1 /*
2 * QEMU PowerPC PowerNV (POWER8) PHB3 model
3 *
4 * Copyright (c) 2014-2020, IBM Corporation.
5 *
6 * This code is licensed under the GPL version 2 or later. See the
7 * COPYING file in the top-level directory.
8 */
9 #include "qemu/osdep.h"
10 #include "qemu/log.h"
11 #include "qapi/visitor.h"
12 #include "qapi/error.h"
13 #include "hw/pci-host/pnv_phb3_regs.h"
14 #include "hw/pci-host/pnv_phb.h"
15 #include "hw/pci-host/pnv_phb3.h"
16 #include "hw/pci/pcie_host.h"
17 #include "hw/pci/pcie_port.h"
18 #include "hw/ppc/pnv.h"
19 #include "hw/ppc/pnv_chip.h"
20 #include "hw/irq.h"
21 #include "hw/qdev-properties.h"
22 #include "qom/object.h"
23 #include "sysemu/sysemu.h"
24
25 #define phb3_error(phb, fmt, ...) \
26 qemu_log_mask(LOG_GUEST_ERROR, "phb3[%d:%d]: " fmt "\n", \
27 (phb)->chip_id, (phb)->phb_id, ## __VA_ARGS__)
28
pnv_phb3_find_cfg_dev(PnvPHB3 * phb)29 static PCIDevice *pnv_phb3_find_cfg_dev(PnvPHB3 *phb)
30 {
31 PCIHostState *pci = PCI_HOST_BRIDGE(phb->phb_base);
32 uint64_t addr = phb->regs[PHB_CONFIG_ADDRESS >> 3];
33 uint8_t bus, devfn;
34
35 if (!(addr >> 63)) {
36 return NULL;
37 }
38 bus = (addr >> 52) & 0xff;
39 devfn = (addr >> 44) & 0xff;
40
41 return pci_find_device(pci->bus, bus, devfn);
42 }
43
44 /*
45 * The CONFIG_DATA register expects little endian accesses, but as the
46 * region is big endian, we have to swap the value.
47 */
pnv_phb3_config_write(PnvPHB3 * phb,unsigned off,unsigned size,uint64_t val)48 static void pnv_phb3_config_write(PnvPHB3 *phb, unsigned off,
49 unsigned size, uint64_t val)
50 {
51 uint32_t cfg_addr, limit;
52 PCIDevice *pdev;
53
54 pdev = pnv_phb3_find_cfg_dev(phb);
55 if (!pdev) {
56 return;
57 }
58 cfg_addr = (phb->regs[PHB_CONFIG_ADDRESS >> 3] >> 32) & 0xffc;
59 cfg_addr |= off;
60 limit = pci_config_size(pdev);
61 if (limit <= cfg_addr) {
62 /*
63 * conventional pci device can be behind pcie-to-pci bridge.
64 * 256 <= addr < 4K has no effects.
65 */
66 return;
67 }
68 switch (size) {
69 case 1:
70 break;
71 case 2:
72 val = bswap16(val);
73 break;
74 case 4:
75 val = bswap32(val);
76 break;
77 default:
78 g_assert_not_reached();
79 }
80 pci_host_config_write_common(pdev, cfg_addr, limit, val, size);
81 }
82
pnv_phb3_config_read(PnvPHB3 * phb,unsigned off,unsigned size)83 static uint64_t pnv_phb3_config_read(PnvPHB3 *phb, unsigned off,
84 unsigned size)
85 {
86 uint32_t cfg_addr, limit;
87 PCIDevice *pdev;
88 uint64_t val;
89
90 pdev = pnv_phb3_find_cfg_dev(phb);
91 if (!pdev) {
92 return ~0ull;
93 }
94 cfg_addr = (phb->regs[PHB_CONFIG_ADDRESS >> 3] >> 32) & 0xffc;
95 cfg_addr |= off;
96 limit = pci_config_size(pdev);
97 if (limit <= cfg_addr) {
98 /*
99 * conventional pci device can be behind pcie-to-pci bridge.
100 * 256 <= addr < 4K has no effects.
101 */
102 return ~0ull;
103 }
104 val = pci_host_config_read_common(pdev, cfg_addr, limit, size);
105 switch (size) {
106 case 1:
107 return val;
108 case 2:
109 return bswap16(val);
110 case 4:
111 return bswap32(val);
112 default:
113 g_assert_not_reached();
114 }
115 }
116
pnv_phb3_check_m32(PnvPHB3 * phb)117 static void pnv_phb3_check_m32(PnvPHB3 *phb)
118 {
119 uint64_t base, start, size;
120 MemoryRegion *parent;
121 PnvPBCQState *pbcq = &phb->pbcq;
122
123 if (memory_region_is_mapped(&phb->mr_m32)) {
124 memory_region_del_subregion(phb->mr_m32.container, &phb->mr_m32);
125 }
126
127 if (!(phb->regs[PHB_PHB3_CONFIG >> 3] & PHB_PHB3C_M32_EN)) {
128 return;
129 }
130
131 /* Grab geometry from registers */
132 base = phb->regs[PHB_M32_BASE_ADDR >> 3];
133 start = phb->regs[PHB_M32_START_ADDR >> 3];
134 size = ~(phb->regs[PHB_M32_BASE_MASK >> 3] | 0xfffc000000000000ull) + 1;
135
136 /* Check if it matches an enabled MMIO region in the PBCQ */
137 if (memory_region_is_mapped(&pbcq->mmbar0) &&
138 base >= pbcq->mmio0_base &&
139 (base + size) <= (pbcq->mmio0_base + pbcq->mmio0_size)) {
140 parent = &pbcq->mmbar0;
141 base -= pbcq->mmio0_base;
142 } else if (memory_region_is_mapped(&pbcq->mmbar1) &&
143 base >= pbcq->mmio1_base &&
144 (base + size) <= (pbcq->mmio1_base + pbcq->mmio1_size)) {
145 parent = &pbcq->mmbar1;
146 base -= pbcq->mmio1_base;
147 } else {
148 return;
149 }
150
151 /* Create alias */
152 memory_region_init_alias(&phb->mr_m32, OBJECT(phb), "phb3-m32",
153 &phb->pci_mmio, start, size);
154 memory_region_add_subregion(parent, base, &phb->mr_m32);
155 }
156
pnv_phb3_check_m64(PnvPHB3 * phb,uint32_t index)157 static void pnv_phb3_check_m64(PnvPHB3 *phb, uint32_t index)
158 {
159 uint64_t base, start, size, m64;
160 MemoryRegion *parent;
161 PnvPBCQState *pbcq = &phb->pbcq;
162
163 if (memory_region_is_mapped(&phb->mr_m64[index])) {
164 /* Should we destroy it in RCU friendly way... ? */
