Merge tag 'net-pull-request' of https://github.com/jasowang/qemu into staging
[qemu.git] / hw / pci-host / pnv_phb3.c
1 /*
2 * QEMU PowerPC PowerNV (POWER8) PHB3 model
3 *
4 * Copyright (c) 2014-2020, IBM Corporation.
5 *
6 * This code is licensed under the GPL version 2 or later. See the
7 * COPYING file in the top-level directory.
8 */
9 #include "qemu/osdep.h"
10 #include "qemu/log.h"
11 #include "qapi/visitor.h"
12 #include "qapi/error.h"
13 #include "qemu-common.h"
14 #include "hw/pci-host/pnv_phb3_regs.h"
15 #include "hw/pci-host/pnv_phb3.h"
16 #include "hw/pci/pcie_host.h"
17 #include "hw/pci/pcie_port.h"
18 #include "hw/ppc/pnv.h"
19 #include "hw/irq.h"
20 #include "hw/qdev-properties.h"
21 #include "qom/object.h"
22 #include "sysemu/sysemu.h"
23
24 #define phb3_error(phb, fmt, ...) \
25 qemu_log_mask(LOG_GUEST_ERROR, "phb3[%d:%d]: " fmt "\n", \
26 (phb)->chip_id, (phb)->phb_id, ## __VA_ARGS__)
27
28 static PCIDevice *pnv_phb3_find_cfg_dev(PnvPHB3 *phb)
29 {
30 PCIHostState *pci = PCI_HOST_BRIDGE(phb);
31 uint64_t addr = phb->regs[PHB_CONFIG_ADDRESS >> 3];
32 uint8_t bus, devfn;
33
34 if (!(addr >> 63)) {
35 return NULL;
36 }
37 bus = (addr >> 52) & 0xff;
38 devfn = (addr >> 44) & 0xff;
39
40 return pci_find_device(pci->bus, bus, devfn);
41 }
42
43 /*
44 * The CONFIG_DATA register expects little endian accesses, but as the
45 * region is big endian, we have to swap the value.
46 */
47 static void pnv_phb3_config_write(PnvPHB3 *phb, unsigned off,
48 unsigned size, uint64_t val)
49 {
50 uint32_t cfg_addr, limit;
51 PCIDevice *pdev;
52
53 pdev = pnv_phb3_find_cfg_dev(phb);
54 if (!pdev) {
55 return;
56 }
57 cfg_addr = (phb->regs[PHB_CONFIG_ADDRESS >> 3] >> 32) & 0xffc;
58 cfg_addr |= off;
59 limit = pci_config_size(pdev);
60 if (limit <= cfg_addr) {
61 /*
62 * conventional pci device can be behind pcie-to-pci bridge.
63 * 256 <= addr < 4K has no effects.
64 */
65 return;
66 }
67 switch (size) {
68 case 1:
69 break;
70 case 2:
71 val = bswap16(val);
72 break;
73 case 4:
74 val = bswap32(val);
75 break;
76 default:
77 g_assert_not_reached();
78 }
79 pci_host_config_write_common(pdev, cfg_addr, limit, val, size);
80 }
81
82 static uint64_t pnv_phb3_config_read(PnvPHB3 *phb, unsigned off,
83 unsigned size)
84 {
85 uint32_t cfg_addr, limit;
86 PCIDevice *pdev;
87 uint64_t val;
88
89 pdev = pnv_phb3_find_cfg_dev(phb);
90 if (!pdev) {
91 return ~0ull;
92 }
93 cfg_addr = (phb->regs[PHB_CONFIG_ADDRESS >> 3] >> 32) & 0xffc;
94 cfg_addr |= off;
95 limit = pci_config_size(pdev);
96 if (limit <= cfg_addr) {
97 /*
98 * conventional pci device can be behind pcie-to-pci bridge.
99 * 256 <= addr < 4K has no effects.
100 */
101 return ~0ull;
102 }
103 val = pci_host_config_read_common(pdev, cfg_addr, limit, size);
104 switch (size) {
105 case 1:
106 return val;
107 case 2:
108 return bswap16(val);
109 case 4:
110 return bswap32(val);
111 default:
112 g_assert_not_reached();
113 }
114 }
115
116 static void pnv_phb3_check_m32(PnvPHB3 *phb)
117 {
118 uint64_t base, start, size;
119 MemoryRegion *parent;
120 PnvPBCQState *pbcq = &phb->pbcq;
121
122 if (memory_region_is_mapped(&phb->mr_m32)) {
123 memory_region_del_subregion(phb->mr_m32.container, &phb->mr_m32);
124 }
125
126 if (!(phb->regs[PHB_PHB3_CONFIG >> 3] & PHB_PHB3C_M32_EN)) {
127 return;
128 }
129
130 /* Grab geometry from registers */
131 base = phb->regs[PHB_M32_BASE_ADDR >> 3];
132 start = phb->regs[PHB_M32_START_ADDR >> 3];
133 size = ~(phb->regs[PHB_M32_BASE_MASK >> 3] | 0xfffc000000000000ull) + 1;
134
135 /* Check if it matches an enabled MMIO region in the PBCQ */
136 if (memory_region_is_mapped(&pbcq->mmbar0) &&
137 base >= pbcq->mmio0_base &&
138 (base + size) <= (pbcq->mmio0_base + pbcq->mmio0_size)) {
139 parent = &pbcq->mmbar0;
140 base -= pbcq->mmio0_base;
141 } else if (memory_region_is_mapped(&pbcq->mmbar1) &&
142 base >= pbcq->mmio1_base &&
143 (base + size) <= (pbcq->mmio1_base + pbcq->mmio1_size)) {
144 parent = &pbcq->mmbar1;
145 base -= pbcq->mmio1_base;
146 } else {
147 return;
148 }
149
150 /* Create alias */
151 memory_region_init_alias(&phb->mr_m32, OBJECT(phb), "phb3-m32",
152 &phb->pci_mmio, start, size);
153 memory_region_add_subregion(parent, base, &phb->mr_m32);
154 }
155
156 static void pnv_phb3_check_m64(PnvPHB3 *phb, uint32_t index)
157 {
158 uint64_t base, start, size, m64;
159 MemoryRegion *parent;
160 PnvPBCQState *pbcq = &phb->pbcq;
161
162 if (memory_region_is_mapped(&phb->mr_m64[index])) {
