1 /*
2 * QEMU CXL Devices
3 *
4 * Copyright (c) 2020 Intel
5 *
6 * This work is licensed under the terms of the GNU GPL, version 2. See the
7 * COPYING file in the top-level directory.
8 */
9
10 #ifndef CXL_DEVICE_H
11 #define CXL_DEVICE_H
12
13 #include "hw/cxl/cxl_component.h"
14 #include "hw/pci/pci_device.h"
15 #include "hw/register.h"
16 #include "hw/cxl/cxl_events.h"
17
18 /*
19 * The following is how a CXL device's Memory Device registers are laid out.
20 * The only requirement from the spec is that the capabilities array and the
21 * capability headers start at offset 0 and are contiguously packed. The headers
22 * themselves provide offsets to the register fields. For this emulation, the
23 * actual registers * will start at offset 0x80 (m == 0x80). No secondary
24 * mailbox is implemented which means that the offset of the start of the
25 * mailbox payload (n) is given by
26 * n = m + sizeof(mailbox registers) + sizeof(device registers).
27 *
28 * +---------------------------------+
29 * | |
30 * | Memory Device Registers |
31 * | |
32 * n + PAYLOAD_SIZE_MAX -----------------------------------
33 * ^ | |
34 * | | |
35 * | | |
36 * | | |
37 * | | |
38 * | | Mailbox Payload |
39 * | | |
40 * | | |
41 * | | |
42 * n -----------------------------------
43 * ^ | Mailbox Registers |
44 * | | |
45 * | -----------------------------------
46 * | | |
47 * | | Device Registers |
48 * | | |
49 * m ---------------------------------->
50 * ^ | Memory Device Capability Header|
51 * | -----------------------------------
52 * | | Mailbox Capability Header |
53 * | -----------------------------------
54 * | | Device Capability Header |
55 * | -----------------------------------
56 * | | Device Cap Array Register |
57 * 0 +---------------------------------+
58 *
59 */
60
61 #define CXL_DEVICE_CAP_HDR1_OFFSET 0x10 /* Figure 138 */
62 #define CXL_DEVICE_CAP_REG_SIZE 0x10 /* 8.2.8.2 */
63 #define CXL_DEVICE_CAPS_MAX 4 /* 8.2.8.2.1 + 8.2.8.5 */
64 #define CXL_CAPS_SIZE \
65 (CXL_DEVICE_CAP_REG_SIZE * (CXL_DEVICE_CAPS_MAX + 1)) /* +1 for header */
66
67 #define CXL_DEVICE_STATUS_REGISTERS_OFFSET 0x80 /* Read comment above */
68 #define CXL_DEVICE_STATUS_REGISTERS_LENGTH 0x8 /* 8.2.8.3.1 */
69
70 #define CXL_MAILBOX_REGISTERS_OFFSET \
71 (CXL_DEVICE_STATUS_REGISTERS_OFFSET + CXL_DEVICE_STATUS_REGISTERS_LENGTH)
72 #define CXL_MAILBOX_REGISTERS_SIZE 0x20 /* 8.2.8.4, Figure 139 */
73 #define CXL_MAILBOX_PAYLOAD_SHIFT 11
74 #define CXL_MAILBOX_MAX_PAYLOAD_SIZE (1 << CXL_MAILBOX_PAYLOAD_SHIFT)
75 #define CXL_MAILBOX_REGISTERS_LENGTH \
76 (CXL_MAILBOX_REGISTERS_SIZE + CXL_MAILBOX_MAX_PAYLOAD_SIZE)
77
78 #define CXL_MEMORY_DEVICE_REGISTERS_OFFSET \
79 (CXL_MAILBOX_REGISTERS_OFFSET + CXL_MAILBOX_REGISTERS_LENGTH)
80 #define CXL_MEMORY_DEVICE_REGISTERS_LENGTH 0x8
81
82 #define CXL_MMIO_SIZE \
