xref: /openbmc/qemu/hw/pci/pcie.c (revision 709395f8)
1 /*
2  * pcie.c
3  *
4  * Copyright (c) 2010 Isaku Yamahata <yamahata at valinux co jp>
5  *                    VA Linux Systems Japan K.K.
6  *
7  * This program is free software; you can redistribute it and/or modify
8  * it under the terms of the GNU General Public License as published by
9  * the Free Software Foundation; either version 2 of the License, or
10  * (at your option) any later version.
11  *
12  * This program is distributed in the hope that it will be useful,
13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
15  * GNU General Public License for more details.
16  *
17  * You should have received a copy of the GNU General Public License along
18  * with this program; if not, see <http://www.gnu.org/licenses/>.
19  */
20 
21 #include "qemu/osdep.h"
22 #include "qapi/error.h"
23 #include "qemu-common.h"
24 #include "hw/pci/pci_bridge.h"
25 #include "hw/pci/pcie.h"
26 #include "hw/pci/msix.h"
27 #include "hw/pci/msi.h"
28 #include "hw/pci/pci_bus.h"
29 #include "hw/pci/pcie_regs.h"
30 #include "hw/pci/pcie_port.h"
31 #include "qemu/range.h"
32 
33 //#define DEBUG_PCIE
34 #ifdef DEBUG_PCIE
35 # define PCIE_DPRINTF(fmt, ...)                                         \
36     fprintf(stderr, "%s:%d " fmt, __func__, __LINE__, ## __VA_ARGS__)
37 #else
38 # define PCIE_DPRINTF(fmt, ...) do {} while (0)
39 #endif
40 #define PCIE_DEV_PRINTF(dev, fmt, ...)                                  \
41     PCIE_DPRINTF("%s:%x "fmt, (dev)->name, (dev)->devfn, ## __VA_ARGS__)
42 
43 
44 /***************************************************************************
45  * pci express capability helper functions
46  */
47 
48 static void
49 pcie_cap_v1_fill(PCIDevice *dev, uint8_t port, uint8_t type, uint8_t version)
50 {
51     uint8_t *exp_cap = dev->config + dev->exp.exp_cap;
52     uint8_t *cmask = dev->cmask + dev->exp.exp_cap;
53 
54     /* capability register
55     interrupt message number defaults to 0 */
56     pci_set_word(exp_cap + PCI_EXP_FLAGS,
57                  ((type << PCI_EXP_FLAGS_TYPE_SHIFT) & PCI_EXP_FLAGS_TYPE) |
58                  version);
59 
60     /* device capability register
61      * table 7-12:
62      * roll based error reporting bit must be set by all
63      * Functions conforming to the ECN, PCI Express Base
64      * Specification, Revision 1.1., or subsequent PCI Express Base
65      * Specification revisions.
66      */
67     pci_set_long(exp_cap + PCI_EXP_DEVCAP, PCI_EXP_DEVCAP_RBER);
68 
69     pci_set_long(exp_cap + PCI_EXP_LNKCAP,
70                  (port << PCI_EXP_LNKCAP_PN_SHIFT) |
71                  PCI_EXP_LNKCAP_ASPMS_0S |
72                  QEMU_PCI_EXP_LNKCAP_MLW(QEMU_PCI_EXP_LNK_X1) |
73                  QEMU_PCI_EXP_LNKCAP_MLS(QEMU_PCI_EXP_LNK_2_5GT));
74 
75     pci_set_word(exp_cap + PCI_EXP_LNKSTA,
76                  QEMU_PCI_EXP_LNKSTA_NLW(QEMU_PCI_EXP_LNK_X1) |
77                  QEMU_PCI_EXP_LNKSTA_CLS(QEMU_PCI_EXP_LNK_2_5GT));
78 
79     if (dev->cap_present & QEMU_PCIE_LNKSTA_DLLLA) {
80         pci_word_test_and_set_mask(exp_cap + PCI_EXP_LNKSTA,
81                                    PCI_EXP_LNKSTA_DLLLA);
82     }
83 
84     /* We changed link status bits over time, and changing them across
85      * migrations is generally fine as hardware changes them too.
86      * Let's not bother checking.
87      */
88     pci_set_word(cmask + PCI_EXP_LNKSTA, 0);
89 }
90 
91 static void pcie_cap_fill_slot_lnk(PCIDevice *dev)
92 {
93     PCIESlot *s = (PCIESlot *)object_dynamic_cast(OBJECT(dev), TYPE_PCIE_SLOT);
94     uint8_t *exp_cap = dev->config + dev->exp.exp_cap;
95 
96     /* Skip anything that isn't a PCIESlot */
97     if (!s) {
98         return;
99     }
100 
101     /* Clear and fill LNKCAP from what was configured above */
102     pci_long_test_and_clear_mask(exp_cap + PCI_EXP_LNKCAP,
103                                  PCI_EXP_LNKCAP_MLW | PCI_EXP_LNKCAP_SLS);
104     pci_long_test_and_set_mask(exp_cap + PCI_EXP_LNKCAP,
105                                QEMU_PCI_EXP_LNKCAP_MLW(s->width) |
106                                QEMU_PCI_EXP_LNKCAP_MLS(s->speed));
107 
108     /*
109      * Link bandwidth notification is required for all root ports and
110      * downstream ports supporting links wider than x1 or multiple link
111      * speeds.
