xref: /openbmc/qemu/hw/pci/pcie.c (revision e3ae2bbf)
1 /*
2  * pcie.c
3  *
4  * Copyright (c) 2010 Isaku Yamahata <yamahata at valinux co jp>
5  *                    VA Linux Systems Japan K.K.
6  *
7  * This program is free software; you can redistribute it and/or modify
8  * it under the terms of the GNU General Public License as published by
9  * the Free Software Foundation; either version 2 of the License, or
10  * (at your option) any later version.
11  *
12  * This program is distributed in the hope that it will be useful,
13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
15  * GNU General Public License for more details.
16  *
17  * You should have received a copy of the GNU General Public License along
18  * with this program; if not, see <http://www.gnu.org/licenses/>.
19  */
20 
21 #include "qemu/osdep.h"
22 #include "qapi/error.h"
23 #include "hw/pci/pci_bridge.h"
24 #include "hw/pci/pcie.h"
25 #include "hw/pci/msix.h"
26 #include "hw/pci/msi.h"
27 #include "hw/pci/pci_bus.h"
28 #include "hw/pci/pcie_regs.h"
29 #include "hw/pci/pcie_port.h"
30 #include "qemu/range.h"
31 
32 //#define DEBUG_PCIE
33 #ifdef DEBUG_PCIE
34 # define PCIE_DPRINTF(fmt, ...)                                         \
35     fprintf(stderr, "%s:%d " fmt, __func__, __LINE__, ## __VA_ARGS__)
36 #else
37 # define PCIE_DPRINTF(fmt, ...) do {} while (0)
38 #endif
39 #define PCIE_DEV_PRINTF(dev, fmt, ...)                                  \
40     PCIE_DPRINTF("%s:%x "fmt, (dev)->name, (dev)->devfn, ## __VA_ARGS__)
41 
42 
43 /***************************************************************************
44  * pci express capability helper functions
45  */
46 
47 static void
48 pcie_cap_v1_fill(PCIDevice *dev, uint8_t port, uint8_t type, uint8_t version)
49 {
50     uint8_t *exp_cap = dev->config + dev->exp.exp_cap;
51     uint8_t *cmask = dev->cmask + dev->exp.exp_cap;
52 
53     /* capability register
54     interrupt message number defaults to 0 */
55     pci_set_word(exp_cap + PCI_EXP_FLAGS,
56                  ((type << PCI_EXP_FLAGS_TYPE_SHIFT) & PCI_EXP_FLAGS_TYPE) |
57                  version);
58 
59     /* device capability register
60      * table 7-12:
61      * roll based error reporting bit must be set by all
62      * Functions conforming to the ECN, PCI Express Base
63      * Specification, Revision 1.1., or subsequent PCI Express Base
64      * Specification revisions.
65      */
66     pci_set_long(exp_cap + PCI_EXP_DEVCAP, PCI_EXP_DEVCAP_RBER);
67 
68     pci_set_long(exp_cap + PCI_EXP_LNKCAP,
69                  (port << PCI_EXP_LNKCAP_PN_SHIFT) |
70                  PCI_EXP_LNKCAP_ASPMS_0S |
71                  QEMU_PCI_EXP_LNKCAP_MLW(QEMU_PCI_EXP_LNK_X1) |
72                  QEMU_PCI_EXP_LNKCAP_MLS(QEMU_PCI_EXP_LNK_2_5GT));
73 
74     pci_set_word(exp_cap + PCI_EXP_LNKSTA,
75                  QEMU_PCI_EXP_LNKSTA_NLW(QEMU_PCI_EXP_LNK_X1) |
76                  QEMU_PCI_EXP_LNKSTA_CLS(QEMU_PCI_EXP_LNK_2_5GT));
77 
78     /* We changed link status bits over time, and changing them across
79      * migrations is generally fine as hardware changes them too.
80      * Let's not bother checking.
81      */
82     pci_set_word(cmask + PCI_EXP_LNKSTA, 0);
83 }
84 
85 static void pcie_cap_fill_slot_lnk(PCIDevice *dev)
86 {
87     PCIESlot *s = (PCIESlot *)object_dynamic_cast(OBJECT(dev), TYPE_PCIE_SLOT);
88     uint8_t *exp_cap = dev->config + dev->exp.exp_cap;
89 
90     /* Skip anything that isn't a PCIESlot */
91     if (!s) {
92         return;
93     }
94 
95     /* Clear and fill LNKCAP from what was configured above */
96     pci_long_test_and_clear_mask(exp_cap + PCI_EXP_LNKCAP,
97                                  PCI_EXP_LNKCAP_MLW | PCI_EXP_LNKCAP_SLS);
98     pci_long_test_and_set_mask(exp_cap + PCI_EXP_LNKCAP,
99                                QEMU_PCI_EXP_LNKCAP_MLW(s->width) |
100                                QEMU_PCI_EXP_LNKCAP_MLS(s->speed));
101 
102     /*
103      * Link bandwidth notification is required for all root ports and
104      * downstream ports supporting links wider than x1 or multiple link
105      * speeds.
106      */
107     if (s->width > QEMU_PCI_EXP_LNK_X1 ||
108         s->speed > QEMU_PCI_EXP_LNK_2_5GT) {
109         pci_long_test_and_set_mask(exp_cap + PCI_EXP_LNKCAP,
110                                    PCI_EXP_LNKCAP_LBNC);
111     }
112 
113     if (s->speed > QEMU_PCI_EXP_LNK_2_5GT) {
114         /*
115          * Hot-plug capable downstream ports and downstream ports supporting
116          * link speeds greater than 5GT/s must hardwire PCI_EXP_LNKCAP_DLLLARC
117          * to 1b.  PCI_EXP_LNKCAP_DLLLARC implies PCI_EXP_LNKSTA_DLLLA, which
118          * we also hardwire to 1b here.  2.5GT/s hot-plug slots should also
119          * technically implement this, but it's not done here for compatibility.
120          */
121         pci_long_test_and_set_mask(exp_cap + PCI_EXP_LNKCAP,
122                                    PCI_EXP_LNKCAP_DLLLARC);
123         /* the PCI_EXP_LNKSTA_DLLLA will be set in the hotplug function */
124 
125         /*
126          * Target Link Speed defaults to the highest link speed supported by
127          * the component.  2.5GT/s devices are permitted to hardwire to zero.
128          */
129         pci_word_test_and_clear_mask(exp_cap + PCI_EXP_LNKCTL2,
130                                      PCI_EXP_LNKCTL2_TLS);
131         pci_word_test_and_set_mask(exp_cap + PCI_EXP_LNKCTL2,
132                                    QEMU_PCI_EXP_LNKCAP_MLS(s->speed) &
133                                    PCI_EXP_LNKCTL2_TLS);
134     }
135 
136     /*
137      * 2.5 & 5.0GT/s can be fully described by LNKCAP, but 8.0GT/s is
138      * actually a reference to the highest bit supported in this register.