83 (CXL_DEVICE_CAP_REG_SIZE + CXL_DEVICE_STATUS_REGISTERS_LENGTH + \
84 CXL_MAILBOX_REGISTERS_LENGTH + CXL_MEMORY_DEVICE_REGISTERS_LENGTH)
85
86 /* 8.2.8.4.5.1 Command Return Codes */
87 typedef enum {
88 CXL_MBOX_SUCCESS = 0x0,
89 CXL_MBOX_BG_STARTED = 0x1,
90 CXL_MBOX_INVALID_INPUT = 0x2,
91 CXL_MBOX_UNSUPPORTED = 0x3,
92 CXL_MBOX_INTERNAL_ERROR = 0x4,
93 CXL_MBOX_RETRY_REQUIRED = 0x5,
94 CXL_MBOX_BUSY = 0x6,
95 CXL_MBOX_MEDIA_DISABLED = 0x7,
96 CXL_MBOX_FW_XFER_IN_PROGRESS = 0x8,
97 CXL_MBOX_FW_XFER_OUT_OF_ORDER = 0x9,
98 CXL_MBOX_FW_AUTH_FAILED = 0xa,
99 CXL_MBOX_FW_INVALID_SLOT = 0xb,
100 CXL_MBOX_FW_ROLLEDBACK = 0xc,
101 CXL_MBOX_FW_REST_REQD = 0xd,
102 CXL_MBOX_INVALID_HANDLE = 0xe,
103 CXL_MBOX_INVALID_PA = 0xf,
104 CXL_MBOX_INJECT_POISON_LIMIT = 0x10,
105 CXL_MBOX_PERMANENT_MEDIA_FAILURE = 0x11,
106 CXL_MBOX_ABORTED = 0x12,
107 CXL_MBOX_INVALID_SECURITY_STATE = 0x13,
108 CXL_MBOX_INCORRECT_PASSPHRASE = 0x14,
109 CXL_MBOX_UNSUPPORTED_MAILBOX = 0x15,
110 CXL_MBOX_INVALID_PAYLOAD_LENGTH = 0x16,
111 CXL_MBOX_MAX = 0x17
112 } CXLRetCode;
113
114 typedef struct CXLCCI CXLCCI;
115 typedef struct cxl_device_state CXLDeviceState;
116 struct cxl_cmd;
117 typedef CXLRetCode (*opcode_handler)(const struct cxl_cmd *cmd,
118 uint8_t *payload_in, size_t len_in,
119 uint8_t *payload_out, size_t *len_out,
120 CXLCCI *cci);
121 struct cxl_cmd {
122 const char *name;
123 opcode_handler handler;
124 ssize_t in;
125 uint16_t effect; /* Reported in CEL */
126 };
127
128 typedef struct CXLEvent {
129 CXLEventRecordRaw data;
130 QSIMPLEQ_ENTRY(CXLEvent) node;
131 } CXLEvent;
132
133 typedef struct CXLEventLog {
134 uint16_t next_handle;
135 uint16_t overflow_err_count;
136 uint64_t first_overflow_timestamp;
137 uint64_t last_overflow_timestamp;
138 bool irq_enabled;
139 int irq_vec;
140 QemuMutex lock;
141 QSIMPLEQ_HEAD(, CXLEvent) events;
142 } CXLEventLog;
143
144 typedef struct CXLCCI {
145 const struct cxl_cmd (*cxl_cmd_set)[256];
146 struct cel_log {
147 uint16_t opcode;
148 uint16_t effect;
149 } cel_log[1 << 16];
150 size_t cel_size;
151
152 /* background command handling (times in ms) */
153 struct {
154 uint16_t opcode;
155 uint16_t complete_pct;
156 uint16_t ret_code; /* Current value of retcode */
157 uint64_t starttime;
158 /* set by each bg cmd, cleared by the bg_timer when complete */
159 uint64_t runtime;
160 QEMUTimer *timer;
161 } bg;
162 size_t payload_max;
163 /* Pointer to device hosting the CCI */
164 DeviceState *d;
165 /* Pointer to the device hosting the protocol conversion */
166 DeviceState *intf;
167 } CXLCCI;
168
169 typedef struct cxl_device_state {
170 MemoryRegion device_registers;
171
172 /* mmio for device capabilities array - 8.2.8.2 */
173 struct {
174 MemoryRegion device;
175 union {
176 uint8_t dev_reg_state[CXL_DEVICE_STATUS_REGISTERS_LENGTH];
