xref: /openbmc/qemu/hw/pci/pcie.c (revision 5242ef88)
1 /*
2  * pcie.c
3  *
4  * Copyright (c) 2010 Isaku Yamahata <yamahata at valinux co jp>
5  *                    VA Linux Systems Japan K.K.
6  *
7  * This program is free software; you can redistribute it and/or modify
8  * it under the terms of the GNU General Public License as published by
9  * the Free Software Foundation; either version 2 of the License, or
10  * (at your option) any later version.
11  *
12  * This program is distributed in the hope that it will be useful,
13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
15  * GNU General Public License for more details.
16  *
17  * You should have received a copy of the GNU General Public License along
18  * with this program; if not, see <http://www.gnu.org/licenses/>.
19  */
20 
21 #include "qemu/osdep.h"
22 #include "qapi/error.h"
23 #include "hw/pci/pci_bridge.h"
24 #include "hw/pci/pcie.h"
25 #include "hw/pci/msix.h"
26 #include "hw/pci/msi.h"
27 #include "hw/pci/pci_bus.h"
28 #include "hw/pci/pcie_regs.h"
29 #include "hw/pci/pcie_port.h"
30 #include "qemu/range.h"
31 
32 //#define DEBUG_PCIE
33 #ifdef DEBUG_PCIE
34 # define PCIE_DPRINTF(fmt, ...)                                         \
35     fprintf(stderr, "%s:%d " fmt, __func__, __LINE__, ## __VA_ARGS__)
36 #else
37 # define PCIE_DPRINTF(fmt, ...) do {} while (0)
38 #endif
39 #define PCIE_DEV_PRINTF(dev, fmt, ...)                                  \
40     PCIE_DPRINTF("%s:%x "fmt, (dev)->name, (dev)->devfn, ## __VA_ARGS__)
41 
42 
43 /***************************************************************************
44  * pci express capability helper functions
45  */
46 
47 static void
48 pcie_cap_v1_fill(PCIDevice *dev, uint8_t port, uint8_t type, uint8_t version)
49 {
50     uint8_t *exp_cap = dev->config + dev->exp.exp_cap;
51     uint8_t *cmask = dev->cmask + dev->exp.exp_cap;
52 
53     /* capability register
54     interrupt message number defaults to 0 */
55     pci_set_word(exp_cap + PCI_EXP_FLAGS,
56                  ((type << PCI_EXP_FLAGS_TYPE_SHIFT) & PCI_EXP_FLAGS_TYPE) |
57                  version);
58 
59     /* device capability register
60      * table 7-12:
61      * roll based error reporting bit must be set by all
62      * Functions conforming to the ECN, PCI Express Base
63      * Specification, Revision 1.1., or subsequent PCI Express Base
64      * Specification revisions.
65      */
66     pci_set_long(exp_cap + PCI_EXP_DEVCAP, PCI_EXP_DEVCAP_RBER);
67 
68     pci_set_long(exp_cap + PCI_EXP_LNKCAP,
69                  (port << PCI_EXP_LNKCAP_PN_SHIFT) |
70                  PCI_EXP_LNKCAP_ASPMS_0S |
71                  QEMU_PCI_EXP_LNKCAP_MLW(QEMU_PCI_EXP_LNK_X1) |
72                  QEMU_PCI_EXP_LNKCAP_MLS(QEMU_PCI_EXP_LNK_2_5GT));
73 
74     pci_set_word(exp_cap + PCI_EXP_LNKSTA,
75                  QEMU_PCI_EXP_LNKSTA_NLW(QEMU_PCI_EXP_LNK_X1) |
76                  QEMU_PCI_EXP_LNKSTA_CLS(QEMU_PCI_EXP_LNK_2_5GT));
77 
78     /* We changed link status bits over time, and changing them across
79      * migrations is generally fine as hardware changes them too.
80      * Let's not bother checking.
81      */
82     pci_set_word(cmask + PCI_EXP_LNKSTA, 0);
83 }
84 
85 static void pcie_cap_fill_slot_lnk(PCIDevice *dev)
86 {
87     PCIESlot *s = (PCIESlot *)object_dynamic_cast(OBJECT(dev), TYPE_PCIE_SLOT);
88     uint8_t *exp_cap = dev->config + dev->exp.exp_cap;
89 
90     /* Skip anything that isn't a PCIESlot */
91     if (!s) {
92         return;
93     }
94 
95     /* Clear and fill LNKCAP from what was configured above */
96     pci_long_test_and_clear_mask(exp_cap + PCI_EXP_LNKCAP,
97                                  PCI_EXP_LNKCAP_MLW | PCI_EXP_LNKCAP_SLS);
98     pci_long_test_and_set_mask(exp_cap + PCI_EXP_LNKCAP,
99                                QEMU_PCI_EXP_LNKCAP_MLW(s->width) |
100                                QEMU_PCI_EXP_LNKCAP_MLS(s->speed));
101 
102     /*
103      * Link bandwidth notification is required for all root ports and
104      * downstream ports supporting links wider than x1 or multiple link
105      * speeds.
106      */
107     if (s->width > QEMU_PCI_EXP_LNK_X1 ||
108         s->speed > QEMU_PCI_EXP_LNK_2_5GT) {
109         pci_long_test_and_set_mask(exp_cap + PCI_EXP_LNKCAP,
110                                    PCI_EXP_LNKCAP_LBNC);
111     }
112 
113     if (s->speed > QEMU_PCI_EXP_LNK_2_5GT) {
114         /*
115          * Hot-plug capable downstream ports and downstream ports supporting
116          * link speeds greater than 5GT/s must hardwire PCI_EXP_LNKCAP_DLLLARC
117          * to 1b.  PCI_EXP_LNKCAP_DLLLARC implies PCI_EXP_LNKSTA_DLLLA, which
118          * we also hardwire to 1b here.  2.5GT/s hot-plug slots should also
119          * technically implement this, but it's not done here for compatibility.
120          */
121         pci_long_test_and_set_mask(exp_cap + PCI_EXP_LNKCAP,
122                                    PCI_EXP_LNKCAP_DLLLARC);
123         /* the PCI_EXP_LNKSTA_DLLLA will be set in the hotplug function */
124 
125         /*
126          * Target Link Speed defaults to the highest link speed supported by
127          * the component.  2.5GT/s devices are permitted to hardwire to zero.
128          */
129         pci_word_test_and_clear_mask(exp_cap + PCI_EXP_LNKCTL2,
130                                      PCI_EXP_LNKCTL2_TLS);
131         pci_word_test_and_set_mask(exp_cap + PCI_EXP_LNKCTL2,
132                                    QEMU_PCI_EXP_LNKCAP_MLS(s->speed) &
133                                    PCI_EXP_LNKCTL2_TLS);
134     }
135 
136     /*
137      * 2.5 & 5.0GT/s can be fully described by LNKCAP, but 8.0GT/s is
138      * actually a reference to the highest bit supported in this register.
