xref: /openbmc/qemu/hw/pci/pcie.c (revision feb58e3b)
1 /*
2  * pcie.c
3  *
4  * Copyright (c) 2010 Isaku Yamahata <yamahata at valinux co jp>
5  *                    VA Linux Systems Japan K.K.
6  *
7  * This program is free software; you can redistribute it and/or modify
8  * it under the terms of the GNU General Public License as published by
9  * the Free Software Foundation; either version 2 of the License, or
10  * (at your option) any later version.
11  *
12  * This program is distributed in the hope that it will be useful,
13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
15  * GNU General Public License for more details.
16  *
17  * You should have received a copy of the GNU General Public License along
18  * with this program; if not, see <http://www.gnu.org/licenses/>.
19  */
20 
21 #include "qemu/osdep.h"
22 #include "qapi/error.h"
23 #include "hw/pci/pci_bridge.h"
24 #include "hw/pci/pcie.h"
25 #include "hw/pci/msix.h"
26 #include "hw/pci/msi.h"
27 #include "hw/pci/pci_bus.h"
28 #include "hw/pci/pcie_regs.h"
29 #include "hw/pci/pcie_port.h"
30 #include "qemu/range.h"
31 #include "trace.h"
32 
33 //#define DEBUG_PCIE
34 #ifdef DEBUG_PCIE
35 # define PCIE_DPRINTF(fmt, ...)                                         \
36     fprintf(stderr, "%s:%d " fmt, __func__, __LINE__, ## __VA_ARGS__)
37 #else
38 # define PCIE_DPRINTF(fmt, ...) do {} while (0)
39 #endif
40 #define PCIE_DEV_PRINTF(dev, fmt, ...)                                  \
41     PCIE_DPRINTF("%s:%x "fmt, (dev)->name, (dev)->devfn, ## __VA_ARGS__)
42 
43 static bool pcie_sltctl_powered_off(uint16_t sltctl)
44 {
45     return (sltctl & PCI_EXP_SLTCTL_PCC) == PCI_EXP_SLTCTL_PWR_OFF
46         && (sltctl & PCI_EXP_SLTCTL_PIC) == PCI_EXP_SLTCTL_PWR_IND_OFF;
47 }
48 
49 static const char *pcie_led_state_to_str(uint16_t value)
50 {
51     switch (value) {
52     case PCI_EXP_SLTCTL_PWR_IND_ON:
53     case PCI_EXP_SLTCTL_ATTN_IND_ON:
54         return "on";
55     case PCI_EXP_SLTCTL_PWR_IND_BLINK:
56     case PCI_EXP_SLTCTL_ATTN_IND_BLINK:
57         return "blink";
58     case PCI_EXP_SLTCTL_PWR_IND_OFF:
59     case PCI_EXP_SLTCTL_ATTN_IND_OFF:
60         return "off";
61     default:
62         return "invalid";
63     }
64 }
65 
66 /***************************************************************************
67  * pci express capability helper functions
68  */
69 
70 static void
71 pcie_cap_v1_fill(PCIDevice *dev, uint8_t port, uint8_t type, uint8_t version)
72 {
73     uint8_t *exp_cap = dev->config + dev->exp.exp_cap;
74     uint8_t *cmask = dev->cmask + dev->exp.exp_cap;
75 
76     /* capability register
77     interrupt message number defaults to 0 */
78     pci_set_word(exp_cap + PCI_EXP_FLAGS,
79                  ((type << PCI_EXP_FLAGS_TYPE_SHIFT) & PCI_EXP_FLAGS_TYPE) |
80                  version);
81 
82     /* device capability register
83      * table 7-12:
84      * roll based error reporting bit must be set by all
85      * Functions conforming to the ECN, PCI Express Base
86      * Specification, Revision 1.1., or subsequent PCI Express Base
87      * Specification revisions.
88      */
89     pci_set_long(exp_cap + PCI_EXP_DEVCAP, PCI_EXP_DEVCAP_RBER);
90 
91     pci_set_long(exp_cap + PCI_EXP_LNKCAP,
92                  (port << PCI_EXP_LNKCAP_PN_SHIFT) |
93                  PCI_EXP_LNKCAP_ASPMS_0S |
94                  QEMU_PCI_EXP_LNKCAP_MLW(QEMU_PCI_EXP_LNK_X1) |
95                  QEMU_PCI_EXP_LNKCAP_MLS(QEMU_PCI_EXP_LNK_2_5GT));
96 
97     pci_set_word(exp_cap + PCI_EXP_LNKSTA,
98                  QEMU_PCI_EXP_LNKSTA_NLW(QEMU_PCI_EXP_LNK_X1) |
99                  QEMU_PCI_EXP_LNKSTA_CLS(QEMU_PCI_EXP_LNK_2_5GT));
100 
101     /* We changed link status bits over time, and changing them across
102      * migrations is generally fine as hardware changes them too.
103      * Let's not bother checking.
104      */
105     pci_set_word(cmask + PCI_EXP_LNKSTA, 0);
106 }
107 
108 /* Includes setting the target speed default */
109 static void pcie_cap_fill_lnk(uint8_t *exp_cap, PCIExpLinkWidth width,
110                               PCIExpLinkSpeed speed)
111 {
112     /* Clear and fill LNKCAP from what was configured above */
113     pci_long_test_and_clear_mask(exp_cap + PCI_EXP_LNKCAP,
114                                  PCI_EXP_LNKCAP_MLW | PCI_EXP_LNKCAP_SLS);
115     pci_long_test_and_set_mask(exp_cap + PCI_EXP_LNKCAP,
116                                QEMU_PCI_EXP_LNKCAP_MLW(width) |
117                                QEMU_PCI_EXP_LNKCAP_MLS(speed));
118 
119     if (speed > QEMU_PCI_EXP_LNK_2_5GT) {
120         /*
121          * Target Link Speed defaults to the highest link speed supported by
122          * the component.  2.5GT/s devices are permitted to hardwire to zero.
123          */
124         pci_word_test_and_clear_mask(exp_cap + PCI_EXP_LNKCTL2,
125                                      PCI_EXP_LNKCTL2_TLS);
126         pci_word_test_and_set_mask(exp_cap + PCI_EXP_LNKCTL2,
127                                    QEMU_PCI_EXP_LNKCAP_MLS(speed) &
128                                    PCI_EXP_LNKCTL2_TLS);
129     }
130 
131     /*
132      * 2.5 & 5.0GT/s can be fully described by LNKCAP, but 8.0GT/s is
133      * actually a reference to the highest bit supported in this register.
134      * We assume the device supports all link speeds.
