xref: /openbmc/qemu/hw/pci/pcie.c (revision 7ae71462)
1 /*
2  * pcie.c
3  *
4  * Copyright (c) 2010 Isaku Yamahata <yamahata at valinux co jp>
5  *                    VA Linux Systems Japan K.K.
6  *
7  * This program is free software; you can redistribute it and/or modify
8  * it under the terms of the GNU General Public License as published by
9  * the Free Software Foundation; either version 2 of the License, or
10  * (at your option) any later version.
11  *
12  * This program is distributed in the hope that it will be useful,
13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
15  * GNU General Public License for more details.
16  *
17  * You should have received a copy of the GNU General Public License along
18  * with this program; if not, see <http://www.gnu.org/licenses/>.
19  */
20 
21 #include "qemu/osdep.h"
22 #include "qapi/error.h"
23 #include "hw/pci/pci_bridge.h"
24 #include "hw/pci/pcie.h"
25 #include "hw/pci/msix.h"
26 #include "hw/pci/msi.h"
27 #include "hw/pci/pci_bus.h"
28 #include "hw/pci/pcie_regs.h"
29 #include "hw/pci/pcie_port.h"
30 #include "qemu/range.h"
31 
32 //#define DEBUG_PCIE
33 #ifdef DEBUG_PCIE
34 # define PCIE_DPRINTF(fmt, ...)                                         \
35     fprintf(stderr, "%s:%d " fmt, __func__, __LINE__, ## __VA_ARGS__)
36 #else
37 # define PCIE_DPRINTF(fmt, ...) do {} while (0)
38 #endif
39 #define PCIE_DEV_PRINTF(dev, fmt, ...)                                  \
40     PCIE_DPRINTF("%s:%x "fmt, (dev)->name, (dev)->devfn, ## __VA_ARGS__)
41 
42 
43 /***************************************************************************
44  * pci express capability helper functions
45  */
46 
47 static void
48 pcie_cap_v1_fill(PCIDevice *dev, uint8_t port, uint8_t type, uint8_t version)
49 {
50     uint8_t *exp_cap = dev->config + dev->exp.exp_cap;
51     uint8_t *cmask = dev->cmask + dev->exp.exp_cap;
52 
53     /* capability register
54     interrupt message number defaults to 0 */
55     pci_set_word(exp_cap + PCI_EXP_FLAGS,
56                  ((type << PCI_EXP_FLAGS_TYPE_SHIFT) & PCI_EXP_FLAGS_TYPE) |
57                  version);
58 
59     /* device capability register
60      * table 7-12:
61      * roll based error reporting bit must be set by all
62      * Functions conforming to the ECN, PCI Express Base
63      * Specification, Revision 1.1., or subsequent PCI Express Base
64      * Specification revisions.
65      */
66     pci_set_long(exp_cap + PCI_EXP_DEVCAP, PCI_EXP_DEVCAP_RBER);
67 
68     pci_set_long(exp_cap + PCI_EXP_LNKCAP,
69                  (port << PCI_EXP_LNKCAP_PN_SHIFT) |
70                  PCI_EXP_LNKCAP_ASPMS_0S |
71                  QEMU_PCI_EXP_LNKCAP_MLW(QEMU_PCI_EXP_LNK_X1) |
72                  QEMU_PCI_EXP_LNKCAP_MLS(QEMU_PCI_EXP_LNK_2_5GT));
73 
74     pci_set_word(exp_cap + PCI_EXP_LNKSTA,
75                  QEMU_PCI_EXP_LNKSTA_NLW(QEMU_PCI_EXP_LNK_X1) |
76                  QEMU_PCI_EXP_LNKSTA_CLS(QEMU_PCI_EXP_LNK_2_5GT));
77 
78     /* We changed link status bits over time, and changing them across
79      * migrations is generally fine as hardware changes them too.
80      * Let's not bother checking.
81      */
82     pci_set_word(cmask + PCI_EXP_LNKSTA, 0);
83 }
84 
85 static void pcie_cap_fill_slot_lnk(PCIDevice *dev)
86 {
87     PCIESlot *s = (PCIESlot *)object_dynamic_cast(OBJECT(dev), TYPE_PCIE_SLOT);
88     uint8_t *exp_cap = dev->config + dev->exp.exp_cap;
89 
90     /* Skip anything that isn't a PCIESlot */
91     if (!s) {
92         return;
93     }
94 
95     /* Clear and fill LNKCAP from what was configured above */
96     pci_long_test_and_clear_mask(exp_cap + PCI_EXP_LNKCAP,
97                                  PCI_EXP_LNKCAP_MLW | PCI_EXP_LNKCAP_SLS);
98     pci_long_test_and_set_mask(exp_cap + PCI_EXP_LNKCAP,
99                                QEMU_PCI_EXP_LNKCAP_MLW(s->width) |
100                                QEMU_PCI_EXP_LNKCAP_MLS(s->speed));
101 
102     /*
103      * Link bandwidth notification is required for all root ports and
104      * downstream ports supporting links wider than x1 or multiple link
105      * speeds.
106      */
107     if (s->width > QEMU_PCI_EXP_LNK_X1 ||
108         s->speed > QEMU_PCI_EXP_LNK_2_5GT) {
109         pci_long_test_and_set_mask(exp_cap + PCI_EXP_LNKCAP,
110                                    PCI_EXP_LNKCAP_LBNC);
111     }
112 
113     if (s->speed > QEMU_PCI_EXP_LNK_2_5GT) {
114         /*
115          * Hot-plug capable downstream ports and downstream ports supporting
116          * link speeds greater than 5GT/s must hardwire PCI_EXP_LNKCAP_DLLLARC
117          * to 1b.  PCI_EXP_LNKCAP_DLLLARC implies PCI_EXP_LNKSTA_DLLLA, which
118          * we also hardwire to 1b here.  2.5GT/s hot-plug slots should also
119          * technically implement this, but it's not done here for compatibility.
120          */
121         pci_long_test_and_set_mask(exp_cap + PCI_EXP_LNKCAP,
122                                    PCI_EXP_LNKCAP_DLLLARC);
123         /* the PCI_EXP_LNKSTA_DLLLA will be set in the hotplug function */
124 
125         /*
126          * Target Link Speed defaults to the highest link speed supported by
127          * the component.  2.5GT/s devices are permitted to hardwire to zero.
128          */
129         pci_word_test_and_clear_mask(exp_cap + PCI_EXP_LNKCTL2,
130                                      PCI_EXP_LNKCTL2_TLS);
131         pci_word_test_and_set_mask(exp_cap + PCI_EXP_LNKCTL2,
132                                    QEMU_PCI_EXP_LNKCAP_MLS(s->speed) &
133                                    PCI_EXP_LNKCTL2_TLS);
134     }
135 
136     /*
137      * 2.5 & 5.0GT/s can be fully described by LNKCAP, but 8.0GT/s is
138      * actually a reference to the highest bit supported in this register.
