xref: /openbmc/qemu/hw/pci-host/pnv_phb3.c (revision 9c4888c9)
1 /*
2  * QEMU PowerPC PowerNV (POWER8) PHB3 model
3  *
4  * Copyright (c) 2014-2020, IBM Corporation.
5  *
6  * This code is licensed under the GPL version 2 or later. See the
7  * COPYING file in the top-level directory.
8  */
9 #include "qemu/osdep.h"
10 #include "qemu/log.h"
11 #include "qapi/visitor.h"
12 #include "qapi/error.h"
13 #include "hw/pci-host/pnv_phb3_regs.h"
14 #include "hw/pci-host/pnv_phb3.h"
15 #include "hw/pci/pcie_host.h"
16 #include "hw/pci/pcie_port.h"
17 #include "hw/ppc/pnv.h"
18 #include "hw/irq.h"
19 #include "hw/qdev-properties.h"
20 #include "qom/object.h"
21 #include "sysemu/sysemu.h"
22 
23 #define phb3_error(phb, fmt, ...)                                       \
24     qemu_log_mask(LOG_GUEST_ERROR, "phb3[%d:%d]: " fmt "\n",            \
25                   (phb)->chip_id, (phb)->phb_id, ## __VA_ARGS__)
26 
27 static PCIDevice *pnv_phb3_find_cfg_dev(PnvPHB3 *phb)
28 {
29     PCIHostState *pci = PCI_HOST_BRIDGE(phb);
30     uint64_t addr = phb->regs[PHB_CONFIG_ADDRESS >> 3];
31     uint8_t bus, devfn;
32 
33     if (!(addr >> 63)) {
34         return NULL;
35     }
36     bus = (addr >> 52) & 0xff;
37     devfn = (addr >> 44) & 0xff;
38 
39     return pci_find_device(pci->bus, bus, devfn);
40 }
41 
42 /*
43  * The CONFIG_DATA register expects little endian accesses, but as the
44  * region is big endian, we have to swap the value.
45  */
46 static void pnv_phb3_config_write(PnvPHB3 *phb, unsigned off,
47                                   unsigned size, uint64_t val)
48 {
49     uint32_t cfg_addr, limit;
50     PCIDevice *pdev;
51 
52     pdev = pnv_phb3_find_cfg_dev(phb);
53     if (!pdev) {
54         return;
55     }
56     cfg_addr = (phb->regs[PHB_CONFIG_ADDRESS >> 3] >> 32) & 0xffc;
57     cfg_addr |= off;
58     limit = pci_config_size(pdev);
59     if (limit <= cfg_addr) {
60         /*
61          * conventional pci device can be behind pcie-to-pci bridge.
62          * 256 <= addr < 4K has no effects.
63          */
64         return;
65     }
66     switch (size) {
67     case 1:
68         break;
69     case 2:
70         val = bswap16(val);
71         break;
72     case 4:
73         val = bswap32(val);
74         break;
75     default:
76         g_assert_not_reached();
77     }
78     pci_host_config_write_common(pdev, cfg_addr, limit, val, size);
79 }
80 
81 static uint64_t pnv_phb3_config_read(PnvPHB3 *phb, unsigned off,
82                                      unsigned size)
83 {
84     uint32_t cfg_addr, limit;
85     PCIDevice *pdev;
86     uint64_t val;
87 
88     pdev = pnv_phb3_find_cfg_dev(phb);
89     if (!pdev) {
90         return ~0ull;
91     }
92     cfg_addr = (phb->regs[PHB_CONFIG_ADDRESS >> 3] >> 32) & 0xffc;
93     cfg_addr |= off;
94     limit = pci_config_size(pdev);
95     if (limit <= cfg_addr) {
96         /*
97          * conventional pci device can be behind pcie-to-pci bridge.
98          * 256 <= addr < 4K has no effects.
99          */
100         return ~0ull;
101     }
102     val = pci_host_config_read_common(pdev, cfg_addr, limit, size);
103     switch (size) {
104     case 1:
105         return val;
106     case 2:
107         return bswap16(val);
108     case 4:
109         return bswap32(val);
110     default:
111         g_assert_not_reached();
112     }
113 }
114 
115 static void pnv_phb3_check_m32(PnvPHB3 *phb)
116 {
117     uint64_t base, start, size;
118     MemoryRegion *parent;
119     PnvPBCQState *pbcq = &phb->pbcq;
120 
121     if (memory_region_is_mapped(&phb->mr_m32)) {
122         memory_region_del_subregion(phb->mr_m32.container, &phb->mr_m32);
123     }
124 
125     if (!(phb->regs[PHB_PHB3_CONFIG >> 3] & PHB_PHB3C_M32_EN)) {
126         return;
127     }
128 
129     /* Grab geometry from registers */
130     base = phb->regs[PHB_M32_BASE_ADDR >> 3];
131     start = phb->regs[PHB_M32_START_ADDR >> 3];
132     size = ~(phb->regs[PHB_M32_BASE_MASK >> 3] | 0xfffc000000000000ull) + 1;
133 
134     /* Check if it matches an enabled MMIO region in the PBCQ */
135     if (memory_region_is_mapped(&pbcq->mmbar0) &&
136         base >= pbcq->mmio0_base &&
137         (base + size) <= (pbcq->mmio0_base + pbcq->mmio0_size)) {
138         parent = &pbcq->mmbar0;
139         base -= pbcq->mmio0_base;
140     } else if (memory_region_is_mapped(&pbcq->mmbar1) &&
141                base >= pbcq->mmio1_base &&
142                (base + size) <= (pbcq->mmio1_base + pbcq->mmio1_size)) {
143         parent = &pbcq->mmbar1;
144         base -= pbcq->mmio1_base;
145     } else {
146         return;
147     }
148 
149     /* Create alias */
150     memory_region_init_alias(&phb->mr_m32, OBJECT(phb), "phb3-m32",
151                              &phb->pci_mmio, start, size);
152     memory_region_add_subregion(parent, base, &phb->mr_m32);
153 }
154 
155 static void pnv_phb3_check_m64(PnvPHB3 *phb, uint32_t index)
156 {
157     uint64_t base, start, size, m64;
158     MemoryRegion *parent;
159     PnvPBCQState *pbcq = &phb->pbcq;
160 
161     if (memory_region_is_mapped(&phb->mr_m64[index])) {
162         /* Should we destroy it in RCU friendly way... ? */
163         memory_region_del_subregion(phb->mr_m64[index].container,
164                                     &phb->mr_m64[index]);
165     }
166 
167     /* Get table entry */