165 memory_region_del_subregion(phb->mr_m64[index].container,
166 &phb->mr_m64[index]);
167 }
168
169 /* Get table entry */
170 m64 = phb->ioda_M64BT[index];
171
172 if (!(m64 & IODA2_M64BT_ENABLE)) {
173 return;
174 }
175
176 /* Grab geometry from registers */
177 base = GETFIELD(IODA2_M64BT_BASE, m64) << 20;
178 if (m64 & IODA2_M64BT_SINGLE_PE) {
179 base &= ~0x1ffffffull;
180 }
181 size = GETFIELD(IODA2_M64BT_MASK, m64) << 20;
182 size |= 0xfffc000000000000ull;
183 size = ~size + 1;
184 start = base | (phb->regs[PHB_M64_UPPER_BITS >> 3]);
185
186 /* Check if it matches an enabled MMIO region in the PBCQ */
187 if (memory_region_is_mapped(&pbcq->mmbar0) &&
188 base >= pbcq->mmio0_base &&
189 (base + size) <= (pbcq->mmio0_base + pbcq->mmio0_size)) {
190 parent = &pbcq->mmbar0;
191 base -= pbcq->mmio0_base;
192 } else if (memory_region_is_mapped(&pbcq->mmbar1) &&
193 base >= pbcq->mmio1_base &&
194 (base + size) <= (pbcq->mmio1_base + pbcq->mmio1_size)) {
195 parent = &pbcq->mmbar1;
196 base -= pbcq->mmio1_base;
197 } else {
198 return;
199 }
200
201 /* Create alias */
202 memory_region_init_alias(&phb->mr_m64[index], OBJECT(phb), "phb3-m64",
203 &phb->pci_mmio, start, size);
204 memory_region_add_subregion(parent, base, &phb->mr_m64[index]);
205 }
206
pnv_phb3_check_all_m64s(PnvPHB3 * phb)207 static void pnv_phb3_check_all_m64s(PnvPHB3 *phb)
208 {
209 uint64_t i;
210
211 for (i = 0; i < PNV_PHB3_NUM_M64; i++) {
212 pnv_phb3_check_m64(phb, i);
213 }
214 }
215
pnv_phb3_lxivt_write(PnvPHB3 * phb,unsigned idx,uint64_t val)216 static void pnv_phb3_lxivt_write(PnvPHB3 *phb, unsigned idx, uint64_t val)
217 {
218 uint8_t server, prio;
219
220 phb->ioda_LXIVT[idx] = val & (IODA2_LXIVT_SERVER |
221 IODA2_LXIVT_PRIORITY |
222 IODA2_LXIVT_NODE_ID);
223 server = GETFIELD(IODA2_LXIVT_SERVER, val);
224 prio = GETFIELD(IODA2_LXIVT_PRIORITY, val);
225
226 /*
227 * The low order 2 bits are the link pointer (Type II interrupts).
228 * Shift back to get a valid IRQ server.
229 */
230 server >>= 2;
231
232 ics_write_xive(&phb->lsis, idx, server, prio, prio);
233 }
234
pnv_phb3_ioda_access(PnvPHB3 * phb,unsigned * out_table,unsigned * out_idx)235 static uint64_t *pnv_phb3_ioda_access(PnvPHB3 *phb,
236 unsigned *out_table, unsigned *out_idx)
237 {
238 uint64_t adreg = phb->regs[PHB_IODA_ADDR >> 3];
239 unsigned int index = GETFIELD(PHB_IODA_AD_TADR, adreg);
240 unsigned int table = GETFIELD(PHB_IODA_AD_TSEL, adreg);
241 unsigned int mask;
242 uint64_t *tptr = NULL;
243
244 switch (table) {
245 case IODA2_TBL_LIST:
246 tptr = phb->ioda_LIST;
247 mask = 7;
248 break;
249 case IODA2_TBL_LXIVT:
250 tptr = phb->ioda_LXIVT;
251 mask = 7;
252 break;
253 case IODA2_TBL_IVC_CAM:
254 case IODA2_TBL_RBA:
255 mask = 31;
256 break;
257 case IODA2_TBL_RCAM:
258 mask = 63;
259 break;
260 case IODA2_TBL_MRT:
261 mask = 7;
262 break;
263 case IODA2_TBL_PESTA:
264 case IODA2_TBL_PESTB:
265 mask = 255;
266 break;
267 case IODA2_TBL_TVT:
268 tptr = phb->ioda_TVT;
269 mask = 511;
270 break;
271 case IODA2_TBL_TCAM:
272 case IODA2_TBL_TDR:
273 mask = 63;
274 break;
275 case IODA2_TBL_M64BT:
276 tptr = phb->ioda_M64BT;
277 mask = 15;
278 break;
279 case IODA2_TBL_M32DT:
280 tptr = phb->ioda_MDT;
281 mask = 255;
282 break;
283 case IODA2_TBL_PEEV:
284 tptr = phb->ioda_PEEV;
285 mask = 3;
286 break;
287 default:
288 phb3_error(phb, "invalid IODA table %d", table);
289 return NULL;
290 }
291 index &= mask;
292 if (out_idx) {
293 *out_idx = index;
294 }
295 if (out_table) {
296 *out_table = table;
297 }
298 if (tptr) {
299 tptr += index;
300 }
301 if (adreg & PHB_IODA_AD_AUTOINC) {
302 index = (index + 1) & mask;
303 adreg = SETFIELD(PHB_IODA_AD_TADR, adreg, index);
304 }
305 phb->regs[PHB_IODA_ADDR >> 3] = adreg;
306 return tptr;
307 }
308
pnv_phb3_ioda_read(PnvPHB3 * phb)309 static uint64_t pnv_phb3_ioda_read(PnvPHB3 *phb)
310 {
311 unsigned table;
312 uint64_t *tptr;
313
314 tptr = pnv_phb3_ioda_access(phb, &table, NULL);
315 if (!tptr) {
316 /* Return 0 on unsupported tables, not ff's */
317 return 0;
318 }
319 return *tptr;
320 }
321
pnv_phb3_ioda_write(PnvPHB3 * phb,uint64_t val)322 static void pnv_phb3_ioda_write(PnvPHB3 *phb, uint64_t val)
323 {
324 unsigned table, idx;
325 uint64_t *tptr;
326
327 tptr = pnv_phb3_ioda_access(phb, &table, &idx);
328 if (!tptr) {
329 return;
330 }
331
332 /* Handle side effects */
333 switch (table) {
334 case IODA2_TBL_LXIVT:
335 pnv_phb3_lxivt_write(phb, idx, val);
336 break;
337 case IODA2_TBL_M64BT:
338 *tptr = val;
339 pnv_phb3_check_m64(phb, idx);
340 break;
341 default:
342 *tptr = val;
343 }
344 }
345
346 /*
347 * This is called whenever the PHB LSI, MSI source ID register or
348 * the PBCQ irq filters are written.