139      * We assume the device supports all link speeds.
140      */
141     if (s->speed > QEMU_PCI_EXP_LNK_5GT) {
142         pci_long_test_and_clear_mask(exp_cap + PCI_EXP_LNKCAP2, ~0U);
143         pci_long_test_and_set_mask(exp_cap + PCI_EXP_LNKCAP2,
144                                    PCI_EXP_LNKCAP2_SLS_2_5GB |
145                                    PCI_EXP_LNKCAP2_SLS_5_0GB |
146                                    PCI_EXP_LNKCAP2_SLS_8_0GB);
147         if (s->speed > QEMU_PCI_EXP_LNK_8GT) {
148             pci_long_test_and_set_mask(exp_cap + PCI_EXP_LNKCAP2,
149                                        PCI_EXP_LNKCAP2_SLS_16_0GB);
150         }
151     }
152 }
153 
154 int pcie_cap_init(PCIDevice *dev, uint8_t offset,
155                   uint8_t type, uint8_t port,
156                   Error **errp)
157 {
158     /* PCIe cap v2 init */
159     int pos;
160     uint8_t *exp_cap;
161 
162     assert(pci_is_express(dev));
163 
164     pos = pci_add_capability(dev, PCI_CAP_ID_EXP, offset,
165                              PCI_EXP_VER2_SIZEOF, errp);
166     if (pos < 0) {
167         return pos;
168     }
169     dev->exp.exp_cap = pos;
170     exp_cap = dev->config + pos;
171 
172     /* Filling values common with v1 */
173     pcie_cap_v1_fill(dev, port, type, PCI_EXP_FLAGS_VER2);
174 
175     /* Fill link speed and width options */
176     pcie_cap_fill_slot_lnk(dev);
177 
178     /* Filling v2 specific values */
179     pci_set_long(exp_cap + PCI_EXP_DEVCAP2,
180                  PCI_EXP_DEVCAP2_EFF | PCI_EXP_DEVCAP2_EETLPP);
181 
182     pci_set_word(dev->wmask + pos + PCI_EXP_DEVCTL2, PCI_EXP_DEVCTL2_EETLPPB);
183 
184     if (dev->cap_present & QEMU_PCIE_EXTCAP_INIT) {
185         /* read-only to behave like a 'NULL' Extended Capability Header */
186         pci_set_long(dev->wmask + PCI_CONFIG_SPACE_SIZE, 0);
187     }
188 
189     return pos;
190 }
191 
192 int pcie_cap_v1_init(PCIDevice *dev, uint8_t offset, uint8_t type,
193                      uint8_t port)
194 {
195     /* PCIe cap v1 init */
196     int pos;
197     Error *local_err = NULL;
198 
199     assert(pci_is_express(dev));
200 
201     pos = pci_add_capability(dev, PCI_CAP_ID_EXP, offset,
202                              PCI_EXP_VER1_SIZEOF, &local_err);
203     if (pos < 0) {
204         error_report_err(local_err);
205         return pos;
206     }
207     dev->exp.exp_cap = pos;
208 
209     pcie_cap_v1_fill(dev, port, type, PCI_EXP_FLAGS_VER1);
210 
211     return pos;
212 }
213 
214 static int
215 pcie_endpoint_cap_common_init(PCIDevice *dev, uint8_t offset, uint8_t cap_size)
216 {
217     uint8_t type = PCI_EXP_TYPE_ENDPOINT;
218     Error *local_err = NULL;
219     int ret;
220 
221     /*
222      * Windows guests will report Code 10, device cannot start, if
223      * a regular Endpoint type is exposed on a root complex.  These
224      * should instead be Root Complex Integrated Endpoints.
225      */
226     if (pci_bus_is_express(pci_get_bus(dev))
227         && pci_bus_is_root(pci_get_bus(dev))) {
228         type = PCI_EXP_TYPE_RC_END;
229     }
230 
231     if (cap_size == PCI_EXP_VER1_SIZEOF) {
232         return pcie_cap_v1_init(dev, offset, type, 0);
233     } else {
234         ret = pcie_cap_init(dev, offset, type, 0, &local_err);
235 
236         if (ret < 0) {
237             error_report_err(local_err);
238         }
239 
240         return ret;
241     }
242 }
243 
244 int pcie_endpoint_cap_init(PCIDevice *dev, uint8_t offset)
245 {
246     return pcie_endpoint_cap_common_init(dev, offset, PCI_EXP_VER2_SIZEOF);
247 }
248 
249 int pcie_endpoint_cap_v1_init(PCIDevice *dev, uint8_t offset)
250 {
251     return pcie_endpoint_cap_common_init(dev, offset, PCI_EXP_VER1_SIZEOF);
252 }
253 
254 void pcie_cap_exit(PCIDevice *dev)
255 {
256     pci_del_capability(dev, PCI_CAP_ID_EXP, PCI_EXP_VER2_SIZEOF);
257 }
258 
259 void pcie_cap_v1_exit(PCIDevice *dev)
260 {
261     pci_del_capability(dev, PCI_CAP_ID_EXP, PCI_EXP_VER1_SIZEOF);
262 }
263 
264 uint8_t pcie_cap_get_type(const PCIDevice *dev)
265 {
266     uint32_t pos = dev->exp.exp_cap;
267     assert(pos > 0);
268     return (pci_get_word(dev->config + pos + PCI_EXP_FLAGS) &
269             PCI_EXP_FLAGS_TYPE) >> PCI_EXP_FLAGS_TYPE_SHIFT;
270 }
271 
272 /* MSI/MSI-X */
273 /* pci express interrupt message number */
274 /* 7.8.2 PCI Express Capabilities Register: Interrupt Message Number */
275 void pcie_cap_flags_set_vector(PCIDevice *dev, uint8_t vector)
276 {
277     uint8_t *exp_cap = dev->config + dev->exp.exp_cap;
278     assert(vector < 32);
279     pci_word_test_and_clear_mask(exp_cap + PCI_EXP_FLAGS, PCI_EXP_FLAGS_IRQ);
280     pci_word_test_and_set_mask(exp_cap + PCI_EXP_FLAGS,
281                                vector << PCI_EXP_FLAGS_IRQ_SHIFT);
282 }
283 
284 uint8_t pcie_cap_flags_get_vector(PCIDevice *dev)
285 {
286     return (pci_get_word(dev->config + dev->exp.exp_cap + PCI_EXP_FLAGS) &
287             PCI_EXP_FLAGS_IRQ) >> PCI_EXP_FLAGS_IRQ_SHIFT;
288 }
289 
290 void pcie_cap_deverr_init(PCIDevice *dev)
291 {
292     uint32_t pos = dev->exp.exp_cap;
293     pci_long_test_and_set_mask(dev->config + pos + PCI_EXP_DEVCAP,
294                                PCI_EXP_DEVCAP_RBER);
295     pci_long_test_and_set_mask(dev->wmask + pos + PCI_EXP_DEVCTL,
