1 /*
2 * QEMU PowerPC PowerNV (POWER8) PHB3 model
3 *
4 * Copyright (c) 2014-2020, IBM Corporation.
5 *
6 * This code is licensed under the GPL version 2 or later. See the
7 * COPYING file in the top-level directory.
8 */
9 #include "qemu/osdep.h"
10 #include "qemu/log.h"
11 #include "qemu/bswap.h"
12 #include "qapi/visitor.h"
13 #include "qapi/error.h"
14 #include "hw/pci-host/pnv_phb3_regs.h"
15 #include "hw/pci-host/pnv_phb.h"
16 #include "hw/pci-host/pnv_phb3.h"
17 #include "hw/pci/pcie_host.h"
18 #include "hw/pci/pcie_port.h"
19 #include "hw/ppc/pnv.h"
20 #include "hw/ppc/pnv_chip.h"
21 #include "hw/irq.h"
22 #include "hw/qdev-properties.h"
23 #include "qom/object.h"
24 #include "system/system.h"
25
26 #define phb3_error(phb, fmt, ...) \
27 qemu_log_mask(LOG_GUEST_ERROR, "phb3[%d:%d]: " fmt "\n", \
28 (phb)->chip_id, (phb)->phb_id, ## __VA_ARGS__)
29
pnv_phb3_find_cfg_dev(PnvPHB3 * phb)30 static PCIDevice *pnv_phb3_find_cfg_dev(PnvPHB3 *phb)
31 {
32 PCIHostState *pci = PCI_HOST_BRIDGE(phb->phb_base);
33 uint64_t addr = phb->regs[PHB_CONFIG_ADDRESS >> 3];
34 uint8_t bus, devfn;
35
36 if (!(addr >> 63)) {
37 return NULL;
38 }
39 bus = (addr >> 52) & 0xff;
40 devfn = (addr >> 44) & 0xff;
41
42 return pci_find_device(pci->bus, bus, devfn);
43 }
44
45 /*
46 * The CONFIG_DATA register expects little endian accesses, but as the
47 * region is big endian, we have to swap the value.
48 */
pnv_phb3_config_write(PnvPHB3 * phb,unsigned off,unsigned size,uint64_t val)49 static void pnv_phb3_config_write(PnvPHB3 *phb, unsigned off,
50 unsigned size, uint64_t val)
51 {
52 uint32_t cfg_addr, limit;
53 PCIDevice *pdev;
54
55 pdev = pnv_phb3_find_cfg_dev(phb);
56 if (!pdev) {
57 return;
58 }
59 cfg_addr = (phb->regs[PHB_CONFIG_ADDRESS >> 3] >> 32) & 0xffc;
60 cfg_addr |= off;
61 limit = pci_config_size(pdev);
62 if (limit <= cfg_addr) {
63 /*
64 * conventional pci device can be behind pcie-to-pci bridge.
65 * 256 <= addr < 4K has no effects.
66 */
67 return;
68 }
69 switch (size) {
70 case 1:
71 break;
72 case 2:
73 val = bswap16(val);
74 break;
75 case 4:
76 val = bswap32(val);
77 break;
78 default:
79 g_assert_not_reached();
80 }
81 pci_host_config_write_common(pdev, cfg_addr, limit, val, size);
82 }
83
pnv_phb3_config_read(PnvPHB3 * phb,unsigned off,unsigned size)84 static uint64_t pnv_phb3_config_read(PnvPHB3 *phb, unsigned off,
85 unsigned size)
86 {
87 uint32_t cfg_addr, limit;
88 PCIDevice *pdev;
89 uint64_t val;
90
91 pdev = pnv_phb3_find_cfg_dev(phb);
92 if (!pdev) {
93 return ~0ull;
94 }
95 cfg_addr = (phb->regs[PHB_CONFIG_ADDRESS >> 3] >> 32) & 0xffc;
96 cfg_addr |= off;
97 limit = pci_config_size(pdev);
98 if (limit <= cfg_addr) {
99 /*
100 * conventional pci device can be behind pcie-to-pci bridge.
101 * 256 <= addr < 4K has no effects.
102 */
103 return ~0ull;
104 }
105 val = pci_host_config_read_common(pdev, cfg_addr, limit, size);
106 switch (size) {
107 case 1:
108 return val;
109 case 2:
110 return bswap16(val);
111 case 4:
112 return bswap32(val);
113 default:
114 g_assert_not_reached();
115 }
116 }
117
pnv_phb3_check_m32(PnvPHB3 * phb)118 static void pnv_phb3_check_m32(PnvPHB3 *phb)
119 {
120 uint64_t base, start, size;
121 MemoryRegion *parent;
122 PnvPBCQState *pbcq = &phb->pbcq;
123
124 if (memory_region_is_mapped(&phb->mr_m32)) {
125 memory_region_del_subregion(phb->mr_m32.container, &phb->mr_m32);
126 }
127
128 if (!(phb->regs[PHB_PHB3_CONFIG >> 3] & PHB_PHB3C_M32_EN)) {
129 return;
130 }
131
132 /* Grab geometry from registers */
133 base = phb->regs[PHB_M32_BASE_ADDR >> 3];
134 start = phb->regs[PHB_M32_START_ADDR >> 3];
135 size = ~(phb->regs[PHB_M32_BASE_MASK >> 3] | 0xfffc000000000000ull) + 1;
136
137 /* Check if it matches an enabled MMIO region in the PBCQ */
138 if (memory_region_is_mapped(&pbcq->mmbar0) &&
139 base >= pbcq->mmio0_base &&
140 (base + size) <= (pbcq->mmio0_base + pbcq->mmio0_size)) {
141 parent = &pbcq->mmbar0;
142 base -= pbcq->mmio0_base;
143 } else if (memory_region_is_mapped(&pbcq->mmbar1) &&
144 base >= pbcq->mmio1_base &&
145 (base + size) <= (pbcq->mmio1_base + pbcq->mmio1_size)) {
146 parent = &pbcq->mmbar1;
147 base -= pbcq->mmio1_base;
148 } else {
149 return;
150 }
151
152 /* Create alias */
153 memory_region_init_alias(&phb->mr_m32, OBJECT(phb), "phb3-m32",
154 &phb->pci_mmio, start, size);
155 memory_region_add_subregion(parent, base, &phb->mr_m32);
156 }
157
pnv_phb3_check_m64(PnvPHB3 * phb,uint32_t index)158 static void pnv_phb3_check_m64(PnvPHB3 *phb, uint32_t index)
159 {
160 uint64_t base, start, size, m64;
161 MemoryRegion *parent;
162 PnvPBCQState *pbcq = &phb->pbcq;
163
164 if (memory_region_is_mapped(&phb->mr_m64[index])) {
165 /* Should we destroy it in RCU friendly way... ? */