139      * We assume the device supports all link speeds.
140      */
141     if (s->speed > QEMU_PCI_EXP_LNK_5GT) {
142         pci_long_test_and_clear_mask(exp_cap + PCI_EXP_LNKCAP2, ~0U);
143         pci_long_test_and_set_mask(exp_cap + PCI_EXP_LNKCAP2,
144                                    PCI_EXP_LNKCAP2_SLS_2_5GB |
145                                    PCI_EXP_LNKCAP2_SLS_5_0GB |
146                                    PCI_EXP_LNKCAP2_SLS_8_0GB);
147         if (s->speed > QEMU_PCI_EXP_LNK_8GT) {
148             pci_long_test_and_set_mask(exp_cap + PCI_EXP_LNKCAP2,
149                                        PCI_EXP_LNKCAP2_SLS_16_0GB);
150         }
151     }
152 }
153 
154 int pcie_cap_init(PCIDevice *dev, uint8_t offset,
155                   uint8_t type, uint8_t port,
156                   Error **errp)
157 {
158     /* PCIe cap v2 init */
159     int pos;
160     uint8_t *exp_cap;
161 
162     assert(pci_is_express(dev));
163 
164     pos = pci_add_capability(dev, PCI_CAP_ID_EXP, offset,
165                              PCI_EXP_VER2_SIZEOF, errp);
166     if (pos < 0) {
167         return pos;
168     }
169     dev->exp.exp_cap = pos;
170     exp_cap = dev->config + pos;
171 
172     /* Filling values common with v1 */
173     pcie_cap_v1_fill(dev, port, type, PCI_EXP_FLAGS_VER2);
174 
175     /* Fill link speed and width options */
176     pcie_cap_fill_slot_lnk(dev);
177 
178     /* Filling v2 specific values */
179     pci_set_long(exp_cap + PCI_EXP_DEVCAP2,
180                  PCI_EXP_DEVCAP2_EFF | PCI_EXP_DEVCAP2_EETLPP);
181 
182     pci_set_word(dev->wmask + pos + PCI_EXP_DEVCTL2, PCI_EXP_DEVCTL2_EETLPPB);
183 
184     if (dev->cap_present & QEMU_PCIE_EXTCAP_INIT) {
185         /* read-only to behave like a 'NULL' Extended Capability Header */
186         pci_set_long(dev->wmask + PCI_CONFIG_SPACE_SIZE, 0);
187     }
188 
189     return pos;
190 }
191 
192 int pcie_cap_v1_init(PCIDevice *dev, uint8_t offset, uint8_t type,
193                      uint8_t port)
194 {
195     /* PCIe cap v1 init */
196     int pos;
197     Error *local_err = NULL;
198 
199     assert(pci_is_express(dev));
200 
201     pos = pci_add_capability(dev, PCI_CAP_ID_EXP, offset,
202                              PCI_EXP_VER1_SIZEOF, &local_err);
203     if (pos < 0) {
204         error_report_err(local_err);
205         return pos;
206     }
207     dev->exp.exp_cap = pos;
208 
209     pcie_cap_v1_fill(dev, port, type, PCI_EXP_FLAGS_VER1);
210 
211     return pos;
212 }
213 
214 static int
215 pcie_endpoint_cap_common_init(PCIDevice *dev, uint8_t offset, uint8_t cap_size)
216 {
217     uint8_t type = PCI_EXP_TYPE_ENDPOINT;
218     Error *local_err = NULL;
219     int ret;
220 
221     /*
222      * Windows guests will report Code 10, device cannot start, if
223      * a regular Endpoint type is exposed on a root complex.  These
224      * should instead be Root Complex Integrated Endpoints.
225      */
226     if (pci_bus_is_express(pci_get_bus(dev))
227         && pci_bus_is_root(pci_get_bus(dev))) {
228         type = PCI_EXP_TYPE_RC_END;
229     }
230 
231     if (cap_size == PCI_EXP_VER1_SIZEOF) {
232         return pcie_cap_v1_init(dev, offset, type, 0);
233     } else {
234         ret = pcie_cap_init(dev, offset, type, 0, &local_err);
235 
236         if (ret < 0) {
237             error_report_err(local_err);
238         }
239 
240         return ret;
241     }
242 }
243 
244 int pcie_endpoint_cap_init(PCIDevice *dev, uint8_t offset)
245 {
246     return pcie_endpoint_cap_common_init(dev, offset, PCI_EXP_VER2_SIZEOF);
247 }
248 
249 int pcie_endpoint_cap_v1_init(PCIDevice *dev, uint8_t offset)
250 {
251     return pcie_endpoint_cap_common_init(dev, offset, PCI_EXP_VER1_SIZEOF);
252 }
253 
254 void pcie_cap_exit(PCIDevice *dev)
255 {
256     pci_del_capability(dev, PCI_CAP_ID_EXP, PCI_EXP_VER2_SIZEOF);
257 }
258 
259 void pcie_cap_v1_exit(PCIDevice *dev)
260 {
261     pci_del_capability(dev, PCI_CAP_ID_EXP, PCI_EXP_VER1_SIZEOF);
262 }
263 
264 uint8_t pcie_cap_get_type(const PCIDevice *dev)
265 {
266     uint32_t pos = dev->exp.exp_cap;
267     assert(pos > 0);
268     return (pci_get_word(dev->config + pos + PCI_EXP_FLAGS) &
269             PCI_EXP_FLAGS_TYPE) >> PCI_EXP_FLAGS_TYPE_SHIFT;
270 }
271 
272 /* MSI/MSI-X */
273 /* pci express interrupt message number */
274 /* 7.8.2 PCI Express Capabilities Register: Interrupt Message Number */
275 void pcie_cap_flags_set_vector(PCIDevice *dev, uint8_t vector)
276 {
277     uint8_t *exp_cap = dev->config + dev->exp.exp_cap;
278     assert(vector < 32);
279     pci_word_test_and_clear_mask(exp_cap + PCI_EXP_FLAGS, PCI_EXP_FLAGS_IRQ);
280     pci_word_test_and_set_mask(exp_cap + PCI_EXP_FLAGS,
281                                vector << PCI_EXP_FLAGS_IRQ_SHIFT);
282 }
283 
284 uint8_t pcie_cap_flags_get_vector(PCIDevice *dev)
285 {
286     return (pci_get_word(dev->config + dev->exp.exp_cap + PCI_EXP_FLAGS) &
287             PCI_EXP_FLAGS_IRQ) >> PCI_EXP_FLAGS_IRQ_SHIFT;
288 }
289 
290 void pcie_cap_deverr_init(PCIDevice *dev)