168     m64 = phb->ioda_M64BT[index];
169 
170     if (!(m64 & IODA2_M64BT_ENABLE)) {
171         return;
172     }
173 
174     /* Grab geometry from registers */
175     base = GETFIELD(IODA2_M64BT_BASE, m64) << 20;
176     if (m64 & IODA2_M64BT_SINGLE_PE) {
177         base &= ~0x1ffffffull;
178     }
179     size = GETFIELD(IODA2_M64BT_MASK, m64) << 20;
180     size |= 0xfffc000000000000ull;
181     size = ~size + 1;
182     start = base | (phb->regs[PHB_M64_UPPER_BITS >> 3]);
183 
184     /* Check if it matches an enabled MMIO region in the PBCQ */
185     if (memory_region_is_mapped(&pbcq->mmbar0) &&
186         base >= pbcq->mmio0_base &&
187         (base + size) <= (pbcq->mmio0_base + pbcq->mmio0_size)) {
188         parent = &pbcq->mmbar0;
189         base -= pbcq->mmio0_base;
190     } else if (memory_region_is_mapped(&pbcq->mmbar1) &&
191                base >= pbcq->mmio1_base &&
192                (base + size) <= (pbcq->mmio1_base + pbcq->mmio1_size)) {
193         parent = &pbcq->mmbar1;
194         base -= pbcq->mmio1_base;
195     } else {
196         return;
197     }
198 
199     /* Create alias */
200     memory_region_init_alias(&phb->mr_m64[index], OBJECT(phb), "phb3-m64",
201                              &phb->pci_mmio, start, size);
202     memory_region_add_subregion(parent, base, &phb->mr_m64[index]);
203 }
204 
205 static void pnv_phb3_check_all_m64s(PnvPHB3 *phb)
206 {
207     uint64_t i;
208 
209     for (i = 0; i < PNV_PHB3_NUM_M64; i++) {
210         pnv_phb3_check_m64(phb, i);
211     }
212 }
213 
214 static void pnv_phb3_lxivt_write(PnvPHB3 *phb, unsigned idx, uint64_t val)
215 {
216     uint8_t server, prio;
217 
218     phb->ioda_LXIVT[idx] = val & (IODA2_LXIVT_SERVER |
219                                   IODA2_LXIVT_PRIORITY |
220                                   IODA2_LXIVT_NODE_ID);
221     server = GETFIELD(IODA2_LXIVT_SERVER, val);
222     prio = GETFIELD(IODA2_LXIVT_PRIORITY, val);
223 
224     /*
225      * The low order 2 bits are the link pointer (Type II interrupts).
226      * Shift back to get a valid IRQ server.
227      */
228     server >>= 2;
229 
230     ics_write_xive(&phb->lsis, idx, server, prio, prio);
231 }
232 
233 static uint64_t *pnv_phb3_ioda_access(PnvPHB3 *phb,
234                                       unsigned *out_table, unsigned *out_idx)
235 {
236     uint64_t adreg = phb->regs[PHB_IODA_ADDR >> 3];
237     unsigned int index = GETFIELD(PHB_IODA_AD_TADR, adreg);
238     unsigned int table = GETFIELD(PHB_IODA_AD_TSEL, adreg);
239     unsigned int mask;
240     uint64_t *tptr = NULL;
241 
242     switch (table) {
243     case IODA2_TBL_LIST:
244         tptr = phb->ioda_LIST;
245         mask = 7;
246         break;
247     case IODA2_TBL_LXIVT:
248         tptr = phb->ioda_LXIVT;
249         mask = 7;
250         break;
251     case IODA2_TBL_IVC_CAM:
252     case IODA2_TBL_RBA:
253         mask = 31;
254         break;
255     case IODA2_TBL_RCAM:
256         mask = 63;
257         break;
258     case IODA2_TBL_MRT:
259         mask = 7;
260         break;
261     case IODA2_TBL_PESTA:
262     case IODA2_TBL_PESTB:
263         mask = 255;
264         break;
265     case IODA2_TBL_TVT:
266         tptr = phb->ioda_TVT;
267         mask = 511;
268         break;
269     case IODA2_TBL_TCAM:
270     case IODA2_TBL_TDR:
271         mask = 63;
272         break;
273     case IODA2_TBL_M64BT:
274         tptr = phb->ioda_M64BT;
275         mask = 15;
276         break;
277     case IODA2_TBL_M32DT:
278         tptr = phb->ioda_MDT;
279         mask = 255;
280         break;
281     case IODA2_TBL_PEEV:
282         tptr = phb->ioda_PEEV;
283         mask = 3;
284         break;
285     default:
286         phb3_error(phb, "invalid IODA table %d", table);
287         return NULL;
288     }
289     index &= mask;
290     if (out_idx) {
291         *out_idx = index;
292     }
293     if (out_table) {
294         *out_table = table;
295     }
296     if (tptr) {
297         tptr += index;
298     }
299     if (adreg & PHB_IODA_AD_AUTOINC) {
300         index = (index + 1) & mask;
301         adreg = SETFIELD(PHB_IODA_AD_TADR, adreg, index);
302     }
303     phb->regs[PHB_IODA_ADDR >> 3] = adreg;
304     return tptr;
305 }
306 
307 static uint64_t pnv_phb3_ioda_read(PnvPHB3 *phb)
308 {
309         unsigned table;
310         uint64_t *tptr;
311 
312         tptr = pnv_phb3_ioda_access(phb, &table, NULL);
313         if (!tptr) {
314             /* Return 0 on unsupported tables, not ff's */
315             return 0;
316         }
317         return *tptr;
318 }
319 
320 static void pnv_phb3_ioda_write(PnvPHB3 *phb, uint64_t val)
321 {
322         unsigned table, idx;
323         uint64_t *tptr;
324 
325         tptr = pnv_phb3_ioda_access(phb, &table, &idx);
326         if (!tptr) {
327             return;
328         }
329 
330         /* Handle side effects */
331         switch (table) {
332         case IODA2_TBL_LXIVT:
333             pnv_phb3_lxivt_write(phb, idx, val);
334             break;
335         case IODA2_TBL_M64BT:
336             *tptr = val;
337             pnv_phb3_check_m64(phb, idx);
338             break;
339         default:
340             *tptr = val;
341         }
342 }
343 
344 /*
345  * This is called whenever the PHB LSI, MSI source ID register or
346  * the PBCQ irq filters are written.