139      * We assume the device supports all link speeds.
140      */
141     if (s->speed > QEMU_PCI_EXP_LNK_5GT) {
142         pci_long_test_and_clear_mask(exp_cap + PCI_EXP_LNKCAP2, ~0U);
143         pci_long_test_and_set_mask(exp_cap + PCI_EXP_LNKCAP2,
144                                    PCI_EXP_LNKCAP2_SLS_2_5GB |
145                                    PCI_EXP_LNKCAP2_SLS_5_0GB |
146                                    PCI_EXP_LNKCAP2_SLS_8_0GB);
147         if (s->speed > QEMU_PCI_EXP_LNK_8GT) {
148             pci_long_test_and_set_mask(exp_cap + PCI_EXP_LNKCAP2,
149                                        PCI_EXP_LNKCAP2_SLS_16_0GB);
150         }
151     }
152 }
153 
154 int pcie_cap_init(PCIDevice *dev, uint8_t offset,
155                   uint8_t type, uint8_t port,
156                   Error **errp)
157 {
158     /* PCIe cap v2 init */
159     int pos;
160     uint8_t *exp_cap;
161 
162     assert(pci_is_express(dev));
163 
164     pos = pci_add_capability(dev, PCI_CAP_ID_EXP, offset,
165                              PCI_EXP_VER2_SIZEOF, errp);
166     if (pos < 0) {
167         return pos;
168     }
169     dev->exp.exp_cap = pos;
170     exp_cap = dev->config + pos;
171 
172     /* Filling values common with v1 */
173     pcie_cap_v1_fill(dev, port, type, PCI_EXP_FLAGS_VER2);
174 
175     /* Fill link speed and width options */
176     pcie_cap_fill_slot_lnk(dev);
177 
178     /* Filling v2 specific values */
179     pci_set_long(exp_cap + PCI_EXP_DEVCAP2,
180                  PCI_EXP_DEVCAP2_EFF | PCI_EXP_DEVCAP2_EETLPP);
181 
182     pci_set_word(dev->wmask + pos + PCI_EXP_DEVCTL2, PCI_EXP_DEVCTL2_EETLPPB);
183 
184     if (dev->cap_present & QEMU_PCIE_EXTCAP_INIT) {
185         /* read-only to behave like a 'NULL' Extended Capability Header */
186         pci_set_long(dev->wmask + PCI_CONFIG_SPACE_SIZE, 0);
187     }
188 
189     return pos;
190 }
191 
192 int pcie_cap_v1_init(PCIDevice *dev, uint8_t offset, uint8_t type,
193                      uint8_t port)
194 {
195     /* PCIe cap v1 init */
196     int pos;
197     Error *local_err = NULL;
198 
199     assert(pci_is_express(dev));
200 
201     pos = pci_add_capability(dev, PCI_CAP_ID_EXP, offset,
202                              PCI_EXP_VER1_SIZEOF, &local_err);
203     if (pos < 0) {
204         error_report_err(local_err);
205         return pos;
206     }
207     dev->exp.exp_cap = pos;
208 
209     pcie_cap_v1_fill(dev, port, type, PCI_EXP_FLAGS_VER1);
210 
211     return pos;
212 }
213 
214 static int
215 pcie_endpoint_cap_common_init(PCIDevice *dev, uint8_t offset, uint8_t cap_size)
216 {
217     uint8_t type = PCI_EXP_TYPE_ENDPOINT;
218     Error *local_err = NULL;
219     int ret;
220 
221     /*
222      * Windows guests will report Code 10, device cannot start, if
223      * a regular Endpoint type is exposed on a root complex.  These
224      * should instead be Root Complex Integrated Endpoints.
225      */
226     if (pci_bus_is_express(pci_get_bus(dev))
227         && pci_bus_is_root(pci_get_bus(dev))) {
228         type = PCI_EXP_TYPE_RC_END;
229     }
230 
231     if (cap_size == PCI_EXP_VER1_SIZEOF) {
232         return pcie_cap_v1_init(dev, offset, type, 0);
233     } else {
234         ret = pcie_cap_init(dev, offset, type, 0, &local_err);
235 
236         if (ret < 0) {
237             error_report_err(local_err);
238         }
239 
240         return ret;
241     }
242 }
243 
244 int pcie_endpoint_cap_init(PCIDevice *dev, uint8_t offset)
245 {
246     return pcie_endpoint_cap_common_init(dev, offset, PCI_EXP_VER2_SIZEOF);
247 }
248 
249 int pcie_endpoint_cap_v1_init(PCIDevice *dev, uint8_t offset)
250 {
251     return pcie_endpoint_cap_common_init(dev, offset, PCI_EXP_VER1_SIZEOF);
252 }
253 
254 void pcie_cap_exit(PCIDevice *dev)
255 {
256     pci_del_capability(dev, PCI_CAP_ID_EXP, PCI_EXP_VER2_SIZEOF);
257 }
258 
259 void pcie_cap_v1_exit(PCIDevice *dev)
260 {
261     pci_del_capability(dev, PCI_CAP_ID_EXP, PCI_EXP_VER1_SIZEOF);
262 }
263 
264 uint8_t pcie_cap_get_type(const PCIDevice *dev)
265 {
266     uint32_t pos = dev->exp.exp_cap;
267     assert(pos > 0);
268     return (pci_get_word(dev->config + pos + PCI_EXP_FLAGS) &
269             PCI_EXP_FLAGS_TYPE) >> PCI_EXP_FLAGS_TYPE_SHIFT;
270 }
271 
272 /* MSI/MSI-X */
273 /* pci express interrupt message number */
274 /* 7.8.2 PCI Express Capabilities Register: Interrupt Message Number */
275 void pcie_cap_flags_set_vector(PCIDevice *dev, uint8_t vector)
276 {
277     uint8_t *exp_cap = dev->config + dev->exp.exp_cap;
278     assert(vector < 32);
279     pci_word_test_and_clear_mask(exp_cap + PCI_EXP_FLAGS, PCI_EXP_FLAGS_IRQ);
280     pci_word_test_and_set_mask(exp_cap + PCI_EXP_FLAGS,
281                                vector << PCI_EXP_FLAGS_IRQ_SHIFT);
282 }
283 
284 uint8_t pcie_cap_flags_get_vector(PCIDevice *dev)
285 {
286     return (pci_get_word(dev->config + dev->exp.exp_cap + PCI_EXP_FLAGS) &
287             PCI_EXP_FLAGS_IRQ) >> PCI_EXP_FLAGS_IRQ_SHIFT;
288 }
289 
290 void pcie_cap_deverr_init(PCIDevice *dev)
291 {
292     uint32_t pos = dev->exp.exp_cap;
293     pci_long_test_and_set_mask(dev->config + pos + PCI_EXP_DEVCAP,
294                                PCI_EXP_DEVCAP_RBER);
