1 /* 2 * QEMU PowerPC PowerNV (POWER8) PHB3 model 3 * 4 * Copyright (c) 2014-2020, IBM Corporation. 5 * 6 * This code is licensed under the GPL version 2 or later. See the 7 * COPYING file in the top-level directory. 8 */ 9 #include "qemu/osdep.h" 10 #include "qemu/log.h" 11 #include "qemu/bswap.h" 12 #include "qapi/visitor.h" 13 #include "qapi/error.h" 14 #include "hw/pci-host/pnv_phb3_regs.h" 15 #include "hw/pci-host/pnv_phb.h" 16 #include "hw/pci-host/pnv_phb3.h" 17 #include "hw/pci/pcie_host.h" 18 #include "hw/pci/pcie_port.h" 19 #include "hw/ppc/pnv.h" 20 #include "hw/ppc/pnv_chip.h" 21 #include "hw/irq.h" 22 #include "hw/qdev-properties.h" 23 #include "qom/object.h" 24 #include "system/system.h" 25 26 #define phb3_error(phb, fmt, ...) \ 27 qemu_log_mask(LOG_GUEST_ERROR, "phb3[%d:%d]: " fmt "\n", \ 28 (phb)->chip_id, (phb)->phb_id, ## __VA_ARGS__) 29 30 static PCIDevice *pnv_phb3_find_cfg_dev(PnvPHB3 *phb) 31 { 32 PCIHostState *pci = PCI_HOST_BRIDGE(phb->phb_base); 33 uint64_t addr = phb->regs[PHB_CONFIG_ADDRESS >> 3]; 34 uint8_t bus, devfn; 35 36 if (!(addr >> 63)) { 37 return NULL; 38 } 39 bus = (addr >> 52) & 0xff; 40 devfn = (addr >> 44) & 0xff; 41 42 return pci_find_device(pci->bus, bus, devfn); 43 } 44 45 /* 46 * The CONFIG_DATA register expects little endian accesses, but as the 47 * region is big endian, we have to swap the value. 48 */ 49 static void pnv_phb3_config_write(PnvPHB3 *phb, unsigned off, 50 unsigned size, uint64_t val) 51 { 52 uint32_t cfg_addr, limit; 53 PCIDevice *pdev; 54 55 pdev = pnv_phb3_find_cfg_dev(phb); 56 if (!pdev) { 57 return; 58 } 59 cfg_addr = (phb->regs[PHB_CONFIG_ADDRESS >> 3] >> 32) & 0xffc; 60 cfg_addr |= off; 61 limit = pci_config_size(pdev); 62 if (limit <= cfg_addr) { 63 /* 64 * conventional pci device can be behind pcie-to-pci bridge. 65 * 256 <= addr < 4K has no effects. 66 */ 67 return; 68 } 69 switch (size) { 70 case 1: 71 break; 72 case 2: 73 val = bswap16(val); 74 break; 75 case 4: 76 val = bswap32(val); 77 break; 78 default: 79 g_assert_not_reached(); 80 } 81 pci_host_config_write_common(pdev, cfg_addr, limit, val, size); 82 } 83 84 static uint64_t pnv_phb3_config_read(PnvPHB3 *phb, unsigned off, 85 unsigned size) 86 { 87 uint32_t cfg_addr, limit; 88 PCIDevice *pdev; 89 uint64_t val; 90 91 pdev = pnv_phb3_find_cfg_dev(phb); 92 if (!pdev) { 93 return ~0ull; 94 } 95 cfg_addr = (phb->regs[PHB_CONFIG_ADDRESS >> 3] >> 32) & 0xffc; 96 cfg_addr |= off; 97 limit = pci_config_size(pdev); 98 if (limit <= cfg_addr) { 99 /* 100 * conventional pci device can be behind pcie-to-pci bridge. 101 * 256 <= addr < 4K has no effects. 102 */ 103 return ~0ull; 104 } 105 val = pci_host_config_read_common(pdev, cfg_addr, limit, size); 106 switch (size) { 107 case 1: 108 return val; 109 case 2: 110 return bswap16(val); 111 case 4: 112 return bswap32(val); 113 default: 114 g_assert_not_reached(); 115 } 116 } 117 118 static void pnv_phb3_check_m32(PnvPHB3 *phb) 119 { 120 uint64_t base, start, size; 121 MemoryRegion *parent; 122 PnvPBCQState *pbcq = &phb->pbcq; 123 124 if (memory_region_is_mapped(&phb->mr_m32)) { 125 memory_region_del_subregion(phb->mr_m32.container, &phb->mr_m32); 126 } 127 128 if (!(phb->regs[PHB_PHB3_CONFIG >> 3] & PHB_PHB3C_M32_EN)) { 129 return; 130 } 131 132 /* Grab geometry from registers */ 133 base = phb->regs[PHB_M32_BASE_ADDR >> 3]; 134 start = phb->regs[PHB_M32_START_ADDR >> 3]; 135 size = ~(phb->regs[PHB_M32_BASE_MASK >> 3] | 0xfffc000000000000ull) + 1; 136 137 /* Check if it matches an enabled MMIO region in the PBCQ */ 138 if (memory_region_is_mapped(&pbcq->mmbar0) && 139 base >= pbcq->mmio0_base && 140 (base + size) <= (pbcq->mmio0_base + pbcq->mmio0_size)) { 141 parent = &pbcq->mmbar0; 142 base -= pbcq->mmio0_base; 143 } else if (memory_region_is_mapped(&pbcq->mmbar1) && 144 base >= pbcq->mmio1_base && 145 (base + size) <= (pbcq->mmio1_base + pbcq->mmio1_size)) { 146 parent = &pbcq->mmbar1; 147 base -= pbcq->mmio1_base; 148 } else { 149 return; 150 } 151 152 /* Create alias */ 153 memory_region_init_alias(&phb->mr_m32, OBJECT(phb), "phb3-m32", 154 &phb->pci_mmio, start, size); 155 memory_region_add_subregion(parent, base, &phb->mr_m32); 156 } 157 158 static void pnv_phb3_check_m64(PnvPHB3 *phb, uint32_t index) 159 { 160 uint64_t base, start, size, m64; 161 MemoryRegion *parent; 162 PnvPBCQState *pbcq = &phb->pbcq; 163 164 if (memory_region_is_mapped(&phb->mr_m64[index])) { 165 /* Should we destroy it in RCU friendly way... ? */ 166 memory_region_del_subregion(phb->mr_m64[index].container, 167 &phb->mr_m64[index]); 168 } 169 170 /* Get table entry */ 171 m64 = phb->ioda_M64BT[index]; 172 173 if (!