All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH 0/9] ppc/pnv: Introduce the XIVE2 and PHB5 controllers for the POWER10 chip
@ 2020-05-13 15:11 Cédric Le Goater
  2020-05-13 15:11 ` [PATCH 1/9] ppc/xive: Export PQ get/set routines Cédric Le Goater
                   ` (9 more replies)
  0 siblings, 10 replies; 25+ messages in thread
From: Cédric Le Goater @ 2020-05-13 15:11 UTC (permalink / raw)
  To: David Gibson; +Cc: Cédric Le Goater, qemu-ppc, Greg Kurz, qemu-devel

Hello,

This series completes the PowerNV POWER10 machine with the XIVE2
interrupt controller and the PHB5 PCI host bridge controller.

The XIVE2 interrupt controller of the POWER10 processor follows the
same logic than on POWER9 but the HW interface has been largely
reviewed. To avoid adding too much complexity in the P9 XIVE models,
a new XIVE2 core framework is introduced.

The PHB5 and PHB4 controllers are very similar. Not much changes there
apart from the mapping addresses and ids. There is more to come on
PHB5 regarding interrupt offload on the interrupt controller, but this
is for another round.

This series also adds basic OCC and CPU Quad models which are not very
much exercised by the firmware.

Thanks,

C.

Cédric Le Goater (9):
  ppc/xive: Export PQ get/set routines
  ppc/xive: Export xive_presenter_notify()
  ppc/xive2: Introduce a XIVE2 core framework
  ppc/xive2: Introduce a presenter matching routine
  ppc/pnv: Add a XIVE2 controller to the POWER10 chip.
  ppc/pnv: Add a OCC model for POWER10
  ppc/pnv: Add POWER10 quads
  ppc/pnv: Add model for POWER9 PHB5 PCIe Host bridge
  ppc/psi: Add support for StoreEOI and 64k ESB pages (POWER10)

 hw/intc/pnv_xive2_regs.h       |  428 +++++++
 include/hw/pci-host/pnv_phb4.h |   11 +
 include/hw/ppc/pnv.h           |   30 +
 include/hw/ppc/pnv_occ.h       |    2 +
 include/hw/ppc/pnv_xive.h      |   71 ++
 include/hw/ppc/pnv_xscom.h     |   12 +
 include/hw/ppc/xive.h          |    8 +
 include/hw/ppc/xive2.h         |   93 ++
 include/hw/ppc/xive2_regs.h    |  198 ++++
 hw/intc/pnv_xive2.c            | 2026 ++++++++++++++++++++++++++++++++
 hw/intc/spapr_xive_kvm.c       |    8 +-
 hw/intc/xive.c                 |   14 +-
 hw/intc/xive2.c                |  756 ++++++++++++
 hw/pci-host/pnv_phb4_pec.c     |   44 +
 hw/ppc/pnv.c                   |  243 +++-
 hw/ppc/pnv_occ.c               |   17 +
 hw/ppc/pnv_psi.c               |   32 +-
 hw/intc/Makefile.objs          |    4 +-
 18 files changed, 3974 insertions(+), 23 deletions(-)
 create mode 100644 hw/intc/pnv_xive2_regs.h
 create mode 100644 include/hw/ppc/xive2.h
 create mode 100644 include/hw/ppc/xive2_regs.h
 create mode 100644 hw/intc/pnv_xive2.c
 create mode 100644 hw/intc/xive2.c

-- 
2.25.4



^ permalink raw reply	[flat|nested] 25+ messages in thread

* [PATCH 1/9] ppc/xive: Export PQ get/set routines
  2020-05-13 15:11 [PATCH 0/9] ppc/pnv: Introduce the XIVE2 and PHB5 controllers for the POWER10 chip Cédric Le Goater
@ 2020-05-13 15:11 ` Cédric Le Goater
  2020-05-13 15:11 ` [PATCH 2/9] ppc/xive: Export xive_presenter_notify() Cédric Le Goater
                   ` (8 subsequent siblings)
  9 siblings, 0 replies; 25+ messages in thread
From: Cédric Le Goater @ 2020-05-13 15:11 UTC (permalink / raw)
  To: David Gibson; +Cc: Cédric Le Goater, qemu-ppc, Greg Kurz, qemu-devel

These will be shared with the XIVE2 router.

Reviewed-by: Greg Kurz <groug@kaod.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 include/hw/ppc/xive.h    | 4 ++++
 hw/intc/spapr_xive_kvm.c | 8 ++++----
 hw/intc/xive.c           | 6 +++---
 3 files changed, 11 insertions(+), 7 deletions(-)

diff --git a/include/hw/ppc/xive.h b/include/hw/ppc/xive.h
index 705cf48176fc..112fb6fb6dbe 100644
--- a/include/hw/ppc/xive.h
+++ b/include/hw/ppc/xive.h
@@ -255,6 +255,10 @@ static inline hwaddr xive_source_esb_mgmt(XiveSource *xsrc, int srcno)
 #define XIVE_ESB_QUEUED       (XIVE_ESB_VAL_P | XIVE_ESB_VAL_Q)
 #define XIVE_ESB_OFF          XIVE_ESB_VAL_Q
 
+bool xive_esb_trigger(uint8_t *pq);
+bool xive_esb_eoi(uint8_t *pq);
+uint8_t xive_esb_set(uint8_t *pq, uint8_t value);
+
 /*
  * "magic" Event State Buffer (ESB) MMIO offsets.
  *
diff --git a/hw/intc/spapr_xive_kvm.c b/hw/intc/spapr_xive_kvm.c
index edb7ee0e74f1..43f4d56b958c 100644
--- a/hw/intc/spapr_xive_kvm.c
+++ b/hw/intc/spapr_xive_kvm.c
@@ -308,7 +308,7 @@ static uint8_t xive_esb_read(XiveSource *xsrc, int srcno, uint32_t offset)
     return xive_esb_rw(xsrc, srcno, offset, 0, 0) & 0x3;
 }
 
-static void xive_esb_trigger(XiveSource *xsrc, int srcno)
+static void kvmppc_xive_esb_trigger(XiveSource *xsrc, int srcno)
 {
     uint64_t *addr = xsrc->esb_mmap + xive_source_esb_page(xsrc, srcno);
 
@@ -331,7 +331,7 @@ uint64_t kvmppc_xive_esb_rw(XiveSource *xsrc, int srcno, uint32_t offset,
         offset == XIVE_ESB_LOAD_EOI) {
         xive_esb_read(xsrc, srcno, XIVE_ESB_SET_PQ_00);
         if (xsrc->status[srcno] & XIVE_STATUS_ASSERTED) {
-            xive_esb_trigger(xsrc, srcno);
+            kvmppc_xive_esb_trigger(xsrc, srcno);
         }
         return 0;
     } else {
@@ -375,7 +375,7 @@ void kvmppc_xive_source_set_irq(void *opaque, int srcno, int val)
         }
     }
 
-    xive_esb_trigger(xsrc, srcno);
+    kvmppc_xive_esb_trigger(xsrc, srcno);
 }
 
 /*
@@ -544,7 +544,7 @@ static void kvmppc_xive_change_state_handler(void *opaque, int running,
              * generate a trigger.
              */
             if (pq == XIVE_ESB_RESET && old_pq == XIVE_ESB_QUEUED) {
-                xive_esb_trigger(xsrc, i);
+                kvmppc_xive_esb_trigger(xsrc, i);
             }
         }
 
diff --git a/hw/intc/xive.c b/hw/intc/xive.c
index d6183f8ae40a..b8825577f719 100644
--- a/hw/intc/xive.c
+++ b/hw/intc/xive.c
@@ -789,7 +789,7 @@ void xive_tctx_destroy(XiveTCTX *tctx)
  * XIVE ESB helpers
  */
 
-static uint8_t xive_esb_set(uint8_t *pq, uint8_t value)
+uint8_t xive_esb_set(uint8_t *pq, uint8_t value)
 {
     uint8_t old_pq = *pq & 0x3;
 
@@ -799,7 +799,7 @@ static uint8_t xive_esb_set(uint8_t *pq, uint8_t value)
     return old_pq;
 }
 
-static bool xive_esb_trigger(uint8_t *pq)
+bool xive_esb_trigger(uint8_t *pq)
 {
     uint8_t old_pq = *pq & 0x3;
 
@@ -819,7 +819,7 @@ static bool xive_esb_trigger(uint8_t *pq)
     }
 }
 
-static bool xive_esb_eoi(uint8_t *pq)
+bool xive_esb_eoi(uint8_t *pq)
 {
     uint8_t old_pq = *pq & 0x3;
 
-- 
2.25.4



^ permalink raw reply related	[flat|nested] 25+ messages in thread

* [PATCH 2/9] ppc/xive: Export xive_presenter_notify()
  2020-05-13 15:11 [PATCH 0/9] ppc/pnv: Introduce the XIVE2 and PHB5 controllers for the POWER10 chip Cédric Le Goater
  2020-05-13 15:11 ` [PATCH 1/9] ppc/xive: Export PQ get/set routines Cédric Le Goater
@ 2020-05-13 15:11 ` Cédric Le Goater
  2020-05-19  9:18   ` Greg Kurz
  2020-05-13 15:11 ` [PATCH 3/9] ppc/xive2: Introduce a XIVE2 core framework Cédric Le Goater
                   ` (7 subsequent siblings)
  9 siblings, 1 reply; 25+ messages in thread
From: Cédric Le Goater @ 2020-05-13 15:11 UTC (permalink / raw)
  To: David Gibson; +Cc: Cédric Le Goater, qemu-ppc, Greg Kurz, qemu-devel

It's generic enough to be used from the XIVE2 router and avoid more
duplication.

Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 include/hw/ppc/xive.h | 4 ++++
 hw/intc/xive.c        | 8 ++++----
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/include/hw/ppc/xive.h b/include/hw/ppc/xive.h
index 112fb6fb6dbe..88b0a2a3811f 100644
--- a/include/hw/ppc/xive.h
+++ b/include/hw/ppc/xive.h
@@ -406,6 +406,10 @@ int xive_presenter_tctx_match(XivePresenter *xptr, XiveTCTX *tctx,
                               uint8_t format,
                               uint8_t nvt_blk, uint32_t nvt_idx,
                               bool cam_ignore, uint32_t logic_serv);
+bool xive_presenter_notify(XiveFabric *xfb, uint8_t format,
+                           uint8_t nvt_blk, uint32_t nvt_idx,
+                           bool cam_ignore, uint8_t priority,
+                           uint32_t logic_serv);
 
 /*
  * XIVE Fabric (Interface between Interrupt Controller and Machine)
diff --git a/hw/intc/xive.c b/hw/intc/xive.c
index b8825577f719..f08fcec1c039 100644
--- a/hw/intc/xive.c
+++ b/hw/intc/xive.c
@@ -1481,10 +1481,10 @@ int xive_presenter_tctx_match(XivePresenter *xptr, XiveTCTX *tctx,
  *
  * The parameters represent what is sent on the PowerBus
  */
-static bool xive_presenter_notify(XiveFabric *xfb, uint8_t format,
-                                  uint8_t nvt_blk, uint32_t nvt_idx,
-                                  bool cam_ignore, uint8_t priority,
-                                  uint32_t logic_serv)
+bool xive_presenter_notify(XiveFabric *xfb, uint8_t format,
+                           uint8_t nvt_blk, uint32_t nvt_idx,
+                           bool cam_ignore, uint8_t priority,
+                           uint32_t logic_serv)
 {
     XiveFabricClass *xfc = XIVE_FABRIC_GET_CLASS(xfb);
     XiveTCTXMatch match = { .tctx = NULL, .ring = 0 };
-- 
2.25.4



^ permalink raw reply related	[flat|nested] 25+ messages in thread

* [PATCH 3/9] ppc/xive2: Introduce a XIVE2 core framework
  2020-05-13 15:11 [PATCH 0/9] ppc/pnv: Introduce the XIVE2 and PHB5 controllers for the POWER10 chip Cédric Le Goater
  2020-05-13 15:11 ` [PATCH 1/9] ppc/xive: Export PQ get/set routines Cédric Le Goater
  2020-05-13 15:11 ` [PATCH 2/9] ppc/xive: Export xive_presenter_notify() Cédric Le Goater
@ 2020-05-13 15:11 ` Cédric Le Goater
  2020-05-20 16:40   ` Greg Kurz
  2020-05-13 15:11 ` [PATCH 4/9] ppc/xive2: Introduce a presenter matching routine Cédric Le Goater
                   ` (6 subsequent siblings)
  9 siblings, 1 reply; 25+ messages in thread
From: Cédric Le Goater @ 2020-05-13 15:11 UTC (permalink / raw)
  To: David Gibson; +Cc: Cédric Le Goater, qemu-ppc, Greg Kurz, qemu-devel

The XIVE2 interrupt controller of the POWER10 processor follows the
same logic than on POWER9 but the HW interface has been largely
reviewed. The interrupt controller has a new register interface,
different BARs, extra VSDs, these will be described when we add the
device model for the baremetal machine.

The XIVE internal structures for the EAS, END, NVT have a different
layout which is a problem for the current core XIVE framework. To
avoid adding too much complexity in the XIVE models, a new XIVE2 core
framework is introduced. It duplicates the models which are closely
linked to the XIVE internal structures : Xive2Router and Xive2ENDSource
and reuses the XiveSource, XivePresenter, XiveTCTX models, as they are
more generic.

Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 include/hw/ppc/xive2.h      |  84 +++++
 include/hw/ppc/xive2_regs.h | 198 +++++++++++
 hw/intc/xive2.c             | 669 ++++++++++++++++++++++++++++++++++++
 hw/intc/Makefile.objs       |   2 +-
 4 files changed, 952 insertions(+), 1 deletion(-)
 create mode 100644 include/hw/ppc/xive2.h
 create mode 100644 include/hw/ppc/xive2_regs.h
 create mode 100644 hw/intc/xive2.c

diff --git a/include/hw/ppc/xive2.h b/include/hw/ppc/xive2.h
new file mode 100644
index 000000000000..cb15487efdb6
--- /dev/null
+++ b/include/hw/ppc/xive2.h
@@ -0,0 +1,84 @@
+/*
+ * QEMU PowerPC XIVE2 interrupt controller model  (POWER10)
+ *
+ * Copyright (c) 2019-2020, IBM Corporation.
+ *
+ * This code is licensed under the GPL version 2 or later. See the
+ * COPYING file in the top-level directory.
+ *
+ */
+
+#ifndef PPC_XIVE2_H
+#define PPC_XIVE2_H
+
+#include "hw/ppc/xive2_regs.h"
+
+/*
+ * XIVE2 Router (POWER10)
+ */
+typedef struct Xive2Router {
+    SysBusDevice    parent;
+
+    XiveFabric *xfb;
+} Xive2Router;
+
+#define TYPE_XIVE2_ROUTER TYPE_XIVE_ROUTER "2"
+#define XIVE2_ROUTER(obj)                                \
+    OBJECT_CHECK(Xive2Router, (obj), TYPE_XIVE2_ROUTER)
+#define XIVE2_ROUTER_CLASS(klass)                                        \
+    OBJECT_CLASS_CHECK(Xive2RouterClass, (klass), TYPE_XIVE2_ROUTER)
+#define XIVE2_ROUTER_GET_CLASS(obj)                              \
+    OBJECT_GET_CLASS(Xive2RouterClass, (obj), TYPE_XIVE2_ROUTER)
+
+typedef struct Xive2RouterClass {
+    SysBusDeviceClass parent;
+
+    /* XIVE table accessors */
+    int (*get_eas)(Xive2Router *xrtr, uint8_t eas_blk, uint32_t eas_idx,
+                   Xive2Eas *eas);
+    int (*get_end)(Xive2Router *xrtr, uint8_t end_blk, uint32_t end_idx,
+                   Xive2End *end);
+    int (*write_end)(Xive2Router *xrtr, uint8_t end_blk, uint32_t end_idx,
+                     Xive2End *end, uint8_t word_number);
+    int (*get_nvp)(Xive2Router *xrtr, uint8_t nvt_blk, uint32_t nvt_idx,
+                   Xive2Nvp *nvt);
+    int (*write_nvp)(Xive2Router *xrtr, uint8_t nvt_blk, uint32_t nvt_idx,
+                     Xive2Nvp *nvt, uint8_t word_number);
+    uint8_t (*get_block_id)(Xive2Router *xrtr);
+} Xive2RouterClass;
+
+int xive2_router_get_eas(Xive2Router *xrtr, uint8_t eas_blk, uint32_t eas_idx,
+                        Xive2Eas *eas);
+int xive2_router_get_end(Xive2Router *xrtr, uint8_t end_blk, uint32_t end_idx,
+                        Xive2End *end);
+int xive2_router_write_end(Xive2Router *xrtr, uint8_t end_blk, uint32_t end_idx,
+                          Xive2End *end, uint8_t word_number);
+int xive2_router_get_nvp(Xive2Router *xrtr, uint8_t nvt_blk, uint32_t nvt_idx,
+                        Xive2Nvp *nvt);
+int xive2_router_write_nvp(Xive2Router *xrtr, uint8_t nvt_blk, uint32_t nvt_idx,
+                          Xive2Nvp *nvt, uint8_t word_number);
+
+void xive2_router_notify(XiveNotifier *xn, uint32_t lisn);
+
+/*
+ * XIVE2 END ESBs  (POWER10)
+ */
+
+#define TYPE_XIVE2_END_SOURCE TYPE_XIVE_END_SOURCE "2"
+#define XIVE2_END_SOURCE(obj) \
+    OBJECT_CHECK(Xive2EndSource, (obj), TYPE_XIVE2_END_SOURCE)
+
+typedef struct Xive2EndSource {
+    DeviceState parent;
+
+    uint32_t        nr_ends;
+
+    /* ESB memory region */
+    uint32_t        esb_shift;
+    MemoryRegion    esb_mmio;
+
+    Xive2Router     *xrtr;
+} Xive2EndSource;
+
+
+#endif /* PPC_XIVE2_H */
diff --git a/include/hw/ppc/xive2_regs.h b/include/hw/ppc/xive2_regs.h
new file mode 100644
index 000000000000..7440c44d4a3e
--- /dev/null
+++ b/include/hw/ppc/xive2_regs.h
@@ -0,0 +1,198 @@
+/*
+ * QEMU PowerPC XIVE2 internal structure definitions (POWER10)
+ *
+ * Copyright (c) 2019-2020, IBM Corporation.
+ *
+ * This code is licensed under the GPL version 2 or later. See the
+ * COPYING file in the top-level directory.
+ */
+
+#ifndef PPC_XIVE2_REGS_H
+#define PPC_XIVE2_REGS_H
+
+/*
+ * Thread Interrupt Management Area
+ *
+ * In Gen1 mode (P9 compat mode) word 2 is the same. However in Gen2
+ * mode (P10), the CAM line is slightly different as the VP space was
+ * increased.
+ */
+#define   TM2_QW0W2_VU           PPC_BIT32(0)
+#define   TM2_QW0W2_LOGIC_SERV   PPC_BITMASK32(4, 31)
+#define   TM2_QW1W2_VO           PPC_BIT32(0)
+#define   TM2_QW1W2_OS_CAM       PPC_BITMASK32(4, 31)
+#define   TM2_QW2W2_VP           PPC_BIT32(0)
+#define   TM2_QW2W2_POOL_CAM     PPC_BITMASK32(4, 31)
+#define   TM2_QW3W2_VT           PPC_BIT32(0)
+#define   TM2_QW3W2_LP           PPC_BIT32(6)
+#define   TM2_QW3W2_LE           PPC_BIT32(7)
+
+/*
+ * Event Assignment Structure (EAS)
+ */
+
+typedef struct Xive2Eas {
+        uint64_t       w;
+#define EAS2_VALID                 PPC_BIT(0)
+#define EAS2_END_BLOCK             PPC_BITMASK(4, 7) /* Destination EQ block# */
+#define EAS2_END_INDEX             PPC_BITMASK(8, 31) /* Destination EQ index */
+#define EAS2_MASKED                PPC_BIT(32) /* Masked                 */
+#define EAS2_END_DATA              PPC_BITMASK(33, 63) /* written to the EQ */
+} Xive2Eas;
+
+#define xive2_eas_is_valid(eas)   (be64_to_cpu((eas)->w) & EAS2_VALID)
+#define xive2_eas_is_masked(eas)  (be64_to_cpu((eas)->w) & EAS2_MASKED)
+
+void xive2_eas_pic_print_info(Xive2Eas *eas, uint32_t lisn, Monitor *mon);
+
+/*
+ * Event Notifification Descriptor (END)
+ */
+
+typedef struct Xive2End {
+        uint32_t       w0;
+#define END2_W0_VALID              PPC_BIT32(0) /* "v" bit */
+#define END2_W0_ENQUEUE            PPC_BIT32(5) /* "q" bit */
+#define END2_W0_UCOND_NOTIFY       PPC_BIT32(6) /* "n" bit */
+#define END2_W0_SILENT_ESCALATE    PPC_BIT32(7) /* "s" bit */
+#define END2_W0_BACKLOG            PPC_BIT32(8) /* "b" bit */
+#define END2_W0_PRECL_ESC_CTL      PPC_BIT32(9) /* "p" bit */
+#define END2_W0_UNCOND_ESCALATE    PPC_BIT32(10) /* "u" bit */
+#define END2_W0_ESCALATE_CTL       PPC_BIT32(11) /* "e" bit */
+#define END2_W0_ADAPTIVE_ESC       PPC_BIT32(12) /* "a" bit */
+#define END2_W0_ESCALATE_END       PPC_BIT32(13) /* "N" bit */
+#define END2_W0_FIRMARE1           PPC_BIT32(16) /* Owned by FW */
+#define END2_W0_FIRMARE2           PPC_BIT32(17) /* Owned by FW */
+#define END2_W0_AEC_SIZE           PPC_BITMASK32(18, 19)
+#define END2_W0_AEG_SIZE           PPC_BITMASK32(20, 23)
+#define END2_W0_EQ_VG_PREDICT      PPC_BITMASK32(24, 31) /* Owned by HW */
+        uint32_t       w1;
+#define END2_W1_ESn                PPC_BITMASK32(0, 1)
+#define END2_W1_ESn_P              PPC_BIT32(0)
+#define END2_W1_ESn_Q              PPC_BIT32(1)
+#define END2_W1_ESe                PPC_BITMASK32(2, 3)
+#define END2_W1_ESe_P              PPC_BIT32(2)
+#define END2_W1_ESe_Q              PPC_BIT32(3)
+#define END2_W1_GEN_FLIPPED        PPC_BIT32(8)
+#define END2_W1_GENERATION         PPC_BIT32(9)
+#define END2_W1_PAGE_OFF           PPC_BITMASK32(10, 31)
+        uint32_t       w2;
+#define END2_W2_RESERVED           PPC_BITMASK32(4, 7)
+#define END2_W2_EQ_ADDR_HI         PPC_BITMASK32(8, 31)
+        uint32_t       w3;
+#define END2_W3_EQ_ADDR_LO         PPC_BITMASK32(0, 24)
+#define END2_W3_QSIZE              PPC_BITMASK32(28, 31)
+        uint32_t       w4;
+#define END2_W4_END_BLOCK          PPC_BITMASK32(4, 7)
+#define END2_W4_ESC_END_INDEX      PPC_BITMASK32(8, 31)
+#define END2_W4_ESB_BLOCK          PPC_BITMASK32(0, 3)
+#define END2_W4_ESC_ESB_INDEX      PPC_BITMASK32(4, 31)
+        uint32_t       w5;
+#define END2_W5_ESC_END_DATA       PPC_BITMASK32(1, 31)
+        uint32_t       w6;
+#define END2_W6_FORMAT_BIT         PPC_BIT32(0)
+#define END2_W6_IGNORE             PPC_BIT32(1)
+#define END2_W6_VP_BLOCK           PPC_BITMASK32(4, 7)
+#define END2_W6_VP_OFFSET          PPC_BITMASK32(8, 31)
+#define END2_W6_VP_OFFSET_GEN1     PPC_BITMASK32(13, 31)
+        uint32_t       w7;
+#define END2_W7_TOPO               PPC_BITMASK32(0, 3) /* Owned by HW */
+#define END2_W7_F0_PRIORITY        PPC_BITMASK32(8, 15)
+#define END2_W7_F1_LOG_SERVER_ID   PPC_BITMASK32(4, 31)
+} Xive2End;
+
+#define xive2_end_is_valid(end)    (be32_to_cpu((end)->w0) & END2_W0_VALID)
+#define xive2_end_is_enqueue(end)  (be32_to_cpu((end)->w0) & END2_W0_ENQUEUE)
+#define xive2_end_is_notify(end)                \
+    (be32_to_cpu((end)->w0) & END2_W0_UCOND_NOTIFY)
+#define xive2_end_is_backlog(end)  (be32_to_cpu((end)->w0) & END2_W0_BACKLOG)
+#define xive2_end_is_escalate(end)                      \
+    (be32_to_cpu((end)->w0) & END2_W0_ESCALATE_CTL)
+#define xive2_end_is_uncond_escalation(end)              \
+    (be32_to_cpu((end)->w0) & END2_W0_UNCOND_ESCALATE)
+#define xive2_end_is_silent_escalation(end)              \
+    (be32_to_cpu((end)->w0) & END2_W0_SILENT_ESCALATE)
+#define xive2_end_is_escalate_end(end)              \
+    (be32_to_cpu((end)->w0) & END2_W0_ESCALATE_END)
+
+static inline uint64_t xive2_end_qaddr(Xive2End *end)
+{
+    return ((uint64_t) be32_to_cpu(end->w2) & END2_W2_EQ_ADDR_HI) << 32 |
+        (be32_to_cpu(end->w3) & END2_W3_EQ_ADDR_LO);
+}
+
+void xive2_end_pic_print_info(Xive2End *end, uint32_t end_idx, Monitor *mon);
+void xive2_end_queue_pic_print_info(Xive2End *end, uint32_t width,
+                                    Monitor *mon);
+void xive2_end_eas_pic_print_info(Xive2End *end, uint32_t end_idx,
+                                   Monitor *mon);
+
+/*
+ * Notification Virtual Processor (NVP)
+ */
+typedef struct Xive2Nvp {
+        uint32_t       w0;
+#define NVP2_W0_VALID              PPC_BIT32(0)
+#define NVP2_W0_ESC_END            PPC_BIT32(25) /* 'N' bit 0:ESB  1:END */
+        uint32_t       w1;
+        uint32_t       w2;
+#define NVP2_W2_CPPR               PPC_BITMASK32(0, 7)
+#define NVP2_W2_IPB                PPC_BITMASK32(8, 15)
+#define NVP2_W2_LSMFB              PPC_BITMASK32(16, 23)
+        uint32_t       w3;
+        uint32_t       w4;
+#define NVP2_W4_ESC_ESB_BLOCK      PPC_BITMASK32(0, 3)  /* N:0 */
+#define NVP2_W4_ESC_ESB_INDEX      PPC_BITMASK32(4, 31) /* N:0 */
+#define NVP2_W4_ESC_END_BLOCK      PPC_BITMASK32(4, 7)  /* N:1 */
+#define NVP2_W4_ESC_END_INDEX      PPC_BITMASK32(8, 31) /* N:1 */
+        uint32_t       w5;
+#define NVP2_W5_PSIZE              PPC_BITMASK32(0, 1)
+#define NVP2_W5_VP_END_BLOCK       PPC_BITMASK32(4, 7)
+#define NVP2_W5_VP_END_INDEX       PPC_BITMASK32(8, 31)
+        uint32_t       w6;
+        uint32_t       w7;
+} Xive2Nvp;
+
+#define xive2_nvp_is_valid(nvp)    (be32_to_cpu((nvp)->w0) & NVP2_W0_VALID)
+#define xive2_nvp_is_hw(nvp)       (be32_to_cpu((nvp)->w0) & NVP2_W0_HW)
+#define xive2_nvp_is_co(nvp)       (be32_to_cpu((nvp)->w1) & NVP2_W1_CO)
+
+/*
+ * The VP number space in a block is defined by the END2_W6_VP_OFFSET
+ * field of the XIVE END. When running in Gen1 mode (P9 compat mode),
+ * the VP space is reduced to (1 << 19) VPs per block
+ */
+#define XIVE2_NVP_SHIFT              24
+#define XIVE2_NVP_COUNT              (1 << XIVE2_NVP_SHIFT)
+
+static inline uint32_t xive2_nvp_cam_line(uint8_t nvp_blk, uint32_t nvp_idx)
+{
+    return (nvp_blk << XIVE2_NVP_SHIFT) | nvp_idx;
+}
+
+static inline uint32_t xive2_nvp_idx(uint32_t cam_line)
+{
+    return cam_line & ((1 << XIVE2_NVP_SHIFT) - 1);
+}
+
+static inline uint32_t xive2_nvp_blk(uint32_t cam_line)
+{
+    return (cam_line >> XIVE2_NVP_SHIFT) & 0xf;
+}
+
+/*
+ * Notification Virtual Group or Crowd (NVG/NVC)
+ */
+typedef struct Xive2Nvgc {
+        uint32_t        w0;
+#define NVGC2_W0_VALID             PPC_BIT32(0)
+        uint32_t        w1;
+        uint32_t        w2;
+        uint32_t        w3;
+        uint32_t        w4;
+        uint32_t        w5;
+        uint32_t        w6;
+        uint32_t        w7;
+} Xive2Nvgc;
+
+#endif /* PPC_XIVE2_REGS_H */
diff --git a/hw/intc/xive2.c b/hw/intc/xive2.c
new file mode 100644
index 000000000000..15ea04cf1822
--- /dev/null
+++ b/hw/intc/xive2.c
@@ -0,0 +1,669 @@
+/*
+ * QEMU PowerPC XIVE2 interrupt controller model (POWER10)
+ *
+ * Copyright (c) 2019-2020, IBM Corporation..
+ *
+ * This code is licensed under the GPL version 2 or later. See the
+ * COPYING file in the top-level directory.
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/log.h"
+#include "qemu/module.h"
+#include "qapi/error.h"
+#include "target/ppc/cpu.h"
+#include "sysemu/cpus.h"
+#include "sysemu/dma.h"
+#include "hw/qdev-properties.h"
+#include "monitor/monitor.h"
+#include "hw/ppc/xive.h"
+#include "hw/ppc/xive2.h"
+#include "hw/ppc/xive2_regs.h"
+
+static uint8_t priority_to_ipb(uint8_t priority)
+{
+    return priority > XIVE_PRIORITY_MAX ?
+        0 : 1 << (XIVE_PRIORITY_MAX - priority);
+}
+
+void xive2_eas_pic_print_info(Xive2Eas *eas, uint32_t lisn, Monitor *mon)
+{
+    if (!xive2_eas_is_valid(eas)) {
+        return;
+    }
+
+    monitor_printf(mon, "  %08x %s end:%02x/%04x data:%08x\n",
+                   lisn, xive2_eas_is_masked(eas) ? "M" : " ",
+                   (uint8_t)  xive_get_field64(EAS2_END_BLOCK, eas->w),
+                   (uint32_t) xive_get_field64(EAS2_END_INDEX, eas->w),
+                   (uint32_t) xive_get_field64(EAS2_END_DATA, eas->w));
+}
+
+void xive2_end_queue_pic_print_info(Xive2End *end, uint32_t width,
+                                     Monitor *mon)
+{
+    uint64_t qaddr_base = xive2_end_qaddr(end);
+    uint32_t qsize = xive_get_field32(END2_W3_QSIZE, end->w3);
+    uint32_t qindex = xive_get_field32(END2_W1_PAGE_OFF, end->w1);
+    uint32_t qentries = 1 << (qsize + 10);
+    int i;
+
+    /*
+     * print out the [ (qindex - (width - 1)) .. (qindex + 1)] window
+     */
+    monitor_printf(mon, " [ ");
+    qindex = (qindex - (width - 1)) & (qentries - 1);
+    for (i = 0; i < width; i++) {
+        uint64_t qaddr = qaddr_base + (qindex << 2);
+        uint32_t qdata = -1;
+
+        if (dma_memory_read(&address_space_memory, qaddr, &qdata,
+                            sizeof(qdata))) {
+            qemu_log_mask(LOG_GUEST_ERROR, "XIVE: failed to read EQ @0x%"
+                          HWADDR_PRIx "\n", qaddr);
+            return;
+        }
+        monitor_printf(mon, "%s%08x ", i == width - 1 ? "^" : "",
+                       be32_to_cpu(qdata));
+        qindex = (qindex + 1) & (qentries - 1);
+    }
+    monitor_printf(mon, "]");
+}
+
+void xive2_end_pic_print_info(Xive2End *end, uint32_t end_idx, Monitor *mon)
+{
+    uint64_t qaddr_base = xive2_end_qaddr(end);
+    uint32_t qindex = xive_get_field32(END2_W1_PAGE_OFF, end->w1);
+    uint32_t qgen = xive_get_field32(END2_W1_GENERATION, end->w1);
+    uint32_t qsize = xive_get_field32(END2_W3_QSIZE, end->w3);
+    uint32_t qentries = 1 << (qsize + 10);
+
+    uint32_t nvp_blk = xive_get_field32(END2_W6_VP_BLOCK, end->w6);
+    uint32_t nvp_idx = xive_get_field32(END2_W6_VP_OFFSET, end->w6);
+    uint8_t priority = xive_get_field32(END2_W7_F0_PRIORITY, end->w7);
+    uint8_t pq;
+
+    if (!xive2_end_is_valid(end)) {
+        return;
+    }
+
+    pq = xive_get_field32(END2_W1_ESn, end->w1);
+
+    monitor_printf(mon, "  %08x %c%c %c%c%c%c%c%c%c%c prio:%d nvp:%02x/%04x",
+                   end_idx,
+                   pq & XIVE_ESB_VAL_P ? 'P' : '-',
+                   pq & XIVE_ESB_VAL_Q ? 'Q' : '-',
+                   xive2_end_is_valid(end)    ? 'v' : '-',
+                   xive2_end_is_enqueue(end)  ? 'q' : '-',
+                   xive2_end_is_notify(end)   ? 'n' : '-',
+                   xive2_end_is_backlog(end)  ? 'b' : '-',
+                   xive2_end_is_escalate(end) ? 'e' : '-',
+                   xive2_end_is_escalate_end(end) ? 'N' : '-',
+                   xive2_end_is_uncond_escalation(end)   ? 'u' : '-',
+                   xive2_end_is_silent_escalation(end)   ? 's' : '-',
+                   priority, nvp_blk, nvp_idx);
+
+    if (qaddr_base) {
+        monitor_printf(mon, " eq:@%08"PRIx64"% 6d/%5d ^%d",
+                       qaddr_base, qindex, qentries, qgen);
+        xive2_end_queue_pic_print_info(end, 6, mon);
+    }
+    monitor_printf(mon, "\n");
+}
+
+void xive2_end_eas_pic_print_info(Xive2End *end, uint32_t end_idx,
+                                   Monitor *mon)
+{
+    Xive2Eas *eas = (Xive2Eas *) &end->w4;
+    uint8_t pq;
+
+    if (!xive2_end_is_escalate(end)) {
+        return;
+    }
+
+    pq = xive_get_field32(END2_W1_ESe, end->w1);
+
+    monitor_printf(mon, "  %08x %c%c %c%c end:%02x/%04x data:%08x\n",
+                   end_idx,
+                   pq & XIVE_ESB_VAL_P ? 'P' : '-',
+                   pq & XIVE_ESB_VAL_Q ? 'Q' : '-',
+                   xive2_eas_is_valid(eas) ? 'v' : ' ',
+                   xive2_eas_is_masked(eas) ? 'M' : ' ',
+                   (uint8_t)  xive_get_field64(EAS2_END_BLOCK, eas->w),
+                   (uint32_t) xive_get_field64(EAS2_END_INDEX, eas->w),
+                   (uint32_t) xive_get_field64(EAS2_END_DATA, eas->w));
+}
+
+static void xive2_end_enqueue(Xive2End *end, uint32_t data)
+{
+    uint64_t qaddr_base = xive2_end_qaddr(end);
+    uint32_t qsize = xive_get_field32(END2_W3_QSIZE, end->w3);
+    uint32_t qindex = xive_get_field32(END2_W1_PAGE_OFF, end->w1);
+    uint32_t qgen = xive_get_field32(END2_W1_GENERATION, end->w1);
+
+    uint64_t qaddr = qaddr_base + (qindex << 2);
+    uint32_t qdata = cpu_to_be32((qgen << 31) | (data & 0x7fffffff));
+    uint32_t qentries = 1 << (qsize + 10);
+
+    if (dma_memory_write(&address_space_memory, qaddr, &qdata, sizeof(qdata))) {
+        qemu_log_mask(LOG_GUEST_ERROR, "XIVE: failed to write END data @0x%"
+                      HWADDR_PRIx "\n", qaddr);
+        return;
+    }
+
+    qindex = (qindex + 1) & (qentries - 1);
+    if (qindex == 0) {
+        qgen ^= 1;
+        end->w1 = xive_set_field32(END2_W1_GENERATION, end->w1, qgen);
+
+        /* TODO(PowerNV): reset GF bit on a cache watch operation */
+        end->w1 = xive_set_field32(END2_W1_GEN_FLIPPED, end->w1, qgen);
+    }
+    end->w1 = xive_set_field32(END2_W1_PAGE_OFF, end->w1, qindex);
+}
+/*
+ * XIVE Router (aka. Virtualization Controller or IVRE)
+ */
+
+int xive2_router_get_eas(Xive2Router *xrtr, uint8_t eas_blk, uint32_t eas_idx,
+                        Xive2Eas *eas)
+{
+    Xive2RouterClass *xrc = XIVE2_ROUTER_GET_CLASS(xrtr);
+
+    return xrc->get_eas(xrtr, eas_blk, eas_idx, eas);
+}
+
+int xive2_router_get_end(Xive2Router *xrtr, uint8_t end_blk, uint32_t end_idx,
+                        Xive2End *end)
+{
+   Xive2RouterClass *xrc = XIVE2_ROUTER_GET_CLASS(xrtr);
+
+   return xrc->get_end(xrtr, end_blk, end_idx, end);
+}
+
+int xive2_router_write_end(Xive2Router *xrtr, uint8_t end_blk, uint32_t end_idx,
+                          Xive2End *end, uint8_t word_number)
+{
+   Xive2RouterClass *xrc = XIVE2_ROUTER_GET_CLASS(xrtr);
+
+   return xrc->write_end(xrtr, end_blk, end_idx, end, word_number);
+}
+
+int xive2_router_get_nvp(Xive2Router *xrtr, uint8_t nvp_blk, uint32_t nvp_idx,
+                        Xive2Nvp *nvp)
+{
+   Xive2RouterClass *xrc = XIVE2_ROUTER_GET_CLASS(xrtr);
+
+   return xrc->get_nvp(xrtr, nvp_blk, nvp_idx, nvp);
+}
+
+int xive2_router_write_nvp(Xive2Router *xrtr, uint8_t nvp_blk, uint32_t nvp_idx,
+                        Xive2Nvp *nvp, uint8_t word_number)
+{
+   Xive2RouterClass *xrc = XIVE2_ROUTER_GET_CLASS(xrtr);
+
+   return xrc->write_nvp(xrtr, nvp_blk, nvp_idx, nvp, word_number);
+}
+
+static int xive2_router_get_block_id(Xive2Router *xrtr)
+{
+   Xive2RouterClass *xrc = XIVE2_ROUTER_GET_CLASS(xrtr);
+
+   return xrc->get_block_id(xrtr);
+}
+
+static void xive2_router_realize(DeviceState *dev, Error **errp)
+{
+    Xive2Router *xrtr = XIVE2_ROUTER(dev);
+
+    assert(xrtr->xfb);
+}
+
+/*
+ * Notification using the END ESe/ESn bit (Event State Buffer for
+ * escalation and notification). Profide futher coalescing in the
+ * Router.
+ */
+static bool xive2_router_end_es_notify(Xive2Router *xrtr, uint8_t end_blk,
+                                        uint32_t end_idx, Xive2End *end,
+                                        uint32_t end_esmask)
+{
+    uint8_t pq = xive_get_field32(end_esmask, end->w1);
+    bool notify = xive_esb_trigger(&pq);
+
+    if (pq != xive_get_field32(end_esmask, end->w1)) {
+        end->w1 = xive_set_field32(end_esmask, end->w1, pq);
+        xive2_router_write_end(xrtr, end_blk, end_idx, end, 1);
+    }
+
+    /* ESe/n[Q]=1 : end of notification */
+    return notify;
+}
+
+/*
+ * An END trigger can come from an event trigger (IPI or HW) or from
+ * another chip. We don't model the PowerBus but the END trigger
+ * message has the same parameters than in the function below.
+ */
+static void xive2_router_end_notify(Xive2Router *xrtr, uint8_t end_blk,
+                                     uint32_t end_idx, uint32_t end_data)
+{
+    Xive2End end;
+    uint8_t priority;
+    uint8_t format;
+    bool found;
+    Xive2Nvp nvp;
+    uint8_t nvp_blk;
+    uint32_t nvp_idx;
+
+    /* END cache lookup */
+    if (xive2_router_get_end(xrtr, end_blk, end_idx, &end)) {
+        qemu_log_mask(LOG_GUEST_ERROR, "XIVE: No END %x/%x\n", end_blk,
+                      end_idx);
+        return;
+    }
+
+    if (!xive2_end_is_valid(&end)) {
+        qemu_log_mask(LOG_GUEST_ERROR, "XIVE: END %x/%x is invalid\n",
+                      end_blk, end_idx);
+        return;
+    }
+
+    if (xive2_end_is_enqueue(&end)) {
+        xive2_end_enqueue(&end, end_data);
+        /* Enqueuing event data modifies the EQ toggle and index */
+        xive2_router_write_end(xrtr, end_blk, end_idx, &end, 1);
+    }
+
+    /*
+     * When the END is silent, we skip the notification part.
+     */
+    if (xive2_end_is_silent_escalation(&end)) {
+        goto do_escalation;
+    }
+
+    /*
+     * The W7 format depends on the F bit in W6. It defines the type
+     * of the notification :
+     *
+     *   F=0 : single or multiple NVP notification
+     *   F=1 : User level Event-Based Branch (EBB) notification, no
+     *         priority
+     */
+    format = xive_get_field32(END2_W6_FORMAT_BIT, end.w6);
+    priority = xive_get_field32(END2_W7_F0_PRIORITY, end.w7);
+
+    /* The END is masked */
+    if (format == 0 && priority == 0xff) {
+        return;
+    }
+
+    /*
+     * Check the END ESn (Event State Buffer for notification) for
+     * even futher coalescing in the Router
+     */
+    if (!xive2_end_is_notify(&end)) {
+        /* ESn[Q]=1 : end of notification */
+        if (!xive2_router_end_es_notify(xrtr, end_blk, end_idx,
+                                       &end, END2_W1_ESn)) {
+            return;
+        }
+    }
+
+    /*
+     * Follows IVPE notification
+     */
+    nvp_blk = xive_get_field32(END2_W6_VP_BLOCK, end.w6);
+    nvp_idx = xive_get_field32(END2_W6_VP_OFFSET, end.w6);
+
+    /* NVP cache lookup */
+    if (xive2_router_get_nvp(xrtr, nvp_blk, nvp_idx, &nvp)) {
+        qemu_log_mask(LOG_GUEST_ERROR, "XIVE: no NVP %x/%x\n",
+                      nvp_blk, nvp_idx);
+        return;
+    }
+
+    if (!xive2_nvp_is_valid(&nvp)) {
+        qemu_log_mask(LOG_GUEST_ERROR, "XIVE: NVP %x/%x is invalid\n",
+                      nvp_blk, nvp_idx);
+        return;
+    }
+
+    found = xive_presenter_notify(xrtr->xfb, format, nvp_blk, nvp_idx,
+                          xive_get_field32(END2_W6_IGNORE, end.w7),
+                          priority,
+                          xive_get_field32(END2_W7_F1_LOG_SERVER_ID, end.w7));
+
+    /* TODO: Auto EOI. */
+
+    if (found) {
+        return;
+    }
+
+    /*
+     * If no matching NVP is dispatched on a HW thread :
+     * - specific VP: update the NVP structure if backlog is activated
+     * - logical server : forward request to IVPE (not supported)
+     */
+    if (xive2_end_is_backlog(&end)) {
+        uint8_t ipb;
+
+        if (format == 1) {
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "XIVE: END %x/%x invalid config: F1 & backlog\n",
+                          end_blk, end_idx);
+            return;
+        }
+
+        /*
+         * Record the IPB in the associated NVP structure for later
+         * use. The presenter will resend the interrupt when the vCPU
+         * is dispatched again on a HW thread.
+         */
+        ipb = xive_get_field32(NVP2_W2_IPB, nvp.w2) |
+            priority_to_ipb(priority);
+        nvp.w2 = xive_set_field32(NVP2_W2_IPB, nvp.w2, ipb);
+        xive2_router_write_nvp(xrtr, nvp_blk, nvp_idx, &nvp, 2);
+
+        /*
+         * On HW, follows a "Broadcast Backlog" to IVPEs
+         */
+    }
+
+do_escalation:
+    /*
+     * If activated, escalate notification using the ESe PQ bits and
+     * the EAS in w4-5
+     */
+    if (!xive2_end_is_escalate(&end)) {
+        return;
+    }
+
+    /*
+     * Check the END ESe (Event State Buffer for escalation) for even
+     * futher coalescing in the Router
+     */
+    if (!xive2_end_is_uncond_escalation(&end)) {
+        /* ESe[Q]=1 : end of escalation notification */
+        if (!xive2_router_end_es_notify(xrtr, end_blk, end_idx,
+                                       &end, END2_W1_ESe)) {
+            return;
+        }
+    }
+
+    /*
+     * The END trigger becomes an Escalation trigger
+     */
+    xive2_router_end_notify(xrtr,
+                           xive_get_field32(END2_W4_END_BLOCK,     end.w4),
+                           xive_get_field32(END2_W4_ESC_END_INDEX, end.w4),
+                           xive_get_field32(END2_W5_ESC_END_DATA,  end.w5));
+}
+
+void xive2_router_notify(XiveNotifier *xn, uint32_t lisn)
+{
+    Xive2Router *xrtr = XIVE2_ROUTER(xn);
+    uint8_t eas_blk = XIVE_EAS_BLOCK(lisn);
+    uint32_t eas_idx = XIVE_EAS_INDEX(lisn);
+    Xive2Eas eas;
+
+    /* EAS cache lookup */
+    if (xive2_router_get_eas(xrtr, eas_blk, eas_idx, &eas)) {
+        qemu_log_mask(LOG_GUEST_ERROR, "XIVE: Unknown LISN %x\n", lisn);
+        return;
+    }
+
+    if (!xive2_eas_is_valid(&eas)) {
+        qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid LISN %x\n", lisn);
+        return;
+    }
+
+    if (xive2_eas_is_masked(&eas)) {
+        /* Notification completed */
+        return;
+    }
+
+    /*
+     * The event trigger becomes an END trigger
+     */
+    xive2_router_end_notify(xrtr,
+                             xive_get_field64(EAS2_END_BLOCK, eas.w),
+                             xive_get_field64(EAS2_END_INDEX, eas.w),
+                             xive_get_field64(EAS2_END_DATA,  eas.w));
+}
+
+static Property xive2_router_properties[] = {
+    DEFINE_PROP_LINK("xive-fabric", Xive2Router, xfb,
+                     TYPE_XIVE_FABRIC, XiveFabric *),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
+static void xive2_router_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    XiveNotifierClass *xnc = XIVE_NOTIFIER_CLASS(klass);
+
+    dc->desc    = "XIVE2 Router Engine";
+    device_class_set_props(dc, xive2_router_properties);
+    /* Parent is SysBusDeviceClass. No need to call its realize hook */
+    dc->realize = xive2_router_realize;
+    xnc->notify = xive2_router_notify;
+}
+
+static const TypeInfo xive2_router_info = {
+    .name          = TYPE_XIVE2_ROUTER,
+    .parent        = TYPE_SYS_BUS_DEVICE,
+    .abstract      = true,
+    .instance_size = sizeof(Xive2Router),
+    .class_size    = sizeof(Xive2RouterClass),
+    .class_init    = xive2_router_class_init,
+    .interfaces    = (InterfaceInfo[]) {
+        { TYPE_XIVE_NOTIFIER },
+        { TYPE_XIVE_PRESENTER },
+        { }
+    }
+};
+
+static inline bool addr_is_even(hwaddr addr, uint32_t shift)
+{
+    return !((addr >> shift) & 1);
+}
+
+static uint64_t xive2_end_source_read(void *opaque, hwaddr addr, unsigned size)
+{
+    Xive2EndSource *xsrc = XIVE2_END_SOURCE(opaque);
+    uint32_t offset = addr & 0xFFF;
+    uint8_t end_blk;
+    uint32_t end_idx;
+    Xive2End end;
+    uint32_t end_esmask;
+    uint8_t pq;
+    uint64_t ret = -1;
+
+    /*
+     * The block id should be deduced from the load address on the END
+     * ESB MMIO but our model only supports a single block per XIVE chip.
+     */
+    end_blk = xive2_router_get_block_id(xsrc->xrtr);
+    end_idx = addr >> (xsrc->esb_shift + 1);
+
+    if (xive2_router_get_end(xsrc->xrtr, end_blk, end_idx, &end)) {
+        qemu_log_mask(LOG_GUEST_ERROR, "XIVE: No END %x/%x\n", end_blk,
+                      end_idx);
+        return -1;
+    }
+
+    if (!xive2_end_is_valid(&end)) {
+        qemu_log_mask(LOG_GUEST_ERROR, "XIVE: END %x/%x is invalid\n",
+                      end_blk, end_idx);
+        return -1;
+    }
+
+    end_esmask = addr_is_even(addr, xsrc->esb_shift) ? END2_W1_ESn :
+        END2_W1_ESe;
+    pq = xive_get_field32(end_esmask, end.w1);
+
+    switch (offset) {
+    case XIVE_ESB_LOAD_EOI ... XIVE_ESB_LOAD_EOI + 0x7FF:
+        ret = xive_esb_eoi(&pq);
+
+        /* Forward the source event notification for routing ?? */
+        break;
+
+    case XIVE_ESB_GET ... XIVE_ESB_GET + 0x3FF:
+        ret = pq;
+        break;
+
+    case XIVE_ESB_SET_PQ_00 ... XIVE_ESB_SET_PQ_00 + 0x0FF:
+    case XIVE_ESB_SET_PQ_01 ... XIVE_ESB_SET_PQ_01 + 0x0FF:
+    case XIVE_ESB_SET_PQ_10 ... XIVE_ESB_SET_PQ_10 + 0x0FF:
+    case XIVE_ESB_SET_PQ_11 ... XIVE_ESB_SET_PQ_11 + 0x0FF:
+        ret = xive_esb_set(&pq, (offset >> 8) & 0x3);
+        break;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid END ESB load addr %d\n",
+                      offset);
+        return -1;
+    }
+
+    if (pq != xive_get_field32(end_esmask, end.w1)) {
+        end.w1 = xive_set_field32(end_esmask, end.w1, pq);
+        xive2_router_write_end(xsrc->xrtr, end_blk, end_idx, &end, 1);
+    }
+
+    return ret;
+}
+
+static void xive2_end_source_write(void *opaque, hwaddr addr,
+                                  uint64_t value, unsigned size)
+{
+    Xive2EndSource *xsrc = XIVE2_END_SOURCE(opaque);
+    uint32_t offset = addr & 0xFFF;
+    uint8_t end_blk;
+    uint32_t end_idx;
+    Xive2End end;
+    uint32_t end_esmask;
+    uint8_t pq;
+    bool notify = false;
+
+    /*
+     * The block id should be deduced from the load address on the END
+     * ESB MMIO but our model only supports a single block per XIVE chip.
+     */
+    end_blk = xive2_router_get_block_id(xsrc->xrtr);
+    end_idx = addr >> (xsrc->esb_shift + 1);
+
+    if (xive2_router_get_end(xsrc->xrtr, end_blk, end_idx, &end)) {
+        qemu_log_mask(LOG_GUEST_ERROR, "XIVE: No END %x/%x\n", end_blk,
+                      end_idx);
+        return;
+    }
+
+    if (!xive2_end_is_valid(&end)) {
+        qemu_log_mask(LOG_GUEST_ERROR, "XIVE: END %x/%x is invalid\n",
+                      end_blk, end_idx);
+        return;
+    }
+
+    end_esmask = addr_is_even(addr, xsrc->esb_shift) ? END2_W1_ESn :
+        END2_W1_ESe;
+    pq = xive_get_field32(end_esmask, end.w1);
+
+    switch (offset) {
+    case 0 ... 0x3FF:
+        notify = xive_esb_trigger(&pq);
+        break;
+
+    case XIVE_ESB_STORE_EOI ... XIVE_ESB_STORE_EOI + 0x3FF:
+        /* TODO: can we check StoreEOI availability from the router ? */
+        notify = xive_esb_eoi(&pq);
+        break;
+
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid END ESB write addr %d\n",
+                      offset);
+        return;
+    }
+
+    if (pq != xive_get_field32(end_esmask, end.w1)) {
+        end.w1 = xive_set_field32(end_esmask, end.w1, pq);
+        xive2_router_write_end(xsrc->xrtr, end_blk, end_idx, &end, 1);
+    }
+
+    /* TODO: Forward the source event notification for routing */
+    if (notify) {
+        ;
+    }
+}
+
+static const MemoryRegionOps xive2_end_source_ops = {
+    .read = xive2_end_source_read,
+    .write = xive2_end_source_write,
+    .endianness = DEVICE_BIG_ENDIAN,
+    .valid = {
+        .min_access_size = 8,
+        .max_access_size = 8,
+    },
+    .impl = {
+        .min_access_size = 8,
+        .max_access_size = 8,
+    },
+};
+
+static void xive2_end_source_realize(DeviceState *dev, Error **errp)
+{
+    Xive2EndSource *xsrc = XIVE2_END_SOURCE(dev);
+
+    assert(xsrc->xrtr);
+
+    if (!xsrc->nr_ends) {
+        error_setg(errp, "Number of interrupt needs to be greater than 0");
+        return;
+    }
+
+    if (xsrc->esb_shift != XIVE_ESB_4K &&
+        xsrc->esb_shift != XIVE_ESB_64K) {
+        error_setg(errp, "Invalid ESB shift setting");
+        return;
+    }
+
+    /*
+     * Each END is assigned an even/odd pair of MMIO pages, the even page
+     * manages the ESn field while the odd page manages the ESe field.
+     */
+    memory_region_init_io(&xsrc->esb_mmio, OBJECT(xsrc),
+                          &xive2_end_source_ops, xsrc, "xive.end",
+                          (1ull << (xsrc->esb_shift + 1)) * xsrc->nr_ends);
+}
+
+static Property xive2_end_source_properties[] = {
+    DEFINE_PROP_UINT32("nr-ends", Xive2EndSource, nr_ends, 0),
+    DEFINE_PROP_UINT32("shift", Xive2EndSource, esb_shift, XIVE_ESB_64K),
+    DEFINE_PROP_LINK("xive", Xive2EndSource, xrtr, TYPE_XIVE2_ROUTER,
+                     Xive2Router *),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
+static void xive2_end_source_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->desc    = "XIVE END Source";
+    device_class_set_props(dc, xive2_end_source_properties);
+    dc->realize = xive2_end_source_realize;
+}
+
+static const TypeInfo xive2_end_source_info = {
+    .name          = TYPE_XIVE2_END_SOURCE,
+    .parent        = TYPE_DEVICE,
+    .instance_size = sizeof(Xive2EndSource),
+    .class_init    = xive2_end_source_class_init,
+};
+
+static void xive2_register_types(void)
+{
+    type_register_static(&xive2_router_info);
+    type_register_static(&xive2_end_source_info);
+}
+
+type_init(xive2_register_types)
diff --git a/hw/intc/Makefile.objs b/hw/intc/Makefile.objs
index f726d8753276..3af575aeb87d 100644
--- a/hw/intc/Makefile.objs
+++ b/hw/intc/Makefile.objs
@@ -37,7 +37,7 @@ obj-$(CONFIG_SH4) += sh_intc.o
 obj-$(CONFIG_XICS) += xics.o
 obj-$(CONFIG_XICS_SPAPR) += xics_spapr.o
 obj-$(CONFIG_XICS_KVM) += xics_kvm.o
-obj-$(CONFIG_XIVE) += xive.o
+obj-$(CONFIG_XIVE) += xive.o xive2.o
 obj-$(CONFIG_XIVE_SPAPR) += spapr_xive.o
 obj-$(CONFIG_XIVE_KVM) += spapr_xive_kvm.o
 obj-$(CONFIG_POWERNV) += xics_pnv.o pnv_xive.o
-- 
2.25.4



^ permalink raw reply related	[flat|nested] 25+ messages in thread

* [PATCH 4/9] ppc/xive2: Introduce a presenter matching routine
  2020-05-13 15:11 [PATCH 0/9] ppc/pnv: Introduce the XIVE2 and PHB5 controllers for the POWER10 chip Cédric Le Goater
                   ` (2 preceding siblings ...)
  2020-05-13 15:11 ` [PATCH 3/9] ppc/xive2: Introduce a XIVE2 core framework Cédric Le Goater
@ 2020-05-13 15:11 ` Cédric Le Goater
  2020-05-20 17:17   ` Greg Kurz
  2020-05-20 17:20   ` Greg Kurz
  2020-05-13 15:11 ` [PATCH 5/9] ppc/pnv: Add a XIVE2 controller to the POWER10 chip Cédric Le Goater
                   ` (5 subsequent siblings)
  9 siblings, 2 replies; 25+ messages in thread
From: Cédric Le Goater @ 2020-05-13 15:11 UTC (permalink / raw)
  To: David Gibson; +Cc: Cédric Le Goater, qemu-ppc, Greg Kurz, qemu-devel

The VP space is larger in XIVE2 (P10), 24 bits instead of 19bits on
XIVE (P9), and the CAM line can use a 7bits or 8bits thread id.

For now, we only use 7bits thread ids, same as P9, but because of the
change of the size of the VP space, the CAM matching routine is
different between P9 and P10. It is easier to duplicate the whole
routine than to add extra handlers in xive_presenter_tctx_match() used
for P9.

We might come with a better solution later on, after we have added
some more support for the XIVE2 controller.

Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 include/hw/ppc/xive2.h |  9 +++++
 hw/intc/xive2.c        | 87 ++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 96 insertions(+)

diff --git a/include/hw/ppc/xive2.h b/include/hw/ppc/xive2.h
index cb15487efdb6..4aefca4d96f1 100644
--- a/include/hw/ppc/xive2.h
+++ b/include/hw/ppc/xive2.h
@@ -60,6 +60,15 @@ int xive2_router_write_nvp(Xive2Router *xrtr, uint8_t nvt_blk, uint32_t nvt_idx,
 
 void xive2_router_notify(XiveNotifier *xn, uint32_t lisn);
 
+/*
+ * XIVE2 Presenter (POWER10)
+ */
+
+int xive2_presenter_tctx_match(XivePresenter *xptr, XiveTCTX *tctx,
+                                uint8_t format,
+                                uint8_t nvt_blk, uint32_t nvt_idx,
+                                bool cam_ignore, uint32_t logic_serv);
+
 /*
  * XIVE2 END ESBs  (POWER10)
  */
diff --git a/hw/intc/xive2.c b/hw/intc/xive2.c
index 15ea04cf1822..1ce9d995e990 100644
--- a/hw/intc/xive2.c
+++ b/hw/intc/xive2.c
@@ -20,6 +20,11 @@
 #include "hw/ppc/xive2.h"
 #include "hw/ppc/xive2_regs.h"
 
+static inline uint32_t xive_tctx_word2(uint8_t *ring)
+{
+    return *((uint32_t *) &ring[TM_WORD2]);
+}
+
 static uint8_t priority_to_ipb(uint8_t priority)
 {
     return priority > XIVE_PRIORITY_MAX ?
@@ -212,6 +217,88 @@ static int xive2_router_get_block_id(Xive2Router *xrtr)
    return xrc->get_block_id(xrtr);
 }
 
+/*
+ * Encode the HW CAM line with 7bit or 8bit thread id. The thread id
+ * width and block id width is configurable at the IC level.
+ *
+ *    chipid << 19 | 0000000 0 0001 threadid (7Bit)
+ *    chipid << 24 | 0000 0000 0000 0001 threadid (8Bit)
+ */
+static uint32_t xive2_tctx_hw_cam_line(XivePresenter *xptr, XiveTCTX *tctx)
+{
+    Xive2Router *xrtr = XIVE2_ROUTER(xptr);
+    CPUPPCState *env = &POWERPC_CPU(tctx->cs)->env;
+    uint32_t pir = env->spr_cb[SPR_PIR].default_value;
+    uint8_t blk = xive2_router_get_block_id(xrtr);
+    uint8_t tid_shift = 7;
+    uint8_t tid_mask = (1 << tid_shift) - 1;
+
+    return xive2_nvp_cam_line(blk, 1 << tid_shift | (pir & tid_mask));
+}
+
+/*
+ * The thread context register words are in big-endian format.
+ */
+int xive2_presenter_tctx_match(XivePresenter *xptr, XiveTCTX *tctx,
+                                uint8_t format,
+                                uint8_t nvt_blk, uint32_t nvt_idx,
+                                bool cam_ignore, uint32_t logic_serv)
+{
+    uint32_t cam =   xive2_nvp_cam_line(nvt_blk, nvt_idx);
+    uint32_t qw3w2 = xive_tctx_word2(&tctx->regs[TM_QW3_HV_PHYS]);
+    uint32_t qw2w2 = xive_tctx_word2(&tctx->regs[TM_QW2_HV_POOL]);
+    uint32_t qw1w2 = xive_tctx_word2(&tctx->regs[TM_QW1_OS]);
+    uint32_t qw0w2 = xive_tctx_word2(&tctx->regs[TM_QW0_USER]);
+
+    /*
+     * TODO (PowerNV): ignore mode. The low order bits of the NVT
+     * identifier are ignored in the "CAM" match.
+     */
+
+    if (format == 0) {
+        if (cam_ignore == true) {
+            /*
+             * F=0 & i=1: Logical server notification (bits ignored at
+             * the end of the NVT identifier)
+             */
+            qemu_log_mask(LOG_UNIMP, "XIVE: no support for LS NVT %x/%x\n",
+                          nvt_blk, nvt_idx);
+             return -1;
+        }
+
+        /* F=0 & i=0: Specific NVT notification */
+
+        /* PHYS ring */
+        if ((be32_to_cpu(qw3w2) & TM2_QW3W2_VT) &&
+            cam == xive2_tctx_hw_cam_line(xptr, tctx)) {
+            return TM_QW3_HV_PHYS;
+        }
+
+        /* HV POOL ring */
+        if ((be32_to_cpu(qw2w2) & TM2_QW2W2_VP) &&
+            cam == xive_get_field32(TM2_QW2W2_POOL_CAM, qw2w2)) {
+            return TM_QW2_HV_POOL;
+        }
+
+        /* OS ring */
+        if ((be32_to_cpu(qw1w2) & TM2_QW1W2_VO) &&
+            cam == xive_get_field32(TM2_QW1W2_OS_CAM, qw1w2)) {
+            return TM_QW1_OS;
+        }
+    } else {
+        /* F=1 : User level Event-Based Branch (EBB) notification */
+
+        /* USER ring */
+        if  ((be32_to_cpu(qw1w2) & TM2_QW1W2_VO) &&
+             (cam == xive_get_field32(TM2_QW1W2_OS_CAM, qw1w2)) &&
+             (be32_to_cpu(qw0w2) & TM2_QW0W2_VU) &&
+             (logic_serv == xive_get_field32(TM2_QW0W2_LOGIC_SERV, qw0w2))) {
+            return TM_QW0_USER;
+        }
+    }
+    return -1;
+}
+
 static void xive2_router_realize(DeviceState *dev, Error **errp)
 {
     Xive2Router *xrtr = XIVE2_ROUTER(dev);
-- 
2.25.4



^ permalink raw reply related	[flat|nested] 25+ messages in thread

* [PATCH 5/9] ppc/pnv: Add a XIVE2 controller to the POWER10 chip.
  2020-05-13 15:11 [PATCH 0/9] ppc/pnv: Introduce the XIVE2 and PHB5 controllers for the POWER10 chip Cédric Le Goater
                   ` (3 preceding siblings ...)
  2020-05-13 15:11 ` [PATCH 4/9] ppc/xive2: Introduce a presenter matching routine Cédric Le Goater
@ 2020-05-13 15:11 ` Cédric Le Goater
  2020-05-19  9:48   ` Greg Kurz
  2020-05-13 15:11 ` [PATCH 6/9] ppc/pnv: Add a OCC model for POWER10 Cédric Le Goater
                   ` (4 subsequent siblings)
  9 siblings, 1 reply; 25+ messages in thread
From: Cédric Le Goater @ 2020-05-13 15:11 UTC (permalink / raw)
  To: David Gibson; +Cc: Cédric Le Goater, qemu-ppc, Greg Kurz, qemu-devel

The XIVE2 interrupt controller of the POWER10 processor follows the
same logic than on POWER9 but the HW interface has been largely
reviewed.  It has a new register interface, different BARs, extra
VSDs, new layout for the XIVE2 structures, and a set of new features
which are described below.

This is a model of the POWER10 XIVE2 interrupt controller for the
PowerNV machine. It focuses primarily on the needs of the skiboot
firmware but some initial hypervisor support is implemented for KVM
use (escalation).

Support for new features will be implemented in time and will require
new support from the OS.

* XIVE2 BARS

The interrupt controller BARs have a different layout outlined below.
Each sub-engine has now own its range and the indirect TIMA access was
replaced with a set of pages, one per CPU, under the IC BAR:

  - IC BAR (Interrupt Controller)
    . 4 pages, one per sub-engine
    . 128 indirect TIMA pages
  - TM BAR (Thread Interrupt Management Area)
    . 4 pages
  - ESB BAR (ESB pages for IPIs)
    . up to 1TB
  - END BAR (ESB pages for ENDs)
    . up to 2TB
  - NVC BAR (Notification Virtual Crowd)
    . up to 128
  - NVPG BAR (Notification Virtual Process and Group)
    . up to 1TB
  - Direct mapped Thread Context Area (reads & writes)

OPAL does not use the grouping and crowd capability.

* Virtual Structure Tables

XIVE2 adds new tables types and also changes the field layout of the END
and NVP Virtualization Structure Descriptors.

  - EAS
  - END new layout
  - NVT was splitted in :
    . NVP (Processor), 32B
    . NVG (Group), 32B
    . NVC (Crowd == P9 block group) 32B
  - IC for remote configuration
  - SYNC for cache injection
  - ERQ for event input queue

The setup is slighly different on XIVE2 because the indexing has changed
for some of the tables, block ID or the chip topology ID can be used.

* XIVE2 features

SCOM and MMIO registers have a new layout and XIVE2 adds a new global
capability and configuration registers.

The lowlevel hardware offers a set of new features among which :

  - a configurable number of priorities : 1 - 8
  - StoreEOI with load-after-store ordering is activated by default
  - Gen2 TIMA layout
  - A P9-compat mode, or Gen1, TIMA toggle bit for SW compatibility
  - increase to 24bit for VP number

Other features will have some impact on the Hypervisor and guest OS
when activated, but this is not required for initial support of the
controller.

Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 hw/intc/pnv_xive2_regs.h   |  428 ++++++++
 include/hw/ppc/pnv.h       |   22 +
 include/hw/ppc/pnv_xive.h  |   71 ++
 include/hw/ppc/pnv_xscom.h |    3 +
 hw/intc/pnv_xive2.c        | 2026 ++++++++++++++++++++++++++++++++++++
 hw/ppc/pnv.c               |   89 +-
 hw/intc/Makefile.objs      |    2 +-
 7 files changed, 2637 insertions(+), 4 deletions(-)
 create mode 100644 hw/intc/pnv_xive2_regs.h
 create mode 100644 hw/intc/pnv_xive2.c

diff --git a/hw/intc/pnv_xive2_regs.h b/hw/intc/pnv_xive2_regs.h
new file mode 100644
index 000000000000..6ad0eee824b1
--- /dev/null
+++ b/hw/intc/pnv_xive2_regs.h
@@ -0,0 +1,428 @@
+/*
+ * QEMU PowerPC XIVE2 interrupt controller model  (POWER10)
+ *
+ * Copyright (c) 2019-2020, IBM Corporation.
+ *
+ * This code is licensed under the GPL version 2 or later. See the
+ * COPYING file in the top-level directory.
+ */
+
+#ifndef PPC_PNV_XIVE2_REGS_H
+#define PPC_PNV_XIVE2_REGS_H
+
+/*
+ * CQ Common Queue (PowerBus bridge) Registers
+ */
+
+/* XIVE2 Capabilities */
+#define X_CQ_XIVE_CAP                           0x02
+#define CQ_XIVE_CAP                             0x010
+#define    CQ_XIVE_CAP_VERSION                  PPC_BITMASK(0, 3)
+/* 4:6 reserved */
+#define    CQ_XIVE_CAP_USER_INT_PRIO            PPC_BITMASK(8, 9)
+#define       CQ_XIVE_CAP_USER_INT_PRIO_1       0
+#define       CQ_XIVE_CAP_USER_INT_PRIO_1_2     1
+#define       CQ_XIVE_CAP_USER_INT_PRIO_1_4     2
+#define       CQ_XIVE_CAP_USER_INT_PRIO_1_8     3
+#define    CQ_XIVE_CAP_VP_INT_PRIO              PPC_BITMASK(10, 11)
+#define       CQ_XIVE_CAP_VP_INT_PRIO_1_8       0
+#define       CQ_XIVE_CAP_VP_INT_PRIO_2_8       1
+#define       CQ_XIVE_CAP_VP_INT_PRIO_4_8       2
+#define       CQ_XIVE_CAP_VP_INT_PRIO_8         3
+#define    CQ_XIVE_CAP_BLOCK_ID_WIDTH           PPC_BITMASK(12, 13)
+
+/* XIVE2 Configuration */
+#define X_CQ_XIVE_CFG                           0x03
+#define CQ_XIVE_CFG                             0x018
+
+/* 0:7 reserved */
+#define    CQ_XIVE_CFG_USER_INT_PRIO            PPC_BITMASK(8, 9)
+#define    CQ_XIVE_CFG_VP_INT_PRIO              PPC_BITMASK(10, 11)
+#define       CQ_XIVE_CFG_INT_PRIO_1            0
+#define       CQ_XIVE_CFG_INT_PRIO_2            1
+#define       CQ_XIVE_CFG_INT_PRIO_4            2
+#define       CQ_XIVE_CFG_INT_PRIO_8            3
+#define    CQ_XIVE_CFG_BLOCK_ID_WIDTH           PPC_BITMASK(12, 13)
+#define       CQ_XIVE_CFG_BLOCK_ID_4BITS        0
+#define       CQ_XIVE_CFG_BLOCK_ID_5BITS        1
+#define       CQ_XIVE_CFG_BLOCK_ID_6BITS        2
+#define       CQ_XIVE_CFG_BLOCK_ID_7BITS        3
+#define    CQ_XIVE_CFG_HYP_HARD_RANGE           PPC_BITMASK(14, 15)
+#define       CQ_XIVE_CFG_THREADID_7BITS        0
+#define       CQ_XIVE_CFG_THREADID_8BITS        1
+#define       CQ_XIVE_CFG_THREADID_9BITS        2
+#define       CQ_XIVE_CFG_THREADID_10BITs       3
+#define    CQ_XIVE_CFG_HYP_HARD_BLKID_OVERRIDE  PPC_BIT(16)
+#define    CQ_XIVE_CFG_HYP_HARD_BLOCK_ID        PPC_BITMASK(17, 23)
+
+/* Interrupt Controller Base Address Register - 512 pages (32M) */
+#define X_CQ_IC_BAR                             0x08
+#define CQ_IC_BAR                               0x040
+#define    CQ_IC_BAR_VALID                      PPC_BIT(0)
+#define    CQ_IC_BAR_64K                        PPC_BIT(1)
+/* 2:7 reserved */
+#define    CQ_IC_BAR_ADDR                       PPC_BITMASK(8, 42)
+/* 43:63 reserved */
+
+/* Thread Management Base Address Register - 4 pages */
+#define X_CQ_TM_BAR                             0x09
+#define CQ_TM_BAR                               0x048
+#define    CQ_TM_BAR_VALID                      PPC_BIT(0)
+#define    CQ_TM_BAR_64K                        PPC_BIT(1)
+#define    CQ_TM_BAR_ADDR                       PPC_BITMASK(8, 49)
+
+/* ESB Base Address Register */
+#define X_CQ_ESB_BAR                            0x0A
+#define CQ_ESB_BAR                              0x050
+#define    CQ_BAR_VALID                         PPC_BIT(0)
+#define    CQ_BAR_64K                           PPC_BIT(1)
+/* 2:7 reserved */
+#define    CQ_BAR_ADDR                          PPC_BITMASK(8, 39)
+#define    CQ_BAR_SET_DIV                       PPC_BITMASK(56, 58)
+#define    CQ_BAR_RANGE                         PPC_BITMASK(59, 63)
+                                                /* 0 (16M) - 16 (16T) */
+
+/* END Base Address Register */
+#define X_CQ_END_BAR                            0x0B
+#define CQ_END_BAR                              0x058
+
+/* NVPG Base Address Register */
+#define X_CQ_NVPG_BAR                           0x0C
+#define CQ_NVPG_BAR                             0x060
+
+/* NVC Base Address Register */
+#define X_CQ_NVC_BAR                            0x0D
+#define CQ_NVC_BAR                              0x068
+
+/* Table Address Register */
+#define X_CQ_TAR                                0x0E
+#define CQ_TAR                                  0x070
+#define     CQ_TAR_AUTOINC                      PPC_BIT(0)
+#define     CQ_TAR_SELECT                       PPC_BITMASK(12, 15)
+#define     CQ_TAR_ESB                          0       /* 0 - 15 */
+#define     CQ_TAR_END                          2       /* 0 - 15 */
+#define     CQ_TAR_NVPG                         3       /* 0 - 15 */
+#define     CQ_TAR_NVC                          5       /* 0 - 15 */
+#define     CQ_TAR_ENTRY_SELECT                 PPC_BITMASK(28, 31)
+
+/* Table Data Register */
+#define X_CQ_TDR                                0x0F
+#define CQ_TDR                                  0x078
+/* for the NVPG, NVC, ESB, END Set Translation Tables */
+#define     CQ_TDR_VALID                        PPC_BIT(0)
+#define     CQ_TDR_BLOCK_ID                     PPC_BITMASK(60, 63)
+
+/*
+ * Processor Cores Enabled for MsgSnd
+ * Identifies which of the 32 possible core chiplets are enabled and
+ * available to receive the MsgSnd command
+ */
+#define X_CQ_MSGSND                             0x10
+#define CQ_MSGSND                               0x080
+
+/* Interrupt Unit Reset Control */
+#define X_CQ_RST_CTL                            0x12
+#define CQ_RST_CTL                              0x090
+#define     CQ_RST_SYNC_RESET                   PPC_BIT(0)      /* Write Only */
+#define     CQ_RST_QUIESCE_PB                   PPC_BIT(1)      /* RW */
+#define     CQ_RST_MASTER_IDLE                  PPC_BIT(2)      /* Read Only */
+#define     CQ_RST_SAVE_IDLE                    PPC_BIT(3)      /* Read Only */
+#define     CQ_RST_PB_BAR_RESET                 PPC_BIT(4)      /* Write Only */
+
+/* PowerBus General Configuration */
+#define X_CQ_CFG_PB_GEN                         0x14
+#define CQ_CFG_PB_GEN                           0x0A0
+#define    CQ_CFG_PB_GEN_PB_INIT                PPC_BIT(45)
+
+/*
+ * FIR
+ *     (And-Mask)
+ *     (Or-Mask)
+ */
+#define X_CQ_FIR                                0x30
+#define X_CQ_FIR_AND                            0x31
+#define X_CQ_FIR_OR                             0x32
+#define CQ_FIR                                  0x180
+#define CQ_FIR_AND                              0x188
+#define CQ_FIR_OR                               0x190
+#define  CQ_FIR_PB_RCMDX_CI_ERR1                PPC_BIT(19)
+#define  CQ_FIR_VC_INFO_ERROR_0_2               PPC_BITMASK(61, 63)
+
+/*
+ * FIR Mask
+ *     (And-Mask)
+ *     (Or-Mask)
+ */
+#define X_CQ_FIRMASK                            0x33
+#define X_CQ_FIRMASK_AND                        0x34
+#define X_CQ_FIRMASK_OR                         0x35
+#define CQ_FIRMASK                              0x198
+#define CQ_FIRMASK_AND                          0x1A0
+#define CQ_FIRMASK_OR                           0x1A8
+
+/*
+ * VC0
+ */
+
+/* VSD table address */
+#define X_VC_VSD_TABLE_ADDR                     0x100
+#define VC_VSD_TABLE_ADDR                       0x000
+#define   VC_VSD_TABLE_AUTOINC                  PPC_BIT(0)
+#define   VC_VSD_TABLE_SELECT                   PPC_BITMASK(12, 15)
+#define   VC_VSD_TABLE_ADDRESS                  PPC_BITMASK(28, 31)
+
+/* VSD table data */
+#define X_VC_VSD_TABLE_DATA                     0x101
+#define VC_VSD_TABLE_DATA                       0x008
+
+/* AIB AT macro indirect kill */
+#define X_VC_AT_MACRO_KILL                      0x102
+#define VC_AT_MACRO_KILL                        0x010
+#define  VC_AT_MACRO_KILL_VALID                 PPC_BIT(0)
+#define  VC_AT_MACRO_KILL_VSD                   PPC_BITMASK(12, 15)
+#define  VC_AT_MACRO_KILL_BLOCK_ID              PPC_BITMASK(28, 31)
+#define  VC_AT_MACRO_KILL_OFFSET                PPC_BITMASK(48, 60)
+
+/* AIB AT macro indirect kill mask (same bit definitions) */
+#define X_VC_AT_MACRO_KILL_MASK                 0x103
+#define VC_AT_MACRO_KILL_MASK                   0x018
+
+/* Remote IRQs and ERQs configuration [n] (n = 0:6) */
+#define X_VC_QUEUES_CFG_REM0                    0x117
+
+#define VC_QUEUES_CFG_REM0                      0x0B8
+#define VC_QUEUES_CFG_REM1                      0x0C0
+#define VC_QUEUES_CFG_REM2                      0x0C8
+#define VC_QUEUES_CFG_REM3                      0x0D0
+#define VC_QUEUES_CFG_REM4                      0x0D8
+#define VC_QUEUES_CFG_REM5                      0x0E0
+#define VC_QUEUES_CFG_REM6                      0x0E8
+#define  VC_QUEUES_CFG_MEMB_EN                  PPC_BIT(38)
+#define  VC_QUEUES_CFG_MEMB_SZ                  PPC_BITMASK(42, 47)
+
+/*
+ * VC1
+ */
+
+/* ESBC cache flush control trigger */
+#define X_VC_ESBC_FLUSH_CTRL                    0x140
+#define VC_ESBC_FLUSH_CTRL                      0x200
+#define  VC_ESBC_FLUSH_CTRL_POLL_VALID          PPC_BIT(0)
+#define  VC_ESBC_FLUSH_CTRL_WANT_CACHE_DISABLE  PPC_BIT(2)
+
+/* ESBC cache flush poll trigger */
+#define X_VC_ESBC_FLUSH_POLL                    0x141
+#define VC_ESBC_FLUSH_POLL                      0x208
+#define  VC_ESBC_FLUSH_POLL_BLOCK_ID            PPC_BITMASK(0, 3)
+#define  VC_ESBC_FLUSH_POLL_OFFSET              PPC_BITMASK(4, 31)  /* 28-bit */
+#define  VC_ESBC_FLUSH_POLL_BLOCK_ID_MASK       PPC_BITMASK(32, 35)
+#define  VC_ESBC_FLUSH_POLL_OFFSET_MASK         PPC_BITMASK(36, 63) /* 28-bit */
+
+/* EASC flush control register */
+#define X_VC_EASC_FLUSH_CTRL                    0x160
+#define VC_EASC_FLUSH_CTRL                      0x300
+#define  VC_EASC_FLUSH_CTRL_POLL_VALID          PPC_BIT(0)
+#define  VC_EASC_FLUSH_CTRL_WANT_CACHE_DISABLE  PPC_BIT(2)
+
+/* EASC flush poll register */
+#define X_VC_EASC_FLUSH_POLL                    0x161
+#define VC_EASC_FLUSH_POLL                      0x308
+#define  VC_EASC_FLUSH_POLL_BLOCK_ID            PPC_BITMASK(0, 3)
+#define  VC_EASC_FLUSH_POLL_OFFSET              PPC_BITMASK(4, 31)  /* 28-bit */
+#define  VC_EASC_FLUSH_POLL_BLOCK_ID_MASK       PPC_BITMASK(32, 35)
+#define  VC_EASC_FLUSH_POLL_OFFSET_MASK         PPC_BITMASK(36, 63) /* 28-bit */
+
+/*
+ * VC2
+ */
+
+/* ENDC flush control register */
+#define X_VC_ENDC_FLUSH_CTRL                    0x180
+#define VC_ENDC_FLUSH_CTRL                      0x400
+#define  VC_ENDC_FLUSH_CTRL_POLL_VALID          PPC_BIT(0)
+#define  VC_ENDC_FLUSH_CTRL_WANT_CACHE_DISABLE  PPC_BIT(2)
+#define  VC_ENDC_FLUSH_CTRL_WANT_INVALIDATE     PPC_BIT(3)
+#define  VC_ENDC_FLUSH_CTRL_INJECT_INVALIDATE   PPC_BIT(7)
+
+/* ENDC flush poll register */
+#define X_VC_ENDC_FLUSH_POLL                    0x181
+#define VC_ENDC_FLUSH_POLL                      0x408
+#define  VC_ENDC_FLUSH_POLL_BLOCK_ID            PPC_BITMASK(4, 7)
+#define  VC_ENDC_FLUSH_POLL_OFFSET              PPC_BITMASK(8, 31)  /* 24-bit */
+#define  VC_ENDC_FLUSH_POLL_BLOCK_ID_MASK       PPC_BITMASK(36, 39)
+#define  VC_ENDC_FLUSH_POLL_OFFSET_MASK         PPC_BITMASK(40, 63) /* 24-bit */
+
+/* ENDC Sync done */
+#define X_VC_ENDC_SYNC_DONE                     0x184
+#define VC_ENDC_SYNC_DONE                       0x420
+#define   VC_ENDC_SYNC_POLL_DONE                PPC_BITMASK(0, 6)
+#define   VC_ENDC_SYNC_QUEUE_IPI                PPC_BIT(0)
+#define   VC_ENDC_SYNC_QUEUE_HWD                PPC_BIT(1)
+#define   VC_ENDC_SYNC_QUEUE_NXC                PPC_BIT(2)
+#define   VC_ENDC_SYNC_QUEUE_INT                PPC_BIT(3)
+#define   VC_ENDC_SYNC_QUEUE_OS                 PPC_BIT(4)
+#define   VC_ENDC_SYNC_QUEUE_POOL               PPC_BIT(5)
+#define   VC_ENDC_SYNC_QUEUE_HARD               PPC_BIT(6)
+#define   VC_QUEUE_COUNT                        7
+
+/* ENDC cache watch specification 0  */
+#define X_VC_ENDC_WATCH0_SPEC                   0x1A0
+#define VC_ENDC_WATCH0_SPEC                     0x500
+#define   VC_ENDC_WATCH_CONFLICT                PPC_BIT(0)
+#define   VC_ENDC_WATCH_FULL                    PPC_BIT(8)
+#define   VC_ENDC_WATCH_BLOCK_ID                PPC_BITMASK(28, 31)
+#define   VC_ENDC_WATCH_INDEX                   PPC_BITMASK(40, 63)
+
+/* ENDC cache watch data 0 */
+#define X_VC_ENDC_WATCH0_DATA0                  0x1A4
+#define X_VC_ENDC_WATCH0_DATA1                  0x1A5
+#define X_VC_ENDC_WATCH0_DATA2                  0x1A6
+#define X_VC_ENDC_WATCH0_DATA3                  0x1A7
+
+#define VC_ENDC_WATCH0_DATA0                    0x520
+#define VC_ENDC_WATCH0_DATA1                    0x528
+#define VC_ENDC_WATCH0_DATA2                    0x530
+#define VC_ENDC_WATCH0_DATA3                    0x538
+
+/*
+ * PC LSB1
+ */
+
+/* VSD table address register */
+#define X_PC_VSD_TABLE_ADDR                     0x200
+#define PC_VSD_TABLE_ADDR                       0x000
+#define   PC_VSD_TABLE_AUTOINC                  PPC_BIT(0)
+#define   PC_VSD_TABLE_SELECT                   PPC_BITMASK(12, 15)
+#define   PC_VSD_TABLE_ADDRESS                  PPC_BITMASK(28, 31)
+
+/* VSD table data register */
+#define X_PC_VSD_TABLE_DATA                     0x201
+#define PC_VSD_TABLE_DATA                       0x008
+
+/* AT indirect kill register */
+#define X_PC_AT_KILL                            0x202
+#define PC_AT_KILL                              0x010
+#define     PC_AT_KILL_VALID                    PPC_BIT(0)
+#define     PC_AT_KILL_VSD_TYPE                 PPC_BITMASK(24, 27)
+/* Only NVP, NVG, NVC */
+#define     PC_AT_KILL_BLOCK_ID                 PPC_BITMASK(28, 31)
+#define     PC_AT_KILL_OFFSET                   PPC_BITMASK(48, 60)
+
+/* AT indirect kill mask register */
+#define X_PC_AT_KILL_MASK                       0x203
+#define PC_AT_KILL_MASK                         0x018
+#define     PC_AT_KILL_MASK_VSD_TYPE            PPC_BITMASK(24, 27)
+#define     PC_AT_KILL_MASK_BLOCK_ID            PPC_BITMASK(28, 31)
+#define     PC_AT_KILL_MASK_OFFSET              PPC_BITMASK(48, 60)
+
+/*
+ * PC LSB2
+ */
+
+/* NxC Cache flush control */
+#define X_PC_NXC_FLUSH_CTRL                     0x280
+#define PC_NXC_FLUSH_CTRL                       0x400
+#define  PC_NXC_FLUSH_CTRL_POLL_VALID           PPC_BIT(0)
+#define  PC_NXC_FLUSH_CTRL_WANT_CACHE_DISABLE   PPC_BIT(2)
+#define  PC_NXC_FLUSH_CTRL_WANT_INVALIDATE      PPC_BIT(3)
+#define  PC_NXC_FLUSH_CTRL_INJECT_INVALIDATE    PPC_BIT(7)
+
+/* NxC Cache flush poll */
+#define X_PC_NXC_FLUSH_POLL                     0x281
+#define PC_NXC_FLUSH_POLL                       0x408
+#define  PC_NXC_FLUSH_POLL_NXC_TYPE             PPC_BITMASK(2, 3)
+#define    PC_NXC_FLUSH_POLL_NXC_TYPE_NVP       0
+#define    PC_NXC_FLUSH_POLL_NXC_TYPE_NVG       2
+#define    PC_NXC_FLUSH_POLL_NXC_TYPE_NVC       3
+#define  PC_NXC_FLUSH_POLL_BLOCK_ID             PPC_BITMASK(4, 7)
+#define  PC_NXC_FLUSH_POLL_OFFSET               PPC_BITMASK(8, 31)  /* 24-bit */
+#define  PC_NXC_FLUSH_POLL_NXC_TYPE_MASK        PPC_BITMASK(34, 35) /* 0: Ign */
+#define  PC_NXC_FLUSH_POLL_BLOCK_ID_MASK        PPC_BITMASK(36, 39)
+#define  PC_NXC_FLUSH_POLL_OFFSET_MASK          PPC_BITMASK(40, 63) /* 24-bit */
+
+/* NxC Cache Watch 0 Specification */
+#define X_PC_NXC_WATCH0_SPEC                    0x2A0
+#define PC_NXC_WATCH0_SPEC                      0x500
+#define   PC_NXC_WATCH_CONFLICT                 PPC_BIT(0)
+#define   PC_NXC_WATCH_FULL                     PPC_BIT(8)
+#define   PC_NXC_WATCH_NXC_TYPE                 PPC_BITMASK(26, 37)
+#define     PC_NXC_WATCH_NXC_NVP                0
+#define     PC_NXC_WATCH_NXC_NVG                2
+#define     PC_NXC_WATCH_NXC_NVC                3
+#define   PC_NXC_WATCH_BLOCK_ID                 PPC_BITMASK(28, 31)
+#define   PC_NXC_WATCH_INDEX                    PPC_BITMASK(40, 63)
+
+/* NxC Cache Watch 0 Data */
+#define X_PC_NXC_WATCH0_DATA0                   0x2A4
+#define X_PC_NXC_WATCH0_DATA1                   0x2A5
+#define X_PC_NXC_WATCH0_DATA2                   0x2A6
+#define X_PC_NXC_WATCH0_DATA3                   0x2A7
+
+#define PC_NXC_WATCH0_DATA0                     0x520
+#define PC_NXC_WATCH0_DATA1                     0x528
+#define PC_NXC_WATCH0_DATA2                     0x530
+#define PC_NXC_WATCH0_DATA3                     0x538
+
+/*
+ * TCTXT Registers
+ */
+
+/* Physical Thread Enable0 register */
+#define X_TCTXT_EN0                             0x300
+#define TCTXT_EN0                               0x000
+
+/* Physical Thread Enable0 Set register */
+#define X_TCTXT_EN0_SET                         0x302
+#define TCTXT_EN0_SET                           0x010
+
+/* Physical Thread Enable0 Reset register */
+#define X_TCTXT_EN0_RESET                       0x303
+#define TCTXT_EN0_RESET                         0x018
+
+/* Physical Thread Enable1 register */
+#define X_TCTXT_EN1                             0x304
+#define TCTXT_EN1                               0x020
+
+/* Physical Thread Enable1 Set register */
+#define X_TCTXT_EN1_SET                         0x306
+#define TCTXT_EN1_SET                           0x030
+
+/* Physical Thread Enable1 Reset register */
+#define X_TCTXT_EN1_RESET                       0x307
+#define TCTXT_EN1_RESET                         0x038
+
+/*
+ * VSD Tables
+ */
+#define VST_ESB                  0
+#define VST_EAS                  1 /* No used by PC */
+#define VST_END                  2
+#define VST_NVP                  3
+#define VST_NVG                  4
+#define VST_NVC                  5
+#define VST_IC                   6 /* No used by PC */
+#define VST_SYNC                 7
+#define VST_ERQ                  8 /* No used by PC */
+
+/*
+ * Bits in a VSD entry.
+ *
+ * Note: the address is naturally aligned, we don't use a PPC_BITMASK,
+ *       but just a mask to apply to the address before OR'ing it in.
+ *
+ * Note: VSD_FIRMWARE is a SW bit ! It hijacks an unused bit in the
+ *       VSD and is only meant to be used in indirect mode !
+ */
+#define VSD_MODE                PPC_BITMASK(0, 1)
+#define  VSD_MODE_SHARED        1
+#define  VSD_MODE_EXCLUSIVE     2
+#define  VSD_MODE_FORWARD       3
+#define VSD_FIRMWARE            PPC_BIT(2) /* Read warning */
+#define VSD_FIRMWARE2           PPC_BIT(3) /* unused */
+#define VSD_RESERVED            PPC_BITMASK(4, 7) /* P10 reserved */
+#define VSD_ADDRESS_MASK        0x00fffffffffff000ull
+#define VSD_MIGRATION_REG       PPC_BITMASK(52, 55)
+#define VSD_INDIRECT            PPC_BIT(56)
+#define VSD_TSIZE               PPC_BITMASK(59, 63)
+
+#endif /* PPC_PNV_XIVE2_REGS_H */
diff --git a/include/hw/ppc/pnv.h b/include/hw/ppc/pnv.h
index d4b0b0e2ff71..f318bb10add4 100644
--- a/include/hw/ppc/pnv.h
+++ b/include/hw/ppc/pnv.h
@@ -119,10 +119,14 @@ typedef struct Pnv10Chip {
     PnvChip      parent_obj;
 
