1 /* 2 * QEMU PowerPC PowerNV (POWER8) PHB3 model 3 * 4 * Copyright (c) 2014-2020, IBM Corporation. 5 * 6 * This code is licensed under the GPL version 2 or later. See the 7 * COPYING file in the top-level directory. 8 */ 9 #include "qemu/osdep.h" 10 #include "qemu/log.h" 11 #include "qapi/visitor.h" 12 #include "qapi/error.h" 13 #include "qemu-common.h" 14 #include "hw/pci-host/pnv_phb3_regs.h" 15 #include "hw/pci-host/pnv_phb3.h" 16 #include "hw/pci/pcie_host.h" 17 #include "hw/pci/pcie_port.h" 18 #include "hw/ppc/pnv.h" 19 #include "hw/irq.h" 20 #include "hw/qdev-properties.h" 21 #include "qom/object.h" 22 #include "sysemu/sysemu.h" 23 24 #define phb3_error(phb, fmt, ...) \ 25 qemu_log_mask(LOG_GUEST_ERROR, "phb3[%d:%d]: " fmt "\n", \ 26 (phb)->chip_id, (phb)->phb_id, ## __VA_ARGS__) 27 28 static PCIDevice *pnv_phb3_find_cfg_dev(PnvPHB3 *phb) 29 { 30 PCIHostState *pci = PCI_HOST_BRIDGE(phb); 31 uint64_t addr = phb->regs[PHB_CONFIG_ADDRESS >> 3]; 32 uint8_t bus, devfn; 33 34 if (!(addr >> 63)) { 35 return NULL; 36 } 37 bus = (addr >> 52) & 0xff; 38 devfn = (addr >> 44) & 0xff; 39 40 return pci_find_device(pci->bus, bus, devfn); 41 } 42 43 /* 44 * The CONFIG_DATA register expects little endian accesses, but as the 45 * region is big endian, we have to swap the value. 46 */ 47 static void pnv_phb3_config_write(PnvPHB3 *phb, unsigned off, 48 unsigned size, uint64_t val) 49 { 50 uint32_t cfg_addr, limit; 51 PCIDevice *pdev; 52 53 pdev = pnv_phb3_find_cfg_dev(phb); 54 if (!pdev) { 55 return; 56 } 57 cfg_addr = (phb->regs[PHB_CONFIG_ADDRESS >> 3] >> 32) & 0xffc; 58 cfg_addr |= off; 59 limit = pci_config_size(pdev); 60 if (limit <= cfg_addr) { 61 /* 62 * conventional pci device can be behind pcie-to-pci bridge. 63 * 256 <= addr < 4K has no effects. 64 */ 65 return; 66 } 67 switch (size) { 68 case 1: 69 break; 70 case 2: 71 val = bswap16(val); 72 break; 73 case 4: 74 val = bswap32(val); 75 break; 76 default: 77 g_assert_not_reached(); 78 } 79 pci_host_config_write_common(pdev, cfg_addr, limit, val, size); 80 } 81 82 static uint64_t pnv_phb3_config_read(PnvPHB3 *phb, unsigned off, 83 unsigned size) 84 { 85 uint32_t cfg_addr, limit; 86 PCIDevice *pdev; 87 uint64_t val; 88 89 pdev = pnv_phb3_find_cfg_dev(phb); 90 if (!pdev) { 91 return ~0ull; 92 } 93 cfg_addr = (phb->regs[PHB_CONFIG_ADDRESS >> 3] >> 32) & 0xffc; 94 cfg_addr |= off; 95 limit = pci_config_size(pdev); 96 if (limit <= cfg_addr) { 97 /* 98 * conventional pci device can be behind pcie-to-pci bridge. 99 * 256 <= addr < 4K has no effects. 100 */ 101 return ~0ull; 102 } 103 val = pci_host_config_read_common(pdev, cfg_addr, limit, size); 104 switch (size) { 105 case 1: 106 return val; 107 case 2: 108 return bswap16(val); 109 case 4: 110 return bswap32(val); 111 default: 112 g_assert_not_reached(); 113 } 114 } 115 116 static void pnv_phb3_check_m32(PnvPHB3 *phb) 117 { 118 uint64_t base, start, size; 119 MemoryRegion *parent; 120 PnvPBCQState *pbcq = &phb->pbcq; 121 122 if (memory_region_is_mapped(&phb->mr_m32)) { 123 memory_region_del_subregion(phb->mr_m32.container, &phb->mr_m32); 124 } 125 126 if (!(phb->regs[PHB_PHB3_CONFIG >> 3] & PHB_PHB3C_M32_EN)) { 127 return; 128 } 129 130 /* Grab geometry from registers */ 131 base = phb->regs[PHB_M32_BASE_ADDR >> 3]; 132 start = phb->regs[PHB_M32_START_ADDR >> 3]; 133 size = ~(phb->regs[PHB_M32_BASE_MASK >> 3] | 0xfffc000000000000ull) + 1; 134 135 /* Check if it matches an enabled MMIO region in the PBCQ */ 136 if (memory_region_is_mapped(&pbcq->mmbar0) && 137 base >= pbcq->mmio0_base && 138 (base + size) <= (pbcq->mmio0_base + pbcq->mmio0_size)) { 139 parent = &pbcq->mmbar0; 140 base -= pbcq->mmio0_base; 141 } else if (memory_region_is_mapped(&pbcq->mmbar1) && 142 base >= pbcq->mmio1_base && 143 (base + size) <= (pbcq->mmio1_base + pbcq->mmio1_size)) { 144 parent = &pbcq->mmbar1; 145 base -= pbcq->mmio1_base; 146 } else { 147 return; 148 } 149 150 /* Create alias */ 151 memory_region_init_alias(&phb->mr_m32, OBJECT(phb), "phb3-m32", 152 &phb->pci_mmio, start, size); 153 memory_region_add_subregion(parent, base, &phb->mr_m32); 154 } 155 156 static void pnv_phb3_check_m64(PnvPHB3 *phb, uint32_t index) 157 { 158 uint64_t base, start, size, m64; 159 MemoryRegion *parent; 160 PnvPBCQState *pbcq = &phb->pbcq; 161 162 if (memory_region_is_mapped(&phb->mr_m64[index])) { 163 /* Should we destroy it in RCU friendly way... ? */ 164 memory_region_del_subregion(phb->mr_m64[index].container, 165 &phb->mr_m64[index]); 166 } 167 168 /* Get table entry */ 169 m64 = phb->ioda_M64BT[index]; 170 171 if (!