291 {
292     uint32_t pos = dev->exp.exp_cap;
293     pci_long_test_and_set_mask(dev->config + pos + PCI_EXP_DEVCAP,
294                                PCI_EXP_DEVCAP_RBER);
295     pci_long_test_and_set_mask(dev->wmask + pos + PCI_EXP_DEVCTL,
296                                PCI_EXP_DEVCTL_CERE | PCI_EXP_DEVCTL_NFERE |
297                                PCI_EXP_DEVCTL_FERE | PCI_EXP_DEVCTL_URRE);
298     pci_long_test_and_set_mask(dev->w1cmask + pos + PCI_EXP_DEVSTA,
299                                PCI_EXP_DEVSTA_CED | PCI_EXP_DEVSTA_NFED |
300                                PCI_EXP_DEVSTA_FED | PCI_EXP_DEVSTA_URD);
301 }
302 
303 void pcie_cap_deverr_reset(PCIDevice *dev)
304 {
305     uint8_t *devctl = dev->config + dev->exp.exp_cap + PCI_EXP_DEVCTL;
306     pci_long_test_and_clear_mask(devctl,
307                                  PCI_EXP_DEVCTL_CERE | PCI_EXP_DEVCTL_NFERE |
308                                  PCI_EXP_DEVCTL_FERE | PCI_EXP_DEVCTL_URRE);
309 }
310 
311 void pcie_cap_lnkctl_init(PCIDevice *dev)
312 {
313     uint32_t pos = dev->exp.exp_cap;
314     pci_long_test_and_set_mask(dev->wmask + pos + PCI_EXP_LNKCTL,
315                                PCI_EXP_LNKCTL_CCC | PCI_EXP_LNKCTL_ES);
316 }
317 
318 void pcie_cap_lnkctl_reset(PCIDevice *dev)
319 {
320     uint8_t *lnkctl = dev->config + dev->exp.exp_cap + PCI_EXP_LNKCTL;
321     pci_long_test_and_clear_mask(lnkctl,
322                                  PCI_EXP_LNKCTL_CCC | PCI_EXP_LNKCTL_ES);
323 }
324 
325 static void hotplug_event_update_event_status(PCIDevice *dev)
326 {
327     uint32_t pos = dev->exp.exp_cap;
328     uint8_t *exp_cap = dev->config + pos;
329     uint16_t sltctl = pci_get_word(exp_cap + PCI_EXP_SLTCTL);
330     uint16_t sltsta = pci_get_word(exp_cap + PCI_EXP_SLTSTA);
331 
332     dev->exp.hpev_notified = (sltctl & PCI_EXP_SLTCTL_HPIE) &&
333         (sltsta & sltctl & PCI_EXP_HP_EV_SUPPORTED);
334 }
335 
336 static void hotplug_event_notify(PCIDevice *dev)
337 {
338     bool prev = dev->exp.hpev_notified;
339 
340     hotplug_event_update_event_status(dev);
341 
342     if (prev == dev->exp.hpev_notified) {
343         return;
344     }
345 
346     /* Note: the logic above does not take into account whether interrupts
347      * are masked. The result is that interrupt will be sent when it is
348      * subsequently unmasked. This appears to be legal: Section 6.7.3.4:
349      * The Port may optionally send an MSI when there are hot-plug events that
350      * occur while interrupt generation is disabled, and interrupt generation is
351      * subsequently enabled. */
352     if (msix_enabled(dev)) {
353         msix_notify(dev, pcie_cap_flags_get_vector(dev));
354     } else if (msi_enabled(dev)) {
355         msi_notify(dev, pcie_cap_flags_get_vector(dev));
356     } else {
357         pci_set_irq(dev, dev->exp.hpev_notified);
358     }
359 }
360 
361 static void hotplug_event_clear(PCIDevice *dev)
362 {
363     hotplug_event_update_event_status(dev);
364     if (!msix_enabled(dev) && !msi_enabled(dev) && !dev->exp.hpev_notified) {
365         pci_irq_deassert(dev);
366     }
367 }
368 
369 static void pcie_set_power_device(PCIBus *bus, PCIDevice *dev, void *opaque)
370 {
371     bool *power = opaque;
372 
373     pci_set_power(dev, *power);
374 }
375 
376 static void pcie_cap_update_power(PCIDevice *hotplug_dev)
377 {
378     uint8_t *exp_cap = hotplug_dev->config + hotplug_dev->exp.exp_cap;
379     PCIBus *sec_bus = pci_bridge_get_sec_bus(PCI_BRIDGE(hotplug_dev));
380     uint32_t sltcap = pci_get_long(exp_cap + PCI_EXP_SLTCAP);
381     uint16_t sltctl = pci_get_word(exp_cap + PCI_EXP_SLTCTL);
382     bool power = true;
383 
384     if (sltcap & PCI_EXP_SLTCAP_PCP) {
385         power = (sltctl & PCI_EXP_SLTCTL_PCC) == PCI_EXP_SLTCTL_PWR_ON;
386     }
387 
388     pci_for_each_device(sec_bus, pci_bus_num(sec_bus),
389                         pcie_set_power_device, &power);
390 }
391 
392 /*
393  * A PCI Express Hot-Plug Event has occurred, so update slot status register
394  * and notify OS of the event if necessary.
395  *
396  * 6.7.3 PCI Express Hot-Plug Events
397  * 6.7.3.4 Software Notification of Hot-Plug Events
398  */
399 static void pcie_cap_slot_event(PCIDevice *dev, PCIExpressHotPlugEvent event)
400 {
401     /* Minor optimization: if nothing changed - no event is needed. */
402     if (pci_word_test_and_set_mask(dev->config + dev->exp.exp_cap +
403                                    PCI_EXP_SLTSTA, event) == event) {
404         return;
405     }
406     hotplug_event_notify(dev);
407 }
408 
409 static void pcie_cap_slot_plug_common(PCIDevice *hotplug_dev, DeviceState *dev,
410                                       Error **errp)
411 {
412     uint8_t *exp_cap = hotplug_dev->config + hotplug_dev->exp.exp_cap;
413     uint16_t sltsta = pci_get_word(exp_cap + PCI_EXP_SLTSTA);
414 
415     PCIE_DEV_PRINTF(PCI_DEVICE(dev), "hotplug state: 0x%x\n", sltsta);
416     if (sltsta & PCI_EXP_SLTSTA_EIS) {
417         /* the slot is electromechanically locked.