349 */
pnv_phb3_remap_irqs(PnvPHB3 * phb)350 void pnv_phb3_remap_irqs(PnvPHB3 *phb)
351 {
352 ICSState *ics = &phb->lsis;
353 uint32_t local, global, count, mask, comp;
354 uint64_t baren;
355 PnvPBCQState *pbcq = &phb->pbcq;
356
357 /*
358 * First check if we are enabled. Unlike real HW we don't separate
359 * TX and RX so we enable if both are set
360 */
361 baren = pbcq->nest_regs[PBCQ_NEST_BAR_EN];
362 if (!(baren & PBCQ_NEST_BAR_EN_IRSN_RX) ||
363 !(baren & PBCQ_NEST_BAR_EN_IRSN_TX)) {
364 ics->offset = 0;
365 return;
366 }
367
368 /* Grab local LSI source ID */
369 local = GETFIELD(PHB_LSI_SRC_ID, phb->regs[PHB_LSI_SOURCE_ID >> 3]) << 3;
370
371 /* Grab global one and compare */
372 global = GETFIELD(PBCQ_NEST_LSI_SRC,
373 pbcq->nest_regs[PBCQ_NEST_LSI_SRC_ID]) << 3;
374 if (global != local) {
375 /*
376 * This happens during initialization, let's come back when we
377 * are properly configured
378 */
379 ics->offset = 0;
380 return;
381 }
382
383 /* Get the base on the powerbus */
384 comp = GETFIELD(PBCQ_NEST_IRSN_COMP,
385 pbcq->nest_regs[PBCQ_NEST_IRSN_COMPARE]);
386 mask = GETFIELD(PBCQ_NEST_IRSN_COMP,
387 pbcq->nest_regs[PBCQ_NEST_IRSN_MASK]);
388 count = ((~mask) + 1) & 0x7ffff;
389 phb->total_irq = count;
390
391 /* Sanity checks */
392 if ((global + PNV_PHB3_NUM_LSI) > count) {
393 phb3_error(phb, "LSIs out of reach: LSI base=%d total irq=%d", global,
394 count);
395 }
396
397 if (count > 2048) {
398 phb3_error(phb, "More interrupts than supported: %d", count);
399 }
400
401 if ((comp & mask) != comp) {
402 phb3_error(phb, "IRQ compare bits not in mask: comp=0x%x mask=0x%x",
403 comp, mask);
404 comp &= mask;
405 }
406 /* Setup LSI offset */
407 ics->offset = comp + global;
408
409 /* Setup MSI offset */
410 pnv_phb3_msi_update_config(&phb->msis, comp, count - PNV_PHB3_NUM_LSI);
411 }
412
pnv_phb3_lsi_src_id_write(PnvPHB3 * phb,uint64_t val)413 static void pnv_phb3_lsi_src_id_write(PnvPHB3 *phb, uint64_t val)
414 {
415 /* Sanitize content */
416 val &= PHB_LSI_SRC_ID;
417 phb->regs[PHB_LSI_SOURCE_ID >> 3] = val;
418 pnv_phb3_remap_irqs(phb);
419 }
420
pnv_phb3_rtc_invalidate(PnvPHB3 * phb,uint64_t val)421 static void pnv_phb3_rtc_invalidate(PnvPHB3 *phb, uint64_t val)
422 {
423 PnvPhb3DMASpace *ds;
424
425 /* Always invalidate all for now ... */
426 QLIST_FOREACH(ds, &phb->dma_spaces, list) {
427 ds->pe_num = PHB_INVALID_PE;
428 }
429 }
430
431
pnv_phb3_update_msi_regions(PnvPhb3DMASpace * ds)432 static void pnv_phb3_update_msi_regions(PnvPhb3DMASpace *ds)
433 {
434 uint64_t cfg = ds->phb->regs[PHB_PHB3_CONFIG >> 3];
435
436 if (cfg & PHB_PHB3C_32BIT_MSI_EN) {
437 if (!memory_region_is_mapped(&ds->msi32_mr)) {
438 memory_region_add_subregion(MEMORY_REGION(&ds->dma_mr),
439 0xffff0000, &ds->msi32_mr);
440 }
441 } else {
442 if (memory_region_is_mapped(&ds->msi32_mr)) {
443 memory_region_del_subregion(MEMORY_REGION(&ds->dma_mr),
444 &ds->msi32_mr);
445 }
446 }
447
448 if (cfg & PHB_PHB3C_64BIT_MSI_EN) {
449 if (!memory_region_is_mapped(&ds->msi64_mr)) {
450 memory_region_add_subregion(MEMORY_REGION(&ds->dma_mr),
451 (1ull << 60), &ds->msi64_mr);
452 }
453 } else {
454 if (memory_region_is_mapped(&ds->msi64_mr)) {
455 memory_region_del_subregion(MEMORY_REGION(&ds->dma_mr),
456 &ds->msi64_mr);
457 }
458 }
459 }
460
pnv_phb3_update_all_msi_regions(PnvPHB3 * phb)461 static void pnv_phb3_update_all_msi_regions(PnvPHB3 *phb)
462 {
463 PnvPhb3DMASpace *ds;
464
465 QLIST_FOREACH(ds, &phb->dma_spaces, list) {
466 pnv_phb3_update_msi_regions(ds);
467 }
468 }
469
pnv_phb3_reg_write(void * opaque,hwaddr off,uint64_t val,unsigned size)470 void pnv_phb3_reg_write(void *opaque, hwaddr off, uint64_t val, unsigned size)
471 {
472 PnvPHB3 *phb = opaque;
473 bool changed;
474