163 /* Should we destroy it in RCU friendly way... ? */
164 memory_region_del_subregion(phb->mr_m64[index].container,
165 &phb->mr_m64[index]);
166 }
167
168 /* Get table entry */
169 m64 = phb->ioda_M64BT[index];
170
171 if (!(m64 & IODA2_M64BT_ENABLE)) {
172 return;
173 }
174
175 /* Grab geometry from registers */
176 base = GETFIELD(IODA2_M64BT_BASE, m64) << 20;
177 if (m64 & IODA2_M64BT_SINGLE_PE) {
178 base &= ~0x1ffffffull;
179 }
180 size = GETFIELD(IODA2_M64BT_MASK, m64) << 20;
181 size |= 0xfffc000000000000ull;
182 size = ~size + 1;
183 start = base | (phb->regs[PHB_M64_UPPER_BITS >> 3]);
184
185 /* Check if it matches an enabled MMIO region in the PBCQ */
186 if (memory_region_is_mapped(&pbcq->mmbar0) &&
187 base >= pbcq->mmio0_base &&
188 (base + size) <= (pbcq->mmio0_base + pbcq->mmio0_size)) {
189 parent = &pbcq->mmbar0;
190 base -= pbcq->mmio0_base;
191 } else if (memory_region_is_mapped(&pbcq->mmbar1) &&
192 base >= pbcq->mmio1_base &&
193 (base + size) <= (pbcq->mmio1_base + pbcq->mmio1_size)) {
194 parent = &pbcq->mmbar1;
195 base -= pbcq->mmio1_base;
196 } else {
197 return;
198 }
199
200 /* Create alias */
201 memory_region_init_alias(&phb->mr_m64[index], OBJECT(phb), "phb3-m64",
202 &phb->pci_mmio, start, size);
203 memory_region_add_subregion(parent, base, &phb->mr_m64[index]);
204 }
205
206 static void pnv_phb3_check_all_m64s(PnvPHB3 *phb)
207 {
208 uint64_t i;
209
210 for (i = 0; i < PNV_PHB3_NUM_M64; i++) {
211 pnv_phb3_check_m64(phb, i);
212 }
213 }
214
215 static void pnv_phb3_lxivt_write(PnvPHB3 *phb, unsigned idx, uint64_t val)
216 {
217 uint8_t server, prio;
218
219 phb->ioda_LXIVT[idx] = val & (IODA2_LXIVT_SERVER |
220 IODA2_LXIVT_PRIORITY |
221 IODA2_LXIVT_NODE_ID);
222 server = GETFIELD(IODA2_LXIVT_SERVER, val);
223 prio = GETFIELD(IODA2_LXIVT_PRIORITY, val);
224
225 /*
226 * The low order 2 bits are the link pointer (Type II interrupts).
227 * Shift back to get a valid IRQ server.
228 */
229 server >>= 2;
230
231 ics_write_xive(&phb->lsis, idx, server, prio, prio);
232 }
233
234 static uint64_t *pnv_phb3_ioda_access(PnvPHB3 *phb,
235 unsigned *out_table, unsigned *out_idx)
236 {
237 uint64_t adreg = phb->regs[PHB_IODA_ADDR >> 3];
238 unsigned int index = GETFIELD(PHB_IODA_AD_TADR, adreg);
239 unsigned int table = GETFIELD(PHB_IODA_AD_TSEL, adreg);
240 unsigned int mask;
241 uint64_t *tptr = NULL;
242
243 switch (table) {
244 case IODA2_TBL_LIST:
245 tptr = phb->ioda_LIST;
246 mask = 7;
247 break;
248 case IODA2_TBL_LXIVT:
249 tptr = phb->ioda_LXIVT;
250 mask = 7;
251 break;
252 case IODA2_TBL_IVC_CAM:
253 case IODA2_TBL_RBA:
254 mask = 31;
255 break;
256 case IODA2_TBL_RCAM:
257 mask = 63;
258 break;
259 case IODA2_TBL_MRT:
260 mask = 7;
261 break;
262 case IODA2_TBL_PESTA:
263 case IODA2_TBL_PESTB:
264 mask = 255;
265 break;
266 case IODA2_TBL_TVT:
267 tptr = phb->ioda_TVT;
268 mask = 511;
269 break;
270 case IODA2_TBL_TCAM:
271 case IODA2_TBL_TDR:
272 mask = 63;
273 break;
274 case IODA2_TBL_M64BT:
275 tptr = phb->ioda_M64BT;
276 mask = 15;
277 break;
278 case IODA2_TBL_M32DT:
279 tptr = phb->ioda_MDT;
280 mask = 255;
281 break;
282 case IODA2_TBL_PEEV:
283 tptr = phb->ioda_PEEV;
284 mask = 3;
285 break;
286 default:
287 phb3_error(phb, "invalid IODA table %d", table);
288 return NULL;
289 }
290 index &= mask;
291 if (out_idx) {
292 *out_idx = index;
293 }
294 if (out_table) {
295 *out_table = table;
296 }
297 if (tptr) {
298 tptr += index;
299 }
300 if (adreg & PHB_IODA_AD_AUTOINC) {
301 index = (index + 1) & mask;
302 adreg = SETFIELD(PHB_IODA_AD_TADR, adreg, index);
303 }
304 phb->regs[PHB_IODA_ADDR >> 3] = adreg;
305 return tptr;
306 }
307
308 static uint64_t pnv_phb3_ioda_read(PnvPHB3 *phb)
309 {
310 unsigned table;
311 uint64_t *tptr;
312
313 tptr = pnv_phb3_ioda_access(phb, &table, NULL);
314 if (!tptr) {
315 /* Return 0 on unsupported tables, not ff's */
316 return 0;
317 }
318 return *tptr;
319 }
320
321 static void pnv_phb3_ioda_write(PnvPHB3 *phb, uint64_t val)
322 {
323 unsigned table, idx;
324 uint64_t *tptr;
325
326 tptr = pnv_phb3_ioda_access(phb, &table, &idx);
327 if (!tptr) {
328 return;
329 }
330
331 /* Handle side effects */
332 switch (table) {
333 case IODA2_TBL_LXIVT:
334 pnv_phb3_lxivt_write(phb, idx, val);
335 break;
336 case IODA2_TBL_M64BT:
337 *tptr = val;
338 pnv_phb3_check_m64(phb, idx);
339 break;
340 default:
341 *tptr = val;
342 }
343 }
344
345 /*
346 * This is called whenever the PHB LSI, MSI source ID register or
347 * the PBCQ irq filters are written.