418          * This error is propagated up to qdev and then to HMP/QMP.
419          */
420         error_setg_errno(errp, EBUSY, "slot is electromechanically locked");
421     }
422 }
423 
424 void pcie_cap_slot_pre_plug_cb(HotplugHandler *hotplug_dev, DeviceState *dev,
425                                Error **errp)
426 {
427     PCIDevice *hotplug_pdev = PCI_DEVICE(hotplug_dev);
428     uint8_t *exp_cap = hotplug_pdev->config + hotplug_pdev->exp.exp_cap;
429     uint32_t sltcap = pci_get_word(exp_cap + PCI_EXP_SLTCAP);
430 
431     /* Check if hot-plug is disabled on the slot */
432     if (dev->hotplugged && (sltcap & PCI_EXP_SLTCAP_HPC) == 0) {
433         error_setg(errp, "Hot-plug failed: unsupported by the port device '%s'",
434                          DEVICE(hotplug_pdev)->id);
435         return;
436     }
437 
438     pcie_cap_slot_plug_common(PCI_DEVICE(hotplug_dev), dev, errp);
439 }
440 
441 void pcie_cap_slot_plug_cb(HotplugHandler *hotplug_dev, DeviceState *dev,
442                            Error **errp)
443 {
444     PCIDevice *hotplug_pdev = PCI_DEVICE(hotplug_dev);
445     uint8_t *exp_cap = hotplug_pdev->config + hotplug_pdev->exp.exp_cap;
446     PCIDevice *pci_dev = PCI_DEVICE(dev);
447     uint32_t lnkcap = pci_get_long(exp_cap + PCI_EXP_LNKCAP);
448 
449     /* Don't send event when device is enabled during qemu machine creation:
450      * it is present on boot, no hotplug event is necessary. We do send an
451      * event when the device is disabled later. */
452     if (!dev->hotplugged) {
453         pci_word_test_and_set_mask(exp_cap + PCI_EXP_SLTSTA,
454                                    PCI_EXP_SLTSTA_PDS);
455         if (pci_dev->cap_present & QEMU_PCIE_LNKSTA_DLLLA ||
456             (lnkcap & PCI_EXP_LNKCAP_DLLLARC)) {
457             pci_word_test_and_set_mask(exp_cap + PCI_EXP_LNKSTA,
458                                        PCI_EXP_LNKSTA_DLLLA);
459         }
460         pcie_cap_update_power(hotplug_pdev);
461         return;
462     }
463 
464     /* To enable multifunction hot-plug, we just ensure the function
465      * 0 added last. When function 0 is added, we set the sltsta and
466      * inform OS via event notification.
467      */
468     if (pci_get_function_0(pci_dev)) {
469         pci_word_test_and_set_mask(exp_cap + PCI_EXP_SLTSTA,
470                                    PCI_EXP_SLTSTA_PDS);
471         if (pci_dev->cap_present & QEMU_PCIE_LNKSTA_DLLLA ||
472             (lnkcap & PCI_EXP_LNKCAP_DLLLARC)) {
473             pci_word_test_and_set_mask(exp_cap + PCI_EXP_LNKSTA,
474                                        PCI_EXP_LNKSTA_DLLLA);
475         }
476         pcie_cap_slot_event(hotplug_pdev,
477                             PCI_EXP_HP_EV_PDC | PCI_EXP_HP_EV_ABP);
478         pcie_cap_update_power(hotplug_pdev);
479     }
480 }
481 
482 void pcie_cap_slot_unplug_cb(HotplugHandler *hotplug_dev, DeviceState *dev,
483                              Error **errp)
484 {
485     qdev_unrealize(dev);
486 }
487 
488 static void pcie_unplug_device(PCIBus *bus, PCIDevice *dev, void *opaque)
489 {
490     HotplugHandler *hotplug_ctrl = qdev_get_hotplug_handler(DEVICE(dev));
491 
492     if (dev->partially_hotplugged) {
493         dev->qdev.pending_deleted_event = false;
494         return;
495     }
496     hotplug_handler_unplug(hotplug_ctrl, DEVICE(dev), &error_abort);
497     object_unparent(OBJECT(dev));
498 }
499 
500 static void pcie_cap_slot_do_unplug(PCIDevice *dev)
501 {
502     PCIBus *sec_bus = pci_bridge_get_sec_bus(PCI_BRIDGE(dev));
503     uint8_t *exp_cap = dev->config + dev->exp.exp_cap;
504     uint32_t lnkcap = pci_get_long(exp_cap + PCI_EXP_LNKCAP);
505 
506     pci_for_each_device_under_bus(sec_bus, pcie_unplug_device, NULL);
507 
508     pci_word_test_and_clear_mask(exp_cap + PCI_EXP_SLTSTA,
509                                  PCI_EXP_SLTSTA_PDS);
510     if (dev->cap_present & QEMU_PCIE_LNKSTA_DLLLA ||
511         (lnkcap & PCI_EXP_LNKCAP_DLLLARC)) {
512         pci_word_test_and_clear_mask(exp_cap + PCI_EXP_LNKSTA,
513                                      PCI_EXP_LNKSTA_DLLLA);
514     }
515     pci_word_test_and_set_mask(exp_cap + PCI_EXP_SLTSTA,
516                                PCI_EXP_SLTSTA_PDC);
517 }
518 
519 void pcie_cap_slot_unplug_request_cb(HotplugHandler *hotplug_dev,
520                                      DeviceState *dev, Error **errp)
521 {
522     Error *local_err = NULL;
523     PCIDevice *pci_dev = PCI_DEVICE(dev);
524     PCIBus *bus = pci_get_bus(pci_dev);
525     PCIDevice *hotplug_pdev = PCI_DEVICE(hotplug_dev);
526     uint8_t *exp_cap = hotplug_pdev->config + hotplug_pdev->exp.exp_cap;
527     uint32_t sltcap = pci_get_word(exp_cap + PCI_EXP_SLTCAP);
528     uint16_t sltctl = pci_get_word(exp_cap + PCI_EXP_SLTCTL);
529 
530     /* Check if hot-unplug is disabled on the slot */
531     if ((sltcap & PCI_EXP_SLTCAP_HPC) == 0) {
532         error_setg(errp, "Hot-unplug failed: "
533                          "unsupported by the port device '%s'",
534                          DEVICE(hotplug_pdev)->id);
535         return;
536     }
537 
538     pcie_cap_slot_plug_common(hotplug_pdev, dev, &local_err);
539     if (local_err) {
540         error_propagate(errp, local_err);
541         return;
542     }
543 
544     if ((sltctl & PCI_EXP_SLTCTL_PIC) == PCI_EXP_SLTCTL_PWR_IND_BLINK) {
545         error_setg(errp, "Hot-unplug failed: "
546                    "guest is busy (power indicator blinking)");
547         return;
548     }
549 
550     dev->pending_deleted_event = true;
551     dev->pending_deleted_expires_ms =
552         qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) + 5000; /* 5 secs */
553 
554     /* In case user cancel the operation of multi-function hot-add,
555      * remove the function that is unexposed to guest individually,
556      * without interaction with guest.
