xref: /openbmc/qemu/hw/pci-host/pnv_phb3.c (revision 74154d7e)
1 /*
2  * QEMU PowerPC PowerNV (POWER8) PHB3 model
3  *
4  * Copyright (c) 2014-2020, IBM Corporation.
5  *
6  * This code is licensed under the GPL version 2 or later. See the
7  * COPYING file in the top-level directory.
8  */
9 #include "qemu/osdep.h"
10 #include "qemu/log.h"
11 #include "qapi/visitor.h"
12 #include "qapi/error.h"
13 #include "qemu-common.h"
14 #include "hw/pci-host/pnv_phb3_regs.h"
15 #include "hw/pci-host/pnv_phb3.h"
16 #include "hw/pci/pcie_host.h"
17 #include "hw/pci/pcie_port.h"
18 #include "hw/ppc/pnv.h"
19 #include "hw/irq.h"
20 #include "hw/qdev-properties.h"
21 #include "qom/object.h"
22 #include "sysemu/sysemu.h"
23 
24 #define phb3_error(phb, fmt, ...)                                       \
25     qemu_log_mask(LOG_GUEST_ERROR, "phb3[%d:%d]: " fmt "\n",            \
26                   (phb)->chip_id, (phb)->phb_id, ## __VA_ARGS__)
27 
28 static PCIDevice *pnv_phb3_find_cfg_dev(PnvPHB3 *phb)
29 {
30     PCIHostState *pci = PCI_HOST_BRIDGE(phb);
31     uint64_t addr = phb->regs[PHB_CONFIG_ADDRESS >> 3];
32     uint8_t bus, devfn;
33 
34     if (!(addr >> 63)) {
35         return NULL;
36     }
37     bus = (addr >> 52) & 0xff;
38     devfn = (addr >> 44) & 0xff;
39 
40     return pci_find_device(pci->bus, bus, devfn);
41 }
42 
43 /*
44  * The CONFIG_DATA register expects little endian accesses, but as the
45  * region is big endian, we have to swap the value.
46  */
47 static void pnv_phb3_config_write(PnvPHB3 *phb, unsigned off,
48                                   unsigned size, uint64_t val)
49 {
50     uint32_t cfg_addr, limit;
51     PCIDevice *pdev;
52 
53     pdev = pnv_phb3_find_cfg_dev(phb);
54     if (!pdev) {
55         return;
56     }
57     cfg_addr = (phb->regs[PHB_CONFIG_ADDRESS >> 3] >> 32) & 0xffc;
58     cfg_addr |= off;
59     limit = pci_config_size(pdev);
60     if (limit <= cfg_addr) {
61         /*
62          * conventional pci device can be behind pcie-to-pci bridge.
63          * 256 <= addr < 4K has no effects.
64          */
65         return;
66     }
67     switch (size) {
68     case 1:
69         break;
70     case 2:
71         val = bswap16(val);
72         break;
73     case 4:
74         val = bswap32(val);
75         break;
76     default:
77         g_assert_not_reached();
78     }
79     pci_host_config_write_common(pdev, cfg_addr, limit, val, size);
80 }
81 
82 static uint64_t pnv_phb3_config_read(PnvPHB3 *phb, unsigned off,
83                                      unsigned size)
84 {
85     uint32_t cfg_addr, limit;
86     PCIDevice *pdev;
87     uint64_t val;
88 
89     pdev = pnv_phb3_find_cfg_dev(phb);
90     if (!pdev) {
91         return ~0ull;
92     }
93     cfg_addr = (phb->regs[PHB_CONFIG_ADDRESS >> 3] >> 32) & 0xffc;
94     cfg_addr |= off;
95     limit = pci_config_size(pdev);
96     if (limit <= cfg_addr) {
97         /*
98          * conventional pci device can be behind pcie-to-pci bridge.
99          * 256 <= addr < 4K has no effects.
100          */
101         return ~0ull;
102     }
103     val = pci_host_config_read_common(pdev, cfg_addr, limit, size);
104     switch (size) {
105     case 1:
106         return val;
107     case 2:
108         return bswap16(val);
109     case 4:
110         return bswap32(val);
111     default:
112         g_assert_not_reached();
113     }
114 }
115 
116 static void pnv_phb3_check_m32(PnvPHB3 *phb)
117 {
118     uint64_t base, start, size;
119     MemoryRegion *parent;
120     PnvPBCQState *pbcq = &phb->pbcq;
121 
122     if (memory_region_is_mapped(&phb->mr_m32)) {
123         memory_region_del_subregion(phb->mr_m32.container, &phb->mr_m32);
124     }
125 
126     if (!(phb->regs[PHB_PHB3_CONFIG >> 3] & PHB_PHB3C_M32_EN)) {
127         return;
128     }
129 
130     /* Grab geometry from registers */
131     base = phb->regs[PHB_M32_BASE_ADDR >> 3];
132     start = phb->regs[PHB_M32_START_ADDR >> 3];
133     size = ~(phb->regs[PHB_M32_BASE_MASK >> 3] | 0xfffc000000000000ull) + 1;
134 
135     /* Check if it matches an enabled MMIO region in the PBCQ */
136     if (memory_region_is_mapped(&pbcq->mmbar0) &&
137         base >= pbcq->mmio0_base &&
138         (base + size) <= (pbcq->mmio0_base + pbcq->mmio0_size)) {
139         parent = &pbcq->mmbar0;
140         base -= pbcq->mmio0_base;
141     } else if (memory_region_is_mapped(&pbcq->mmbar1) &&
142                base >= pbcq->mmio1_base &&
143                (base + size) <= (pbcq->mmio1_base + pbcq->mmio1_size)) {
144         parent = &pbcq->mmbar1;
145         base -= pbcq->mmio1_base;
146     } else {
147         return;
148     }
149 
150     /* Create alias */
151     memory_region_init_alias(&phb->mr_m32, OBJECT(phb), "phb3-m32",
152                              &phb->pci_mmio, start, size);
153     memory_region_add_subregion(parent, base, &phb->mr_m32);
154 }
155 
156 static void pnv_phb3_check_m64(PnvPHB3 *phb, uint32_t index)
157 {
158     uint64_t base, start, size, m64;
159     MemoryRegion *parent;
160     PnvPBCQState *pbcq = &phb->pbcq;
161 
162     if (memory_region_is_mapped(&phb->mr_m64[index])) {
163         /* Should we destroy it in RCU friendly way... ? */
164         memory_region_del_subregion(phb->mr_m64[index].container,
165                                     &phb->mr_m64[index]);
166     }
167 
168     /* Get table entry */