(m64 & IODA2_M64BT_ENABLE)) { 174 return; 175 } 176 177 /* Grab geometry from registers */ 178 base = GETFIELD(IODA2_M64BT_BASE, m64) << 20; 179 if (m64 & IODA2_M64BT_SINGLE_PE) { 180 base &= ~0x1ffffffull; 181 } 182 size = GETFIELD(IODA2_M64BT_MASK, m64) << 20; 183 size |= 0xfffc000000000000ull; 184 size = ~size + 1; 185 start = base | (phb->regs[PHB_M64_UPPER_BITS >> 3]); 186 187 /* Check if it matches an enabled MMIO region in the PBCQ */ 188 if (memory_region_is_mapped(&pbcq->mmbar0) && 189 base >= pbcq->mmio0_base && 190 (base + size) <= (pbcq->mmio0_base + pbcq->mmio0_size)) { 191 parent = &pbcq->mmbar0; 192 base -= pbcq->mmio0_base; 193 } else if (memory_region_is_mapped(&pbcq->mmbar1) && 194 base >= pbcq->mmio1_base && 195 (base + size) <= (pbcq->mmio1_base + pbcq->mmio1_size)) { 196 parent = &pbcq->mmbar1; 197 base -= pbcq->mmio1_base; 198 } else { 199 return; 200 } 201 202 /* Create alias */ 203 memory_region_init_alias(&phb->mr_m64[index], OBJECT(phb), "phb3-m64", 204 &phb->pci_mmio, start, size); 205 memory_region_add_subregion(parent, base, &phb->mr_m64[index]); 206 } 207 208 static void pnv_phb3_check_all_m64s(PnvPHB3 *phb) 209 { 210 uint64_t i; 211 212 for (i = 0; i < PNV_PHB3_NUM_M64; i++) { 213 pnv_phb3_check_m64(phb, i); 214 } 215 } 216 217 static void pnv_phb3_lxivt_write(PnvPHB3 *phb, unsigned idx, uint64_t val) 218 { 219 uint8_t server, prio; 220 221 phb->ioda_LXIVT[idx] = val & (IODA2_LXIVT_SERVER | 222 IODA2_LXIVT_PRIORITY | 223 IODA2_LXIVT_NODE_ID); 224 server = GETFIELD(IODA2_LXIVT_SERVER, val); 225 prio = GETFIELD(IODA2_LXIVT_PRIORITY, val); 226 227 /* 228 * The low order 2 bits are the link pointer (Type II interrupts). 229 * Shift back to get a valid IRQ server. 230 */ 231 server >>= 2; 232 233 ics_write_xive(&phb->lsis, idx, server, prio, prio); 234 } 235 236 static uint64_t *pnv_phb3_ioda_access(PnvPHB3 *phb, 237 unsigned *out_table, unsigned *out_idx) 238 { 239 uint64_t adreg = phb->regs[PHB_IODA_ADDR >> 3]; 240 unsigned int index = GETFIELD(PHB_IODA_AD_TADR, adreg); 241 unsigned int table = GETFIELD(PHB_IODA_AD_TSEL, adreg); 242 unsigned int mask; 243 uint64_t *tptr = NULL; 244 245 switch (table) { 246 case IODA2_TBL_LIST: 247 tptr = phb->ioda_LIST; 248 mask = 7; 249 break; 250 case IODA2_TBL_LXIVT: 251 tptr = phb->ioda_LXIVT; 252 mask = 7; 253 break; 254 case IODA2_TBL_IVC_CAM: 255 case IODA2_TBL_RBA: 256 mask = 31; 257 break; 258 case IODA2_TBL_RCAM: 259 mask = 63; 260 break; 261 case IODA2_TBL_MRT: 262 mask = 7; 263 break; 264 case IODA2_TBL_PESTA: 265 case IODA2_TBL_PESTB: 266 mask = 255; 267 break; 268 case IODA2_TBL_TVT: 269 tptr = phb->ioda_TVT; 270 mask = 511; 271 break; 272 case IODA2_TBL_TCAM: 273 case IODA2_TBL_TDR: 274 mask = 63; 275 break; 276 case IODA2_TBL_M64BT: 277 tptr = phb->ioda_M64BT; 278 mask = 15; 279 break; 280 case IODA2_TBL_M32DT: 281 tptr = phb->ioda_MDT; 282 mask = 255; 283 break; 284 case IODA2_TBL_PEEV: 285 tptr = phb->ioda_PEEV; 286 mask = 3; 287 break; 288 default: 289 phb3_error(phb, "invalid IODA table %d", table); 290 return NULL; 291 } 292 index &= mask; 293 if (out_idx) { 294 *out_idx = index; 295 } 296 if (out_table) { 297 *out_table = table; 298 } 299 if (tptr) { 300 tptr += index; 301 } 302 if (adreg & PHB_IODA_AD_AUTOINC) { 303 index = (index + 1) & mask; 304 adreg = SETFIELD(PHB_IODA_AD_TADR, adreg, index); 305 } 306 phb->regs[PHB_IODA_ADDR >> 3] = adreg; 307 return tptr; 308 } 309 310 static uint64_t pnv_phb3_ioda_read(PnvPHB3 *phb) 311 { 312 unsigned table; 313 uint64_t *tptr; 314 315 tptr = pnv_phb3_ioda_access(phb, &table, NULL); 316 if (!tptr) { 317 /* Return 0 on unsupported tables, not ff's */ 318 return 0; 319 } 320 return *tptr; 321 } 322 323 static void pnv_phb3_ioda_write(PnvPHB3 *phb, uint64_t val) 324 { 325 unsigned table, idx; 326 uint64_t *tptr; 327 328 tptr = pnv_phb3_ioda_access(phb, &table, &idx); 329 if (!tptr) { 330 return; 331 } 332 333 /* Handle side effects */ 334 switch (table) { 335 case IODA2_TBL_LXIVT: 336 pnv_phb3_lxivt_write(phb, idx, val); 337 break; 338 case IODA2_TBL_M64BT: 339 *tptr = val; 340 pnv_phb3_check_m64(phb, idx); 341 break; 342 default: 343 *tptr = val; 344 } 345 } 346 347 /* 348 * This is called whenever the PHB LSI, MSI source ID register or 349 * the PBCQ irq filters are written. 350 */ 351 void pnv_phb3_remap_irqs(PnvPHB3 *phb) 352 { 353 ICSState *ics = &phb->lsis; 354 uint32_t local, global, count, mask, comp; 355 uint64_t baren; 356 PnvPBCQState *pbcq = &phb->pbcq; 357 358 /* 359 * First check if we are enabled. Unlike real HW we don't separate 360 * TX and RX so we enable if both are set 361 */ 362 baren = pbcq->nest_regs[PBCQ_NEST_BAR_EN]; 363 if (!(baren & PBCQ_NEST_BAR_EN_IRSN_RX) || 364 !(baren & PBCQ_NEST_BAR_EN_IRSN_TX)) { 365 ics->offset = 0; 366 return; 367 } 368 369 /* Grab local LSI source ID */ 370 local = GETFIELD(PHB_LSI_SRC_ID, phb->regs[PHB_LSI_SOURCE_ID >> 3]) << 3; 371 372 /* Grab global one and compare */ 373 global = GETFIELD(PBCQ_NEST_LSI_SRC, 374 pbcq->nest_regs[PBCQ_NEST_LSI_SRC_ID]) << 3; 375 if (global != local) { 376 /* 377 * This happens during initialization, let's come back when we 378 * are properly configured 379 */ 380 ics->offset = 0; 381 return; 382 } 383 384 /* Get the base on the powerbus */ 385 comp = GETFIELD(PBCQ_NEST_IRSN_COMP, 386 pbcq->nest_regs[PBCQ_NEST_IRSN_COMPARE]); 387 mask = GETFIELD(PBCQ_NEST_IRSN_COMP, 388 pbcq->nest_regs[PBCQ_NEST_IRSN_MASK]); 389 count = ((~mask) + 1) & 0x7ffff; 390 phb->total_irq = count; 391 392 /* Sanity checks */ 393 if ((global + PNV_PHB3_NUM_LSI) > count) { 394 phb3_error(phb, "LSIs out of reach: LSI base=%d total irq=%d", global, 395 count); 396 } 397 398 if (count > 2048) { 399 phb3_error(phb, "More interrupts than supported: %d", count); 400 } 401 402 if ((comp & mask) != comp) { 403 phb3_error(phb, "IRQ compare bits not in mask: comp=0x%x mask=0x%x", 404 comp, mask); 405 comp &= mask; 406 } 407 /* Setup LSI offset */ 408 ics->offset = comp + global; 409 410 /* Setup MSI offset */ 411 pnv_phb3_msi_update_config(&phb->msis, comp, count - PNV_PHB3_NUM_LSI); 412 } 413 414 static void pnv_phb3_lsi_src_id_write(PnvPHB3 *phb, uint64_t val) 415 { 416 /* Sanitize content */ 417 val &= PHB_LSI_SRC_ID; 418 phb->regs[PHB_LSI_SOURCE_ID >> 3] = val; 419 pnv_phb3_remap_irqs(phb); 420 } 421 422 static void pnv_phb3_rtc_invalidate(PnvPHB3 *phb, uint64_t val) 423 { 424 PnvPhb3DMASpace *ds; 425 426 /* Always invalidate all for now ... */ 427 QLIST_FOREACH(ds, &phb->dma_spaces, list) { 428 ds->pe_num = PHB_INVALID_PE; 429 } 430 } 431 432 433 static void pnv_phb3_update_msi_regions(PnvPhb3DMASpace *ds) 434 { 435 uint64_t cfg = ds->phb->regs[PHB_PHB3_CONFIG >> 3]; 436 437 if (cfg & PHB_PHB3C_32BIT_MSI_EN) { 438 if (!memory_region_is_mapped(&ds->msi32_mr)) { 439 memory_region_add_subregion(MEMORY_REGION(&ds->dma_mr), 440 0xffff0000, &ds->msi32_mr); 441 } 442 } else { 443 if (memory_region_is_mapped(&ds->msi32_mr)) { 444 memory_region_del_subregion(MEMORY_REGION(&ds->dma_mr), 445 &ds->msi32_mr); 446 } 447 } 448 449 if (cfg & PHB_PHB3C_64BIT_MSI_EN) { 450 if (!memory_region_is_mapped(&ds->msi64_mr)) { 451 memory_region_add_subregion(MEMORY_REGION(&ds->dma_mr), 452 (1ull << 60), &ds->msi64_mr); 453 } 454 } else { 455 if (memory_region_is_mapped(&ds->msi64_mr)) { 456 memory_region_del_subregion(MEMORY_REGION(&ds->dma_mr), 457 &ds->msi64_mr); 458 } 459 } 460 } 461 462 static void pnv_phb3_update_all_msi_regions(PnvPHB3 *phb) 463 { 464 PnvPhb3DMASpace *ds; 465 466 QLIST_FOREACH(ds, &phb->dma_spaces, list) { 