1 /* 2 * QEMU PowerPC PowerNV (POWER8) PHB3 model 3 * 4 * Copyright (c) 2014-2020, IBM Corporation. 5 * 6 * This code is licensed under the GPL version 2 or later. See the 7 * COPYING file in the top-level directory. 8 */ 9 #include "qemu/osdep.h" 10 #include "qemu/log.h" 11 #include "qapi/visitor.h" 12 #include "qapi/error.h" 13 #include "qemu-common.h" 14 #include "hw/pci-host/pnv_phb3_regs.h" 15 #include "hw/pci-host/pnv_phb3.h" 16 #include "hw/pci/pcie_host.h" 17 #include "hw/pci/pcie_port.h" 18 #include "hw/ppc/pnv.h" 19 #include "hw/irq.h" 20 #include "hw/qdev-properties.h" 21 22 #define phb3_error(phb, fmt, ...) \ 23 qemu_log_mask(LOG_GUEST_ERROR, "phb3[%d:%d]: " fmt "\n", \ 24 (phb)->chip_id, (phb)->phb_id, ## __VA_ARGS__) 25 26 static PCIDevice *pnv_phb3_find_cfg_dev(PnvPHB3 *phb) 27 { 28 PCIHostState *pci = PCI_HOST_BRIDGE(phb); 29 uint64_t addr = phb->regs[PHB_CONFIG_ADDRESS >> 3]; 30 uint8_t bus, devfn; 31 32 if (!(addr >> 63)) { 33 return NULL; 34 } 35 bus = (addr >> 52) & 0xff; 36 devfn = (addr >> 44) & 0xff; 37 38 return pci_find_device(pci->bus, bus, devfn); 39 } 40 41 /* 42 * The CONFIG_DATA register expects little endian accesses, but as the 43 * region is big endian, we have to swap the value. 44 */ 45 static void pnv_phb3_config_write(PnvPHB3 *phb, unsigned off, 46 unsigned size, uint64_t val) 47 { 48 uint32_t cfg_addr, limit; 49 PCIDevice *pdev; 50 51 pdev = pnv_phb3_find_cfg_dev(phb); 52 if (!pdev) { 53 return; 54 } 55 cfg_addr = (phb->regs[PHB_CONFIG_ADDRESS >> 3] >> 32) & 0xffc; 56 cfg_addr |= off; 57 limit = pci_config_size(pdev); 58 if (limit <= cfg_addr) { 59 /* 60 * conventional pci device can be behind pcie-to-pci bridge. 61 * 256 <= addr < 4K has no effects. 62 */ 63 return; 64 } 65 switch (size) { 66 case 1: 67 break; 68 case 2: 69 val = bswap16(val); 70 break; 71 case 4: 72 val = bswap32(val); 73 break; 74 default: 75 g_assert_not_reached(); 76 } 77 pci_host_config_write_common(pdev, cfg_addr, limit, val, size); 78 } 79 80 static uint64_t pnv_phb3_config_read(PnvPHB3 *phb, unsigned off, 81 unsigned size) 82 { 83 uint32_t cfg_addr, limit; 84 PCIDevice *pdev; 85 uint64_t val; 86 87 pdev = pnv_phb3_find_cfg_dev(phb); 88 if (!pdev) { 89 return ~0ull; 90 } 91 cfg_addr = (phb->regs[PHB_CONFIG_ADDRESS >> 3] >> 32) & 0xffc; 92 cfg_addr |= off; 93 limit = pci_config_size(pdev); 94 if (limit <= cfg_addr) { 95 /* 96 * conventional pci device can be behind pcie-to-pci bridge. 97 * 256 <= addr < 4K has no effects. 98 */ 99 return ~0ull; 100 } 101 val = pci_host_config_read_common(pdev, cfg_addr, limit, size); 102 switch (size) { 103 case 1: 104 return val; 105 case 2: 106 return bswap16(val); 107 case 4: 108 return bswap32(val); 109 default: 110 g_assert_not_reached(); 111 } 112 } 113 114 static void pnv_phb3_check_m32(PnvPHB3 *phb) 115 { 116 uint64_t base, start, size; 117 MemoryRegion *parent; 118 PnvPBCQState *pbcq = &phb->pbcq; 119 120 if (memory_region_is_mapped(&phb->mr_m32)) { 121 memory_region_del_subregion(phb->mr_m32.container, &phb->mr_m32); 122 } 123 124 if (!(phb->regs[PHB_PHB3_CONFIG >> 3] & PHB_PHB3C_M32_EN)) { 125 return; 126 } 127 128 /* Grab geometry from registers */ 129 base = phb->regs[PHB_M32_BASE_ADDR >> 3]; 130 start = phb->regs[PHB_M32_START_ADDR >> 3]; 131 size = ~(phb->regs[PHB_M32_BASE_MASK >> 3] | 0xfffc000000000000ull) + 1; 132 133 /* Check if it matches an enabled MMIO region in the PBCQ */ 134 if (memory_region_is_mapped(&pbcq->mmbar0) && 135 base >= pbcq->mmio0_base && 136 (base + size) <= (pbcq->mmio0_base + pbcq->mmio0_size)) { 137 parent = &pbcq->mmbar0; 138 base -= pbcq->mmio0_base; 139 } else if (memory_region_is_mapped(&pbcq->mmbar1) && 140 base >= pbcq->mmio1_base && 141 (base + size) <= (pbcq->mmio1_base + pbcq->mmio1_size)) { 142 parent = &pbcq->mmbar1; 143 base -= pbcq->mmio1_base; 144 } else { 145 return; 146 } 147 148 /* Create alias */ 149 memory_region_init_alias(&phb->mr_m32, OBJECT(phb), "phb3-m32", 150 &phb->pci_mmio, start, size); 151 memory_region_add_subregion(parent, base, &phb->mr_m32); 152 } 153 154 static void pnv_phb3_check_m64(PnvPHB3 *phb, uint32_t index) 155 { 156 uint64_t base, start, size, m64; 157 MemoryRegion *parent; 158 PnvPBCQState *pbcq = &phb->pbcq; 159 160 if (memory_region_is_mapped(&phb->mr_m64[index])) { 161 /* Should we destroy it in RCU friendly way... ? */ 162 memory_region_del_subregion(phb->mr_m64[index].container, 163 &phb->mr_m64[index]); 164 } 165 166 /* Get table entry */ 167 m64 = phb->ioda_M64BT[index]; 168 169 if (!