166 memory_region_del_subregion(phb->mr_m64[index].container,
167 &phb->mr_m64[index]);
168 }
169
170 /* Get table entry */
171 m64 = phb->ioda_M64BT[index];
172
173 if (!(m64 & IODA2_M64BT_ENABLE)) {
174 return;
175 }
176
177 /* Grab geometry from registers */
178 base = GETFIELD(IODA2_M64BT_BASE, m64) << 20;
179 if (m64 & IODA2_M64BT_SINGLE_PE) {
180 base &= ~0x1ffffffull;
181 }
182 size = GETFIELD(IODA2_M64BT_MASK, m64) << 20;
183 size |= 0xfffc000000000000ull;
184 size = ~size + 1;
185 start = base | (phb->regs[PHB_M64_UPPER_BITS >> 3]);
186
187 /* Check if it matches an enabled MMIO region in the PBCQ */
188 if (memory_region_is_mapped(&pbcq->mmbar0) &&
189 base >= pbcq->mmio0_base &&
190 (base + size) <= (pbcq->mmio0_base + pbcq->mmio0_size)) {
191 parent = &pbcq->mmbar0;
192 base -= pbcq->mmio0_base;
193 } else if (memory_region_is_mapped(&pbcq->mmbar1) &&
194 base >= pbcq->mmio1_base &&
195 (base + size) <= (pbcq->mmio1_base + pbcq->mmio1_size)) {
196 parent = &pbcq->mmbar1;
197 base -= pbcq->mmio1_base;
198 } else {
199 return;
200 }
201
202 /* Create alias */
203 memory_region_init_alias(&phb->mr_m64[index], OBJECT(phb), "phb3-m64",
204 &phb->pci_mmio, start, size);
205 memory_region_add_subregion(parent, base, &phb->mr_m64[index]);
206 }
207
pnv_phb3_check_all_m64s(PnvPHB3 * phb)208 static void pnv_phb3_check_all_m64s(PnvPHB3 *phb)
209 {
210 uint64_t i;
211
212 for (i = 0; i < PNV_PHB3_NUM_M64; i++) {
213 pnv_phb3_check_m64(phb, i);
214 }
215 }
216
pnv_phb3_lxivt_write(PnvPHB3 * phb,unsigned idx,uint64_t val)217 static void pnv_phb3_lxivt_write(PnvPHB3 *phb, unsigned idx, uint64_t val)
218 {
219 uint8_t server, prio;
220
221 phb->ioda_LXIVT[idx] = val & (IODA2_LXIVT_SERVER |
222 IODA2_LXIVT_PRIORITY |
223 IODA2_LXIVT_NODE_ID);
224 server = GETFIELD(IODA2_LXIVT_SERVER, val);
225 prio = GETFIELD(IODA2_LXIVT_PRIORITY, val);
226
227 /*
228 * The low order 2 bits are the link pointer (Type II interrupts).
229 * Shift back to get a valid IRQ server.
230 */
231 server >>= 2;
232
233 ics_write_xive(&phb->lsis, idx, server, prio, prio);
234 }
235
pnv_phb3_ioda_access(PnvPHB3 * phb,unsigned * out_table,unsigned * out_idx)236 static uint64_t *pnv_phb3_ioda_access(PnvPHB3 *phb,
237 unsigned *out_table, unsigned *out_idx)
238 {
239 uint64_t adreg = phb->regs[PHB_IODA_ADDR >> 3];
240 unsigned int index = GETFIELD(PHB_IODA_AD_TADR, adreg);
241 unsigned int table = GETFIELD(PHB_IODA_AD_TSEL, adreg);
242 unsigned int mask;
243 uint64_t *tptr = NULL;
244
245 switch (table) {
246 case IODA2_TBL_LIST:
247 tptr = phb->ioda_LIST;
248 mask = 7;
249 break;
250 case IODA2_TBL_LXIVT:
251 tptr = phb->ioda_LXIVT;
252 mask = 7;
253 break;
254 case IODA2_TBL_IVC_CAM:
255 case IODA2_TBL_RBA:
256 mask = 31;
257 break;
258 case IODA2_TBL_RCAM:
259 mask = 63;
260 break;
261 case IODA2_TBL_MRT:
262 mask = 7;
263 break;
264 case IODA2_TBL_PESTA:
265 case IODA2_TBL_PESTB:
266 mask = 255;
267 break;
268 case IODA2_TBL_TVT:
269 tptr = phb->ioda_TVT;
270 mask = 511;
271 break;
272 case IODA2_TBL_TCAM:
273 case IODA2_TBL_TDR:
274 mask = 63;
275 break;
276 case IODA2_TBL_M64BT:
277 tptr = phb->ioda_M64BT;
278 mask = 15;
279 break;
280 case IODA2_TBL_M32DT:
281 tptr = phb->ioda_MDT;
282 mask = 255;
283 break;
284 case IODA2_TBL_PEEV:
285 tptr = phb->ioda_PEEV;
286 mask = 3;
287 break;
288 default:
289 phb3_error(phb, "invalid IODA table %d", table);
290 return NULL;
291 }
292 index &= mask;
293 if (out_idx) {
294 *out_idx = index;
295 }
296 if (out_table) {
297 *out_table = table;
298 }
299 if (tptr) {
300 tptr += index;
301 }
302 if (adreg & PHB_IODA_AD_AUTOINC) {
303 index = (index + 1) & mask;
304 adreg = SETFIELD(PHB_IODA_AD_TADR, adreg, index);
305 }
306 phb->regs[PHB_IODA_ADDR >> 3] = adreg;
307 return tptr;
308 }
309
pnv_phb3_ioda_read(PnvPHB3 * phb)310 static uint64_t pnv_phb3_ioda_read(PnvPHB3 *phb)
311 {
312 unsigned table;
313 uint64_t *tptr;
314
315 tptr = pnv_phb3_ioda_access(phb, &table, NULL);
316 if (!tptr) {
317 /* Return 0 on unsupported tables, not ff's */
318 return 0;
319 }
320 return *tptr;
321 }
322
pnv_phb3_ioda_write(PnvPHB3 * phb,uint64_t val)323 static void pnv_phb3_ioda_write(PnvPHB3 *phb, uint64_t val)
324 {
325 unsigned table, idx;
326 uint64_t *tptr;
327
328 tptr = pnv_phb3_ioda_access(phb, &table, &idx);
329 if (!tptr) {
330 return;
331 }
332
333 /* Handle side effects */
334 switch (table) {
335 case IODA2_TBL_LXIVT:
336 pnv_phb3_lxivt_write(phb, idx, val);
337 break;
338 case IODA2_TBL_M64BT:
339 *tptr = val;
340 pnv_phb3_check_m64(phb, idx);
341 break;
342 default:
343 *tptr = val;
344 }
345 }
346
347 /*
348 * This is called whenever the PHB LSI, MSI source ID register or
349 * the PBCQ irq filters are written.