348 */
349 void pnv_phb3_remap_irqs(PnvPHB3 *phb)
350 {
351 ICSState *ics = &phb->lsis;
352 uint32_t local, global, count, mask, comp;
353 uint64_t baren;
354 PnvPBCQState *pbcq = &phb->pbcq;
355
356 /*
357 * First check if we are enabled. Unlike real HW we don't separate
358 * TX and RX so we enable if both are set
359 */
360 baren = pbcq->nest_regs[PBCQ_NEST_BAR_EN];
361 if (!(baren & PBCQ_NEST_BAR_EN_IRSN_RX) ||
362 !(baren & PBCQ_NEST_BAR_EN_IRSN_TX)) {
363 ics->offset = 0;
364 return;
365 }
366
367 /* Grab local LSI source ID */
368 local = GETFIELD(PHB_LSI_SRC_ID, phb->regs[PHB_LSI_SOURCE_ID >> 3]) << 3;
369
370 /* Grab global one and compare */
371 global = GETFIELD(PBCQ_NEST_LSI_SRC,
372 pbcq->nest_regs[PBCQ_NEST_LSI_SRC_ID]) << 3;
373 if (global != local) {
374 /*
375 * This happens during initialization, let's come back when we
376 * are properly configured
377 */
378 ics->offset = 0;
379 return;
380 }
381
382 /* Get the base on the powerbus */
383 comp = GETFIELD(PBCQ_NEST_IRSN_COMP,
384 pbcq->nest_regs[PBCQ_NEST_IRSN_COMPARE]);
385 mask = GETFIELD(PBCQ_NEST_IRSN_COMP,
386 pbcq->nest_regs[PBCQ_NEST_IRSN_MASK]);
387 count = ((~mask) + 1) & 0x7ffff;
388 phb->total_irq = count;
389
390 /* Sanity checks */
391 if ((global + PNV_PHB3_NUM_LSI) > count) {
392 phb3_error(phb, "LSIs out of reach: LSI base=%d total irq=%d", global,
393 count);
394 }
395
396 if (count > 2048) {
397 phb3_error(phb, "More interrupts than supported: %d", count);
398 }
399
400 if ((comp & mask) != comp) {
401 phb3_error(phb, "IRQ compare bits not in mask: comp=0x%x mask=0x%x",
402 comp, mask);
403 comp &= mask;
404 }
405 /* Setup LSI offset */
406 ics->offset = comp + global;
407
408 /* Setup MSI offset */
409 pnv_phb3_msi_update_config(&phb->msis, comp, count - PNV_PHB3_NUM_LSI);
410 }
411
412 static void pnv_phb3_lsi_src_id_write(PnvPHB3 *phb, uint64_t val)
413 {
414 /* Sanitize content */
415 val &= PHB_LSI_SRC_ID;
416 phb->regs[PHB_LSI_SOURCE_ID >> 3] = val;
417 pnv_phb3_remap_irqs(phb);
418 }
419
420 static void pnv_phb3_rtc_invalidate(PnvPHB3 *phb, uint64_t val)
421 {
422 PnvPhb3DMASpace *ds;
423
424 /* Always invalidate all for now ... */
425 QLIST_FOREACH(ds, &phb->dma_spaces, list) {
426 ds->pe_num = PHB_INVALID_PE;
427 }
428 }
429
430
431 static void pnv_phb3_update_msi_regions(PnvPhb3DMASpace *ds)
432 {
433 uint64_t cfg = ds->phb->regs[PHB_PHB3_CONFIG >> 3];
434
435 if (cfg & PHB_PHB3C_32BIT_MSI_EN) {
436 if (!memory_region_is_mapped(&ds->msi32_mr)) {
437 memory_region_add_subregion(MEMORY_REGION(&ds->dma_mr),
438 0xffff0000, &ds->msi32_mr);
439 }
440 } else {
441 if (memory_region_is_mapped(&ds->msi32_mr)) {
442 memory_region_del_subregion(MEMORY_REGION(&ds->dma_mr),
443 &ds->msi32_mr);
444 }
445 }
446
447 if (cfg & PHB_PHB3C_64BIT_MSI_EN) {
448 if (!memory_region_is_mapped(&ds->msi64_mr)) {
449 memory_region_add_subregion(MEMORY_REGION(&ds->dma_mr),
450 (1ull << 60), &ds->msi64_mr);
451 }
452 } else {
453 if (memory_region_is_mapped(&ds->msi64_mr)) {
454 memory_region_del_subregion(MEMORY_REGION(&ds->dma_mr),
455 &ds->msi64_mr);
456 }
457 }
458 }
459
460 static void pnv_phb3_update_all_msi_regions(PnvPHB3 *phb)
461 {
462 PnvPhb3DMASpace *ds;
463
464 QLIST_FOREACH(ds, &phb->dma_spaces, list) {
465 pnv_phb3_update_msi_regions(ds);
466 }
467 }
468
469 void pnv_phb3_reg_write(void *opaque, hwaddr off, uint64_t val, unsigned size)
470 {
471 PnvPHB3 *phb = opaque;
472 bool changed;
473
474 /* Special case configuration data */
475 if ((off & 0xfffc) == PHB_CONFIG_DATA) {
476 pnv_phb3_config_write(phb, off & 0x3, size, val);
477 return;
478 }
479
480 /* Other registers are 64-bit only */
481 if (size != 8 || off & 0x7) {
482 phb3_error(phb, "Invalid register access, offset: 0x%"PRIx64" size: %d",
483 off, size);
484 return;
