xref: /openbmc/qemu/hw/pci-host/pnv_phb3.c (revision ba7d12eb)
1 /*
2  * QEMU PowerPC PowerNV (POWER8) PHB3 model
3  *
4  * Copyright (c) 2014-2020, IBM Corporation.
5  *
6  * This code is licensed under the GPL version 2 or later. See the
7  * COPYING file in the top-level directory.
8  */
9 #include "qemu/osdep.h"
10 #include "qemu/log.h"
11 #include "qapi/visitor.h"
12 #include "qapi/error.h"
13 #include "hw/pci-host/pnv_phb3_regs.h"
14 #include "hw/pci-host/pnv_phb.h"
15 #include "hw/pci-host/pnv_phb3.h"
16 #include "hw/pci/pcie_host.h"
17 #include "hw/pci/pcie_port.h"
18 #include "hw/ppc/pnv.h"
19 #include "hw/ppc/pnv_chip.h"
20 #include "hw/irq.h"
21 #include "hw/qdev-properties.h"
22 #include "qom/object.h"
23 #include "sysemu/sysemu.h"
24 
25 #define phb3_error(phb, fmt, ...)                                       \
26     qemu_log_mask(LOG_GUEST_ERROR, "phb3[%d:%d]: " fmt "\n",            \
27                   (phb)->chip_id, (phb)->phb_id, ## __VA_ARGS__)
28 
pnv_phb3_find_cfg_dev(PnvPHB3 * phb)29 static PCIDevice *pnv_phb3_find_cfg_dev(PnvPHB3 *phb)
30 {
31     PCIHostState *pci = PCI_HOST_BRIDGE(phb->phb_base);
32     uint64_t addr = phb->regs[PHB_CONFIG_ADDRESS >> 3];
33     uint8_t bus, devfn;
34 
35     if (!(addr >> 63)) {
36         return NULL;
37     }
38     bus = (addr >> 52) & 0xff;
39     devfn = (addr >> 44) & 0xff;
40 
41     return pci_find_device(pci->bus, bus, devfn);
42 }
43 
44 /*
45  * The CONFIG_DATA register expects little endian accesses, but as the
46  * region is big endian, we have to swap the value.
47  */
pnv_phb3_config_write(PnvPHB3 * phb,unsigned off,unsigned size,uint64_t val)48 static void pnv_phb3_config_write(PnvPHB3 *phb, unsigned off,
49                                   unsigned size, uint64_t val)
50 {
51     uint32_t cfg_addr, limit;
52     PCIDevice *pdev;
53 
54     pdev = pnv_phb3_find_cfg_dev(phb);
55     if (!pdev) {
56         return;
57     }
58     cfg_addr = (phb->regs[PHB_CONFIG_ADDRESS >> 3] >> 32) & 0xffc;
59     cfg_addr |= off;
60     limit = pci_config_size(pdev);
61     if (limit <= cfg_addr) {
62         /*
63          * conventional pci device can be behind pcie-to-pci bridge.
64          * 256 <= addr < 4K has no effects.
65          */
66         return;
67     }
68     switch (size) {
69     case 1:
70         break;
71     case 2:
72         val = bswap16(val);
73         break;
74     case 4:
75         val = bswap32(val);
76         break;
77     default:
78         g_assert_not_reached();
79     }
80     pci_host_config_write_common(pdev, cfg_addr, limit, val, size);
81 }
82 
pnv_phb3_config_read(PnvPHB3 * phb,unsigned off,unsigned size)83 static uint64_t pnv_phb3_config_read(PnvPHB3 *phb, unsigned off,
84                                      unsigned size)
85 {
86     uint32_t cfg_addr, limit;
87     PCIDevice *pdev;
88     uint64_t val;
89 
90     pdev = pnv_phb3_find_cfg_dev(phb);
91     if (!pdev) {
92         return ~0ull;
93     }
94     cfg_addr = (phb->regs[PHB_CONFIG_ADDRESS >> 3] >> 32) & 0xffc;
95     cfg_addr |= off;
96     limit = pci_config_size(pdev);
97     if (limit <= cfg_addr) {
98         /*
99          * conventional pci device can be behind pcie-to-pci bridge.
100          * 256 <= addr < 4K has no effects.
101          */
102         return ~0ull;
103     }
104     val = pci_host_config_read_common(pdev, cfg_addr, limit, size);
105     switch (size) {
106     case 1:
107         return val;
108     case 2:
109         return bswap16(val);
110     case 4:
111         return bswap32(val);
112     default:
113         g_assert_not_reached();
114     }
115 }
116 
pnv_phb3_check_m32(PnvPHB3 * phb)117 static void pnv_phb3_check_m32(PnvPHB3 *phb)
118 {
119     uint64_t base, start, size;
120     MemoryRegion *parent;
121     PnvPBCQState *pbcq = &phb->pbcq;
122 
123     if (memory_region_is_mapped(&phb->mr_m32)) {
124         memory_region_del_subregion(phb->mr_m32.container, &phb->mr_m32);
125     }
126 
127     if (!(phb->regs[PHB_PHB3_CONFIG >> 3] & PHB_PHB3C_M32_EN)) {
128         return;
129     }
130 
131     /* Grab geometry from registers */
132     base = phb->regs[PHB_M32_BASE_ADDR >> 3];
133     start = phb->regs[PHB_M32_START_ADDR >> 3];
134     size = ~(phb->regs[PHB_M32_BASE_MASK >> 3] | 0xfffc000000000000ull) + 1;
135 
136     /* Check if it matches an enabled MMIO region in the PBCQ */
137     if (memory_region_is_mapped(&pbcq->mmbar0) &&
138         base >= pbcq->mmio0_base &&
139         (base + size) <= (pbcq->mmio0_base + pbcq->mmio0_size)) {
140         parent = &pbcq->mmbar0;
141         base -= pbcq->mmio0_base;
142     } else if (memory_region_is_mapped(&pbcq->mmbar1) &&
143                base >= pbcq->mmio1_base &&
144                (base + size) <= (pbcq->mmio1_base + pbcq->mmio1_size)) {
145         parent = &pbcq->mmbar1;
146         base -= pbcq->mmio1_base;
147     } else {
148         return;
149     }
150 
151     /* Create alias */
152     memory_region_init_alias(&phb->mr_m32, OBJECT(phb), "phb3-m32",
153                              &phb->pci_mmio, start, size);
154     memory_region_add_subregion(parent, base, &phb->mr_m32);
155 }
156 
pnv_phb3_check_m64(PnvPHB3 * phb,uint32_t index)157 static void pnv_phb3_check_m64(PnvPHB3 *phb, uint32_t index)
158 {
159     uint64_t base, start, size, m64;
160     MemoryRegion *parent;
161     PnvPBCQState *pbcq = &phb->pbcq;
162 
163     if (memory_region_is_mapped(&phb->mr_m64[index])) {
164         /* Should we destroy it in RCU friendly way... ? */
165         memory_region_del_subregion(phb->mr_m64[index].container,
166                                     &phb->mr_m64[index]);
167     }