350 */
pnv_phb3_remap_irqs(PnvPHB3 * phb)351 void pnv_phb3_remap_irqs(PnvPHB3 *phb)
352 {
353 ICSState *ics = &phb->lsis;
354 uint32_t local, global, count, mask, comp;
355 uint64_t baren;
356 PnvPBCQState *pbcq = &phb->pbcq;
357
358 /*
359 * First check if we are enabled. Unlike real HW we don't separate
360 * TX and RX so we enable if both are set
361 */
362 baren = pbcq->nest_regs[PBCQ_NEST_BAR_EN];
363 if (!(baren & PBCQ_NEST_BAR_EN_IRSN_RX) ||
364 !(baren & PBCQ_NEST_BAR_EN_IRSN_TX)) {
365 ics->offset = 0;
366 return;
367 }
368
369 /* Grab local LSI source ID */
370 local = GETFIELD(PHB_LSI_SRC_ID, phb->regs[PHB_LSI_SOURCE_ID >> 3]) << 3;
371
372 /* Grab global one and compare */
373 global = GETFIELD(PBCQ_NEST_LSI_SRC,
374 pbcq->nest_regs[PBCQ_NEST_LSI_SRC_ID]) << 3;
375 if (global != local) {
376 /*
377 * This happens during initialization, let's come back when we
378 * are properly configured
379 */
380 ics->offset = 0;
381 return;
382 }
383
384 /* Get the base on the powerbus */
385 comp = GETFIELD(PBCQ_NEST_IRSN_COMP,
386 pbcq->nest_regs[PBCQ_NEST_IRSN_COMPARE]);
387 mask = GETFIELD(PBCQ_NEST_IRSN_COMP,
388 pbcq->nest_regs[PBCQ_NEST_IRSN_MASK]);
389 count = ((~mask) + 1) & 0x7ffff;
390 phb->total_irq = count;
391
392 /* Sanity checks */
393 if ((global + PNV_PHB3_NUM_LSI) > count) {
394 phb3_error(phb, "LSIs out of reach: LSI base=%d total irq=%d", global,
395 count);
396 }
397
398 if (count > 2048) {
399 phb3_error(phb, "More interrupts than supported: %d", count);
400 }
401
402 if ((comp & mask) != comp) {
403 phb3_error(phb, "IRQ compare bits not in mask: comp=0x%x mask=0x%x",
404 comp, mask);
405 comp &= mask;
406 }
407 /* Setup LSI offset */
408 ics->offset = comp + global;
409
410 /* Setup MSI offset */
411 pnv_phb3_msi_update_config(&phb->msis, comp, count - PNV_PHB3_NUM_LSI);
412 }
413
pnv_phb3_lsi_src_id_write(PnvPHB3 * phb,uint64_t val)414 static void pnv_phb3_lsi_src_id_write(PnvPHB3 *phb, uint64_t val)
415 {
416 /* Sanitize content */
417 val &= PHB_LSI_SRC_ID;
418 phb->regs[PHB_LSI_SOURCE_ID >> 3] = val;
419 pnv_phb3_remap_irqs(phb);
420 }
421
pnv_phb3_rtc_invalidate(PnvPHB3 * phb,uint64_t val)422 static void pnv_phb3_rtc_invalidate(PnvPHB3 *phb, uint64_t val)
423 {
424 PnvPhb3DMASpace *ds;
425
426 /* Always invalidate all for now ... */
427 QLIST_FOREACH(ds, &phb->dma_spaces, list) {
428 ds->pe_num = PHB_INVALID_PE;
429 }
430 }
431
432
pnv_phb3_update_msi_regions(PnvPhb3DMASpace * ds)433 static void pnv_phb3_update_msi_regions(PnvPhb3DMASpace *ds)
434 {
435 uint64_t cfg = ds->phb->regs[PHB_PHB3_CONFIG >> 3];
436
437 if (cfg & PHB_PHB3C_32BIT_MSI_EN) {
438 if (!memory_region_is_mapped(&ds->msi32_mr)) {
439 memory_region_add_subregion(MEMORY_REGION(&ds->dma_mr),
440 0xffff0000, &ds->msi32_mr);
441 }
442 } else {
443 if (memory_region_is_mapped(&ds->msi32_mr)) {
444 memory_region_del_subregion(MEMORY_REGION(&ds->dma_mr),
445 &ds->msi32_mr);
446 }
447 }
448
449 if (cfg & PHB_PHB3C_64BIT_MSI_EN) {
450 if (!memory_region_is_mapped(&ds->msi64_mr)) {
451 memory_region_add_subregion(MEMORY_REGION(&ds->dma_mr),
452 (1ull << 60), &ds->msi64_mr);
453 }
454 } else {
455 if (memory_region_is_mapped(&ds->msi64_mr)) {
456 memory_region_del_subregion(MEMORY_REGION(&ds->dma_mr),
457 &ds->msi64_mr);
458 }
459 }
460 }
461
pnv_phb3_update_all_msi_regions(PnvPHB3 * phb)462 static void pnv_phb3_update_all_msi_regions(PnvPHB3 *phb)
463 {
464 PnvPhb3DMASpace *ds;
465
466 QLIST_FOREACH(ds, &phb->dma_spaces, list) {
467 pnv_phb3_update_msi_regions(ds);
468 }
469 }
470
pnv_phb3_reg_write(void * opaque,hwaddr off,uint64_t val,unsigned size)471 void pnv_phb3_reg_write(void *opaque, hwaddr off, uint64_t val, unsigned size)
472 {
473 PnvPHB3 *phb = opaque;
474 bool changed;
475