557      */
558     if (pci_dev->devfn &&
559         !bus->devices[0]) {
560         pcie_unplug_device(bus, pci_dev, NULL);
561 
562         return;
563     }
564 
565     if (((sltctl & PCI_EXP_SLTCTL_PIC) == PCI_EXP_SLTCTL_PWR_IND_OFF) &&
566         ((sltctl & PCI_EXP_SLTCTL_PCC) == PCI_EXP_SLTCTL_PWR_OFF)) {
567         /* slot is powered off -> unplug without round-trip to the guest */
568         pcie_cap_slot_do_unplug(hotplug_pdev);
569         hotplug_event_notify(hotplug_pdev);
570         pci_word_test_and_clear_mask(exp_cap + PCI_EXP_SLTSTA,
571                                      PCI_EXP_SLTSTA_ABP);
572         return;
573     }
574 
575     pcie_cap_slot_push_attention_button(hotplug_pdev);
576 }
577 
578 /* pci express slot for pci express root/downstream port
579    PCI express capability slot registers */
580 void pcie_cap_slot_init(PCIDevice *dev, PCIESlot *s)
581 {
582     uint32_t pos = dev->exp.exp_cap;
583 
584     pci_word_test_and_set_mask(dev->config + pos + PCI_EXP_FLAGS,
585                                PCI_EXP_FLAGS_SLOT);
586 
587     pci_long_test_and_clear_mask(dev->config + pos + PCI_EXP_SLTCAP,
588                                  ~PCI_EXP_SLTCAP_PSN);
589     pci_long_test_and_set_mask(dev->config + pos + PCI_EXP_SLTCAP,
590                                (s->slot << PCI_EXP_SLTCAP_PSN_SHIFT) |
591                                PCI_EXP_SLTCAP_EIP |
592                                PCI_EXP_SLTCAP_PIP |
593                                PCI_EXP_SLTCAP_AIP |
594                                PCI_EXP_SLTCAP_ABP);
595 
596     /*
597      * Enable native hot-plug on all hot-plugged bridges unless
598      * hot-plug is disabled on the slot.
599      */
600     if (s->hotplug &&
601         (s->native_hotplug || DEVICE(dev)->hotplugged)) {
602         pci_long_test_and_set_mask(dev->config + pos + PCI_EXP_SLTCAP,
603                                    PCI_EXP_SLTCAP_HPS |
604                                    PCI_EXP_SLTCAP_HPC);
605     }
606 
607     if (dev->cap_present & QEMU_PCIE_SLTCAP_PCP) {
608         pci_long_test_and_set_mask(dev->config + pos + PCI_EXP_SLTCAP,
609                                    PCI_EXP_SLTCAP_PCP);
610         pci_word_test_and_clear_mask(dev->config + pos + PCI_EXP_SLTCTL,
611                                      PCI_EXP_SLTCTL_PCC);
612         pci_word_test_and_set_mask(dev->wmask + pos + PCI_EXP_SLTCTL,
613                                    PCI_EXP_SLTCTL_PCC);
614     }
615 
616     pci_word_test_and_clear_mask(dev->config + pos + PCI_EXP_SLTCTL,
617                                  PCI_EXP_SLTCTL_PIC |
618                                  PCI_EXP_SLTCTL_AIC);
619     pci_word_test_and_set_mask(dev->config + pos + PCI_EXP_SLTCTL,
620                                PCI_EXP_SLTCTL_PIC_OFF |
621                                PCI_EXP_SLTCTL_AIC_OFF);
622     pci_word_test_and_set_mask(dev->wmask + pos + PCI_EXP_SLTCTL,
623                                PCI_EXP_SLTCTL_PIC |
624                                PCI_EXP_SLTCTL_AIC |
625                                PCI_EXP_SLTCTL_HPIE |
626                                PCI_EXP_SLTCTL_CCIE |
627                                PCI_EXP_SLTCTL_PDCE |
628                                PCI_EXP_SLTCTL_ABPE);
629     /* Although reading PCI_EXP_SLTCTL_EIC returns always 0,
630      * make the bit writable here in order to detect 1b is written.
631      * pcie_cap_slot_write_config() test-and-clear the bit, so
632      * this bit always returns 0 to the guest.