169     m64 = phb->ioda_M64BT[index];
170 
171     if (!(m64 & IODA2_M64BT_ENABLE)) {
172         return;
173     }
174 
175     /* Grab geometry from registers */
176     base = GETFIELD(IODA2_M64BT_BASE, m64) << 20;
177     if (m64 & IODA2_M64BT_SINGLE_PE) {
178         base &= ~0x1ffffffull;
179     }
180     size = GETFIELD(IODA2_M64BT_MASK, m64) << 20;
181     size |= 0xfffc000000000000ull;
182     size = ~size + 1;
183     start = base | (phb->regs[PHB_M64_UPPER_BITS >> 3]);
184 
185     /* Check if it matches an enabled MMIO region in the PBCQ */
186     if (memory_region_is_mapped(&pbcq->mmbar0) &&
187         base >= pbcq->mmio0_base &&
188         (base + size) <= (pbcq->mmio0_base + pbcq->mmio0_size)) {
189         parent = &pbcq->mmbar0;
190         base -= pbcq->mmio0_base;
191     } else if (memory_region_is_mapped(&pbcq->mmbar1) &&
192                base >= pbcq->mmio1_base &&
193                (base + size) <= (pbcq->mmio1_base + pbcq->mmio1_size)) {
194         parent = &pbcq->mmbar1;
195         base -= pbcq->mmio1_base;
196     } else {
197         return;
198     }
199 
200     /* Create alias */
201     memory_region_init_alias(&phb->mr_m64[index], OBJECT(phb), "phb3-m64",
202                              &phb->pci_mmio, start, size);
203     memory_region_add_subregion(parent, base, &phb->mr_m64[index]);
204 }
205 
206 static void pnv_phb3_check_all_m64s(PnvPHB3 *phb)
207 {
208     uint64_t i;
209 
210     for (i = 0; i < PNV_PHB3_NUM_M64; i++) {
211         pnv_phb3_check_m64(phb, i);
212     }
213 }
214 
215 static void pnv_phb3_lxivt_write(PnvPHB3 *phb, unsigned idx, uint64_t val)
216 {
217     uint8_t server, prio;
218 
219     phb->ioda_LXIVT[idx] = val & (IODA2_LXIVT_SERVER |
220                                   IODA2_LXIVT_PRIORITY |
221                                   IODA2_LXIVT_NODE_ID);
222     server = GETFIELD(IODA2_LXIVT_SERVER, val);
223     prio = GETFIELD(IODA2_LXIVT_PRIORITY, val);
224 
225     /*
226      * The low order 2 bits are the link pointer (Type II interrupts).
227      * Shift back to get a valid IRQ server.
228      */
229     server >>= 2;
230 
231     ics_write_xive(&phb->lsis, idx, server, prio, prio);
232 }
233 
234 static uint64_t *pnv_phb3_ioda_access(PnvPHB3 *phb,
235                                       unsigned *out_table, unsigned *out_idx)
236 {
237     uint64_t adreg = phb->regs[PHB_IODA_ADDR >> 3];
238     unsigned int index = GETFIELD(PHB_IODA_AD_TADR, adreg);
239     unsigned int table = GETFIELD(PHB_IODA_AD_TSEL, adreg);
240     unsigned int mask;
241     uint64_t *tptr = NULL;
242 
243     switch (table) {
244     case IODA2_TBL_LIST:
245         tptr = phb->ioda_LIST;
246         mask = 7;
247         break;
248     case IODA2_TBL_LXIVT:
249         tptr = phb->ioda_LXIVT;
250         mask = 7;
251         break;
252     case IODA2_TBL_IVC_CAM:
253     case IODA2_TBL_RBA:
254         mask = 31;
255         break;
256     case IODA2_TBL_RCAM:
257         mask = 63;
258         break;
259     case IODA2_TBL_MRT:
260         mask = 7;
261         break;
262     case IODA2_TBL_PESTA:
263     case IODA2_TBL_PESTB:
264         mask = 255;
265         break;
266     case IODA2_TBL_TVT:
267         tptr = phb->ioda_TVT;
268         mask = 511;
269         break;
270     case IODA2_TBL_TCAM:
271     case IODA2_TBL_TDR:
272         mask = 63;
273         break;
274     case IODA2_TBL_M64BT:
275         tptr = phb->ioda_M64BT;
276         mask = 15;
277         break;
278     case IODA2_TBL_M32DT:
279         tptr = phb->ioda_MDT;
280         mask = 255;
281         break;
282     case IODA2_TBL_PEEV:
283         tptr = phb->ioda_PEEV;
284         mask = 3;
285         break;
286     default:
287         phb3_error(phb, "invalid IODA table %d", table);
288         return NULL;
289     }
290     index &= mask;
291     if (out_idx) {
292         *out_idx = index;
293     }
294     if (out_table) {
295         *out_table = table;
296     }
297     if (tptr) {
298         tptr += index;
299     }
300     if (adreg & PHB_IODA_AD_AUTOINC) {
301         index = (index + 1) & mask;
302         adreg = SETFIELD(PHB_IODA_AD_TADR, adreg, index);
303     }
304     phb->regs[PHB_IODA_ADDR >> 3] = adreg;
305     return tptr;
306 }
307 
308 static uint64_t pnv_phb3_ioda_read(PnvPHB3 *phb)
309 {
310         unsigned table;
311         uint64_t *tptr;
312 
313         tptr = pnv_phb3_ioda_access(phb, &table, NULL);
314         if (!tptr) {
315             /* Return 0 on unsupported tables, not ff's */
316             return 0;
317         }
318         return *tptr;
319 }
320 
321 static void pnv_phb3_ioda_write(PnvPHB3 *phb, uint64_t val)
322 {
323         unsigned table, idx;
324         uint64_t *tptr;
325 
326         tptr = pnv_phb3_ioda_access(phb, &table, &idx);
327         if (!tptr) {
328             return;
329         }
330 
331         /* Handle side effects */
332         switch (table) {
333         case IODA2_TBL_LXIVT:
334             pnv_phb3_lxivt_write(phb, idx, val);
335             break;
336         case IODA2_TBL_M64BT:
337             *tptr = val;
338             pnv_phb3_check_m64(phb, idx);
339             break;
340         default:
341             *tptr = val;
342         }
343 }
344 
345 /*
346  * This is called whenever the PHB LSI, MSI source ID register or
347  * the PBCQ irq filters are written.