296                                PCI_EXP_DEVCTL_CERE | PCI_EXP_DEVCTL_NFERE |
297                                PCI_EXP_DEVCTL_FERE | PCI_EXP_DEVCTL_URRE);
298     pci_long_test_and_set_mask(dev->w1cmask + pos + PCI_EXP_DEVSTA,
299                                PCI_EXP_DEVSTA_CED | PCI_EXP_DEVSTA_NFED |
300                                PCI_EXP_DEVSTA_FED | PCI_EXP_DEVSTA_URD);
301 }
302 
303 void pcie_cap_deverr_reset(PCIDevice *dev)
304 {
305     uint8_t *devctl = dev->config + dev->exp.exp_cap + PCI_EXP_DEVCTL;
306     pci_long_test_and_clear_mask(devctl,
307                                  PCI_EXP_DEVCTL_CERE | PCI_EXP_DEVCTL_NFERE |
308                                  PCI_EXP_DEVCTL_FERE | PCI_EXP_DEVCTL_URRE);
309 }
310 
311 void pcie_cap_lnkctl_init(PCIDevice *dev)
312 {
313     uint32_t pos = dev->exp.exp_cap;
314     pci_long_test_and_set_mask(dev->wmask + pos + PCI_EXP_LNKCTL,
315                                PCI_EXP_LNKCTL_CCC | PCI_EXP_LNKCTL_ES);
316 }
317 
318 void pcie_cap_lnkctl_reset(PCIDevice *dev)
319 {
320     uint8_t *lnkctl = dev->config + dev->exp.exp_cap + PCI_EXP_LNKCTL;
321     pci_long_test_and_clear_mask(lnkctl,
322                                  PCI_EXP_LNKCTL_CCC | PCI_EXP_LNKCTL_ES);
323 }
324 
325 static void hotplug_event_update_event_status(PCIDevice *dev)
326 {
327     uint32_t pos = dev->exp.exp_cap;
328     uint8_t *exp_cap = dev->config + pos;
329     uint16_t sltctl = pci_get_word(exp_cap + PCI_EXP_SLTCTL);
330     uint16_t sltsta = pci_get_word(exp_cap + PCI_EXP_SLTSTA);
331 
332     dev->exp.hpev_notified = (sltctl & PCI_EXP_SLTCTL_HPIE) &&
333         (sltsta & sltctl & PCI_EXP_HP_EV_SUPPORTED);
334 }
335 
336 static void hotplug_event_notify(PCIDevice *dev)
337 {
338     bool prev = dev->exp.hpev_notified;
339 
340     hotplug_event_update_event_status(dev);
341 
342     if (prev == dev->exp.hpev_notified) {
343         return;
344     }
345 
346     /* Note: the logic above does not take into account whether interrupts
347      * are masked. The result is that interrupt will be sent when it is
348      * subsequently unmasked. This appears to be legal: Section 6.7.3.4:
349      * The Port may optionally send an MSI when there are hot-plug events that
350      * occur while interrupt generation is disabled, and interrupt generation is
351      * subsequently enabled. */
352     if (msix_enabled(dev)) {
353         msix_notify(dev, pcie_cap_flags_get_vector(dev));
354     } else if (msi_enabled(dev)) {
355         msi_notify(dev, pcie_cap_flags_get_vector(dev));
356     } else if (pci_intx(dev) != -1) {
357         pci_set_irq(dev, dev->exp.hpev_notified);
358     }
359 }
360 
361 static void hotplug_event_clear(PCIDevice *dev)
362 {
363     hotplug_event_update_event_status(dev);
364     if (!msix_enabled(dev) && !msi_enabled(dev) && pci_intx(dev) != -1 &&
365         !dev->exp.hpev_notified) {
366         pci_irq_deassert(dev);
367     }
368 }
369 
370 void pcie_cap_slot_enable_power(PCIDevice *dev)
371 {
372     uint8_t *exp_cap = dev->config + dev->exp.exp_cap;
373     uint32_t sltcap = pci_get_long(exp_cap + PCI_EXP_SLTCAP);
374 
375     if (sltcap & PCI_EXP_SLTCAP_PCP) {
376         pci_set_word_by_mask(exp_cap + PCI_EXP_SLTCTL,
377                              PCI_EXP_SLTCTL_PCC, PCI_EXP_SLTCTL_PWR_ON);
378     }
379 }
380 
381 static void pcie_set_power_device(PCIBus *bus, PCIDevice *dev, void *opaque)
382 {
383     bool *power = opaque;
384 
385     pci_set_power(dev, *power);
386 }
387 
388 static void pcie_cap_update_power(PCIDevice *hotplug_dev)
389 {
390     uint8_t *exp_cap = hotplug_dev->config + hotplug_dev->exp.exp_cap;
391     PCIBus *sec_bus = pci_bridge_get_sec_bus(PCI_BRIDGE(hotplug_dev));
392     uint32_t sltcap = pci_get_long(exp_cap + PCI_EXP_SLTCAP);
393     uint16_t sltctl = pci_get_word(exp_cap + PCI_EXP_SLTCTL);
394     bool power = true;
395 
396     if (sltcap & PCI_EXP_SLTCAP_PCP) {
397         power = (sltctl & PCI_EXP_SLTCTL_PCC) == PCI_EXP_SLTCTL_PWR_ON;
398     }
399 
400     pci_for_each_device(sec_bus, pci_bus_num(sec_bus),
401                         pcie_set_power_device, &power);
402 }
403 
404 /*
405  * A PCI Express Hot-Plug Event has occurred, so update slot status register
406  * and notify OS of the event if necessary.
407  *
408  * 6.7.3 PCI Express Hot-Plug Events
409  * 6.7.3.4 Software Notification of Hot-Plug Events
410  */
411 static void pcie_cap_slot_event(PCIDevice *dev, PCIExpressHotPlugEvent event)
412 {
413     /* Minor optimization: if nothing changed - no event is needed. */
414     if (pci_word_test_and_set_mask(dev->config + dev->exp.exp_cap +
415                                    PCI_EXP_SLTSTA, event) == event) {
416         return;
417     }
418     hotplug_event_notify(dev);
419 }
420 
421 static void pcie_cap_slot_plug_common(PCIDevice *hotplug_dev, DeviceState *dev,
422                                       Error **errp)
423 {
424     uint8_t *exp_cap = hotplug_dev->config + hotplug_dev->exp.exp_cap;
425     uint16_t sltsta = pci_get_word(exp_cap + PCI_EXP_SLTSTA);
426 
427     PCIE_DEV_PRINTF(PCI_DEVICE(dev), "hotplug state: 0x%x\n", sltsta);
428     if (sltsta & PCI_EXP_SLTSTA_EIS) {
429         /* the slot is electromechanically locked.