168 
169     /* Get table entry */
170     m64 = phb->ioda_M64BT[index];
171 
172     if (!(m64 & IODA2_M64BT_ENABLE)) {
173         return;
174     }
175 
176     /* Grab geometry from registers */
177     base = GETFIELD(IODA2_M64BT_BASE, m64) << 20;
178     if (m64 & IODA2_M64BT_SINGLE_PE) {
179         base &= ~0x1ffffffull;
180     }
181     size = GETFIELD(IODA2_M64BT_MASK, m64) << 20;
182     size |= 0xfffc000000000000ull;
183     size = ~size + 1;
184     start = base | (phb->regs[PHB_M64_UPPER_BITS >> 3]);
185 
186     /* Check if it matches an enabled MMIO region in the PBCQ */
187     if (memory_region_is_mapped(&pbcq->mmbar0) &&
188         base >= pbcq->mmio0_base &&
189         (base + size) <= (pbcq->mmio0_base + pbcq->mmio0_size)) {
190         parent = &pbcq->mmbar0;
191         base -= pbcq->mmio0_base;
192     } else if (memory_region_is_mapped(&pbcq->mmbar1) &&
193                base >= pbcq->mmio1_base &&
194                (base + size) <= (pbcq->mmio1_base + pbcq->mmio1_size)) {
195         parent = &pbcq->mmbar1;
196         base -= pbcq->mmio1_base;
197     } else {
198         return;
199     }
200 
201     /* Create alias */
202     memory_region_init_alias(&phb->mr_m64[index], OBJECT(phb), "phb3-m64",
203                              &phb->pci_mmio, start, size);
204     memory_region_add_subregion(parent, base, &phb->mr_m64[index]);
205 }
206 
pnv_phb3_check_all_m64s(PnvPHB3 * phb)207 static void pnv_phb3_check_all_m64s(PnvPHB3 *phb)
208 {
209     uint64_t i;
210 
211     for (i = 0; i < PNV_PHB3_NUM_M64; i++) {
212         pnv_phb3_check_m64(phb, i);
213     }
214 }
215 
pnv_phb3_lxivt_write(PnvPHB3 * phb,unsigned idx,uint64_t val)216 static void pnv_phb3_lxivt_write(PnvPHB3 *phb, unsigned idx, uint64_t val)
217 {
218     uint8_t server, prio;
219 
220     phb->ioda_LXIVT[idx] = val & (IODA2_LXIVT_SERVER |
221                                   IODA2_LXIVT_PRIORITY |
222                                   IODA2_LXIVT_NODE_ID);
223     server = GETFIELD(IODA2_LXIVT_SERVER, val);
224     prio = GETFIELD(IODA2_LXIVT_PRIORITY, val);
225 
226     /*
227      * The low order 2 bits are the link pointer (Type II interrupts).
228      * Shift back to get a valid IRQ server.
229      */
230     server >>= 2;
231 
232     ics_write_xive(&phb->lsis, idx, server, prio, prio);
233 }
234 
pnv_phb3_ioda_access(PnvPHB3 * phb,unsigned * out_table,unsigned * out_idx)235 static uint64_t *pnv_phb3_ioda_access(PnvPHB3 *phb,
236                                       unsigned *out_table, unsigned *out_idx)
237 {
238     uint64_t adreg = phb->regs[PHB_IODA_ADDR >> 3];
239     unsigned int index = GETFIELD(PHB_IODA_AD_TADR, adreg);
240     unsigned int table = GETFIELD(PHB_IODA_AD_TSEL, adreg);
241     unsigned int mask;
242     uint64_t *tptr = NULL;
243 
244     switch (table) {
245     case IODA2_TBL_LIST:
246         tptr = phb->ioda_LIST;
247         mask = 7;
248         break;
249     case IODA2_TBL_LXIVT:
250         tptr = phb->ioda_LXIVT;
251         mask = 7;
252         break;
253     case IODA2_TBL_IVC_CAM:
254     case IODA2_TBL_RBA:
255         mask = 31;
256         break;
257     case IODA2_TBL_RCAM:
258         mask = 63;
259         break;
260     case IODA2_TBL_MRT:
261         mask = 7;
262         break;
263     case IODA2_TBL_PESTA:
264     case IODA2_TBL_PESTB:
265         mask = 255;
266         break;
267     case IODA2_TBL_TVT:
268         tptr = phb->ioda_TVT;
269         mask = 511;
270         break;
271     case IODA2_TBL_TCAM:
272     case IODA2_TBL_TDR:
273         mask = 63;
274         break;
275     case IODA2_TBL_M64BT:
276         tptr = phb->ioda_M64BT;
277         mask = 15;
278         break;
279     case IODA2_TBL_M32DT:
280         tptr = phb->ioda_MDT;
281         mask = 255;
282         break;
283     case IODA2_TBL_PEEV:
284         tptr = phb->ioda_PEEV;
285         mask = 3;
286         break;
287     default:
288         phb3_error(phb, "invalid IODA table %d", table);
289         return NULL;
290     }
291     index &= mask;
292     if (out_idx) {
293         *out_idx = index;
294     }
295     if (out_table) {
296         *out_table = table;
297     }
298     if (tptr) {
299         tptr += index;
300     }
301     if (adreg & PHB_IODA_AD_AUTOINC) {
302         index = (index + 1) & mask;
303         adreg = SETFIELD(PHB_IODA_AD_TADR, adreg, index);
304     }
305     phb->regs[PHB_IODA_ADDR >> 3] = adreg;
306     return tptr;
307 }
308 
pnv_phb3_ioda_read(PnvPHB3 * phb)309 static uint64_t pnv_phb3_ioda_read(PnvPHB3 *phb)
310 {
311         unsigned table;
312         uint64_t *tptr;
313 
314         tptr = pnv_phb3_ioda_access(phb, &table, NULL);
315         if (!tptr) {
316             /* Return 0 on unsupported tables, not ff's */
317             return 0;
318         }
319         return *tptr;
320 }
321 
pnv_phb3_ioda_write(PnvPHB3 * phb,uint64_t val)322 static void pnv_phb3_ioda_write(PnvPHB3 *phb, uint64_t val)
323 {
324         unsigned table, idx;
325         uint64_t *tptr;
326 
327         tptr = pnv_phb3_ioda_access(phb, &table, &idx);
328         if (!tptr) {
329             return;
330         }
331 
332         /* Handle side effects */
333         switch (table) {
334         case IODA2_TBL_LXIVT:
335             pnv_phb3_lxivt_write(phb, idx, val);
336             break;
337         case IODA2_TBL_M64BT:
338             *tptr = val;
339             pnv_phb3_check_m64(phb, idx);
340             break;
341         default:
342             *tptr = val;
343         }
344 }
345 
346 /*
347  * This is called whenever the PHB LSI, MSI source ID register or
348  * the PBCQ irq filters are written.