     /*< public >*/
+    PnvXive2     xive;
     Pnv9Psi      psi;
     PnvLpcController lpc;
 } Pnv10Chip;
 
+#define PNV10_PIR2FUSEDCORE(pir) (((pir) >> 3) & 0xf)
+#define PNV10_PIR2CHIP(pir)      (((pir) >> 8) & 0x7f)
+
 typedef struct PnvChipClass {
     /*< private >*/
     SysBusDeviceClass parent_class;
@@ -340,10 +344,28 @@ void pnv_bmc_set_pnor(IPMIBmc *bmc, PnvPnor *pnor);
 #define PNV10_LPCM_SIZE             0x0000000100000000ull
 #define PNV10_LPCM_BASE(chip)       PNV10_CHIP_BASE(chip, 0x0006030000000000ull)
 
+#define PNV10_XIVE2_IC_SIZE         0x0000000002000000ull
+#define PNV10_XIVE2_IC_BASE(chip)   PNV10_CHIP_BASE(chip, 0x0006030200000000ull)
+
 #define PNV10_PSIHB_ESB_SIZE        0x0000000000100000ull
 #define PNV10_PSIHB_ESB_BASE(chip)  PNV10_CHIP_BASE(chip, 0x0006030202000000ull)
 
 #define PNV10_PSIHB_SIZE            0x0000000000100000ull
 #define PNV10_PSIHB_BASE(chip)      PNV10_CHIP_BASE(chip, 0x0006030203000000ull)
 
+#define PNV10_XIVE2_TM_SIZE         0x0000000000040000ull
+#define PNV10_XIVE2_TM_BASE(chip)   PNV10_CHIP_BASE(chip, 0x0006030203180000ull)
+
+#define PNV10_XIVE2_NVC_SIZE        0x0000000008000000ull
+#define PNV10_XIVE2_NVC_BASE(chip)  PNV10_CHIP_BASE(chip, 0x0006030208000000ull)
+
+#define PNV10_XIVE2_NVPG_SIZE       0x0000010000000000ull
+#define PNV10_XIVE2_NVPG_BASE(chip) PNV10_CHIP_BASE(chip, 0x0006040000000000ull)
+
+#define PNV10_XIVE2_ESB_SIZE        0x0000010000000000ull
+#define PNV10_XIVE2_ESB_BASE(chip)  PNV10_CHIP_BASE(chip, 0x0006050000000000ull)
+
+#define PNV10_XIVE2_END_SIZE        0x0000020000000000ull
+#define PNV10_XIVE2_END_BASE(chip)  PNV10_CHIP_BASE(chip, 0x0006060000000000ull)
+
 #endif /* PPC_PNV_H */
diff --git a/include/hw/ppc/pnv_xive.h b/include/hw/ppc/pnv_xive.h
index 76cf16f64472..7d8630775786 100644
--- a/include/hw/ppc/pnv_xive.h
+++ b/include/hw/ppc/pnv_xive.h
@@ -11,6 +11,7 @@
 #define PPC_PNV_XIVE_H
 
 #include "hw/ppc/xive.h"
+#include "hw/ppc/xive2.h"
 
 struct PnvChip;
 
@@ -97,4 +98,74 @@ typedef struct PnvXiveClass {
 
 void pnv_xive_pic_print_info(PnvXive *xive, Monitor *mon);
 
+/*
+ * XIVE2 interrupt controller (POWER10)
+ */
+#define TYPE_PNV_XIVE2 TYPE_PNV_XIVE "2"
+#define PNV_XIVE2(obj) OBJECT_CHECK(PnvXive2, (obj), TYPE_PNV_XIVE2)
+#define PNV_XIVE2_CLASS(klass)                                   \
+    OBJECT_CLASS_CHECK(PnvXive2Class, (klass), TYPE_PNV_XIVE2)
+#define PNV_XIVE2_GET_CLASS(obj)                                 \
+    OBJECT_GET_CLASS(PnvXive2Class, (obj), TYPE_PNV_XIVE2)
+
+typedef struct PnvXive2 {
+    Xive2Router   parent_obj;
+
+    /* Owning chip */
+    struct PnvChip *chip;
+
+    /* XSCOM addresses giving access to the controller registers */
+    MemoryRegion  xscom_regs;
+
+    MemoryRegion  ic_mmio;
+    MemoryRegion  ic_mmios[8];
+    MemoryRegion  esb_mmio;
+    MemoryRegion  end_mmio;
+    MemoryRegion  nvc_mmio;
+    MemoryRegion  nvpg_mmio;
+    MemoryRegion  tm_mmio;
+
+    /* Shortcut values for the Main MMIO regions */
+    hwaddr        ic_base;
+    uint32_t      ic_shift;
+    hwaddr        esb_base;
+    uint32_t      esb_shift;
+    hwaddr        end_base;
+    uint32_t      end_shift;
+    hwaddr        nvc_base;
+    uint32_t      nvc_shift;
+    hwaddr        nvpg_base;
+    uint32_t      nvpg_shift;
+    hwaddr        tm_base;
+    uint32_t      tm_shift;
+
+    /* Interrupt controller registers */
+    uint64_t      cq_regs[0x40];
+    uint64_t      vc_regs[0x100];
+    uint64_t      pc_regs[0x100];
+    uint64_t      tctxt_regs[0x30];
+
+    /* Our XIVE source objects for IPIs and ENDs */
+    XiveSource    ipi_source;
+    Xive2EndSource end_source;
+
+    /*
+     * Virtual Structure Descriptor tables
+     * These are in a SRAM protected by ECC.
+     */
+    uint64_t      vsds[9][XIVE_BLOCK_MAX];
+
+    /* Translation tables */
+    uint64_t      tables[8][XIVE_BLOCK_MAX];
+
+} PnvXive2;
+
+typedef struct PnvXive2Class {
+    Xive2RouterClass parent_class;
+
+    DeviceRealize parent_realize;
+} PnvXive2Class;
+
+void pnv_xive2_pic_print_info(PnvXive2 *xive, Monitor *mon);
+
 #endif /* PPC_PNV_XIVE_H */
diff --git a/include/hw/ppc/pnv_xscom.h b/include/hw/ppc/pnv_xscom.h
index 09156a5a7a6f..1211add3e79c 100644
--- a/include/hw/ppc/pnv_xscom.h
+++ b/include/hw/ppc/pnv_xscom.h
@@ -133,6 +133,9 @@ typedef struct PnvXScomInterfaceClass {
 #define PNV10_XSCOM_PSIHB_BASE     0x3011D00
 #define PNV10_XSCOM_PSIHB_SIZE     0x100
 
+#define PNV10_XSCOM_XIVE2_BASE     0x2010800
+#define PNV10_XSCOM_XIVE2_SIZE     0x400
+
 void pnv_xscom_realize(PnvChip *chip, uint64_t size, Error **errp);
 int pnv_dt_xscom(PnvChip *chip, void *fdt, int root_offset,
                  uint64_t xscom_base, uint64_t xscom_size,
diff --git a/hw/intc/pnv_xive2.c b/hw/intc/pnv_xive2.c
new file mode 100644
index 000000000000..761e9406315a
--- /dev/null
+++ b/hw/intc/pnv_xive2.c
@@ -0,0 +1,2026 @@
+/*
+ * QEMU PowerPC XIVE2 interrupt controller model  (POWER10)
+ *
+ * Copyright (c) 2019-2020, IBM Corporation.
+ *
+ * This code is licensed under the GPL version 2 or later. See the
+ * COPYING file in the top-level directory.
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/log.h"
+#include "qapi/error.h"
+#include "target/ppc/cpu.h"
+#include "sysemu/cpus.h"
+#include "sysemu/dma.h"
+#include "monitor/monitor.h"
+#include "hw/ppc/fdt.h"
+#include "hw/ppc/pnv.h"
+#include "hw/ppc/pnv_core.h"
+#include "hw/ppc/pnv_xscom.h"
+#include "hw/ppc/xive2.h"
+#include "hw/ppc/pnv_xive.h"
+#include "hw/ppc/xive_regs.h"
+#include "hw/ppc/xive2_regs.h"
+#include "hw/ppc/ppc.h"
+#include "hw/qdev-properties.h"
+#include "sysemu/reset.h"
+
+#include <libfdt.h>
+
+#include "pnv_xive2_regs.h"
+
+#undef XIVE2_DEBUG
+
+/*
+ * Virtual structures table (VST)
+ */
+#define SBE_PER_BYTE   4
+
+typedef struct XiveVstInfo {
+    const char *name;
+    uint32_t    size;
+    uint32_t    max_blocks;
+} XiveVstInfo;
+
+static const XiveVstInfo vst_infos[] = {
+
+    [VST_EAS]  = { "EAT",  sizeof(Xive2Eas),  16 },
+    [VST_ESB]  = { "ESB",  1,                  16 },
+    [VST_END]  = { "ENDT", sizeof(Xive2End),  16 },
+
+    [VST_NVP]  = { "NVPT", sizeof(Xive2Nvp),  16 },
+    [VST_NVG]  = { "NVGT", sizeof(Xive2Nvgc), 16 },
+    [VST_NVC]  = { "NVCT", sizeof(Xive2Nvgc), 16 },
+
+    [VST_IC]  =  { "IC",   1 /* ? */         , 16 }, /* Topology # */
+    [VST_SYNC] = { "SYNC", 1 /* ? */         , 16 }, /* Topology # */
+
+    /*
+     * This table contains the backing store pages for the interrupt
+     * fifos of the VC sub-engine in case of overflow.
+     *
+     * 0 - IPI,
+     * 1 - HWD,
+     * 2 - NxC,
+     * 3 - INT,
+     * 4 - OS-Queue,
+     * 5 - Pool-Queue,
+     * 6 - Hard-Queue
+     */
+    [VST_ERQ]  = { "ERQ",  1,                   VC_QUEUE_COUNT },
+};
+
+#define xive2_error(xive, fmt, ...)                                      \
+    qemu_log_mask(LOG_GUEST_ERROR, "XIVE[%x] - " fmt "\n",              \
+                  (xive)->chip->chip_id, ## __VA_ARGS__);
+
+/*
+ * QEMU version of the GETFIELD/SETFIELD macros
+ *
+ * TODO: It might be better to use the existing extract64() and
+ * deposit64() but this means that all the register definitions will
+ * change and become incompatible with the ones found in skiboot.
+ *
+ * Keep it as it is for now until we find a common ground.
+ */
+static inline uint64_t GETFIELD(uint64_t mask, uint64_t word)
+{
+    return (word & mask) >> ctz64(mask);
+}
+
+static inline uint64_t SETFIELD(uint64_t mask, uint64_t word,
+                                uint64_t value)
+{
+    return (word & ~mask) | ((value << ctz64(mask)) & mask);
+}
+
+/*
+ * TODO: Document block id override
+ */
+static uint32_t pnv_xive2_block_id(PnvXive2 *xive)
+{
+    uint8_t blk = xive->chip->chip_id;
+    uint64_t cfg_val = xive->cq_regs[CQ_XIVE_CFG >> 3];
+
+    if (cfg_val & CQ_XIVE_CFG_HYP_HARD_BLKID_OVERRIDE) {
+        blk = GETFIELD(CQ_XIVE_CFG_HYP_HARD_BLOCK_ID, cfg_val);
+    }
+
+    return blk;
+}
+
+/*
+ * Remote access to controllers. HW uses MMIOs. For now, a simple scan
+ * of the chips is good enough.
+ *
+ * TODO: Block scope support
+ */
+static PnvXive2 *pnv_xive2_get_remote(uint8_t blk)
+{
+    PnvMachineState *pnv = PNV_MACHINE(qdev_get_machine());
+    int i;
+
+    for (i = 0; i < pnv->num_chips; i++) {
+        Pnv10Chip *chip10 = PNV10_CHIP(pnv->chips[i]);
+        PnvXive2 *xive = &chip10->xive;
+
+        if (pnv_xive2_block_id(xive) == blk) {
+            return xive;
+        }
+    }
+    return NULL;
+}
+
+/*
+ * VST accessors for ESB, EAT, ENDT, NVP
+ *
+ * Indirect VST tables are arrays of VSDs pointing to a page (of same
+ * size). Each page is a direct VST table.
+ */
+
+#define XIVE_VSD_SIZE 8
+
+/* Indirect page size can be 4K, 64K, 2M, 16M. */
+static uint64_t pnv_xive2_vst_page_size_allowed(uint32_t page_shift)
+{
+     return page_shift == 12 || page_shift == 16 ||
+         page_shift == 21 || page_shift == 24;
+}
+
+static uint64_t pnv_xive2_vst_addr_direct(PnvXive2 *xive, uint32_t type,
+                                         uint64_t vsd, uint32_t idx)
+{
+    const XiveVstInfo *info = &vst_infos[type];
+    uint64_t vst_addr = vsd & VSD_ADDRESS_MASK;
+    uint64_t vst_tsize = 1ull << (GETFIELD(VSD_TSIZE, vsd) + 12);
+    uint32_t idx_max;
+
+    idx_max = vst_tsize / info->size - 1;
+    if (idx > idx_max) {
+#ifdef XIVE2_DEBUG
+        xive2_error(xive, "VST: %s entry %x out of range [ 0 .. %x ] !?",
+                   info->name, idx, idx_max);
+#endif
+        return 0;
+    }
+
+    return vst_addr + idx * info->size;
+}
+
+static uint64_t pnv_xive2_vst_addr_indirect(PnvXive2 *xive, uint32_t type,
+                                           uint64_t vsd, uint32_t idx)
+{
+    const XiveVstInfo *info = &vst_infos[type];
+    uint64_t vsd_addr;
+    uint32_t vsd_idx;
+    uint32_t page_shift;
+    uint32_t vst_per_page;
+
+    /* Get the page size of the indirect table. */
+    vsd_addr = vsd & VSD_ADDRESS_MASK;
+    vsd = ldq_be_dma(&address_space_memory, vsd_addr);
+
+    if (!(vsd & VSD_ADDRESS_MASK)) {
+        xive2_error(xive, "VST: invalid %s entry %x !?", info->name, idx);
+        return 0;
+    }
+
+    page_shift = GETFIELD(VSD_TSIZE, vsd) + 12;
+
+    if (!pnv_xive2_vst_page_size_allowed(page_shift)) {
+        xive2_error(xive, "VST: invalid %s page shift %d", info->name,
+                   page_shift);
+        return 0;
+    }
+
+    vst_per_page = (1ull << page_shift) / info->size;
+    vsd_idx = idx / vst_per_page;
+
+    /* Load the VSD we are looking for, if not already done */
+    if (vsd_idx) {
+        vsd_addr = vsd_addr + vsd_idx * XIVE_VSD_SIZE;
+        vsd = ldq_be_dma(&address_space_memory, vsd_addr);
+
+        if (!(vsd & VSD_ADDRESS_MASK)) {
+            xive2_error(xive, "VST: invalid %s entry %x !?", info->name, idx);
+            return 0;
+        }
+
+        /*
+         * Check that the pages have a consistent size across the
+         * indirect table
+         */
+        if (page_shift != GETFIELD(VSD_TSIZE, vsd) + 12) {
+            xive2_error(xive, "VST: %s entry %x indirect page size differ !?",
+                       info->name, idx);
+            return 0;
+        }
+    }
+
+    return pnv_xive2_vst_addr_direct(xive, type, vsd, (idx % vst_per_page));
+}
+
+static uint64_t pnv_xive2_vst_addr(PnvXive2 *xive, uint32_t type, uint8_t blk,
+                                  uint32_t idx)
+{
+    const XiveVstInfo *info = &vst_infos[type];
+    uint64_t vsd;
+
+    if (blk >= info->max_blocks) {
+        xive2_error(xive, "VST: invalid block id %d for VST %s %d !?",
+                   blk, info->name, idx);
+        return 0;
+    }
+
+    vsd = xive->vsds[type][blk];
+
+    /* Remote VST access */
+    if (GETFIELD(VSD_MODE, vsd) == VSD_MODE_FORWARD) {
+        xive = pnv_xive2_get_remote(blk);
+
+        return xive ? pnv_xive2_vst_addr(xive, type, blk, idx) : 0;
+    }
+
+    if (VSD_INDIRECT & vsd) {
+        return pnv_xive2_vst_addr_indirect(xive, type, vsd, idx);
+    }
+
+    return pnv_xive2_vst_addr_direct(xive, type, vsd, idx);
+}
+
+static int pnv_xive2_vst_read(PnvXive2 *xive, uint32_t type, uint8_t blk,
+                             uint32_t idx, void *data)
+{
+    const XiveVstInfo *info = &vst_infos[type];
+    uint64_t addr = pnv_xive2_vst_addr(xive, type, blk, idx);
+
+    if (!addr) {
+        return -1;
+    }
+
+    cpu_physical_memory_read(addr, data, info->size);
+    return 0;
+}
+
+#define XIVE_VST_WORD_ALL -1
+
+static int pnv_xive2_vst_write(PnvXive2 *xive, uint32_t type, uint8_t blk,
+                              uint32_t idx, void *data, uint32_t word_number)
+{
+    const XiveVstInfo *info = &vst_infos[type];
+    uint64_t addr = pnv_xive2_vst_addr(xive, type, blk, idx);
+
+    if (!addr) {
+        return -1;
+    }
+
+    if (word_number == XIVE_VST_WORD_ALL) {
+        cpu_physical_memory_write(addr, data, info->size);
+    } else {
+        cpu_physical_memory_write(addr + word_number * 4,
+                                  data + word_number * 4, 4);
+    }
+    return 0;
+}
+
+static int pnv_xive2_get_end(Xive2Router *xrtr, uint8_t blk, uint32_t idx,
+                            Xive2End *end)
+{
+    return pnv_xive2_vst_read(PNV_XIVE2(xrtr), VST_END, blk, idx, end);
+}
+
+static int pnv_xive2_write_end(Xive2Router *xrtr, uint8_t blk, uint32_t idx,
+                              Xive2End *end, uint8_t word_number)
+{
+    return pnv_xive2_vst_write(PNV_XIVE2(xrtr), VST_END, blk, idx, end,
+                              word_number);
+}
+
+static int pnv_xive2_end_update(PnvXive2 *xive)
+{
+    uint8_t  blk = GETFIELD(VC_ENDC_WATCH_BLOCK_ID,
+                           xive->vc_regs[(VC_ENDC_WATCH0_SPEC >> 3)]);
+    uint32_t idx = GETFIELD(VC_ENDC_WATCH_INDEX,
+                           xive->vc_regs[(VC_ENDC_WATCH0_SPEC >> 3)]);
+    int i;
+    uint64_t endc_watch[4];
+
+    for (i = 0; i < ARRAY_SIZE(endc_watch); i++) {
+        endc_watch[i] =
+            cpu_to_be64(xive->vc_regs[(VC_ENDC_WATCH0_DATA0 >> 3) + i]);
+    }
+
+    return pnv_xive2_vst_write(xive, VST_END, blk, idx, endc_watch,
+                              XIVE_VST_WORD_ALL);
+}
+
+static void pnv_xive2_end_cache_load(PnvXive2 *xive)
+{
+    uint8_t  blk = GETFIELD(VC_ENDC_WATCH_BLOCK_ID,
+                           xive->vc_regs[(VC_ENDC_WATCH0_SPEC >> 3)]);
+    uint32_t idx = GETFIELD(VC_ENDC_WATCH_INDEX,
+                           xive->vc_regs[(VC_ENDC_WATCH0_SPEC >> 3)]);
+    uint64_t endc_watch[4] = { 0 };
+    int i;
+
+    if (pnv_xive2_vst_read(xive, VST_END, blk, idx, endc_watch)) {
+        xive2_error(xive, "VST: no END entry %x/%x !?", blk, idx);
+    }
+
+    for (i = 0; i < ARRAY_SIZE(endc_watch); i++) {
+        xive->vc_regs[(VC_ENDC_WATCH0_DATA0 >> 3) + i] =
+            be64_to_cpu(endc_watch[i]);
+    }
+}
+
+static int pnv_xive2_get_nvp(Xive2Router *xrtr, uint8_t blk, uint32_t idx,
+                            Xive2Nvp *nvp)
+{
+    return pnv_xive2_vst_read(PNV_XIVE2(xrtr), VST_NVP, blk, idx, nvp);
+}
+
+static int pnv_xive2_write_nvp(Xive2Router *xrtr, uint8_t blk, uint32_t idx,
+                              Xive2Nvp *nvp, uint8_t word_number)
+{
+    return pnv_xive2_vst_write(PNV_XIVE2(xrtr), VST_NVP, blk, idx, nvp,
+                              word_number);
+}
+
+static int pnv_xive2_nvp_update(PnvXive2 *xive)
+{
+    uint8_t  blk = GETFIELD(PC_NXC_WATCH_BLOCK_ID,
+                            xive->pc_regs[(PC_NXC_WATCH0_SPEC >> 3)]);
+    uint32_t idx = GETFIELD(PC_NXC_WATCH_INDEX,
+                            xive->pc_regs[(PC_NXC_WATCH0_SPEC >> 3)]);
+    int i;
+    uint64_t nxc_watch[4];
+
+    for (i = 0; i < ARRAY_SIZE(nxc_watch); i++) {
+        nxc_watch[i] =
+            cpu_to_be64(xive->pc_regs[(PC_NXC_WATCH0_DATA0 >> 3) + i]);
+    }
+
+    return pnv_xive2_vst_write(xive, VST_NVP, blk, idx, nxc_watch,
+                              XIVE_VST_WORD_ALL);
+}
+
+static void pnv_xive2_nvp_cache_load(PnvXive2 *xive)
+{
+    uint8_t  blk = GETFIELD(PC_NXC_WATCH_BLOCK_ID,
+                           xive->pc_regs[(PC_NXC_WATCH0_SPEC >> 3)]);
+    uint32_t idx = GETFIELD(PC_NXC_WATCH_INDEX,
+                           xive->pc_regs[(PC_NXC_WATCH0_SPEC >> 3)]);
+    uint64_t nxc_watch[4] = { 0 };
+    int i;
+
+    if (pnv_xive2_vst_read(xive, VST_NVP, blk, idx, nxc_watch)) {
+        xive2_error(xive, "VST: no NVP entry %x/%x !?", blk, idx);
+    }
+
+    for (i = 0; i < ARRAY_SIZE(nxc_watch); i++) {
+        xive->pc_regs[(PC_NXC_WATCH0_DATA0 >> 3) + i] =
+            be64_to_cpu(nxc_watch[i]);
+    }
+}
+
+static int pnv_xive2_get_eas(Xive2Router *xrtr, uint8_t blk, uint32_t idx,
+                            Xive2Eas *eas)
+{
+    PnvXive2 *xive = PNV_XIVE2(xrtr);
+
+    if (pnv_xive2_block_id(xive) != blk) {
+        xive2_error(xive, "VST: EAS %x is remote !?", XIVE_EAS(blk, idx));
+        return -1;
+    }
+
+    return pnv_xive2_vst_read(xive, VST_EAS, blk, idx, eas);
+}
+
+static bool pnv_xive2_is_cpu_enabled(PnvXive2 *xive, PowerPCCPU *cpu)
+{
+    int pir = ppc_cpu_pir(cpu);
+    uint32_t fc = PNV10_PIR2FUSEDCORE(pir);
+    uint64_t reg = fc < 8 ? TCTXT_EN0 : TCTXT_EN1;
+    uint32_t bit = pir & 0x3f;
+
+    return xive->tctxt_regs[reg >> 3] & PPC_BIT(bit);
+}
+
+static int pnv_xive2_match_nvt(XivePresenter *xptr, uint8_t format,
+                                uint8_t nvt_blk, uint32_t nvt_idx,
+                                bool cam_ignore, uint8_t priority,
+                                uint32_t logic_serv, XiveTCTXMatch *match)
+{
+    PnvXive2 *xive = PNV_XIVE2(xptr);
+    PnvChip *chip = xive->chip;
+    int count = 0;
+    int i, j;
+
+    for (i = 0; i < chip->nr_cores; i++) {
+        PnvCore *pc = chip->cores[i];
+        CPUCore *cc = CPU_CORE(pc);
+
+        for (j = 0; j < cc->nr_threads; j++) {
+            PowerPCCPU *cpu = pc->threads[j];
+            XiveTCTX *tctx;
+            int ring;
+
+            if (!pnv_xive2_is_cpu_enabled(xive, cpu)) {
+                continue;
+            }
+
+            tctx = XIVE_TCTX(pnv_cpu_state(cpu)->intc);
+
+            ring = xive2_presenter_tctx_match(xptr, tctx, format, nvt_blk,
+                                              nvt_idx, cam_ignore,
+                                              logic_serv);
+
+            /*
+             * Save the context and follow on to catch duplicates,
+             * that we don't support yet.
+             */
+            if (ring != -1) {
+                if (match->tctx) {
+                    qemu_log_mask(LOG_GUEST_ERROR, "XIVE: already found a "
+                                  "thread context NVT %x/%x\n",
+                                  nvt_blk, nvt_idx);
+                    return false;
+                }
+
+                match->ring = ring;
+                match->tctx = tctx;
+                count++;
+            }
+        }
+    }
+
+    return count;
+}
+
+static uint8_t pnv_xive2_get_block_id(Xive2Router *xrtr)
+{
+    return pnv_xive2_block_id(PNV_XIVE2(xrtr));
+}
+
+/*
+ * The TIMA MMIO space is shared among the chips and to identify the
+ * chip from which the access is being done, we extract the chip id
+ * from the PIR.
+ */
+static PnvXive2 *pnv_xive2_tm_get_xive(PowerPCCPU *cpu)
+{
+    int pir = ppc_cpu_pir(cpu);
+    XivePresenter *xptr = XIVE_TCTX(pnv_cpu_state(cpu)->intc)->xptr;
+    PnvXive2 *xive = PNV_XIVE2(xptr);
+
+    if (!pnv_xive2_is_cpu_enabled(xive, cpu)) {
+        xive2_error(xive, "IC: CPU %x is not enabled", pir);
+    }
+    return xive;
+}
+
+/*
+ * The internal sources of the interrupt controller have no knowledge
+ * of the XIVE2 chip on which they reside. Encode the block id in the
+ * source interrupt number before forwarding the source event
+ * notification to the Router. This is required on a multichip system.
+ */
+static void pnv_xive2_notify(XiveNotifier *xn, uint32_t srcno)
+{
+    PnvXive2 *xive = PNV_XIVE2(xn);
+    uint8_t blk = pnv_xive2_block_id(xive);
+
+    xive2_router_notify(xn, XIVE_EAS(blk, srcno));
+}
+
+/*
+ * Set Translation Tables
+ *
+ * TODO add support for multiple sets
+ */
+static int pnv_xive2_stt_set_data(PnvXive2 *xive, uint64_t val)
+{
+    uint8_t tsel = GETFIELD(CQ_TAR_SELECT, xive->cq_regs[CQ_TAR >> 3]);
+    uint8_t entry = GETFIELD(CQ_TAR_ENTRY_SELECT,
+                                  xive->cq_regs[CQ_TAR >> 3]);
+
+    switch (tsel) {
+    case CQ_TAR_NVPG:
+    case CQ_TAR_ESB:
+    case CQ_TAR_END:
+        xive->tables[tsel][entry] = val;
+        break;
+    default:
+        xive2_error(xive, "IC: unsupported table %d", tsel);
+        return -1;
+    }
+
+    if (xive->cq_regs[CQ_TAR >> 3] & CQ_TAR_AUTOINC) {
+        xive->cq_regs[CQ_TAR >> 3] = SETFIELD(CQ_TAR_ENTRY_SELECT,
+                     xive->cq_regs[CQ_TAR >> 3], ++entry);
+    }
+
+    return 0;
+}
+/*
+ * Virtual Structure Tables (VST) configuration
+ */
+static void pnv_xive2_vst_set_exclusive(PnvXive2 *xive2, uint8_t type,
+                                       uint8_t blk, uint64_t vsd)
+{
+    Xive2EndSource *end_xsrc = &xive2->end_source;
+    XiveSource *xsrc = &xive2->ipi_source;
+    const XiveVstInfo *info = &vst_infos[type];
+    uint32_t page_shift = GETFIELD(VSD_TSIZE, vsd) + 12;
+    uint64_t vst_tsize = 1ull << page_shift;
+    uint64_t vst_addr = vsd & VSD_ADDRESS_MASK;
+
+    /* Basic checks */
+
+    if (VSD_INDIRECT & vsd) {
+        if (!pnv_xive2_vst_page_size_allowed(page_shift)) {
+            xive2_error(xive2, "VST: invalid %s page shift %d", info->name,
+                       page_shift);
+            return;
+        }
+    }
+
+    if (!QEMU_IS_ALIGNED(vst_addr, 1ull << page_shift)) {
+        xive2_error(xive2, "VST: %s table address 0x%"PRIx64
+                    " is not aligned with page shift %d",
+                    info->name, vst_addr, page_shift);
+        return;
+    }
+
+    /* Record the table configuration (in SRAM on HW) */
+    xive2->vsds[type][blk] = vsd;
+
+    /* Now tune the models with the configuration provided by the FW */
+
+    switch (type) {
+    case VST_ESB:
+        /*
+         * Backing store pages for the source PQ bits. The model does
+         * not use these PQ bits backed in RAM because the XiveSource
+         * model has its own.
+         *
+         * If the table is direct, we can compute the number of PQ
+         * entries provisioned by FW (such as skiboot) and resize the
+         * ESB window accordingly.
+         */
+        if (!(VSD_INDIRECT & vsd)) {
+            memory_region_set_size(&xsrc->esb_mmio, vst_tsize * SBE_PER_BYTE
+                                   * (1ull << xsrc->esb_shift));
+        }
+
+        memory_region_add_subregion(&xive2->esb_mmio, 0, &xsrc->esb_mmio);
+        break;
+
+    case VST_EAS:  /* Nothing to be done */
+        break;
+
+    case VST_END:
+        /*
+         * Backing store pages for the END.
+         */
+        if (!(VSD_INDIRECT & vsd)) {
+            memory_region_set_size(&end_xsrc->esb_mmio, (vst_tsize / info->size)
+                                   * (1ull << xsrc->esb_shift));
+        }
+        memory_region_add_subregion(&xive2->end_mmio, 0, &end_xsrc->esb_mmio);
+        break;
+
+    case VST_NVP:  /* Not modeled */
+    case VST_NVG:  /* Not modeled */
+    case VST_NVC:  /* Not modeled */
+    case VST_IC:   /* Not modeled */
+    case VST_SYNC: /* Not modeled */
+    case VST_ERQ:  /* Not modeled */
+        break;
+
+    default:
+        g_assert_not_reached();
+    }
+}
+
+/*
+ * Both PC and VC sub-engines are configured as each use the Virtual
+ * Structure Tables
+ */
+static void pnv_xive2_vst_set_data(PnvXive2 *xive2, uint64_t vsd)
+{
+    uint8_t mode = GETFIELD(VSD_MODE, vsd);
+    uint8_t type = GETFIELD(VC_VSD_TABLE_SELECT,
+                            xive2->vc_regs[VC_VSD_TABLE_ADDR >> 3]);
+    uint8_t blk = GETFIELD(VC_VSD_TABLE_ADDRESS,
+                           xive2->vc_regs[VC_VSD_TABLE_ADDR >> 3]);
+    uint64_t vst_addr = vsd & VSD_ADDRESS_MASK;
+
+    if (type > VST_ERQ) {
+        xive2_error(xive2, "VST: invalid table type %d", type);
+        return;
+    }
+
+    if (blk >= vst_infos[type].max_blocks) {
+        xive2_error(xive2, "VST: invalid block id %d for"
+                      " %s table", blk, vst_infos[type].name);
+        return;
+    }
+
+    if (!vst_addr) {
+        xive2_error(xive2, "VST: invalid %s table address",
+                   vst_infos[type].name);
+        return;
+    }
+
+    switch (mode) {
+    case VSD_MODE_FORWARD:
+        xive2->vsds[type][blk] = vsd;
+        break;
+
+    case VSD_MODE_EXCLUSIVE:
+        pnv_xive2_vst_set_exclusive(xive2, type, blk, vsd);
+        break;
+
+    default:
+        xive2_error(xive2, "VST: unsupported table mode %d", mode);
+        return;
+    }
+}
+
+/*
+ * MMIO handlers
+ */
+
+
+/*
+ * IC BAR layout
+ *
+ * Page 0: Internal CQ register accesses (reads & writes)
+ * Page 1: Internal PC register accesses (reads & writes)
+ * Page 2: Internal VC register accesses (reads & writes)
+ * Page 3: Internal TCTXT (TIMA) reg accesses (read & writes)
+ * Page 4: Notify Port page (writes only, w/data),
+ * Page 5: Reserved
+ * Page 6: Sync Poll page (writes only, dataless)
+ * Page 7: Sync Inject page (writes only, dataless)
+ * Page 8: LSI Trigger page (writes only, dataless)
+ * Page 9: LSI SB Management page (reads & writes dataless)
+ * Pages 10-255: Reserved
+ * Pages 256-383: Direct mapped Thread Context Area (reads & writes)
+ *                covering the 128 threads in P10.
+ * Pages 384-511: Reserved
+ */
+typedef struct PnvXive2Region {
+    const char *name;
+    uint32_t pgoff;
+    uint32_t pgsize;
+    const MemoryRegionOps *ops;
+} PnvXive2Region;
+
+static const MemoryRegionOps pnv_xive2_ic_cq_ops;
+static const MemoryRegionOps pnv_xive2_ic_pc_ops;
+static const MemoryRegionOps pnv_xive2_ic_vc_ops;
+static const MemoryRegionOps pnv_xive2_ic_tctxt_ops;
+static const MemoryRegionOps pnv_xive2_ic_notify_ops;
+static const MemoryRegionOps pnv_xive2_ic_sync_ops;
+static const MemoryRegionOps pnv_xive2_ic_lsi_ops;
+static const MemoryRegionOps pnv_xive2_ic_tm_indirect_ops;
+
+/* 512 pages. 4K: 2M range, 64K: 32M range */
+static const PnvXive2Region pnv_xive2_ic_regions[] = {
+    { "xive-ic-cq",        0,   1,   &pnv_xive2_ic_cq_ops     },
+    { "xive-ic-vc",        1,   1,   &pnv_xive2_ic_vc_ops     },
+    { "xive-ic-pc",        2,   1,   &pnv_xive2_ic_pc_ops     },
+    { "xive-ic-tctxt",     3,   1,   &pnv_xive2_ic_tctxt_ops  },
+    { "xive-ic-notify",    4,   1,   &pnv_xive2_ic_notify_ops },
+    /* page 5 reserved */
+    { "xive-ic-sync",      6,   2,   &pnv_xive2_ic_sync_ops   },
+    { "xive-ic-lsi",       8,   2,   &pnv_xive2_ic_lsi_ops    },
+    /* pages 10-255 reserved */
+    { "xive-ic-tm-indirect", 256, 128, &pnv_xive2_ic_tm_indirect_ops  },
+    /* pages 384-511 reserved */
+};
+
+/*
+ * CQ operations
+ */
+
+static uint64_t pnv_xive2_ic_cq_read(void *opaque, hwaddr offset,
+                                        unsigned size)
+{
+    PnvXive2 *xive = PNV_XIVE2(opaque);
+    uint32_t reg = offset >> 3;
+    uint64_t val = 0;
+
+    switch (offset) {
+    case CQ_XIVE_CAP: /* Set at reset */
+    case CQ_XIVE_CFG:
+        val = xive->cq_regs[reg];
+        break;
+    case CQ_MSGSND: /* TODO check the #cores of the machine */
+        val = 0xffffffff00000000;
+        break;
+    case CQ_CFG_PB_GEN:
+        val = CQ_CFG_PB_GEN_PB_INIT; /* TODO: fix CQ_CFG_PB_GEN default value */
+        break;
+    default:
+        xive2_error(xive, "CQ: invalid read @%"HWADDR_PRIx, offset);
+    }
+
+    return val;
+}
+
+static uint64_t pnv_xive2_bar_size(uint64_t val)
+{
+    return 1ull << (GETFIELD(CQ_BAR_RANGE, val) + 24);
+}
+
+static void pnv_xive2_ic_cq_write(void *opaque, hwaddr offset,
+                                     uint64_t val, unsigned size)
+{
+    PnvXive2 *xive2 = PNV_XIVE2(opaque);
+    MemoryRegion *sysmem = get_system_memory();
+    uint32_t reg = offset >> 3;
+    int i;
+
+    switch (offset) {
+    case CQ_XIVE_CFG:
+    case CQ_RST_CTL: /* TODO: reset all BARs */
+        break;
+
+    case CQ_IC_BAR:
+        xive2->ic_shift = val & CQ_IC_BAR_64K ? 16 : 12;
+        if (!(val & CQ_IC_BAR_VALID)) {
+            xive2->ic_base = 0;
+            if (xive2->cq_regs[reg] & CQ_IC_BAR_VALID) {
+                for (i = 0; i < ARRAY_SIZE(xive2->ic_mmios); i++) {
+                    memory_region_del_subregion(&xive2->ic_mmio,
+                                                &xive2->ic_mmios[i]);
+                }
+                memory_region_del_subregion(sysmem, &xive2->ic_mmio);
+            }
+        } else {
+            xive2->ic_base = val & ~(CQ_IC_BAR_VALID | CQ_IC_BAR_64K);
+            if (!(xive2->cq_regs[reg] & CQ_IC_BAR_VALID)) {
+                for (i = 0; i < ARRAY_SIZE(xive2->ic_mmios); i++) {
+                    memory_region_add_subregion(&xive2->ic_mmio,
+                               pnv_xive2_ic_regions[i].pgoff << xive2->ic_shift,
+                               &xive2->ic_mmios[i]);
+                }
+                memory_region_add_subregion(sysmem, xive2->ic_base,
+                                            &xive2->ic_mmio);
+            }
+        }
+        break;
+
+    case CQ_TM_BAR:
+        xive2->tm_shift = val & CQ_TM_BAR_64K ? 16 : 12;
+        if (!(val & CQ_TM_BAR_VALID)) {
+            xive2->tm_base = 0;
+            if (xive2->cq_regs[reg] & CQ_TM_BAR_VALID) {
+                memory_region_del_subregion(sysmem, &xive2->tm_mmio);
+            }
+        } else {
+            xive2->tm_base = val & ~(CQ_TM_BAR_VALID | CQ_TM_BAR_64K);
+            if (!(xive2->cq_regs[reg] & CQ_TM_BAR_VALID)) {
+                memory_region_add_subregion(sysmem, xive2->tm_base,
+                                            &xive2->tm_mmio);
+            }
+        }
+        break;
+
+    case CQ_ESB_BAR:
+        xive2->esb_shift = val & CQ_BAR_64K ? 16 : 12;
+        if (!(val & CQ_BAR_VALID)) {
+            xive2->esb_base = 0;
+            if (xive2->cq_regs[reg] & CQ_BAR_VALID) {
+                memory_region_del_subregion(sysmem, &xive2->esb_mmio);
+            }
+        } else {
+            xive2->esb_base = val & CQ_BAR_ADDR;
+            if (!(xive2->cq_regs[reg] & CQ_BAR_VALID)) {
+                memory_region_set_size(&xive2->esb_mmio,
+                                       pnv_xive2_bar_size(val));
+                memory_region_add_subregion(sysmem, xive2->esb_base,
+                                            &xive2->esb_mmio);
+            }
+        }
+        break;
+
+    case CQ_END_BAR:
+        xive2->end_shift = val & CQ_BAR_64K ? 16 : 12;
+        if (!(val & CQ_BAR_VALID)) {
+            xive2->end_base = 0;
+            if (xive2->cq_regs[reg] & CQ_BAR_VALID) {
+                memory_region_del_subregion(sysmem, &xive2->end_mmio);
+            }
+        } else {
+            xive2->end_base = val & CQ_BAR_ADDR;
+            if (!(xive2->cq_regs[reg] & CQ_BAR_VALID)) {
+                memory_region_set_size(&xive2->end_mmio,
+                                       pnv_xive2_bar_size(val));
+                memory_region_add_subregion(sysmem, xive2->end_base,
+                                            &xive2->end_mmio);
+            }
+        }
+        break;
+
+    case CQ_NVC_BAR:
+        xive2->nvc_shift = val & CQ_BAR_64K ? 16 : 12;
+        if (!(val & CQ_BAR_VALID)) {
+            xive2->nvc_base = 0;
+            if (xive2->cq_regs[reg] & CQ_BAR_VALID) {
+                memory_region_del_subregion(sysmem, &xive2->nvc_mmio);
+            }
+        } else {
+            xive2->nvc_base = val & CQ_BAR_ADDR;
+            if (!(xive2->cq_regs[reg] & CQ_BAR_VALID)) {
+                memory_region_set_size(&xive2->nvc_mmio,
+                                       pnv_xive2_bar_size(val));
+                memory_region_add_subregion(sysmem, xive2->nvc_base,
+                                            &xive2->nvc_mmio);
+            }
+        }
+        break;
+
+    case CQ_NVPG_BAR:
+        xive2->nvpg_shift = val & CQ_BAR_64K ? 16 : 12;
+        if (!(val & CQ_BAR_VALID)) {
+            xive2->nvpg_base = 0;
+            if (xive2->cq_regs[reg] & CQ_BAR_VALID) {
+                memory_region_del_subregion(sysmem, &xive2->nvpg_mmio);
+            }
+        } else {
+            xive2->nvpg_base = val & CQ_BAR_ADDR;
+            if (!(xive2->cq_regs[reg] & CQ_BAR_VALID)) {
+                memory_region_set_size(&xive2->nvpg_mmio,
+                                       pnv_xive2_bar_size(val));
+                memory_region_add_subregion(sysmem, xive2->nvpg_base,
+                                            &xive2->nvpg_mmio);
+            }
+        }
+        break;
+
+    case CQ_TAR: /* Set Translation Table Address */
+        break;
+    case CQ_TDR: /* Set Translation Table Data */
+        pnv_xive2_stt_set_data(xive2, val);
+        break;
+    case CQ_FIRMASK_OR: /* FIR error reporting */
+        break;
+    default:
+        xive2_error(xive2, "CQ: invalid write 0x%"HWADDR_PRIx, offset);
+        return;
+    }
+
+    xive2->cq_regs[reg] = val;
+}
+
+static const MemoryRegionOps pnv_xive2_ic_cq_ops = {
+    .read = pnv_xive2_ic_cq_read,
+    .write = pnv_xive2_ic_cq_write,
+    .endianness = DEVICE_BIG_ENDIAN,
+    .valid = {
+        .min_access_size = 8,
+        .max_access_size = 8,
+    },
+    .impl = {
+        .min_access_size = 8,
+        .max_access_size = 8,
+    },
+};
+
+static uint64_t pnv_xive2_ic_vc_read(void *opaque, hwaddr offset,
+                                 unsigned size)
+{
+    PnvXive2 *xive = PNV_XIVE2(opaque);
+    uint64_t val = 0;
+    uint32_t reg = offset >> 3;
+
+    switch (offset) {
+    /*
+     * VSD table settings.
+     */
+    case VC_VSD_TABLE_ADDR:
+    case VC_VSD_TABLE_DATA:
+        val = xive->vc_regs[reg];
+        break;
+
+    /*
+     * ESB cache updates (not modeled)
+     */
+    case VC_ESBC_FLUSH_CTRL:
+        xive->vc_regs[reg] &= ~VC_ESBC_FLUSH_CTRL_POLL_VALID;
+        val = xive->vc_regs[reg];
+        break;
+
+    /*
+     * EAS cache updates (not modeled)
+     */
+    case VC_EASC_FLUSH_CTRL:
+        xive->vc_regs[reg] &= ~VC_EASC_FLUSH_CTRL_POLL_VALID;
+        val = xive->vc_regs[reg];
+        break;
+
+    /*
+     * END cache updates
+     */
+    case VC_ENDC_WATCH0_SPEC:
+        xive->vc_regs[reg] &= ~(VC_ENDC_WATCH_FULL | VC_ENDC_WATCH_CONFLICT);
+        val = xive->vc_regs[reg];
+        break;
+
+    case VC_ENDC_WATCH0_DATA0:
+        /*
+         * Load DATA registers from cache with data requested by the
+         * SPEC register
+         */
+        pnv_xive2_end_cache_load(xive);
+        val = xive->vc_regs[reg];
+        break;
+
+    case VC_ENDC_WATCH0_DATA1 ... VC_ENDC_WATCH0_DATA3:
+        val = xive->vc_regs[reg];
+        break;
+
+    case VC_ENDC_FLUSH_CTRL:
+        xive->vc_regs[reg] &= ~VC_ENDC_FLUSH_CTRL_POLL_VALID;
+        val = xive->vc_regs[reg];
+        break;
+
+    /*
+     * Indirect invalidation
+     */
+    case VC_AT_MACRO_KILL_MASK:
+        val = xive->vc_regs[reg];
+        break;
+
+    case VC_AT_MACRO_KILL:
+        xive->vc_regs[reg] &= ~VC_AT_MACRO_KILL_VALID;
+        val = xive->vc_regs[reg];
+        break;
+
+    /*
+     * Interrupt fifo overflow in memory backing store (Not modeled)
+     */
+    case VC_QUEUES_CFG_REM0 ... VC_QUEUES_CFG_REM6:
+        val = xive->vc_regs[reg];
+        break;
+
+    /*
+     * Synchronisation
+     */
+    case VC_ENDC_SYNC_DONE:
+        val = VC_ENDC_SYNC_POLL_DONE;
+        break;
+    default:
+        xive2_error(xive, "VC: invalid read @%"HWADDR_PRIx, offset);
+    }
+
+    return val;
+}
+
+static void pnv_xive2_ic_vc_write(void *opaque, hwaddr offset,
+                              uint64_t val, unsigned size)
+{
+    PnvXive2 *xive = PNV_XIVE2(opaque);
+    uint32_t reg = offset >> 3;
+
+    switch (offset) {
+    /*
+     * VSD table settings.
+     */
+    case VC_VSD_TABLE_ADDR:
+       break;
+    case VC_VSD_TABLE_DATA:
+        pnv_xive2_vst_set_data(xive, val);
+        break;
+
+    /*
+     * ESB cache updates (not modeled)
+     */
+    /* case VC_ESBC_FLUSH_CTRL: */
+    case VC_ESBC_FLUSH_POLL:
+        xive->vc_regs[VC_ESBC_FLUSH_CTRL >> 3] |= VC_ESBC_FLUSH_CTRL_POLL_VALID;
+        /* ESB update */
+        break;
+
+    /*
+     * EAS cache updates (not modeled)
+     */
+    /* case VC_EASC_FLUSH_CTRL: */
+    case VC_EASC_FLUSH_POLL:
+        xive->vc_regs[VC_EASC_FLUSH_CTRL >> 3] |= VC_EASC_FLUSH_CTRL_POLL_VALID;
+        /* EAS update */
+        break;
+
+    /*
+     * END cache updates
+     */
+    case VC_ENDC_WATCH0_SPEC:
+         val &= ~VC_ENDC_WATCH_CONFLICT; /* HW will set this bit */
+        break;
+
+    case VC_ENDC_WATCH0_DATA1 ... VC_ENDC_WATCH0_DATA3:
+        break;
+    case VC_ENDC_WATCH0_DATA0:
+        /* writing to DATA0 triggers the cache write */
+        xive->vc_regs[reg] = val;
+        pnv_xive2_end_update(xive);
+        break;
+
+
+    /* case VC_ENDC_FLUSH_CTRL: */
+    case VC_ENDC_FLUSH_POLL:
+        xive->vc_regs[VC_ENDC_FLUSH_CTRL >> 3] |= VC_ENDC_FLUSH_CTRL_POLL_VALID;
+        break;
+
+    /*
+     * Indirect invalidation
+     */
+    case VC_AT_MACRO_KILL:
+    case VC_AT_MACRO_KILL_MASK:
+        break;
+
+    /*
+     * Interrupt fifo overflow in memory backing store (Not modeled)
+     */
+    case VC_QUEUES_CFG_REM0 ... VC_QUEUES_CFG_REM6:
+        break;
+
+    /*
+     * Synchronisation
+     */
+    case VC_ENDC_SYNC_DONE:
+        break;
+
+    default:
+        xive2_error(xive, "VC: invalid write @%"HWADDR_PRIx, offset);
+        return;
+    }
+
+    xive->vc_regs[reg] = val;
+}
+
+static const MemoryRegionOps pnv_xive2_ic_vc_ops = {
+    .read = pnv_xive2_ic_vc_read,
+    .write = pnv_xive2_ic_vc_write,
+    .endianness = DEVICE_BIG_ENDIAN,
+    .valid = {
+        .min_access_size = 8,
+        .max_access_size = 8,
+    },
+    .impl = {
+        .min_access_size = 8,
+        .max_access_size = 8,
+    },
+};
+
+static uint64_t pnv_xive2_ic_pc_read(void *opaque, hwaddr offset,
+                                            unsigned size)
+{
+    PnvXive2 *xive = PNV_XIVE2(opaque);
+    uint64_t val = -1;
+    uint32_t reg = offset >> 3;
+
+    switch (offset) {
+    /*
+     * VSD table settings.
+     */
+    case PC_VSD_TABLE_ADDR:
+    case PC_VSD_TABLE_DATA:
+        val = xive->pc_regs[reg];
+        break;
+
+    /*
+     * cache updates
+     */
+    case PC_NXC_WATCH0_SPEC:
+        xive->pc_regs[reg] &= ~(PC_NXC_WATCH_FULL | PC_NXC_WATCH_CONFLICT);
+        val = xive->pc_regs[reg];
+        break;
+
+    case PC_NXC_WATCH0_DATA0:
+       /*
+        * Load DATA registers from cache with data requested by the
+        * SPEC register
+        */
+        pnv_xive2_nvp_cache_load(xive);
+        val = xive->pc_regs[reg];
+        break;
+
+    case PC_NXC_WATCH0_DATA1 ... PC_NXC_WATCH0_DATA3:
+        val = xive->pc_regs[reg];
+        break;
+
+    case PC_NXC_FLUSH_CTRL:
+        xive->pc_regs[reg] &= ~PC_NXC_FLUSH_CTRL_POLL_VALID;
+        val = xive->pc_regs[reg];
+        break;
+
+    /*
+     * Indirect invalidation
+     */
+    case PC_AT_KILL:
+        xive->pc_regs[reg] &= ~PC_AT_KILL_VALID;
+        val = xive->pc_regs[reg];
+        break;
+
+    default:
+        xive2_error(xive, "PC: invalid read @%"HWADDR_PRIx, offset);
+    }
+
+    return val;
+}
+
+static void pnv_xive2_ic_pc_write(void *opaque, hwaddr offset,
+                                         uint64_t val, unsigned size)
+{
+    PnvXive2 *xive = PNV_XIVE2(opaque);
+    uint32_t reg = offset >> 3;
+
+    switch (offset) {
+
+    /*
+     * VSD table settings. Only taken into account in the VC
+     * sub-engine because the Xive2Router model combines both VC and PC
+     * sub-engines
+     */
+    case PC_VSD_TABLE_ADDR:
+    case PC_VSD_TABLE_DATA:
+        break;
+
+    /*
+     * cache updates
+     */
+    case PC_NXC_WATCH0_SPEC:
+        val &= ~PC_NXC_WATCH_CONFLICT; /* HW will set this bit */
+        break;
+
+    case PC_NXC_WATCH0_DATA1 ... PC_NXC_WATCH0_DATA3:
+        break;
+    case PC_NXC_WATCH0_DATA0:
+        /* writing to DATA0 triggers the cache write */
+        xive->pc_regs[reg] = val;
+        pnv_xive2_nvp_update(xive);
+        break;
+
+   /* case PC_NXC_FLUSH_CTRL: */
+    case PC_NXC_FLUSH_POLL:
+        xive->pc_regs[PC_NXC_FLUSH_CTRL >> 3] |= PC_NXC_FLUSH_CTRL_POLL_VALID;
+        break;
+
+    /*
+     * Indirect invalidation
+     */
+    case PC_AT_KILL:
+    case PC_AT_KILL_MASK:
+        break;
+
+    default:
+        xive2_error(xive, "PC: invalid write @%"HWADDR_PRIx, offset);
+        return;
+    }
+
+    xive->pc_regs[reg] = val;
+}
+
+static const MemoryRegionOps pnv_xive2_ic_pc_ops = {
+    .read = pnv_xive2_ic_pc_read,
+    .write = pnv_xive2_ic_pc_write,
+    .endianness = DEVICE_BIG_ENDIAN,
+    .valid = {
+        .min_access_size = 8,
+        .max_access_size = 8,
+    },
+    .impl = {
+        .min_access_size = 8,
+        .max_access_size = 8,
+    },
+};
+
+
+static uint64_t pnv_xive2_ic_tctxt_read(void *opaque, hwaddr offset,
+                                         unsigned size)
+{
+    PnvXive2 *xive = PNV_XIVE2(opaque);
+    uint64_t val = -1;
+    uint32_t reg = offset >> 3;
+
+    switch (offset) {
+    /*
+     * XIVE2 hardware thread enablement
+     */
+    case TCTXT_EN0:
+    case TCTXT_EN1:
+        val = xive->tctxt_regs[reg];
+        break;
+
+    case TCTXT_EN0_SET:
+    case TCTXT_EN0_RESET:
+        val = xive->tctxt_regs[TCTXT_EN0 >> 3];
+        break;
+    case TCTXT_EN1_SET:
+    case TCTXT_EN1_RESET:
+        val = xive->tctxt_regs[TCTXT_EN1 >> 3];
+        break;
+    default:
+        xive2_error(xive, "TCTXT: invalid read @%"HWADDR_PRIx, offset);
+    }
+
+    return val;
+}
+
+static void pnv_xive2_ic_tctxt_write(void *opaque, hwaddr offset,
+                                            uint64_t val, unsigned size)
+{
+    PnvXive2 *xive = PNV_XIVE2(opaque);
+    uint32_t reg = offset >> 3;
+
+    switch (offset) {
+    /*
+     * XIVE2 hardware thread enablement
+     */
+    case TCTXT_EN0: /* Physical Thread Enable */
+    case TCTXT_EN1: /* Physical Thread Enable (fused core) */
+        break;
+
+    case TCTXT_EN0_SET:
+        xive->tctxt_regs[TCTXT_EN0 >> 3] |= val;
+        break;
+    case TCTXT_EN1_SET:
+        xive->tctxt_regs[TCTXT_EN1 >> 3] |= val;
+        break;
+    case TCTXT_EN0_RESET:
+        xive->tctxt_regs[TCTXT_EN0 >> 3] &= ~val;
+        break;
+    case TCTXT_EN1_RESET:
+        xive->tctxt_regs[TCTXT_EN1 >> 3] &= ~val;
+        break;
+
+    default:
+        xive2_error(xive, "TCTXT: invalid write @%"HWADDR_PRIx, offset);
+        return;
+    }
+
+    xive->pc_regs[reg] = val;
+}
+
+static const MemoryRegionOps pnv_xive2_ic_tctxt_ops = {
+    .read = pnv_xive2_ic_tctxt_read,
+    .write = pnv_xive2_ic_tctxt_write,
+    .endianness = DEVICE_BIG_ENDIAN,
+    .valid = {
+        .min_access_size = 8,
+        .max_access_size = 8,
+    },
+    .impl = {
+        .min_access_size = 8,
+        .max_access_size = 8,
+    },
+};
+
+/*
+ * Redirect XSCOM to MMIO handlers
+ */
+static uint64_t pnv_xive2_xscom_read(void *opaque, hwaddr offset,
+                                 unsigned size)
+{
+    PnvXive2 *xive = PNV_XIVE2(opaque);
+    uint64_t val = -1;
+    uint32_t xscom_reg = offset >> 3;
+    uint32_t mmio_offset = (xscom_reg & 0xFF) << 3;
+
+    switch (xscom_reg) {
+    case 0x000 ... 0x0FF:
+        val = pnv_xive2_ic_cq_read(opaque, mmio_offset, size);
+        break;
+    case 0x100 ... 0x1FF:
+        val = pnv_xive2_ic_vc_read(opaque, mmio_offset, size);
+        break;
+    case 0x200 ... 0x2FF:
+        val = pnv_xive2_ic_pc_read(opaque, mmio_offset, size);
+        break;
+    case 0x300 ... 0x3FF:
+        val = pnv_xive2_ic_tctxt_read(opaque, mmio_offset, size);
+        break;
+    default:
+        xive2_error(xive, "XSCOM: invalid read @%"HWADDR_PRIx, offset);
+    }
+
+    return val;
+}
+
+static void pnv_xive2_xscom_write(void *opaque, hwaddr offset,
+                                   uint64_t val, unsigned size)
+{
+    PnvXive2 *xive = PNV_XIVE2(opaque);
+    uint32_t xscom_reg = offset >> 3;
+    uint32_t mmio_offset = (xscom_reg & 0xFF) << 3;
+
+    switch (xscom_reg) {
+    case 0x000 ... 0x0FF:
+        pnv_xive2_ic_cq_write(opaque, mmio_offset, val, size);
+        break;
+    case 0x100 ... 0x1FF:
+        pnv_xive2_ic_vc_write(opaque, mmio_offset, val, size);
+        break;
+    case 0x200 ... 0x2FF:
+        pnv_xive2_ic_pc_write(opaque, mmio_offset, val, size);
+        break;
+    case 0x300 ... 0x3FF:
+        pnv_xive2_ic_tctxt_write(opaque, mmio_offset, val, size);
+        break;
+    default:
+        xive2_error(xive, "XSCOM: invalid write @%"HWADDR_PRIx, offset);
+    }
+}
+
+static const MemoryRegionOps pnv_xive2_xscom_ops = {
+    .read = pnv_xive2_xscom_read,
+    .write = pnv_xive2_xscom_write,
+    .endianness = DEVICE_BIG_ENDIAN,
+    .valid = {
+        .min_access_size = 8,
+        .max_access_size = 8,
+    },
+    .impl = {
+        .min_access_size = 8,
+        .max_access_size = 8,
+    },
+};
+
+/*
+ * Notify port page. The layout is compatible between 4K and 64K pages :
+ *
+ * Page 1           Notify page (writes only)
+ *  0x000 - 0x7FF   IPI interrupt (NPU)
+ *  0x800 - 0xFFF   HW interrupt triggers (PSI, PHB)
+ */
+
+static void pnv_xive2_ic_hw_trigger(PnvXive2 *xive, hwaddr addr,
+                                     uint64_t val)
+{
+    uint8_t blk;
+    uint32_t idx;
+
+    if (val & XIVE_TRIGGER_END) {
+        xive2_error(xive, "IC: END trigger at @0x%"HWADDR_PRIx" data 0x%"PRIx64,
+                   addr, val);
+        return;
+    }
+
+    /*
+     * Forward the source event notification directly to the Router.
+     * The source interrupt number should already be correctly encoded
+     * with the chip block id by the sending device (PHB, PSI).
+     */
+    blk = XIVE_EAS_BLOCK(val);
+    idx = XIVE_EAS_INDEX(val);
+
+    xive2_router_notify(XIVE_NOTIFIER(xive), XIVE_EAS(blk, idx));
+}
+
+static void pnv_xive2_ic_notify_write(void *opaque, hwaddr offset,
+                                       uint64_t val, unsigned size)
+{
+    PnvXive2 *xive = PNV_XIVE2(opaque);
+
+    /* VC: IPI triggers */
+    switch (offset) {
+    case 0x000 ... 0x7FF:
+        /* TODO: check IPI notify sub-page routing */
+        pnv_xive2_ic_hw_trigger(opaque, offset, val);
+        break;
+
+    /* VC: HW triggers */
+    case 0x800 ... 0xFFF:
+        pnv_xive2_ic_hw_trigger(opaque, offset, val);
+        break;
+
+    default:
+        xive2_error(xive, "NOTIFY: invalid write @%"HWADDR_PRIx, offset);
+    }
+}
+
+static uint64_t pnv_xive2_ic_notify_read(void *opaque, hwaddr offset,
+                                                unsigned size)
+{
+    PnvXive2 *xive = PNV_XIVE2(opaque);
+
+   /* loads are invalid */
+    xive2_error(xive, "NOTIFY: invalid read @%"HWADDR_PRIx, offset);
+    return -1;
+}
+
+static const MemoryRegionOps pnv_xive2_ic_notify_ops = {
+    .read = pnv_xive2_ic_notify_read,
+    .write = pnv_xive2_ic_notify_write,
+    .endianness = DEVICE_BIG_ENDIAN,
+    .valid = {
+        .min_access_size = 8,
+        .max_access_size = 8,
+    },
+    .impl = {
+        .min_access_size = 8,
+        .max_access_size = 8,
+    },
+};
+
+static uint64_t pnv_xive2_ic_lsi_read(void *opaque, hwaddr offset,
+                                             unsigned size)
+{
+    PnvXive2 *xive = PNV_XIVE2(opaque);
+
+    xive2_error(xive, "LSI: invalid read @%"HWADDR_PRIx, offset);
+    return -1;
+}
+
+static void pnv_xive2_ic_lsi_write(void *opaque, hwaddr offset,
+                                          uint64_t val, unsigned size)
+{
+    PnvXive2 *xive = PNV_XIVE2(opaque);
+
+    xive2_error(xive, "LSI: invalid write @%"HWADDR_PRIx, offset);
+}
+
+static const MemoryRegionOps pnv_xive2_ic_lsi_ops = {
+    .read = pnv_xive2_ic_lsi_read,
+    .write = pnv_xive2_ic_lsi_write,
+    .endianness = DEVICE_BIG_ENDIAN,
+    .valid = {
+        .min_access_size = 8,
+        .max_access_size = 8,
+    },
+    .impl = {
+        .min_access_size = 8,
+        .max_access_size = 8,
+    },
+};
+
+/*
+ * Sync MMIO page (write only)
+ */
+#define PNV_XIVE2_SYNC_IPI      0x000
+#define PNV_XIVE2_SYNC_HW       0x080
+#define PNV_XIVE2_SYNC_NxC      0x100
+#define PNV_XIVE2_SYNC_INT      0x180
+#define PNV_XIVE2_SYNC_OS_ESC   0x200
+#define PNV_XIVE2_SYNC_POOL_ESC 0x280
+#define PNV_XIVE2_SYNC_HARD_ESC 0x300
+
+static uint64_t pnv_xive2_ic_sync_read(void *opaque, hwaddr offset,
+                                              unsigned size)
+{
+    PnvXive2 *xive = PNV_XIVE2(opaque);
+
+    /* loads are invalid */
+    xive2_error(xive, "SYNC: invalid read @%"HWADDR_PRIx, offset);
+    return -1;
+}
+
+static void pnv_xive2_ic_sync_write(void *opaque, hwaddr offset,
+                                           uint64_t val, unsigned size)
+{
+    PnvXive2 *xive = PNV_XIVE2(opaque);
+
+    switch (offset) {
+    case PNV_XIVE2_SYNC_IPI:
+    case PNV_XIVE2_SYNC_HW:
+    case PNV_XIVE2_SYNC_NxC:
+    case PNV_XIVE2_SYNC_INT:
+    case PNV_XIVE2_SYNC_OS_ESC:
+    case PNV_XIVE2_SYNC_POOL_ESC:
+    case PNV_XIVE2_SYNC_HARD_ESC:
+        break;
+    default:
+        xive2_error(xive, "SYNC: invalid write @%"HWADDR_PRIx, offset);
+    }
+}
+
+static const MemoryRegionOps pnv_xive2_ic_sync_ops = {
+    .read = pnv_xive2_ic_sync_read,
+    .write = pnv_xive2_ic_sync_write,
+    .endianness = DEVICE_BIG_ENDIAN,
+    .valid = {
+        .min_access_size = 8,
+        .max_access_size = 8,
+    },
+    .impl = {
+        .min_access_size = 8,
+        .max_access_size = 8,
+    },
+};
+
+/*
+ * When the TM direct pages of the IC controller are accessed, the
+ * target HW thread is deduced from the page offset.
+ */
+static XiveTCTX *pnv_xive2_get_indirect_tctx(PnvXive2 *xive, uint32_t pir)
+{
+    PnvChip *chip = xive->chip;
+    PowerPCCPU *cpu = NULL;
+
+    cpu = pnv_chip_find_cpu(chip, pir);
+    if (!cpu) {
+        xive2_error(xive, "IC: invalid PIR %x for indirect access", pir);
+        return NULL;
+    }
+
+    if (!pnv_xive2_is_cpu_enabled(xive, cpu)) {
+        xive2_error(xive, "IC: CPU %x is not enabled", pir);
+    }
+
+    return XIVE_TCTX(pnv_cpu_state(cpu)->intc);
+}
+
+static uint64_t pnv_xive2_ic_tm_indirect_read(void *opaque, hwaddr offset,
+                                              unsigned size)
+{
+    PnvXive2 *xive = PNV_XIVE2(opaque);
+    uint32_t pir = offset >> xive->ic_shift;
+    XiveTCTX *tctx = pnv_xive2_get_indirect_tctx(xive, pir);
+    uint64_t val = -1;
+
+    if (tctx) {
+        val = xive_tctx_tm_read(NULL, tctx, offset, size);
+    }
+
+    return val;
+}
+
+static void pnv_xive2_ic_tm_indirect_write(void *opaque, hwaddr offset,
+                                           uint64_t val, unsigned size)
+{
+    PnvXive2 *xive = PNV_XIVE2(opaque);
+    uint32_t pir = offset >> xive->ic_shift;
+    XiveTCTX *tctx = pnv_xive2_get_indirect_tctx(xive, pir);
+
+    if (tctx) {
+        xive_tctx_tm_write(NULL, tctx, offset, val, size);
+    }
+}
+
+static const MemoryRegionOps pnv_xive2_ic_tm_indirect_ops = {
+    .read = pnv_xive2_ic_tm_indirect_read,
+    .write = pnv_xive2_ic_tm_indirect_write,
+    .endianness = DEVICE_BIG_ENDIAN,
+    .valid = {
+        .min_access_size = 8,
+        .max_access_size = 8,
+    },
+    .impl = {
+        .min_access_size = 8,
+        .max_access_size = 8,
+    },
+};
+
+/*
+ * TIMA ops
+ */
+
+static void pnv_xive2_tm_write(void *opaque, hwaddr offset,
+                          uint64_t value, unsigned size)
+{
+    PowerPCCPU *cpu = POWERPC_CPU(current_cpu);
+    PnvXive2 *xive = pnv_xive2_tm_get_xive(cpu);
+    XiveTCTX *tctx = XIVE_TCTX(pnv_cpu_state(cpu)->intc);
+
+    /* Other TM ops are the same as XIVE1 */
+    xive_tctx_tm_write(XIVE_PRESENTER(xive), tctx, offset, value, size);
+}
+
+static uint64_t pnv_xive2_tm_read(void *opaque, hwaddr offset, unsigned size)
+{
+    PowerPCCPU *cpu = POWERPC_CPU(current_cpu);
+    PnvXive2 *xive = pnv_xive2_tm_get_xive(cpu);
+    XiveTCTX *tctx = XIVE_TCTX(pnv_cpu_state(cpu)->intc);
+
+    /* Other TM ops are the same as XIVE1 */
+    return xive_tctx_tm_read(XIVE_PRESENTER(xive), tctx, offset, size);
+}
+
+static const MemoryRegionOps pnv_xive2_tm_ops = {
+    .read = pnv_xive2_tm_read,
+    .write = pnv_xive2_tm_write,
+    .endianness = DEVICE_BIG_ENDIAN,
+    .valid = {
+        .min_access_size = 1,
+        .max_access_size = 8,
+    },
+    .impl = {
+        .min_access_size = 1,
+        .max_access_size = 8,
+    },
+};
+
+static uint64_t pnv_xive2_nvc_read(void *opaque, hwaddr offset,
+                                          unsigned size)
+{
+    PnvXive2 *xive = PNV_XIVE2(opaque);
+
+    xive2_error(xive, "NVC: invalid read @%"HWADDR_PRIx, offset);
+    return -1;
+}
+
+static void pnv_xive2_nvc_write(void *opaque, hwaddr offset,
+                                       uint64_t val, unsigned size)
+{
+    PnvXive2 *xive = PNV_XIVE2(opaque);
+
+    xive2_error(xive, "NVC: invalid write @%"HWADDR_PRIx, offset);
+}
+
+static const MemoryRegionOps pnv_xive2_nvc_ops = {
+    .read = pnv_xive2_nvc_read,
+    .write = pnv_xive2_nvc_write,
+    .endianness = DEVICE_BIG_ENDIAN,
+    .valid = {
+        .min_access_size = 8,
+        .max_access_size = 8,
+    },
+    .impl = {
+        .min_access_size = 8,
+        .max_access_size = 8,
+    },
+};
+
+static uint64_t pnv_xive2_nvpg_read(void *opaque, hwaddr offset,
+                                           unsigned size)
+{
+    PnvXive2 *xive = PNV_XIVE2(opaque);
+
+    xive2_error(xive, "NVPG: invalid read @%"HWADDR_PRIx, offset);
+    return -1;
+}
+
+static void pnv_xive2_nvpg_write(void *opaque, hwaddr offset,
+                                        uint64_t val, unsigned size)
+{
+    PnvXive2 *xive = PNV_XIVE2(opaque);
+
+    xive2_error(xive, "NVPG: invalid write @%"HWADDR_PRIx, offset);
+}
+
+static const MemoryRegionOps pnv_xive2_nvpg_ops = {
+    .read = pnv_xive2_nvpg_read,
+    .write = pnv_xive2_nvpg_write,
+    .endianness = DEVICE_BIG_ENDIAN,
+    .valid = {
+        .min_access_size = 8,
+        .max_access_size = 8,
+    },
+    .impl = {
+        .min_access_size = 8,
+        .max_access_size = 8,
+    },
+};
+
+/*
+ * POWER10 default capabilities: 0x2000120076f00000
+ */
+#define PNV_XIVE2_CAPABILITIES  0x2000120076f00000
+
+/*
+ * POWER10 default configuration: 0x0030000033000000
+ *
+ * 8bits thread id was dropped for P10
+ */
+#define PNV_XIVE2_CONFIGURATION 0x0030000033000000
+
+static void pnv_xive2_reset(void *dev)
+{
+    PnvXive2 *xive2 = PNV_XIVE2(dev);
+    XiveSource *xsrc = &xive2->ipi_source;
+    Xive2EndSource *end_xsrc = &xive2->end_source;
+
+    xive2->cq_regs[CQ_XIVE_CAP >> 3] = PNV_XIVE2_CAPABILITIES;
+    xive2->cq_regs[CQ_XIVE_CFG >> 3] = PNV_XIVE2_CONFIGURATION;
+
+    /* HW hardwires the #Topology of the chip in the block field */
+    xive2->cq_regs[CQ_XIVE_CFG >> 3] |=
+        SETFIELD(CQ_XIVE_CFG_HYP_HARD_BLOCK_ID, 0ull, xive2->chip->chip_id);
+
+    /* Set default page size to 64k */
+    xive2->ic_shift = xive2->esb_shift = xive2->end_shift = 16;
+    xive2->nvc_shift = xive2->nvpg_shift = xive2->tm_shift = 16;
+
+    /* Clear source MMIOs */
+    if (memory_region_is_mapped(&xsrc->esb_mmio)) {
+        memory_region_del_subregion(&xive2->esb_mmio, &xsrc->esb_mmio);
+    }
+
+    if (memory_region_is_mapped(&end_xsrc->esb_mmio)) {
+        memory_region_del_subregion(&xive2->end_mmio, &end_xsrc->esb_mmio);
+    }
+}
+
+/*
+ *  Maximum number of IRQs and ENDs supported by HW. Will be tuned by
+ *  software.
+ */
+#define PNV_XIVE2_NR_IRQS (PNV10_XIVE2_ESB_SIZE / (1ull << XIVE_ESB_64K_2PAGE))
+#define PNV_XIVE2_NR_ENDS (PNV10_XIVE2_END_SIZE / (1ull << XIVE_ESB_64K_2PAGE))
+
+static void pnv_xive2_realize(DeviceState *dev, Error **errp)
+{
+    PnvXive2 *xive2 = PNV_XIVE2(dev);
+    PnvXive2Class *pxc = PNV_XIVE2_GET_CLASS(dev);
+    XiveSource *xsrc = &xive2->ipi_source;
+    Xive2EndSource *end_xsrc = &xive2->end_source;
+    Error *local_err = NULL;
+    int i;
+
+    pxc->parent_realize(dev, &local_err);
+    if (local_err) {
+        error_propagate(errp, local_err);
+        return;
+    }
+
+    assert(xive2->chip);
+
+    /*
+     * The XiveSource and Xive2EndSource objects are realized with the
+     * maximum allowed HW configuration. The ESB MMIO regions will be
+     * resized dynamically when the controller is configured by the FW
+     * to limit accesses to resources not provisioned.
+     */
+    object_property_set_int(OBJECT(xsrc), XIVE_SRC_STORE_EOI, "flags",
+                            &error_fatal);
+    object_property_set_int(OBJECT(xsrc), PNV_XIVE2_NR_IRQS, "nr-irqs",
+                            &error_fatal);
+    object_property_set_link(OBJECT(xsrc), OBJECT(xive2), "xive",
+                             &error_fatal);
+    object_property_set_bool(OBJECT(xsrc), true, "realized", &local_err);
+    if (local_err) {
+        error_propagate(errp, local_err);
+        return;
+    }
+
+    object_property_set_int(OBJECT(end_xsrc), PNV_XIVE2_NR_ENDS, "nr-ends",
+                            &error_fatal);
+    object_property_set_link(OBJECT(end_xsrc), OBJECT(xive2), "xive",
+                             &error_abort);
+    object_property_set_bool(OBJECT(end_xsrc), true, "realized", &local_err);
+    if (local_err) {
+        error_propagate(errp, local_err);
+        return;
+    }
+
+    /* XSCOM region, used for initial configuration of the BARs */
+    memory_region_init_io(&xive2->xscom_regs, OBJECT(dev),
+                          &pnv_xive2_xscom_ops, xive2, "xscom-xive",
+                          PNV10_XSCOM_XIVE2_SIZE << 3);
+
+    /* Interrupt controller MMIO regions */
+    xive2->ic_shift = 16;
+    memory_region_init(&xive2->ic_mmio, OBJECT(dev), "xive-ic",
+                       PNV10_XIVE2_IC_SIZE);
+
+    for (i = 0; i < ARRAY_SIZE(xive2->ic_mmios); i++) {
+        memory_region_init_io(&xive2->ic_mmios[i], OBJECT(dev),
+                         pnv_xive2_ic_regions[i].ops, xive2,
+                         pnv_xive2_ic_regions[i].name,
+                         pnv_xive2_ic_regions[i].pgsize << xive2->ic_shift);
+    }
+
+    /*
+     * VC MMIO regions.
+     */
+    xive2->esb_shift = 16;
+    xive2->end_shift = 16;
+    memory_region_init(&xive2->esb_mmio, OBJECT(xive2), "xive-esb",
+                       PNV10_XIVE2_ESB_SIZE);
+    memory_region_init(&xive2->end_mmio, OBJECT(xive2), "xive-end",
+                       PNV10_XIVE2_END_SIZE);
+
+    /* Presenter Controller MMIO region (not modeled) */
+    xive2->nvc_shift = 16;
+    xive2->nvpg_shift = 16;
+    memory_region_init_io(&xive2->nvc_mmio, OBJECT(dev),
+                          &pnv_xive2_nvc_ops, xive2,
+                          "xive-nvc", PNV10_XIVE2_NVC_SIZE);
+
+    memory_region_init_io(&xive2->nvpg_mmio, OBJECT(dev),
+                          &pnv_xive2_nvpg_ops, xive2,
+                          "xive-nvpg", PNV10_XIVE2_NVPG_SIZE);
+
+    /* Thread Interrupt Management Area (Direct) */
+    xive2->tm_shift = 16;
+    memory_region_init_io(&xive2->tm_mmio, OBJECT(dev), &pnv_xive2_tm_ops,
+                          xive2, "xive-tima", PNV10_XIVE2_TM_SIZE);
+
+    qemu_register_reset(pnv_xive2_reset, dev);
+}
+
+static Property pnv_xive2_properties[] = {
+    DEFINE_PROP_UINT64("ic-bar", PnvXive2, ic_base, 0),
+    DEFINE_PROP_UINT64("esb-bar", PnvXive2, esb_base, 0),
+    DEFINE_PROP_UINT64("end-bar", PnvXive2, end_base, 0),
+    DEFINE_PROP_UINT64("nvc-bar", PnvXive2, nvc_base, 0),
+    DEFINE_PROP_UINT64("nvpg-bar", PnvXive2, nvpg_base, 0),
+    DEFINE_PROP_UINT64("tm-bar", PnvXive2, tm_base, 0),
+    DEFINE_PROP_LINK("chip", PnvXive2, chip, TYPE_PNV_CHIP, PnvChip *),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
+static void pnv_xive2_instance_init(Object *obj)
+{
+    PnvXive2 *xive = PNV_XIVE2(obj);
+
+    object_initialize_child(obj, "ipi_source", &xive->ipi_source,
+                            sizeof(xive->ipi_source), TYPE_XIVE_SOURCE,
+                            &error_abort, NULL);
+    object_initialize_child(obj, "end_source", &xive->end_source,
+                            sizeof(xive->end_source), TYPE_XIVE2_END_SOURCE,
+                            &error_abort, NULL);
+}
+
+static int pnv_xive2_dt_xscom(PnvXScomInterface *dev, void *fdt,
+                             int xscom_offset)
+{
+    const char compat_p10[] = "ibm,power10-xive-x";
+    char *name;
+    int offset;
+    uint32_t reg[] = {
+        cpu_to_be32(PNV10_XSCOM_XIVE2_BASE),
+        cpu_to_be32(PNV10_XSCOM_XIVE2_SIZE)
+    };
+
+    name = g_strdup_printf("xive@%x", PNV10_XSCOM_XIVE2_BASE);
+    offset = fdt_add_subnode(fdt, xscom_offset, name);
+    _FDT(offset);
+    g_free(name);
+
+    _FDT((fdt_setprop(fdt, offset, "reg", reg, sizeof(reg))));
+    _FDT(fdt_setprop(fdt, offset, "compatible", compat_p10,
+                     sizeof(compat_p10)));
+    return 0;
+}
+
+static void pnv_xive2_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    PnvXScomInterfaceClass *xdc = PNV_XSCOM_INTERFACE_CLASS(klass);
+    Xive2RouterClass *xrc = XIVE2_ROUTER_CLASS(klass);
+    XiveNotifierClass *xnc = XIVE_NOTIFIER_CLASS(klass);
+    XivePresenterClass *xpc = XIVE_PRESENTER_CLASS(klass);
+    PnvXive2Class *pxc = PNV_XIVE2_CLASS(klass);
+
+    xdc->dt_xscom  = pnv_xive2_dt_xscom;
+
+    dc->desc       = "PowerNV XIVE2 Interrupt Controller (POWER10)";
+    device_class_set_parent_realize(dc, pnv_xive2_realize,
+                                    &pxc->parent_realize);
+    device_class_set_props(dc, pnv_xive2_properties);
+
+    xrc->get_eas   = pnv_xive2_get_eas;
+    xrc->get_end   = pnv_xive2_get_end;
+    xrc->write_end = pnv_xive2_write_end;
+    xrc->get_nvp   = pnv_xive2_get_nvp;
+    xrc->write_nvp = pnv_xive2_write_nvp;
+    xrc->get_block_id = pnv_xive2_get_block_id;
+
+    xnc->notify    = pnv_xive2_notify;
+
+    xpc->match_nvt  = pnv_xive2_match_nvt;
+};
+
+static const TypeInfo pnv_xive2_info = {
+    .name          = TYPE_PNV_XIVE2,
+    .parent        = TYPE_XIVE2_ROUTER,
+    .instance_init = pnv_xive2_instance_init,
+    .instance_size = sizeof(PnvXive2),
+    .class_init    = pnv_xive2_class_init,
+    .class_size    = sizeof(PnvXive2Class),
+    .interfaces    = (InterfaceInfo[]) {
+        { TYPE_PNV_XSCOM_INTERFACE },
+        { }
+    }
+};
+
+static void pnv_xive2_register_types(void)
+{
+    type_register_static(&pnv_xive2_info);
+}
+
+type_init(pnv_xive2_register_types)
+
+static void xive2_nvp_pic_print_info(Xive2Nvp *nvp, uint32_t nvp_idx,
+                                     Monitor *mon)
+{
+    uint8_t  eq_blk = xive_get_field32(NVP2_W5_VP_END_BLOCK, nvp->w5);
+    uint32_t eq_idx = xive_get_field32(NVP2_W5_VP_END_INDEX, nvp->w5);
+
+    if (!xive2_nvp_is_valid(nvp)) {
+        return;
+    }
+
+    monitor_printf(mon, "  %08x end:%02x/%04x CPPR:%02x IPB:%02x\n",
+                   nvp_idx, eq_blk, eq_idx,
+                   xive_get_field32(NVP2_W2_CPPR, nvp->w2),
+                   xive_get_field32(NVP2_W2_IPB, nvp->w2));
+}
+
+/*
+ * If the table is direct, we can compute the number of PQ entries
+ * provisioned by FW.
+ */
+static uint32_t pnv_xive2_nr_esbs(PnvXive2 *xive)
+{
+    uint8_t blk = pnv_xive2_block_id(xive);
+    uint64_t vsd = xive->vsds[VST_ESB][blk];
+    uint64_t vst_tsize = 1ull << (GETFIELD(VSD_TSIZE, vsd) + 12);
+
+    return VSD_INDIRECT & vsd ? 0 : vst_tsize * SBE_PER_BYTE;
+}
+
+/*
+ * Compute the number of entries per indirect subpage.
+ */
+static uint64_t pnv_xive2_vst_per_subpage(PnvXive2 *xive, uint32_t type)
+{
+    uint8_t blk = pnv_xive2_block_id(xive);
+    uint64_t vsd = xive->vsds[type][blk];
+    const XiveVstInfo *info = &vst_infos[type];
+    uint64_t vsd_addr;
+    uint32_t page_shift;
+
+    /* For direct tables, fake a valid value */
+    if (!(VSD_INDIRECT & vsd)) {
+        return 1;
+    }
+
+    /* Get the page size of the indirect table. */
+    vsd_addr = vsd & VSD_ADDRESS_MASK;
+    vsd = ldq_be_dma(&address_space_memory, vsd_addr);
+
+    if (!(vsd & VSD_ADDRESS_MASK)) {
+#ifdef XIVE2_DEBUG
+        xive2_error(xive, "VST: invalid %s entry!?", info->name);
+#endif
+        return 0;
+    }
+
+    page_shift = GETFIELD(VSD_TSIZE, vsd) + 12;
+
+    if (!pnv_xive2_vst_page_size_allowed(page_shift)) {
+        xive2_error(xive, "VST: invalid %s page shift %d", info->name,
+                   page_shift);
+        return 0;
+    }
+
+    return (1ull << page_shift) / info->size;
+}
+
+void pnv_xive2_pic_print_info(PnvXive2 *xive, Monitor *mon)
+{
+    Xive2Router *xrtr = XIVE2_ROUTER(xive);
+    uint8_t blk = pnv_xive2_block_id(xive);
+    uint8_t chip_id = xive->chip->chip_id;
+    uint32_t srcno0 = XIVE_EAS(blk, 0);
+    uint32_t nr_esbs = pnv_xive2_nr_esbs(xive);
+    Xive2Eas eas;
+    Xive2End end;
+    Xive2Nvp nvp;
+    int i;
+    uint64_t xive_nvp_per_subpage;
+
+    monitor_printf(mon, "XIVE[%x] Source %08x .. %08x\n", blk, srcno0,
+                   srcno0 + nr_esbs - 1);
+    xive_source_pic_print_info(&xive->ipi_source, srcno0, mon);
+
+    monitor_printf(mon, "XIVE[%x] EAT %08x .. %08x\n", blk, srcno0,
+                   srcno0 + nr_esbs - 1);
+    for (i = 0; i < nr_esbs; i++) {
+        if (xive2_router_get_eas(xrtr, blk, i, &eas)) {
+            break;
+        }
+        if (!xive2_eas_is_masked(&eas)) {
+            xive2_eas_pic_print_info(&eas, i, mon);
+        }
+    }
+
+    monitor_printf(mon, "XIVE[%x] #%d END Escalation EAT\n", chip_id, blk);
+    i = 0;
+    while (!xive2_router_get_end(xrtr, blk, i, &end)) {
+        xive2_end_eas_pic_print_info(&end, i++, mon);
+    }
+
+    monitor_printf(mon, "XIVE[%x] #%d ENDT\n", chip_id, blk);
+    i = 0;
+    while (!xive2_router_get_end(xrtr, blk, i, &end)) {
+        xive2_end_pic_print_info(&end, i++, mon);
+    }
+
+    monitor_printf(mon, "XIVE[%x] #%d NVPT %08x .. %08x\n", chip_id, blk,
+                   0, XIVE2_NVP_COUNT - 1);
+    xive_nvp_per_subpage = pnv_xive2_vst_per_subpage(xive, VST_NVP);
+    for (i = 0; i < XIVE2_NVP_COUNT; i += xive_nvp_per_subpage) {
+        while (!xive2_router_get_nvp(xrtr, blk, i, &nvp)) {
+            xive2_nvp_pic_print_info(&nvp, i++, mon);
+        }
+    }
+}
diff --git a/hw/ppc/pnv.c b/hw/ppc/pnv.c
index 1b4748ce6dc3..73c40ce3209f 100644
--- a/hw/ppc/pnv.c
+++ b/hw/ppc/pnv.c
@@ -706,6 +706,7 @@ static void pnv_chip_power10_pic_print_info(PnvChip *chip, Monitor *mon)
 {
     Pnv10Chip *chip10 = PNV10_CHIP(chip);
 