475 /* Special case configuration data */
476 if ((off & 0xfffc) == PHB_CONFIG_DATA) {
477 pnv_phb3_config_write(phb, off & 0x3, size, val);
478 return;
479 }
480
481 /* Other registers are 64-bit only */
482 if (size != 8 || off & 0x7) {
483 phb3_error(phb, "Invalid register access, offset: 0x%"PRIx64" size: %d",
484 off, size);
485 return;
486 }
487
488 /* Handle masking & filtering */
489 switch (off) {
490 case PHB_M64_UPPER_BITS:
491 val &= 0xfffc000000000000ull;
492 break;
493 case PHB_Q_DMA_R:
494 /*
495 * This is enough logic to make SW happy but we aren't actually
496 * quiescing the DMAs
497 */
498 if (val & PHB_Q_DMA_R_AUTORESET) {
499 val = 0;
500 } else {
501 val &= PHB_Q_DMA_R_QUIESCE_DMA;
502 }
503 break;
504 /* LEM stuff */
505 case PHB_LEM_FIR_AND_MASK:
506 phb->regs[PHB_LEM_FIR_ACCUM >> 3] &= val;
507 return;
508 case PHB_LEM_FIR_OR_MASK:
509 phb->regs[PHB_LEM_FIR_ACCUM >> 3] |= val;
510 return;
511 case PHB_LEM_ERROR_AND_MASK:
512 phb->regs[PHB_LEM_ERROR_MASK >> 3] &= val;
513 return;
514 case PHB_LEM_ERROR_OR_MASK:
515 phb->regs[PHB_LEM_ERROR_MASK >> 3] |= val;
516 return;
517 case PHB_LEM_WOF:
518 val = 0;
519 break;
520 }
521
522 /* Record whether it changed */
523 changed = phb->regs[off >> 3] != val;
524
525 /* Store in register cache first */
526 phb->regs[off >> 3] = val;
527
528 /* Handle side effects */
529 switch (off) {
530 case PHB_PHB3_CONFIG:
531 if (changed) {
532 pnv_phb3_update_all_msi_regions(phb);
533 }
534 /* fall through */
535 case PHB_M32_BASE_ADDR:
536 case PHB_M32_BASE_MASK:
537 case PHB_M32_START_ADDR:
538 if (changed) {
539 pnv_phb3_check_m32(phb);
540 }
541 break;
542 case PHB_M64_UPPER_BITS:
543 if (changed) {
544 pnv_phb3_check_all_m64s(phb);
545 }
546 break;
547 case PHB_LSI_SOURCE_ID:
548 if (changed) {
549 pnv_phb3_lsi_src_id_write(phb, val);
550 }
551 break;
552
553 /* IODA table accesses */
554 case PHB_IODA_DATA0:
555 pnv_phb3_ioda_write(phb, val);
556 break;
557
558 /* RTC invalidation */
559 case PHB_RTC_INVALIDATE:
560 pnv_phb3_rtc_invalidate(phb, val);
561 break;
562
563 /* FFI request */
564 case PHB_FFI_REQUEST:
565 pnv_phb3_msi_ffi(&phb->msis, val);
566 break;
567
568 /* Silent simple writes */
569 case PHB_CONFIG_ADDRESS:
570 case PHB_IODA_ADDR:
571 case PHB_TCE_KILL:
572 case PHB_TCE_SPEC_CTL:
573 case PHB_PEST_BAR:
574 case PHB_PELTV_BAR:
575 case PHB_RTT_BAR:
576 case PHB_RBA_BAR:
577 case PHB_IVT_BAR:
578 case PHB_FFI_LOCK:
579 case PHB_LEM_FIR_ACCUM:
580 case PHB_LEM_ERROR_MASK:
581 case PHB_LEM_ACTION0:
582 case PHB_LEM_ACTION1:
583 break;
584
585 /* Noise on anything else */
586 default:
587 qemu_log_mask(LOG_UNIMP, "phb3: reg_write 0x%"PRIx64"=%"PRIx64"\n",
588 off, val);
589 }
590 }
591
pnv_phb3_reg_read(void * opaque,hwaddr off,unsigned size)592 uint64_t pnv_phb3_reg_read(void *opaque, hwaddr off, unsigned size)
593 {
594 PnvPHB3 *phb = opaque;
595 PCIHostState *pci = PCI_HOST_BRIDGE(phb->phb_base);
596 uint64_t val;
597
598 if ((off & 0xfffc) == PHB_CONFIG_DATA) {
599 return pnv_phb3_config_read(phb, off & 0x3, size);
600 }
601
602 /* Other registers are 64-bit only */
603 if (size != 8 || off & 0x7) {
604 phb3_error(phb, "Invalid register access, offset: 0x%"PRIx64" size: %d",
605 off, size);
606 return ~0ull;
607 }
608
609 /* Default read from cache */
610 val = phb->regs[off >> 3];
611
612 switch (off) {
613 /* Simulate venice DD2.0 */
614 case PHB_VERSION:
615 return 0x000000a300000005ull;
616 case PHB_PCIE_SYSTEM_CONFIG:
617 return 0x441100fc30000000;
618
619 /* IODA table accesses */
620 case PHB_IODA_DATA0:
621 return pnv_phb3_ioda_read(phb);
622
623 /* Link training always appears trained */
624 case PHB_PCIE_DLP_TRAIN_CTL:
625 if (!pci_find_device(pci->bus, 1, 0)) {
626 return 0;
627 }
628 return PHB_PCIE_DLP_INBAND_PRESENCE | PHB_PCIE_DLP_TC_DL_LINKACT;