135      */
136     if (speed > QEMU_PCI_EXP_LNK_5GT) {
137         pci_long_test_and_clear_mask(exp_cap + PCI_EXP_LNKCAP2, ~0U);
138         pci_long_test_and_set_mask(exp_cap + PCI_EXP_LNKCAP2,
139                                    PCI_EXP_LNKCAP2_SLS_2_5GB |
140                                    PCI_EXP_LNKCAP2_SLS_5_0GB |
141                                    PCI_EXP_LNKCAP2_SLS_8_0GB);
142         if (speed > QEMU_PCI_EXP_LNK_8GT) {
143             pci_long_test_and_set_mask(exp_cap + PCI_EXP_LNKCAP2,
144                                        PCI_EXP_LNKCAP2_SLS_16_0GB);
145         }
146         if (speed > QEMU_PCI_EXP_LNK_16GT) {
147             pci_long_test_and_set_mask(exp_cap + PCI_EXP_LNKCAP2,
148                                        PCI_EXP_LNKCAP2_SLS_32_0GB);
149         }
150         if (speed > QEMU_PCI_EXP_LNK_32GT) {
151             pci_long_test_and_set_mask(exp_cap + PCI_EXP_LNKCAP2,
152                                        PCI_EXP_LNKCAP2_SLS_64_0GB);
153         }
154     }
155 }
156 
157 void pcie_cap_fill_link_ep_usp(PCIDevice *dev, PCIExpLinkWidth width,
158                                PCIExpLinkSpeed speed)
159 {
160     uint8_t *exp_cap = dev->config + dev->exp.exp_cap;
161 
162     /*
163      * For an end point or USP need to set the current status as well
164      * as the capabilities.
165      */
166     pci_long_test_and_clear_mask(exp_cap + PCI_EXP_LNKSTA,
167                                  PCI_EXP_LNKSTA_CLS | PCI_EXP_LNKSTA_NLW);
168     pci_long_test_and_set_mask(exp_cap + PCI_EXP_LNKSTA,
169                                QEMU_PCI_EXP_LNKSTA_NLW(width) |
170                                QEMU_PCI_EXP_LNKSTA_CLS(speed));
171 
172     pcie_cap_fill_lnk(exp_cap, width, speed);
173 }
174 
175 static void pcie_cap_fill_slot_lnk(PCIDevice *dev)
176 {
177     PCIESlot *s = (PCIESlot *)object_dynamic_cast(OBJECT(dev), TYPE_PCIE_SLOT);
178     uint8_t *exp_cap = dev->config + dev->exp.exp_cap;
179 
180     /* Skip anything that isn't a PCIESlot */
181     if (!s) {
182         return;
183     }
184 
185     /*
186      * Link bandwidth notification is required for all root ports and
187      * downstream ports supporting links wider than x1 or multiple link
188      * speeds.
189      */
190     if (s->width > QEMU_PCI_EXP_LNK_X1 ||
191         s->speed > QEMU_PCI_EXP_LNK_2_5GT) {
192         pci_long_test_and_set_mask(exp_cap + PCI_EXP_LNKCAP,
193                                    PCI_EXP_LNKCAP_LBNC);
194     }
195 
196     if (s->speed > QEMU_PCI_EXP_LNK_2_5GT) {
197         /*
198          * Hot-plug capable downstream ports and downstream ports supporting
199          * link speeds greater than 5GT/s must hardwire PCI_EXP_LNKCAP_DLLLARC
200          * to 1b.  PCI_EXP_LNKCAP_DLLLARC implies PCI_EXP_LNKSTA_DLLLA, which
201          * we also hardwire to 1b here.  2.5GT/s hot-plug slots should also
202          * technically implement this, but it's not done here for compatibility.
203          */
204         pci_long_test_and_set_mask(exp_cap + PCI_EXP_LNKCAP,
205                                    PCI_EXP_LNKCAP_DLLLARC);
206         /* the PCI_EXP_LNKSTA_DLLLA will be set in the hotplug function */
207     }
208 
209     pcie_cap_fill_lnk(exp_cap, s->width, s->speed);
210 }
211 
212 int pcie_cap_init(PCIDevice *dev, uint8_t offset,
213                   uint8_t type, uint8_t port,
214                   Error **errp)
215 {
216     /* PCIe cap v2 init */
217     int pos;
218     uint8_t *exp_cap;
219 
220     assert(pci_is_express(dev));
221 
222     pos = pci_add_capability(dev, PCI_CAP_ID_EXP, offset,
223                              PCI_EXP_VER2_SIZEOF, errp);
224     if (pos < 0) {
225         return pos;
226     }
227     dev->exp.exp_cap = pos;
228     exp_cap = dev->config + pos;
229 
230     /* Filling values common with v1 */
231     pcie_cap_v1_fill(dev, port, type, PCI_EXP_FLAGS_VER2);
232 
233     /* Fill link speed and width options */
234     pcie_cap_fill_slot_lnk(dev);
235 
236     /* Filling v2 specific values */
237     pci_set_long(exp_cap + PCI_EXP_DEVCAP2,
238                  PCI_EXP_DEVCAP2_EFF | PCI_EXP_DEVCAP2_EETLPP);
239 
240     pci_set_word(dev->wmask + pos + PCI_EXP_DEVCTL2, PCI_EXP_DEVCTL2_EETLPPB);
241 
242     if (dev->cap_present & QEMU_PCIE_EXTCAP_INIT) {
243         /* read-only to behave like a 'NULL' Extended Capability Header */
244         pci_set_long(dev->wmask + PCI_CONFIG_SPACE_SIZE, 0);
245     }
246 
247     return pos;
248 }
249 
250 int pcie_cap_v1_init(PCIDevice *dev, uint8_t offset, uint8_t type,
251                      uint8_t port)
252 {
253     /* PCIe cap v1 init */
254     int pos;
255     Error *local_err = NULL;
256 
257     assert(pci_is_express(dev));
258 
259     pos = pci_add_capability(dev, PCI_CAP_ID_EXP, offset,
260                              PCI_EXP_VER1_SIZEOF, &local_err);
261     if (pos < 0) {
262         error_report_err(local_err);
263         return pos;
264     }
265     dev->exp.exp_cap = pos;
266 
267     pcie_cap_v1_fill(dev, port, type, PCI_EXP_FLAGS_VER1);
268 
269     return pos;
270 }
271 
272 static int
273 pcie_endpoint_cap_common_init(PCIDevice *dev, uint8_t offset, uint8_t cap_size)
274 {
275     uint8_t type = PCI_EXP_TYPE_ENDPOINT;
276     Error *local_err = NULL;
277     int ret;
278 
279     /*
280      * Windows guests will report Code 10, device cannot start, if
281      * a regular Endpoint type is exposed on a root complex.  These
282      * should instead be Root Complex Integrated Endpoints.