348  */
349 void pnv_phb3_remap_irqs(PnvPHB3 *phb)
350 {
351     ICSState *ics = &phb->lsis;
352     uint32_t local, global, count, mask, comp;
353     uint64_t baren;
354     PnvPBCQState *pbcq = &phb->pbcq;
355 
356     /*
357      * First check if we are enabled. Unlike real HW we don't separate
358      * TX and RX so we enable if both are set
359      */
360     baren = pbcq->nest_regs[PBCQ_NEST_BAR_EN];
361     if (!(baren & PBCQ_NEST_BAR_EN_IRSN_RX) ||
362         !(baren & PBCQ_NEST_BAR_EN_IRSN_TX)) {
363         ics->offset = 0;
364         return;
365     }
366 
367     /* Grab local LSI source ID */
368     local = GETFIELD(PHB_LSI_SRC_ID, phb->regs[PHB_LSI_SOURCE_ID >> 3]) << 3;
369 
370     /* Grab global one and compare */
371     global = GETFIELD(PBCQ_NEST_LSI_SRC,
372                       pbcq->nest_regs[PBCQ_NEST_LSI_SRC_ID]) << 3;
373     if (global != local) {
374         /*
375          * This happens during initialization, let's come back when we
376          * are properly configured
377          */
378         ics->offset = 0;
379         return;
380     }
381 
382     /* Get the base on the powerbus */
383     comp = GETFIELD(PBCQ_NEST_IRSN_COMP,
384                     pbcq->nest_regs[PBCQ_NEST_IRSN_COMPARE]);
385     mask = GETFIELD(PBCQ_NEST_IRSN_COMP,
386                     pbcq->nest_regs[PBCQ_NEST_IRSN_MASK]);
387     count = ((~mask) + 1) & 0x7ffff;
388     phb->total_irq = count;
389 
390     /* Sanity checks */
391     if ((global + PNV_PHB3_NUM_LSI) > count) {
392         phb3_error(phb, "LSIs out of reach: LSI base=%d total irq=%d", global,
393                    count);
394     }
395 
396     if (count > 2048) {
397         phb3_error(phb, "More interrupts than supported: %d", count);
398     }
399 
400     if ((comp & mask) != comp) {
401         phb3_error(phb, "IRQ compare bits not in mask: comp=0x%x mask=0x%x",
402                    comp, mask);
403         comp &= mask;
404     }
405     /* Setup LSI offset */
406     ics->offset = comp + global;
407 
408     /* Setup MSI offset */
409     pnv_phb3_msi_update_config(&phb->msis, comp, count - PNV_PHB3_NUM_LSI);
410 }
411 
412 static void pnv_phb3_lsi_src_id_write(PnvPHB3 *phb, uint64_t val)
413 {
414     /* Sanitize content */
415     val &= PHB_LSI_SRC_ID;
416     phb->regs[PHB_LSI_SOURCE_ID >> 3] = val;
417     pnv_phb3_remap_irqs(phb);
418 }
419 
420 static void pnv_phb3_rtc_invalidate(PnvPHB3 *phb, uint64_t val)
421 {
422     PnvPhb3DMASpace *ds;
423 
424     /* Always invalidate all for now ... */
425     QLIST_FOREACH(ds, &phb->dma_spaces, list) {
426         ds->pe_num = PHB_INVALID_PE;
427     }
428 }
429 
430 
431 static void pnv_phb3_update_msi_regions(PnvPhb3DMASpace *ds)
432 {
433     uint64_t cfg = ds->phb->regs[PHB_PHB3_CONFIG >> 3];
434 
435     if (cfg & PHB_PHB3C_32BIT_MSI_EN) {
436         if (!memory_region_is_mapped(&ds->msi32_mr)) {
437             memory_region_add_subregion(MEMORY_REGION(&ds->dma_mr),
438                                         0xffff0000, &ds->msi32_mr);
439         }
440     } else {
441         if (memory_region_is_mapped(&ds->msi32_mr)) {
442             memory_region_del_subregion(MEMORY_REGION(&ds->dma_mr),
443                                         &ds->msi32_mr);
444         }
445     }
446 
447     if (cfg & PHB_PHB3C_64BIT_MSI_EN) {
448         if (!memory_region_is_mapped(&ds->msi64_mr)) {
449             memory_region_add_subregion(MEMORY_REGION(&ds->dma_mr),
450                                         (1ull << 60), &ds->msi64_mr);
451         }
452     } else {
453         if (memory_region_is_mapped(&ds->msi64_mr)) {
454             memory_region_del_subregion(MEMORY_REGION(&ds->dma_mr),
455                                         &ds->msi64_mr);
456         }
457     }
458 }
459 
460 static void pnv_phb3_update_all_msi_regions(PnvPHB3 *phb)
461 {
462     PnvPhb3DMASpace *ds;
463 
464     QLIST_FOREACH(ds, &phb->dma_spaces, list) {
465         pnv_phb3_update_msi_regions(ds);
466     }
467 }
468 
469 void pnv_phb3_reg_write(void *opaque, hwaddr off, uint64_t val, unsigned size)
470 {
471     PnvPHB3 *phb = opaque;
472     bool changed;
473 
474     /* Special case configuration data */
475     if ((off & 0xfffc) == PHB_CONFIG_DATA) {
476         pnv_phb3_config_write(phb, off & 0x3, size, val);
477         return;
478     }
479 
480     /* Other registers are 64-bit only */
481     if (size != 8 || off & 0x7) {
482         phb3_error(phb, "Invalid register access, offset: 0x%"PRIx64" size: %d",
483                    off, size);
484         return;
485     }
486 
487     /* Handle masking & filtering */
488     switch (off) {
489     case PHB_M64_UPPER_BITS:
490         val &= 0xfffc000000000000ull;
491         break;
492     case PHB_Q_DMA_R:
493         /*
494          * This is enough logic to make SW happy but we aren't actually
495          * quiescing the DMAs
496          */
497         if (val & PHB_Q_DMA_R_AUTORESET) {
498             val = 0;
499         } else {
500             val &= PHB_Q_DMA_R_QUIESCE_DMA;