295     pci_long_test_and_set_mask(dev->wmask + pos + PCI_EXP_DEVCTL,
296                                PCI_EXP_DEVCTL_CERE | PCI_EXP_DEVCTL_NFERE |
297                                PCI_EXP_DEVCTL_FERE | PCI_EXP_DEVCTL_URRE);
298     pci_long_test_and_set_mask(dev->w1cmask + pos + PCI_EXP_DEVSTA,
299                                PCI_EXP_DEVSTA_CED | PCI_EXP_DEVSTA_NFED |
300                                PCI_EXP_DEVSTA_FED | PCI_EXP_DEVSTA_URD);
301 }
302 
303 void pcie_cap_deverr_reset(PCIDevice *dev)
304 {
305     uint8_t *devctl = dev->config + dev->exp.exp_cap + PCI_EXP_DEVCTL;
306     pci_long_test_and_clear_mask(devctl,
307                                  PCI_EXP_DEVCTL_CERE | PCI_EXP_DEVCTL_NFERE |
308                                  PCI_EXP_DEVCTL_FERE | PCI_EXP_DEVCTL_URRE);
309 }
310 
311 void pcie_cap_lnkctl_init(PCIDevice *dev)
312 {
313     uint32_t pos = dev->exp.exp_cap;
314     pci_long_test_and_set_mask(dev->wmask + pos + PCI_EXP_LNKCTL,
315                                PCI_EXP_LNKCTL_CCC | PCI_EXP_LNKCTL_ES);
316 }
317 
318 void pcie_cap_lnkctl_reset(PCIDevice *dev)
319 {
320     uint8_t *lnkctl = dev->config + dev->exp.exp_cap + PCI_EXP_LNKCTL;
321     pci_long_test_and_clear_mask(lnkctl,
322                                  PCI_EXP_LNKCTL_CCC | PCI_EXP_LNKCTL_ES);
323 }
324 
325 static void hotplug_event_update_event_status(PCIDevice *dev)
326 {
327     uint32_t pos = dev->exp.exp_cap;
328     uint8_t *exp_cap = dev->config + pos;
329     uint16_t sltctl = pci_get_word(exp_cap + PCI_EXP_SLTCTL);
330     uint16_t sltsta = pci_get_word(exp_cap + PCI_EXP_SLTSTA);
331 
332     dev->exp.hpev_notified = (sltctl & PCI_EXP_SLTCTL_HPIE) &&
333         (sltsta & sltctl & PCI_EXP_HP_EV_SUPPORTED);
334 }
335 
336 static void hotplug_event_notify(PCIDevice *dev)
337 {
338     bool prev = dev->exp.hpev_notified;
339 
340     hotplug_event_update_event_status(dev);
341 
342     if (prev == dev->exp.hpev_notified) {
343         return;
344     }
345 
346     /* Note: the logic above does not take into account whether interrupts
347      * are masked. The result is that interrupt will be sent when it is
348      * subsequently unmasked. This appears to be legal: Section 6.7.3.4:
349      * The Port may optionally send an MSI when there are hot-plug events that
350      * occur while interrupt generation is disabled, and interrupt generation is
351      * subsequently enabled. */
352     if (msix_enabled(dev)) {
353         msix_notify(dev, pcie_cap_flags_get_vector(dev));
354     } else if (msi_enabled(dev)) {
355         msi_notify(dev, pcie_cap_flags_get_vector(dev));
356     } else {
357         pci_set_irq(dev, dev->exp.hpev_notified);
358     }
359 }
360 
361 static void hotplug_event_clear(PCIDevice *dev)
362 {
363     hotplug_event_update_event_status(dev);
364     if (!msix_enabled(dev) && !msi_enabled(dev) && !dev->exp.hpev_notified) {
365         pci_irq_deassert(dev);
366     }
367 }
368 
369 void pcie_cap_slot_enable_power(PCIDevice *dev)
370 {
371     uint8_t *exp_cap = dev->config + dev->exp.exp_cap;
372     uint32_t sltcap = pci_get_long(exp_cap + PCI_EXP_SLTCAP);
373 
374     if (sltcap & PCI_EXP_SLTCAP_PCP) {
375         pci_set_word_by_mask(exp_cap + PCI_EXP_SLTCTL,
376                              PCI_EXP_SLTCTL_PCC, PCI_EXP_SLTCTL_PWR_ON);
377     }
378 }
379 
380 static void pcie_set_power_device(PCIBus *bus, PCIDevice *dev, void *opaque)
381 {
382     bool *power = opaque;
383 
384     pci_set_power(dev, *power);
385 }
386 
387 static void pcie_cap_update_power(PCIDevice *hotplug_dev)
388 {
389     uint8_t *exp_cap = hotplug_dev->config + hotplug_dev->exp.exp_cap;
390     PCIBus *sec_bus = pci_bridge_get_sec_bus(PCI_BRIDGE(hotplug_dev));
391     uint32_t sltcap = pci_get_long(exp_cap + PCI_EXP_SLTCAP);
392     uint16_t sltctl = pci_get_word(exp_cap + PCI_EXP_SLTCTL);
393     bool power = true;
394 
395     if (sltcap & PCI_EXP_SLTCAP_PCP) {
396         power = (sltctl & PCI_EXP_SLTCTL_PCC) == PCI_EXP_SLTCTL_PWR_ON;
397     }
398 
399     pci_for_each_device(sec_bus, pci_bus_num(sec_bus),
400                         pcie_set_power_device, &power);
401 }
402 
403 /*
404  * A PCI Express Hot-Plug Event has occurred, so update slot status register
405  * and notify OS of the event if necessary.
406  *
407  * 6.7.3 PCI Express Hot-Plug Events
408  * 6.7.3.4 Software Notification of Hot-Plug Events
409  */
410 static void pcie_cap_slot_event(PCIDevice *dev, PCIExpressHotPlugEvent event)
411 {
412     /* Minor optimization: if nothing changed - no event is needed. */
413     if (pci_word_test_and_set_mask(dev->config + dev->exp.exp_cap +
414                                    PCI_EXP_SLTSTA, event) == event) {
415         return;
416     }
417     hotplug_event_notify(dev);
418 }
419 
420 static void pcie_cap_slot_plug_common(PCIDevice *hotplug_dev, DeviceState *dev,
421                                       Error **errp)
422 {
423     uint8_t *exp_cap = hotplug_dev->config + hotplug_dev->exp.exp_cap;
424     uint16_t sltsta = pci_get_word(exp_cap + PCI_EXP_SLTSTA);
425 
426     PCIE_DEV_PRINTF(PCI_DEVICE(dev), "hotplug state: 0x%x\n", sltsta);
427     if (sltsta & PCI_EXP_SLTSTA_EIS) {
428         /* the slot is electromechanically locked.