283      */
284     if (pci_bus_is_express(pci_get_bus(dev))
285         && pci_bus_is_root(pci_get_bus(dev))) {
286         type = PCI_EXP_TYPE_RC_END;
287     }
288 
289     if (cap_size == PCI_EXP_VER1_SIZEOF) {
290         return pcie_cap_v1_init(dev, offset, type, 0);
291     } else {
292         ret = pcie_cap_init(dev, offset, type, 0, &local_err);
293 
294         if (ret < 0) {
295             error_report_err(local_err);
296         }
297 
298         return ret;
299     }
300 }
301 
302 int pcie_endpoint_cap_init(PCIDevice *dev, uint8_t offset)
303 {
304     return pcie_endpoint_cap_common_init(dev, offset, PCI_EXP_VER2_SIZEOF);
305 }
306 
307 int pcie_endpoint_cap_v1_init(PCIDevice *dev, uint8_t offset)
308 {
309     return pcie_endpoint_cap_common_init(dev, offset, PCI_EXP_VER1_SIZEOF);
310 }
311 
312 void pcie_cap_exit(PCIDevice *dev)
313 {
314     pci_del_capability(dev, PCI_CAP_ID_EXP, PCI_EXP_VER2_SIZEOF);
315 }
316 
317 void pcie_cap_v1_exit(PCIDevice *dev)
318 {
319     pci_del_capability(dev, PCI_CAP_ID_EXP, PCI_EXP_VER1_SIZEOF);
320 }
321 
322 uint8_t pcie_cap_get_type(const PCIDevice *dev)
323 {
324     uint32_t pos = dev->exp.exp_cap;
325     assert(pos > 0);
326     return (pci_get_word(dev->config + pos + PCI_EXP_FLAGS) &
327             PCI_EXP_FLAGS_TYPE) >> PCI_EXP_FLAGS_TYPE_SHIFT;
328 }
329 
330 uint8_t pcie_cap_get_version(const PCIDevice *dev)
331 {
332     uint32_t pos = dev->exp.exp_cap;
333     assert(pos > 0);
334     return pci_get_word(dev->config + pos + PCI_EXP_FLAGS) & PCI_EXP_FLAGS_VERS;
335 }
336 
337 /* MSI/MSI-X */
338 /* pci express interrupt message number */
339 /* 7.8.2 PCI Express Capabilities Register: Interrupt Message Number */
340 void pcie_cap_flags_set_vector(PCIDevice *dev, uint8_t vector)
341 {
342     uint8_t *exp_cap = dev->config + dev->exp.exp_cap;
343     assert(vector < 32);
344     pci_word_test_and_clear_mask(exp_cap + PCI_EXP_FLAGS, PCI_EXP_FLAGS_IRQ);
345     pci_word_test_and_set_mask(exp_cap + PCI_EXP_FLAGS,
346                                vector << PCI_EXP_FLAGS_IRQ_SHIFT);
347 }
348 
349 uint8_t pcie_cap_flags_get_vector(PCIDevice *dev)
350 {
351     return (pci_get_word(dev->config + dev->exp.exp_cap + PCI_EXP_FLAGS) &
352             PCI_EXP_FLAGS_IRQ) >> PCI_EXP_FLAGS_IRQ_SHIFT;
353 }
354 
355 void pcie_cap_deverr_init(PCIDevice *dev)
356 {
357     uint32_t pos = dev->exp.exp_cap;
358     pci_long_test_and_set_mask(dev->config + pos + PCI_EXP_DEVCAP,
359                                PCI_EXP_DEVCAP_RBER);
360     pci_long_test_and_set_mask(dev->wmask + pos + PCI_EXP_DEVCTL,
361                                PCI_EXP_DEVCTL_CERE | PCI_EXP_DEVCTL_NFERE |
362                                PCI_EXP_DEVCTL_FERE | PCI_EXP_DEVCTL_URRE);
363     pci_long_test_and_set_mask(dev->w1cmask + pos + PCI_EXP_DEVSTA,
364                                PCI_EXP_DEVSTA_CED | PCI_EXP_DEVSTA_NFED |
365                                PCI_EXP_DEVSTA_FED | PCI_EXP_DEVSTA_URD);
366 }
367 
368 void pcie_cap_deverr_reset(PCIDevice *dev)
369 {
370     uint8_t *devctl = dev->config + dev->exp.exp_cap + PCI_EXP_DEVCTL;
371     pci_long_test_and_clear_mask(devctl,
372                                  PCI_EXP_DEVCTL_CERE | PCI_EXP_DEVCTL_NFERE |
373                                  PCI_EXP_DEVCTL_FERE | PCI_EXP_DEVCTL_URRE);
374 }
375 
376 void pcie_cap_lnkctl_init(PCIDevice *dev)
377 {
378     uint32_t pos = dev->exp.exp_cap;
379     pci_long_test_and_set_mask(dev->wmask + pos + PCI_EXP_LNKCTL,
380                                PCI_EXP_LNKCTL_CCC | PCI_EXP_LNKCTL_ES);
381 }
382 
383 void pcie_cap_lnkctl_reset(PCIDevice *dev)
384 {
385     uint8_t *lnkctl = dev->config + dev->exp.exp_cap + PCI_EXP_LNKCTL;
386     pci_long_test_and_clear_mask(lnkctl,
387                                  PCI_EXP_LNKCTL_CCC | PCI_EXP_LNKCTL_ES);
388 }
389 
390 static void hotplug_event_update_event_status(PCIDevice *dev)
391 {
392     uint32_t pos = dev->exp.exp_cap;
393     uint8_t *exp_cap = dev->config + pos;
394     uint16_t sltctl = pci_get_word(exp_cap + PCI_EXP_SLTCTL);
395     uint16_t sltsta = pci_get_word(exp_cap + PCI_EXP_SLTSTA);
396 
397     dev->exp.hpev_notified = (sltctl & PCI_EXP_SLTCTL_HPIE) &&
398         (sltsta & sltctl & PCI_EXP_HP_EV_SUPPORTED);
399 }
400 
401 static void hotplug_event_notify(PCIDevice *dev)
402 {
403     bool prev = dev->exp.hpev_notified;
404 
405     hotplug_event_update_event_status(dev);
406 
407     if (prev == dev->exp.hpev_notified) {
408         return;
409     }
410 
411     /* Note: the logic above does not take into account whether interrupts
412      * are masked. The result is that interrupt will be sent when it is
413      * subsequently unmasked. This appears to be legal: Section 6.7.3.4:
414      * The Port may optionally send an MSI when there are hot-plug events that
415      * occur while interrupt generation is disabled, and interrupt generation is
416      * subsequently enabled. */
417     if (msix_enabled(dev)) {
418         msix_notify(dev, pcie_cap_flags_get_vector(dev));
419     } else if (msi_enabled(dev)) {
420         msi_notify(dev, pcie_cap_flags_get_vector(dev));
421     } else if (pci_intx(dev) != -1) {
422         pci_set_irq(dev, dev->exp.hpev_notified);
423     }
424 }
425 
426 static void hotplug_event_clear(PCIDevice *dev)
427 {
428     hotplug_event_update_event_status(dev);
429     if (!msix_enabled(dev) && !msi_enabled(dev) && pci_intx(dev) != -1 &&
430         !dev->exp.hpev_notified) {
431         pci_irq_deassert(dev);
432     }
433 }
434 
435 void pcie_cap_slot_enable_power(PCIDevice *dev)
436 {
437     uint8_t *exp_cap = dev->config + dev->exp.exp_cap;
438     uint32_t sltcap = pci_get_long(exp_cap + PCI_EXP_SLTCAP);
439 
440     if (sltcap & PCI_EXP_SLTCAP_PCP) {
441         pci_word_test_and_clear_mask(exp_cap + PCI_EXP_SLTCTL,
442                                      PCI_EXP_SLTCTL_PCC);
443     }
444 }
445 
446 static void pcie_set_power_device(PCIBus *bus, PCIDevice *dev, void *opaque)
447 {
448     bool *power = opaque;
449 
450     pci_set_power(dev, *power);
451 }
452 
453 static void pcie_cap_update_power(PCIDevice *hotplug_dev)
454 {
455     uint8_t *exp_cap = hotplug_dev->config + hotplug_dev->exp.exp_cap;
456     PCIBus *sec_bus = pci_bridge_get_sec_bus(PCI_BRIDGE(hotplug_dev));
457     uint32_t sltcap = pci_get_long(exp_cap + PCI_EXP_SLTCAP);
458     uint16_t sltctl = pci_get_word(exp_cap + PCI_EXP_SLTCTL);
459     bool power = true;
460 
461     if (sltcap & PCI_EXP_SLTCAP_PCP) {
462         power = (sltctl & PCI_EXP_SLTCTL_PCC) == PCI_EXP_SLTCTL_PWR_ON;
463         /* Don't we need to check also (sltctl & PCI_EXP_SLTCTL_PIC) ? */
464     }
465 
466     pci_for_each_device(sec_bus, pci_bus_num(sec_bus),
467                         pcie_set_power_device, &power);
468 }
469 
470 /*
471  * A PCI Express Hot-Plug Event has occurred, so update slot status register
472  * and notify OS of the event if necessary.