+    pnv_xive2_pic_print_info(&chip10->xive, mon);
     pnv_psi_pic_print_info(&chip10->psi, mon);
 }
 
@@ -997,27 +998,45 @@ static void pnv_chip_power9_intc_print_info(PnvChip *chip, PowerPCCPU *cpu,
 static void pnv_chip_power10_intc_create(PnvChip *chip, PowerPCCPU *cpu,
                                         Error **errp)
 {
+    Pnv10Chip *chip10 = PNV10_CHIP(chip);
+    Error *local_err = NULL;
+    Object *obj;
     PnvCPUState *pnv_cpu = pnv_cpu_state(cpu);
 
-    /* Will be defined when the interrupt controller is */
-    pnv_cpu->intc = NULL;
+    /*
+     * The core creates its interrupt presenter but the XIVE2 interrupt
+     * controller object is initialized afterwards. Hopefully, it's
+     * only used at runtime.
+     */
+    obj = xive_tctx_create(OBJECT(cpu), XIVE_PRESENTER(&chip10->xive),
+                           &local_err);
+    if (local_err) {
+        error_propagate(errp, local_err);
+        return;
+    }
+
+    pnv_cpu->intc = obj;
 }
 
 static void pnv_chip_power10_intc_reset(PnvChip *chip, PowerPCCPU *cpu)
 {
-    ;
+    PnvCPUState *pnv_cpu = pnv_cpu_state(cpu);
+
+    xive_tctx_reset(XIVE_TCTX(pnv_cpu->intc));
 }
 
 static void pnv_chip_power10_intc_destroy(PnvChip *chip, PowerPCCPU *cpu)
 {
     PnvCPUState *pnv_cpu = pnv_cpu_state(cpu);
 
+    xive_tctx_destroy(XIVE_TCTX(pnv_cpu->intc));
     pnv_cpu->intc = NULL;
 }
 
 static void pnv_chip_power10_intc_print_info(PnvChip *chip, PowerPCCPU *cpu,
                                              Monitor *mon)
 {
+    xive_tctx_pic_print_info(XIVE_TCTX(pnv_cpu_state(cpu)->intc), mon);
 }
 
 /*
@@ -1590,6 +1609,10 @@ static void pnv_chip_power10_instance_init(Object *obj)
 {
     Pnv10Chip *chip10 = PNV10_CHIP(obj);
 
+    object_initialize_child(obj, "xive", &chip10->xive, sizeof(chip10->xive),
+                            TYPE_PNV_XIVE2, &error_abort, NULL);
+    object_property_add_alias(obj, "xive-fabric", OBJECT(&chip10->xive),
+                              "xive-fabric", &error_abort);
     object_initialize_child(obj, "psi",  &chip10->psi, sizeof(chip10->psi),
                             TYPE_PNV10_PSI, &error_abort, NULL);
     object_initialize_child(obj, "lpc",  &chip10->lpc, sizeof(chip10->lpc),
@@ -1617,6 +1640,30 @@ static void pnv_chip_power10_realize(DeviceState *dev, Error **errp)
         return;
     }
 
+    /* XIVE2 interrupt controller (POWER10) */
+    object_property_set_int(OBJECT(&chip10->xive), PNV10_XIVE2_IC_BASE(chip),
+                            "ic-bar", &error_fatal);
+    object_property_set_int(OBJECT(&chip10->xive), PNV10_XIVE2_ESB_BASE(chip),
+                            "esb-bar", &error_fatal);
+    object_property_set_int(OBJECT(&chip10->xive), PNV10_XIVE2_END_BASE(chip),
+                            "end-bar", &error_fatal);
+    object_property_set_int(OBJECT(&chip10->xive), PNV10_XIVE2_NVPG_BASE(chip),
+                            "nvpg-bar", &error_fatal);
+    object_property_set_int(OBJECT(&chip10->xive), PNV10_XIVE2_NVC_BASE(chip),
+                            "nvc-bar", &error_fatal);
+    object_property_set_int(OBJECT(&chip10->xive), PNV10_XIVE2_TM_BASE(chip),
+                            "tm-bar", &error_fatal);
+    object_property_set_link(OBJECT(&chip10->xive), OBJECT(chip), "chip",
+                             &error_abort);
+    object_property_set_bool(OBJECT(&chip10->xive), true, "realized",
+                             &local_err);
+    if (local_err) {
+        error_propagate(errp, local_err);
+        return;
+    }
+    pnv_xscom_add_subregion(chip, PNV10_XSCOM_XIVE2_BASE,
+                            &chip10->xive.xscom_regs);
+
     /* Processor Service Interface (PSI) Host Bridge */
     object_property_set_int(OBJECT(&chip10->psi), PNV10_PSIHB_BASE(chip),
                             "bar", &error_fatal);
@@ -1913,6 +1960,35 @@ static int pnv_match_nvt(XiveFabric *xfb, uint8_t format,
     return total_count;
 }
 
+static int pnv10_xive_match_nvt(XiveFabric *xfb, uint8_t format,
+                                uint8_t nvt_blk, uint32_t nvt_idx,
+                                bool cam_ignore, uint8_t priority,
+                                uint32_t logic_serv,
+                                XiveTCTXMatch *match)
+{
+    PnvMachineState *pnv = PNV_MACHINE(xfb);
+    int total_count = 0;
+    int i;
+
+    for (i = 0; i < pnv->num_chips; i++) {
+        Pnv10Chip *chip10 = PNV10_CHIP(pnv->chips[i]);
+        XivePresenter *xptr = XIVE_PRESENTER(&chip10->xive);
+        XivePresenterClass *xpc = XIVE_PRESENTER_GET_CLASS(xptr);
+        int count;
+
+        count = xpc->match_nvt(xptr, format, nvt_blk, nvt_idx, cam_ignore,
+                               priority, logic_serv, match);
+
+        if (count < 0) {
+            return count;
+        }
+
+        total_count += count;
+    }
+
+    return total_count;
+}
+
 static void pnv_machine_power8_class_init(ObjectClass *oc, void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
@@ -1953,6 +2029,7 @@ static void pnv_machine_power10_class_init(ObjectClass *oc, void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     PnvMachineClass *pmc = PNV_MACHINE_CLASS(oc);
+    XiveFabricClass *xfc = XIVE_FABRIC_CLASS(oc);
     static const char compat[] = "qemu,powernv10\0ibm,powernv";
 
     mc->desc = "IBM PowerNV (Non-Virtualized) POWER10";
@@ -1961,6 +2038,8 @@ static void pnv_machine_power10_class_init(ObjectClass *oc, void *data)
     pmc->compat = compat;
     pmc->compat_size = sizeof(compat);
     pmc->dt_power_mgt = pnv_dt_power_mgt;
+
+    xfc->match_nvt = pnv10_xive_match_nvt;
 }
 
 static bool pnv_machine_get_hb(Object *obj, Error **errp)
@@ -2074,6 +2153,10 @@ static const TypeInfo types[] = {
         .name          = MACHINE_TYPE_NAME("powernv10"),
         .parent        = TYPE_PNV_MACHINE,
         .class_init    = pnv_machine_power10_class_init,
+        .interfaces = (InterfaceInfo[]) {
+            { TYPE_XIVE_FABRIC },
+            { },
+        },
     },
     {
         .name          = MACHINE_TYPE_NAME("powernv9"),
diff --git a/hw/intc/Makefile.objs b/hw/intc/Makefile.objs
index 3af575aeb87d..b879a6eb3c3a 100644
--- a/hw/intc/Makefile.objs
+++ b/hw/intc/Makefile.objs
@@ -40,7 +40,7 @@ obj-$(CONFIG_XICS_KVM) += xics_kvm.o
 obj-$(CONFIG_XIVE) += xive.o xive2.o
 obj-$(CONFIG_XIVE_SPAPR) += spapr_xive.o
 obj-$(CONFIG_XIVE_KVM) += spapr_xive_kvm.o
-obj-$(CONFIG_POWERNV) += xics_pnv.o pnv_xive.o
+obj-$(CONFIG_POWERNV) += xics_pnv.o pnv_xive.o pnv_xive2.o
 obj-$(CONFIG_ALLWINNER_A10_PIC) += allwinner-a10-pic.o
 obj-$(CONFIG_S390_FLIC) += s390_flic.o
 obj-$(CONFIG_S390_FLIC_KVM) += s390_flic_kvm.o
-- 
2.25.4



^ permalink raw reply related	[flat|nested] 25+ messages in thread

* [PATCH 6/9] ppc/pnv: Add a OCC model for POWER10
  2020-05-13 15:11 [PATCH 0/9] ppc/pnv: Introduce the XIVE2 and PHB5 controllers for the POWER10 chip Cédric Le Goater
                   ` (4 preceding siblings ...)
  2020-05-13 15:11 ` [PATCH 5/9] ppc/pnv: Add a XIVE2 controller to the POWER10 chip Cédric Le Goater
@ 2020-05-13 15:11 ` Cédric Le Goater
  2020-05-20 14:22   ` Greg Kurz
  2020-05-13 15:11 ` [PATCH 7/9] ppc/pnv: Add POWER10 quads Cédric Le Goater
                   ` (3 subsequent siblings)
  9 siblings, 1 reply; 25+ messages in thread
From: Cédric Le Goater @ 2020-05-13 15:11 UTC (permalink / raw)
  To: David Gibson; +Cc: Cédric Le Goater, qemu-ppc, Greg Kurz, qemu-devel

Needs some more refinements but this model does not do much anyhow.

Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 include/hw/ppc/pnv.h       |  1 +
 include/hw/ppc/pnv_occ.h   |  2 ++
 include/hw/ppc/pnv_xscom.h |  3 +++
 hw/ppc/pnv.c               | 14 ++++++++++++++
 hw/ppc/pnv_occ.c           | 17 +++++++++++++++++
 5 files changed, 37 insertions(+)

diff --git a/include/hw/ppc/pnv.h b/include/hw/ppc/pnv.h
index f318bb10add4..3ff610a9c7b5 100644
--- a/include/hw/ppc/pnv.h
+++ b/include/hw/ppc/pnv.h
@@ -122,6 +122,7 @@ typedef struct Pnv10Chip {
     PnvXive2     xive;
     Pnv9Psi      psi;
     PnvLpcController lpc;
+    PnvOCC       occ;
 } Pnv10Chip;
 
 #define PNV10_PIR2FUSEDCORE(pir) (((pir) >> 3) & 0xf)
diff --git a/include/hw/ppc/pnv_occ.h b/include/hw/ppc/pnv_occ.h
index f8d3061419dc..57cb437c9ca1 100644
--- a/include/hw/ppc/pnv_occ.h
+++ b/include/hw/ppc/pnv_occ.h
@@ -28,6 +28,8 @@
 #define PNV8_OCC(obj) OBJECT_CHECK(PnvOCC, (obj), TYPE_PNV8_OCC)
 #define TYPE_PNV9_OCC TYPE_PNV_OCC "-POWER9"
 #define PNV9_OCC(obj) OBJECT_CHECK(PnvOCC, (obj), TYPE_PNV9_OCC)
+#define TYPE_PNV10_OCC TYPE_PNV_OCC "-POWER10"
+#define PNV10_OCC(obj) OBJECT_CHECK(PnvOCC, (obj), TYPE_PNV10_OCC)
 
 #define PNV_OCC_SENSOR_DATA_BLOCK_OFFSET 0x00580000
 #define PNV_OCC_SENSOR_DATA_BLOCK_SIZE   0x00025800
diff --git a/include/hw/ppc/pnv_xscom.h b/include/hw/ppc/pnv_xscom.h
index 1211add3e79c..f26c5217764d 100644
--- a/include/hw/ppc/pnv_xscom.h
+++ b/include/hw/ppc/pnv_xscom.h
@@ -133,6 +133,9 @@ typedef struct PnvXScomInterfaceClass {
 #define PNV10_XSCOM_PSIHB_BASE     0x3011D00
 #define PNV10_XSCOM_PSIHB_SIZE     0x100
 
+#define PNV10_XSCOM_OCC_BASE       PNV_XSCOM_OCC_BASE
+#define PNV10_XSCOM_OCC_SIZE       0x8000
+
 #define PNV10_XSCOM_XIVE2_BASE     0x2010800
 #define PNV10_XSCOM_XIVE2_SIZE     0x400
 
diff --git a/hw/ppc/pnv.c b/hw/ppc/pnv.c
index 73c40ce3209f..9f1698a74467 100644
--- a/hw/ppc/pnv.c
+++ b/hw/ppc/pnv.c
@@ -1617,6 +1617,8 @@ static void pnv_chip_power10_instance_init(Object *obj)
                             TYPE_PNV10_PSI, &error_abort, NULL);
     object_initialize_child(obj, "lpc",  &chip10->lpc, sizeof(chip10->lpc),
                             TYPE_PNV10_LPC, &error_abort, NULL);
+    object_initialize_child(obj, "occ",  &chip10->occ, sizeof(chip10->occ),
+                            TYPE_PNV10_OCC, &error_abort, NULL);
 }
 
 static void pnv_chip_power10_realize(DeviceState *dev, Error **errp)
@@ -1690,6 +1692,18 @@ static void pnv_chip_power10_realize(DeviceState *dev, Error **errp)
 
     chip->dt_isa_nodename = g_strdup_printf("/lpcm-opb@%" PRIx64 "/lpc@0",
                                             (uint64_t) PNV10_LPCM_BASE(chip));
+
+    /* Create the simplified OCC model */
+    object_property_set_link(OBJECT(&chip10->occ), OBJECT(&chip10->psi), "psi",
+                             &error_abort);
+    object_property_set_bool(OBJECT(&chip10->occ), true, "realized",
+                             &local_err);
+    if (local_err) {
+        error_propagate(errp, local_err);
+        return;
+    }
+    pnv_xscom_add_subregion(chip, PNV10_XSCOM_OCC_BASE,
+                            &chip10->occ.xscom_regs);
 }
 
 static uint32_t pnv_chip_power10_xscom_pcba(PnvChip *chip, uint64_t addr)
diff --git a/hw/ppc/pnv_occ.c b/hw/ppc/pnv_occ.c
index 5a716c256edc..7a2aea8fb9d1 100644
--- a/hw/ppc/pnv_occ.c
+++ b/hw/ppc/pnv_occ.c
@@ -249,6 +249,22 @@ static const TypeInfo pnv_occ_power9_type_info = {
     .class_init    = pnv_occ_power9_class_init,
 };
 
+static void pnv_occ_power10_class_init(ObjectClass *klass, void *data)
+{
+    PnvOCCClass *poc = PNV_OCC_CLASS(klass);
+
+    poc->xscom_size = PNV9_XSCOM_OCC_SIZE;
+    poc->xscom_ops = &pnv_occ_power9_xscom_ops;
+    poc->psi_irq = PSIHB9_IRQ_OCC;
+}
+
+static const TypeInfo pnv_occ_power10_type_info = {
+    .name          = TYPE_PNV10_OCC,
+    .parent        = TYPE_PNV_OCC,
+    .instance_size = sizeof(PnvOCC),
+    .class_init    = pnv_occ_power10_class_init,
+};
+
 static void pnv_occ_realize(DeviceState *dev, Error **errp)
 {
     PnvOCC *occ = PNV_OCC(dev);
@@ -297,6 +313,7 @@ static void pnv_occ_register_types(void)
     type_register_static(&pnv_occ_type_info);
     type_register_static(&pnv_occ_power8_type_info);
     type_register_static(&pnv_occ_power9_type_info);
+    type_register_static(&pnv_occ_power10_type_info);
 }
 
 type_init(pnv_occ_register_types);
-- 
2.25.4



^ permalink raw reply related	[flat|nested] 25+ messages in thread

* [PATCH 7/9] ppc/pnv: Add POWER10 quads
  2020-05-13 15:11 [PATCH 0/9] ppc/pnv: Introduce the XIVE2 and PHB5 controllers for the POWER10 chip Cédric Le Goater
                   ` (5 preceding siblings ...)
  2020-05-13 15:11 ` [PATCH 6/9] ppc/pnv: Add a OCC model for POWER10 Cédric Le Goater
@ 2020-05-13 15:11 ` Cédric Le Goater
  2020-05-20 14:44   ` Greg Kurz
  2020-05-13 15:11 ` [PATCH 8/9] ppc/pnv: Add model for POWER9 PHB5 PCIe Host bridge Cédric Le Goater
                   ` (2 subsequent siblings)
  9 siblings, 1 reply; 25+ messages in thread
From: Cédric Le Goater @ 2020-05-13 15:11 UTC (permalink / raw)
  To: David Gibson; +Cc: Cédric Le Goater, qemu-ppc, Greg Kurz, qemu-devel

Still needs some refinements on the XSCOM registers.

Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 include/hw/ppc/pnv.h |  4 ++++
 hw/ppc/pnv.c         | 33 +++++++++++++++++++++++++++++++++
 2 files changed, 37 insertions(+)

diff --git a/include/hw/ppc/pnv.h b/include/hw/ppc/pnv.h
index 3ff610a9c7b5..86bfa2107a8c 100644
--- a/include/hw/ppc/pnv.h
+++ b/include/hw/ppc/pnv.h
@@ -123,6 +123,10 @@ typedef struct Pnv10Chip {
     Pnv9Psi      psi;
     PnvLpcController lpc;
     PnvOCC       occ;
+
+    uint32_t     nr_quads;
+    PnvQuad      *quads;
+
 } Pnv10Chip;
 
 #define PNV10_PIR2FUSEDCORE(pir) (((pir) >> 3) & 0xf)
diff --git a/hw/ppc/pnv.c b/hw/ppc/pnv.c
index 9f1698a74467..fc751dd575d4 100644
--- a/hw/ppc/pnv.c
+++ b/hw/ppc/pnv.c
@@ -1621,6 +1621,33 @@ static void pnv_chip_power10_instance_init(Object *obj)
                             TYPE_PNV10_OCC, &error_abort, NULL);
 }
 
+
+static void pnv_chip_power10_quad_realize(Pnv10Chip *chip10, Error **errp)
+{
+    PnvChip *chip = PNV_CHIP(chip10);
+    int i;
+
+    chip10->nr_quads = DIV_ROUND_UP(chip->nr_cores, 4);
+    chip10->quads = g_new0(PnvQuad, chip10->nr_quads);
+
+    for (i = 0; i < chip10->nr_quads; i++) {
+        char eq_name[32];
+        PnvQuad *eq = &chip10->quads[i];
+        PnvCore *pnv_core = chip->cores[i * 4];
+        int core_id = CPU_CORE(pnv_core)->core_id;
+
+        snprintf(eq_name, sizeof(eq_name), "eq[%d]", core_id);
+        object_initialize_child(OBJECT(chip), eq_name, eq, sizeof(*eq),
+                                TYPE_PNV_QUAD, &error_fatal, NULL);
+
+        object_property_set_int(OBJECT(eq), core_id, "id", &error_fatal);
+        object_property_set_bool(OBJECT(eq), true, "realized", &error_fatal);
+
+        pnv_xscom_add_subregion(chip, PNV10_XSCOM_EQ_BASE(eq->id),
+                                &eq->xscom_regs);
+    }
+}
+
 static void pnv_chip_power10_realize(DeviceState *dev, Error **errp)
 {
     PnvChipClass *pcc = PNV_CHIP_GET_CLASS(dev);
@@ -1642,6 +1669,12 @@ static void pnv_chip_power10_realize(DeviceState *dev, Error **errp)
         return;
     }
 
+    pnv_chip_power10_quad_realize(chip10, &local_err);
+    if (local_err) {
+        error_propagate(errp, local_err);
+        return;
+    }
+
     /* XIVE2 interrupt controller (POWER10) */
     object_property_set_int(OBJECT(&chip10->xive), PNV10_XIVE2_IC_BASE(chip),
                             "ic-bar", &error_fatal);
-- 
2.25.4



^ permalink raw reply related	[flat|nested] 25+ messages in thread

* [PATCH 8/9] ppc/pnv: Add model for POWER9 PHB5 PCIe Host bridge
  2020-05-13 15:11 [PATCH 0/9] ppc/pnv: Introduce the XIVE2 and PHB5 controllers for the POWER10 chip Cédric Le Goater
                   ` (6 preceding siblings ...)
  2020-05-13 15:11 ` [PATCH 7/9] ppc/pnv: Add POWER10 quads Cédric Le Goater
@ 2020-05-13 15:11 ` Cédric Le Goater
  2020-05-20 13:46   ` Greg Kurz
  2020-05-13 15:11 ` [PATCH 9/9] ppc/psi: Add support for StoreEOI and 64k ESB pages (POWER10) Cédric Le Goater
  2020-05-19  9:40 ` [PATCH 0/9] ppc/pnv: Introduce the XIVE2 and PHB5 controllers for the POWER10 chip Greg Kurz
  9 siblings, 1 reply; 25+ messages in thread
From: Cédric Le Goater @ 2020-05-13 15:11 UTC (permalink / raw)
  To: David Gibson; +Cc: Cédric Le Goater, qemu-ppc, Greg Kurz, qemu-devel

PHB4 and PHB5 are very similar. Use the PHB4 models with some minor
adjustements in a subclass for P10.

Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 include/hw/pci-host/pnv_phb4.h |  11 ++++
 include/hw/ppc/pnv.h           |   3 +
 include/hw/ppc/pnv_xscom.h     |   6 ++
 hw/pci-host/pnv_phb4_pec.c     |  44 ++++++++++++++
 hw/ppc/pnv.c                   | 101 +++++++++++++++++++++++++++++++++
 5 files changed, 165 insertions(+)

diff --git a/include/hw/pci-host/pnv_phb4.h b/include/hw/pci-host/pnv_phb4.h
index c882bfd0aa23..ea3810f74066 100644
--- a/include/hw/pci-host/pnv_phb4.h
+++ b/include/hw/pci-host/pnv_phb4.h
@@ -227,4 +227,15 @@ typedef struct PnvPhb4PecClass {
     int stk_compat_size;
 } PnvPhb4PecClass;
 
+/*
+ * POWER10 definitions
+ */
+
+#define PNV_PHB5_VERSION           0x000000a500000001ull
+#define PNV_PHB5_DEVICE_ID         0x0652
+
+#define TYPE_PNV_PHB5_PEC "pnv-phb5-pec"
+#define PNV_PHB5_PEC(obj) \
+    OBJECT_CHECK(PnvPhb4PecState, (obj), TYPE_PNV_PHB5_PEC)
+
 #endif /* PCI_HOST_PNV_PHB4_H */
diff --git a/include/hw/ppc/pnv.h b/include/hw/ppc/pnv.h
index 86bfa2107a8c..516229a51e7b 100644
--- a/include/hw/ppc/pnv.h
+++ b/include/hw/ppc/pnv.h
@@ -127,6 +127,9 @@ typedef struct Pnv10Chip {
     uint32_t     nr_quads;
     PnvQuad      *quads;
 
+#define PNV10_CHIP_MAX_PEC 2
+    PnvPhb4PecState pecs[PNV10_CHIP_MAX_PEC];
+
 } Pnv10Chip;
 
 #define PNV10_PIR2FUSEDCORE(pir) (((pir) >> 3) & 0xf)
diff --git a/include/hw/ppc/pnv_xscom.h b/include/hw/ppc/pnv_xscom.h
index f26c5217764d..433c7b878af4 100644
--- a/include/hw/ppc/pnv_xscom.h
+++ b/include/hw/ppc/pnv_xscom.h
@@ -139,6 +139,12 @@ typedef struct PnvXScomInterfaceClass {
 #define PNV10_XSCOM_XIVE2_BASE     0x2010800
 #define PNV10_XSCOM_XIVE2_SIZE     0x400
 
+#define PNV10_XSCOM_PEC_NEST_BASE  0x3011800 /* index goes downwards ... */
+#define PNV10_XSCOM_PEC_NEST_SIZE  0x100
+
+#define PNV10_XSCOM_PEC_PCI_BASE   0x8010800 /* index goes upwards ... */
+#define PNV10_XSCOM_PEC_PCI_SIZE   0x200
+
 void pnv_xscom_realize(PnvChip *chip, uint64_t size, Error **errp);
 int pnv_dt_xscom(PnvChip *chip, void *fdt, int root_offset,
                  uint64_t xscom_base, uint64_t xscom_size,
diff --git a/hw/pci-host/pnv_phb4_pec.c b/hw/pci-host/pnv_phb4_pec.c
index 911d147ffd7d..869fd77b62cc 100644
--- a/hw/pci-host/pnv_phb4_pec.c
+++ b/hw/pci-host/pnv_phb4_pec.c
@@ -586,9 +586,53 @@ static const TypeInfo pnv_pec_stk_type_info = {
     }
 };
 
+/*
+ * POWER10 definitions
+ */
+
+static uint32_t pnv_phb5_pec_xscom_pci_base(PnvPhb4PecState *pec)
+{
+    return PNV10_XSCOM_PEC_PCI_BASE + 0x1000000 * pec->index;
+}
+
+static uint32_t pnv_phb5_pec_xscom_nest_base(PnvPhb4PecState *pec)
+{
+    /* index goes down ... */
+    return PNV10_XSCOM_PEC_NEST_BASE - 0x1000000 * pec->index;
+}
+
+static void pnv_phb5_pec_class_init(ObjectClass *klass, void *data)
+{
+    PnvPhb4PecClass *pecc = PNV_PHB4_PEC_CLASS(klass);
+    static const char compat[] = "ibm,power10-pbcq";
+    static const char stk_compat[] = "ibm,power10-phb-stack";
+
+    pecc->xscom_nest_base = pnv_phb5_pec_xscom_nest_base;
+    pecc->xscom_pci_base  = pnv_phb5_pec_xscom_pci_base;
+    pecc->xscom_nest_size = PNV10_XSCOM_PEC_NEST_SIZE;
+    pecc->xscom_pci_size  = PNV10_XSCOM_PEC_PCI_SIZE;
+    pecc->compat = compat;
+    pecc->compat_size = sizeof(compat);
+    pecc->stk_compat = stk_compat;
+    pecc->stk_compat_size = sizeof(stk_compat);
+}
+
+static const TypeInfo pnv_phb5_pec_type_info = {
+    .name          = TYPE_PNV_PHB5_PEC,
+    .parent        = TYPE_PNV_PHB4_PEC,
+    .instance_size = sizeof(PnvPhb4PecState),
+    .class_init    = pnv_phb5_pec_class_init,
+    .class_size    = sizeof(PnvPhb4PecClass),
+    .interfaces    = (InterfaceInfo[]) {
+        { TYPE_PNV_XSCOM_INTERFACE },
+        { }
+    }
+};
+
 static void pnv_pec_register_types(void)
 {
     type_register_static(&pnv_pec_type_info);
+    type_register_static(&pnv_phb5_pec_type_info);
     type_register_static(&pnv_pec_stk_type_info);
 }
 
diff --git a/hw/ppc/pnv.c b/hw/ppc/pnv.c
index fc751dd575d4..ac4bd2a17a9e 100644
--- a/hw/ppc/pnv.c
+++ b/hw/ppc/pnv.c
@@ -705,9 +705,17 @@ static void pnv_ipmi_bt_init(ISABus *bus, IPMIBmc *bmc, uint32_t irq)
 static void pnv_chip_power10_pic_print_info(PnvChip *chip, Monitor *mon)
 {
     Pnv10Chip *chip10 = PNV10_CHIP(chip);
+    int i, j;
 
     pnv_xive2_pic_print_info(&chip10->xive, mon);
     pnv_psi_pic_print_info(&chip10->psi, mon);
+
+    for (i = 0; i < PNV10_CHIP_MAX_PEC; i++) {
+        PnvPhb4PecState *pec = &chip10->pecs[i];
+        for (j = 0; j < pec->num_stacks; j++) {
+            pnv_phb4_pic_print_info(&pec->stacks[j].phb, mon);
+        }
+    }
 }
 
 static void pnv_init(MachineState *machine)
@@ -1607,7 +1615,10 @@ static void pnv_chip_power9_class_init(ObjectClass *klass, void *data)
 
 static void pnv_chip_power10_instance_init(Object *obj)
 {
+    PnvChip *chip = PNV_CHIP(obj);
     Pnv10Chip *chip10 = PNV10_CHIP(obj);
+    PnvChipClass *pcc = PNV_CHIP_GET_CLASS(obj);
+    int i;
 
     object_initialize_child(obj, "xive", &chip10->xive, sizeof(chip10->xive),
                             TYPE_PNV_XIVE2, &error_abort, NULL);
@@ -1619,6 +1630,17 @@ static void pnv_chip_power10_instance_init(Object *obj)
                             TYPE_PNV10_LPC, &error_abort, NULL);
     object_initialize_child(obj, "occ",  &chip10->occ, sizeof(chip10->occ),
                             TYPE_PNV10_OCC, &error_abort, NULL);
+
+    for (i = 0; i < PNV10_CHIP_MAX_PEC; i++) {
+        object_initialize_child(obj, "pec[*]", &chip10->pecs[i],
+                                sizeof(chip10->pecs[i]), TYPE_PNV_PHB5_PEC,
+                                &error_abort, NULL);
+    }
+
+    /*
+     * Number of PHBs is the chip default
+     */
+    chip->num_phbs = pcc->num_phbs;
 }
 
 
@@ -1648,6 +1670,77 @@ static void pnv_chip_power10_quad_realize(Pnv10Chip *chip10, Error **errp)
     }
 }
 
+static void pnv_chip_power10_phb_realize(PnvChip *chip, Error **errp)
+{
+    Pnv10Chip *chip10 = PNV10_CHIP(chip);
+    Error *local_err = NULL;
+    int i, j;
+    int phb_id = 0;
+
+    for (i = 0; i < PNV10_CHIP_MAX_PEC; i++) {
+        PnvPhb4PecState *pec = &chip10->pecs[i];
+        PnvPhb4PecClass *pecc = PNV_PHB4_PEC_GET_CLASS(pec);
+        uint32_t pec_nest_base;
+        uint32_t pec_pci_base;
+
+        object_property_set_int(OBJECT(pec), i, "index", &error_fatal);
+        /*
+         * PEC0 -> 3 stacks
+         * PEC1 -> 3 stacks
+         */
+        object_property_set_int(OBJECT(pec), 3, "num-stacks",
+                                &error_fatal);
+        object_property_set_int(OBJECT(pec), chip->chip_id, "chip-id",
+                                 &error_fatal);
+        object_property_set_link(OBJECT(pec), OBJECT(get_system_memory()),
+                                 "system-memory", &error_abort);
+        object_property_set_bool(OBJECT(pec), true, "realized", &local_err);
+        if (local_err) {
+            error_propagate(errp, local_err);
+            return;
+        }
+
+        pec_nest_base = pecc->xscom_nest_base(pec);
+        pec_pci_base = pecc->xscom_pci_base(pec);
+
+        pnv_xscom_add_subregion(chip, pec_nest_base, &pec->nest_regs_mr);
+        pnv_xscom_add_subregion(chip, pec_pci_base, &pec->pci_regs_mr);
+
+        for (j = 0; j < pec->num_stacks && phb_id < chip->num_phbs;
+             j++, phb_id++) {
+            PnvPhb4PecStack *stack = &pec->stacks[j];
+            Object *obj = OBJECT(&stack->phb);
+
+            object_property_set_int(obj, phb_id, "index", &error_fatal);
+            object_property_set_int(obj, chip->chip_id, "chip-id",
+                                    &error_fatal);
+            object_property_set_int(obj, PNV_PHB5_VERSION, "version",
+                                    &error_fatal);
+            object_property_set_int(obj, PNV_PHB5_DEVICE_ID, "device-id",
+                                    &error_fatal);
+            object_property_set_link(obj, OBJECT(stack), "stack", &error_abort);
+            object_property_set_bool(obj, true, "realized", &local_err);
+            if (local_err) {
+                error_propagate(errp, local_err);
+                return;
+            }
+            qdev_set_parent_bus(DEVICE(obj), sysbus_get_default());
+
+            /* Populate the XSCOM address space. */
+            pnv_xscom_add_subregion(chip,
+                                   pec_nest_base + 0x40 * (stack->stack_no + 1),
+                                   &stack->nest_regs_mr);
+            pnv_xscom_add_subregion(chip,
+                                    pec_pci_base + 0x40 * (stack->stack_no + 1),
+                                    &stack->pci_regs_mr);
+            pnv_xscom_add_subregion(chip,
+                                    pec_pci_base + PNV9_XSCOM_PEC_PCI_STK0 +
+                                    0x40 * stack->stack_no,
+                                    &stack->phb_regs_mr);
+        }
+    }
+}
+
 static void pnv_chip_power10_realize(DeviceState *dev, Error **errp)
 {
     PnvChipClass *pcc = PNV_CHIP_GET_CLASS(dev);
@@ -1737,6 +1830,13 @@ static void pnv_chip_power10_realize(DeviceState *dev, Error **errp)
     }
     pnv_xscom_add_subregion(chip, PNV10_XSCOM_OCC_BASE,
                             &chip10->occ.xscom_regs);
+
+    /* PHBs */
+    pnv_chip_power10_phb_realize(chip, &local_err);
+    if (local_err) {
+        error_propagate(errp, local_err);
+        return;
+    }
 }
 
 static uint32_t pnv_chip_power10_xscom_pcba(PnvChip *chip, uint64_t addr)
@@ -1763,6 +1863,7 @@ static void pnv_chip_power10_class_init(ObjectClass *klass, void *data)
     k->xscom_core_base = pnv_chip_power10_xscom_core_base;
     k->xscom_pcba = pnv_chip_power10_xscom_pcba;
     dc->desc = "PowerNV Chip POWER10";
+    k->num_phbs = 6;
 
     device_class_set_parent_realize(dc, pnv_chip_power10_realize,
                                     &k->parent_realize);
-- 
2.25.4



^ permalink raw reply related	[flat|nested] 25+ messages in thread

* [PATCH 9/9] ppc/psi: Add support for StoreEOI and 64k ESB pages (POWER10)
  2020-05-13 15:11 [PATCH 0/9] ppc/pnv: Introduce the XIVE2 and PHB5 controllers for the POWER10 chip Cédric Le Goater
                   ` (7 preceding siblings ...)
  2020-05-13 15:11 ` [PATCH 8/9] ppc/pnv: Add model for POWER9 PHB5 PCIe Host bridge Cédric Le Goater
@ 2020-05-13 15:11 ` Cédric Le Goater
  2020-05-19  9:40 ` [PATCH 0/9] ppc/pnv: Introduce the XIVE2 and PHB5 controllers for the POWER10 chip Greg Kurz
  9 siblings, 0 replies; 25+ messages in thread
From: Cédric Le Goater @ 2020-05-13 15:11 UTC (permalink / raw)
  To: David Gibson; +Cc: Cédric Le Goater, qemu-ppc, Greg Kurz, qemu-devel

POWER10 adds support for StoreEOI operation and 64K ESB pages on PSIHB
to be consistent with the other interrupt sources of the system.

Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 hw/ppc/pnv.c     |  6 ++++++
 hw/ppc/pnv_psi.c | 32 +++++++++++++++++++++++++-------
 2 files changed, 31 insertions(+), 7 deletions(-)

diff --git a/hw/ppc/pnv.c b/hw/ppc/pnv.c
index ac4bd2a17a9e..0062e9b5ab28 100644
--- a/hw/ppc/pnv.c
+++ b/hw/ppc/pnv.c
@@ -1523,6 +1523,9 @@ static void pnv_chip_power9_realize(DeviceState *dev, Error **errp)
     /* Processor Service Interface (PSI) Host Bridge */
     object_property_set_int(OBJECT(&chip9->psi), PNV9_PSIHB_BASE(chip),
                             "bar", &error_fatal);
+    /* This is the only device with 4k ESB pages */
+    object_property_set_int(OBJECT(&chip9->psi), XIVE_ESB_4K, "shift",
+                            &error_fatal);
     object_property_set_bool(OBJECT(&chip9->psi), true, "realized", &local_err);
     if (local_err) {
         error_propagate(errp, local_err);
@@ -1795,6 +1798,9 @@ static void pnv_chip_power10_realize(DeviceState *dev, Error **errp)
     /* Processor Service Interface (PSI) Host Bridge */
     object_property_set_int(OBJECT(&chip10->psi), PNV10_PSIHB_BASE(chip),
                             "bar", &error_fatal);
+    /* PSI can now be configured to use 64k ESB pages on POWER10 */
+    object_property_set_int(OBJECT(&chip10->psi), XIVE_ESB_64K, "shift",
+                            &error_fatal);
     object_property_set_bool(OBJECT(&chip10->psi), true, "realized",
                              &local_err);
     if (local_err) {
diff --git a/hw/ppc/pnv_psi.c b/hw/ppc/pnv_psi.c
index c34a49b000f2..fbf92cf93a22 100644
--- a/hw/ppc/pnv_psi.c
+++ b/hw/ppc/pnv_psi.c
@@ -607,7 +607,6 @@ static const TypeInfo pnv_psi_power8_info = {
 #define   PSIHB9_IRQ_METHOD             PPC_BIT(0)
 #define   PSIHB9_IRQ_RESET              PPC_BIT(1)
 #define PSIHB9_ESB_CI_BASE              0x60
-#define   PSIHB9_ESB_CI_64K             PPC_BIT(1)
 #define   PSIHB9_ESB_CI_ADDR_MASK       PPC_BITMASK(8, 47)
 #define   PSIHB9_ESB_CI_VALID           PPC_BIT(63)
 #define PSIHB9_ESB_NOTIF_ADDR           0x68
@@ -652,6 +651,14 @@ static const TypeInfo pnv_psi_power8_info = {
 #define   PSIHB9_IRQ_STAT_DIO           PPC_BIT(12)
 #define   PSIHB9_IRQ_STAT_PSU           PPC_BIT(13)
 
+/* P10 register extensions */
+
+#define PSIHB10_CR                       PSIHB9_CR
+#define    PSIHB10_CR_STORE_EOI          PPC_BIT(12)
+
+#define PSIHB10_ESB_CI_BASE              PSIHB9_ESB_CI_BASE
+#define   PSIHB10_ESB_CI_64K             PPC_BIT(1)
+
 static void pnv_psi_notify(XiveNotifier *xf, uint32_t srcno)
 {
     PnvPsi *psi = PNV_PSI(xf);
@@ -710,6 +717,13 @@ static void pnv_psi_p9_mmio_write(void *opaque, hwaddr addr,
 
     switch (addr) {
     case PSIHB9_CR:
+        if (val & PSIHB10_CR_STORE_EOI) {
+            psi9->source.esb_flags |= XIVE_SRC_STORE_EOI;
+        } else {
+            psi9->source.esb_flags &= ~XIVE_SRC_STORE_EOI;
+        }
+        break;
+
     case PSIHB9_SEMR:
         /* FSP stuff */
         break;
@@ -721,15 +735,20 @@ static void pnv_psi_p9_mmio_write(void *opaque, hwaddr addr,
         break;
 
     case PSIHB9_ESB_CI_BASE:
+        if (val & PSIHB10_ESB_CI_64K) {
+            psi9->source.esb_shift = XIVE_ESB_64K;
+        } else {
+            psi9->source.esb_shift = XIVE_ESB_4K;
+        }
         if (!(val & PSIHB9_ESB_CI_VALID)) {
             if (psi->regs[reg] & PSIHB9_ESB_CI_VALID) {
                 memory_region_del_subregion(sysmem, &psi9->source.esb_mmio);
             }
         } else {
             if (!(psi->regs[reg] & PSIHB9_ESB_CI_VALID)) {
-                memory_region_add_subregion(sysmem,
-                                        val & ~PSIHB9_ESB_CI_VALID,
-                                        &psi9->source.esb_mmio);
+                hwaddr addr = val & ~(PSIHB9_ESB_CI_VALID | PSIHB10_ESB_CI_64K);
+                memory_region_add_subregion(sysmem, addr,
+                                            &psi9->source.esb_mmio);
             }
         }
         psi->regs[reg] = val;
@@ -838,6 +857,8 @@ static void pnv_psi_power9_instance_init(Object *obj)
 
     object_initialize_child(obj, "source", &psi->source, sizeof(psi->source),
                             TYPE_XIVE_SOURCE, &error_abort, NULL);
+    object_property_add_alias(obj, "shift", OBJECT(&psi->source), "shift",
+                              &error_abort);
 }
 
 static void pnv_psi_power9_realize(DeviceState *dev, Error **errp)
@@ -847,9 +868,6 @@ static void pnv_psi_power9_realize(DeviceState *dev, Error **errp)
     Error *local_err = NULL;
     int i;
 
-    /* This is the only device with 4k ESB pages */
-    object_property_set_int(OBJECT(xsrc), XIVE_ESB_4K, "shift",
-                            &error_fatal);
     object_property_set_int(OBJECT(xsrc), PSIHB9_NUM_IRQS, "nr-irqs",
                             &error_fatal);
     object_property_set_link(OBJECT(xsrc), OBJECT(psi), "xive", &error_abort);
-- 
2.25.4



^ permalink raw reply related	[flat|nested] 25+ messages in thread

* Re: [PATCH 2/9] ppc/xive: Export xive_presenter_notify()
  2020-05-13 15:11 ` [PATCH 2/9] ppc/xive: Export xive_presenter_notify() Cédric Le Goater
@ 2020-05-19  9:18   ` Greg Kurz
  0 siblings, 0 replies; 25+ messages in thread
From: Greg Kurz @ 2020-05-19  9:18 UTC (permalink / raw)
  To: Cédric Le Goater; +Cc: qemu-ppc, qemu-devel, David Gibson

On Wed, 13 May 2020 17:11:02 +0200
Cédric Le Goater <clg@kaod.org> wrote:

> It's generic enough to be used from the XIVE2 router and avoid more
> duplication.
> 
> Signed-off-by: Cédric Le Goater <clg@kaod.org>
> ---

Reviewed-by: Greg Kurz <groug@kaod.org>

>  include/hw/ppc/xive.h | 4 ++++
>  hw/intc/xive.c        | 8 ++++----
>  2 files changed, 8 insertions(+), 4 deletions(-)
> 
> diff --git a/include/hw/ppc/xive.h b/include/hw/ppc/xive.h
> index 112fb6fb6dbe..88b0a2a3811f 100644
> --- a/include/hw/ppc/xive.h
> +++ b/include/hw/ppc/xive.h
> @@ -406,6 +406,10 @@ int xive_presenter_tctx_match(XivePresenter *xptr, XiveTCTX *tctx,
>                                uint8_t format,
>                                uint8_t nvt_blk, uint32_t nvt_idx,
>                                bool cam_ignore, uint32_t logic_serv);
> +bool xive_presenter_notify(XiveFabric *xfb, uint8_t format,
> +                           uint8_t nvt_blk, uint32_t nvt_idx,
> +                           bool cam_ignore, uint8_t priority,
> +                           uint32_t logic_serv);
>  
>  /*
>   * XIVE Fabric (Interface between Interrupt Controller and Machine)
> diff --git a/hw/intc/xive.c b/hw/intc/xive.c
> index b8825577f719..f08fcec1c039 100644
> --- a/hw/intc/xive.c
> +++ b/hw/intc/xive.c
> @@ -1481,10 +1481,10 @@ int xive_presenter_tctx_match(XivePresenter *xptr, XiveTCTX *tctx,
>   *
>   * The parameters represent what is sent on the PowerBus
>   */
> -static bool xive_presenter_notify(XiveFabric *xfb, uint8_t format,
> -                                  uint8_t nvt_blk, uint32_t nvt_idx,
> -                                  bool cam_ignore, uint8_t priority,
> -                                  uint32_t logic_serv)
> +bool xive_presenter_notify(XiveFabric *xfb, uint8_t format,
> +                           uint8_t nvt_blk, uint32_t nvt_idx,
> +                           bool cam_ignore, uint8_t priority,
> +                           uint32_t logic_serv)
>  {
>      XiveFabricClass *xfc = XIVE_FABRIC_GET_CLASS(xfb);
>      XiveTCTXMatch match = { .tctx = NULL, .ring = 0 };



^ permalink raw reply	[flat|nested] 25+ messages in thread

* Re: [PATCH 0/9] ppc/pnv: Introduce the XIVE2 and PHB5 controllers for the POWER10 chip
  2020-05-13 15:11 [PATCH 0/9] ppc/pnv: Introduce the XIVE2 and PHB5 controllers for the POWER10 chip Cédric Le Goater
                   ` (8 preceding siblings ...)
  2020-05-13 15:11 ` [PATCH 9/9] ppc/psi: Add support for StoreEOI and 64k ESB pages (POWER10) Cédric Le Goater
@ 2020-05-19  9:40 ` Greg Kurz
  9 siblings, 0 replies; 25+ messages in thread
From: Greg Kurz @ 2020-05-19  9:40 UTC (permalink / raw)
  To: Cédric Le Goater; +Cc: qemu-ppc, qemu-devel, David Gibson

On Wed, 13 May 2020 17:11:00 +0200
Cédric Le Goater <clg@kaod.org> wrote:

> Hello,
> 
> This series completes the PowerNV POWER10 machine with the XIVE2
> interrupt controller and the PHB5 PCI host bridge controller.
> 
> The XIVE2 interrupt controller of the POWER10 processor follows the
> same logic than on POWER9 but the HW interface has been largely
> reviewed. To avoid adding too much complexity in the P9 XIVE models,
> a new XIVE2 core framework is introduced.
> 
> The PHB5 and PHB4 controllers are very similar. Not much changes there
> apart from the mapping addresses and ids. There is more to come on
> PHB5 regarding interrupt offload on the interrupt controller, but this
> is for another round.
> 
> This series also adds basic OCC and CPU Quad models which are not very
> much exercised by the firmware.
> 
> Thanks,
> 
> C.
> 

This series is huge and it requires great knowledge of the HW, that I don't
have (who does? ;-), to do a real review. I'll stick to find obvious errors
and nits...

> Cédric Le Goater (9):
>   ppc/xive: Export PQ get/set routines
>   ppc/xive: Export xive_presenter_notify()
>   ppc/xive2: Introduce a XIVE2 core framework
>   ppc/xive2: Introduce a presenter matching routine
>   ppc/pnv: Add a XIVE2 controller to the POWER10 chip.
>   ppc/pnv: Add a OCC model for POWER10
>   ppc/pnv: Add POWER10 quads
>   ppc/pnv: Add model for POWER9 PHB5 PCIe Host bridge
>   ppc/psi: Add support for StoreEOI and 64k ESB pages (POWER10)
> 
>  hw/intc/pnv_xive2_regs.h       |  428 +++++++
>  include/hw/pci-host/pnv_phb4.h |   11 +
>  include/hw/ppc/pnv.h           |   30 +
>  include/hw/ppc/pnv_occ.h       |    2 +
>  include/hw/ppc/pnv_xive.h      |   71 ++
>  include/hw/ppc/pnv_xscom.h     |   12 +
>  include/hw/ppc/xive.h          |    8 +
>  include/hw/ppc/xive2.h         |   93 ++
>  include/hw/ppc/xive2_regs.h    |  198 ++++
>  hw/intc/pnv_xive2.c            | 2026 ++++++++++++++++++++++++++++++++
>  hw/intc/spapr_xive_kvm.c       |    8 +-
>  hw/intc/xive.c                 |   14 +-
>  hw/intc/xive2.c                |  756 ++++++++++++
>  hw/pci-host/pnv_phb4_pec.c     |   44 +
>  hw/ppc/pnv.c                   |  243 +++-
>  hw/ppc/pnv_occ.c               |   17 +
>  hw/ppc/pnv_psi.c               |   32 +-
>  hw/intc/Makefile.objs          |    4 +-
>  18 files changed, 3974 insertions(+), 23 deletions(-)
>  create mode 100644 hw/intc/pnv_xive2_regs.h
>  create mode 100644 include/hw/ppc/xive2.h
>  create mode 100644 include/hw/ppc/xive2_regs.h
>  create mode 100644 hw/intc/pnv_xive2.c
>  create mode 100644 hw/intc/xive2.c
> 



^ permalink raw reply	[flat|nested] 25+ messages in thread

* Re: [PATCH 5/9] ppc/pnv: Add a XIVE2 controller to the POWER10 chip.
  2020-05-13 15:11 ` [PATCH 5/9] ppc/pnv: Add a XIVE2 controller to the POWER10 chip Cédric Le Goater
@ 2020-05-19  9:48   ` Greg Kurz
  2020-05-25 10:12     ` Cédric Le Goater
  0 siblings, 1 reply; 25+ messages in thread
From: Greg Kurz @ 2020-05-19  9:48 UTC (permalink / raw)
  To: Cédric Le Goater; +Cc: qemu-ppc, qemu-devel, David Gibson

On Wed, 13 May 2020 17:11:05 +0200
Cédric Le Goater <clg@kaod.org> wrote:

> The XIVE2 interrupt controller of the POWER10 processor follows the
> same logic than on POWER9 but the HW interface has been largely
> reviewed.  It has a new register interface, different BARs, extra
> VSDs, new layout for the XIVE2 structures, and a set of new features
> which are described below.
> 
> This is a model of the POWER10 XIVE2 interrupt controller for the
> PowerNV machine. It focuses primarily on the needs of the skiboot
> firmware but some initial hypervisor support is implemented for KVM
> use (escalation).
> 
> Support for new features will be implemented in time and will require
> new support from the OS.
> 
> * XIVE2 BARS
> 
> The interrupt controller BARs have a different layout outlined below.
> Each sub-engine has now own its range and the indirect TIMA access was
> replaced with a set of pages, one per CPU, under the IC BAR:
> 
>   - IC BAR (Interrupt Controller)
>     . 4 pages, one per sub-engine
>     . 128 indirect TIMA pages
>   - TM BAR (Thread Interrupt Management Area)
>     . 4 pages
>   - ESB BAR (ESB pages for IPIs)
>     . up to 1TB
>   - END BAR (ESB pages for ENDs)
>     . up to 2TB
>   - NVC BAR (Notification Virtual Crowd)
>     . up to 128
>   - NVPG BAR (Notification Virtual Process and Group)
>     . up to 1TB
>   - Direct mapped Thread Context Area (reads & writes)
> 
> OPAL does not use the grouping and crowd capability.
> 
> * Virtual Structure Tables
> 
> XIVE2 adds new tables types and also changes the field layout of the END
> and NVP Virtualization Structure Descriptors.
> 
>   - EAS
>   - END new layout
>   - NVT was splitted in :
>     . NVP (Processor), 32B
>     . NVG (Group), 32B
>     . NVC (Crowd == P9 block group) 32B
>   - IC for remote configuration
>   - SYNC for cache injection
>   - ERQ for event input queue
> 
> The setup is slighly different on XIVE2 because the indexing has changed
> for some of the tables, block ID or the chip topology ID can be used.
> 
> * XIVE2 features
> 
> SCOM and MMIO registers have a new layout and XIVE2 adds a new global
> capability and configuration registers.
> 
> The lowlevel hardware offers a set of new features among which :
> 
>   - a configurable number of priorities : 1 - 8
>   - StoreEOI with load-after-store ordering is activated by default
>   - Gen2 TIMA layout
>   - A P9-compat mode, or Gen1, TIMA toggle bit for SW compatibility
>   - increase to 24bit for VP number
> 
> Other features will have some impact on the Hypervisor and guest OS
> when activated, but this is not required for initial support of the
> controller.
> 
> Signed-off-by: Cédric Le Goater <clg@kaod.org>
> ---

Apart from plugging the XIVE2 on the main system bus, like Markus's
fix for XIVE, I don't see any obvious things to change.