476 /* Special case configuration data */
477 if ((off & 0xfffc) == PHB_CONFIG_DATA) {
478 pnv_phb3_config_write(phb, off & 0x3, size, val);
479 return;
480 }
481
482 /* Other registers are 64-bit only */
483 if (size != 8 || off & 0x7) {
484 phb3_error(phb, "Invalid register access, offset: 0x%"PRIx64" size: %d",
485 off, size);
486 return;
487 }
488
489 /* Handle masking & filtering */
490 switch (off) {
491 case PHB_M64_UPPER_BITS:
492 val &= 0xfffc000000000000ull;
493 break;
494 case PHB_Q_DMA_R:
495 /*
496 * This is enough logic to make SW happy but we aren't actually
497 * quiescing the DMAs
498 */
499 if (val & PHB_Q_DMA_R_AUTORESET) {
500 val = 0;
501 } else {
502 val &= PHB_Q_DMA_R_QUIESCE_DMA;
503 }
504 break;
505 /* LEM stuff */
506 case PHB_LEM_FIR_AND_MASK:
507 phb->regs[PHB_LEM_FIR_ACCUM >> 3] &= val;
508 return;
509 case PHB_LEM_FIR_OR_MASK:
510 phb->regs[PHB_LEM_FIR_ACCUM >> 3] |= val;
511 return;
512 case PHB_LEM_ERROR_AND_MASK:
513 phb->regs[PHB_LEM_ERROR_MASK >> 3] &= val;
514 return;
515 case PHB_LEM_ERROR_OR_MASK:
516 phb->regs[PHB_LEM_ERROR_MASK >> 3] |= val;
517 return;
518 case PHB_LEM_WOF:
519 val = 0;
520 break;
521 }
522
523 /* Record whether it changed */
524 changed = phb->regs[off >> 3] != val;
525
526 /* Store in register cache first */
527 phb->regs[off >> 3] = val;
528
529 /* Handle side effects */
530 switch (off) {
531 case PHB_PHB3_CONFIG:
532 if (changed) {
533 pnv_phb3_update_all_msi_regions(phb);
534 }
535 /* fall through */
536 case PHB_M32_BASE_ADDR:
537 case PHB_M32_BASE_MASK:
538 case PHB_M32_START_ADDR:
539 if (changed) {
540 pnv_phb3_check_m32(phb);
541 }
542 break;
543 case PHB_M64_UPPER_BITS:
544 if (changed) {
545 pnv_phb3_check_all_m64s(phb);
546 }
547 break;
548 case PHB_LSI_SOURCE_ID:
549 if (changed) {
550 pnv_phb3_lsi_src_id_write(phb, val);
551 }
552 break;
553
554 /* IODA table accesses */
555 case PHB_IODA_DATA0:
556 pnv_phb3_ioda_write(phb, val);
557 break;
558
559 /* RTC invalidation */
560 case PHB_RTC_INVALIDATE:
561 pnv_phb3_rtc_invalidate(phb, val);
562 break;
563
564 /* FFI request */
565 case PHB_FFI_REQUEST:
566 pnv_phb3_msi_ffi(&phb->msis, val);
567 break;
568
569 /* Silent simple writes */
570 case PHB_CONFIG_ADDRESS:
571 case PHB_IODA_ADDR:
572 case PHB_TCE_KILL:
573 case PHB_TCE_SPEC_CTL:
574 case PHB_PEST_BAR:
575 case PHB_PELTV_BAR:
576 case PHB_RTT_BAR:
577 case PHB_RBA_BAR:
578 case PHB_IVT_BAR:
579 case PHB_FFI_LOCK:
580 case PHB_LEM_FIR_ACCUM:
581 case PHB_LEM_ERROR_MASK:
582 case PHB_LEM_ACTION0:
583 case PHB_LEM_ACTION1:
584 break;
585
586 /* Noise on anything else */
587 default:
588 qemu_log_mask(LOG_UNIMP, "phb3: reg_write 0x%"PRIx64"=%"PRIx64"\n",
589 off, val);
590 }
591 }
592
pnv_phb3_reg_read(void * opaque,hwaddr off,unsigned size)593 uint64_t pnv_phb3_reg_read(void *opaque, hwaddr off, unsigned size)
594 {
595 PnvPHB3 *phb = opaque;
596 PCIHostState *pci = PCI_HOST_BRIDGE(phb->phb_base);
597 uint64_t val;
598
599 if ((off & 0xfffc) == PHB_CONFIG_DATA) {
600 return pnv_phb3_config_read(phb, off & 0x3, size);
601 }
602
603 /* Other registers are 64-bit only */
604 if (size != 8 || off & 0x7) {
605 phb3_error(phb, "Invalid register access, offset: 0x%"PRIx64" size: %d",
606 off, size);
607 return ~0ull;
608 }
609
610 /* Default read from cache */
611 val = phb->regs[off >> 3];
612
613 switch (off) {
614 /* Simulate venice DD2.0 */
615 case PHB_VERSION:
616 return 0x000000a300000005ull;
617 case PHB_PCIE_SYSTEM_CONFIG:
618 return 0x441100fc30000000;
619
620 /* IODA table accesses */
621 case PHB_IODA_DATA0:
622 return pnv_phb3_ioda_read(phb);
623
624 /* Link training always appears trained */
625 case PHB_PCIE_DLP_TRAIN_CTL:
626 if (!pci_find_device(pci->bus, 1, 0)) {
627 return 0;
628 }
629 return PHB_PCIE_DLP_INBAND_PRESENCE | PHB_PCIE_DLP_TC_DL_LINKACT;