349  */
pnv_phb3_remap_irqs(PnvPHB3 * phb)350 void pnv_phb3_remap_irqs(PnvPHB3 *phb)
351 {
352     ICSState *ics = &phb->lsis;
353     uint32_t local, global, count, mask, comp;
354     uint64_t baren;
355     PnvPBCQState *pbcq = &phb->pbcq;
356 
357     /*
358      * First check if we are enabled. Unlike real HW we don't separate
359      * TX and RX so we enable if both are set
360      */
361     baren = pbcq->nest_regs[PBCQ_NEST_BAR_EN];
362     if (!(baren & PBCQ_NEST_BAR_EN_IRSN_RX) ||
363         !(baren & PBCQ_NEST_BAR_EN_IRSN_TX)) {
364         ics->offset = 0;
365         return;
366     }
367 
368     /* Grab local LSI source ID */
369     local = GETFIELD(PHB_LSI_SRC_ID, phb->regs[PHB_LSI_SOURCE_ID >> 3]) << 3;
370 
371     /* Grab global one and compare */
372     global = GETFIELD(PBCQ_NEST_LSI_SRC,
373                       pbcq->nest_regs[PBCQ_NEST_LSI_SRC_ID]) << 3;
374     if (global != local) {
375         /*
376          * This happens during initialization, let's come back when we
377          * are properly configured
378          */
379         ics->offset = 0;
380         return;
381     }
382 
383     /* Get the base on the powerbus */
384     comp = GETFIELD(PBCQ_NEST_IRSN_COMP,
385                     pbcq->nest_regs[PBCQ_NEST_IRSN_COMPARE]);
386     mask = GETFIELD(PBCQ_NEST_IRSN_COMP,
387                     pbcq->nest_regs[PBCQ_NEST_IRSN_MASK]);
388     count = ((~mask) + 1) & 0x7ffff;
389     phb->total_irq = count;
390 
391     /* Sanity checks */
392     if ((global + PNV_PHB3_NUM_LSI) > count) {
393         phb3_error(phb, "LSIs out of reach: LSI base=%d total irq=%d", global,
394                    count);
395     }
396 
397     if (count > 2048) {
398         phb3_error(phb, "More interrupts than supported: %d", count);
399     }
400 
401     if ((comp & mask) != comp) {
402         phb3_error(phb, "IRQ compare bits not in mask: comp=0x%x mask=0x%x",
403                    comp, mask);
404         comp &= mask;
405     }
406     /* Setup LSI offset */
407     ics->offset = comp + global;
408 
409     /* Setup MSI offset */
410     pnv_phb3_msi_update_config(&phb->msis, comp, count - PNV_PHB3_NUM_LSI);
411 }
412 
pnv_phb3_lsi_src_id_write(PnvPHB3 * phb,uint64_t val)413 static void pnv_phb3_lsi_src_id_write(PnvPHB3 *phb, uint64_t val)
414 {
415     /* Sanitize content */
416     val &= PHB_LSI_SRC_ID;
417     phb->regs[PHB_LSI_SOURCE_ID >> 3] = val;
418     pnv_phb3_remap_irqs(phb);
419 }
420 
pnv_phb3_rtc_invalidate(PnvPHB3 * phb,uint64_t val)421 static void pnv_phb3_rtc_invalidate(PnvPHB3 *phb, uint64_t val)
422 {
423     PnvPhb3DMASpace *ds;
424 
425     /* Always invalidate all for now ... */
426     QLIST_FOREACH(ds, &phb->dma_spaces, list) {
427         ds->pe_num = PHB_INVALID_PE;
428     }
429 }
430 
431 
pnv_phb3_update_msi_regions(PnvPhb3DMASpace * ds)432 static void pnv_phb3_update_msi_regions(PnvPhb3DMASpace *ds)
433 {
434     uint64_t cfg = ds->phb->regs[PHB_PHB3_CONFIG >> 3];
435 
436     if (cfg & PHB_PHB3C_32BIT_MSI_EN) {
437         if (!memory_region_is_mapped(&ds->msi32_mr)) {
438             memory_region_add_subregion(MEMORY_REGION(&ds->dma_mr),
439                                         0xffff0000, &ds->msi32_mr);
440         }
441     } else {
442         if (memory_region_is_mapped(&ds->msi32_mr)) {
443             memory_region_del_subregion(MEMORY_REGION(&ds->dma_mr),
444                                         &ds->msi32_mr);
445         }
446     }
447 
448     if (cfg & PHB_PHB3C_64BIT_MSI_EN) {
449         if (!memory_region_is_mapped(&ds->msi64_mr)) {
450             memory_region_add_subregion(MEMORY_REGION(&ds->dma_mr),
451                                         (1ull << 60), &ds->msi64_mr);
452         }
453     } else {
454         if (memory_region_is_mapped(&ds->msi64_mr)) {
455             memory_region_del_subregion(MEMORY_REGION(&ds->dma_mr),
456                                         &ds->msi64_mr);
457         }
458     }
459 }
460 
pnv_phb3_update_all_msi_regions(PnvPHB3 * phb)461 static void pnv_phb3_update_all_msi_regions(PnvPHB3 *phb)
462 {
463     PnvPhb3DMASpace *ds;
464 
465     QLIST_FOREACH(ds, &phb->dma_spaces, list) {
466         pnv_phb3_update_msi_regions(ds);
467     }
468 }
469 
pnv_phb3_reg_write(void * opaque,hwaddr off,uint64_t val,unsigned size)470 void pnv_phb3_reg_write(void *opaque, hwaddr off, uint64_t val, unsigned size)
471 {
472     PnvPHB3 *phb = opaque;
473     bool changed;
474 