429          * This error is propagated up to qdev and then to HMP/QMP.
430          */
431         error_setg_errno(errp, EBUSY, "slot is electromechanically locked");
432     }
433 }
434 
435 void pcie_cap_slot_pre_plug_cb(HotplugHandler *hotplug_dev, DeviceState *dev,
436                                Error **errp)
437 {
438     PCIDevice *hotplug_pdev = PCI_DEVICE(hotplug_dev);
439     uint8_t *exp_cap = hotplug_pdev->config + hotplug_pdev->exp.exp_cap;
440     uint32_t sltcap = pci_get_word(exp_cap + PCI_EXP_SLTCAP);
441 
442     /* Check if hot-plug is disabled on the slot */
443     if (dev->hotplugged && (sltcap & PCI_EXP_SLTCAP_HPC) == 0) {
444         error_setg(errp, "Hot-plug failed: unsupported by the port device '%s'",
445                          DEVICE(hotplug_pdev)->id);
446         return;
447     }
448 
449     pcie_cap_slot_plug_common(PCI_DEVICE(hotplug_dev), dev, errp);
450 }
451 
452 void pcie_cap_slot_plug_cb(HotplugHandler *hotplug_dev, DeviceState *dev,
453                            Error **errp)
454 {
455     PCIDevice *hotplug_pdev = PCI_DEVICE(hotplug_dev);
456     uint8_t *exp_cap = hotplug_pdev->config + hotplug_pdev->exp.exp_cap;
457     PCIDevice *pci_dev = PCI_DEVICE(dev);
458     uint32_t lnkcap = pci_get_long(exp_cap + PCI_EXP_LNKCAP);
459 
460     if (pci_is_vf(pci_dev)) {
461         /* Virtual function cannot be physically disconnected */
462         return;
463     }
464 
465     /* Don't send event when device is enabled during qemu machine creation:
466      * it is present on boot, no hotplug event is necessary. We do send an
467      * event when the device is disabled later. */
468     if (!dev->hotplugged) {
469         pci_word_test_and_set_mask(exp_cap + PCI_EXP_SLTSTA,
470                                    PCI_EXP_SLTSTA_PDS);
471         if (pci_dev->cap_present & QEMU_PCIE_LNKSTA_DLLLA ||
472             (lnkcap & PCI_EXP_LNKCAP_DLLLARC)) {
473             pci_word_test_and_set_mask(exp_cap + PCI_EXP_LNKSTA,
474                                        PCI_EXP_LNKSTA_DLLLA);
475         }
476         pcie_cap_update_power(hotplug_pdev);
477         return;
478     }
479 
480     /* To enable multifunction hot-plug, we just ensure the function
481      * 0 added last. When function 0 is added, we set the sltsta and
482      * inform OS via event notification.
483      */
484     if (pci_get_function_0(pci_dev)) {
485         pci_word_test_and_set_mask(exp_cap + PCI_EXP_SLTSTA,
486                                    PCI_EXP_SLTSTA_PDS);
487         if (pci_dev->cap_present & QEMU_PCIE_LNKSTA_DLLLA ||
488             (lnkcap & PCI_EXP_LNKCAP_DLLLARC)) {
489             pci_word_test_and_set_mask(exp_cap + PCI_EXP_LNKSTA,
490                                        PCI_EXP_LNKSTA_DLLLA);
491         }
492         pcie_cap_slot_event(hotplug_pdev,
493                             PCI_EXP_HP_EV_PDC | PCI_EXP_HP_EV_ABP);
494         pcie_cap_update_power(hotplug_pdev);
495     }
496 }
497 
498 void pcie_cap_slot_unplug_cb(HotplugHandler *hotplug_dev, DeviceState *dev,
499                              Error **errp)
500 {
501     qdev_unrealize(dev);
502 }
503 
504 static void pcie_unplug_device(PCIBus *bus, PCIDevice *dev, void *opaque)
505 {
506     HotplugHandler *hotplug_ctrl = qdev_get_hotplug_handler(DEVICE(dev));
507 
508     if (dev->partially_hotplugged) {
509         dev->qdev.pending_deleted_event = false;
510         return;
511     }
512     hotplug_handler_unplug(hotplug_ctrl, DEVICE(dev), &error_abort);
513     object_unparent(OBJECT(dev));
514 }
515 
516 static void pcie_cap_slot_do_unplug(PCIDevice *dev)
517 {
518     PCIBus *sec_bus = pci_bridge_get_sec_bus(PCI_BRIDGE(dev));
519     uint8_t *exp_cap = dev->config + dev->exp.exp_cap;
520     uint32_t lnkcap = pci_get_long(exp_cap + PCI_EXP_LNKCAP);
521 
522     pci_for_each_device_under_bus(sec_bus, pcie_unplug_device, NULL);
523 
524     pci_word_test_and_clear_mask(exp_cap + PCI_EXP_SLTSTA,
525                                  PCI_EXP_SLTSTA_PDS);
526     if (dev->cap_present & QEMU_PCIE_LNKSTA_DLLLA ||
527         (lnkcap & PCI_EXP_LNKCAP_DLLLARC)) {
528         pci_word_test_and_clear_mask(exp_cap + PCI_EXP_LNKSTA,
529                                      PCI_EXP_LNKSTA_DLLLA);
530     }
531     pci_word_test_and_set_mask(exp_cap + PCI_EXP_SLTSTA,
532                                PCI_EXP_SLTSTA_PDC);
533 }
534 
535 void pcie_cap_slot_unplug_request_cb(HotplugHandler *hotplug_dev,
536                                      DeviceState *dev, Error **errp)
537 {
538     Error *local_err = NULL;
539     PCIDevice *pci_dev = PCI_DEVICE(dev);
540     PCIBus *bus = pci_get_bus(pci_dev);
541     PCIDevice *hotplug_pdev = PCI_DEVICE(hotplug_dev);
542     uint8_t *exp_cap = hotplug_pdev->config + hotplug_pdev->exp.exp_cap;
543     uint32_t sltcap = pci_get_word(exp_cap + PCI_EXP_SLTCAP);
544     uint16_t sltctl = pci_get_word(exp_cap + PCI_EXP_SLTCTL);
545 
546     /* Check if hot-unplug is disabled on the slot */
547     if ((sltcap & PCI_EXP_SLTCAP_HPC) == 0) {
548         error_setg(errp, "Hot-unplug failed: "
549                          "unsupported by the port device '%s'",
550                          DEVICE(hotplug_pdev)->id);
551         return;
552     }
553 
554     pcie_cap_slot_plug_common(hotplug_pdev, dev, &local_err);
555     if (local_err) {
556         error_propagate(errp, local_err);
557         return;
558     }
559 
560     if ((sltctl & PCI_EXP_SLTCTL_PIC) == PCI_EXP_SLTCTL_PWR_IND_BLINK) {
561         error_setg(errp, "Hot-unplug failed: "
562                    "guest is busy (power indicator blinking)");
563         return;
564     }
565 
566     dev->pending_deleted_event = true;
567     dev->pending_deleted_expires_ms =
568         qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) + 5000; /* 5 secs */
569 
570     /* In case user cancel the operation of multi-function hot-add,
571      * remove the function that is unexposed to guest individually,
572      * without interaction with guest.