630
631 /* FFI Lock */
632 case PHB_FFI_LOCK:
633 /* Set lock and return previous value */
634 phb->regs[off >> 3] |= PHB_FFI_LOCK_STATE;
635 return val;
636
637 /* DMA read sync: make it look like it's complete */
638 case PHB_DMARD_SYNC:
639 return PHB_DMARD_SYNC_COMPLETE;
640
641 /* Silent simple reads */
642 case PHB_PHB3_CONFIG:
643 case PHB_M32_BASE_ADDR:
644 case PHB_M32_BASE_MASK:
645 case PHB_M32_START_ADDR:
646 case PHB_CONFIG_ADDRESS:
647 case PHB_IODA_ADDR:
648 case PHB_RTC_INVALIDATE:
649 case PHB_TCE_KILL:
650 case PHB_TCE_SPEC_CTL:
651 case PHB_PEST_BAR:
652 case PHB_PELTV_BAR:
653 case PHB_RTT_BAR:
654 case PHB_RBA_BAR:
655 case PHB_IVT_BAR:
656 case PHB_M64_UPPER_BITS:
657 case PHB_LEM_FIR_ACCUM:
658 case PHB_LEM_ERROR_MASK:
659 case PHB_LEM_ACTION0:
660 case PHB_LEM_ACTION1:
661 break;
662
663 /* Noise on anything else */
664 default:
665 qemu_log_mask(LOG_UNIMP, "phb3: reg_read 0x%"PRIx64"=%"PRIx64"\n",
666 off, val);
667 }
668 return val;
669 }
670
671 static const MemoryRegionOps pnv_phb3_reg_ops = {
672 .read = pnv_phb3_reg_read,
673 .write = pnv_phb3_reg_write,
674 .valid.min_access_size = 1,
675 .valid.max_access_size = 8,
676 .impl.min_access_size = 1,
677 .impl.max_access_size = 8,
678 .endianness = DEVICE_BIG_ENDIAN,
679 };
680
pnv_phb3_map_irq(PCIDevice * pci_dev,int irq_num)681 static int pnv_phb3_map_irq(PCIDevice *pci_dev, int irq_num)
682 {
683 /* Check that out properly ... */
684 return irq_num & 3;
685 }
686
pnv_phb3_set_irq(void * opaque,int irq_num,int level)687 static void pnv_phb3_set_irq(void *opaque, int irq_num, int level)
688 {
689 PnvPHB3 *phb = opaque;
690
691 /* LSI only ... */
692 if (irq_num > 3) {
693 phb3_error(phb, "Unknown IRQ to set %d", irq_num);
694 }
695 qemu_set_irq(phb->qirqs[irq_num], level);
696 }
697
pnv_phb3_resolve_pe(PnvPhb3DMASpace * ds)698 static bool pnv_phb3_resolve_pe(PnvPhb3DMASpace *ds)
699 {
700 uint64_t rtt, addr;
701 uint16_t rte;
702 int bus_num;
703
704 /* Already resolved ? */
705 if (ds->pe_num != PHB_INVALID_PE) {
706 return true;
707 }
708
709 /* We need to lookup the RTT */
710 rtt = ds->phb->regs[PHB_RTT_BAR >> 3];
711 if (!(rtt & PHB_RTT_BAR_ENABLE)) {
712 phb3_error(ds->phb, "DMA with RTT BAR disabled !");
713 /* Set error bits ? fence ? ... */
714 return false;
715 }
716
717 /* Read RTE */
718 bus_num = pci_bus_num(ds->bus);
719 addr = rtt & PHB_RTT_BASE_ADDRESS_MASK;
720 addr += 2 * ((bus_num << 8) | ds->devfn);
721 if (dma_memory_read(&address_space_memory, addr, &rte,
722 sizeof(rte), MEMTXATTRS_UNSPECIFIED)) {
723 phb3_error(ds->phb, "Failed to read RTT entry at 0x%"PRIx64, addr);
724 /* Set error bits ? fence ? ... */
725 return false;
726 }
727 rte = be16_to_cpu(rte);
728
729 /* Fail upon reading of invalid PE# */
730 if (rte >= PNV_PHB3_NUM_PE) {
731 phb3_error(ds->phb, "RTE for RID 0x%x invalid (%04x", ds->devfn, rte);
732 /* Set error bits ? fence ? ... */
733 return false;
734 }
735 ds->pe_num = rte;
736 return true;
737 }
738
pnv_phb3_translate_tve(PnvPhb3DMASpace * ds,hwaddr addr,bool is_write,uint64_t tve,IOMMUTLBEntry * tlb)739 static void pnv_phb3_translate_tve(PnvPhb3DMASpace *ds, hwaddr addr,
740 bool is_write, uint64_t tve,
741 IOMMUTLBEntry *tlb)
742 {
743 uint64_t tta = GETFIELD(IODA2_TVT_TABLE_ADDR, tve);
744 int32_t lev = GETFIELD(IODA2_TVT_NUM_LEVELS, tve);
745 uint32_t tts = GETFIELD(IODA2_TVT_TCE_TABLE_SIZE, tve);
746 uint32_t tps = GETFIELD(IODA2_TVT_IO_PSIZE, tve);
747 PnvPHB3 *phb = ds->phb;
748
749 /* Invalid levels */
750 if (lev > 4) {
751 phb3_error(phb, "Invalid #levels in TVE %d", lev);
752 return;
753 }
754
755 /* IO Page Size of 0 means untranslated, else use TCEs */
756 if (tps == 0) {
757 /*
758 * We only support non-translate in top window.