430          * This error is propagated up to qdev and then to HMP/QMP.
431          */
432         error_setg_errno(errp, EBUSY, "slot is electromechanically locked");
433     }
434 }
435 
436 void pcie_cap_slot_pre_plug_cb(HotplugHandler *hotplug_dev, DeviceState *dev,
437                                Error **errp)
438 {
439     PCIDevice *hotplug_pdev = PCI_DEVICE(hotplug_dev);
440     uint8_t *exp_cap = hotplug_pdev->config + hotplug_pdev->exp.exp_cap;
441     uint32_t sltcap = pci_get_word(exp_cap + PCI_EXP_SLTCAP);
442 
443     /* Check if hot-plug is disabled on the slot */
444     if (dev->hotplugged && (sltcap & PCI_EXP_SLTCAP_HPC) == 0) {
445         error_setg(errp, "Hot-plug failed: unsupported by the port device '%s'",
446                          DEVICE(hotplug_pdev)->id);
447         return;
448     }
449 
450     pcie_cap_slot_plug_common(PCI_DEVICE(hotplug_dev), dev, errp);
451 }
452 
453 void pcie_cap_slot_plug_cb(HotplugHandler *hotplug_dev, DeviceState *dev,
454                            Error **errp)
455 {
456     PCIDevice *hotplug_pdev = PCI_DEVICE(hotplug_dev);
457     uint8_t *exp_cap = hotplug_pdev->config + hotplug_pdev->exp.exp_cap;
458     PCIDevice *pci_dev = PCI_DEVICE(dev);
459     uint32_t lnkcap = pci_get_long(exp_cap + PCI_EXP_LNKCAP);
460 
461     if (pci_is_vf(pci_dev)) {
462         /* Virtual function cannot be physically disconnected */
463         return;
464     }
465 
466     /* Don't send event when device is enabled during qemu machine creation:
467      * it is present on boot, no hotplug event is necessary. We do send an
468      * event when the device is disabled later. */
469     if (!dev->hotplugged) {
470         pci_word_test_and_set_mask(exp_cap + PCI_EXP_SLTSTA,
471                                    PCI_EXP_SLTSTA_PDS);
472         if (pci_dev->cap_present & QEMU_PCIE_LNKSTA_DLLLA ||
473             (lnkcap & PCI_EXP_LNKCAP_DLLLARC)) {
474             pci_word_test_and_set_mask(exp_cap + PCI_EXP_LNKSTA,
475                                        PCI_EXP_LNKSTA_DLLLA);
476         }
477         pcie_cap_update_power(hotplug_pdev);
478         return;
479     }
480 
481     /* To enable multifunction hot-plug, we just ensure the function
482      * 0 added last. When function 0 is added, we set the sltsta and
483      * inform OS via event notification.
484      */
485     if (pci_get_function_0(pci_dev)) {
486         pci_word_test_and_set_mask(exp_cap + PCI_EXP_SLTSTA,
487                                    PCI_EXP_SLTSTA_PDS);
488         if (pci_dev->cap_present & QEMU_PCIE_LNKSTA_DLLLA ||
489             (lnkcap & PCI_EXP_LNKCAP_DLLLARC)) {
490             pci_word_test_and_set_mask(exp_cap + PCI_EXP_LNKSTA,
491                                        PCI_EXP_LNKSTA_DLLLA);
492         }
493         pcie_cap_slot_event(hotplug_pdev,
494                             PCI_EXP_HP_EV_PDC | PCI_EXP_HP_EV_ABP);
495         pcie_cap_update_power(hotplug_pdev);
496     }
497 }
498 
499 void pcie_cap_slot_unplug_cb(HotplugHandler *hotplug_dev, DeviceState *dev,
500                              Error **errp)
501 {
502     qdev_unrealize(dev);
503 }
504 
505 static void pcie_unplug_device(PCIBus *bus, PCIDevice *dev, void *opaque)
506 {
507     HotplugHandler *hotplug_ctrl = qdev_get_hotplug_handler(DEVICE(dev));
508 
509     if (dev->partially_hotplugged) {
510         dev->qdev.pending_deleted_event = false;
511         return;
512     }
513     hotplug_handler_unplug(hotplug_ctrl, DEVICE(dev), &error_abort);
514     object_unparent(OBJECT(dev));
515 }
516 
517 static void pcie_cap_slot_do_unplug(PCIDevice *dev)
518 {
519     PCIBus *sec_bus = pci_bridge_get_sec_bus(PCI_BRIDGE(dev));
520     uint8_t *exp_cap = dev->config + dev->exp.exp_cap;
521     uint32_t lnkcap = pci_get_long(exp_cap + PCI_EXP_LNKCAP);
522 
523     pci_for_each_device_under_bus(sec_bus, pcie_unplug_device, NULL);
524 
525     pci_word_test_and_clear_mask(exp_cap + PCI_EXP_SLTSTA,
526                                  PCI_EXP_SLTSTA_PDS);
527     if (dev->cap_present & QEMU_PCIE_LNKSTA_DLLLA ||
528         (lnkcap & PCI_EXP_LNKCAP_DLLLARC)) {
529         pci_word_test_and_clear_mask(exp_cap + PCI_EXP_LNKSTA,
530                                      PCI_EXP_LNKSTA_DLLLA);
531     }
532     pci_word_test_and_set_mask(exp_cap + PCI_EXP_SLTSTA,
533                                PCI_EXP_SLTSTA_PDC);
534 }
535 
536 void pcie_cap_slot_unplug_request_cb(HotplugHandler *hotplug_dev,
537                                      DeviceState *dev, Error **errp)
538 {
539     Error *local_err = NULL;
540     PCIDevice *pci_dev = PCI_DEVICE(dev);
541     PCIBus *bus = pci_get_bus(pci_dev);
542     PCIDevice *hotplug_pdev = PCI_DEVICE(hotplug_dev);
543     uint8_t *exp_cap = hotplug_pdev->config + hotplug_pdev->exp.exp_cap;
544     uint32_t sltcap = pci_get_word(exp_cap + PCI_EXP_SLTCAP);
545     uint16_t sltctl = pci_get_word(exp_cap + PCI_EXP_SLTCTL);
546 
547     /* Check if hot-unplug is disabled on the slot */
548     if ((sltcap & PCI_EXP_SLTCAP_HPC) == 0) {
549         error_setg(errp, "Hot-unplug failed: "
550                          "unsupported by the port device '%s'",
551                          DEVICE(hotplug_pdev)->id);
552         return;
553     }
554 
555     pcie_cap_slot_plug_common(hotplug_pdev, dev, &local_err);
556     if (local_err) {
557         error_propagate(errp, local_err);
558         return;
559     }
560 
561     if ((sltctl & PCI_EXP_SLTCTL_PIC) == PCI_EXP_SLTCTL_PWR_IND_BLINK) {
562         error_setg(errp, "Hot-unplug failed: "
563                    "guest is busy (power indicator blinking)");
564         return;
565     }
566 
567     dev->pending_deleted_event = true;
568     dev->pending_deleted_expires_ms =
569         qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) + 5000; /* 5 secs */
570 
571     /* In case user cancel the operation of multi-function hot-add,
572      * remove the function that is unexposed to guest individually,
573      * without interaction with guest.