112      */
113     if (s->width > QEMU_PCI_EXP_LNK_X1 ||
114         s->speed > QEMU_PCI_EXP_LNK_2_5GT) {
115         pci_long_test_and_set_mask(exp_cap + PCI_EXP_LNKCAP,
116                                    PCI_EXP_LNKCAP_LBNC);
117     }
118 
119     if (s->speed > QEMU_PCI_EXP_LNK_2_5GT) {
120         /*
121          * Hot-plug capable downstream ports and downstream ports supporting
122          * link speeds greater than 5GT/s must hardwire PCI_EXP_LNKCAP_DLLLARC
123          * to 1b.  PCI_EXP_LNKCAP_DLLLARC implies PCI_EXP_LNKSTA_DLLLA, which
124          * we also hardwire to 1b here.  2.5GT/s hot-plug slots should also
125          * technically implement this, but it's not done here for compatibility.
126          */
127         pci_long_test_and_set_mask(exp_cap + PCI_EXP_LNKCAP,
128                                    PCI_EXP_LNKCAP_DLLLARC);
129         pci_word_test_and_set_mask(exp_cap + PCI_EXP_LNKSTA,
130                                    PCI_EXP_LNKSTA_DLLLA);
131 
132         /*
133          * Target Link Speed defaults to the highest link speed supported by
134          * the component.  2.5GT/s devices are permitted to hardwire to zero.
135          */
136         pci_word_test_and_clear_mask(exp_cap + PCI_EXP_LNKCTL2,
137                                      PCI_EXP_LNKCTL2_TLS);
138         pci_word_test_and_set_mask(exp_cap + PCI_EXP_LNKCTL2,
139                                    QEMU_PCI_EXP_LNKCAP_MLS(s->speed) &
140                                    PCI_EXP_LNKCTL2_TLS);
141     }
142 
143     /*
144      * 2.5 & 5.0GT/s can be fully described by LNKCAP, but 8.0GT/s is
145      * actually a reference to the highest bit supported in this register.
146      * We assume the device supports all link speeds.
147      */
148     if (s->speed > QEMU_PCI_EXP_LNK_5GT) {
149         pci_long_test_and_clear_mask(exp_cap + PCI_EXP_LNKCAP2, ~0U);
150         pci_long_test_and_set_mask(exp_cap + PCI_EXP_LNKCAP2,
151                                    PCI_EXP_LNKCAP2_SLS_2_5GB |
152                                    PCI_EXP_LNKCAP2_SLS_5_0GB |
153                                    PCI_EXP_LNKCAP2_SLS_8_0GB);
154         if (s->speed > QEMU_PCI_EXP_LNK_8GT) {
155             pci_long_test_and_set_mask(exp_cap + PCI_EXP_LNKCAP2,
156                                        PCI_EXP_LNKCAP2_SLS_16_0GB);
157         }
158     }
159 }
160 
161 int pcie_cap_init(PCIDevice *dev, uint8_t offset,
162                   uint8_t type, uint8_t port,
163                   Error **errp)
164 {
165     /* PCIe cap v2 init */
166     int pos;
167     uint8_t *exp_cap;
168 
169     assert(pci_is_express(dev));
170 
171     pos = pci_add_capability(dev, PCI_CAP_ID_EXP, offset,
172                              PCI_EXP_VER2_SIZEOF, errp);
173     if (pos < 0) {
174         return pos;
175     }
176     dev->exp.exp_cap = pos;
177     exp_cap = dev->config + pos;
178 
179     /* Filling values common with v1 */
180     pcie_cap_v1_fill(dev, port, type, PCI_EXP_FLAGS_VER2);
181 
182     /* Fill link speed and width options */
183     pcie_cap_fill_slot_lnk(dev);
184 
185     /* Filling v2 specific values */
186     pci_set_long(exp_cap + PCI_EXP_DEVCAP2,
187                  PCI_EXP_DEVCAP2_EFF | PCI_EXP_DEVCAP2_EETLPP);
188 
189     pci_set_word(dev->wmask + pos + PCI_EXP_DEVCTL2, PCI_EXP_DEVCTL2_EETLPPB);
190 
191     if (dev->cap_present & QEMU_PCIE_EXTCAP_INIT) {
192         /* read-only to behave like a 'NULL' Extended Capability Header */
193         pci_set_long(dev->wmask + PCI_CONFIG_SPACE_SIZE, 0);
194     }
195 
196     return pos;
197 }
198 
199 int pcie_cap_v1_init(PCIDevice *dev, uint8_t offset, uint8_t type,
200                      uint8_t port)
201 {
202     /* PCIe cap v1 init */
203     int pos;
204     Error *local_err = NULL;
205 
206     assert(pci_is_express(dev));
207 
208     pos = pci_add_capability(dev, PCI_CAP_ID_EXP, offset,
209                              PCI_EXP_VER1_SIZEOF, &local_err);
210     if (pos < 0) {
211         error_report_err(local_err);
212         return pos;
213     }
214     dev->exp.exp_cap = pos;
215 
216     pcie_cap_v1_fill(dev, port, type, PCI_EXP_FLAGS_VER1);
217 
218     return pos;
219 }
220 
221 static int
222 pcie_endpoint_cap_common_init(PCIDevice *dev, uint8_t offset, uint8_t cap_size)
223 {
224     uint8_t type = PCI_EXP_TYPE_ENDPOINT;
225     Error *local_err = NULL;
226     int ret;
227 
228     /*
229      * Windows guests will report Code 10, device cannot start, if
230      * a regular Endpoint type is exposed on a root complex.  These
231      * should instead be Root Complex Integrated Endpoints.