759 *
760 * TODO: Venice/Murano support it on bottom window above 4G and
761 * Naples supports it on everything
762 */
763 if (!(tve & PPC_BIT(51))) {
764 phb3_error(phb, "xlate for invalid non-translate TVE");
765 return;
766 }
767 /* TODO: Handle boundaries */
768
769 /* Use 4k pages like q35 ... for now */
770 tlb->iova = addr & 0xfffffffffffff000ull;
771 tlb->translated_addr = addr & 0x0003fffffffff000ull;
772 tlb->addr_mask = 0xfffull;
773 tlb->perm = IOMMU_RW;
774 } else {
775 uint32_t tce_shift, tbl_shift, sh;
776 uint64_t base, taddr, tce, tce_mask;
777
778 /* TVE disabled ? */
779 if (tts == 0) {
780 phb3_error(phb, "xlate for invalid translated TVE");
781 return;
782 }
783
784 /* Address bits per bottom level TCE entry */
785 tce_shift = tps + 11;
786
787 /* Address bits per table level */
788 tbl_shift = tts + 8;
789
790 /* Top level table base address */
791 base = tta << 12;
792
793 /* Total shift to first level */
794 sh = tbl_shift * lev + tce_shift;
795
796 /* TODO: Multi-level untested */
797 do {
798 lev--;
799
800 /* Grab the TCE address */
801 taddr = base | (((addr >> sh) & ((1ul << tbl_shift) - 1)) << 3);
802 if (dma_memory_read(&address_space_memory, taddr, &tce,
803 sizeof(tce), MEMTXATTRS_UNSPECIFIED)) {
804 phb3_error(phb, "Failed to read TCE at 0x%"PRIx64, taddr);
805 return;
806 }
807 tce = be64_to_cpu(tce);
808
809 /* Check permission for indirect TCE */
810 if ((lev >= 0) && !(tce & 3)) {
811 phb3_error(phb, "Invalid indirect TCE at 0x%"PRIx64, taddr);
812 phb3_error(phb, " xlate %"PRIx64":%c TVE=%"PRIx64, addr,
813 is_write ? 'W' : 'R', tve);
814 phb3_error(phb, " tta=%"PRIx64" lev=%d tts=%d tps=%d",
815 tta, lev, tts, tps);
816 return;
817 }
818 sh -= tbl_shift;
819 base = tce & ~0xfffull;
820 } while (lev >= 0);
821
822 /* We exit the loop with TCE being the final TCE */
823 if ((is_write & !(tce & 2)) || ((!is_write) && !(tce & 1))) {
824 phb3_error(phb, "TCE access fault at 0x%"PRIx64, taddr);
825 phb3_error(phb, " xlate %"PRIx64":%c TVE=%"PRIx64, addr,
826 is_write ? 'W' : 'R', tve);
827 phb3_error(phb, " tta=%"PRIx64" lev=%d tts=%d tps=%d",
828 tta, lev, tts, tps);
829 return;
830 }
831 tce_mask = ~((1ull << tce_shift) - 1);
832 tlb->iova = addr & tce_mask;
833 tlb->translated_addr = tce & tce_mask;
834 tlb->addr_mask = ~tce_mask;
835 tlb->perm = tce & 3;
836 }
837 }
838
pnv_phb3_translate_iommu(IOMMUMemoryRegion * iommu,hwaddr addr,IOMMUAccessFlags flag,int iommu_idx)839 static IOMMUTLBEntry pnv_phb3_translate_iommu(IOMMUMemoryRegion *iommu,
840 hwaddr addr,
841 IOMMUAccessFlags flag,
842 int iommu_idx)
843 {
844 PnvPhb3DMASpace *ds = container_of(iommu, PnvPhb3DMASpace, dma_mr);
845 int tve_sel;
846 uint64_t tve, cfg;
847 IOMMUTLBEntry ret = {
848 .target_as = &address_space_memory,
849 .iova = addr,
850 .translated_addr = 0,
851 .addr_mask = ~(hwaddr)0,
852 .perm = IOMMU_NONE,
853 };
854 PnvPHB3 *phb = ds->phb;
855
856 /* Resolve PE# */
857 if (!pnv_phb3_resolve_pe(ds)) {
858 phb3_error(phb, "Failed to resolve PE# for bus @%p (%d) devfn 0x%x",
859 ds->bus, pci_bus_num(ds->bus), ds->devfn);
860 return ret;
861 }
862
863 /* Check top bits */
864 switch (addr >> 60) {
865 case 00:
866 /* DMA or 32-bit MSI ? */
867 cfg = ds->phb->regs[PHB_PHB3_CONFIG >> 3];
868 if ((cfg & PHB_PHB3C_32BIT_MSI_EN) &&
869 ((addr & 0xffffffffffff0000ull) == 0xffff0000ull)) {
870 phb3_error(phb, "xlate on 32-bit MSI region");
871 return ret;
872 }
873 /* Choose TVE XXX Use PHB3 Control Register */
874 tve_sel = (addr >> 59) & 1;
875 tve = ds->phb->ioda_TVT[ds->pe_num * 2 + tve_sel];
876 pnv_phb3_translate_tve(ds, addr, flag & IOMMU_WO, tve, &ret);
877 break;
878 case 01:
879 phb3_error(phb, "xlate on 64-bit MSI region");
880 break;
881 default:
882 phb3_error(phb, "xlate on unsupported address 0x%"PRIx64, addr);
883 }
884 return ret;
885 }
886
887 #define TYPE_PNV_PHB3_IOMMU_MEMORY_REGION "pnv-phb3-iommu-memory-region"
DECLARE_INSTANCE_CHECKER(IOMMUMemoryRegion,PNV_PHB3_IOMMU_MEMORY_REGION,TYPE_PNV_PHB3_IOMMU_MEMORY_REGION)888 DECLARE_INSTANCE_CHECKER(IOMMUMemoryRegion, PNV_PHB3_IOMMU_MEMORY_REGION,
889 TYPE_PNV_PHB3_IOMMU_MEMORY_REGION)
890
891 static void pnv_phb3_iommu_memory_region_class_init(ObjectClass *klass,
892 const void *data)
893 {
894 IOMMUMemoryRegionClass *imrc = IOMMU_MEMORY_REGION_CLASS(klass);
895
896 imrc->translate = pnv_phb3_translate_iommu;
897 }
898
899 static const TypeInfo pnv_phb3_iommu_memory_region_info = {
900 .parent = TYPE_IOMMU_MEMORY_REGION,
901 .name = TYPE_PNV_PHB3_IOMMU_MEMORY_REGION,
902 .class_init = pnv_phb3_iommu_memory_region_class_init,
903 };
904
905 /*
906 * MSI/MSIX memory region implementation.
907 * The handler handles both MSI and MSIX.