633      */
634     pci_word_test_and_set_mask(dev->wmask + pos + PCI_EXP_SLTCTL,
635                                PCI_EXP_SLTCTL_EIC);
636 
637     pci_word_test_and_set_mask(dev->w1cmask + pos + PCI_EXP_SLTSTA,
638                                PCI_EXP_HP_EV_SUPPORTED);
639 
640     dev->exp.hpev_notified = false;
641 
642     qbus_set_hotplug_handler(BUS(pci_bridge_get_sec_bus(PCI_BRIDGE(dev))),
643                              OBJECT(dev));
644 }
645 
646 void pcie_cap_slot_reset(PCIDevice *dev)
647 {
648     uint8_t *exp_cap = dev->config + dev->exp.exp_cap;
649     uint8_t port_type = pcie_cap_get_type(dev);
650 
651     assert(port_type == PCI_EXP_TYPE_DOWNSTREAM ||
652            port_type == PCI_EXP_TYPE_ROOT_PORT);
653 
654     PCIE_DEV_PRINTF(dev, "reset\n");
655 
656     pci_word_test_and_clear_mask(exp_cap + PCI_EXP_SLTCTL,
657                                  PCI_EXP_SLTCTL_EIC |
658                                  PCI_EXP_SLTCTL_PIC |
659                                  PCI_EXP_SLTCTL_AIC |
660                                  PCI_EXP_SLTCTL_HPIE |
661                                  PCI_EXP_SLTCTL_CCIE |
662                                  PCI_EXP_SLTCTL_PDCE |
663                                  PCI_EXP_SLTCTL_ABPE);
664     pci_word_test_and_set_mask(exp_cap + PCI_EXP_SLTCTL,
665                                PCI_EXP_SLTCTL_AIC_OFF);
666 
667     if (dev->cap_present & QEMU_PCIE_SLTCAP_PCP) {
668         /* Downstream ports enforce device number 0. */
669         bool populated = pci_bridge_get_sec_bus(PCI_BRIDGE(dev))->devices[0];
670         uint16_t pic;
671 
672         if (populated) {
673             pci_word_test_and_clear_mask(exp_cap + PCI_EXP_SLTCTL,
674                                          PCI_EXP_SLTCTL_PCC);
675         } else {
676             pci_word_test_and_set_mask(exp_cap + PCI_EXP_SLTCTL,
677                                        PCI_EXP_SLTCTL_PCC);
678         }
679 
680         pic = populated ? PCI_EXP_SLTCTL_PIC_ON : PCI_EXP_SLTCTL_PIC_OFF;
681         pci_word_test_and_set_mask(exp_cap + PCI_EXP_SLTCTL, pic);
682     }
683 
684     pci_word_test_and_clear_mask(exp_cap + PCI_EXP_SLTSTA,
685                                  PCI_EXP_SLTSTA_EIS |/* on reset,
686                                                         the lock is released */
687                                  PCI_EXP_SLTSTA_CC |
688                                  PCI_EXP_SLTSTA_PDC |
689                                  PCI_EXP_SLTSTA_ABP);
690 
691     pcie_cap_update_power(dev);
692     hotplug_event_update_event_status(dev);
693 }
694 
695 void pcie_cap_slot_get(PCIDevice *dev, uint16_t *slt_ctl, uint16_t *slt_sta)
696 {
697     uint32_t pos = dev->exp.exp_cap;
698     uint8_t *exp_cap = dev->config + pos;
699     *slt_ctl = pci_get_word(exp_cap + PCI_EXP_SLTCTL);
700     *slt_sta = pci_get_word(exp_cap + PCI_EXP_SLTSTA);
701 }
702 
703 void pcie_cap_slot_write_config(PCIDevice *dev,
704                                 uint16_t old_slt_ctl, uint16_t old_slt_sta,
705                                 uint32_t addr, uint32_t val, int len)
706 {
707     uint32_t pos = dev->exp.exp_cap;
708     uint8_t *exp_cap = dev->config + pos;
709     uint16_t sltsta = pci_get_word(exp_cap + PCI_EXP_SLTSTA);
710 
711     if (ranges_overlap(addr, len, pos + PCI_EXP_SLTSTA, 2)) {
712         /*
713          * Guests tend to clears all bits during init.
714          * If they clear bits that weren't set this is racy and will lose events:
715          * not a big problem for manual button presses, but a problem for us.
716          * As a work-around, detect this and revert status to what it was
717          * before the write.
718          *
719          * Note: in theory this can be detected as a duplicate button press
720          * which cancels the previous press. Does not seem to happen in
721          * practice as guests seem to only have this bug during init.
722          */
723 #define PCIE_SLOT_EVENTS (PCI_EXP_SLTSTA_ABP | PCI_EXP_SLTSTA_PFD | \
724                           PCI_EXP_SLTSTA_MRLSC | PCI_EXP_SLTSTA_PDC | \
725                           PCI_EXP_SLTSTA_CC)
726 
727         if (val & ~old_slt_sta & PCIE_SLOT_EVENTS) {
728             sltsta = (sltsta & ~PCIE_SLOT_EVENTS) | (old_slt_sta & PCIE_SLOT_EVENTS);
729             pci_set_word(exp_cap + PCI_EXP_SLTSTA, sltsta);
730         }
731         hotplug_event_clear(dev);
732     }
733 
734     if (!ranges_overlap(addr, len, pos + PCI_EXP_SLTCTL, 2)) {
735         return;
736     }
737 
738     if (pci_word_test_and_clear_mask(exp_cap + PCI_EXP_SLTCTL,
739                                      PCI_EXP_SLTCTL_EIC)) {
740         sltsta ^= PCI_EXP_SLTSTA_EIS; /* toggle PCI_EXP_SLTSTA_EIS bit */
741         pci_set_word(exp_cap + PCI_EXP_SLTSTA, sltsta);
742         PCIE_DEV_PRINTF(dev, "PCI_EXP_SLTCTL_EIC: "
743                         "sltsta -> 0x%02"PRIx16"\n",
744                         sltsta);
745     }
746 
747     /*
748      * If the slot is populated, power indicator is off and power
749      * controller is off, it is safe to detach the devices.
750      *
751      * Note: don't detach if condition was already true:
752      * this is a work around for guests that overwrite
753      * control of powered off slots before powering them on.
754      */
755     if ((sltsta & PCI_EXP_SLTSTA_PDS) && (val & PCI_EXP_SLTCTL_PCC) &&
756         (val & PCI_EXP_SLTCTL_PIC_OFF) == PCI_EXP_SLTCTL_PIC_OFF &&
757         (!(old_slt_ctl & PCI_EXP_SLTCTL_PCC) ||
758         (old_slt_ctl & PCI_EXP_SLTCTL_PIC_OFF) != PCI_EXP_SLTCTL_PIC_OFF)) {
759         pcie_cap_slot_do_unplug(dev);
760     }
761     pcie_cap_update_power(dev);
762 
763     hotplug_event_notify(dev);
764 
765     /*
766      * 6.7.3.2 Command Completed Events
767      *
768      * Software issues a command to a hot-plug capable Downstream Port by
769      * issuing a write transaction that targets any portion of the Port’s Slot
770      * Control register. A single write to the Slot Control register is
771      * considered to be a single command, even if the write affects more than
772      * one field in the Slot Control register. In response to this transaction,
773      * the Port must carry out the requested actions and then set the
774      * associated status field for the command completed event. */
775 
776     /* Real hardware might take a while to complete requested command because
777      * physical movement would be involved like locking the electromechanical
778      * lock.  However in our case, command is completed instantaneously above,
779      * so send a command completion event right now.
780      */
781     pcie_cap_slot_event(dev, PCI_EXP_HP_EV_CCI);
782 }
783 
784 int pcie_cap_slot_post_load(void *opaque, int version_id)
785 {
786     PCIDevice *dev = opaque;
787     hotplug_event_update_event_status(dev);
788     pcie_cap_update_power(dev);
789     return 0;
790 }
791 
792 void pcie_cap_slot_push_attention_button(PCIDevice *dev)
793 {
794     pcie_cap_slot_event(dev, PCI_EXP_HP_EV_ABP);
795 }
796 
797 /* root control/capabilities/status. PME isn't emulated for now */
798 void pcie_cap_root_init(PCIDevice *dev)
799 {
800     pci_set_word(dev->wmask + dev->exp.exp_cap + PCI_EXP_RTCTL,
801                  PCI_EXP_RTCTL_SECEE | PCI_EXP_RTCTL_SENFEE |
802                  PCI_EXP_RTCTL_SEFEE);
803 }
804 
805 void pcie_cap_root_reset(PCIDevice *dev)
806 {
807     pci_set_word(dev->config + dev->exp.exp_cap + PCI_EXP_RTCTL, 0);
808 }
809 
810 /* function level reset(FLR) */
811 void pcie_cap_flr_init(PCIDevice *dev)
812 {
813     pci_long_test_and_set_mask(dev->config + dev->exp.exp_cap + PCI_EXP_DEVCAP,
814                                PCI_EXP_DEVCAP_FLR);
815 
816     /* Although reading BCR_FLR returns always 0,
817      * the bit is made writable here in order to detect the 1b is written
818      * pcie_cap_flr_write_config() test-and-clear the bit, so
819      * this bit always returns 0 to the guest.