629
630 /* FFI Lock */
631 case PHB_FFI_LOCK:
632 /* Set lock and return previous value */
633 phb->regs[off >> 3] |= PHB_FFI_LOCK_STATE;
634 return val;
635
636 /* DMA read sync: make it look like it's complete */
637 case PHB_DMARD_SYNC:
638 return PHB_DMARD_SYNC_COMPLETE;
639
640 /* Silent simple reads */
641 case PHB_PHB3_CONFIG:
642 case PHB_M32_BASE_ADDR:
643 case PHB_M32_BASE_MASK:
644 case PHB_M32_START_ADDR:
645 case PHB_CONFIG_ADDRESS:
646 case PHB_IODA_ADDR:
647 case PHB_RTC_INVALIDATE:
648 case PHB_TCE_KILL:
649 case PHB_TCE_SPEC_CTL:
650 case PHB_PEST_BAR:
651 case PHB_PELTV_BAR:
652 case PHB_RTT_BAR:
653 case PHB_RBA_BAR:
654 case PHB_IVT_BAR:
655 case PHB_M64_UPPER_BITS:
656 case PHB_LEM_FIR_ACCUM:
657 case PHB_LEM_ERROR_MASK:
658 case PHB_LEM_ACTION0:
659 case PHB_LEM_ACTION1:
660 break;
661
662 /* Noise on anything else */
663 default:
664 qemu_log_mask(LOG_UNIMP, "phb3: reg_read 0x%"PRIx64"=%"PRIx64"\n",
665 off, val);
666 }
667 return val;
668 }
669
670 static const MemoryRegionOps pnv_phb3_reg_ops = {
671 .read = pnv_phb3_reg_read,
672 .write = pnv_phb3_reg_write,
673 .valid.min_access_size = 1,
674 .valid.max_access_size = 8,
675 .impl.min_access_size = 1,
676 .impl.max_access_size = 8,
677 .endianness = DEVICE_BIG_ENDIAN,
678 };
679
pnv_phb3_map_irq(PCIDevice * pci_dev,int irq_num)680 static int pnv_phb3_map_irq(PCIDevice *pci_dev, int irq_num)
681 {
682 /* Check that out properly ... */
683 return irq_num & 3;
684 }
685
pnv_phb3_set_irq(void * opaque,int irq_num,int level)686 static void pnv_phb3_set_irq(void *opaque, int irq_num, int level)
687 {
688 PnvPHB3 *phb = opaque;
689
690 /* LSI only ... */
691 if (irq_num > 3) {
692 phb3_error(phb, "Unknown IRQ to set %d", irq_num);
693 }
694 qemu_set_irq(phb->qirqs[irq_num], level);
695 }
696
pnv_phb3_resolve_pe(PnvPhb3DMASpace * ds)697 static bool pnv_phb3_resolve_pe(PnvPhb3DMASpace *ds)
698 {
699 uint64_t rtt, addr;
700 uint16_t rte;
701 int bus_num;
702
703 /* Already resolved ? */
704 if (ds->pe_num != PHB_INVALID_PE) {
705 return true;
706 }
707
708 /* We need to lookup the RTT */
709 rtt = ds->phb->regs[PHB_RTT_BAR >> 3];
710 if (!(rtt & PHB_RTT_BAR_ENABLE)) {
711 phb3_error(ds->phb, "DMA with RTT BAR disabled !");
712 /* Set error bits ? fence ? ... */
713 return false;
714 }
715
716 /* Read RTE */
717 bus_num = pci_bus_num(ds->bus);
718 addr = rtt & PHB_RTT_BASE_ADDRESS_MASK;
719 addr += 2 * ((bus_num << 8) | ds->devfn);
720 if (dma_memory_read(&address_space_memory, addr, &rte,
721 sizeof(rte), MEMTXATTRS_UNSPECIFIED)) {
722 phb3_error(ds->phb, "Failed to read RTT entry at 0x%"PRIx64, addr);
723 /* Set error bits ? fence ? ... */
724 return false;
725 }
726 rte = be16_to_cpu(rte);
727
728 /* Fail upon reading of invalid PE# */
729 if (rte >= PNV_PHB3_NUM_PE) {
730 phb3_error(ds->phb, "RTE for RID 0x%x invalid (%04x", ds->devfn, rte);
731 /* Set error bits ? fence ? ... */
732 return false;
733 }
734 ds->pe_num = rte;
735 return true;
736 }
737
pnv_phb3_translate_tve(PnvPhb3DMASpace * ds,hwaddr addr,bool is_write,uint64_t tve,IOMMUTLBEntry * tlb)738 static void pnv_phb3_translate_tve(PnvPhb3DMASpace *ds, hwaddr addr,
739 bool is_write, uint64_t tve,
740 IOMMUTLBEntry *tlb)
741 {
742 uint64_t tta = GETFIELD(IODA2_TVT_TABLE_ADDR, tve);
743 int32_t lev = GETFIELD(IODA2_TVT_NUM_LEVELS, tve);
744 uint32_t tts = GETFIELD(IODA2_TVT_TCE_TABLE_SIZE, tve);
745 uint32_t tps = GETFIELD(IODA2_TVT_IO_PSIZE, tve);
746 PnvPHB3 *phb = ds->phb;
747
748 /* Invalid levels */
749 if (lev > 4) {
750 phb3_error(phb, "Invalid #levels in TVE %d", lev);
751 return;
752 }
753
754 /* IO Page Size of 0 means untranslated, else use TCEs */
755 if (tps == 0) {
756 /*
757 * We only support non-translate in top window.