485 }
486
487 /* Handle masking & filtering */
488 switch (off) {
489 case PHB_M64_UPPER_BITS:
490 val &= 0xfffc000000000000ull;
491 break;
492 case PHB_Q_DMA_R:
493 /*
494 * This is enough logic to make SW happy but we aren't actually
495 * quiescing the DMAs
496 */
497 if (val & PHB_Q_DMA_R_AUTORESET) {
498 val = 0;
499 } else {
500 val &= PHB_Q_DMA_R_QUIESCE_DMA;
501 }
502 break;
503 /* LEM stuff */
504 case PHB_LEM_FIR_AND_MASK:
505 phb->regs[PHB_LEM_FIR_ACCUM >> 3] &= val;
506 return;
507 case PHB_LEM_FIR_OR_MASK:
508 phb->regs[PHB_LEM_FIR_ACCUM >> 3] |= val;
509 return;
510 case PHB_LEM_ERROR_AND_MASK:
511 phb->regs[PHB_LEM_ERROR_MASK >> 3] &= val;
512 return;
513 case PHB_LEM_ERROR_OR_MASK:
514 phb->regs[PHB_LEM_ERROR_MASK >> 3] |= val;
515 return;
516 case PHB_LEM_WOF:
517 val = 0;
518 break;
519 }
520
521 /* Record whether it changed */
522 changed = phb->regs[off >> 3] != val;
523
524 /* Store in register cache first */
525 phb->regs[off >> 3] = val;
526
527 /* Handle side effects */
528 switch (off) {
529 case PHB_PHB3_CONFIG:
530 if (changed) {
531 pnv_phb3_update_all_msi_regions(phb);
532 }
533 /* fall through */
534 case PHB_M32_BASE_ADDR:
535 case PHB_M32_BASE_MASK:
536 case PHB_M32_START_ADDR:
537 if (changed) {
538 pnv_phb3_check_m32(phb);
539 }
540 break;
541 case PHB_M64_UPPER_BITS:
542 if (changed) {
543 pnv_phb3_check_all_m64s(phb);
544 }
545 break;
546 case PHB_LSI_SOURCE_ID:
547 if (changed) {
548 pnv_phb3_lsi_src_id_write(phb, val);
549 }
550 break;
551
552 /* IODA table accesses */
553 case PHB_IODA_DATA0:
554 pnv_phb3_ioda_write(phb, val);
555 break;
556
557 /* RTC invalidation */
558 case PHB_RTC_INVALIDATE:
559 pnv_phb3_rtc_invalidate(phb, val);
560 break;
561
562 /* FFI request */
563 case PHB_FFI_REQUEST:
564 pnv_phb3_msi_ffi(&phb->msis, val);
565 break;
566
567 /* Silent simple writes */
568 case PHB_CONFIG_ADDRESS:
569 case PHB_IODA_ADDR:
570 case PHB_TCE_KILL:
571 case PHB_TCE_SPEC_CTL:
572 case PHB_PEST_BAR:
573 case PHB_PELTV_BAR:
574 case PHB_RTT_BAR:
575 case PHB_RBA_BAR:
576 case PHB_IVT_BAR:
577 case PHB_FFI_LOCK:
578 case PHB_LEM_FIR_ACCUM:
579 case PHB_LEM_ERROR_MASK:
580 case PHB_LEM_ACTION0:
581 case PHB_LEM_ACTION1:
582 break;
583
584 /* Noise on anything else */
585 default:
586 qemu_log_mask(LOG_UNIMP, "phb3: reg_write 0x%"PRIx64"=%"PRIx64"\n",
587 off, val);
588 }
589 }
590
591 uint64_t pnv_phb3_reg_read(void *opaque, hwaddr off, unsigned size)
592 {
593 PnvPHB3 *phb = opaque;
594 PCIHostState *pci = PCI_HOST_BRIDGE(phb);
595 uint64_t val;
596
597 if ((off & 0xfffc) == PHB_CONFIG_DATA) {
598 return pnv_phb3_config_read(phb, off & 0x3, size);
599 }
600
601 /* Other registers are 64-bit only */
602 if (size != 8 || off & 0x7) {
603 phb3_error(phb, "Invalid register access, offset: 0x%"PRIx64" size: %d",
604 off, size);
605 return ~0ull;
606 }
607
608 /* Default read from cache */
609 val = phb->regs[off >> 3];
610
611 switch (off) {
612 /* Simulate venice DD2.0 */
613 case PHB_VERSION:
614 return 0x000000a300000005ull;
615 case PHB_PCIE_SYSTEM_CONFIG:
616 return 0x441100fc30000000;
617
618 /* IODA table accesses */
619 case PHB_IODA_DATA0:
620 return pnv_phb3_ioda_read(phb);
621
622 /* Link training always appears trained */
623 case PHB_PCIE_DLP_TRAIN_CTL:
624 if (!pci_find_device(pci->bus, 1, 0)) {
625 return 0;
626 }
627 return PHB_PCIE_DLP_INBAND_PRESENCE | PHB_PCIE_DLP_TC_DL_LINKACT;
628
629 /* FFI Lock */
630 case PHB_FFI_LOCK:
631 /* Set lock and return previous value */
632 phb->regs[off >> 3] |= PHB_FFI_LOCK_STATE;
633 return val;
634
635 /* DMA read sync: make it look like it's complete */
636 case PHB_DMARD_SYNC:
637 return PHB_DMARD_SYNC_COMPLETE;
638
639 /* Silent simple reads */
640 case PHB_PHB3_CONFIG:
641 case PHB_M32_BASE_ADDR:
642 case PHB_M32_BASE_MASK:
643 case PHB_M32_START_ADDR:
644 case PHB_CONFIG_ADDRESS:
645 case PHB_IODA_ADDR:
646 case PHB_RTC_INVALIDATE:
647 case PHB_TCE_KILL:
648 case PHB_TCE_SPEC_CTL:
649 case PHB_PEST_BAR:
650 case PHB_PELTV_BAR:
651 case PHB_RTT_BAR:
652 case PHB_RBA_BAR:
653 case PHB_IVT_BAR:
654 case PHB_M64_UPPER_BITS:
655 case PHB_LEM_FIR_ACCUM:
656 case PHB_LEM_ERROR_MASK:
657 case PHB_LEM_ACTION0:
658 case PHB_LEM_ACTION1:
659 break;
660
661 /* Noise on anything else */
662 default:
663 qemu_log_mask(LOG_UNIMP, "phb3: reg_read 0x%"PRIx64"=%"PRIx64"\n",
664 off, val);
665 }
666 return val;
667 }
668
669 static const MemoryRegionOps pnv_phb3_reg_ops = {
670 .read = pnv_phb3_reg_read,
671 .write = pnv_phb3_reg_write,
672 .valid.min_access_size = 1,
673 .valid.max_access_size = 8,
674 .impl.min_access_size = 1,
675 .impl.max_access_size = 8,
676 .endianness = DEVICE_BIG_ENDIAN,
677 };
678
679 static int pnv_phb3_map_irq(PCIDevice *pci_dev, int irq_num)
680 {
681 /* Check that out properly ... */
682 return irq_num & 3;
683 }
684
685 static void pnv_phb3_set_irq(void *opaque, int irq_num, int level)
686 {
687 PnvPHB3 *phb = opaque;
688
689 /* LSI only ... */
690 if (irq_num > 3) {
691 phb3_error(phb, "Unknown IRQ to set %d", irq_num);
692 }
693 qemu_set_irq(phb->qirqs[irq_num], level);
694 }
695
696 static bool pnv_phb3_resolve_pe(PnvPhb3DMASpace *ds)
697 {
698 uint64_t rtt, addr;
699 uint16_t rte;
700 int bus_num;
701
702 /* Already resolved ? */
703 if (ds->pe_num != PHB_INVALID_PE) {
704 return true;
705 }
706
707 /* We need to lookup the RTT */
708 rtt = ds->phb->regs[PHB_RTT_BAR >> 3];
709 if (!(rtt & PHB_RTT_BAR_ENABLE)) {
710 phb3_error(ds->phb, "DMA with RTT BAR disabled !");
711 /* Set error bits ? fence ? ... */
712 return false;
713 }
714
715 /* Read RTE */
716 bus_num = pci_bus_num(ds->bus);
717 addr = rtt & PHB_RTT_BASE_ADDRESS_MASK;
718 addr += 2 * ((bus_num << 8) | ds->devfn);
719 if (dma_memory_read(&address_space_memory, addr, &rte,
720 sizeof(rte), MEMTXATTRS_UNSPECIFIED)) {
721 phb3_error(ds->phb, "Failed to read RTT entry at 0x%"PRIx64, addr);
722 /* Set error bits ? fence ? ... */
723 return false;
724 }
725 rte = be16_to_cpu(rte);
726
727 /* Fail upon reading of invalid PE# */
728 if (rte >= PNV_PHB3_NUM_PE) {
729 phb3_error(ds->phb, "RTE for RID 0x%x invalid (%04x", ds->devfn, rte);
730 /* Set error bits ? fence ? ... */
731 return false;
732 }
733 ds->pe_num = rte;
734 return true;
735 }
736
737 static void pnv_phb3_translate_tve(PnvPhb3DMASpace *ds, hwaddr addr,
738 bool is_write, uint64_t tve,
739 IOMMUTLBEntry *tlb)
740 {
741 uint64_t tta = GETFIELD(IODA2_TVT_TABLE_ADDR, tve);
742 int32_t lev = GETFIELD(IODA2_TVT_NUM_LEVELS, tve);
743 uint32_t tts = GETFIELD(IODA2_TVT_TCE_TABLE_SIZE, tve);
744 uint32_t tps = GETFIELD(IODA2_TVT_IO_PSIZE, tve);
745 PnvPHB3 *phb = ds->phb;
746
747 /* Invalid levels */
748 if (lev > 4) {
749 phb3_error(phb, "Invalid #levels in TVE %d", lev);
750 return;
751 }
752
753 /* IO Page Size of 0 means untranslated, else use TCEs */
754 if (tps == 0) {
755 /*
756 * We only support non-translate in top window.
757 *
758 * TODO: Venice/Murano support it on bottom window above 4G and
759 * Naples suports it on everything
760 */
761 if (!(tve & PPC_BIT(51))) {
762 phb3_error(phb, "xlate for invalid non-translate TVE");
763 return;
764 }
765 /* TODO: Handle boundaries */
766
767 /* Use 4k pages like q35 ... for now */
768 tlb->iova = addr & 0xfffffffffffff000ull;
769 tlb->translated_addr = addr & 0x0003fffffffff000ull;
770 tlb->addr_mask = 0xfffull;
771 tlb->perm = IOMMU_RW;
772 } else {
773 uint32_t tce_shift, tbl_shift, sh;
774 uint64_t base, taddr, tce, tce_mask;
775
776 /* TVE disabled ? */
777 if (tts == 0) {
778 phb3_error(phb, "xlate for invalid translated TVE");