501         }
502         break;
503     /* LEM stuff */
504     case PHB_LEM_FIR_AND_MASK:
505         phb->regs[PHB_LEM_FIR_ACCUM >> 3] &= val;
506         return;
507     case PHB_LEM_FIR_OR_MASK:
508         phb->regs[PHB_LEM_FIR_ACCUM >> 3] |= val;
509         return;
510     case PHB_LEM_ERROR_AND_MASK:
511         phb->regs[PHB_LEM_ERROR_MASK >> 3] &= val;
512         return;
513     case PHB_LEM_ERROR_OR_MASK:
514         phb->regs[PHB_LEM_ERROR_MASK >> 3] |= val;
515         return;
516     case PHB_LEM_WOF:
517         val = 0;
518         break;
519     }
520 
521     /* Record whether it changed */
522     changed = phb->regs[off >> 3] != val;
523 
524     /* Store in register cache first */
525     phb->regs[off >> 3] = val;
526 
527     /* Handle side effects */
528     switch (off) {
529     case PHB_PHB3_CONFIG:
530         if (changed) {
531             pnv_phb3_update_all_msi_regions(phb);
532         }
533         /* fall through */
534     case PHB_M32_BASE_ADDR:
535     case PHB_M32_BASE_MASK:
536     case PHB_M32_START_ADDR:
537         if (changed) {
538             pnv_phb3_check_m32(phb);
539         }
540         break;
541     case PHB_M64_UPPER_BITS:
542         if (changed) {
543             pnv_phb3_check_all_m64s(phb);
544         }
545         break;
546     case PHB_LSI_SOURCE_ID:
547         if (changed) {
548             pnv_phb3_lsi_src_id_write(phb, val);
549         }
550         break;
551 
552     /* IODA table accesses */
553     case PHB_IODA_DATA0:
554         pnv_phb3_ioda_write(phb, val);
555         break;
556 
557     /* RTC invalidation */
558     case PHB_RTC_INVALIDATE:
559         pnv_phb3_rtc_invalidate(phb, val);
560         break;
561 
562     /* FFI request */
563     case PHB_FFI_REQUEST:
564         pnv_phb3_msi_ffi(&phb->msis, val);
565         break;
566 
567     /* Silent simple writes */
568     case PHB_CONFIG_ADDRESS:
569     case PHB_IODA_ADDR:
570     case PHB_TCE_KILL:
571     case PHB_TCE_SPEC_CTL:
572     case PHB_PEST_BAR:
573     case PHB_PELTV_BAR:
574     case PHB_RTT_BAR:
575     case PHB_RBA_BAR:
576     case PHB_IVT_BAR:
577     case PHB_FFI_LOCK:
578     case PHB_LEM_FIR_ACCUM:
579     case PHB_LEM_ERROR_MASK:
580     case PHB_LEM_ACTION0:
581     case PHB_LEM_ACTION1:
582         break;
583 
584     /* Noise on anything else */
585     default:
586         qemu_log_mask(LOG_UNIMP, "phb3: reg_write 0x%"PRIx64"=%"PRIx64"\n",
587                       off, val);
588     }
589 }
590 
591 uint64_t pnv_phb3_reg_read(void *opaque, hwaddr off, unsigned size)
592 {
593     PnvPHB3 *phb = opaque;
594     PCIHostState *pci = PCI_HOST_BRIDGE(phb);
595     uint64_t val;
596 
597     if ((off & 0xfffc) == PHB_CONFIG_DATA) {
598         return pnv_phb3_config_read(phb, off & 0x3, size);
599     }
600 
601     /* Other registers are 64-bit only */
602     if (size != 8 || off & 0x7) {
603         phb3_error(phb, "Invalid register access, offset: 0x%"PRIx64" size: %d",
604                    off, size);
605         return ~0ull;
606     }
607 
608     /* Default read from cache */
609     val = phb->regs[off >> 3];
610 
611     switch (off) {
612     /* Simulate venice DD2.0 */
613     case PHB_VERSION:
614         return 0x000000a300000005ull;
615     case PHB_PCIE_SYSTEM_CONFIG:
616         return 0x441100fc30000000;
617 
618     /* IODA table accesses */
619     case PHB_IODA_DATA0:
620         return pnv_phb3_ioda_read(phb);
621 
622     /* Link training always appears trained */
623     case PHB_PCIE_DLP_TRAIN_CTL:
624         if (!pci_find_device(pci->bus, 1, 0)) {
625             return 0;
626         }
627         return PHB_PCIE_DLP_INBAND_PRESENCE | PHB_PCIE_DLP_TC_DL_LINKACT;
628 
629     /* FFI Lock */
630     case PHB_FFI_LOCK:
631         /* Set lock and return previous value */
632         phb->regs[off >> 3] |= PHB_FFI_LOCK_STATE;
633         return val;
634 
635     /* DMA read sync: make it look like it's complete */
636     case PHB_DMARD_SYNC:
637         return PHB_DMARD_SYNC_COMPLETE;
638 
639     /* Silent simple reads */
640     case PHB_PHB3_CONFIG:
641     case PHB_M32_BASE_ADDR:
642     case PHB_M32_BASE_MASK:
643     case PHB_M32_START_ADDR:
644     case PHB_CONFIG_ADDRESS:
645     case PHB_IODA_ADDR:
646     case PHB_RTC_INVALIDATE:
647     case PHB_TCE_KILL:
648     case PHB_TCE_SPEC_CTL:
649     case PHB_PEST_BAR:
650     case PHB_PELTV_BAR:
651     case PHB_RTT_BAR:
652     case PHB_RBA_BAR:
653     case PHB_IVT_BAR:
654     case PHB_M64_UPPER_BITS:
655     case PHB_LEM_FIR_ACCUM:
656     case PHB_LEM_ERROR_MASK:
657     case PHB_LEM_ACTION0:
658     case PHB_LEM_ACTION1:
659         break;
660 
661     /* Noise on anything else */
662     default:
663         qemu_log_mask(LOG_UNIMP, "phb3: reg_read 0x%"PRIx64"=%"PRIx64"\n",
664                       off, val);
665     }
666     return val;
667 }
668 
669 static const MemoryRegionOps pnv_phb3_reg_ops = {
670     .read = pnv_phb3_reg_read,
671     .write = pnv_phb3_reg_write,
672     .valid.min_access_size = 1,