820      */
821     pci_word_test_and_set_mask(dev->wmask + dev->exp.exp_cap + PCI_EXP_DEVCTL,
822                                PCI_EXP_DEVCTL_BCR_FLR);
823 }
824 
825 void pcie_cap_flr_write_config(PCIDevice *dev,
826                                uint32_t addr, uint32_t val, int len)
827 {
828     uint8_t *devctl = dev->config + dev->exp.exp_cap + PCI_EXP_DEVCTL;
829     if (pci_get_word(devctl) & PCI_EXP_DEVCTL_BCR_FLR) {
830         /* Clear PCI_EXP_DEVCTL_BCR_FLR after invoking the reset handler
831            so the handler can detect FLR by looking at this bit. */
832         pci_device_reset(dev);
833         pci_word_test_and_clear_mask(devctl, PCI_EXP_DEVCTL_BCR_FLR);
834     }
835 }
836 
837 /* Alternative Routing-ID Interpretation (ARI)
838  * forwarding support for root and downstream ports
839  */
840 void pcie_cap_arifwd_init(PCIDevice *dev)
841 {
842     uint32_t pos = dev->exp.exp_cap;
843     pci_long_test_and_set_mask(dev->config + pos + PCI_EXP_DEVCAP2,
844                                PCI_EXP_DEVCAP2_ARI);
845     pci_long_test_and_set_mask(dev->wmask + pos + PCI_EXP_DEVCTL2,
846                                PCI_EXP_DEVCTL2_ARI);
847 }
848 
849 void pcie_cap_arifwd_reset(PCIDevice *dev)
850 {
851     uint8_t *devctl2 = dev->config + dev->exp.exp_cap + PCI_EXP_DEVCTL2;
852     pci_long_test_and_clear_mask(devctl2, PCI_EXP_DEVCTL2_ARI);
853 }
854 
855 bool pcie_cap_is_arifwd_enabled(const PCIDevice *dev)
856 {
857     if (!pci_is_express(dev)) {
858         return false;
859     }
860     if (!dev->exp.exp_cap) {
861         return false;
862     }
863 
864     return pci_get_long(dev->config + dev->exp.exp_cap + PCI_EXP_DEVCTL2) &
865         PCI_EXP_DEVCTL2_ARI;
866 }
867 
868 /**************************************************************************
869  * pci express extended capability list management functions
870  * uint16_t ext_cap_id (16 bit)
871  * uint8_t cap_ver (4 bit)
872  * uint16_t cap_offset (12 bit)
873  * uint16_t ext_cap_size
874  */
875 
876 /* Passing a cap_id value > 0xffff will return 0 and put end of list in prev */
877 static uint16_t pcie_find_capability_list(PCIDevice *dev, uint32_t cap_id,
878                                           uint16_t *prev_p)
879 {
880     uint16_t prev = 0;
881     uint16_t next;
882     uint32_t header = pci_get_long(dev->config + PCI_CONFIG_SPACE_SIZE);
883 
884     if (!header) {
885         /* no extended capability */
886         next = 0;
887         goto out;
888     }
889     for (next = PCI_CONFIG_SPACE_SIZE; next;
890          prev = next, next = PCI_EXT_CAP_NEXT(header)) {
891 
892         assert(next >= PCI_CONFIG_SPACE_SIZE);
893         assert(next <= PCIE_CONFIG_SPACE_SIZE - 8);
894 
895         header = pci_get_long(dev->config + next);
896         if (PCI_EXT_CAP_ID(header) == cap_id) {
897             break;
898         }
899     }
900 
901 out:
902     if (prev_p) {
903         *prev_p = prev;
904     }
905     return next;
906 }
907 
908 uint16_t pcie_find_capability(PCIDevice *dev, uint16_t cap_id)
909 {
910     return pcie_find_capability_list(dev, cap_id, NULL);
911 }
912 
913 static void pcie_ext_cap_set_next(PCIDevice *dev, uint16_t pos, uint16_t next)
914 {
915     uint32_t header = pci_get_long(dev->config + pos);
916     assert(!(next & (PCI_EXT_CAP_ALIGN - 1)));
917     header = (header & ~PCI_EXT_CAP_NEXT_MASK) |
918         ((next << PCI_EXT_CAP_NEXT_SHIFT) & PCI_EXT_CAP_NEXT_MASK);
919     pci_set_long(dev->config + pos, header);
920 }
921 
922 /*
923  * Caller must supply valid (offset, size) such that the range wouldn't
924  * overlap with other capability or other registers.
925  * This function doesn't check it.
926  */
927 void pcie_add_capability(PCIDevice *dev,
928                          uint16_t cap_id, uint8_t cap_ver,
929                          uint16_t offset, uint16_t size)
930 {
931     assert(offset >= PCI_CONFIG_SPACE_SIZE);
932     assert(offset < (uint16_t)(offset + size));
933     assert((uint16_t)(offset + size) <= PCIE_CONFIG_SPACE_SIZE);
934     assert(size >= 8);
935     assert(pci_is_express(dev));
936 
937     if (offset != PCI_CONFIG_SPACE_SIZE) {
938         uint16_t prev;
939 
940         /*
941          * 0xffffffff is not a valid cap id (it's a 16 bit field). use
942          * internally to find the last capability in the linked list.
943          */
944         pcie_find_capability_list(dev, 0xffffffff, &prev);
945         assert(prev >= PCI_CONFIG_SPACE_SIZE);
946         pcie_ext_cap_set_next(dev, prev, offset);
947     }
948     pci_set_long(dev->config + offset, PCI_EXT_CAP(cap_id, cap_ver, 0));
949 
950     /* Make capability read-only by default */
951     memset(dev->wmask + offset, 0, size);
952     memset(dev->w1cmask + offset, 0, size);
953     /* Check capability by default */
954     memset(dev->cmask + offset, 0xFF, size);
955 }
956 
957 /*
958  * Sync the PCIe Link Status negotiated speed and width of a bridge with the
959  * downstream device.  If downstream device is not present, re-write with the
960  * Link Capability fields.  If downstream device reports invalid width or
961  * speed, replace with minimum values (LnkSta fields are RsvdZ on VFs but such
962  * values interfere with PCIe native hotplug detecting new devices).  Limit
963  * width and speed to bridge capabilities for compatibility.  Use config_read
964  * to access the downstream device since it could be an assigned device with
965  * volatile link information.