232      */
233     if (pci_bus_is_express(pci_get_bus(dev))
234         && pci_bus_is_root(pci_get_bus(dev))) {
235         type = PCI_EXP_TYPE_RC_END;
236     }
237 
238     if (cap_size == PCI_EXP_VER1_SIZEOF) {
239         return pcie_cap_v1_init(dev, offset, type, 0);
240     } else {
241         ret = pcie_cap_init(dev, offset, type, 0, &local_err);
242 
243         if (ret < 0) {
244             error_report_err(local_err);
245         }
246 
247         return ret;
248     }
249 }
250 
251 int pcie_endpoint_cap_init(PCIDevice *dev, uint8_t offset)
252 {
253     return pcie_endpoint_cap_common_init(dev, offset, PCI_EXP_VER2_SIZEOF);
254 }
255 
256 int pcie_endpoint_cap_v1_init(PCIDevice *dev, uint8_t offset)
257 {
258     return pcie_endpoint_cap_common_init(dev, offset, PCI_EXP_VER1_SIZEOF);
259 }
260 
261 void pcie_cap_exit(PCIDevice *dev)
262 {
263     pci_del_capability(dev, PCI_CAP_ID_EXP, PCI_EXP_VER2_SIZEOF);
264 }
265 
266 void pcie_cap_v1_exit(PCIDevice *dev)
267 {
268     pci_del_capability(dev, PCI_CAP_ID_EXP, PCI_EXP_VER1_SIZEOF);
269 }
270 
271 uint8_t pcie_cap_get_type(const PCIDevice *dev)
272 {
273     uint32_t pos = dev->exp.exp_cap;
274     assert(pos > 0);
275     return (pci_get_word(dev->config + pos + PCI_EXP_FLAGS) &
276             PCI_EXP_FLAGS_TYPE) >> PCI_EXP_FLAGS_TYPE_SHIFT;
277 }
278 
279 /* MSI/MSI-X */
280 /* pci express interrupt message number */
281 /* 7.8.2 PCI Express Capabilities Register: Interrupt Message Number */
282 void pcie_cap_flags_set_vector(PCIDevice *dev, uint8_t vector)
283 {
284     uint8_t *exp_cap = dev->config + dev->exp.exp_cap;
285     assert(vector < 32);
286     pci_word_test_and_clear_mask(exp_cap + PCI_EXP_FLAGS, PCI_EXP_FLAGS_IRQ);
287     pci_word_test_and_set_mask(exp_cap + PCI_EXP_FLAGS,
288                                vector << PCI_EXP_FLAGS_IRQ_SHIFT);
289 }
290 
291 uint8_t pcie_cap_flags_get_vector(PCIDevice *dev)
292 {
293     return (pci_get_word(dev->config + dev->exp.exp_cap + PCI_EXP_FLAGS) &
294             PCI_EXP_FLAGS_IRQ) >> PCI_EXP_FLAGS_IRQ_SHIFT;
295 }
296 
297 void pcie_cap_deverr_init(PCIDevice *dev)
298 {
299     uint32_t pos = dev->exp.exp_cap;
300     pci_long_test_and_set_mask(dev->config + pos + PCI_EXP_DEVCAP,
301                                PCI_EXP_DEVCAP_RBER);
302     pci_long_test_and_set_mask(dev->wmask + pos + PCI_EXP_DEVCTL,
303                                PCI_EXP_DEVCTL_CERE | PCI_EXP_DEVCTL_NFERE |
304                                PCI_EXP_DEVCTL_FERE | PCI_EXP_DEVCTL_URRE);
305     pci_long_test_and_set_mask(dev->w1cmask + pos + PCI_EXP_DEVSTA,
306                                PCI_EXP_DEVSTA_CED | PCI_EXP_DEVSTA_NFED |
307                                PCI_EXP_DEVSTA_FED | PCI_EXP_DEVSTA_URD);
308 }
309 
310 void pcie_cap_deverr_reset(PCIDevice *dev)
311 {
312     uint8_t *devctl = dev->config + dev->exp.exp_cap + PCI_EXP_DEVCTL;
313     pci_long_test_and_clear_mask(devctl,
314                                  PCI_EXP_DEVCTL_CERE | PCI_EXP_DEVCTL_NFERE |
315                                  PCI_EXP_DEVCTL_FERE | PCI_EXP_DEVCTL_URRE);
316 }
317 
318 void pcie_cap_lnkctl_init(PCIDevice *dev)
319 {
320     uint32_t pos = dev->exp.exp_cap;
321     pci_long_test_and_set_mask(dev->wmask + pos + PCI_EXP_LNKCTL,
322                                PCI_EXP_LNKCTL_CCC | PCI_EXP_LNKCTL_ES);
323 }
324 
325 void pcie_cap_lnkctl_reset(PCIDevice *dev)
326 {
327     uint8_t *lnkctl = dev->config + dev->exp.exp_cap + PCI_EXP_LNKCTL;
328     pci_long_test_and_clear_mask(lnkctl,
329                                  PCI_EXP_LNKCTL_CCC | PCI_EXP_LNKCTL_ES);
330 }
331 
332 static void hotplug_event_update_event_status(PCIDevice *dev)
333 {
334     uint32_t pos = dev->exp.exp_cap;
335     uint8_t *exp_cap = dev->config + pos;
336     uint16_t sltctl = pci_get_word(exp_cap + PCI_EXP_SLTCTL);
337     uint16_t sltsta = pci_get_word(exp_cap + PCI_EXP_SLTSTA);
338 
339     dev->exp.hpev_notified = (sltctl & PCI_EXP_SLTCTL_HPIE) &&
340         (sltsta & sltctl & PCI_EXP_HP_EV_SUPPORTED);
341 }
342 
343 static void hotplug_event_notify(PCIDevice *dev)
344 {
345     bool prev = dev->exp.hpev_notified;
346 
347     hotplug_event_update_event_status(dev);
348 
349     if (prev == dev->exp.hpev_notified) {
350         return;
351     }
352 
353     /* Note: the logic above does not take into account whether interrupts
354      * are masked. The result is that interrupt will be sent when it is
355      * subsequently unmasked. This appears to be legal: Section 6.7.3.4:
356      * The Port may optionally send an MSI when there are hot-plug events that
357      * occur while interrupt generation is disabled, and interrupt generation is
358      * subsequently enabled. */
359     if (msix_enabled(dev)) {
360         msix_notify(dev, pcie_cap_flags_get_vector(dev));
361     } else if (msi_enabled(dev)) {
362         msi_notify(dev, pcie_cap_flags_get_vector(dev));
363     } else {
364         pci_set_irq(dev, dev->exp.hpev_notified);
365     }
366 }
367 
368 static void hotplug_event_clear(PCIDevice *dev)
369 {
370     hotplug_event_update_event_status(dev);
371     if (!msix_enabled(dev) && !msi_enabled(dev) && !dev->exp.hpev_notified) {
372         pci_irq_deassert(dev);
373     }
374 }
375 
376 /*
377  * A PCI Express Hot-Plug Event has occurred, so update slot status register
378  * and notify OS of the event if necessary.