177 uint16_t dev_reg_state16[CXL_DEVICE_STATUS_REGISTERS_LENGTH / 2];
178 uint32_t dev_reg_state32[CXL_DEVICE_STATUS_REGISTERS_LENGTH / 4];
179 uint64_t dev_reg_state64[CXL_DEVICE_STATUS_REGISTERS_LENGTH / 8];
180 };
181 uint64_t event_status;
182 };
183 MemoryRegion memory_device;
184 struct {
185 MemoryRegion caps;
186 union {
187 uint32_t caps_reg_state32[CXL_CAPS_SIZE / 4];
188 uint64_t caps_reg_state64[CXL_CAPS_SIZE / 8];
189 };
190 };
191
192 /* mmio for the mailbox registers 8.2.8.4 */
193 struct {
194 MemoryRegion mailbox;
195 uint16_t payload_size;
196 uint8_t mbox_msi_n;
197 union {
198 uint8_t mbox_reg_state[CXL_MAILBOX_REGISTERS_LENGTH];
199 uint16_t mbox_reg_state16[CXL_MAILBOX_REGISTERS_LENGTH / 2];
200 uint32_t mbox_reg_state32[CXL_MAILBOX_REGISTERS_LENGTH / 4];
201 uint64_t mbox_reg_state64[CXL_MAILBOX_REGISTERS_LENGTH / 8];
202 };
203 };
204
205 /* Stash the memory device status value */
206 uint64_t memdev_status;
207
208 struct {
209 bool set;
210 uint64_t last_set;
211 uint64_t host_set;
212 } timestamp;
213
214 /* memory region size, HDM */
215 uint64_t mem_size;
216 uint64_t pmem_size;
217 uint64_t vmem_size;
218
219 const struct cxl_cmd (*cxl_cmd_set)[256];
220 CXLEventLog event_logs[CXL_EVENT_TYPE_MAX];
221 } CXLDeviceState;
222
223 /* Initialize the register block for a device */
224 void cxl_device_register_block_init(Object *obj, CXLDeviceState *dev,
225 CXLCCI *cci);
226
227 typedef struct CXLType3Dev CXLType3Dev;
228 typedef struct CSWMBCCIDev CSWMBCCIDev;
229 /* Set up default values for the register block */
230 void cxl_device_register_init_t3(CXLType3Dev *ct3d);
231 void cxl_device_register_init_swcci(CSWMBCCIDev *sw);
232
233 /*
234 * CXL 2.0 - 8.2.8.1 including errata F4
235 * Documented as a 128 bit register, but 64 bit accesses and the second
236 * 64 bits are currently reserved.
237 */
238 REG64(CXL_DEV_CAP_ARRAY, 0)
239 FIELD(CXL_DEV_CAP_ARRAY, CAP_ID, 0, 16)
240 FIELD(CXL_DEV_CAP_ARRAY, CAP_VERSION, 16, 8)
241 FIELD(CXL_DEV_CAP_ARRAY, CAP_COUNT, 32, 16)
242
243 void cxl_event_set_status(CXLDeviceState *cxl_dstate, CXLEventLogType log_type,
244 bool available);
245
246 /*
247 * Helper macro to initialize capability headers for CXL devices.
248 *
249 * In the 8.2.8.2, this is listed as a 128b register, but in 8.2.8, it says:
250 * > No registers defined in Section 8.2.8 are larger than 64-bits wide so that
251 * > is the maximum access size allowed for these registers. If this rule is not
252 * > followed, the behavior is undefined
253 *
254 * CXL 2.0 Errata F4 states further that the layouts in the specification are
255 * shown as greater than 128 bits, but implementations are expected to
256 * use any size of access up to 64 bits.
257 *
258 * Here we've chosen to make it 4 dwords. The spec allows any pow2 multiple
259 * access to be used for a register up to 64 bits.