(m64 & IODA2_M64BT_ENABLE)) { 172 return; 173 } 174 175 /* Grab geometry from registers */ 176 base = GETFIELD(IODA2_M64BT_BASE, m64) << 20; 177 if (m64 & IODA2_M64BT_SINGLE_PE) { 178 base &= ~0x1ffffffull; 179 } 180 size = GETFIELD(IODA2_M64BT_MASK, m64) << 20; 181 size |= 0xfffc000000000000ull; 182 size = ~size + 1; 183 start = base | (phb->regs[PHB_M64_UPPER_BITS >> 3]); 184 185 /* Check if it matches an enabled MMIO region in the PBCQ */ 186 if (memory_region_is_mapped(&pbcq->mmbar0) && 187 base >= pbcq->mmio0_base && 188 (base + size) <= (pbcq->mmio0_base + pbcq->mmio0_size)) { 189 parent = &pbcq->mmbar0; 190 base -= pbcq->mmio0_base; 191 } else if (memory_region_is_mapped(&pbcq->mmbar1) && 192 base >= pbcq->mmio1_base && 193 (base + size) <= (pbcq->mmio1_base + pbcq->mmio1_size)) { 194 parent = &pbcq->mmbar1; 195 base -= pbcq->mmio1_base; 196 } else { 197 return; 198 } 199 200 /* Create alias */ 201 memory_region_init_alias(&phb->mr_m64[index], OBJECT(phb), "phb3-m64", 202 &phb->pci_mmio, start, size); 203 memory_region_add_subregion(parent, base, &phb->mr_m64[index]); 204 } 205 206 static void pnv_phb3_check_all_m64s(PnvPHB3 *phb) 207 { 208 uint64_t i; 209 210 for (i = 0; i < PNV_PHB3_NUM_M64; i++) { 211 pnv_phb3_check_m64(phb, i); 212 } 213 } 214 215 static void pnv_phb3_lxivt_write(PnvPHB3 *phb, unsigned idx, uint64_t val) 216 { 217 uint8_t server, prio; 218 219 phb->ioda_LXIVT[idx] = val & (IODA2_LXIVT_SERVER | 220 IODA2_LXIVT_PRIORITY | 221 IODA2_LXIVT_NODE_ID); 222 server = GETFIELD(IODA2_LXIVT_SERVER, val); 223 prio = GETFIELD(IODA2_LXIVT_PRIORITY, val); 224 225 /* 226 * The low order 2 bits are the link pointer (Type II interrupts). 227 * Shift back to get a valid IRQ server. 228 */ 229 server >>= 2; 230 231 ics_write_xive(&phb->lsis, idx, server, prio, prio); 232 } 233 234 static uint64_t *pnv_phb3_ioda_access(PnvPHB3 *phb, 235 unsigned *out_table, unsigned *out_idx) 236 { 237 uint64_t adreg = phb->regs[PHB_IODA_ADDR >> 3]; 238 unsigned int index = GETFIELD(PHB_IODA_AD_TADR, adreg); 239 unsigned int table = GETFIELD(PHB_IODA_AD_TSEL, adreg); 240 unsigned int mask; 241 uint64_t *tptr = NULL; 242 243 switch (table) { 244 case IODA2_TBL_LIST: 245 tptr = phb->ioda_LIST; 246 mask = 7; 247 break; 248 case IODA2_TBL_LXIVT: 249 tptr = phb->ioda_LXIVT; 250 mask = 7; 251 break; 252 case IODA2_TBL_IVC_CAM: 253 case IODA2_TBL_RBA: 254 mask = 31; 255 break; 256 case IODA2_TBL_RCAM: 257 mask = 63; 258 break; 259 case IODA2_TBL_MRT: 260 mask = 7; 261 break; 262 case IODA2_TBL_PESTA: 263 case IODA2_TBL_PESTB: 264 mask = 255; 265 break; 266 case IODA2_TBL_TVT: 267 tptr = phb->ioda_TVT; 268 mask = 511; 269 break; 270 case IODA2_TBL_TCAM: 271 case IODA2_TBL_TDR: 272 mask = 63; 273 break; 274 case IODA2_TBL_M64BT: 275 tptr = phb->ioda_M64BT; 276 mask = 15; 277 break; 278 case IODA2_TBL_M32DT: 279 tptr = phb->ioda_MDT; 280 mask = 255; 281 break; 282 case IODA2_TBL_PEEV: 283 tptr = phb->ioda_PEEV; 284 mask = 3; 285 break; 286 default: 287 phb3_error(phb, "invalid IODA table %d", table); 288 return NULL; 289 } 290 index &= mask; 291 if (out_idx) { 292 *out_idx = index; 293 } 294 if (out_table) { 295 *out_table = table; 296 } 297 if (tptr) { 298 tptr += index; 299 } 300 if (adreg & PHB_IODA_AD_AUTOINC) { 301 index = (index + 1) & mask; 302 adreg = SETFIELD(PHB_IODA_AD_TADR, adreg, index); 303 } 304 phb->regs[PHB_IODA_ADDR >> 3] = adreg; 305 return tptr; 306 } 307 308 static uint64_t pnv_phb3_ioda_read(PnvPHB3 *phb) 309 { 310 unsigned table; 311 uint64_t *tptr; 312 313 tptr = pnv_phb3_ioda_access(phb, &table, NULL); 314 if (!tptr) { 315 /* Return 0 on unsupported tables, not ff's */ 316 return 0; 317 } 318 return *tptr; 319 } 320 321 static void pnv_phb3_ioda_write(PnvPHB3 *phb, uint64_t val) 322 { 323 unsigned table, idx; 324 uint64_t *tptr; 325 326 tptr = pnv_phb3_ioda_access(phb, &table, &idx); 327 if (!tptr) { 328 return; 329 } 330 331 /* Handle side effects */ 332 switch (table) { 333 case IODA2_TBL_LXIVT: 334 pnv_phb3_lxivt_write(phb, idx, val); 335 break; 336 case IODA2_TBL_M64BT: 337 *tptr = val; 338 pnv_phb3_check_m64(phb, idx); 339 break; 340 default: 341 *tptr = val; 342 } 343 } 344 345 /* 346 * This is called whenever the PHB LSI, MSI source ID register or 347 * the PBCQ irq filters are written. 