379  *
380  * 6.7.3 PCI Express Hot-Plug Events
381  * 6.7.3.4 Software Notification of Hot-Plug Events
382  */
383 static void pcie_cap_slot_event(PCIDevice *dev, PCIExpressHotPlugEvent event)
384 {
385     /* Minor optimization: if nothing changed - no event is needed. */
386     if (pci_word_test_and_set_mask(dev->config + dev->exp.exp_cap +
387                                    PCI_EXP_SLTSTA, event)) {
388         return;
389     }
390     hotplug_event_notify(dev);
391 }
392 
393 static void pcie_cap_slot_plug_common(PCIDevice *hotplug_dev, DeviceState *dev,
394                                       Error **errp)
395 {
396     uint8_t *exp_cap = hotplug_dev->config + hotplug_dev->exp.exp_cap;
397     uint16_t sltsta = pci_get_word(exp_cap + PCI_EXP_SLTSTA);
398 
399     PCIE_DEV_PRINTF(PCI_DEVICE(dev), "hotplug state: 0x%x\n", sltsta);
400     if (sltsta & PCI_EXP_SLTSTA_EIS) {
401         /* the slot is electromechanically locked.
402          * This error is propagated up to qdev and then to HMP/QMP.
403          */
404         error_setg_errno(errp, EBUSY, "slot is electromechanically locked");
405     }
406 }
407 
408 void pcie_cap_slot_pre_plug_cb(HotplugHandler *hotplug_dev, DeviceState *dev,
409                                Error **errp)
410 {
411     pcie_cap_slot_plug_common(PCI_DEVICE(hotplug_dev), dev, errp);
412 }
413 
414 void pcie_cap_slot_plug_cb(HotplugHandler *hotplug_dev, DeviceState *dev,
415                            Error **errp)
416 {
417     PCIDevice *hotplug_pdev = PCI_DEVICE(hotplug_dev);
418     uint8_t *exp_cap = hotplug_pdev->config + hotplug_pdev->exp.exp_cap;
419     PCIDevice *pci_dev = PCI_DEVICE(dev);
420 
421     /* Don't send event when device is enabled during qemu machine creation:
422      * it is present on boot, no hotplug event is necessary. We do send an
423      * event when the device is disabled later. */
424     if (!dev->hotplugged) {
425         pci_word_test_and_set_mask(exp_cap + PCI_EXP_SLTSTA,
426                                    PCI_EXP_SLTSTA_PDS);
427         if (pci_dev->cap_present & QEMU_PCIE_LNKSTA_DLLLA) {
428             pci_word_test_and_set_mask(exp_cap + PCI_EXP_LNKSTA,
429                                        PCI_EXP_LNKSTA_DLLLA);
430         }
431         return;
432     }
433 
434     /* To enable multifunction hot-plug, we just ensure the function
435      * 0 added last. When function 0 is added, we set the sltsta and
436      * inform OS via event notification.
437      */
438     if (pci_get_function_0(pci_dev)) {
439         pci_word_test_and_set_mask(exp_cap + PCI_EXP_SLTSTA,
440                                    PCI_EXP_SLTSTA_PDS);
441         if (pci_dev->cap_present & QEMU_PCIE_LNKSTA_DLLLA) {
442             pci_word_test_and_set_mask(exp_cap + PCI_EXP_LNKSTA,
443                                        PCI_EXP_LNKSTA_DLLLA);
444         }
445         pcie_cap_slot_event(PCI_DEVICE(hotplug_dev),
446                             PCI_EXP_HP_EV_PDC | PCI_EXP_HP_EV_ABP);
447     }
448 }
449 
450 void pcie_cap_slot_unplug_cb(HotplugHandler *hotplug_dev, DeviceState *dev,
451                              Error **errp)
452 {
453     object_unparent(OBJECT(dev));
454 }
455 
456 static void pcie_unplug_device(PCIBus *bus, PCIDevice *dev, void *opaque)
457 {
458     HotplugHandler *hotplug_ctrl = qdev_get_hotplug_handler(DEVICE(dev));
459 
460     hotplug_handler_unplug(hotplug_ctrl, DEVICE(dev), &error_abort);
461 }
462 
463 void pcie_cap_slot_unplug_request_cb(HotplugHandler *hotplug_dev,
464                                      DeviceState *dev, Error **errp)
465 {
466     Error *local_err = NULL;
467     PCIDevice *pci_dev = PCI_DEVICE(dev);
468     PCIBus *bus = pci_get_bus(pci_dev);
469 
470     pcie_cap_slot_plug_common(PCI_DEVICE(hotplug_dev), dev, &local_err);
471     if (local_err) {
472         error_propagate(errp, local_err);
473         return;
474     }
475 
476     /* In case user cancel the operation of multi-function hot-add,
477      * remove the function that is unexposed to guest individually,
478      * without interaction with guest.