475     /* Special case configuration data */
476     if ((off & 0xfffc) == PHB_CONFIG_DATA) {
477         pnv_phb3_config_write(phb, off & 0x3, size, val);
478         return;
479     }
480 
481     /* Other registers are 64-bit only */
482     if (size != 8 || off & 0x7) {
483         phb3_error(phb, "Invalid register access, offset: 0x%"PRIx64" size: %d",
484                    off, size);
485         return;
486     }
487 
488     /* Handle masking & filtering */
489     switch (off) {
490     case PHB_M64_UPPER_BITS:
491         val &= 0xfffc000000000000ull;
492         break;
493     case PHB_Q_DMA_R:
494         /*
495          * This is enough logic to make SW happy but we aren't actually
496          * quiescing the DMAs
497          */
498         if (val & PHB_Q_DMA_R_AUTORESET) {
499             val = 0;
500         } else {
501             val &= PHB_Q_DMA_R_QUIESCE_DMA;
502         }
503         break;
504     /* LEM stuff */
505     case PHB_LEM_FIR_AND_MASK:
506         phb->regs[PHB_LEM_FIR_ACCUM >> 3] &= val;
507         return;
508     case PHB_LEM_FIR_OR_MASK:
509         phb->regs[PHB_LEM_FIR_ACCUM >> 3] |= val;
510         return;
511     case PHB_LEM_ERROR_AND_MASK:
512         phb->regs[PHB_LEM_ERROR_MASK >> 3] &= val;
513         return;
514     case PHB_LEM_ERROR_OR_MASK:
515         phb->regs[PHB_LEM_ERROR_MASK >> 3] |= val;
516         return;
517     case PHB_LEM_WOF:
518         val = 0;
519         break;
520     }
521 
522     /* Record whether it changed */
523     changed = phb->regs[off >> 3] != val;
524 
525     /* Store in register cache first */
526     phb->regs[off >> 3] = val;
527 
528     /* Handle side effects */
529     switch (off) {
530     case PHB_PHB3_CONFIG:
531         if (changed) {
532             pnv_phb3_update_all_msi_regions(phb);
533         }
534         /* fall through */
535     case PHB_M32_BASE_ADDR:
536     case PHB_M32_BASE_MASK:
537     case PHB_M32_START_ADDR:
538         if (changed) {
539             pnv_phb3_check_m32(phb);
540         }
541         break;
542     case PHB_M64_UPPER_BITS:
543         if (changed) {
544             pnv_phb3_check_all_m64s(phb);
545         }
546         break;
547     case PHB_LSI_SOURCE_ID:
548         if (changed) {
549             pnv_phb3_lsi_src_id_write(phb, val);
550         }
551         break;
552 
553     /* IODA table accesses */
554     case PHB_IODA_DATA0:
555         pnv_phb3_ioda_write(phb, val);
556         break;
557 
558     /* RTC invalidation */
559     case PHB_RTC_INVALIDATE:
560         pnv_phb3_rtc_invalidate(phb, val);
561         break;
562 
563     /* FFI request */
564     case PHB_FFI_REQUEST:
565         pnv_phb3_msi_ffi(&phb->msis, val);
566         break;
567 
568     /* Silent simple writes */
569     case PHB_CONFIG_ADDRESS:
570     case PHB_IODA_ADDR:
571     case PHB_TCE_KILL:
572     case PHB_TCE_SPEC_CTL:
573     case PHB_PEST_BAR:
574     case PHB_PELTV_BAR:
575     case PHB_RTT_BAR:
576     case PHB_RBA_BAR:
577     case PHB_IVT_BAR:
578     case PHB_FFI_LOCK:
579     case PHB_LEM_FIR_ACCUM:
580     case PHB_LEM_ERROR_MASK:
581     case PHB_LEM_ACTION0:
582     case PHB_LEM_ACTION1:
583         break;
584 
585     /* Noise on anything else */
586     default:
587         qemu_log_mask(LOG_UNIMP, "phb3: reg_write 0x%"PRIx64"=%"PRIx64"\n",
588                       off, val);
589     }
590 }
591 
pnv_phb3_reg_read(void * opaque,hwaddr off,unsigned size)592 uint64_t pnv_phb3_reg_read(void *opaque, hwaddr off, unsigned size)
593 {
594     PnvPHB3 *phb = opaque;
595     PCIHostState *pci = PCI_HOST_BRIDGE(phb->phb_base);
596     uint64_t val;
597 
598     if ((off & 0xfffc) == PHB_CONFIG_DATA) {
599         return pnv_phb3_config_read(phb, off & 0x3, size);
600     }
601 
602     /* Other registers are 64-bit only */
603     if (size != 8 || off & 0x7) {
604         phb3_error(phb, "Invalid register access, offset: 0x%"PRIx64" size: %d",
605                    off, size);
606         return ~0ull;
607     }
608 
609     /* Default read from cache */
610     val = phb->regs[off >> 3];
611 
612     switch (off) {
613     /* Simulate venice DD2.0 */
614     case PHB_VERSION:
615         return 0x000000a300000005ull;
616     case PHB_PCIE_SYSTEM_CONFIG:
617         return 0x441100fc30000000;
618 
619     /* IODA table accesses */
620     case PHB_IODA_DATA0:
621         return pnv_phb3_ioda_read(phb);
622 
623     /* Link training always appears trained */
624     case PHB_PCIE_DLP_TRAIN_CTL:
625         if (!pci_find_device(pci->bus, 1, 0)) {
626             return 0;
627         }
628         return PHB_PCIE_DLP_INBAND_PRESENCE | PHB_PCIE_DLP_TC_DL_LINKACT;
629 
630     /* FFI Lock */
631     case PHB_FFI_LOCK:
632         /* Set lock and return previous value */
633         phb->regs[off >> 3] |= PHB_FFI_LOCK_STATE;
634         return val;
635 
636     /* DMA read sync: make it look like it's complete */
637     case PHB_DMARD_SYNC:
638         return PHB_DMARD_SYNC_COMPLETE;
639 
640     /* Silent simple reads */
641     case PHB_PHB3_CONFIG:
642     case PHB_M32_BASE_ADDR:
643     case PHB_M32_BASE_MASK:
644     case PHB_M32_START_ADDR:
645     case PHB_CONFIG_ADDRESS:
646     case PHB_IODA_ADDR:
647     case PHB_RTC_INVALIDATE:
648     case PHB_TCE_KILL:
649     case PHB_TCE_SPEC_CTL:
650     case PHB_PEST_BAR:
651     case PHB_PELTV_BAR:
652     case PHB_RTT_BAR:
653     case PHB_RBA_BAR:
654     case PHB_IVT_BAR:
655     case PHB_M64_UPPER_BITS:
656     case PHB_LEM_FIR_ACCUM:
657     case PHB_LEM_ERROR_MASK:
658     case PHB_LEM_ACTION0:
659     case PHB_LEM_ACTION1:
660         break;
661 
662     /* Noise on anything else */
663     default:
664         qemu_log_mask(LOG_UNIMP, "phb3: reg_read 0x%"PRIx64"=%"PRIx64"\n",
665                       off, val);
666     }
667     return val;
668 }
669 
670 static const MemoryRegionOps pnv_phb3_reg_ops = {
671     .read = pnv_phb3_reg_read,
672     .write = pnv_phb3_reg_write,
673     .valid.min_access_size = 1,
674     .valid.max_access_size = 8,
675     .impl.min_access_size = 1,
676     .impl.max_access_size = 8,
677     .endianness = DEVICE_BIG_ENDIAN,
678 };
679 
pnv_phb3_map_irq(PCIDevice * pci_dev,int irq_num)680 static int pnv_phb3_map_irq(PCIDevice *pci_dev, int irq_num)
681 {
682     /* Check that out properly ... */
683     return irq_num & 3;
684 }
685 
pnv_phb3_set_irq(void * opaque,int irq_num,int level)686 static void pnv_phb3_set_irq(void *opaque, int irq_num, int level)
687 {
688     PnvPHB3 *phb = opaque;
689 
690     /* LSI only ... */
691     if (irq_num > 3) {
692         phb3_error(phb, "Unknown IRQ to set %d", irq_num);
693     }
694     qemu_set_irq(phb->qirqs[irq_num], level);
695 }
696 
pnv_phb3_resolve_pe(PnvPhb3DMASpace * ds)697 static bool pnv_phb3_resolve_pe(PnvPhb3DMASpace *ds)
698 {
699     uint64_t rtt, addr;
700     uint16_t rte;
701     int bus_num;
702 
703     /* Already resolved ? */
704     if (ds->pe_num != PHB_INVALID_PE) {
705         return true;
706     }
707 
708     /* We need to lookup the RTT */
709     rtt = ds->phb->regs[PHB_RTT_BAR >> 3];
710     if (!(rtt & PHB_RTT_BAR_ENABLE)) {
711         phb3_error(ds->phb, "DMA with RTT BAR disabled !");
712         /* Set error bits ? fence ? ... */
713         return false;
714     }
715 
716     /* Read RTE */
717     bus_num = pci_bus_num(ds->bus);
718     addr = rtt & PHB_RTT_BASE_ADDRESS_MASK;
719     addr += 2 * ((bus_num << 8) | ds->devfn);
720     if (dma_memory_read(&address_space_memory, addr, &rte,
721                         sizeof(rte), MEMTXATTRS_UNSPECIFIED)) {
722         phb3_error(ds->phb, "Failed to read RTT entry at 0x%"PRIx64, addr);
723         /* Set error bits ? fence ? ... */
724         return false;
725     }
726     rte = be16_to_cpu(rte);
727 
728     /* Fail upon reading of invalid PE# */
729     if (rte >= PNV_PHB3_NUM_PE) {
730         phb3_error(ds->phb, "RTE for RID 0x%x invalid (%04x", ds->devfn, rte);
731         /* Set error bits ? fence ? ... */
732         return false;
733     }
734     ds->pe_num = rte;
735     return true;
736 }
737 
pnv_phb3_translate_tve(PnvPhb3DMASpace * ds,hwaddr addr,bool is_write,uint64_t tve,IOMMUTLBEntry * tlb)738 static void pnv_phb3_translate_tve(PnvPhb3DMASpace *ds, hwaddr addr,
739                                    bool is_write, uint64_t tve,
740                                    IOMMUTLBEntry *tlb)
741 {
742     uint64_t tta = GETFIELD(IODA2_TVT_TABLE_ADDR, tve);
743     int32_t  lev = GETFIELD(IODA2_TVT_NUM_LEVELS, tve);
744     uint32_t tts = GETFIELD(IODA2_TVT_TCE_TABLE_SIZE, tve);
745     uint32_t tps = GETFIELD(IODA2_TVT_IO_PSIZE, tve);
746     PnvPHB3 *phb = ds->phb;
747 
748     /* Invalid levels */
749     if (lev > 4) {
750         phb3_error(phb, "Invalid #levels in TVE %d", lev);
751         return;
752     }
753 
754     /* IO Page Size of 0 means untranslated, else use TCEs */
755     if (tps == 0) {
756         /*
757          * We only support non-translate in top window.