(m64 & IODA2_M64BT_ENABLE)) { 170 return; 171 } 172 173 /* Grab geometry from registers */ 174 base = GETFIELD(IODA2_M64BT_BASE, m64) << 20; 175 if (m64 & IODA2_M64BT_SINGLE_PE) { 176 base &= ~0x1ffffffull; 177 } 178 size = GETFIELD(IODA2_M64BT_MASK, m64) << 20; 179 size |= 0xfffc000000000000ull; 180 size = ~size + 1; 181 start = base | (phb->regs[PHB_M64_UPPER_BITS >> 3]); 182 183 /* Check if it matches an enabled MMIO region in the PBCQ */ 184 if (memory_region_is_mapped(&pbcq->mmbar0) && 185 base >= pbcq->mmio0_base && 186 (base + size) <= (pbcq->mmio0_base + pbcq->mmio0_size)) { 187 parent = &pbcq->mmbar0; 188 base -= pbcq->mmio0_base; 189 } else if (memory_region_is_mapped(&pbcq->mmbar1) && 190 base >= pbcq->mmio1_base && 191 (base + size) <= (pbcq->mmio1_base + pbcq->mmio1_size)) { 192 parent = &pbcq->mmbar1; 193 base -= pbcq->mmio1_base; 194 } else { 195 return; 196 } 197 198 /* Create alias */ 199 memory_region_init_alias(&phb->mr_m64[index], OBJECT(phb), "phb3-m64", 200 &phb->pci_mmio, start, size); 201 memory_region_add_subregion(parent, base, &phb->mr_m64[index]); 202 } 203 204 static void pnv_phb3_check_all_m64s(PnvPHB3 *phb) 205 { 206 uint64_t i; 207 208 for (i = 0; i < PNV_PHB3_NUM_M64; i++) { 209 pnv_phb3_check_m64(phb, i); 210 } 211 } 212 213 static void pnv_phb3_lxivt_write(PnvPHB3 *phb, unsigned idx, uint64_t val) 214 { 215 uint8_t server, prio; 216 217 phb->ioda_LXIVT[idx] = val & (IODA2_LXIVT_SERVER | 218 IODA2_LXIVT_PRIORITY | 219 IODA2_LXIVT_NODE_ID); 220 server = GETFIELD(IODA2_LXIVT_SERVER, val); 221 prio = GETFIELD(IODA2_LXIVT_PRIORITY, val); 222 223 /* 224 * The low order 2 bits are the link pointer (Type II interrupts). 225 * Shift back to get a valid IRQ server. 226 */ 227 server >>= 2; 228 229 ics_write_xive(&phb->lsis, idx, server, prio, prio); 230 } 231 232 static uint64_t *pnv_phb3_ioda_access(PnvPHB3 *phb, 233 unsigned *out_table, unsigned *out_idx) 234 { 235 uint64_t adreg = phb->regs[PHB_IODA_ADDR >> 3]; 236 unsigned int index = GETFIELD(PHB_IODA_AD_TADR, adreg); 237 unsigned int table = GETFIELD(PHB_IODA_AD_TSEL, adreg); 238 unsigned int mask; 239 uint64_t *tptr = NULL; 240 241 switch (table) { 242 case IODA2_TBL_LIST: 243 tptr = phb->ioda_LIST; 244 mask = 7; 245 break; 246 case IODA2_TBL_LXIVT: 247 tptr = phb->ioda_LXIVT; 248 mask = 7; 249 break; 250 case IODA2_TBL_IVC_CAM: 251 case IODA2_TBL_RBA: 252 mask = 31; 253 break; 254 case IODA2_TBL_RCAM: 255 mask = 63; 256 break; 257 case IODA2_TBL_MRT: 258 mask = 7; 259 break; 260 case IODA2_TBL_PESTA: 261 case IODA2_TBL_PESTB: 262 mask = 255; 263 break; 264 case IODA2_TBL_TVT: 265 tptr = phb->ioda_TVT; 266 mask = 511; 267 break; 268 case IODA2_TBL_TCAM: 269 case IODA2_TBL_TDR: 270 mask = 63; 271 break; 272 case IODA2_TBL_M64BT: 273 tptr = phb->ioda_M64BT; 274 mask = 15; 275 break; 276 case IODA2_TBL_M32DT: 277 tptr = phb->ioda_MDT; 278 mask = 255; 279 break; 280 case IODA2_TBL_PEEV: 281 tptr = phb->ioda_PEEV; 282 mask = 3; 283 break; 284 default: 285 phb3_error(phb, "invalid IODA table %d", table); 286 return NULL; 287 } 288 index &= mask; 289 if (out_idx) { 290 *out_idx = index; 291 } 292 if (out_table) { 293 *out_table = table; 294 } 295 if (tptr) { 296 tptr += index; 297 } 298 if (adreg & PHB_IODA_AD_AUTOINC) { 299 index = (index + 1) & mask; 300 adreg = SETFIELD(PHB_IODA_AD_TADR, adreg, index); 301 } 302 phb->regs[PHB_IODA_ADDR >> 3] = adreg; 303 return tptr; 304 } 305 306 static uint64_t pnv_phb3_ioda_read(PnvPHB3 *phb) 307 { 308 unsigned table; 309 uint64_t *tptr; 310 311 tptr = pnv_phb3_ioda_access(phb, &table, NULL); 312 if (!tptr) { 313 /* Return 0 on unsupported tables, not ff's */ 314 return 0; 315 } 316 return *tptr; 317 } 318 319 static void pnv_phb3_ioda_write(PnvPHB3 *phb, uint64_t val) 320 { 321 unsigned table, idx; 322 uint64_t *tptr; 323 324 tptr = pnv_phb3_ioda_access(phb, &table, &idx); 325 if (!tptr) { 326 return; 327 } 328 329 /* Handle side effects */ 330 switch (table) { 331 case IODA2_TBL_LXIVT: 332 pnv_phb3_lxivt_write(phb, idx, val); 333 break; 334 case IODA2_TBL_M64BT: 335 *tptr = val; 336 pnv_phb3_check_m64(phb, idx); 337 break; 338 default: 339 *tptr = val; 340 } 341 } 342 343 /* 344 * This is called whenever the PHB LSI, MSI source ID register or 345 * the PBCQ irq filters are written. 