779 return;
780 }
781
782 /* Address bits per bottom level TCE entry */
783 tce_shift = tps + 11;
784
785 /* Address bits per table level */
786 tbl_shift = tts + 8;
787
788 /* Top level table base address */
789 base = tta << 12;
790
791 /* Total shift to first level */
792 sh = tbl_shift * lev + tce_shift;
793
794 /* TODO: Multi-level untested */
795 while ((lev--) >= 0) {
796 /* Grab the TCE address */
797 taddr = base | (((addr >> sh) & ((1ul << tbl_shift) - 1)) << 3);
798 if (dma_memory_read(&address_space_memory, taddr, &tce,
799 sizeof(tce), MEMTXATTRS_UNSPECIFIED)) {
800 phb3_error(phb, "Failed to read TCE at 0x%"PRIx64, taddr);
801 return;
802 }
803 tce = be64_to_cpu(tce);
804
805 /* Check permission for indirect TCE */
806 if ((lev >= 0) && !(tce & 3)) {
807 phb3_error(phb, "Invalid indirect TCE at 0x%"PRIx64, taddr);
808 phb3_error(phb, " xlate %"PRIx64":%c TVE=%"PRIx64, addr,
809 is_write ? 'W' : 'R', tve);
810 phb3_error(phb, " tta=%"PRIx64" lev=%d tts=%d tps=%d",
811 tta, lev, tts, tps);
812 return;
813 }
814 sh -= tbl_shift;
815 base = tce & ~0xfffull;
816 }
817
818 /* We exit the loop with TCE being the final TCE */
819 tce_mask = ~((1ull << tce_shift) - 1);
820 tlb->iova = addr & tce_mask;
821 tlb->translated_addr = tce & tce_mask;
822 tlb->addr_mask = ~tce_mask;
823 tlb->perm = tce & 3;
824 if ((is_write & !(tce & 2)) || ((!is_write) && !(tce & 1))) {
825 phb3_error(phb, "TCE access fault at 0x%"PRIx64, taddr);
826 phb3_error(phb, " xlate %"PRIx64":%c TVE=%"PRIx64, addr,
827 is_write ? 'W' : 'R', tve);
828 phb3_error(phb, " tta=%"PRIx64" lev=%d tts=%d tps=%d",
829 tta, lev, tts, tps);
830 }
831 }
832 }
833
834 static IOMMUTLBEntry pnv_phb3_translate_iommu(IOMMUMemoryRegion *iommu,
835 hwaddr addr,
836 IOMMUAccessFlags flag,
837 int iommu_idx)
838 {
839 PnvPhb3DMASpace *ds = container_of(iommu, PnvPhb3DMASpace, dma_mr);
840 int tve_sel;
841 uint64_t tve, cfg;
842 IOMMUTLBEntry ret = {
843 .target_as = &address_space_memory,
844 .iova = addr,
845 .translated_addr = 0,
846 .addr_mask = ~(hwaddr)0,
847 .perm = IOMMU_NONE,
848 };
849 PnvPHB3 *phb = ds->phb;
850
851 /* Resolve PE# */
852 if (!pnv_phb3_resolve_pe(ds)) {
853 phb3_error(phb, "Failed to resolve PE# for bus @%p (%d) devfn 0x%x",
854 ds->bus, pci_bus_num(ds->bus), ds->devfn);
855 return ret;
856 }
857
858 /* Check top bits */
859 switch (addr >> 60) {
860 case 00:
861 /* DMA or 32-bit MSI ? */
862 cfg = ds->phb->regs[PHB_PHB3_CONFIG >> 3];
863 if ((cfg & PHB_PHB3C_32BIT_MSI_EN) &&
864 ((addr & 0xffffffffffff0000ull) == 0xffff0000ull)) {
865 phb3_error(phb, "xlate on 32-bit MSI region");
866 return ret;
867 }
868 /* Choose TVE XXX Use PHB3 Control Register */
869 tve_sel = (addr >> 59) & 1;
870 tve = ds->phb->ioda_TVT[ds->pe_num * 2 + tve_sel];
871 pnv_phb3_translate_tve(ds, addr, flag & IOMMU_WO, tve, &ret);
872 break;
873 case 01:
874 phb3_error(phb, "xlate on 64-bit MSI region");
875 break;
876 default:
877 phb3_error(phb, "xlate on unsupported address 0x%"PRIx64, addr);
878 }
879 return ret;
880 }
881
882 #define TYPE_PNV_PHB3_IOMMU_MEMORY_REGION "pnv-phb3-iommu-memory-region"
883 DECLARE_INSTANCE_CHECKER(IOMMUMemoryRegion, PNV_PHB3_IOMMU_MEMORY_REGION,
884 TYPE_PNV_PHB3_IOMMU_MEMORY_REGION)
885
886 static void pnv_phb3_iommu_memory_region_class_init(ObjectClass *klass,
887 void *data)
888 {
889 IOMMUMemoryRegionClass *imrc = IOMMU_MEMORY_REGION_CLASS(klass);
890
891 imrc->translate = pnv_phb3_translate_iommu;
892 }
893
894 static const TypeInfo pnv_phb3_iommu_memory_region_info = {
895 .parent = TYPE_IOMMU_MEMORY_REGION,
896 .name = TYPE_PNV_PHB3_IOMMU_MEMORY_REGION,
897 .class_init = pnv_phb3_iommu_memory_region_class_init,
898 };
899
900 /*
901 * MSI/MSIX memory region implementation.
902 * The handler handles both MSI and MSIX.