573      */
574     if (pci_dev->devfn &&
575         !bus->devices[0]) {
576         pcie_unplug_device(bus, pci_dev, NULL);
577 
578         return;
579     }
580 
581     if (((sltctl & PCI_EXP_SLTCTL_PIC) == PCI_EXP_SLTCTL_PWR_IND_OFF) &&
582         ((sltctl & PCI_EXP_SLTCTL_PCC) == PCI_EXP_SLTCTL_PWR_OFF)) {
583         /* slot is powered off -> unplug without round-trip to the guest */
584         pcie_cap_slot_do_unplug(hotplug_pdev);
585         hotplug_event_notify(hotplug_pdev);
586         pci_word_test_and_clear_mask(exp_cap + PCI_EXP_SLTSTA,
587                                      PCI_EXP_SLTSTA_ABP);
588         return;
589     }
590 
591     pcie_cap_slot_push_attention_button(hotplug_pdev);
592 }
593 
594 /* pci express slot for pci express root/downstream port
595    PCI express capability slot registers */
596 void pcie_cap_slot_init(PCIDevice *dev, PCIESlot *s)
597 {
598     uint32_t pos = dev->exp.exp_cap;
599 
600     pci_word_test_and_set_mask(dev->config + pos + PCI_EXP_FLAGS,
601                                PCI_EXP_FLAGS_SLOT);
602 
603     pci_long_test_and_clear_mask(dev->config + pos + PCI_EXP_SLTCAP,
604                                  ~PCI_EXP_SLTCAP_PSN);
605     pci_long_test_and_set_mask(dev->config + pos + PCI_EXP_SLTCAP,
606                                (s->slot << PCI_EXP_SLTCAP_PSN_SHIFT) |
607                                PCI_EXP_SLTCAP_EIP |
608                                PCI_EXP_SLTCAP_PIP |
609                                PCI_EXP_SLTCAP_AIP |
610                                PCI_EXP_SLTCAP_ABP);
611 
612     /*
613      * Enable native hot-plug on all hot-plugged bridges unless
614      * hot-plug is disabled on the slot.
615      */
616     if (s->hotplug &&
617         (s->native_hotplug || DEVICE(dev)->hotplugged)) {
618         pci_long_test_and_set_mask(dev->config + pos + PCI_EXP_SLTCAP,
619                                    PCI_EXP_SLTCAP_HPS |
620                                    PCI_EXP_SLTCAP_HPC);
621     }
622 
623     if (dev->cap_present & QEMU_PCIE_SLTCAP_PCP) {
624         pci_long_test_and_set_mask(dev->config + pos + PCI_EXP_SLTCAP,
625                                    PCI_EXP_SLTCAP_PCP);
626         pci_word_test_and_clear_mask(dev->config + pos + PCI_EXP_SLTCTL,
627                                      PCI_EXP_SLTCTL_PCC);
628         pci_word_test_and_set_mask(dev->wmask + pos + PCI_EXP_SLTCTL,
629                                    PCI_EXP_SLTCTL_PCC);
630     }
631 
632     pci_word_test_and_clear_mask(dev->config + pos + PCI_EXP_SLTCTL,
633                                  PCI_EXP_SLTCTL_PIC |
634                                  PCI_EXP_SLTCTL_AIC);
635     pci_word_test_and_set_mask(dev->config + pos + PCI_EXP_SLTCTL,
636                                PCI_EXP_SLTCTL_PIC_OFF |
637                                PCI_EXP_SLTCTL_AIC_OFF);
638     pci_word_test_and_set_mask(dev->wmask + pos + PCI_EXP_SLTCTL,
639                                PCI_EXP_SLTCTL_PIC |
640                                PCI_EXP_SLTCTL_AIC |
641                                PCI_EXP_SLTCTL_HPIE |
642                                PCI_EXP_SLTCTL_CCIE |
643                                PCI_EXP_SLTCTL_PDCE |
644                                PCI_EXP_SLTCTL_ABPE);
645     /* Although reading PCI_EXP_SLTCTL_EIC returns always 0,
646      * make the bit writable here in order to detect 1b is written.
647      * pcie_cap_slot_write_config() test-and-clear the bit, so
648      * this bit always returns 0 to the guest.