758 *
759 * TODO: Venice/Murano support it on bottom window above 4G and
760 * Naples supports it on everything
761 */
762 if (!(tve & PPC_BIT(51))) {
763 phb3_error(phb, "xlate for invalid non-translate TVE");
764 return;
765 }
766 /* TODO: Handle boundaries */
767
768 /* Use 4k pages like q35 ... for now */
769 tlb->iova = addr & 0xfffffffffffff000ull;
770 tlb->translated_addr = addr & 0x0003fffffffff000ull;
771 tlb->addr_mask = 0xfffull;
772 tlb->perm = IOMMU_RW;
773 } else {
774 uint32_t tce_shift, tbl_shift, sh;
775 uint64_t base, taddr, tce, tce_mask;
776
777 /* TVE disabled ? */
778 if (tts == 0) {
779 phb3_error(phb, "xlate for invalid translated TVE");
780 return;
781 }
782
783 /* Address bits per bottom level TCE entry */
784 tce_shift = tps + 11;
785
786 /* Address bits per table level */
787 tbl_shift = tts + 8;
788
789 /* Top level table base address */
790 base = tta << 12;
791
792 /* Total shift to first level */
793 sh = tbl_shift * lev + tce_shift;
794
795 /* TODO: Multi-level untested */
796 do {
797 lev--;
798
799 /* Grab the TCE address */
800 taddr = base | (((addr >> sh) & ((1ul << tbl_shift) - 1)) << 3);
801 if (dma_memory_read(&address_space_memory, taddr, &tce,
802 sizeof(tce), MEMTXATTRS_UNSPECIFIED)) {
803 phb3_error(phb, "Failed to read TCE at 0x%"PRIx64, taddr);
804 return;
805 }
806 tce = be64_to_cpu(tce);
807
808 /* Check permission for indirect TCE */
809 if ((lev >= 0) && !(tce & 3)) {
810 phb3_error(phb, "Invalid indirect TCE at 0x%"PRIx64, taddr);
811 phb3_error(phb, " xlate %"PRIx64":%c TVE=%"PRIx64, addr,
812 is_write ? 'W' : 'R', tve);
813 phb3_error(phb, " tta=%"PRIx64" lev=%d tts=%d tps=%d",
814 tta, lev, tts, tps);
815 return;
816 }
817 sh -= tbl_shift;
818 base = tce & ~0xfffull;
819 } while (lev >= 0);
820
821 /* We exit the loop with TCE being the final TCE */
822 if ((is_write & !(tce & 2)) || ((!is_write) && !(tce & 1))) {
823 phb3_error(phb, "TCE access fault at 0x%"PRIx64, taddr);
824 phb3_error(phb, " xlate %"PRIx64":%c TVE=%"PRIx64, addr,
825 is_write ? 'W' : 'R', tve);
826 phb3_error(phb, " tta=%"PRIx64" lev=%d tts=%d tps=%d",
827 tta, lev, tts, tps);
828 return;
829 }
830 tce_mask = ~((1ull << tce_shift) - 1);
831 tlb->iova = addr & tce_mask;
832 tlb->translated_addr = tce & tce_mask;
833 tlb->addr_mask = ~tce_mask;
834 tlb->perm = tce & 3;
835 }
836 }
837
pnv_phb3_translate_iommu(IOMMUMemoryRegion * iommu,hwaddr addr,IOMMUAccessFlags flag,int iommu_idx)838 static IOMMUTLBEntry pnv_phb3_translate_iommu(IOMMUMemoryRegion *iommu,
839 hwaddr addr,
840 IOMMUAccessFlags flag,
841 int iommu_idx)
842 {
843 PnvPhb3DMASpace *ds = container_of(iommu, PnvPhb3DMASpace, dma_mr);
844 int tve_sel;
845 uint64_t tve, cfg;
846 IOMMUTLBEntry ret = {
847 .target_as = &address_space_memory,
848 .iova = addr,
849 .translated_addr = 0,
850 .addr_mask = ~(hwaddr)0,
851 .perm = IOMMU_NONE,
852 };
853 PnvPHB3 *phb = ds->phb;
854
855 /* Resolve PE# */
856 if (!pnv_phb3_resolve_pe(ds)) {
857 phb3_error(phb, "Failed to resolve PE# for bus @%p (%d) devfn 0x%x",
858 ds->bus, pci_bus_num(ds->bus), ds->devfn);
859 return ret;
860 }
861
862 /* Check top bits */
863 switch (addr >> 60) {
864 case 00:
865 /* DMA or 32-bit MSI ? */
866 cfg = ds->phb->regs[PHB_PHB3_CONFIG >> 3];
867 if ((cfg & PHB_PHB3C_32BIT_MSI_EN) &&
868 ((addr & 0xffffffffffff0000ull) == 0xffff0000ull)) {
869 phb3_error(phb, "xlate on 32-bit MSI region");
870 return ret;
871 }
872 /* Choose TVE XXX Use PHB3 Control Register */
873 tve_sel = (addr >> 59) & 1;
874 tve = ds->phb->ioda_TVT[ds->pe_num * 2 + tve_sel];
875 pnv_phb3_translate_tve(ds, addr, flag & IOMMU_WO, tve, &ret);
876 break;
877 case 01:
878 phb3_error(phb, "xlate on 64-bit MSI region");
879 break;
880 default:
881 phb3_error(phb, "xlate on unsupported address 0x%"PRIx64, addr);
882 }
883 return ret;
884 }
885
886 #define TYPE_PNV_PHB3_IOMMU_MEMORY_REGION "pnv-phb3-iommu-memory-region"
DECLARE_INSTANCE_CHECKER(IOMMUMemoryRegion,PNV_PHB3_IOMMU_MEMORY_REGION,TYPE_PNV_PHB3_IOMMU_MEMORY_REGION)887 DECLARE_INSTANCE_CHECKER(IOMMUMemoryRegion, PNV_PHB3_IOMMU_MEMORY_REGION,
888 TYPE_PNV_PHB3_IOMMU_MEMORY_REGION)
889
890 static void pnv_phb3_iommu_memory_region_class_init(ObjectClass *klass,
891 void *data)
892 {
893 IOMMUMemoryRegionClass *imrc = IOMMU_MEMORY_REGION_CLASS(klass);
894
895 imrc->translate = pnv_phb3_translate_iommu;
896 }
897
898 static const TypeInfo pnv_phb3_iommu_memory_region_info = {
899 .parent = TYPE_IOMMU_MEMORY_REGION,
900 .name = TYPE_PNV_PHB3_IOMMU_MEMORY_REGION,
901 .class_init = pnv_phb3_iommu_memory_region_class_init,
902 };
903
904 /*
905 * MSI/MSIX memory region implementation.
906 * The handler handles both MSI and MSIX.