346 */ 347 void pnv_phb3_remap_irqs(PnvPHB3 *phb) 348 { 349 ICSState *ics = &phb->lsis; 350 uint32_t local, global, count, mask, comp; 351 uint64_t baren; 352 PnvPBCQState *pbcq = &phb->pbcq; 353 354 /* 355 * First check if we are enabled. Unlike real HW we don't separate 356 * TX and RX so we enable if both are set 357 */ 358 baren = pbcq->nest_regs[PBCQ_NEST_BAR_EN]; 359 if (!(baren & PBCQ_NEST_BAR_EN_IRSN_RX) || 360 !(baren & PBCQ_NEST_BAR_EN_IRSN_TX)) { 361 ics->offset = 0; 362 return; 363 } 364 365 /* Grab local LSI source ID */ 366 local = GETFIELD(PHB_LSI_SRC_ID, phb->regs[PHB_LSI_SOURCE_ID >> 3]) << 3; 367 368 /* Grab global one and compare */ 369 global = GETFIELD(PBCQ_NEST_LSI_SRC, 370 pbcq->nest_regs[PBCQ_NEST_LSI_SRC_ID]) << 3; 371 if (global != local) { 372 /* 373 * This happens during initialization, let's come back when we 374 * are properly configured 375 */ 376 ics->offset = 0; 377 return; 378 } 379 380 /* Get the base on the powerbus */ 381 comp = GETFIELD(PBCQ_NEST_IRSN_COMP, 382 pbcq->nest_regs[PBCQ_NEST_IRSN_COMPARE]); 383 mask = GETFIELD(PBCQ_NEST_IRSN_COMP, 384 pbcq->nest_regs[PBCQ_NEST_IRSN_MASK]); 385 count = ((~mask) + 1) & 0x7ffff; 386 phb->total_irq = count; 387 388 /* Sanity checks */ 389 if ((global + PNV_PHB3_NUM_LSI) > count) { 390 phb3_error(phb, "LSIs out of reach: LSI base=%d total irq=%d", global, 391 count); 392 } 393 394 if (count > 2048) { 395 phb3_error(phb, "More interrupts than supported: %d", count); 396 } 397 398 if ((comp & mask) != comp) { 399 phb3_error(phb, "IRQ compare bits not in mask: comp=0x%x mask=0x%x", 400 comp, mask); 401 comp &= mask; 402 } 403 /* Setup LSI offset */ 404 ics->offset = comp + global; 405 406 /* Setup MSI offset */ 407 pnv_phb3_msi_update_config(&phb->msis, comp, count - PNV_PHB3_NUM_LSI); 408 } 409 410 static void pnv_phb3_lsi_src_id_write(PnvPHB3 *phb, uint64_t val) 411 { 412 /* Sanitize content */ 413 val &= PHB_LSI_SRC_ID; 414 phb->regs[PHB_LSI_SOURCE_ID >> 3] = val; 415 pnv_phb3_remap_irqs(phb); 416 } 417 418 static void pnv_phb3_rtc_invalidate(PnvPHB3 *phb, uint64_t val) 419 { 420 PnvPhb3DMASpace *ds; 421 422 /* Always invalidate all for now ... */ 423 QLIST_FOREACH(ds, &phb->dma_spaces, list) { 424 ds->pe_num = PHB_INVALID_PE; 425 } 426 } 427 428 429 static void pnv_phb3_update_msi_regions(PnvPhb3DMASpace *ds) 430 { 431 uint64_t cfg = ds->phb->regs[PHB_PHB3_CONFIG >> 3]; 432 433 if (cfg & PHB_PHB3C_32BIT_MSI_EN) { 434 if (!memory_region_is_mapped(&ds->msi32_mr)) { 435 memory_region_add_subregion(MEMORY_REGION(&ds->dma_mr), 436 0xffff0000, &ds->msi32_mr); 437 } 438 } else { 439 if (memory_region_is_mapped(&ds->msi32_mr)) { 440 memory_region_del_subregion(MEMORY_REGION(&ds->dma_mr), 441 &ds->msi32_mr); 442 } 443 } 444 445 if (cfg & PHB_PHB3C_64BIT_MSI_EN) { 446 if (!memory_region_is_mapped(&ds->msi64_mr)) { 447 memory_region_add_subregion(MEMORY_REGION(&ds->dma_mr), 448 (1ull << 60), &ds->msi64_mr); 449 } 450 } else { 451 if (memory_region_is_mapped(&ds->msi64_mr)) { 452 memory_region_del_subregion(MEMORY_REGION(&ds->dma_mr), 453 &ds->msi64_mr); 454 } 455 } 456 } 457 458 static void pnv_phb3_update_all_msi_regions(PnvPHB3 *phb) 459 { 460 PnvPhb3DMASpace *ds; 461 462 QLIST_FOREACH(ds, &phb->dma_spaces, list) { 463 pnv_phb3_update_msi_regions(ds); 464 } 465 } 466 467 void pnv_phb3_reg_write(void *opaque, hwaddr off, uint64_t val, unsigned size) 468 { 469 PnvPHB3 *phb = opaque; 470 bool changed; 471 472 /* Special case configuration data */ 473 if ((off & 