348 */ 349 void pnv_phb3_remap_irqs(PnvPHB3 *phb) 350 { 351 ICSState *ics = &phb->lsis; 352 uint32_t local, global, count, mask, comp; 353 uint64_t baren; 354 PnvPBCQState *pbcq = &phb->pbcq; 355 356 /* 357 * First check if we are enabled. Unlike real HW we don't separate 358 * TX and RX so we enable if both are set 359 */ 360 baren = pbcq->nest_regs[PBCQ_NEST_BAR_EN]; 361 if (!(baren & PBCQ_NEST_BAR_EN_IRSN_RX) || 362 !(baren & PBCQ_NEST_BAR_EN_IRSN_TX)) { 363 ics->offset = 0; 364 return; 365 } 366 367 /* Grab local LSI source ID */ 368 local = GETFIELD(PHB_LSI_SRC_ID, phb->regs[PHB_LSI_SOURCE_ID >> 3]) << 3; 369 370 /* Grab global one and compare */ 371 global = GETFIELD(PBCQ_NEST_LSI_SRC, 372 pbcq->nest_regs[PBCQ_NEST_LSI_SRC_ID]) << 3; 373 if (global != local) { 374 /* 375 * This happens during initialization, let's come back when we 376 * are properly configured 377 */ 378 ics->offset = 0; 379 return; 380 } 381 382 /* Get the base on the powerbus */ 383 comp = GETFIELD(PBCQ_NEST_IRSN_COMP, 384 pbcq->nest_regs[PBCQ_NEST_IRSN_COMPARE]); 385 mask = GETFIELD(PBCQ_NEST_IRSN_COMP, 386 pbcq->nest_regs[PBCQ_NEST_IRSN_MASK]); 387 count = ((~mask) + 1) & 0x7ffff; 388 phb->total_irq = count; 389 390 /* Sanity checks */ 391 if ((global + PNV_PHB3_NUM_LSI) > count) { 392 phb3_error(phb, "LSIs out of reach: LSI base=%d total irq=%d", global, 393 count); 394 } 395 396 if (count > 2048) { 397 phb3_error(phb, "More interrupts than supported: %d", count); 398 } 399 400 if ((comp & mask) != comp) { 401 phb3_error(phb, "IRQ compare bits not in mask: comp=0x%x mask=0x%x", 402 comp, mask); 403 comp &= mask; 404 } 405 /* Setup LSI offset */ 406 ics->offset = comp + global; 407 408 /* Setup MSI offset */ 409 pnv_phb3_msi_update_config(&phb->msis, comp, count - PNV_PHB3_NUM_LSI); 410 } 411 412 static void pnv_phb3_lsi_src_id_write(PnvPHB3 *phb, uint64_t val) 413 { 414 /* Sanitize content */ 415 val &= PHB_LSI_SRC_ID; 416 phb->regs[PHB_LSI_SOURCE_ID >> 3] = val; 417 pnv_phb3_remap_irqs(phb); 418 } 419 420 static void pnv_phb3_rtc_invalidate(PnvPHB3 *phb, uint64_t val) 421 { 422 PnvPhb3DMASpace *ds; 423 424 /* Always invalidate all for now ... */ 425 QLIST_FOREACH(ds, &phb->dma_spaces, list) { 426 ds->pe_num = PHB_INVALID_PE; 427 } 428 } 429 430 431 static void pnv_phb3_update_msi_regions(PnvPhb3DMASpace *ds) 432 { 433 uint64_t cfg = ds->phb->regs[PHB_PHB3_CONFIG >> 3]; 434 435 if (cfg & PHB_PHB3C_32BIT_MSI_EN) { 436 if (!memory_region_is_mapped(&ds->msi32_mr)) { 437 memory_region_add_subregion(MEMORY_REGION(&ds->dma_mr), 438 0xffff0000, &ds->msi32_mr); 439 } 440 } else { 441 if (memory_region_is_mapped(&ds->msi32_mr)) { 442 memory_region_del_subregion(MEMORY_REGION(&ds->dma_mr), 443 &ds->msi32_mr); 444 } 445 } 446 447 if (cfg & PHB_PHB3C_64BIT_MSI_EN) { 448 if (!memory_region_is_mapped(&ds->msi64_mr)) { 449 memory_region_add_subregion(MEMORY_REGION(&ds->dma_mr), 450 (1ull << 60), &ds->msi64_mr); 451 } 452 } else { 453 if (memory_region_is_mapped(&ds->msi64_mr)) { 454 memory_region_del_subregion(MEMORY_REGION(&ds->dma_mr), 455 &ds->msi64_mr); 456 } 457 } 458 } 459 460 static void pnv_phb3_update_all_msi_regions(PnvPHB3 *phb) 461 { 462 PnvPhb3DMASpace *ds; 463 464 QLIST_FOREACH(ds, &phb->dma_spaces, list) { 465 pnv_phb3_update_msi_regions(ds); 466 } 467 } 468 469 void pnv_phb3_reg_write(void *opaque, hwaddr off, uint64_t val, unsigned size) 470 { 471 PnvPHB3 *phb = opaque; 472 bool changed; 473 474 /* Special case configuration data */ 475 if ((off & 0xfffc) == PHB_CONFIG_DATA) { 476 pnv_phb3_config_write(phb, off & 0x3, size, val); 477 return; 478 } 479 480 /* Other registers are 64-bit only */ 481 if (size != 8 || off & 0x7) { 482 phb3_error(phb, "Invalid register access, offset: 0x%"PRIx64" size: %d", 483 off, size); 484 return; 485 } 486 487 /* Handle masking & filtering */ 488 