473  *
474  * 6.7.3 PCI Express Hot-Plug Events
475  * 6.7.3.4 Software Notification of Hot-Plug Events
476  */
477 static void pcie_cap_slot_event(PCIDevice *dev, PCIExpressHotPlugEvent event)
478 {
479     /* Minor optimization: if nothing changed - no event is needed. */
480     if (pci_word_test_and_set_mask(dev->config + dev->exp.exp_cap +
481                                    PCI_EXP_SLTSTA, event) == event) {
482         return;
483     }
484     hotplug_event_notify(dev);
485 }
486 
487 static void pcie_cap_slot_plug_common(PCIDevice *hotplug_dev, DeviceState *dev,
488                                       Error **errp)
489 {
490     uint8_t *exp_cap = hotplug_dev->config + hotplug_dev->exp.exp_cap;
491     uint16_t sltsta = pci_get_word(exp_cap + PCI_EXP_SLTSTA);
492 
493     PCIE_DEV_PRINTF(PCI_DEVICE(dev), "hotplug state: 0x%x\n", sltsta);
494     if (sltsta & PCI_EXP_SLTSTA_EIS) {
495         /* the slot is electromechanically locked.
496          * This error is propagated up to qdev and then to HMP/QMP.
497          */
498         error_setg_errno(errp, EBUSY, "slot is electromechanically locked");
499     }
500 }
501 
502 void pcie_cap_slot_pre_plug_cb(HotplugHandler *hotplug_dev, DeviceState *dev,
503                                Error **errp)
504 {
505     PCIDevice *hotplug_pdev = PCI_DEVICE(hotplug_dev);
506     uint8_t *exp_cap = hotplug_pdev->config + hotplug_pdev->exp.exp_cap;
507     uint32_t sltcap = pci_get_word(exp_cap + PCI_EXP_SLTCAP);
508 
509     /* Check if hot-plug is disabled on the slot */
510     if (dev->hotplugged && (sltcap & PCI_EXP_SLTCAP_HPC) == 0) {
511         error_setg(errp, "Hot-plug failed: unsupported by the port device '%s'",
512                          DEVICE(hotplug_pdev)->id);
513         return;
514     }
515 
516     pcie_cap_slot_plug_common(PCI_DEVICE(hotplug_dev), dev, errp);
517 }
518 
519 void pcie_cap_slot_plug_cb(HotplugHandler *hotplug_dev, DeviceState *dev,
520                            Error **errp)
521 {
522     PCIDevice *hotplug_pdev = PCI_DEVICE(hotplug_dev);
523     uint8_t *exp_cap = hotplug_pdev->config + hotplug_pdev->exp.exp_cap;
524     PCIDevice *pci_dev = PCI_DEVICE(dev);
525     uint32_t lnkcap = pci_get_long(exp_cap + PCI_EXP_LNKCAP);
526 
527     if (pci_is_vf(pci_dev)) {
528         /* Virtual function cannot be physically disconnected */
529         return;
530     }
531 
532     /* Don't send event when device is enabled during qemu machine creation:
533      * it is present on boot, no hotplug event is necessary. We do send an
534      * event when the device is disabled later. */
535     if (!dev->hotplugged) {
536         pci_word_test_and_set_mask(exp_cap + PCI_EXP_SLTSTA,
537                                    PCI_EXP_SLTSTA_PDS);
538         if (pci_dev->cap_present & QEMU_PCIE_LNKSTA_DLLLA ||
539             (lnkcap & PCI_EXP_LNKCAP_DLLLARC)) {
540             pci_word_test_and_set_mask(exp_cap + PCI_EXP_LNKSTA,
541                                        PCI_EXP_LNKSTA_DLLLA);
542         }
543         pcie_cap_update_power(hotplug_pdev);
544         return;
545     }
546 
547     /* To enable multifunction hot-plug, we just ensure the function
548      * 0 added last. When function 0 is added, we set the sltsta and
549      * inform OS via event notification.
550      */
551     if (pci_get_function_0(pci_dev)) {
552         pci_word_test_and_set_mask(exp_cap + PCI_EXP_SLTSTA,
553                                    PCI_EXP_SLTSTA_PDS);
554         if (pci_dev->cap_present & QEMU_PCIE_LNKSTA_DLLLA ||
555             (lnkcap & PCI_EXP_LNKCAP_DLLLARC)) {
556             pci_word_test_and_set_mask(exp_cap + PCI_EXP_LNKSTA,
557                                        PCI_EXP_LNKSTA_DLLLA);
558         }
559         pcie_cap_slot_event(hotplug_pdev,
560                             PCI_EXP_HP_EV_PDC | PCI_EXP_HP_EV_ABP);
561         pcie_cap_update_power(hotplug_pdev);
562     }
563 }
564 
565 void pcie_cap_slot_unplug_cb(HotplugHandler *hotplug_dev, DeviceState *dev,
566                              Error **errp)
567 {
568     qdev_unrealize(dev);
569 }
570 
571 static void pcie_unplug_device(PCIBus *bus, PCIDevice *dev, void *opaque)
572 {
573     HotplugHandler *hotplug_ctrl = qdev_get_hotplug_handler(DEVICE(dev));
574 
575     if (dev->partially_hotplugged) {
576         dev->qdev.pending_deleted_event = false;
577         return;
578     }
579     hotplug_handler_unplug(hotplug_ctrl, DEVICE(dev), &error_abort);
580     object_unparent(OBJECT(dev));
581 }
582 
583 static void pcie_cap_slot_do_unplug(PCIDevice *dev)
584 {
585     PCIBus *sec_bus = pci_bridge_get_sec_bus(PCI_BRIDGE(dev));
586     uint8_t *exp_cap = dev->config + dev->exp.exp_cap;
587     uint32_t lnkcap = pci_get_long(exp_cap + PCI_EXP_LNKCAP);
588 
589     pci_for_each_device_under_bus(sec_bus, pcie_unplug_device, NULL);
590 
591     pci_word_test_and_clear_mask(exp_cap + PCI_EXP_SLTSTA,
592                                  PCI_EXP_SLTSTA_PDS);
593     if (dev->cap_present & QEMU_PCIE_LNKSTA_DLLLA ||
594         (lnkcap & PCI_EXP_LNKCAP_DLLLARC)) {
595         pci_word_test_and_clear_mask(exp_cap + PCI_EXP_LNKSTA,
596                                      PCI_EXP_LNKSTA_DLLLA);
597     }
598     pci_word_test_and_set_mask(exp_cap + PCI_EXP_SLTSTA,
599                                PCI_EXP_SLTSTA_PDC);
600 }
601 
602 void pcie_cap_slot_unplug_request_cb(HotplugHandler *hotplug_dev,
603                                      DeviceState *dev, Error **errp)
604 {
605     Error *local_err = NULL;
606     PCIDevice *pci_dev = PCI_DEVICE(dev);
607     PCIBus *bus = pci_get_bus(pci_dev);
608     PCIDevice *hotplug_pdev = PCI_DEVICE(hotplug_dev);
609     uint8_t *exp_cap = hotplug_pdev->config + hotplug_pdev->exp.exp_cap;
610     uint32_t sltcap = pci_get_word(exp_cap + PCI_EXP_SLTCAP);
611     uint16_t sltctl = pci_get_word(exp_cap + PCI_EXP_SLTCTL);
612 
613     /* Check if hot-unplug is disabled on the slot */
614     if ((sltcap & PCI_EXP_SLTCAP_HPC) == 0) {
615         error_setg(errp, "Hot-unplug failed: "
616                          "unsupported by the port device '%s'",
617                          DEVICE(hotplug_pdev)->id);
618         return;
619     }
620 
621     pcie_cap_slot_plug_common(hotplug_pdev, dev, &local_err);
622     if (local_err) {
623         error_propagate(errp, local_err);
624         return;
625     }
626 
627     if ((sltctl & PCI_EXP_SLTCTL_PIC) == PCI_EXP_SLTCTL_PWR_IND_BLINK) {
628         error_setg(errp, "Hot-unplug failed: "
629                    "guest is busy (power indicator blinking)");
630         return;
631     }
632 
633     dev->pending_deleted_event = true;
634     dev->pending_deleted_expires_ms =
635         qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) + 5000; /* 5 secs */
636 
637     /* In case user cancel the operation of multi-function hot-add,
638      * remove the function that is unexposed to guest individually,
639      * without interaction with guest.