966  */
967 void pcie_sync_bridge_lnk(PCIDevice *bridge_dev)
968 {
969     PCIBridge *br = PCI_BRIDGE(bridge_dev);
970     PCIBus *bus = pci_bridge_get_sec_bus(br);
971     PCIDevice *target = bus->devices[0];
972     uint8_t *exp_cap = bridge_dev->config + bridge_dev->exp.exp_cap;
973     uint16_t lnksta, lnkcap = pci_get_word(exp_cap + PCI_EXP_LNKCAP);
974 
975     if (!target || !target->exp.exp_cap) {
976         lnksta = lnkcap;
977     } else {
978         lnksta = target->config_read(target,
979                                      target->exp.exp_cap + PCI_EXP_LNKSTA,
980                                      sizeof(lnksta));
981 
982         if ((lnksta & PCI_EXP_LNKSTA_NLW) > (lnkcap & PCI_EXP_LNKCAP_MLW)) {
983             lnksta &= ~PCI_EXP_LNKSTA_NLW;
984             lnksta |= lnkcap & PCI_EXP_LNKCAP_MLW;
985         } else if (!(lnksta & PCI_EXP_LNKSTA_NLW)) {
986             lnksta |= QEMU_PCI_EXP_LNKSTA_NLW(QEMU_PCI_EXP_LNK_X1);
987         }
988 
989         if ((lnksta & PCI_EXP_LNKSTA_CLS) > (lnkcap & PCI_EXP_LNKCAP_SLS)) {
990             lnksta &= ~PCI_EXP_LNKSTA_CLS;
991             lnksta |= lnkcap & PCI_EXP_LNKCAP_SLS;
992         } else if (!(lnksta & PCI_EXP_LNKSTA_CLS)) {
993             lnksta |= QEMU_PCI_EXP_LNKSTA_CLS(QEMU_PCI_EXP_LNK_2_5GT);
994         }
995     }
996 
997     pci_word_test_and_clear_mask(exp_cap + PCI_EXP_LNKSTA,
998                                  PCI_EXP_LNKSTA_CLS | PCI_EXP_LNKSTA_NLW);
999     pci_word_test_and_set_mask(exp_cap + PCI_EXP_LNKSTA, lnksta &
1000                                (PCI_EXP_LNKSTA_CLS | PCI_EXP_LNKSTA_NLW));
1001 }
1002 
1003 /**************************************************************************
1004  * pci express extended capability helper functions
1005  */
1006 
1007 /* ARI */
1008 void pcie_ari_init(PCIDevice *dev, uint16_t offset, uint16_t nextfn)
1009 {
1010     pcie_add_capability(dev, PCI_EXT_CAP_ID_ARI, PCI_ARI_VER,
1011                         offset, PCI_ARI_SIZEOF);
1012     pci_set_long(dev->config + offset + PCI_ARI_CAP, (nextfn & 0xff) << 8);
1013 }
1014 
1015 void pcie_dev_ser_num_init(PCIDevice *dev, uint16_t offset, uint64_t ser_num)
1016 {
1017     static const int pci_dsn_ver = 1;
1018     static const int pci_dsn_cap = 4;
1019 
1020     pcie_add_capability(dev, PCI_EXT_CAP_ID_DSN, pci_dsn_ver, offset,
1021                         PCI_EXT_CAP_DSN_SIZEOF);
1022     pci_set_quad(dev->config + offset + pci_dsn_cap, ser_num);
1023 }
1024 
1025 void pcie_ats_init(PCIDevice *dev, uint16_t offset, bool aligned)
1026 {
1027     pcie_add_capability(dev, PCI_EXT_CAP_ID_ATS, 0x1,
1028                         offset, PCI_EXT_CAP_ATS_SIZEOF);
1029 
1030     dev->exp.ats_cap = offset;
1031 
1032     /* Invalidate Queue Depth 0 */
1033     if (aligned) {
1034         pci_set_word(dev->config + offset + PCI_ATS_CAP,
1035                      PCI_ATS_CAP_PAGE_ALIGNED);
1036     }
1037     /* STU 0, Disabled by default */
1038     pci_set_word(dev->config + offset + PCI_ATS_CTRL, 0);
1039 
1040     pci_set_word(dev->wmask + dev->exp.ats_cap + PCI_ATS_CTRL, 0x800f);
1041 }
1042 
1043 /* ACS (Access Control Services) */
1044 void pcie_acs_init(PCIDevice *dev, uint16_t offset)
1045 {
1046     bool is_downstream = pci_is_express_downstream_port(dev);
1047     uint16_t cap_bits = 0;
1048 
1049     /* For endpoints, only multifunction devs may have an ACS capability: */
1050     assert(is_downstream ||
1051            (dev->cap_present & QEMU_PCI_CAP_MULTIFUNCTION) ||
1052            PCI_FUNC(dev->devfn));
1053 
1054     pcie_add_capability(dev, PCI_EXT_CAP_ID_ACS, PCI_ACS_VER, offset,
1055                         PCI_ACS_SIZEOF);
1056     dev->exp.acs_cap = offset;
1057 
1058     if (is_downstream) {
1059         /*
1060          * Downstream ports must implement SV, TB, RR, CR, UF, and DT (with
1061          * caveats on the latter four that we ignore for simplicity).
1062          * Endpoints may also implement a subset of ACS capabilities,
1063          * but these are optional if the endpoint does not support
1064          * peer-to-peer between functions and thus omitted here.
1065          */
1066         cap_bits = PCI_ACS_SV | PCI_ACS_TB | PCI_ACS_RR |
1067             PCI_ACS_CR | PCI_ACS_UF | PCI_ACS_DT;
1068     }
1069 
1070     pci_set_word(dev->config + offset + PCI_ACS_CAP, cap_bits);
1071     pci_set_word(dev->wmask + offset + PCI_ACS_CTRL, cap_bits);
1072 }
1073 
1074 void pcie_acs_reset(PCIDevice *dev)
1075 {
1076     if (dev->exp.acs_cap) {
1077         pci_set_word(dev->config + dev->exp.acs_cap + PCI_ACS_CTRL, 0);
1078     }
1079 }
1080