574      */
575     if (pci_dev->devfn &&
576         !bus->devices[0]) {
577         pcie_unplug_device(bus, pci_dev, NULL);
578 
579         return;
580     }
581 
582     if (((sltctl & PCI_EXP_SLTCTL_PIC) == PCI_EXP_SLTCTL_PWR_IND_OFF) &&
583         ((sltctl & PCI_EXP_SLTCTL_PCC) == PCI_EXP_SLTCTL_PWR_OFF)) {
584         /* slot is powered off -> unplug without round-trip to the guest */
585         pcie_cap_slot_do_unplug(hotplug_pdev);
586         hotplug_event_notify(hotplug_pdev);
587         pci_word_test_and_clear_mask(exp_cap + PCI_EXP_SLTSTA,
588                                      PCI_EXP_SLTSTA_ABP);
589         return;
590     }
591 
592     pcie_cap_slot_push_attention_button(hotplug_pdev);
593 }
594 
595 /* pci express slot for pci express root/downstream port
596    PCI express capability slot registers */
597 void pcie_cap_slot_init(PCIDevice *dev, PCIESlot *s)
598 {
599     uint32_t pos = dev->exp.exp_cap;
600 
601     pci_word_test_and_set_mask(dev->config + pos + PCI_EXP_FLAGS,
602                                PCI_EXP_FLAGS_SLOT);
603 
604     pci_long_test_and_clear_mask(dev->config + pos + PCI_EXP_SLTCAP,
605                                  ~PCI_EXP_SLTCAP_PSN);
606     pci_long_test_and_set_mask(dev->config + pos + PCI_EXP_SLTCAP,
607                                (s->slot << PCI_EXP_SLTCAP_PSN_SHIFT) |
608                                PCI_EXP_SLTCAP_EIP |
609                                PCI_EXP_SLTCAP_PIP |
610                                PCI_EXP_SLTCAP_AIP |
611                                PCI_EXP_SLTCAP_ABP);
612 
613     /*
614      * Expose native hot-plug on all bridges if hot-plug is enabled on the slot.
615      * (unless broken 6.1 ABI is enforced for compat reasons)
616      */
617     if (s->hotplug &&
618         (!s->hide_native_hotplug_cap || DEVICE(dev)->hotplugged)) {
619         pci_long_test_and_set_mask(dev->config + pos + PCI_EXP_SLTCAP,
620                                    PCI_EXP_SLTCAP_HPS |
621                                    PCI_EXP_SLTCAP_HPC);
622     }
623 
624     if (dev->cap_present & QEMU_PCIE_SLTCAP_PCP) {
625         pci_long_test_and_set_mask(dev->config + pos + PCI_EXP_SLTCAP,
626                                    PCI_EXP_SLTCAP_PCP);
627         pci_word_test_and_clear_mask(dev->config + pos + PCI_EXP_SLTCTL,
628                                      PCI_EXP_SLTCTL_PCC);
629         pci_word_test_and_set_mask(dev->wmask + pos + PCI_EXP_SLTCTL,
630                                    PCI_EXP_SLTCTL_PCC);
631     }
632 
633     pci_word_test_and_clear_mask(dev->config + pos + PCI_EXP_SLTCTL,
634                                  PCI_EXP_SLTCTL_PIC |
635                                  PCI_EXP_SLTCTL_AIC);
636     pci_word_test_and_set_mask(dev->config + pos + PCI_EXP_SLTCTL,
637                                PCI_EXP_SLTCTL_PIC_OFF |
638                                PCI_EXP_SLTCTL_AIC_OFF);
639     pci_word_test_and_set_mask(dev->wmask + pos + PCI_EXP_SLTCTL,
640                                PCI_EXP_SLTCTL_PIC |
641                                PCI_EXP_SLTCTL_AIC |
642                                PCI_EXP_SLTCTL_HPIE |
643                                PCI_EXP_SLTCTL_CCIE |
644                                PCI_EXP_SLTCTL_PDCE |
645                                PCI_EXP_SLTCTL_ABPE);
646     /* Although reading PCI_EXP_SLTCTL_EIC returns always 0,
647      * make the bit writable here in order to detect 1b is written.
648      * pcie_cap_slot_write_config() test-and-clear the bit, so
649      * this bit always returns 0 to the guest.