switch (off) { 489 case PHB_M64_UPPER_BITS: 490 val &= 0xfffc000000000000ull; 491 break; 492 case PHB_Q_DMA_R: 493 /* 494 * This is enough logic to make SW happy but we aren't actually 495 * quiescing the DMAs 496 */ 497 if (val & PHB_Q_DMA_R_AUTORESET) { 498 val = 0; 499 } else { 500 val &= PHB_Q_DMA_R_QUIESCE_DMA; 501 } 502 break; 503 /* LEM stuff */ 504 case PHB_LEM_FIR_AND_MASK: 505 phb->regs[PHB_LEM_FIR_ACCUM >> 3] &= val; 506 return; 507 case PHB_LEM_FIR_OR_MASK: 508 phb->regs[PHB_LEM_FIR_ACCUM >> 3] |= val; 509 return; 510 case PHB_LEM_ERROR_AND_MASK: 511 phb->regs[PHB_LEM_ERROR_MASK >> 3] &= val; 512 return; 513 case PHB_LEM_ERROR_OR_MASK: 514 phb->regs[PHB_LEM_ERROR_MASK >> 3] |= val; 515 return; 516 case PHB_LEM_WOF: 517 val = 0; 518 break; 519 } 520 521 /* Record whether it changed */ 522 changed = phb->regs[off >> 3] != val; 523 524 /* Store in register cache first */ 525 phb->regs[off >> 3] = val; 526 527 /* Handle side effects */ 528 switch (off) { 529 case PHB_PHB3_CONFIG: 530 if (changed) { 531 pnv_phb3_update_all_msi_regions(phb); 532 } 533 /* fall through */ 534 case PHB_M32_BASE_ADDR: 535 case PHB_M32_BASE_MASK: 536 case PHB_M32_START_ADDR: 537 if (changed) { 538 pnv_phb3_check_m32(phb); 539 } 540 break; 541 case PHB_M64_UPPER_BITS: 542 if (changed) { 543 pnv_phb3_check_all_m64s(phb); 544 } 545 break; 546 case PHB_LSI_SOURCE_ID: 547 if (changed) { 548 pnv_phb3_lsi_src_id_write(phb, val); 549 } 550 break; 551 552 /* IODA table accesses */ 553 case PHB_IODA_DATA0: 554 pnv_phb3_ioda_write(phb, val); 555 break; 556 557 /* RTC invalidation */ 558 case PHB_RTC_INVALIDATE: 559 pnv_phb3_rtc_invalidate(phb, val); 560 break; 561 562 /* FFI request */ 563 case PHB_FFI_REQUEST: 564 pnv_phb3_msi_ffi(&phb->msis, val); 565 break; 566 567 /* Silent simple writes */ 568 case PHB_CONFIG_ADDRESS: 569 case PHB_IODA_ADDR: 570 case PHB_TCE_KILL: 571 case PHB_TCE_SPEC_CTL: 572 case PHB_PEST_BAR: 573 case PHB_PELTV_BAR: 574 case PHB_RTT_BAR: 575 case PHB_RBA_BAR: 576 case PHB_IVT_BAR: 577 case PHB_FFI_LOCK: 578 case PHB_LEM_FIR_ACCUM: 579 case PHB_LEM_ERROR_MASK: 580 case PHB_LEM_ACTION0: 581 case PHB_LEM_ACTION1: 582 break; 583 584 /* Noise on anything else */ 585 default: 586 qemu_log_mask(LOG_UNIMP, "phb3: reg_write 0x%"PRIx64"=%"PRIx64"\n", 587 off, val); 588 } 589 } 590 591 uint64_t pnv_phb3_reg_read(void *opaque, hwaddr off, unsigned size) 592 { 593 PnvPHB3 *phb = opaque; 594 PCIHostState *pci = PCI_HOST_BRIDGE(phb); 595 uint64_t val; 596 597 if ((off & 0xfffc) == PHB_CONFIG_DATA) { 598 return pnv_phb3_config_read(phb, off & 0x3, size); 599 } 600 601 /* Other registers are 64-bit only */ 602 if (size != 8 || off & 0x7) { 603 phb3_error(phb, "Invalid register access, offset: 0x%"PRIx64" size: %d", 604 off, size); 605 return ~0ull; 606 } 607 608 /* Default read from cache */ 609 val = phb->regs[off >> 3]; 610 611 switch (off) { 612 /* Simulate venice DD2.0 */ 613 case PHB_VERSION: 614 return 0x000000a300000005ull; 615 case PHB_PCIE_SYSTEM_CONFIG: 616 return 0x441100fc30000000; 617 618 /* IODA table accesses */ 619 case PHB_IODA_DATA0: 620 return pnv_phb3_ioda_read(phb); 621 622 /* Link training always appears trained */ 623 case PHB_PCIE_DLP_TRAIN_CTL: 624 if (!pci_find_device(pci->bus, 1, 0)) { 625 return 0; 626 } 627 return PHB_PCIE_DLP_INBAND_PRESENCE | PHB_PCIE_DLP_TC_DL_LINKACT; 628 629 /* FFI Lock */ 630 case PHB_FFI_LOCK: 631 /* Set lock and return previous value */ 632 phb->regs[off >> 3] |= PHB_FFI_LOCK_STATE; 633 return val; 634 635 /* DMA read sync: make it look like it's complete */ 636 case PHB_DMARD_SYNC: 637 return PHB_DMARD_SYNC_COMPLETE; 638 639 /* Silent simple reads */ 640 case PHB_PHB3_CONFIG: 641 case PHB_M32_BASE_ADDR: 642 case PHB_M32_BASE_MASK: 643 case PHB_M32_START_ADDR: 644 case PHB_CONFIG_ADDRESS: 645 case PHB_IODA_ADDR: 646 case PHB_RTC_INVALIDATE: 647 case PHB_TCE_KILL: 648 case PHB_TCE_SPEC_CTL: 649 case PHB_PEST_BAR: 650 case PHB_PELTV_BAR: 651 case PHB_RTT_BAR: 652 case PHB_RBA_BAR: 653 case PHB_IVT_BAR: 654 case PHB_M64_UPPER_BITS: 655 case PHB_LEM_FIR_ACCUM: 656 case PHB_LEM_ERROR_MASK: 657 case PHB_LEM_ACTION0: 658 case PHB_LEM_ACTION1: 659 break; 660 661 /* Noise on anything else */ 662 default: 663 