479      */
480     if (pci_dev->devfn &&
481         !bus->devices[0]) {
482         pcie_unplug_device(bus, pci_dev, NULL);
483 
484         return;
485     }
486 
487     pcie_cap_slot_push_attention_button(PCI_DEVICE(hotplug_dev));
488 }
489 
490 /* pci express slot for pci express root/downstream port
491    PCI express capability slot registers */
492 void pcie_cap_slot_init(PCIDevice *dev, uint16_t slot)
493 {
494     uint32_t pos = dev->exp.exp_cap;
495 
496     pci_word_test_and_set_mask(dev->config + pos + PCI_EXP_FLAGS,
497                                PCI_EXP_FLAGS_SLOT);
498 
499     pci_long_test_and_clear_mask(dev->config + pos + PCI_EXP_SLTCAP,
500                                  ~PCI_EXP_SLTCAP_PSN);
501     pci_long_test_and_set_mask(dev->config + pos + PCI_EXP_SLTCAP,
502                                (slot << PCI_EXP_SLTCAP_PSN_SHIFT) |
503                                PCI_EXP_SLTCAP_EIP |
504                                PCI_EXP_SLTCAP_HPS |
505                                PCI_EXP_SLTCAP_HPC |
506                                PCI_EXP_SLTCAP_PIP |
507                                PCI_EXP_SLTCAP_AIP |
508                                PCI_EXP_SLTCAP_ABP);
509 
510     if (dev->cap_present & QEMU_PCIE_SLTCAP_PCP) {
511         pci_long_test_and_set_mask(dev->config + pos + PCI_EXP_SLTCAP,
512                                    PCI_EXP_SLTCAP_PCP);
513         pci_word_test_and_clear_mask(dev->config + pos + PCI_EXP_SLTCTL,
514                                      PCI_EXP_SLTCTL_PCC);
515         pci_word_test_and_set_mask(dev->wmask + pos + PCI_EXP_SLTCTL,
516                                    PCI_EXP_SLTCTL_PCC);
517     }
518 
519     pci_word_test_and_clear_mask(dev->config + pos + PCI_EXP_SLTCTL,
520                                  PCI_EXP_SLTCTL_PIC |
521                                  PCI_EXP_SLTCTL_AIC);
522     pci_word_test_and_set_mask(dev->config + pos + PCI_EXP_SLTCTL,
523                                PCI_EXP_SLTCTL_PIC_OFF |
524                                PCI_EXP_SLTCTL_AIC_OFF);
525     pci_word_test_and_set_mask(dev->wmask + pos + PCI_EXP_SLTCTL,
526                                PCI_EXP_SLTCTL_PIC |
527                                PCI_EXP_SLTCTL_AIC |
528                                PCI_EXP_SLTCTL_HPIE |
529                                PCI_EXP_SLTCTL_CCIE |
530                                PCI_EXP_SLTCTL_PDCE |
531                                PCI_EXP_SLTCTL_ABPE);
532     /* Although reading PCI_EXP_SLTCTL_EIC returns always 0,
533      * make the bit writable here in order to detect 1b is written.
534      * pcie_cap_slot_write_config() test-and-clear the bit, so
535      * this bit always returns 0 to the guest.
536      */
537     pci_word_test_and_set_mask(dev->wmask + pos + PCI_EXP_SLTCTL,
538                                PCI_EXP_SLTCTL_EIC);
539 
540     pci_word_test_and_set_mask(dev->w1cmask + pos + PCI_EXP_SLTSTA,
541                                PCI_EXP_HP_EV_SUPPORTED);
542 
543     dev->exp.hpev_notified = false;
544 
545     qbus_set_hotplug_handler(BUS(pci_bridge_get_sec_bus(PCI_BRIDGE(dev))),
546                              OBJECT(dev), NULL);
547 }
548 
549 void pcie_cap_slot_reset(PCIDevice *dev)
550 {
551     uint8_t *exp_cap = dev->config + dev->exp.exp_cap;
552     uint8_t port_type = pcie_cap_get_type(dev);
553 
554     assert(port_type == PCI_EXP_TYPE_DOWNSTREAM ||
555            port_type == PCI_EXP_TYPE_ROOT_PORT);
556 
557     PCIE_DEV_PRINTF(dev, "reset\n");
558 
559     pci_word_test_and_clear_mask(exp_cap + PCI_EXP_SLTCTL,
560                                  PCI_EXP_SLTCTL_EIC |
561                                  PCI_EXP_SLTCTL_PIC |
562                                  PCI_EXP_SLTCTL_AIC |
563                                  PCI_EXP_SLTCTL_HPIE |
564                                  PCI_EXP_SLTCTL_CCIE |
565                                  PCI_EXP_SLTCTL_PDCE |
566                                  PCI_EXP_SLTCTL_ABPE);
567     pci_word_test_and_set_mask(exp_cap + PCI_EXP_SLTCTL,
568                                PCI_EXP_SLTCTL_AIC_OFF);
569 
570     if (dev->cap_present & QEMU_PCIE_SLTCAP_PCP) {
571         /* Downstream ports enforce device number 0. */
572         bool populated = pci_bridge_get_sec_bus(PCI_BRIDGE(dev))->devices[0];
573         uint16_t pic;
574 
575         if (populated) {
576             pci_word_test_and_clear_mask(exp_cap + PCI_EXP_SLTCTL,
577                                          PCI_EXP_SLTCTL_PCC);
578         } else {
579             pci_word_test_and_set_mask(exp_cap + PCI_EXP_SLTCTL,
580                                        PCI_EXP_SLTCTL_PCC);
581         }
582 
583         pic = populated ? PCI_EXP_SLTCTL_PIC_ON : PCI_EXP_SLTCTL_PIC_OFF;