467 pnv_phb3_update_msi_regions(ds); 468 } 469 } 470 471 void pnv_phb3_reg_write(void *opaque, hwaddr off, uint64_t val, unsigned size) 472 { 473 PnvPHB3 *phb = opaque; 474 bool changed; 475 476 /* Special case configuration data */ 477 if ((off & 0xfffc) == PHB_CONFIG_DATA) { 478 pnv_phb3_config_write(phb, off & 0x3, size, val); 479 return; 480 } 481 482 /* Other registers are 64-bit only */ 483 if (size != 8 || off & 0x7) { 484 phb3_error(phb, "Invalid register access, offset: 0x%"PRIx64" size: %d", 485 off, size); 486 return; 487 } 488 489 /* Handle masking & filtering */ 490 switch (off) { 491 case PHB_M64_UPPER_BITS: 492 val &= 0xfffc000000000000ull; 493 break; 494 case PHB_Q_DMA_R: 495 /* 496 * This is enough logic to make SW happy but we aren't actually 497 * quiescing the DMAs 498 */ 499 if (val & PHB_Q_DMA_R_AUTORESET) { 500 val = 0; 501 } else { 502 val &= PHB_Q_DMA_R_QUIESCE_DMA; 503 } 504 break; 505 /* LEM stuff */ 506 case PHB_LEM_FIR_AND_MASK: 507 phb->regs[PHB_LEM_FIR_ACCUM >> 3] &= val; 508 return; 509 case PHB_LEM_FIR_OR_MASK: 510 phb->regs[PHB_LEM_FIR_ACCUM >> 3] |= val; 511 return; 512 case PHB_LEM_ERROR_AND_MASK: 513 phb->regs[PHB_LEM_ERROR_MASK >> 3] &= val; 514 return; 515 case PHB_LEM_ERROR_OR_MASK: 516 phb->regs[PHB_LEM_ERROR_MASK >> 3] |= val; 517 return; 518 case PHB_LEM_WOF: 519 val = 0; 520 break; 521 } 522 523 /* Record whether it changed */ 524 changed = phb->regs[off >> 3] != val; 525 526 /* Store in register cache first */ 527 phb->regs[off >> 3] = val; 528 529 /* Handle side effects */ 530 switch (off) { 531 case PHB_PHB3_CONFIG: 532 if (changed) { 533 pnv_phb3_update_all_msi_regions(phb); 534 } 535 /* fall through */ 536 case PHB_M32_BASE_ADDR: 537 case PHB_M32_BASE_MASK: 538 case PHB_M32_START_ADDR: 539 if (changed) { 540 pnv_phb3_check_m32(phb); 541 } 542 break; 543 case PHB_M64_UPPER_BITS: 544 if (changed) { 545 pnv_phb3_check_all_m64s(phb); 546 } 547 break; 548 case PHB_LSI_SOURCE_ID: 549 if (changed) { 550 pnv_phb3_lsi_src_id_write(phb, val); 551 } 552 break; 553 554 /* IODA table accesses */ 555 case PHB_IODA_DATA0: 556 pnv_phb3_ioda_write(phb, val); 557 break; 558 559 /* RTC invalidation */ 560 case PHB_RTC_INVALIDATE: 561 pnv_phb3_rtc_invalidate(phb, val); 562 break; 563 564 /* FFI request */ 565 case PHB_FFI_REQUEST: 566 pnv_phb3_msi_ffi(&phb->msis, val); 567 break; 568 569 /* Silent simple writes */ 570 case PHB_CONFIG_ADDRESS: 571 case PHB_IODA_ADDR: 572 case PHB_TCE_KILL: 573 case PHB_TCE_SPEC_CTL: 574 case PHB_PEST_BAR: 575 case PHB_PELTV_BAR: 576 case PHB_RTT_BAR: 577 case PHB_RBA_BAR: 578 case PHB_IVT_BAR: 579 case PHB_FFI_LOCK: 580 case PHB_LEM_FIR_ACCUM: 581 case PHB_LEM_ERROR_MASK: 582 case PHB_LEM_ACTION0: 583 case PHB_LEM_ACTION1: 584 break; 585 586 /* Noise on anything else */ 587 default: 588 qemu_log_mask(LOG_UNIMP, "phb3: reg_write 0x%"PRIx64"=%"PRIx64"\n", 589 off, val); 590 } 591 } 592 593 uint64_t pnv_phb3_reg_read(void *opaque, hwaddr off, unsigned size) 594 { 595 PnvPHB3 *phb = opaque; 596 PCIHostState *pci = PCI_HOST_BRIDGE(phb->phb_base); 597 uint64_t val; 598 599 if ((off & 0xfffc) == PHB_CONFIG_DATA) { 600 return pnv_phb3_config_read(phb, off & 0x3, size); 601 } 602 603 /* Other registers are 64-bit only */ 604 if (size != 8 || off & 0x7) { 605 phb3_error(phb, "Invalid register access, offset: 0x%"PRIx64" size: %d", 606 off, size); 607 return ~0ull; 608 } 609 610 /* Default read from cache */ 611 val = phb->regs[off >> 3]; 612 613 switch (off) { 614 /* Simulate venice DD2.0 */ 615 case PHB_VERSION: 616 return 0x000000a300000005ull; 617 case PHB_PCIE_SYSTEM_CONFIG: 618 return 0x441100fc30000000; 619 620 /* IODA table accesses */ 621 case PHB_IODA_DATA0: 622 return pnv_phb3_ioda_read(phb); 623 624 /* Link training always appears trained */ 625 case PHB_PCIE_DLP_TRAIN_CTL: 626 if (!pci_find_device(pci->bus, 1, 0)) { 627 return 0; 628 } 629 return PHB_PCIE_DLP_INBAND_PRESENCE | PHB_PCIE_DLP_TC_DL_LINKACT; 630 631 /* FFI Lock */ 632 case PHB_FFI_LOCK: 633 /* Set lock and return previous value */ 634 phb->regs[off >> 3] |= PHB_FFI_LOCK_STATE; 635 return val; 636 637 /* DMA read sync: make it look like it's complete */ 638 case PHB_DMARD_SYNC: 639 return PHB_DMARD_SYNC_COMPLETE; 640 641 /* Silent simple reads */ 642 case PHB_PHB3_CONFIG: 643 case PHB_M32_BASE_ADDR: 644 case PHB_M32_BASE_MASK: 645 case PHB_M32_START_ADDR: 646 case PHB_CONFIG_ADDRESS: 647 case PHB_IODA_ADDR: 648 case PHB_RTC_INVALIDATE: 649 case PHB_TCE_KILL: 650 case PHB_TCE_SPEC_CTL: 651 case PHB_PEST_BAR: 652 case PHB_PELTV_BAR: 653 case PHB_RTT_BAR: 654 case PHB_RBA_BAR: 655 case PHB_IVT_BAR: 656 case PHB_M64_UPPER_BITS: 657 case PHB_LEM_FIR_ACCUM: 658 case PHB_LEM_ERROR_MASK: 659 case PHB_LEM_ACTION0: 660 case PHB_LEM_ACTION1: 661 break; 662 663 /* Noise on anything else */ 664 default: 665 qemu_log_mask(LOG_UNIMP, "phb3: reg_read 0x%"PRIx64"=%"PRIx64"\n", 666 off, val); 667 } 668 return val; 669 } 670 671 static const MemoryRegionOps pnv_phb3_reg_ops = { 672 .read = pnv_phb3_reg_read, 673 .write = pnv_phb3_reg_write, 674 .valid.min_access_size = 1, 675 .valid.max_access_size = 8, 676 .impl.min_access_size = 1, 677 .impl.max_access_size = 8, 678 .endianness = DEVICE_BIG_ENDIAN, 679 }; 680 681 static int pnv_phb3_map_irq(PCIDevice *pci_dev, int irq_num) 682 { 683 /* Check that out properly ... */ 684 return irq_num & 3; 685 } 686 687 static void pnv_phb3_set_irq(void *opaque, int irq_num, int level) 688 { 689 PnvPHB3 *phb = opaque; 690 691 /* LSI only ... */ 692 if (irq_num > 3) { 693 phb3_error(phb, "Unknown IRQ to set %d", irq_num); 694 } 695 qemu_set_irq(phb->qirqs[irq_num], level); 696 } 697 698 static bool pnv_phb3_resolve_pe(PnvPhb3DMASpace *ds) 699 { 700 uint64_t rtt, addr; 701 uint16_t rte; 702 int bus_num; 703 704 /* Already resolved ? */ 705 if (ds->pe_num != PHB_INVALID_PE) { 706 return true; 707 } 708 709 /* We need to lookup the RTT */ 710 rtt = ds->phb->regs[PHB_RTT_BAR >> 3]; 711 if (!(rtt & PHB_RTT_BAR_ENABLE)) { 712 phb3_error(ds->phb, "DMA with RTT BAR disabled !"); 713 /* Set error bits ? fence ? ... */ 714 return false; 715 } 716 717 /* Read RTE */ 718 bus_num = pci_bus_num(ds->bus); 719 addr = rtt & PHB_RTT_BASE_ADDRESS_MASK; 720 addr += 2 * ((bus_num << 8) | ds->devfn); 721 if (dma_memory_read(&address_space_memory, addr, &rte, 722 sizeof(rte), MEMTXATTRS_UNSPECIFIED)) { 723 phb3_error(ds->phb, "Failed to read RTT entry at 0x%"PRIx64, addr); 724 /* Set error bits ? fence ? ... */ 725 return false; 726 } 727 rte = be16_to_cpu(rte); 728 729 /* Fail upon reading of invalid PE# */ 730 if (rte >= PNV_PHB3_NUM_PE) { 731 phb3_error(ds->phb, "RTE for RID 0x%x invalid (%04x", ds->devfn, rte); 732 /* Set error bits ? fence ? ... */ 733 return false; 734 } 735 ds->pe_num = rte; 736 return true; 737 } 738 739 static void pnv_phb3_translate_tve(PnvPhb3DMASpace *ds, hwaddr addr, 740 bool is_write, uint64_t tve, 741 IOMMUTLBEntry *tlb) 742 { 743 uint64_t tta = GETFIELD(IODA2_TVT_TABLE_ADDR, tve); 744 int32_t lev = GETFIELD(IODA2_TVT_NUM_LEVELS, tve); 745 uint32_t tts = GETFIELD(IODA2_TVT_TCE_TABLE_SIZE, tve); 746 uint32_t tps = GETFIELD(IODA2_TVT_IO_PSIZE, tve); 747 PnvPHB3 *phb = ds->phb; 748 749 /* Invalid levels */ 750 if (lev > 4) { 751 phb3_error(phb, "Invalid #levels in TVE %d", lev); 752 return; 753 } 754 755 /* IO Page Size of 0 means untranslated, else use TCEs */ 756 if (tps == 0) { 757 /* 758 * We only support non-translate in top window. 759 * 760 * TODO: Venice/Murano support it on bottom window above 4G and 761 * Naples supports it on everything 762 */ 763 if (!