903 */
904 static void pnv_phb3_msi_write(void *opaque, hwaddr addr,
905 uint64_t data, unsigned size)
906 {
907 PnvPhb3DMASpace *ds = opaque;
908
909 /* Resolve PE# */
910 if (!pnv_phb3_resolve_pe(ds)) {
911 phb3_error(ds->phb, "Failed to resolve PE# for bus @%p (%d) devfn 0x%x",
912 ds->bus, pci_bus_num(ds->bus), ds->devfn);
913 return;
914 }
915
916 pnv_phb3_msi_send(&ds->phb->msis, addr, data, ds->pe_num);
917 }
918
919 /* There is no .read as the read result is undefined by PCI spec */
920 static uint64_t pnv_phb3_msi_read(void *opaque, hwaddr addr, unsigned size)
921 {
922 PnvPhb3DMASpace *ds = opaque;
923
924 phb3_error(ds->phb, "invalid read @ 0x%" HWADDR_PRIx, addr);
925 return -1;
926 }
927
928 static const MemoryRegionOps pnv_phb3_msi_ops = {
929 .read = pnv_phb3_msi_read,
930 .write = pnv_phb3_msi_write,
931 .endianness = DEVICE_LITTLE_ENDIAN
932 };
933
934 static AddressSpace *pnv_phb3_dma_iommu(PCIBus *bus, void *opaque, int devfn)
935 {
936 PnvPHB3 *phb = opaque;
937 PnvPhb3DMASpace *ds;
938
939 QLIST_FOREACH(ds, &phb->dma_spaces, list) {
940 if (ds->bus == bus && ds->devfn == devfn) {
941 break;
942 }
943 }
944
945 if (ds == NULL) {
946 ds = g_malloc0(sizeof(PnvPhb3DMASpace));
947 ds->bus = bus;
948 ds->devfn = devfn;
949 ds->pe_num = PHB_INVALID_PE;
950 ds->phb = phb;
951 memory_region_init_iommu(&ds->dma_mr, sizeof(ds->dma_mr),
952 TYPE_PNV_PHB3_IOMMU_MEMORY_REGION,
953 OBJECT(phb), "phb3_iommu", UINT64_MAX);
954 address_space_init(&ds->dma_as, MEMORY_REGION(&ds->dma_mr),
955 "phb3_iommu");
956 memory_region_init_io(&ds->msi32_mr, OBJECT(phb), &pnv_phb3_msi_ops,
957 ds, "msi32", 0x10000);
958 memory_region_init_io(&ds->msi64_mr, OBJECT(phb), &pnv_phb3_msi_ops,
959 ds, "msi64", 0x100000);
960 pnv_phb3_update_msi_regions(ds);
961
962 QLIST_INSERT_HEAD(&phb->dma_spaces, ds, list);
963 }
964 return &ds->dma_as;
965 }
966
967 static void pnv_phb3_instance_init(Object *obj)
968 {
969 PnvPHB3 *phb = PNV_PHB3(obj);
970
971 QLIST_INIT(&phb->dma_spaces);
972
973 /* LSI sources */
974 object_initialize_child(obj, "lsi", &phb->lsis, TYPE_ICS);
975
976 /* Default init ... will be fixed by HW inits */
977 phb->lsis.offset = 0;
978
979 /* MSI sources */
980 object_initialize_child(obj, "msi", &phb->msis, TYPE_PHB3_MSI);
981
982 /* Power Bus Common Queue */
983 object_initialize_child(obj, "pbcq", &phb->pbcq, TYPE_PNV_PBCQ);
984
985 }
986
987 static void pnv_phb3_realize(DeviceState *dev, Error **errp)
988 {
989 PnvPHB3 *phb = PNV_PHB3(dev);
990 PCIHostState *pci = PCI_HOST_BRIDGE(dev);
991 PnvMachineState *pnv = PNV_MACHINE(qdev_get_machine());
992 int i;
993
994 /* User created devices */
995 if (!phb->chip) {
996 Error *local_err = NULL;
997 BusState *s;
998
999 phb->chip = pnv_get_chip(pnv, phb->chip_id);
1000 if (!phb->chip) {
1001 error_setg(errp, "invalid chip id: %d", phb->chip_id);
1002 return;
1003 }
1004
1005 /*
1006 * Reparent user created devices to the chip to build
1007 * correctly the device tree.
1008 */
1009 pnv_chip_parent_fixup(phb->chip, OBJECT(phb), phb->phb_id);
1010
1011 s = qdev_get_parent_bus(DEVICE(phb->chip));
1012 if (!qdev_set_parent_bus(DEVICE(phb), s, &local_err)) {
1013 error_propagate(errp, local_err);
1014 return;
1015 }
1016 }
1017
1018 if (phb->phb_id >= PNV_CHIP_GET_CLASS(phb->chip)->num_phbs) {
1019 error_setg(errp, "invalid PHB index: %d", phb->phb_id);
1020 return;
1021 }
1022
1023 /* LSI sources */
1024 object_property_set_link(OBJECT(&phb->lsis), "xics", OBJECT(pnv),
1025 &error_abort);
1026 object_property_set_int(OBJECT(&phb->lsis), "nr-irqs", PNV_PHB3_NUM_LSI,
1027 &error_abort);
1028 if (!qdev_realize(DEVICE(&phb->lsis), NULL, errp)) {
1029 return;
1030 }
1031
1032 for (i = 0; i < phb->lsis.nr_irqs; i++) {
1033 ics_set_irq_type(&phb->lsis, i, true);
1034 }
1035
1036 phb->qirqs = qemu_allocate_irqs(ics_set_irq, &phb->lsis, phb->lsis.nr_irqs);
1037
1038 /* MSI sources */
1039 object_property_set_link(OBJECT(&phb->msis), "phb", OBJECT(phb),
1040 &error_abort);
1041 object_property_set_link(OBJECT(&phb->msis), "xics", OBJECT(pnv),
1042 &error_abort);
1043 object_property_set_int(OBJECT(&phb->msis), "nr-irqs", PHB3_MAX_MSI,
1044 &error_abort);
1045 if (!qdev_realize(DEVICE(&phb->msis), NULL, errp)) {
1046 return;
1047 }
1048
1049 /* Power Bus Common Queue */
1050 object_property_set_link(OBJECT(&phb->pbcq), "phb", OBJECT(phb),
1051 &error_abort);
1052 if (!qdev_realize(DEVICE(&phb->pbcq), NULL, errp)) {
1053 return;
1054 }
1055
1056 /* Controller Registers */
1057 memory_region_init_io(&phb->mr_regs, OBJECT(phb), &pnv_phb3_reg_ops, phb,
1058 "phb3-regs", 0x1000);
1059
1060 /*
1061 * PHB3 doesn't support IO space. However, qemu gets very upset if
1062 * we don't have an IO region to anchor IO BARs onto so we just
1063 * initialize one which we never hook up to anything
1064 */
1065 memory_region_init(&phb->pci_io, OBJECT(phb), "pci-io", 0x10000);