260 */
261 #define CXL_DEVICE_CAPABILITY_HEADER_REGISTER(n, offset) \
262 REG32(CXL_DEV_##n##_CAP_HDR0, offset) \
263 FIELD(CXL_DEV_##n##_CAP_HDR0, CAP_ID, 0, 16) \
264 FIELD(CXL_DEV_##n##_CAP_HDR0, CAP_VERSION, 16, 8) \
265 REG32(CXL_DEV_##n##_CAP_HDR1, offset + 4) \
266 FIELD(CXL_DEV_##n##_CAP_HDR1, CAP_OFFSET, 0, 32) \
267 REG32(CXL_DEV_##n##_CAP_HDR2, offset + 8) \
268 FIELD(CXL_DEV_##n##_CAP_HDR2, CAP_LENGTH, 0, 32)
269
270 CXL_DEVICE_CAPABILITY_HEADER_REGISTER(DEVICE_STATUS, CXL_DEVICE_CAP_HDR1_OFFSET)
271 CXL_DEVICE_CAPABILITY_HEADER_REGISTER(MAILBOX, CXL_DEVICE_CAP_HDR1_OFFSET + \
272 CXL_DEVICE_CAP_REG_SIZE)
273 CXL_DEVICE_CAPABILITY_HEADER_REGISTER(MEMORY_DEVICE,
274 CXL_DEVICE_CAP_HDR1_OFFSET +
275 CXL_DEVICE_CAP_REG_SIZE * 2)
276
277 void cxl_initialize_mailbox_t3(CXLCCI *cci, DeviceState *d, size_t payload_max);
278 void cxl_initialize_mailbox_swcci(CXLCCI *cci, DeviceState *intf,
279 DeviceState *d, size_t payload_max);
280 void cxl_init_cci(CXLCCI *cci, size_t payload_max);
281 int cxl_process_cci_message(CXLCCI *cci, uint8_t set, uint8_t cmd,
282 size_t len_in, uint8_t *pl_in,
283 size_t *len_out, uint8_t *pl_out,
284 bool *bg_started);
285 void cxl_initialize_t3_fm_owned_ld_mctpcci(CXLCCI *cci, DeviceState *d,
286 DeviceState *intf,
287 size_t payload_max);
288
289 void cxl_initialize_t3_ld_cci(CXLCCI *cci, DeviceState *d,
290 DeviceState *intf, size_t payload_max);
291
292 #define cxl_device_cap_init(dstate, reg, cap_id, ver) \
293 do { \
294 uint32_t *cap_hdrs = dstate->caps_reg_state32; \
295 int which = R_CXL_DEV_##reg##_CAP_HDR0; \
296 cap_hdrs[which] = \
297 FIELD_DP32(cap_hdrs[which], CXL_DEV_##reg##_CAP_HDR0, \
298 CAP_ID, cap_id); \
299 cap_hdrs[which] = FIELD_DP32( \
300 cap_hdrs[which], CXL_DEV_##reg##_CAP_HDR0, CAP_VERSION, ver); \
301 cap_hdrs[which + 1] = \
302 FIELD_DP32(cap_hdrs[which + 1], CXL_DEV_##reg##_CAP_HDR1, \
303 CAP_OFFSET, CXL_##reg##_REGISTERS_OFFSET); \
304 cap_hdrs[which + 2] = \
305 FIELD_DP32(cap_hdrs[which + 2], CXL_DEV_##reg##_CAP_HDR2, \
306 CAP_LENGTH, CXL_##reg##_REGISTERS_LENGTH); \
307 } while (0)
308
309 /* CXL 3.0 8.2.8.3.1 Event Status Register */
310 REG64(CXL_DEV_EVENT_STATUS, 0)
311 FIELD(CXL_DEV_EVENT_STATUS, EVENT_STATUS, 0, 32)
312
313 /* CXL 2.0 8.2.8.4.3 Mailbox Capabilities Register */
314 REG32(CXL_DEV_MAILBOX_CAP, 0)
315 FIELD(CXL_DEV_MAILBOX_CAP, PAYLOAD_SIZE, 0, 5)
316 FIELD(CXL_DEV_MAILBOX_CAP, INT_CAP, 5, 1)
317 FIELD(CXL_DEV_MAILBOX_CAP, BG_INT_CAP, 6, 1)
318 FIELD(CXL_DEV_MAILBOX_CAP, MSI_N, 7, 4)
319
320 /* CXL 2.0 8.2.8.4.4 Mailbox Control Register */