907 */
pnv_phb3_msi_write(void * opaque,hwaddr addr,uint64_t data,unsigned size)908 static void pnv_phb3_msi_write(void *opaque, hwaddr addr,
909 uint64_t data, unsigned size)
910 {
911 PnvPhb3DMASpace *ds = opaque;
912
913 /* Resolve PE# */
914 if (!pnv_phb3_resolve_pe(ds)) {
915 phb3_error(ds->phb, "Failed to resolve PE# for bus @%p (%d) devfn 0x%x",
916 ds->bus, pci_bus_num(ds->bus), ds->devfn);
917 return;
918 }
919
920 pnv_phb3_msi_send(&ds->phb->msis, addr, data, ds->pe_num);
921 }
922
923 /* There is no .read as the read result is undefined by PCI spec */
pnv_phb3_msi_read(void * opaque,hwaddr addr,unsigned size)924 static uint64_t pnv_phb3_msi_read(void *opaque, hwaddr addr, unsigned size)
925 {
926 PnvPhb3DMASpace *ds = opaque;
927
928 phb3_error(ds->phb, "invalid read @ 0x%" HWADDR_PRIx, addr);
929 return -1;
930 }
931
932 static const MemoryRegionOps pnv_phb3_msi_ops = {
933 .read = pnv_phb3_msi_read,
934 .write = pnv_phb3_msi_write,
935 .endianness = DEVICE_LITTLE_ENDIAN
936 };
937
pnv_phb3_dma_iommu(PCIBus * bus,void * opaque,int devfn)938 static AddressSpace *pnv_phb3_dma_iommu(PCIBus *bus, void *opaque, int devfn)
939 {
940 PnvPHB3 *phb = opaque;
941 PnvPhb3DMASpace *ds;
942
943 QLIST_FOREACH(ds, &phb->dma_spaces, list) {
944 if (ds->bus == bus && ds->devfn == devfn) {
945 break;
946 }
947 }
948
949 if (ds == NULL) {
950 ds = g_new0(PnvPhb3DMASpace, 1);
951 ds->bus = bus;
952 ds->devfn = devfn;
953 ds->pe_num = PHB_INVALID_PE;
954 ds->phb = phb;
955 memory_region_init_iommu(&ds->dma_mr, sizeof(ds->dma_mr),
956 TYPE_PNV_PHB3_IOMMU_MEMORY_REGION,
957 OBJECT(phb), "phb3_iommu", UINT64_MAX);
958 address_space_init(&ds->dma_as, MEMORY_REGION(&ds->dma_mr),
959 "phb3_iommu");
960 memory_region_init_io(&ds->msi32_mr, OBJECT(phb), &pnv_phb3_msi_ops,
961 ds, "msi32", 0x10000);
962 memory_region_init_io(&ds->msi64_mr, OBJECT(phb), &pnv_phb3_msi_ops,
963 ds, "msi64", 0x100000);
964 pnv_phb3_update_msi_regions(ds);
965
966 QLIST_INSERT_HEAD(&phb->dma_spaces, ds, list);
967 }
968 return &ds->dma_as;
969 }
970
971 static PCIIOMMUOps pnv_phb3_iommu_ops = {
972 .get_address_space = pnv_phb3_dma_iommu,
973 };
974
pnv_phb3_instance_init(Object * obj)975 static void pnv_phb3_instance_init(Object *obj)
976 {
977 PnvPHB3 *phb = PNV_PHB3(obj);
978
979 QLIST_INIT(&phb->dma_spaces);
980
981 /* LSI sources */
982 object_initialize_child(obj, "lsi", &phb->lsis, TYPE_ICS);
983
984 /* Default init ... will be fixed by HW inits */
985 phb->lsis.offset = 0;
986
987 /* MSI sources */
988 object_initialize_child(obj, "msi", &phb->msis, TYPE_PHB3_MSI);
989
990 /* Power Bus Common Queue */
991 object_initialize_child(obj, "pbcq", &phb->pbcq, TYPE_PNV_PBCQ);
992
993 }
994
pnv_phb3_bus_init(DeviceState * dev,PnvPHB3 * phb)995 void pnv_phb3_bus_init(DeviceState *dev, PnvPHB3 *phb)
996 {
997 PCIHostState *pci = PCI_HOST_BRIDGE(dev);
998
999 /*
1000 * PHB3 doesn't support IO space. However, qemu gets very upset if
1001 * we don't have an IO region to anchor IO BARs onto so we just
1002 * initialize one which we never hook up to anything
1003 */
1004 memory_region_init(&phb->pci_io, OBJECT(phb), "pci-io", 0x10000);
1005 memory_region_init(&phb->pci_mmio, OBJECT(phb), "pci-mmio",
1006 PCI_MMIO_TOTAL_SIZE);
1007
1008 pci->bus = pci_register_root_bus(dev,
1009 dev->id ? dev->id : NULL,
1010 pnv_phb3_set_irq, pnv_phb3_map_irq, phb,
1011 &phb->pci_mmio, &phb->pci_io,
1012 0, 4, TYPE_PNV_PHB3_ROOT_BUS);
1013
1014 object_property_set_int(OBJECT(pci->bus), "phb-id", phb->phb_id,
1015 &error_abort);
1016 object_property_set_int(OBJECT(pci->bus), "chip-id", phb->chip_id,
1017 &error_abort);
1018
1019 pci_setup_iommu(pci->bus, &pnv_phb3_iommu_ops, phb);
1020 }
1021
pnv_phb3_realize(DeviceState * dev,Error ** errp)1022 static void pnv_phb3_realize(DeviceState *dev, Error **errp)
1023 {
1024 PnvPHB3 *phb = PNV_PHB3(dev);
1025 PnvMachineState *pnv = PNV_MACHINE(qdev_get_machine());
1026 int i;
1027
1028 if (phb->phb_id >= PNV_CHIP_GET_CLASS(phb->chip)->num_phbs) {
1029 error_setg(errp, "invalid PHB index: %d", phb->phb_id);
1030 return;
1031 }
1032
1033 /* LSI sources */
1034 object_property_set_link(OBJECT(&phb->lsis), "xics", OBJECT(pnv),
1035 &error_abort);
1036 object_property_set_int(OBJECT(&phb->lsis), "nr-irqs", PNV_PHB3_NUM_LSI,
1037 &error_abort);
1038 if (!qdev_realize(DEVICE(&phb->lsis), NULL, errp)) {
1039 return;
1040 }
1041
1042 for (i = 0; i < phb->lsis.nr_irqs; i++) {
1043 ics_set_irq_type(&phb->lsis, i, true);
1044 }
1045
1046 phb->qirqs = qemu_allocate_irqs(ics_set_irq, &phb->lsis, phb->lsis.nr_irqs);
