xref: /openbmc/qemu/hw/pci-host/versatile.c (revision a719a27c)
1 /*
2  * ARM Versatile/PB PCI host controller
3  *
4  * Copyright (c) 2006-2009 CodeSourcery.
5  * Written by Paul Brook
6  *
7  * This code is licensed under the LGPL.
8  */
9 
10 #include "hw/sysbus.h"
11 #include "hw/pci/pci.h"
12 #include "hw/pci/pci_bus.h"
13 #include "hw/pci/pci_host.h"
14 #include "exec/address-spaces.h"
15 
16 /* Old and buggy versions of QEMU used the wrong mapping from
17  * PCI IRQs to system interrupt lines. Unfortunately the Linux
18  * kernel also had the corresponding bug in setting up interrupts
19  * (so older kernels work on QEMU and not on real hardware).
20  * We automatically detect these broken kernels and flip back
21  * to the broken irq mapping by spotting guest writes to the
22  * PCI_INTERRUPT_LINE register to see where the guest thinks
23  * interrupts are going to be routed. So we start in state
24  * ASSUME_OK on reset, and transition to either BROKEN or
25  * FORCE_OK at the first write to an INTERRUPT_LINE register for
26  * a slot where broken and correct interrupt mapping would differ.
27  * Once in either BROKEN or FORCE_OK we never transition again;
28  * this allows a newer kernel to use the INTERRUPT_LINE
29  * registers arbitrarily once it has indicated that it isn't
30  * broken in its init code somewhere.
31  *
32  * Unfortunately we have to cope with multiple different
33  * variants on the broken kernel behaviour:
34  *  phase I (before kernel commit 1bc39ac5d) kernels assume old
35  *   QEMU behaviour, so they use IRQ 27 for all slots
36  *  phase II (1bc39ac5d and later, but before e3e92a7be6) kernels
37  *   swizzle IRQs between slots, but do it wrongly, so they
38  *   work only for every fourth PCI card, and only if (like old
39  *   QEMU) the PCI host device is at slot 0 rather than where
40  *   the h/w actually puts it
41  *  phase III (e3e92a7be6 and later) kernels still swizzle IRQs between
42  *   slots wrongly, but add a fixed offset of 64 to everything
43  *   they write to PCI_INTERRUPT_LINE.
44  *
45  * We live in hope of a mythical phase IV kernel which might
46  * actually behave in ways that work on the hardware. Such a
47  * kernel should probably start off by writing some value neither
48  * 27 nor 91 to slot zero's PCI_INTERRUPT_LINE register to
49  * disable the autodetection. After that it can do what it likes.
50  *
51  * Slot % 4 | hw | I  | II | III
52  * -------------------------------
53  *   0      | 29 | 27 | 27 | 91
54  *   1      | 30 | 27 | 28 | 92
55  *   2      | 27 | 27 | 29 | 93
56  *   3      | 28 | 27 | 30 | 94
57  *
58  * Since our autodetection is not perfect we also provide a
59  * property so the user can make us start in BROKEN or FORCE_OK
60  * on reset if they know they have a bad or good kernel.
61  */
62 enum {
63     PCI_VPB_IRQMAP_ASSUME_OK,
64     PCI_VPB_IRQMAP_BROKEN,
65     PCI_VPB_IRQMAP_FORCE_OK,
66 };
67 
68 typedef struct {
69     PCIHostState parent_obj;
70 
71     qemu_irq irq[4];
72     MemoryRegion controlregs;
73     MemoryRegion mem_config;
74     MemoryRegion mem_config2;
75     /* Containers representing the PCI address spaces */
76     MemoryRegion pci_io_space;
77     MemoryRegion pci_mem_space;
78     /* Alias regions into PCI address spaces which we expose as sysbus regions.
79      * The offsets into pci_mem_space are controlled by the imap registers.
80      */
81     MemoryRegion pci_io_window;
82     MemoryRegion pci_mem_window[3];
83     PCIBus pci_bus;
84     PCIDevice pci_dev;
85 
86     /* Constant for life of device: */
87     int realview;
88     uint32_t mem_win_size[3];
89     uint8_t irq_mapping_prop;
90 
91     /* Variable state: */
92     uint32_t imap[3];
93     uint32_t smap[3];
94     uint32_t selfid;
95     uint32_t flags;
96     uint8_t irq_mapping;
97 } PCIVPBState;
98 
99 static void pci_vpb_update_window(PCIVPBState *s, int i)
100 {
101     /* Adjust the offset of the alias region we use for
102      * the memory window i to account for a change in the
103      * value of the corresponding IMAP register.