321 REG32(CXL_DEV_MAILBOX_CTRL, 4)
322 FIELD(CXL_DEV_MAILBOX_CTRL, DOORBELL, 0, 1)
323 FIELD(CXL_DEV_MAILBOX_CTRL, INT_EN, 1, 1)
324 FIELD(CXL_DEV_MAILBOX_CTRL, BG_INT_EN, 2, 1)
325
326 /* CXL 2.0 8.2.8.4.5 Command Register */
327 REG64(CXL_DEV_MAILBOX_CMD, 8)
328 FIELD(CXL_DEV_MAILBOX_CMD, COMMAND, 0, 8)
329 FIELD(CXL_DEV_MAILBOX_CMD, COMMAND_SET, 8, 8)
330 FIELD(CXL_DEV_MAILBOX_CMD, LENGTH, 16, 20)
331
332 /* CXL 2.0 8.2.8.4.6 Mailbox Status Register */
333 REG64(CXL_DEV_MAILBOX_STS, 0x10)
334 FIELD(CXL_DEV_MAILBOX_STS, BG_OP, 0, 1)
335 FIELD(CXL_DEV_MAILBOX_STS, ERRNO, 32, 16)
336 FIELD(CXL_DEV_MAILBOX_STS, VENDOR_ERRNO, 48, 16)
337
338 /* CXL 2.0 8.2.8.4.7 Background Command Status Register */
339 REG64(CXL_DEV_BG_CMD_STS, 0x18)
340 FIELD(CXL_DEV_BG_CMD_STS, OP, 0, 16)
341 FIELD(CXL_DEV_BG_CMD_STS, PERCENTAGE_COMP, 16, 7)
342 FIELD(CXL_DEV_BG_CMD_STS, RET_CODE, 32, 16)
343 FIELD(CXL_DEV_BG_CMD_STS, VENDOR_RET_CODE, 48, 16)
344
345 /* CXL 2.0 8.2.8.4.8 Command Payload Registers */
346 REG32(CXL_DEV_CMD_PAYLOAD, 0x20)
347
348 REG64(CXL_MEM_DEV_STS, 0)
349 FIELD(CXL_MEM_DEV_STS, FATAL, 0, 1)
350 FIELD(CXL_MEM_DEV_STS, FW_HALT, 1, 1)
351 FIELD(CXL_MEM_DEV_STS, MEDIA_STATUS, 2, 2)
352 FIELD(CXL_MEM_DEV_STS, MBOX_READY, 4, 1)
353 FIELD(CXL_MEM_DEV_STS, RESET_NEEDED, 5, 3)
354
__toggle_media(CXLDeviceState * cxl_dstate,int val)355 static inline void __toggle_media(CXLDeviceState *cxl_dstate, int val)
356 {
357 uint64_t dev_status_reg;
358
359 dev_status_reg = cxl_dstate->memdev_status;
360 dev_status_reg = FIELD_DP64(dev_status_reg, CXL_MEM_DEV_STS, MEDIA_STATUS,
361 val);
362 cxl_dstate->memdev_status = dev_status_reg;
363 }
364 #define cxl_dev_disable_media(cxlds) \
365 do { __toggle_media((cxlds), 0x3); } while (0)
366 #define cxl_dev_enable_media(cxlds) \
367 do { __toggle_media((cxlds), 0x1); } while (0)
368
sanitize_running(CXLCCI * cci)369 static inline bool sanitize_running(CXLCCI *cci)
370 {
371 return !!cci->bg.runtime && cci->bg.opcode == 0x4400;
372 }
373
374 typedef struct CXLError {
375 QTAILQ_ENTRY(CXLError) node;
376 int type; /* Error code as per FE definition */
377 uint32_t header[CXL_RAS_ERR_HEADER_NUM];
378 } CXLError;
379
380 typedef QTAILQ_HEAD(, CXLError) CXLErrorList;
381
382 typedef struct CXLPoison {
383 uint64_t start, length;
384 uint8_t type;
385 #define CXL_POISON_TYPE_EXTERNAL 0x1
386 #define CXL_POISON_TYPE_INTERNAL 0x2
387 #define CXL_POISON_TYPE_INJECTED 0x3
388 QLIST_ENTRY(CXLPoison) node;
389 } CXLPoison;
390
391 typedef QLIST_HEAD(, CXLPoison) CXLPoisonList;
392 #define CXL_POISON_LIST_LIMIT 256