673     .valid.max_access_size = 8,
674     .impl.min_access_size = 1,
675     .impl.max_access_size = 8,
676     .endianness = DEVICE_BIG_ENDIAN,
677 };
678 
679 static int pnv_phb3_map_irq(PCIDevice *pci_dev, int irq_num)
680 {
681     /* Check that out properly ... */
682     return irq_num & 3;
683 }
684 
685 static void pnv_phb3_set_irq(void *opaque, int irq_num, int level)
686 {
687     PnvPHB3 *phb = opaque;
688 
689     /* LSI only ... */
690     if (irq_num > 3) {
691         phb3_error(phb, "Unknown IRQ to set %d", irq_num);
692     }
693     qemu_set_irq(phb->qirqs[irq_num], level);
694 }
695 
696 static bool pnv_phb3_resolve_pe(PnvPhb3DMASpace *ds)
697 {
698     uint64_t rtt, addr;
699     uint16_t rte;
700     int bus_num;
701 
702     /* Already resolved ? */
703     if (ds->pe_num != PHB_INVALID_PE) {
704         return true;
705     }
706 
707     /* We need to lookup the RTT */
708     rtt = ds->phb->regs[PHB_RTT_BAR >> 3];
709     if (!(rtt & PHB_RTT_BAR_ENABLE)) {
710         phb3_error(ds->phb, "DMA with RTT BAR disabled !");
711         /* Set error bits ? fence ? ... */
712         return false;
713     }
714 
715     /* Read RTE */
716     bus_num = pci_bus_num(ds->bus);
717     addr = rtt & PHB_RTT_BASE_ADDRESS_MASK;
718     addr += 2 * ((bus_num << 8) | ds->devfn);
719     if (dma_memory_read(&address_space_memory, addr, &rte,
720                         sizeof(rte), MEMTXATTRS_UNSPECIFIED)) {
721         phb3_error(ds->phb, "Failed to read RTT entry at 0x%"PRIx64, addr);
722         /* Set error bits ? fence ? ... */
723         return false;
724     }
725     rte = be16_to_cpu(rte);
726 
727     /* Fail upon reading of invalid PE# */
728     if (rte >= PNV_PHB3_NUM_PE) {
729         phb3_error(ds->phb, "RTE for RID 0x%x invalid (%04x", ds->devfn, rte);
730         /* Set error bits ? fence ? ... */
731         return false;
732     }
733     ds->pe_num = rte;
734     return true;
735 }
736 
737 static void pnv_phb3_translate_tve(PnvPhb3DMASpace *ds, hwaddr addr,
738                                    bool is_write, uint64_t tve,
739                                    IOMMUTLBEntry *tlb)
740 {
741     uint64_t tta = GETFIELD(IODA2_TVT_TABLE_ADDR, tve);
742     int32_t  lev = GETFIELD(IODA2_TVT_NUM_LEVELS, tve);
743     uint32_t tts = GETFIELD(IODA2_TVT_TCE_TABLE_SIZE, tve);
744     uint32_t tps = GETFIELD(IODA2_TVT_IO_PSIZE, tve);
745     PnvPHB3 *phb = ds->phb;
746 
747     /* Invalid levels */
748     if (lev > 4) {
749         phb3_error(phb, "Invalid #levels in TVE %d", lev);
750         return;
751     }
752 
753     /* IO Page Size of 0 means untranslated, else use TCEs */
754     if (tps == 0) {
755         /*
756          * We only support non-translate in top window.
757          *
758          * TODO: Venice/Murano support it on bottom window above 4G and
759          * Naples suports it on everything
760          */
761         if (!(tve & PPC_BIT(51))) {
762             phb3_error(phb, "xlate for invalid non-translate TVE");
763             return;
764         }
765         /* TODO: Handle boundaries */
766 
767         /* Use 4k pages like q35 ... for now */
768         tlb->iova = addr & 0xfffffffffffff000ull;
769         tlb->translated_addr = addr & 0x0003fffffffff000ull;
770         tlb->addr_mask = 0xfffull;
771         tlb->perm = IOMMU_RW;
772     } else {
773         uint32_t tce_shift, tbl_shift, sh;
774         uint64_t base, taddr, tce, tce_mask;
775 
776         /* TVE disabled ? */
777         if (tts == 0) {
778             phb3_error(phb, "xlate for invalid translated TVE");
779             return;
780         }
781 
782         /* Address bits per bottom level TCE entry */
783         tce_shift = tps + 11;
784 
785         /* Address bits per table level */
786         tbl_shift = tts + 8;
787 
788         /* Top level table base address */
789         base = tta << 12;
790 
791         /* Total shift to first level */
792         sh = tbl_shift * lev + tce_shift;
793 
794         /* TODO: Multi-level untested */
795         do {
796             lev--;
797 
798             /* Grab the TCE address */
799             taddr = base | (((addr >> sh) & ((1ul << tbl_shift) - 1)) << 3);
800             if (dma_memory_read(&address_space_memory, taddr, &tce,
801                                 sizeof(tce), MEMTXATTRS_UNSPECIFIED)) {
802                 phb3_error(phb, "Failed to read TCE at 0x%"PRIx64, taddr);
803                 return;
804             }
805             tce = be64_to_cpu(tce);
806 
807             /* Check permission for indirect TCE */
808             if ((lev >= 0) && !(tce & 3)) {
809                 phb3_error(phb, "Invalid indirect TCE at 0x%"PRIx64, taddr);
810                 phb3_error(phb, " xlate %"PRIx64":%c TVE=%"PRIx64, addr,
811                            is_write ? 'W' : 'R', tve);
812                 phb3_error(phb, " tta=%"PRIx64" lev=%d tts=%d tps=%d",
813                            tta, lev, tts, tps);
814                 return;
815             }