(tve & PPC_BIT(51))) { 764 phb3_error(phb, "xlate for invalid non-translate TVE"); 765 return; 766 } 767 /* TODO: Handle boundaries */ 768 769 /* Use 4k pages like q35 ... for now */ 770 tlb->iova = addr & 0xfffffffffffff000ull; 771 tlb->translated_addr = addr & 0x0003fffffffff000ull; 772 tlb->addr_mask = 0xfffull; 773 tlb->perm = IOMMU_RW; 774 } else { 775 uint32_t tce_shift, tbl_shift, sh; 776 uint64_t base, taddr, tce, tce_mask; 777 778 /* TVE disabled ? */ 779 if (tts == 0) { 780 phb3_error(phb, "xlate for invalid translated TVE"); 781 return; 782 } 783 784 /* Address bits per bottom level TCE entry */ 785 tce_shift = tps + 11; 786 787 /* Address bits per table level */ 788 tbl_shift = tts + 8; 789 790 /* Top level table base address */ 791 base = tta << 12; 792 793 /* Total shift to first level */ 794 sh = tbl_shift * lev + tce_shift; 795 796 /* TODO: Multi-level untested */ 797 do { 798 lev--; 799 800 /* Grab the TCE address */ 801 taddr = base | (((addr >> sh) & ((1ul << tbl_shift) - 1)) << 3); 802 if (dma_memory_read(&address_space_memory, taddr, &tce, 803 sizeof(tce), MEMTXATTRS_UNSPECIFIED)) { 804 phb3_error(phb, "Failed to read TCE at 0x%"PRIx64, taddr); 805 return; 806 } 807 tce = be64_to_cpu(tce); 808 809 /* Check permission for indirect TCE */ 810 if ((lev >= 0) && !(tce & 3)) { 811 phb3_error(phb, "Invalid indirect TCE at 0x%"PRIx64, taddr); 812 phb3_error(phb, " xlate %"PRIx64":%c TVE=%"PRIx64, addr, 813 is_write ? 'W' : 'R', tve); 814 phb3_error(phb, " tta=%"PRIx64" lev=%d tts=%d tps=%d", 815 tta, lev, tts, tps); 816 return; 817 } 818 sh -= tbl_shift; 819 base = tce & ~0xfffull; 820 } while (lev >= 0); 821 822 /* We exit the loop with TCE being the final TCE */ 823 if ((is_write & !(tce & 2)) || ((!is_write) && !(tce & 1))) { 824 phb3_error(phb, "TCE access fault at 0x%"PRIx64, taddr); 825 phb3_error(phb, " xlate %"PRIx64":%c TVE=%"PRIx64, addr, 826 is_write ? 'W' : 'R', tve); 827 phb3_error(phb, " tta=%"PRIx64" lev=%d tts=%d tps=%d", 828 tta, lev, tts, tps); 829 return; 830 } 831 tce_mask = ~((1ull << tce_shift) - 1); 832 tlb->iova = addr & tce_mask; 833 tlb->translated_addr = tce & tce_mask; 834 tlb->addr_mask = ~tce_mask; 835 tlb->perm = tce & 3; 836 } 837 } 838 839 static IOMMUTLBEntry pnv_phb3_translate_iommu(IOMMUMemoryRegion *iommu, 840 hwaddr addr, 841 IOMMUAccessFlags flag, 842 int iommu_idx) 843 { 844 PnvPhb3DMASpace *ds = container_of(iommu, PnvPhb3DMASpace, dma_mr); 845 int tve_sel; 846 uint64_t tve, cfg; 847 IOMMUTLBEntry ret = { 848 .target_as = &address_space_memory, 849 .iova = addr, 850 .translated_addr = 0, 851 .addr_mask = ~(hwaddr)0, 852 .perm = IOMMU_NONE, 853 }; 854 PnvPHB3 *phb = ds->phb; 855 856 /* Resolve PE# */ 857 if (!pnv_phb3_resolve_pe(ds)) { 858 phb3_error(phb, "Failed to resolve PE# for bus @%p (%d) devfn 0x%x", 859 ds->bus, pci_bus_num(ds->bus), ds->devfn); 860 return ret; 861 } 862 863 /* Check top bits */ 864 switch (addr >> 60) { 865 case 00: 866 /* DMA or 32-bit MSI ? */ 867 cfg = ds->phb->regs[PHB_PHB3_CONFIG >> 3]; 868 if ((cfg & PHB_PHB3C_32BIT_MSI_EN) && 869 ((addr & 0xffffffffffff0000ull) == 0xffff0000ull)) { 870 phb3_error(phb, "xlate on 32-bit MSI region"); 871 return ret; 872 } 873 /* Choose TVE XXX Use PHB3 Control Register */ 874 tve_sel = (addr >> 59) & 1; 875 tve = ds->phb->ioda_TVT[ds->pe_num * 2 + tve_sel]; 876 pnv_phb3_translate_tve(ds, addr, flag & IOMMU_WO, tve, &ret); 877 break; 878 case 01: 879 phb3_error(phb, "xlate on 64-bit MSI region"); 880 break; 881 default: 882 phb3_error(phb, "xlate on unsupported address 0x%"PRIx64, addr); 883 } 884 return ret; 885 } 886 887 #define TYPE_PNV_PHB3_IOMMU_MEMORY_REGION "pnv-phb3-iommu-memory-region" 888 DECLARE_INSTANCE_CHECKER(IOMMUMemoryRegion, PNV_PHB3_IOMMU_MEMORY_REGION, 889 TYPE_PNV_PHB3_IOMMU_MEMORY_REGION) 890 891 static void pnv_phb3_iommu_memory_region_class_init(ObjectClass *klass, 892 const void *data) 893 { 894 IOMMUMemoryRegionClass *imrc = IOMMU_MEMORY_REGION_CLASS(klass); 895 896 imrc->translate = pnv_phb3_translate_iommu; 897 } 898 899 static const TypeInfo pnv_phb3_iommu_memory_region_info = { 900 .parent = TYPE_IOMMU_MEMORY_REGION, 901 .name = TYPE_PNV_PHB3_IOMMU_MEMORY_REGION, 902 .class_init = pnv_phb3_iommu_memory_region_class_init, 903 }; 904 905 /* 906 * MSI/MSIX memory region implementation. 