104      * Note that the semantics of the IMAP register differ
105      * for realview and versatile variants of the controller.
106      */
107     hwaddr offset;
108     if (s->realview) {
109         /* Top bits of register (masked according to window size) provide
110          * top bits of PCI address.
111          */
112         offset = s->imap[i] & ~(s->mem_win_size[i] - 1);
113     } else {
114         /* Bottom 4 bits of register provide top 4 bits of PCI address */
115         offset = s->imap[i] << 28;
116     }
117     memory_region_set_alias_offset(&s->pci_mem_window[i], offset);
118 }
119 
120 static void pci_vpb_update_all_windows(PCIVPBState *s)
121 {
122     /* Update all alias windows based on the current register state */
123     int i;
124 
125     for (i = 0; i < 3; i++) {
126         pci_vpb_update_window(s, i);
127     }
128 }
129 
130 static int pci_vpb_post_load(void *opaque, int version_id)
131 {
132     PCIVPBState *s = opaque;
133     pci_vpb_update_all_windows(s);
134     return 0;
135 }
136 
137 static const VMStateDescription pci_vpb_vmstate = {
138     .name = "versatile-pci",
139     .version_id = 1,
140     .minimum_version_id = 1,
141     .post_load = pci_vpb_post_load,
142     .fields = (VMStateField[]) {
143         VMSTATE_UINT32_ARRAY(imap, PCIVPBState, 3),
144         VMSTATE_UINT32_ARRAY(smap, PCIVPBState, 3),
145         VMSTATE_UINT32(selfid, PCIVPBState),
146         VMSTATE_UINT32(flags, PCIVPBState),
147         VMSTATE_UINT8(irq_mapping, PCIVPBState),
148         VMSTATE_END_OF_LIST()
149     }
150 };
151 
152 #define TYPE_VERSATILE_PCI "versatile_pci"
153 #define PCI_VPB(obj) \
154     OBJECT_CHECK(PCIVPBState, (obj), TYPE_VERSATILE_PCI)
155 
156 #define TYPE_VERSATILE_PCI_HOST "versatile_pci_host"
157 #define PCI_VPB_HOST(obj) \
158     OBJECT_CHECK(PCIDevice, (obj), TYPE_VERSATILE_PCIHOST)
159 
160 typedef enum {
161     PCI_IMAP0 = 0x0,
162     PCI_IMAP1 = 0x4,
163     PCI_IMAP2 = 0x8,
164     PCI_SELFID = 0xc,
165     PCI_FLAGS = 0x10,
166     PCI_SMAP0 = 0x14,
167     PCI_SMAP1 = 0x18,
168     PCI_SMAP2 = 0x1c,
169 } PCIVPBControlRegs;
170 
171 static void pci_vpb_reg_write(void *opaque, hwaddr addr,
172                               uint64_t val, unsigned size)
173 {
174     PCIVPBState *s = opaque;
175 
176     switch (addr) {
177     case PCI_IMAP0:
178     case PCI_IMAP1:
179     case PCI_IMAP2:
180     {
181         int win = (addr - PCI_IMAP0) >> 2;
182         s->imap[win] = val;
183         pci_vpb_update_window(s, win);
184         break;
185     }
186     case PCI_SELFID:
187         s->selfid = val;
188         break;
189     case PCI_FLAGS:
190         s->flags = val;
191         break;
192     case PCI_SMAP0:
193     case PCI_SMAP1:
194     case PCI_SMAP2:
195     {
196         int win = (addr - PCI_SMAP0) >> 2;
197         s->smap[win] = val;
198         break;
199     }
200     default:
201         qemu_log_mask(LOG_GUEST_ERROR,
202                       "pci_vpb_reg_write: Bad offset %x\n", (int)addr);
203         break;
204     }
205 }
206 
207 static uint64_t pci_vpb_reg_read(void *opaque, hwaddr addr,
208                                  unsigned size)
209 {
210     PCIVPBState *s = opaque;
211 
212     switch (addr) {
213     case PCI_IMAP0:
214     case PCI_IMAP1:
215     case PCI_IMAP2:
216     {
217         int win = (addr - PCI_IMAP0) >> 2;
218         return s->imap[win];
219     }
220     case PCI_SELFID:
221         return s->selfid;
222     case PCI_FLAGS:
223         return s->flags;
224     case PCI_SMAP0:
225     case PCI_SMAP1:
226     case PCI_SMAP2:
227     {
228         int win = (addr - PCI_SMAP0) >> 2;
229         return s->smap[win];
230     }
231     default:
232         qemu_log_mask(LOG_GUEST_ERROR,
233                       "pci_vpb_reg_read: Bad offset %x\n", (int)addr);
234         return 0;
235     }
236 }
237 
238 static const MemoryRegionOps pci_vpb_reg_ops = {
239     .read = pci_vpb_reg_read,
240     .write = pci_vpb_reg_write,
241     .endianness = DEVICE_NATIVE_ENDIAN,
242     .valid = {
243         .min_access_size = 4,
244         .max_access_size = 4,
245     },
246 };
247 
248 static int pci_vpb_broken_irq(int slot, int irq)
249 {
250     /* Determine whether this IRQ value for this slot represents a
251      * known broken Linux kernel behaviour for this slot.