650      */
651     pci_word_test_and_set_mask(dev->wmask + pos + PCI_EXP_SLTCTL,
652                                PCI_EXP_SLTCTL_EIC);
653 
654     pci_word_test_and_set_mask(dev->w1cmask + pos + PCI_EXP_SLTSTA,
655                                PCI_EXP_HP_EV_SUPPORTED);
656 
657     dev->exp.hpev_notified = false;
658 
659     qbus_set_hotplug_handler(BUS(pci_bridge_get_sec_bus(PCI_BRIDGE(dev))),
660                              OBJECT(dev));
661 }
662 
663 void pcie_cap_slot_reset(PCIDevice *dev)
664 {
665     uint8_t *exp_cap = dev->config + dev->exp.exp_cap;
666     uint8_t port_type = pcie_cap_get_type(dev);
667 
668     assert(port_type == PCI_EXP_TYPE_DOWNSTREAM ||
669            port_type == PCI_EXP_TYPE_ROOT_PORT);
670 
671     PCIE_DEV_PRINTF(dev, "reset\n");
672 
673     pci_word_test_and_clear_mask(exp_cap + PCI_EXP_SLTCTL,
674                                  PCI_EXP_SLTCTL_EIC |
675                                  PCI_EXP_SLTCTL_PIC |
676                                  PCI_EXP_SLTCTL_AIC |
677                                  PCI_EXP_SLTCTL_HPIE |
678                                  PCI_EXP_SLTCTL_CCIE |
679                                  PCI_EXP_SLTCTL_PDCE |
680                                  PCI_EXP_SLTCTL_ABPE);
681     pci_word_test_and_set_mask(exp_cap + PCI_EXP_SLTCTL,
682                                PCI_EXP_SLTCTL_AIC_OFF);
683 
684     if (dev->cap_present & QEMU_PCIE_SLTCAP_PCP) {
685         /* Downstream ports enforce device number 0. */
686         bool populated = pci_bridge_get_sec_bus(PCI_BRIDGE(dev))->devices[0];
687         uint16_t pic;
688 
689         if (populated) {
690             pci_word_test_and_clear_mask(exp_cap + PCI_EXP_SLTCTL,
691                                          PCI_EXP_SLTCTL_PCC);
692         } else {
693             pci_word_test_and_set_mask(exp_cap + PCI_EXP_SLTCTL,
694                                        PCI_EXP_SLTCTL_PCC);
695         }
696 
697         pic = populated ? PCI_EXP_SLTCTL_PIC_ON : PCI_EXP_SLTCTL_PIC_OFF;
698         pci_word_test_and_set_mask(exp_cap + PCI_EXP_SLTCTL, pic);
699     }
700 
701     pci_word_test_and_clear_mask(exp_cap + PCI_EXP_SLTSTA,
702                                  PCI_EXP_SLTSTA_EIS |/* on reset,
703                                                         the lock is released */
704                                  PCI_EXP_SLTSTA_CC |
705                                  PCI_EXP_SLTSTA_PDC |
706                                  PCI_EXP_SLTSTA_ABP);
707 
708     pcie_cap_update_power(dev);
709     hotplug_event_update_event_status(dev);
710 }
711 
712 void pcie_cap_slot_get(PCIDevice *dev, uint16_t *slt_ctl, uint16_t *slt_sta)
713 {
714     uint32_t pos = dev->exp.exp_cap;
715     uint8_t *exp_cap = dev->config + pos;
716     *slt_ctl = pci_get_word(exp_cap + PCI_EXP_SLTCTL);
717     *slt_sta = pci_get_word(exp_cap + PCI_EXP_SLTSTA);
718 }
719 
720 void pcie_cap_slot_write_config(PCIDevice *dev,
721                                 uint16_t old_slt_ctl, uint16_t old_slt_sta,
722                                 uint32_t addr, uint32_t val, int len)
723 {
724     uint32_t pos = dev->exp.exp_cap;
725     uint8_t *exp_cap = dev->config + pos;
726     uint16_t sltsta = pci_get_word(exp_cap + PCI_EXP_SLTSTA);
727 
728     if (ranges_overlap(addr, len, pos + PCI_EXP_SLTSTA, 2)) {
729         /*
730          * Guests tend to clears all bits during init.
731          * If they clear bits that weren't set this is racy and will lose events:
732          * not a big problem for manual button presses, but a problem for us.
733          * As a work-around, detect this and revert status to what it was
734          * before the write.
735          *
736          * Note: in theory this can be detected as a duplicate button press
737          * which cancels the previous press. Does not seem to happen in
738          * practice as guests seem to only have this bug during init.
739          */
740 #define PCIE_SLOT_EVENTS (PCI_EXP_SLTSTA_ABP | PCI_EXP_SLTSTA_PFD | \
741                           PCI_EXP_SLTSTA_MRLSC | PCI_EXP_SLTSTA_PDC | \
742                           PCI_EXP_SLTSTA_CC)
743 
744         if (val & ~old_slt_sta & PCIE_SLOT_EVENTS) {
745             sltsta = (sltsta & ~PCIE_SLOT_EVENTS) | (old_slt_sta & PCIE_SLOT_EVENTS);
746             pci_set_word(exp_cap + PCI_EXP_SLTSTA, sltsta);
747         }
748         hotplug_event_clear(dev);
749     }
750 
751     if (!ranges_overlap(addr, len, pos + PCI_EXP_SLTCTL, 2)) {
752         return;
753     }
754 
755     if (pci_word_test_and_clear_mask(exp_cap + PCI_EXP_SLTCTL,
756                                      PCI_EXP_SLTCTL_EIC)) {
757         sltsta ^= PCI_EXP_SLTSTA_EIS; /* toggle PCI_EXP_SLTSTA_EIS bit */
758         pci_set_word(exp_cap + PCI_EXP_SLTSTA, sltsta);
759         PCIE_DEV_PRINTF(dev, "PCI_EXP_SLTCTL_EIC: "
760                         "sltsta -> 0x%02"PRIx16"\n",
761                         sltsta);
762     }
763 
764     /*
765      * If the slot is populated, power indicator is off and power
766      * controller is off, it is safe to detach the devices.
767      *
768      * Note: don't detach if condition was already true:
769      * this is a work around for guests that overwrite
770      * control of powered off slots before powering them on.
771      */
772     if ((sltsta & PCI_EXP_SLTSTA_PDS) && (val & PCI_EXP_SLTCTL_PCC) &&
773         (val & PCI_EXP_SLTCTL_PIC_OFF) == PCI_EXP_SLTCTL_PIC_OFF &&
774         (!(old_slt_ctl & PCI_EXP_SLTCTL_PCC) ||
775         (old_slt_ctl & PCI_EXP_SLTCTL_PIC_OFF) != PCI_EXP_SLTCTL_PIC_OFF)) {
776         pcie_cap_slot_do_unplug(dev);
777     }
778     pcie_cap_update_power(dev);
779 
780     hotplug_event_notify(dev);
781 
782     /*
783      * 6.7.3.2 Command Completed Events
784      *
785      * Software issues a command to a hot-plug capable Downstream Port by
786      * issuing a write transaction that targets any portion of the Port’s Slot
787      * Control register. A single write to the Slot Control register is
788      * considered to be a single command, even if the write affects more than
789      * one field in the Slot Control register. In response to this transaction,
790      * the Port must carry out the requested actions and then set the
791      * associated status field for the command completed event. */
792 
793     /* Real hardware might take a while to complete requested command because
794      * physical movement would be involved like locking the electromechanical
795      * lock.  However in our case, command is completed instantaneously above,
796      * so send a command completion event right now.