758          *
759          * TODO: Venice/Murano support it on bottom window above 4G and
760          * Naples supports it on everything
761          */
762         if (!(tve & PPC_BIT(51))) {
763             phb3_error(phb, "xlate for invalid non-translate TVE");
764             return;
765         }
766         /* TODO: Handle boundaries */
767 
768         /* Use 4k pages like q35 ... for now */
769         tlb->iova = addr & 0xfffffffffffff000ull;
770         tlb->translated_addr = addr & 0x0003fffffffff000ull;
771         tlb->addr_mask = 0xfffull;
772         tlb->perm = IOMMU_RW;
773     } else {
774         uint32_t tce_shift, tbl_shift, sh;
775         uint64_t base, taddr, tce, tce_mask;
776 
777         /* TVE disabled ? */
778         if (tts == 0) {
779             phb3_error(phb, "xlate for invalid translated TVE");
780             return;
781         }
782 
783         /* Address bits per bottom level TCE entry */
784         tce_shift = tps + 11;
785 
786         /* Address bits per table level */
787         tbl_shift = tts + 8;
788 
789         /* Top level table base address */
790         base = tta << 12;
791 
792         /* Total shift to first level */
793         sh = tbl_shift * lev + tce_shift;
794 
795         /* TODO: Multi-level untested */
796         do {
797             lev--;
798 
799             /* Grab the TCE address */
800             taddr = base | (((addr >> sh) & ((1ul << tbl_shift) - 1)) << 3);
801             if (dma_memory_read(&address_space_memory, taddr, &tce,
802                                 sizeof(tce), MEMTXATTRS_UNSPECIFIED)) {
803                 phb3_error(phb, "Failed to read TCE at 0x%"PRIx64, taddr);
804                 return;
805             }
806             tce = be64_to_cpu(tce);
807 
808             /* Check permission for indirect TCE */
809             if ((lev >= 0) && !(tce & 3)) {
810                 phb3_error(phb, "Invalid indirect TCE at 0x%"PRIx64, taddr);
811                 phb3_error(phb, " xlate %"PRIx64":%c TVE=%"PRIx64, addr,
812                            is_write ? 'W' : 'R', tve);
813                 phb3_error(phb, " tta=%"PRIx64" lev=%d tts=%d tps=%d",
814                            tta, lev, tts, tps);
815                 return;
816             }
817             sh -= tbl_shift;
818             base = tce & ~0xfffull;
819         } while (lev >= 0);
820 
821         /* We exit the loop with TCE being the final TCE */
822         if ((is_write & !(tce & 2)) || ((!is_write) && !(tce & 1))) {
823             phb3_error(phb, "TCE access fault at 0x%"PRIx64, taddr);
824             phb3_error(phb, " xlate %"PRIx64":%c TVE=%"PRIx64, addr,
825                        is_write ? 'W' : 'R', tve);
826             phb3_error(phb, " tta=%"PRIx64" lev=%d tts=%d tps=%d",
827                        tta, lev, tts, tps);
828             return;
829         }
830         tce_mask = ~((1ull << tce_shift) - 1);
831         tlb->iova = addr & tce_mask;
832         tlb->translated_addr = tce & tce_mask;
833         tlb->addr_mask = ~tce_mask;
834         tlb->perm = tce & 3;
835     }
836 }
837 
pnv_phb3_translate_iommu(IOMMUMemoryRegion * iommu,hwaddr addr,IOMMUAccessFlags flag,int iommu_idx)838 static IOMMUTLBEntry pnv_phb3_translate_iommu(IOMMUMemoryRegion *iommu,
839                                               hwaddr addr,
840                                               IOMMUAccessFlags flag,
841                                               int iommu_idx)
842 {
843     PnvPhb3DMASpace *ds = container_of(iommu, PnvPhb3DMASpace, dma_mr);
844     int tve_sel;
845     uint64_t tve, cfg;
846     IOMMUTLBEntry ret = {
847         .target_as = &address_space_memory,
848         .iova = addr,
849         .translated_addr = 0,
850         .addr_mask = ~(hwaddr)0,
851         .perm = IOMMU_NONE,
852     };
853     PnvPHB3 *phb = ds->phb;
854 
855     /* Resolve PE# */
856     if (!pnv_phb3_resolve_pe(ds)) {
857         phb3_error(phb, "Failed to resolve PE# for bus @%p (%d) devfn 0x%x",
858                    ds->bus, pci_bus_num(ds->bus), ds->devfn);
859         return ret;
860     }
861 
862     /* Check top bits */
863     switch (addr >> 60) {
864     case 00:
865         /* DMA or 32-bit MSI ? */
866         cfg = ds->phb->regs[PHB_PHB3_CONFIG >> 3];
867         if ((cfg & PHB_PHB3C_32BIT_MSI_EN) &&
868             ((addr & 0xffffffffffff0000ull) == 0xffff0000ull)) {
869             phb3_error(phb, "xlate on 32-bit MSI region");
870             return ret;
871         }
872         /* Choose TVE XXX Use PHB3 Control Register */
873         tve_sel = (addr >> 59) & 1;
874         tve = ds->phb->ioda_TVT[ds->pe_num * 2 + tve_sel];
875         pnv_phb3_translate_tve(ds, addr, flag & IOMMU_WO, tve, &ret);
876         break;
877     case 01:
878         phb3_error(phb, "xlate on 64-bit MSI region");
879         break;
880     default:
881         phb3_error(phb, "xlate on unsupported address 0x%"PRIx64, addr);
882     }
883     return ret;
884 }
885 
886 #define TYPE_PNV_PHB3_IOMMU_MEMORY_REGION "pnv-phb3-iommu-memory-region"
DECLARE_INSTANCE_CHECKER(IOMMUMemoryRegion,PNV_PHB3_IOMMU_MEMORY_REGION,TYPE_PNV_PHB3_IOMMU_MEMORY_REGION)887 DECLARE_INSTANCE_CHECKER(IOMMUMemoryRegion, PNV_PHB3_IOMMU_MEMORY_REGION,
888                          TYPE_PNV_PHB3_IOMMU_MEMORY_REGION)
889 
890 static void pnv_phb3_iommu_memory_region_class_init(ObjectClass *klass,
891                                                     void *data)
892 {
893     IOMMUMemoryRegionClass *imrc = IOMMU_MEMORY_REGION_CLASS(klass);
894 
895     imrc->translate = pnv_phb3_translate_iommu;
896 }
897 
898 static const TypeInfo pnv_phb3_iommu_memory_region_info = {
899     .parent = TYPE_IOMMU_MEMORY_REGION,
900     .name = TYPE_PNV_PHB3_IOMMU_MEMORY_REGION,
901     .class_init = pnv_phb3_iommu_memory_region_class_init,
902 };
903 
904 /*
905  * MSI/MSIX memory region implementation.
906  * The handler handles both MSI and MSIX.