252      * Return one of the PCI_VPB_IRQMAP_ constants:
253      *   BROKEN : if this definitely looks like a broken kernel
254      *   FORCE_OK : if this definitely looks good
255      *   ASSUME_OK : if we can't tell
256      */
257     slot %= PCI_NUM_PINS;
258 
259     if (irq == 27) {
260         if (slot == 2) {
261             /* Might be a Phase I kernel, or might be a fixed kernel,
262              * since slot 2 is where we expect this IRQ.
263              */
264             return PCI_VPB_IRQMAP_ASSUME_OK;
265         }
266         /* Phase I kernel */
267         return PCI_VPB_IRQMAP_BROKEN;
268     }
269     if (irq == slot + 27) {
270         /* Phase II kernel */
271         return PCI_VPB_IRQMAP_BROKEN;
272     }
273     if (irq == slot + 27 + 64) {
274         /* Phase III kernel */
275         return PCI_VPB_IRQMAP_BROKEN;
276     }
277     /* Anything else must be a fixed kernel, possibly using an
278      * arbitrary irq map.
279      */
280     return PCI_VPB_IRQMAP_FORCE_OK;
281 }
282 
283 static void pci_vpb_config_write(void *opaque, hwaddr addr,
284                                  uint64_t val, unsigned size)
285 {
286     PCIVPBState *s = opaque;
287     if (!s->realview && (addr & 0xff) == PCI_INTERRUPT_LINE
288         && s->irq_mapping == PCI_VPB_IRQMAP_ASSUME_OK) {
289         uint8_t devfn = addr >> 8;
290         s->irq_mapping = pci_vpb_broken_irq(PCI_SLOT(devfn), val);
291     }
292     pci_data_write(&s->pci_bus, addr, val, size);
293 }
294 
295 static uint64_t pci_vpb_config_read(void *opaque, hwaddr addr,
296                                     unsigned size)
297 {
298     PCIVPBState *s = opaque;
299     uint32_t val;
300     val = pci_data_read(&s->pci_bus, addr, size);
301     return val;
302 }
303 
304 static const MemoryRegionOps pci_vpb_config_ops = {
305     .read = pci_vpb_config_read,
306     .write = pci_vpb_config_write,
307     .endianness = DEVICE_NATIVE_ENDIAN,
308 };
309 
310 static int pci_vpb_map_irq(PCIDevice *d, int irq_num)
311 {
312     PCIVPBState *s = container_of(d->bus, PCIVPBState, pci_bus);
313 
314     if (s->irq_mapping == PCI_VPB_IRQMAP_BROKEN) {
315         /* Legacy broken IRQ mapping for compatibility with old and
316          * buggy Linux guests
317          */
318         return irq_num;
319     }
320 
321     /* Slot to IRQ mapping for RealView Platform Baseboard 926 backplane
322      *      name    slot    IntA    IntB    IntC    IntD
323      *      A       31      IRQ28   IRQ29   IRQ30   IRQ27
324      *      B       30      IRQ27   IRQ28   IRQ29   IRQ30
325      *      C       29      IRQ30   IRQ27   IRQ28   IRQ29
326      * Slot C is for the host bridge; A and B the peripherals.
327      * Our output irqs 0..3 correspond to the baseboard's 27..30.
328      *
329      * This mapping function takes account of an oddity in the PB926
330      * board wiring, where the FPGA's P_nINTA input is connected to
331      * the INTB connection on the board PCI edge connector, P_nINTB
332      * is connected to INTC, and so on, so everything is one number
333      * further round from where you might expect.