347  */
348 void pnv_phb3_remap_irqs(PnvPHB3 *phb)
349 {
350     ICSState *ics = &phb->lsis;
351     uint32_t local, global, count, mask, comp;
352     uint64_t baren;
353     PnvPBCQState *pbcq = &phb->pbcq;
354 
355     /*
356      * First check if we are enabled. Unlike real HW we don't separate
357      * TX and RX so we enable if both are set
358      */
359     baren = pbcq->nest_regs[PBCQ_NEST_BAR_EN];
360     if (!(baren & PBCQ_NEST_BAR_EN_IRSN_RX) ||
361         !(baren & PBCQ_NEST_BAR_EN_IRSN_TX)) {
362         ics->offset = 0;
363         return;
364     }
365 
366     /* Grab local LSI source ID */
367     local = GETFIELD(PHB_LSI_SRC_ID, phb->regs[PHB_LSI_SOURCE_ID >> 3]) << 3;
368 
369     /* Grab global one and compare */
370     global = GETFIELD(PBCQ_NEST_LSI_SRC,
371                       pbcq->nest_regs[PBCQ_NEST_LSI_SRC_ID]) << 3;
372     if (global != local) {
373         /*
374          * This happens during initialization, let's come back when we
375          * are properly configured
376          */
377         ics->offset = 0;
378         return;
379     }
380 
381     /* Get the base on the powerbus */
382     comp = GETFIELD(PBCQ_NEST_IRSN_COMP,
383                     pbcq->nest_regs[PBCQ_NEST_IRSN_COMPARE]);
384     mask = GETFIELD(PBCQ_NEST_IRSN_COMP,
385                     pbcq->nest_regs[PBCQ_NEST_IRSN_MASK]);
386     count = ((~mask) + 1) & 0x7ffff;
387     phb->total_irq = count;
388 
389     /* Sanity checks */
390     if ((global + PNV_PHB3_NUM_LSI) > count) {
391         phb3_error(phb, "LSIs out of reach: LSI base=%d total irq=%d", global,
392                    count);
393     }
394 
395     if (count > 2048) {
396         phb3_error(phb, "More interrupts than supported: %d", count);
397     }
398 
399     if ((comp & mask) != comp) {
400         phb3_error(phb, "IRQ compare bits not in mask: comp=0x%x mask=0x%x",
401                    comp, mask);
402         comp &= mask;
403     }
404     /* Setup LSI offset */
405     ics->offset = comp + global;
406 
407     /* Setup MSI offset */
408     pnv_phb3_msi_update_config(&phb->msis, comp, count - PNV_PHB3_NUM_LSI);
409 }
410 
411 static void pnv_phb3_lsi_src_id_write(PnvPHB3 *phb, uint64_t val)
412 {
413     /* Sanitize content */
414     val &= PHB_LSI_SRC_ID;
415     phb->regs[PHB_LSI_SOURCE_ID >> 3] = val;
416     pnv_phb3_remap_irqs(phb);
417 }
418 
419 static void pnv_phb3_rtc_invalidate(PnvPHB3 *phb, uint64_t val)
420 {
421     PnvPhb3DMASpace *ds;
422 
423     /* Always invalidate all for now ... */
424     QLIST_FOREACH(ds, &phb->dma_spaces, list) {
425         ds->pe_num = PHB_INVALID_PE;
426     }
427 }
428 
429 
430 static void pnv_phb3_update_msi_regions(PnvPhb3DMASpace *ds)
431 {
432     uint64_t cfg = ds->phb->regs[PHB_PHB3_CONFIG >> 3];
433 
434     if (cfg & PHB_PHB3C_32BIT_MSI_EN) {
435         if (!memory_region_is_mapped(&ds->msi32_mr)) {
436             memory_region_add_subregion(MEMORY_REGION(&ds->dma_mr),
437                                         0xffff0000, &ds->msi32_mr);
438         }
439     } else {
440         if (memory_region_is_mapped(&ds->msi32_mr)) {
441             memory_region_del_subregion(MEMORY_REGION(&ds->dma_mr),
442                                         &ds->msi32_mr);
443         }
444     }
445 
446     if (cfg & PHB_PHB3C_64BIT_MSI_EN) {
447         if (!memory_region_is_mapped(&ds->msi64_mr)) {
448             memory_region_add_subregion(MEMORY_REGION(&ds->dma_mr),
449                                         (1ull << 60), &ds->msi64_mr);
450         }
451     } else {
452         if (memory_region_is_mapped(&ds->msi64_mr)) {
453             memory_region_del_subregion(MEMORY_REGION(&ds->dma_mr),
454                                         &ds->msi64_mr);
455         }
456     }
457 }
458 
459 static void pnv_phb3_update_all_msi_regions(PnvPHB3 *phb)
460 {
461     PnvPhb3DMASpace *ds;
462 
463     QLIST_FOREACH(ds, &phb->dma_spaces, list) {
464         pnv_phb3_update_msi_regions(ds);
465     }
466 }
467 
468 void pnv_phb3_reg_write(void *opaque, hwaddr off, uint64_t val, unsigned size)
469 {
470     PnvPHB3 *phb = opaque;
471     bool changed;
472 
473     /* Special case configuration data */
474     if ((off & 0xfffc) == PHB_CONFIG_DATA) {