649      */
650     pci_word_test_and_set_mask(dev->wmask + pos + PCI_EXP_SLTCTL,
651                                PCI_EXP_SLTCTL_EIC);
652 
653     pci_word_test_and_set_mask(dev->w1cmask + pos + PCI_EXP_SLTSTA,
654                                PCI_EXP_HP_EV_SUPPORTED);
655 
656     dev->exp.hpev_notified = false;
657 
658     qbus_set_hotplug_handler(BUS(pci_bridge_get_sec_bus(PCI_BRIDGE(dev))),
659                              OBJECT(dev));
660 }
661 
662 void pcie_cap_slot_reset(PCIDevice *dev)
663 {
664     uint8_t *exp_cap = dev->config + dev->exp.exp_cap;
665     uint8_t port_type = pcie_cap_get_type(dev);
666 
667     assert(port_type == PCI_EXP_TYPE_DOWNSTREAM ||
668            port_type == PCI_EXP_TYPE_ROOT_PORT);
669 
670     PCIE_DEV_PRINTF(dev, "reset\n");
671 
672     pci_word_test_and_clear_mask(exp_cap + PCI_EXP_SLTCTL,
673                                  PCI_EXP_SLTCTL_EIC |
674                                  PCI_EXP_SLTCTL_PIC |
675                                  PCI_EXP_SLTCTL_AIC |
676                                  PCI_EXP_SLTCTL_HPIE |
677                                  PCI_EXP_SLTCTL_CCIE |
678                                  PCI_EXP_SLTCTL_PDCE |
679                                  PCI_EXP_SLTCTL_ABPE);
680     pci_word_test_and_set_mask(exp_cap + PCI_EXP_SLTCTL,
681                                PCI_EXP_SLTCTL_AIC_OFF);
682 
683     if (dev->cap_present & QEMU_PCIE_SLTCAP_PCP) {
684         /* Downstream ports enforce device number 0. */
685         bool populated = pci_bridge_get_sec_bus(PCI_BRIDGE(dev))->devices[0];
686         uint16_t pic;
687 
688         if (populated) {
689             pci_word_test_and_clear_mask(exp_cap + PCI_EXP_SLTCTL,
690                                          PCI_EXP_SLTCTL_PCC);
691         } else {
692             pci_word_test_and_set_mask(exp_cap + PCI_EXP_SLTCTL,
693                                        PCI_EXP_SLTCTL_PCC);
694         }
695 
696         pic = populated ? PCI_EXP_SLTCTL_PIC_ON : PCI_EXP_SLTCTL_PIC_OFF;
697         pci_word_test_and_set_mask(exp_cap + PCI_EXP_SLTCTL, pic);
698     }
699 
700     pci_word_test_and_clear_mask(exp_cap + PCI_EXP_SLTSTA,
701                                  PCI_EXP_SLTSTA_EIS |/* on reset,
702                                                         the lock is released */
703                                  PCI_EXP_SLTSTA_CC |
704                                  PCI_EXP_SLTSTA_PDC |
705                                  PCI_EXP_SLTSTA_ABP);
706 
707     pcie_cap_update_power(dev);
708     hotplug_event_update_event_status(dev);
709 }
710 
711 void pcie_cap_slot_get(PCIDevice *dev, uint16_t *slt_ctl, uint16_t *slt_sta)
712 {
713     uint32_t pos = dev->exp.exp_cap;
714     uint8_t *exp_cap = dev->config + pos;
715     *slt_ctl = pci_get_word(exp_cap + PCI_EXP_SLTCTL);
716     *slt_sta = pci_get_word(exp_cap + PCI_EXP_SLTSTA);
717 }
718 
719 void pcie_cap_slot_write_config(PCIDevice *dev,
720                                 uint16_t old_slt_ctl, uint16_t old_slt_sta,
721                                 uint32_t addr, uint32_t val, int len)
722 {
723     uint32_t pos = dev->exp.exp_cap;
724     uint8_t *exp_cap = dev->config + pos;
725     uint16_t sltsta = pci_get_word(exp_cap + PCI_EXP_SLTSTA);
726 
727     if (ranges_overlap(addr, len, pos + PCI_EXP_SLTSTA, 2)) {
728         /*
729          * Guests tend to clears all bits during init.
730          * If they clear bits that weren't set this is racy and will lose events:
731          * not a big problem for manual button presses, but a problem for us.
732          * As a work-around, detect this and revert status to what it was
733          * before the write.
734          *
735          * Note: in theory this can be detected as a duplicate button press
736          * which cancels the previous press. Does not seem to happen in
737          * practice as guests seem to only have this bug during init.
738          */
739 #define PCIE_SLOT_EVENTS (PCI_EXP_SLTSTA_ABP | PCI_EXP_SLTSTA_PFD | \
740                           PCI_EXP_SLTSTA_MRLSC | PCI_EXP_SLTSTA_PDC | \
741                           PCI_EXP_SLTSTA_CC)
742 
743         if (val & ~old_slt_sta & PCIE_SLOT_EVENTS) {
744             sltsta = (sltsta & ~PCIE_SLOT_EVENTS) | (old_slt_sta & PCIE_SLOT_EVENTS);
745             pci_set_word(exp_cap + PCI_EXP_SLTSTA, sltsta);
746         }
747         hotplug_event_clear(dev);
748     }
749 
750     if (!ranges_overlap(addr, len, pos + PCI_EXP_SLTCTL, 2)) {
751         return;
752     }
753 
754     if (pci_word_test_and_clear_mask(exp_cap + PCI_EXP_SLTCTL,
755                                      PCI_EXP_SLTCTL_EIC)) {
756         sltsta ^= PCI_EXP_SLTSTA_EIS; /* toggle PCI_EXP_SLTSTA_EIS bit */
757         pci_set_word(exp_cap + PCI_EXP_SLTSTA, sltsta);
758         PCIE_DEV_PRINTF(dev, "PCI_EXP_SLTCTL_EIC: "
759                         "sltsta -> 0x%02"PRIx16"\n",
760                         sltsta);
761     }
762 
763     /*
764      * If the slot is populated, power indicator is off and power
765      * controller is off, it is safe to detach the devices.
766      *
767      * Note: don't detach if condition was already true:
768      * this is a work around for guests that overwrite
769      * control of powered off slots before powering them on.
770      */
771     if ((sltsta & PCI_EXP_SLTSTA_PDS) && (val & PCI_EXP_SLTCTL_PCC) &&
772         (val & PCI_EXP_SLTCTL_PIC_OFF) == PCI_EXP_SLTCTL_PIC_OFF &&
773         (!(old_slt_ctl & PCI_EXP_SLTCTL_PCC) ||
774         (old_slt_ctl & PCI_EXP_SLTCTL_PIC_OFF) != PCI_EXP_SLTCTL_PIC_OFF)) {
775         pcie_cap_slot_do_unplug(dev);
776     }
777     pcie_cap_update_power(dev);
778 
779     hotplug_event_notify(dev);
780 
781     /*
782      * 6.7.3.2 Command Completed Events
783      *
784      * Software issues a command to a hot-plug capable Downstream Port by
785      * issuing a write transaction that targets any portion of the Port’s Slot
786      * Control register. A single write to the Slot Control register is
787      * considered to be a single command, even if the write affects more than
788      * one field in the Slot Control register. In response to this transaction,
789      * the Port must carry out the requested actions and then set the
790      * associated status field for the command completed event. */
791 
792     /* Real hardware might take a while to complete requested command because
793      * physical movement would be involved like locking the electromechanical
794      * lock.  However in our case, command is completed instantaneously above,
795      * so send a command completion event right now.