1047
1048 /* MSI sources */
1049 object_property_set_link(OBJECT(&phb->msis), "phb", OBJECT(phb),
1050 &error_abort);
1051 object_property_set_link(OBJECT(&phb->msis), "xics", OBJECT(pnv),
1052 &error_abort);
1053 object_property_set_int(OBJECT(&phb->msis), "nr-irqs", PHB3_MAX_MSI,
1054 &error_abort);
1055 if (!qdev_realize(DEVICE(&phb->msis), NULL, errp)) {
1056 return;
1057 }
1058
1059 /* Power Bus Common Queue */
1060 object_property_set_link(OBJECT(&phb->pbcq), "phb", OBJECT(phb),
1061 &error_abort);
1062 if (!qdev_realize(DEVICE(&phb->pbcq), NULL, errp)) {
1063 return;
1064 }
1065
1066 /* Controller Registers */
1067 memory_region_init_io(&phb->mr_regs, OBJECT(phb), &pnv_phb3_reg_ops, phb,
1068 "phb3-regs", 0x1000);
1069 }
1070
pnv_phb3_update_regions(PnvPHB3 * phb)1071 void pnv_phb3_update_regions(PnvPHB3 *phb)
1072 {
1073 PnvPBCQState *pbcq = &phb->pbcq;
1074
1075 /* Unmap first always */
1076 if (memory_region_is_mapped(&phb->mr_regs)) {
1077 memory_region_del_subregion(&pbcq->phbbar, &phb->mr_regs);
1078 }
1079
1080 /* Map registers if enabled */
1081 if (memory_region_is_mapped(&pbcq->phbbar)) {
1082 /* TODO: We should use the PHB BAR 2 register but we don't ... */
1083 memory_region_add_subregion(&pbcq->phbbar, 0, &phb->mr_regs);
1084 }
1085
1086 /* Check/update m32 */
1087 if (memory_region_is_mapped(&phb->mr_m32)) {
1088 pnv_phb3_check_m32(phb);
1089 }
1090 pnv_phb3_check_all_m64s(phb);
1091 }
1092
1093 static Property pnv_phb3_properties[] = {
1094 DEFINE_PROP_UINT32("index", PnvPHB3, phb_id, 0),
1095 DEFINE_PROP_UINT32("chip-id", PnvPHB3, chip_id, 0),
1096 DEFINE_PROP_LINK("chip", PnvPHB3, chip, TYPE_PNV_CHIP, PnvChip *),
1097 DEFINE_PROP_LINK("phb-base", PnvPHB3, phb_base, TYPE_PNV_PHB, PnvPHB *),
1098 DEFINE_PROP_END_OF_LIST(),
1099 };
1100
pnv_phb3_class_init(ObjectClass * klass,void * data)1101 static void pnv_phb3_class_init(ObjectClass *klass, void *data)
1102 {
1103 DeviceClass *dc = DEVICE_CLASS(klass);
1104
1105 dc->realize = pnv_phb3_realize;
1106 device_class_set_props(dc, pnv_phb3_properties);
1107 dc->user_creatable = false;
1108 }
1109
1110 static const TypeInfo pnv_phb3_type_info = {
1111 .name = TYPE_PNV_PHB3,
1112 .parent = TYPE_DEVICE,
1113 .instance_size = sizeof(PnvPHB3),
1114 .class_init = pnv_phb3_class_init,
1115 .instance_init = pnv_phb3_instance_init,
1116 };
1117
pnv_phb3_root_bus_get_prop(Object * obj,Visitor * v,const char * name,void * opaque,Error ** errp)1118 static void pnv_phb3_root_bus_get_prop(Object *obj, Visitor *v,
1119 const char *name,
1120 void *opaque, Error **errp)
1121 {
1122 PnvPHB3RootBus *bus = PNV_PHB3_ROOT_BUS(obj);
1123 uint64_t value = 0;
1124
1125 if (strcmp(name, "phb-id") == 0) {
1126 value = bus->phb_id;
1127 } else {
1128 value = bus->chip_id;
1129 }
1130
1131 visit_type_size(v, name, &value, errp);
1132 }
1133
pnv_phb3_root_bus_set_prop(Object * obj,Visitor * v,const char * name,void * opaque,Error ** errp)1134 static void pnv_phb3_root_bus_set_prop(Object *obj, Visitor *v,
1135 const char *name,
1136 void *opaque, Error **errp)
1137
1138 {
1139 PnvPHB3RootBus *bus = PNV_PHB3_ROOT_BUS(obj);
1140 uint64_t value;
1141
1142 if (!visit_type_size(v, name, &value, errp)) {
1143 return;
1144 }
1145
1146 if (strcmp(name, "phb-id") == 0) {
1147 bus->phb_id = value;
1148 } else {
1149 bus->chip_id = value;
1150 }
1151 }
1152
pnv_phb3_root_bus_class_init(ObjectClass * klass,void * data)1153 static void pnv_phb3_root_bus_class_init(ObjectClass *klass, void *data)
1154 {
1155 BusClass *k = BUS_CLASS(klass);
1156
1157 object_class_property_add(klass, "phb-id", "int",
1158 pnv_phb3_root_bus_get_prop,
1159 pnv_phb3_root_bus_set_prop,
1160 NULL, NULL);
1161
1162 object_class_property_add(klass, "chip-id", "int",
1163 pnv_phb3_root_bus_get_prop,
1164 pnv_phb3_root_bus_set_prop,
1165 NULL, NULL);
1166
1167 /*
1168 * PHB3 has only a single root complex. Enforce the limit on the
1169 * parent bus
1170 */
1171 k->max_dev = 1;
1172 }
1173
1174 static const TypeInfo pnv_phb3_root_bus_info = {
1175 .name = TYPE_PNV_PHB3_ROOT_BUS,
1176 .parent = TYPE_PCIE_BUS,
1177 .instance_size = sizeof(PnvPHB3RootBus),
1178 .class_init = pnv_phb3_root_bus_class_init,
1179 };
1180
pnv_phb3_register_types(void)1181 static void pnv_phb3_register_types(void)
1182 {
1183 type_register_static(&pnv_phb3_root_bus_info);
1184 type_register_static(&pnv_phb3_type_info);
1185 type_register_static(&pnv_phb3_iommu_memory_region_info);
1186 }
1187
1188 type_init(pnv_phb3_register_types)
1189