816             sh -= tbl_shift;
817             base = tce & ~0xfffull;
818         } while (lev >= 0);
819 
820         /* We exit the loop with TCE being the final TCE */
821         if ((is_write & !(tce & 2)) || ((!is_write) && !(tce & 1))) {
822             phb3_error(phb, "TCE access fault at 0x%"PRIx64, taddr);
823             phb3_error(phb, " xlate %"PRIx64":%c TVE=%"PRIx64, addr,
824                        is_write ? 'W' : 'R', tve);
825             phb3_error(phb, " tta=%"PRIx64" lev=%d tts=%d tps=%d",
826                        tta, lev, tts, tps);
827             return;
828         }
829         tce_mask = ~((1ull << tce_shift) - 1);
830         tlb->iova = addr & tce_mask;
831         tlb->translated_addr = tce & tce_mask;
832         tlb->addr_mask = ~tce_mask;
833         tlb->perm = tce & 3;
834     }
835 }
836 
837 static IOMMUTLBEntry pnv_phb3_translate_iommu(IOMMUMemoryRegion *iommu,
838                                               hwaddr addr,
839                                               IOMMUAccessFlags flag,
840                                               int iommu_idx)
841 {
842     PnvPhb3DMASpace *ds = container_of(iommu, PnvPhb3DMASpace, dma_mr);
843     int tve_sel;
844     uint64_t tve, cfg;
845     IOMMUTLBEntry ret = {
846         .target_as = &address_space_memory,
847         .iova = addr,
848         .translated_addr = 0,
849         .addr_mask = ~(hwaddr)0,
850         .perm = IOMMU_NONE,
851     };
852     PnvPHB3 *phb = ds->phb;
853 
854     /* Resolve PE# */
855     if (!pnv_phb3_resolve_pe(ds)) {
856         phb3_error(phb, "Failed to resolve PE# for bus @%p (%d) devfn 0x%x",
857                    ds->bus, pci_bus_num(ds->bus), ds->devfn);
858         return ret;
859     }
860 
861     /* Check top bits */
862     switch (addr >> 60) {
863     case 00:
864         /* DMA or 32-bit MSI ? */
865         cfg = ds->phb->regs[PHB_PHB3_CONFIG >> 3];
866         if ((cfg & PHB_PHB3C_32BIT_MSI_EN) &&
867             ((addr & 0xffffffffffff0000ull) == 0xffff0000ull)) {
868             phb3_error(phb, "xlate on 32-bit MSI region");
869             return ret;
870         }
871         /* Choose TVE XXX Use PHB3 Control Register */
872         tve_sel = (addr >> 59) & 1;
873         tve = ds->phb->ioda_TVT[ds->pe_num * 2 + tve_sel];
874         pnv_phb3_translate_tve(ds, addr, flag & IOMMU_WO, tve, &ret);
875         break;
876     case 01:
877         phb3_error(phb, "xlate on 64-bit MSI region");
878         break;
879     default:
880         phb3_error(phb, "xlate on unsupported address 0x%"PRIx64, addr);
881     }
882     return ret;
883 }
884 
885 #define TYPE_PNV_PHB3_IOMMU_MEMORY_REGION "pnv-phb3-iommu-memory-region"
886 DECLARE_INSTANCE_CHECKER(IOMMUMemoryRegion, PNV_PHB3_IOMMU_MEMORY_REGION,
887                          TYPE_PNV_PHB3_IOMMU_MEMORY_REGION)
888 
889 static void pnv_phb3_iommu_memory_region_class_init(ObjectClass *klass,
890                                                     void *data)
891 {
892     IOMMUMemoryRegionClass *imrc = IOMMU_MEMORY_REGION_CLASS(klass);
893 
894     imrc->translate = pnv_phb3_translate_iommu;
895 }
896 
897 static const TypeInfo pnv_phb3_iommu_memory_region_info = {
898     .parent = TYPE_IOMMU_MEMORY_REGION,
899     .name = TYPE_PNV_PHB3_IOMMU_MEMORY_REGION,
900     .class_init = pnv_phb3_iommu_memory_region_class_init,
901 };
902 
903 /*
904  * MSI/MSIX memory region implementation.
905  * The handler handles both MSI and MSIX.
906  */
907 static void pnv_phb3_msi_write(void *opaque, hwaddr addr,
908                                uint64_t data, unsigned size)
909 {
910     PnvPhb3DMASpace *ds = opaque;
911 
912     /* Resolve PE# */
913     if (!pnv_phb3_resolve_pe(ds)) {
914         phb3_error(ds->phb, "Failed to resolve PE# for bus @%p (%d) devfn 0x%x",
915                    ds->bus, pci_bus_num(ds->bus), ds->devfn);
916         return;
917     }
918 
919     pnv_phb3_msi_send(&ds->phb->msis, addr, data, ds->pe_num);
920 }
921 
922 /* There is no .read as the read result is undefined by PCI spec */
923 static uint64_t pnv_phb3_msi_read(void *opaque, hwaddr addr, unsigned size)
924 {
925     PnvPhb3DMASpace *ds = opaque;
926 
927     phb3_error(ds->phb, "invalid read @ 0x%" HWADDR_PRIx, addr);
928     return -1;
929 }
930 
931 static const MemoryRegionOps pnv_phb3_msi_ops = {
932     .read = pnv_phb3_msi_read,
933     .write = pnv_phb3_msi_write,
934     .endianness = DEVICE_LITTLE_ENDIAN
935 };
936 
937 static AddressSpace *pnv_phb3_dma_iommu(PCIBus *bus, void *opaque, int devfn)
938 {
939     PnvPHB3 *phb = opaque;
940     PnvPhb3DMASpace *ds;
941 
942     QLIST_FOREACH(ds, &phb->dma_spaces, list) {
943         if (ds->bus == bus && ds->devfn == devfn) {
944             break;
945         }
946     }
947 
948     if (ds == NULL) {
949         ds = g_malloc0(sizeof(PnvPhb3DMASpace));
950         ds->bus = bus;
951         ds->devfn = devfn;
952         ds->pe_num = PHB_INVALID_PE;
953         ds->phb = phb;
954         memory_region_init_iommu(&ds->dma_mr, sizeof(ds->dma_mr),