796      */
797     pcie_cap_slot_event(dev, PCI_EXP_HP_EV_CCI);
798 }
799 
800 int pcie_cap_slot_post_load(void *opaque, int version_id)
801 {
802     PCIDevice *dev = opaque;
803     hotplug_event_update_event_status(dev);
804     pcie_cap_update_power(dev);
805     return 0;
806 }
807 
808 void pcie_cap_slot_push_attention_button(PCIDevice *dev)
809 {
810     pcie_cap_slot_event(dev, PCI_EXP_HP_EV_ABP);
811 }
812 
813 /* root control/capabilities/status. PME isn't emulated for now */
814 void pcie_cap_root_init(PCIDevice *dev)
815 {
816     pci_set_word(dev->wmask + dev->exp.exp_cap + PCI_EXP_RTCTL,
817                  PCI_EXP_RTCTL_SECEE | PCI_EXP_RTCTL_SENFEE |
818                  PCI_EXP_RTCTL_SEFEE);
819 }
820 
821 void pcie_cap_root_reset(PCIDevice *dev)
822 {
823     pci_set_word(dev->config + dev->exp.exp_cap + PCI_EXP_RTCTL, 0);
824 }
825 
826 /* function level reset(FLR) */
827 void pcie_cap_flr_init(PCIDevice *dev)
828 {
829     pci_long_test_and_set_mask(dev->config + dev->exp.exp_cap + PCI_EXP_DEVCAP,
830                                PCI_EXP_DEVCAP_FLR);
831 
832     /* Although reading BCR_FLR returns always 0,
833      * the bit is made writable here in order to detect the 1b is written
834      * pcie_cap_flr_write_config() test-and-clear the bit, so
835      * this bit always returns 0 to the guest.
836      */
837     pci_word_test_and_set_mask(dev->wmask + dev->exp.exp_cap + PCI_EXP_DEVCTL,
838                                PCI_EXP_DEVCTL_BCR_FLR);
839 }
840 
841 void pcie_cap_flr_write_config(PCIDevice *dev,
842                                uint32_t addr, uint32_t val, int len)
843 {
844     uint8_t *devctl = dev->config + dev->exp.exp_cap + PCI_EXP_DEVCTL;
845     if (pci_get_word(devctl) & PCI_EXP_DEVCTL_BCR_FLR) {
846         /* Clear PCI_EXP_DEVCTL_BCR_FLR after invoking the reset handler
847            so the handler can detect FLR by looking at this bit. */
848         pci_device_reset(dev);
849         pci_word_test_and_clear_mask(devctl, PCI_EXP_DEVCTL_BCR_FLR);
850     }
851 }
852 
853 /* Alternative Routing-ID Interpretation (ARI)
854  * forwarding support for root and downstream ports
855  */
856 void pcie_cap_arifwd_init(PCIDevice *dev)
857 {
858     uint32_t pos = dev->exp.exp_cap;
859     pci_long_test_and_set_mask(dev->config + pos + PCI_EXP_DEVCAP2,
860                                PCI_EXP_DEVCAP2_ARI);
861     pci_long_test_and_set_mask(dev->wmask + pos + PCI_EXP_DEVCTL2,
862                                PCI_EXP_DEVCTL2_ARI);
863 }
864 
865 void pcie_cap_arifwd_reset(PCIDevice *dev)
866 {
867     uint8_t *devctl2 = dev->config + dev->exp.exp_cap + PCI_EXP_DEVCTL2;
868     pci_long_test_and_clear_mask(devctl2, PCI_EXP_DEVCTL2_ARI);
869 }
870 
871 bool pcie_cap_is_arifwd_enabled(const PCIDevice *dev)
872 {
873     if (!pci_is_express(dev)) {
874         return false;
875     }
876     if (!dev->exp.exp_cap) {
877         return false;
878     }
879 
880     return pci_get_long(dev->config + dev->exp.exp_cap + PCI_EXP_DEVCTL2) &
881         PCI_EXP_DEVCTL2_ARI;
882 }
883 
884 /**************************************************************************
885  * pci express extended capability list management functions
886  * uint16_t ext_cap_id (16 bit)
887  * uint8_t cap_ver (4 bit)
888  * uint16_t cap_offset (12 bit)
889  * uint16_t ext_cap_size
890  */
891 
892 /* Passing a cap_id value > 0xffff will return 0 and put end of list in prev */
893 static uint16_t pcie_find_capability_list(PCIDevice *dev, uint32_t cap_id,
894                                           uint16_t *prev_p)
895 {
896     uint16_t prev = 0;
897     uint16_t next;
898     uint32_t header = pci_get_long(dev->config + PCI_CONFIG_SPACE_SIZE);
899 
900     if (!header) {
901         /* no extended capability */
902         next = 0;
903         goto out;
904     }
905     for (next = PCI_CONFIG_SPACE_SIZE; next;
906          prev = next, next = PCI_EXT_CAP_NEXT(header)) {
907 
908         assert(next >= PCI_CONFIG_SPACE_SIZE);
909         assert(next <= PCIE_CONFIG_SPACE_SIZE - 8);
910 
911         header = pci_get_long(dev->config + next);
912         if (PCI_EXT_CAP_ID(header) == cap_id) {
913             break;
914         }
915     }
916 
917 out:
918     if (prev_p) {
919         *prev_p = prev;
920     }
921     return next;
922 }
923 
924 uint16_t pcie_find_capability(PCIDevice *dev, uint16_t cap_id)
925 {
926     return pcie_find_capability_list(dev, cap_id, NULL);
927 }
928 
929 static void pcie_ext_cap_set_next(PCIDevice *dev, uint16_t pos, uint16_t next)
930 {
931     uint32_t header = pci_get_long(dev->config + pos);
932     assert(!(next & (PCI_EXT_CAP_ALIGN - 1)));
933     header = (header & ~PCI_EXT_CAP_NEXT_MASK) |
934         ((next << PCI_EXT_CAP_NEXT_SHIFT) & PCI_EXT_CAP_NEXT_MASK);
935     pci_set_long(dev->config + pos, header);
936 }
937 
938 /*
939  * Caller must supply valid (offset, size) such that the range wouldn't
940  * overlap with other capability or other registers.
941  * This function doesn't check it.
942  */
943 void pcie_add_capability(PCIDevice *dev,
944                          uint16_t cap_id, uint8_t cap_ver,
945                          uint16_t offset, uint16_t size)
946 {
947     assert(offset >= PCI_CONFIG_SPACE_SIZE);
948     assert(offset < (uint16_t)(offset + size));
949     assert((uint16_t)(offset + size) <= PCIE_CONFIG_SPACE_SIZE);
950     assert(size >= 8);
951     assert(pci_is_express(dev));
952 
953     if (offset != PCI_CONFIG_SPACE_SIZE) {
954         uint16_t prev;
955 
956         /*
957          * 0xffffffff is not a valid cap id (it's a 16 bit field). use
958          * internally to find the last capability in the linked list.