qemu_log_mask(LOG_UNIMP, "phb3: reg_read 0x%"PRIx64"=%"PRIx64"\n", 664 off, val); 665 } 666 return val; 667 } 668 669 static const MemoryRegionOps pnv_phb3_reg_ops = { 670 .read = pnv_phb3_reg_read, 671 .write = pnv_phb3_reg_write, 672 .valid.min_access_size = 1, 673 .valid.max_access_size = 8, 674 .impl.min_access_size = 1, 675 .impl.max_access_size = 8, 676 .endianness = DEVICE_BIG_ENDIAN, 677 }; 678 679 static int pnv_phb3_map_irq(PCIDevice *pci_dev, int irq_num) 680 { 681 /* Check that out properly ... */ 682 return irq_num & 3; 683 } 684 685 static void pnv_phb3_set_irq(void *opaque, int irq_num, int level) 686 { 687 PnvPHB3 *phb = opaque; 688 689 /* LSI only ... */ 690 if (irq_num > 3) { 691 phb3_error(phb, "Unknown IRQ to set %d", irq_num); 692 } 693 qemu_set_irq(phb->qirqs[irq_num], level); 694 } 695 696 static bool pnv_phb3_resolve_pe(PnvPhb3DMASpace *ds) 697 { 698 uint64_t rtt, addr; 699 uint16_t rte; 700 int bus_num; 701 702 /* Already resolved ? */ 703 if (ds->pe_num != PHB_INVALID_PE) { 704 return true; 705 } 706 707 /* We need to lookup the RTT */ 708 rtt = ds->phb->regs[PHB_RTT_BAR >> 3]; 709 if (!(rtt & PHB_RTT_BAR_ENABLE)) { 710 phb3_error(ds->phb, "DMA with RTT BAR disabled !"); 711 /* Set error bits ? fence ? ... */ 712 return false; 713 } 714 715 /* Read RTE */ 716 bus_num = pci_bus_num(ds->bus); 717 addr = rtt & PHB_RTT_BASE_ADDRESS_MASK; 718 addr += 2 * ((bus_num << 8) | ds->devfn); 719 if (dma_memory_read(&address_space_memory, addr, &rte, 720 sizeof(rte), MEMTXATTRS_UNSPECIFIED)) { 721 phb3_error(ds->phb, "Failed to read RTT entry at 0x%"PRIx64, addr); 722 /* Set error bits ? fence ? ... */ 723 return false; 724 } 725 rte = be16_to_cpu(rte); 726 727 /* Fail upon reading of invalid PE# */ 728 if (rte >= PNV_PHB3_NUM_PE) { 729 phb3_error(ds->phb, "RTE for RID 0x%x invalid (%04x", ds->devfn, rte); 730 /* Set error bits ? fence ? ... */ 731 return false; 732 } 733 ds->pe_num = rte; 734 return true; 735 } 736 737 static void pnv_phb3_translate_tve(PnvPhb3DMASpace *ds, hwaddr addr, 738 bool is_write, uint64_t tve, 739 IOMMUTLBEntry *tlb) 740 { 741 uint64_t tta = GETFIELD(IODA2_TVT_TABLE_ADDR, tve); 742 int32_t lev = GETFIELD(IODA2_TVT_NUM_LEVELS, tve); 743 uint32_t tts = GETFIELD(IODA2_TVT_TCE_TABLE_SIZE, tve); 744 uint32_t tps = GETFIELD(IODA2_TVT_IO_PSIZE, tve); 745 PnvPHB3 *phb = ds->phb; 746 747 /* Invalid levels */ 748 if (lev > 4) { 749 phb3_error(phb, "Invalid #levels in TVE %d", lev); 750 return; 751 } 752 753 /* IO Page Size of 0 means untranslated, else use TCEs */ 754 if (tps == 0) { 755 /* 756 * We only support non-translate in top window. 757 * 758 * TODO: Venice/Murano support it on bottom window above 4G and 759 * Naples suports it on everything 760 */ 761 if (!(tve & PPC_BIT(51))) { 762 phb3_error(phb, "xlate for invalid non-translate TVE"); 763 return; 764 } 765 /* TODO: Handle boundaries */ 766 767 /* Use 4k pages like q35 ... for now */ 768 tlb->iova = addr & 0xfffffffffffff000ull; 769 tlb->translated_addr = addr & 0x0003fffffffff000ull; 770 tlb->addr_mask = 0xfffull; 771 tlb->perm = IOMMU_RW; 772 } else { 773 uint32_t tce_shift, tbl_shift, sh; 774 uint64_t base, taddr, tce, tce_mask; 775 776 /* TVE disabled ? */ 777 if (tts == 0) { 778 phb3_error(phb, "xlate for invalid translated TVE"); 779 return; 780 } 781 782 /* Address bits per bottom level TCE entry */ 783 tce_shift = tps + 11; 784 785 /* Address bits per table level */ 786 tbl_shift = tts + 8; 787 788 /* Top level table base address */ 789 base = tta << 12; 790 791 /* Total shift to first level */ 792 sh = tbl_shift * lev + tce_shift; 793 794 /* TODO: Multi-level untested */ 795 do { 796 lev--; 797 798 /* Grab the TCE address */ 799 taddr = base | (((addr >> sh) & ((1ul << tbl_shift) - 1)) << 3); 800 if (dma_memory_read(&address_space_memory, taddr, &tce, 801 sizeof(tce), MEMTXATTRS_UNSPECIFIED)) { 802 phb3_error(phb, "Failed to read TCE at 0x%"PRIx64, taddr); 803 return; 804 } 805 tce = be64_to_cpu(tce); 806 807 /* Check permission for indirect TCE */ 808 if ((lev >= 0) && !(tce & 3)) { 809 phb3_error(phb, "Invalid indirect TCE at 0x%"PRIx64, taddr); 810 phb3_error(phb, " xlate %"PRIx64":%c TVE=%"PRIx64, addr, 811 is_write ? 