584         pci_word_test_and_set_mask(exp_cap + PCI_EXP_SLTCTL, pic);
585     }
586 
587     pci_word_test_and_clear_mask(exp_cap + PCI_EXP_SLTSTA,
588                                  PCI_EXP_SLTSTA_EIS |/* on reset,
589                                                         the lock is released */
590                                  PCI_EXP_SLTSTA_CC |
591                                  PCI_EXP_SLTSTA_PDC |
592                                  PCI_EXP_SLTSTA_ABP);
593 
594     hotplug_event_update_event_status(dev);
595 }
596 
597 void pcie_cap_slot_write_config(PCIDevice *dev,
598                                 uint32_t addr, uint32_t val, int len)
599 {
600     uint32_t pos = dev->exp.exp_cap;
601     uint8_t *exp_cap = dev->config + pos;
602     uint16_t sltsta = pci_get_word(exp_cap + PCI_EXP_SLTSTA);
603 
604     if (ranges_overlap(addr, len, pos + PCI_EXP_SLTSTA, 2)) {
605         hotplug_event_clear(dev);
606     }
607 
608     if (!ranges_overlap(addr, len, pos + PCI_EXP_SLTCTL, 2)) {
609         return;
610     }
611 
612     if (pci_word_test_and_clear_mask(exp_cap + PCI_EXP_SLTCTL,
613                                      PCI_EXP_SLTCTL_EIC)) {
614         sltsta ^= PCI_EXP_SLTSTA_EIS; /* toggle PCI_EXP_SLTSTA_EIS bit */
615         pci_set_word(exp_cap + PCI_EXP_SLTSTA, sltsta);
616         PCIE_DEV_PRINTF(dev, "PCI_EXP_SLTCTL_EIC: "
617                         "sltsta -> 0x%02"PRIx16"\n",
618                         sltsta);
619     }
620 
621     /*
622      * If the slot is polulated, power indicator is off and power
623      * controller is off, it is safe to detach the devices.
624      */
625     if ((sltsta & PCI_EXP_SLTSTA_PDS) && (val & PCI_EXP_SLTCTL_PCC) &&
626         ((val & PCI_EXP_SLTCTL_PIC_OFF) == PCI_EXP_SLTCTL_PIC_OFF)) {
627         PCIBus *sec_bus = pci_bridge_get_sec_bus(PCI_BRIDGE(dev));
628         pci_for_each_device(sec_bus, pci_bus_num(sec_bus),
629                             pcie_unplug_device, NULL);
630 
631         pci_word_test_and_clear_mask(exp_cap + PCI_EXP_SLTSTA,
632                                      PCI_EXP_SLTSTA_PDS);
633         if (dev->cap_present & QEMU_PCIE_LNKSTA_DLLLA) {
634             pci_word_test_and_clear_mask(exp_cap + PCI_EXP_LNKSTA,
635                                          PCI_EXP_LNKSTA_DLLLA);
636         }
637         pci_word_test_and_set_mask(exp_cap + PCI_EXP_SLTSTA,
638                                        PCI_EXP_SLTSTA_PDC);
639     }
640 
641     hotplug_event_notify(dev);
642 
643     /*
644      * 6.7.3.2 Command Completed Events
645      *
646      * Software issues a command to a hot-plug capable Downstream Port by
647      * issuing a write transaction that targets any portion of the Port’s Slot
648      * Control register. A single write to the Slot Control register is
649      * considered to be a single command, even if the write affects more than
650      * one field in the Slot Control register. In response to this transaction,
651      * the Port must carry out the requested actions and then set the
652      * associated status field for the command completed event. */
653 
654     /* Real hardware might take a while to complete requested command because
655      * physical movement would be involved like locking the electromechanical
656      * lock.  However in our case, command is completed instantaneously above,
657      * so send a command completion event right now.
658      */
659     pcie_cap_slot_event(dev, PCI_EXP_HP_EV_CCI);
660 }
661 
662 int pcie_cap_slot_post_load(void *opaque, int version_id)
663 {
664     PCIDevice *dev = opaque;
665     hotplug_event_update_event_status(dev);
666     return 0;
667 }
668 
669 void pcie_cap_slot_push_attention_button(PCIDevice *dev)
670 {
671     pcie_cap_slot_event(dev, PCI_EXP_HP_EV_ABP);
672 }
673 
674 /* root control/capabilities/status. PME isn't emulated for now */
675 void pcie_cap_root_init(PCIDevice *dev)
676 {
677     pci_set_word(dev->wmask + dev->exp.exp_cap + PCI_EXP_RTCTL,
678                  PCI_EXP_RTCTL_SECEE | PCI_EXP_RTCTL_SENFEE |
679                  PCI_EXP_RTCTL_SEFEE);
680 }
681 
682 void pcie_cap_root_reset(PCIDevice *dev)
683 {
684     pci_set_word(dev->config + dev->exp.exp_cap + PCI_EXP_RTCTL, 0);
685 }
686 
687 /* function level reset(FLR) */
688 void pcie_cap_flr_init(PCIDevice *dev)
689 {
690     pci_long_test_and_set_mask(dev->config + dev->exp.exp_cap + PCI_EXP_DEVCAP,
691                                PCI_EXP_DEVCAP_FLR);
692 
693     /* Although reading BCR_FLR returns always 0,
694      * the bit is made writable here in order to detect the 1b is written
695      * pcie_cap_flr_write_config() test-and-clear the bit, so
696      * this bit always returns 0 to the guest.