393
394 struct CXLType3Dev {
395 /* Private */
396 PCIDevice parent_obj;
397
398 /* Properties */
399 HostMemoryBackend *hostmem; /* deprecated */
400 HostMemoryBackend *hostvmem;
401 HostMemoryBackend *hostpmem;
402 HostMemoryBackend *lsa;
403 uint64_t sn;
404
405 /* State */
406 AddressSpace hostvmem_as;
407 AddressSpace hostpmem_as;
408 CXLComponentState cxl_cstate;
409 CXLDeviceState cxl_dstate;
410 CXLCCI cci; /* Primary PCI mailbox CCI */
411 /* Always initialized as no way to know if a VDM might show up */
412 CXLCCI vdm_fm_owned_ld_mctp_cci;
413 CXLCCI ld0_cci;
414
415 /* DOE */
416 DOECap doe_cdat;
417
418 /* Error injection */
419 CXLErrorList error_list;
420
421 /* Poison Injection - cache */
422 CXLPoisonList poison_list;
423 unsigned int poison_list_cnt;
424 bool poison_list_overflowed;
425 uint64_t poison_list_overflow_ts;
426 };
427
428 #define TYPE_CXL_TYPE3 "cxl-type3"
429 OBJECT_DECLARE_TYPE(CXLType3Dev, CXLType3Class, CXL_TYPE3)
430
431 struct CXLType3Class {
432 /* Private */
433 PCIDeviceClass parent_class;
434
435 /* public */
436 uint64_t (*get_lsa_size)(CXLType3Dev *ct3d);
437
438 uint64_t (*get_lsa)(CXLType3Dev *ct3d, void *buf, uint64_t size,
439 uint64_t offset);
440 void (*set_lsa)(CXLType3Dev *ct3d, const void *buf, uint64_t size,
441 uint64_t offset);
442 bool (*set_cacheline)(CXLType3Dev *ct3d, uint64_t dpa_offset,
443 uint8_t *data);
444 };
445
446 struct CSWMBCCIDev {
447 PCIDevice parent_obj;
448 PCIDevice *target;
449 CXLComponentState cxl_cstate;
450 CXLDeviceState cxl_dstate;
451 CXLCCI *cci;
452 };
453
454 #define TYPE_CXL_SWITCH_MAILBOX_CCI "cxl-switch-mailbox-cci"
455 OBJECT_DECLARE_TYPE(CSWMBCCIDev, CSWMBCCIClass, CXL_SWITCH_MAILBOX_CCI)
456
457 MemTxResult cxl_type3_read(PCIDevice *d, hwaddr host_addr, uint64_t *data,
458 unsigned size, MemTxAttrs attrs);
459 MemTxResult cxl_type3_write(PCIDevice *d, hwaddr host_addr, uint64_t data,
460 unsigned size, MemTxAttrs attrs);
461
462 uint64_t cxl_device_get_timestamp(CXLDeviceState *cxlds);
463
464 void cxl_event_init(CXLDeviceState *cxlds, int start_msg_num);
465 bool cxl_event_insert(CXLDeviceState *cxlds, CXLEventLogType log_type,
466 CXLEventRecordRaw *event);
467 CXLRetCode cxl_event_get_records(CXLDeviceState *cxlds, CXLGetEventPayload *pl,
468 uint8_t log_type, int max_recs,
469 size_t *len);
470 CXLRetCode cxl_event_clear_records(CXLDeviceState *cxlds,
471 CXLClearEventPayload *pl);
472
473 void cxl_event_irq_assert(CXLType3Dev *ct3d);
474
475 void cxl_set_poison_list_overflowed(CXLType3Dev *ct3d);
476
477 #endif
478