'W' : 'R', tve); 812 phb3_error(phb, " tta=%"PRIx64" lev=%d tts=%d tps=%d", 813 tta, lev, tts, tps); 814 return; 815 } 816 sh -= tbl_shift; 817 base = tce & ~0xfffull; 818 } while (lev >= 0); 819 820 /* We exit the loop with TCE being the final TCE */ 821 if ((is_write & !(tce & 2)) || ((!is_write) && !(tce & 1))) { 822 phb3_error(phb, "TCE access fault at 0x%"PRIx64, taddr); 823 phb3_error(phb, " xlate %"PRIx64":%c TVE=%"PRIx64, addr, 824 is_write ? 'W' : 'R', tve); 825 phb3_error(phb, " tta=%"PRIx64" lev=%d tts=%d tps=%d", 826 tta, lev, tts, tps); 827 return; 828 } 829 tce_mask = ~((1ull << tce_shift) - 1); 830 tlb->iova = addr & tce_mask; 831 tlb->translated_addr = tce & tce_mask; 832 tlb->addr_mask = ~tce_mask; 833 tlb->perm = tce & 3; 834 } 835 } 836 837 static IOMMUTLBEntry pnv_phb3_translate_iommu(IOMMUMemoryRegion *iommu, 838 hwaddr addr, 839 IOMMUAccessFlags flag, 840 int iommu_idx) 841 { 842 PnvPhb3DMASpace *ds = container_of(iommu, PnvPhb3DMASpace, dma_mr); 843 int tve_sel; 844 uint64_t tve, cfg; 845 IOMMUTLBEntry ret = { 846 .target_as = &address_space_memory, 847 .iova = addr, 848 .translated_addr = 0, 849 .addr_mask = ~(hwaddr)0, 850 .perm = IOMMU_NONE, 851 }; 852 PnvPHB3 *phb = ds->phb; 853 854 /* Resolve PE# */ 855 if (!pnv_phb3_resolve_pe(ds)) { 856 phb3_error(phb, "Failed to resolve PE# for bus @%p (%d) devfn 0x%x", 857 ds->bus, pci_bus_num(ds->bus), ds->devfn); 858 return ret; 859 } 860 861 /* Check top bits */ 862 switch (addr >> 60) { 863 case 00: 864 /* DMA or 32-bit MSI ? */ 865 cfg = ds->phb->regs[PHB_PHB3_CONFIG >> 3]; 866 if ((cfg & PHB_PHB3C_32BIT_MSI_EN) && 867 ((addr & 0xffffffffffff0000ull) == 0xffff0000ull)) { 868 phb3_error(phb, "xlate on 32-bit MSI region"); 869 return ret; 870 } 871 /* Choose TVE XXX Use PHB3 Control Register */ 872 tve_sel = (addr >> 59) & 1; 873 tve = ds->phb->ioda_TVT[ds->pe_num * 2 + tve_sel]; 874 pnv_phb3_translate_tve(ds, addr, flag & IOMMU_WO, tve, &ret); 875 break; 876 case 01: 877 phb3_error(phb, "xlate on 64-bit MSI region"); 878 break; 879 default: 880 phb3_error(phb, "xlate on unsupported address 0x%"PRIx64, addr); 881 } 882 return ret; 883 } 884 885 #define TYPE_PNV_PHB3_IOMMU_MEMORY_REGION "pnv-phb3-iommu-memory-region" 886 DECLARE_INSTANCE_CHECKER(IOMMUMemoryRegion, PNV_PHB3_IOMMU_MEMORY_REGION, 887 TYPE_PNV_PHB3_IOMMU_MEMORY_REGION) 888 889 static void pnv_phb3_iommu_memory_region_class_init(ObjectClass *klass, 890 void *data) 891 { 892 IOMMUMemoryRegionClass *imrc = IOMMU_MEMORY_REGION_CLASS(klass); 893 894 imrc->translate = pnv_phb3_translate_iommu; 895 } 896 897 static const TypeInfo pnv_phb3_iommu_memory_region_info = { 898 .parent = TYPE_IOMMU_MEMORY_REGION, 899 .name = TYPE_PNV_PHB3_IOMMU_MEMORY_REGION, 900 .class_init = pnv_phb3_iommu_memory_region_class_init, 901 }; 902 903 /* 904 * MSI/MSIX memory region implementation. 905 * The handler handles both MSI and MSIX. 906 */ 907 static void pnv_phb3_msi_write(void *opaque, hwaddr addr, 908 uint64_t data, unsigned size) 909 { 910 PnvPhb3DMASpace *ds = opaque; 911 912 /* Resolve PE# */ 913 if (!pnv_phb3_resolve_pe(ds)) { 914 phb3_error(ds->phb, "Failed to resolve PE# for bus @%p (%d) devfn 0x%x", 915 ds->bus, pci_bus_num(ds->bus), ds->devfn); 916 return; 917 } 918 919 pnv_phb3_msi_send(&ds->phb->msis, addr, data, ds->pe_num); 920 } 921 922 /* There is no .read as the read result is undefined by PCI spec */ 923 static uint64_t pnv_phb3_msi_read(void *opaque, hwaddr addr, unsigned size) 924 { 925 PnvPhb3DMASpace *ds = opaque; 926 927 phb3_error(ds->phb, "invalid read @ 0x%" HWADDR_PRIx, addr); 928 return -1; 929 } 930 931 static const MemoryRegionOps pnv_phb3_msi_ops = { 932 .read = pnv_phb3_msi_read, 933 .write = pnv_phb3_msi_write, 934 .endianness = DEVICE_LITTLE_ENDIAN 935 }; 936 937 static AddressSpace *pnv_phb3_dma_iommu(PCIBus *bus, void *opaque, int devfn) 938 { 939 PnvPHB3 *phb = opaque; 940 PnvPhb3DMASpace *ds; 941 942 QLIST_FOREACH(ds, &phb->dma_spaces, list) { 943 if (ds->bus == bus && ds->devfn == devfn) { 944 break; 945 } 946 } 947 948 if (ds == NULL) { 949 ds = g_malloc0(sizeof(PnvPhb3DMASpace)); 950 ds->bus = bus; 951 ds->devfn = devfn; 952 ds->pe_num = PHB_INVALID_PE; 953 ds->phb = phb; 954 memory_region_init_iommu(&ds->dma_mr, sizeof(ds->dma_mr), 