959          */
960         pcie_find_capability_list(dev, 0xffffffff, &prev);
961         assert(prev >= PCI_CONFIG_SPACE_SIZE);
962         pcie_ext_cap_set_next(dev, prev, offset);
963     }
964     pci_set_long(dev->config + offset, PCI_EXT_CAP(cap_id, cap_ver, 0));
965 
966     /* Make capability read-only by default */
967     memset(dev->wmask + offset, 0, size);
968     memset(dev->w1cmask + offset, 0, size);
969     /* Check capability by default */
970     memset(dev->cmask + offset, 0xFF, size);
971 }
972 
973 /*
974  * Sync the PCIe Link Status negotiated speed and width of a bridge with the
975  * downstream device.  If downstream device is not present, re-write with the
976  * Link Capability fields.  If downstream device reports invalid width or
977  * speed, replace with minimum values (LnkSta fields are RsvdZ on VFs but such
978  * values interfere with PCIe native hotplug detecting new devices).  Limit
979  * width and speed to bridge capabilities for compatibility.  Use config_read
980  * to access the downstream device since it could be an assigned device with
981  * volatile link information.
982  */
983 void pcie_sync_bridge_lnk(PCIDevice *bridge_dev)
984 {
985     PCIBridge *br = PCI_BRIDGE(bridge_dev);
986     PCIBus *bus = pci_bridge_get_sec_bus(br);
987     PCIDevice *target = bus->devices[0];
988     uint8_t *exp_cap = bridge_dev->config + bridge_dev->exp.exp_cap;
989     uint16_t lnksta, lnkcap = pci_get_word(exp_cap + PCI_EXP_LNKCAP);
990 
991     if (!target || !target->exp.exp_cap) {
992         lnksta = lnkcap;
993     } else {
994         lnksta = target->config_read(target,
995                                      target->exp.exp_cap + PCI_EXP_LNKSTA,
996                                      sizeof(lnksta));
997 
998         if ((lnksta & PCI_EXP_LNKSTA_NLW) > (lnkcap & PCI_EXP_LNKCAP_MLW)) {
999             lnksta &= ~PCI_EXP_LNKSTA_NLW;
1000             lnksta |= lnkcap & PCI_EXP_LNKCAP_MLW;
1001         } else if (!(lnksta & PCI_EXP_LNKSTA_NLW)) {
1002             lnksta |= QEMU_PCI_EXP_LNKSTA_NLW(QEMU_PCI_EXP_LNK_X1);
1003         }
1004 
1005         if ((lnksta & PCI_EXP_LNKSTA_CLS) > (lnkcap & PCI_EXP_LNKCAP_SLS)) {
1006             lnksta &= ~PCI_EXP_LNKSTA_CLS;
1007             lnksta |= lnkcap & PCI_EXP_LNKCAP_SLS;
1008         } else if (!(lnksta & PCI_EXP_LNKSTA_CLS)) {
1009             lnksta |= QEMU_PCI_EXP_LNKSTA_CLS(QEMU_PCI_EXP_LNK_2_5GT);
1010         }
1011     }
1012 
1013     pci_word_test_and_clear_mask(exp_cap + PCI_EXP_LNKSTA,
1014                                  PCI_EXP_LNKSTA_CLS | PCI_EXP_LNKSTA_NLW);
1015     pci_word_test_and_set_mask(exp_cap + PCI_EXP_LNKSTA, lnksta &
1016                                (PCI_EXP_LNKSTA_CLS | PCI_EXP_LNKSTA_NLW));
1017 }
1018 
1019 /**************************************************************************
1020  * pci express extended capability helper functions
1021  */
1022 
1023 /* ARI */
1024 void pcie_ari_init(PCIDevice *dev, uint16_t offset, uint16_t nextfn)
1025 {
1026     pcie_add_capability(dev, PCI_EXT_CAP_ID_ARI, PCI_ARI_VER,
1027                         offset, PCI_ARI_SIZEOF);
1028     pci_set_long(dev->config + offset + PCI_ARI_CAP, (nextfn & 0xff) << 8);
1029 }
1030 
1031 void pcie_dev_ser_num_init(PCIDevice *dev, uint16_t offset, uint64_t ser_num)
1032 {
1033     static const int pci_dsn_ver = 1;
1034     static const int pci_dsn_cap = 4;
1035 
1036     pcie_add_capability(dev, PCI_EXT_CAP_ID_DSN, pci_dsn_ver, offset,
1037                         PCI_EXT_CAP_DSN_SIZEOF);
1038     pci_set_quad(dev->config + offset + pci_dsn_cap, ser_num);
1039 }
1040 
1041 void pcie_ats_init(PCIDevice *dev, uint16_t offset, bool aligned)
1042 {
1043     pcie_add_capability(dev, PCI_EXT_CAP_ID_ATS, 0x1,
1044                         offset, PCI_EXT_CAP_ATS_SIZEOF);
1045 
1046     dev->exp.ats_cap = offset;
1047 
1048     /* Invalidate Queue Depth 0 */
1049     if (aligned) {
1050         pci_set_word(dev->config + offset + PCI_ATS_CAP,
1051                      PCI_ATS_CAP_PAGE_ALIGNED);
1052     }
1053     /* STU 0, Disabled by default */
1054     pci_set_word(dev->config + offset + PCI_ATS_CTRL, 0);
1055 
1056     pci_set_word(dev->wmask + dev->exp.ats_cap + PCI_ATS_CTRL, 0x800f);
1057 }
1058 
1059 /* ACS (Access Control Services) */
1060 void pcie_acs_init(PCIDevice *dev, uint16_t offset)
1061 {
1062     bool is_downstream = pci_is_express_downstream_port(dev);
1063     uint16_t cap_bits = 0;
1064 
1065     /* For endpoints, only multifunction devs may have an ACS capability: */
1066     assert(is_downstream ||
1067            (dev->cap_present & QEMU_PCI_CAP_MULTIFUNCTION) ||
1068            PCI_FUNC(dev->devfn));
1069 
1070     pcie_add_capability(dev, PCI_EXT_CAP_ID_ACS, PCI_ACS_VER, offset,
1071                         PCI_ACS_SIZEOF);
1072     dev->exp.acs_cap = offset;
1073 
1074     if (is_downstream) {
1075         /*
1076          * Downstream ports must implement SV, TB, RR, CR, UF, and DT (with
1077          * caveats on the latter four that we ignore for simplicity).
1078          * Endpoints may also implement a subset of ACS capabilities,
1079          * but these are optional if the endpoint does not support
1080          * peer-to-peer between functions and thus omitted here.
1081          */
1082         cap_bits = PCI_ACS_SV | PCI_ACS_TB | PCI_ACS_RR |
1083             PCI_ACS_CR | PCI_ACS_UF | PCI_ACS_DT;
1084     }
1085 
1086     pci_set_word(dev->config + offset + PCI_ACS_CAP, cap_bits);
1087     pci_set_word(dev->wmask + offset + PCI_ACS_CTRL, cap_bits);
1088 }
1089 
1090 void pcie_acs_reset(PCIDevice *dev)
1091 {
1092     if (dev->exp.acs_cap) {
1093         pci_set_word(dev->config + dev->exp.acs_cap + PCI_ACS_CTRL, 0);
1094     }
1095 }
1096