697      */
698     pci_word_test_and_set_mask(dev->wmask + dev->exp.exp_cap + PCI_EXP_DEVCTL,
699                                PCI_EXP_DEVCTL_BCR_FLR);
700 }
701 
702 void pcie_cap_flr_write_config(PCIDevice *dev,
703                                uint32_t addr, uint32_t val, int len)
704 {
705     uint8_t *devctl = dev->config + dev->exp.exp_cap + PCI_EXP_DEVCTL;
706     if (pci_get_word(devctl) & PCI_EXP_DEVCTL_BCR_FLR) {
707         /* Clear PCI_EXP_DEVCTL_BCR_FLR after invoking the reset handler
708            so the handler can detect FLR by looking at this bit. */
709         pci_device_reset(dev);
710         pci_word_test_and_clear_mask(devctl, PCI_EXP_DEVCTL_BCR_FLR);
711     }
712 }
713 
714 /* Alternative Routing-ID Interpretation (ARI)
715  * forwarding support for root and downstream ports
716  */
717 void pcie_cap_arifwd_init(PCIDevice *dev)
718 {
719     uint32_t pos = dev->exp.exp_cap;
720     pci_long_test_and_set_mask(dev->config + pos + PCI_EXP_DEVCAP2,
721                                PCI_EXP_DEVCAP2_ARI);
722     pci_long_test_and_set_mask(dev->wmask + pos + PCI_EXP_DEVCTL2,
723                                PCI_EXP_DEVCTL2_ARI);
724 }
725 
726 void pcie_cap_arifwd_reset(PCIDevice *dev)
727 {
728     uint8_t *devctl2 = dev->config + dev->exp.exp_cap + PCI_EXP_DEVCTL2;
729     pci_long_test_and_clear_mask(devctl2, PCI_EXP_DEVCTL2_ARI);
730 }
731 
732 bool pcie_cap_is_arifwd_enabled(const PCIDevice *dev)
733 {
734     if (!pci_is_express(dev)) {
735         return false;
736     }
737     if (!dev->exp.exp_cap) {
738         return false;
739     }
740 
741     return pci_get_long(dev->config + dev->exp.exp_cap + PCI_EXP_DEVCTL2) &
742         PCI_EXP_DEVCTL2_ARI;
743 }
744 
745 /**************************************************************************
746  * pci express extended capability list management functions
747  * uint16_t ext_cap_id (16 bit)
748  * uint8_t cap_ver (4 bit)
749  * uint16_t cap_offset (12 bit)
750  * uint16_t ext_cap_size
751  */
752 
753 /* Passing a cap_id value > 0xffff will return 0 and put end of list in prev */
754 static uint16_t pcie_find_capability_list(PCIDevice *dev, uint32_t cap_id,
755                                           uint16_t *prev_p)
756 {
757     uint16_t prev = 0;
758     uint16_t next;
759     uint32_t header = pci_get_long(dev->config + PCI_CONFIG_SPACE_SIZE);
760 
761     if (!header) {
762         /* no extended capability */
763         next = 0;
764         goto out;
765     }
766     for (next = PCI_CONFIG_SPACE_SIZE; next;
767          prev = next, next = PCI_EXT_CAP_NEXT(header)) {
768 
769         assert(next >= PCI_CONFIG_SPACE_SIZE);
770         assert(next <= PCIE_CONFIG_SPACE_SIZE - 8);
771 
772         header = pci_get_long(dev->config + next);
773         if (PCI_EXT_CAP_ID(header) == cap_id) {
774             break;
775         }
776     }
777 
778 out:
779     if (prev_p) {
780         *prev_p = prev;
781     }
782     return next;
783 }
784 
785 uint16_t pcie_find_capability(PCIDevice *dev, uint16_t cap_id)
786 {
787     return pcie_find_capability_list(dev, cap_id, NULL);
788 }
789 
790 static void pcie_ext_cap_set_next(PCIDevice *dev, uint16_t pos, uint16_t next)
791 {
792     uint32_t header = pci_get_long(dev->config + pos);
793     assert(!(next & (PCI_EXT_CAP_ALIGN - 1)));
794     header = (header & ~PCI_EXT_CAP_NEXT_MASK) |
795         ((next << PCI_EXT_CAP_NEXT_SHIFT) & PCI_EXT_CAP_NEXT_MASK);
796     pci_set_long(dev->config + pos, header);
797 }
798 
799 /*
800  * Caller must supply valid (offset, size) such that the range wouldn't
801  * overlap with other capability or other registers.
802  * This function doesn't check it.
803  */
804 void pcie_add_capability(PCIDevice *dev,
805                          uint16_t cap_id, uint8_t cap_ver,
806                          uint16_t offset, uint16_t size)
807 {
808     assert(offset >= PCI_CONFIG_SPACE_SIZE);
809     assert(offset < offset + size);
810     assert(offset + size <= PCIE_CONFIG_SPACE_SIZE);
811     assert(size >= 8);
812     assert(pci_is_express(dev));
813 
814     if (offset != PCI_CONFIG_SPACE_SIZE) {
815         uint16_t prev;
816 
817         /*
818          * 0xffffffff is not a valid cap id (it's a 16 bit field). use
819          * internally to find the last capability in the linked list.
