }
1605     }
1606 
1607     /* Set the "big_phb" flag */
1608     phb->big_phb = phb->phb_id == 0 || phb->phb_id == 3;
1609 
1610     /* Controller Registers */
1611     snprintf(name, sizeof(name), "phb4-%d.%d-regs", phb->chip_id,
1612              phb->phb_id);
1613     memory_region_init_io(&phb->mr_regs, OBJECT(phb), &pnv_phb4_reg_ops, phb,
1614                           name, 0x2000);
1615 
1616     /*
1617      * PHB4 doesn't support IO space. However, qemu gets very upset if
1618      * we don't have an IO region to anchor IO BARs onto so we just
1619      * initialize one which we never hook up to anything
1620      */
1621 
1622     snprintf(name, sizeof(name), "phb4-%d.%d-pci-io", phb->chip_id,
1623              phb->phb_id);
1624     memory_region_init(&phb->pci_io, OBJECT(phb), name, 0x10000);
1625 
1626     snprintf(name, sizeof(name), "phb4-%d.%d-pci-mmio", phb->chip_id,
1627              phb->phb_id);
1628     memory_region_init(&phb->pci_mmio, OBJECT(phb), name,
1629                        PCI_MMIO_TOTAL_SIZE);
1630 
1631     pci->bus = pci_register_root_bus(dev, dev->id,
1632                                      pnv_phb4_set_irq, pnv_phb4_map_irq, phb,
1633                                      &phb->pci_mmio, &phb->pci_io,
1634                                      0, 4, TYPE_PNV_PHB4_ROOT_BUS);
1635     pci_setup_iommu(pci->bus, pnv_phb4_dma_iommu, phb);
1636     pci->bus->flags |= PCI_BUS_EXTENDED_CONFIG_SPACE;
1637 
1638     /* Setup XIVE Source */
1639     if (phb->big_phb) {
1640         nr_irqs = PNV_PHB4_MAX_INTs;
1641     } else {
1642         nr_irqs = PNV_PHB4_MAX_INTs >> 1;
1643     }
1644     object_property_set_int(OBJECT(xsrc), "nr-irqs", nr_irqs, &error_fatal);
1645     object_property_set_link(OBJECT(xsrc), "xive", OBJECT(phb), &error_fatal);
1646     if (!qdev_realize(DEVICE(xsrc), NULL, errp)) {
1647         return;
1648     }
1649 
1650     pnv_phb4_update_xsrc(phb);
1651 
1652     phb->qirqs = qemu_allocate_irqs(xive_source_set_irq, xsrc, xsrc->nr_irqs);
1653 
1654     pnv_phb4_xscom_realize(phb);
1655 }
1656 
1657 static const char *pnv_phb4_root_bus_path(PCIHostState *host_bridge,
1658                                           PCIBus *rootbus)
1659 {
1660     PnvPHB4 *phb = PNV_PHB4(host_bridge);
1661 
1662     snprintf(phb->bus_path, sizeof(phb->bus_path), "00%02x:%02x",
1663              phb->chip_id, phb->phb_id);
1664     return phb->bus_path;
1665 }
1666 
1667 static void pnv_phb4_xive_notify(XiveNotifier *xf, uint32_t srcno)
1668 {
1669     PnvPHB4 *phb = PNV_PHB4(xf);
1670     uint64_t notif_port = phb->regs[PHB_INT_NOTIFY_ADDR >> 3];
1671     uint32_t offset = phb->regs[PHB_INT_NOTIFY_INDEX >> 3];
1672     uint64_t data = XIVE_TRIGGER_PQ | offset | srcno;
1673     MemTxResult result;
1674 
1675     trace_pnv_phb4_xive_notify(notif_port, data);
1676 
1677     address_space_stq_be(&address_space_memory, notif_port, data,
1678                          MEMTXATTRS_UNSPECIFIED, &result);
1679     if (result != MEMTX_OK) {
1680         phb_error(phb, "trigger failed @%"HWADDR_PRIx "\n", notif_port);
1681         return;
1682     }
1683 }
1684 
1685 static Property pnv_phb4_properties[] = {
1686         DEFINE_PROP_UINT32("index", PnvPHB4, phb_id, 0),
1687         DEFINE_PROP_UINT32("chip-id", PnvPHB4, chip_id, 0),
1688         DEFINE_PROP_LINK("pec", PnvPHB4, pec, TYPE_PNV_PHB4_PEC,
1689                          PnvPhb4PecState *),
1690         DEFINE_PROP_END_OF_LIST(),
1691 };
1692 
1693 static void pnv_phb4_class_init(ObjectClass *klass, void *data)
1694 {
1695     PCIHostBridgeClass *hc = PCI_HOST_BRIDGE_CLASS(klass);
1696     DeviceClass *dc = DEVICE_CLASS(klass);
1697     XiveNotifierClass *xfc = XIVE_NOTIFIER_CLASS(klass);
1698 
1699     hc->root_bus_path   = pnv_phb4_root_bus_path;
1700     dc->realize         = pnv_phb4_realize;
1701     device_class_set_props(dc, pnv_phb4_properties);
1702     set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
1703     dc->user_creatable  = true;
1704 
1705     xfc->notify         = pnv_phb4_xive_notify;
1706 }
1707 
1708 static const TypeInfo pnv_phb4_type_info = {
1709     .name          = TYPE_PNV_PHB4,
1710     .parent        = TYPE_PCIE_HOST_BRIDGE,
1711     .instance_init = pnv_phb4_instance_init,
1712     .instance_size = sizeof(PnvPHB4),
1713     .class_init    = pnv_phb4_class_init,
1714     .interfaces = (InterfaceInfo[]) {