955 TYPE_PNV_PHB3_IOMMU_MEMORY_REGION, 956 OBJECT(phb), "phb3_iommu", UINT64_MAX); 957 address_space_init(&ds->dma_as, MEMORY_REGION(&ds->dma_mr), 958 "phb3_iommu"); 959 memory_region_init_io(&ds->msi32_mr, OBJECT(phb), &pnv_phb3_msi_ops, 960 ds, "msi32", 0x10000); 961 memory_region_init_io(&ds->msi64_mr, OBJECT(phb), &pnv_phb3_msi_ops, 962 ds, "msi64", 0x100000); 963 pnv_phb3_update_msi_regions(ds); 964 965 QLIST_INSERT_HEAD(&phb->dma_spaces, ds, list); 966 } 967 return &ds->dma_as; 968 } 969 970 static void pnv_phb3_instance_init(Object *obj) 971 { 972 PnvPHB3 *phb = PNV_PHB3(obj); 973 974 QLIST_INIT(&phb->dma_spaces); 975 976 /* LSI sources */ 977 object_initialize_child(obj, "lsi", &phb->lsis, TYPE_ICS); 978 979 /* Default init ... will be fixed by HW inits */ 980 phb->lsis.offset = 0; 981 982 /* MSI sources */ 983 object_initialize_child(obj, "msi", &phb->msis, TYPE_PHB3_MSI); 984 985 /* Power Bus Common Queue */ 986 object_initialize_child(obj, "pbcq", &phb->pbcq, TYPE_PNV_PBCQ); 987 988 } 989 990 static void pnv_phb3_realize(DeviceState *dev, Error **errp) 991 { 992 PnvPHB3 *phb = PNV_PHB3(dev); 993 PCIHostState *pci = PCI_HOST_BRIDGE(dev); 994 PnvMachineState *pnv = PNV_MACHINE(qdev_get_machine()); 995 int i; 996 997 /* User created devices */ 998 if (!phb->chip) { 999 Error *local_err = NULL; 1000 BusState *s; 1001 1002 phb->chip = pnv_get_chip(pnv, phb->chip_id); 1003 if (!phb->chip) { 1004 error_setg(errp, "invalid chip id: %d", phb->chip_id); 1005 return; 1006 } 1007 1008 /* 1009 * Reparent user created devices to the chip to build 1010 * correctly the device tree. 1011 */ 1012 pnv_chip_parent_fixup(phb->chip, OBJECT(phb), phb->phb_id); 1013 1014 s = qdev_get_parent_bus(DEVICE(phb->chip)); 1015 if (!qdev_set_parent_bus(DEVICE(phb), s, &local_err)) { 1016 error_propagate(errp, local_err); 1017 return; 1018 } 1019 } 1020 1021 if (phb->phb_id >= PNV_CHIP_GET_CLASS(phb->chip)->num_phbs) { 1022 error_setg(errp, "invalid PHB index: %d", phb->phb_id); 1023 return; 1024 } 1025 1026 /* LSI sources */ 1027 object_property_set_link(OBJECT(&phb->lsis), "xics", OBJECT(pnv), 1028 &error_abort); 1029 object_property_set_int(OBJECT(&phb->lsis), "nr-irqs", PNV_PHB3_NUM_LSI, 1030 &error_abort); 1031 if (!qdev_realize(DEVICE(&phb->lsis), NULL, errp)) { 1032 return; 1033 } 1034 1035 for (i = 0; i < phb->lsis.nr_irqs; i++) { 1036 ics_set_irq_type(&phb->lsis, i, true); 1037 } 1038 1039 phb->qirqs = qemu_allocate_irqs(ics_set_irq, &phb->lsis, phb->lsis.nr_irqs); 1040 1041 /* MSI sources */ 1042 object_property_set_link(OBJECT(&phb->msis), "phb", OBJECT(phb), 1043 &error_abort); 1044 object_property_set_link(OBJECT(&phb->msis), "xics", OBJECT(pnv), 1045 &error_abort); 1046 object_property_set_int(OBJECT(&phb->msis), "nr-irqs", PHB3_MAX_MSI, 1047 &error_abort); 1048 if (!qdev_realize(DEVICE(&phb->msis), NULL, errp)) { 1049 return; 1050 } 1051 1052 /* Power Bus Common Queue */ 1053 object_property_set_link(OBJECT(&phb->pbcq), "phb", OBJECT(phb), 1054 &error_abort); 1055 if (!qdev_realize(DEVICE(&phb->pbcq), NULL, errp)) { 1056 return; 1057 } 1058 1059 /* Controller Registers */ 1060 memory_region_init_io(&phb->mr_regs, OBJECT(phb), &pnv_phb3_reg_ops, phb, 1061 "phb3-regs", 0x1000); 1062 1063 /* 1064 * PHB3 doesn't support IO space. However, qemu gets very upset if 1065 * we don't have an IO region to anchor IO BARs onto so we just 1066 * initialize one which we never hook up to anything 1067 */ 1068 memory_region_init(&phb->pci_io, OBJECT(phb), "pci-io", 0x10000); 1069 memory_region_init(&phb->pci_mmio, OBJECT(phb), "pci-mmio", 1070 PCI_MMIO_TOTAL_SIZE); 1071 1072 pci->bus = pci_register_root_bus(dev, 1073 dev->id ? dev->id : NULL, 1074 pnv_phb3_set_irq, pnv_phb3_map_irq, phb, 1075 &phb->pci_mmio, &phb->pci_io, 1076 0, 4, TYPE_PNV_PHB3_ROOT_BUS); 1077 1078 pci_setup_iommu(pci->bus, pnv_phb3_dma_iommu, phb); 1079 1080 if (defaults_enabled()) { 1081 pnv_phb_attach_root_port(PCI_HOST_BRIDGE(phb), 1082 TYPE_PNV_PHB3_ROOT_PORT); 1083 } 1084 } 1085 1086 void pnv_phb3_update_regions(PnvPHB3 *phb) 1087 { 1088 PnvPBCQState *pbcq = &phb->pbcq; 1089 1090 /* Unmap first always */ 1091 if (memory_region_is_mapped(&phb->mr_regs)) { 1092 memory_region_del_subregion(&pbcq->phbbar, &phb->mr_regs); 