640      */
641     if (pci_dev->devfn &&
642         !bus->devices[0]) {
643         pcie_unplug_device(bus, pci_dev, NULL);
644 
645         return;
646     }
647 
648     if (pcie_sltctl_powered_off(sltctl)) {
649         /* slot is powered off -> unplug without round-trip to the guest */
650         pcie_cap_slot_do_unplug(hotplug_pdev);
651         hotplug_event_notify(hotplug_pdev);
652         pci_word_test_and_clear_mask(exp_cap + PCI_EXP_SLTSTA,
653                                      PCI_EXP_SLTSTA_ABP);
654         return;
655     }
656 
657     pcie_cap_slot_push_attention_button(hotplug_pdev);
658 }
659 
660 /* pci express slot for pci express root/downstream port
661    PCI express capability slot registers */
662 void pcie_cap_slot_init(PCIDevice *dev, PCIESlot *s)
663 {
664     uint32_t pos = dev->exp.exp_cap;
665 
666     pci_word_test_and_set_mask(dev->config + pos + PCI_EXP_FLAGS,
667                                PCI_EXP_FLAGS_SLOT);
668 
669     pci_long_test_and_clear_mask(dev->config + pos + PCI_EXP_SLTCAP,
670                                  ~PCI_EXP_SLTCAP_PSN);
671     pci_long_test_and_set_mask(dev->config + pos + PCI_EXP_SLTCAP,
672                                (s->slot << PCI_EXP_SLTCAP_PSN_SHIFT) |
673                                PCI_EXP_SLTCAP_EIP |
674                                PCI_EXP_SLTCAP_PIP |
675                                PCI_EXP_SLTCAP_AIP |
676                                PCI_EXP_SLTCAP_ABP);
677 
678     /*
679      * Expose native hot-plug on all bridges if hot-plug is enabled on the slot.
680      * (unless broken 6.1 ABI is enforced for compat reasons)
681      */
682     if (s->hotplug &&
683         (!s->hide_native_hotplug_cap || DEVICE(dev)->hotplugged)) {
684         pci_long_test_and_set_mask(dev->config + pos + PCI_EXP_SLTCAP,
685                                    PCI_EXP_SLTCAP_HPS |
686                                    PCI_EXP_SLTCAP_HPC);
687     }
688 
689     if (dev->cap_present & QEMU_PCIE_SLTCAP_PCP) {
690         pci_long_test_and_set_mask(dev->config + pos + PCI_EXP_SLTCAP,
691                                    PCI_EXP_SLTCAP_PCP);
692         pci_word_test_and_clear_mask(dev->config + pos + PCI_EXP_SLTCTL,
693                                      PCI_EXP_SLTCTL_PCC);
694         pci_word_test_and_set_mask(dev->wmask + pos + PCI_EXP_SLTCTL,
695                                    PCI_EXP_SLTCTL_PCC);
696     }
697 
698     pci_word_test_and_clear_mask(dev->config + pos + PCI_EXP_SLTCTL,
699                                  PCI_EXP_SLTCTL_PIC |
700                                  PCI_EXP_SLTCTL_AIC);
701     pci_word_test_and_set_mask(dev->config + pos + PCI_EXP_SLTCTL,
702                                PCI_EXP_SLTCTL_PWR_IND_OFF |
703                                PCI_EXP_SLTCTL_ATTN_IND_OFF);
704     pci_word_test_and_set_mask(dev->wmask + pos + PCI_EXP_SLTCTL,
705                                PCI_EXP_SLTCTL_PIC |
706                                PCI_EXP_SLTCTL_AIC |
707                                PCI_EXP_SLTCTL_HPIE |
708                                PCI_EXP_SLTCTL_CCIE |
709                                PCI_EXP_SLTCTL_PDCE |
710                                PCI_EXP_SLTCTL_ABPE);
711     /* Although reading PCI_EXP_SLTCTL_EIC returns always 0,
712      * make the bit writable here in order to detect 1b is written.
713      * pcie_cap_slot_write_config() test-and-clear the bit, so
714      * this bit always returns 0 to the guest.
715      */
716     pci_word_test_and_set_mask(dev->wmask + pos + PCI_EXP_SLTCTL,
717                                PCI_EXP_SLTCTL_EIC);
718 
719     pci_word_test_and_set_mask(dev->w1cmask + pos + PCI_EXP_SLTSTA,
720                                PCI_EXP_HP_EV_SUPPORTED);
721 
722     /* Avoid migration abortion when this device hot-removed by guest */
723     pci_word_test_and_clear_mask(dev->cmask + pos + PCI_EXP_SLTSTA,
724                                  PCI_EXP_SLTSTA_PDS);
725 
726     dev->exp.hpev_notified = false;
727 
728     qbus_set_hotplug_handler(BUS(pci_bridge_get_sec_bus(PCI_BRIDGE(dev))),
729                              OBJECT(dev));
730 }
731 
732 void pcie_cap_slot_reset(PCIDevice *dev)
733 {
734     uint8_t *exp_cap = dev->config + dev->exp.exp_cap;
735     uint8_t port_type = pcie_cap_get_type(dev);
736 
737     assert(port_type == PCI_EXP_TYPE_DOWNSTREAM ||
738            port_type == PCI_EXP_TYPE_ROOT_PORT);
739 
740     PCIE_DEV_PRINTF(dev, "reset\n");
741 
742     pci_word_test_and_clear_mask(exp_cap + PCI_EXP_SLTCTL,
743                                  PCI_EXP_SLTCTL_EIC |
744                                  PCI_EXP_SLTCTL_PIC |
745                                  PCI_EXP_SLTCTL_AIC |
746                                  PCI_EXP_SLTCTL_HPIE |
747                                  PCI_EXP_SLTCTL_CCIE |
748                                  PCI_EXP_SLTCTL_PDCE |
749                                  PCI_EXP_SLTCTL_ABPE);
750     pci_word_test_and_set_mask(exp_cap + PCI_EXP_SLTCTL,
751                                PCI_EXP_SLTCTL_PWR_IND_OFF |
752                                PCI_EXP_SLTCTL_ATTN_IND_OFF);
753 
754     if (dev->cap_present & QEMU_PCIE_SLTCAP_PCP) {
755         /* Downstream ports enforce device number 0. */
756         bool populated = pci_bridge_get_sec_bus(PCI_BRIDGE(dev))->devices[0];
757         uint16_t pic;
758 
759         if (populated) {
760             pci_word_test_and_clear_mask(exp_cap + PCI_EXP_SLTCTL,
761                                          PCI_EXP_SLTCTL_PCC);
762         } else {
763             pci_word_test_and_set_mask(exp_cap + PCI_EXP_SLTCTL,
764                                        PCI_EXP_SLTCTL_PCC);
765         }
766 
767         pic = populated ?