955                                  TYPE_PNV_PHB3_IOMMU_MEMORY_REGION,
956                                  OBJECT(phb), "phb3_iommu", UINT64_MAX);
957         address_space_init(&ds->dma_as, MEMORY_REGION(&ds->dma_mr),
958                            "phb3_iommu");
959         memory_region_init_io(&ds->msi32_mr, OBJECT(phb), &pnv_phb3_msi_ops,
960                               ds, "msi32", 0x10000);
961         memory_region_init_io(&ds->msi64_mr, OBJECT(phb), &pnv_phb3_msi_ops,
962                               ds, "msi64", 0x100000);
963         pnv_phb3_update_msi_regions(ds);
964 
965         QLIST_INSERT_HEAD(&phb->dma_spaces, ds, list);
966     }
967     return &ds->dma_as;
968 }
969 
970 static void pnv_phb3_instance_init(Object *obj)
971 {
972     PnvPHB3 *phb = PNV_PHB3(obj);
973 
974     QLIST_INIT(&phb->dma_spaces);
975 
976     /* LSI sources */
977     object_initialize_child(obj, "lsi", &phb->lsis, TYPE_ICS);
978 
979     /* Default init ... will be fixed by HW inits */
980     phb->lsis.offset = 0;
981 
982     /* MSI sources */
983     object_initialize_child(obj, "msi", &phb->msis, TYPE_PHB3_MSI);
984 
985     /* Power Bus Common Queue */
986     object_initialize_child(obj, "pbcq", &phb->pbcq, TYPE_PNV_PBCQ);
987 
988 }
989 
990 static void pnv_phb3_realize(DeviceState *dev, Error **errp)
991 {
992     PnvPHB3 *phb = PNV_PHB3(dev);
993     PCIHostState *pci = PCI_HOST_BRIDGE(dev);
994     PnvMachineState *pnv = PNV_MACHINE(qdev_get_machine());
995     int i;
996 
997     /* User created devices */
998     if (!phb->chip) {
999         Error *local_err = NULL;
1000         BusState *s;
1001 
1002         phb->chip = pnv_get_chip(pnv, phb->chip_id);
1003         if (!phb->chip) {
1004             error_setg(errp, "invalid chip id: %d", phb->chip_id);
1005             return;
1006         }
1007 
1008         /*
1009          * Reparent user created devices to the chip to build
1010          * correctly the device tree.
1011          */
1012         pnv_chip_parent_fixup(phb->chip, OBJECT(phb), phb->phb_id);
1013 
1014         s = qdev_get_parent_bus(DEVICE(phb->chip));
1015         if (!qdev_set_parent_bus(DEVICE(phb), s, &local_err)) {
1016             error_propagate(errp, local_err);
1017             return;
1018         }
1019     }
1020 
1021     if (phb->phb_id >= PNV_CHIP_GET_CLASS(phb->chip)->num_phbs) {
1022         error_setg(errp, "invalid PHB index: %d", phb->phb_id);
1023         return;
1024     }
1025 
1026     /* LSI sources */
1027     object_property_set_link(OBJECT(&phb->lsis), "xics", OBJECT(pnv),
1028                              &error_abort);
1029     object_property_set_int(OBJECT(&phb->lsis), "nr-irqs", PNV_PHB3_NUM_LSI,
1030                             &error_abort);
1031     if (!qdev_realize(DEVICE(&phb->lsis), NULL, errp)) {
1032         return;
1033     }
1034 
1035     for (i = 0; i < phb->lsis.nr_irqs; i++) {
1036         ics_set_irq_type(&phb->lsis, i, true);
1037     }
1038 
1039     phb->qirqs = qemu_allocate_irqs(ics_set_irq, &phb->lsis, phb->lsis.nr_irqs);
1040 
1041     /* MSI sources */
1042     object_property_set_link(OBJECT(&phb->msis), "phb", OBJECT(phb),
1043                              &error_abort);
1044     object_property_set_link(OBJECT(&phb->msis), "xics", OBJECT(pnv),
1045                              &error_abort);
1046     object_property_set_int(OBJECT(&phb->msis), "nr-irqs", PHB3_MAX_MSI,
1047                             &error_abort);
1048     if (!qdev_realize(DEVICE(&phb->msis), NULL, errp)) {
1049         return;
1050     }
1051 
1052     /* Power Bus Common Queue */
1053     object_property_set_link(OBJECT(&phb->pbcq), "phb", OBJECT(phb),
1054                              &error_abort);
1055     if (!qdev_realize(DEVICE(&phb->pbcq), NULL, errp)) {
1056         return;
1057     }
1058 
1059     /* Controller Registers */
1060     memory_region_init_io(&phb->mr_regs, OBJECT(phb), &pnv_phb3_reg_ops, phb,
1061                           "phb3-regs", 0x1000);
1062 
1063     /*
1064      * PHB3 doesn't support IO space. However, qemu gets very upset if
1065      * we don't have an IO region to anchor IO BARs onto so we just
1066      * initialize one which we never hook up to anything
1067      */
1068     memory_region_init(&phb->pci_io, OBJECT(phb), "pci-io", 0x10000);
1069     memory_region_init(&phb->pci_mmio, OBJECT(phb), "pci-mmio",
1070                        PCI_MMIO_TOTAL_SIZE);
1071 
1072     pci->bus = pci_register_root_bus(dev,
1073                                      dev->id ? dev->id : NULL,
1074                                      pnv_phb3_set_irq, pnv_phb3_map_irq, phb,
1075                                      &phb->pci_mmio, &phb->pci_io,
1076                                      0, 4, TYPE_PNV_PHB3_ROOT_BUS);
1077 
1078     pci_setup_iommu(pci->bus, pnv_phb3_dma_iommu, phb);
1079 
1080     if (defaults_enabled()) {
1081         pnv_phb_attach_root_port(PCI_HOST_BRIDGE(phb),
1082                                  TYPE_PNV_PHB3_ROOT_PORT);
1083     }