334      */
335     return pci_swizzle_map_irq_fn(d, irq_num + 2);
336 }
337 
338 static int pci_vpb_rv_map_irq(PCIDevice *d, int irq_num)
339 {
340     /* Slot to IRQ mapping for RealView EB and PB1176 backplane
341      *      name    slot    IntA    IntB    IntC    IntD
342      *      A       31      IRQ50   IRQ51   IRQ48   IRQ49
343      *      B       30      IRQ49   IRQ50   IRQ51   IRQ48
344      *      C       29      IRQ48   IRQ49   IRQ50   IRQ51
345      * Slot C is for the host bridge; A and B the peripherals.
346      * Our output irqs 0..3 correspond to the baseboard's 48..51.
347      *
348      * The PB1176 and EB boards don't have the PB926 wiring oddity
349      * described above; P_nINTA connects to INTA, P_nINTB to INTB
350      * and so on, which is why this mapping function is different.
351      */
352     return pci_swizzle_map_irq_fn(d, irq_num + 3);
353 }
354 
355 static void pci_vpb_set_irq(void *opaque, int irq_num, int level)
356 {
357     qemu_irq *pic = opaque;
358 
359     qemu_set_irq(pic[irq_num], level);
360 }
361 
362 static void pci_vpb_reset(DeviceState *d)
363 {
364     PCIVPBState *s = PCI_VPB(d);
365 
366     s->imap[0] = 0;
367     s->imap[1] = 0;
368     s->imap[2] = 0;
369     s->smap[0] = 0;
370     s->smap[1] = 0;
371     s->smap[2] = 0;
372     s->selfid = 0;
373     s->flags = 0;
374     s->irq_mapping = s->irq_mapping_prop;
375 
376     pci_vpb_update_all_windows(s);
377 }
378 
379 static void pci_vpb_init(Object *obj)
380 {
381     PCIHostState *h = PCI_HOST_BRIDGE(obj);
382     PCIVPBState *s = PCI_VPB(obj);
383 
384     memory_region_init(&s->pci_io_space, OBJECT(s), "pci_io", 1ULL << 32);
385     memory_region_init(&s->pci_mem_space, OBJECT(s), "pci_mem", 1ULL << 32);
386 
387     pci_bus_new_inplace(&s->pci_bus, sizeof(s->pci_bus), DEVICE(obj), "pci",
388                         &s->pci_mem_space, &s->pci_io_space,
389                         PCI_DEVFN(11, 0), TYPE_PCI_BUS);
390     h->bus = &s->pci_bus;
391 
392     object_initialize(&s->pci_dev, sizeof(s->pci_dev), TYPE_VERSATILE_PCI_HOST);
393     qdev_set_parent_bus(DEVICE(&s->pci_dev), BUS(&s->pci_bus));
394 
395     /* Window sizes for VersatilePB; realview_pci's init will override */
396     s->mem_win_size[0] = 0x0c000000;
397     s->mem_win_size[1] = 0x10000000;
398     s->mem_win_size[2] = 0x10000000;
399 }
400 
401 static void pci_vpb_realize(DeviceState *dev, Error **errp)
402 {
403     PCIVPBState *s = PCI_VPB(dev);
404     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
405     pci_map_irq_fn mapfn;
406     int i;
407 
408     for (i = 0; i < 4; i++) {
409         sysbus_init_irq(sbd, &s->irq[i]);
410     }
411 
412     if (s->realview) {
413         mapfn = pci_vpb_rv_map_irq;
414     } else {
415         mapfn = pci_vpb_map_irq;
416     }
417 
418     pci_bus_irqs(&s->pci_bus, pci_vpb_set_irq, mapfn, s->irq, 4);
419 
420     /* Our memory regions are:
421      * 0 : our control registers
422      * 1 : PCI self config window
423      * 2 : PCI config window
424      * 3 : PCI IO window
425      * 4..6 : PCI memory windows
426      */
427     memory_region_init_io(&s->controlregs, OBJECT(s), &pci_vpb_reg_ops, s,
428                           "pci-vpb-regs", 0x1000);
429     sysbus_init_mmio(sbd, &s->controlregs);
430     memory_region_init_io(&s->mem_config, OBJECT(s), &pci_vpb_config_ops, s,
431                           "pci-vpb-selfconfig", 0x1000000);
432     sysbus_init_mmio(sbd, &s->mem_config);
433     memory_region_init_io(&s->mem_config2, OBJECT(s), &pci_vpb_config_ops, s,
434                           "pci-vpb-config", 0x1000000);
435     sysbus_init_mmio(sbd, &s->mem_config2);
436 
437     /* The window into I/O space is always into a fixed base address;
438      * its size is the same for both realview and versatile.