475         pnv_phb3_config_write(phb, off & 0x3, size, val);
476         return;
477     }
478 
479     /* Other registers are 64-bit only */
480     if (size != 8 || off & 0x7) {
481         phb3_error(phb, "Invalid register access, offset: 0x%"PRIx64" size: %d",
482                    off, size);
483         return;
484     }
485 
486     /* Handle masking & filtering */
487     switch (off) {
488     case PHB_M64_UPPER_BITS:
489         val &= 0xfffc000000000000ull;
490         break;
491     case PHB_Q_DMA_R:
492         /*
493          * This is enough logic to make SW happy but we aren't actually
494          * quiescing the DMAs
495          */
496         if (val & PHB_Q_DMA_R_AUTORESET) {
497             val = 0;
498         } else {
499             val &= PHB_Q_DMA_R_QUIESCE_DMA;
500         }
501         break;
502     /* LEM stuff */
503     case PHB_LEM_FIR_AND_MASK:
504         phb->regs[PHB_LEM_FIR_ACCUM >> 3] &= val;
505         return;
506     case PHB_LEM_FIR_OR_MASK:
507         phb->regs[PHB_LEM_FIR_ACCUM >> 3] |= val;
508         return;
509     case PHB_LEM_ERROR_AND_MASK:
510         phb->regs[PHB_LEM_ERROR_MASK >> 3] &= val;
511         return;
512     case PHB_LEM_ERROR_OR_MASK:
513         phb->regs[PHB_LEM_ERROR_MASK >> 3] |= val;
514         return;
515     case PHB_LEM_WOF:
516         val = 0;
517         break;
518     }
519 
520     /* Record whether it changed */
521     changed = phb->regs[off >> 3] != val;
522 
523     /* Store in register cache first */
524     phb->regs[off >> 3] = val;
525 
526     /* Handle side effects */
527     switch (off) {
528     case PHB_PHB3_CONFIG:
529         if (changed) {
530             pnv_phb3_update_all_msi_regions(phb);
531         }
532         /* fall through */
533     case PHB_M32_BASE_ADDR:
534     case PHB_M32_BASE_MASK:
535     case PHB_M32_START_ADDR:
536         if (changed) {
537             pnv_phb3_check_m32(phb);
538         }
539         break;
540     case PHB_M64_UPPER_BITS:
541         if (changed) {
542             pnv_phb3_check_all_m64s(phb);
543         }
544         break;
545     case PHB_LSI_SOURCE_ID:
546         if (changed) {
547             pnv_phb3_lsi_src_id_write(phb, val);
548         }
549         break;
550 
551     /* IODA table accesses */
552     case PHB_IODA_DATA0:
553         pnv_phb3_ioda_write(phb, val);
554         break;
555 
556     /* RTC invalidation */
557     case PHB_RTC_INVALIDATE:
558         pnv_phb3_rtc_invalidate(phb, val);
559         break;
560 
561     /* FFI request */
562     case PHB_FFI_REQUEST:
563         pnv_phb3_msi_ffi(&phb->msis, val);
564         break;
565 
566     /* Silent simple writes */
567     case PHB_CONFIG_ADDRESS:
568     case PHB_IODA_ADDR:
569     case PHB_TCE_KILL:
570     case PHB_TCE_SPEC_CTL:
571     case PHB_PEST_BAR:
572     case PHB_PELTV_BAR:
573     case PHB_RTT_BAR:
574     case PHB_RBA_BAR:
575     case PHB_IVT_BAR:
576     case PHB_FFI_LOCK:
577     case PHB_LEM_FIR_ACCUM:
578     case PHB_LEM_ERROR_MASK:
579     case PHB_LEM_ACTION0:
580     case PHB_LEM_ACTION1:
581         break;
582 
583     /* Noise on anything else */
584     default:
585         qemu_log_mask(LOG_UNIMP, "phb3: reg_write 0x%"PRIx64"=%"PRIx64"\n",
586                       off, val);
587     }
588 }
589 
590 uint64_t pnv_phb3_reg_read(void *opaque, hwaddr off, unsigned size)
591 {
592     PnvPHB3 *phb = opaque;
593     PCIHostState *pci = PCI_HOST_BRIDGE(phb);
594     uint64_t val;
595 
596     if ((off & 0xfffc) == PHB_CONFIG_DATA) {
597         return pnv_phb3_config_read(phb, off & 0x3, size);
598     }
599 
600     /* Other registers are 64-bit only */
601     if (size != 8 || off & 0x7) {
602         phb3_error(phb, "Invalid register access, offset: 0x%"PRIx64" size: %d",
603                    off, size);
604         return ~0ull;
605     }
606 
607     /* Default read from cache */
608     val = phb->regs[off >> 3];
609 
610     switch (off) {
611     /* Simulate venice DD2.0 */
612     case PHB_VERSION:
613         return 0x000000a300000005ull;
614     case PHB_PCIE_SYSTEM_CONFIG:
615         return 0x441100fc30000000;
616 
617     /* IODA table accesses */
618     case PHB_IODA_DATA0:
619         return pnv_phb3_ioda_read(phb);
620 
621     /* Link training always appears trained */