907  */
pnv_phb3_msi_write(void * opaque,hwaddr addr,uint64_t data,unsigned size)908 static void pnv_phb3_msi_write(void *opaque, hwaddr addr,
909                                uint64_t data, unsigned size)
910 {
911     PnvPhb3DMASpace *ds = opaque;
912 
913     /* Resolve PE# */
914     if (!pnv_phb3_resolve_pe(ds)) {
915         phb3_error(ds->phb, "Failed to resolve PE# for bus @%p (%d) devfn 0x%x",
916                    ds->bus, pci_bus_num(ds->bus), ds->devfn);
917         return;
918     }
919 
920     pnv_phb3_msi_send(&ds->phb->msis, addr, data, ds->pe_num);
921 }
922 
923 /* There is no .read as the read result is undefined by PCI spec */
pnv_phb3_msi_read(void * opaque,hwaddr addr,unsigned size)924 static uint64_t pnv_phb3_msi_read(void *opaque, hwaddr addr, unsigned size)
925 {
926     PnvPhb3DMASpace *ds = opaque;
927 
928     phb3_error(ds->phb, "invalid read @ 0x%" HWADDR_PRIx, addr);
929     return -1;
930 }
931 
932 static const MemoryRegionOps pnv_phb3_msi_ops = {
933     .read = pnv_phb3_msi_read,
934     .write = pnv_phb3_msi_write,
935     .endianness = DEVICE_LITTLE_ENDIAN
936 };
937 
pnv_phb3_dma_iommu(PCIBus * bus,void * opaque,int devfn)938 static AddressSpace *pnv_phb3_dma_iommu(PCIBus *bus, void *opaque, int devfn)
939 {
940     PnvPHB3 *phb = opaque;
941     PnvPhb3DMASpace *ds;
942 
943     QLIST_FOREACH(ds, &phb->dma_spaces, list) {
944         if (ds->bus == bus && ds->devfn == devfn) {
945             break;
946         }
947     }
948 
949     if (ds == NULL) {
950         ds = g_new0(PnvPhb3DMASpace, 1);
951         ds->bus = bus;
952         ds->devfn = devfn;
953         ds->pe_num = PHB_INVALID_PE;
954         ds->phb = phb;
955         memory_region_init_iommu(&ds->dma_mr, sizeof(ds->dma_mr),
956                                  TYPE_PNV_PHB3_IOMMU_MEMORY_REGION,
957                                  OBJECT(phb), "phb3_iommu", UINT64_MAX);
958         address_space_init(&ds->dma_as, MEMORY_REGION(&ds->dma_mr),
959                            "phb3_iommu");
960         memory_region_init_io(&ds->msi32_mr, OBJECT(phb), &pnv_phb3_msi_ops,
961                               ds, "msi32", 0x10000);
962         memory_region_init_io(&ds->msi64_mr, OBJECT(phb), &pnv_phb3_msi_ops,
963                               ds, "msi64", 0x100000);
964         pnv_phb3_update_msi_regions(ds);
965 
966         QLIST_INSERT_HEAD(&phb->dma_spaces, ds, list);
967     }
968     return &ds->dma_as;
969 }
970 
971 static PCIIOMMUOps pnv_phb3_iommu_ops = {
972     .get_address_space = pnv_phb3_dma_iommu,
973 };
974 
pnv_phb3_instance_init(Object * obj)975 static void pnv_phb3_instance_init(Object *obj)
976 {
977     PnvPHB3 *phb = PNV_PHB3(obj);
978 
979     QLIST_INIT(&phb->dma_spaces);
980 
981     /* LSI sources */
982     object_initialize_child(obj, "lsi", &phb->lsis, TYPE_ICS);
983 
984     /* Default init ... will be fixed by HW inits */
985     phb->lsis.offset = 0;
986 
987     /* MSI sources */
988     object_initialize_child(obj, "msi", &phb->msis, TYPE_PHB3_MSI);
989 
990     /* Power Bus Common Queue */
991     object_initialize_child(obj, "pbcq", &phb->pbcq, TYPE_PNV_PBCQ);
992 
993 }
994 
pnv_phb3_bus_init(DeviceState * dev,PnvPHB3 * phb)995 void pnv_phb3_bus_init(DeviceState *dev, PnvPHB3 *phb)
996 {
997     PCIHostState *pci = PCI_HOST_BRIDGE(dev);
998 
999     /*
1000      * PHB3 doesn't support IO space. However, qemu gets very upset if
1001      * we don't have an IO region to anchor IO BARs onto so we just
1002      * initialize one which we never hook up to anything
1003      */
1004     memory_region_init(&phb->pci_io, OBJECT(phb), "pci-io", 0x10000);
1005     memory_region_init(&phb->pci_mmio, OBJECT(phb), "pci-mmio",
1006                        PCI_MMIO_TOTAL_SIZE);
1007 
1008     pci->bus = pci_register_root_bus(dev,
1009                                      dev->id ? dev->id : NULL,
1010                                      pnv_phb3_set_irq, pnv_phb3_map_irq, phb,
1011                                      &phb->pci_mmio, &phb->pci_io,
1012                                      0, 4, TYPE_PNV_PHB3_ROOT_BUS);
1013 
1014     object_property_set_int(OBJECT(pci->bus), "phb-id", phb->phb_id,
1015                             &error_abort);
1016     object_property_set_int(OBJECT(pci->bus), "chip-id", phb->chip_id,
1017                             &error_abort);
1018 
1019     pci_setup_iommu(pci->bus, &pnv_phb3_iommu_ops, phb);
1020 }
1021 
pnv_phb3_realize(DeviceState * dev,Error ** errp)1022 static void pnv_phb3_realize(DeviceState *dev, Error **errp)
1023 {
1024     PnvPHB3 *phb = PNV_PHB3(dev);
1025     PnvMachineState *pnv = PNV_MACHINE(qdev_get_machine());
1026     int i;
1027 
1028     if (phb->phb_id >= PNV_CHIP_GET_CLASS(phb->chip)->num_phbs) {
1029         error_setg(errp, "invalid PHB index: %d", phb->phb_id);
1030         return;
1031     }
1032 
1033     /* LSI sources */
1034     object_property_set_link(OBJECT(&phb->lsis), "xics", OBJECT(pnv),
1035                              &error_abort);
1036     object_property_set_int(OBJECT(&phb->lsis), "nr-irqs", PNV_PHB3_NUM_LSI,
1037                             &error_abort);
1038     if (!qdev_realize(DEVICE(&phb->lsis), NULL, errp)) {
1039         return;
1040     }
1041 
1042     for (i = 0; i < phb->lsis.nr_irqs; i++) {
1043         ics_set_irq_type(&phb->lsis, i, true);
1044     }
1045 