1715             { TYPE_XIVE_NOTIFIER },
1716             { },
1717     }
1718 };
1719 
1720 static void pnv_phb4_root_bus_class_init(ObjectClass *klass, void *data)
1721 {
1722     BusClass *k = BUS_CLASS(klass);
1723 
1724     /*
1725      * PHB4 has only a single root complex. Enforce the limit on the
1726      * parent bus
1727      */
1728     k->max_dev = 1;
1729 }
1730 
1731 static const TypeInfo pnv_phb4_root_bus_info = {
1732     .name = TYPE_PNV_PHB4_ROOT_BUS,
1733     .parent = TYPE_PCIE_BUS,
1734     .class_init = pnv_phb4_root_bus_class_init,
1735     .interfaces = (InterfaceInfo[]) {
1736         { INTERFACE_PCIE_DEVICE },
1737         { }
1738     },
1739 };
1740 
1741 static void pnv_phb4_root_port_reset(DeviceState *dev)
1742 {
1743     PCIERootPortClass *rpc = PCIE_ROOT_PORT_GET_CLASS(dev);
1744     PCIDevice *d = PCI_DEVICE(dev);
1745     uint8_t *conf = d->config;
1746 
1747     rpc->parent_reset(dev);
1748 
1749     pci_byte_test_and_set_mask(conf + PCI_IO_BASE,
1750                                PCI_IO_RANGE_MASK & 0xff);
1751     pci_byte_test_and_clear_mask(conf + PCI_IO_LIMIT,
1752                                  PCI_IO_RANGE_MASK & 0xff);
1753     pci_set_word(conf + PCI_MEMORY_BASE, 0);
1754     pci_set_word(conf + PCI_MEMORY_LIMIT, 0xfff0);
1755     pci_set_word(conf + PCI_PREF_MEMORY_BASE, 0x1);
1756     pci_set_word(conf + PCI_PREF_MEMORY_LIMIT, 0xfff1);
1757     pci_set_long(conf + PCI_PREF_BASE_UPPER32, 0x1); /* Hack */
1758     pci_set_long(conf + PCI_PREF_LIMIT_UPPER32, 0xffffffff);
1759 }
1760 
1761 static void pnv_phb4_root_port_realize(DeviceState *dev, Error **errp)
1762 {
1763     PCIERootPortClass *rpc = PCIE_ROOT_PORT_GET_CLASS(dev);
1764     PCIDevice *pci = PCI_DEVICE(dev);
1765     PCIBus *bus = pci_get_bus(pci);
1766     PnvPHB4 *phb = NULL;
1767     Error *local_err = NULL;
1768 
1769     phb = (PnvPHB4 *) object_dynamic_cast(OBJECT(bus->qbus.parent),
1770                                           TYPE_PNV_PHB4);
1771 
1772     if (!phb) {
1773         error_setg(errp, "%s must be connected to pnv-phb4 buses", dev->id);
1774         return;
1775     }
1776 
1777     /* Set unique chassis/slot values for the root port */
1778     qdev_prop_set_uint8(&pci->qdev, "chassis", phb->chip_id);
1779     qdev_prop_set_uint16(&pci->qdev, "slot", phb->phb_id);
1780 
1781     rpc->parent_realize(dev, &local_err);
1782     if (local_err) {
1783         error_propagate(errp, local_err);
1784         return;
1785     }
1786 }
1787 
1788 static void pnv_phb4_root_port_class_init(ObjectClass *klass, void *data)
1789 {
1790     DeviceClass *dc = DEVICE_CLASS(klass);
1791     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
1792     PCIERootPortClass *rpc = PCIE_ROOT_PORT_CLASS(klass);
1793 
1794     dc->desc     = "IBM PHB4 PCIE Root Port";
1795     dc->user_creatable = true;
1796 
1797     device_class_set_parent_realize(dc, pnv_phb4_root_port_realize,
1798                                     &rpc->parent_realize);
1799     device_class_set_parent_reset(dc, pnv_phb4_root_port_reset,
1800                                   &rpc->parent_reset);
1801 
1802     k->vendor_id = PCI_VENDOR_ID_IBM;
1803     k->device_id = PNV_PHB4_DEVICE_ID;
1804     k->revision  = 0;
1805 
1806     rpc->exp_offset = 0x48;
1807     rpc->aer_offset = 0x100;
1808 
1809     dc->reset = &pnv_phb4_root_port_reset;
1810 }
1811 
1812 static const TypeInfo pnv_phb4_root_port_info = {
1813     .name          = TYPE_PNV_PHB4_ROOT_PORT,
1814     .parent        = TYPE_PCIE_ROOT_PORT,
1815     .instance_size = sizeof(PnvPHB4RootPort),
1816     .class_init    = pnv_phb4_root_port_class_init,
1817 };
1818 
1819 static void pnv_phb4_register_types(void)
1820 {
1821     type_register_static(&pnv_phb4_root_bus_info);
1822     type_register_static(&pnv_phb4_root_port_info);
1823     type_register_static(&pnv_phb4_type_info);
1824     type_register_static(&pnv_phb4_iommu_memory_region_info);
1825 }
1826 
1827 type_init(pnv_phb4_register_types);
1828 
1829 void pnv_phb4_pic_print_info(PnvPHB4 *phb, Monitor *mon)
1830 {
1831     uint32_t offset = phb->regs[PHB_INT_NOTIFY_INDEX >> 3];
1832 
1833     monitor_printf(mon, "PHB4[%x:%x] Source %08x .. %08x\n",
1834                    phb->chip_id, phb->phb_id,
1835                    offset, offset + phb->xsrc.nr_irqs - 1);
1836     xive_source_pic_print_info(&phb->xsrc, 0, mon);
1837 }
1838