622     case PHB_PCIE_DLP_TRAIN_CTL:
623         if (!pci_find_device(pci->bus, 1, 0)) {
624             return 0;
625         }
626         return PHB_PCIE_DLP_INBAND_PRESENCE | PHB_PCIE_DLP_TC_DL_LINKACT;
627 
628     /* FFI Lock */
629     case PHB_FFI_LOCK:
630         /* Set lock and return previous value */
631         phb->regs[off >> 3] |= PHB_FFI_LOCK_STATE;
632         return val;
633 
634     /* DMA read sync: make it look like it's complete */
635     case PHB_DMARD_SYNC:
636         return PHB_DMARD_SYNC_COMPLETE;
637 
638     /* Silent simple reads */
639     case PHB_PHB3_CONFIG:
640     case PHB_M32_BASE_ADDR:
641     case PHB_M32_BASE_MASK:
642     case PHB_M32_START_ADDR:
643     case PHB_CONFIG_ADDRESS:
644     case PHB_IODA_ADDR:
645     case PHB_RTC_INVALIDATE:
646     case PHB_TCE_KILL:
647     case PHB_TCE_SPEC_CTL:
648     case PHB_PEST_BAR:
649     case PHB_PELTV_BAR:
650     case PHB_RTT_BAR:
651     case PHB_RBA_BAR:
652     case PHB_IVT_BAR:
653     case PHB_M64_UPPER_BITS:
654     case PHB_LEM_FIR_ACCUM:
655     case PHB_LEM_ERROR_MASK:
656     case PHB_LEM_ACTION0:
657     case PHB_LEM_ACTION1:
658         break;
659 
660     /* Noise on anything else */
661     default:
662         qemu_log_mask(LOG_UNIMP, "phb3: reg_read 0x%"PRIx64"=%"PRIx64"\n",
663                       off, val);
664     }
665     return val;
666 }
667 
668 static const MemoryRegionOps pnv_phb3_reg_ops = {
669     .read = pnv_phb3_reg_read,
670     .write = pnv_phb3_reg_write,
671     .valid.min_access_size = 1,
672     .valid.max_access_size = 8,
673     .impl.min_access_size = 1,
674     .impl.max_access_size = 8,
675     .endianness = DEVICE_BIG_ENDIAN,
676 };
677 
678 static int pnv_phb3_map_irq(PCIDevice *pci_dev, int irq_num)
679 {
680     /* Check that out properly ... */
681     return irq_num & 3;
682 }
683 
684 static void pnv_phb3_set_irq(void *opaque, int irq_num, int level)
685 {
686     PnvPHB3 *phb = opaque;
687 
688     /* LSI only ... */
689     if (irq_num > 3) {
690         phb3_error(phb, "Unknown IRQ to set %d", irq_num);
691     }
692     qemu_set_irq(phb->qirqs[irq_num], level);
693 }
694 
695 static bool pnv_phb3_resolve_pe(PnvPhb3DMASpace *ds)
696 {
697     uint64_t rtt, addr;
698     uint16_t rte;
699     int bus_num;
700 
701     /* Already resolved ? */
702     if (ds->pe_num != PHB_INVALID_PE) {
703         return true;
704     }
705 
706     /* We need to lookup the RTT */
707     rtt = ds->phb->regs[PHB_RTT_BAR >> 3];
708     if (!(rtt & PHB_RTT_BAR_ENABLE)) {
709         phb3_error(ds->phb, "DMA with RTT BAR disabled !");
710         /* Set error bits ? fence ? ... */
711         return false;
712     }
713 
714     /* Read RTE */
715     bus_num = pci_bus_num(ds->bus);
716     addr = rtt & PHB_RTT_BASE_ADDRESS_MASK;
717     addr += 2 * ((bus_num << 8) | ds->devfn);
718     if (dma_memory_read(&address_space_memory, addr, &rte,
719                         sizeof(rte), MEMTXATTRS_UNSPECIFIED)) {
720         phb3_error(ds->phb, "Failed to read RTT entry at 0x%"PRIx64, addr);
721         /* Set error bits ? fence ? ... */
722         return false;
723     }
724     rte = be16_to_cpu(rte);
725 
726     /* Fail upon reading of invalid PE# */
727     if (rte >= PNV_PHB3_NUM_PE) {
728         phb3_error(ds->phb, "RTE for RID 0x%x invalid (%04x", ds->devfn, rte);
729         /* Set error bits ? fence ? ... */
730         return false;
731     }
732     ds->pe_num = rte;
733     return true;
734 }
735 
736 static void pnv_phb3_translate_tve(PnvPhb3DMASpace *ds, hwaddr addr,
737                                    bool is_write, uint64_t tve,
738                                    IOMMUTLBEntry *tlb)
739 {
740     uint64_t tta = GETFIELD(IODA2_TVT_TABLE_ADDR, tve);
741     int32_t  lev = GETFIELD(IODA2_TVT_NUM_LEVELS, tve);
742     uint32_t tts = GETFIELD(IODA2_TVT_TCE_TABLE_SIZE, tve);
743     uint32_t tps = GETFIELD(IODA2_TVT_IO_PSIZE, tve);
744     PnvPHB3 *phb = ds->phb;
745 
746     /* Invalid levels */
747     if (lev > 4) {
748         phb3_error(phb, "Invalid #levels in TVE %d", lev);
749         return;
750     }
751 
752     /* IO Page Size of 0 means untranslated, else use TCEs */
753     if (tps == 0) {
754         /*
755          * We only support non-translate in top window.