439      */
440     memory_region_init_alias(&s->pci_io_window, OBJECT(s), "pci-vbp-io-window",
441                              &s->pci_io_space, 0, 0x100000);
442 
443     sysbus_init_mmio(sbd, &s->pci_io_space);
444 
445     /* Create the alias regions corresponding to our three windows onto
446      * PCI memory space. The sizes vary from board to board; the base
447      * offsets are guest controllable via the IMAP registers.
448      */
449     for (i = 0; i < 3; i++) {
450         memory_region_init_alias(&s->pci_mem_window[i], OBJECT(s), "pci-vbp-window",
451                                  &s->pci_mem_space, 0, s->mem_win_size[i]);
452         sysbus_init_mmio(sbd, &s->pci_mem_window[i]);
453     }
454 
455     /* TODO Remove once realize propagates to child devices. */
456     object_property_set_bool(OBJECT(&s->pci_dev), true, "realized", errp);
457 }
458 
459 static int versatile_pci_host_init(PCIDevice *d)
460 {
461     pci_set_word(d->config + PCI_STATUS,
462                  PCI_STATUS_66MHZ | PCI_STATUS_DEVSEL_MEDIUM);
463     pci_set_byte(d->config + PCI_LATENCY_TIMER, 0x10);
464     return 0;
465 }
466 
467 static void versatile_pci_host_class_init(ObjectClass *klass, void *data)
468 {
469     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
470     DeviceClass *dc = DEVICE_CLASS(klass);
471 
472     k->init = versatile_pci_host_init;
473     k->vendor_id = PCI_VENDOR_ID_XILINX;
474     k->device_id = PCI_DEVICE_ID_XILINX_XC2VP30;
475     k->class_id = PCI_CLASS_PROCESSOR_CO;
476     /*
477      * PCI-facing part of the host bridge, not usable without the
478      * host-facing part, which can't be device_add'ed, yet.
479      */
480     dc->cannot_instantiate_with_device_add_yet = true;
481 }
482 
483 static const TypeInfo versatile_pci_host_info = {
484     .name          = TYPE_VERSATILE_PCI_HOST,
485     .parent        = TYPE_PCI_DEVICE,
486     .instance_size = sizeof(PCIDevice),
487     .class_init    = versatile_pci_host_class_init,
488 };
489 
490 static Property pci_vpb_properties[] = {
491     DEFINE_PROP_UINT8("broken-irq-mapping", PCIVPBState, irq_mapping_prop,
492                       PCI_VPB_IRQMAP_ASSUME_OK),
493     DEFINE_PROP_END_OF_LIST()
494 };
495 
496 static void pci_vpb_class_init(ObjectClass *klass, void *data)
497 {
498     DeviceClass *dc = DEVICE_CLASS(klass);
499 
500     dc->realize = pci_vpb_realize;
501     dc->reset = pci_vpb_reset;
502     dc->vmsd = &pci_vpb_vmstate;
503     dc->props = pci_vpb_properties;
504 }
505 
506 static const TypeInfo pci_vpb_info = {
507     .name          = TYPE_VERSATILE_PCI,
508     .parent        = TYPE_PCI_HOST_BRIDGE,
509     .instance_size = sizeof(PCIVPBState),
510     .instance_init = pci_vpb_init,
511     .class_init    = pci_vpb_class_init,
512 };
513 
514 static void pci_realview_init(Object *obj)
515 {
516     PCIVPBState *s = PCI_VPB(obj);
517 
518     s->realview = 1;
519     /* The PCI window sizes are different on Realview boards */
520     s->mem_win_size[0] = 0x01000000;
521     s->mem_win_size[1] = 0x04000000;
522     s->mem_win_size[2] = 0x08000000;
523 }
524 
525 static const TypeInfo pci_realview_info = {
526     .name          = "realview_pci",
527     .parent        = TYPE_VERSATILE_PCI,
528     .instance_init = pci_realview_init,
529 };
530 
531 static void versatile_pci_register_types(void)
532 {
533     type_register_static(&pci_vpb_info);
534     type_register_static(&pci_realview_info);
535     type_register_static(&versatile_pci_host_info);
536 }
537 
538 type_init(versatile_pci_register_types)
539