>  hw/intc/pnv_xive2_regs.h   |  428 ++++++++
>  include/hw/ppc/pnv.h       |   22 +
>  include/hw/ppc/pnv_xive.h  |   71 ++
>  include/hw/ppc/pnv_xscom.h |    3 +
>  hw/intc/pnv_xive2.c        | 2026 ++++++++++++++++++++++++++++++++++++
>  hw/ppc/pnv.c               |   89 +-
>  hw/intc/Makefile.objs      |    2 +-
>  7 files changed, 2637 insertions(+), 4 deletions(-)
>  create mode 100644 hw/intc/pnv_xive2_regs.h
>  create mode 100644 hw/intc/pnv_xive2.c
> 
> diff --git a/hw/intc/pnv_xive2_regs.h b/hw/intc/pnv_xive2_regs.h
> new file mode 100644
> index 000000000000..6ad0eee824b1
> --- /dev/null
> +++ b/hw/intc/pnv_xive2_regs.h
> @@ -0,0 +1,428 @@
> +/*
> + * QEMU PowerPC XIVE2 interrupt controller model  (POWER10)
> + *
> + * Copyright (c) 2019-2020, IBM Corporation.
> + *
> + * This code is licensed under the GPL version 2 or later. See the
> + * COPYING file in the top-level directory.
> + */
> +
> +#ifndef PPC_PNV_XIVE2_REGS_H
> +#define PPC_PNV_XIVE2_REGS_H
> +
> +/*
> + * CQ Common Queue (PowerBus bridge) Registers
> + */
> +
> +/* XIVE2 Capabilities */
> +#define X_CQ_XIVE_CAP                           0x02
> +#define CQ_XIVE_CAP                             0x010
> +#define    CQ_XIVE_CAP_VERSION                  PPC_BITMASK(0, 3)
> +/* 4:6 reserved */
> +#define    CQ_XIVE_CAP_USER_INT_PRIO            PPC_BITMASK(8, 9)
> +#define       CQ_XIVE_CAP_USER_INT_PRIO_1       0
> +#define       CQ_XIVE_CAP_USER_INT_PRIO_1_2     1
> +#define       CQ_XIVE_CAP_USER_INT_PRIO_1_4     2
> +#define       CQ_XIVE_CAP_USER_INT_PRIO_1_8     3
> +#define    CQ_XIVE_CAP_VP_INT_PRIO              PPC_BITMASK(10, 11)
> +#define       CQ_XIVE_CAP_VP_INT_PRIO_1_8       0
> +#define       CQ_XIVE_CAP_VP_INT_PRIO_2_8       1
> +#define       CQ_XIVE_CAP_VP_INT_PRIO_4_8       2
> +#define       CQ_XIVE_CAP_VP_INT_PRIO_8         3
> +#define    CQ_XIVE_CAP_BLOCK_ID_WIDTH           PPC_BITMASK(12, 13)
> +
> +/* XIVE2 Configuration */
> +#define X_CQ_XIVE_CFG                           0x03
> +#define CQ_XIVE_CFG                             0x018
> +
> +/* 0:7 reserved */
> +#define    CQ_XIVE_CFG_USER_INT_PRIO            PPC_BITMASK(8, 9)
> +#define    CQ_XIVE_CFG_VP_INT_PRIO              PPC_BITMASK(10, 11)
> +#define       CQ_XIVE_CFG_INT_PRIO_1            0
> +#define       CQ_XIVE_CFG_INT_PRIO_2            1
> +#define       CQ_XIVE_CFG_INT_PRIO_4            2
> +#define       CQ_XIVE_CFG_INT_PRIO_8            3
> +#define    CQ_XIVE_CFG_BLOCK_ID_WIDTH           PPC_BITMASK(12, 13)
> +#define       CQ_XIVE_CFG_BLOCK_ID_4BITS        0
> +#define       CQ_XIVE_CFG_BLOCK_ID_5BITS        1
> +#define       CQ_XIVE_CFG_BLOCK_ID_6BITS        2
> +#define       CQ_XIVE_CFG_BLOCK_ID_7BITS        3
> +#define    CQ_XIVE_CFG_HYP_HARD_RANGE           PPC_BITMASK(14, 15)
> +#define       CQ_XIVE_CFG_THREADID_7BITS        0
> +#define       CQ_XIVE_CFG_THREADID_8BITS        1
> +#define       CQ_XIVE_CFG_THREADID_9BITS        2
> +#define       CQ_XIVE_CFG_THREADID_10BITs       3
> +#define    CQ_XIVE_CFG_HYP_HARD_BLKID_OVERRIDE  PPC_BIT(16)
> +#define    CQ_XIVE_CFG_HYP_HARD_BLOCK_ID        PPC_BITMASK(17, 23)
> +
> +/* Interrupt Controller Base Address Register - 512 pages (32M) */
> +#define X_CQ_IC_BAR                             0x08
> +#define CQ_IC_BAR                               0x040
> +#define    CQ_IC_BAR_VALID                      PPC_BIT(0)
> +#define    CQ_IC_BAR_64K                        PPC_BIT(1)
> +/* 2:7 reserved */
> +#define    CQ_IC_BAR_ADDR                       PPC_BITMASK(8, 42)
> +/* 43:63 reserved */
> +
> +/* Thread Management Base Address Register - 4 pages */
> +#define X_CQ_TM_BAR                             0x09
> +#define CQ_TM_BAR                               0x048
> +#define    CQ_TM_BAR_VALID                      PPC_BIT(0)
> +#define    CQ_TM_BAR_64K                        PPC_BIT(1)
> +#define    CQ_TM_BAR_ADDR                       PPC_BITMASK(8, 49)
> +
> +/* ESB Base Address Register */
> +#define X_CQ_ESB_BAR                            0x0A
> +#define CQ_ESB_BAR                              0x050
> +#define    CQ_BAR_VALID                         PPC_BIT(0)
> +#define    CQ_BAR_64K                           PPC_BIT(1)
> +/* 2:7 reserved */
> +#define    CQ_BAR_ADDR                          PPC_BITMASK(8, 39)
> +#define    CQ_BAR_SET_DIV                       PPC_BITMASK(56, 58)
> +#define    CQ_BAR_RANGE                         PPC_BITMASK(59, 63)
> +                                                /* 0 (16M) - 16 (16T) */
> +
> +/* END Base Address Register */
> +#define X_CQ_END_BAR                            0x0B
> +#define CQ_END_BAR                              0x058
> +
> +/* NVPG Base Address Register */
> +#define X_CQ_NVPG_BAR                           0x0C
> +#define CQ_NVPG_BAR                             0x060
> +
> +/* NVC Base Address Register */
> +#define X_CQ_NVC_BAR                            0x0D
> +#define CQ_NVC_BAR                              0x068
> +
> +/* Table Address Register */
> +#define X_CQ_TAR                                0x0E
> +#define CQ_TAR                                  0x070
> +#define     CQ_TAR_AUTOINC                      PPC_BIT(0)
> +#define     CQ_TAR_SELECT                       PPC_BITMASK(12, 15)
> +#define     CQ_TAR_ESB                          0       /* 0 - 15 */
> +#define     CQ_TAR_END                          2       /* 0 - 15 */
> +#define     CQ_TAR_NVPG                         3       /* 0 - 15 */
> +#define     CQ_TAR_NVC                          5       /* 0 - 15 */
> +#define     CQ_TAR_ENTRY_SELECT                 PPC_BITMASK(28, 31)
> +
> +/* Table Data Register */
> +#define X_CQ_TDR                                0x0F
> +#define CQ_TDR                                  0x078
> +/* for the NVPG, NVC, ESB, END Set Translation Tables */
> +#define     CQ_TDR_VALID                        PPC_BIT(0)
> +#define     CQ_TDR_BLOCK_ID                     PPC_BITMASK(60, 63)
> +
> +/*
> + * Processor Cores Enabled for MsgSnd
> + * Identifies which of the 32 possible core chiplets are enabled and
> + * available to receive the MsgSnd command
> + */
> +#define X_CQ_MSGSND                             0x10
> +#define CQ_MSGSND                               0x080
> +
> +/* Interrupt Unit Reset Control */
> +#define X_CQ_RST_CTL                            0x12
> +#define CQ_RST_CTL                              0x090
> +#define     CQ_RST_SYNC_RESET                   PPC_BIT(0)      /* Write Only */
> +#define     CQ_RST_QUIESCE_PB                   PPC_BIT(1)      /* RW */
> +#define     CQ_RST_MASTER_IDLE                  PPC_BIT(2)      /* Read Only */
> +#define     CQ_RST_SAVE_IDLE                    PPC_BIT(3)      /* Read Only */
> +#define     CQ_RST_PB_BAR_RESET                 PPC_BIT(4)      /* Write Only */
> +
> +/* PowerBus General Configuration */
> +#define X_CQ_CFG_PB_GEN                         0x14
> +#define CQ_CFG_PB_GEN                           0x0A0
> +#define    CQ_CFG_PB_GEN_PB_INIT                PPC_BIT(45)
> +
> +/*
> + * FIR
> + *     (And-Mask)
> + *     (Or-Mask)
> + */
> +#define X_CQ_FIR                                0x30
> +#define X_CQ_FIR_AND                            0x31
> +#define X_CQ_FIR_OR                             0x32
> +#define CQ_FIR                                  0x180
> +#define CQ_FIR_AND                              0x188
> +#define CQ_FIR_OR                               0x190
> +#define  CQ_FIR_PB_RCMDX_CI_ERR1                PPC_BIT(19)
> +#define  CQ_FIR_VC_INFO_ERROR_0_2               PPC_BITMASK(61, 63)
> +
> +/*
> + * FIR Mask
> + *     (And-Mask)
> + *     (Or-Mask)
> + */
> +#define X_CQ_FIRMASK                            0x33
> +#define X_CQ_FIRMASK_AND                        0x34
> +#define X_CQ_FIRMASK_OR                         0x35
> +#define CQ_FIRMASK                              0x198
> +#define CQ_FIRMASK_AND                          0x1A0
> +#define CQ_FIRMASK_OR                           0x1A8
> +
> +/*
> + * VC0
> + */
> +
> +/* VSD table address */
> +#define X_VC_VSD_TABLE_ADDR                     0x100
> +#define VC_VSD_TABLE_ADDR                       0x000
> +#define   VC_VSD_TABLE_AUTOINC                  PPC_BIT(0)
> +#define   VC_VSD_TABLE_SELECT                   PPC_BITMASK(12, 15)
> +#define   VC_VSD_TABLE_ADDRESS                  PPC_BITMASK(28, 31)
> +
> +/* VSD table data */
> +#define X_VC_VSD_TABLE_DATA                     0x101
> +#define VC_VSD_TABLE_DATA                       0x008
> +
> +/* AIB AT macro indirect kill */
> +#define X_VC_AT_MACRO_KILL                      0x102
> +#define VC_AT_MACRO_KILL                        0x010
> +#define  VC_AT_MACRO_KILL_VALID                 PPC_BIT(0)
> +#define  VC_AT_MACRO_KILL_VSD                   PPC_BITMASK(12, 15)
> +#define  VC_AT_MACRO_KILL_BLOCK_ID              PPC_BITMASK(28, 31)
> +#define  VC_AT_MACRO_KILL_OFFSET                PPC_BITMASK(48, 60)
> +
> +/* AIB AT macro indirect kill mask (same bit definitions) */
> +#define X_VC_AT_MACRO_KILL_MASK                 0x103
> +#define VC_AT_MACRO_KILL_MASK                   0x018
> +
> +/* Remote IRQs and ERQs configuration [n] (n = 0:6) */
> +#define X_VC_QUEUES_CFG_REM0                    0x117
> +
> +#define VC_QUEUES_CFG_REM0                      0x0B8
> +#define VC_QUEUES_CFG_REM1                      0x0C0
> +#define VC_QUEUES_CFG_REM2                      0x0C8
> +#define VC_QUEUES_CFG_REM3                      0x0D0
> +#define VC_QUEUES_CFG_REM4                      0x0D8
> +#define VC_QUEUES_CFG_REM5                      0x0E0
> +#define VC_QUEUES_CFG_REM6                      0x0E8
> +#define  VC_QUEUES_CFG_MEMB_EN                  PPC_BIT(38)
> +#define  VC_QUEUES_CFG_MEMB_SZ                  PPC_BITMASK(42, 47)
> +
> +/*
> + * VC1
> + */
> +
> +/* ESBC cache flush control trigger */
> +#define X_VC_ESBC_FLUSH_CTRL                    0x140
> +#define VC_ESBC_FLUSH_CTRL                      0x200
> +#define  VC_ESBC_FLUSH_CTRL_POLL_VALID          PPC_BIT(0)
> +#define  VC_ESBC_FLUSH_CTRL_WANT_CACHE_DISABLE  PPC_BIT(2)
> +
> +/* ESBC cache flush poll trigger */
> +#define X_VC_ESBC_FLUSH_POLL                    0x141
> +#define VC_ESBC_FLUSH_POLL                      0x208
> +#define  VC_ESBC_FLUSH_POLL_BLOCK_ID            PPC_BITMASK(0, 3)
> +#define  VC_ESBC_FLUSH_POLL_OFFSET              PPC_BITMASK(4, 31)  /* 28-bit */
> +#define  VC_ESBC_FLUSH_POLL_BLOCK_ID_MASK       PPC_BITMASK(32, 35)
> +#define  VC_ESBC_FLUSH_POLL_OFFSET_MASK         PPC_BITMASK(36, 63) /* 28-bit */
> +
> +/* EASC flush control register */
> +#define X_VC_EASC_FLUSH_CTRL                    0x160
> +#define VC_EASC_FLUSH_CTRL                      0x300
> +#define  VC_EASC_FLUSH_CTRL_POLL_VALID          PPC_BIT(0)
> +#define  VC_EASC_FLUSH_CTRL_WANT_CACHE_DISABLE  PPC_BIT(2)
> +
> +/* EASC flush poll register */
> +#define X_VC_EASC_FLUSH_POLL                    0x161
> +#define VC_EASC_FLUSH_POLL                      0x308
> +#define  VC_EASC_FLUSH_POLL_BLOCK_ID            PPC_BITMASK(0, 3)
> +#define  VC_EASC_FLUSH_POLL_OFFSET              PPC_BITMASK(4, 31)  /* 28-bit */
> +#define  VC_EASC_FLUSH_POLL_BLOCK_ID_MASK       PPC_BITMASK(32, 35)
> +#define  VC_EASC_FLUSH_POLL_OFFSET_MASK         PPC_BITMASK(36, 63) /* 28-bit */
> +
> +/*
> + * VC2
> + */
> +
> +/* ENDC flush control register */
> +#define X_VC_ENDC_FLUSH_CTRL                    0x180
> +#define VC_ENDC_FLUSH_CTRL                      0x400
> +#define  VC_ENDC_FLUSH_CTRL_POLL_VALID          PPC_BIT(0)
> +#define  VC_ENDC_FLUSH_CTRL_WANT_CACHE_DISABLE  PPC_BIT(2)
> +#define  VC_ENDC_FLUSH_CTRL_WANT_INVALIDATE     PPC_BIT(3)
> +#define  VC_ENDC_FLUSH_CTRL_INJECT_INVALIDATE   PPC_BIT(7)
> +
> +/* ENDC flush poll register */
> +#define X_VC_ENDC_FLUSH_POLL                    0x181
> +#define VC_ENDC_FLUSH_POLL                      0x408
> +#define  VC_ENDC_FLUSH_POLL_BLOCK_ID            PPC_BITMASK(4, 7)
> +#define  VC_ENDC_FLUSH_POLL_OFFSET              PPC_BITMASK(8, 31)  /* 24-bit */
> +#define  VC_ENDC_FLUSH_POLL_BLOCK_ID_MASK       PPC_BITMASK(36, 39)
> +#define  VC_ENDC_FLUSH_POLL_OFFSET_MASK         PPC_BITMASK(40, 63) /* 24-bit */
> +
> +/* ENDC Sync done */
> +#define X_VC_ENDC_SYNC_DONE                     0x184
> +#define VC_ENDC_SYNC_DONE                       0x420
> +#define   VC_ENDC_SYNC_POLL_DONE                PPC_BITMASK(0, 6)
> +#define   VC_ENDC_SYNC_QUEUE_IPI                PPC_BIT(0)
> +#define   VC_ENDC_SYNC_QUEUE_HWD                PPC_BIT(1)
> +#define   VC_ENDC_SYNC_QUEUE_NXC                PPC_BIT(2)
> +#define   VC_ENDC_SYNC_QUEUE_INT                PPC_BIT(3)
> +#define   VC_ENDC_SYNC_QUEUE_OS                 PPC_BIT(4)
> +#define   VC_ENDC_SYNC_QUEUE_POOL               PPC_BIT(5)
> +#define   VC_ENDC_SYNC_QUEUE_HARD               PPC_BIT(6)
> +#define   VC_QUEUE_COUNT                        7
> +
> +/* ENDC cache watch specification 0  */
> +#define X_VC_ENDC_WATCH0_SPEC                   0x1A0
> +#define VC_ENDC_WATCH0_SPEC                     0x500
> +#define   VC_ENDC_WATCH_CONFLICT                PPC_BIT(0)
> +#define   VC_ENDC_WATCH_FULL                    PPC_BIT(8)
> +#define   VC_ENDC_WATCH_BLOCK_ID                PPC_BITMASK(28, 31)
> +#define   VC_ENDC_WATCH_INDEX                   PPC_BITMASK(40, 63)
> +
> +/* ENDC cache watch data 0 */
> +#define X_VC_ENDC_WATCH0_DATA0                  0x1A4
> +#define X_VC_ENDC_WATCH0_DATA1                  0x1A5
> +#define X_VC_ENDC_WATCH0_DATA2                  0x1A6
> +#define X_VC_ENDC_WATCH0_DATA3                  0x1A7
> +
> +#define VC_ENDC_WATCH0_DATA0                    0x520
> +#define VC_ENDC_WATCH0_DATA1                    0x528
> +#define VC_ENDC_WATCH0_DATA2                    0x530
> +#define VC_ENDC_WATCH0_DATA3                    0x538
> +
> +/*
> + * PC LSB1
> + */
> +
> +/* VSD table address register */
> +#define X_PC_VSD_TABLE_ADDR                     0x200
> +#define PC_VSD_TABLE_ADDR                       0x000
> +#define   PC_VSD_TABLE_AUTOINC                  PPC_BIT(0)
> +#define   PC_VSD_TABLE_SELECT                   PPC_BITMASK(12, 15)
> +#define   PC_VSD_TABLE_ADDRESS                  PPC_BITMASK(28, 31)
> +
> +/* VSD table data register */
> +#define X_PC_VSD_TABLE_DATA                     0x201
> +#define PC_VSD_TABLE_DATA                       0x008
> +
> +/* AT indirect kill register */
> +#define X_PC_AT_KILL                            0x202
> +#define PC_AT_KILL                              0x010
> +#define     PC_AT_KILL_VALID                    PPC_BIT(0)
> +#define     PC_AT_KILL_VSD_TYPE                 PPC_BITMASK(24, 27)
> +/* Only NVP, NVG, NVC */
> +#define     PC_AT_KILL_BLOCK_ID                 PPC_BITMASK(28, 31)
> +#define     PC_AT_KILL_OFFSET                   PPC_BITMASK(48, 60)
> +
> +/* AT indirect kill mask register */
> +#define X_PC_AT_KILL_MASK                       0x203
> +#define PC_AT_KILL_MASK                         0x018
> +#define     PC_AT_KILL_MASK_VSD_TYPE            PPC_BITMASK(24, 27)
> +#define     PC_AT_KILL_MASK_BLOCK_ID            PPC_BITMASK(28, 31)
> +#define     PC_AT_KILL_MASK_OFFSET              PPC_BITMASK(48, 60)
> +
> +/*
> + * PC LSB2
> + */
> +
> +/* NxC Cache flush control */
> +#define X_PC_NXC_FLUSH_CTRL                     0x280
> +#define PC_NXC_FLUSH_CTRL                       0x400
> +#define  PC_NXC_FLUSH_CTRL_POLL_VALID           PPC_BIT(0)
> +#define  PC_NXC_FLUSH_CTRL_WANT_CACHE_DISABLE   PPC_BIT(2)
> +#define  PC_NXC_FLUSH_CTRL_WANT_INVALIDATE      PPC_BIT(3)
> +#define  PC_NXC_FLUSH_CTRL_INJECT_INVALIDATE    PPC_BIT(7)
> +
> +/* NxC Cache flush poll */
> +#define X_PC_NXC_FLUSH_POLL                     0x281
> +#define PC_NXC_FLUSH_POLL                       0x408
> +#define  PC_NXC_FLUSH_POLL_NXC_TYPE             PPC_BITMASK(2, 3)
> +#define    PC_NXC_FLUSH_POLL_NXC_TYPE_NVP       0
> +#define    PC_NXC_FLUSH_POLL_NXC_TYPE_NVG       2
> +#define    PC_NXC_FLUSH_POLL_NXC_TYPE_NVC       3
> +#define  PC_NXC_FLUSH_POLL_BLOCK_ID             PPC_BITMASK(4, 7)
> +#define  PC_NXC_FLUSH_POLL_OFFSET               PPC_BITMASK(8, 31)  /* 24-bit */
> +#define  PC_NXC_FLUSH_POLL_NXC_TYPE_MASK        PPC_BITMASK(34, 35) /* 0: Ign */
> +#define  PC_NXC_FLUSH_POLL_BLOCK_ID_MASK        PPC_BITMASK(36, 39)
> +#define  PC_NXC_FLUSH_POLL_OFFSET_MASK          PPC_BITMASK(40, 63) /* 24-bit */
> +
> +/* NxC Cache Watch 0 Specification */
> +#define X_PC_NXC_WATCH0_SPEC                    0x2A0
> +#define PC_NXC_WATCH0_SPEC                      0x500
> +#define   PC_NXC_WATCH_CONFLICT                 PPC_BIT(0)
> +#define   PC_NXC_WATCH_FULL                     PPC_BIT(8)
> +#define   PC_NXC_WATCH_NXC_TYPE                 PPC_BITMASK(26, 37)
> +#define     PC_NXC_WATCH_NXC_NVP                0
> +#define     PC_NXC_WATCH_NXC_NVG                2
> +#define     PC_NXC_WATCH_NXC_NVC                3
> +#define   PC_NXC_WATCH_BLOCK_ID                 PPC_BITMASK(28, 31)
> +#define   PC_NXC_WATCH_INDEX                    PPC_BITMASK(40, 63)
> +
> +/* NxC Cache Watch 0 Data */
> +#define X_PC_NXC_WATCH0_DATA0                   0x2A4
> +#define X_PC_NXC_WATCH0_DATA1                   0x2A5
> +#define X_PC_NXC_WATCH0_DATA2                   0x2A6
> +#define X_PC_NXC_WATCH0_DATA3                   0x2A7
> +
> +#define PC_NXC_WATCH0_DATA0                     0x520
> +#define PC_NXC_WATCH0_DATA1                     0x528
> +#define PC_NXC_WATCH0_DATA2                     0x530
> +#define PC_NXC_WATCH0_DATA3                     0x538
> +
> +/*
> + * TCTXT Registers
> + */
> +
> +/* Physical Thread Enable0 register */
> +#define X_TCTXT_EN0                             0x300
> +#define TCTXT_EN0                               0x000
> +
> +/* Physical Thread Enable0 Set register */
> +#define X_TCTXT_EN0_SET                         0x302
> +#define TCTXT_EN0_SET                           0x010
> +
> +/* Physical Thread Enable0 Reset register */
> +#define X_TCTXT_EN0_RESET                       0x303
> +#define TCTXT_EN0_RESET                         0x018
> +
> +/* Physical Thread Enable1 register */
> +#define X_TCTXT_EN1                             0x304
> +#define TCTXT_EN1                               0x020
> +
> +/* Physical Thread Enable1 Set register */
> +#define X_TCTXT_EN1_SET                         0x306
> +#define TCTXT_EN1_SET                           0x030
> +
> +/* Physical Thread Enable1 Reset register */
> +#define X_TCTXT_EN1_RESET                       0x307
> +#define TCTXT_EN1_RESET                         0x038
> +
> +/*
> + * VSD Tables
> + */
> +#define VST_ESB                  0
> +#define VST_EAS                  1 /* No used by PC */
> +#define VST_END                  2
> +#define VST_NVP                  3
> +#define VST_NVG                  4
> +#define VST_NVC                  5
> +#define VST_IC                   6 /* No used by PC */
> +#define VST_SYNC                 7
> +#define VST_ERQ                  8 /* No used by PC */
> +
> +/*
> + * Bits in a VSD entry.
> + *
> + * Note: the address is naturally aligned, we don't use a PPC_BITMASK,
> + *       but just a mask to apply to the address before OR'ing it in.
> + *
> + * Note: VSD_FIRMWARE is a SW bit ! It hijacks an unused bit in the
> + *       VSD and is only meant to be used in indirect mode !
> + */
> +#define VSD_MODE                PPC_BITMASK(0, 1)
> +#define  VSD_MODE_SHARED        1
> +#define  VSD_MODE_EXCLUSIVE     2
> +#define  VSD_MODE_FORWARD       3
> +#define VSD_FIRMWARE            PPC_BIT(2) /* Read warning */
> +#define VSD_FIRMWARE2           PPC_BIT(3) /* unused */
> +#define VSD_RESERVED            PPC_BITMASK(4, 7) /* P10 reserved */
> +#define VSD_ADDRESS_MASK        0x00fffffffffff000ull
> +#define VSD_MIGRATION_REG       PPC_BITMASK(52, 55)
> +#define VSD_INDIRECT            PPC_BIT(56)
> +#define VSD_TSIZE               PPC_BITMASK(59, 63)
> +
> +#endif /* PPC_PNV_XIVE2_REGS_H */
> diff --git a/include/hw/ppc/pnv.h b/include/hw/ppc/pnv.h
> index d4b0b0e2ff71..f318bb10add4 100644
> --- a/include/hw/ppc/pnv.h
> +++ b/include/hw/ppc/pnv.h
> @@ -119,10 +119,14 @@ typedef struct Pnv10Chip {
>      PnvChip      parent_obj;
>  
>      /*< public >*/
> +    PnvXive2     xive;
>      Pnv9Psi      psi;
>      PnvLpcController lpc;
>  } Pnv10Chip;
>  
> +#define PNV10_PIR2FUSEDCORE(pir) (((pir) >> 3) & 0xf)
> +#define PNV10_PIR2CHIP(pir)      (((pir) >> 8) & 0x7f)
> +
>  typedef struct PnvChipClass {
>      /*< private >*/
>      SysBusDeviceClass parent_class;
> @@ -340,10 +344,28 @@ void pnv_bmc_set_pnor(IPMIBmc *bmc, PnvPnor *pnor);
>  #define PNV10_LPCM_SIZE             0x0000000100000000ull
>  #define PNV10_LPCM_BASE(chip)       PNV10_CHIP_BASE(chip, 0x0006030000000000ull)
>  
> +#define PNV10_XIVE2_IC_SIZE         0x0000000002000000ull
> +#define PNV10_XIVE2_IC_BASE(chip)   PNV10_CHIP_BASE(chip, 0x0006030200000000ull)
> +
>  #define PNV10_PSIHB_ESB_SIZE        0x0000000000100000ull
>  #define PNV10_PSIHB_ESB_BASE(chip)  PNV10_CHIP_BASE(chip, 0x0006030202000000ull)
>  
>  #define PNV10_PSIHB_SIZE            0x0000000000100000ull
>  #define PNV10_PSIHB_BASE(chip)      PNV10_CHIP_BASE(chip, 0x0006030203000000ull)
>  
> +#define PNV10_XIVE2_TM_SIZE         0x0000000000040000ull
> +#define PNV10_XIVE2_TM_BASE(chip)   PNV10_CHIP_BASE(chip, 0x0006030203180000ull)
> +
> +#define PNV10_XIVE2_NVC_SIZE        0x0000000008000000ull
> +#define PNV10_XIVE2_NVC_BASE(chip)  PNV10_CHIP_BASE(chip, 0x0006030208000000ull)
> +
> +#define PNV10_XIVE2_NVPG_SIZE       0x0000010000000000ull
> +#define PNV10_XIVE2_NVPG_BASE(chip) PNV10_CHIP_BASE(chip, 0x0006040000000000ull)
> +
> +#define PNV10_XIVE2_ESB_SIZE        0x0000010000000000ull
> +#define PNV10_XIVE2_ESB_BASE(chip)  PNV10_CHIP_BASE(chip, 0x0006050000000000ull)
> +
> +#define PNV10_XIVE2_END_SIZE        0x0000020000000000ull
> +#define PNV10_XIVE2_END_BASE(chip)  PNV10_CHIP_BASE(chip, 0x0006060000000000ull)
> +
>  #endif /* PPC_PNV_H */
> diff --git a/include/hw/ppc/pnv_xive.h b/include/hw/ppc/pnv_xive.h
> index 76cf16f64472..7d8630775786 100644
> --- a/include/hw/ppc/pnv_xive.h
> +++ b/include/hw/ppc/pnv_xive.h
> @@ -11,6 +11,7 @@
>  #define PPC_PNV_XIVE_H
>  
>  #include "hw/ppc/xive.h"
> +#include "hw/ppc/xive2.h"
>  
>  struct PnvChip;
>  
> @@ -97,4 +98,74 @@ typedef struct PnvXiveClass {
>  
>  void pnv_xive_pic_print_info(PnvXive *xive, Monitor *mon);
>  
> +/*
> + * XIVE2 interrupt controller (POWER10)
> + */
> +#define TYPE_PNV_XIVE2 TYPE_PNV_XIVE "2"
> +#define PNV_XIVE2(obj) OBJECT_CHECK(PnvXive2, (obj), TYPE_PNV_XIVE2)
> +#define PNV_XIVE2_CLASS(klass)                                   \
> +    OBJECT_CLASS_CHECK(PnvXive2Class, (klass), TYPE_PNV_XIVE2)
> +#define PNV_XIVE2_GET_CLASS(obj)                                 \
> +    OBJECT_GET_CLASS(PnvXive2Class, (obj), TYPE_PNV_XIVE2)
> +
> +typedef struct PnvXive2 {
> +    Xive2Router   parent_obj;
> +
> +    /* Owning chip */
> +    struct PnvChip *chip;
> +
> +    /* XSCOM addresses giving access to the controller registers */
> +    MemoryRegion  xscom_regs;
> +
> +    MemoryRegion  ic_mmio;
> +    MemoryRegion  ic_mmios[8];
> +    MemoryRegion  esb_mmio;
> +    MemoryRegion  end_mmio;
> +    MemoryRegion  nvc_mmio;
> +    MemoryRegion  nvpg_mmio;
> +    MemoryRegion  tm_mmio;
> +
> +    /* Shortcut values for the Main MMIO regions */
> +    hwaddr        ic_base;
> +    uint32_t      ic_shift;
> +    hwaddr        esb_base;
> +    uint32_t      esb_shift;
> +    hwaddr        end_base;
> +    uint32_t      end_shift;
> +    hwaddr        nvc_base;
> +    uint32_t      nvc_shift;
> +    hwaddr        nvpg_base;
> +    uint32_t      nvpg_shift;
> +    hwaddr        tm_base;
> +    uint32_t      tm_shift;
> +
> +    /* Interrupt controller registers */
> +    uint64_t      cq_regs[0x40];
> +    uint64_t      vc_regs[0x100];
> +    uint64_t      pc_regs[0x100];
> +    uint64_t      tctxt_regs[0x30];
> +
> +    /* Our XIVE source objects for IPIs and ENDs */
> +    XiveSource    ipi_source;
> +    Xive2EndSource end_source;
> +
> +    /*
> +     * Virtual Structure Descriptor tables
> +     * These are in a SRAM protected by ECC.
> +     */
> +    uint64_t      vsds[9][XIVE_BLOCK_MAX];
> +
> +    /* Translation tables */
> +    uint64_t      tables[8][XIVE_BLOCK_MAX];
> +
> +} PnvXive2;
> +
> +typedef struct PnvXive2Class {
> +    Xive2RouterClass parent_class;
> +
> +    DeviceRealize parent_realize;
> +} PnvXive2Class;
> +
> +void pnv_xive2_pic_print_info(PnvXive2 *xive, Monitor *mon);
> +
>  #endif /* PPC_PNV_XIVE_H */
> diff --git a/include/hw/ppc/pnv_xscom.h b/include/hw/ppc/pnv_xscom.h
> index 09156a5a7a6f..1211add3e79c 100644
> --- a/include/hw/ppc/pnv_xscom.h
> +++ b/include/hw/ppc/pnv_xscom.h
> @@ -133,6 +133,9 @@ typedef struct PnvXScomInterfaceClass {
>  #define PNV10_XSCOM_PSIHB_BASE     0x3011D00
>  #define PNV10_XSCOM_PSIHB_SIZE     0x100
>  
> +#define PNV10_XSCOM_XIVE2_BASE     0x2010800
> +#define PNV10_XSCOM_XIVE2_SIZE     0x400
> +
>  void pnv_xscom_realize(PnvChip *chip, uint64_t size, Error **errp);
>  int pnv_dt_xscom(PnvChip *chip, void *fdt, int root_offset,
>                   uint64_t xscom_base, uint64_t xscom_size,
> diff --git a/hw/intc/pnv_xive2.c b/hw/intc/pnv_xive2.c
> new file mode 100644
> index 000000000000..761e9406315a
> --- /dev/null
> +++ b/hw/intc/pnv_xive2.c
> @@ -0,0 +1,2026 @@
> +/*
> + * QEMU PowerPC XIVE2 interrupt controller model  (POWER10)
> + *
> + * Copyright (c) 2019-2020, IBM Corporation.
> + *
> + * This code is licensed under the GPL version 2 or later. See the
> + * COPYING file in the top-level directory.
> + */
> +
> +#include "qemu/osdep.h"
> +#include "qemu/log.h"
> +#include "qapi/error.h"
> +#include "target/ppc/cpu.h"
> +#include "sysemu/cpus.h"
> +#include "sysemu/dma.h"
> +#include "monitor/monitor.h"
> +#include "hw/ppc/fdt.h"
> +#include "hw/ppc/pnv.h"
> +#include "hw/ppc/pnv_core.h"
> +#include "hw/ppc/pnv_xscom.h"
> +#include "hw/ppc/xive2.h"
> +#include "hw/ppc/pnv_xive.h"
> +#include "hw/ppc/xive_regs.h"
> +#include "hw/ppc/xive2_regs.h"
> +#include "hw/ppc/ppc.h"
> +#include "hw/qdev-properties.h"
> +#include "sysemu/reset.h"
> +
> +#include <libfdt.h>
> +
> +#include "pnv_xive2_regs.h"
> +
> +#undef XIVE2_DEBUG
> +
> +/*
> + * Virtual structures table (VST)
> + */
> +#define SBE_PER_BYTE   4
> +
> +typedef struct XiveVstInfo {
> +    const char *name;
> +    uint32_t    size;
> +    uint32_t    max_blocks;
> +} XiveVstInfo;
> +
> +static const XiveVstInfo vst_infos[] = {
> +
> +    [VST_EAS]  = { "EAT",  sizeof(Xive2Eas),  16 },
> +    [VST_ESB]  = { "ESB",  1,                  16 },
> +    [VST_END]  = { "ENDT", sizeof(Xive2End),  16 },
> +
> +    [VST_NVP]  = { "NVPT", sizeof(Xive2Nvp),  16 },
> +    [VST_NVG]  = { "NVGT", sizeof(Xive2Nvgc), 16 },
> +    [VST_NVC]  = { "NVCT", sizeof(Xive2Nvgc), 16 },
> +
> +    [VST_IC]  =  { "IC",   1 /* ? */         , 16 }, /* Topology # */
> +    [VST_SYNC] = { "SYNC", 1 /* ? */         , 16 }, /* Topology # */
> +
> +    /*
> +     * This table contains the backing store pages for the interrupt
> +     * fifos of the VC sub-engine in case of overflow.
> +     *
> +     * 0 - IPI,
> +     * 1 - HWD,
> +     * 2 - NxC,
> +     * 3 - INT,
> +     * 4 - OS-Queue,
> +     * 5 - Pool-Queue,
> +     * 6 - Hard-Queue
> +     */
> +    [VST_ERQ]  = { "ERQ",  1,                   VC_QUEUE_COUNT },
> +};
> +
> +#define xive2_error(xive, fmt, ...)                                      \
> +    qemu_log_mask(LOG_GUEST_ERROR, "XIVE[%x] - " fmt "\n",              \
> +                  (xive)->chip->chip_id, ## __VA_ARGS__);
> +
> +/*
> + * QEMU version of the GETFIELD/SETFIELD macros
> + *
> + * TODO: It might be better to use the existing extract64() and
> + * deposit64() but this means that all the register definitions will
> + * change and become incompatible with the ones found in skiboot.
> + *
> + * Keep it as it is for now until we find a common ground.
> + */
> +static inline uint64_t GETFIELD(uint64_t mask, uint64_t word)
> +{
> +    return (word & mask) >> ctz64(mask);
> +}
> +
> +static inline uint64_t SETFIELD(uint64_t mask, uint64_t word,
> +                                uint64_t value)
> +{
> +    return (word & ~mask) | ((value << ctz64(mask)) & mask);
> +}
> +
> +/*
> + * TODO: Document block id override
> + */
> +static uint32_t pnv_xive2_block_id(PnvXive2 *xive)
> +{
> +    uint8_t blk = xive->chip->chip_id;
> +    uint64_t cfg_val = xive->cq_regs[CQ_XIVE_CFG >> 3];
> +
> +    if (cfg_val & CQ_XIVE_CFG_HYP_HARD_BLKID_OVERRIDE) {
> +        blk = GETFIELD(CQ_XIVE_CFG_HYP_HARD_BLOCK_ID, cfg_val);
> +    }
> +
> +    return blk;
> +}
> +
> +/*
> + * Remote access to controllers. HW uses MMIOs. For now, a simple scan
> + * of the chips is good enough.
> + *
> + * TODO: Block scope support
> + */
> +static PnvXive2 *pnv_xive2_get_remote(uint8_t blk)
> +{
> +    PnvMachineState *pnv = PNV_MACHINE(qdev_get_machine());
> +    int i;
> +
> +    for (i = 0; i < pnv->num_chips; i++) {
> +        Pnv10Chip *chip10 = PNV10_CHIP(pnv->chips[i]);
> +        PnvXive2 *xive = &chip10->xive;
> +
> +        if (pnv_xive2_block_id(xive) == blk) {
> +            return xive;
> +        }
> +    }
> +    return NULL;
> +}
> +
> +/*
> + * VST accessors for ESB, EAT, ENDT, NVP
> + *
> + * Indirect VST tables are arrays of VSDs pointing to a page (of same
> + * size). Each page is a direct VST table.
> + */
> +
> +#define XIVE_VSD_SIZE 8
> +
> +/* Indirect page size can be 4K, 64K, 2M, 16M. */
> +static uint64_t pnv_xive2_vst_page_size_allowed(uint32_t page_shift)
> +{
> +     return page_shift == 12 || page_shift == 16 ||
> +         page_shift == 21 || page_shift == 24;
> +}
> +
> +static uint64_t pnv_xive2_vst_addr_direct(PnvXive2 *xive, uint32_t type,
> +                                         uint64_t vsd, uint32_t idx)
> +{
> +    const XiveVstInfo *info = &vst_infos[type];
> +    uint64_t vst_addr = vsd & VSD_ADDRESS_MASK;
> +    uint64_t vst_tsize = 1ull << (GETFIELD(VSD_TSIZE, vsd) + 12);
> +    uint32_t idx_max;
> +
> +    idx_max = vst_tsize / info->size - 1;
> +    if (idx > idx_max) {
> +#ifdef XIVE2_DEBUG
> +        xive2_error(xive, "VST: %s entry %x out of range [ 0 .. %x ] !?",
> +                   info->name, idx, idx_max);
> +#endif
> +        return 0;
> +    }
> +
> +    return vst_addr + idx * info->size;
> +}
> +
> +static uint64_t pnv_xive2_vst_addr_indirect(PnvXive2 *xive, uint32_t type,
> +                                           uint64_t vsd, uint32_t idx)
> +{
> +    const XiveVstInfo *info = &vst_infos[type];
> +    uint64_t vsd_addr;
> +    uint32_t vsd_idx;
> +    uint32_t page_shift;
> +    uint32_t vst_per_page;
> +
> +    /* Get the page size of the indirect table. */
> +    vsd_addr = vsd & VSD_ADDRESS_MASK;
> +    vsd = ldq_be_dma(&address_space_memory, vsd_addr);
> +
> +    if (!(vsd & VSD_ADDRESS_MASK)) {
> +        xive2_error(xive, "VST: invalid %s entry %x !?", info->name, idx);
> +        return 0;
> +    }
> +
> +    page_shift = GETFIELD(VSD_TSIZE, vsd) + 12;
> +
> +    if (!pnv_xive2_vst_page_size_allowed(page_shift)) {
> +        xive2_error(xive, "VST: invalid %s page shift %d", info->name,
> +                   page_shift);
> +        return 0;
> +    }
> +
> +    vst_per_page = (1ull << page_shift) / info->size;
> +    vsd_idx = idx / vst_per_page;
> +
> +    /* Load the VSD we are looking for, if not already done */
> +    if (vsd_idx) {
> +        vsd_addr = vsd_addr + vsd_idx * XIVE_VSD_SIZE;
> +        vsd = ldq_be_dma(&address_space_memory, vsd_addr);
> +
> +        if (!(vsd & VSD_ADDRESS_MASK)) {
> +            xive2_error(xive, "VST: invalid %s entry %x !?", info->name, idx);
> +            return 0;
> +        }
> +
> +        /*
> +         * Check that the pages have a consistent size across the
> +         * indirect table
> +         */
> +        if (page_shift != GETFIELD(VSD_TSIZE, vsd) + 12) {
> +            xive2_error(xive, "VST: %s entry %x indirect page size differ !?",
> +                       info->name, idx);
> +            return 0;
> +        }
> +    }
> +
> +    return pnv_xive2_vst_addr_direct(xive, type, vsd, (idx % vst_per_page));
> +}
> +
> +static uint64_t pnv_xive2_vst_addr(PnvXive2 *xive, uint32_t type, uint8_t blk,
> +                                  uint32_t idx)
> +{
> +    const XiveVstInfo *info = &vst_infos[type];
> +    uint64_t vsd;
> +
> +    if (blk >= info->max_blocks) {
> +        xive2_error(xive, "VST: invalid block id %d for VST %s %d !?",
> +                   blk, info->name, idx);
> +        return 0;
> +    }
> +
> +    vsd = xive->vsds[type][blk];
> +
> +    /* Remote VST access */
> +    if (GETFIELD(VSD_MODE, vsd) == VSD_MODE_FORWARD) {
> +        xive = pnv_xive2_get_remote(blk);
> +
> +        return xive ? pnv_xive2_vst_addr(xive, type, blk, idx) : 0;
> +    }
> +
> +    if (VSD_INDIRECT & vsd) {
> +        return pnv_xive2_vst_addr_indirect(xive, type, vsd, idx);
> +    }
> +
> +    return pnv_xive2_vst_addr_direct(xive, type, vsd, idx);
> +}
> +
> +static int pnv_xive2_vst_read(PnvXive2 *xive, uint32_t type, uint8_t blk,
> +                             uint32_t idx, void *data)
> +{
> +    const XiveVstInfo *info = &vst_infos[type];
> +    uint64_t addr = pnv_xive2_vst_addr(xive, type, blk, idx);
> +
> +    if (!addr) {
> +        return -1;
> +    }
> +
> +    cpu_physical_memory_read(addr, data, info->size);
> +    return 0;
> +}
> +
> +#define XIVE_VST_WORD_ALL -1
> +
> +static int pnv_xive2_vst_write(PnvXive2 *xive, uint32_t type, uint8_t blk,
> +                              uint32_t idx, void *data, uint32_t word_number)
> +{
> +    const XiveVstInfo *info = &vst_infos[type];
> +    uint64_t addr = pnv_xive2_vst_addr(xive, type, blk, idx);
> +
> +    if (!addr) {
> +        return -1;
> +    }
> +
> +    if (word_number == XIVE_VST_WORD_ALL) {
> +        cpu_physical_memory_write(addr, data, info->size);
> +    } else {
> +        cpu_physical_memory_write(addr + word_number * 4,
> +                                  data + word_number * 4, 4);
> +    }
> +    return 0;
> +}
> +
> +static int pnv_xive2_get_end(Xive2Router *xrtr, uint8_t blk, uint32_t idx,
> +                            Xive2End *end)
> +{
> +    return pnv_xive2_vst_read(PNV_XIVE2(xrtr), VST_END, blk, idx, end);
> +}
> +
> +static int pnv_xive2_write_end(Xive2Router *xrtr, uint8_t blk, uint32_t idx,
> +                              Xive2End *end, uint8_t word_number)
> +{
> +    return pnv_xive2_vst_write(PNV_XIVE2(xrtr), VST_END, blk, idx, end,
> +                              word_number);
> +}
> +
> +static int pnv_xive2_end_update(PnvXive2 *xive)
> +{
> +    uint8_t  blk = GETFIELD(VC_ENDC_WATCH_BLOCK_ID,
> +                           xive->vc_regs[(VC_ENDC_WATCH0_SPEC >> 3)]);
> +    uint32_t idx = GETFIELD(VC_ENDC_WATCH_INDEX,
> +                           xive->vc_regs[(VC_ENDC_WATCH0_SPEC >> 3)]);
> +    int i;
> +    uint64_t endc_watch[4];
> +
> +    for (i = 0; i < ARRAY_SIZE(endc_watch); i++) {
> +        endc_watch[i] =
> +            cpu_to_be64(xive->vc_regs[(VC_ENDC_WATCH0_DATA0 >> 3) + i]);
> +    }
> +
> +    return pnv_xive2_vst_write(xive, VST_END, blk, idx, endc_watch,
> +                              XIVE_VST_WORD_ALL);
> +}
> +
> +static void pnv_xive2_end_cache_load(PnvXive2 *xive)
> +{
> +    uint8_t  blk = GETFIELD(VC_ENDC_WATCH_BLOCK_ID,
> +                           xive->vc_regs[(VC_ENDC_WATCH0_SPEC >> 3)]);
> +    uint32_t idx = GETFIELD(VC_ENDC_WATCH_INDEX,
> +                           xive->vc_regs[(VC_ENDC_WATCH0_SPEC >> 3)]);
> +    uint64_t endc_watch[4] = { 0 };
> +    int i;
> +
> +    if (pnv_xive2_vst_read(xive, VST_END, blk, idx, endc_watch)) {
> +        xive2_error(xive, "VST: no END entry %x/%x !?", blk, idx);
> +    }
> +
> +    for (i = 0; i < ARRAY_SIZE(endc_watch); i++) {
> +        xive->vc_regs[(VC_ENDC_WATCH0_DATA0 >> 3) + i] =
> +            be64_to_cpu(endc_watch[i]);
> +    }
> +}
> +
> +static int pnv_xive2_get_nvp(Xive2Router *xrtr, uint8_t blk, uint32_t idx,
> +                            Xive2Nvp *nvp)
> +{
> +    return pnv_xive2_vst_read(PNV_XIVE2(xrtr), VST_NVP, blk, idx, nvp);
> +}
> +
> +static int pnv_xive2_write_nvp(Xive2Router *xrtr, uint8_t blk, uint32_t idx,
> +                              Xive2Nvp *nvp, uint8_t word_number)
> +{
> +    return pnv_xive2_vst_write(PNV_XIVE2(xrtr), VST_NVP, blk, idx, nvp,
> +                              word_number);
> +}
> +
> +static int pnv_xive2_nvp_update(PnvXive2 *xive)
> +{
> +    uint8_t  blk = GETFIELD(PC_NXC_WATCH_BLOCK_ID,
> +                            xive->pc_regs[(PC_NXC_WATCH0_SPEC >> 3)]);
> +    uint32_t idx = GETFIELD(PC_NXC_WATCH_INDEX,
> +                            xive->pc_regs[(PC_NXC_WATCH0_SPEC >> 3)]);
> +    int i;
> +    uint64_t nxc_watch[4];
> +
> +    for (i = 0; i < ARRAY_SIZE(nxc_watch); i++) {
> +        nxc_watch[i] =
> +            cpu_to_be64(xive->pc_regs[(PC_NXC_WATCH0_DATA0 >> 3) + i]);
> +    }
> +
> +    return pnv_xive2_vst_write(xive, VST_NVP, blk, idx, nxc_watch,
> +                              XIVE_VST_WORD_ALL);
> +}
> +
> +static void pnv_xive2_nvp_cache_load(PnvXive2 *xive)
> +{
> +    uint8_t  blk = GETFIELD(PC_NXC_WATCH_BLOCK_ID,
> +                           xive->pc_regs[(PC_NXC_WATCH0_SPEC >> 3)]);
> +    uint32_t idx = GETFIELD(PC_NXC_WATCH_INDEX,
> +                           xive->pc_regs[(PC_NXC_WATCH0_SPEC >> 3)]);
> +    uint64_t nxc_watch[4] = { 0 };
> +    int i;
> +
> +    if (pnv_xive2_vst_read(xive, VST_NVP, blk, idx, nxc_watch)) {
> +        xive2_error(xive, "VST: no NVP entry %x/%x !?", blk, idx);
> +    }
> +
> +    for (i = 0; i < ARRAY_SIZE(nxc_watch); i++) {
> +        xive->pc_regs[(PC_NXC_WATCH0_DATA0 >> 3) + i] =
> +            be64_to_cpu(nxc_watch[i]);
> +    }
> +}
> +
> +static int pnv_xive2_get_eas(Xive2Router *xrtr, uint8_t blk, uint32_t idx,
> +                            Xive2Eas *eas)
> +{
> +    PnvXive2 *xive = PNV_XIVE2(xrtr);
> +
> +    if (pnv_xive2_block_id(xive) != blk) {
> +        xive2_error(xive, "VST: EAS %x is remote !?", XIVE_EAS(blk, idx));
> +        return -1;
> +    }
> +
> +    return pnv_xive2_vst_read(xive, VST_EAS, blk, idx, eas);
> +}
> +
> +static bool pnv_xive2_is_cpu_enabled(PnvXive2 *xive, PowerPCCPU *cpu)
> +{
> +    int pir = ppc_cpu_pir(cpu);
> +    uint32_t fc = PNV10_PIR2FUSEDCORE(pir);
> +    uint64_t reg = fc < 8 ? TCTXT_EN0 : TCTXT_EN1;
> +    uint32_t bit = pir & 0x3f;
> +
> +    return xive->tctxt_regs[reg >> 3] & PPC_BIT(bit);
> +}
> +
> +static int pnv_xive2_match_nvt(XivePresenter *xptr, uint8_t format,
> +                                uint8_t nvt_blk, uint32_t nvt_idx,
> +                                bool cam_ignore, uint8_t priority,
> +                                uint32_t logic_serv, XiveTCTXMatch *match)
> +{
> +    PnvXive2 *xive = PNV_XIVE2(xptr);
> +    PnvChip *chip = xive->chip;
> +    int count = 0;
> +    int i, j;
> +
> +    for (i = 0; i < chip->nr_cores; i++) {
> +        PnvCore *pc = chip->cores[i];
> +        CPUCore *cc = CPU_CORE(pc);
> +
> +        for (j = 0; j < cc->nr_threads; j++) {
> +            PowerPCCPU *cpu = pc->threads[j];
> +            XiveTCTX *tctx;
> +            int ring;
> +
> +            if (!pnv_xive2_is_cpu_enabled(xive, cpu)) {
> +                continue;
> +            }
> +
> +            tctx = XIVE_TCTX(pnv_cpu_state(cpu)->intc);
> +
> +            ring = xive2_presenter_tctx_match(xptr, tctx, format, nvt_blk,
> +                                              nvt_idx, cam_ignore,
> +                                              logic_serv);
> +
> +            /*
> +             * Save the context and follow on to catch duplicates,
> +             * that we don't support yet.
> +             */
> +            if (ring != -1) {
> +                if (match->tctx) {
> +                    qemu_log_mask(LOG_GUEST_ERROR, "XIVE: already found a "
> +                                  "thread context NVT %x/%x\n",
> +                                  nvt_blk, nvt_idx);
> +                    return false;
> +                }
> +
> +                match->ring = ring;
> +                match->tctx = tctx;
> +                count++;
> +            }
> +        }
> +    }
> +
> +    return count;
> +}
> +
> +static uint8_t pnv_xive2_get_block_id(Xive2Router *xrtr)
> +{
> +    return pnv_xive2_block_id(PNV_XIVE2(xrtr));
> +}
> +
> +/*
> + * The TIMA MMIO space is shared among the chips and to identify the
> + * chip from which the access is being done, we extract the chip id
> + * from the PIR.
> + */
> +static PnvXive2 *pnv_xive2_tm_get_xive(PowerPCCPU *cpu)
> +{
> +    int pir = ppc_cpu_pir(cpu);
> +    XivePresenter *xptr = XIVE_TCTX(pnv_cpu_state(cpu)->intc)->xptr;
> +    PnvXive2 *xive = PNV_XIVE2(xptr);
> +
> +    if (!pnv_xive2_is_cpu_enabled(xive, cpu)) {
> +        xive2_error(xive, "IC: CPU %x is not enabled", pir);
> +    }
> +    return xive;
> +}
> +
> +/*
> + * The internal sources of the interrupt controller have no knowledge
> + * of the XIVE2 chip on which they reside. Encode the block id in the
> + * source interrupt number before forwarding the source event
> + * notification to the Router. This is required on a multichip system.
> + */
> +static void pnv_xive2_notify(XiveNotifier *xn, uint32_t srcno)
> +{
> +    PnvXive2 *xive = PNV_XIVE2(xn);
> +    uint8_t blk = pnv_xive2_block_id(xive);
> +
> +    xive2_router_notify(xn, XIVE_EAS(blk, srcno));
> +}
> +
> +/*
> + * Set Translation Tables
> + *
> + * TODO add support for multiple sets
> + */
> +static int pnv_xive2_stt_set_data(PnvXive2 *xive, uint64_t val)
> +{
> +    uint8_t tsel = GETFIELD(CQ_TAR_SELECT, xive->cq_regs[CQ_TAR >> 3]);
> +    uint8_t entry = GETFIELD(CQ_TAR_ENTRY_SELECT,
> +                                  xive->cq_regs[CQ_TAR >> 3]);
> +
> +    switch (tsel) {
> +    case CQ_TAR_NVPG:
> +    case CQ_TAR_ESB:
> +    case CQ_TAR_END:
> +        xive->tables[tsel][entry] = val;
> +        break;
> +    default:
> +        xive2_error(xive, "IC: unsupported table %d", tsel);
> +        return -1;
> +    }
> +
> +    if (xive->cq_regs[CQ_TAR >> 3] & CQ_TAR_AUTOINC) {
> +        xive->cq_regs[CQ_TAR >> 3] = SETFIELD(CQ_TAR_ENTRY_SELECT,
> +                     xive->cq_regs[CQ_TAR >> 3], ++entry);
> +    }
> +
> +    return 0;
> +}
> +/*
> + * Virtual Structure Tables (VST) configuration
> + */
> +static void pnv_xive2_vst_set_exclusive(PnvXive2 *xive2, uint8_t type,
> +                                       uint8_t blk, uint64_t vsd)
> +{
> +    Xive2EndSource *end_xsrc = &xive2->end_source;
> +    XiveSource *xsrc = &xive2->ipi_source;
> +    const XiveVstInfo *info = &vst_infos[type];
> +    uint32_t page_shift = GETFIELD(VSD_TSIZE, vsd) + 12;
> +    uint64_t vst_tsize = 1ull << page_shift;
> +    uint64_t vst_addr = vsd & VSD_ADDRESS_MASK;
> +
> +    /* Basic checks */
> +
> +    if (VSD_INDIRECT & vsd) {
> +        if (!pnv_xive2_vst_page_size_allowed(page_shift)) {
> +            xive2_error(xive2, "VST: invalid %s page shift %d", info->name,
> +                       page_shift);
> +            return;
> +        }
> +    }
> +
> +    if (!QEMU_IS_ALIGNED(vst_addr, 1ull << page_shift)) {
> +        xive2_error(xive2, "VST: %s table address 0x%"PRIx64
> +                    " is not aligned with page shift %d",
> +                    info->name, vst_addr, page_shift);
> +        return;
> +    }
> +
> +    /* Record the table configuration (in SRAM on HW) */
> +    xive2->vsds[type][blk] = vsd;
> +
> +    /* Now tune the models with the configuration provided by the FW */
> +
> +    switch (type) {
> +    case VST_ESB:
> +        /*
> +         * Backing store pages for the source PQ bits. The model does
> +         * not use these PQ bits backed in RAM because the XiveSource
> +         * model has its own.
> +         *
> +         * If the table is direct, we can compute the number of PQ
> +         * entries provisioned by FW (such as skiboot) and resize the
> +         * ESB window accordingly.
> +         */
> +        if (!(VSD_INDIRECT & vsd)) {
> +            memory_region_set_size(&xsrc->esb_mmio, vst_tsize * SBE_PER_BYTE
> +                                   * (1ull << xsrc->esb_shift));
> +        }
> +
> +        memory_region_add_subregion(&xive2->esb_mmio, 0, &xsrc->esb_mmio);
> +        break;
> +
> +    case VST_EAS:  /* Nothing to be done */
> +        break;
> +
> +    case VST_END:
> +        /*
> +         * Backing store pages for the END.
> +         */
> +        if (!(VSD_INDIRECT & vsd)) {
> +            memory_region_set_size(&end_xsrc->esb_mmio, (vst_tsize / info->size)
> +                                   * (1ull << xsrc->esb_shift));
> +        }
> +        memory_region_add_subregion(&xive2->end_mmio, 0, &end_xsrc->esb_mmio);
> +        break;
> +
> +    case VST_NVP:  /* Not modeled */
> +    case VST_NVG:  /* Not modeled */
> +    case VST_NVC:  /* Not modeled */
> +    case VST_IC:   /* Not modeled */
> +    case VST_SYNC: /* Not modeled */
> +    case VST_ERQ:  /* Not modeled */
> +        break;
> +
> +    default:
> +        g_assert_not_reached();
> +    }
> +}
> +
> +/*
> + * Both PC and VC sub-engines are configured as each use the Virtual
> + * Structure Tables
> + */
> +static void pnv_xive2_vst_set_data(PnvXive2 *xive2, uint64_t vsd)
> +{
> +    uint8_t mode = GETFIELD(VSD_MODE, vsd);
> +    uint8_t type = GETFIELD(VC_VSD_TABLE_SELECT,
> +                            xive2->vc_regs[VC_VSD_TABLE_ADDR >> 3]);
> +    uint8_t blk = GETFIELD(VC_VSD_TABLE_ADDRESS,
> +                           xive2->vc_regs[VC_VSD_TABLE_ADDR >> 3]);
> +    uint64_t vst_addr = vsd & VSD_ADDRESS_MASK;
> +
> +    if (type > VST_ERQ) {
> +        xive2_error(xive2, "VST: invalid table type %d", type);
> +        return;
> +    }
> +
> +    if (blk >= vst_infos[type].max_blocks) {
> +        xive2_error(xive2, "VST: invalid block id %d for"
> +                      " %s table", blk, vst_infos[type].name);
> +        return;
> +    }
> +
> +    if (!vst_addr) {
> +        xive2_error(xive2, "VST: invalid %s table address",
> +                   vst_infos[type].name);
> +        return;
> +    }
> +
> +    switch (mode) {
> +    case VSD_MODE_FORWARD:
> +        xive2->vsds[type][blk] = vsd;
> +        break;
> +
> +    case VSD_MODE_EXCLUSIVE:
> +        pnv_xive2_vst_set_exclusive(xive2, type, blk, vsd);
> +        break;
> +
> +    default:
> +        xive2_error(xive2, "VST: unsupported table mode %d", mode);
> +        return;
> +    }
> +}
> +
> +/*
> + * MMIO handlers
> + */
> +
> +
> +/*
> + * IC BAR layout
> + *
> + * Page 0: Internal CQ register accesses (reads & writes)
> + * Page 1: Internal PC register accesses (reads & writes)
> + * Page 2: Internal VC register accesses (reads & writes)
> + * Page 3: Internal TCTXT (TIMA) reg accesses (read & writes)
> + * Page 4: Notify Port page (writes only, w/data),
> + * Page 5: Reserved
> + * Page 6: Sync Poll page (writes only, dataless)
> + * Page 7: Sync Inject page (writes only, dataless)
> + * Page 8: LSI Trigger page (writes only, dataless)
> + * Page 9: LSI SB Management page (reads & writes dataless)
> + * Pages 10-255: Reserved
> + * Pages 256-383: Direct mapped Thread Context Area (reads & writes)
> + *                covering the 128 threads in P10.
> + * Pages 384-511: Reserved
> + */
> +typedef struct PnvXive2Region {
> +    const char *name;
> +    uint32_t pgoff;
> +    uint32_t pgsize;
> +    const MemoryRegionOps *ops;
> +} PnvXive2Region;
> +
> +static const MemoryRegionOps pnv_xive2_ic_cq_ops;
> +static const MemoryRegionOps pnv_xive2_ic_pc_ops;
> +static const MemoryRegionOps pnv_xive2_ic_vc_ops;
> +static const MemoryRegionOps pnv_xive2_ic_tctxt_ops;
> +static const MemoryRegionOps pnv_xive2_ic_notify_ops;
> +static const MemoryRegionOps pnv_xive2_ic_sync_ops;
> +static const MemoryRegionOps pnv_xive2_ic_lsi_ops;
> +static const MemoryRegionOps pnv_xive2_ic_tm_indirect_ops;
> +
> +/* 512 pages. 4K: 2M range, 64K: 32M range */
> +static const PnvXive2Region pnv_xive2_ic_regions[] = {
> +    { "xive-ic-cq",        0,   1,   &pnv_xive2_ic_cq_ops     },
> +    { "xive-ic-vc",        1,   1,   &pnv_xive2_ic_vc_ops     },
> +    { "xive-ic-pc",        2,   1,   &pnv_xive2_ic_pc_ops     },
> +    { "xive-ic-tctxt",     3,   1,   &pnv_xive2_ic_tctxt_ops  },
> +    { "xive-ic-notify",    4,   1,   &pnv_xive2_ic_notify_ops },
> +    /* page 5 reserved */
> +    { "xive-ic-sync",      6,   2,   &pnv_xive2_ic_sync_ops   },
> +    { "xive-ic-lsi",       8,   2,   &pnv_xive2_ic_lsi_ops    },
> +    /* pages 10-255 reserved */
> +    { "xive-ic-tm-indirect", 256, 128, &pnv_xive2_ic_tm_indirect_ops  },
> +    /* pages 384-511 reserved */
> +};
> +
> +/*
> + * CQ operations
> + */
> +
> +static uint64_t pnv_xive2_ic_cq_read(void *opaque, hwaddr offset,
> +                                        unsigned size)
> +{
> +    PnvXive2 *xive = PNV_XIVE2(opaque);
> +    uint32_t reg = offset >> 3;
> +    uint64_t val = 0;
> +
> +    switch (offset) {
> +    case CQ_XIVE_CAP: /* Set at reset */
> +    case CQ_XIVE_CFG:
> +        val = xive->cq_regs[reg];
> +        break;
> +    case CQ_MSGSND: /* TODO check the #cores of the machine */
> +        val = 0xffffffff00000000;
> +        break;
> +    case CQ_CFG_PB_GEN:
> +        val = CQ_CFG_PB_GEN_PB_INIT; /* TODO: fix CQ_CFG_PB_GEN default value */
> +        break;
> +    default:
> +        xive2_error(xive, "CQ: invalid read @%"HWADDR_PRIx, offset);
> +    }
> +
> +    return val;
> +}
> +
> +static uint64_t pnv_xive2_bar_size(uint64_t val)
> +{
> +    return 1ull << (GETFIELD(CQ_BAR_RANGE, val) + 24);
> +}
> +
> +static void pnv_xive2_ic_cq_write(void *opaque, hwaddr offset,
> +                                     uint64_t val, unsigned size)
> +{
> +    PnvXive2 *xive2 = PNV_XIVE2(opaque);
> +    MemoryRegion *sysmem = get_system_memory();
> +    uint32_t reg = offset >> 3;
> +    int i;
> +
> +    switch (offset) {
> +    case CQ_XIVE_CFG:
> +    case CQ_RST_CTL: /* TODO: reset all BARs */
> +        break;
> +
> +    case CQ_IC_BAR:
> +        xive2->ic_shift = val & CQ_IC_BAR_64K ? 16 : 12;
> +        if (!(val & CQ_IC_BAR_VALID)) {
> +            xive2->ic_base = 0;
> +            if (xive2->cq_regs[reg] & CQ_IC_BAR_VALID) {
> +                for (i = 0; i < ARRAY_SIZE(xive2->ic_mmios); i++) {
> +                    memory_region_del_subregion(&xive2->ic_mmio,
> +                                                &xive2->ic_mmios[i]);
> +                }
> +                memory_region_del_subregion(sysmem, &xive2->ic_mmio);
> +            }
> +        } else {
> +            xive2->ic_base = val & ~(CQ_IC_BAR_VALID | CQ_IC_BAR_64K);
> +            if (!(xive2->cq_regs[reg] & CQ_IC_BAR_VALID)) {
> +                for (i = 0; i < ARRAY_SIZE(xive2->ic_mmios); i++) {
> +                    memory_region_add_subregion(&xive2->ic_mmio,
> +                               pnv_xive2_ic_regions[i].pgoff << xive2->ic_shift,
> +                               &xive2->ic_mmios[i]);
> +                }
> +                memory_region_add_subregion(sysmem, xive2->ic_base,
> +                                            &xive2->ic_mmio);
> +            }
> +        }
> +        break;
> +
> +    case CQ_TM_BAR:
> +        xive2->tm_shift = val & CQ_TM_BAR_64K ? 16 : 12;
> +        if (!(val & CQ_TM_BAR_VALID)) {
> +            xive2->tm_base = 0;
> +            if (xive2->cq_regs[reg] & CQ_TM_BAR_VALID) {
> +                memory_region_del_subregion(sysmem, &xive2->tm_mmio);
> +            }
> +        } else {
> +            xive2->tm_base = val & ~(CQ_TM_BAR_VALID | CQ_TM_BAR_64K);
> +            if (!(xive2->cq_regs[reg] & CQ_TM_BAR_VALID)) {
> +                memory_region_add_subregion(sysmem, xive2->tm_base,
> +                                            &xive2->tm_mmio);
> +            }
> +        }
> +        break;
> +
> +    case CQ_ESB_BAR:
> +        xive2->esb_shift = val & CQ_BAR_64K ? 16 : 12;
> +        if (!(val & CQ_BAR_VALID)) {
> +            xive2->esb_base = 0;
> +            if (xive2->cq_regs[reg] & CQ_BAR_VALID) {
> +                memory_region_del_subregion(sysmem, &xive2->esb_mmio);
> +            }
> +        } else {
> +            xive2->esb_base = val & CQ_BAR_ADDR;
> +            if (!(xive2->cq_regs[reg] & CQ_BAR_VALID)) {
> +                memory_region_set_size(&xive2->esb_mmio,
> +                                       pnv_xive2_bar_size(val));
> +                memory_region_add_subregion(sysmem, xive2->esb_base,
> +                                            &xive2->esb_mmio);
> +            }
> +        }
> +        break;
> +
> +    case CQ_END_BAR:
> +        xive2->end_shift = val & CQ_BAR_64K ? 16 : 12;
> +        if (!(val & CQ_BAR_VALID)) {
> +            xive2->end_base = 0;
> +            if (xive2->cq_regs[reg] & CQ_BAR_VALID) {
> +                memory_region_del_subregion(sysmem, &xive2->end_mmio);
> +            }
> +        } else {
> +            xive2->end_base = val & CQ_BAR_ADDR;
> +            if (!(xive2->cq_regs[reg] & CQ_BAR_VALID)) {
> +                memory_region_set_size(&xive2->end_mmio,
> +                                       pnv_xive2_bar_size(val));
> +                memory_region_add_subregion(sysmem, xive2->end_base,
> +                                            &xive2->end_mmio);
> +            }
> +        }
> +        break;
> +
> +    case CQ_NVC_BAR:
> +        xive2->nvc_shift = val & CQ_BAR_64K ? 16 : 12;
> +        if (!(val & CQ_BAR_VALID)) {
> +            xive2->nvc_base = 0;
> +            if (xive2->cq_regs[reg] & CQ_BAR_VALID) {
> +                memory_region_del_subregion(sysmem, &xive2->nvc_mmio);
> +            }
> +        } else {
> +            xive2->nvc_base = val & CQ_BAR_ADDR;
> +            if (!(xive2->cq_regs[reg] & CQ_BAR_VALID)) {
> +                memory_region_set_size(&xive2->nvc_mmio,
> +                                       pnv_xive2_bar_size(val));
> +                memory_region_add_subregion(sysmem, xive2->nvc_base,
> +                                            &xive2->nvc_mmio);
> +            }
> +        }
> +        break;
> +
> +    case CQ_NVPG_BAR:
> +        xive2->nvpg_shift = val & CQ_BAR_64K ? 16 : 12;
> +        if (!(val & CQ_BAR_VALID)) {
> +            xive2->nvpg_base = 0;
> +            if (xive2->cq_regs[reg] & CQ_BAR_VALID) {
> +                memory_region_del_subregion(sysmem, &xive2->nvpg_mmio);
> +            }
> +        } else {
> +            xive2->nvpg_base = val & CQ_BAR_ADDR;
> +            if (!(xive2->cq_regs[reg] & CQ_BAR_VALID)) {
> +                memory_region_set_size(&xive2->nvpg_mmio,
> +                                       pnv_xive2_bar_size(val));
> +                memory_region_add_subregion(sysmem, xive2->nvpg_base,
> +                                            &xive2->nvpg_mmio);
> +            }
> +        }
> +        break;
> +
> +    case CQ_TAR: /* Set Translation Table Address */
> +        break;
> +    case CQ_TDR: /* Set Translation Table Data */
> +        pnv_xive2_stt_set_data(xive2, val);
> +        break;
> +    case CQ_FIRMASK_OR: /* FIR error reporting */
> +        break;
> +    default:
> +        xive2_error(xive2, "CQ: invalid write 0x%"HWADDR_PRIx, offset);
> +        return;
> +    }
> +
> +    xive2->cq_regs[reg] = val;
> +}
> +
> +static const MemoryRegionOps pnv_xive2_ic_cq_ops = {
> +    .read = pnv_xive2_ic_cq_read,
> +    .write = pnv_xive2_ic_cq_write,
> +    .endianness = DEVICE_BIG_ENDIAN,
> +    .valid = {
> +        .min_access_size = 8,
> +        .max_access_size = 8,
> +    },
> +    .impl = {
> +        .min_access_size = 8,
> +        .max_access_size = 8,
> +    },
> +};
> +
> +static uint64_t pnv_xive2_ic_vc_read(void *opaque, hwaddr offset,
> +                                 unsigned size)
> +{
> +    PnvXive2 *xive = PNV_XIVE2(opaque);
> +    uint64_t val = 0;
> +    uint32_t reg = offset >> 3;
> +
> +    switch (offset) {
> +    /*
> +     * VSD table settings.
> +     */
> +    case VC_VSD_TABLE_ADDR:
> +    case VC_VSD_TABLE_DATA:
> +        val = xive->vc_regs[reg];
> +        break;
> +
> +    /*
> +     * ESB cache updates (not modeled)
> +     */
> +    case VC_ESBC_FLUSH_CTRL:
> +        xive->vc_regs[reg] &= ~VC_ESBC_FLUSH_CTRL_POLL_VALID;
> +        val = xive->vc_regs[reg];
> +        break;
> +
> +    /*
> +     * EAS cache updates (not modeled)
> +     */
> +    case VC_EASC_FLUSH_CTRL:
> +        xive->vc_regs[reg] &= ~VC_EASC_FLUSH_CTRL_POLL_VALID;
> +        val = xive->vc_regs[reg];
> +        break;
> +
> +    /*
> +     * END cache updates
> +     */
> +    case VC_ENDC_WATCH0_SPEC:
> +        xive->vc_regs[reg] &= ~(VC_ENDC_WATCH_FULL | VC_ENDC_WATCH_CONFLICT);
> +        val = xive->vc_regs[reg];
> +        break;
> +
> +    case VC_ENDC_WATCH0_DATA0:
> +        /*
> +         * Load DATA registers from cache with data requested by the
> +         * SPEC register
> +         */
> +        pnv_xive2_end_cache_load(xive);
> +        val = xive->vc_regs[reg];
> +        break;
> +
> +    case VC_ENDC_WATCH0_DATA1 ... VC_ENDC_WATCH0_DATA3:
> +        val = xive->vc_regs[reg];
> +        break;
> +
> +    case VC_ENDC_FLUSH_CTRL:
> +        xive->vc_regs[reg] &= ~VC_ENDC_FLUSH_CTRL_POLL_VALID;
> +        val = xive->vc_regs[reg];
> +        break;
> +
> +    /*
> +     * Indirect invalidation
> +     */
> +    case VC_AT_MACRO_KILL_MASK:
> +        val = xive->vc_regs[reg];
> +        break;
> +
> +    case VC_AT_MACRO_KILL:
> +        xive->vc_regs[reg] &= ~VC_AT_MACRO_KILL_VALID;
> +        val = xive->vc_regs[reg];
> +        break;
> +
> +    /*
> +     * Interrupt fifo overflow in memory backing store (Not modeled)
> +     */
> +    case VC_QUEUES_CFG_REM0 ... VC_QUEUES_CFG_REM6:
> +        val = xive->vc_regs[reg];
> +        break;
> +
> +    /*
> +     * Synchronisation
> +     */
> +    case VC_ENDC_SYNC_DONE:
> +        val = VC_ENDC_SYNC_POLL_DONE;
> +        break;
> +    default:
> +        xive2_error(xive, "VC: invalid read @%"HWADDR_PRIx, offset);
> +    }
> +
> +    return val;
> +}
> +
> +static void pnv_xive2_ic_vc_write(void *opaque, hwaddr offset,
> +                              uint64_t val, unsigned size)
> +{
> +    PnvXive2 *xive = PNV_XIVE2(opaque);
> +    uint32_t reg = offset >> 3;
> +
> +    switch (offset) {
> +    /*
> +     * VSD table settings.
> +     */
> +    case VC_VSD_TABLE_ADDR:
> +       break;
> +    case VC_VSD_TABLE_DATA:
> +        pnv_xive2_vst_set_data(xive, val);
> +        break;
> +
> +    /*
> +     * ESB cache updates (not modeled)
> +     */
> +    /* case VC_ESBC_FLUSH_CTRL: */
> +    case VC_ESBC_FLUSH_POLL:
> +        xive->vc_regs[VC_ESBC_FLUSH_CTRL >> 3] |= VC_ESBC_FLUSH_CTRL_POLL_VALID;
> +        /* ESB update */
> +        break;
> +
> +    /*
> +     * EAS cache updates (not modeled)
> +     */
> +    /* case VC_EASC_FLUSH_CTRL: */
> +    case VC_EASC_FLUSH_POLL:
> +        xive->vc_regs[VC_EASC_FLUSH_CTRL >> 3] |= VC_EASC_FLUSH_CTRL_POLL_VALID;
> +        /* EAS update */
> +        break;
> +
> +    /*
> +     * END cache updates
> +     */
> +    case VC_ENDC_WATCH0_SPEC:
> +         val &= ~VC_ENDC_WATCH_CONFLICT; /* HW will set this bit */
> +        break;
> +
> +    case VC_ENDC_WATCH0_DATA1 ... VC_ENDC_WATCH0_DATA3:
> +        break;
> +    case VC_ENDC_WATCH0_DATA0:
> +        /* writing to DATA0 triggers the cache write */
> +        xive->vc_regs[reg] = val;
> +        pnv_xive2_end_update(xive);
> +        break;
> +
> +
> +    /* case VC_ENDC_FLUSH_CTRL: */
> +    case VC_ENDC_FLUSH_POLL:
> +        xive->vc_regs[VC_ENDC_FLUSH_CTRL >> 3] |= VC_ENDC_FLUSH_CTRL_POLL_VALID;
> +        break;
> +
> +    /*
> +     * Indirect invalidation
> +     */
> +    case VC_AT_MACRO_KILL:
> +    case VC_AT_MACRO_KILL_MASK:
> +        break;
> +
> +    /*
> +     * Interrupt fifo overflow in memory backing store (Not modeled)
> +     */
> +    case VC_QUEUES_CFG_REM0 ... VC_QUEUES_CFG_REM6:
> +        break;
> +
> +    /*
> +     * Synchronisation
> +     */
> +    case VC_ENDC_SYNC_DONE:
> +        break;
> +
> +    default:
> +        xive2_error(xive, "VC: invalid write @%"HWADDR_PRIx, offset);
> +        return;
> +    }
> +
> +    xive->vc_regs[reg] = val;
> +}
> +
> +static const MemoryRegionOps pnv_xive2_ic_vc_ops = {
> +    .read = pnv_xive2_ic_vc_read,
> +    .write = pnv_xive2_ic_vc_write,
> +    .endianness = DEVICE_BIG_ENDIAN,
> +    .valid = {
> +        .min_access_size = 8,
> +        .max_access_size = 8,
> +    },
> +    .impl = {
> +        .min_access_size = 8,
> +        .max_access_size = 8,
> +    },
> +};
> +
> +static uint64_t pnv_xive2_ic_pc_read(void *opaque, hwaddr offset,
> +                                            unsigned size)
> +{
> +    PnvXive2 *xive = PNV_XIVE2(opaque);
> +    uint64_t val = -1;
> +    uint32_t reg = offset >> 3;
> +
> +    switch (offset) {
> +    /*
> +     * VSD table settings.
> +     */
> +    case PC_VSD_TABLE_ADDR:
> +    case PC_VSD_TABLE_DATA:
> +        val = xive->pc_regs[reg];
> +        break;
> +
> +    /*
> +     * cache updates
> +     */
> +    case PC_NXC_WATCH0_SPEC:
> +        xive->pc_regs[reg] &= ~(PC_NXC_WATCH_FULL | PC_NXC_WATCH_CONFLICT);
> +        val = xive->pc_regs[reg];
> +        break;
> +
> +    case PC_NXC_WATCH0_DATA0:
> +       /*
> +        * Load DATA registers from cache with data requested by the
> +        * SPEC register
> +        */
> +        pnv_xive2_nvp_cache_load(xive);
> +        val = xive->pc_regs[reg];
> +        break;
> +
> +    case PC_NXC_WATCH0_DATA1 ... PC_NXC_WATCH0_DATA3:
> +        val = xive->pc_regs[reg];
> +        break;
> +
> +    case PC_NXC_FLUSH_CTRL:
> +        xive->pc_regs[reg] &= ~PC_NXC_FLUSH_CTRL_POLL_VALID;
> +        val = xive->pc_regs[reg];
> +        break;
> +
> +    /*
> +     * Indirect invalidation
> +     */
> +    case PC_AT_KILL:
> +        xive->pc_regs[reg] &= ~PC_AT_KILL_VALID;
> +        val = xive->pc_regs[reg];
> +        break;
> +
> +    default:
> +        xive2_error(xive, "PC: invalid read @%"HWADDR_PRIx, offset);
> +    }
> +
> +    return val;
> +}
> +
> +static void pnv_xive2_ic_pc_write(void *opaque, hwaddr offset,
> +                                         uint64_t val, unsigned size)
> +{
> +    PnvXive2 *xive = PNV_XIVE2(opaque);
> +    uint32_t reg = offset >> 3;
> +
> +    switch (offset) {
> +
> +    /*
> +     * VSD table settings. Only taken into account in the VC
> +     * sub-engine because the Xive2Router model combines both VC and PC
> +     * sub-engines
> +     */
> +    case PC_VSD_TABLE_ADDR:
> +    case PC_VSD_TABLE_DATA:
> +        break;
> +
> +    /*
> +     * cache updates
> +     */
> +    case PC_NXC_WATCH0_SPEC:
> +        val &= ~PC_NXC_WATCH_CONFLICT; /* HW will set this bit */
> +        break;
> +
> +    case PC_NXC_WATCH0_DATA1 ... PC_NXC_WATCH0_DATA3:
> +        break;
> +    case PC_NXC_WATCH0_DATA0:
> +        /* writing to DATA0 triggers the cache write */
> +        xive->pc_regs[reg] = val;
> +        pnv_xive2_nvp_update(xive);
> +        break;
> +
> +   /* case PC_NXC_FLUSH_CTRL: */
> +    case PC_NXC_FLUSH_POLL:
> +        xive->pc_regs[PC_NXC_FLUSH_CTRL >> 3] |= PC_NXC_FLUSH_CTRL_POLL_VALID;
> +        break;
> +
> +    /*
> +     * Indirect invalidation
> +     */
> +    case PC_AT_KILL:
> +    case PC_AT_KILL_MASK:
> +        break;
> +
> +    default:
> +        xive2_error(xive, "PC: invalid write @%"HWADDR_PRIx, offset);
> +        return;
> +    }
> +
> +    xive->pc_regs[reg] = val;
> +}
> +
> +static const MemoryRegionOps pnv_xive2_ic_pc_ops = {
> +    .read = pnv_xive2_ic_pc_read,
> +    .write = pnv_xive2_ic_pc_write,
> +    .endianness = DEVICE_BIG_ENDIAN,
> +    .valid = {
> +        .min_access_size = 8,
> +        .max_access_size = 8,
> +    },
> +    .impl = {
> +        .min_access_size = 8,
> +        .max_access_size = 8,
> +    },
> +};
> +
> +
> +static uint64_t pnv_xive2_ic_tctxt_read(void *opaque, hwaddr offset,
> +                                         unsigned size)
> +{
> +    PnvXive2 *xive = PNV_XIVE2(opaque);
> +    uint64_t val = -1;
> +    uint32_t reg = offset >> 3;
> +
> +    switch (offset) {
> +    /*
> +     * XIVE2 hardware thread enablement
> +     */
> +    case TCTXT_EN0:
> +    case TCTXT_EN1:
> +        val = xive->tctxt_regs[reg];
> +        break;
> +
> +    case TCTXT_EN0_SET:
> +    case TCTXT_EN0_RESET:
> +        val = xive->tctxt_regs[TCTXT_EN0 >> 3];
> +        break;
> +    case TCTXT_EN1_SET:
> +    case TCTXT_EN1_RESET:
> +        val = xive->tctxt_regs[TCTXT_EN1 >> 3];
> +        break;
> +    default:
> +        xive2_error(xive, "TCTXT: invalid read @%"HWADDR_PRIx, offset);
> +    }
> +
> +    return val;
> +}
> +
> +static void pnv_xive2_ic_tctxt_write(void *opaque, hwaddr offset,
> +                                            uint64_t val, unsigned size)
> +{
> +    PnvXive2 *xive = PNV_XIVE2(opaque);
> +    uint32_t reg = offset >> 3;
> +
> +    switch (offset) {
> +    /*
> +     * XIVE2 hardware thread enablement
> +     */
> +    case TCTXT_EN0: /* Physical Thread Enable */
> +    case TCTXT_EN1: /* Physical Thread Enable (fused core) */
> +        break;
> +
> +    case TCTXT_EN0_SET:
> +        xive->tctxt_regs[TCTXT_EN0 >> 3] |= val;
> +        break;
> +    case TCTXT_EN1_SET:
> +        xive->tctxt_regs[TCTXT_EN1 >> 3] |= val;
> +        break;
> +    case TCTXT_EN0_RESET:
> +        xive->tctxt_regs[TCTXT_EN0 >> 3] &= ~val;
> +        break;
> +    case TCTXT_EN1_RESET:
> +        xive->tctxt_regs[TCTXT_EN1 >> 3] &= ~val;
> +        break;
> +
> +    default:
> +        xive2_error(xive, "TCTXT: invalid write @%"HWADDR_PRIx, offset);
> +        return;
> +    }
> +
> +    xive->pc_regs[reg] = val;
> +}
> +
> +static const MemoryRegionOps pnv_xive2_ic_tctxt_ops = {
> +    .read = pnv_xive2_ic_tctxt_read,
> +    .write = pnv_xive2_ic_tctxt_write,
> +    .endianness = DEVICE_BIG_ENDIAN,
> +    .valid = {
> +        .min_access_size = 8,
> +        .max_access_size = 8,
> +    },
> +    .impl = {
> +        .min_access_size = 8,
> +        .max_access_size = 8,
> +    },
> +};
> +
> +/*
> + * Redirect XSCOM to MMIO handlers
> + */
> +static uint64_t pnv_xive2_xscom_read(void *opaque, hwaddr offset,
> +                                 unsigned size)
> +{
> +    PnvXive2 *xive = PNV_XIVE2(opaque);
> +    uint64_t val = -1;
> +    uint32_t xscom_reg = offset >> 3;
> +    uint32_t mmio_offset = (xscom_reg & 0xFF) << 3;
> +
> +    switch (xscom_reg) {
> +    case 0x000 ... 0x0FF:
> +        val = pnv_xive2_ic_cq_read(opaque, mmio_offset, size);
> +        break;
> +    case 0x100 ... 0x1FF:
> +        val = pnv_xive2_ic_vc_read(opaque, mmio_offset, size);
> +        break;
> +    case 0x200 ... 0x2FF:
> +        val = pnv_xive2_ic_pc_read(opaque, mmio_offset, size);
> +        break;
> +    case 0x300 ... 0x3FF:
> +        val = pnv_xive2_ic_tctxt_read(opaque, mmio_offset, size);
> +        break;
> +    default:
> +        xive2_error(xive, "XSCOM: invalid read @%"HWADDR_PRIx, offset);
> +    }
> +
> +    return val;
> +}
> +
> +static void pnv_xive2_xscom_write(void *opaque, hwaddr offset,
> +                                   uint64_t val, unsigned size)
> +{
> +    PnvXive2 *xive = PNV_XIVE2(opaque);
> +    uint32_t xscom_reg = offset >> 3;
> +    uint32_t mmio_offset = (xscom_reg & 0xFF) << 3;
> +
> +    switch (xscom_reg) {
> +    case 0x000 ... 0x0FF:
> +        pnv_xive2_ic_cq_write(opaque, mmio_offset, val, size);
> +        break;
> +    case 0x100 ... 0x1FF:
> +        pnv_xive2_ic_vc_write(opaque, mmio_offset, val, size);
> +        break;
> +    case 0x200 ... 0x2FF:
> +        pnv_xive2_ic_pc_write(opaque, mmio_offset, val, size);
> +        break;
> +    case 0x300 ... 0x3FF:
> +        pnv_xive2_ic_tctxt_write(opaque, mmio_offset, val, size);
> +        break;
> +    default:
> +        xive2_error(xive, "XSCOM: invalid write @%"HWADDR_PRIx, offset);
> +    }
> +}
> +
> +static const MemoryRegionOps pnv_xive2_xscom_ops = {
> +    .read = pnv_xive2_xscom_read,
> +    .write = pnv_xive2_xscom_write,
> +    .endianness = DEVICE_BIG_ENDIAN,
> +    .valid = {
> +        .min_access_size = 8,
> +        .max_access_size = 8,
> +    },
> +    .impl = {
> +        .min_access_size = 8,
> +        .max_access_size = 8,
> +    },
> +};
> +
> +/*
> + * Notify port page. The layout is compatible between 4K and 64K pages :
> + *
> + * Page 1           Notify page (writes only)
> + *  0x000 - 0x7FF   IPI interrupt (NPU)
> + *  0x800 - 0xFFF   HW interrupt triggers (PSI, PHB)
> + */
> +
> +static void pnv_xive2_ic_hw_trigger(PnvXive2 *xive, hwaddr addr,
> +                                     uint64_t val)
> +{
> +    uint8_t blk;
> +    uint32_t idx;
> +
> +    if (val & XIVE_TRIGGER_END) {
> +        xive2_error(xive, "IC: END trigger at @0x%"HWADDR_PRIx" data 0x%"PRIx64,
> +                   addr, val);
> +        return;
> +    }
> +
> +    /*
> +     * Forward the source event notification directly to the Router.
> +     * The source interrupt number should already be correctly encoded
> +     * with the chip block id by the sending device (PHB, PSI).
> +     */
> +    blk = XIVE_EAS_BLOCK(val);
> +    idx = XIVE_EAS_INDEX(val);
> +
> +    xive2_router_notify(XIVE_NOTIFIER(xive), XIVE_EAS(blk, idx));
> +}
> +
> +static void pnv_xive2_ic_notify_write(void *opaque, hwaddr offset,
> +                                       uint64_t val, unsigned size)
> +{
> +    PnvXive2 *xive = PNV_XIVE2(opaque);
> +
> +    /* VC: IPI triggers */
> +    switch (offset) {
> +    case 0x000 ... 0x7FF:
> +        /* TODO: check IPI notify sub-page routing */
> +        pnv_xive2_ic_hw_trigger(opaque, offset, val);
> +        break;
> +
> +    /* VC: HW triggers */
> +    case 0x800 ... 0xFFF:
> +        pnv_xive2_ic_hw_trigger(opaque, offset, val);
> +        break;
> +
> +    default:
> +        xive2_error(xive, "NOTIFY: invalid write @%"HWADDR_PRIx, offset);
> +    }
> +}
> +
> +static uint64_t pnv_xive2_ic_notify_read(void *opaque, hwaddr offset,
> +                                                unsigned size)
> +{
> +    PnvXive2 *xive = PNV_XIVE2(opaque);
> +
> +   /* loads are invalid */
> +    xive2_error(xive, "NOTIFY: invalid read @%"HWADDR_PRIx, offset);
> +    return -1;
> +}
> +
> +static const MemoryRegionOps pnv_xive2_ic_notify_ops = {
> +    .read = pnv_xive2_ic_notify_read,
> +    .write = pnv_xive2_ic_notify_write,
> +    .endianness = DEVICE_BIG_ENDIAN,
> +    .valid = {
> +        .min_access_size = 8,
> +        .max_access_size = 8,
> +    },
> +    .impl = {
> +        .min_access_size = 8,
> +        .max_access_size = 8,
> +    },
> +};
> +
> +static uint64_t pnv_xive2_ic_lsi_read(void *opaque, hwaddr offset,
> +                                             unsigned size)
> +{
> +    PnvXive2 *xive = PNV_XIVE2(opaque);
> +
> +    xive2_error(xive, "LSI: invalid read @%"HWADDR_PRIx, offset);
> +    return -1;
> +}
> +
> +static void pnv_xive2_ic_lsi_write(void *opaque, hwaddr offset,
> +                                          uint64_t val, unsigned size)
> +{
> +    PnvXive2 *xive = PNV_XIVE2(opaque);
> +
> +    xive2_error(xive, "LSI: invalid write @%"HWADDR_PRIx, offset);
> +}
> +
> +static const MemoryRegionOps pnv_xive2_ic_lsi_ops = {
> +    .read = pnv_xive2_ic_lsi_read,
> +    .write = pnv_xive2_ic_lsi_write,
> +    .endianness = DEVICE_BIG_ENDIAN,
> +    .valid = {
> +        .min_access_size = 8,
> +        .max_access_size = 8,
> +    },
> +    .impl = {
> +        .min_access_size = 8,
> +        .max_access_size = 8,
> +    },
> +};
> +
> +/*
> + * Sync MMIO page (write only)
> + */
> +#define PNV_XIVE2_SYNC_IPI      0x000
> +#define PNV_XIVE2_SYNC_HW       0x080
> +#define PNV_XIVE2_SYNC_NxC      0x100
> +#define PNV_XIVE2_SYNC_INT      0x180
> +#define PNV_XIVE2_SYNC_OS_ESC   0x200
> +#define PNV_XIVE2_SYNC_POOL_ESC 0x280
> +#define PNV_XIVE2_SYNC_HARD_ESC 0x300
> +
> +static uint64_t pnv_xive2_ic_sync_read(void *opaque, hwaddr offset,
> +                                              unsigned size)
> +{
> +    PnvXive2 *xive = PNV_XIVE2(opaque);
> +
> +    /* loads are invalid */
> +    xive2_error(xive, "SYNC: invalid read @%"HWADDR_PRIx, offset);
> +    return -1;
> +}
> +
> +static void pnv_xive2_ic_sync_write(void *opaque, hwaddr offset,
> +                                           uint64_t val, unsigned size)
> +{
> +    PnvXive2 *xive = PNV_XIVE2(opaque);
> +
> +    switch (offset) {
> +    case PNV_XIVE2_SYNC_IPI:
> +    case PNV_XIVE2_SYNC_HW:
> +    case PNV_XIVE2_SYNC_NxC:
> +    case PNV_XIVE2_SYNC_INT:
> +    case PNV_XIVE2_SYNC_OS_ESC:
> +    case PNV_XIVE2_SYNC_POOL_ESC:
> +    case PNV_XIVE2_SYNC_HARD_ESC:
> +        break;
> +    default:
> +        xive2_error(xive, "SYNC: invalid write @%"HWADDR_PRIx, offset);
> +    }
> +}
> +
> +static const MemoryRegionOps pnv_xive2_ic_sync_ops = {
> +    .read = pnv_xive2_ic_sync_read,
> +    .write = pnv_xive2_ic_sync_write,
> +    .endianness = DEVICE_BIG_ENDIAN,
> +    .valid = {
> +        .min_access_size = 8,
> +        .max_access_size = 8,
> +    },
> +    .impl = {
> +        .min_access_size = 8,
> +        .max_access_size = 8,
> +    },
> +};
> +
> +/*
> + * When the TM direct pages of the IC controller are accessed, the
> + * target HW thread is deduced from the page offset.
> + */
> +static XiveTCTX *pnv_xive2_get_indirect_tctx(PnvXive2 *xive, uint32_t pir)
> +{
> +    PnvChip *chip = xive->chip;
> +    PowerPCCPU *cpu = NULL;
> +
> +    cpu = pnv_chip_find_cpu(chip, pir);
> +    if (!cpu) {
> +        xive2_error(xive, "IC: invalid PIR %x for indirect access", pir);
> +        return NULL;
> +    }
> +
> +    if (!pnv_xive2_is_cpu_enabled(xive, cpu)) {
> +        xive2_error(xive, "IC: CPU %x is not enabled", pir);
> +    }
> +
> +    return XIVE_TCTX(pnv_cpu_state(cpu)->intc);
> +}
> +
> +static uint64_t pnv_xive2_ic_tm_indirect_read(void *opaque, hwaddr offset,
> +                                              unsigned size)
> +{
> +    PnvXive2 *xive = PNV_XIVE2(opaque);
> +    uint32_t pir = offset >> xive->ic_shift;
> +    XiveTCTX *tctx = pnv_xive2_get_indirect_tctx(xive, pir);
> +    uint64_t val = -1;
> +
> +    if (tctx) {
> +        val = xive_tctx_tm_read(NULL, tctx, offset, size);
> +    }
> +
> +    return val;
> +}
> +
> +static void pnv_xive2_ic_tm_indirect_write(void *opaque, hwaddr offset,
> +                                           uint64_t val, unsigned size)
> +{
> +    PnvXive2 *xive = PNV_XIVE2(opaque);
> +    uint32_t pir = offset >> xive->ic_shift;
> +    XiveTCTX *tctx = pnv_xive2_get_indirect_tctx(xive, pir);
> +
> +    if (tctx) {
> +        xive_tctx_tm_write(NULL, tctx, offset, val, size);
> +    }
> +}
> +
> +static const MemoryRegionOps pnv_xive2_ic_tm_indirect_ops = {
> +    .read = pnv_xive2_ic_tm_indirect_read,
> +    .write = pnv_xive2_ic_tm_indirect_write,
> +    .endianness = DEVICE_BIG_ENDIAN,
> +    .valid = {
> +        .min_access_size = 8,
> +        .max_access_size = 8,
> +    },
> +    .impl = {
> +        .min_access_size = 8,
> +        .max_access_size = 8,
> +    },
> +};
> +
> +/*
> + * TIMA ops
> + */
> +
> +static void pnv_xive2_tm_write(void *opaque, hwaddr offset,
> +                          uint64_t value, unsigned size)
> +{
> +    PowerPCCPU *cpu = POWERPC_CPU(current_cpu);
> +    PnvXive2 *xive = pnv_xive2_tm_get_xive(cpu);
> +    XiveTCTX *tctx = XIVE_TCTX(pnv_cpu_state(cpu)->intc);
> +
> +    /* Other TM ops are the same as XIVE1 */
> +    xive_tctx_tm_write(XIVE_PRESENTER(xive), tctx, offset, value, size);
> +}
> +
> +static uint64_t pnv_xive2_tm_read(void *opaque, hwaddr offset, unsigned size)
> +{
> +    PowerPCCPU *cpu = POWERPC_CPU(current_cpu);
> +    PnvXive2 *xive = pnv_xive2_tm_get_xive(cpu);
> +    XiveTCTX *tctx = XIVE_TCTX(pnv_cpu_state(cpu)->intc);
> +
> +    /* Other TM ops are the same as XIVE1 */
> +    return xive_tctx_tm_read(XIVE_PRESENTER(xive), tctx, offset, size);
> +}
> +
> +static const MemoryRegionOps pnv_xive2_tm_ops = {
> +    .read = pnv_xive2_tm_read,
> +    .write = pnv_xive2_tm_write,
> +    .endianness = DEVICE_BIG_ENDIAN,
> +    .valid = {
> +        .min_access_size = 1,
> +        .max_access_size = 8,
> +    },
> +    .impl = {
> +        .min_access_size = 1,
> +        .max_access_size = 8,
> +    },
> +};
> +
> +static uint64_t pnv_xive2_nvc_read(void *opaque, hwaddr offset,
> +                                          unsigned size)
> +{
> +    PnvXive2 *xive = PNV_XIVE2(opaque);
> +
> +    xive2_error(xive, "NVC: invalid read @%"HWADDR_PRIx, offset);
> +    return -1;
> +}
> +
> +static void pnv_xive2_nvc_write(void *opaque, hwaddr offset,
> +                                       uint64_t val, unsigned size)
> +{
> +    PnvXive2 *xive = PNV_XIVE2(opaque);
> +
> +    xive2_error(xive, "NVC: invalid write @%"HWADDR_PRIx, offset);
> +}
> +
> +static const MemoryRegionOps pnv_xive2_nvc_ops = {
> +    .read = pnv_xive2_nvc_read,
> +    .write = pnv_xive2_nvc_write,
> +    .endianness = DEVICE_BIG_ENDIAN,
> +    .valid = {
> +        .min_access_size = 8,
> +        .max_access_size = 8,
> +    },
> +    .impl = {
> +        .min_access_size = 8,
> +        .max_access_size = 8,
> +    },
> +};
> +
> +static uint64_t pnv_xive2_nvpg_read(void *opaque, hwaddr offset,
> +                                           unsigned size)
> +{
> +    PnvXive2 *xive = PNV_XIVE2(opaque);
> +
> +    xive2_error(xive, "NVPG: invalid read @%"HWADDR_PRIx, offset);
> +    return -1;
> +}
> +
> +static void pnv_xive2_nvpg_write(void *opaque, hwaddr offset,
> +                                        uint64_t val, unsigned size)
> +{
> +    PnvXive2 *xive = PNV_XIVE2(opaque);
> +
> +    xive2_error(xive, "NVPG: invalid write @%"HWADDR_PRIx, offset);
> +}
> +
> +static const MemoryRegionOps pnv_xive2_nvpg_ops = {
> +    .read = pnv_xive2_nvpg_read,
> +    .write = pnv_xive2_nvpg_write,
> +    .endianness = DEVICE_BIG_ENDIAN,
> +    .valid = {
> +        .min_access_size = 8,
> +        .max_access_size = 8,
> +    },
> +    .impl = {
> +        .min_access_size = 8,
> +        .max_access_size = 8,
> +    },
> +};
> +
> +/*
> + * POWER10 default capabilities: 0x2000120076f00000
> + */
> +#define PNV_XIVE2_CAPABILITIES  0x2000120076f00000
> +
> +/*
> + * POWER10 default configuration: 0x0030000033000000
> + *
> + * 8bits thread id was dropped for P10
> + */
> +#define PNV_XIVE2_CONFIGURATION 0x0030000033000000
> +
> +static void pnv_xive2_reset(void *dev)
> +{
> +    PnvXive2 *xive2 = PNV_XIVE2(dev);
> +    XiveSource *xsrc = &xive2->ipi_source;
> +    Xive2EndSource *end_xsrc = &xive2->end_source;
> +
> +    xive2->cq_regs[CQ_XIVE_CAP >> 3] = PNV_XIVE2_CAPABILITIES;
> +    xive2->cq_regs[CQ_XIVE_CFG >> 3] = PNV_XIVE2_CONFIGURATION;
> +
> +    /* HW hardwires the #Topology of the chip in the block field */
> +    xive2->cq_regs[CQ_XIVE_CFG >> 3] |=
> +        SETFIELD(CQ_XIVE_CFG_HYP_HARD_BLOCK_ID, 0ull, xive2->chip->chip_id);
> +
> +    /* Set default page size to 64k */
> +    xive2->ic_shift = xive2->esb_shift = xive2->end_shift = 16;
> +    xive2->nvc_shift = xive2->nvpg_shift = xive2->tm_shift = 16;
> +
> +    /* Clear source MMIOs */
> +    if (memory_region_is_mapped(&xsrc->esb_mmio)) {
> +        memory_region_del_subregion(&xive2->esb_mmio, &xsrc->esb_mmio);
> +    }
> +
> +    if (memory_region_is_mapped(&end_xsrc->esb_mmio)) {
> +        memory_region_del_subregion(&xive2->end_mmio, &end_xsrc->esb_mmio);
> +    }
> +}
> +
> +/*
> + *  Maximum number of IRQs and ENDs supported by HW. Will be tuned by
> + *  software.
> + */
> +#define PNV_XIVE2_NR_IRQS (PNV10_XIVE2_ESB_SIZE / (1ull << XIVE_ESB_64K_2PAGE))
> +#define PNV_XIVE2_NR_ENDS (PNV10_XIVE2_END_SIZE / (1ull << XIVE_ESB_64K_2PAGE))
> +
> +static void pnv_xive2_realize(DeviceState *dev, Error **errp)
> +{
> +    PnvXive2 *xive2 = PNV_XIVE2(dev);
> +    PnvXive2Class *pxc = PNV_XIVE2_GET_CLASS(dev);
> +    XiveSource *xsrc = &xive2->ipi_source;
> +    Xive2EndSource *end_xsrc = &xive2->end_source;
> +    Error *local_err = NULL;
> +    int i;
> +
> +    pxc->parent_realize(dev, &local_err);
> +    if (local_err) {
> +        error_propagate(errp, local_err);
> +        return;
> +    }
> +
> +    assert(xive2->chip);
> +
> +    /*
> +     * The XiveSource and Xive2EndSource objects are realized with the
> +     * maximum allowed HW configuration. The ESB MMIO regions will be
> +     * resized dynamically when the controller is configured by the FW
> +     * to limit accesses to resources not provisioned.
> +     */
> +    object_property_set_int(OBJECT(xsrc), XIVE_SRC_STORE_EOI, "flags",
> +                            &error_fatal);
> +    object_property_set_int(OBJECT(xsrc), PNV_XIVE2_NR_IRQS, "nr-irqs",
> +                            &error_fatal);
> +    object_property_set_link(OBJECT(xsrc), OBJECT(xive2), "xive",
> +                             &error_fatal);
> +    object_property_set_bool(OBJECT(xsrc), true, "realized", &local_err);
> +    if (local_err) {
> +        error_propagate(errp, local_err);
> +        return;
> +    }
> +
> +    object_property_set_int(OBJECT(end_xsrc), PNV_XIVE2_NR_ENDS, "nr-ends",
> +                            &error_fatal);
> +    object_property_set_link(OBJECT(end_xsrc), OBJECT(xive2), "xive",
> +                             &error_abort);
> +    object_property_set_bool(OBJECT(end_xsrc), true, "realized", &local_err);
> +    if (local_err) {
> +        error_propagate(errp, local_err);
> +        return;
> +    }
> +
> +    /* XSCOM region, used for initial configuration of the BARs */
> +    memory_region_init_io(&xive2->xscom_regs, OBJECT(dev),
> +                          &pnv_xive2_xscom_ops, xive2, "xscom-xive",
> +                          PNV10_XSCOM_XIVE2_SIZE << 3);
> +
> +    /* Interrupt controller MMIO regions */
> +    xive2->ic_shift = 16;
> +    memory_region_init(&xive2->ic_mmio, OBJECT(dev), "xive-ic",
> +                       PNV10_XIVE2_IC_SIZE);
> +
> +    for (i = 0; i < ARRAY_SIZE(xive2->ic_mmios); i++) {
> +        memory_region_init_io(&xive2->ic_mmios[i], OBJECT(dev),
> +                         pnv_xive2_ic_regions[i].ops, xive2,
> +                         pnv_xive2_ic_regions[i].name,
> +                         pnv_xive2_ic_regions[i].pgsize << xive2->ic_shift);
> +    }
> +
> +    /*
> +     * VC MMIO regions.
> +     */
> +    xive2->esb_shift = 16;
> +    xive2->end_shift = 16;
> +    memory_region_init(&xive2->esb_mmio, OBJECT(xive2), "xive-esb",
> +                       PNV10_XIVE2_ESB_SIZE);
> +    memory_region_init(&xive2->end_mmio, OBJECT(xive2), "xive-end",
> +                       PNV10_XIVE2_END_SIZE);
> +
> +    /* Presenter Controller MMIO region (not modeled) */
> +    xive2->nvc_shift = 16;
> +    xive2->nvpg_shift = 16;
> +    memory_region_init_io(&xive2->nvc_mmio, OBJECT(dev),
> +                          &pnv_xive2_nvc_ops, xive2,
> +                          "xive-nvc", PNV10_XIVE2_NVC_SIZE);
> +
> +    memory_region_init_io(&xive2->nvpg_mmio, OBJECT(dev),
> +                          &pnv_xive2_nvpg_ops, xive2,
> +                          "xive-nvpg", PNV10_XIVE2_NVPG_SIZE);
> +
> +    /* Thread Interrupt Management Area (Direct) */
> +    xive2->tm_shift = 16;
> +    memory_region_init_io(&xive2->tm_mmio, OBJECT(dev), &pnv_xive2_tm_ops,
> +                          xive2, "xive-tima", PNV10_XIVE2_TM_SIZE);
> +
> +    qemu_register_reset(pnv_xive2_reset, dev);
> +}
> +
> +static Property pnv_xive2_properties[] = {
> +    DEFINE_PROP_UINT64("ic-bar", PnvXive2, ic_base, 0),
> +    DEFINE_PROP_UINT64("esb-bar", PnvXive2, esb_base, 0),
> +    DEFINE_PROP_UINT64("end-bar", PnvXive2, end_base, 0),
> +    DEFINE_PROP_UINT64("nvc-bar", PnvXive2, nvc_base, 0),
> +    DEFINE_PROP_UINT64("nvpg-bar", PnvXive2, nvpg_base, 0),
> +    DEFINE_PROP_UINT64("tm-bar", PnvXive2, tm_base, 0),
> +    DEFINE_PROP_LINK("chip", PnvXive2, chip, TYPE_PNV_CHIP, PnvChip *),
> +    DEFINE_PROP_END_OF_LIST(),
> +};
> +
> +static void pnv_xive2_instance_init(Object *obj)
> +{
> +    PnvXive2 *xive = PNV_XIVE2(obj);
> +
> +    object_initialize_child(obj, "ipi_source", &xive->ipi_source,
> +                            sizeof(xive->ipi_source), TYPE_XIVE_SOURCE,
> +                            &error_abort, NULL);
> +    object_initialize_child(obj, "end_source", &xive->end_source,
> +                            sizeof(xive->end_source), TYPE_XIVE2_END_SOURCE,
> +                            &error_abort, NULL);
> +}
> +
> +static int pnv_xive2_dt_xscom(PnvXScomInterface *dev, void *fdt,
> +                             int xscom_offset)
> +{
> +    const char compat_p10[] = "ibm,power10-xive-x";
> +    char *name;
> +    int offset;
> +    uint32_t reg[] = {
> +        cpu_to_be32(PNV10_XSCOM_XIVE2_BASE),
> +        cpu_to_be32(PNV10_XSCOM_XIVE2_SIZE)
> +    };
> +
> +    name = g_strdup_printf("xive@%x", PNV10_XSCOM_XIVE2_BASE);
> +    offset = fdt_add_subnode(fdt, xscom_offset, name);
> +    _FDT(offset);
> +    g_free(name);
> +
> +    _FDT((fdt_setprop(fdt, offset, "reg", reg, sizeof(reg))));
> +    _FDT(fdt_setprop(fdt, offset, "compatible", compat_p10,
> +                     sizeof(compat_p10)));
> +    return 0;
> +}
> +
> +static void pnv_xive2_class_init(ObjectClass *klass, void *data)
> +{
> +    DeviceClass *dc = DEVICE_CLASS(klass);
> +    PnvXScomInterfaceClass *xdc = PNV_XSCOM_INTERFACE_CLASS(klass);
> +    Xive2RouterClass *xrc = XIVE2_ROUTER_CLASS(klass);
> +    XiveNotifierClass *xnc = XIVE_NOTIFIER_CLASS(klass);
> +    XivePresenterClass *xpc = XIVE_PRESENTER_CLASS(klass);
> +    PnvXive2Class *pxc = PNV_XIVE2_CLASS(klass);
> +
> +    xdc->dt_xscom  = pnv_xive2_dt_xscom;
> +
> +    dc->desc       = "PowerNV XIVE2 Interrupt Controller (POWER10)";
> +    device_class_set_parent_realize(dc, pnv_xive2_realize,
> +                                    &pxc->parent_realize);
> +    device_class_set_props(dc, pnv_xive2_properties);
> +
> +    xrc->get_eas   = pnv_xive2_get_eas;
> +    xrc->get_end   = pnv_xive2_get_end;
> +    xrc->write_end = pnv_xive2_write_end;
> +    xrc->get_nvp   = pnv_xive2_get_nvp;
> +    xrc->write_nvp = pnv_xive2_write_nvp;
> +    xrc->get_block_id = pnv_xive2_get_block_id;
> +
> +    xnc->notify    = pnv_xive2_notify;
> +
> +    xpc->match_nvt  = pnv_xive2_match_nvt;
> +};
> +
> +static const TypeInfo pnv_xive2_info = {
> +    .name          = TYPE_PNV_XIVE2,
> +    .parent        = TYPE_XIVE2_ROUTER,
> +    .instance_init = pnv_xive2_instance_init,
> +    .instance_size = sizeof(PnvXive2),
> +    .class_init    = pnv_xive2_class_init,
> +    .class_size    = sizeof(PnvXive2Class),
> +    .interfaces    = (InterfaceInfo[]) {
> +        { TYPE_PNV_XSCOM_INTERFACE },
> +        { }
> +    }
> +};
> +
> +static void pnv_xive2_register_types(void)
> +{
> +    type_register_static(&pnv_xive2_info);
> +}
> +
> +type_init(pnv_xive2_register_types)
> +
> +static void xive2_nvp_pic_print_info(Xive2Nvp *nvp, uint32_t nvp_idx,
> +                                     Monitor *mon)
> +{
> +    uint8_t  eq_blk = xive_get_field32(NVP2_W5_VP_END_BLOCK, nvp->w5);
> +    uint32_t eq_idx = xive_get_field32(NVP2_W5_VP_END_INDEX, nvp->w5);
> +
> +    if (!xive2_nvp_is_valid(nvp)) {
> +        return;
> +    }
> +
> +    monitor_printf(mon, "  %08x end:%02x/%04x CPPR:%02x IPB:%02x\n",
> +                   nvp_idx, eq_blk, eq_idx,
> +                   xive_get_field32(NVP2_W2_CPPR, nvp->w2),
> +                   xive_get_field32(NVP2_W2_IPB, nvp->w2));
> +}
> +
> +/*
> + * If the table is direct, we can compute the number of PQ entries
> + * provisioned by FW.
> + */
> +static uint32_t pnv_xive2_nr_esbs(PnvXive2 *xive)
> +{
> +    uint8_t blk = pnv_xive2_block_id(xive);
> +    uint64_t vsd = xive->vsds[VST_ESB][blk];
> +    uint64_t vst_tsize = 1ull << (GETFIELD(VSD_TSIZE, vsd) + 12);
> +
> +    return VSD_INDIRECT & vsd ? 0 : vst_tsize * SBE_PER_BYTE;
> +}
> +
> +/*
> + * Compute the number of entries per indirect subpage.
> + */
> +static uint64_t pnv_xive2_vst_per_subpage(PnvXive2 *xive, uint32_t type)
> +{
> +    uint8_t blk = pnv_xive2_block_id(xive);
> +    uint64_t vsd = xive->vsds[type][blk];
> +    const XiveVstInfo *info = &vst_infos[type];
> +    uint64_t vsd_addr;
> +    uint32_t page_shift;
> +
> +    /* For direct tables, fake a valid value */
> +    if (!(VSD_INDIRECT & vsd)) {
> +        return 1;
> +    }
> +
> +    /* Get the page size of the indirect table. */
> +    vsd_addr = vsd & VSD_ADDRESS_MASK;
> +    vsd = ldq_be_dma(&address_space_memory, vsd_addr);
> +
> +    if (!(vsd & VSD_ADDRESS_MASK)) {
> +#ifdef XIVE2_DEBUG
> +        xive2_error(xive, "VST: invalid %s entry!?", info->name);
> +#endif
> +        return 0;
> +    }
> +
> +    page_shift = GETFIELD(VSD_TSIZE, vsd) + 12;
> +
> +    if (!pnv_xive2_vst_page_size_allowed(page_shift)) {
> +        xive2_error(xive, "VST: invalid %s page shift %d", info->name,
> +                   page_shift);
> +        return 0;
> +    }
> +
> +    return (1ull << page_shift) / info->size;
> +}
> +
> +void pnv_xive2_pic_print_info(PnvXive2 *xive, Monitor *mon)
> +{
> +    Xive2Router *xrtr = XIVE2_ROUTER(xive);
> +    uint8_t blk = pnv_xive2_block_id(xive);
> +    uint8_t chip_id = xive->chip->chip_id;
> +    uint32_t srcno0 = XIVE_EAS(blk, 0);
> +    uint32_t nr_esbs = pnv_xive2_nr_esbs(xive);
> +    Xive2Eas eas;
> +    Xive2End end;
> +    Xive2Nvp nvp;
> +    int i;
> +    uint64_t xive_nvp_per_subpage;
> +
> +    monitor_printf(mon, "XIVE[%x] Source %08x .. %08x\n", blk, srcno0,
> +                   srcno0 + nr_esbs - 1);
> +    xive_source_pic_print_info(&xive->ipi_source, srcno0, mon);
> +
> +    monitor_printf(mon, "XIVE[%x] EAT %08x .. %08x\n", blk, srcno0,
> +                   srcno0 + nr_esbs - 1);
> +    for (i = 0; i < nr_esbs; i++) {
> +        if (xive2_router_get_eas(xrtr, blk, i, &eas)) {
> +            break;
> +        }
> +        if (!xive2_eas_is_masked(&eas)) {
> +            xive2_eas_pic_print_info(&eas, i, mon);
> +        }
> +    }
> +
> +    monitor_printf(mon, "XIVE[%x] #%d END Escalation EAT\n", chip_id, blk);
> +    i = 0;
> +    while (!xive2_router_get_end(xrtr, blk, i, &end)) {
> +        xive2_end_eas_pic_print_info(&end, i++, mon);
> +    }
> +
> +    monitor_printf(mon, "XIVE[%x] #%d ENDT\n", chip_id, blk);
> +    i = 0;
> +    while (!xive2_router_get_end(xrtr, blk, i, &end)) {
> +        xive2_end_pic_print_info(&end, i++, mon);
> +    }
> +
> +    monitor_printf(mon, "XIVE[%x] #%d NVPT %08x .. %08x\n", chip_id, blk,
> +                   0, XIVE2_NVP_COUNT - 1);
> +    xive_nvp_per_subpage = pnv_xive2_vst_per_subpage(xive, VST_NVP);
> +    for (i = 0; i < XIVE2_NVP_COUNT; i += xive_nvp_per_subpage) {
> +        while (!xive2_router_get_nvp(xrtr, blk, i, &nvp)) {
> +            xive2_nvp_pic_print_info(&nvp, i++, mon);
> +        }
> +    }
> +}
> diff --git a/hw/ppc/pnv.c b/hw/ppc/pnv.c
> index 1b4748ce6dc3..73c40ce3209f 100644
> --- a/hw/ppc/pnv.c
> +++ b/hw/ppc/pnv.c
> @@ -706,6 +706,7 @@ static void pnv_chip_power10_pic_print_info(PnvChip *chip, Monitor *mon)
>  {
>      Pnv10Chip *chip10 = PNV10_CHIP(chip);
>  
> +    pnv_xive2_pic_print_info(&chip10->xive, mon);
>      pnv_psi_pic_print_info(&chip10->psi, mon);
>  }
>  
> @@ -997,27 +998,45 @@ static void pnv_chip_power9_intc_print_info(PnvChip *chip, PowerPCCPU *cpu,
>  static void pnv_chip_power10_intc_create(PnvChip *chip, PowerPCCPU *cpu,
>                                          Error **errp)
>  {
> +    Pnv10Chip *chip10 = PNV10_CHIP(chip);
> +    Error *local_err = NULL;
> +    Object *obj;
>      PnvCPUState *pnv_cpu = pnv_cpu_state(cpu);
>  
> -    /* Will be defined when the interrupt controller is */
> -    pnv_cpu->intc = NULL;
> +    /*
> +     * The core creates its interrupt presenter but the XIVE2 interrupt
> +     * controller object is initialized afterwards. Hopefully, it's
> +     * only used at runtime.
> +     */
> +    obj = xive_tctx_create(OBJECT(cpu), XIVE_PRESENTER(&chip10->xive),
> +                           &local_err);
> +    if (local_err) {
> +        error_propagate(errp, local_err);
> +        return;
> +    }
> +
> +    pnv_cpu->intc = obj;
>  }
>  
>  static void pnv_chip_power10_intc_reset(PnvChip *chip, PowerPCCPU *cpu)
>  {
> -    ;
> +    PnvCPUState *pnv_cpu = pnv_cpu_state(cpu);
> +
> +    xive_tctx_reset(XIVE_TCTX(pnv_cpu->intc));
>  }
>  
>  static void pnv_chip_power10_intc_destroy(PnvChip *chip, PowerPCCPU *cpu)
>  {
>      PnvCPUState *pnv_cpu = pnv_cpu_state(cpu);
>  
> +    xive_tctx_destroy(XIVE_TCTX(pnv_cpu->intc));
>      pnv_cpu->intc = NULL;
>  }
>  
>  static void pnv_chip_power10_intc_print_info(PnvChip *chip, PowerPCCPU *cpu,
>                                               Monitor *mon)
>  {
> +    xive_tctx_pic_print_info(XIVE_TCTX(pnv_cpu_state(cpu)->intc), mon);
>  }
>  
>  /*
> @@ -1590,6 +1609,10 @@ static void pnv_chip_power10_instance_init(Object *obj)
>  {
>      Pnv10Chip *chip10 = PNV10_CHIP(obj);
>  
> +    object_initialize_child(obj, "xive", &chip10->xive, sizeof(chip10->xive),
> +                            TYPE_PNV_XIVE2, &error_abort, NULL);
> +    object_property_add_alias(obj, "xive-fabric", OBJECT(&chip10->xive),
> +                              "xive-fabric", &error_abort);
>      object_initialize_child(obj, "psi",  &chip10->psi, sizeof(chip10->psi),
>                              TYPE_PNV10_PSI, &error_abort, NULL);
>      object_initialize_child(obj, "lpc",  &chip10->lpc, sizeof(chip10->lpc),
> @@ -1617,6 +1640,30 @@ static void pnv_chip_power10_realize(DeviceState *dev, Error **errp)
>          return;
>      }
>  
> +    /* XIVE2 interrupt controller (POWER10) */
> +    object_property_set_int(OBJECT(&chip10->xive), PNV10_XIVE2_IC_BASE(chip),
> +                            "ic-bar", &error_fatal);
> +    object_property_set_int(OBJECT(&chip10->xive), PNV10_XIVE2_ESB_BASE(chip),
> +                            "esb-bar", &error_fatal);
> +    object_property_set_int(OBJECT(&chip10->xive), PNV10_XIVE2_END_BASE(chip),
> +                            "end-bar", &error_fatal);
> +    object_property_set_int(OBJECT(&chip10->xive), PNV10_XIVE2_NVPG_BASE(chip),
> +                            "nvpg-bar", &error_fatal);
> +    object_property_set_int(OBJECT(&chip10->xive), PNV10_XIVE2_NVC_BASE(chip),
> +                            "nvc-bar", &error_fatal);
> +    object_property_set_int(OBJECT(&chip10->xive), PNV10_XIVE2_TM_BASE(chip),
> +                            "tm-bar", &error_fatal);
> +    object_property_set_link(OBJECT(&chip10->xive), OBJECT(chip), "chip",
> +                             &error_abort);
> +    object_property_set_bool(OBJECT(&chip10->xive), true, "realized",
> +                             &local_err);
> +    if (local_err) {
> +        error_propagate(errp, local_err);
> +        return;
> +    }
> +    pnv_xscom_add_subregion(chip, PNV10_XSCOM_XIVE2_BASE,
> +                            &chip10->xive.xscom_regs);
> +
>      /* Processor Service Interface (PSI) Host Bridge */
>      object_property_set_int(OBJECT(&chip10->psi), PNV10_PSIHB_BASE(chip),
>                              "bar", &error_fatal);
> @@ -1913,6 +1960,35 @@ static int pnv_match_nvt(XiveFabric *xfb, uint8_t format,
>      return total_count;
>  }
>  
> +static int pnv10_xive_match_nvt(XiveFabric *xfb, uint8_t format,
> +                                uint8_t nvt_blk, uint32_t nvt_idx,
> +                                bool cam_ignore, uint8_t priority,
> +                                uint32_t logic_serv,
> +                                XiveTCTXMatch *match)
> +{
> +    PnvMachineState *pnv = PNV_MACHINE(xfb);
> +    int total_count = 0;
> +    int i;
> +
> +    for (i = 0; i < pnv->num_chips; i++) {
> +        Pnv10Chip *chip10 = PNV10_CHIP(pnv->chips[i]);
> +        XivePresenter *xptr = XIVE_PRESENTER(&chip10->xive);
> +        XivePresenterClass *xpc = XIVE_PRESENTER_GET_CLASS(xptr);
> +        int count;
> +
> +        count = xpc->match_nvt(xptr, format, nvt_blk, nvt_idx, cam_ignore,
> +                               priority, logic_serv, match);
> +
> +        if (count < 0) {
> +            return count;
> +        }
> +
> +        total_count += count;
> +    }
> +
> +    return total_count;
> +}
> +
>  static void pnv_machine_power8_class_init(ObjectClass *oc, void *data)
>  {
>      MachineClass *mc = MACHINE_CLASS(oc);
> @@ -1953,6 +2029,7 @@ static void pnv_machine_power10_class_init(ObjectClass *oc, void *data)
>  {
>      MachineClass *mc = MACHINE_CLASS(oc);
>      PnvMachineClass *pmc = PNV_MACHINE_CLASS(oc);
> +    XiveFabricClass *xfc = XIVE_FABRIC_CLASS(oc);
>      static const char compat[] = "qemu,powernv10\0ibm,powernv";
>  
>      mc->desc = "IBM PowerNV (Non-Virtualized) POWER10";
> @@ -1961,6 +2038,8 @@ static void pnv_machine_power10_class_init(ObjectClass *oc, void *data)
>      pmc->compat = compat;
>      pmc->compat_size = sizeof(compat);
>      pmc->dt_power_mgt = pnv_dt_power_mgt;
> +
> +    xfc->match_nvt = pnv10_xive_match_nvt;
>  }
>  
>  static bool pnv_machine_get_hb(Object *obj, Error **errp)
> @@ -2074,6 +2153,10 @@ static const TypeInfo types[] = {
>          .name          = MACHINE_TYPE_NAME("powernv10"),
>          .parent        = TYPE_PNV_MACHINE,
>          .class_init    = pnv_machine_power10_class_init,
> +        .interfaces = (InterfaceInfo[]) {
> +            { TYPE_XIVE_FABRIC },
> +            { },
> +        },
>      },
>      {
>          .name          = MACHINE_TYPE_NAME("powernv9"),
> diff --git a/hw/intc/Makefile.objs b/hw/intc/Makefile.objs
> index 3af575aeb87d..b879a6eb3c3a 100644
> --- a/hw/intc/Makefile.objs
> +++ b/hw/intc/Makefile.objs
> @@ -40,7 +40,7 @@ obj-$(CONFIG_XICS_KVM) += xics_kvm.o
>  obj-$(CONFIG_XIVE) += xive.o xive2.o
>  obj-$(CONFIG_XIVE_SPAPR) += spapr_xive.o
>  obj-$(CONFIG_XIVE_KVM) += spapr_xive_kvm.o
> -obj-$(CONFIG_POWERNV) += xics_pnv.o pnv_xive.o
> +obj-$(CONFIG_POWERNV) += xics_pnv.o pnv_xive.o pnv_xive2.o
>  obj-$(CONFIG_ALLWINNER_A10_PIC) += allwinner-a10-pic.o
>  obj-$(CONFIG_S390_FLIC) += s390_flic.o
>  obj-$(CONFIG_S390_FLIC_KVM) += s390_flic_kvm.o