768                 PCI_EXP_SLTCTL_PWR_IND_ON : PCI_EXP_SLTCTL_PWR_IND_OFF;
769         pci_word_test_and_set_mask(exp_cap + PCI_EXP_SLTCTL, pic);
770     }
771 
772     pci_word_test_and_clear_mask(exp_cap + PCI_EXP_SLTSTA,
773                                  PCI_EXP_SLTSTA_EIS |/* on reset,
774                                                         the lock is released */
775                                  PCI_EXP_SLTSTA_CC |
776                                  PCI_EXP_SLTSTA_PDC |
777                                  PCI_EXP_SLTSTA_ABP);
778 
779     pcie_cap_update_power(dev);
780     hotplug_event_update_event_status(dev);
781 }
782 
783 void pcie_cap_slot_get(PCIDevice *dev, uint16_t *slt_ctl, uint16_t *slt_sta)
784 {
785     uint32_t pos = dev->exp.exp_cap;
786     uint8_t *exp_cap = dev->config + pos;
787     *slt_ctl = pci_get_word(exp_cap + PCI_EXP_SLTCTL);
788     *slt_sta = pci_get_word(exp_cap + PCI_EXP_SLTSTA);
789 }
790 
791 static void find_child_fn(PCIBus *bus, PCIDevice *dev, void *opaque)
792 {
793     PCIDevice **child = opaque;
794 
795     if (!*child) {
796         *child = dev;
797     }
798 }
799 
800 /*
801  * Returns the plugged device or first function of multifunction plugged device
802  */
803 static PCIDevice *pcie_cap_slot_find_child(PCIDevice *dev)
804 {
805     PCIBus *sec_bus = pci_bridge_get_sec_bus(PCI_BRIDGE(dev));
806     PCIDevice *child = NULL;
807 
808     pci_for_each_device(sec_bus, pci_bus_num(sec_bus), find_child_fn, &child);
809 
810     return child;
811 }
812 
813 void pcie_cap_slot_write_config(PCIDevice *dev,
814                                 uint16_t old_slt_ctl, uint16_t old_slt_sta,
815                                 uint32_t addr, uint32_t val, int len)
816 {
817     uint32_t pos = dev->exp.exp_cap;
818     uint8_t *exp_cap = dev->config + pos;
819     uint16_t sltsta = pci_get_word(exp_cap + PCI_EXP_SLTSTA);
820 
821     if (ranges_overlap(addr, len, pos + PCI_EXP_SLTSTA, 2)) {
822         /*
823          * Guests tend to clears all bits during init.
824          * If they clear bits that weren't set this is racy and will lose events:
825          * not a big problem for manual button presses, but a problem for us.
826          * As a work-around, detect this and revert status to what it was
827          * before the write.
828          *
829          * Note: in theory this can be detected as a duplicate button press
830          * which cancels the previous press. Does not seem to happen in
831          * practice as guests seem to only have this bug during init.
832          */
833 #define PCIE_SLOT_EVENTS (PCI_EXP_SLTSTA_ABP | PCI_EXP_SLTSTA_PFD | \
834                           PCI_EXP_SLTSTA_MRLSC | PCI_EXP_SLTSTA_PDC | \
835                           PCI_EXP_SLTSTA_CC)
836 
837         if (val & ~old_slt_sta & PCIE_SLOT_EVENTS) {
838             sltsta = (sltsta & ~PCIE_SLOT_EVENTS) | (old_slt_sta & PCIE_SLOT_EVENTS);
839             pci_set_word(exp_cap + PCI_EXP_SLTSTA, sltsta);
840         }
841         hotplug_event_clear(dev);
842     }
843 
844     if (!ranges_overlap(addr, len, pos + PCI_EXP_SLTCTL, 2)) {
845         return;
846     }
847 
848     if (pci_word_test_and_clear_mask(exp_cap + PCI_EXP_SLTCTL,
849                                      PCI_EXP_SLTCTL_EIC)) {
850         sltsta ^= PCI_EXP_SLTSTA_EIS; /* toggle PCI_EXP_SLTSTA_EIS bit */
851         pci_set_word(exp_cap + PCI_EXP_SLTSTA, sltsta);
852         PCIE_DEV_PRINTF(dev, "PCI_EXP_SLTCTL_EIC: "
853                         "sltsta -> 0x%02"PRIx16"\n",
854                         sltsta);
855     }
856 
857     if (trace_event_get_state_backends(TRACE_PCIE_CAP_SLOT_WRITE_CONFIG)) {
858         DeviceState *parent = DEVICE(dev);
859         DeviceState *child = DEVICE(pcie_cap_slot_find_child(dev));
860 
861         trace_pcie_cap_slot_write_config(
862             parent->canonical_path,
863             child ? child->canonical_path : "no-child",
864             (sltsta & PCI_EXP_SLTSTA_PDS) ? "present" : "not present",
865             pcie_led_state_to_str(old_slt_ctl & PCI_EXP_SLTCTL_PIC),
866             pcie_led_state_to_str(val & PCI_EXP_SLTCTL_PIC),
867             pcie_led_state_to_str(old_slt_ctl & PCI_EXP_SLTCTL_AIC),
868             pcie_led_state_to_str(val & PCI_EXP_SLTCTL_AIC),
869             (old_slt_ctl & PCI_EXP_SLTCTL_PWR_OFF) ? "off" : "on",
870             (val & PCI_EXP_SLTCTL_PWR_OFF) ? "off" : "on");
871     }
872 
873     /*
874      * If the slot is populated, power indicator is off and power
875      * controller is off, it is safe to detach the devices.
876      *
877      * Note: don't detach if condition was already true:
878      * this is a work around for guests that overwrite
879      * control of powered off slots before powering them on.
880      */
881     if ((sltsta & PCI_EXP_SLTSTA_PDS) && pcie_sltctl_powered_off(val) &&
882         !pcie_sltctl_powered_off(old_slt_ctl))
883     {
884         pcie_cap_slot_do_unplug(dev);
885     }
886     pcie_cap_update_power(dev);
887 
888     hotplug_event_notify(dev);
889 
890     /*
891      * 6.7.3.2 Command Completed Events
892      *
893      * Software issues a command to a hot-plug capable Downstream Port by
894      * issuing a write transaction that targets any portion of the Port’s Slot
895      * Control register. A single write to the Slot Control register is
896      * considered to be a single command, even if the write affects more than
897      * one field in the Slot Control register. In response to this transaction,
898      * the Port must carry out the requested actions and then set the
899      * associated status field for the command completed event. */
900 
901     /* Real hardware might take a while to complete requested command because
902      * physical movement would be involved like locking the electromechanical
903      * lock.  However in our case, command is completed instantaneously above,
904      * so send a command completion event right now.