908 */
pnv_phb3_msi_write(void * opaque,hwaddr addr,uint64_t data,unsigned size)909 static void pnv_phb3_msi_write(void *opaque, hwaddr addr,
910 uint64_t data, unsigned size)
911 {
912 PnvPhb3DMASpace *ds = opaque;
913
914 /* Resolve PE# */
915 if (!pnv_phb3_resolve_pe(ds)) {
916 phb3_error(ds->phb, "Failed to resolve PE# for bus @%p (%d) devfn 0x%x",
917 ds->bus, pci_bus_num(ds->bus), ds->devfn);
918 return;
919 }
920
921 pnv_phb3_msi_send(&ds->phb->msis, addr, data, ds->pe_num);
922 }
923
924 /* There is no .read as the read result is undefined by PCI spec */
pnv_phb3_msi_read(void * opaque,hwaddr addr,unsigned size)925 static uint64_t pnv_phb3_msi_read(void *opaque, hwaddr addr, unsigned size)
926 {
927 PnvPhb3DMASpace *ds = opaque;
928
929 phb3_error(ds->phb, "invalid read @ 0x%" HWADDR_PRIx, addr);
930 return -1;
931 }
932
933 static const MemoryRegionOps pnv_phb3_msi_ops = {
934 .read = pnv_phb3_msi_read,
935 .write = pnv_phb3_msi_write,
936 .endianness = DEVICE_LITTLE_ENDIAN
937 };
938
pnv_phb3_dma_iommu(PCIBus * bus,void * opaque,int devfn)939 static AddressSpace *pnv_phb3_dma_iommu(PCIBus *bus, void *opaque, int devfn)
940 {
941 PnvPHB3 *phb = opaque;
942 PnvPhb3DMASpace *ds;
943
944 QLIST_FOREACH(ds, &phb->dma_spaces, list) {
945 if (ds->bus == bus && ds->devfn == devfn) {
946 break;
947 }
948 }
949
950 if (ds == NULL) {
951 ds = g_new0(PnvPhb3DMASpace, 1);
952 ds->bus = bus;
953 ds->devfn = devfn;
954 ds->pe_num = PHB_INVALID_PE;
955 ds->phb = phb;
956 memory_region_init_iommu(&ds->dma_mr, sizeof(ds->dma_mr),
957 TYPE_PNV_PHB3_IOMMU_MEMORY_REGION,
958 OBJECT(phb), "phb3_iommu", UINT64_MAX);
959 address_space_init(&ds->dma_as, MEMORY_REGION(&ds->dma_mr),
960 "phb3_iommu");
961 memory_region_init_io(&ds->msi32_mr, OBJECT(phb), &pnv_phb3_msi_ops,
962 ds, "msi32", 0x10000);
963 memory_region_init_io(&ds->msi64_mr, OBJECT(phb), &pnv_phb3_msi_ops,
964 ds, "msi64", 0x100000);
965 pnv_phb3_update_msi_regions(ds);
966
967 QLIST_INSERT_HEAD(&phb->dma_spaces, ds, list);
968 }
969 return &ds->dma_as;
970 }
971
972 static PCIIOMMUOps pnv_phb3_iommu_ops = {
973 .get_address_space = pnv_phb3_dma_iommu,
974 };
975
pnv_phb3_instance_init(Object * obj)976 static void pnv_phb3_instance_init(Object *obj)
977 {
978 PnvPHB3 *phb = PNV_PHB3(obj);
979
980 QLIST_INIT(&phb->dma_spaces);
981
982 /* LSI sources */
983 object_initialize_child(obj, "lsi", &phb->lsis, TYPE_ICS);
984
985 /* Default init ... will be fixed by HW inits */
986 phb->lsis.offset = 0;
987
988 /* MSI sources */
989 object_initialize_child(obj, "msi", &phb->msis, TYPE_PHB3_MSI);
990
991 /* Power Bus Common Queue */
992 object_initialize_child(obj, "pbcq", &phb->pbcq, TYPE_PNV_PBCQ);
993
994 }
995
pnv_phb3_bus_init(DeviceState * dev,PnvPHB3 * phb)996 void pnv_phb3_bus_init(DeviceState *dev, PnvPHB3 *phb)
997 {
998 PCIHostState *pci = PCI_HOST_BRIDGE(dev);
999
1000 /*
1001 * PHB3 doesn't support IO space. However, qemu gets very upset if
1002 * we don't have an IO region to anchor IO BARs onto so we just
1003 * initialize one which we never hook up to anything
1004 */
1005 memory_region_init(&phb->pci_io, OBJECT(phb), "pci-io", 0x10000);
1006 memory_region_init(&phb->pci_mmio, OBJECT(phb), "pci-mmio",
1007 PCI_MMIO_TOTAL_SIZE);
1008
1009 pci->bus = pci_register_root_bus(dev,
1010 dev->id ? dev->id : NULL,
1011 pnv_phb3_set_irq, pnv_phb3_map_irq, phb,
1012 &phb->pci_mmio, &phb->pci_io,
1013 0, 4, TYPE_PNV_PHB3_ROOT_BUS);
1014
1015 object_property_set_int(OBJECT(pci->bus), "phb-id", phb->phb_id,
1016 &error_abort);
1017 object_property_set_int(OBJECT(pci->bus), "chip-id", phb->chip_id,
1018 &error_abort);
1019
1020 pci_setup_iommu(pci->bus, &pnv_phb3_iommu_ops, phb);
1021 }
1022
pnv_phb3_realize(DeviceState * dev,Error ** errp)1023 static void pnv_phb3_realize(DeviceState *dev, Error **errp)
1024 {
1025 PnvPHB3 *phb = PNV_PHB3(dev);
1026 PnvMachineState *pnv = PNV_MACHINE(qdev_get_machine());
1027 int i;
1028
1029 if (phb->phb_id >= PNV_CHIP_GET_CLASS(phb->chip)->num_phbs) {
1030 error_setg(errp, "invalid PHB index: %d", phb->phb_id);
1031 return;
1032 }
1033
1034 /* LSI sources */
1035 object_property_set_link(OBJECT(&phb->lsis), "xics", OBJECT(pnv),
1036 &error_abort);
1037 object_property_set_int(OBJECT(&phb->lsis), "nr-irqs", PNV_PHB3_NUM_LSI,
1038 &error_abort);
1039 if (!qdev_realize(DEVICE(&phb->lsis), NULL, errp)) {
1040 return;
1041 }
1042
1043 for (i = 0; i < phb->lsis.nr_irqs; i++) {
1044 ics_set_irq_type(&phb->lsis, i, true);
1045 }
1046
1047 phb->qirqs = qemu_allocate_irqs(ics_set_irq, &phb->lsis, phb->lsis.nr_irqs);