797      */
798     pcie_cap_slot_event(dev, PCI_EXP_HP_EV_CCI);
799 }
800 
801 int pcie_cap_slot_post_load(void *opaque, int version_id)
802 {
803     PCIDevice *dev = opaque;
804     hotplug_event_update_event_status(dev);
805     pcie_cap_update_power(dev);
806     return 0;
807 }
808 
809 void pcie_cap_slot_push_attention_button(PCIDevice *dev)
810 {
811     pcie_cap_slot_event(dev, PCI_EXP_HP_EV_ABP);
812 }
813 
814 /* root control/capabilities/status. PME isn't emulated for now */
815 void pcie_cap_root_init(PCIDevice *dev)
816 {
817     pci_set_word(dev->wmask + dev->exp.exp_cap + PCI_EXP_RTCTL,
818                  PCI_EXP_RTCTL_SECEE | PCI_EXP_RTCTL_SENFEE |
819                  PCI_EXP_RTCTL_SEFEE);
820 }
821 
822 void pcie_cap_root_reset(PCIDevice *dev)
823 {
824     pci_set_word(dev->config + dev->exp.exp_cap + PCI_EXP_RTCTL, 0);
825 }
826 
827 /* function level reset(FLR) */
828 void pcie_cap_flr_init(PCIDevice *dev)
829 {
830     pci_long_test_and_set_mask(dev->config + dev->exp.exp_cap + PCI_EXP_DEVCAP,
831                                PCI_EXP_DEVCAP_FLR);
832 
833     /* Although reading BCR_FLR returns always 0,
834      * the bit is made writable here in order to detect the 1b is written
835      * pcie_cap_flr_write_config() test-and-clear the bit, so
836      * this bit always returns 0 to the guest.
837      */
838     pci_word_test_and_set_mask(dev->wmask + dev->exp.exp_cap + PCI_EXP_DEVCTL,
839                                PCI_EXP_DEVCTL_BCR_FLR);
840 }
841 
842 void pcie_cap_flr_write_config(PCIDevice *dev,
843                                uint32_t addr, uint32_t val, int len)
844 {
845     uint8_t *devctl = dev->config + dev->exp.exp_cap + PCI_EXP_DEVCTL;
846     if (pci_get_word(devctl) & PCI_EXP_DEVCTL_BCR_FLR) {
847         /* Clear PCI_EXP_DEVCTL_BCR_FLR after invoking the reset handler
848            so the handler can detect FLR by looking at this bit. */
849         pci_device_reset(dev);
850         pci_word_test_and_clear_mask(devctl, PCI_EXP_DEVCTL_BCR_FLR);
851     }
852 }
853 
854 /* Alternative Routing-ID Interpretation (ARI)
855  * forwarding support for root and downstream ports
856  */
857 void pcie_cap_arifwd_init(PCIDevice *dev)
858 {
859     uint32_t pos = dev->exp.exp_cap;
860     pci_long_test_and_set_mask(dev->config + pos + PCI_EXP_DEVCAP2,
861                                PCI_EXP_DEVCAP2_ARI);
862     pci_long_test_and_set_mask(dev->wmask + pos + PCI_EXP_DEVCTL2,
863                                PCI_EXP_DEVCTL2_ARI);
864 }
865 
866 void pcie_cap_arifwd_reset(PCIDevice *dev)
867 {
868     uint8_t *devctl2 = dev->config + dev->exp.exp_cap + PCI_EXP_DEVCTL2;
869     pci_long_test_and_clear_mask(devctl2, PCI_EXP_DEVCTL2_ARI);
870 }
871 
872 bool pcie_cap_is_arifwd_enabled(const PCIDevice *dev)
873 {
874     if (!pci_is_express(dev)) {
875         return false;
876     }
877     if (!dev->exp.exp_cap) {
878         return false;
879     }
880 
881     return pci_get_long(dev->config + dev->exp.exp_cap + PCI_EXP_DEVCTL2) &
882         PCI_EXP_DEVCTL2_ARI;
883 }
884 
885 /**************************************************************************
886  * pci express extended capability list management functions
887  * uint16_t ext_cap_id (16 bit)
888  * uint8_t cap_ver (4 bit)
889  * uint16_t cap_offset (12 bit)
890  * uint16_t ext_cap_size
891  */
892 
893 /* Passing a cap_id value > 0xffff will return 0 and put end of list in prev */
894 static uint16_t pcie_find_capability_list(PCIDevice *dev, uint32_t cap_id,
895                                           uint16_t *prev_p)
896 {
897     uint16_t prev = 0;
898     uint16_t next;
899     uint32_t header = pci_get_long(dev->config + PCI_CONFIG_SPACE_SIZE);
900 
901     if (!header) {
902         /* no extended capability */
903         next = 0;
904         goto out;
905     }
906     for (next = PCI_CONFIG_SPACE_SIZE; next;
907          prev = next, next = PCI_EXT_CAP_NEXT(header)) {
908 
909         assert(next >= PCI_CONFIG_SPACE_SIZE);
910         assert(next <= PCIE_CONFIG_SPACE_SIZE - 8);
911 
912         header = pci_get_long(dev->config + next);
913         if (PCI_EXT_CAP_ID(header) == cap_id) {
914             break;
915         }
916     }
917 
918 out:
919     if (prev_p) {
920         *prev_p = prev;
921     }
922     return next;
923 }
924 
925 uint16_t pcie_find_capability(PCIDevice *dev, uint16_t cap_id)
926 {
927     return pcie_find_capability_list(dev, cap_id, NULL);
928 }
929 
930 static void pcie_ext_cap_set_next(PCIDevice *dev, uint16_t pos, uint16_t next)
931 {
932     uint32_t header = pci_get_long(dev->config + pos);
933     assert(!(next & (PCI_EXT_CAP_ALIGN - 1)));
934     header = (header & ~PCI_EXT_CAP_NEXT_MASK) |
935         ((next << PCI_EXT_CAP_NEXT_SHIFT) & PCI_EXT_CAP_NEXT_MASK);
936     pci_set_long(dev->config + pos, header);
937 }
938 
939 /*
940  * Caller must supply valid (offset, size) such that the range wouldn't
941  * overlap with other capability or other registers.
942  * This function doesn't check it.
943  */
944 void pcie_add_capability(PCIDevice *dev,
945                          uint16_t cap_id, uint8_t cap_ver,
946                          uint16_t offset, uint16_t size)
947 {
948     assert(offset >= PCI_CONFIG_SPACE_SIZE);
949     assert(offset < (uint16_t)(offset + size));
950     assert((uint16_t)(offset + size) <= PCIE_CONFIG_SPACE_SIZE);
951     assert(size >= 8);
952     assert(pci_is_express(dev));
953 
954     if (offset != PCI_CONFIG_SPACE_SIZE) {
955         uint16_t prev;
956 
957         /*
958          * 0xffffffff is not a valid cap id (it's a 16 bit field). use
959          * internally to find the last capability in the linked list.