^ permalink raw reply	[flat|nested] 25+ messages in thread

* Re: [PATCH 8/9] ppc/pnv: Add model for POWER9 PHB5 PCIe Host bridge
  2020-05-13 15:11 ` [PATCH 8/9] ppc/pnv: Add model for POWER9 PHB5 PCIe Host bridge Cédric Le Goater
@ 2020-05-20 13:46   ` Greg Kurz
  2020-05-25 10:13     ` Cédric Le Goater
  0 siblings, 1 reply; 25+ messages in thread
From: Greg Kurz @ 2020-05-20 13:46 UTC (permalink / raw)
  To: Cédric Le Goater; +Cc: qemu-ppc, qemu-devel, David Gibson

I guess you mean POWER10 ?

On Wed, 13 May 2020 17:11:08 +0200
Cédric Le Goater <clg@kaod.org> wrote:

> PHB4 and PHB5 are very similar. Use the PHB4 models with some minor
> adjustements in a subclass for P10.
> 
> Signed-off-by: Cédric Le Goater <clg@kaod.org>
> ---
>  include/hw/pci-host/pnv_phb4.h |  11 ++++
>  include/hw/ppc/pnv.h           |   3 +
>  include/hw/ppc/pnv_xscom.h     |   6 ++
>  hw/pci-host/pnv_phb4_pec.c     |  44 ++++++++++++++
>  hw/ppc/pnv.c                   | 101 +++++++++++++++++++++++++++++++++
>  5 files changed, 165 insertions(+)
> 
> diff --git a/include/hw/pci-host/pnv_phb4.h b/include/hw/pci-host/pnv_phb4.h
> index c882bfd0aa23..ea3810f74066 100644
> --- a/include/hw/pci-host/pnv_phb4.h
> +++ b/include/hw/pci-host/pnv_phb4.h
> @@ -227,4 +227,15 @@ typedef struct PnvPhb4PecClass {
>      int stk_compat_size;
>  } PnvPhb4PecClass;
>  
> +/*
> + * POWER10 definitions
> + */
> +
> +#define PNV_PHB5_VERSION           0x000000a500000001ull
> +#define PNV_PHB5_DEVICE_ID         0x0652
> +
> +#define TYPE_PNV_PHB5_PEC "pnv-phb5-pec"
> +#define PNV_PHB5_PEC(obj) \
> +    OBJECT_CHECK(PnvPhb4PecState, (obj), TYPE_PNV_PHB5_PEC)
> +
>  #endif /* PCI_HOST_PNV_PHB4_H */
> diff --git a/include/hw/ppc/pnv.h b/include/hw/ppc/pnv.h
> index 86bfa2107a8c..516229a51e7b 100644
> --- a/include/hw/ppc/pnv.h
> +++ b/include/hw/ppc/pnv.h
> @@ -127,6 +127,9 @@ typedef struct Pnv10Chip {
>      uint32_t     nr_quads;
>      PnvQuad      *quads;
>  
> +#define PNV10_CHIP_MAX_PEC 2
> +    PnvPhb4PecState pecs[PNV10_CHIP_MAX_PEC];
> +
>  } Pnv10Chip;
>  
>  #define PNV10_PIR2FUSEDCORE(pir) (((pir) >> 3) & 0xf)
> diff --git a/include/hw/ppc/pnv_xscom.h b/include/hw/ppc/pnv_xscom.h
> index f26c5217764d..433c7b878af4 100644
> --- a/include/hw/ppc/pnv_xscom.h
> +++ b/include/hw/ppc/pnv_xscom.h
> @@ -139,6 +139,12 @@ typedef struct PnvXScomInterfaceClass {
>  #define PNV10_XSCOM_XIVE2_BASE     0x2010800
>  #define PNV10_XSCOM_XIVE2_SIZE     0x400
>  
> +#define PNV10_XSCOM_PEC_NEST_BASE  0x3011800 /* index goes downwards ... */
> +#define PNV10_XSCOM_PEC_NEST_SIZE  0x100
> +
> +#define PNV10_XSCOM_PEC_PCI_BASE   0x8010800 /* index goes upwards ... */
> +#define PNV10_XSCOM_PEC_PCI_SIZE   0x200
> +
>  void pnv_xscom_realize(PnvChip *chip, uint64_t size, Error **errp);
>  int pnv_dt_xscom(PnvChip *chip, void *fdt, int root_offset,
>                   uint64_t xscom_base, uint64_t xscom_size,
> diff --git a/hw/pci-host/pnv_phb4_pec.c b/hw/pci-host/pnv_phb4_pec.c
> index 911d147ffd7d..869fd77b62cc 100644
> --- a/hw/pci-host/pnv_phb4_pec.c
> +++ b/hw/pci-host/pnv_phb4_pec.c
> @@ -586,9 +586,53 @@ static const TypeInfo pnv_pec_stk_type_info = {
>      }
>  };
>  
> +/*
> + * POWER10 definitions
> + */
> +
> +static uint32_t pnv_phb5_pec_xscom_pci_base(PnvPhb4PecState *pec)
> +{
> +    return PNV10_XSCOM_PEC_PCI_BASE + 0x1000000 * pec->index;
> +}
> +
> +static uint32_t pnv_phb5_pec_xscom_nest_base(PnvPhb4PecState *pec)
> +{
> +    /* index goes down ... */
> +    return PNV10_XSCOM_PEC_NEST_BASE - 0x1000000 * pec->index;
> +}
> +
> +static void pnv_phb5_pec_class_init(ObjectClass *klass, void *data)
> +{
> +    PnvPhb4PecClass *pecc = PNV_PHB4_PEC_CLASS(klass);
> +    static const char compat[] = "ibm,power10-pbcq";
> +    static const char stk_compat[] = "ibm,power10-phb-stack";
> +
> +    pecc->xscom_nest_base = pnv_phb5_pec_xscom_nest_base;
> +    pecc->xscom_pci_base  = pnv_phb5_pec_xscom_pci_base;
> +    pecc->xscom_nest_size = PNV10_XSCOM_PEC_NEST_SIZE;
> +    pecc->xscom_pci_size  = PNV10_XSCOM_PEC_PCI_SIZE;
> +    pecc->compat = compat;
> +    pecc->compat_size = sizeof(compat);
> +    pecc->stk_compat = stk_compat;
> +    pecc->stk_compat_size = sizeof(stk_compat);
> +}
> +
> +static const TypeInfo pnv_phb5_pec_type_info = {
> +    .name          = TYPE_PNV_PHB5_PEC,
> +    .parent        = TYPE_PNV_PHB4_PEC,
> +    .instance_size = sizeof(PnvPhb4PecState),
> +    .class_init    = pnv_phb5_pec_class_init,
> +    .class_size    = sizeof(PnvPhb4PecClass),
> +    .interfaces    = (InterfaceInfo[]) {
> +        { TYPE_PNV_XSCOM_INTERFACE },
> +        { }
> +    }
> +};
> +
>  static void pnv_pec_register_types(void)
>  {
>      type_register_static(&pnv_pec_type_info);
> +    type_register_static(&pnv_phb5_pec_type_info);
>      type_register_static(&pnv_pec_stk_type_info);
>  }
>  
> diff --git a/hw/ppc/pnv.c b/hw/ppc/pnv.c
> index fc751dd575d4..ac4bd2a17a9e 100644
> --- a/hw/ppc/pnv.c
> +++ b/hw/ppc/pnv.c
> @@ -705,9 +705,17 @@ static void pnv_ipmi_bt_init(ISABus *bus, IPMIBmc *bmc, uint32_t irq)
>  static void pnv_chip_power10_pic_print_info(PnvChip *chip, Monitor *mon)
>  {
>      Pnv10Chip *chip10 = PNV10_CHIP(chip);
> +    int i, j;
>  
>      pnv_xive2_pic_print_info(&chip10->xive, mon);
>      pnv_psi_pic_print_info(&chip10->psi, mon);
> +
> +    for (i = 0; i < PNV10_CHIP_MAX_PEC; i++) {
> +        PnvPhb4PecState *pec = &chip10->pecs[i];
> +        for (j = 0; j < pec->num_stacks; j++) {
> +            pnv_phb4_pic_print_info(&pec->stacks[j].phb, mon);
> +        }
> +    }
>  }
>  
>  static void pnv_init(MachineState *machine)
> @@ -1607,7 +1615,10 @@ static void pnv_chip_power9_class_init(ObjectClass *klass, void *data)
>  
>  static void pnv_chip_power10_instance_init(Object *obj)
>  {
> +    PnvChip *chip = PNV_CHIP(obj);
>      Pnv10Chip *chip10 = PNV10_CHIP(obj);
> +    PnvChipClass *pcc = PNV_CHIP_GET_CLASS(obj);
> +    int i;
>  
>      object_initialize_child(obj, "xive", &chip10->xive, sizeof(chip10->xive),
>                              TYPE_PNV_XIVE2, &error_abort, NULL);
> @@ -1619,6 +1630,17 @@ static void pnv_chip_power10_instance_init(Object *obj)
>                              TYPE_PNV10_LPC, &error_abort, NULL);
>      object_initialize_child(obj, "occ",  &chip10->occ, sizeof(chip10->occ),
>                              TYPE_PNV10_OCC, &error_abort, NULL);
> +
> +    for (i = 0; i < PNV10_CHIP_MAX_PEC; i++) {
> +        object_initialize_child(obj, "pec[*]", &chip10->pecs[i],
> +                                sizeof(chip10->pecs[i]), TYPE_PNV_PHB5_PEC,
> +                                &error_abort, NULL);
> +    }
> +
> +    /*
> +     * Number of PHBs is the chip default
> +     */
> +    chip->num_phbs = pcc->num_phbs;
>  }
>  
>  
> @@ -1648,6 +1670,77 @@ static void pnv_chip_power10_quad_realize(Pnv10Chip *chip10, Error **errp)
>      }
>  }
>  
> +static void pnv_chip_power10_phb_realize(PnvChip *chip, Error **errp)
> +{
> +    Pnv10Chip *chip10 = PNV10_CHIP(chip);
> +    Error *local_err = NULL;
> +    int i, j;
> +    int phb_id = 0;
> +
> +    for (i = 0; i < PNV10_CHIP_MAX_PEC; i++) {
> +        PnvPhb4PecState *pec = &chip10->pecs[i];
> +        PnvPhb4PecClass *pecc = PNV_PHB4_PEC_GET_CLASS(pec);
> +        uint32_t pec_nest_base;
> +        uint32_t pec_pci_base;
> +
> +        object_property_set_int(OBJECT(pec), i, "index", &error_fatal);
> +        /*
> +         * PEC0 -> 3 stacks
> +         * PEC1 -> 3 stacks
> +         */
> +        object_property_set_int(OBJECT(pec), 3, "num-stacks",
> +                                &error_fatal);
> +        object_property_set_int(OBJECT(pec), chip->chip_id, "chip-id",
> +                                 &error_fatal);
> +        object_property_set_link(OBJECT(pec), OBJECT(get_system_memory()),
> +                                 "system-memory", &error_abort);
> +        object_property_set_bool(OBJECT(pec), true, "realized", &local_err);
> +        if (local_err) {
> +            error_propagate(errp, local_err);
> +            return;
> +        }
> +
> +        pec_nest_base = pecc->xscom_nest_base(pec);
> +        pec_pci_base = pecc->xscom_pci_base(pec);
> +
> +        pnv_xscom_add_subregion(chip, pec_nest_base, &pec->nest_regs_mr);
> +        pnv_xscom_add_subregion(chip, pec_pci_base, &pec->pci_regs_mr);
> +
> +        for (j = 0; j < pec->num_stacks && phb_id < chip->num_phbs;
> +             j++, phb_id++) {
> +            PnvPhb4PecStack *stack = &pec->stacks[j];
> +            Object *obj = OBJECT(&stack->phb);
> +
> +            object_property_set_int(obj, phb_id, "index", &error_fatal);
> +            object_property_set_int(obj, chip->chip_id, "chip-id",
> +                                    &error_fatal);
> +            object_property_set_int(obj, PNV_PHB5_VERSION, "version",
> +                                    &error_fatal);
> +            object_property_set_int(obj, PNV_PHB5_DEVICE_ID, "device-id",
> +                                    &error_fatal);
> +            object_property_set_link(obj, OBJECT(stack), "stack", &error_abort);
> +            object_property_set_bool(obj, true, "realized", &local_err);
> +            if (local_err) {
> +                error_propagate(errp, local_err);
> +                return;
> +            }
> +            qdev_set_parent_bus(DEVICE(obj), sysbus_get_default());
> +
> +            /* Populate the XSCOM address space. */
> +            pnv_xscom_add_subregion(chip,
> +                                   pec_nest_base + 0x40 * (stack->stack_no + 1),
> +                                   &stack->nest_regs_mr);
> +            pnv_xscom_add_subregion(chip,
> +                                    pec_pci_base + 0x40 * (stack->stack_no + 1),
> +                                    &stack->pci_regs_mr);
> +            pnv_xscom_add_subregion(chip,
> +                                    pec_pci_base + PNV9_XSCOM_PEC_PCI_STK0 +
> +                                    0x40 * stack->stack_no,
> +                                    &stack->phb_regs_mr);
> +        }
> +    }
> +}
> +
>  static void pnv_chip_power10_realize(DeviceState *dev, Error **errp)
>  {
>      PnvChipClass *pcc = PNV_CHIP_GET_CLASS(dev);
> @@ -1737,6 +1830,13 @@ static void pnv_chip_power10_realize(DeviceState *dev, Error **errp)
>      }
>      pnv_xscom_add_subregion(chip, PNV10_XSCOM_OCC_BASE,
>                              &chip10->occ.xscom_regs);
> +
> +    /* PHBs */
> +    pnv_chip_power10_phb_realize(chip, &local_err);
> +    if (local_err) {
> +        error_propagate(errp, local_err);
> +        return;
> +    }
>  }
>  
>  static uint32_t pnv_chip_power10_xscom_pcba(PnvChip *chip, uint64_t addr)
> @@ -1763,6 +1863,7 @@ static void pnv_chip_power10_class_init(ObjectClass *klass, void *data)
>      k->xscom_core_base = pnv_chip_power10_xscom_core_base;
>      k->xscom_pcba = pnv_chip_power10_xscom_pcba;
>      dc->desc = "PowerNV Chip POWER10";
> +    k->num_phbs = 6;
>  
>      device_class_set_parent_realize(dc, pnv_chip_power10_realize,
>                                      &k->parent_realize);



^ permalink raw reply	[flat|nested] 25+ messages in thread

* Re: [PATCH 6/9] ppc/pnv: Add a OCC model for POWER10
  2020-05-13 15:11 ` [PATCH 6/9] ppc/pnv: Add a OCC model for POWER10 Cédric Le Goater
@ 2020-05-20 14:22   ` Greg Kurz
  2020-05-25 11:14     ` Cédric Le Goater
  0 siblings, 1 reply; 25+ messages in thread
From: Greg Kurz @ 2020-05-20 14:22 UTC (permalink / raw)
  To: Cédric Le Goater; +Cc: qemu-ppc, qemu-devel, David Gibson

On Wed, 13 May 2020 17:11:06 +0200
Cédric Le Goater <clg@kaod.org> wrote:

> Needs some more refinements but this model does not do much anyhow.
> 
> Signed-off-by: Cédric Le Goater <clg@kaod.org>
> ---
>  include/hw/ppc/pnv.h       |  1 +
>  include/hw/ppc/pnv_occ.h   |  2 ++
>  include/hw/ppc/pnv_xscom.h |  3 +++
>  hw/ppc/pnv.c               | 14 ++++++++++++++
>  hw/ppc/pnv_occ.c           | 17 +++++++++++++++++
>  5 files changed, 37 insertions(+)
> 
> diff --git a/include/hw/ppc/pnv.h b/include/hw/ppc/pnv.h
> index f318bb10add4..3ff610a9c7b5 100644
> --- a/include/hw/ppc/pnv.h
> +++ b/include/hw/ppc/pnv.h
> @@ -122,6 +122,7 @@ typedef struct Pnv10Chip {
>      PnvXive2     xive;
>      Pnv9Psi      psi;
>      PnvLpcController lpc;
> +    PnvOCC       occ;
>  } Pnv10Chip;
>  
>  #define PNV10_PIR2FUSEDCORE(pir) (((pir) >> 3) & 0xf)
> diff --git a/include/hw/ppc/pnv_occ.h b/include/hw/ppc/pnv_occ.h
> index f8d3061419dc..57cb437c9ca1 100644
> --- a/include/hw/ppc/pnv_occ.h
> +++ b/include/hw/ppc/pnv_occ.h
> @@ -28,6 +28,8 @@
>  #define PNV8_OCC(obj) OBJECT_CHECK(PnvOCC, (obj), TYPE_PNV8_OCC)
>  #define TYPE_PNV9_OCC TYPE_PNV_OCC "-POWER9"
>  #define PNV9_OCC(obj) OBJECT_CHECK(PnvOCC, (obj), TYPE_PNV9_OCC)
> +#define TYPE_PNV10_OCC TYPE_PNV_OCC "-POWER10"
> +#define PNV10_OCC(obj) OBJECT_CHECK(PnvOCC, (obj), TYPE_PNV10_OCC)
>  
>  #define PNV_OCC_SENSOR_DATA_BLOCK_OFFSET 0x00580000
>  #define PNV_OCC_SENSOR_DATA_BLOCK_SIZE   0x00025800
> diff --git a/include/hw/ppc/pnv_xscom.h b/include/hw/ppc/pnv_xscom.h
> index 1211add3e79c..f26c5217764d 100644
> --- a/include/hw/ppc/pnv_xscom.h
> +++ b/include/hw/ppc/pnv_xscom.h
> @@ -133,6 +133,9 @@ typedef struct PnvXScomInterfaceClass {
>  #define PNV10_XSCOM_PSIHB_BASE     0x3011D00
>  #define PNV10_XSCOM_PSIHB_SIZE     0x100
>  
> +#define PNV10_XSCOM_OCC_BASE       PNV_XSCOM_OCC_BASE
> +#define PNV10_XSCOM_OCC_SIZE       0x8000
> +

I don't understand why you explicitly reuse the P8/P9 definition
for the base address and you open-code the size which is the
same as P9... 

>  #define PNV10_XSCOM_XIVE2_BASE     0x2010800
>  #define PNV10_XSCOM_XIVE2_SIZE     0x400
>  
> diff --git a/hw/ppc/pnv.c b/hw/ppc/pnv.c
> index 73c40ce3209f..9f1698a74467 100644
> --- a/hw/ppc/pnv.c
> +++ b/hw/ppc/pnv.c
> @@ -1617,6 +1617,8 @@ static void pnv_chip_power10_instance_init(Object *obj)
>                              TYPE_PNV10_PSI, &error_abort, NULL);
>      object_initialize_child(obj, "lpc",  &chip10->lpc, sizeof(chip10->lpc),
>                              TYPE_PNV10_LPC, &error_abort, NULL);
> +    object_initialize_child(obj, "occ",  &chip10->occ, sizeof(chip10->occ),
> +                            TYPE_PNV10_OCC, &error_abort, NULL);
>  }
>  
>  static void pnv_chip_power10_realize(DeviceState *dev, Error **errp)
> @@ -1690,6 +1692,18 @@ static void pnv_chip_power10_realize(DeviceState *dev, Error **errp)
>  
>      chip->dt_isa_nodename = g_strdup_printf("/lpcm-opb@%" PRIx64 "/lpc@0",
>                                              (uint64_t) PNV10_LPCM_BASE(chip));
> +
> +    /* Create the simplified OCC model */
> +    object_property_set_link(OBJECT(&chip10->occ), OBJECT(&chip10->psi), "psi",
> +                             &error_abort);
> +    object_property_set_bool(OBJECT(&chip10->occ), true, "realized",
> +                             &local_err);
> +    if (local_err) {
> +        error_propagate(errp, local_err);
> +        return;
> +    }
> +    pnv_xscom_add_subregion(chip, PNV10_XSCOM_OCC_BASE,
> +                            &chip10->occ.xscom_regs);
>  }
>  
>  static uint32_t pnv_chip_power10_xscom_pcba(PnvChip *chip, uint64_t addr)
> diff --git a/hw/ppc/pnv_occ.c b/hw/ppc/pnv_occ.c
> index 5a716c256edc..7a2aea8fb9d1 100644
> --- a/hw/ppc/pnv_occ.c
> +++ b/hw/ppc/pnv_occ.c
> @@ -249,6 +249,22 @@ static const TypeInfo pnv_occ_power9_type_info = {
>      .class_init    = pnv_occ_power9_class_init,
>  };
>  
> +static void pnv_occ_power10_class_init(ObjectClass *klass, void *data)
> +{
> +    PnvOCCClass *poc = PNV_OCC_CLASS(klass);
> +
> +    poc->xscom_size = PNV9_XSCOM_OCC_SIZE;

Shouldn't it be PNV10_XSCOM_OCC_SIZE since you define it in
include/hw/ppc/pnv_xscom.h above ?

> +    poc->xscom_ops = &pnv_occ_power9_xscom_ops;
> +    poc->psi_irq = PSIHB9_IRQ_OCC;

Using P9 bits in P10 code might be a little confusing for the
casual reader. A comment could be helpful until you come up
with the refinements mentioned in the changelog.

> +}
> +
> +static const TypeInfo pnv_occ_power10_type_info = {
> +    .name          = TYPE_PNV10_OCC,
> +    .parent        = TYPE_PNV_OCC,
> +    .instance_size = sizeof(PnvOCC),
> +    .class_init    = pnv_occ_power10_class_init,
> +};
> +
>  static void pnv_occ_realize(DeviceState *dev, Error **errp)
>  {
>      PnvOCC *occ = PNV_OCC(dev);
> @@ -297,6 +313,7 @@ static void pnv_occ_register_types(void)
>      type_register_static(&pnv_occ_type_info);
>      type_register_static(&pnv_occ_power8_type_info);
>      type_register_static(&pnv_occ_power9_type_info);
> +    type_register_static(&pnv_occ_power10_type_info);
>  }
>  
>  type_init(pnv_occ_register_types);



^ permalink raw reply	[flat|nested] 25+ messages in thread

* Re: [PATCH 7/9] ppc/pnv: Add POWER10 quads
  2020-05-13 15:11 ` [PATCH 7/9] ppc/pnv: Add POWER10 quads Cédric Le Goater
@ 2020-05-20 14:44   ` Greg Kurz
  2020-05-25 11:27     ` Cédric Le Goater
  0 siblings, 1 reply; 25+ messages in thread
From: Greg Kurz @ 2020-05-20 14:44 UTC (permalink / raw)
  To: Cédric Le Goater; +Cc: qemu-ppc, qemu-devel, David Gibson

On Wed, 13 May 2020 17:11:07 +0200
Cédric Le Goater <clg@kaod.org> wrote:

> Still needs some refinements on the XSCOM registers.
> 
> Signed-off-by: Cédric Le Goater <clg@kaod.org>
> ---
>  include/hw/ppc/pnv.h |  4 ++++
>  hw/ppc/pnv.c         | 33 +++++++++++++++++++++++++++++++++
>  2 files changed, 37 insertions(+)
> 
> diff --git a/include/hw/ppc/pnv.h b/include/hw/ppc/pnv.h
> index 3ff610a9c7b5..86bfa2107a8c 100644
> --- a/include/hw/ppc/pnv.h
> +++ b/include/hw/ppc/pnv.h
> @@ -123,6 +123,10 @@ typedef struct Pnv10Chip {
>      Pnv9Psi      psi;
>      PnvLpcController lpc;
>      PnvOCC       occ;
> +
> +    uint32_t     nr_quads;
> +    PnvQuad      *quads;
> +
>  } Pnv10Chip;
>  
>  #define PNV10_PIR2FUSEDCORE(pir) (((pir) >> 3) & 0xf)
> diff --git a/hw/ppc/pnv.c b/hw/ppc/pnv.c
> index 9f1698a74467..fc751dd575d4 100644
> --- a/hw/ppc/pnv.c
> +++ b/hw/ppc/pnv.c
> @@ -1621,6 +1621,33 @@ static void pnv_chip_power10_instance_init(Object *obj)
>                              TYPE_PNV10_OCC, &error_abort, NULL);
>  }
>  
> +
> +static void pnv_chip_power10_quad_realize(Pnv10Chip *chip10, Error **errp)
> +{
> +    PnvChip *chip = PNV_CHIP(chip10);
> +    int i;
> +
> +    chip10->nr_quads = DIV_ROUND_UP(chip->nr_cores, 4);
> +    chip10->quads = g_new0(PnvQuad, chip10->nr_quads);
> +
> +    for (i = 0; i < chip10->nr_quads; i++) {
> +        char eq_name[32];
> +        PnvQuad *eq = &chip10->quads[i];
> +        PnvCore *pnv_core = chip->cores[i * 4];
> +        int core_id = CPU_CORE(pnv_core)->core_id;
> +
> +        snprintf(eq_name, sizeof(eq_name), "eq[%d]", core_id);
> +        object_initialize_child(OBJECT(chip), eq_name, eq, sizeof(*eq),
> +                                TYPE_PNV_QUAD, &error_fatal, NULL);
> +
> +        object_property_set_int(OBJECT(eq), core_id, "id", &error_fatal);
> +        object_property_set_bool(OBJECT(eq), true, "realized", &error_fatal);
> +
> +        pnv_xscom_add_subregion(chip, PNV10_XSCOM_EQ_BASE(eq->id),
> +                                &eq->xscom_regs);
> +    }
> +}

So, this function is mostly identical to the P9 variant, except the xscom
offset. Unless the refinements envisioned in the changelog bring substantial
change, I'd suggest to move this to a common helper and call it from dedicated
P9 and P10 realize functions.

> +
>  static void pnv_chip_power10_realize(DeviceState *dev, Error **errp)
>  {
>      PnvChipClass *pcc = PNV_CHIP_GET_CLASS(dev);
> @@ -1642,6 +1669,12 @@ static void pnv_chip_power10_realize(DeviceState *dev, Error **errp)
>          return;
>      }
>  
> +    pnv_chip_power10_quad_realize(chip10, &local_err);
> +    if (local_err) {
> +        error_propagate(errp, local_err);
> +        return;
> +    }
> +
>      /* XIVE2 interrupt controller (POWER10) */
>      object_property_set_int(OBJECT(&chip10->xive), PNV10_XIVE2_IC_BASE(chip),
>                              "ic-bar", &error_fatal);



^ permalink raw reply	[flat|nested] 25+ messages in thread

* Re: [PATCH 3/9] ppc/xive2: Introduce a XIVE2 core framework
  2020-05-13 15:11 ` [PATCH 3/9] ppc/xive2: Introduce a XIVE2 core framework Cédric Le Goater
@ 2020-05-20 16:40   ` Greg Kurz
  2020-05-25 11:41     ` Cédric Le Goater
  0 siblings, 1 reply; 25+ messages in thread
From: Greg Kurz @ 2020-05-20 16:40 UTC (permalink / raw)
  To: Cédric Le Goater; +Cc: qemu-ppc, qemu-devel, David Gibson

On Wed, 13 May 2020 17:11:03 +0200
Cédric Le Goater <clg@kaod.org> wrote:

> The XIVE2 interrupt controller of the POWER10 processor follows the
> same logic than on POWER9 but the HW interface has been largely
> reviewed. The interrupt controller has a new register interface,
> different BARs, extra VSDs, these will be described when we add the
> device model for the baremetal machine.
> 
> The XIVE internal structures for the EAS, END, NVT have a different
> layout which is a problem for the current core XIVE framework. To
> avoid adding too much complexity in the XIVE models, a new XIVE2 core
> framework is introduced. It duplicates the models which are closely
> linked to the XIVE internal structures : Xive2Router and Xive2ENDSource
> and reuses the XiveSource, XivePresenter, XiveTCTX models, as they are
> more generic.
> 
> Signed-off-by: Cédric Le Goater <clg@kaod.org>
> ---
>  include/hw/ppc/xive2.h      |  84 +++++
>  include/hw/ppc/xive2_regs.h | 198 +++++++++++
>  hw/intc/xive2.c             | 669 ++++++++++++++++++++++++++++++++++++
>  hw/intc/Makefile.objs       |   2 +-
>  4 files changed, 952 insertions(+), 1 deletion(-)
>  create mode 100644 include/hw/ppc/xive2.h
>  create mode 100644 include/hw/ppc/xive2_regs.h
>  create mode 100644 hw/intc/xive2.c
> 
> diff --git a/include/hw/ppc/xive2.h b/include/hw/ppc/xive2.h
> new file mode 100644
> index 000000000000..cb15487efdb6
> --- /dev/null
> +++ b/include/hw/ppc/xive2.h
> @@ -0,0 +1,84 @@
> +/*
> + * QEMU PowerPC XIVE2 interrupt controller model  (POWER10)
> + *
> + * Copyright (c) 2019-2020, IBM Corporation.
> + *
> + * This code is licensed under the GPL version 2 or later. See the
> + * COPYING file in the top-level directory.
> + *
> + */
> +
> +#ifndef PPC_XIVE2_H
> +#define PPC_XIVE2_H
> +
> +#include "hw/ppc/xive2_regs.h"
> +
> +/*
> + * XIVE2 Router (POWER10)
> + */
> +typedef struct Xive2Router {
> +    SysBusDevice    parent;
> +
> +    XiveFabric *xfb;
> +} Xive2Router;
> +
> +#define TYPE_XIVE2_ROUTER TYPE_XIVE_ROUTER "2"
> +#define XIVE2_ROUTER(obj)                                \
> +    OBJECT_CHECK(Xive2Router, (obj), TYPE_XIVE2_ROUTER)
> +#define XIVE2_ROUTER_CLASS(klass)                                        \
> +    OBJECT_CLASS_CHECK(Xive2RouterClass, (klass), TYPE_XIVE2_ROUTER)
> +#define XIVE2_ROUTER_GET_CLASS(obj)                              \
> +    OBJECT_GET_CLASS(Xive2RouterClass, (obj), TYPE_XIVE2_ROUTER)
> +
> +typedef struct Xive2RouterClass {
> +    SysBusDeviceClass parent;
> +
> +    /* XIVE table accessors */
> +    int (*get_eas)(Xive2Router *xrtr, uint8_t eas_blk, uint32_t eas_idx,
> +                   Xive2Eas *eas);
> +    int (*get_end)(Xive2Router *xrtr, uint8_t end_blk, uint32_t end_idx,
> +                   Xive2End *end);
> +    int (*write_end)(Xive2Router *xrtr, uint8_t end_blk, uint32_t end_idx,
> +                     Xive2End *end, uint8_t word_number);
> +    int (*get_nvp)(Xive2Router *xrtr, uint8_t nvt_blk, uint32_t nvt_idx,
> +                   Xive2Nvp *nvt);
> +    int (*write_nvp)(Xive2Router *xrtr, uint8_t nvt_blk, uint32_t nvt_idx,
> +                     Xive2Nvp *nvt, uint8_t word_number);

The mix of nvt and nvp wording is confusing. I suggest you drop the
nvt_ prefix for the block and index arguments, and rename the nvt
argument to nvp.

> +    uint8_t (*get_block_id)(Xive2Router *xrtr);

$ for i in get_eas get_end write_end get_nv[tp] write_nv[tp] get_block_id; do \
     echo == $i ==; git grep -E "$i[[:space:]]+= " hw/intc ; \
  done
== get_eas ==
hw/intc/pnv_xive.c:    xrc->get_eas = pnv_xive_get_eas;
hw/intc/pnv_xive2.c:    xrc->get_eas   = pnv_xive2_get_eas;
hw/intc/spapr_xive.c:    xrc->get_eas = spapr_xive_get_eas;
== get_end ==
hw/intc/pnv_xive.c:    xrc->get_end = pnv_xive_get_end;
hw/intc/pnv_xive2.c:    xrc->get_end   = pnv_xive2_get_end;
hw/intc/spapr_xive.c:    xrc->get_end = spapr_xive_get_end;
== write_end ==
hw/intc/pnv_xive.c:    xrc->write_end = pnv_xive_write_end;
hw/intc/pnv_xive2.c:    xrc->write_end = pnv_xive2_write_end;
hw/intc/spapr_xive.c:    xrc->write_end = spapr_xive_write_end;
== get_nv[tp] ==
hw/intc/pnv_xive.c:    xrc->get_nvt = pnv_xive_get_nvt;
hw/intc/pnv_xive2.c:    xrc->get_nvp   = pnv_xive2_get_nvp;
hw/intc/spapr_xive.c:    xrc->get_nvt = spapr_xive_get_nvt;
== write_nv[tp] ==
hw/intc/pnv_xive.c:    xrc->write_nvt = pnv_xive_write_nvt;
hw/intc/pnv_xive2.c:    xrc->write_nvp = pnv_xive2_write_nvp;
hw/intc/spapr_xive.c:    xrc->write_nvt = spapr_xive_write_nvt;
== get_block_id ==
hw/intc/pnv_xive.c:    xrc->get_block_id = pnv_xive_get_block_id;
hw/intc/pnv_xive2.c:    xrc->get_block_id = pnv_xive2_get_block_id;
hw/intc/spapr_xive.c:    xrc->get_block_id = spapr_xive_get_block_id;

So I guess you envision spapr variants for these callbacks ?

> +} Xive2RouterClass;
> +
> +int xive2_router_get_eas(Xive2Router *xrtr, uint8_t eas_blk, uint32_t eas_idx,
> +                        Xive2Eas *eas);
> +int xive2_router_get_end(Xive2Router *xrtr, uint8_t end_blk, uint32_t end_idx,
> +                        Xive2End *end);
> +int xive2_router_write_end(Xive2Router *xrtr, uint8_t end_blk, uint32_t end_idx,
> +                          Xive2End *end, uint8_t word_number);
> +int xive2_router_get_nvp(Xive2Router *xrtr, uint8_t nvt_blk, uint32_t nvt_idx,
> +                        Xive2Nvp *nvt);
> +int xive2_router_write_nvp(Xive2Router *xrtr, uint8_t nvt_blk, uint32_t nvt_idx,
> +                          Xive2Nvp *nvt, uint8_t word_number);
> +

Same remark as above.

> +void xive2_router_notify(XiveNotifier *xn, uint32_t lisn);
> +
> +/*
> + * XIVE2 END ESBs  (POWER10)
> + */
> +
> +#define TYPE_XIVE2_END_SOURCE TYPE_XIVE_END_SOURCE "2"
> +#define XIVE2_END_SOURCE(obj) \
> +    OBJECT_CHECK(Xive2EndSource, (obj), TYPE_XIVE2_END_SOURCE)
> +
> +typedef struct Xive2EndSource {
> +    DeviceState parent;
> +
> +    uint32_t        nr_ends;
> +
> +    /* ESB memory region */
> +    uint32_t        esb_shift;
> +    MemoryRegion    esb_mmio;
> +
> +    Xive2Router     *xrtr;
> +} Xive2EndSource;
> +
> +
> +#endif /* PPC_XIVE2_H */
> diff --git a/include/hw/ppc/xive2_regs.h b/include/hw/ppc/xive2_regs.h
> new file mode 100644
> index 000000000000..7440c44d4a3e
> --- /dev/null
> +++ b/include/hw/ppc/xive2_regs.h
> @@ -0,0 +1,198 @@
> +/*
> + * QEMU PowerPC XIVE2 internal structure definitions (POWER10)
> + *
> + * Copyright (c) 2019-2020, IBM Corporation.
> + *
> + * This code is licensed under the GPL version 2 or later. See the
> + * COPYING file in the top-level directory.
> + */
> +
> +#ifndef PPC_XIVE2_REGS_H
> +#define PPC_XIVE2_REGS_H
> +
> +/*
> + * Thread Interrupt Management Area

Maybe add (TIMA) for consistency with the other definitions.

> + *
> + * In Gen1 mode (P9 compat mode) word 2 is the same. However in Gen2
> + * mode (P10), the CAM line is slightly different as the VP space was
> + * increased.
> + */
> +#define   TM2_QW0W2_VU           PPC_BIT32(0)
> +#define   TM2_QW0W2_LOGIC_SERV   PPC_BITMASK32(4, 31)
> +#define   TM2_QW1W2_VO           PPC_BIT32(0)
> +#define   TM2_QW1W2_OS_CAM       PPC_BITMASK32(4, 31)
> +#define   TM2_QW2W2_VP           PPC_BIT32(0)
> +#define   TM2_QW2W2_POOL_CAM     PPC_BITMASK32(4, 31)
> +#define   TM2_QW3W2_VT           PPC_BIT32(0)
> +#define   TM2_QW3W2_LP           PPC_BIT32(6)
> +#define   TM2_QW3W2_LE           PPC_BIT32(7)
> +
> +/*
> + * Event Assignment Structure (EAS)
> + */
> +
> +typedef struct Xive2Eas {
> +        uint64_t       w;
> +#define EAS2_VALID                 PPC_BIT(0)
> +#define EAS2_END_BLOCK             PPC_BITMASK(4, 7) /* Destination EQ block# */
> +#define EAS2_END_INDEX             PPC_BITMASK(8, 31) /* Destination EQ index */
> +#define EAS2_MASKED                PPC_BIT(32) /* Masked                 */
> +#define EAS2_END_DATA              PPC_BITMASK(33, 63) /* written to the EQ */
> +} Xive2Eas;
> +
> +#define xive2_eas_is_valid(eas)   (be64_to_cpu((eas)->w) & EAS2_VALID)
> +#define xive2_eas_is_masked(eas)  (be64_to_cpu((eas)->w) & EAS2_MASKED)
> +
> +void xive2_eas_pic_print_info(Xive2Eas *eas, uint32_t lisn, Monitor *mon);
> +
> +/*
> + * Event Notifification Descriptor (END)
> + */
> +
> +typedef struct Xive2End {
> +        uint32_t       w0;
> +#define END2_W0_VALID              PPC_BIT32(0) /* "v" bit */
> +#define END2_W0_ENQUEUE            PPC_BIT32(5) /* "q" bit */
> +#define END2_W0_UCOND_NOTIFY       PPC_BIT32(6) /* "n" bit */
> +#define END2_W0_SILENT_ESCALATE    PPC_BIT32(7) /* "s" bit */
> +#define END2_W0_BACKLOG            PPC_BIT32(8) /* "b" bit */
> +#define END2_W0_PRECL_ESC_CTL      PPC_BIT32(9) /* "p" bit */
> +#define END2_W0_UNCOND_ESCALATE    PPC_BIT32(10) /* "u" bit */
> +#define END2_W0_ESCALATE_CTL       PPC_BIT32(11) /* "e" bit */
> +#define END2_W0_ADAPTIVE_ESC       PPC_BIT32(12) /* "a" bit */
> +#define END2_W0_ESCALATE_END       PPC_BIT32(13) /* "N" bit */
> +#define END2_W0_FIRMARE1           PPC_BIT32(16) /* Owned by FW */
> +#define END2_W0_FIRMARE2           PPC_BIT32(17) /* Owned by FW */
> +#define END2_W0_AEC_SIZE           PPC_BITMASK32(18, 19)
> +#define END2_W0_AEG_SIZE           PPC_BITMASK32(20, 23)
> +#define END2_W0_EQ_VG_PREDICT      PPC_BITMASK32(24, 31) /* Owned by HW */
> +        uint32_t       w1;
> +#define END2_W1_ESn                PPC_BITMASK32(0, 1)
> +#define END2_W1_ESn_P              PPC_BIT32(0)
> +#define END2_W1_ESn_Q              PPC_BIT32(1)
> +#define END2_W1_ESe                PPC_BITMASK32(2, 3)
> +#define END2_W1_ESe_P              PPC_BIT32(2)
> +#define END2_W1_ESe_Q              PPC_BIT32(3)
> +#define END2_W1_GEN_FLIPPED        PPC_BIT32(8)
> +#define END2_W1_GENERATION         PPC_BIT32(9)
> +#define END2_W1_PAGE_OFF           PPC_BITMASK32(10, 31)
> +        uint32_t       w2;
> +#define END2_W2_RESERVED           PPC_BITMASK32(4, 7)
> +#define END2_W2_EQ_ADDR_HI         PPC_BITMASK32(8, 31)
> +        uint32_t       w3;
> +#define END2_W3_EQ_ADDR_LO         PPC_BITMASK32(0, 24)
> +#define END2_W3_QSIZE              PPC_BITMASK32(28, 31)
> +        uint32_t       w4;
> +#define END2_W4_END_BLOCK          PPC_BITMASK32(4, 7)
> +#define END2_W4_ESC_END_INDEX      PPC_BITMASK32(8, 31)
> +#define END2_W4_ESB_BLOCK          PPC_BITMASK32(0, 3)
> +#define END2_W4_ESC_ESB_INDEX      PPC_BITMASK32(4, 31)
> +        uint32_t       w5;
> +#define END2_W5_ESC_END_DATA       PPC_BITMASK32(1, 31)
> +        uint32_t       w6;
> +#define END2_W6_FORMAT_BIT         PPC_BIT32(0)
> +#define END2_W6_IGNORE             PPC_BIT32(1)
> +#define END2_W6_VP_BLOCK           PPC_BITMASK32(4, 7)
> +#define END2_W6_VP_OFFSET          PPC_BITMASK32(8, 31)
> +#define END2_W6_VP_OFFSET_GEN1     PPC_BITMASK32(13, 31)
> +        uint32_t       w7;
> +#define END2_W7_TOPO               PPC_BITMASK32(0, 3) /* Owned by HW */
> +#define END2_W7_F0_PRIORITY        PPC_BITMASK32(8, 15)
> +#define END2_W7_F1_LOG_SERVER_ID   PPC_BITMASK32(4, 31)
> +} Xive2End;
> +
> +#define xive2_end_is_valid(end)    (be32_to_cpu((end)->w0) & END2_W0_VALID)
> +#define xive2_end_is_enqueue(end)  (be32_to_cpu((end)->w0) & END2_W0_ENQUEUE)
> +#define xive2_end_is_notify(end)                \
> +    (be32_to_cpu((end)->w0) & END2_W0_UCOND_NOTIFY)
> +#define xive2_end_is_backlog(end)  (be32_to_cpu((end)->w0) & END2_W0_BACKLOG)
> +#define xive2_end_is_escalate(end)                      \
> +    (be32_to_cpu((end)->w0) & END2_W0_ESCALATE_CTL)
> +#define xive2_end_is_uncond_escalation(end)              \
> +    (be32_to_cpu((end)->w0) & END2_W0_UNCOND_ESCALATE)
> +#define xive2_end_is_silent_escalation(end)              \
> +    (be32_to_cpu((end)->w0) & END2_W0_SILENT_ESCALATE)
> +#define xive2_end_is_escalate_end(end)              \
> +    (be32_to_cpu((end)->w0) & END2_W0_ESCALATE_END)
> +
> +static inline uint64_t xive2_end_qaddr(Xive2End *end)
> +{
> +    return ((uint64_t) be32_to_cpu(end->w2) & END2_W2_EQ_ADDR_HI) << 32 |
> +        (be32_to_cpu(end->w3) & END2_W3_EQ_ADDR_LO);
> +}
> +
> +void xive2_end_pic_print_info(Xive2End *end, uint32_t end_idx, Monitor *mon);
> +void xive2_end_queue_pic_print_info(Xive2End *end, uint32_t width,
> +                                    Monitor *mon);
> +void xive2_end_eas_pic_print_info(Xive2End *end, uint32_t end_idx,
> +                                   Monitor *mon);
> +
> +/*
> + * Notification Virtual Processor (NVP)
> + */
> +typedef struct Xive2Nvp {
> +        uint32_t       w0;
> +#define NVP2_W0_VALID              PPC_BIT32(0)
> +#define NVP2_W0_ESC_END            PPC_BIT32(25) /* 'N' bit 0:ESB  1:END */
> +        uint32_t       w1;
> +        uint32_t       w2;
> +#define NVP2_W2_CPPR               PPC_BITMASK32(0, 7)
> +#define NVP2_W2_IPB                PPC_BITMASK32(8, 15)
> +#define NVP2_W2_LSMFB              PPC_BITMASK32(16, 23)
> +        uint32_t       w3;
> +        uint32_t       w4;
> +#define NVP2_W4_ESC_ESB_BLOCK      PPC_BITMASK32(0, 3)  /* N:0 */
> +#define NVP2_W4_ESC_ESB_INDEX      PPC_BITMASK32(4, 31) /* N:0 */
> +#define NVP2_W4_ESC_END_BLOCK      PPC_BITMASK32(4, 7)  /* N:1 */
> +#define NVP2_W4_ESC_END_INDEX      PPC_BITMASK32(8, 31) /* N:1 */
> +        uint32_t       w5;
> +#define NVP2_W5_PSIZE              PPC_BITMASK32(0, 1)
> +#define NVP2_W5_VP_END_BLOCK       PPC_BITMASK32(4, 7)
> +#define NVP2_W5_VP_END_INDEX       PPC_BITMASK32(8, 31)
> +        uint32_t       w6;
> +        uint32_t       w7;
> +} Xive2Nvp;
> +
> +#define xive2_nvp_is_valid(nvp)    (be32_to_cpu((nvp)->w0) & NVP2_W0_VALID)
> +#define xive2_nvp_is_hw(nvp)       (be32_to_cpu((nvp)->w0) & NVP2_W0_HW)
> +#define xive2_nvp_is_co(nvp)       (be32_to_cpu((nvp)->w1) & NVP2_W1_CO)
> +
> +/*
> + * The VP number space in a block is defined by the END2_W6_VP_OFFSET
> + * field of the XIVE END. When running in Gen1 mode (P9 compat mode),
> + * the VP space is reduced to (1 << 19) VPs per block
> + */
> +#define XIVE2_NVP_SHIFT              24
> +#define XIVE2_NVP_COUNT              (1 << XIVE2_NVP_SHIFT)
> +
> +static inline uint32_t xive2_nvp_cam_line(uint8_t nvp_blk, uint32_t nvp_idx)
> +{
> +    return (nvp_blk << XIVE2_NVP_SHIFT) | nvp_idx;
> +}
> +
> +static inline uint32_t xive2_nvp_idx(uint32_t cam_line)
> +{
> +    return cam_line & ((1 << XIVE2_NVP_SHIFT) - 1);
> +}
> +
> +static inline uint32_t xive2_nvp_blk(uint32_t cam_line)
> +{
> +    return (cam_line >> XIVE2_NVP_SHIFT) & 0xf;
> +}
> +
> +/*
> + * Notification Virtual Group or Crowd (NVG/NVC)
> + */
> +typedef struct Xive2Nvgc {
> +        uint32_t        w0;
> +#define NVGC2_W0_VALID             PPC_BIT32(0)
> +        uint32_t        w1;
> +        uint32_t        w2;
> +        uint32_t        w3;
> +        uint32_t        w4;
> +        uint32_t        w5;
> +        uint32_t        w6;
> +        uint32_t        w7;
> +} Xive2Nvgc;
> +
> +#endif /* PPC_XIVE2_REGS_H */
> diff --git a/hw/intc/xive2.c b/hw/intc/xive2.c
> new file mode 100644
> index 000000000000..15ea04cf1822
> --- /dev/null
> +++ b/hw/intc/xive2.c
> @@ -0,0 +1,669 @@
> +/*
> + * QEMU PowerPC XIVE2 interrupt controller model (POWER10)
> + *
> + * Copyright (c) 2019-2020, IBM Corporation..
> + *
> + * This code is licensed under the GPL version 2 or later. See the
> + * COPYING file in the top-level directory.
> + */
> +
> +#include "qemu/osdep.h"
> +#include "qemu/log.h"
> +#include "qemu/module.h"
> +#include "qapi/error.h"
> +#include "target/ppc/cpu.h"
> +#include "sysemu/cpus.h"
> +#include "sysemu/dma.h"
> +#include "hw/qdev-properties.h"
> +#include "monitor/monitor.h"
> +#include "hw/ppc/xive.h"
> +#include "hw/ppc/xive2.h"
> +#include "hw/ppc/xive2_regs.h"
> +
> +static uint8_t priority_to_ipb(uint8_t priority)
> +{
> +    return priority > XIVE_PRIORITY_MAX ?
> +        0 : 1 << (XIVE_PRIORITY_MAX - priority);
> +}
> +
> +void xive2_eas_pic_print_info(Xive2Eas *eas, uint32_t lisn, Monitor *mon)
> +{
> +    if (!xive2_eas_is_valid(eas)) {
> +        return;
> +    }
> +
> +    monitor_printf(mon, "  %08x %s end:%02x/%04x data:%08x\n",
> +                   lisn, xive2_eas_is_masked(eas) ? "M" : " ",
> +                   (uint8_t)  xive_get_field64(EAS2_END_BLOCK, eas->w),
> +                   (uint32_t) xive_get_field64(EAS2_END_INDEX, eas->w),
> +                   (uint32_t) xive_get_field64(EAS2_END_DATA, eas->w));
> +}
> +
> +void xive2_end_queue_pic_print_info(Xive2End *end, uint32_t width,
> +                                     Monitor *mon)

Indent and in many other places in this file.

> +{
> +    uint64_t qaddr_base = xive2_end_qaddr(end);
> +    uint32_t qsize = xive_get_field32(END2_W3_QSIZE, end->w3);
> +    uint32_t qindex = xive_get_field32(END2_W1_PAGE_OFF, end->w1);
> +    uint32_t qentries = 1 << (qsize + 10);
> +    int i;
> +
> +    /*
> +     * print out the [ (qindex - (width - 1)) .. (qindex + 1)] window
> +     */
> +    monitor_printf(mon, " [ ");
> +    qindex = (qindex - (width - 1)) & (qentries - 1);
> +    for (i = 0; i < width; i++) {
> +        uint64_t qaddr = qaddr_base + (qindex << 2);
> +        uint32_t qdata = -1;
> +
> +        if (dma_memory_read(&address_space_memory, qaddr, &qdata,
> +                            sizeof(qdata))) {
> +            qemu_log_mask(LOG_GUEST_ERROR, "XIVE: failed to read EQ @0x%"
> +                          HWADDR_PRIx "\n", qaddr);
> +            return;
> +        }
> +        monitor_printf(mon, "%s%08x ", i == width - 1 ? "^" : "",
> +                       be32_to_cpu(qdata));
> +        qindex = (qindex + 1) & (qentries - 1);
> +    }
> +    monitor_printf(mon, "]");
> +}
> +
> +void xive2_end_pic_print_info(Xive2End *end, uint32_t end_idx, Monitor *mon)
> +{
> +    uint64_t qaddr_base = xive2_end_qaddr(end);
> +    uint32_t qindex = xive_get_field32(END2_W1_PAGE_OFF, end->w1);
> +    uint32_t qgen = xive_get_field32(END2_W1_GENERATION, end->w1);
> +    uint32_t qsize = xive_get_field32(END2_W3_QSIZE, end->w3);
> +    uint32_t qentries = 1 << (qsize + 10);
> +
> +    uint32_t nvp_blk = xive_get_field32(END2_W6_VP_BLOCK, end->w6);
> +    uint32_t nvp_idx = xive_get_field32(END2_W6_VP_OFFSET, end->w6);
> +    uint8_t priority = xive_get_field32(END2_W7_F0_PRIORITY, end->w7);
> +    uint8_t pq;
> +
> +    if (!xive2_end_is_valid(end)) {
> +        return;
> +    }
> +
> +    pq = xive_get_field32(END2_W1_ESn, end->w1);
> +
> +    monitor_printf(mon, "  %08x %c%c %c%c%c%c%c%c%c%c prio:%d nvp:%02x/%04x",
> +                   end_idx,
> +                   pq & XIVE_ESB_VAL_P ? 'P' : '-',
> +                   pq & XIVE_ESB_VAL_Q ? 'Q' : '-',
> +                   xive2_end_is_valid(end)    ? 'v' : '-',
> +                   xive2_end_is_enqueue(end)  ? 'q' : '-',
> +                   xive2_end_is_notify(end)   ? 'n' : '-',
> +                   xive2_end_is_backlog(end)  ? 'b' : '-',
> +                   xive2_end_is_escalate(end) ? 'e' : '-',
> +                   xive2_end_is_escalate_end(end) ? 'N' : '-',
> +                   xive2_end_is_uncond_escalation(end)   ? 'u' : '-',
> +                   xive2_end_is_silent_escalation(end)   ? 's' : '-',
> +                   priority, nvp_blk, nvp_idx);
> +
> +    if (qaddr_base) {
> +        monitor_printf(mon, " eq:@%08"PRIx64"% 6d/%5d ^%d",
> +                       qaddr_base, qindex, qentries, qgen);
> +        xive2_end_queue_pic_print_info(end, 6, mon);
> +    }
> +    monitor_printf(mon, "\n");
> +}
> +
> +void xive2_end_eas_pic_print_info(Xive2End *end, uint32_t end_idx,
> +                                   Monitor *mon)
> +{
> +    Xive2Eas *eas = (Xive2Eas *) &end->w4;
> +    uint8_t pq;
> +
> +    if (!xive2_end_is_escalate(end)) {
> +        return;
> +    }
> +
> +    pq = xive_get_field32(END2_W1_ESe, end->w1);
> +
> +    monitor_printf(mon, "  %08x %c%c %c%c end:%02x/%04x data:%08x\n",
> +                   end_idx,
> +                   pq & XIVE_ESB_VAL_P ? 'P' : '-',
> +                   pq & XIVE_ESB_VAL_Q ? 'Q' : '-',
> +                   xive2_eas_is_valid(eas) ? 'v' : ' ',
> +                   xive2_eas_is_masked(eas) ? 'M' : ' ',
> +                   (uint8_t)  xive_get_field64(EAS2_END_BLOCK, eas->w),
> +                   (uint32_t) xive_get_field64(EAS2_END_INDEX, eas->w),
> +                   (uint32_t) xive_get_field64(EAS2_END_DATA, eas->w));
> +}
> +
> +static void xive2_end_enqueue(Xive2End *end, uint32_t data)
> +{
> +    uint64_t qaddr_base = xive2_end_qaddr(end);
> +    uint32_t qsize = xive_get_field32(END2_W3_QSIZE, end->w3);
> +    uint32_t qindex = xive_get_field32(END2_W1_PAGE_OFF, end->w1);
> +    uint32_t qgen = xive_get_field32(END2_W1_GENERATION, end->w1);
> +
> +    uint64_t qaddr = qaddr_base + (qindex << 2);
> +    uint32_t qdata = cpu_to_be32((qgen << 31) | (data & 0x7fffffff));
> +    uint32_t qentries = 1 << (qsize + 10);
> +
> +    if (dma_memory_write(&address_space_memory, qaddr, &qdata, sizeof(qdata))) {
> +        qemu_log_mask(LOG_GUEST_ERROR, "XIVE: failed to write END data @0x%"
> +                      HWADDR_PRIx "\n", qaddr);
> +        return;
> +    }
> +
> +    qindex = (qindex + 1) & (qentries - 1);
> +    if (qindex == 0) {
> +        qgen ^= 1;
> +        end->w1 = xive_set_field32(END2_W1_GENERATION, end->w1, qgen);
> +
> +        /* TODO(PowerNV): reset GF bit on a cache watch operation */
> +        end->w1 = xive_set_field32(END2_W1_GEN_FLIPPED, end->w1, qgen);
> +    }
> +    end->w1 = xive_set_field32(END2_W1_PAGE_OFF, end->w1, qindex);
> +}
> +/*
> + * XIVE Router (aka. Virtualization Controller or IVRE)
> + */
> +
> +int xive2_router_get_eas(Xive2Router *xrtr, uint8_t eas_blk, uint32_t eas_idx,
> +                        Xive2Eas *eas)
> +{
> +    Xive2RouterClass *xrc = XIVE2_ROUTER_GET_CLASS(xrtr);
> +
> +    return xrc->get_eas(xrtr, eas_blk, eas_idx, eas);
> +}
> +
> +int xive2_router_get_end(Xive2Router *xrtr, uint8_t end_blk, uint32_t end_idx,
> +                        Xive2End *end)
> +{
> +   Xive2RouterClass *xrc = XIVE2_ROUTER_GET_CLASS(xrtr);
> +
> +   return xrc->get_end(xrtr, end_blk, end_idx, end);
> +}
> +
> +int xive2_router_write_end(Xive2Router *xrtr, uint8_t end_blk, uint32_t end_idx,
> +                          Xive2End *end, uint8_t word_number)
> +{
> +   Xive2RouterClass *xrc = XIVE2_ROUTER_GET_CLASS(xrtr);
> +
> +   return xrc->write_end(xrtr, end_blk, end_idx, end, word_number);
> +}
> +
> +int xive2_router_get_nvp(Xive2Router *xrtr, uint8_t nvp_blk, uint32_t nvp_idx,
> +                        Xive2Nvp *nvp)
> +{
> +   Xive2RouterClass *xrc = XIVE2_ROUTER_GET_CLASS(xrtr);
> +
> +   return xrc->get_nvp(xrtr, nvp_blk, nvp_idx, nvp);
> +}
> +
> +int xive2_router_write_nvp(Xive2Router *xrtr, uint8_t nvp_blk, uint32_t nvp_idx,
> +                        Xive2Nvp *nvp, uint8_t word_number)
> +{
> +   Xive2RouterClass *xrc = XIVE2_ROUTER_GET_CLASS(xrtr);
> +
> +   return xrc->write_nvp(xrtr, nvp_blk, nvp_idx, nvp, word_number);
> +}
> +
> +static int xive2_router_get_block_id(Xive2Router *xrtr)
> +{
> +   Xive2RouterClass *xrc = XIVE2_ROUTER_GET_CLASS(xrtr);
> +
> +   return xrc->get_block_id(xrtr);
> +}
> +
> +static void xive2_router_realize(DeviceState *dev, Error **errp)
> +{
> +    Xive2Router *xrtr = XIVE2_ROUTER(dev);
> +
> +    assert(xrtr->xfb);
> +}
> +
> +/*
> + * Notification using the END ESe/ESn bit (Event State Buffer for
> + * escalation and notification). Profide futher coalescing in the
> + * Router.
> + */
> +static bool xive2_router_end_es_notify(Xive2Router *xrtr, uint8_t end_blk,
> +                                        uint32_t end_idx, Xive2End *end,
> +                                        uint32_t end_esmask)
> +{
> +    uint8_t pq = xive_get_field32(end_esmask, end->w1);
> +    bool notify = xive_esb_trigger(&pq);
> +
> +    if (pq != xive_get_field32(end_esmask, end->w1)) {
> +        end->w1 = xive_set_field32(end_esmask, end->w1, pq);
> +        xive2_router_write_end(xrtr, end_blk, end_idx, end, 1);
> +    }
> +
> +    /* ESe/n[Q]=1 : end of notification */
> +    return notify;
> +}
> +
> +/*
> + * An END trigger can come from an event trigger (IPI or HW) or from
> + * another chip. We don't model the PowerBus but the END trigger
> + * message has the same parameters than in the function below.
> + */
> +static void xive2_router_end_notify(Xive2Router *xrtr, uint8_t end_blk,
> +                                     uint32_t end_idx, uint32_t end_data)
> +{
> +    Xive2End end;
> +    uint8_t priority;
> +    uint8_t format;
> +    bool found;
> +    Xive2Nvp nvp;
> +    uint8_t nvp_blk;
> +    uint32_t nvp_idx;
> +
> +    /* END cache lookup */
> +    if (xive2_router_get_end(xrtr, end_blk, end_idx, &end)) {
> +        qemu_log_mask(LOG_GUEST_ERROR, "XIVE: No END %x/%x\n", end_blk,
> +                      end_idx);
> +        return;
> +    }
> +
> +    if (!xive2_end_is_valid(&end)) {
> +        qemu_log_mask(LOG_GUEST_ERROR, "XIVE: END %x/%x is invalid\n",
> +                      end_blk, end_idx);
> +        return;
> +    }
> +
> +    if (xive2_end_is_enqueue(&end)) {
> +        xive2_end_enqueue(&end, end_data);
> +        /* Enqueuing event data modifies the EQ toggle and index */
> +        xive2_router_write_end(xrtr, end_blk, end_idx, &end, 1);
> +    }
> +
> +    /*
> +     * When the END is silent, we skip the notification part.
> +     */
> +    if (xive2_end_is_silent_escalation(&end)) {
> +        goto do_escalation;
> +    }
> +
> +    /*
> +     * The W7 format depends on the F bit in W6. It defines the type
> +     * of the notification :
> +     *
> +     *   F=0 : single or multiple NVP notification
> +     *   F=1 : User level Event-Based Branch (EBB) notification, no
> +     *         priority
> +     */
> +    format = xive_get_field32(END2_W6_FORMAT_BIT, end.w6);
> +    priority = xive_get_field32(END2_W7_F0_PRIORITY, end.w7);
> +
> +    /* The END is masked */
> +    if (format == 0 && priority == 0xff) {
> +        return;
> +    }
> +
> +    /*
> +     * Check the END ESn (Event State Buffer for notification) for
> +     * even futher coalescing in the Router
> +     */
> +    if (!xive2_end_is_notify(&end)) {
> +        /* ESn[Q]=1 : end of notification */
> +        if (!xive2_router_end_es_notify(xrtr, end_blk, end_idx,
> +                                       &end, END2_W1_ESn)) {
> +            return;
> +        }
> +    }
> +
> +    /*
> +     * Follows IVPE notification
> +     */
> +    nvp_blk = xive_get_field32(END2_W6_VP_BLOCK, end.w6);
> +    nvp_idx = xive_get_field32(END2_W6_VP_OFFSET, end.w6);
> +
> +    /* NVP cache lookup */
> +    if (xive2_router_get_nvp(xrtr, nvp_blk, nvp_idx, &nvp)) {
> +        qemu_log_mask(LOG_GUEST_ERROR, "XIVE: no NVP %x/%x\n",
> +                      nvp_blk, nvp_idx);
> +        return;
> +    }
> +
> +    if (!xive2_nvp_is_valid(&nvp)) {
> +        qemu_log_mask(LOG_GUEST_ERROR, "XIVE: NVP %x/%x is invalid\n",
> +                      nvp_blk, nvp_idx);
> +        return;
> +    }
> +
> +    found = xive_presenter_notify(xrtr->xfb, format, nvp_blk, nvp_idx,
> +                          xive_get_field32(END2_W6_IGNORE, end.w7),
> +                          priority,
> +                          xive_get_field32(END2_W7_F1_LOG_SERVER_ID, end.w7));
> +
> +    /* TODO: Auto EOI. */
> +
> +    if (found) {
> +        return;
> +    }
> +
> +    /*
> +     * If no matching NVP is dispatched on a HW thread :
> +     * - specific VP: update the NVP structure if backlog is activated
> +     * - logical server : forward request to IVPE (not supported)
> +     */
> +    if (xive2_end_is_backlog(&end)) {
> +        uint8_t ipb;
> +
> +        if (format == 1) {
> +            qemu_log_mask(LOG_GUEST_ERROR,
> +                          "XIVE: END %x/%x invalid config: F1 & backlog\n",
> +                          end_blk, end_idx);
> +            return;
> +        }
> +
> +        /*
> +         * Record the IPB in the associated NVP structure for later
> +         * use. The presenter will resend the interrupt when the vCPU
> +         * is dispatched again on a HW thread.
> +         */
> +        ipb = xive_get_field32(NVP2_W2_IPB, nvp.w2) |
> +            priority_to_ipb(priority);
> +        nvp.w2 = xive_set_field32(NVP2_W2_IPB, nvp.w2, ipb);
> +        xive2_router_write_nvp(xrtr, nvp_blk, nvp_idx, &nvp, 2);
> +
> +        /*
> +         * On HW, follows a "Broadcast Backlog" to IVPEs
> +         */
> +    }
> +
> +do_escalation:
> +    /*
> +     * If activated, escalate notification using the ESe PQ bits and
> +     * the EAS in w4-5
> +     */
> +    if (!xive2_end_is_escalate(&end)) {
> +        return;
> +    }
> +
> +    /*
> +     * Check the END ESe (Event State Buffer for escalation) for even
> +     * futher coalescing in the Router
> +     */
> +    if (!xive2_end_is_uncond_escalation(&end)) {
> +        /* ESe[Q]=1 : end of escalation notification */
> +        if (!xive2_router_end_es_notify(xrtr, end_blk, end_idx,
> +                                       &end, END2_W1_ESe)) {
> +            return;
> +        }
> +    }
> +
> +    /*
> +     * The END trigger becomes an Escalation trigger
> +     */
> +    xive2_router_end_notify(xrtr,
> +                           xive_get_field32(END2_W4_END_BLOCK,     end.w4),
> +                           xive_get_field32(END2_W4_ESC_END_INDEX, end.w4),
> +                           xive_get_field32(END2_W5_ESC_END_DATA,  end.w5));
> +}
> +
> +void xive2_router_notify(XiveNotifier *xn, uint32_t lisn)
> +{
> +    Xive2Router *xrtr = XIVE2_ROUTER(xn);
> +    uint8_t eas_blk = XIVE_EAS_BLOCK(lisn);
> +    uint32_t eas_idx = XIVE_EAS_INDEX(lisn);
> +    Xive2Eas eas;
> +
> +    /* EAS cache lookup */
> +    if (xive2_router_get_eas(xrtr, eas_blk, eas_idx, &eas)) {
> +        qemu_log_mask(LOG_GUEST_ERROR, "XIVE: Unknown LISN %x\n", lisn);
> +        return;
> +    }
> +
> +    if (!xive2_eas_is_valid(&eas)) {
> +        qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid LISN %x\n", lisn);

s/invalid/Invalid for consistency with Unkown ?