756          *
757          * TODO: Venice/Murano support it on bottom window above 4G and
758          * Naples suports it on everything
759          */
760         if (!(tve & PPC_BIT(51))) {
761             phb3_error(phb, "xlate for invalid non-translate TVE");
762             return;
763         }
764         /* TODO: Handle boundaries */
765 
766         /* Use 4k pages like q35 ... for now */
767         tlb->iova = addr & 0xfffffffffffff000ull;
768         tlb->translated_addr = addr & 0x0003fffffffff000ull;
769         tlb->addr_mask = 0xfffull;
770         tlb->perm = IOMMU_RW;
771     } else {
772         uint32_t tce_shift, tbl_shift, sh;
773         uint64_t base, taddr, tce, tce_mask;
774 
775         /* TVE disabled ? */
776         if (tts == 0) {
777             phb3_error(phb, "xlate for invalid translated TVE");
778             return;
779         }
780 
781         /* Address bits per bottom level TCE entry */
782         tce_shift = tps + 11;
783 
784         /* Address bits per table level */
785         tbl_shift = tts + 8;
786 
787         /* Top level table base address */
788         base = tta << 12;
789 
790         /* Total shift to first level */
791         sh = tbl_shift * lev + tce_shift;
792 
793         /* TODO: Multi-level untested */
794         do {
795             lev--;
796 
797             /* Grab the TCE address */
798             taddr = base | (((addr >> sh) & ((1ul << tbl_shift) - 1)) << 3);
799             if (dma_memory_read(&address_space_memory, taddr, &tce,
800                                 sizeof(tce), MEMTXATTRS_UNSPECIFIED)) {
801                 phb3_error(phb, "Failed to read TCE at 0x%"PRIx64, taddr);
802                 return;
803             }
804             tce = be64_to_cpu(tce);
805 
806             /* Check permission for indirect TCE */
807             if ((lev >= 0) && !(tce & 3)) {
808                 phb3_error(phb, "Invalid indirect TCE at 0x%"PRIx64, taddr);
809                 phb3_error(phb, " xlate %"PRIx64":%c TVE=%"PRIx64, addr,
810                            is_write ? 'W' : 'R', tve);
811                 phb3_error(phb, " tta=%"PRIx64" lev=%d tts=%d tps=%d",
812                            tta, lev, tts, tps);
813                 return;
814             }
815             sh -= tbl_shift;
816             base = tce & ~0xfffull;
817         } while (lev >= 0);
818 
819         /* We exit the loop with TCE being the final TCE */
820         if ((is_write & !(tce & 2)) || ((!is_write) && !(tce & 1))) {
821             phb3_error(phb, "TCE access fault at 0x%"PRIx64, taddr);
822             phb3_error(phb, " xlate %"PRIx64":%c TVE=%"PRIx64, addr,
823                        is_write ? 'W' : 'R', tve);
824             phb3_error(phb, " tta=%"PRIx64" lev=%d tts=%d tps=%d",
825                        tta, lev, tts, tps);
826             return;
827         }
828         tce_mask = ~((1ull << tce_shift) - 1);
829         tlb->iova = addr & tce_mask;
830         tlb->translated_addr = tce & tce_mask;
831         tlb->addr_mask = ~tce_mask;
832         tlb->perm = tce & 3;
833     }
834 }
835 
836 static IOMMUTLBEntry pnv_phb3_translate_iommu(IOMMUMemoryRegion *iommu,
837                                               hwaddr addr,
838                                               IOMMUAccessFlags flag,
839                                               int iommu_idx)
840 {
841     PnvPhb3DMASpace *ds = container_of(iommu, PnvPhb3DMASpace, dma_mr);
842     int tve_sel;
843     uint64_t tve, cfg;
844     IOMMUTLBEntry ret = {
845         .target_as = &address_space_memory,
846         .iova = addr,
847         .translated_addr = 0,
848         .addr_mask = ~(hwaddr)0,
849         .perm = IOMMU_NONE,
850     };
851     PnvPHB3 *phb = ds->phb;
852 
853     /* Resolve PE# */
854     if (!pnv_phb3_resolve_pe(ds)) {
855         phb3_error(phb, "Failed to resolve PE# for bus @%p (%d) devfn 0x%x",
856                    ds->bus, pci_bus_num(ds->bus), ds->devfn);
857         return ret;
858     }
859 
860     /* Check top bits */
861     switch (addr >> 60) {
862     case 00:
863         /* DMA or 32-bit MSI ? */
864         cfg = ds->phb->regs[PHB_PHB3_CONFIG >> 3];
865         if ((cfg & PHB_PHB3C_32BIT_MSI_EN) &&
866             ((addr & 0xffffffffffff0000ull) == 0xffff0000ull)) {
867             phb3_error(phb, "xlate on 32-bit MSI region");
868             return ret;
869         }
870         /* Choose TVE XXX Use PHB3 Control Register */
871         tve_sel = (addr >> 59) & 1;
872         tve = ds->phb->ioda_TVT[ds->pe_num * 2 + tve_sel];
873         pnv_phb3_translate_tve(ds, addr, flag & IOMMU_WO, tve, &ret);
874         break;
875     case 01:
876         phb3_error(phb, "xlate on 64-bit MSI region");
877         break;
878     default:
879         phb3_error(phb, "xlate on unsupported address 0x%"PRIx64, addr);
880     }
881     return ret;
882 }
883 
884 #define TYPE_PNV_PHB3_IOMMU_MEMORY_REGION "pnv-phb3-iommu-memory-region"
885 DECLARE_INSTANCE_CHECKER(IOMMUMemoryRegion, PNV_PHB3_IOMMU_MEMORY_REGION,
886                          TYPE_PNV_PHB3_IOMMU_MEMORY_REGION)
887 
888 static void pnv_phb3_iommu_memory_region_class_init(ObjectClass *klass,
889                                                     void *data)
890 {
891     IOMMUMemoryRegionClass *imrc = IOMMU_MEMORY_REGION_CLASS(klass);
892 
893     imrc->translate = pnv_phb3_translate_iommu;
894 }
895 
896 static const TypeInfo pnv_phb3_iommu_memory_region_info = {
897     .parent = TYPE_IOMMU_MEMORY_REGION,
898     .name = TYPE_PNV_PHB3_IOMMU_MEMORY_REGION,
899     .class_init = pnv_phb3_iommu_memory_region_class_init,
900 };
901 
902 /*
903  * MSI/MSIX memory region implementation.
904  * The handler handles both MSI and MSIX.