907 * The handler handles both MSI and MSIX. 908 */ 909 static void pnv_phb3_msi_write(void *opaque, hwaddr addr, 910 uint64_t data, unsigned size) 911 { 912 PnvPhb3DMASpace *ds = opaque; 913 914 /* Resolve PE# */ 915 if (!pnv_phb3_resolve_pe(ds)) { 916 phb3_error(ds->phb, "Failed to resolve PE# for bus @%p (%d) devfn 0x%x", 917 ds->bus, pci_bus_num(ds->bus), ds->devfn); 918 return; 919 } 920 921 pnv_phb3_msi_send(&ds->phb->msis, addr, data, ds->pe_num); 922 } 923 924 /* There is no .read as the read result is undefined by PCI spec */ 925 static uint64_t pnv_phb3_msi_read(void *opaque, hwaddr addr, unsigned size) 926 { 927 PnvPhb3DMASpace *ds = opaque; 928 929 phb3_error(ds->phb, "invalid read @ 0x%" HWADDR_PRIx, addr); 930 return -1; 931 } 932 933 static const MemoryRegionOps pnv_phb3_msi_ops = { 934 .read = pnv_phb3_msi_read, 935 .write = pnv_phb3_msi_write, 936 .endianness = DEVICE_LITTLE_ENDIAN 937 }; 938 939 static AddressSpace *pnv_phb3_dma_iommu(PCIBus *bus, void *opaque, int devfn) 940 { 941 PnvPHB3 *phb = opaque; 942 PnvPhb3DMASpace *ds; 943 944 QLIST_FOREACH(ds, &phb->dma_spaces, list) { 945 if (ds->bus == bus && ds->devfn == devfn) { 946 break; 947 } 948 } 949 950 if (ds == NULL) { 951 ds = g_new0(PnvPhb3DMASpace, 1); 952 ds->bus = bus; 953 ds->devfn = devfn; 954 ds->pe_num = PHB_INVALID_PE; 955 ds->phb = phb; 956 memory_region_init_iommu(&ds->dma_mr, sizeof(ds->dma_mr), 957 TYPE_PNV_PHB3_IOMMU_MEMORY_REGION, 958 OBJECT(phb), "phb3_iommu", UINT64_MAX); 959 address_space_init(&ds->dma_as, MEMORY_REGION(&ds->dma_mr), 960 "phb3_iommu"); 961 memory_region_init_io(&ds->msi32_mr, OBJECT(phb), &pnv_phb3_msi_ops, 962 ds, "msi32", 0x10000); 963 memory_region_init_io(&ds->msi64_mr, OBJECT(phb), &pnv_phb3_msi_ops, 964 ds, "msi64", 0x100000); 965 pnv_phb3_update_msi_regions(ds); 966 967 QLIST_INSERT_HEAD(&phb->dma_spaces, ds, list); 968 } 969 return &ds->dma_as; 970 } 971 972 static PCIIOMMUOps pnv_phb3_iommu_ops = { 973 .get_address_space = pnv_phb3_dma_iommu, 974 }; 975 976 static void pnv_phb3_instance_init(Object *obj) 977 { 978 PnvPHB3 *phb = PNV_PHB3(obj); 979 980 QLIST_INIT(&phb->dma_spaces); 981 982 /* LSI sources */ 983 object_initialize_child(obj, "lsi", &phb->lsis, TYPE_ICS); 984 985 /* Default init ... will be fixed by HW inits */ 986 phb->lsis.offset = 0; 987 988 /* MSI sources */ 989 object_initialize_child(obj, "msi", &phb->msis, TYPE_PHB3_MSI); 990 991 /* Power Bus Common Queue */ 992 object_initialize_child(obj, "pbcq", &phb->pbcq, TYPE_PNV_PBCQ); 993 994 } 995 996 void pnv_phb3_bus_init(DeviceState *dev, PnvPHB3 *phb) 997 { 998 PCIHostState *pci = PCI_HOST_BRIDGE(dev); 999 1000 /* 1001 * PHB3 doesn't support IO space. However, qemu gets very upset if 1002 * we don't have an IO region to anchor IO BARs onto so we just 1003 * initialize one which we never hook up to anything 1004 */ 1005 memory_region_init(&phb->pci_io, OBJECT(phb), "pci-io", 0x10000); 1006 memory_region_init(&phb->pci_mmio, OBJECT(phb), "pci-mmio", 1007 PCI_MMIO_TOTAL_SIZE); 1008 1009 pci->bus = pci_register_root_bus(dev, 1010 dev->id ? dev->id : NULL, 1011 pnv_phb3_set_irq, pnv_phb3_map_irq, phb, 1012 &phb->pci_mmio, &phb->pci_io, 1013 0, 4, TYPE_PNV_PHB3_ROOT_BUS); 1014 1015 object_property_set_int(OBJECT(pci->bus), "phb-id", phb->phb_id, 1016 &error_abort); 1017 object_property_set_int(OBJECT(pci->bus), "chip-id", phb->chip_id, 1018 &error_abort); 1019 1020 pci_setup_iommu(pci->bus, &pnv_phb3_iommu_ops, phb); 1021 } 1022 1023 static void pnv_phb3_realize(DeviceState *dev, Error **errp) 1024 { 1025 PnvPHB3 *phb = PNV_PHB3(dev); 1026 PnvMachineState *pnv = PNV_MACHINE(qdev_get_machine()); 1027 int i; 1028 1029 if (phb->phb_id >= PNV_CHIP_GET_CLASS(phb->chip)->num_phbs) { 1030 error_setg(errp, "invalid PHB index: %d", phb->phb_id); 1031 return; 1032 } 1033 1034 /* LSI sources */ 1035 object_property_set_link(OBJECT(&phb->lsis), "xics", OBJECT(pnv), 1036 &error_abort); 1037 object_property_set_int(OBJECT(&phb->lsis), "nr-irqs", PNV_PHB3_NUM_LSI, 1038 &error_abort); 1039 if (!qdev_realize(DEVICE(&phb->lsis), NULL, errp)) { 1040 return; 1041 } 1042 1043 for (i = 0; i < phb->lsis.nr_irqs; i++) { 1044 ics_set_irq_type(&phb->lsis, i, true); 1045 } 1046 1047 phb->qirqs = qemu_allocate_irqs(ics_set_irq, &phb->lsis, phb->lsis.nr_irqs); 1048 1049 /* MSI sources */ 1050 