820          */
821         pcie_find_capability_list(dev, 0xffffffff, &prev);
822         assert(prev >= PCI_CONFIG_SPACE_SIZE);
823         pcie_ext_cap_set_next(dev, prev, offset);
824     }
825     pci_set_long(dev->config + offset, PCI_EXT_CAP(cap_id, cap_ver, 0));
826 
827     /* Make capability read-only by default */
828     memset(dev->wmask + offset, 0, size);
829     memset(dev->w1cmask + offset, 0, size);
830     /* Check capability by default */
831     memset(dev->cmask + offset, 0xFF, size);
832 }
833 
834 /*
835  * Sync the PCIe Link Status negotiated speed and width of a bridge with the
836  * downstream device.  If downstream device is not present, re-write with the
837  * Link Capability fields.  If downstream device reports invalid width or
838  * speed, replace with minimum values (LnkSta fields are RsvdZ on VFs but such
839  * values interfere with PCIe native hotplug detecting new devices).  Limit
840  * width and speed to bridge capabilities for compatibility.  Use config_read
841  * to access the downstream device since it could be an assigned device with
842  * volatile link information.
843  */
844 void pcie_sync_bridge_lnk(PCIDevice *bridge_dev)
845 {
846     PCIBridge *br = PCI_BRIDGE(bridge_dev);
847     PCIBus *bus = pci_bridge_get_sec_bus(br);
848     PCIDevice *target = bus->devices[0];
849     uint8_t *exp_cap = bridge_dev->config + bridge_dev->exp.exp_cap;
850     uint16_t lnksta, lnkcap = pci_get_word(exp_cap + PCI_EXP_LNKCAP);
851 
852     if (!target || !target->exp.exp_cap) {
853         lnksta = lnkcap;
854     } else {
855         lnksta = target->config_read(target,
856                                      target->exp.exp_cap + PCI_EXP_LNKSTA,
857                                      sizeof(lnksta));
858 
859         if ((lnksta & PCI_EXP_LNKSTA_NLW) > (lnkcap & PCI_EXP_LNKCAP_MLW)) {
860             lnksta &= ~PCI_EXP_LNKSTA_NLW;
861             lnksta |= lnkcap & PCI_EXP_LNKCAP_MLW;
862         } else if (!(lnksta & PCI_EXP_LNKSTA_NLW)) {
863             lnksta |= QEMU_PCI_EXP_LNKSTA_NLW(QEMU_PCI_EXP_LNK_X1);
864         }
865 
866         if ((lnksta & PCI_EXP_LNKSTA_CLS) > (lnkcap & PCI_EXP_LNKCAP_SLS)) {
867             lnksta &= ~PCI_EXP_LNKSTA_CLS;
868             lnksta |= lnkcap & PCI_EXP_LNKCAP_SLS;
869         } else if (!(lnksta & PCI_EXP_LNKSTA_CLS)) {
870             lnksta |= QEMU_PCI_EXP_LNKSTA_CLS(QEMU_PCI_EXP_LNK_2_5GT);
871         }
872     }
873 
874     pci_word_test_and_clear_mask(exp_cap + PCI_EXP_LNKSTA,
875                                  PCI_EXP_LNKSTA_CLS | PCI_EXP_LNKSTA_NLW);
876     pci_word_test_and_set_mask(exp_cap + PCI_EXP_LNKSTA, lnksta &
877                                (PCI_EXP_LNKSTA_CLS | PCI_EXP_LNKSTA_NLW));
878 }
879 
880 /**************************************************************************
881  * pci express extended capability helper functions
882  */
883 
884 /* ARI */
885 void pcie_ari_init(PCIDevice *dev, uint16_t offset, uint16_t nextfn)
886 {
887     pcie_add_capability(dev, PCI_EXT_CAP_ID_ARI, PCI_ARI_VER,
888                         offset, PCI_ARI_SIZEOF);
889     pci_set_long(dev->config + offset + PCI_ARI_CAP, (nextfn & 0xff) << 8);
890 }
891 
892 void pcie_dev_ser_num_init(PCIDevice *dev, uint16_t offset, uint64_t ser_num)
893 {
894     static const int pci_dsn_ver = 1;
895     static const int pci_dsn_cap = 4;
896 
897     pcie_add_capability(dev, PCI_EXT_CAP_ID_DSN, pci_dsn_ver, offset,
898                         PCI_EXT_CAP_DSN_SIZEOF);
899     pci_set_quad(dev->config + offset + pci_dsn_cap, ser_num);
900 }
901 
902 void pcie_ats_init(PCIDevice *dev, uint16_t offset)
903 {
904     pcie_add_capability(dev, PCI_EXT_CAP_ID_ATS, 0x1,
905                         offset, PCI_EXT_CAP_ATS_SIZEOF);
906 
907     dev->exp.ats_cap = offset;
908 
909     /* Invalidate Queue Depth 0, Page Aligned Request 0 */
910     pci_set_word(dev->config + offset + PCI_ATS_CAP, 0);
911     /* STU 0, Disabled by default */
912     pci_set_word(dev->config + offset + PCI_ATS_CTRL, 0);
913 
914     pci_set_word(dev->wmask + dev->exp.ats_cap + PCI_ATS_CTRL, 0x800f);
915 }
916