905  */
906 static void pnv_phb3_msi_write(void *opaque, hwaddr addr,
907                                uint64_t data, unsigned size)
908 {
909     PnvPhb3DMASpace *ds = opaque;
910 
911     /* Resolve PE# */
912     if (!pnv_phb3_resolve_pe(ds)) {
913         phb3_error(ds->phb, "Failed to resolve PE# for bus @%p (%d) devfn 0x%x",
914                    ds->bus, pci_bus_num(ds->bus), ds->devfn);
915         return;
916     }
917 
918     pnv_phb3_msi_send(&ds->phb->msis, addr, data, ds->pe_num);
919 }
920 
921 /* There is no .read as the read result is undefined by PCI spec */
922 static uint64_t pnv_phb3_msi_read(void *opaque, hwaddr addr, unsigned size)
923 {
924     PnvPhb3DMASpace *ds = opaque;
925 
926     phb3_error(ds->phb, "invalid read @ 0x%" HWADDR_PRIx, addr);
927     return -1;
928 }
929 
930 static const MemoryRegionOps pnv_phb3_msi_ops = {
931     .read = pnv_phb3_msi_read,
932     .write = pnv_phb3_msi_write,
933     .endianness = DEVICE_LITTLE_ENDIAN
934 };
935 
936 static AddressSpace *pnv_phb3_dma_iommu(PCIBus *bus, void *opaque, int devfn)
937 {
938     PnvPHB3 *phb = opaque;
939     PnvPhb3DMASpace *ds;
940 
941     QLIST_FOREACH(ds, &phb->dma_spaces, list) {
942         if (ds->bus == bus && ds->devfn == devfn) {
943             break;
944         }
945     }
946 
947     if (ds == NULL) {
948         ds = g_new0(PnvPhb3DMASpace, 1);
949         ds->bus = bus;
950         ds->devfn = devfn;
951         ds->pe_num = PHB_INVALID_PE;
952         ds->phb = phb;
953         memory_region_init_iommu(&ds->dma_mr, sizeof(ds->dma_mr),
954                                  TYPE_PNV_PHB3_IOMMU_MEMORY_REGION,
955                                  OBJECT(phb), "phb3_iommu", UINT64_MAX);
956         address_space_init(&ds->dma_as, MEMORY_REGION(&ds->dma_mr),
957                            "phb3_iommu");
958         memory_region_init_io(&ds->msi32_mr, OBJECT(phb), &pnv_phb3_msi_ops,
959                               ds, "msi32", 0x10000);
960         memory_region_init_io(&ds->msi64_mr, OBJECT(phb), &pnv_phb3_msi_ops,
961                               ds, "msi64", 0x100000);
962         pnv_phb3_update_msi_regions(ds);
963 
964         QLIST_INSERT_HEAD(&phb->dma_spaces, ds, list);
965     }
966     return &ds->dma_as;
967 }
968 
969 static void pnv_phb3_instance_init(Object *obj)
970 {
971     PnvPHB3 *phb = PNV_PHB3(obj);
972 
973     QLIST_INIT(&phb->dma_spaces);
974 
975     /* LSI sources */
976     object_initialize_child(obj, "lsi", &phb->lsis, TYPE_ICS);
977 
978     /* Default init ... will be fixed by HW inits */
979     phb->lsis.offset = 0;
980 
981     /* MSI sources */
982     object_initialize_child(obj, "msi", &phb->msis, TYPE_PHB3_MSI);
983 
984     /* Power Bus Common Queue */
985     object_initialize_child(obj, "pbcq", &phb->pbcq, TYPE_PNV_PBCQ);
986 
987 }
988 
989 static void pnv_phb3_realize(DeviceState *dev, Error **errp)
990 {
991     PnvPHB3 *phb = PNV_PHB3(dev);
992     PCIHostState *pci = PCI_HOST_BRIDGE(dev);
993     PnvMachineState *pnv = PNV_MACHINE(qdev_get_machine());
994     int i;
995 
996     if (phb->phb_id >= PNV_CHIP_GET_CLASS(phb->chip)->num_phbs) {
997         error_setg(errp, "invalid PHB index: %d", phb->phb_id);
998         return;
999     }
1000 
1001     /* LSI sources */
1002     object_property_set_link(OBJECT(&phb->lsis), "xics", OBJECT(pnv),
1003                              &error_abort);
1004     object_property_set_int(OBJECT(&phb->lsis), "nr-irqs", PNV_PHB3_NUM_LSI,
1005                             &error_abort);
1006     if (!qdev_realize(DEVICE(&phb->lsis), NULL, errp)) {
1007         return;
1008     }
1009 
1010     for (i = 0; i < phb->lsis.nr_irqs; i++) {
1011         ics_set_irq_type(&phb->lsis, i, true);
1012     }
1013 
1014     phb->qirqs = qemu_allocate_irqs(ics_set_irq, &phb->lsis, phb->lsis.nr_irqs);
1015 
1016     /* MSI sources */
1017     object_property_set_link(OBJECT(&phb->msis), "phb", OBJECT(phb),
1018                              &error_abort);
1019     object_property_set_link(OBJECT(&phb->msis), "xics", OBJECT(pnv),
1020                              &error_abort);
1021     object_property_set_int(OBJECT(&phb->msis), "nr-irqs", PHB3_MAX_MSI,
1022                             &error_abort);
1023     if (!qdev_realize(DEVICE(&phb->msis), NULL, errp)) {
1024         return;
1025     }
1026 
1027     /* Power Bus Common Queue */
1028     object_property_set_link(OBJECT(&phb->pbcq), "phb", OBJECT(phb),
1029                              &error_abort);
1030     if (!qdev_realize(DEVICE(&phb->pbcq), NULL, errp)) {
1031         return;
1032     }
1033 
1034     /* Controller Registers */
1035     memory_region_init_io(&phb->mr_regs, OBJECT(phb), &pnv_phb3_reg_ops, phb,
1036                           "phb3-regs", 0x1000);
1037 
1038     /*
1039      * PHB3 doesn't support IO space. However, qemu gets very upset if
1040      * we don't have an IO region to anchor IO BARs onto so we just
1041      * initialize one which we never hook up to anything
1042      */
1043     memory_region_init(&phb->pci_io, OBJECT(phb), "pci-io", 0x10000);
1044     memory_region_init(&phb->pci_mmio, OBJECT(phb), "pci-mmio",
1045                        PCI_MMIO_TOTAL_SIZE);
1046 
1047     pci->bus = pci_register_root_bus(dev,
1048                                      dev->id ? dev->id : NULL,
1049                                      pnv_phb3_set_irq, pnv_phb3_map_irq, phb,