1093 } 1094 1095 /* Map registers if enabled */ 1096 if (memory_region_is_mapped(&pbcq->phbbar)) { 1097 /* TODO: We should use the PHB BAR 2 register but we don't ... */ 1098 memory_region_add_subregion(&pbcq->phbbar, 0, &phb->mr_regs); 1099 } 1100 1101 /* Check/update m32 */ 1102 if (memory_region_is_mapped(&phb->mr_m32)) { 1103 pnv_phb3_check_m32(phb); 1104 } 1105 pnv_phb3_check_all_m64s(phb); 1106 } 1107 1108 static const char *pnv_phb3_root_bus_path(PCIHostState *host_bridge, 1109 PCIBus *rootbus) 1110 { 1111 PnvPHB3 *phb = PNV_PHB3(host_bridge); 1112 1113 snprintf(phb->bus_path, sizeof(phb->bus_path), "00%02x:%02x", 1114 phb->chip_id, phb->phb_id); 1115 return phb->bus_path; 1116 } 1117 1118 static Property pnv_phb3_properties[] = { 1119 DEFINE_PROP_UINT32("index", PnvPHB3, phb_id, 0), 1120 DEFINE_PROP_UINT32("chip-id", PnvPHB3, chip_id, 0), 1121 DEFINE_PROP_LINK("chip", PnvPHB3, chip, TYPE_PNV_CHIP, PnvChip *), 1122 DEFINE_PROP_END_OF_LIST(), 1123 }; 1124 1125 static void pnv_phb3_class_init(ObjectClass *klass, void *data) 1126 { 1127 PCIHostBridgeClass *hc = PCI_HOST_BRIDGE_CLASS(klass); 1128 DeviceClass *dc = DEVICE_CLASS(klass); 1129 1130 hc->root_bus_path = pnv_phb3_root_bus_path; 1131 dc->realize = pnv_phb3_realize; 1132 device_class_set_props(dc, pnv_phb3_properties); 1133 set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories); 1134 dc->user_creatable = true; 1135 } 1136 1137 static const TypeInfo pnv_phb3_type_info = { 1138 .name = TYPE_PNV_PHB3, 1139 .parent = TYPE_PCIE_HOST_BRIDGE, 1140 .instance_size = sizeof(PnvPHB3), 1141 .class_init = pnv_phb3_class_init, 1142 .instance_init = pnv_phb3_instance_init, 1143 }; 1144 1145 static void pnv_phb3_root_bus_class_init(ObjectClass *klass, void *data) 1146 { 1147 BusClass *k = BUS_CLASS(klass); 1148 1149 /* 1150 * PHB3 has only a single root complex. Enforce the limit on the 1151 * parent bus 1152 */ 1153 k->max_dev = 1; 1154 } 1155 1156 static const TypeInfo pnv_phb3_root_bus_info = { 1157 .name = TYPE_PNV_PHB3_ROOT_BUS, 1158 .parent = TYPE_PCIE_BUS, 1159 .class_init = pnv_phb3_root_bus_class_init, 1160 .interfaces = (InterfaceInfo[]) { 1161 { INTERFACE_PCIE_DEVICE }, 1162 { } 1163 }, 1164 }; 1165 1166 static void pnv_phb3_root_port_realize(DeviceState *dev, Error **errp) 1167 { 1168 PCIERootPortClass *rpc = PCIE_ROOT_PORT_GET_CLASS(dev); 1169 PCIDevice *pci = PCI_DEVICE(dev); 1170 PCIBus *bus = pci_get_bus(pci); 1171 PnvPHB3 *phb = NULL; 1172 Error *local_err = NULL; 1173 1174 phb = (PnvPHB3 *) object_dynamic_cast(OBJECT(bus->qbus.parent), 1175 TYPE_PNV_PHB3); 1176 1177 if (!phb) { 1178 error_setg(errp, 1179 "pnv_phb3_root_port devices must be connected to pnv-phb3 buses"); 1180 return; 1181 } 1182 1183 /* Set unique chassis/slot values for the root port */ 1184 qdev_prop_set_uint8(&pci->qdev, "chassis", phb->chip_id); 1185 qdev_prop_set_uint16(&pci->qdev, "slot", phb->phb_id); 1186 1187 rpc->parent_realize(dev, &local_err); 1188 if (local_err) { 1189 error_propagate(errp, local_err); 1190 return; 1191 } 1192 } 1193 1194 static void pnv_phb3_root_port_class_init(ObjectClass *klass, void *data) 1195 { 1196 DeviceClass *dc = DEVICE_CLASS(klass); 1197 PCIDeviceClass *k = PCI_DEVICE_CLASS(klass); 1198 PCIERootPortClass *rpc = PCIE_ROOT_PORT_CLASS(klass); 1199 1200 dc->desc = "IBM PHB3 PCIE Root Port"; 1201 1202 device_class_set_parent_realize(dc, pnv_phb3_root_port_realize, 1203 &rpc->parent_realize); 1204 dc->user_creatable = true; 1205 1206 k->vendor_id = PCI_VENDOR_ID_IBM; 1207 k->device_id = 0x03dc; 1208 k->revision = 0; 1209 1210 rpc->exp_offset = 0x48; 1211 rpc->aer_offset = 0x100; 1212 } 1213 1214 static const TypeInfo pnv_phb3_root_port_info = { 1215 .name = TYPE_PNV_PHB3_ROOT_PORT, 1216 .parent = TYPE_PCIE_ROOT_PORT, 1217 .instance_size = sizeof(PnvPHB3RootPort), 1218 .class_init = pnv_phb3_root_port_class_init, 1219 }; 1220 1221 static void pnv_phb3_register_types(void) 1222 { 1223 type_register_static(&pnv_phb3_root_bus_info); 1224 type_register_static(&pnv_phb3_root_port_info); 1225 type_register_static(&pnv_phb3_type_info); 1226 type_register_static(&pnv_phb3_iommu_memory_region_info); 1227 } 1228 1229 type_init(pnv_phb3_register_types) 1230