1048
1049 /* MSI sources */
1050 object_property_set_link(OBJECT(&phb->msis), "phb", OBJECT(phb),
1051 &error_abort);
1052 object_property_set_link(OBJECT(&phb->msis), "xics", OBJECT(pnv),
1053 &error_abort);
1054 object_property_set_int(OBJECT(&phb->msis), "nr-irqs", PHB3_MAX_MSI,
1055 &error_abort);
1056 if (!qdev_realize(DEVICE(&phb->msis), NULL, errp)) {
1057 return;
1058 }
1059
1060 /* Power Bus Common Queue */
1061 object_property_set_link(OBJECT(&phb->pbcq), "phb", OBJECT(phb),
1062 &error_abort);
1063 if (!qdev_realize(DEVICE(&phb->pbcq), NULL, errp)) {
1064 return;
1065 }
1066
1067 /* Controller Registers */
1068 memory_region_init_io(&phb->mr_regs, OBJECT(phb), &pnv_phb3_reg_ops, phb,
1069 "phb3-regs", 0x1000);
1070 }
1071
pnv_phb3_update_regions(PnvPHB3 * phb)1072 void pnv_phb3_update_regions(PnvPHB3 *phb)
1073 {
1074 PnvPBCQState *pbcq = &phb->pbcq;
1075
1076 /* Unmap first always */
1077 if (memory_region_is_mapped(&phb->mr_regs)) {
1078 memory_region_del_subregion(&pbcq->phbbar, &phb->mr_regs);
1079 }
1080
1081 /* Map registers if enabled */
1082 if (memory_region_is_mapped(&pbcq->phbbar)) {
1083 /* TODO: We should use the PHB BAR 2 register but we don't ... */
1084 memory_region_add_subregion(&pbcq->phbbar, 0, &phb->mr_regs);
1085 }
1086
1087 /* Check/update m32 */
1088 if (memory_region_is_mapped(&phb->mr_m32)) {
1089 pnv_phb3_check_m32(phb);
1090 }
1091 pnv_phb3_check_all_m64s(phb);
1092 }
1093
1094 static const Property pnv_phb3_properties[] = {
1095 DEFINE_PROP_UINT32("index", PnvPHB3, phb_id, 0),
1096 DEFINE_PROP_UINT32("chip-id", PnvPHB3, chip_id, 0),
1097 DEFINE_PROP_LINK("chip", PnvPHB3, chip, TYPE_PNV_CHIP, PnvChip *),
1098 DEFINE_PROP_LINK("phb-base", PnvPHB3, phb_base, TYPE_PNV_PHB, PnvPHB *),
1099 };
1100
pnv_phb3_class_init(ObjectClass * klass,const void * data)1101 static void pnv_phb3_class_init(ObjectClass *klass, const void *data)
1102 {
1103 DeviceClass *dc = DEVICE_CLASS(klass);
1104
1105 dc->realize = pnv_phb3_realize;
1106 device_class_set_props(dc, pnv_phb3_properties);
1107 dc->user_creatable = false;
1108 }
1109
1110 static const TypeInfo pnv_phb3_type_info = {
1111 .name = TYPE_PNV_PHB3,
1112 .parent = TYPE_DEVICE,
1113 .instance_size = sizeof(PnvPHB3),
1114 .class_init = pnv_phb3_class_init,
1115 .instance_init = pnv_phb3_instance_init,
1116 };
1117
pnv_phb3_root_bus_get_prop(Object * obj,Visitor * v,const char * name,void * opaque,Error ** errp)1118 static void pnv_phb3_root_bus_get_prop(Object *obj, Visitor *v,
1119 const char *name,
1120 void *opaque, Error **errp)
1121 {
1122 PnvPHB3RootBus *bus = PNV_PHB3_ROOT_BUS(obj);
1123 uint64_t value = 0;
1124
1125 if (strcmp(name, "phb-id") == 0) {
1126 value = bus->phb_id;
1127 } else {
1128 value = bus->chip_id;
1129 }
1130
1131 visit_type_size(v, name, &value, errp);
1132 }
1133
pnv_phb3_root_bus_set_prop(Object * obj,Visitor * v,const char * name,void * opaque,Error ** errp)1134 static void pnv_phb3_root_bus_set_prop(Object *obj, Visitor *v,
1135 const char *name,
1136 void *opaque, Error **errp)
1137
1138 {
1139 PnvPHB3RootBus *bus = PNV_PHB3_ROOT_BUS(obj);
1140 uint64_t value;
1141
1142 if (!visit_type_size(v, name, &value, errp)) {
1143 return;
1144 }
1145
1146 if (strcmp(name, "phb-id") == 0) {
1147 bus->phb_id = value;
1148 } else {
1149 bus->chip_id = value;
1150 }
1151 }
1152
pnv_phb3_root_bus_class_init(ObjectClass * klass,const void * data)1153 static void pnv_phb3_root_bus_class_init(ObjectClass *klass, const void *data)
1154 {
1155 BusClass *k = BUS_CLASS(klass);
1156
1157 object_class_property_add(klass, "phb-id", "int",
1158 pnv_phb3_root_bus_get_prop,
1159 pnv_phb3_root_bus_set_prop,
1160 NULL, NULL);
1161
1162 object_class_property_add(klass, "chip-id", "int",
1163 pnv_phb3_root_bus_get_prop,
1164 pnv_phb3_root_bus_set_prop,
1165 NULL, NULL);
1166
1167 /*
1168 * PHB3 has only a single root complex. Enforce the limit on the
1169 * parent bus
1170 */
1171 k->max_dev = 1;
1172 }
1173
1174 static const TypeInfo pnv_phb3_root_bus_info = {
1175 .name = TYPE_PNV_PHB3_ROOT_BUS,
1176 .parent = TYPE_PCIE_BUS,
1177 .instance_size = sizeof(PnvPHB3RootBus),
1178 .class_init = pnv_phb3_root_bus_class_init,
1179 };
1180
pnv_phb3_register_types(void)1181 static void pnv_phb3_register_types(void)
1182 {
1183 type_register_static(&pnv_phb3_root_bus_info);
1184 type_register_static(&pnv_phb3_type_info);
1185 type_register_static(&pnv_phb3_iommu_memory_region_info);
1186 }
1187
1188 type_init(pnv_phb3_register_types)
1189