1084 }
1085 
1086 void pnv_phb3_update_regions(PnvPHB3 *phb)
1087 {
1088     PnvPBCQState *pbcq = &phb->pbcq;
1089 
1090     /* Unmap first always */
1091     if (memory_region_is_mapped(&phb->mr_regs)) {
1092         memory_region_del_subregion(&pbcq->phbbar, &phb->mr_regs);
1093     }
1094 
1095     /* Map registers if enabled */
1096     if (memory_region_is_mapped(&pbcq->phbbar)) {
1097         /* TODO: We should use the PHB BAR 2 register but we don't ... */
1098         memory_region_add_subregion(&pbcq->phbbar, 0, &phb->mr_regs);
1099     }
1100 
1101     /* Check/update m32 */
1102     if (memory_region_is_mapped(&phb->mr_m32)) {
1103         pnv_phb3_check_m32(phb);
1104     }
1105     pnv_phb3_check_all_m64s(phb);
1106 }
1107 
1108 static const char *pnv_phb3_root_bus_path(PCIHostState *host_bridge,
1109                                           PCIBus *rootbus)
1110 {
1111     PnvPHB3 *phb = PNV_PHB3(host_bridge);
1112 
1113     snprintf(phb->bus_path, sizeof(phb->bus_path), "00%02x:%02x",
1114              phb->chip_id, phb->phb_id);
1115     return phb->bus_path;
1116 }
1117 
1118 static Property pnv_phb3_properties[] = {
1119         DEFINE_PROP_UINT32("index", PnvPHB3, phb_id, 0),
1120         DEFINE_PROP_UINT32("chip-id", PnvPHB3, chip_id, 0),
1121         DEFINE_PROP_LINK("chip", PnvPHB3, chip, TYPE_PNV_CHIP, PnvChip *),
1122         DEFINE_PROP_END_OF_LIST(),
1123 };
1124 
1125 static void pnv_phb3_class_init(ObjectClass *klass, void *data)
1126 {
1127     PCIHostBridgeClass *hc = PCI_HOST_BRIDGE_CLASS(klass);
1128     DeviceClass *dc = DEVICE_CLASS(klass);
1129 
1130     hc->root_bus_path = pnv_phb3_root_bus_path;
1131     dc->realize = pnv_phb3_realize;
1132     device_class_set_props(dc, pnv_phb3_properties);
1133     set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
1134     dc->user_creatable = true;
1135 }
1136 
1137 static const TypeInfo pnv_phb3_type_info = {
1138     .name          = TYPE_PNV_PHB3,
1139     .parent        = TYPE_PCIE_HOST_BRIDGE,
1140     .instance_size = sizeof(PnvPHB3),
1141     .class_init    = pnv_phb3_class_init,
1142     .instance_init = pnv_phb3_instance_init,
1143 };
1144 
1145 static void pnv_phb3_root_bus_class_init(ObjectClass *klass, void *data)
1146 {
1147     BusClass *k = BUS_CLASS(klass);
1148 
1149     /*
1150      * PHB3 has only a single root complex. Enforce the limit on the
1151      * parent bus
1152      */
1153     k->max_dev = 1;
1154 }
1155 
1156 static const TypeInfo pnv_phb3_root_bus_info = {
1157     .name = TYPE_PNV_PHB3_ROOT_BUS,
1158     .parent = TYPE_PCIE_BUS,
1159     .class_init = pnv_phb3_root_bus_class_init,
1160     .interfaces = (InterfaceInfo[]) {
1161         { INTERFACE_PCIE_DEVICE },
1162         { }
1163     },
1164 };
1165 
1166 static void pnv_phb3_root_port_realize(DeviceState *dev, Error **errp)
1167 {
1168     PCIERootPortClass *rpc = PCIE_ROOT_PORT_GET_CLASS(dev);
1169     PCIDevice *pci = PCI_DEVICE(dev);
1170     PCIBus *bus = pci_get_bus(pci);
1171     PnvPHB3 *phb = NULL;
1172     Error *local_err = NULL;
1173 
1174     phb = (PnvPHB3 *) object_dynamic_cast(OBJECT(bus->qbus.parent),
1175                                           TYPE_PNV_PHB3);
1176 
1177     if (!phb) {
1178         error_setg(errp,
1179 "pnv_phb3_root_port devices must be connected to pnv-phb3 buses");
1180         return;
1181     }
1182 
1183     /* Set unique chassis/slot values for the root port */
1184     qdev_prop_set_uint8(&pci->qdev, "chassis", phb->chip_id);
1185     qdev_prop_set_uint16(&pci->qdev, "slot", phb->phb_id);
1186 
1187     rpc->parent_realize(dev, &local_err);
1188     if (local_err) {
1189         error_propagate(errp, local_err);
1190         return;
1191     }
1192 }
1193 
1194 static void pnv_phb3_root_port_class_init(ObjectClass *klass, void *data)
1195 {
1196     DeviceClass *dc = DEVICE_CLASS(klass);
1197     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
1198     PCIERootPortClass *rpc = PCIE_ROOT_PORT_CLASS(klass);
1199 
1200     dc->desc     = "IBM PHB3 PCIE Root Port";
1201 
1202     device_class_set_parent_realize(dc, pnv_phb3_root_port_realize,
1203                                     &rpc->parent_realize);
1204     dc->user_creatable = true;
1205 
1206     k->vendor_id = PCI_VENDOR_ID_IBM;
1207     k->device_id = 0x03dc;
1208     k->revision  = 0;
1209 
1210     rpc->exp_offset = 0x48;
1211     rpc->aer_offset = 0x100;
1212 }
1213 
1214 static const TypeInfo pnv_phb3_root_port_info = {
1215     .name          = TYPE_PNV_PHB3_ROOT_PORT,
1216     .parent        = TYPE_PCIE_ROOT_PORT,
1217     .instance_size = sizeof(PnvPHB3RootPort),
1218     .class_init    = pnv_phb3_root_port_class_init,
1219 };
1220 
1221 static void pnv_phb3_register_types(void)
1222 {
1223     type_register_static(&pnv_phb3_root_bus_info);
1224     type_register_static(&pnv_phb3_root_port_info);
1225     type_register_static(&pnv_phb3_type_info);
1226     type_register_static(&pnv_phb3_iommu_memory_region_info);
1227 }
1228 
1229 type_init(pnv_phb3_register_types)
1230