960          */
961         pcie_find_capability_list(dev, 0xffffffff, &prev);
962         assert(prev >= PCI_CONFIG_SPACE_SIZE);
963         pcie_ext_cap_set_next(dev, prev, offset);
964     }
965     pci_set_long(dev->config + offset, PCI_EXT_CAP(cap_id, cap_ver, 0));
966 
967     /* Make capability read-only by default */
968     memset(dev->wmask + offset, 0, size);
969     memset(dev->w1cmask + offset, 0, size);
970     /* Check capability by default */
971     memset(dev->cmask + offset, 0xFF, size);
972 }
973 
974 /*
975  * Sync the PCIe Link Status negotiated speed and width of a bridge with the
976  * downstream device.  If downstream device is not present, re-write with the
977  * Link Capability fields.  If downstream device reports invalid width or
978  * speed, replace with minimum values (LnkSta fields are RsvdZ on VFs but such
979  * values interfere with PCIe native hotplug detecting new devices).  Limit
980  * width and speed to bridge capabilities for compatibility.  Use config_read
981  * to access the downstream device since it could be an assigned device with
982  * volatile link information.
983  */
984 void pcie_sync_bridge_lnk(PCIDevice *bridge_dev)
985 {
986     PCIBridge *br = PCI_BRIDGE(bridge_dev);
987     PCIBus *bus = pci_bridge_get_sec_bus(br);
988     PCIDevice *target = bus->devices[0];
989     uint8_t *exp_cap = bridge_dev->config + bridge_dev->exp.exp_cap;
990     uint16_t lnksta, lnkcap = pci_get_word(exp_cap + PCI_EXP_LNKCAP);
991 
992     if (!target || !target->exp.exp_cap) {
993         lnksta = lnkcap;
994     } else {
995         lnksta = target->config_read(target,
996                                      target->exp.exp_cap + PCI_EXP_LNKSTA,
997                                      sizeof(lnksta));
998 
999         if ((lnksta & PCI_EXP_LNKSTA_NLW) > (lnkcap & PCI_EXP_LNKCAP_MLW)) {
1000             lnksta &= ~PCI_EXP_LNKSTA_NLW;
1001             lnksta |= lnkcap & PCI_EXP_LNKCAP_MLW;
1002         } else if (!(lnksta & PCI_EXP_LNKSTA_NLW)) {
1003             lnksta |= QEMU_PCI_EXP_LNKSTA_NLW(QEMU_PCI_EXP_LNK_X1);
1004         }
1005 
1006         if ((lnksta & PCI_EXP_LNKSTA_CLS) > (lnkcap & PCI_EXP_LNKCAP_SLS)) {
1007             lnksta &= ~PCI_EXP_LNKSTA_CLS;
1008             lnksta |= lnkcap & PCI_EXP_LNKCAP_SLS;
1009         } else if (!(lnksta & PCI_EXP_LNKSTA_CLS)) {
1010             lnksta |= QEMU_PCI_EXP_LNKSTA_CLS(QEMU_PCI_EXP_LNK_2_5GT);
1011         }
1012     }
1013 
1014     pci_word_test_and_clear_mask(exp_cap + PCI_EXP_LNKSTA,
1015                                  PCI_EXP_LNKSTA_CLS | PCI_EXP_LNKSTA_NLW);
1016     pci_word_test_and_set_mask(exp_cap + PCI_EXP_LNKSTA, lnksta &
1017                                (PCI_EXP_LNKSTA_CLS | PCI_EXP_LNKSTA_NLW));
1018 }
1019 
1020 /**************************************************************************
1021  * pci express extended capability helper functions
1022  */
1023 
1024 /* ARI */
1025 void pcie_ari_init(PCIDevice *dev, uint16_t offset, uint16_t nextfn)
1026 {
1027     pcie_add_capability(dev, PCI_EXT_CAP_ID_ARI, PCI_ARI_VER,
1028                         offset, PCI_ARI_SIZEOF);
1029     pci_set_long(dev->config + offset + PCI_ARI_CAP, (nextfn & 0xff) << 8);
1030 }
1031 
1032 void pcie_dev_ser_num_init(PCIDevice *dev, uint16_t offset, uint64_t ser_num)
1033 {
1034     static const int pci_dsn_ver = 1;
1035     static const int pci_dsn_cap = 4;
1036 
1037     pcie_add_capability(dev, PCI_EXT_CAP_ID_DSN, pci_dsn_ver, offset,
1038                         PCI_EXT_CAP_DSN_SIZEOF);
1039     pci_set_quad(dev->config + offset + pci_dsn_cap, ser_num);
1040 }
1041 
1042 void pcie_ats_init(PCIDevice *dev, uint16_t offset, bool aligned)
1043 {
1044     pcie_add_capability(dev, PCI_EXT_CAP_ID_ATS, 0x1,
1045                         offset, PCI_EXT_CAP_ATS_SIZEOF);
1046 
1047     dev->exp.ats_cap = offset;
1048 
1049     /* Invalidate Queue Depth 0 */
1050     if (aligned) {
1051         pci_set_word(dev->config + offset + PCI_ATS_CAP,
1052                      PCI_ATS_CAP_PAGE_ALIGNED);
1053     }
1054     /* STU 0, Disabled by default */
1055     pci_set_word(dev->config + offset + PCI_ATS_CTRL, 0);
1056 
1057     pci_set_word(dev->wmask + dev->exp.ats_cap + PCI_ATS_CTRL, 0x800f);
1058 }
1059 
1060 /* ACS (Access Control Services) */
1061 void pcie_acs_init(PCIDevice *dev, uint16_t offset)
1062 {
1063     bool is_downstream = pci_is_express_downstream_port(dev);
1064     uint16_t cap_bits = 0;
1065 
1066     /* For endpoints, only multifunction devs may have an ACS capability: */
1067     assert(is_downstream ||
1068            (dev->cap_present & QEMU_PCI_CAP_MULTIFUNCTION) ||
1069            PCI_FUNC(dev->devfn));
1070 
1071     pcie_add_capability(dev, PCI_EXT_CAP_ID_ACS, PCI_ACS_VER, offset,
1072                         PCI_ACS_SIZEOF);
1073     dev->exp.acs_cap = offset;
1074 
1075     if (is_downstream) {
1076         /*
1077          * Downstream ports must implement SV, TB, RR, CR, UF, and DT (with
1078          * caveats on the latter four that we ignore for simplicity).
1079          * Endpoints may also implement a subset of ACS capabilities,
1080          * but these are optional if the endpoint does not support
1081          * peer-to-peer between functions and thus omitted here.
1082          */
1083         cap_bits = PCI_ACS_SV | PCI_ACS_TB | PCI_ACS_RR |
1084             PCI_ACS_CR | PCI_ACS_UF | PCI_ACS_DT;
1085     }
1086 
1087     pci_set_word(dev->config + offset + PCI_ACS_CAP, cap_bits);
1088     pci_set_word(dev->wmask + offset + PCI_ACS_CTRL, cap_bits);
1089 }
1090 
1091 void pcie_acs_reset(PCIDevice *dev)
1092 {
1093     if (dev->exp.acs_cap) {
1094         pci_set_word(dev->config + dev->exp.acs_cap + PCI_ACS_CTRL, 0);
1095     }
1096 }
1097