1050                                      &phb->pci_mmio, &phb->pci_io,
1051                                      0, 4, TYPE_PNV_PHB3_ROOT_BUS);
1052 
1053     pci_setup_iommu(pci->bus, pnv_phb3_dma_iommu, phb);
1054 
1055     pnv_phb_attach_root_port(PCI_HOST_BRIDGE(phb), TYPE_PNV_PHB3_ROOT_PORT);
1056 }
1057 
1058 void pnv_phb3_update_regions(PnvPHB3 *phb)
1059 {
1060     PnvPBCQState *pbcq = &phb->pbcq;
1061 
1062     /* Unmap first always */
1063     if (memory_region_is_mapped(&phb->mr_regs)) {
1064         memory_region_del_subregion(&pbcq->phbbar, &phb->mr_regs);
1065     }
1066 
1067     /* Map registers if enabled */
1068     if (memory_region_is_mapped(&pbcq->phbbar)) {
1069         /* TODO: We should use the PHB BAR 2 register but we don't ... */
1070         memory_region_add_subregion(&pbcq->phbbar, 0, &phb->mr_regs);
1071     }
1072 
1073     /* Check/update m32 */
1074     if (memory_region_is_mapped(&phb->mr_m32)) {
1075         pnv_phb3_check_m32(phb);
1076     }
1077     pnv_phb3_check_all_m64s(phb);
1078 }
1079 
1080 static const char *pnv_phb3_root_bus_path(PCIHostState *host_bridge,
1081                                           PCIBus *rootbus)
1082 {
1083     PnvPHB3 *phb = PNV_PHB3(host_bridge);
1084 
1085     snprintf(phb->bus_path, sizeof(phb->bus_path), "00%02x:%02x",
1086              phb->chip_id, phb->phb_id);
1087     return phb->bus_path;
1088 }
1089 
1090 static Property pnv_phb3_properties[] = {
1091         DEFINE_PROP_UINT32("index", PnvPHB3, phb_id, 0),
1092         DEFINE_PROP_UINT32("chip-id", PnvPHB3, chip_id, 0),
1093         DEFINE_PROP_LINK("chip", PnvPHB3, chip, TYPE_PNV_CHIP, PnvChip *),
1094         DEFINE_PROP_END_OF_LIST(),
1095 };
1096 
1097 static void pnv_phb3_class_init(ObjectClass *klass, void *data)
1098 {
1099     PCIHostBridgeClass *hc = PCI_HOST_BRIDGE_CLASS(klass);
1100     DeviceClass *dc = DEVICE_CLASS(klass);
1101 
1102     hc->root_bus_path = pnv_phb3_root_bus_path;
1103     dc->realize = pnv_phb3_realize;
1104     device_class_set_props(dc, pnv_phb3_properties);
1105     set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
1106     dc->user_creatable = false;
1107 }
1108 
1109 static const TypeInfo pnv_phb3_type_info = {
1110     .name          = TYPE_PNV_PHB3,
1111     .parent        = TYPE_PCIE_HOST_BRIDGE,
1112     .instance_size = sizeof(PnvPHB3),
1113     .class_init    = pnv_phb3_class_init,
1114     .instance_init = pnv_phb3_instance_init,
1115 };
1116 
1117 static void pnv_phb3_root_bus_class_init(ObjectClass *klass, void *data)
1118 {
1119     BusClass *k = BUS_CLASS(klass);
1120 
1121     /*
1122      * PHB3 has only a single root complex. Enforce the limit on the
1123      * parent bus
1124      */
1125     k->max_dev = 1;
1126 }
1127 
1128 static const TypeInfo pnv_phb3_root_bus_info = {
1129     .name = TYPE_PNV_PHB3_ROOT_BUS,
1130     .parent = TYPE_PCIE_BUS,
1131     .class_init = pnv_phb3_root_bus_class_init,
1132     .interfaces = (InterfaceInfo[]) {
1133         { INTERFACE_PCIE_DEVICE },
1134         { }
1135     },
1136 };
1137 
1138 static void pnv_phb3_root_port_realize(DeviceState *dev, Error **errp)
1139 {
1140     PCIERootPortClass *rpc = PCIE_ROOT_PORT_GET_CLASS(dev);
1141     PCIDevice *pci = PCI_DEVICE(dev);
1142     PCIBus *bus = pci_get_bus(pci);
1143     PnvPHB3 *phb = NULL;
1144     Error *local_err = NULL;
1145 
1146     phb = (PnvPHB3 *) object_dynamic_cast(OBJECT(bus->qbus.parent),
1147                                           TYPE_PNV_PHB3);
1148 
1149     if (!phb) {
1150         error_setg(errp,
1151 "pnv_phb3_root_port devices must be connected to pnv-phb3 buses");
1152         return;
1153     }
1154 
1155     /* Set unique chassis/slot values for the root port */
1156     qdev_prop_set_uint8(&pci->qdev, "chassis", phb->chip_id);
1157     qdev_prop_set_uint16(&pci->qdev, "slot", phb->phb_id);
1158 
1159     rpc->parent_realize(dev, &local_err);
1160     if (local_err) {
1161         error_propagate(errp, local_err);
1162         return;
1163     }
1164     pci_config_set_interrupt_pin(pci->config, 0);
1165 }
1166 
1167 static void pnv_phb3_root_port_class_init(ObjectClass *klass, void *data)
1168 {
1169     DeviceClass *dc = DEVICE_CLASS(klass);
1170     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
1171     PCIERootPortClass *rpc = PCIE_ROOT_PORT_CLASS(klass);
1172 
1173     dc->desc     = "IBM PHB3 PCIE Root Port";
1174 
1175     device_class_set_parent_realize(dc, pnv_phb3_root_port_realize,
1176                                     &rpc->parent_realize);
1177     dc->user_creatable = false;
1178 
1179     k->vendor_id = PCI_VENDOR_ID_IBM;
1180     k->device_id = 0x03dc;
1181     k->revision  = 0;
1182 
1183     rpc->exp_offset = 0x48;
1184     rpc->aer_offset = 0x100;
1185 }
1186 
1187 static const TypeInfo pnv_phb3_root_port_info = {
1188     .name          = TYPE_PNV_PHB3_ROOT_PORT,
1189     .parent        = TYPE_PCIE_ROOT_PORT,
1190     .instance_size = sizeof(PnvPHB3RootPort),
1191     .class_init    = pnv_phb3_root_port_class_init,
1192 };
1193 
1194 static void pnv_phb3_register_types(void)
1195 {
1196     type_register_static(&pnv_phb3_root_bus_info);
1197     type_register_static(&pnv_phb3_root_port_info);
1198     type_register_static(&pnv_phb3_type_info);
1199     type_register_static(&pnv_phb3_iommu_memory_region_info);
1200 }
1201 
1202 type_init(pnv_phb3_register_types)
1203