905      */
906     pcie_cap_slot_event(dev, PCI_EXP_HP_EV_CCI);
907 }
908 
909 int pcie_cap_slot_post_load(void *opaque, int version_id)
910 {
911     PCIDevice *dev = opaque;
912     hotplug_event_update_event_status(dev);
913     pcie_cap_update_power(dev);
914     return 0;
915 }
916 
917 void pcie_cap_slot_push_attention_button(PCIDevice *dev)
918 {
919     pcie_cap_slot_event(dev, PCI_EXP_HP_EV_ABP);
920 }
921 
922 /* root control/capabilities/status. PME isn't emulated for now */
923 void pcie_cap_root_init(PCIDevice *dev)
924 {
925     pci_set_word(dev->wmask + dev->exp.exp_cap + PCI_EXP_RTCTL,
926                  PCI_EXP_RTCTL_SECEE | PCI_EXP_RTCTL_SENFEE |
927                  PCI_EXP_RTCTL_SEFEE);
928 }
929 
930 void pcie_cap_root_reset(PCIDevice *dev)
931 {
932     pci_set_word(dev->config + dev->exp.exp_cap + PCI_EXP_RTCTL, 0);
933 }
934 
935 /* function level reset(FLR) */
936 void pcie_cap_flr_init(PCIDevice *dev)
937 {
938     pci_long_test_and_set_mask(dev->config + dev->exp.exp_cap + PCI_EXP_DEVCAP,
939                                PCI_EXP_DEVCAP_FLR);
940 
941     /* Although reading BCR_FLR returns always 0,
942      * the bit is made writable here in order to detect the 1b is written
943      * pcie_cap_flr_write_config() test-and-clear the bit, so
944      * this bit always returns 0 to the guest.
945      */
946     pci_word_test_and_set_mask(dev->wmask + dev->exp.exp_cap + PCI_EXP_DEVCTL,
947                                PCI_EXP_DEVCTL_BCR_FLR);
948 }
949 
950 void pcie_cap_flr_write_config(PCIDevice *dev,
951                                uint32_t addr, uint32_t val, int len)
952 {
953     uint8_t *devctl = dev->config + dev->exp.exp_cap + PCI_EXP_DEVCTL;
954     if (pci_get_word(devctl) & PCI_EXP_DEVCTL_BCR_FLR) {
955         /* Clear PCI_EXP_DEVCTL_BCR_FLR after invoking the reset handler
956            so the handler can detect FLR by looking at this bit. */
957         pci_device_reset(dev);
958         pci_word_test_and_clear_mask(devctl, PCI_EXP_DEVCTL_BCR_FLR);
959     }
960 }
961 
962 /* Alternative Routing-ID Interpretation (ARI)
963  * forwarding support for root and downstream ports
964  */
965 void pcie_cap_arifwd_init(PCIDevice *dev)
966 {
967     uint32_t pos = dev->exp.exp_cap;
968     pci_long_test_and_set_mask(dev->config + pos + PCI_EXP_DEVCAP2,
969                                PCI_EXP_DEVCAP2_ARI);
970     pci_long_test_and_set_mask(dev->wmask + pos + PCI_EXP_DEVCTL2,
971                                PCI_EXP_DEVCTL2_ARI);
972 }
973 
974 void pcie_cap_arifwd_reset(PCIDevice *dev)
975 {
976     uint8_t *devctl2 = dev->config + dev->exp.exp_cap + PCI_EXP_DEVCTL2;
977     pci_long_test_and_clear_mask(devctl2, PCI_EXP_DEVCTL2_ARI);
978 }
979 
980 bool pcie_cap_is_arifwd_enabled(const PCIDevice *dev)
981 {
982     if (!pci_is_express(dev)) {
983         return false;
984     }
985     if (!dev->exp.exp_cap) {
986         return false;
987     }
988 
989     return pci_get_long(dev->config + dev->exp.exp_cap + PCI_EXP_DEVCTL2) &
990         PCI_EXP_DEVCTL2_ARI;
991 }
992 
993 /**************************************************************************
994  * pci express extended capability list management functions
995  * uint16_t ext_cap_id (16 bit)
996  * uint8_t cap_ver (4 bit)
997  * uint16_t cap_offset (12 bit)
998  * uint16_t ext_cap_size
999  */
1000 
1001 /* Passing a cap_id value > 0xffff will return 0 and put end of list in prev */
1002 static uint16_t pcie_find_capability_list(PCIDevice *dev, uint32_t cap_id,
1003                                           uint16_t *prev_p)
1004 {
1005     uint16_t prev = 0;
1006     uint16_t next;
1007     uint32_t header = pci_get_long(dev->config + PCI_CONFIG_SPACE_SIZE);
1008 
1009     if (!header) {
1010         /* no extended capability */
1011         next = 0;
1012         goto out;
1013     }
1014     for (next = PCI_CONFIG_SPACE_SIZE; next;
1015          prev = next, next = PCI_EXT_CAP_NEXT(header)) {
1016 
1017         assert(next >= PCI_CONFIG_SPACE_SIZE);
1018         assert(next <= PCIE_CONFIG_SPACE_SIZE - 8);
1019 
1020         header = pci_get_long(dev->config + next);
1021         if (PCI_EXT_CAP_ID(header) == cap_id) {
1022             break;
1023         }
1024     }
1025 
1026 out:
1027     if (prev_p) {
1028         *prev_p = prev;
1029     }
1030     return next;
1031 }
1032 
1033 uint16_t pcie_find_capability(PCIDevice *dev, uint16_t cap_id)
1034 {
1035     return pcie_find_capability_list(dev, cap_id, NULL);
1036 }
1037 
1038 static void pcie_ext_cap_set_next(PCIDevice *dev, uint16_t pos, uint16_t next)
1039 {
1040     uint32_t header = pci_get_long(dev->config + pos);
1041     assert(!(next & (PCI_EXT_CAP_ALIGN - 1)));
1042     header = (header & ~PCI_EXT_CAP_NEXT_MASK) |
1043         ((next << PCI_EXT_CAP_NEXT_SHIFT) & PCI_EXT_CAP_NEXT_MASK);
1044     pci_set_long(dev->config + pos, header);
1045 }
1046 
1047 /*
1048  * Caller must supply valid (offset, size) such that the range wouldn't
1049  * overlap with other capability or other registers.
1050  * This function doesn't check it.
1051  */
1052 void pcie_add_capability(PCIDevice *dev,
1053                          uint16_t cap_id, uint8_t cap_ver,
1054                          uint16_t offset, uint16_t size)
1055 {
1056     assert(offset >= PCI_CONFIG_SPACE_SIZE);
1057     assert(offset < (uint16_t)(offset + size));
1058     assert((uint16_t)(offset + size) <= PCIE_CONFIG_SPACE_SIZE);
1059     assert(size >= 8);
1060     assert(pci_is_express(dev));
1061 
1062     if (offset != PCI_CONFIG_SPACE_SIZE) {
1063         uint16_t prev;
1064 
1065         /*
1066          * 0xffffffff is not a valid cap id (it's a 16 bit field). use
1067          * internally to find the last capability in the linked list.