1066 memory_region_init(&phb->pci_mmio, OBJECT(phb), "pci-mmio",
1067 PCI_MMIO_TOTAL_SIZE);
1068
1069 pci->bus = pci_register_root_bus(dev,
1070 dev->id ? dev->id : NULL,
1071 pnv_phb3_set_irq, pnv_phb3_map_irq, phb,
1072 &phb->pci_mmio, &phb->pci_io,
1073 0, 4, TYPE_PNV_PHB3_ROOT_BUS);
1074
1075 pci_setup_iommu(pci->bus, pnv_phb3_dma_iommu, phb);
1076
1077 if (defaults_enabled()) {
1078 pnv_phb_attach_root_port(PCI_HOST_BRIDGE(phb),
1079 TYPE_PNV_PHB3_ROOT_PORT);
1080 }
1081 }
1082
1083 void pnv_phb3_update_regions(PnvPHB3 *phb)
1084 {
1085 PnvPBCQState *pbcq = &phb->pbcq;
1086
1087 /* Unmap first always */
1088 if (memory_region_is_mapped(&phb->mr_regs)) {
1089 memory_region_del_subregion(&pbcq->phbbar, &phb->mr_regs);
1090 }
1091
1092 /* Map registers if enabled */
1093 if (memory_region_is_mapped(&pbcq->phbbar)) {
1094 /* TODO: We should use the PHB BAR 2 register but we don't ... */
1095 memory_region_add_subregion(&pbcq->phbbar, 0, &phb->mr_regs);
1096 }
1097
1098 /* Check/update m32 */
1099 if (memory_region_is_mapped(&phb->mr_m32)) {
1100 pnv_phb3_check_m32(phb);
1101 }
1102 pnv_phb3_check_all_m64s(phb);
1103 }
1104
1105 static const char *pnv_phb3_root_bus_path(PCIHostState *host_bridge,
1106 PCIBus *rootbus)
1107 {
1108 PnvPHB3 *phb = PNV_PHB3(host_bridge);
1109
1110 snprintf(phb->bus_path, sizeof(phb->bus_path), "00%02x:%02x",
1111 phb->chip_id, phb->phb_id);
1112 return phb->bus_path;
1113 }
1114
1115 static Property pnv_phb3_properties[] = {
1116 DEFINE_PROP_UINT32("index", PnvPHB3, phb_id, 0),
1117 DEFINE_PROP_UINT32("chip-id", PnvPHB3, chip_id, 0),
1118 DEFINE_PROP_LINK("chip", PnvPHB3, chip, TYPE_PNV_CHIP, PnvChip *),
1119 DEFINE_PROP_END_OF_LIST(),
1120 };
1121
1122 static void pnv_phb3_class_init(ObjectClass *klass, void *data)
1123 {
1124 PCIHostBridgeClass *hc = PCI_HOST_BRIDGE_CLASS(klass);
1125 DeviceClass *dc = DEVICE_CLASS(klass);
1126
1127 hc->root_bus_path = pnv_phb3_root_bus_path;
1128 dc->realize = pnv_phb3_realize;
1129 device_class_set_props(dc, pnv_phb3_properties);
1130 set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
1131 dc->user_creatable = true;
1132 }
1133
1134 static const TypeInfo pnv_phb3_type_info = {
1135 .name = TYPE_PNV_PHB3,
1136 .parent = TYPE_PCIE_HOST_BRIDGE,
1137 .instance_size = sizeof(PnvPHB3),
1138 .class_init = pnv_phb3_class_init,
1139 .instance_init = pnv_phb3_instance_init,
1140 };
1141
1142 static void pnv_phb3_root_bus_class_init(ObjectClass *klass, void *data)
1143 {
1144 BusClass *k = BUS_CLASS(klass);
1145
1146 /*
1147 * PHB3 has only a single root complex. Enforce the limit on the
1148 * parent bus
1149 */
1150 k->max_dev = 1;
1151 }
1152
1153 static const TypeInfo pnv_phb3_root_bus_info = {
1154 .name = TYPE_PNV_PHB3_ROOT_BUS,
1155 .parent = TYPE_PCIE_BUS,
1156 .class_init = pnv_phb3_root_bus_class_init,
1157 .interfaces = (InterfaceInfo[]) {
1158 { INTERFACE_PCIE_DEVICE },
1159 { }
1160 },
1161 };
1162
1163 static void pnv_phb3_root_port_realize(DeviceState *dev, Error **errp)
1164 {
1165 PCIERootPortClass *rpc = PCIE_ROOT_PORT_GET_CLASS(dev);
1166 PCIDevice *pci = PCI_DEVICE(dev);
1167 PCIBus *bus = pci_get_bus(pci);
1168 PnvPHB3 *phb = NULL;
1169 Error *local_err = NULL;
1170
1171 phb = (PnvPHB3 *) object_dynamic_cast(OBJECT(bus->qbus.parent),
1172 TYPE_PNV_PHB3);
1173
1174 if (!phb) {
1175 error_setg(errp,
1176 "pnv_phb3_root_port devices must be connected to pnv-phb3 buses");
1177 return;
1178 }
1179
1180 /* Set unique chassis/slot values for the root port */
1181 qdev_prop_set_uint8(&pci->qdev, "chassis", phb->chip_id);
1182 qdev_prop_set_uint16(&pci->qdev, "slot", phb->phb_id);
1183
1184 rpc->parent_realize(dev, &local_err);
1185 if (local_err) {
1186 error_propagate(errp, local_err);
1187 return;
1188 }
1189 }
1190
1191 static void pnv_phb3_root_port_class_init(ObjectClass *klass, void *data)
1192 {
1193 DeviceClass *dc = DEVICE_CLASS(klass);
1194 PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
1195 PCIERootPortClass *rpc = PCIE_ROOT_PORT_CLASS(klass);
1196
1197 dc->desc = "IBM PHB3 PCIE Root Port";
1198
1199 device_class_set_parent_realize(dc, pnv_phb3_root_port_realize,
1200 &rpc->parent_realize);
1201 dc->user_creatable = true;
1202
1203 k->vendor_id = PCI_VENDOR_ID_IBM;
1204 k->device_id = 0x03dc;
1205 k->revision = 0;
1206
1207 rpc->exp_offset = 0x48;
1208 rpc->aer_offset = 0x100;
1209 }
1210
1211 static const TypeInfo pnv_phb3_root_port_info = {
1212 .name = TYPE_PNV_PHB3_ROOT_PORT,
1213 .parent = TYPE_PCIE_ROOT_PORT,
1214 .instance_size = sizeof(PnvPHB3RootPort),
1215 .class_init = pnv_phb3_root_port_class_init,
1216 };
1217
1218 static void pnv_phb3_register_types(void)
1219 {
1220 type_register_static(&pnv_phb3_root_bus_info);
1221 type_register_static(&pnv_phb3_root_port_info);
1222 type_register_static(&pnv_phb3_type_info);
1223 type_register_static(&pnv_phb3_iommu_memory_region_info);
1224 }
1225
1226 type_init(pnv_phb3_register_types)