0xfffc) == PHB_CONFIG_DATA) { 474 pnv_phb3_config_write(phb, off & 0x3, size, val); 475 return; 476 } 477 478 /* Other registers are 64-bit only */ 479 if (size != 8 || off & 0x7) { 480 phb3_error(phb, "Invalid register access, offset: 0x%"PRIx64" size: %d", 481 off, size); 482 return; 483 } 484 485 /* Handle masking & filtering */ 486 switch (off) { 487 case PHB_M64_UPPER_BITS: 488 val &= 0xfffc000000000000ull; 489 break; 490 case PHB_Q_DMA_R: 491 /* 492 * This is enough logic to make SW happy but we aren't actually 493 * quiescing the DMAs 494 */ 495 if (val & PHB_Q_DMA_R_AUTORESET) { 496 val = 0; 497 } else { 498 val &= PHB_Q_DMA_R_QUIESCE_DMA; 499 } 500 break; 501 /* LEM stuff */ 502 case PHB_LEM_FIR_AND_MASK: 503 phb->regs[PHB_LEM_FIR_ACCUM >> 3] &= val; 504 return; 505 case PHB_LEM_FIR_OR_MASK: 506 phb->regs[PHB_LEM_FIR_ACCUM >> 3] |= val; 507 return; 508 case PHB_LEM_ERROR_AND_MASK: 509 phb->regs[PHB_LEM_ERROR_MASK >> 3] &= val; 510 return; 511 case PHB_LEM_ERROR_OR_MASK: 512 phb->regs[PHB_LEM_ERROR_MASK >> 3] |= val; 513 return; 514 case PHB_LEM_WOF: 515 val = 0; 516 break; 517 } 518 519 /* Record whether it changed */ 520 changed = phb->regs[off >> 3] != val; 521 522 /* Store in register cache first */ 523 phb->regs[off >> 3] = val; 524 525 /* Handle side effects */ 526 switch (off) { 527 case PHB_PHB3_CONFIG: 528 if (changed) { 529 pnv_phb3_update_all_msi_regions(phb); 530 } 531 /* fall through */ 532 case PHB_M32_BASE_ADDR: 533 case PHB_M32_BASE_MASK: 534 case PHB_M32_START_ADDR: 535 if (changed) { 536 pnv_phb3_check_m32(phb); 537 } 538 break; 539 case PHB_M64_UPPER_BITS: 540 if (changed) { 541 pnv_phb3_check_all_m64s(phb); 542 } 543 break; 544 case PHB_LSI_SOURCE_ID: 545 if (changed) { 546 pnv_phb3_lsi_src_id_write(phb, val); 547 } 548 break; 549 550 /* IODA table accesses */ 551 case PHB_IODA_DATA0: 552 pnv_phb3_ioda_write(phb, val); 553 break; 554 555 /* RTC invalidation */ 556 case PHB_RTC_INVALIDATE: 557 pnv_phb3_rtc_invalidate(phb, val); 558 break; 559 560 /* FFI request */ 561 case PHB_FFI_REQUEST: 562 pnv_phb3_msi_ffi(&phb->msis, val); 563 break; 564 565 /* Silent simple writes */ 566 case PHB_CONFIG_ADDRESS: 567 case PHB_IODA_ADDR: 568 case PHB_TCE_KILL: 569 case PHB_TCE_SPEC_CTL: 570 case PHB_PEST_BAR: 571 case PHB_PELTV_BAR: 572 case PHB_RTT_BAR: 573 case PHB_RBA_BAR: 574 case PHB_IVT_BAR: 575 case PHB_FFI_LOCK: 576 case PHB_LEM_FIR_ACCUM: 577 case PHB_LEM_ERROR_MASK: 578 case PHB_LEM_ACTION0: 579 case PHB_LEM_ACTION1: 580 break; 581 582 /* Noise on anything else */ 583 default: 584 qemu_log_mask(LOG_UNIMP, "phb3: reg_write 0x%"PRIx64"=%"PRIx64"\n", 585 off, val); 586 } 587 } 588 589 uint64_t pnv_phb3_reg_read(void *opaque, hwaddr off, unsigned size) 590 { 591 PnvPHB3 *phb = opaque; 592 PCIHostState *pci = PCI_HOST_BRIDGE(phb); 593 uint64_t val; 594 595 if ((off & 0xfffc) == PHB_CONFIG_DATA) { 596 return pnv_phb3_config_read(phb, off & 0x3, size); 597 } 598 599 /* Other registers are 64-bit only */ 600 if (size != 8 || off & 0x7) { 601 phb3_error(phb, "Invalid register access, offset: 0x%"PRIx64" size: %d", 602 off, size); 603 return ~0ull; 604 } 605 606 /* Default read from cache */ 607 val = phb->regs[off >> 3]; 608 609 switch (off) { 610 /* Simulate venice DD2.0 */ 611 case PHB_VERSION: 612 return 0x000000a300000005ull; 613 case PHB_PCIE_SYSTEM_CONFIG: 614 return 0x441100fc30000000; 615 616 /* IODA table accesses */ 617 case PHB_IODA_DATA0: 618 return pnv_phb3_ioda_read(phb); 619 620 /* Link training always appears trained */ 621 case PHB_PCIE_DLP_TRAIN_CTL: 622 if (!pci_find_device(pci->bus, 1, 0)) { 623 return 0; 624 } 625 return PHB_PCIE_DLP_INBAND_PRESENCE | PHB_PCIE_DLP_TC_DL_LINKACT; 626 627 /* FFI Lock */ 628 case PHB_FFI_LOCK: 629 /* Set lock and return previous value */ 630 phb->regs[off >> 3] |= PHB_FFI_LOCK_STATE; 631 return val; 632 633 /* DMA read sync: make it look like it's complete */ 634 case PHB_DMARD_SYNC: 635 return PHB_DMARD_SYNC_COMPLETE; 636 637 /* Silent simple reads */ 638 case PHB_PHB3_CONFIG: 639 case PHB_M32_BASE_ADDR: 640 case PHB_M32_BASE_MASK: 641 case PHB_M32_START_ADDR: 