> +        return;
> +    }
> +
> +    if (xive2_eas_is_masked(&eas)) {
> +        /* Notification completed */
> +        return;
> +    }
> +
> +    /*
> +     * The event trigger becomes an END trigger
> +     */
> +    xive2_router_end_notify(xrtr,
> +                             xive_get_field64(EAS2_END_BLOCK, eas.w),
> +                             xive_get_field64(EAS2_END_INDEX, eas.w),
> +                             xive_get_field64(EAS2_END_DATA,  eas.w));
> +}
> +
> +static Property xive2_router_properties[] = {
> +    DEFINE_PROP_LINK("xive-fabric", Xive2Router, xfb,
> +                     TYPE_XIVE_FABRIC, XiveFabric *),
> +    DEFINE_PROP_END_OF_LIST(),
> +};
> +
> +static void xive2_router_class_init(ObjectClass *klass, void *data)
> +{
> +    DeviceClass *dc = DEVICE_CLASS(klass);
> +    XiveNotifierClass *xnc = XIVE_NOTIFIER_CLASS(klass);
> +
> +    dc->desc    = "XIVE2 Router Engine";
> +    device_class_set_props(dc, xive2_router_properties);
> +    /* Parent is SysBusDeviceClass. No need to call its realize hook */
> +    dc->realize = xive2_router_realize;
> +    xnc->notify = xive2_router_notify;
> +}
> +
> +static const TypeInfo xive2_router_info = {
> +    .name          = TYPE_XIVE2_ROUTER,
> +    .parent        = TYPE_SYS_BUS_DEVICE,
> +    .abstract      = true,
> +    .instance_size = sizeof(Xive2Router),
> +    .class_size    = sizeof(Xive2RouterClass),
> +    .class_init    = xive2_router_class_init,
> +    .interfaces    = (InterfaceInfo[]) {
> +        { TYPE_XIVE_NOTIFIER },
> +        { TYPE_XIVE_PRESENTER },
> +        { }
> +    }
> +};
> +
> +static inline bool addr_is_even(hwaddr addr, uint32_t shift)
> +{
> +    return !((addr >> shift) & 1);
> +}
> +
> +static uint64_t xive2_end_source_read(void *opaque, hwaddr addr, unsigned size)
> +{
> +    Xive2EndSource *xsrc = XIVE2_END_SOURCE(opaque);
> +    uint32_t offset = addr & 0xFFF;
> +    uint8_t end_blk;
> +    uint32_t end_idx;
> +    Xive2End end;
> +    uint32_t end_esmask;
> +    uint8_t pq;
> +    uint64_t ret = -1;

It seems that ret is necessarily set when reaching the final return
statement.

Rest LGTM.

> +
> +    /*
> +     * The block id should be deduced from the load address on the END
> +     * ESB MMIO but our model only supports a single block per XIVE chip.
> +     */
> +    end_blk = xive2_router_get_block_id(xsrc->xrtr);
> +    end_idx = addr >> (xsrc->esb_shift + 1);
> +
> +    if (xive2_router_get_end(xsrc->xrtr, end_blk, end_idx, &end)) {
> +        qemu_log_mask(LOG_GUEST_ERROR, "XIVE: No END %x/%x\n", end_blk,
> +                      end_idx);
> +        return -1;
> +    }
> +
> +    if (!xive2_end_is_valid(&end)) {
> +        qemu_log_mask(LOG_GUEST_ERROR, "XIVE: END %x/%x is invalid\n",
> +                      end_blk, end_idx);
> +        return -1;
> +    }
> +
> +    end_esmask = addr_is_even(addr, xsrc->esb_shift) ? END2_W1_ESn :
> +        END2_W1_ESe;
> +    pq = xive_get_field32(end_esmask, end.w1);
> +
> +    switch (offset) {
> +    case XIVE_ESB_LOAD_EOI ... XIVE_ESB_LOAD_EOI + 0x7FF:
> +        ret = xive_esb_eoi(&pq);
> +
> +        /* Forward the source event notification for routing ?? */
> +        break;
> +
> +    case XIVE_ESB_GET ... XIVE_ESB_GET + 0x3FF:
> +        ret = pq;
> +        break;
> +
> +    case XIVE_ESB_SET_PQ_00 ... XIVE_ESB_SET_PQ_00 + 0x0FF:
> +    case XIVE_ESB_SET_PQ_01 ... XIVE_ESB_SET_PQ_01 + 0x0FF:
> +    case XIVE_ESB_SET_PQ_10 ... XIVE_ESB_SET_PQ_10 + 0x0FF:
> +    case XIVE_ESB_SET_PQ_11 ... XIVE_ESB_SET_PQ_11 + 0x0FF:
> +        ret = xive_esb_set(&pq, (offset >> 8) & 0x3);
> +        break;
> +    default:
> +        qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid END ESB load addr %d\n",
> +                      offset);
> +        return -1;
> +    }
> +
> +    if (pq != xive_get_field32(end_esmask, end.w1)) {
> +        end.w1 = xive_set_field32(end_esmask, end.w1, pq);
> +        xive2_router_write_end(xsrc->xrtr, end_blk, end_idx, &end, 1);
> +    }
> +
> +    return ret;
> +}
> +
> +static void xive2_end_source_write(void *opaque, hwaddr addr,
> +                                  uint64_t value, unsigned size)
> +{
> +    Xive2EndSource *xsrc = XIVE2_END_SOURCE(opaque);
> +    uint32_t offset = addr & 0xFFF;
> +    uint8_t end_blk;
> +    uint32_t end_idx;
> +    Xive2End end;
> +    uint32_t end_esmask;
> +    uint8_t pq;
> +    bool notify = false;
> +
> +    /*
> +     * The block id should be deduced from the load address on the END
> +     * ESB MMIO but our model only supports a single block per XIVE chip.
> +     */
> +    end_blk = xive2_router_get_block_id(xsrc->xrtr);
> +    end_idx = addr >> (xsrc->esb_shift + 1);
> +
> +    if (xive2_router_get_end(xsrc->xrtr, end_blk, end_idx, &end)) {
> +        qemu_log_mask(LOG_GUEST_ERROR, "XIVE: No END %x/%x\n", end_blk,
> +                      end_idx);
> +        return;
> +    }
> +
> +    if (!xive2_end_is_valid(&end)) {
> +        qemu_log_mask(LOG_GUEST_ERROR, "XIVE: END %x/%x is invalid\n",
> +                      end_blk, end_idx);
> +        return;
> +    }
> +
> +    end_esmask = addr_is_even(addr, xsrc->esb_shift) ? END2_W1_ESn :
> +        END2_W1_ESe;
> +    pq = xive_get_field32(end_esmask, end.w1);
> +
> +    switch (offset) {
> +    case 0 ... 0x3FF:
> +        notify = xive_esb_trigger(&pq);
> +        break;
> +
> +    case XIVE_ESB_STORE_EOI ... XIVE_ESB_STORE_EOI + 0x3FF:
> +        /* TODO: can we check StoreEOI availability from the router ? */
> +        notify = xive_esb_eoi(&pq);
> +        break;
> +
> +    default:
> +        qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid END ESB write addr %d\n",
> +                      offset);
> +        return;
> +    }
> +
> +    if (pq != xive_get_field32(end_esmask, end.w1)) {
> +        end.w1 = xive_set_field32(end_esmask, end.w1, pq);
> +        xive2_router_write_end(xsrc->xrtr, end_blk, end_idx, &end, 1);
> +    }
> +
> +    /* TODO: Forward the source event notification for routing */
> +    if (notify) {
> +        ;
> +    }
> +}
> +
> +static const MemoryRegionOps xive2_end_source_ops = {
> +    .read = xive2_end_source_read,
> +    .write = xive2_end_source_write,
> +    .endianness = DEVICE_BIG_ENDIAN,
> +    .valid = {
> +        .min_access_size = 8,
> +        .max_access_size = 8,
> +    },
> +    .impl = {
> +        .min_access_size = 8,
> +        .max_access_size = 8,
> +    },
> +};
> +
> +static void xive2_end_source_realize(DeviceState *dev, Error **errp)
> +{
> +    Xive2EndSource *xsrc = XIVE2_END_SOURCE(dev);
> +
> +    assert(xsrc->xrtr);
> +
> +    if (!xsrc->nr_ends) {
> +        error_setg(errp, "Number of interrupt needs to be greater than 0");
> +        return;
> +    }
> +
> +    if (xsrc->esb_shift != XIVE_ESB_4K &&
> +        xsrc->esb_shift != XIVE_ESB_64K) {
> +        error_setg(errp, "Invalid ESB shift setting");
> +        return;
> +    }
> +
> +    /*
> +     * Each END is assigned an even/odd pair of MMIO pages, the even page
> +     * manages the ESn field while the odd page manages the ESe field.
> +     */
> +    memory_region_init_io(&xsrc->esb_mmio, OBJECT(xsrc),
> +                          &xive2_end_source_ops, xsrc, "xive.end",
> +                          (1ull << (xsrc->esb_shift + 1)) * xsrc->nr_ends);
> +}
> +
> +static Property xive2_end_source_properties[] = {
> +    DEFINE_PROP_UINT32("nr-ends", Xive2EndSource, nr_ends, 0),
> +    DEFINE_PROP_UINT32("shift", Xive2EndSource, esb_shift, XIVE_ESB_64K),
> +    DEFINE_PROP_LINK("xive", Xive2EndSource, xrtr, TYPE_XIVE2_ROUTER,
> +                     Xive2Router *),
> +    DEFINE_PROP_END_OF_LIST(),
> +};
> +
> +static void xive2_end_source_class_init(ObjectClass *klass, void *data)
> +{
> +    DeviceClass *dc = DEVICE_CLASS(klass);
> +
> +    dc->desc    = "XIVE END Source";
> +    device_class_set_props(dc, xive2_end_source_properties);
> +    dc->realize = xive2_end_source_realize;
> +}
> +
> +static const TypeInfo xive2_end_source_info = {
> +    .name          = TYPE_XIVE2_END_SOURCE,
> +    .parent        = TYPE_DEVICE,
> +    .instance_size = sizeof(Xive2EndSource),
> +    .class_init    = xive2_end_source_class_init,
> +};
> +
> +static void xive2_register_types(void)
> +{
> +    type_register_static(&xive2_router_info);
> +    type_register_static(&xive2_end_source_info);
> +}
> +
> +type_init(xive2_register_types)
> diff --git a/hw/intc/Makefile.objs b/hw/intc/Makefile.objs
> index f726d8753276..3af575aeb87d 100644
> --- a/hw/intc/Makefile.objs
> +++ b/hw/intc/Makefile.objs
> @@ -37,7 +37,7 @@ obj-$(CONFIG_SH4) += sh_intc.o
>  obj-$(CONFIG_XICS) += xics.o
>  obj-$(CONFIG_XICS_SPAPR) += xics_spapr.o
>  obj-$(CONFIG_XICS_KVM) += xics_kvm.o
> -obj-$(CONFIG_XIVE) += xive.o
> +obj-$(CONFIG_XIVE) += xive.o xive2.o
>  obj-$(CONFIG_XIVE_SPAPR) += spapr_xive.o
>  obj-$(CONFIG_XIVE_KVM) += spapr_xive_kvm.o
>  obj-$(CONFIG_POWERNV) += xics_pnv.o pnv_xive.o



^ permalink raw reply	[flat|nested] 25+ messages in thread

* Re: [PATCH 4/9] ppc/xive2: Introduce a presenter matching routine
  2020-05-13 15:11 ` [PATCH 4/9] ppc/xive2: Introduce a presenter matching routine Cédric Le Goater
@ 2020-05-20 17:17   ` Greg Kurz
  2020-05-25 12:11     ` Cédric Le Goater
  2020-05-20 17:20   ` Greg Kurz
  1 sibling, 1 reply; 25+ messages in thread
From: Greg Kurz @ 2020-05-20 17:17 UTC (permalink / raw)
  To: Cédric Le Goater; +Cc: qemu-ppc, qemu-devel, David Gibson

On Wed, 13 May 2020 17:11:04 +0200
Cédric Le Goater <clg@kaod.org> wrote:

> The VP space is larger in XIVE2 (P10), 24 bits instead of 19bits on
> XIVE (P9), and the CAM line can use a 7bits or 8bits thread id.
> 
> For now, we only use 7bits thread ids, same as P9, but because of the
> change of the size of the VP space, the CAM matching routine is
> different between P9 and P10. It is easier to duplicate the whole
> routine than to add extra handlers in xive_presenter_tctx_match() used
> for P9.
> 

It's a bit of a pity to duplicate this routine. What about turning it
into a helper with some extra arguments and come up with dedicated
users for P9 and P10 ?

> We might come with a better solution later on, after we have added
> some more support for the XIVE2 controller.
> 

Of course if you envision substantial changes that would prevent to share
enough logic, you can ignore the previous comment. The duplicated routine
looks fine.

> Signed-off-by: Cédric Le Goater <clg@kaod.org>
> ---
>  include/hw/ppc/xive2.h |  9 +++++
>  hw/intc/xive2.c        | 87 ++++++++++++++++++++++++++++++++++++++++++
>  2 files changed, 96 insertions(+)
> 
> diff --git a/include/hw/ppc/xive2.h b/include/hw/ppc/xive2.h
> index cb15487efdb6..4aefca4d96f1 100644
> --- a/include/hw/ppc/xive2.h
> +++ b/include/hw/ppc/xive2.h
> @@ -60,6 +60,15 @@ int xive2_router_write_nvp(Xive2Router *xrtr, uint8_t nvt_blk, uint32_t nvt_idx,
>  
>  void xive2_router_notify(XiveNotifier *xn, uint32_t lisn);
>  
> +/*
> + * XIVE2 Presenter (POWER10)
> + */
> +
> +int xive2_presenter_tctx_match(XivePresenter *xptr, XiveTCTX *tctx,
> +                                uint8_t format,
> +                                uint8_t nvt_blk, uint32_t nvt_idx,
> +                                bool cam_ignore, uint32_t logic_serv);
> +
>  /*
>   * XIVE2 END ESBs  (POWER10)
>   */
> diff --git a/hw/intc/xive2.c b/hw/intc/xive2.c
> index 15ea04cf1822..1ce9d995e990 100644
> --- a/hw/intc/xive2.c
> +++ b/hw/intc/xive2.c
> @@ -20,6 +20,11 @@
>  #include "hw/ppc/xive2.h"
>  #include "hw/ppc/xive2_regs.h"
>  
> +static inline uint32_t xive_tctx_word2(uint8_t *ring)
> +{
> +    return *((uint32_t *) &ring[TM_WORD2]);
> +}
> +
>  static uint8_t priority_to_ipb(uint8_t priority)
>  {
>      return priority > XIVE_PRIORITY_MAX ?
> @@ -212,6 +217,88 @@ static int xive2_router_get_block_id(Xive2Router *xrtr)
>     return xrc->get_block_id(xrtr);
>  }
>  
> +/*
> + * Encode the HW CAM line with 7bit or 8bit thread id. The thread id
> + * width and block id width is configurable at the IC level.
> + *
> + *    chipid << 19 | 0000000 0 0001 threadid (7Bit)
> + *    chipid << 24 | 0000 0000 0000 0001 threadid (8Bit)
> + */

What about introducing:

#define XIVE2_PIR_TO_NVP_IDX(pir, width) \
    (1 << (width) | ((pir) & ((1 << (width)) - 1))

or any better name you can think of and...

> +static uint32_t xive2_tctx_hw_cam_line(XivePresenter *xptr, XiveTCTX *tctx)
> +{
> +    Xive2Router *xrtr = XIVE2_ROUTER(xptr);
> +    CPUPPCState *env = &POWERPC_CPU(tctx->cs)->env;
> +    uint32_t pir = env->spr_cb[SPR_PIR].default_value;
> +    uint8_t blk = xive2_router_get_block_id(xrtr);
> +    uint8_t tid_shift = 7;
> +    uint8_t tid_mask = (1 << tid_shift) - 1;
> +
> +    return xive2_nvp_cam_line(blk, 1 << tid_shift | (pir & tid_mask));

... turn this into:

    /* We only use 7bit thread ids for now */
    return xive2_nvp_cam_line(blk, XIVE2_PIR_TO_NVP_IDX(pir, 7));

> +}
> +
> +/*
> + * The thread context register words are in big-endian format.
> + */
> +int xive2_presenter_tctx_match(XivePresenter *xptr, XiveTCTX *tctx,
> +                                uint8_t format,
> +                                uint8_t nvt_blk, uint32_t nvt_idx,
> +                                bool cam_ignore, uint32_t logic_serv)
> +{
> +    uint32_t cam =   xive2_nvp_cam_line(nvt_blk, nvt_idx);
> +    uint32_t qw3w2 = xive_tctx_word2(&tctx->regs[TM_QW3_HV_PHYS]);
> +    uint32_t qw2w2 = xive_tctx_word2(&tctx->regs[TM_QW2_HV_POOL]);
> +    uint32_t qw1w2 = xive_tctx_word2(&tctx->regs[TM_QW1_OS]);
> +    uint32_t qw0w2 = xive_tctx_word2(&tctx->regs[TM_QW0_USER]);
> +
> +    /*
> +     * TODO (PowerNV): ignore mode. The low order bits of the NVT
> +     * identifier are ignored in the "CAM" match.
> +     */
> +
> +    if (format == 0) {
> +        if (cam_ignore == true) {
> +            /*
> +             * F=0 & i=1: Logical server notification (bits ignored at
> +             * the end of the NVT identifier)
> +             */
> +            qemu_log_mask(LOG_UNIMP, "XIVE: no support for LS NVT %x/%x\n",
> +                          nvt_blk, nvt_idx);
> +             return -1;
> +        }
> +
> +        /* F=0 & i=0: Specific NVT notification */
> +
> +        /* PHYS ring */
> +        if ((be32_to_cpu(qw3w2) & TM2_QW3W2_VT) &&
> +            cam == xive2_tctx_hw_cam_line(xptr, tctx)) {
> +            return TM_QW3_HV_PHYS;
> +        }
> +
> +        /* HV POOL ring */
> +        if ((be32_to_cpu(qw2w2) & TM2_QW2W2_VP) &&
> +            cam == xive_get_field32(TM2_QW2W2_POOL_CAM, qw2w2)) {
> +            return TM_QW2_HV_POOL;
> +        }
> +
> +        /* OS ring */
> +        if ((be32_to_cpu(qw1w2) & TM2_QW1W2_VO) &&
> +            cam == xive_get_field32(TM2_QW1W2_OS_CAM, qw1w2)) {
> +            return TM_QW1_OS;
> +        }
> +    } else {
> +        /* F=1 : User level Event-Based Branch (EBB) notification */
> +
> +        /* USER ring */
> +        if  ((be32_to_cpu(qw1w2) & TM2_QW1W2_VO) &&
> +             (cam == xive_get_field32(TM2_QW1W2_OS_CAM, qw1w2)) &&
> +             (be32_to_cpu(qw0w2) & TM2_QW0W2_VU) &&
> +             (logic_serv == xive_get_field32(TM2_QW0W2_LOGIC_SERV, qw0w2))) {
> +            return TM_QW0_USER;
> +        }
> +    }
> +    return -1;
> +}
> +
>  static void xive2_router_realize(DeviceState *dev, Error **errp)
>  {
>      Xive2Router *xrtr = XIVE2_ROUTER(dev);



^ permalink raw reply	[flat|nested] 25+ messages in thread

* Re: [PATCH 4/9] ppc/xive2: Introduce a presenter matching routine
  2020-05-13 15:11 ` [PATCH 4/9] ppc/xive2: Introduce a presenter matching routine Cédric Le Goater
  2020-05-20 17:17   ` Greg Kurz
@ 2020-05-20 17:20   ` Greg Kurz
  1 sibling, 0 replies; 25+ messages in thread
From: Greg Kurz @ 2020-05-20 17:20 UTC (permalink / raw)
  To: Cédric Le Goater; +Cc: qemu-ppc, qemu-devel, David Gibson

On Wed, 13 May 2020 17:11:04 +0200
Cédric Le Goater <clg@kaod.org> wrote:

> The VP space is larger in XIVE2 (P10), 24 bits instead of 19bits on
> XIVE (P9), and the CAM line can use a 7bits or 8bits thread id.
> 
> For now, we only use 7bits thread ids, same as P9, but because of the
> change of the size of the VP space, the CAM matching routine is
> different between P9 and P10. It is easier to duplicate the whole
> routine than to add extra handlers in xive_presenter_tctx_match() used
> for P9.
> 
> We might come with a better solution later on, after we have added
> some more support for the XIVE2 controller.
> 
> Signed-off-by: Cédric Le Goater <clg@kaod.org>
> ---
>  include/hw/ppc/xive2.h |  9 +++++
>  hw/intc/xive2.c        | 87 ++++++++++++++++++++++++++++++++++++++++++
>  2 files changed, 96 insertions(+)
> 
> diff --git a/include/hw/ppc/xive2.h b/include/hw/ppc/xive2.h
> index cb15487efdb6..4aefca4d96f1 100644
> --- a/include/hw/ppc/xive2.h
> +++ b/include/hw/ppc/xive2.h
> @@ -60,6 +60,15 @@ int xive2_router_write_nvp(Xive2Router *xrtr, uint8_t nvt_blk, uint32_t nvt_idx,
>  
>  void xive2_router_notify(XiveNotifier *xn, uint32_t lisn);
>  
> +/*
> + * XIVE2 Presenter (POWER10)
> + */
> +
> +int xive2_presenter_tctx_match(XivePresenter *xptr, XiveTCTX *tctx,
> +                                uint8_t format,
> +                                uint8_t nvt_blk, uint32_t nvt_idx,
> +                                bool cam_ignore, uint32_t logic_serv);
> +

Indent.

>  /*
>   * XIVE2 END ESBs  (POWER10)
>   */
> diff --git a/hw/intc/xive2.c b/hw/intc/xive2.c
> index 15ea04cf1822..1ce9d995e990 100644
> --- a/hw/intc/xive2.c
> +++ b/hw/intc/xive2.c
> @@ -20,6 +20,11 @@
>  #include "hw/ppc/xive2.h"
>  #include "hw/ppc/xive2_regs.h"
>  
> +static inline uint32_t xive_tctx_word2(uint8_t *ring)
> +{
> +    return *((uint32_t *) &ring[TM_WORD2]);
> +}
> +
>  static uint8_t priority_to_ipb(uint8_t priority)
>  {
>      return priority > XIVE_PRIORITY_MAX ?
> @@ -212,6 +217,88 @@ static int xive2_router_get_block_id(Xive2Router *xrtr)
>     return xrc->get_block_id(xrtr);
>  }
>  
> +/*
> + * Encode the HW CAM line with 7bit or 8bit thread id. The thread id
> + * width and block id width is configurable at the IC level.
> + *
> + *    chipid << 19 | 0000000 0 0001 threadid (7Bit)
> + *    chipid << 24 | 0000 0000 0000 0001 threadid (8Bit)
> + */
> +static uint32_t xive2_tctx_hw_cam_line(XivePresenter *xptr, XiveTCTX *tctx)
> +{
> +    Xive2Router *xrtr = XIVE2_ROUTER(xptr);
> +    CPUPPCState *env = &POWERPC_CPU(tctx->cs)->env;
> +    uint32_t pir = env->spr_cb[SPR_PIR].default_value;
> +    uint8_t blk = xive2_router_get_block_id(xrtr);
> +    uint8_t tid_shift = 7;
> +    uint8_t tid_mask = (1 << tid_shift) - 1;
> +
> +    return xive2_nvp_cam_line(blk, 1 << tid_shift | (pir & tid_mask));
> +}
> +
> +/*
> + * The thread context register words are in big-endian format.
> + */
> +int xive2_presenter_tctx_match(XivePresenter *xptr, XiveTCTX *tctx,
> +                                uint8_t format,
> +                                uint8_t nvt_blk, uint32_t nvt_idx,
> +                                bool cam_ignore, uint32_t logic_serv)
> +{
> +    uint32_t cam =   xive2_nvp_cam_line(nvt_blk, nvt_idx);
> +    uint32_t qw3w2 = xive_tctx_word2(&tctx->regs[TM_QW3_HV_PHYS]);
> +    uint32_t qw2w2 = xive_tctx_word2(&tctx->regs[TM_QW2_HV_POOL]);
> +    uint32_t qw1w2 = xive_tctx_word2(&tctx->regs[TM_QW1_OS]);
> +    uint32_t qw0w2 = xive_tctx_word2(&tctx->regs[TM_QW0_USER]);
> +
> +    /*
> +     * TODO (PowerNV): ignore mode. The low order bits of the NVT
> +     * identifier are ignored in the "CAM" match.
> +     */
> +
> +    if (format == 0) {
> +        if (cam_ignore == true) {
> +            /*
> +             * F=0 & i=1: Logical server notification (bits ignored at
> +             * the end of the NVT identifier)
> +             */
> +            qemu_log_mask(LOG_UNIMP, "XIVE: no support for LS NVT %x/%x\n",
> +                          nvt_blk, nvt_idx);
> +             return -1;
> +        }
> +
> +        /* F=0 & i=0: Specific NVT notification */
> +
> +        /* PHYS ring */
> +        if ((be32_to_cpu(qw3w2) & TM2_QW3W2_VT) &&
> +            cam == xive2_tctx_hw_cam_line(xptr, tctx)) {
> +            return TM_QW3_HV_PHYS;
> +        }
> +
> +        /* HV POOL ring */
> +        if ((be32_to_cpu(qw2w2) & TM2_QW2W2_VP) &&
> +            cam == xive_get_field32(TM2_QW2W2_POOL_CAM, qw2w2)) {
> +            return TM_QW2_HV_POOL;
> +        }
> +
> +        /* OS ring */
> +        if ((be32_to_cpu(qw1w2) & TM2_QW1W2_VO) &&
> +            cam == xive_get_field32(TM2_QW1W2_OS_CAM, qw1w2)) {
> +            return TM_QW1_OS;
> +        }
> +    } else {
> +        /* F=1 : User level Event-Based Branch (EBB) notification */
> +
> +        /* USER ring */
> +        if  ((be32_to_cpu(qw1w2) & TM2_QW1W2_VO) &&
> +             (cam == xive_get_field32(TM2_QW1W2_OS_CAM, qw1w2)) &&
> +             (be32_to_cpu(qw0w2) & TM2_QW0W2_VU) &&
> +             (logic_serv == xive_get_field32(TM2_QW0W2_LOGIC_SERV, qw0w2))) {
> +            return TM_QW0_USER;
> +        }
> +    }
> +    return -1;
> +}
> +
>  static void xive2_router_realize(DeviceState *dev, Error **errp)
>  {
>      Xive2Router *xrtr = XIVE2_ROUTER(dev);



^ permalink raw reply	[flat|nested] 25+ messages in thread

* Re: [PATCH 5/9] ppc/pnv: Add a XIVE2 controller to the POWER10 chip.
  2020-05-19  9:48   ` Greg Kurz
@ 2020-05-25 10:12     ` Cédric Le Goater
  0 siblings, 0 replies; 25+ messages in thread
From: Cédric Le Goater @ 2020-05-25 10:12 UTC (permalink / raw)
  To: Greg Kurz; +Cc: qemu-ppc, qemu-devel, David Gibson

On 5/19/20 11:48 AM, Greg Kurz wrote:
> On Wed, 13 May 2020 17:11:05 +0200
> Cédric Le Goater <clg@kaod.org> wrote:
> 
>> The XIVE2 interrupt controller of the POWER10 processor follows the
>> same logic than on POWER9 but the HW interface has been largely
>> reviewed.  It has a new register interface, different BARs, extra
>> VSDs, new layout for the XIVE2 structures, and a set of new features
>> which are described below.
>>
>> This is a model of the POWER10 XIVE2 interrupt controller for the
>> PowerNV machine. It focuses primarily on the needs of the skiboot
>> firmware but some initial hypervisor support is implemented for KVM
>> use (escalation).
>>
>> Support for new features will be implemented in time and will require
>> new support from the OS.
>>
>> * XIVE2 BARS
>>
>> The interrupt controller BARs have a different layout outlined below.
>> Each sub-engine has now own its range and the indirect TIMA access was
>> replaced with a set of pages, one per CPU, under the IC BAR:
>>
>>   - IC BAR (Interrupt Controller)
>>     . 4 pages, one per sub-engine
>>     . 128 indirect TIMA pages
>>   - TM BAR (Thread Interrupt Management Area)
>>     . 4 pages
>>   - ESB BAR (ESB pages for IPIs)
>>     . up to 1TB
>>   - END BAR (ESB pages for ENDs)
>>     . up to 2TB
>>   - NVC BAR (Notification Virtual Crowd)
>>     . up to 128
>>   - NVPG BAR (Notification Virtual Process and Group)
>>     . up to 1TB
>>   - Direct mapped Thread Context Area (reads & writes)
>>
>> OPAL does not use the grouping and crowd capability.
>>
>> * Virtual Structure Tables
>>
>> XIVE2 adds new tables types and also changes the field layout of the END
>> and NVP Virtualization Structure Descriptors.
>>
>>   - EAS
>>   - END new layout
>>   - NVT was splitted in :
>>     . NVP (Processor), 32B
>>     . NVG (Group), 32B
>>     . NVC (Crowd == P9 block group) 32B
>>   - IC for remote configuration
>>   - SYNC for cache injection
>>   - ERQ for event input queue
>>
>> The setup is slighly different on XIVE2 because the indexing has changed
>> for some of the tables, block ID or the chip topology ID can be used.
>>
>> * XIVE2 features
>>
>> SCOM and MMIO registers have a new layout and XIVE2 adds a new global
>> capability and configuration registers.
>>
>> The lowlevel hardware offers a set of new features among which :
>>
>>   - a configurable number of priorities : 1 - 8
>>   - StoreEOI with load-after-store ordering is activated by default
>>   - Gen2 TIMA layout
>>   - A P9-compat mode, or Gen1, TIMA toggle bit for SW compatibility
>>   - increase to 24bit for VP number
>>
>> Other features will have some impact on the Hypervisor and guest OS
>> when activated, but this is not required for initial support of the
>> controller.
>>
>> Signed-off-by: Cédric Le Goater <clg@kaod.org>
>> ---
> 
> Apart from plugging the XIVE2 on the main system bus, like Markus's
> fix for XIVE, I don't see any obvious things to change.

OK. Fixed. 

Thanks,

C.