1068          */
1069         pcie_find_capability_list(dev, 0xffffffff, &prev);
1070         assert(prev >= PCI_CONFIG_SPACE_SIZE);
1071         pcie_ext_cap_set_next(dev, prev, offset);
1072     }
1073     pci_set_long(dev->config + offset, PCI_EXT_CAP(cap_id, cap_ver, 0));
1074 
1075     /* Make capability read-only by default */
1076     memset(dev->wmask + offset, 0, size);
1077     memset(dev->w1cmask + offset, 0, size);
1078     /* Check capability by default */
1079     memset(dev->cmask + offset, 0xFF, size);
1080 }
1081 
1082 /*
1083  * Sync the PCIe Link Status negotiated speed and width of a bridge with the
1084  * downstream device.  If downstream device is not present, re-write with the
1085  * Link Capability fields.  If downstream device reports invalid width or
1086  * speed, replace with minimum values (LnkSta fields are RsvdZ on VFs but such
1087  * values interfere with PCIe native hotplug detecting new devices).  Limit
1088  * width and speed to bridge capabilities for compatibility.  Use config_read
1089  * to access the downstream device since it could be an assigned device with
1090  * volatile link information.
1091  */
1092 void pcie_sync_bridge_lnk(PCIDevice *bridge_dev)
1093 {
1094     PCIBridge *br = PCI_BRIDGE(bridge_dev);
1095     PCIBus *bus = pci_bridge_get_sec_bus(br);
1096     PCIDevice *target = bus->devices[0];
1097     uint8_t *exp_cap = bridge_dev->config + bridge_dev->exp.exp_cap;
1098     uint16_t lnksta, lnkcap = pci_get_word(exp_cap + PCI_EXP_LNKCAP);
1099 
1100     if (!target || !target->exp.exp_cap) {
1101         lnksta = lnkcap;
1102     } else {
1103         lnksta = target->config_read(target,
1104                                      target->exp.exp_cap + PCI_EXP_LNKSTA,
1105                                      sizeof(lnksta));
1106 
1107         if ((lnksta & PCI_EXP_LNKSTA_NLW) > (lnkcap & PCI_EXP_LNKCAP_MLW)) {
1108             lnksta &= ~PCI_EXP_LNKSTA_NLW;
1109             lnksta |= lnkcap & PCI_EXP_LNKCAP_MLW;
1110         } else if (!(lnksta & PCI_EXP_LNKSTA_NLW)) {
1111             lnksta |= QEMU_PCI_EXP_LNKSTA_NLW(QEMU_PCI_EXP_LNK_X1);
1112         }
1113 
1114         if ((lnksta & PCI_EXP_LNKSTA_CLS) > (lnkcap & PCI_EXP_LNKCAP_SLS)) {
1115             lnksta &= ~PCI_EXP_LNKSTA_CLS;
1116             lnksta |= lnkcap & PCI_EXP_LNKCAP_SLS;
1117         } else if (!(lnksta & PCI_EXP_LNKSTA_CLS)) {
1118             lnksta |= QEMU_PCI_EXP_LNKSTA_CLS(QEMU_PCI_EXP_LNK_2_5GT);
1119         }
1120     }
1121 
1122     pci_word_test_and_clear_mask(exp_cap + PCI_EXP_LNKSTA,
1123                                  PCI_EXP_LNKSTA_CLS | PCI_EXP_LNKSTA_NLW);
1124     pci_word_test_and_set_mask(exp_cap + PCI_EXP_LNKSTA, lnksta &
1125                                (PCI_EXP_LNKSTA_CLS | PCI_EXP_LNKSTA_NLW));
1126 }
1127 
1128 /**************************************************************************
1129  * pci express extended capability helper functions
1130  */
1131 
1132 /* ARI */
1133 void pcie_ari_init(PCIDevice *dev, uint16_t offset)
1134 {
1135     uint16_t nextfn = dev->cap_present & QEMU_PCIE_ARI_NEXTFN_1 ? 1 : 0;
1136 
1137     pcie_add_capability(dev, PCI_EXT_CAP_ID_ARI, PCI_ARI_VER,
1138                         offset, PCI_ARI_SIZEOF);
1139     pci_set_long(dev->config + offset + PCI_ARI_CAP, (nextfn & 0xff) << 8);
1140 }
1141 
1142 void pcie_dev_ser_num_init(PCIDevice *dev, uint16_t offset, uint64_t ser_num)
1143 {
1144     static const int pci_dsn_ver = 1;
1145     static const int pci_dsn_cap = 4;
1146 
1147     pcie_add_capability(dev, PCI_EXT_CAP_ID_DSN, pci_dsn_ver, offset,
1148                         PCI_EXT_CAP_DSN_SIZEOF);
1149     pci_set_quad(dev->config + offset + pci_dsn_cap, ser_num);
1150 }
1151 
1152 void pcie_ats_init(PCIDevice *dev, uint16_t offset, bool aligned)
1153 {
1154     pcie_add_capability(dev, PCI_EXT_CAP_ID_ATS, 0x1,
1155                         offset, PCI_EXT_CAP_ATS_SIZEOF);
1156 
1157     dev->exp.ats_cap = offset;
1158 
1159     /* Invalidate Queue Depth 0 */
1160     if (aligned) {
1161         pci_set_word(dev->config + offset + PCI_ATS_CAP,
1162                      PCI_ATS_CAP_PAGE_ALIGNED);
1163     }
1164     /* STU 0, Disabled by default */
1165     pci_set_word(dev->config + offset + PCI_ATS_CTRL, 0);
1166 
1167     pci_set_word(dev->wmask + dev->exp.ats_cap + PCI_ATS_CTRL, 0x800f);
1168 }
1169 
1170 /* ACS (Access Control Services) */
1171 void pcie_acs_init(PCIDevice *dev, uint16_t offset)
1172 {
1173     bool is_downstream = pci_is_express_downstream_port(dev);
1174     uint16_t cap_bits = 0;
1175 
1176     /* For endpoints, only multifunction devs may have an ACS capability: */
1177     assert(is_downstream ||
1178            (dev->cap_present & QEMU_PCI_CAP_MULTIFUNCTION) ||
1179            PCI_FUNC(dev->devfn));
1180 
1181     pcie_add_capability(dev, PCI_EXT_CAP_ID_ACS, PCI_ACS_VER, offset,
1182                         PCI_ACS_SIZEOF);
1183     dev->exp.acs_cap = offset;
1184 
1185     if (is_downstream) {
1186         /*
1187          * Downstream ports must implement SV, TB, RR, CR, UF, and DT (with
1188          * caveats on the latter four that we ignore for simplicity).
1189          * Endpoints may also implement a subset of ACS capabilities,
1190          * but these are optional if the endpoint does not support
1191          * peer-to-peer between functions and thus omitted here.
1192          */
1193         cap_bits = PCI_ACS_SV | PCI_ACS_TB | PCI_ACS_RR |
1194             PCI_ACS_CR | PCI_ACS_UF | PCI_ACS_DT;
1195     }
1196 
1197     pci_set_word(dev->config + offset + PCI_ACS_CAP, cap_bits);
1198     pci_set_word(dev->wmask + offset + PCI_ACS_CTRL, cap_bits);
1199 }
1200 
1201 void pcie_acs_reset(PCIDevice *dev)
1202 {
1203     if (dev->exp.acs_cap) {
1204         pci_set_word(dev->config + dev->exp.acs_cap + PCI_ACS_CTRL, 0);
1205     }
1206 }
1207