642 case PHB_CONFIG_ADDRESS: 643 case PHB_IODA_ADDR: 644 case PHB_RTC_INVALIDATE: 645 case PHB_TCE_KILL: 646 case PHB_TCE_SPEC_CTL: 647 case PHB_PEST_BAR: 648 case PHB_PELTV_BAR: 649 case PHB_RTT_BAR: 650 case PHB_RBA_BAR: 651 case PHB_IVT_BAR: 652 case PHB_M64_UPPER_BITS: 653 case PHB_LEM_FIR_ACCUM: 654 case PHB_LEM_ERROR_MASK: 655 case PHB_LEM_ACTION0: 656 case PHB_LEM_ACTION1: 657 break; 658 659 /* Noise on anything else */ 660 default: 661 qemu_log_mask(LOG_UNIMP, "phb3: reg_read 0x%"PRIx64"=%"PRIx64"\n", 662 off, val); 663 } 664 return val; 665 } 666 667 static const MemoryRegionOps pnv_phb3_reg_ops = { 668 .read = pnv_phb3_reg_read, 669 .write = pnv_phb3_reg_write, 670 .valid.min_access_size = 1, 671 .valid.max_access_size = 8, 672 .impl.min_access_size = 1, 673 .impl.max_access_size = 8, 674 .endianness = DEVICE_BIG_ENDIAN, 675 }; 676 677 static int pnv_phb3_map_irq(PCIDevice *pci_dev, int irq_num) 678 { 679 /* Check that out properly ... */ 680 return irq_num & 3; 681 } 682 683 static void pnv_phb3_set_irq(void *opaque, int irq_num, int level) 684 { 685 PnvPHB3 *phb = opaque; 686 687 /* LSI only ... */ 688 if (irq_num > 3) { 689 phb3_error(phb, "Unknown IRQ to set %d", irq_num); 690 } 691 qemu_set_irq(phb->qirqs[irq_num], level); 692 } 693 694 static bool pnv_phb3_resolve_pe(PnvPhb3DMASpace *ds) 695 { 696 uint64_t rtt, addr; 697 uint16_t rte; 698 int bus_num; 699 700 /* Already resolved ? */ 701 if (ds->pe_num != PHB_INVALID_PE) { 702 return true; 703 } 704 705 /* We need to lookup the RTT */ 706 rtt = ds->phb->regs[PHB_RTT_BAR >> 3]; 707 if (!(rtt & PHB_RTT_BAR_ENABLE)) { 708 phb3_error(ds->phb, "DMA with RTT BAR disabled !"); 709 /* Set error bits ? fence ? ... */ 710 return false; 711 } 712 713 /* Read RTE */ 714 bus_num = pci_bus_num(ds->bus); 715 addr = rtt & PHB_RTT_BASE_ADDRESS_MASK; 716 addr += 2 * ((bus_num << 8) | ds->devfn); 717 if (dma_memory_read(&address_space_memory, addr, &rte, sizeof(rte))) { 718 phb3_error(ds->phb, "Failed to read RTT entry at 0x%"PRIx64, addr); 719 /* Set error bits ? fence ? ... */ 720 return false; 721 } 722 rte = be16_to_cpu(rte); 723 724 /* Fail upon reading of invalid PE# */ 725 if (rte >= PNV_PHB3_NUM_PE) { 726 phb3_error(ds->phb, "RTE for RID 0x%x invalid (%04x", ds->devfn, rte); 727 /* Set error bits ? fence ? ... */ 728 return false; 729 } 730 ds->pe_num = rte; 731 return true; 732 } 733 734 static void pnv_phb3_translate_tve(PnvPhb3DMASpace *ds, hwaddr addr, 735 bool is_write, uint64_t tve, 736 IOMMUTLBEntry *tlb) 737 { 738 uint64_t tta = GETFIELD(IODA2_TVT_TABLE_ADDR, tve); 739 int32_t lev = GETFIELD(IODA2_TVT_NUM_LEVELS, tve); 740 uint32_t tts = GETFIELD(IODA2_TVT_TCE_TABLE_SIZE, tve); 741 uint32_t tps = GETFIELD(IODA2_TVT_IO_PSIZE, tve); 742 PnvPHB3 *phb = ds->phb; 743 744 /* Invalid levels */ 745 if (lev > 4) { 746 phb3_error(phb, "Invalid #levels in TVE %d", lev); 747 return; 748 } 749 750 /* IO Page Size of 0 means untranslated, else use TCEs */ 751 if (tps == 0) { 752 /* 753 * We only support non-translate in top window. 754 * 755 * TODO: Venice/Murano support it on bottom window above 4G and 756 * Naples suports it on everything 757 */ 758 if (!(tve & PPC_BIT(51))) { 759 phb3_error(phb, "xlate for invalid non-translate TVE"); 760 return; 761 } 762 /* TODO: Handle boundaries */ 763 764 /* Use 4k pages like q35 ... for now */ 765 tlb->iova = addr & 0xfffffffffffff000ull; 766 tlb->translated_addr = addr & 0x0003fffffffff000ull; 767 tlb->addr_mask = 0xfffull; 768 tlb->perm = IOMMU_RW; 769 } else { 770 uint32_t tce_shift, tbl_shift, sh; 771 uint64_t base, taddr, tce, tce_mask; 772 773 /* TVE disabled ? */ 774 if (tts == 0) { 775 phb3_error(phb, "xlate for invalid translated TVE"); 776 return; 777 } 778 779 /* Address bits per bottom level TCE entry */ 780 tce_shift = tps + 11; 781 782 /* Address bits per table level */ 783 tbl_shift = tts + 8; 784 785 /* Top level table base address */ 786 base = tta << 12; 787 788 /* Total shift to first level */ 789 sh = tbl_shift * lev + tce_shift; 790 791 /* TODO: Multi-level untested */ 792 while ((lev--) >= 0) { 793 /* Grab the TCE address */ 794 taddr = base | (((addr >> sh) & ((1ul << tbl_shift) - 1)) << 3); 795 if (dma_memory_read(&address_space_memory, taddr, &tce, 796 sizeof(tce))) { 797 phb3_error(phb, "Failed to read TCE at 0x%"PRIx64, taddr); 798 return; 799 } 800 tce = be64_to_cpu(tce); 801 802 /* Check permission for indirect TCE */ 803 if ((lev >= 0) && !