object_property_set_link(OBJECT(&phb->msis), "phb", OBJECT(phb), 1051 &error_abort); 1052 object_property_set_link(OBJECT(&phb->msis), "xics", OBJECT(pnv), 1053 &error_abort); 1054 object_property_set_int(OBJECT(&phb->msis), "nr-irqs", PHB3_MAX_MSI, 1055 &error_abort); 1056 if (!qdev_realize(DEVICE(&phb->msis), NULL, errp)) { 1057 return; 1058 } 1059 1060 /* Power Bus Common Queue */ 1061 object_property_set_link(OBJECT(&phb->pbcq), "phb", OBJECT(phb), 1062 &error_abort); 1063 if (!qdev_realize(DEVICE(&phb->pbcq), NULL, errp)) { 1064 return; 1065 } 1066 1067 /* Controller Registers */ 1068 memory_region_init_io(&phb->mr_regs, OBJECT(phb), &pnv_phb3_reg_ops, phb, 1069 "phb3-regs", 0x1000); 1070 } 1071 1072 void pnv_phb3_update_regions(PnvPHB3 *phb) 1073 { 1074 PnvPBCQState *pbcq = &phb->pbcq; 1075 1076 /* Unmap first always */ 1077 if (memory_region_is_mapped(&phb->mr_regs)) { 1078 memory_region_del_subregion(&pbcq->phbbar, &phb->mr_regs); 1079 } 1080 1081 /* Map registers if enabled */ 1082 if (memory_region_is_mapped(&pbcq->phbbar)) { 1083 /* TODO: We should use the PHB BAR 2 register but we don't ... */ 1084 memory_region_add_subregion(&pbcq->phbbar, 0, &phb->mr_regs); 1085 } 1086 1087 /* Check/update m32 */ 1088 if (memory_region_is_mapped(&phb->mr_m32)) { 1089 pnv_phb3_check_m32(phb); 1090 } 1091 pnv_phb3_check_all_m64s(phb); 1092 } 1093 1094 static const Property pnv_phb3_properties[] = { 1095 DEFINE_PROP_UINT32("index", PnvPHB3, phb_id, 0), 1096 DEFINE_PROP_UINT32("chip-id", PnvPHB3, chip_id, 0), 1097 DEFINE_PROP_LINK("chip", PnvPHB3, chip, TYPE_PNV_CHIP, PnvChip *), 1098 DEFINE_PROP_LINK("phb-base", PnvPHB3, phb_base, TYPE_PNV_PHB, PnvPHB *), 1099 }; 1100 1101 static void pnv_phb3_class_init(ObjectClass *klass, const void *data) 1102 { 1103 DeviceClass *dc = DEVICE_CLASS(klass); 1104 1105 dc->realize = pnv_phb3_realize; 1106 device_class_set_props(dc, pnv_phb3_properties); 1107 dc->user_creatable = false; 1108 } 1109 1110 static const TypeInfo pnv_phb3_type_info = { 1111 .name = TYPE_PNV_PHB3, 1112 .parent = TYPE_DEVICE, 1113 .instance_size = sizeof(PnvPHB3), 1114 .class_init = pnv_phb3_class_init, 1115 .instance_init = pnv_phb3_instance_init, 1116 }; 1117 1118 static void pnv_phb3_root_bus_get_prop(Object *obj, Visitor *v, 1119 const char *name, 1120 void *opaque, Error **errp) 1121 { 1122 PnvPHB3RootBus *bus = PNV_PHB3_ROOT_BUS(obj); 1123 uint64_t value = 0; 1124 1125 if (strcmp(name, "phb-id") == 0) { 1126 value = bus->phb_id; 1127 } else { 1128 value = bus->chip_id; 1129 } 1130 1131 visit_type_size(v, name, &value, errp); 1132 } 1133 1134 static void pnv_phb3_root_bus_set_prop(Object *obj, Visitor *v, 1135 const char *name, 1136 void *opaque, Error **errp) 1137 1138 { 1139 PnvPHB3RootBus *bus = PNV_PHB3_ROOT_BUS(obj); 1140 uint64_t value; 1141 1142 if (!visit_type_size(v, name, &value, errp)) { 1143 return; 1144 } 1145 1146 if (strcmp(name, "phb-id") == 0) { 1147 bus->phb_id = value; 1148 } else { 1149 bus->chip_id = value; 1150 } 1151 } 1152 1153 static void pnv_phb3_root_bus_class_init(ObjectClass *klass, const void *data) 1154 { 1155 BusClass *k = BUS_CLASS(klass); 1156 1157 object_class_property_add(klass, "phb-id", "int", 1158 pnv_phb3_root_bus_get_prop, 1159 pnv_phb3_root_bus_set_prop, 1160 NULL, NULL); 1161 1162 object_class_property_add(klass, "chip-id", "int", 1163 pnv_phb3_root_bus_get_prop, 1164 pnv_phb3_root_bus_set_prop, 1165 NULL, NULL); 1166 1167 /* 1168 * PHB3 has only a single root complex. Enforce the limit on the 1169 * parent bus 1170 */ 1171 k->max_dev = 1; 1172 } 1173 1174 static const TypeInfo pnv_phb3_root_bus_info = { 1175 .name = TYPE_PNV_PHB3_ROOT_BUS, 1176 .parent = TYPE_PCIE_BUS, 1177 .instance_size = sizeof(PnvPHB3RootBus), 1178 .class_init = pnv_phb3_root_bus_class_init, 1179 }; 1180 1181 static void pnv_phb3_register_types(void) 1182 { 1183 type_register_static(&pnv_phb3_root_bus_info); 1184 type_register_static(&pnv_phb3_type_info); 1185 type_register_static(&pnv_phb3_iommu_memory_region_info); 1186 } 1187 1188 type_init(pnv_phb3_register_types) 1189