1046     phb->qirqs = qemu_allocate_irqs(ics_set_irq, &phb->lsis, phb->lsis.nr_irqs);
1047 
1048     /* MSI sources */
1049     object_property_set_link(OBJECT(&phb->msis), "phb", OBJECT(phb),
1050                              &error_abort);
1051     object_property_set_link(OBJECT(&phb->msis), "xics", OBJECT(pnv),
1052                              &error_abort);
1053     object_property_set_int(OBJECT(&phb->msis), "nr-irqs", PHB3_MAX_MSI,
1054                             &error_abort);
1055     if (!qdev_realize(DEVICE(&phb->msis), NULL, errp)) {
1056         return;
1057     }
1058 
1059     /* Power Bus Common Queue */
1060     object_property_set_link(OBJECT(&phb->pbcq), "phb", OBJECT(phb),
1061                              &error_abort);
1062     if (!qdev_realize(DEVICE(&phb->pbcq), NULL, errp)) {
1063         return;
1064     }
1065 
1066     /* Controller Registers */
1067     memory_region_init_io(&phb->mr_regs, OBJECT(phb), &pnv_phb3_reg_ops, phb,
1068                           "phb3-regs", 0x1000);
1069 }
1070 
pnv_phb3_update_regions(PnvPHB3 * phb)1071 void pnv_phb3_update_regions(PnvPHB3 *phb)
1072 {
1073     PnvPBCQState *pbcq = &phb->pbcq;
1074 
1075     /* Unmap first always */
1076     if (memory_region_is_mapped(&phb->mr_regs)) {
1077         memory_region_del_subregion(&pbcq->phbbar, &phb->mr_regs);
1078     }
1079 
1080     /* Map registers if enabled */
1081     if (memory_region_is_mapped(&pbcq->phbbar)) {
1082         /* TODO: We should use the PHB BAR 2 register but we don't ... */
1083         memory_region_add_subregion(&pbcq->phbbar, 0, &phb->mr_regs);
1084     }
1085 
1086     /* Check/update m32 */
1087     if (memory_region_is_mapped(&phb->mr_m32)) {
1088         pnv_phb3_check_m32(phb);
1089     }
1090     pnv_phb3_check_all_m64s(phb);
1091 }
1092 
1093 static Property pnv_phb3_properties[] = {
1094     DEFINE_PROP_UINT32("index", PnvPHB3, phb_id, 0),
1095     DEFINE_PROP_UINT32("chip-id", PnvPHB3, chip_id, 0),
1096     DEFINE_PROP_LINK("chip", PnvPHB3, chip, TYPE_PNV_CHIP, PnvChip *),
1097     DEFINE_PROP_LINK("phb-base", PnvPHB3, phb_base, TYPE_PNV_PHB, PnvPHB *),
1098     DEFINE_PROP_END_OF_LIST(),
1099 };
1100 
pnv_phb3_class_init(ObjectClass * klass,void * data)1101 static void pnv_phb3_class_init(ObjectClass *klass, void *data)
1102 {
1103     DeviceClass *dc = DEVICE_CLASS(klass);
1104 
1105     dc->realize = pnv_phb3_realize;
1106     device_class_set_props(dc, pnv_phb3_properties);
1107     dc->user_creatable = false;
1108 }
1109 
1110 static const TypeInfo pnv_phb3_type_info = {
1111     .name          = TYPE_PNV_PHB3,
1112     .parent        = TYPE_DEVICE,
1113     .instance_size = sizeof(PnvPHB3),
1114     .class_init    = pnv_phb3_class_init,
1115     .instance_init = pnv_phb3_instance_init,
1116 };
1117 
pnv_phb3_root_bus_get_prop(Object * obj,Visitor * v,const char * name,void * opaque,Error ** errp)1118 static void pnv_phb3_root_bus_get_prop(Object *obj, Visitor *v,
1119                                        const char *name,
1120                                        void *opaque, Error **errp)
1121 {
1122     PnvPHB3RootBus *bus = PNV_PHB3_ROOT_BUS(obj);
1123     uint64_t value = 0;
1124 
1125     if (strcmp(name, "phb-id") == 0) {
1126         value = bus->phb_id;
1127     } else {
1128         value = bus->chip_id;
1129     }
1130 
1131     visit_type_size(v, name, &value, errp);
1132 }
1133 
pnv_phb3_root_bus_set_prop(Object * obj,Visitor * v,const char * name,void * opaque,Error ** errp)1134 static void pnv_phb3_root_bus_set_prop(Object *obj, Visitor *v,
1135                                        const char *name,
1136                                        void *opaque, Error **errp)
1137 
1138 {
1139     PnvPHB3RootBus *bus = PNV_PHB3_ROOT_BUS(obj);
1140     uint64_t value;
1141 
1142     if (!visit_type_size(v, name, &value, errp)) {
1143         return;
1144     }
1145 
1146     if (strcmp(name, "phb-id") == 0) {
1147         bus->phb_id = value;
1148     } else {
1149         bus->chip_id = value;
1150     }
1151 }
1152 
pnv_phb3_root_bus_class_init(ObjectClass * klass,void * data)1153 static void pnv_phb3_root_bus_class_init(ObjectClass *klass, void *data)
1154 {
1155     BusClass *k = BUS_CLASS(klass);
1156 
1157     object_class_property_add(klass, "phb-id", "int",
1158                               pnv_phb3_root_bus_get_prop,
1159                               pnv_phb3_root_bus_set_prop,
1160                               NULL, NULL);
1161 
1162     object_class_property_add(klass, "chip-id", "int",
1163                               pnv_phb3_root_bus_get_prop,
1164                               pnv_phb3_root_bus_set_prop,
1165                               NULL, NULL);
1166 
1167     /*
1168      * PHB3 has only a single root complex. Enforce the limit on the
1169      * parent bus
1170      */
1171     k->max_dev = 1;
1172 }
1173 
1174 static const TypeInfo pnv_phb3_root_bus_info = {
1175     .name = TYPE_PNV_PHB3_ROOT_BUS,
1176     .parent = TYPE_PCIE_BUS,
1177     .instance_size = sizeof(PnvPHB3RootBus),
1178     .class_init = pnv_phb3_root_bus_class_init,
1179 };
1180 
pnv_phb3_register_types(void)1181 static void pnv_phb3_register_types(void)
1182 {
1183     type_register_static(&pnv_phb3_root_bus_info);
1184     type_register_static(&pnv_phb3_type_info);
1185     type_register_static(&pnv_phb3_iommu_memory_region_info);
1186 }
1187 
1188 type_init(pnv_phb3_register_types)
1189