(tce & 3)) { 804 phb3_error(phb, "Invalid indirect TCE at 0x%"PRIx64, taddr); 805 phb3_error(phb, " xlate %"PRIx64":%c TVE=%"PRIx64, addr, 806 is_write ? 'W' : 'R', tve); 807 phb3_error(phb, " tta=%"PRIx64" lev=%d tts=%d tps=%d", 808 tta, lev, tts, tps); 809 return; 810 } 811 sh -= tbl_shift; 812 base = tce & ~0xfffull; 813 } 814 815 /* We exit the loop with TCE being the final TCE */ 816 tce_mask = ~((1ull << tce_shift) - 1); 817 tlb->iova = addr & tce_mask; 818 tlb->translated_addr = tce & tce_mask; 819 tlb->addr_mask = ~tce_mask; 820 tlb->perm = tce & 3; 821 if ((is_write & !(tce & 2)) || ((!is_write) && !(tce & 1))) { 822 phb3_error(phb, "TCE access fault at 0x%"PRIx64, taddr); 823 phb3_error(phb, " xlate %"PRIx64":%c TVE=%"PRIx64, addr, 824 is_write ? 'W' : 'R', tve); 825 phb3_error(phb, " tta=%"PRIx64" lev=%d tts=%d tps=%d", 826 tta, lev, tts, tps); 827 } 828 } 829 } 830 831 static IOMMUTLBEntry pnv_phb3_translate_iommu(IOMMUMemoryRegion *iommu, 832 hwaddr addr, 833 IOMMUAccessFlags flag, 834 int iommu_idx) 835 { 836 PnvPhb3DMASpace *ds = container_of(iommu, PnvPhb3DMASpace, dma_mr); 837 int tve_sel; 838 uint64_t tve, cfg; 839 IOMMUTLBEntry ret = { 840 .target_as = &address_space_memory, 841 .iova = addr, 842 .translated_addr = 0, 843 .addr_mask = ~(hwaddr)0, 844 .perm = IOMMU_NONE, 845 }; 846 PnvPHB3 *phb = ds->phb; 847 848 /* Resolve PE# */ 849 if (!pnv_phb3_resolve_pe(ds)) { 850 phb3_error(phb, "Failed to resolve PE# for bus @%p (%d) devfn 0x%x", 851 ds->bus, pci_bus_num(ds->bus), ds->devfn); 852 return ret; 853 } 854 855 /* Check top bits */ 856 switch (addr >> 60) { 857 case 00: 858 /* DMA or 32-bit MSI ? */ 859 cfg = ds->phb->regs[PHB_PHB3_CONFIG >> 3]; 860 if ((cfg & PHB_PHB3C_32BIT_MSI_EN) && 861 ((addr & 0xffffffffffff0000ull) == 0xffff0000ull)) { 862 phb3_error(phb, "xlate on 32-bit MSI region"); 863 return ret; 864 } 865 /* Choose TVE XXX Use PHB3 Control Register */ 866 tve_sel = (addr >> 59) & 1; 867 tve = ds->phb->ioda_TVT[ds->pe_num * 2 + tve_sel]; 868 pnv_phb3_translate_tve(ds, addr, flag & IOMMU_WO, tve, &ret); 869 break; 870 case 01: 871 phb3_error(phb, "xlate on 64-bit MSI region"); 872 break; 873 default: 874 phb3_error(phb, "xlate on unsupported address 0x%"PRIx64, addr); 875 } 876 return ret; 877 } 878 879 #define TYPE_PNV_PHB3_IOMMU_MEMORY_REGION "pnv-phb3-iommu-memory-region" 880 #define PNV_PHB3_IOMMU_MEMORY_REGION(obj) \ 881 OBJECT_CHECK(IOMMUMemoryRegion, (obj), TYPE_PNV_PHB3_IOMMU_MEMORY_REGION) 882 883 static void pnv_phb3_iommu_memory_region_class_init(ObjectClass *klass, 884 void *data) 885 { 886 IOMMUMemoryRegionClass *imrc = IOMMU_MEMORY_REGION_CLASS(klass); 887 888 imrc->translate = pnv_phb3_translate_iommu; 889 } 890 891 static const TypeInfo pnv_phb3_iommu_memory_region_info = { 892 .parent = TYPE_IOMMU_MEMORY_REGION, 893 .name = TYPE_PNV_PHB3_IOMMU_MEMORY_REGION, 894 .class_init = pnv_phb3_iommu_memory_region_class_init, 895 }; 896 897 /* 898 * MSI/MSIX memory region implementation. 899 * The handler handles both MSI and MSIX. 900 */ 901 static void pnv_phb3_msi_write(void *opaque, hwaddr addr, 902 uint64_t data, unsigned size) 903 { 904 PnvPhb3DMASpace *ds = opaque; 905 906 /* Resolve PE# */ 907 if (!pnv_phb3_resolve_pe(ds)) { 908 phb3_error(ds->phb, "Failed to resolve PE# for bus @%p (%d) devfn 0x%x", 909 ds->bus, pci_bus_num(ds->bus), ds->devfn); 910 return; 911 } 912 913 pnv_phb3_msi_send(&ds->phb->msis, addr, data, ds->pe_num); 914 } 915 916 /* There is no .read as the read result is undefined by PCI spec */ 917 static uint64_t pnv_phb3_msi_read(void *opaque, hwaddr addr, unsigned size) 918 { 919 PnvPhb3DMASpace *ds = opaque; 920 921 phb3_error(ds->phb, "invalid read @ 0x%" HWADDR_PRIx, addr); 922 return -1; 923 } 924 925 static