> 
>>  hw/intc/pnv_xive2_regs.h   |  428 ++++++++
>>  include/hw/ppc/pnv.h       |   22 +
>>  include/hw/ppc/pnv_xive.h  |   71 ++
>>  include/hw/ppc/pnv_xscom.h |    3 +
>>  hw/intc/pnv_xive2.c        | 2026 ++++++++++++++++++++++++++++++++++++
>>  hw/ppc/pnv.c               |   89 +-
>>  hw/intc/Makefile.objs      |    2 +-
>>  7 files changed, 2637 insertions(+), 4 deletions(-)
>>  create mode 100644 hw/intc/pnv_xive2_regs.h
>>  create mode 100644 hw/intc/pnv_xive2.c
>>
>> diff --git a/hw/intc/pnv_xive2_regs.h b/hw/intc/pnv_xive2_regs.h
>> new file mode 100644
>> index 000000000000..6ad0eee824b1
>> --- /dev/null
>> +++ b/hw/intc/pnv_xive2_regs.h
>> @@ -0,0 +1,428 @@
>> +/*
>> + * QEMU PowerPC XIVE2 interrupt controller model  (POWER10)
>> + *
>> + * Copyright (c) 2019-2020, IBM Corporation.
>> + *
>> + * This code is licensed under the GPL version 2 or later. See the
>> + * COPYING file in the top-level directory.
>> + */
>> +
>> +#ifndef PPC_PNV_XIVE2_REGS_H
>> +#define PPC_PNV_XIVE2_REGS_H
>> +
>> +/*
>> + * CQ Common Queue (PowerBus bridge) Registers
>> + */
>> +
>> +/* XIVE2 Capabilities */
>> +#define X_CQ_XIVE_CAP                           0x02
>> +#define CQ_XIVE_CAP                             0x010
>> +#define    CQ_XIVE_CAP_VERSION                  PPC_BITMASK(0, 3)
>> +/* 4:6 reserved */
>> +#define    CQ_XIVE_CAP_USER_INT_PRIO            PPC_BITMASK(8, 9)
>> +#define       CQ_XIVE_CAP_USER_INT_PRIO_1       0
>> +#define       CQ_XIVE_CAP_USER_INT_PRIO_1_2     1
>> +#define       CQ_XIVE_CAP_USER_INT_PRIO_1_4     2
>> +#define       CQ_XIVE_CAP_USER_INT_PRIO_1_8     3
>> +#define    CQ_XIVE_CAP_VP_INT_PRIO              PPC_BITMASK(10, 11)
>> +#define       CQ_XIVE_CAP_VP_INT_PRIO_1_8       0
>> +#define       CQ_XIVE_CAP_VP_INT_PRIO_2_8       1
>> +#define       CQ_XIVE_CAP_VP_INT_PRIO_4_8       2
>> +#define       CQ_XIVE_CAP_VP_INT_PRIO_8         3
>> +#define    CQ_XIVE_CAP_BLOCK_ID_WIDTH           PPC_BITMASK(12, 13)
>> +
>> +/* XIVE2 Configuration */
>> +#define X_CQ_XIVE_CFG                           0x03
>> +#define CQ_XIVE_CFG                             0x018
>> +
>> +/* 0:7 reserved */
>> +#define    CQ_XIVE_CFG_USER_INT_PRIO            PPC_BITMASK(8, 9)
>> +#define    CQ_XIVE_CFG_VP_INT_PRIO              PPC_BITMASK(10, 11)
>> +#define       CQ_XIVE_CFG_INT_PRIO_1            0
>> +#define       CQ_XIVE_CFG_INT_PRIO_2            1
>> +#define       CQ_XIVE_CFG_INT_PRIO_4            2
>> +#define       CQ_XIVE_CFG_INT_PRIO_8            3
>> +#define    CQ_XIVE_CFG_BLOCK_ID_WIDTH           PPC_BITMASK(12, 13)
>> +#define       CQ_XIVE_CFG_BLOCK_ID_4BITS        0
>> +#define       CQ_XIVE_CFG_BLOCK_ID_5BITS        1
>> +#define       CQ_XIVE_CFG_BLOCK_ID_6BITS        2
>> +#define       CQ_XIVE_CFG_BLOCK_ID_7BITS        3
>> +#define    CQ_XIVE_CFG_HYP_HARD_RANGE           PPC_BITMASK(14, 15)
>> +#define       CQ_XIVE_CFG_THREADID_7BITS        0
>> +#define       CQ_XIVE_CFG_THREADID_8BITS        1
>> +#define       CQ_XIVE_CFG_THREADID_9BITS        2
>> +#define       CQ_XIVE_CFG_THREADID_10BITs       3
>> +#define    CQ_XIVE_CFG_HYP_HARD_BLKID_OVERRIDE  PPC_BIT(16)
>> +#define    CQ_XIVE_CFG_HYP_HARD_BLOCK_ID        PPC_BITMASK(17, 23)
>> +
>> +/* Interrupt Controller Base Address Register - 512 pages (32M) */
>> +#define X_CQ_IC_BAR                             0x08
>> +#define CQ_IC_BAR                               0x040
>> +#define    CQ_IC_BAR_VALID                      PPC_BIT(0)
>> +#define    CQ_IC_BAR_64K                        PPC_BIT(1)
>> +/* 2:7 reserved */
>> +#define    CQ_IC_BAR_ADDR                       PPC_BITMASK(8, 42)
>> +/* 43:63 reserved */
>> +
>> +/* Thread Management Base Address Register - 4 pages */
>> +#define X_CQ_TM_BAR                             0x09
>> +#define CQ_TM_BAR                               0x048
>> +#define    CQ_TM_BAR_VALID                      PPC_BIT(0)
>> +#define    CQ_TM_BAR_64K                        PPC_BIT(1)
>> +#define    CQ_TM_BAR_ADDR                       PPC_BITMASK(8, 49)
>> +
>> +/* ESB Base Address Register */
>> +#define X_CQ_ESB_BAR                            0x0A
>> +#define CQ_ESB_BAR                              0x050
>> +#define    CQ_BAR_VALID                         PPC_BIT(0)
>> +#define    CQ_BAR_64K                           PPC_BIT(1)
>> +/* 2:7 reserved */
>> +#define    CQ_BAR_ADDR                          PPC_BITMASK(8, 39)
>> +#define    CQ_BAR_SET_DIV                       PPC_BITMASK(56, 58)
>> +#define    CQ_BAR_RANGE                         PPC_BITMASK(59, 63)
>> +                                                /* 0 (16M) - 16 (16T) */
>> +
>> +/* END Base Address Register */
>> +#define X_CQ_END_BAR                            0x0B
>> +#define CQ_END_BAR                              0x058
>> +
>> +/* NVPG Base Address Register */
>> +#define X_CQ_NVPG_BAR                           0x0C
>> +#define CQ_NVPG_BAR                             0x060
>> +
>> +/* NVC Base Address Register */
>> +#define X_CQ_NVC_BAR                            0x0D
>> +#define CQ_NVC_BAR                              0x068
>> +
>> +/* Table Address Register */
>> +#define X_CQ_TAR                                0x0E
>> +#define CQ_TAR                                  0x070
>> +#define     CQ_TAR_AUTOINC                      PPC_BIT(0)
>> +#define     CQ_TAR_SELECT                       PPC_BITMASK(12, 15)
>> +#define     CQ_TAR_ESB                          0       /* 0 - 15 */
>> +#define     CQ_TAR_END                          2       /* 0 - 15 */
>> +#define     CQ_TAR_NVPG                         3       /* 0 - 15 */
>> +#define     CQ_TAR_NVC                          5       /* 0 - 15 */
>> +#define     CQ_TAR_ENTRY_SELECT                 PPC_BITMASK(28, 31)
>> +
>> +/* Table Data Register */
>> +#define X_CQ_TDR                                0x0F
>> +#define CQ_TDR                                  0x078
>> +/* for the NVPG, NVC, ESB, END Set Translation Tables */
>> +#define     CQ_TDR_VALID                        PPC_BIT(0)
>> +#define     CQ_TDR_BLOCK_ID                     PPC_BITMASK(60, 63)
>> +
>> +/*
>> + * Processor Cores Enabled for MsgSnd
>> + * Identifies which of the 32 possible core chiplets are enabled and
>> + * available to receive the MsgSnd command
>> + */
>> +#define X_CQ_MSGSND                             0x10
>> +#define CQ_MSGSND                               0x080
>> +
>> +/* Interrupt Unit Reset Control */
>> +#define X_CQ_RST_CTL                            0x12
>> +#define CQ_RST_CTL                              0x090
>> +#define     CQ_RST_SYNC_RESET                   PPC_BIT(0)      /* Write Only */
>> +#define     CQ_RST_QUIESCE_PB                   PPC_BIT(1)      /* RW */
>> +#define     CQ_RST_MASTER_IDLE                  PPC_BIT(2)      /* Read Only */
>> +#define     CQ_RST_SAVE_IDLE                    PPC_BIT(3)      /* Read Only */
>> +#define     CQ_RST_PB_BAR_RESET                 PPC_BIT(4)      /* Write Only */
>> +
>> +/* PowerBus General Configuration */
>> +#define X_CQ_CFG_PB_GEN                         0x14
>> +#define CQ_CFG_PB_GEN                           0x0A0
>> +#define    CQ_CFG_PB_GEN_PB_INIT                PPC_BIT(45)
>> +
>> +/*
>> + * FIR
>> + *     (And-Mask)
>> + *     (Or-Mask)
>> + */
>> +#define X_CQ_FIR                                0x30
>> +#define X_CQ_FIR_AND                            0x31
>> +#define X_CQ_FIR_OR                             0x32
>> +#define CQ_FIR                                  0x180
>> +#define CQ_FIR_AND                              0x188
>> +#define CQ_FIR_OR                               0x190
>> +#define  CQ_FIR_PB_RCMDX_CI_ERR1                PPC_BIT(19)
>> +#define  CQ_FIR_VC_INFO_ERROR_0_2               PPC_BITMASK(61, 63)
>> +
>> +/*
>> + * FIR Mask
>> + *     (And-Mask)
>> + *     (Or-Mask)
>> + */
>> +#define X_CQ_FIRMASK                            0x33
>> +#define X_CQ_FIRMASK_AND                        0x34
>> +#define X_CQ_FIRMASK_OR                         0x35
>> +#define CQ_FIRMASK                              0x198
>> +#define CQ_FIRMASK_AND                          0x1A0
>> +#define CQ_FIRMASK_OR                           0x1A8
>> +
>> +/*
>> + * VC0
>> + */
>> +
>> +/* VSD table address */
>> +#define X_VC_VSD_TABLE_ADDR                     0x100
>> +#define VC_VSD_TABLE_ADDR                       0x000
>> +#define   VC_VSD_TABLE_AUTOINC                  PPC_BIT(0)
>> +#define   VC_VSD_TABLE_SELECT                   PPC_BITMASK(12, 15)
>> +#define   VC_VSD_TABLE_ADDRESS                  PPC_BITMASK(28, 31)
>> +
>> +/* VSD table data */
>> +#define X_VC_VSD_TABLE_DATA                     0x101
>> +#define VC_VSD_TABLE_DATA                       0x008
>> +
>> +/* AIB AT macro indirect kill */
>> +#define X_VC_AT_MACRO_KILL                      0x102
>> +#define VC_AT_MACRO_KILL                        0x010
>> +#define  VC_AT_MACRO_KILL_VALID                 PPC_BIT(0)
>> +#define  VC_AT_MACRO_KILL_VSD                   PPC_BITMASK(12, 15)
>> +#define  VC_AT_MACRO_KILL_BLOCK_ID              PPC_BITMASK(28, 31)
>> +#define  VC_AT_MACRO_KILL_OFFSET                PPC_BITMASK(48, 60)
>> +
>> +/* AIB AT macro indirect kill mask (same bit definitions) */
>> +#define X_VC_AT_MACRO_KILL_MASK                 0x103
>> +#define VC_AT_MACRO_KILL_MASK                   0x018
>> +
>> +/* Remote IRQs and ERQs configuration [n] (n = 0:6) */
>> +#define X_VC_QUEUES_CFG_REM0                    0x117
>> +
>> +#define VC_QUEUES_CFG_REM0                      0x0B8
>> +#define VC_QUEUES_CFG_REM1                      0x0C0
>> +#define VC_QUEUES_CFG_REM2                      0x0C8
>> +#define VC_QUEUES_CFG_REM3                      0x0D0
>> +#define VC_QUEUES_CFG_REM4                      0x0D8
>> +#define VC_QUEUES_CFG_REM5                      0x0E0
>> +#define VC_QUEUES_CFG_REM6                      0x0E8
>> +#define  VC_QUEUES_CFG_MEMB_EN                  PPC_BIT(38)
>> +#define  VC_QUEUES_CFG_MEMB_SZ                  PPC_BITMASK(42, 47)
>> +
>> +/*
>> + * VC1
>> + */
>> +
>> +/* ESBC cache flush control trigger */
>> +#define X_VC_ESBC_FLUSH_CTRL                    0x140
>> +#define VC_ESBC_FLUSH_CTRL                      0x200
>> +#define  VC_ESBC_FLUSH_CTRL_POLL_VALID          PPC_BIT(0)
>> +#define  VC_ESBC_FLUSH_CTRL_WANT_CACHE_DISABLE  PPC_BIT(2)
>> +
>> +/* ESBC cache flush poll trigger */
>> +#define X_VC_ESBC_FLUSH_POLL                    0x141
>> +#define VC_ESBC_FLUSH_POLL                      0x208
>> +#define  VC_ESBC_FLUSH_POLL_BLOCK_ID            PPC_BITMASK(0, 3)
>> +#define  VC_ESBC_FLUSH_POLL_OFFSET              PPC_BITMASK(4, 31)  /* 28-bit */
>> +#define  VC_ESBC_FLUSH_POLL_BLOCK_ID_MASK       PPC_BITMASK(32, 35)
>> +#define  VC_ESBC_FLUSH_POLL_OFFSET_MASK         PPC_BITMASK(36, 63) /* 28-bit */
>> +
>> +/* EASC flush control register */
>> +#define X_VC_EASC_FLUSH_CTRL                    0x160
>> +#define VC_EASC_FLUSH_CTRL                      0x300
>> +#define  VC_EASC_FLUSH_CTRL_POLL_VALID          PPC_BIT(0)
>> +#define  VC_EASC_FLUSH_CTRL_WANT_CACHE_DISABLE  PPC_BIT(2)
>> +
>> +/* EASC flush poll register */
>> +#define X_VC_EASC_FLUSH_POLL                    0x161
>> +#define VC_EASC_FLUSH_POLL                      0x308
>> +#define  VC_EASC_FLUSH_POLL_BLOCK_ID            PPC_BITMASK(0, 3)
>> +#define  VC_EASC_FLUSH_POLL_OFFSET              PPC_BITMASK(4, 31)  /* 28-bit */
>> +#define  VC_EASC_FLUSH_POLL_BLOCK_ID_MASK       PPC_BITMASK(32, 35)
>> +#define  VC_EASC_FLUSH_POLL_OFFSET_MASK         PPC_BITMASK(36, 63) /* 28-bit */
>> +
>> +/*
>> + * VC2
>> + */
>> +
>> +/* ENDC flush control register */
>> +#define X_VC_ENDC_FLUSH_CTRL                    0x180
>> +#define VC_ENDC_FLUSH_CTRL                      0x400
>> +#define  VC_ENDC_FLUSH_CTRL_POLL_VALID          PPC_BIT(0)
>> +#define  VC_ENDC_FLUSH_CTRL_WANT_CACHE_DISABLE  PPC_BIT(2)
>> +#define  VC_ENDC_FLUSH_CTRL_WANT_INVALIDATE     PPC_BIT(3)
>> +#define  VC_ENDC_FLUSH_CTRL_INJECT_INVALIDATE   PPC_BIT(7)
>> +
>> +/* ENDC flush poll register */
>> +#define X_VC_ENDC_FLUSH_POLL                    0x181
>> +#define VC_ENDC_FLUSH_POLL                      0x408
>> +#define  VC_ENDC_FLUSH_POLL_BLOCK_ID            PPC_BITMASK(4, 7)
>> +#define  VC_ENDC_FLUSH_POLL_OFFSET              PPC_BITMASK(8, 31)  /* 24-bit */
>> +#define  VC_ENDC_FLUSH_POLL_BLOCK_ID_MASK       PPC_BITMASK(36, 39)
>> +#define  VC_ENDC_FLUSH_POLL_OFFSET_MASK         PPC_BITMASK(40, 63) /* 24-bit */
>> +
>> +/* ENDC Sync done */
>> +#define X_VC_ENDC_SYNC_DONE                     0x184
>> +#define VC_ENDC_SYNC_DONE                       0x420
>> +#define   VC_ENDC_SYNC_POLL_DONE                PPC_BITMASK(0, 6)
>> +#define   VC_ENDC_SYNC_QUEUE_IPI                PPC_BIT(0)
>> +#define   VC_ENDC_SYNC_QUEUE_HWD                PPC_BIT(1)
>> +#define   VC_ENDC_SYNC_QUEUE_NXC                PPC_BIT(2)
>> +#define   VC_ENDC_SYNC_QUEUE_INT                PPC_BIT(3)
>> +#define   VC_ENDC_SYNC_QUEUE_OS                 PPC_BIT(4)
>> +#define   VC_ENDC_SYNC_QUEUE_POOL               PPC_BIT(5)
>> +#define   VC_ENDC_SYNC_QUEUE_HARD               PPC_BIT(6)
>> +#define   VC_QUEUE_COUNT                        7
>> +
>> +/* ENDC cache watch specification 0  */
>> +#define X_VC_ENDC_WATCH0_SPEC                   0x1A0
>> +#define VC_ENDC_WATCH0_SPEC                     0x500
>> +#define   VC_ENDC_WATCH_CONFLICT                PPC_BIT(0)
>> +#define   VC_ENDC_WATCH_FULL                    PPC_BIT(8)
>> +#define   VC_ENDC_WATCH_BLOCK_ID                PPC_BITMASK(28, 31)
>> +#define   VC_ENDC_WATCH_INDEX                   PPC_BITMASK(40, 63)
>> +
>> +/* ENDC cache watch data 0 */
>> +#define X_VC_ENDC_WATCH0_DATA0                  0x1A4
>> +#define X_VC_ENDC_WATCH0_DATA1                  0x1A5
>> +#define X_VC_ENDC_WATCH0_DATA2                  0x1A6
>> +#define X_VC_ENDC_WATCH0_DATA3                  0x1A7
>> +
>> +#define VC_ENDC_WATCH0_DATA0                    0x520
>> +#define VC_ENDC_WATCH0_DATA1                    0x528
>> +#define VC_ENDC_WATCH0_DATA2                    0x530
>> +#define VC_ENDC_WATCH0_DATA3                    0x538
>> +
>> +/*
>> + * PC LSB1
>> + */
>> +
>> +/* VSD table address register */
>> +#define X_PC_VSD_TABLE_ADDR                     0x200
>> +#define PC_VSD_TABLE_ADDR                       0x000
>> +#define   PC_VSD_TABLE_AUTOINC                  PPC_BIT(0)
>> +#define   PC_VSD_TABLE_SELECT                   PPC_BITMASK(12, 15)
>> +#define   PC_VSD_TABLE_ADDRESS                  PPC_BITMASK(28, 31)
>> +
>> +/* VSD table data register */
>> +#define X_PC_VSD_TABLE_DATA                     0x201
>> +#define PC_VSD_TABLE_DATA                       0x008
>> +
>> +/* AT indirect kill register */
>> +#define X_PC_AT_KILL                            0x202
>> +#define PC_AT_KILL                              0x010
>> +#define     PC_AT_KILL_VALID                    PPC_BIT(0)
>> +#define     PC_AT_KILL_VSD_TYPE                 PPC_BITMASK(24, 27)
>> +/* Only NVP, NVG, NVC */
>> +#define     PC_AT_KILL_BLOCK_ID                 PPC_BITMASK(28, 31)
>> +#define     PC_AT_KILL_OFFSET                   PPC_BITMASK(48, 60)
>> +
>> +/* AT indirect kill mask register */
>> +#define X_PC_AT_KILL_MASK                       0x203
>> +#define PC_AT_KILL_MASK                         0x018
>> +#define     PC_AT_KILL_MASK_VSD_TYPE            PPC_BITMASK(24, 27)
>> +#define     PC_AT_KILL_MASK_BLOCK_ID            PPC_BITMASK(28, 31)
>> +#define     PC_AT_KILL_MASK_OFFSET              PPC_BITMASK(48, 60)
>> +
>> +/*
>> + * PC LSB2
>> + */
>> +
>> +/* NxC Cache flush control */
>> +#define X_PC_NXC_FLUSH_CTRL                     0x280
>> +#define PC_NXC_FLUSH_CTRL                       0x400
>> +#define  PC_NXC_FLUSH_CTRL_POLL_VALID           PPC_BIT(0)
>> +#define  PC_NXC_FLUSH_CTRL_WANT_CACHE_DISABLE   PPC_BIT(2)
>> +#define  PC_NXC_FLUSH_CTRL_WANT_INVALIDATE      PPC_BIT(3)
>> +#define  PC_NXC_FLUSH_CTRL_INJECT_INVALIDATE    PPC_BIT(7)
>> +
>> +/* NxC Cache flush poll */
>> +#define X_PC_NXC_FLUSH_POLL                     0x281
>> +#define PC_NXC_FLUSH_POLL                       0x408
>> +#define  PC_NXC_FLUSH_POLL_NXC_TYPE             PPC_BITMASK(2, 3)
>> +#define    PC_NXC_FLUSH_POLL_NXC_TYPE_NVP       0
>> +#define    PC_NXC_FLUSH_POLL_NXC_TYPE_NVG       2
>> +#define    PC_NXC_FLUSH_POLL_NXC_TYPE_NVC       3
>> +#define  PC_NXC_FLUSH_POLL_BLOCK_ID             PPC_BITMASK(4, 7)
>> +#define  PC_NXC_FLUSH_POLL_OFFSET               PPC_BITMASK(8, 31)  /* 24-bit */
>> +#define  PC_NXC_FLUSH_POLL_NXC_TYPE_MASK        PPC_BITMASK(34, 35) /* 0: Ign */
>> +#define  PC_NXC_FLUSH_POLL_BLOCK_ID_MASK        PPC_BITMASK(36, 39)
>> +#define  PC_NXC_FLUSH_POLL_OFFSET_MASK          PPC_BITMASK(40, 63) /* 24-bit */
>> +
>> +/* NxC Cache Watch 0 Specification */
>> +#define X_PC_NXC_WATCH0_SPEC                    0x2A0
>> +#define PC_NXC_WATCH0_SPEC                      0x500
>> +#define   PC_NXC_WATCH_CONFLICT                 PPC_BIT(0)
>> +#define   PC_NXC_WATCH_FULL                     PPC_BIT(8)
>> +#define   PC_NXC_WATCH_NXC_TYPE                 PPC_BITMASK(26, 37)
>> +#define     PC_NXC_WATCH_NXC_NVP                0
>> +#define     PC_NXC_WATCH_NXC_NVG                2
>> +#define     PC_NXC_WATCH_NXC_NVC                3
>> +#define   PC_NXC_WATCH_BLOCK_ID                 PPC_BITMASK(28, 31)
>> +#define   PC_NXC_WATCH_INDEX                    PPC_BITMASK(40, 63)
>> +
>> +/* NxC Cache Watch 0 Data */
>> +#define X_PC_NXC_WATCH0_DATA0                   0x2A4
>> +#define X_PC_NXC_WATCH0_DATA1                   0x2A5
>> +#define X_PC_NXC_WATCH0_DATA2                   0x2A6
>> +#define X_PC_NXC_WATCH0_DATA3                   0x2A7
>> +
>> +#define PC_NXC_WATCH0_DATA0                     0x520
>> +#define PC_NXC_WATCH0_DATA1                     0x528
>> +#define PC_NXC_WATCH0_DATA2                     0x530
>> +#define PC_NXC_WATCH0_DATA3                     0x538
>> +
>> +/*
>> + * TCTXT Registers
>> + */
>> +
>> +/* Physical Thread Enable0 register */
>> +#define X_TCTXT_EN0                             0x300
>> +#define TCTXT_EN0                               0x000
>> +
>> +/* Physical Thread Enable0 Set register */
>> +#define X_TCTXT_EN0_SET                         0x302
>> +#define TCTXT_EN0_SET                           0x010
>> +
>> +/* Physical Thread Enable0 Reset register */
>> +#define X_TCTXT_EN0_RESET                       0x303
>> +#define TCTXT_EN0_RESET                         0x018
>> +
>> +/* Physical Thread Enable1 register */
>> +#define X_TCTXT_EN1                             0x304
>> +#define TCTXT_EN1                               0x020
>> +
>> +/* Physical Thread Enable1 Set register */
>> +#define X_TCTXT_EN1_SET                         0x306
>> +#define TCTXT_EN1_SET                           0x030
>> +
>> +/* Physical Thread Enable1 Reset register */
>> +#define X_TCTXT_EN1_RESET                       0x307
>> +#define TCTXT_EN1_RESET                         0x038
>> +
>> +/*
>> + * VSD Tables
>> + */
>> +#define VST_ESB                  0
>> +#define VST_EAS                  1 /* No used by PC */
>> +#define VST_END                  2
>> +#define VST_NVP                  3
>> +#define VST_NVG                  4
>> +#define VST_NVC                  5
>> +#define VST_IC                   6 /* No used by PC */
>> +#define VST_SYNC                 7
>> +#define VST_ERQ                  8 /* No used by PC */
>> +
>> +/*
>> + * Bits in a VSD entry.
>> + *
>> + * Note: the address is naturally aligned, we don't use a PPC_BITMASK,
>> + *       but just a mask to apply to the address before OR'ing it in.
>> + *
>> + * Note: VSD_FIRMWARE is a SW bit ! It hijacks an unused bit in the
>> + *       VSD and is only meant to be used in indirect mode !
>> + */
>> +#define VSD_MODE                PPC_BITMASK(0, 1)
>> +#define  VSD_MODE_SHARED        1
>> +#define  VSD_MODE_EXCLUSIVE     2
>> +#define  VSD_MODE_FORWARD       3
>> +#define VSD_FIRMWARE            PPC_BIT(2) /* Read warning */
>> +#define VSD_FIRMWARE2           PPC_BIT(3) /* unused */
>> +#define VSD_RESERVED            PPC_BITMASK(4, 7) /* P10 reserved */
>> +#define VSD_ADDRESS_MASK        0x00fffffffffff000ull
>> +#define VSD_MIGRATION_REG       PPC_BITMASK(52, 55)
>> +#define VSD_INDIRECT            PPC_BIT(56)
>> +#define VSD_TSIZE               PPC_BITMASK(59, 63)
>> +
>> +#endif /* PPC_PNV_XIVE2_REGS_H */
>> diff --git a/include/hw/ppc/pnv.h b/include/hw/ppc/pnv.h
>> index d4b0b0e2ff71..f318bb10add4 100644
>> --- a/include/hw/ppc/pnv.h
>> +++ b/include/hw/ppc/pnv.h
>> @@ -119,10 +119,14 @@ typedef struct Pnv10Chip {
>>      PnvChip      parent_obj;
>>  
>>      /*< public >*/
>> +    PnvXive2     xive;
>>      Pnv9Psi      psi;
>>      PnvLpcController lpc;
>>  } Pnv10Chip;
>>  
>> +#define PNV10_PIR2FUSEDCORE(pir) (((pir) >> 3) & 0xf)
>> +#define PNV10_PIR2CHIP(pir)      (((pir) >> 8) & 0x7f)
>> +
>>  typedef struct PnvChipClass {
>>      /*< private >*/
>>      SysBusDeviceClass parent_class;
>> @@ -340,10 +344,28 @@ void pnv_bmc_set_pnor(IPMIBmc *bmc, PnvPnor *pnor);
>>  #define PNV10_LPCM_SIZE             0x0000000100000000ull
>>  #define PNV10_LPCM_BASE(chip)       PNV10_CHIP_BASE(chip, 0x0006030000000000ull)
>>  
>> +#define PNV10_XIVE2_IC_SIZE         0x0000000002000000ull
>> +#define PNV10_XIVE2_IC_BASE(chip)   PNV10_CHIP_BASE(chip, 0x0006030200000000ull)
>> +
>>  #define PNV10_PSIHB_ESB_SIZE        0x0000000000100000ull
>>  #define PNV10_PSIHB_ESB_BASE(chip)  PNV10_CHIP_BASE(chip, 0x0006030202000000ull)
>>  
>>  #define PNV10_PSIHB_SIZE            0x0000000000100000ull
>>  #define PNV10_PSIHB_BASE(chip)      PNV10_CHIP_BASE(chip, 0x0006030203000000ull)
>>  
>> +#define PNV10_XIVE2_TM_SIZE         0x0000000000040000ull
>> +#define PNV10_XIVE2_TM_BASE(chip)   PNV10_CHIP_BASE(chip, 0x0006030203180000ull)
>> +
>> +#define PNV10_XIVE2_NVC_SIZE        0x0000000008000000ull
>> +#define PNV10_XIVE2_NVC_BASE(chip)  PNV10_CHIP_BASE(chip, 0x0006030208000000ull)
>> +
>> +#define PNV10_XIVE2_NVPG_SIZE       0x0000010000000000ull
>> +#define PNV10_XIVE2_NVPG_BASE(chip) PNV10_CHIP_BASE(chip, 0x0006040000000000ull)
>> +
>> +#define PNV10_XIVE2_ESB_SIZE        0x0000010000000000ull
>> +#define PNV10_XIVE2_ESB_BASE(chip)  PNV10_CHIP_BASE(chip, 0x0006050000000000ull)
>> +
>> +#define PNV10_XIVE2_END_SIZE        0x0000020000000000ull
>> +#define PNV10_XIVE2_END_BASE(chip)  PNV10_CHIP_BASE(chip, 0x0006060000000000ull)
>> +
>>  #endif /* PPC_PNV_H */
>> diff --git a/include/hw/ppc/pnv_xive.h b/include/hw/ppc/pnv_xive.h
>> index 76cf16f64472..7d8630775786 100644
>> --- a/include/hw/ppc/pnv_xive.h
>> +++ b/include/hw/ppc/pnv_xive.h
>> @@ -11,6 +11,7 @@
>>  #define PPC_PNV_XIVE_H
>>  
>>  #include "hw/ppc/xive.h"
>> +#include "hw/ppc/xive2.h"
>>  
>>  struct PnvChip;
>>  
>> @@ -97,4 +98,74 @@ typedef struct PnvXiveClass {
>>  
>>  void pnv_xive_pic_print_info(PnvXive *xive, Monitor *mon);
>>  
>> +/*
>> + * XIVE2 interrupt controller (POWER10)
>> + */
>> +#define TYPE_PNV_XIVE2 TYPE_PNV_XIVE "2"
>> +#define PNV_XIVE2(obj) OBJECT_CHECK(PnvXive2, (obj), TYPE_PNV_XIVE2)
>> +#define PNV_XIVE2_CLASS(klass)                                   \
>> +    OBJECT_CLASS_CHECK(PnvXive2Class, (klass), TYPE_PNV_XIVE2)
>> +#define PNV_XIVE2_GET_CLASS(obj)                                 \
>> +    OBJECT_GET_CLASS(PnvXive2Class, (obj), TYPE_PNV_XIVE2)
>> +
>> +typedef struct PnvXive2 {
>> +    Xive2Router   parent_obj;
>> +
>> +    /* Owning chip */
>> +    struct PnvChip *chip;
>> +
>> +    /* XSCOM addresses giving access to the controller registers */
>> +    MemoryRegion  xscom_regs;
>> +
>> +    MemoryRegion  ic_mmio;
>> +    MemoryRegion  ic_mmios[8];
>> +    MemoryRegion  esb_mmio;
>> +    MemoryRegion  end_mmio;
>> +    MemoryRegion  nvc_mmio;
>> +    MemoryRegion  nvpg_mmio;
>> +    MemoryRegion  tm_mmio;
>> +
>> +    /* Shortcut values for the Main MMIO regions */
>> +    hwaddr        ic_base;
>> +    uint32_t      ic_shift;
>> +    hwaddr        esb_base;
>> +    uint32_t      esb_shift;
>> +    hwaddr        end_base;
>> +    uint32_t      end_shift;
>> +    hwaddr        nvc_base;
>> +    uint32_t      nvc_shift;
>> +    hwaddr        nvpg_base;
>> +    uint32_t      nvpg_shift;
>> +    hwaddr        tm_base;
>> +    uint32_t      tm_shift;
>> +
>> +    /* Interrupt controller registers */
>> +    uint64_t      cq_regs[0x40];
>> +    uint64_t      vc_regs[0x100];
>> +    uint64_t      pc_regs[0x100];
>> +    uint64_t      tctxt_regs[0x30];
>> +
>> +    /* Our XIVE source objects for IPIs and ENDs */
>> +    XiveSource    ipi_source;
>> +    Xive2EndSource end_source;
>> +
>> +    /*
>> +     * Virtual Structure Descriptor tables
>> +     * These are in a SRAM protected by ECC.
>> +     */
>> +    uint64_t      vsds[9][XIVE_BLOCK_MAX];
>> +
>> +    /* Translation tables */
>> +    uint64_t      tables[8][XIVE_BLOCK_MAX];
>> +
>> +} PnvXive2;
>> +
>> +typedef struct PnvXive2Class {
>> +    Xive2RouterClass parent_class;
>> +
>> +    DeviceRealize parent_realize;
>> +} PnvXive2Class;
>> +
>> +void pnv_xive2_pic_print_info(PnvXive2 *xive, Monitor *mon);
>> +
>>  #endif /* PPC_PNV_XIVE_H */
>> diff --git a/include/hw/ppc/pnv_xscom.h b/include/hw/ppc/pnv_xscom.h
>> index 09156a5a7a6f..1211add3e79c 100644
>> --- a/include/hw/ppc/pnv_xscom.h
>> +++ b/include/hw/ppc/pnv_xscom.h
>> @@ -133,6 +133,9 @@ typedef struct PnvXScomInterfaceClass {
>>  #define PNV10_XSCOM_PSIHB_BASE     0x3011D00
>>  #define PNV10_XSCOM_PSIHB_SIZE     0x100
>>  
>> +#define PNV10_XSCOM_XIVE2_BASE     0x2010800
>> +#define PNV10_XSCOM_XIVE2_SIZE     0x400
>> +
>>  void pnv_xscom_realize(PnvChip *chip, uint64_t size, Error **errp);
>>  int pnv_dt_xscom(PnvChip *chip, void *fdt, int root_offset,
>>                   uint64_t xscom_base, uint64_t xscom_size,
>> diff --git a/hw/intc/pnv_xive2.c b/hw/intc/pnv_xive2.c
>> new file mode 100644
>> index 000000000000..761e9406315a
>> --- /dev/null
>> +++ b/hw/intc/pnv_xive2.c
>> @@ -0,0 +1,2026 @@
>> +/*
>> + * QEMU PowerPC XIVE2 interrupt controller model  (POWER10)
>> + *
>> + * Copyright (c) 2019-2020, IBM Corporation.
>> + *
>> + * This code is licensed under the GPL version 2 or later. See the
>> + * COPYING file in the top-level directory.
>> + */
>> +
>> +#include "qemu/osdep.h"
>> +#include "qemu/log.h"
>> +#include "qapi/error.h"
>> +#include "target/ppc/cpu.h"
>> +#include "sysemu/cpus.h"
>> +#include "sysemu/dma.h"
>> +#include "monitor/monitor.h"
>> +#include "hw/ppc/fdt.h"
>> +#include "hw/ppc/pnv.h"
>> +#include "hw/ppc/pnv_core.h"
>> +#include "hw/ppc/pnv_xscom.h"
>> +#include "hw/ppc/xive2.h"
>> +#include "hw/ppc/pnv_xive.h"
>> +#include "hw/ppc/xive_regs.h"
>> +#include "hw/ppc/xive2_regs.h"
>> +#include "hw/ppc/ppc.h"
>> +#include "hw/qdev-properties.h"
>> +#include "sysemu/reset.h"
>> +
>> +#include <libfdt.h>
>> +
>> +#include "pnv_xive2_regs.h"
>> +
>> +#undef XIVE2_DEBUG
>> +
>> +/*
>> + * Virtual structures table (VST)
>> + */
>> +#define SBE_PER_BYTE   4
>> +
>> +typedef struct XiveVstInfo {
>> +    const char *name;
>> +    uint32_t    size;
>> +    uint32_t    max_blocks;
>> +} XiveVstInfo;
>> +
>> +static const XiveVstInfo vst_infos[] = {
>> +
>> +    [VST_EAS]  = { "EAT",  sizeof(Xive2Eas),  16 },
>> +    [VST_ESB]  = { "ESB",  1,                  16 },
>> +    [VST_END]  = { "ENDT", sizeof(Xive2End),  16 },
>> +
>> +    [VST_NVP]  = { "NVPT", sizeof(Xive2Nvp),  16 },
>> +    [VST_NVG]  = { "NVGT", sizeof(Xive2Nvgc), 16 },
>> +    [VST_NVC]  = { "NVCT", sizeof(Xive2Nvgc), 16 },
>> +
>> +    [VST_IC]  =  { "IC",   1 /* ? */         , 16 }, /* Topology # */
>> +    [VST_SYNC] = { "SYNC", 1 /* ? */         , 16 }, /* Topology # */
>> +
>> +    /*
>> +     * This table contains the backing store pages for the interrupt
>> +     * fifos of the VC sub-engine in case of overflow.
>> +     *
>> +     * 0 - IPI,
>> +     * 1 - HWD,
>> +     * 2 - NxC,
>> +     * 3 - INT,
>> +     * 4 - OS-Queue,
>> +     * 5 - Pool-Queue,
>> +     * 6 - Hard-Queue
>> +     */
>> +    [VST_ERQ]  = { "ERQ",  1,                   VC_QUEUE_COUNT },
>> +};
>> +
>> +#define xive2_error(xive, fmt, ...)                                      \
>> +    qemu_log_mask(LOG_GUEST_ERROR, "XIVE[%x] - " fmt "\n",              \
>> +                  (xive)->chip->chip_id, ## __VA_ARGS__);
>> +
>> +/*
>> + * QEMU version of the GETFIELD/SETFIELD macros
>> + *
>> + * TODO: It might be better to use the existing extract64() and
>> + * deposit64() but this means that all the register definitions will
>> + * change and become incompatible with the ones found in skiboot.
>> + *
>> + * Keep it as it is for now until we find a common ground.
>> + */
>> +static inline uint64_t GETFIELD(uint64_t mask, uint64_t word)
>> +{
>> +    return (word & mask) >> ctz64(mask);
>> +}
>> +
>> +static inline uint64_t SETFIELD(uint64_t mask, uint64_t word,
>> +                                uint64_t value)
>> +{
>> +    return (word & ~mask) | ((value << ctz64(mask)) & mask);
>> +}
>> +
>> +/*
>> + * TODO: Document block id override
>> + */
>> +static uint32_t pnv_xive2_block_id(PnvXive2 *xive)
>> +{
>> +    uint8_t blk = xive->chip->chip_id;
>> +    uint64_t cfg_val = xive->cq_regs[CQ_XIVE_CFG >> 3];
>> +
>> +    if (cfg_val & CQ_XIVE_CFG_HYP_HARD_BLKID_OVERRIDE) {
>> +        blk = GETFIELD(CQ_XIVE_CFG_HYP_HARD_BLOCK_ID, cfg_val);
>> +    }
>> +
>> +    return blk;
>> +}
>> +
>> +/*
>> + * Remote access to controllers. HW uses MMIOs. For now, a simple scan
>> + * of the chips is good enough.
>> + *
>> + * TODO: Block scope support
>> + */
>> +static PnvXive2 *pnv_xive2_get_remote(uint8_t blk)
>> +{
>> +    PnvMachineState *pnv = PNV_MACHINE(qdev_get_machine());
>> +    int i;
>> +
>> +    for (i = 0; i < pnv->num_chips; i++) {
>> +        Pnv10Chip *chip10 = PNV10_CHIP(pnv->chips[i]);
>> +        PnvXive2 *xive = &chip10->xive;
>> +
>> +        if (pnv_xive2_block_id(xive) == blk) {
>> +            return xive;
>> +        }
>> +    }
>> +    return NULL;
>> +}
>> +
>> +/*
>> + * VST accessors for ESB, EAT, ENDT, NVP
>> + *
>> + * Indirect VST tables are arrays of VSDs pointing to a page (of same
>> + * size). Each page is a direct VST table.
>> + */
>> +
>> +#define XIVE_VSD_SIZE 8
>> +
>> +/* Indirect page size can be 4K, 64K, 2M, 16M. */
>> +static uint64_t pnv_xive2_vst_page_size_allowed(uint32_t page_shift)
>> +{
>> +     return page_shift == 12 || page_shift == 16 ||
>> +         page_shift == 21 || page_shift == 24;
>> +}
>> +
>> +static uint64_t pnv_xive2_vst_addr_direct(PnvXive2 *xive, uint32_t type,
>> +                                         uint64_t vsd, uint32_t idx)
>> +{
>> +    const XiveVstInfo *info = &vst_infos[type];
>> +    uint64_t vst_addr = vsd & VSD_ADDRESS_MASK;
>> +    uint64_t vst_tsize = 1ull << (GETFIELD(VSD_TSIZE, vsd) + 12);
>> +    uint32_t idx_max;
>> +
>> +    idx_max = vst_tsize / info->size - 1;
>> +    if (idx > idx_max) {
>> +#ifdef XIVE2_DEBUG
>> +        xive2_error(xive, "VST: %s entry %x out of range [ 0 .. %x ] !?",
>> +                   info->name, idx, idx_max);
>> +#endif
>> +        return 0;
>> +    }
>> +
>> +    return vst_addr + idx * info->size;
>> +}
>> +
>> +static uint64_t pnv_xive2_vst_addr_indirect(PnvXive2 *xive, uint32_t type,
>> +                                           uint64_t vsd, uint32_t idx)
>> +{
>> +    const XiveVstInfo *info = &vst_infos[type];
>> +    uint64_t vsd_addr;
>> +    uint32_t vsd_idx;
>> +    uint32_t page_shift;
>> +    uint32_t vst_per_page;
>> +
>> +    /* Get the page size of the indirect table. */
>> +    vsd_addr = vsd & VSD_ADDRESS_MASK;
>> +    vsd = ldq_be_dma(&address_space_memory, vsd_addr);
>> +
>> +    if (!(vsd & VSD_ADDRESS_MASK)) {
>> +        xive2_error(xive, "VST: invalid %s entry %x !?", info->name, idx);
>> +        return 0;
>> +    }
>> +
>> +    page_shift = GETFIELD(VSD_TSIZE, vsd) + 12;
>> +
>> +    if (!pnv_xive2_vst_page_size_allowed(page_shift)) {
>> +        xive2_error(xive, "VST: invalid %s page shift %d", info->name,
>> +                   page_shift);
>> +        return 0;
>> +    }
>> +
>> +    vst_per_page = (1ull << page_shift) / info->size;
>> +    vsd_idx = idx / vst_per_page;
>> +
>> +    /* Load the VSD we are looking for, if not already done */
>> +    if (vsd_idx) {
>> +        vsd_addr = vsd_addr + vsd_idx * XIVE_VSD_SIZE;
>> +        vsd = ldq_be_dma(&address_space_memory, vsd_addr);
>> +
>> +        if (!(vsd & VSD_ADDRESS_MASK)) {
>> +            xive2_error(xive, "VST: invalid %s entry %x !?", info->name, idx);
>> +            return 0;
>> +        }
>> +
>> +        /*
>> +         * Check that the pages have a consistent size across the
>> +         * indirect table
>> +         */
>> +        if (page_shift != GETFIELD(VSD_TSIZE, vsd) + 12) {
>> +            xive2_error(xive, "VST: %s entry %x indirect page size differ !?",
>> +                       info->name, idx);
>> +            return 0;
>> +        }
>> +    }
>> +
>> +    return pnv_xive2_vst_addr_direct(xive, type, vsd, (idx % vst_per_page));
>> +}
>> +
>> +static uint64_t pnv_xive2_vst_addr(PnvXive2 *xive, uint32_t type, uint8_t blk,
>> +                                  uint32_t idx)
>> +{
>> +    const XiveVstInfo *info = &vst_infos[type];
>> +    uint64_t vsd;
>> +
>> +    if (blk >= info->max_blocks) {
>> +        xive2_error(xive, "VST: invalid block id %d for VST %s %d !?",
>> +                   blk, info->name, idx);
>> +        return 0;
>> +    }
>> +
>> +    vsd = xive->vsds[type][blk];
>> +
>> +    /* Remote VST access */
>> +    if (GETFIELD(VSD_MODE, vsd) == VSD_MODE_FORWARD) {
>> +        xive = pnv_xive2_get_remote(blk);
>> +
>> +        return xive ? pnv_xive2_vst_addr(xive, type, blk, idx) : 0;
>> +    }
>> +
>> +    if (VSD_INDIRECT & vsd) {
>> +        return pnv_xive2_vst_addr_indirect(xive, type, vsd, idx);
>> +    }
>> +
>> +    return pnv_xive2_vst_addr_direct(xive, type, vsd, idx);
>> +}
>> +
>> +static int pnv_xive2_vst_read(PnvXive2 *xive, uint32_t type, uint8_t blk,
>> +                             uint32_t idx, void *data)
>> +{
>> +    const XiveVstInfo *info = &vst_infos[type];
>> +    uint64_t addr = pnv_xive2_vst_addr(xive, type, blk, idx);
>> +
>> +    if (!addr) {
>> +        return -1;
>> +    }
>> +
>> +    cpu_physical_memory_read(addr, data, info->size);
>> +    return 0;
>> +}
>> +
>> +#define XIVE_VST_WORD_ALL -1
>> +
>> +static int pnv_xive2_vst_write(PnvXive2 *xive, uint32_t type, uint8_t blk,
>> +                              uint32_t idx, void *data, uint32_t word_number)
>> +{
>> +    const XiveVstInfo *info = &vst_infos[type];
>> +    uint64_t addr = pnv_xive2_vst_addr(xive, type, blk, idx);
>> +
>> +    if (!addr) {
>> +        return -1;
>> +    }
>> +
>> +    if (word_number == XIVE_VST_WORD_ALL) {
>> +        cpu_physical_memory_write(addr, data, info->size);
>> +    } else {
>> +        cpu_physical_memory_write(addr + word_number * 4,
>> +                                  data + word_number * 4, 4);
>> +    }
>> +    return 0;
>> +}
>> +
>> +static int pnv_xive2_get_end(Xive2Router *xrtr, uint8_t blk, uint32_t idx,
>> +                            Xive2End *end)
>> +{
>> +    return pnv_xive2_vst_read(PNV_XIVE2(xrtr), VST_END, blk, idx, end);
>> +}
>> +
>> +static int pnv_xive2_write_end(Xive2Router *xrtr, uint8_t blk, uint32_t idx,
>> +                              Xive2End *end, uint8_t word_number)
>> +{
>> +    return pnv_xive2_vst_write(PNV_XIVE2(xrtr), VST_END, blk, idx, end,
>> +                              word_number);
>> +}
>> +
>> +static int pnv_xive2_end_update(PnvXive2 *xive)
>> +{
>> +    uint8_t  blk = GETFIELD(VC_ENDC_WATCH_BLOCK_ID,
>> +                           xive->vc_regs[(VC_ENDC_WATCH0_SPEC >> 3)]);
>> +    uint32_t idx = GETFIELD(VC_ENDC_WATCH_INDEX,
>> +                           xive->vc_regs[(VC_ENDC_WATCH0_SPEC >> 3)]);
>> +    int i;
>> +    uint64_t endc_watch[4];
>> +
>> +    for (i = 0; i < ARRAY_SIZE(endc_watch); i++) {
>> +        endc_watch[i] =
>> +            cpu_to_be64(xive->vc_regs[(VC_ENDC_WATCH0_DATA0 >> 3) + i]);
>> +    }
>> +
>> +    return pnv_xive2_vst_write(xive, VST_END, blk, idx, endc_watch,
>> +                              XIVE_VST_WORD_ALL);
>> +}
>> +
>> +static void pnv_xive2_end_cache_load(PnvXive2 *xive)
>> +{
>> +    uint8_t  blk = GETFIELD(VC_ENDC_WATCH_BLOCK_ID,
>> +                           xive->vc_regs[(VC_ENDC_WATCH0_SPEC >> 3)]);
>> +    uint32_t idx = GETFIELD(VC_ENDC_WATCH_INDEX,
>> +                           xive->vc_regs[(VC_ENDC_WATCH0_SPEC >> 3)]);
>> +    uint64_t endc_watch[4] = { 0 };
>> +    int i;
>> +
>> +    if (pnv_xive2_vst_read(xive, VST_END, blk, idx, endc_watch)) {
>> +        xive2_error(xive, "VST: no END entry %x/%x !?", blk, idx);
>> +    }
>> +
>> +    for (i = 0; i < ARRAY_SIZE(endc_watch); i++) {
>> +        xive->vc_regs[(VC_ENDC_WATCH0_DATA0 >> 3) + i] =
>> +            be64_to_cpu(endc_watch[i]);
>> +    }
>> +}
>> +
>> +static int pnv_xive2_get_nvp(Xive2Router *xrtr, uint8_t blk, uint32_t idx,
>> +                            Xive2Nvp *nvp)
>> +{
>> +    return pnv_xive2_vst_read(PNV_XIVE2(xrtr), VST_NVP, blk, idx, nvp);
>> +}
>> +
>> +static int pnv_xive2_write_nvp(Xive2Router *xrtr, uint8_t blk, uint32_t idx,
>> +                              Xive2Nvp *nvp, uint8_t word_number)
>> +{
>> +    return pnv_xive2_vst_write(PNV_XIVE2(xrtr), VST_NVP, blk, idx, nvp,
>> +                              word_number);
>> +}
>> +
>> +static int pnv_xive2_nvp_update(PnvXive2 *xive)
>> +{
>> +    uint8_t  blk = GETFIELD(PC_NXC_WATCH_BLOCK_ID,
>> +                            xive->pc_regs[(PC_NXC_WATCH0_SPEC >> 3)]);
>> +    uint32_t idx = GETFIELD(PC_NXC_WATCH_INDEX,
>> +                            xive->pc_regs[(PC_NXC_WATCH0_SPEC >> 3)]);
>> +    int i;
>> +    uint64_t nxc_watch[4];
>> +
>> +    for (i = 0; i < ARRAY_SIZE(nxc_watch); i++) {
>> +        nxc_watch[i] =
>> +            cpu_to_be64(xive->pc_regs[(PC_NXC_WATCH0_DATA0 >> 3) + i]);
>> +    }
>> +
>> +    return pnv_xive2_vst_write(xive, VST_NVP, blk, idx, nxc_watch,
>> +                              XIVE_VST_WORD_ALL);
>> +}
>> +
>> +static void pnv_xive2_nvp_cache_load(PnvXive2 *xive)
>> +{
>> +    uint8_t  blk = GETFIELD(PC_NXC_WATCH_BLOCK_ID,
>> +                           xive->pc_regs[(PC_NXC_WATCH0_SPEC >> 3)]);
>> +    uint32_t idx = GETFIELD(PC_NXC_WATCH_INDEX,
>> +                           xive->pc_regs[(PC_NXC_WATCH0_SPEC >> 3)]);
>> +    uint64_t nxc_watch[4] = { 0 };
>> +    int i;
>> +
>> +    if (pnv_xive2_vst_read(xive, VST_NVP, blk, idx, nxc_watch)) {
>> +        xive2_error(xive, "VST: no NVP entry %x/%x !?", blk, idx);
>> +    }
>> +
>> +    for (i = 0; i < ARRAY_SIZE(nxc_watch); i++) {
>> +        xive->pc_regs[(PC_NXC_WATCH0_DATA0 >> 3) + i] =
>> +            be64_to_cpu(nxc_watch[i]);
>> +    }
>> +}
>> +
>> +static int pnv_xive2_get_eas(Xive2Router *xrtr, uint8_t blk, uint32_t idx,
>> +                            Xive2Eas *eas)
>> +{
>> +    PnvXive2 *xive = PNV_XIVE2(xrtr);
>> +
>> +    if (pnv_xive2_block_id(xive) != blk) {
>> +        xive2_error(xive, "VST: EAS %x is remote !?", XIVE_EAS(blk, idx));
>> +        return -1;
>> +    }
>> +
>> +    return pnv_xive2_vst_read(xive, VST_EAS, blk, idx, eas);
>> +}
>> +
>> +static bool pnv_xive2_is_cpu_enabled(PnvXive2 *xive, PowerPCCPU *cpu)
>> +{
>> +    int pir = ppc_cpu_pir(cpu);
>> +    uint32_t fc = PNV10_PIR2FUSEDCORE(pir);
>> +    uint64_t reg = fc < 8 ? TCTXT_EN0 : TCTXT_EN1;
>> +    uint32_t bit = pir & 0x3f;
>> +
>> +    return xive->tctxt_regs[reg >> 3] & PPC_BIT(bit);
>> +}
>> +
>> +static int pnv_xive2_match_nvt(XivePresenter *xptr, uint8_t format,
>> +                                uint8_t nvt_blk, uint32_t nvt_idx,
>> +                                bool cam_ignore, uint8_t priority,
>> +                                uint32_t logic_serv, XiveTCTXMatch *match)
>> +{
>> +    PnvXive2 *xive = PNV_XIVE2(xptr);
>> +    PnvChip *chip = xive->chip;
>> +    int count = 0;
>> +    int i, j;
>> +
>> +    for (i = 0; i < chip->nr_cores; i++) {
>> +        PnvCore *pc = chip->cores[i];
>> +        CPUCore *cc = CPU_CORE(pc);
>> +
>> +        for (j = 0; j < cc->nr_threads; j++) {
>> +            PowerPCCPU *cpu = pc->threads[j];
>> +            XiveTCTX *tctx;
>> +            int ring;
>> +
>> +            if (!pnv_xive2_is_cpu_enabled(xive, cpu)) {
>> +                continue;
>> +            }
>> +
>> +            tctx = XIVE_TCTX(pnv_cpu_state(cpu)->intc);
>> +
>> +            ring = xive2_presenter_tctx_match(xptr, tctx, format, nvt_blk,
>> +                                              nvt_idx, cam_ignore,
>> +                                              logic_serv);
>> +
>> +            /*
>> +             * Save the context and follow on to catch duplicates,
>> +             * that we don't support yet.
>> +             */
>> +            if (ring != -1) {
>> +                if (match->tctx) {
>> +                    qemu_log_mask(LOG_GUEST_ERROR, "XIVE: already found a "
>> +                                  "thread context NVT %x/%x\n",
>> +                                  nvt_blk, nvt_idx);
>> +                    return false;
>> +                }
>> +
>> +                match->ring = ring;
>> +                match->tctx = tctx;
>> +                count++;
>> +            }
>> +        }
>> +    }
>> +
>> +    return count;
>> +}
>> +
>> +static uint8_t pnv_xive2_get_block_id(Xive2Router *xrtr)
>> +{
>> +    return pnv_xive2_block_id(PNV_XIVE2(xrtr));
>> +}
>> +
>> +/*
>> + * The TIMA MMIO space is shared among the chips and to identify the
>> + * chip from which the access is being done, we extract the chip id
>> + * from the PIR.
>> + */
>> +static PnvXive2 *pnv_xive2_tm_get_xive(PowerPCCPU *cpu)
>> +{
>> +    int pir = ppc_cpu_pir(cpu);
>> +    XivePresenter *xptr = XIVE_TCTX(pnv_cpu_state(cpu)->intc)->xptr;
>> +    PnvXive2 *xive = PNV_XIVE2(xptr);
>> +
>> +    if (!pnv_xive2_is_cpu_enabled(xive, cpu)) {
>> +        xive2_error(xive, "IC: CPU %x is not enabled", pir);
>> +    }
>> +    return xive;
>> +}
>> +
>> +/*
>> + * The internal sources of the interrupt controller have no knowledge
>> + * of the XIVE2 chip on which they reside. Encode the block id in the
>> + * source interrupt number before forwarding the source event
>> + * notification to the Router. This is required on a multichip system.
>> + */
>> +static void pnv_xive2_notify(XiveNotifier *xn, uint32_t srcno)
>> +{
>> +    PnvXive2 *xive = PNV_XIVE2(xn);
>> +    uint8_t blk = pnv_xive2_block_id(xive);
>> +
>> +    xive2_router_notify(xn, XIVE_EAS(blk, srcno));
>> +}
>> +
>> +/*
>> + * Set Translation Tables
>> + *
>> + * TODO add support for multiple sets
>> + */
>> +static int pnv_xive2_stt_set_data(PnvXive2 *xive, uint64_t val)
>> +{
>> +    uint8_t tsel = GETFIELD(CQ_TAR_SELECT, xive->cq_regs[CQ_TAR >> 3]);
>> +    uint8_t entry = GETFIELD(CQ_TAR_ENTRY_SELECT,
>> +                                  xive->cq_regs[CQ_TAR >> 3]);
>> +
>> +    switch (tsel) {
>> +    case CQ_TAR_NVPG:
>> +    case CQ_TAR_ESB:
>> +    case CQ_TAR_END:
>> +        xive->tables[tsel][entry] = val;
>> +        break;
>> +    default:
>> +        xive2_error(xive, "IC: unsupported table %d", tsel);
>> +        return -1;
>> +    }
>> +
>> +    if (xive->cq_regs[CQ_TAR >> 3] & CQ_TAR_AUTOINC) {
>> +        xive->cq_regs[CQ_TAR >> 3] = SETFIELD(CQ_TAR_ENTRY_SELECT,
>> +                     xive->cq_regs[CQ_TAR >> 3], ++entry);
>> +    }
>> +
>> +    return 0;
>> +}
>> +/*
>> + * Virtual Structure Tables (VST) configuration
>> + */
>> +static void pnv_xive2_vst_set_exclusive(PnvXive2 *xive2, uint8_t type,
>> +                                       uint8_t blk, uint64_t vsd)
>> +{
>> +    Xive2EndSource *end_xsrc = &xive2->end_source;
>> +    XiveSource *xsrc = &xive2->ipi_source;
>> +    const XiveVstInfo *info = &vst_infos[type];
>> +    uint32_t page_shift = GETFIELD(VSD_TSIZE, vsd) + 12;
>> +    uint64_t vst_tsize = 1ull << page_shift;
>> +    uint64_t vst_addr = vsd & VSD_ADDRESS_MASK;
>> +
>> +    /* Basic checks */
>> +
>> +    if (VSD_INDIRECT & vsd) {
>> +        if (!pnv_xive2_vst_page_size_allowed(page_shift)) {
>> +            xive2_error(xive2, "VST: invalid %s page shift %d", info->name,
>> +                       page_shift);
>> +            return;
>> +        }
>> +    }
>> +
>> +    if (!QEMU_IS_ALIGNED(vst_addr, 1ull << page_shift)) {
>> +        xive2_error(xive2, "VST: %s table address 0x%"PRIx64
>> +                    " is not aligned with page shift %d",
>> +                    info->name, vst_addr, page_shift);
>> +        return;
>> +    }
>> +
>> +    /* Record the table configuration (in SRAM on HW) */
>> +    xive2->vsds[type][blk] = vsd;
>> +
>> +    /* Now tune the models with the configuration provided by the FW */
>> +
>> +    switch (type) {
>> +    case VST_ESB:
>> +        /*
>> +         * Backing store pages for the source PQ bits. The model does
>> +         * not use these PQ bits backed in RAM because the XiveSource
>> +         * model has its own.
>> +         *
>> +         * If the table is direct, we can compute the number of PQ
>> +         * entries provisioned by FW (such as skiboot) and resize the
>> +         * ESB window accordingly.
>> +         */
>> +        if (!(VSD_INDIRECT & vsd)) {
>> +            memory_region_set_size(&xsrc->esb_mmio, vst_tsize * SBE_PER_BYTE
>> +                                   * (1ull << xsrc->esb_shift));
>> +        }
>> +
>> +        memory_region_add_subregion(&xive2->esb_mmio, 0, &xsrc->esb_mmio);
>> +        break;
>> +
>> +    case VST_EAS:  /* Nothing to be done */
>> +        break;
>> +
>> +    case VST_END:
>> +        /*
>> +         * Backing store pages for the END.
>> +         */
>> +        if (!(VSD_INDIRECT & vsd)) {
>> +            memory_region_set_size(&end_xsrc->esb_mmio, (vst_tsize / info->size)
>> +                                   * (1ull << xsrc->esb_shift));
>> +        }
>> +        memory_region_add_subregion(&xive2->end_mmio, 0, &end_xsrc->esb_mmio);
>> +        break;
>> +
>> +    case VST_NVP:  /* Not modeled */
>> +    case VST_NVG:  /* Not modeled */
>> +    case VST_NVC:  /* Not modeled */
>> +    case VST_IC:   /* Not modeled */
>> +    case VST_SYNC: /* Not modeled */
>> +    case VST_ERQ:  /* Not modeled */
>> +        break;
>> +
>> +    default:
>> +        g_assert_not_reached();
>> +    }
>> +}
>> +
>> +/*
>> + * Both PC and VC sub-engines are configured as each use the Virtual
>> + * Structure Tables
>> + */
>> +static void pnv_xive2_vst_set_data(PnvXive2 *xive2, uint64_t vsd)
>> +{
>> +    uint8_t mode = GETFIELD(VSD_MODE, vsd);
>> +    uint8_t type = GETFIELD(VC_VSD_TABLE_SELECT,
>> +                            xive2->vc_regs[VC_VSD_TABLE_ADDR >> 3]);
>> +    uint8_t blk = GETFIELD(VC_VSD_TABLE_ADDRESS,
>> +                           xive2->vc_regs[VC_VSD_TABLE_ADDR >> 3]);
>> +    uint64_t vst_addr = vsd & VSD_ADDRESS_MASK;
>> +
>> +    if (type > VST_ERQ) {
>> +        xive2_error(xive2, "VST: invalid table type %d", type);
>> +        return;
>> +    }
>> +
>> +    if (blk >= vst_infos[type].max_blocks) {
>> +        xive2_error(xive2, "VST: invalid block id %d for"
>> +                      " %s table", blk, vst_infos[type].name);
>> +        return;
>> +    }
>> +
>> +    if (!vst_addr) {
>> +        xive2_error(xive2, "VST: invalid %s table address",
>> +                   vst_infos[type].name);
>> +        return;
>> +    }
>> +
>> +    switch (mode) {
>> +    case VSD_MODE_FORWARD:
>> +        xive2->vsds[type][blk] = vsd;
>> +        break;
>> +
>> +    case VSD_MODE_EXCLUSIVE:
>> +        pnv_xive2_vst_set_exclusive(xive2, type, blk, vsd);
>> +        break;
>> +
>> +    default:
>> +        xive2_error(xive2, "VST: unsupported table mode %d", mode);
>> +        return;
>> +    }
>> +}
>> +
>> +/*
>> + * MMIO handlers
>> + */
>> +
>> +
>> +/*
>> + * IC BAR layout
>> + *
>> + * Page 0: Internal CQ register accesses (reads & writes)
>> + * Page 1: Internal PC register accesses (reads & writes)
>> + * Page 2: Internal VC register accesses (reads & writes)
>> + * Page 3: Internal TCTXT (TIMA) reg accesses (read & writes)
>> + * Page 4: Notify Port page (writes only, w/data),
>> + * Page 5: Reserved
>> + * Page 6: Sync Poll page (writes only, dataless)
>> + * Page 7: Sync Inject page (writes only, dataless)
>> + * Page 8: LSI Trigger page (writes only, dataless)
>> + * Page 9: LSI SB Management page (reads & writes dataless)
>> + * Pages 10-255: Reserved
>> + * Pages 256-383: Direct mapped Thread Context Area (reads & writes)
>> + *                covering the 128 threads in P10.
>> + * Pages 384-511: Reserved
>> + */
>> +typedef struct PnvXive2Region {
>> +    const char *name;
>> +    uint32_t pgoff;
>> +    uint32_t pgsize;
>> +    const MemoryRegionOps *ops;
>> +} PnvXive2Region;
>> +
>> +static const MemoryRegionOps pnv_xive2_ic_cq_ops;
>> +static const MemoryRegionOps pnv_xive2_ic_pc_ops;
>> +static const MemoryRegionOps pnv_xive2_ic_vc_ops;
>> +static const MemoryRegionOps pnv_xive2_ic_tctxt_ops;
>> +static const MemoryRegionOps pnv_xive2_ic_notify_ops;
>> +static const MemoryRegionOps pnv_xive2_ic_sync_ops;
>> +static const MemoryRegionOps pnv_xive2_ic_lsi_ops;
>> +static const MemoryRegionOps pnv_xive2_ic_tm_indirect_ops;
>> +
>> +/* 512 pages. 4K: 2M range, 64K: 32M range */
>> +static const PnvXive2Region pnv_xive2_ic_regions[] = {
>> +    { "xive-ic-cq",        0,   1,   &pnv_xive2_ic_cq_ops     },
>> +    { "xive-ic-vc",        1,   1,   &pnv_xive2_ic_vc_ops     },
>> +    { "xive-ic-pc",        2,   1,   &pnv_xive2_ic_pc_ops     },
>> +    { "xive-ic-tctxt",     3,   1,   &pnv_xive2_ic_tctxt_ops  },
>> +    { "xive-ic-notify",    4,   1,   &pnv_xive2_ic_notify_ops },
>> +    /* page 5 reserved */
>> +    { "xive-ic-sync",      6,   2,   &pnv_xive2_ic_sync_ops   },
>> +    { "xive-ic-lsi",       8,   2,   &pnv_xive2_ic_lsi_ops    },
>> +    /* pages 10-255 reserved */
>> +    { "xive-ic-tm-indirect", 256, 128, &pnv_xive2_ic_tm_indirect_ops  },
>> +    /* pages 384-511 reserved */
>> +};
>> +
>> +/*
>> + * CQ operations
>> + */
>> +
>> +static uint64_t pnv_xive2_ic_cq_read(void *opaque, hwaddr offset,
>> +                                        unsigned size)
>> +{
>> +    PnvXive2 *xive = PNV_XIVE2(opaque);
>> +    uint32_t reg = offset >> 3;
>> +    uint64_t val = 0;
>> +
>> +    switch (offset) {
>> +    case CQ_XIVE_CAP: /* Set at reset */
>> +    case CQ_XIVE_CFG:
>> +        val = xive->cq_regs[reg];
>> +        break;
>> +    case CQ_MSGSND: /* TODO check the #cores of the machine */
>> +        val = 0xffffffff00000000;
>> +        break;
>> +    case CQ_CFG_PB_GEN:
>> +        val = CQ_CFG_PB_GEN_PB_INIT; /* TODO: fix CQ_CFG_PB_GEN default value */
>> +        break;
>> +    default:
>> +        xive2_error(xive, "CQ: invalid read @%"HWADDR_PRIx, offset);
>> +    }
>> +
>> +    return val;
>> +}
>> +
>> +static uint64_t pnv_xive2_bar_size(uint64_t val)
>> +{
>> +    return 1ull << (GETFIELD(CQ_BAR_RANGE, val) + 24);
>> +}
>> +
>> +static void pnv_xive2_ic_cq_write(void *opaque, hwaddr offset,
>> +                                     uint64_t val, unsigned size)
>> +{
>> +    PnvXive2 *xive2 = PNV_XIVE2(opaque);
>> +    MemoryRegion *sysmem = get_system_memory();
>> +    uint32_t reg = offset >> 3;
>> +    int i;
>> +
>> +    switch (offset) {
>> +    case CQ_XIVE_CFG:
>> +    case CQ_RST_CTL: /* TODO: reset all BARs */
>> +        break;
>> +
>> +    case CQ_IC_BAR:
>> +        xive2->ic_shift = val & CQ_IC_BAR_64K ? 16 : 12;
>> +        if (!(val & CQ_IC_BAR_VALID)) {
>> +            xive2->ic_base = 0;
>> +            if (xive2->cq_regs[reg] & CQ_IC_BAR_VALID) {
>> +                for (i = 0; i < ARRAY_SIZE(xive2->ic_mmios); i++) {
>> +                    memory_region_del_subregion(&xive2->ic_mmio,
>> +                                                &xive2->ic_mmios[i]);
>> +                }
>> +                memory_region_del_subregion(sysmem, &xive2->ic_mmio);
>> +            }
>> +        } else {
>> +            xive2->ic_base = val & ~(CQ_IC_BAR_VALID | CQ_IC_BAR_64K);
>> +            if (!(xive2->cq_regs[reg] & CQ_IC_BAR_VALID)) {
>> +                for (i = 0; i < ARRAY_SIZE(xive2->ic_mmios); i++) {
>> +                    memory_region_add_subregion(&xive2->ic_mmio,
>> +                               pnv_xive2_ic_regions[i].pgoff << xive2->ic_shift,
>> +                               &xive2->ic_mmios[i]);
>> +                }
>> +                memory_region_add_subregion(sysmem, xive2->ic_base,
>> +                                            &xive2->ic_mmio);
>> +            }
>> +        }
>> +        break;
>> +
>> +    case CQ_TM_BAR:
>> +        xive2->tm_shift = val & CQ_TM_BAR_64K ? 16 : 12;
>> +        if (!(val & CQ_TM_BAR_VALID)) {
>> +            xive2->tm_base = 0;
>> +            if (xive2->cq_regs[reg] & CQ_TM_BAR_VALID) {
>> +                memory_region_del_subregion(sysmem, &xive2->tm_mmio);
>> +            }
>> +        } else {
>> +            xive2->tm_base = val & ~(CQ_TM_BAR_VALID | CQ_TM_BAR_64K);
>> +            if (!(xive2->cq_regs[reg] & CQ_TM_BAR_VALID)) {
>> +                memory_region_add_subregion(sysmem, xive2->tm_base,
>> +                                            &xive2->tm_mmio);
>> +            }
>> +        }
>> +        break;
>> +
>> +    case CQ_ESB_BAR:
>> +        xive2->esb_shift = val & CQ_BAR_64K ? 16 : 12;
>> +        if (!(val & CQ_BAR_VALID)) {
>> +            xive2->esb_base = 0;
>> +            if (xive2->cq_regs[reg] & CQ_BAR_VALID) {
>> +                memory_region_del_subregion(sysmem, &xive2->esb_mmio);
>> +            }
>> +        } else {
>> +            xive2->esb_base = val & CQ_BAR_ADDR;
>> +            if (!(xive2->cq_regs[reg] & CQ_BAR_VALID)) {
>> +                memory_region_set_size(&xive2->esb_mmio,
>> +                                       pnv_xive2_bar_size(val));
>> +                memory_region_add_subregion(sysmem, xive2->esb_base,
>> +                                            &xive2->esb_mmio);
>> +            }
>> +        }
>> +        break;
>> +
>> +    case CQ_END_BAR:
>> +        xive2->end_shift = val & CQ_BAR_64K ? 16 : 12;
>> +        if (!(val & CQ_BAR_VALID)) {
>> +            xive2->end_base = 0;
>> +            if (xive2->cq_regs[reg] & CQ_BAR_VALID) {
>> +                memory_region_del_subregion(sysmem, &xive2->end_mmio);
>> +            }
>> +        } else {
>> +            xive2->end_base = val & CQ_BAR_ADDR;
>> +            if (!(xive2->cq_regs[reg] & CQ_BAR_VALID)) {
>> +                memory_region_set_size(&xive2->end_mmio,
>> +                                       pnv_xive2_bar_size(val));
>> +                memory_region_add_subregion(sysmem, xive2->end_base,
>> +                                            &xive2->end_mmio);
>> +            }
>> +        }
>> +        break;
>> +
>> +    case CQ_NVC_BAR:
>> +        xive2->nvc_shift = val & CQ_BAR_64K ? 16 : 12;
>> +        if (!(val & CQ_BAR_VALID)) {
>> +            xive2->nvc_base = 0;
>> +            if (xive2->cq_regs[reg] & CQ_BAR_VALID) {
>> +                memory_region_del_subregion(sysmem, &xive2->nvc_mmio);
>> +            }
>> +        } else {
>> +            xive2->nvc_base = val & CQ_BAR_ADDR;
>> +            if (!(xive2->cq_regs[reg] & CQ_BAR_VALID)) {
>> +                memory_region_set_size(&xive2->nvc_mmio,
>> +                                       pnv_xive2_bar_size(val));
>> +                memory_region_add_subregion(sysmem, xive2->nvc_base,
>> +                                            &xive2->nvc_mmio);
>> +            }
>> +        }
>> +        break;
>> +
>> +    case CQ_NVPG_BAR:
>> +        xive2->nvpg_shift = val & CQ_BAR_64K ? 16 : 12;
>> +        if (!(val & CQ_BAR_VALID)) {
>> +            xive2->nvpg_base = 0;
>> +            if (xive2->cq_regs[reg] & CQ_BAR_VALID) {
>> +                memory_region_del_subregion(sysmem, &xive2->nvpg_mmio);
>> +            }
>> +        } else {
>> +            xive2->nvpg_base = val & CQ_BAR_ADDR;
>> +            if (!(xive2->cq_regs[reg] & CQ_BAR_VALID)) {
>> +                memory_region_set_size(&xive2->nvpg_mmio,
>> +                                       pnv_xive2_bar_size(val));
>> +                memory_region_add_subregion(sysmem, xive2->nvpg_base,
>> +                                            &xive2->nvpg_mmio);
>> +            }
>> +        }
>> +        break;
>> +
>> +    case CQ_TAR: /* Set Translation Table Address */
>> +        break;
>> +    case CQ_TDR: /* Set Translation Table Data */
>> +        pnv_xive2_stt_set_data(xive2, val);
>> +        break;
>> +    case CQ_FIRMASK_OR: /* FIR error reporting */
>> +        break;
>> +    default:
>> +        xive2_error(xive2, "CQ: invalid write 0x%"HWADDR_PRIx, offset);
>> +        return;
>> +    }
>> +
>> +    xive2->cq_regs[reg] = val;
>> +}
>> +
>> +static const MemoryRegionOps pnv_xive2_ic_cq_ops = {
>> +    .read = pnv_xive2_ic_cq_read,
>> +    .write = pnv_xive2_ic_cq_write,
>> +    .endianness = DEVICE_BIG_ENDIAN,
>> +    .valid = {
>> +        .min_access_size = 8,
>> +        .max_access_size = 8,
>> +    },
>> +    .impl = {
>> +        .min_access_size = 8,
>> +        .max_access_size = 8,
>> +    },
>> +};
>> +
>> +static uint64_t pnv_xive2_ic_vc_read(void *opaque, hwaddr offset,
>> +                                 unsigned size)
>> +{
>> +    PnvXive2 *xive = PNV_XIVE2(opaque);
>> +    uint64_t val = 0;
>> +    uint32_t reg = offset >> 3;
>> +
>> +    switch (offset) {
>> +    /*
>> +     * VSD table settings.
>> +     */
>> +    case VC_VSD_TABLE_ADDR:
>> +    case VC_VSD_TABLE_DATA:
>> +        val = xive->vc_regs[reg];
>> +        break;
>> +
>> +    /*
>> +     * ESB cache updates (not modeled)
>> +     */
>> +    case VC_ESBC_FLUSH_CTRL:
>> +        xive->vc_regs[reg] &= ~VC_ESBC_FLUSH_CTRL_POLL_VALID;
>> +        val = xive->vc_regs[reg];
>> +        break;
>> +
>> +    /*
>> +     * EAS cache updates (not modeled)
>> +     */
>> +    case VC_EASC_FLUSH_CTRL:
>> +        xive->vc_regs[reg] &= ~VC_EASC_FLUSH_CTRL_POLL_VALID;
>> +        val = xive->vc_regs[reg];
>> +        break;
>> +
>> +    /*
>> +     * END cache updates
>> +     */
>> +    case VC_ENDC_WATCH0_SPEC:
>> +        xive->vc_regs[reg] &= ~(VC_ENDC_WATCH_FULL | VC_ENDC_WATCH_CONFLICT);
>> +        val = xive->vc_regs[reg];
>> +        break;
>> +
>> +    case VC_ENDC_WATCH0_DATA0:
>> +        /*
>> +         * Load DATA registers from cache with data requested by the
>> +         * SPEC register
>> +         */
>> +        pnv_xive2_end_cache_load(xive);
>> +        val = xive->vc_regs[reg];
>> +        break;
>> +
>> +    case VC_ENDC_WATCH0_DATA1 ... VC_ENDC_WATCH0_DATA3:
>> +        val = xive->vc_regs[reg];
>> +        break;
>> +
>> +    case VC_ENDC_FLUSH_CTRL:
>> +        xive->vc_regs[reg] &= ~VC_ENDC_FLUSH_CTRL_POLL_VALID;
>> +        val = xive->vc_regs[reg];
>> +        break;
>> +
>> +    /*
>> +     * Indirect invalidation
>> +     */
>> +    case VC_AT_MACRO_KILL_MASK:
>> +        val = xive->vc_regs[reg];
>> +        break;
>> +
>> +    case VC_AT_MACRO_KILL:
>> +        xive->vc_regs[reg] &= ~VC_AT_MACRO_KILL_VALID;
>> +        val = xive->vc_regs[reg];
>> +        break;
>> +
>> +    /*
>> +     * Interrupt fifo overflow in memory backing store (Not modeled)
>> +     */
>> +    case VC_QUEUES_CFG_REM0 ... VC_QUEUES_CFG_REM6:
>> +        val = xive->vc_regs[reg];
>> +        break;
>> +
>> +    /*
>> +     * Synchronisation
>> +     */
>> +    case VC_ENDC_SYNC_DONE:
>> +        val = VC_ENDC_SYNC_POLL_DONE;
>> +        break;
>> +    default:
>> +        xive2_error(xive, "VC: invalid read @%"HWADDR_PRIx, offset);
>> +    }
>> +
>> +    return val;
>> +}
>> +
>> +static void pnv_xive2_ic_vc_write(void *opaque, hwaddr offset,
>> +                              uint64_t val, unsigned size)
>> +{
>> +    PnvXive2 *xive = PNV_XIVE2(opaque);
>> +    uint32_t reg = offset >> 3;
>> +
>> +    switch (offset) {
>> +    /*
>> +     * VSD table settings.
>> +     */
>> +    case VC_VSD_TABLE_ADDR:
>> +       break;
>> +    case VC_VSD_TABLE_DATA:
>> +        pnv_xive2_vst_set_data(xive, val);
>> +        break;
>> +
>> +    /*
>> +     * ESB cache updates (not modeled)
>> +     */
>> +    /* case VC_ESBC_FLUSH_CTRL: */
>> +    case VC_ESBC_FLUSH_POLL:
>> +        xive->vc_regs[VC_ESBC_FLUSH_CTRL >> 3] |= VC_ESBC_FLUSH_CTRL_POLL_VALID;
>> +        /* ESB update */
>> +        break;
>> +
>> +    /*
>> +     * EAS cache updates (not modeled)
>> +     */
>> +    /* case VC_EASC_FLUSH_CTRL: */
>> +    case VC_EASC_FLUSH_POLL:
>> +        xive->vc_regs[VC_EASC_FLUSH_CTRL >> 3] |= VC_EASC_FLUSH_CTRL_POLL_VALID;
>> +        /* EAS update */
>> +        break;
>> +
>> +    /*
>> +     * END cache updates
>> +     */
>> +    case VC_ENDC_WATCH0_SPEC:
>> +         val &= ~VC_ENDC_WATCH_CONFLICT; /* HW will set this bit */
>> +        break;
>> +
>> +    case VC_ENDC_WATCH0_DATA1 ... VC_ENDC_WATCH0_DATA3:
>> +        break;
>> +    case VC_ENDC_WATCH0_DATA0:
>> +        /* writing to DATA0 triggers the cache write */
>> +        xive->vc_regs[reg] = val;
>> +        pnv_xive2_end_update(xive);
>> +        break;
>> +
>> +
>> +    /* case VC_ENDC_FLUSH_CTRL: */
>> +    case VC_ENDC_FLUSH_POLL:
>> +        xive->vc_regs[VC_ENDC_FLUSH_CTRL >> 3] |= VC_ENDC_FLUSH_CTRL_POLL_VALID;
>> +        break;
>> +
>> +    /*
>> +     * Indirect invalidation
>> +     */
>> +    case VC_AT_MACRO_KILL:
>> +    case VC_AT_MACRO_KILL_MASK:
>> +        break;
>> +
>> +    /*
>> +     * Interrupt fifo overflow in memory backing store (Not modeled)
>> +     */
>> +    case VC_QUEUES_CFG_REM0 ... VC_QUEUES_CFG_REM6:
>> +        break;
>> +
>> +    /*
>> +     * Synchronisation
>> +     */
>> +    case VC_ENDC_SYNC_DONE:
>> +        break;
>> +
>> +    default:
>> +        xive2_error(xive, "VC: invalid write @%"HWADDR_PRIx, offset);
>> +        return;
>> +    }
>> +
>> +    xive->vc_regs[reg] = val;
>> +}
>> +
>> +static const MemoryRegionOps pnv_xive2_ic_vc_ops = {
>> +    .read = pnv_xive2_ic_vc_read,
>> +    .write = pnv_xive2_ic_vc_write,
>> +    .endianness = DEVICE_BIG_ENDIAN,
>> +    .valid = {
>> +        .min_access_size = 8,
>> +        .max_access_size = 8,
>> +    },
>> +    .impl = {
>> +        .min_access_size = 8,
>> +        .max_access_size = 8,
>> +    },
>> +};
>> +
>> +static uint64_t pnv_xive2_ic_pc_read(void *opaque, hwaddr offset,
>> +                                            unsigned size)
>> +{
>> +    PnvXive2 *xive = PNV_XIVE2(opaque);
>> +    uint64_t val = -1;
>> +    uint32_t reg = offset >> 3;
>> +
>> +    switch (offset) {
>> +    /*
>> +     * VSD table settings.
>> +     */
>> +    case PC_VSD_TABLE_ADDR:
>> +    case PC_VSD_TABLE_DATA:
>> +        val = xive->pc_regs[reg];
>> +        break;
>> +
>> +    /*
>> +     * cache updates
>> +     */
>> +    case PC_NXC_WATCH0_SPEC:
>> +        xive->pc_regs[reg] &= ~(PC_NXC_WATCH_FULL | PC_NXC_WATCH_CONFLICT);
>> +        val = xive->pc_regs[reg];
>> +        break;
>> +
>> +    case PC_NXC_WATCH0_DATA0:
>> +       /*
>> +        * Load DATA registers from cache with data requested by the
>> +        * SPEC register
>> +        */
>> +        pnv_xive2_nvp_cache_load(xive);
>> +        val = xive->pc_regs[reg];
>> +        break;
>> +
>> +    case PC_NXC_WATCH0_DATA1 ... PC_NXC_WATCH0_DATA3:
>> +        val = xive->pc_regs[reg];
>> +        break;
>> +
>> +    case PC_NXC_FLUSH_CTRL:
>> +        xive->pc_regs[reg] &= ~PC_NXC_FLUSH_CTRL_POLL_VALID;
>> +        val = xive->pc_regs[reg];
>> +        break;
>> +
>> +    /*
>> +     * Indirect invalidation
>> +     */
>> +    case PC_AT_KILL:
>> +        xive->pc_regs[reg] &= ~PC_AT_KILL_VALID;
>> +        val = xive->pc_regs[reg];
>> +        break;
>> +
>> +    default:
>> +        xive2_error(xive, "PC: invalid read @%"HWADDR_PRIx, offset);
>> +    }
>> +
>> +    return val;
>> +}
>> +
>> +static void pnv_xive2_ic_pc_write(void *opaque, hwaddr offset,
>> +                                         uint64_t val, unsigned size)
>> +{
>> +    PnvXive2 *xive = PNV_XIVE2(opaque);
>> +    uint32_t reg = offset >> 3;
>> +
>> +    switch (offset) {
>> +
>> +    /*
>> +     * VSD table settings. Only taken into account in the VC
>> +     * sub-engine because the Xive2Router model combines both VC and PC
>> +     * sub-engines
>> +     */
>> +    case PC_VSD_TABLE_ADDR:
>> +    case PC_VSD_TABLE_DATA:
>> +        break;
>> +
>> +    /*
>> +     * cache updates
>> +     */
>> +    case PC_NXC_WATCH0_SPEC:
>> +        val &= ~PC_NXC_WATCH_CONFLICT; /* HW will set this bit */
>> +        break;
>> +
>> +    case PC_NXC_WATCH0_DATA1 ... PC_NXC_WATCH0_DATA3:
>> +        break;
>> +    case PC_NXC_WATCH0_DATA0:
>> +        /* writing to DATA0 triggers the cache write */
>> +        xive->pc_regs[reg] = val;
>> +        pnv_xive2_nvp_update(xive);
>> +        break;
>> +
>> +   /* case PC_NXC_FLUSH_CTRL: */
>> +    case PC_NXC_FLUSH_POLL:
>> +        xive->pc_regs[PC_NXC_FLUSH_CTRL >> 3] |= PC_NXC_FLUSH_CTRL_POLL_VALID;
>> +        break;
>> +
>> +    /*
>> +     * Indirect invalidation
>> +     */
>> +    case PC_AT_KILL:
>> +    case PC_AT_KILL_MASK:
>> +        break;
>> +
>> +    default:
>> +        xive2_error(xive, "PC: invalid write @%"HWADDR_PRIx, offset);
>> +        return;
>> +    }
>> +
>> +    xive->pc_regs[reg] = val;
>> +}
>> +
>> +static const MemoryRegionOps pnv_xive2_ic_pc_ops = {
>> +    .read = pnv_xive2_ic_pc_read,
>> +    .write = pnv_xive2_ic_pc_write,
>> +    .endianness = DEVICE_BIG_ENDIAN,
>> +    .valid = {
>> +        .min_access_size = 8,
>> +        .max_access_size = 8,
>> +    },
>> +    .impl = {
>> +        .min_access_size = 8,
>> +        .max_access_size = 8,
>> +    },
>> +};
>> +
>> +
>> +static uint64_t pnv_xive2_ic_tctxt_read(void *opaque, hwaddr offset,
>> +                                         unsigned size)
>> +{
>> +    PnvXive2 *xive = PNV_XIVE2(opaque);
>> +    uint64_t val = -1;
>> +    uint32_t reg = offset >> 3;
>> +
>> +    switch (offset) {
>> +    /*
>> +     * XIVE2 hardware thread enablement
>> +     */
>> +    case TCTXT_EN0:
>> +    case TCTXT_EN1:
>> +        val = xive->tctxt_regs[reg];
>> +        break;
>> +
>> +    case TCTXT_EN0_SET:
>> +    case TCTXT_EN0_RESET:
>> +        val = xive->tctxt_regs[TCTXT_EN0 >> 3];
>> +        break;
>> +    case TCTXT_EN1_SET:
>> +    case TCTXT_EN1_RESET:
>> +        val = xive->tctxt_regs[TCTXT_EN1 >> 3];
>> +        break;
>> +    default:
>> +        xive2_error(xive, "TCTXT: invalid read @%"HWADDR_PRIx, offset);
>> +    }
>> +
>> +    return val;
>> +}
>> +
>> +static void pnv_xive2_ic_tctxt_write(void *opaque, hwaddr offset,
>> +                                            uint64_t val, unsigned size)
>> +{
>> +    PnvXive2 *xive = PNV_XIVE2(opaque);
>> +    uint32_t reg = offset >> 3;
>> +
>> +    switch (offset) {
>> +    /*
>> +     * XIVE2 hardware thread enablement
>> +     */
>> +    case TCTXT_EN0: /* Physical Thread Enable */
>> +    case TCTXT_EN1: /* Physical Thread Enable (fused core) */
>> +        break;
>> +
>> +    case TCTXT_EN0_SET:
>> +        xive->tctxt_regs[TCTXT_EN0 >> 3] |= val;
>> +        break;
>> +    case TCTXT_EN1_SET:
>> +        xive->tctxt_regs[TCTXT_EN1 >> 3] |= val;
>> +        break;
>> +    case TCTXT_EN0_RESET:
>> +        xive->tctxt_regs[TCTXT_EN0 >> 3] &= ~val;
>> +        break;
>> +    case TCTXT_EN1_RESET:
>> +        xive->tctxt_regs[TCTXT_EN1 >> 3] &= ~val;
>> +        break;
>> +
>> +    default:
>> +        xive2_error(xive, "TCTXT: invalid write @%"HWADDR_PRIx, offset);
>> +        return;
>> +    }
>> +
>> +    xive->pc_regs[reg] = val;
>> +}
>> +
>> +static const MemoryRegionOps pnv_xive2_ic_tctxt_ops = {
>> +    .read = pnv_xive2_ic_tctxt_read,
>> +    .write = pnv_xive2_ic_tctxt_write,
>> +    .endianness = DEVICE_BIG_ENDIAN,
>> +    .valid = {
>> +        .min_access_size = 8,
>> +        .max_access_size = 8,
>> +    },
>> +    .impl = {
>> +        .min_access_size = 8,
>> +        .max_access_size = 8,
>> +    },
>> +};
>> +
>> +/*
>> + * Redirect XSCOM to MMIO handlers
>> + */
>> +static uint64_t pnv_xive2_xscom_read(void *opaque, hwaddr offset,
>> +                                 unsigned size)
>> +{
>> +    PnvXive2 *xive = PNV_XIVE2(opaque);
>> +    uint64_t val = -1;
>> +    uint32_t xscom_reg = offset >> 3;
>> +    uint32_t mmio_offset = (xscom_reg & 0xFF) << 3;
>> +
>> +    switch (xscom_reg) {
>> +    case 0x000 ... 0x0FF:
>> +        val = pnv_xive2_ic_cq_read(opaque, mmio_offset, size);
>> +        break;
>> +    case 0x100 ... 0x1FF:
>> +        val = pnv_xive2_ic_vc_read(opaque, mmio_offset, size);
>> +        break;
>> +    case 0x200 ... 0x2FF:
>> +        val = pnv_xive2_ic_pc_read(opaque, mmio_offset, size);
>> +        break;
>> +    case 0x300 ... 0x3FF:
>> +        val = pnv_xive2_ic_tctxt_read(opaque, mmio_offset, size);
>> +        break;
>> +    default:
>> +        xive2_error(xive, "XSCOM: invalid read @%"HWADDR_PRIx, offset);
>> +    }
>> +
>> +    return val;
>> +}
>> +
>> +static void pnv_xive2_xscom_write(void *opaque, hwaddr offset,
>> +                                   uint64_t val, unsigned size)
>> +{
>> +    PnvXive2 *xive = PNV_XIVE2(opaque);
>> +    uint32_t xscom_reg = offset >> 3;
>> +    uint32_t mmio_offset = (xscom_reg & 0xFF) << 3;
>> +
>> +    switch (xscom_reg) {
>> +    case 0x000 ... 0x0FF:
>> +        pnv_xive2_ic_cq_write(opaque, mmio_offset, val, size);
>> +        break;
>> +    case 0x100 ... 0x1FF:
>> +        pnv_xive2_ic_vc_write(opaque, mmio_offset, val, size);
>> +        break;
>> +    case 0x200 ... 0x2FF:
>> +        pnv_xive2_ic_pc_write(opaque, mmio_offset, val, size);
>> +        break;
>> +    case 0x300 ... 0x3FF:
>> +        pnv_xive2_ic_tctxt_write(opaque, mmio_offset, val, size);
>> +        break;
>> +    default:
>> +        xive2_error(xive, "XSCOM: invalid write @%"HWADDR_PRIx, offset);
>> +    }
>> +}
>> +
>> +static const MemoryRegionOps pnv_xive2_xscom_ops = {
>> +    .read = pnv_xive2_xscom_read,
>> +    .write = pnv_xive2_xscom_write,
>> +    .endianness = DEVICE_BIG_ENDIAN,
>> +    .valid = {
>> +        .min_access_size = 8,
>> +        .max_access_size = 8,
>> +    },
>> +    .impl = {
>> +        .min_access_size = 8,
>> +        .max_access_size = 8,
>> +    },
>> +};
>> +
>> +/*
>> + * Notify port page. The layout is compatible between 4K and 64K pages :
>> + *
>> + * Page 1           Notify page (writes only)
>> + *  0x000 - 0x7FF   IPI interrupt (NPU)
>> + *  0x800 - 0xFFF   HW interrupt triggers (PSI, PHB)
>> + */
>> +
>> +static void pnv_xive2_ic_hw_trigger(PnvXive2 *xive, hwaddr addr,
>> +                                     uint64_t val)
>> +{
>> +    uint8_t blk;
>> +    uint32_t idx;
>> +
>> +    if (val & XIVE_TRIGGER_END) {
>> +        xive2_error(xive, "IC: END trigger at @0x%"HWADDR_PRIx" data 0x%"PRIx64,
>> +                   addr, val);
>> +        return;
>> +    }
>> +
>> +    /*
>> +     * Forward the source event notification directly to the Router.
>> +     * The source interrupt number should already be correctly encoded
>> +     * with the chip block id by the sending device (PHB, PSI).
>> +     */
>> +    blk = XIVE_EAS_BLOCK(val);
>> +    idx = XIVE_EAS_INDEX(val);
>> +
>> +    xive2_router_notify(XIVE_NOTIFIER(xive), XIVE_EAS(blk, idx));
>> +}
>> +
>> +static void pnv_xive2_ic_notify_write(void *opaque, hwaddr offset,
>> +                                       uint64_t val, unsigned size)
>> +{
>> +    PnvXive2 *xive = PNV_XIVE2(opaque);
>> +
>> +    /* VC: IPI triggers */
>> +    switch (offset) {
>> +    case 0x000 ... 0x7FF:
>> +        /* TODO: check IPI notify sub-page routing */
>> +        pnv_xive2_ic_hw_trigger(opaque, offset, val);
>> +        break;
>> +
>> +    /* VC: HW triggers */
>> +    case 0x800 ... 0xFFF:
>> +        pnv_xive2_ic_hw_trigger(opaque, offset, val);
>> +        break;
>> +
>> +    default:
>> +        xive2_error(xive, "NOTIFY: invalid write @%"HWADDR_PRIx, offset);
>> +    }
>> +}
>> +
>> +static uint64_t pnv_xive2_ic_notify_read(void *opaque, hwaddr offset,
>> +                                                unsigned size)
>> +{
>> +    PnvXive2 *xive = PNV_XIVE2(opaque);
>> +
>> +   /* loads are invalid */
>> +    xive2_error(xive, "NOTIFY: invalid read @%"HWADDR_PRIx, offset);
>> +    return -1;
>> +}
>> +
>> +static const MemoryRegionOps pnv_xive2_ic_notify_ops = {
>> +    .read = pnv_xive2_ic_notify_read,
>> +    .write = pnv_xive2_ic_notify_write,
>> +    .endianness = DEVICE_BIG_ENDIAN,
>> +    .valid = {
>> +        .min_access_size = 8,
>> +        .max_access_size = 8,
>> +    },
>> +    .impl = {
>> +        .min_access_size = 8,
>> +        .max_access_size = 8,
>> +    },
>> +};
>> +
>> +static uint64_t pnv_xive2_ic_lsi_read(void *opaque, hwaddr offset,
>> +                                             unsigned size)
>> +{
>> +    PnvXive2 *xive = PNV_XIVE2(opaque);
>> +
>> +    xive2_error(xive, "LSI: invalid read @%"HWADDR_PRIx, offset);
>> +    return -1;
>> +}
>> +
>> +static void pnv_xive2_ic_lsi_write(void *opaque, hwaddr offset,
>> +                                          uint64_t val, unsigned size)
>> +{
>> +    PnvXive2 *xive = PNV_XIVE2(opaque);
>> +
>> +    xive2_error(xive, "LSI: invalid write @%"HWADDR_PRIx, offset);
>> +}
>> +
>> +static const MemoryRegionOps pnv_xive2_ic_lsi_ops = {
>> +    .read = pnv_xive2_ic_lsi_read,
>> +    .write = pnv_xive2_ic_lsi_write,
>> +    .endianness = DEVICE_BIG_ENDIAN,
>> +    .valid = {
>> +        .min_access_size = 8,
>> +        .max_access_size = 8,
>> +    },
>> +    .impl = {
>> +        .min_access_size = 8,
>> +        .max_access_size = 8,
>> +    },
>> +};
>> +
>> +/*
>> + * Sync MMIO page (write only)
>> + */
>> +#define PNV_XIVE2_SYNC_IPI      0x000
>> +#define PNV_XIVE2_SYNC_HW       0x080
>> +#define PNV_XIVE2_SYNC_NxC      0x100
>> +#define PNV_XIVE2_SYNC_INT      0x180
>> +#define PNV_XIVE2_SYNC_OS_ESC   0x200
>> +#define PNV_XIVE2_SYNC_POOL_ESC 0x280
>> +#define PNV_XIVE2_SYNC_HARD_ESC 0x300
>> +
>> +static uint64_t pnv_xive2_ic_sync_read(void *opaque, hwaddr offset,
>> +                                              unsigned size)
>> +{
>> +    PnvXive2 *xive = PNV_XIVE2(opaque);
>> +
>> +    /* loads are invalid */
>> +    xive2_error(xive, "SYNC: invalid read @%"HWADDR_PRIx, offset);
>> +    return -1;
>> +}
>> +
>> +static void pnv_xive2_ic_sync_write(void *opaque, hwaddr offset,
>> +                                           uint64_t val, unsigned size)
>> +{
>> +    PnvXive2 *xive = PNV_XIVE2(opaque);
>> +
>> +    switch (offset) {
>> +    case PNV_XIVE2_SYNC_IPI:
>> +    case PNV_XIVE2_SYNC_HW:
>> +    case PNV_XIVE2_SYNC_NxC:
>> +    case PNV_XIVE2_SYNC_INT:
>> +    case PNV_XIVE2_SYNC_OS_ESC:
>> +    case PNV_XIVE2_SYNC_POOL_ESC:
>> +    case PNV_XIVE2_SYNC_HARD_ESC:
>> +        break;
>> +    default:
>> +        xive2_error(xive, "SYNC: invalid write @%"HWADDR_PRIx, offset);
>> +    }
>> +}
>> +
>> +static const MemoryRegionOps pnv_xive2_ic_sync_ops = {
>> +    .read = pnv_xive2_ic_sync_read,
>> +    .write = pnv_xive2_ic_sync_write,
>> +    .endianness = DEVICE_BIG_ENDIAN,
>> +    .valid = {
>> +        .min_access_size = 8,
>> +        .max_access_size = 8,
>> +    },
>> +    .impl = {
>> +        .min_access_size = 8,
>> +        .max_access_size = 8,
>> +    },
>> +};
>> +
>> +/*
>> + * When the TM direct pages of the IC controller are accessed, the
>> + * target HW thread is deduced from the page offset.
>> + */
>> +static XiveTCTX *pnv_xive2_get_indirect_tctx(PnvXive2 *xive, uint32_t pir)
>> +{
>> +    PnvChip *chip = xive->chip;
>> +    PowerPCCPU *cpu = NULL;
>> +
>> +    cpu = pnv_chip_find_cpu(chip, pir);
>> +    if (!cpu) {
>> +        xive2_error(xive, "IC: invalid PIR %x for indirect access", pir);
>> +        return NULL;
>> +    }
>> +
>> +    if (!pnv_xive2_is_cpu_enabled(xive, cpu)) {
>> +        xive2_error(xive, "IC: CPU %x is not enabled", pir);
>> +    }
>> +
>> +    return XIVE_TCTX(pnv_cpu_state(cpu)->intc);
>> +}
>> +
>> +static uint64_t pnv_xive2_ic_tm_indirect_read(void *opaque, hwaddr offset,
>> +                                              unsigned size)
>> +{
>> +    PnvXive2 *xive = PNV_XIVE2(opaque);
>> +    uint32_t pir = offset >> xive->ic_shift;
>> +    XiveTCTX *tctx = pnv_xive2_get_indirect_tctx(xive, pir);
>> +    uint64_t val = -1;
>> +
>> +    if (tctx) {
>> +        val = xive_tctx_tm_read(NULL, tctx, offset, size);
>> +    }
>> +
>> +    return val;
>> +}
>> +
>> +static void pnv_xive2_ic_tm_indirect_write(void *opaque, hwaddr offset,
>> +                                           uint64_t val, unsigned size)
>> +{
>> +    PnvXive2 *xive = PNV_XIVE2(opaque);
>> +    uint32_t pir = offset >> xive->ic_shift;
>> +    XiveTCTX *tctx = pnv_xive2_get_indirect_tctx(xive, pir);
>> +
>> +    if (tctx) {
>> +        xive_tctx_tm_write(NULL, tctx, offset, val, size);
>> +    }
>> +}
>> +
>> +static const MemoryRegionOps pnv_xive2_ic_tm_indirect_ops = {
>> +    .read = pnv_xive2_ic_tm_indirect_read,
>> +    .write = pnv_xive2_ic_tm_indirect_write,
>> +    .endianness = DEVICE_BIG_ENDIAN,
>> +    .valid = {
>> +        .min_access_size = 8,
>> +        .max_access_size = 8,
>> +    },
>> +    .impl = {
>> +        .min_access_size = 8,
>> +        .max_access_size = 8,
>> +    },
>> +};
>> +
>> +/*
>> + * TIMA ops
>> + */
>> +
>> +static void pnv_xive2_tm_write(void *opaque, hwaddr offset,
>> +                          uint64_t value, unsigned size)
>> +{
>> +    PowerPCCPU *cpu = POWERPC_CPU(current_cpu);
>> +    PnvXive2 *xive = pnv_xive2_tm_get_xive(cpu);
>> +    XiveTCTX *tctx = XIVE_TCTX(pnv_cpu_state(cpu)->intc);
>> +
>> +    /* Other TM ops are the same as XIVE1 */
>> +    xive_tctx_tm_write(XIVE_PRESENTER(xive), tctx, offset, value, size);
>> +}
>> +
>> +static uint64_t pnv_xive2_tm_read(void *opaque, hwaddr offset, unsigned size)
>> +{
>> +    PowerPCCPU *cpu = POWERPC_CPU(current_cpu);
>> +    PnvXive2 *xive = pnv_xive2_tm_get_xive(cpu);
>> +    XiveTCTX *tctx = XIVE_TCTX(pnv_cpu_state(cpu)->intc);
>> +
>> +    /* Other TM ops are the same as XIVE1 */
>> +    return xive_tctx_tm_read(XIVE_PRESENTER(xive), tctx, offset, size);
>> +}
>> +
>> +static const MemoryRegionOps pnv_xive2_tm_ops = {
>> +    .read = pnv_xive2_tm_read,
>> +    .write = pnv_xive2_tm_write,
>> +    .endianness = DEVICE_BIG_ENDIAN,
>> +    .valid = {
>> +        .min_access_size = 1,
>> +        .max_access_size = 8,
>> +    },
>> +    .impl = {
>> +        .min_access_size = 1,
>> +        .max_access_size = 8,
>> +    },
>> +};
>> +
>> +static uint64_t pnv_xive2_nvc_read(void *opaque, hwaddr offset,
>> +                                          unsigned size)
>> +{
>> +    PnvXive2 *xive = PNV_XIVE2(opaque);
>> +
>> +    xive2_error(xive, "NVC: invalid read @%"HWADDR_PRIx, offset);
>> +    return -1;
>> +}
>> +
>> +static void pnv_xive2_nvc_write(void *opaque, hwaddr offset,
>> +                                       uint64_t val, unsigned size)
>> +{
>> +    PnvXive2 *xive = PNV_XIVE2(opaque);
>> +
>> +    xive2_error(xive, "NVC: invalid write @%"HWADDR_PRIx, offset);
>> +}
>> +
>> +static const MemoryRegionOps pnv_xive2_nvc_ops = {
>> +    .read = pnv_xive2_nvc_read,
>> +    .write = pnv_xive2_nvc_write,
>> +    .endianness = DEVICE_BIG_ENDIAN,
>> +    .valid = {
>> +        .min_access_size = 8,
>> +        .max_access_size = 8,
>> +    },
>> +    .impl = {
>> +        .min_access_size = 8,
>> +        .max_access_size = 8,
>> +    },
>> +};
>> +
>> +static uint64_t pnv_xive2_nvpg_read(void *opaque, hwaddr offset,
>> +                                           unsigned size)
>> +{
>> +    PnvXive2 *xive = PNV_XIVE2(opaque);
>> +
>> +    xive2_error(xive, "NVPG: invalid read @%"HWADDR_PRIx, offset);
>> +    return -1;
>> +}
>> +
>> +static void pnv_xive2_nvpg_write(void *opaque, hwaddr offset,
>> +                                        uint64_t val, unsigned size)
>> +{
>> +    PnvXive2 *xive = PNV_XIVE2(opaque);
>> +
>> +    xive2_error(xive, "NVPG: invalid write @%"HWADDR_PRIx, offset);
>> +}
>> +
>> +static const MemoryRegionOps pnv_xive2_nvpg_ops = {
>> +    .read = pnv_xive2_nvpg_read,
>> +    .write = pnv_xive2_nvpg_write,
>> +    .endianness = DEVICE_BIG_ENDIAN,
>> +    .valid = {
>> +        .min_access_size = 8,
>> +        .max_access_size = 8,
>> +    },
>> +    .impl = {
>> +        .min_access_size = 8,
>> +        .max_access_size = 8,
>> +    },
>> +};
>> +
>> +/*
>> + * POWER10 default capabilities: 0x2000120076f00000
>> + */
>> +#define PNV_XIVE2_CAPABILITIES  0x2000120076f00000
>> +
>> +/*
>> + * POWER10 default configuration: 0x0030000033000000
>> + *
>> + * 8bits thread id was dropped for P10
>> + */
>> +#define PNV_XIVE2_CONFIGURATION 0x0030000033000000
>> +
>> +static void pnv_xive2_reset(void *dev)
>> +{
>> +    PnvXive2 *xive2 = PNV_XIVE2(dev);
>> +    XiveSource *xsrc = &xive2->ipi_source;
>> +    Xive2EndSource *end_xsrc = &xive2->end_source;
>> +
>> +    xive2->cq_regs[CQ_XIVE_CAP >> 3] = PNV_XIVE2_CAPABILITIES;
>> +    xive2->cq_regs[CQ_XIVE_CFG >> 3] = PNV_XIVE2_CONFIGURATION;
>> +
>> +    /* HW hardwires the #Topology of the chip in the block field */
>> +    xive2->cq_regs[CQ_XIVE_CFG >> 3] |=
>> +        SETFIELD(CQ_XIVE_CFG_HYP_HARD_BLOCK_ID, 0ull, xive2->chip->chip_id);
>> +
>> +    /* Set default page size to 64k */
>> +    xive2->ic_shift = xive2->esb_shift = xive2->end_shift = 16;
>> +    xive2->nvc_shift = xive2->nvpg_shift = xive2->tm_shift = 16;
>> +
>> +    /* Clear source MMIOs */
>> +    if (memory_region_is_mapped(&xsrc->esb_mmio)) {
>> +        memory_region_del_subregion(&xive2->esb_mmio, &xsrc->esb_mmio);
>> +    }
>> +
>> +    if (memory_region_is_mapped(&end_xsrc->esb_mmio)) {
>> +        memory_region_del_subregion(&xive2->end_mmio, &end_xsrc->esb_mmio);
>> +    }
>> +}
>> +
>> +/*
>> + *  Maximum number of IRQs and ENDs supported by HW. Will be tuned by
>> + *  software.
>> + */
>> +#define PNV_XIVE2_NR_IRQS (PNV10_XIVE2_ESB_SIZE / (1ull << XIVE_ESB_64K_2PAGE))
>> +#define PNV_XIVE2_NR_ENDS (PNV10_XIVE2_END_SIZE / (1ull << XIVE_ESB_64K_2PAGE))
>> +
>> +static void pnv_xive2_realize(DeviceState *dev, Error **errp)
>> +{
>> +    PnvXive2 *xive2 = PNV_XIVE2(dev);
>> +    PnvXive2Class *pxc = PNV_XIVE2_GET_CLASS(dev);
>> +    XiveSource *xsrc = &xive2->ipi_source;
>> +    Xive2EndSource *end_xsrc = &xive2->end_source;
>> +    Error *local_err = NULL;
>> +    int i;
>> +
>> +    pxc->parent_realize(dev, &local_err);
>> +    if (local_err) {
>> +        error_propagate(errp, local_err);
>> +        return;
>> +    }
>> +
>> +    assert(xive2->chip);
>> +
>> +    /*
>> +     * The XiveSource and Xive2EndSource objects are realized with the
>> +     * maximum allowed HW configuration. The ESB MMIO regions will be
>> +     * resized dynamically when the controller is configured by the FW
>> +     * to limit accesses to resources not provisioned.
>> +     */
>> +    object_property_set_int(OBJECT(xsrc), XIVE_SRC_STORE_EOI, "flags",
>> +                            &error_fatal);
>> +    object_property_set_int(OBJECT(xsrc), PNV_XIVE2_NR_IRQS, "nr-irqs",
>> +                            &error_fatal);
>> +    object_property_set_link(OBJECT(xsrc), OBJECT(xive2), "xive",
>> +                             &error_fatal);
>> +    object_property_set_bool(OBJECT(xsrc), true, "realized", &local_err);
>> +    if (local_err) {
>> +        error_propagate(errp, local_err);
>> +        return;
>> +    }
>> +
>> +    object_property_set_int(OBJECT(end_xsrc), PNV_XIVE2_NR_ENDS, "nr-ends",
>> +                            &error_fatal);
>> +    object_property_set_link(OBJECT(end_xsrc), OBJECT(xive2), "xive",
>> +                             &error_abort);
>> +    object_property_set_bool(OBJECT(end_xsrc), true, "realized", &local_err);
>> +    if (local_err) {
>> +        error_propagate(errp, local_err);
>> +        return;
>> +    }
>> +
>> +    /* XSCOM region, used for initial configuration of the BARs */
>> +    memory_region_init_io(&xive2->xscom_regs, OBJECT(dev),
>> +                          &pnv_xive2_xscom_ops, xive2, "xscom-xive",
>> +                          PNV10_XSCOM_XIVE2_SIZE << 3);
>> +
>> +    /* Interrupt controller MMIO regions */
>> +    xive2->ic_shift = 16;
>> +    memory_region_init(&xive2->ic_mmio, OBJECT(dev), "xive-ic",
>> +                       PNV10_XIVE2_IC_SIZE);
>> +
>> +    for (i = 0; i < ARRAY_SIZE(xive2->ic_mmios); i++) {
>> +        memory_region_init_io(&xive2->ic_mmios[i], OBJECT(dev),
>> +                         pnv_xive2_ic_regions[i].ops, xive2,
>> +                         pnv_xive2_ic_regions[i].name,
>> +                         pnv_xive2_ic_regions[i].pgsize << xive2->ic_shift);
>> +    }
>> +
>> +    /*
>> +     * VC MMIO regions.
>> +     */
>> +    xive2->esb_shift = 16;
>> +    xive2->end_shift = 16;
>> +    memory_region_init(&xive2->esb_mmio, OBJECT(xive2), "xive-esb",
>> +                       PNV10_XIVE2_ESB_SIZE);
>> +    memory_region_init(&xive2->end_mmio, OBJECT(xive2), "xive-end",
>> +                       PNV10_XIVE2_END_SIZE);
>> +
>> +    /* Presenter Controller MMIO region (not modeled) */
>> +    xive2->nvc_shift = 16;
>> +    xive2->nvpg_shift = 16;
>> +    memory_region_init_io(&xive2->nvc_mmio, OBJECT(dev),
>> +                          &pnv_xive2_nvc_ops, xive2,
>> +                          "xive-nvc", PNV10_XIVE2_NVC_SIZE);
>> +
>> +    memory_region_init_io(&xive2->nvpg_mmio, OBJECT(dev),
>> +                          &pnv_xive2_nvpg_ops, xive2,
>> +                          "xive-nvpg", PNV10_XIVE2_NVPG_SIZE);
>> +
>> +    /* Thread Interrupt Management Area (Direct) */
>> +    xive2->tm_shift = 16;
>> +    memory_region_init_io(&xive2->tm_mmio, OBJECT(dev), &pnv_xive2_tm_ops,
>> +                          xive2, "xive-tima", PNV10_XIVE2_TM_SIZE);
>> +
>> +    qemu_register_reset(pnv_xive2_reset, dev);
>> +}
>> +
>> +static Property pnv_xive2_properties[] = {
>> +    DEFINE_PROP_UINT64("ic-bar", PnvXive2, ic_base, 0),
>> +    DEFINE_PROP_UINT64("esb-bar", PnvXive2, esb_base, 0),
>> +    DEFINE_PROP_UINT64("end-bar", PnvXive2, end_base, 0),
>> +    DEFINE_PROP_UINT64("nvc-bar", PnvXive2, nvc_base, 0),
>> +    DEFINE_PROP_UINT64("nvpg-bar", PnvXive2, nvpg_base, 0),
>> +    DEFINE_PROP_UINT64("tm-bar", PnvXive2, tm_base, 0),
>> +    DEFINE_PROP_LINK("chip", PnvXive2, chip, TYPE_PNV_CHIP, PnvChip *),
>> +    DEFINE_PROP_END_OF_LIST(),
>> +};
>> +
>> +static void pnv_xive2_instance_init(Object *obj)
>> +{
>> +    PnvXive2 *xive = PNV_XIVE2(obj);
>> +
>> +    object_initialize_child(obj, "ipi_source", &xive->ipi_source,
>> +                            sizeof(xive->ipi_source), TYPE_XIVE_SOURCE,
>> +                            &error_abort, NULL);
>> +    object_initialize_child(obj, "end_source", &xive->end_source,
>> +                            sizeof(xive->end_source), TYPE_XIVE2_END_SOURCE,
>> +                            &error_abort, NULL);
>> +}
>> +
>> +static int pnv_xive2_dt_xscom(PnvXScomInterface *dev, void *fdt,
>> +                             int xscom_offset)
>> +{
>> +    const char compat_p10[] = "ibm,power10-xive-x";
>> +    char *name;
>> +    int offset;
>> +    uint32_t reg[] = {
>> +        cpu_to_be32(PNV10_XSCOM_XIVE2_BASE),
>> +        cpu_to_be32(PNV10_XSCOM_XIVE2_SIZE)
>> +    };
>> +
>> +    name = g_strdup_printf("xive@%x", PNV10_XSCOM_XIVE2_BASE);
>> +    offset = fdt_add_subnode(fdt, xscom_offset, name);
>> +    _FDT(offset);
>> +    g_free(name);
>> +
>> +    _FDT((fdt_setprop(fdt, offset, "reg", reg, sizeof(reg))));
>> +    _FDT(fdt_setprop(fdt, offset, "compatible", compat_p10,
>> +                     sizeof(compat_p10)));
>> +    return 0;
>> +}
>> +
>> +static void pnv_xive2_class_init(ObjectClass *klass, void *data)
>> +{
>> +    DeviceClass *dc = DEVICE_CLASS(klass);
>> +    PnvXScomInterfaceClass *xdc = PNV_XSCOM_INTERFACE_CLASS(klass);
>> +    Xive2RouterClass *xrc = XIVE2_ROUTER_CLASS(klass);
>> +    XiveNotifierClass *xnc = XIVE_NOTIFIER_CLASS(klass);
>> +    XivePresenterClass *xpc = XIVE_PRESENTER_CLASS(klass);
>> +    PnvXive2Class *pxc = PNV_XIVE2_CLASS(klass);
>> +
>> +    xdc->dt_xscom  = pnv_xive2_dt_xscom;
>> +
>> +    dc->desc       = "PowerNV XIVE2 Interrupt Controller (POWER10)";
>> +    device_class_set_parent_realize(dc, pnv_xive2_realize,
>> +                                    &pxc->parent_realize);
>> +    device_class_set_props(dc, pnv_xive2_properties);
>> +
>> +    xrc->get_eas   = pnv_xive2_get_eas;
>> +    xrc->get_end   = pnv_xive2_get_end;
>> +    xrc->write_end = pnv_xive2_write_end;
>> +    xrc->get_nvp   = pnv_xive2_get_nvp;
>> +    xrc->write_nvp = pnv_xive2_write_nvp;
>> +    xrc->get_block_id = pnv_xive2_get_block_id;
>> +
>> +    xnc->notify    = pnv_xive2_notify;
>> +
>> +    xpc->match_nvt  = pnv_xive2_match_nvt;
>> +};
>> +
>> +static const TypeInfo pnv_xive2_info = {
>> +    .name          = TYPE_PNV_XIVE2,
>> +    .parent        = TYPE_XIVE2_ROUTER,
>> +    .instance_init = pnv_xive2_instance_init,
>> +    .instance_size = sizeof(PnvXive2),
>> +    .class_init    = pnv_xive2_class_init,
>> +    .class_size    = sizeof(PnvXive2Class),
>> +    .interfaces    = (InterfaceInfo[]) {
>> +        { TYPE_PNV_XSCOM_INTERFACE },
>> +        { }
>> +    }
>> +};
>> +
>> +static void pnv_xive2_register_types(void)
>> +{
>> +    type_register_static(&pnv_xive2_info);
>> +}
>> +
>> +type_init(pnv_xive2_register_types)
>> +
>> +static void xive2_nvp_pic_print_info(Xive2Nvp *nvp, uint32_t nvp_idx,
>> +                                     Monitor *mon)
>> +{
>> +    uint8_t  eq_blk = xive_get_field32(NVP2_W5_VP_END_BLOCK, nvp->w5);
>> +    uint32_t eq_idx = xive_get_field32(NVP2_W5_VP_END_INDEX, nvp->w5);
>> +
>> +    if (!xive2_nvp_is_valid(nvp)) {
>> +        return;
>> +    }
>> +
>> +    monitor_printf(mon, "  %08x end:%02x/%04x CPPR:%02x IPB:%02x\n",
>> +                   nvp_idx, eq_blk, eq_idx,
>> +                   xive_get_field32(NVP2_W2_CPPR, nvp->w2),
>> +                   xive_get_field32(NVP2_W2_IPB, nvp->w2));
>> +}
>> +
>> +/*
>> + * If the table is direct, we can compute the number of PQ entries
>> + * provisioned by FW.
>> + */
>> +static uint32_t pnv_xive2_nr_esbs(PnvXive2 *xive)
>> +{
>> +    uint8_t blk = pnv_xive2_block_id(xive);
>> +    uint64_t vsd = xive->vsds[VST_ESB][blk];
>> +    uint64_t vst_tsize = 1ull << (GETFIELD(VSD_TSIZE, vsd) + 12);
>> +
>> +    return VSD_INDIRECT & vsd ? 0 : vst_tsize * SBE_PER_BYTE;
>> +}
>> +
>> +/*
>> + * Compute the number of entries per indirect subpage.
>> + */
>> +static uint64_t pnv_xive2_vst_per_subpage(PnvXive2 *xive, uint32_t type)
>> +{
>> +    uint8_t blk = pnv_xive2_block_id(xive);
>> +    uint64_t vsd = xive->vsds[type][blk];
>> +    const XiveVstInfo *info = &vst_infos[type];
>> +    uint64_t vsd_addr;
>> +    uint32_t page_shift;
>> +
>> +    /* For direct tables, fake a valid value */
>> +    if (!(VSD_INDIRECT & vsd)) {
>> +        return 1;
>> +    }
>> +
>> +    /* Get the page size of the indirect table. */
>> +    vsd_addr = vsd & VSD_ADDRESS_MASK;
>> +    vsd = ldq_be_dma(&address_space_memory, vsd_addr);
>> +
>> +    if (!(vsd & VSD_ADDRESS_MASK)) {
>> +#ifdef XIVE2_DEBUG
>> +        xive2_error(xive, "VST: invalid %s entry!?", info->name);
>> +#endif
>> +        return 0;
>> +    }
>> +
>> +    page_shift = GETFIELD(VSD_TSIZE, vsd) + 12;
>> +
>> +    if (!pnv_xive2_vst_page_size_allowed(page_shift)) {
>> +        xive2_error(xive, "VST: invalid %s page shift %d", info->name,
>> +                   page_shift);
>> +        return 0;
>> +    }
>> +
>> +    return (1ull << page_shift) / info->size;
>> +}
>> +
>> +void pnv_xive2_pic_print_info(PnvXive2 *xive, Monitor *mon)
>> +{
>> +    Xive2Router *xrtr = XIVE2_ROUTER(xive);
>> +    uint8_t blk = pnv_xive2_block_id(xive);
>> +    uint8_t chip_id = xive->chip->chip_id;
>> +    uint32_t srcno0 = XIVE_EAS(blk, 0);
>> +    uint32_t nr_esbs = pnv_xive2_nr_esbs(xive);
>> +    Xive2Eas eas;
>> +    Xive2End end;
>> +    Xive2Nvp nvp;
>> +    int i;
>> +    uint64_t xive_nvp_per_subpage;
>> +
>> +    monitor_printf(mon, "XIVE[%x] Source %08x .. %08x\n", blk, srcno0,
>> +                   srcno0 + nr_esbs - 1);
>> +    xive_source_pic_print_info(&xive->ipi_source, srcno0, mon);
>> +
>> +    monitor_printf(mon, "XIVE[%x] EAT %08x .. %08x\n", blk, srcno0,
>> +                   srcno0 + nr_esbs - 1);
>> +    for (i = 0; i < nr_esbs; i++) {
>> +        if (xive2_router_get_eas(xrtr, blk, i, &eas)) {
>> +            break;
>> +        }
>> +        if (!xive2_eas_is_masked(&eas)) {
>> +            xive2_eas_pic_print_info(&eas, i, mon);
>> +        }
>> +    }
>> +
>> +    monitor_printf(mon, "XIVE[%x] #%d END Escalation EAT\n", chip_id, blk);
>> +    i = 0;
>> +    while (!xive2_router_get_end(xrtr, blk, i, &end)) {
>> +        xive2_end_eas_pic_print_info(&end, i++, mon);
>> +    }
>> +
>> +    monitor_printf(mon, "XIVE[%x] #%d ENDT\n", chip_id, blk);
>> +    i = 0;
>> +    while (!xive2_router_get_end(xrtr, blk, i, &end)) {
>> +        xive2_end_pic_print_info(&end, i++, mon);
>> +    }
>> +
>> +    monitor_printf(mon, "XIVE[%x] #%d NVPT %08x .. %08x\n", chip_id, blk,
>> +                   0, XIVE2_NVP_COUNT - 1);
>> +    xive_nvp_per_subpage = pnv_xive2_vst_per_subpage(xive, VST_NVP);
>> +    for (i = 0; i < XIVE2_NVP_COUNT; i += xive_nvp_per_subpage) {
>> +        while (!xive2_router_get_nvp(xrtr, blk, i, &nvp)) {
>> +            xive2_nvp_pic_print_info(&nvp, i++, mon);
>> +        }
>> +    }
>> +}
>> diff --git a/hw/ppc/pnv.c b/hw/ppc/pnv.c
>> index 1b4748ce6dc3..73c40ce3209f 100644
>> --- a/hw/ppc/pnv.c
>> +++ b/hw/ppc/pnv.c
>> @@ -706,6 +706,7 @@ static void pnv_chip_power10_pic_print_info(PnvChip *chip, Monitor *mon)
>>  {
>>      Pnv10Chip *chip10 = PNV10_CHIP(chip);
>>  
>> +    pnv_xive2_pic_print_info(&chip10->xive, mon);
>>      pnv_psi_pic_print_info(&chip10->psi, mon);
>>  }
>>  
>> @@ -997,27 +998,45 @@ static void pnv_chip_power9_intc_print_info(PnvChip *chip, PowerPCCPU *cpu,
>>  static void pnv_chip_power10_intc_create(PnvChip *chip, PowerPCCPU *cpu,
>>                                          Error **errp)
>>  {
>> +    Pnv10Chip *chip10 = PNV10_CHIP(chip);
>> +    Error *local_err = NULL;
>> +    Object *obj;
>>      PnvCPUState *pnv_cpu = pnv_cpu_state(cpu);
>>  
>> -    /* Will be defined when the interrupt controller is */
>> -    pnv_cpu->intc = NULL;
>> +    /*
>> +     * The core creates its interrupt presenter but the XIVE2 interrupt
>> +     * controller object is initialized afterwards. Hopefully, it's
>> +     * only used at runtime.
>> +     */
>> +    obj = xive_tctx_create(OBJECT(cpu), XIVE_PRESENTER(&chip10->xive),
>> +                           &local_err);
>> +    if (local_err) {
>> +        error_propagate(errp, local_err);
>> +        return;
>> +    }
>> +
>> +    pnv_cpu->intc = obj;
>>  }
>>  
>>  static void pnv_chip_power10_intc_reset(PnvChip *chip, PowerPCCPU *cpu)
>>  {
>> -    ;
>> +    PnvCPUState *pnv_cpu = pnv_cpu_state(cpu);
>> +
>> +    xive_tctx_reset(XIVE_TCTX(pnv_cpu->intc));
>>  }
>>  
>>  static void pnv_chip_power10_intc_destroy(PnvChip *chip, PowerPCCPU *cpu)
>>  {
>>      PnvCPUState *pnv_cpu = pnv_cpu_state(cpu);
>>  
>> +    xive_tctx_destroy(XIVE_TCTX(pnv_cpu->intc));
>>      pnv_cpu->intc = NULL;
>>  }
>>  
>>  static void pnv_chip_power10_intc_print_info(PnvChip *chip, PowerPCCPU *cpu,
>>                                               Monitor *mon)
>>  {
>> +    xive_tctx_pic_print_info(XIVE_TCTX(pnv_cpu_state(cpu)->intc), mon);
>>  }
>>  
>>  /*
>> @@ -1590,6 +1609,10 @@ static void pnv_chip_power10_instance_init(Object *obj)
>>  {
>>      Pnv10Chip *chip10 = PNV10_CHIP(obj);
>>  
>> +    object_initialize_child(obj, "xive", &chip10->xive, sizeof(chip10->xive),
>> +                            TYPE_PNV_XIVE2, &error_abort, NULL);
>> +    object_property_add_alias(obj, "xive-fabric", OBJECT(&chip10->xive),
>> +                              "xive-fabric", &error_abort);
>>      object_initialize_child(obj, "psi",  &chip10->psi, sizeof(chip10->psi),
>>                              TYPE_PNV10_PSI, &error_abort, NULL);
>>      object_initialize_child(obj, "lpc",  &chip10->lpc, sizeof(chip10->lpc),
>> @@ -1617,6 +1640,30 @@ static void pnv_chip_power10_realize(DeviceState *dev, Error **errp)
>>          return;
>>      }
>>  
>> +    /* XIVE2 interrupt controller (POWER10) */
>> +    object_property_set_int(OBJECT(&chip10->xive), PNV10_XIVE2_IC_BASE(chip),
>> +                            "ic-bar", &error_fatal);
>> +    object_property_set_int(OBJECT(&chip10->xive), PNV10_XIVE2_ESB_BASE(chip),
>> +                            "esb-bar", &error_fatal);
>> +    object_property_set_int(OBJECT(&chip10->xive), PNV10_XIVE2_END_BASE(chip),
>> +                            "end-bar", &error_fatal);
>> +    object_property_set_int(OBJECT(&chip10->xive), PNV10_XIVE2_NVPG_BASE(chip),
>> +                            "nvpg-bar", &error_fatal);
>> +    object_property_set_int(OBJECT(&chip10->xive), PNV10_XIVE2_NVC_BASE(chip),
>> +                            "nvc-bar", &error_fatal);
>> +    object_property_set_int(OBJECT(&chip10->xive), PNV10_XIVE2_TM_BASE(chip),
>> +                            "tm-bar", &error_fatal);
>> +    object_property_set_link(OBJECT(&chip10->xive), OBJECT(chip), "chip",
>> +                             &error_abort);
>> +    object_property_set_bool(OBJECT(&chip10->xive), true, "realized",
>> +                             &local_err);
>> +    if (local_err) {
>> +        error_propagate(errp, local_err);
>> +        return;
>> +    }
>> +    pnv_xscom_add_subregion(chip, PNV10_XSCOM_XIVE2_BASE,
>> +                            &chip10->xive.xscom_regs);
>> +
>>      /* Processor Service Interface (PSI) Host Bridge */
>>      object_property_set_int(OBJECT(&chip10->psi), PNV10_PSIHB_BASE(chip),
>>                              "bar", &error_fatal);
>> @@ -1913,6 +1960,35 @@ static int pnv_match_nvt(XiveFabric *xfb, uint8_t format,
>>      return total_count;
>>  }
>>  
>> +static int pnv10_xive_match_nvt(XiveFabric *xfb, uint8_t format,
>> +                                uint8_t nvt_blk, uint32_t nvt_idx,
>> +                                bool cam_ignore, uint8_t priority,
>> +                                uint32_t logic_serv,
>> +                                XiveTCTXMatch *match)
>> +{
>> +    PnvMachineState *pnv = PNV_MACHINE(xfb);
>> +    int total_count = 0;
>> +    int i;
>> +
>> +    for (i = 0; i < pnv->num_chips; i++) {
>> +        Pnv10Chip *chip10 = PNV10_CHIP(pnv->chips[i]);
>> +        XivePresenter *xptr = XIVE_PRESENTER(&chip10->xive);
>> +        XivePresenterClass *xpc = XIVE_PRESENTER_GET_CLASS(xptr);
>> +        int count;
>> +
>> +        count = xpc->match_nvt(xptr, format, nvt_blk, nvt_idx, cam_ignore,
>> +                               priority, logic_serv, match);
>> +
>> +        if (count < 0) {
>> +            return count;
>> +        }
>> +
>> +        total_count += count;
>> +    }
>> +
>> +    return total_count;
>> +}
>> +
>>  static void pnv_machine_power8_class_init(ObjectClass *oc, void *data)
>>  {
>>      MachineClass *mc = MACHINE_CLASS(oc);
>> @@ -1953,6 +2029,7 @@ static void pnv_machine_power10_class_init(ObjectClass *oc, void *data)
>>  {
>>      MachineClass *mc = MACHINE_CLASS(oc);
>>      PnvMachineClass *pmc = PNV_MACHINE_CLASS(oc);
>> +    XiveFabricClass *xfc = XIVE_FABRIC_CLASS(oc);
>>      static const char compat[] = "qemu,powernv10\0ibm,powernv";
>>  
>>      mc->desc = "IBM PowerNV (Non-Virtualized) POWER10";
>> @@ -1961,6 +2038,8 @@ static void pnv_machine_power10_class_init(ObjectClass *oc, void *data)
>>      pmc->compat = compat;
>>      pmc->compat_size = sizeof(compat);
>>      pmc->dt_power_mgt = pnv_dt_power_mgt;
>> +
>> +    xfc->match_nvt = pnv10_xive_match_nvt;
>>  }
>>  
>>  static bool pnv_machine_get_hb(Object *obj, Error **errp)
>> @@ -2074,6 +2153,10 @@ static const TypeInfo types[] = {
>>          .name          = MACHINE_TYPE_NAME("powernv10"),
>>          .parent        = TYPE_PNV_MACHINE,
>>          .class_init    = pnv_machine_power10_class_init,
>> +        .interfaces = (InterfaceInfo[]) {
>> +            { TYPE_XIVE_FABRIC },
>> +            { },
>> +        },
>>      },
>>      {
>>          .name          = MACHINE_TYPE_NAME("powernv9"),
>> diff --git a/hw/intc/Makefile.objs b/hw/intc/Makefile.objs
>> index 3af575aeb87d..b879a6eb3c3a 100644
>> --- a/hw/intc/Makefile.objs
>> +++ b/hw/intc/Makefile.objs
>> @@ -40,7 +40,7 @@ obj-$(CONFIG_XICS_KVM) += xics_kvm.o
>>  obj-$(CONFIG_XIVE) += xive.o xive2.o
>>  obj-$(CONFIG_XIVE_SPAPR) += spapr_xive.o
>>  obj-$(CONFIG_XIVE_KVM) += spapr_xive_kvm.o
>> -obj-$(CONFIG_POWERNV) += xics_pnv.o pnv_xive.o
>> +obj-$(CONFIG_POWERNV) += xics_pnv.o pnv_xive.o pnv_xive2.o
>>  obj-$(CONFIG_ALLWINNER_A10_PIC) += allwinner-a10-pic.o
>>  obj-$(CONFIG_S390_FLIC) += s390_flic.o
>>  obj-$(CONFIG_S390_FLIC_KVM) += s390_flic_kvm.o
> 



^ permalink raw reply	[flat|nested] 25+ messages in thread

* Re: [PATCH 8/9] ppc/pnv: Add model for POWER9 PHB5 PCIe Host bridge
  2020-05-20 13:46   ` Greg Kurz
@ 2020-05-25 10:13     ` Cédric Le Goater
  0 siblings, 0 replies; 25+ messages in thread
From: Cédric Le Goater @ 2020-05-25 10:13 UTC (permalink / raw)
  To: Greg Kurz; +Cc: qemu-ppc, qemu-devel, David Gibson

On 5/20/20 3:46 PM, Greg Kurz wrote:
> I guess you mean POWER10 ?


Yes :/

Thanks,

C. 