const MemoryRegionOps pnv_phb3_msi_ops = { 926 .read = pnv_phb3_msi_read, 927 .write = pnv_phb3_msi_write, 928 .endianness = DEVICE_LITTLE_ENDIAN 929 }; 930 931 static AddressSpace *pnv_phb3_dma_iommu(PCIBus *bus, void *opaque, int devfn) 932 { 933 PnvPHB3 *phb = opaque; 934 PnvPhb3DMASpace *ds; 935 936 QLIST_FOREACH(ds, &phb->dma_spaces, list) { 937 if (ds->bus == bus && ds->devfn == devfn) { 938 break; 939 } 940 } 941 942 if (ds == NULL) { 943 ds = g_malloc0(sizeof(PnvPhb3DMASpace)); 944 ds->bus = bus; 945 ds->devfn = devfn; 946 ds->pe_num = PHB_INVALID_PE; 947 ds->phb = phb; 948 memory_region_init_iommu(&ds->dma_mr, sizeof(ds->dma_mr), 949 TYPE_PNV_PHB3_IOMMU_MEMORY_REGION, 950 OBJECT(phb), "phb3_iommu", UINT64_MAX); 951 address_space_init(&ds->dma_as, MEMORY_REGION(&ds->dma_mr), 952 "phb3_iommu"); 953 memory_region_init_io(&ds->msi32_mr, OBJECT(phb), &pnv_phb3_msi_ops, 954 ds, "msi32", 0x10000); 955 memory_region_init_io(&ds->msi64_mr, OBJECT(phb), &pnv_phb3_msi_ops, 956 ds, "msi64", 0x100000); 957 pnv_phb3_update_msi_regions(ds); 958 959 QLIST_INSERT_HEAD(&phb->dma_spaces, ds, list); 960 } 961 return &ds->dma_as; 962 } 963 964 static void pnv_phb3_instance_init(Object *obj) 965 { 966 PnvPHB3 *phb = PNV_PHB3(obj); 967 968 QLIST_INIT(&phb->dma_spaces); 969 970 /* LSI sources */ 971 object_initialize_child(obj, "lsi", &phb->lsis, TYPE_ICS); 972 973 /* Default init ... will be fixed by HW inits */ 974 phb->lsis.offset = 0; 975 976 /* MSI sources */ 977 object_initialize_child(obj, "msi", &phb->msis, TYPE_PHB3_MSI); 978 979 /* Power Bus Common Queue */ 980 object_initialize_child(obj, "pbcq", &phb->pbcq, TYPE_PNV_PBCQ); 981 982 /* Root Port */ 983 object_initialize_child(obj, "root", &phb->root, TYPE_PNV_PHB3_ROOT_PORT); 984 qdev_prop_set_int32(DEVICE(&phb->root), "addr", PCI_DEVFN(0, 0)); 985 qdev_prop_set_bit(DEVICE(&phb->root), "multifunction", false); 986 } 987 988 static void pnv_phb3_realize(DeviceState *dev, Error **errp) 989 { 990 PnvPHB3 *phb = PNV_PHB3(dev); 991 PCIHostState *pci = PCI_HOST_BRIDGE(dev); 992 PnvMachineState *pnv = PNV_MACHINE(qdev_get_machine()); 993 int i; 994 995 if (phb->phb_id >= PNV8_CHIP_PHB3_MAX) { 996 error_setg(errp, "invalid PHB index: %d", phb->phb_id); 997 return; 998 } 999 1000 /* LSI sources */ 1001 object_property_set_link(OBJECT(&phb->lsis), "xics", OBJECT(pnv), 1002 &error_abort); 1003 object_property_set_int(OBJECT(&phb->lsis), "nr-irqs", PNV_PHB3_NUM_LSI, 1004 &error_abort); 1005 if (!qdev_realize(DEVICE(&phb->lsis), NULL, errp)) { 1006 return; 1007 } 1008 1009 for (i = 0; i < phb->lsis.nr_irqs; i++) { 1010 ics_set_irq_type(&phb->lsis, i, true); 1011 } 1012 1013 phb->qirqs = qemu_allocate_irqs(ics_set_irq, &phb->lsis, phb->lsis.nr_irqs); 1014 1015 /* MSI sources */ 1016 object_property_set_link(OBJECT(&phb->msis), "phb", OBJECT(phb), 1017 &error_abort); 1018 object_property_set_link(OBJECT(&phb->msis), "xics", OBJECT(pnv), 1019 &error_abort); 1020 object_property_set_int(OBJECT(&phb->msis), "nr-irqs", PHB3_MAX_MSI, 1021 &error_abort); 1022 if (!qdev_realize(DEVICE(&phb->msis), NULL, errp)) { 1023 return; 1024 } 1025 1026 /* Power Bus Common Queue */ 1027 object_property_set_link(OBJECT(&phb->pbcq), "phb", OBJECT(phb), 1028 &error_abort); 1029 if (!qdev_realize(DEVICE(&phb->pbcq), NULL, errp)) { 1030 return; 1031 } 1032 1033 /* Controller Registers */ 1034 memory_region_init_io(&phb->mr_regs, OBJECT(phb), &pnv_phb3_reg_ops, phb, 1035 "phb3-regs", 0x1000); 1036 1037 /* 1038 * PHB3 doesn't support IO space. However, qemu gets very upset if 1039 * we don't have an IO region to anchor IO BARs onto so we just 1040 * initialize one which we never hook up to anything 1041 */ 1042 memory_region_init(&phb->pci_io, OBJECT(phb), "pci-io", 0x10000); 1043 memory_region_init(&phb->pci_mmio, OBJECT(phb), "pci-mmio", 1044 PCI_MMIO_TOTAL_SIZE); 1045 1046 pci->bus = pci_register_root_bus(dev, "root-bus", 1047 pnv_phb3_set_irq, pnv_phb3_map_irq, phb, 1048 &phb->pci_mmio, &phb->pci_io, 1049 0, 4, TYPE_PNV_PHB3_ROOT_BUS); 1050 1051 pci_setup_iommu(pci->bus, pnv_phb3_dma_iommu, phb); 1052 1053 /* Add a single Root port */ 1054 qdev_prop_set_uint8(DEVICE(&phb->root), "chassis", phb->chip_id); 1055 qdev_prop_set_uint16(DEVICE(&phb->root), "slot", phb->phb_id); 1056 qdev_realize(DEVICE(&phb->root), BUS(pci->bus), &error_fatal); 1057 } 1058 1059 void pnv_phb3_update_regions(PnvPHB3 *phb) 1060 { 1061 PnvPBCQState *pbcq = &phb->pbcq; 1062 1063 /* Unmap first always */ 1064 if (memory_region_is_mapped(&phb->mr_regs)) { 1065 memory_region_del_subregion(&pbcq->phbbar, &phb->mr_regs); 1066 } 1067 1068 /* Map registers if enabled */ 1069 if (memory_region_is_mapped(&pbcq->phbbar)) { 1070 /* TODO: We should use the PHB BAR 2 register but we don't ... */ 1071 memory_region_add_subregion(&pbcq->phbbar, 0, &phb->mr_regs); 1072 } 1073 1074 /* Check/update m32 */ 1075 if (memory_region_is_mapped(&phb->mr_m32)) { 1076 pnv_phb3_check_m32(phb); 1077 } 1078 pnv_phb3_check_all_m64s(phb); 1079 } 1080 1081 static const char *pnv_phb3_root_bus_path(PCIHostState *host_bridge, 1082 PCIBus *rootbus) 1083 { 1084 PnvPHB3 *phb = PNV_PHB3(host_bridge); 1085 1086 snprintf(phb->bus_path, sizeof(phb->bus_path), "00%02x:%02x", 1087 phb->chip_id, phb->phb_id); 1088 return phb->bus_path; 1089 } 1090 1091 static Property pnv_phb3_properties[] = { 1092 DEFINE_PROP_UINT32("index", PnvPHB3, phb_id, 0), 1093 DEFINE_PROP_UINT32("chip-id", PnvPHB3, chip_id, 0), 1094 DEFINE_PROP_END_OF_LIST(), 1095 }; 1096 1097 static void pnv_phb3_class_init(ObjectClass *klass, void *data) 1098 { 1099 PCIHostBridgeClass *hc = PCI_HOST_BRIDGE_CLASS(klass); 1100 DeviceClass *dc = DEVICE_CLASS(klass); 1101 1102 hc->root_bus_path = pnv_phb3_root_bus_path; 1103 dc->realize = pnv_phb3_realize; 1104 device_class_set_props(dc, pnv_phb3_properties); 1105 set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories); 1106 dc->user_creatable = false; 1107 } 1108 1109 static const TypeInfo pnv_phb3_type_info = { 1110 .name = TYPE_PNV_PHB3, 1111 .parent = TYPE_PCIE_HOST_BRIDGE, 1112 .instance_size = sizeof(PnvPHB3), 1113 .class_init = pnv_phb3_class_init, 1114 .instance_init = pnv_phb3_instance_init, 1115 }; 1116 1117 static void pnv_phb3_root_bus_class_init(ObjectClass *klass, void *data) 1118 { 1119 BusClass *k = BUS_CLASS(klass); 1120 1121 /* 1122 * PHB3 has only a single root complex. Enforce the limit on the 1123 * parent bus 1124 */ 1125 k->max_dev = 1; 1126 } 1127 1128 static const TypeInfo pnv_phb3_root_bus_info = { 1129 .name = TYPE_PNV_PHB3_ROOT_BUS, 1130 .parent = TYPE_PCIE_BUS, 1131 .class_init = pnv_phb3_root_bus_class_init, 1132 .interfaces = (InterfaceInfo[]) { 1133 { INTERFACE_PCIE_DEVICE }, 1134 { } 1135 }, 1136 }; 1137 1138 static void pnv_phb3_root_port_realize(DeviceState *dev, Error **errp) 1139 { 1140 PCIERootPortClass *rpc = PCIE_ROOT_PORT_GET_CLASS(dev); 1141 Error *local_err = NULL; 1142 1143 rpc->parent_realize(dev, &local_err); 1144 if (local_err) { 1145 error_propagate(errp, local_err); 1146 return; 1147 } 1148 } 1149 1150 static void pnv_phb3_root_port_class_init(ObjectClass *klass, void *data) 1151 { 1152 DeviceClass *dc = DEVICE_CLASS(klass); 1153 PCIDeviceClass *k = PCI_DEVICE_CLASS(klass); 1154 PCIERootPortClass *rpc = PCIE_ROOT_PORT_CLASS(klass); 1155 1156 dc->desc = "IBM PHB3 PCIE Root Port"; 1157 1158 device_class_set_parent_realize(dc, pnv_phb3_root_port_realize, 1159 &rpc->parent_realize); 1160 dc->user_creatable = false; 1161 1162 k->vendor_id = PCI_VENDOR_ID_IBM; 1163 k->device_id = 0x03dc; 1164 k->revision = 0; 1165 1166 rpc->exp_offset = 0x48; 1167 rpc->aer_offset = 0x100; 1168 } 1169 1170 static const TypeInfo pnv_phb3_root_port_info = { 1171 .name = TYPE_PNV_PHB3_ROOT_PORT, 1172 .parent = TYPE_PCIE_ROOT_PORT, 1173 .instance_size = sizeof(PnvPHB3RootPort), 1174 .class_init = pnv_phb3_root_port_class_init, 1175 }; 1176 1177 static void pnv_phb3_register_types(void) 1178 { 1179 type_register_static(&pnv_phb3_root_bus_info); 1180 type_register_static(&pnv_phb3_root_port_info); 1181 type_register_static(&pnv_phb3_type_info); 1182 type_register_static(&pnv_phb3_iommu_memory_region_info); 1183 } 1184 1185 type_init(pnv_phb3_register_types) 1186