> 
> On Wed, 13 May 2020 17:11:08 +0200
> Cédric Le Goater <clg@kaod.org> wrote:
> 
>> PHB4 and PHB5 are very similar. Use the PHB4 models with some minor
>> adjustements in a subclass for P10.
>>
>> Signed-off-by: Cédric Le Goater <clg@kaod.org>
>> ---
>>  include/hw/pci-host/pnv_phb4.h |  11 ++++
>>  include/hw/ppc/pnv.h           |   3 +
>>  include/hw/ppc/pnv_xscom.h     |   6 ++
>>  hw/pci-host/pnv_phb4_pec.c     |  44 ++++++++++++++
>>  hw/ppc/pnv.c                   | 101 +++++++++++++++++++++++++++++++++
>>  5 files changed, 165 insertions(+)
>>
>> diff --git a/include/hw/pci-host/pnv_phb4.h b/include/hw/pci-host/pnv_phb4.h
>> index c882bfd0aa23..ea3810f74066 100644
>> --- a/include/hw/pci-host/pnv_phb4.h
>> +++ b/include/hw/pci-host/pnv_phb4.h
>> @@ -227,4 +227,15 @@ typedef struct PnvPhb4PecClass {
>>      int stk_compat_size;
>>  } PnvPhb4PecClass;
>>  
>> +/*
>> + * POWER10 definitions
>> + */
>> +
>> +#define PNV_PHB5_VERSION           0x000000a500000001ull
>> +#define PNV_PHB5_DEVICE_ID         0x0652
>> +
>> +#define TYPE_PNV_PHB5_PEC "pnv-phb5-pec"
>> +#define PNV_PHB5_PEC(obj) \
>> +    OBJECT_CHECK(PnvPhb4PecState, (obj), TYPE_PNV_PHB5_PEC)
>> +
>>  #endif /* PCI_HOST_PNV_PHB4_H */
>> diff --git a/include/hw/ppc/pnv.h b/include/hw/ppc/pnv.h
>> index 86bfa2107a8c..516229a51e7b 100644
>> --- a/include/hw/ppc/pnv.h
>> +++ b/include/hw/ppc/pnv.h
>> @@ -127,6 +127,9 @@ typedef struct Pnv10Chip {
>>      uint32_t     nr_quads;
>>      PnvQuad      *quads;
>>  
>> +#define PNV10_CHIP_MAX_PEC 2
>> +    PnvPhb4PecState pecs[PNV10_CHIP_MAX_PEC];
>> +
>>  } Pnv10Chip;
>>  
>>  #define PNV10_PIR2FUSEDCORE(pir) (((pir) >> 3) & 0xf)
>> diff --git a/include/hw/ppc/pnv_xscom.h b/include/hw/ppc/pnv_xscom.h
>> index f26c5217764d..433c7b878af4 100644
>> --- a/include/hw/ppc/pnv_xscom.h
>> +++ b/include/hw/ppc/pnv_xscom.h
>> @@ -139,6 +139,12 @@ typedef struct PnvXScomInterfaceClass {
>>  #define PNV10_XSCOM_XIVE2_BASE     0x2010800
>>  #define PNV10_XSCOM_XIVE2_SIZE     0x400
>>  
>> +#define PNV10_XSCOM_PEC_NEST_BASE  0x3011800 /* index goes downwards ... */
>> +#define PNV10_XSCOM_PEC_NEST_SIZE  0x100
>> +
>> +#define PNV10_XSCOM_PEC_PCI_BASE   0x8010800 /* index goes upwards ... */
>> +#define PNV10_XSCOM_PEC_PCI_SIZE   0x200
>> +
>>  void pnv_xscom_realize(PnvChip *chip, uint64_t size, Error **errp);
>>  int pnv_dt_xscom(PnvChip *chip, void *fdt, int root_offset,
>>                   uint64_t xscom_base, uint64_t xscom_size,
>> diff --git a/hw/pci-host/pnv_phb4_pec.c b/hw/pci-host/pnv_phb4_pec.c
>> index 911d147ffd7d..869fd77b62cc 100644
>> --- a/hw/pci-host/pnv_phb4_pec.c
>> +++ b/hw/pci-host/pnv_phb4_pec.c
>> @@ -586,9 +586,53 @@ static const TypeInfo pnv_pec_stk_type_info = {
>>      }
>>  };
>>  
>> +/*
>> + * POWER10 definitions
>> + */
>> +
>> +static uint32_t pnv_phb5_pec_xscom_pci_base(PnvPhb4PecState *pec)
>> +{
>> +    return PNV10_XSCOM_PEC_PCI_BASE + 0x1000000 * pec->index;
>> +}
>> +
>> +static uint32_t pnv_phb5_pec_xscom_nest_base(PnvPhb4PecState *pec)
>> +{
>> +    /* index goes down ... */
>> +    return PNV10_XSCOM_PEC_NEST_BASE - 0x1000000 * pec->index;
>> +}
>> +
>> +static void pnv_phb5_pec_class_init(ObjectClass *klass, void *data)
>> +{
>> +    PnvPhb4PecClass *pecc = PNV_PHB4_PEC_CLASS(klass);
>> +    static const char compat[] = "ibm,power10-pbcq";
>> +    static const char stk_compat[] = "ibm,power10-phb-stack";
>> +
>> +    pecc->xscom_nest_base = pnv_phb5_pec_xscom_nest_base;
>> +    pecc->xscom_pci_base  = pnv_phb5_pec_xscom_pci_base;
>> +    pecc->xscom_nest_size = PNV10_XSCOM_PEC_NEST_SIZE;
>> +    pecc->xscom_pci_size  = PNV10_XSCOM_PEC_PCI_SIZE;
>> +    pecc->compat = compat;
>> +    pecc->compat_size = sizeof(compat);
>> +    pecc->stk_compat = stk_compat;
>> +    pecc->stk_compat_size = sizeof(stk_compat);
>> +}
>> +
>> +static const TypeInfo pnv_phb5_pec_type_info = {
>> +    .name          = TYPE_PNV_PHB5_PEC,
>> +    .parent        = TYPE_PNV_PHB4_PEC,
>> +    .instance_size = sizeof(PnvPhb4PecState),
>> +    .class_init    = pnv_phb5_pec_class_init,
>> +    .class_size    = sizeof(PnvPhb4PecClass),
>> +    .interfaces    = (InterfaceInfo[]) {
>> +        { TYPE_PNV_XSCOM_INTERFACE },
>> +        { }
>> +    }
>> +};
>> +
>>  static void pnv_pec_register_types(void)
>>  {
>>      type_register_static(&pnv_pec_type_info);
>> +    type_register_static(&pnv_phb5_pec_type_info);
>>      type_register_static(&pnv_pec_stk_type_info);
>>  }
>>  
>> diff --git a/hw/ppc/pnv.c b/hw/ppc/pnv.c
>> index fc751dd575d4..ac4bd2a17a9e 100644
>> --- a/hw/ppc/pnv.c
>> +++ b/hw/ppc/pnv.c
>> @@ -705,9 +705,17 @@ static void pnv_ipmi_bt_init(ISABus *bus, IPMIBmc *bmc, uint32_t irq)
>>  static void pnv_chip_power10_pic_print_info(PnvChip *chip, Monitor *mon)
>>  {
>>      Pnv10Chip *chip10 = PNV10_CHIP(chip);
>> +    int i, j;
>>  
>>      pnv_xive2_pic_print_info(&chip10->xive, mon);
>>      pnv_psi_pic_print_info(&chip10->psi, mon);
>> +
>> +    for (i = 0; i < PNV10_CHIP_MAX_PEC; i++) {
>> +        PnvPhb4PecState *pec = &chip10->pecs[i];
>> +        for (j = 0; j < pec->num_stacks; j++) {
>> +            pnv_phb4_pic_print_info(&pec->stacks[j].phb, mon);
>> +        }
>> +    }
>>  }
>>  
>>  static void pnv_init(MachineState *machine)
>> @@ -1607,7 +1615,10 @@ static void pnv_chip_power9_class_init(ObjectClass *klass, void *data)
>>  
>>  static void pnv_chip_power10_instance_init(Object *obj)
>>  {
>> +    PnvChip *chip = PNV_CHIP(obj);
>>      Pnv10Chip *chip10 = PNV10_CHIP(obj);
>> +    PnvChipClass *pcc = PNV_CHIP_GET_CLASS(obj);
>> +    int i;
>>  
>>      object_initialize_child(obj, "xive", &chip10->xive, sizeof(chip10->xive),
>>                              TYPE_PNV_XIVE2, &error_abort, NULL);
>> @@ -1619,6 +1630,17 @@ static void pnv_chip_power10_instance_init(Object *obj)
>>                              TYPE_PNV10_LPC, &error_abort, NULL);
>>      object_initialize_child(obj, "occ",  &chip10->occ, sizeof(chip10->occ),
>>                              TYPE_PNV10_OCC, &error_abort, NULL);
>> +
>> +    for (i = 0; i < PNV10_CHIP_MAX_PEC; i++) {
>> +        object_initialize_child(obj, "pec[*]", &chip10->pecs[i],
>> +                                sizeof(chip10->pecs[i]), TYPE_PNV_PHB5_PEC,
>> +                                &error_abort, NULL);
>> +    }
>> +
>> +    /*
>> +     * Number of PHBs is the chip default
>> +     */
>> +    chip->num_phbs = pcc->num_phbs;
>>  }
>>  
>>  
>> @@ -1648,6 +1670,77 @@ static void pnv_chip_power10_quad_realize(Pnv10Chip *chip10, Error **errp)
>>      }
>>  }
>>  
>> +static void pnv_chip_power10_phb_realize(PnvChip *chip, Error **errp)
>> +{
>> +    Pnv10Chip *chip10 = PNV10_CHIP(chip);
>> +    Error *local_err = NULL;
>> +    int i, j;
>> +    int phb_id = 0;
>> +
>> +    for (i = 0; i < PNV10_CHIP_MAX_PEC; i++) {
>> +        PnvPhb4PecState *pec = &chip10->pecs[i];
>> +        PnvPhb4PecClass *pecc = PNV_PHB4_PEC_GET_CLASS(pec);
>> +        uint32_t pec_nest_base;
>> +        uint32_t pec_pci_base;
>> +
>> +        object_property_set_int(OBJECT(pec), i, "index", &error_fatal);
>> +        /*
>> +         * PEC0 -> 3 stacks
>> +         * PEC1 -> 3 stacks
>> +         */
>> +        object_property_set_int(OBJECT(pec), 3, "num-stacks",
>> +                                &error_fatal);
>> +        object_property_set_int(OBJECT(pec), chip->chip_id, "chip-id",
>> +                                 &error_fatal);
>> +        object_property_set_link(OBJECT(pec), OBJECT(get_system_memory()),
>> +                                 "system-memory", &error_abort);
>> +        object_property_set_bool(OBJECT(pec), true, "realized", &local_err);
>> +        if (local_err) {
>> +            error_propagate(errp, local_err);
>> +            return;
>> +        }
>> +
>> +        pec_nest_base = pecc->xscom_nest_base(pec);
>> +        pec_pci_base = pecc->xscom_pci_base(pec);
>> +
>> +        pnv_xscom_add_subregion(chip, pec_nest_base, &pec->nest_regs_mr);
>> +        pnv_xscom_add_subregion(chip, pec_pci_base, &pec->pci_regs_mr);
>> +
>> +        for (j = 0; j < pec->num_stacks && phb_id < chip->num_phbs;
>> +             j++, phb_id++) {
>> +            PnvPhb4PecStack *stack = &pec->stacks[j];
>> +            Object *obj = OBJECT(&stack->phb);
>> +
>> +            object_property_set_int(obj, phb_id, "index", &error_fatal);
>> +            object_property_set_int(obj, chip->chip_id, "chip-id",
>> +                                    &error_fatal);
>> +            object_property_set_int(obj, PNV_PHB5_VERSION, "version",
>> +                                    &error_fatal);
>> +            object_property_set_int(obj, PNV_PHB5_DEVICE_ID, "device-id",
>> +                                    &error_fatal);
>> +            object_property_set_link(obj, OBJECT(stack), "stack", &error_abort);
>> +            object_property_set_bool(obj, true, "realized", &local_err);
>> +            if (local_err) {
>> +                error_propagate(errp, local_err);
>> +                return;
>> +            }
>> +            qdev_set_parent_bus(DEVICE(obj), sysbus_get_default());
>> +
>> +            /* Populate the XSCOM address space. */
>> +            pnv_xscom_add_subregion(chip,
>> +                                   pec_nest_base + 0x40 * (stack->stack_no + 1),
>> +                                   &stack->nest_regs_mr);
>> +            pnv_xscom_add_subregion(chip,
>> +                                    pec_pci_base + 0x40 * (stack->stack_no + 1),
>> +                                    &stack->pci_regs_mr);
>> +            pnv_xscom_add_subregion(chip,
>> +                                    pec_pci_base + PNV9_XSCOM_PEC_PCI_STK0 +
>> +                                    0x40 * stack->stack_no,
>> +                                    &stack->phb_regs_mr);
>> +        }
>> +    }
>> +}
>> +
>>  static void pnv_chip_power10_realize(DeviceState *dev, Error **errp)
>>  {
>>      PnvChipClass *pcc = PNV_CHIP_GET_CLASS(dev);
>> @@ -1737,6 +1830,13 @@ static void pnv_chip_power10_realize(DeviceState *dev, Error **errp)
>>      }
>>      pnv_xscom_add_subregion(chip, PNV10_XSCOM_OCC_BASE,
>>                              &chip10->occ.xscom_regs);
>> +
>> +    /* PHBs */
>> +    pnv_chip_power10_phb_realize(chip, &local_err);
>> +    if (local_err) {
>> +        error_propagate(errp, local_err);
>> +        return;
>> +    }
>>  }
>>  
>>  static uint32_t pnv_chip_power10_xscom_pcba(PnvChip *chip, uint64_t addr)
>> @@ -1763,6 +1863,7 @@ static void pnv_chip_power10_class_init(ObjectClass *klass, void *data)
>>      k->xscom_core_base = pnv_chip_power10_xscom_core_base;
>>      k->xscom_pcba = pnv_chip_power10_xscom_pcba;
>>      dc->desc = "PowerNV Chip POWER10";
>> +    k->num_phbs = 6;
>>  
>>      device_class_set_parent_realize(dc, pnv_chip_power10_realize,
>>                                      &k->parent_realize);
> 



^ permalink raw reply	[flat|nested] 25+ messages in thread

* Re: [PATCH 6/9] ppc/pnv: Add a OCC model for POWER10
  2020-05-20 14:22   ` Greg Kurz
@ 2020-05-25 11:14     ` Cédric Le Goater
  0 siblings, 0 replies; 25+ messages in thread
From: Cédric Le Goater @ 2020-05-25 11:14 UTC (permalink / raw)
  To: Greg Kurz; +Cc: qemu-ppc, qemu-devel, David Gibson

On 5/20/20 4:22 PM, Greg Kurz wrote:
> On Wed, 13 May 2020 17:11:06 +0200
> Cédric Le Goater <clg@kaod.org> wrote:
> 
>> Needs some more refinements but this model does not do much anyhow.
>>
>> Signed-off-by: Cédric Le Goater <clg@kaod.org>
>> ---
>>  include/hw/ppc/pnv.h       |  1 +
>>  include/hw/ppc/pnv_occ.h   |  2 ++
>>  include/hw/ppc/pnv_xscom.h |  3 +++
>>  hw/ppc/pnv.c               | 14 ++++++++++++++
>>  hw/ppc/pnv_occ.c           | 17 +++++++++++++++++
>>  5 files changed, 37 insertions(+)
>>
>> diff --git a/include/hw/ppc/pnv.h b/include/hw/ppc/pnv.h
>> index f318bb10add4..3ff610a9c7b5 100644
>> --- a/include/hw/ppc/pnv.h
>> +++ b/include/hw/ppc/pnv.h
>> @@ -122,6 +122,7 @@ typedef struct Pnv10Chip {
>>      PnvXive2     xive;
>>      Pnv9Psi      psi;
>>      PnvLpcController lpc;
>> +    PnvOCC       occ;
>>  } Pnv10Chip;
>>  
>>  #define PNV10_PIR2FUSEDCORE(pir) (((pir) >> 3) & 0xf)
>> diff --git a/include/hw/ppc/pnv_occ.h b/include/hw/ppc/pnv_occ.h
>> index f8d3061419dc..57cb437c9ca1 100644
>> --- a/include/hw/ppc/pnv_occ.h
>> +++ b/include/hw/ppc/pnv_occ.h
>> @@ -28,6 +28,8 @@
>>  #define PNV8_OCC(obj) OBJECT_CHECK(PnvOCC, (obj), TYPE_PNV8_OCC)
>>  #define TYPE_PNV9_OCC TYPE_PNV_OCC "-POWER9"
>>  #define PNV9_OCC(obj) OBJECT_CHECK(PnvOCC, (obj), TYPE_PNV9_OCC)
>> +#define TYPE_PNV10_OCC TYPE_PNV_OCC "-POWER10"
>> +#define PNV10_OCC(obj) OBJECT_CHECK(PnvOCC, (obj), TYPE_PNV10_OCC)
>>  
>>  #define PNV_OCC_SENSOR_DATA_BLOCK_OFFSET 0x00580000
>>  #define PNV_OCC_SENSOR_DATA_BLOCK_SIZE   0x00025800
>> diff --git a/include/hw/ppc/pnv_xscom.h b/include/hw/ppc/pnv_xscom.h
>> index 1211add3e79c..f26c5217764d 100644
>> --- a/include/hw/ppc/pnv_xscom.h
>> +++ b/include/hw/ppc/pnv_xscom.h
>> @@ -133,6 +133,9 @@ typedef struct PnvXScomInterfaceClass {
>>  #define PNV10_XSCOM_PSIHB_BASE     0x3011D00
>>  #define PNV10_XSCOM_PSIHB_SIZE     0x100
>>  
>> +#define PNV10_XSCOM_OCC_BASE       PNV_XSCOM_OCC_BASE
>> +#define PNV10_XSCOM_OCC_SIZE       0x8000
>> +
> 
> I don't understand why you explicitly reuse the P8/P9 definition
> for the base address and you open-code the size which is the
> same as P9... 

I will clean that up. 

>>  #define PNV10_XSCOM_XIVE2_BASE     0x2010800
>>  #define PNV10_XSCOM_XIVE2_SIZE     0x400
>>  
>> diff --git a/hw/ppc/pnv.c b/hw/ppc/pnv.c
>> index 73c40ce3209f..9f1698a74467 100644
>> --- a/hw/ppc/pnv.c
>> +++ b/hw/ppc/pnv.c
>> @@ -1617,6 +1617,8 @@ static void pnv_chip_power10_instance_init(Object *obj)
>>                              TYPE_PNV10_PSI, &error_abort, NULL);
>>      object_initialize_child(obj, "lpc",  &chip10->lpc, sizeof(chip10->lpc),
>>                              TYPE_PNV10_LPC, &error_abort, NULL);
>> +    object_initialize_child(obj, "occ",  &chip10->occ, sizeof(chip10->occ),
>> +                            TYPE_PNV10_OCC, &error_abort, NULL);
>>  }
>>  
>>  static void pnv_chip_power10_realize(DeviceState *dev, Error **errp)
>> @@ -1690,6 +1692,18 @@ static void pnv_chip_power10_realize(DeviceState *dev, Error **errp)
>>  
>>      chip->dt_isa_nodename = g_strdup_printf("/lpcm-opb@%" PRIx64 "/lpc@0",
>>                                              (uint64_t) PNV10_LPCM_BASE(chip));
>> +
>> +    /* Create the simplified OCC model */
>> +    object_property_set_link(OBJECT(&chip10->occ), OBJECT(&chip10->psi), "psi",
>> +                             &error_abort);
>> +    object_property_set_bool(OBJECT(&chip10->occ), true, "realized",
>> +                             &local_err);
>> +    if (local_err) {
>> +        error_propagate(errp, local_err);
>> +        return;
>> +    }
>> +    pnv_xscom_add_subregion(chip, PNV10_XSCOM_OCC_BASE,
>> +                            &chip10->occ.xscom_regs);
>>  }
>>  
>>  static uint32_t pnv_chip_power10_xscom_pcba(PnvChip *chip, uint64_t addr)
>> diff --git a/hw/ppc/pnv_occ.c b/hw/ppc/pnv_occ.c
>> index 5a716c256edc..7a2aea8fb9d1 100644
>> --- a/hw/ppc/pnv_occ.c
>> +++ b/hw/ppc/pnv_occ.c
>> @@ -249,6 +249,22 @@ static const TypeInfo pnv_occ_power9_type_info = {
>>      .class_init    = pnv_occ_power9_class_init,
>>  };
>>  
>> +static void pnv_occ_power10_class_init(ObjectClass *klass, void *data)
>> +{
>> +    PnvOCCClass *poc = PNV_OCC_CLASS(klass);
>> +
>> +    poc->xscom_size = PNV9_XSCOM_OCC_SIZE;
> 
> Shouldn't it be PNV10_XSCOM_OCC_SIZE since you define it in
> include/hw/ppc/pnv_xscom.h above ?
> 
>> +    poc->xscom_ops = &pnv_occ_power9_xscom_ops;
>> +    poc->psi_irq = PSIHB9_IRQ_OCC;
> 
> Using P9 bits in P10 code might be a little confusing for the
> casual reader. 

The HW interface has not changed between P9 and P10. That's all.

C. 

> A comment could be helpful until you come up
> with the refinements mentioned in the changelog.
>> +}
>> +
>> +static const TypeInfo pnv_occ_power10_type_info = {
>> +    .name          = TYPE_PNV10_OCC,
>> +    .parent        = TYPE_PNV_OCC,
>> +    .instance_size = sizeof(PnvOCC),
>> +    .class_init    = pnv_occ_power10_class_init,
>> +};
>> +
>>  static void pnv_occ_realize(DeviceState *dev, Error **errp)
>>  {
>>      PnvOCC *occ = PNV_OCC(dev);
>> @@ -297,6 +313,7 @@ static void pnv_occ_register_types(void)
>>      type_register_static(&pnv_occ_type_info);
>>      type_register_static(&pnv_occ_power8_type_info);
>>      type_register_static(&pnv_occ_power9_type_info);
>> +    type_register_static(&pnv_occ_power10_type_info);
>>  }
>>  
>>  type_init(pnv_occ_register_types);
> 



^ permalink raw reply	[flat|nested] 25+ messages in thread

* Re: [PATCH 7/9] ppc/pnv: Add POWER10 quads
  2020-05-20 14:44   ` Greg Kurz
@ 2020-05-25 11:27     ` Cédric Le Goater
  0 siblings, 0 replies; 25+ messages in thread
From: Cédric Le Goater @ 2020-05-25 11:27 UTC (permalink / raw)
  To: Greg Kurz; +Cc: qemu-ppc, qemu-devel, David Gibson

On 5/20/20 4:44 PM, Greg Kurz wrote:
> On Wed, 13 May 2020 17:11:07 +0200
> Cédric Le Goater <clg@kaod.org> wrote:
> 
>> Still needs some refinements on the XSCOM registers.
>>
>> Signed-off-by: Cédric Le Goater <clg@kaod.org>
>> ---
>>  include/hw/ppc/pnv.h |  4 ++++
>>  hw/ppc/pnv.c         | 33 +++++++++++++++++++++++++++++++++
>>  2 files changed, 37 insertions(+)
>>
>> diff --git a/include/hw/ppc/pnv.h b/include/hw/ppc/pnv.h
>> index 3ff610a9c7b5..86bfa2107a8c 100644
>> --- a/include/hw/ppc/pnv.h
>> +++ b/include/hw/ppc/pnv.h
>> @@ -123,6 +123,10 @@ typedef struct Pnv10Chip {
>>      Pnv9Psi      psi;
>>      PnvLpcController lpc;
>>      PnvOCC       occ;
>> +
>> +    uint32_t     nr_quads;
>> +    PnvQuad      *quads;
>> +
>>  } Pnv10Chip;
>>  
>>  #define PNV10_PIR2FUSEDCORE(pir) (((pir) >> 3) & 0xf)
>> diff --git a/hw/ppc/pnv.c b/hw/ppc/pnv.c
>> index 9f1698a74467..fc751dd575d4 100644
>> --- a/hw/ppc/pnv.c
>> +++ b/hw/ppc/pnv.c
>> @@ -1621,6 +1621,33 @@ static void pnv_chip_power10_instance_init(Object *obj)
>>                              TYPE_PNV10_OCC, &error_abort, NULL);
>>  }
>>  
>> +
>> +static void pnv_chip_power10_quad_realize(Pnv10Chip *chip10, Error **errp)
>> +{
>> +    PnvChip *chip = PNV_CHIP(chip10);
>> +    int i;
>> +
>> +    chip10->nr_quads = DIV_ROUND_UP(chip->nr_cores, 4);
>> +    chip10->quads = g_new0(PnvQuad, chip10->nr_quads);
>> +
>> +    for (i = 0; i < chip10->nr_quads; i++) {
>> +        char eq_name[32];
>> +        PnvQuad *eq = &chip10->quads[i];
>> +        PnvCore *pnv_core = chip->cores[i * 4];
>> +        int core_id = CPU_CORE(pnv_core)->core_id;
>> +
>> +        snprintf(eq_name, sizeof(eq_name), "eq[%d]", core_id);
>> +        object_initialize_child(OBJECT(chip), eq_name, eq, sizeof(*eq),
>> +                                TYPE_PNV_QUAD, &error_fatal, NULL);
>> +
>> +        object_property_set_int(OBJECT(eq), core_id, "id", &error_fatal);
>> +        object_property_set_bool(OBJECT(eq), true, "realized", &error_fatal);
>> +
>> +        pnv_xscom_add_subregion(chip, PNV10_XSCOM_EQ_BASE(eq->id),
>> +                                &eq->xscom_regs);
>> +    }
>> +}
> 
> So, this function is mostly identical to the P9 variant, except the xscom
> offset. Unless the refinements envisioned in the changelog bring substantial
> change, I'd suggest to move this to a common helper and call it from dedicated
> P9 and P10 realize functions.

yes. I agree.

Thanks,

C. 

> 
>> +
>>  static void pnv_chip_power10_realize(DeviceState *dev, Error **errp)
>>  {
>>      PnvChipClass *pcc = PNV_CHIP_GET_CLASS(dev);
>> @@ -1642,6 +1669,12 @@ static void pnv_chip_power10_realize(DeviceState *dev, Error **errp)
>>          return;
>>      }
>>  
>> +    pnv_chip_power10_quad_realize(chip10, &local_err);
>> +    if (local_err) {
>> +        error_propagate(errp, local_err);
>> +        return;
>> +    }
>> +
>>      /* XIVE2 interrupt controller (POWER10) */
>>      object_property_set_int(OBJECT(&chip10->xive), PNV10_XIVE2_IC_BASE(chip),
>>                              "ic-bar", &error_fatal);
> 



^ permalink raw reply	[flat|nested] 25+ messages in thread

* Re: [PATCH 3/9] ppc/xive2: Introduce a XIVE2 core framework
  2020-05-20 16:40   ` Greg Kurz
@ 2020-05-25 11:41     ` Cédric Le Goater
  0 siblings, 0 replies; 25+ messages in thread
From: Cédric Le Goater @ 2020-05-25 11:41 UTC (permalink / raw)
  To: Greg Kurz; +Cc: qemu-ppc, qemu-devel, David Gibson

On 5/20/20 6:40 PM, Greg Kurz wrote:
> On Wed, 13 May 2020 17:11:03 +0200
> Cédric Le Goater <clg@kaod.org> wrote:
> 
>> The XIVE2 interrupt controller of the POWER10 processor follows the
>> same logic than on POWER9 but the HW interface has been largely
>> reviewed. The interrupt controller has a new register interface,
>> different BARs, extra VSDs, these will be described when we add the
>> device model for the baremetal machine.
>>
>> The XIVE internal structures for the EAS, END, NVT have a different
>> layout which is a problem for the current core XIVE framework. To
>> avoid adding too much complexity in the XIVE models, a new XIVE2 core
>> framework is introduced. It duplicates the models which are closely
>> linked to the XIVE internal structures : Xive2Router and Xive2ENDSource
>> and reuses the XiveSource, XivePresenter, XiveTCTX models, as they are
>> more generic.
>>
>> Signed-off-by: Cédric Le Goater <clg@kaod.org>
>> ---
>>  include/hw/ppc/xive2.h      |  84 +++++
>>  include/hw/ppc/xive2_regs.h | 198 +++++++++++
>>  hw/intc/xive2.c             | 669 ++++++++++++++++++++++++++++++++++++
>>  hw/intc/Makefile.objs       |   2 +-
>>  4 files changed, 952 insertions(+), 1 deletion(-)
>>  create mode 100644 include/hw/ppc/xive2.h
>>  create mode 100644 include/hw/ppc/xive2_regs.h
>>  create mode 100644 hw/intc/xive2.c
>>
>> diff --git a/include/hw/ppc/xive2.h b/include/hw/ppc/xive2.h
>> new file mode 100644
>> index 000000000000..cb15487efdb6
>> --- /dev/null
>> +++ b/include/hw/ppc/xive2.h
>> @@ -0,0 +1,84 @@
>> +/*
>> + * QEMU PowerPC XIVE2 interrupt controller model  (POWER10)
>> + *
>> + * Copyright (c) 2019-2020, IBM Corporation.
>> + *
>> + * This code is licensed under the GPL version 2 or later. See the
>> + * COPYING file in the top-level directory.
>> + *
>> + */
>> +
>> +#ifndef PPC_XIVE2_H
>> +#define PPC_XIVE2_H
>> +
>> +#include "hw/ppc/xive2_regs.h"
>> +
>> +/*
>> + * XIVE2 Router (POWER10)
>> + */
>> +typedef struct Xive2Router {
>> +    SysBusDevice    parent;
>> +
>> +    XiveFabric *xfb;
>> +} Xive2Router;
>> +
>> +#define TYPE_XIVE2_ROUTER TYPE_XIVE_ROUTER "2"
>> +#define XIVE2_ROUTER(obj)                                \
>> +    OBJECT_CHECK(Xive2Router, (obj), TYPE_XIVE2_ROUTER)
>> +#define XIVE2_ROUTER_CLASS(klass)                                        \
>> +    OBJECT_CLASS_CHECK(Xive2RouterClass, (klass), TYPE_XIVE2_ROUTER)
>> +#define XIVE2_ROUTER_GET_CLASS(obj)                              \
>> +    OBJECT_GET_CLASS(Xive2RouterClass, (obj), TYPE_XIVE2_ROUTER)
>> +
>> +typedef struct Xive2RouterClass {
>> +    SysBusDeviceClass parent;
>> +
>> +    /* XIVE table accessors */
>> +    int (*get_eas)(Xive2Router *xrtr, uint8_t eas_blk, uint32_t eas_idx,
>> +                   Xive2Eas *eas);
>> +    int (*get_end)(Xive2Router *xrtr, uint8_t end_blk, uint32_t end_idx,
>> +                   Xive2End *end);
>> +    int (*write_end)(Xive2Router *xrtr, uint8_t end_blk, uint32_t end_idx,
>> +                     Xive2End *end, uint8_t word_number);
>> +    int (*get_nvp)(Xive2Router *xrtr, uint8_t nvt_blk, uint32_t nvt_idx,
>> +                   Xive2Nvp *nvt);
>> +    int (*write_nvp)(Xive2Router *xrtr, uint8_t nvt_blk, uint32_t nvt_idx,
>> +                     Xive2Nvp *nvt, uint8_t word_number);
> 
> The mix of nvt and nvp wording is confusing. I suggest you drop the
> nvt_ prefix for the block and index arguments, and rename the nvt
> argument to nvp.

yes. These is a leftover.

> 
>> +    uint8_t (*get_block_id)(Xive2Router *xrtr);
> 
> $ for i in get_eas get_end write_end get_nv[tp] write_nv[tp] get_block_id; do \
>      echo == $i ==; git grep -E "$i[[:space:]]+= " hw/intc ; \
>   done
> == get_eas ==
> hw/intc/pnv_xive.c:    xrc->get_eas = pnv_xive_get_eas;
> hw/intc/pnv_xive2.c:    xrc->get_eas   = pnv_xive2_get_eas;
> hw/intc/spapr_xive.c:    xrc->get_eas = spapr_xive_get_eas;
> == get_end ==
> hw/intc/pnv_xive.c:    xrc->get_end = pnv_xive_get_end;
> hw/intc/pnv_xive2.c:    xrc->get_end   = pnv_xive2_get_end;
> hw/intc/spapr_xive.c:    xrc->get_end = spapr_xive_get_end;
> == write_end ==
> hw/intc/pnv_xive.c:    xrc->write_end = pnv_xive_write_end;
> hw/intc/pnv_xive2.c:    xrc->write_end = pnv_xive2_write_end;
> hw/intc/spapr_xive.c:    xrc->write_end = spapr_xive_write_end;
> == get_nv[tp] ==
> hw/intc/pnv_xive.c:    xrc->get_nvt = pnv_xive_get_nvt;
> hw/intc/pnv_xive2.c:    xrc->get_nvp   = pnv_xive2_get_nvp;
> hw/intc/spapr_xive.c:    xrc->get_nvt = spapr_xive_get_nvt;
> == write_nv[tp] ==
> hw/intc/pnv_xive.c:    xrc->write_nvt = pnv_xive_write_nvt;
> hw/intc/pnv_xive2.c:    xrc->write_nvp = pnv_xive2_write_nvp;
> hw/intc/spapr_xive.c:    xrc->write_nvt = spapr_xive_write_nvt;
> == get_block_id ==
> hw/intc/pnv_xive.c:    xrc->get_block_id = pnv_xive_get_block_id;
> hw/intc/pnv_xive2.c:    xrc->get_block_id = pnv_xive2_get_block_id;
> hw/intc/spapr_xive.c:    xrc->get_block_id = spapr_xive_get_block_id;
> 
> So I guess you envision spapr variants for these callbacks ? 

the XIVE spapr interface is not tied to the HW architecture. We will use 
the XIVE1 models under the hood in QEMU for the P10 compat pseries machines.
 
>> +} Xive2RouterClass;
>> +
>> +int xive2_router_get_eas(Xive2Router *xrtr, uint8_t eas_blk, uint32_t eas_idx,
>> +                        Xive2Eas *eas);
>> +int xive2_router_get_end(Xive2Router *xrtr, uint8_t end_blk, uint32_t end_idx,
>> +                        Xive2End *end);
>> +int xive2_router_write_end(Xive2Router *xrtr, uint8_t end_blk, uint32_t end_idx,
>> +                          Xive2End *end, uint8_t word_number);
>> +int xive2_router_get_nvp(Xive2Router *xrtr, uint8_t nvt_blk, uint32_t nvt_idx,
>> +                        Xive2Nvp *nvt);
>> +int xive2_router_write_nvp(Xive2Router *xrtr, uint8_t nvt_blk, uint32_t nvt_idx,
>> +                          Xive2Nvp *nvt, uint8_t word_number);
>> +
> 
> Same remark as above.
> 
>> +void xive2_router_notify(XiveNotifier *xn, uint32_t lisn);
>> +
>> +/*
>> + * XIVE2 END ESBs  (POWER10)
>> + */
>> +
>> +#define TYPE_XIVE2_END_SOURCE TYPE_XIVE_END_SOURCE "2"
>> +#define XIVE2_END_SOURCE(obj) \
>> +    OBJECT_CHECK(Xive2EndSource, (obj), TYPE_XIVE2_END_SOURCE)
>> +
>> +typedef struct Xive2EndSource {
>> +    DeviceState parent;
>> +
>> +    uint32_t        nr_ends;
>> +
>> +    /* ESB memory region */
>> +    uint32_t        esb_shift;
>> +    MemoryRegion    esb_mmio;
>> +
>> +    Xive2Router     *xrtr;
>> +} Xive2EndSource;
>> +
>> +
>> +#endif /* PPC_XIVE2_H */
>> diff --git a/include/hw/ppc/xive2_regs.h b/include/hw/ppc/xive2_regs.h
>> new file mode 100644
>> index 000000000000..7440c44d4a3e
>> --- /dev/null
>> +++ b/include/hw/ppc/xive2_regs.h
>> @@ -0,0 +1,198 @@
>> +/*
>> + * QEMU PowerPC XIVE2 internal structure definitions (POWER10)
>> + *
>> + * Copyright (c) 2019-2020, IBM Corporation.
>> + *
>> + * This code is licensed under the GPL version 2 or later. See the
>> + * COPYING file in the top-level directory.
>> + */
>> +
>> +#ifndef PPC_XIVE2_REGS_H
>> +#define PPC_XIVE2_REGS_H
>> +
>> +/*
>> + * Thread Interrupt Management Area
> 
> Maybe add (TIMA) for consistency with the other definitions.

ok.

> 
>> + *
>> + * In Gen1 mode (P9 compat mode) word 2 is the same. However in Gen2
>> + * mode (P10), the CAM line is slightly different as the VP space was
>> + * increased.
>> + */
>> +#define   TM2_QW0W2_VU           PPC_BIT32(0)
>> +#define   TM2_QW0W2_LOGIC_SERV   PPC_BITMASK32(4, 31)
>> +#define   TM2_QW1W2_VO           PPC_BIT32(0)
>> +#define   TM2_QW1W2_OS_CAM       PPC_BITMASK32(4, 31)
>> +#define   TM2_QW2W2_VP           PPC_BIT32(0)
>> +#define   TM2_QW2W2_POOL_CAM     PPC_BITMASK32(4, 31)
>> +#define   TM2_QW3W2_VT           PPC_BIT32(0)
>> +#define   TM2_QW3W2_LP           PPC_BIT32(6)
>> +#define   TM2_QW3W2_LE           PPC_BIT32(7)
>> +
>> +/*
>> + * Event Assignment Structure (EAS)
>> + */
>> +
>> +typedef struct Xive2Eas {
>> +        uint64_t       w;
>> +#define EAS2_VALID                 PPC_BIT(0)
>> +#define EAS2_END_BLOCK             PPC_BITMASK(4, 7) /* Destination EQ block# */
>> +#define EAS2_END_INDEX             PPC_BITMASK(8, 31) /* Destination EQ index */
>> +#define EAS2_MASKED                PPC_BIT(32) /* Masked                 */
>> +#define EAS2_END_DATA              PPC_BITMASK(33, 63) /* written to the EQ */
>> +} Xive2Eas;
>> +
>> +#define xive2_eas_is_valid(eas)   (be64_to_cpu((eas)->w) & EAS2_VALID)
>> +#define xive2_eas_is_masked(eas)  (be64_to_cpu((eas)->w) & EAS2_MASKED)
>> +
>> +void xive2_eas_pic_print_info(Xive2Eas *eas, uint32_t lisn, Monitor *mon);
>> +
>> +/*
>> + * Event Notifification Descriptor (END)
>> + */
>> +
>> +typedef struct Xive2End {
>> +        uint32_t       w0;
>> +#define END2_W0_VALID              PPC_BIT32(0) /* "v" bit */
>> +#define END2_W0_ENQUEUE            PPC_BIT32(5) /* "q" bit */
>> +#define END2_W0_UCOND_NOTIFY       PPC_BIT32(6) /* "n" bit */
>> +#define END2_W0_SILENT_ESCALATE    PPC_BIT32(7) /* "s" bit */
>> +#define END2_W0_BACKLOG            PPC_BIT32(8) /* "b" bit */
>> +#define END2_W0_PRECL_ESC_CTL      PPC_BIT32(9) /* "p" bit */
>> +#define END2_W0_UNCOND_ESCALATE    PPC_BIT32(10) /* "u" bit */
>> +#define END2_W0_ESCALATE_CTL       PPC_BIT32(11) /* "e" bit */
>> +#define END2_W0_ADAPTIVE_ESC       PPC_BIT32(12) /* "a" bit */
>> +#define END2_W0_ESCALATE_END       PPC_BIT32(13) /* "N" bit */
>> +#define END2_W0_FIRMARE1           PPC_BIT32(16) /* Owned by FW */
>> +#define END2_W0_FIRMARE2           PPC_BIT32(17) /* Owned by FW */
>> +#define END2_W0_AEC_SIZE           PPC_BITMASK32(18, 19)
>> +#define END2_W0_AEG_SIZE           PPC_BITMASK32(20, 23)
>> +#define END2_W0_EQ_VG_PREDICT      PPC_BITMASK32(24, 31) /* Owned by HW */
>> +        uint32_t       w1;
>> +#define END2_W1_ESn                PPC_BITMASK32(0, 1)
>> +#define END2_W1_ESn_P              PPC_BIT32(0)
>> +#define END2_W1_ESn_Q              PPC_BIT32(1)
>> +#define END2_W1_ESe                PPC_BITMASK32(2, 3)
>> +#define END2_W1_ESe_P              PPC_BIT32(2)
>> +#define END2_W1_ESe_Q              PPC_BIT32(3)
>> +#define END2_W1_GEN_FLIPPED        PPC_BIT32(8)
>> +#define END2_W1_GENERATION         PPC_BIT32(9)
>> +#define END2_W1_PAGE_OFF           PPC_BITMASK32(10, 31)
>> +        uint32_t       w2;
>> +#define END2_W2_RESERVED           PPC_BITMASK32(4, 7)
>> +#define END2_W2_EQ_ADDR_HI         PPC_BITMASK32(8, 31)
>> +        uint32_t       w3;
>> +#define END2_W3_EQ_ADDR_LO         PPC_BITMASK32(0, 24)
>> +#define END2_W3_QSIZE              PPC_BITMASK32(28, 31)
>> +        uint32_t       w4;
>> +#define END2_W4_END_BLOCK          PPC_BITMASK32(4, 7)
>> +#define END2_W4_ESC_END_INDEX      PPC_BITMASK32(8, 31)
>> +#define END2_W4_ESB_BLOCK          PPC_BITMASK32(0, 3)
>> +#define END2_W4_ESC_ESB_INDEX      PPC_BITMASK32(4, 31)
>> +        uint32_t       w5;
>> +#define END2_W5_ESC_END_DATA       PPC_BITMASK32(1, 31)
>> +        uint32_t       w6;
>> +#define END2_W6_FORMAT_BIT         PPC_BIT32(0)
>> +#define END2_W6_IGNORE             PPC_BIT32(1)
>> +#define END2_W6_VP_BLOCK           PPC_BITMASK32(4, 7)
>> +#define END2_W6_VP_OFFSET          PPC_BITMASK32(8, 31)
>> +#define END2_W6_VP_OFFSET_GEN1     PPC_BITMASK32(13, 31)
>> +        uint32_t       w7;
>> +#define END2_W7_TOPO               PPC_BITMASK32(0, 3) /* Owned by HW */
>> +#define END2_W7_F0_PRIORITY        PPC_BITMASK32(8, 15)
>> +#define END2_W7_F1_LOG_SERVER_ID   PPC_BITMASK32(4, 31)
>> +} Xive2End;
>> +
>> +#define xive2_end_is_valid(end)    (be32_to_cpu((end)->w0) & END2_W0_VALID)
>> +#define xive2_end_is_enqueue(end)  (be32_to_cpu((end)->w0) & END2_W0_ENQUEUE)
>> +#define xive2_end_is_notify(end)                \
>> +    (be32_to_cpu((end)->w0) & END2_W0_UCOND_NOTIFY)
>> +#define xive2_end_is_backlog(end)  (be32_to_cpu((end)->w0) & END2_W0_BACKLOG)
>> +#define xive2_end_is_escalate(end)                      \
>> +    (be32_to_cpu((end)->w0) & END2_W0_ESCALATE_CTL)
>> +#define xive2_end_is_uncond_escalation(end)              \
>> +    (be32_to_cpu((end)->w0) & END2_W0_UNCOND_ESCALATE)
>> +#define xive2_end_is_silent_escalation(end)              \
>> +    (be32_to_cpu((end)->w0) & END2_W0_SILENT_ESCALATE)
>> +#define xive2_end_is_escalate_end(end)              \
>> +    (be32_to_cpu((end)->w0) & END2_W0_ESCALATE_END)
>> +
>> +static inline uint64_t xive2_end_qaddr(Xive2End *end)
>> +{
>> +    return ((uint64_t) be32_to_cpu(end->w2) & END2_W2_EQ_ADDR_HI) << 32 |
>> +        (be32_to_cpu(end->w3) & END2_W3_EQ_ADDR_LO);
>> +}
>> +
>> +void xive2_end_pic_print_info(Xive2End *end, uint32_t end_idx, Monitor *mon);
>> +void xive2_end_queue_pic_print_info(Xive2End *end, uint32_t width,
>> +                                    Monitor *mon);
>> +void xive2_end_eas_pic_print_info(Xive2End *end, uint32_t end_idx,
>> +                                   Monitor *mon);
>> +
>> +/*
>> + * Notification Virtual Processor (NVP)
>> + */
>> +typedef struct Xive2Nvp {
>> +        uint32_t       w0;
>> +#define NVP2_W0_VALID              PPC_BIT32(0)
>> +#define NVP2_W0_ESC_END            PPC_BIT32(25) /* 'N' bit 0:ESB  1:END */
>> +        uint32_t       w1;
>> +        uint32_t       w2;
>> +#define NVP2_W2_CPPR               PPC_BITMASK32(0, 7)
>> +#define NVP2_W2_IPB                PPC_BITMASK32(8, 15)
>> +#define NVP2_W2_LSMFB              PPC_BITMASK32(16, 23)
>> +        uint32_t       w3;
>> +        uint32_t       w4;
>> +#define NVP2_W4_ESC_ESB_BLOCK      PPC_BITMASK32(0, 3)  /* N:0 */
>> +#define NVP2_W4_ESC_ESB_INDEX      PPC_BITMASK32(4, 31) /* N:0 */
>> +#define NVP2_W4_ESC_END_BLOCK      PPC_BITMASK32(4, 7)  /* N:1 */
>> +#define NVP2_W4_ESC_END_INDEX      PPC_BITMASK32(8, 31) /* N:1 */
>> +        uint32_t       w5;
>> +#define NVP2_W5_PSIZE              PPC_BITMASK32(0, 1)
>> +#define NVP2_W5_VP_END_BLOCK       PPC_BITMASK32(4, 7)
>> +#define NVP2_W5_VP_END_INDEX       PPC_BITMASK32(8, 31)
>> +        uint32_t       w6;
>> +        uint32_t       w7;
>> +} Xive2Nvp;
>> +
>> +#define xive2_nvp_is_valid(nvp)    (be32_to_cpu((nvp)->w0) & NVP2_W0_VALID)
>> +#define xive2_nvp_is_hw(nvp)       (be32_to_cpu((nvp)->w0) & NVP2_W0_HW)
>> +#define xive2_nvp_is_co(nvp)       (be32_to_cpu((nvp)->w1) & NVP2_W1_CO)
>> +
>> +/*
>> + * The VP number space in a block is defined by the END2_W6_VP_OFFSET
>> + * field of the XIVE END. When running in Gen1 mode (P9 compat mode),
>> + * the VP space is reduced to (1 << 19) VPs per block
>> + */
>> +#define XIVE2_NVP_SHIFT              24
>> +#define XIVE2_NVP_COUNT              (1 << XIVE2_NVP_SHIFT)
>> +
>> +static inline uint32_t xive2_nvp_cam_line(uint8_t nvp_blk, uint32_t nvp_idx)
>> +{
>> +    return (nvp_blk << XIVE2_NVP_SHIFT) | nvp_idx;
>> +}
>> +
>> +static inline uint32_t xive2_nvp_idx(uint32_t cam_line)
>> +{
>> +    return cam_line & ((1 << XIVE2_NVP_SHIFT) - 1);
>> +}
>> +
>> +static inline uint32_t xive2_nvp_blk(uint32_t cam_line)
>> +{
>> +    return (cam_line >> XIVE2_NVP_SHIFT) & 0xf;
>> +}
>> +
>> +/*
>> + * Notification Virtual Group or Crowd (NVG/NVC)
>> + */
>> +typedef struct Xive2Nvgc {
>> +        uint32_t        w0;
>> +#define NVGC2_W0_VALID             PPC_BIT32(0)
>> +        uint32_t        w1;
>> +        uint32_t        w2;
>> +        uint32_t        w3;
>> +        uint32_t        w4;
>> +        uint32_t        w5;
>> +        uint32_t        w6;
>> +        uint32_t        w7;
>> +} Xive2Nvgc;
>> +
>> +#endif /* PPC_XIVE2_REGS_H */
>> diff --git a/hw/intc/xive2.c b/hw/intc/xive2.c
>> new file mode 100644
>> index 000000000000..15ea04cf1822
>> --- /dev/null
>> +++ b/hw/intc/xive2.c
>> @@ -0,0 +1,669 @@
>> +/*
>> + * QEMU PowerPC XIVE2 interrupt controller model (POWER10)
>> + *
>> + * Copyright (c) 2019-2020, IBM Corporation..
>> + *
>> + * This code is licensed under the GPL version 2 or later. See the
>> + * COPYING file in the top-level directory.
>> + */
>> +
>> +#include "qemu/osdep.h"
>> +#include "qemu/log.h"
>> +#include "qemu/module.h"
>> +#include "qapi/error.h"
>> +#include "target/ppc/cpu.h"
>> +#include "sysemu/cpus.h"
>> +#include "sysemu/dma.h"
>> +#include "hw/qdev-properties.h"
>> +#include "monitor/monitor.h"
>> +#include "hw/ppc/xive.h"
>> +#include "hw/ppc/xive2.h"
>> +#include "hw/ppc/xive2_regs.h"
>> +
>> +static uint8_t priority_to_ipb(uint8_t priority)
>> +{
>> +    return priority > XIVE_PRIORITY_MAX ?
>> +        0 : 1 << (XIVE_PRIORITY_MAX - priority);
>> +}
>> +
>> +void xive2_eas_pic_print_info(Xive2Eas *eas, uint32_t lisn, Monitor *mon)
>> +{
>> +    if (!xive2_eas_is_valid(eas)) {
>> +        return;
>> +    }
>> +
>> +    monitor_printf(mon, "  %08x %s end:%02x/%04x data:%08x\n",
>> +                   lisn, xive2_eas_is_masked(eas) ? "M" : " ",
>> +                   (uint8_t)  xive_get_field64(EAS2_END_BLOCK, eas->w),
>> +                   (uint32_t) xive_get_field64(EAS2_END_INDEX, eas->w),
>> +                   (uint32_t) xive_get_field64(EAS2_END_DATA, eas->w));
>> +}
>> +
>> +void xive2_end_queue_pic_print_info(Xive2End *end, uint32_t width,
>> +                                     Monitor *mon)
> 
> Indent and in many other places in this file.
> 
>> +{
>> +    uint64_t qaddr_base = xive2_end_qaddr(end);
>> +    uint32_t qsize = xive_get_field32(END2_W3_QSIZE, end->w3);
>> +    uint32_t qindex = xive_get_field32(END2_W1_PAGE_OFF, end->w1);
>> +    uint32_t qentries = 1 << (qsize + 10);
>> +    int i;
>> +
>> +    /*
>> +     * print out the [ (qindex - (width - 1)) .. (qindex + 1)] window
>> +     */
>> +    monitor_printf(mon, " [ ");
>> +    qindex = (qindex - (width - 1)) & (qentries - 1);
>> +    for (i = 0; i < width; i++) {
>> +        uint64_t qaddr = qaddr_base + (qindex << 2);
>> +        uint32_t qdata = -1;
>> +
>> +        if (dma_memory_read(&address_space_memory, qaddr, &qdata,
>> +                            sizeof(qdata))) {
>> +            qemu_log_mask(LOG_GUEST_ERROR, "XIVE: failed to read EQ @0x%"
>> +                          HWADDR_PRIx "\n", qaddr);
>> +            return;
>> +        }
>> +        monitor_printf(mon, "%s%08x ", i == width - 1 ? "^" : "",
>> +                       be32_to_cpu(qdata));
>> +        qindex = (qindex + 1) & (qentries - 1);
>> +    }
>> +    monitor_printf(mon, "]");
>> +}
>> +
>> +void xive2_end_pic_print_info(Xive2End *end, uint32_t end_idx, Monitor *mon)
>> +{
>> +    uint64_t qaddr_base = xive2_end_qaddr(end);
>> +    uint32_t qindex = xive_get_field32(END2_W1_PAGE_OFF, end->w1);
>> +    uint32_t qgen = xive_get_field32(END2_W1_GENERATION, end->w1);
>> +    uint32_t qsize = xive_get_field32(END2_W3_QSIZE, end->w3);
>> +    uint32_t qentries = 1 << (qsize + 10);
>> +
>> +    uint32_t nvp_blk = xive_get_field32(END2_W6_VP_BLOCK, end->w6);
>> +    uint32_t nvp_idx = xive_get_field32(END2_W6_VP_OFFSET, end->w6);
>> +    uint8_t priority = xive_get_field32(END2_W7_F0_PRIORITY, end->w7);
>> +    uint8_t pq;
>> +
>> +    if (!xive2_end_is_valid(end)) {
>> +        return;
>> +    }
>> +
>> +    pq = xive_get_field32(END2_W1_ESn, end->w1);
>> +
>> +    monitor_printf(mon, "  %08x %c%c %c%c%c%c%c%c%c%c prio:%d nvp:%02x/%04x",
>> +                   end_idx,
>> +                   pq & XIVE_ESB_VAL_P ? 'P' : '-',
>> +                   pq & XIVE_ESB_VAL_Q ? 'Q' : '-',
>> +                   xive2_end_is_valid(end)    ? 'v' : '-',
>> +                   xive2_end_is_enqueue(end)  ? 'q' : '-',
>> +                   xive2_end_is_notify(end)   ? 'n' : '-',
>> +                   xive2_end_is_backlog(end)  ? 'b' : '-',
>> +                   xive2_end_is_escalate(end) ? 'e' : '-',
>> +                   xive2_end_is_escalate_end(end) ? 'N' : '-',
>> +                   xive2_end_is_uncond_escalation(end)   ? 'u' : '-',
>> +                   xive2_end_is_silent_escalation(end)   ? 's' : '-',
>> +                   priority, nvp_blk, nvp_idx);
>> +
>> +    if (qaddr_base) {
>> +        monitor_printf(mon, " eq:@%08"PRIx64"% 6d/%5d ^%d",
>> +                       qaddr_base, qindex, qentries, qgen);
>> +        xive2_end_queue_pic_print_info(end, 6, mon);
>> +    }
>> +    monitor_printf(mon, "\n");
>> +}
>> +
>> +void xive2_end_eas_pic_print_info(Xive2End *end, uint32_t end_idx,
>> +                                   Monitor *mon)
>> +{
>> +    Xive2Eas *eas = (Xive2Eas *) &end->w4;
>> +    uint8_t pq;
>> +
>> +    if (!xive2_end_is_escalate(end)) {
>> +        return;
>> +    }
>> +
>> +    pq = xive_get_field32(END2_W1_ESe, end->w1);
>> +
>> +    monitor_printf(mon, "  %08x %c%c %c%c end:%02x/%04x data:%08x\n",
>> +                   end_idx,
>> +                   pq & XIVE_ESB_VAL_P ? 'P' : '-',
>> +                   pq & XIVE_ESB_VAL_Q ? 'Q' : '-',
>> +                   xive2_eas_is_valid(eas) ? 'v' : ' ',
>> +                   xive2_eas_is_masked(eas) ? 'M' : ' ',
>> +                   (uint8_t)  xive_get_field64(EAS2_END_BLOCK, eas->w),
>> +                   (uint32_t) xive_get_field64(EAS2_END_INDEX, eas->w),
>> +                   (uint32_t) xive_get_field64(EAS2_END_DATA, eas->w));
>> +}
>> +
>> +static void xive2_end_enqueue(Xive2End *end, uint32_t data)
>> +{
>> +    uint64_t qaddr_base = xive2_end_qaddr(end);
>> +    uint32_t qsize = xive_get_field32(END2_W3_QSIZE, end->w3);
>> +    uint32_t qindex = xive_get_field32(END2_W1_PAGE_OFF, end->w1);
>> +    uint32_t qgen = xive_get_field32(END2_W1_GENERATION, end->w1);
>> +
>> +    uint64_t qaddr = qaddr_base + (qindex << 2);
>> +    uint32_t qdata = cpu_to_be32((qgen << 31) | (data & 0x7fffffff));
>> +    uint32_t qentries = 1 << (qsize + 10);
>> +
>> +    if (dma_memory_write(&address_space_memory, qaddr, &qdata, sizeof(qdata))) {
>> +        qemu_log_mask(LOG_GUEST_ERROR, "XIVE: failed to write END data @0x%"
>> +                      HWADDR_PRIx "\n", qaddr);
>> +        return;
>> +    }
>> +
>> +    qindex = (qindex + 1) & (qentries - 1);
>> +    if (qindex == 0) {
>> +        qgen ^= 1;
>> +        end->w1 = xive_set_field32(END2_W1_GENERATION, end->w1, qgen);
>> +
>> +        /* TODO(PowerNV): reset GF bit on a cache watch operation */
>> +        end->w1 = xive_set_field32(END2_W1_GEN_FLIPPED, end->w1, qgen);
>> +    }
>> +    end->w1 = xive_set_field32(END2_W1_PAGE_OFF, end->w1, qindex);
>> +}
>> +/*
>> + * XIVE Router (aka. Virtualization Controller or IVRE)
>> + */
>> +
>> +int xive2_router_get_eas(Xive2Router *xrtr, uint8_t eas_blk, uint32_t eas_idx,
>> +                        Xive2Eas *eas)
>> +{
>> +    Xive2RouterClass *xrc = XIVE2_ROUTER_GET_CLASS(xrtr);
>> +
>> +    return xrc->get_eas(xrtr, eas_blk, eas_idx, eas);
>> +}
>> +
>> +int xive2_router_get_end(Xive2Router *xrtr, uint8_t end_blk, uint32_t end_idx,
>> +                        Xive2End *end)
>> +{
>> +   Xive2RouterClass *xrc = XIVE2_ROUTER_GET_CLASS(xrtr);
>> +
>> +   return xrc->get_end(xrtr, end_blk, end_idx, end);
>> +}
>> +
>> +int xive2_router_write_end(Xive2Router *xrtr, uint8_t end_blk, uint32_t end_idx,
>> +                          Xive2End *end, uint8_t word_number)
>> +{
>> +   Xive2RouterClass *xrc = XIVE2_ROUTER_GET_CLASS(xrtr);
>> +
>> +   return xrc->write_end(xrtr, end_blk, end_idx, end, word_number);
>> +}
>> +
>> +int xive2_router_get_nvp(Xive2Router *xrtr, uint8_t nvp_blk, uint32_t nvp_idx,
>> +                        Xive2Nvp *nvp)
>> +{
>> +   Xive2RouterClass *xrc = XIVE2_ROUTER_GET_CLASS(xrtr);
>> +
>> +   return xrc->get_nvp(xrtr, nvp_blk, nvp_idx, nvp);
>> +}
>> +
>> +int xive2_router_write_nvp(Xive2Router *xrtr, uint8_t nvp_blk, uint32_t nvp_idx,
>> +                        Xive2Nvp *nvp, uint8_t word_number)
>> +{
>> +   Xive2RouterClass *xrc = XIVE2_ROUTER_GET_CLASS(xrtr);
>> +
>> +   return xrc->write_nvp(xrtr, nvp_blk, nvp_idx, nvp, word_number);
>> +}
>> +
>> +static int xive2_router_get_block_id(Xive2Router *xrtr)
>> +{
>> +   Xive2RouterClass *xrc = XIVE2_ROUTER_GET_CLASS(xrtr);
>> +
>> +   return xrc->get_block_id(xrtr);
>> +}
>> +
>> +static void xive2_router_realize(DeviceState *dev, Error **errp)
>> +{
>> +    Xive2Router *xrtr = XIVE2_ROUTER(dev);
>> +
>> +    assert(xrtr->xfb);
>> +}
>> +
>> +/*
>> + * Notification using the END ESe/ESn bit (Event State Buffer for
>> + * escalation and notification). Profide futher coalescing in the
>> + * Router.
>> + */
>> +static bool xive2_router_end_es_notify(Xive2Router *xrtr, uint8_t end_blk,
>> +                                        uint32_t end_idx, Xive2End *end,
>> +                                        uint32_t end_esmask)
>> +{
>> +    uint8_t pq = xive_get_field32(end_esmask, end->w1);
>> +    bool notify = xive_esb_trigger(&pq);
>> +
>> +    if (pq != xive_get_field32(end_esmask, end->w1)) {
>> +        end->w1 = xive_set_field32(end_esmask, end->w1, pq);
>> +        xive2_router_write_end(xrtr, end_blk, end_idx, end, 1);
>> +    }
>> +
>> +    /* ESe/n[Q]=1 : end of notification */
>> +    return notify;
>> +}
>> +
>> +/*
>> + * An END trigger can come from an event trigger (IPI or HW) or from
>> + * another chip. We don't model the PowerBus but the END trigger
>> + * message has the same parameters than in the function below.
>> + */
>> +static void xive2_router_end_notify(Xive2Router *xrtr, uint8_t end_blk,
>> +                                     uint32_t end_idx, uint32_t end_data)
>> +{
>> +    Xive2End end;
>> +    uint8_t priority;
>> +    uint8_t format;
>> +    bool found;
>> +    Xive2Nvp nvp;
>> +    uint8_t nvp_blk;
>> +    uint32_t nvp_idx;
>> +
>> +    /* END cache lookup */
>> +    if (xive2_router_get_end(xrtr, end_blk, end_idx, &end)) {
>> +        qemu_log_mask(LOG_GUEST_ERROR, "XIVE: No END %x/%x\n", end_blk,
>> +                      end_idx);
>> +        return;
>> +    }
>> +
>> +    if (!xive2_end_is_valid(&end)) {
>> +        qemu_log_mask(LOG_GUEST_ERROR, "XIVE: END %x/%x is invalid\n",
>> +                      end_blk, end_idx);
>> +        return;
>> +    }
>> +
>> +    if (xive2_end_is_enqueue(&end)) {
>> +        xive2_end_enqueue(&end, end_data);
>> +        /* Enqueuing event data modifies the EQ toggle and index */
>> +        xive2_router_write_end(xrtr, end_blk, end_idx, &end, 1);
>> +    }
>> +
>> +    /*
>> +     * When the END is silent, we skip the notification part.
>> +     */
>> +    if (xive2_end_is_silent_escalation(&end)) {
>> +        goto do_escalation;
>> +    }
>> +
>> +    /*
>> +     * The W7 format depends on the F bit in W6. It defines the type
>> +     * of the notification :
>> +     *
>> +     *   F=0 : single or multiple NVP notification
>> +     *   F=1 : User level Event-Based Branch (EBB) notification, no
>> +     *         priority
>> +     */
>> +    format = xive_get_field32(END2_W6_FORMAT_BIT, end.w6);
>> +    priority = xive_get_field32(END2_W7_F0_PRIORITY, end.w7);
>> +
>> +    /* The END is masked */
>> +    if (format == 0 && priority == 0xff) {
>> +        return;
>> +    }
>> +
>> +    /*
>> +     * Check the END ESn (Event State Buffer for notification) for
>> +     * even futher coalescing in the Router
>> +     */
>> +    if (!xive2_end_is_notify(&end)) {
>> +        /* ESn[Q]=1 : end of notification */
>> +        if (!xive2_router_end_es_notify(xrtr, end_blk, end_idx,
>> +                                       &end, END2_W1_ESn)) {
>> +            return;
>> +        }
>> +    }
>> +
>> +    /*
>> +     * Follows IVPE notification
>> +     */
>> +    nvp_blk = xive_get_field32(END2_W6_VP_BLOCK, end.w6);
>> +    nvp_idx = xive_get_field32(END2_W6_VP_OFFSET, end.w6);
>> +
>> +    /* NVP cache lookup */
>> +    if (xive2_router_get_nvp(xrtr, nvp_blk, nvp_idx, &nvp)) {
>> +        qemu_log_mask(LOG_GUEST_ERROR, "XIVE: no NVP %x/%x\n",
>> +                      nvp_blk, nvp_idx);
>> +        return;
>> +    }
>> +
>> +    if (!xive2_nvp_is_valid(&nvp)) {
>> +        qemu_log_mask(LOG_GUEST_ERROR, "XIVE: NVP %x/%x is invalid\n",
>> +                      nvp_blk, nvp_idx);
>> +        return;
>> +    }
>> +
>> +    found = xive_presenter_notify(xrtr->xfb, format, nvp_blk, nvp_idx,
>> +                          xive_get_field32(END2_W6_IGNORE, end.w7),
>> +                          priority,
>> +                          xive_get_field32(END2_W7_F1_LOG_SERVER_ID, end.w7));
>> +
>> +    /* TODO: Auto EOI. */
>> +
>> +    if (found) {
>> +        return;
>> +    }
>> +
>> +    /*
>> +     * If no matching NVP is dispatched on a HW thread :
>> +     * - specific VP: update the NVP structure if backlog is activated
>> +     * - logical server : forward request to IVPE (not supported)
>> +     */
>> +    if (xive2_end_is_backlog(&end)) {
>> +        uint8_t ipb;
>> +
>> +        if (format == 1) {
>> +            qemu_log_mask(LOG_GUEST_ERROR,
>> +                          "XIVE: END %x/%x invalid config: F1 & backlog\n",
>> +                          end_blk, end_idx);
>> +            return;
>> +        }
>> +
>> +        /*
>> +         * Record the IPB in the associated NVP structure for later
>> +         * use. The presenter will resend the interrupt when the vCPU
>> +         * is dispatched again on a HW thread.
>> +         */
>> +        ipb = xive_get_field32(NVP2_W2_IPB, nvp.w2) |
>> +            priority_to_ipb(priority);
>> +        nvp.w2 = xive_set_field32(NVP2_W2_IPB, nvp.w2, ipb);
>> +        xive2_router_write_nvp(xrtr, nvp_blk, nvp_idx, &nvp, 2);
>> +
>> +        /*
>> +         * On HW, follows a "Broadcast Backlog" to IVPEs
>> +         */
>> +    }
>> +
>> +do_escalation:
>> +    /*
>> +     * If activated, escalate notification using the ESe PQ bits and
>> +     * the EAS in w4-5
>> +     */
>> +    if (!xive2_end_is_escalate(&end)) {
>> +        return;
>> +    }
>> +
>> +    /*
>> +     * Check the END ESe (Event State Buffer for escalation) for even
>> +     * futher coalescing in the Router
>> +     */
>> +    if (!xive2_end_is_uncond_escalation(&end)) {
>> +        /* ESe[Q]=1 : end of escalation notification */
>> +        if (!xive2_router_end_es_notify(xrtr, end_blk, end_idx,
>> +                                       &end, END2_W1_ESe)) {
>> +            return;
>> +        }
>> +    }
>> +
>> +    /*
>> +     * The END trigger becomes an Escalation trigger
>> +     */
>> +    xive2_router_end_notify(xrtr,
>> +                           xive_get_field32(END2_W4_END_BLOCK,     end.w4),
>> +                           xive_get_field32(END2_W4_ESC_END_INDEX, end.w4),
>> +                           xive_get_field32(END2_W5_ESC_END_DATA,  end.w5));
>> +}
>> +
>> +void xive2_router_notify(XiveNotifier *xn, uint32_t lisn)
>> +{
>> +    Xive2Router *xrtr = XIVE2_ROUTER(xn);
>> +    uint8_t eas_blk = XIVE_EAS_BLOCK(lisn);
>> +    uint32_t eas_idx = XIVE_EAS_INDEX(lisn);
>> +    Xive2Eas eas;
>> +
>> +    /* EAS cache lookup */
>> +    if (xive2_router_get_eas(xrtr, eas_blk, eas_idx, &eas)) {
>> +        qemu_log_mask(LOG_GUEST_ERROR, "XIVE: Unknown LISN %x\n", lisn);
>> +        return;
>> +    }
>> +
>> +    if (!xive2_eas_is_valid(&eas)) {
>> +        qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid LISN %x\n", lisn);
> 
> s/invalid/Invalid for consistency with Unkown ?
> 
>> +        return;
>> +    }
>> +
>> +    if (xive2_eas_is_masked(&eas)) {
>> +        /* Notification completed */
>> +        return;
>> +    }
>> +
>> +    /*
>> +     * The event trigger becomes an END trigger
>> +     */
>> +    xive2_router_end_notify(xrtr,
>> +                             xive_get_field64(EAS2_END_BLOCK, eas.w),
>> +                             xive_get_field64(EAS2_END_INDEX, eas.w),
>> +                             xive_get_field64(EAS2_END_DATA,  eas.w));
>> +}
>> +
>> +static Property xive2_router_properties[] = {
>> +    DEFINE_PROP_LINK("xive-fabric", Xive2Router, xfb,
>> +                     TYPE_XIVE_FABRIC, XiveFabric *),
>> +    DEFINE_PROP_END_OF_LIST(),
>> +};
>> +
>> +static void xive2_router_class_init(ObjectClass *klass, void *data)
>> +{
>> +    DeviceClass *dc = DEVICE_CLASS(klass);
>> +    XiveNotifierClass *xnc = XIVE_NOTIFIER_CLASS(klass);
>> +
>> +    dc->desc    = "XIVE2 Router Engine";
>> +    device_class_set_props(dc, xive2_router_properties);
>> +    /* Parent is SysBusDeviceClass. No need to call its realize hook */
>> +    dc->realize = xive2_router_realize;
>> +    xnc->notify = xive2_router_notify;
>> +}
>> +
>> +static const TypeInfo xive2_router_info = {
>> +    .name          = TYPE_XIVE2_ROUTER,
>> +    .parent        = TYPE_SYS_BUS_DEVICE,
>> +    .abstract      = true,
>> +    .instance_size = sizeof(Xive2Router),
>> +    .class_size    = sizeof(Xive2RouterClass),
>> +    .class_init    = xive2_router_class_init,
>> +    .interfaces    = (InterfaceInfo[]) {
>> +        { TYPE_XIVE_NOTIFIER },
>> +        { TYPE_XIVE_PRESENTER },
>> +        { }
>> +    }
>> +};
>> +
>> +static inline bool addr_is_even(hwaddr addr, uint32_t shift)
>> +{
>> +    return !((addr >> shift) & 1);
>> +}
>> +
>> +static uint64_t xive2_end_source_read(void *opaque, hwaddr addr, unsigned size)
>> +{
>> +    Xive2EndSource *xsrc = XIVE2_END_SOURCE(opaque);
>> +    uint32_t offset = addr & 0xFFF;
>> +    uint8_t end_blk;
>> +    uint32_t end_idx;
>> +    Xive2End end;
>> +    uint32_t end_esmask;
>> +    uint8_t pq;
>> +    uint64_t ret = -1;
> 
> It seems that ret is necessarily set when reaching the final return
> statement.

yes.
 
> Rest LGTM.

Thanks, 

C.

> 
>> +
>> +    /*
>> +     * The block id should be deduced from the load address on the END
>> +     * ESB MMIO but our model only supports a single block per XIVE chip.
>> +     */
>> +    end_blk = xive2_router_get_block_id(xsrc->xrtr);
>> +    end_idx = addr >> (xsrc->esb_shift + 1);
>> +
>> +    if (xive2_router_get_end(xsrc->xrtr, end_blk, end_idx, &end)) {
>> +        qemu_log_mask(LOG_GUEST_ERROR, "XIVE: No END %x/%x\n", end_blk,
>> +                      end_idx);
>> +        return -1;
>> +    }
>> +
>> +    if (!xive2_end_is_valid(&end)) {
>> +        qemu_log_mask(LOG_GUEST_ERROR, "XIVE: END %x/%x is invalid\n",
>> +                      end_blk, end_idx);
>> +        return -1;
>> +    }
>> +
>> +    end_esmask = addr_is_even(addr, xsrc->esb_shift) ? END2_W1_ESn :
>> +        END2_W1_ESe;
>> +    pq = xive_get_field32(end_esmask, end.w1);
>> +
>> +    switch (offset) {
>> +    case XIVE_ESB_LOAD_EOI ... XIVE_ESB_LOAD_EOI + 0x7FF:
>> +        ret = xive_esb_eoi(&pq);
>> +
>> +        /* Forward the source event notification for routing ?? */
>> +        break;
>> +
>> +    case XIVE_ESB_GET ... XIVE_ESB_GET + 0x3FF:
>> +        ret = pq;
>> +        break;
>> +
>> +    case XIVE_ESB_SET_PQ_00 ... XIVE_ESB_SET_PQ_00 + 0x0FF:
>> +    case XIVE_ESB_SET_PQ_01 ... XIVE_ESB_SET_PQ_01 + 0x0FF:
>> +    case XIVE_ESB_SET_PQ_10 ... XIVE_ESB_SET_PQ_10 + 0x0FF:
>> +    case XIVE_ESB_SET_PQ_11 ... XIVE_ESB_SET_PQ_11 + 0x0FF:
>> +        ret = xive_esb_set(&pq, (offset >> 8) & 0x3);
>> +        break;
>> +    default:
>> +        qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid END ESB load addr %d\n",
>> +                      offset);
>> +        return -1;
>> +    }
>> +
>> +    if (pq != xive_get_field32(end_esmask, end.w1)) {
>> +        end.w1 = xive_set_field32(end_esmask, end.w1, pq);
>> +        xive2_router_write_end(xsrc->xrtr, end_blk, end_idx, &end, 1);
>> +    }
>> +
>> +    return ret;
>> +}
>> +
>> +static void xive2_end_source_write(void *opaque, hwaddr addr,
>> +                                  uint64_t value, unsigned size)
>> +{
>> +    Xive2EndSource *xsrc = XIVE2_END_SOURCE(opaque);
>> +    uint32_t offset = addr & 0xFFF;
>> +    uint8_t end_blk;
>> +    uint32_t end_idx;
>> +    Xive2End end;
>> +    uint32_t end_esmask;
>> +    uint8_t pq;
>> +    bool notify = false;
>> +
>> +    /*
>> +     * The block id should be deduced from the load address on the END
>> +     * ESB MMIO but our model only supports a single block per XIVE chip.
>> +     */
>> +    end_blk = xive2_router_get_block_id(xsrc->xrtr);
>> +    end_idx = addr >> (xsrc->esb_shift + 1);
>> +
>> +    if (xive2_router_get_end(xsrc->xrtr, end_blk, end_idx, &end)) {
>> +        qemu_log_mask(LOG_GUEST_ERROR, "XIVE: No END %x/%x\n", end_blk,
>> +                      end_idx);
>> +        return;
>> +    }
>> +
>> +    if (!xive2_end_is_valid(&end)) {
>> +        qemu_log_mask(LOG_GUEST_ERROR, "XIVE: END %x/%x is invalid\n",
>> +                      end_blk, end_idx);
>> +        return;
>> +    }
>> +
>> +    end_esmask = addr_is_even(addr, xsrc->esb_shift) ? END2_W1_ESn :
>> +        END2_W1_ESe;
>> +    pq = xive_get_field32(end_esmask, end.w1);
>> +
>> +    switch (offset) {
>> +    case 0 ... 0x3FF:
>> +        notify = xive_esb_trigger(&pq);
>> +        break;
>> +
>> +    case XIVE_ESB_STORE_EOI ... XIVE_ESB_STORE_EOI + 0x3FF:
>> +        /* TODO: can we check StoreEOI availability from the router ? */
>> +        notify = xive_esb_eoi(&pq);
>> +        break;
>> +
>> +    default:
>> +        qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid END ESB write addr %d\n",
>> +                      offset);
>> +        return;
>> +    }
>> +
>> +    if (pq != xive_get_field32(end_esmask, end.w1)) {
>> +        end.w1 = xive_set_field32(end_esmask, end.w1, pq);
>> +        xive2_router_write_end(xsrc->xrtr, end_blk, end_idx, &end, 1);
>> +    }
>> +
>> +    /* TODO: Forward the source event notification for routing */
>> +    if (notify) {
>> +        ;
>> +    }
>> +}
>> +
>> +static const MemoryRegionOps xive2_end_source_ops = {
>> +    .read = xive2_end_source_read,
>> +    .write = xive2_end_source_write,
>> +    .endianness = DEVICE_BIG_ENDIAN,
>> +    .valid = {
>> +        .min_access_size = 8,
>> +        .max_access_size = 8,
>> +    },
>> +    .impl = {
>> +        .min_access_size = 8,
>> +        .max_access_size = 8,
>> +    },
>> +};
>> +
>> +static void xive2_end_source_realize(DeviceState *dev, Error **errp)
>> +{
>> +    Xive2EndSource *xsrc = XIVE2_END_SOURCE(dev);
>> +
>> +    assert(xsrc->xrtr);
>> +
>> +    if (!xsrc->nr_ends) {
>> +        error_setg(errp, "Number of interrupt needs to be greater than 0");
>> +        return;
>> +    }
>> +
>> +    if (xsrc->esb_shift != XIVE_ESB_4K &&
>> +        xsrc->esb_shift != XIVE_ESB_64K) {
>> +        error_setg(errp, "Invalid ESB shift setting");
>> +        return;
>> +    }
>> +
>> +    /*
>> +     * Each END is assigned an even/odd pair of MMIO pages, the even page
>> +     * manages the ESn field while the odd page manages the ESe field.
>> +     */
>> +    memory_region_init_io(&xsrc->esb_mmio, OBJECT(xsrc),
>> +                          &xive2_end_source_ops, xsrc, "xive.end",
>> +                          (1ull << (xsrc->esb_shift + 1)) * xsrc->nr_ends);
>> +}
>> +
>> +static Property xive2_end_source_properties[] = {
>> +    DEFINE_PROP_UINT32("nr-ends", Xive2EndSource, nr_ends, 0),
>> +    DEFINE_PROP_UINT32("shift", Xive2EndSource, esb_shift, XIVE_ESB_64K),
>> +    DEFINE_PROP_LINK("xive", Xive2EndSource, xrtr, TYPE_XIVE2_ROUTER,
>> +                     Xive2Router *),
>> +    DEFINE_PROP_END_OF_LIST(),
>> +};
>> +
>> +static void xive2_end_source_class_init(ObjectClass *klass, void *data)
>> +{
>> +    DeviceClass *dc = DEVICE_CLASS(klass);
>> +
>> +    dc->desc    = "XIVE END Source";
>> +    device_class_set_props(dc, xive2_end_source_properties);
>> +    dc->realize = xive2_end_source_realize;
>> +}
>> +
>> +static const TypeInfo xive2_end_source_info = {
>> +    .name          = TYPE_XIVE2_END_SOURCE,
>> +    .parent        = TYPE_DEVICE,
>> +    .instance_size = sizeof(Xive2EndSource),
>> +    .class_init    = xive2_end_source_class_init,
>> +};
>> +
>> +static void xive2_register_types(void)
>> +{
>> +    type_register_static(&xive2_router_info);
>> +    type_register_static(&xive2_end_source_info);
>> +}
>> +
>> +type_init(xive2_register_types)
>> diff --git a/hw/intc/Makefile.objs b/hw/intc/Makefile.objs
>> index f726d8753276..3af575aeb87d 100644
>> --- a/hw/intc/Makefile.objs
>> +++ b/hw/intc/Makefile.objs
>> @@ -37,7 +37,7 @@ obj-$(CONFIG_SH4) += sh_intc.o
>>  obj-$(CONFIG_XICS) += xics.o
>>  obj-$(CONFIG_XICS_SPAPR) += xics_spapr.o
>>  obj-$(CONFIG_XICS_KVM) += xics_kvm.o
>> -obj-$(CONFIG_XIVE) += xive.o
>> +obj-$(CONFIG_XIVE) += xive.o xive2.o
>>  obj-$(CONFIG_XIVE_SPAPR) += spapr_xive.o
>>  obj-$(CONFIG_XIVE_KVM) += spapr_xive_kvm.o
>>  obj-$(CONFIG_POWERNV) += xics_pnv.o pnv_xive.o
> 



^ permalink raw reply	[flat|nested] 25+ messages in thread

* Re: [PATCH 4/9] ppc/xive2: Introduce a presenter matching routine
  2020-05-20 17:17   ` Greg Kurz
@ 2020-05-25 12:11     ` Cédric Le Goater
  0 siblings, 0 replies; 25+ messages in thread
From: Cédric Le Goater @ 2020-05-25 12:11 UTC (permalink / raw)
  To: Greg Kurz; +Cc: qemu-ppc, qemu-devel, David Gibson

On 5/20/20 7:17 PM, Greg Kurz wrote:
> On Wed, 13 May 2020 17:11:04 +0200
> Cédric Le Goater <clg@kaod.org> wrote:
> 
>> The VP space is larger in XIVE2 (P10), 24 bits instead of 19bits on
>> XIVE (P9), and the CAM line can use a 7bits or 8bits thread id.
>>
>> For now, we only use 7bits thread ids, same as P9, but because of the
>> change of the size of the VP space, the CAM matching routine is
>> different between P9 and P10. It is easier to duplicate the whole
>> routine than to add extra handlers in xive_presenter_tctx_match() used
>> for P9.
>>
> 
> It's a bit of a pity to duplicate this routine. What about turning it
> into a helper with some extra arguments and come up with dedicated
> users for P9 and P10 ?

The size of the context fields have changed. It's not sure it will
be better.

>> We might come with a better solution later on, after we have added
>> some more support for the XIVE2 controller.
>>
> 
> Of course if you envision substantial changes that would prevent to share
> enough logic, you can ignore the previous comment. The duplicated routine
> looks fine.
> 
>> Signed-off-by: Cédric Le Goater <clg@kaod.org>
>> ---
>>  include/hw/ppc/xive2.h |  9 +++++
>>  hw/intc/xive2.c        | 87 ++++++++++++++++++++++++++++++++++++++++++
>>  2 files changed, 96 insertions(+)
>>
>> diff --git a/include/hw/ppc/xive2.h b/include/hw/ppc/xive2.h
>> index cb15487efdb6..4aefca4d96f1 100644
>> --- a/include/hw/ppc/xive2.h
>> +++ b/include/hw/ppc/xive2.h
>> @@ -60,6 +60,15 @@ int xive2_router_write_nvp(Xive2Router *xrtr, uint8_t nvt_blk, uint32_t nvt_idx,
>>  
>>  void xive2_router_notify(XiveNotifier *xn, uint32_t lisn);
>>  
>> +/*
>> + * XIVE2 Presenter (POWER10)
>> + */
>> +
>> +int xive2_presenter_tctx_match(XivePresenter *xptr, XiveTCTX *tctx,
>> +                                uint8_t format,
>> +                                uint8_t nvt_blk, uint32_t nvt_idx,
>> +                                bool cam_ignore, uint32_t logic_serv);
>> +
>>  /*
>>   * XIVE2 END ESBs  (POWER10)
>>   */
>> diff --git a/hw/intc/xive2.c b/hw/intc/xive2.c
>> index 15ea04cf1822..1ce9d995e990 100644
>> --- a/hw/intc/xive2.c
>> +++ b/hw/intc/xive2.c
>> @@ -20,6 +20,11 @@
>>  #include "hw/ppc/xive2.h"
>>  #include "hw/ppc/xive2_regs.h"
>>  
>> +static inline uint32_t xive_tctx_word2(uint8_t *ring)
>> +{
>> +    return *((uint32_t *) &ring[TM_WORD2]);
>> +}
>> +
>>  static uint8_t priority_to_ipb(uint8_t priority)
>>  {
>>      return priority > XIVE_PRIORITY_MAX ?
>> @@ -212,6 +217,88 @@ static int xive2_router_get_block_id(Xive2Router *xrtr)
>>     return xrc->get_block_id(xrtr);
>>  }
>>  
>> +/*
>> + * Encode the HW CAM line with 7bit or 8bit thread id. The thread id
>> + * width and block id width is configurable at the IC level.
>> + *
>> + *    chipid << 19 | 0000000 0 0001 threadid (7Bit)
>> + *    chipid << 24 | 0000 0000 0000 0001 threadid (8Bit)
>> + */
> 
> What about introducing:
> 
> #define XIVE2_PIR_TO_NVP_IDX(pir, width) \
>     (1 << (width) | ((pir) & ((1 << (width)) - 1))
> 
> or any better name you can think of and...

yes. This looks nice.

Thanks,

C. 

> 
>> +static uint32_t xive2_tctx_hw_cam_line(XivePresenter *xptr, XiveTCTX *tctx)
>> +{
>> +    Xive2Router *xrtr = XIVE2_ROUTER(xptr);
>> +    CPUPPCState *env = &POWERPC_CPU(tctx->cs)->env;
>> +    uint32_t pir = env->spr_cb[SPR_PIR].default_value;
>> +    uint8_t blk = xive2_router_get_block_id(xrtr);
>> +    uint8_t tid_shift = 7;
>> +    uint8_t tid_mask = (1 << tid_shift) - 1;
>> +
>> +    return xive2_nvp_cam_line(blk, 1 << tid_shift | (pir & tid_mask));
> 
> ... turn this into:
> 
>     /* We only use 7bit thread ids for now */
>     return xive2_nvp_cam_line(blk, XIVE2_PIR_TO_NVP_IDX(pir, 7));
> 
>> +}
>> +
>> +/*
>> + * The thread context register words are in big-endian format.
>> + */
>> +int xive2_presenter_tctx_match(XivePresenter *xptr, XiveTCTX *tctx,
>> +                                uint8_t format,
>> +                                uint8_t nvt_blk, uint32_t nvt_idx,
>> +                                bool cam_ignore, uint32_t logic_serv)
>> +{
>> +    uint32_t cam =   xive2_nvp_cam_line(nvt_blk, nvt_idx);
>> +    uint32_t qw3w2 = xive_tctx_word2(&tctx->regs[TM_QW3_HV_PHYS]);
>> +    uint32_t qw2w2 = xive_tctx_word2(&tctx->regs[TM_QW2_HV_POOL]);
>> +    uint32_t qw1w2 = xive_tctx_word2(&tctx->regs[TM_QW1_OS]);
>> +    uint32_t qw0w2 = xive_tctx_word2(&tctx->regs[TM_QW0_USER]);
>> +
>> +    /*
>> +     * TODO (PowerNV): ignore mode. The low order bits of the NVT
>> +     * identifier are ignored in the "CAM" match.
>> +     */
>> +
>> +    if (format == 0) {
>> +        if (cam_ignore == true) {
>> +            /*
>> +             * F=0 & i=1: Logical server notification (bits ignored at
>> +             * the end of the NVT identifier)
>> +             */
>> +            qemu_log_mask(LOG_UNIMP, "XIVE: no support for LS NVT %x/%x\n",
>> +                          nvt_blk, nvt_idx);
>> +             return -1;
>> +        }
>> +
>> +        /* F=0 & i=0: Specific NVT notification */
>> +
>> +        /* PHYS ring */
>> +        if ((be32_to_cpu(qw3w2) & TM2_QW3W2_VT) &&
>> +            cam == xive2_tctx_hw_cam_line(xptr, tctx)) {
>> +            return TM_QW3_HV_PHYS;
>> +        }
>> +
>> +        /* HV POOL ring */
>> +        if ((be32_to_cpu(qw2w2) & TM2_QW2W2_VP) &&
>> +            cam == xive_get_field32(TM2_QW2W2_POOL_CAM, qw2w2)) {
>> +            return TM_QW2_HV_POOL;
>> +        }
>> +
>> +        /* OS ring */
>> +        if ((be32_to_cpu(qw1w2) & TM2_QW1W2_VO) &&
>> +            cam == xive_get_field32(TM2_QW1W2_OS_CAM, qw1w2)) {
>> +            return TM_QW1_OS;
>> +        }
>> +    } else {
>> +        /* F=1 : User level Event-Based Branch (EBB) notification */
>> +
>> +        /* USER ring */
>> +        if  ((be32_to_cpu(qw1w2) & TM2_QW1W2_VO) &&
>> +             (cam == xive_get_field32(TM2_QW1W2_OS_CAM, qw1w2)) &&
>> +             (be32_to_cpu(qw0w2) & TM2_QW0W2_VU) &&
>> +             (logic_serv == xive_get_field32(TM2_QW0W2_LOGIC_SERV, qw0w2))) {
>> +            return TM_QW0_USER;
>> +        }
>> +    }
>> +    return -1;
>> +}
>> +
>>  static void xive2_router_realize(DeviceState *dev, Error **errp)
>>  {
>>      Xive2Router *xrtr = XIVE2_ROUTER(dev);
> 



^ permalink raw reply	[flat|nested] 25+ messages in thread

end of thread, other threads:[~2020-05-25 12:13 UTC | newest]

Thread overview: 25+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-05-13 15:11 [PATCH 0/9] ppc/pnv: Introduce the XIVE2 and PHB5 controllers for the POWER10 chip Cédric Le Goater
2020-05-13 15:11 ` [PATCH 1/9] ppc/xive: Export PQ get/set routines Cédric Le Goater
2020-05-13 15:11 ` [PATCH 2/9] ppc/xive: Export xive_presenter_notify() Cédric Le Goater
2020-05-19  9:18   ` Greg Kurz
2020-05-13 15:11 ` [PATCH 3/9] ppc/xive2: Introduce a XIVE2 core framework Cédric Le Goater
2020-05-20 16:40   ` Greg Kurz
2020-05-25 11:41     ` Cédric Le Goater
2020-05-13 15:11 ` [PATCH 4/9] ppc/xive2: Introduce a presenter matching routine Cédric Le Goater
2020-05-20 17:17   ` Greg Kurz
2020-05-25 12:11     ` Cédric Le Goater
2020-05-20 17:20   ` Greg Kurz
2020-05-13 15:11 ` [PATCH 5/9] ppc/pnv: Add a XIVE2 controller to the POWER10 chip Cédric Le Goater
2020-05-19  9:48   ` Greg Kurz
2020-05-25 10:12     ` Cédric Le Goater
2020-05-13 15:11 ` [PATCH 6/9] ppc/pnv: Add a OCC model for POWER10 Cédric Le Goater
2020-05-20 14:22   ` Greg Kurz
2020-05-25 11:14     ` Cédric Le Goater
2020-05-13 15:11 ` [PATCH 7/9] ppc/pnv: Add POWER10 quads Cédric Le Goater
2020-05-20 14:44   ` Greg Kurz
2020-05-25 11:27     ` Cédric Le Goater
2020-05-13 15:11 ` [PATCH 8/9] ppc/pnv: Add model for POWER9 PHB5 PCIe Host bridge Cédric Le Goater
2020-05-20 13:46   ` Greg Kurz
2020-05-25 10:13     ` Cédric Le Goater
2020-05-13 15:11 ` [PATCH 9/9] ppc/psi: Add support for StoreEOI and 64k ESB pages (POWER10) Cédric Le Goater
2020-05-19  9:40 ` [PATCH 0/9] ppc/pnv: Introduce the XIVE2 and PHB5 controllers for the POWER10 chip Greg Kurz

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.