xref: /openbmc/qemu/hw/ppc/spapr_pci.c (revision 1d300b5f)
1 /*
2  * QEMU sPAPR PCI host originated from Uninorth PCI host
3  *
4  * Copyright (c) 2011 Alexey Kardashevskiy, IBM Corporation.
5  * Copyright (C) 2011 David Gibson, IBM Corporation.
6  *
7  * Permission is hereby granted, free of charge, to any person obtaining a copy
8  * of this software and associated documentation files (the "Software"), to deal
9  * in the Software without restriction, including without limitation the rights
10  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
11  * copies of the Software, and to permit persons to whom the Software is
12  * furnished to do so, subject to the following conditions:
13  *
14  * The above copyright notice and this permission notice shall be included in
15  * all copies or substantial portions of the Software.
16  *
17  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
18  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
19  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
20  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
21  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
22  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
23  * THE SOFTWARE.
24  */
25 #include "hw/hw.h"
26 #include "hw/pci/pci.h"
27 #include "hw/pci/msi.h"
28 #include "hw/pci/msix.h"
29 #include "hw/pci/pci_host.h"
30 #include "hw/ppc/spapr.h"
31 #include "hw/pci-host/spapr.h"
32 #include "exec/address-spaces.h"
33 #include <libfdt.h>
34 #include "trace.h"
35 
36 #include "hw/pci/pci_bus.h"
37 
38 /* Copied from the kernel arch/powerpc/platforms/pseries/msi.c */
39 #define RTAS_QUERY_FN           0
40 #define RTAS_CHANGE_FN          1
41 #define RTAS_RESET_FN           2
42 #define RTAS_CHANGE_MSI_FN      3
43 #define RTAS_CHANGE_MSIX_FN     4
44 
45 /* Interrupt types to return on RTAS_CHANGE_* */
46 #define RTAS_TYPE_MSI           1
47 #define RTAS_TYPE_MSIX          2
48 
49 static sPAPRPHBState *find_phb(sPAPREnvironment *spapr, uint64_t buid)
50 {
51     sPAPRPHBState *sphb;
52 
53     QLIST_FOREACH(sphb, &spapr->phbs, list) {
54         if (sphb->buid != buid) {
55             continue;
56         }
57         return sphb;
58     }
59 
60     return NULL;
61 }
62 
63 static PCIDevice *find_dev(sPAPREnvironment *spapr, uint64_t buid,
64                            uint32_t config_addr)
65 {
66     sPAPRPHBState *sphb = find_phb(spapr, buid);
67     PCIHostState *phb = PCI_HOST_BRIDGE(sphb);
68     BusState *bus = BUS(phb->bus);
69     BusChild *kid;
70     int devfn = (config_addr >> 8) & 0xFF;
71 
72     if (!phb) {
73         return NULL;
74     }
75 
76     QTAILQ_FOREACH(kid, &bus->children, sibling) {
77         PCIDevice *dev = (PCIDevice *)kid->child;
78         if (dev->devfn == devfn) {
79             return dev;
80         }
81     }
82 
83     return NULL;
84 }
85 
86 static uint32_t rtas_pci_cfgaddr(uint32_t arg)
87 {
88     /* This handles the encoding of extended config space addresses */
89     return ((arg >> 20) & 0xf00) | (arg & 0xff);
90 }
91 
92 static void finish_read_pci_config(sPAPREnvironment *spapr, uint64_t buid,
93                                    uint32_t addr, uint32_t size,
94                                    target_ulong rets)
95 {
96     PCIDevice *pci_dev;
97     uint32_t val;
98 
99     if ((size != 1) && (size != 2) && (size != 4)) {
100         /* access must be 1, 2 or 4 bytes */
101         rtas_st(rets, 0, -1);
102         return;
103     }
104 
105     pci_dev = find_dev(spapr, buid, addr);
106     addr = rtas_pci_cfgaddr(addr);
107 
108     if (!pci_dev || (addr % size) || (addr >= pci_config_size(pci_dev))) {
109         /* Access must be to a valid device, within bounds and
110          * naturally aligned */
111         rtas_st(rets, 0, -1);
112         return;
113     }
114 
115     val = pci_host_config_read_common(pci_dev, addr,
116                                       pci_config_size(pci_dev), size);
117 
118     rtas_st(rets, 0, 0);
119     rtas_st(rets, 1, val);
120 }
121 
122 static void rtas_ibm_read_pci_config(PowerPCCPU *cpu, sPAPREnvironment *spapr,
123                                      uint32_t token, uint32_t nargs,
124                                      target_ulong args,
125                                      uint32_t nret, target_ulong rets)
126 {
127     uint64_t buid;
128     uint32_t size, addr;
129 
130     if ((nargs != 4) || (nret != 2)) {
131         rtas_st(rets, 0, -1);
132         return;
133     }
134 
135     buid = ((uint64_t)rtas_ld(args, 1) << 32) | rtas_ld(args, 2);
136     size = rtas_ld(args, 3);
137     addr = rtas_ld(args, 0);
138 
139     finish_read_pci_config(spapr, buid, addr, size, rets);
140 }
141 
142 static void rtas_read_pci_config(PowerPCCPU *cpu, sPAPREnvironment *spapr,
143                                  uint32_t token, uint32_t nargs,
144                                  target_ulong args,
145                                  uint32_t nret, target_ulong rets)
146 {
147     uint32_t size, addr;
148 
149     if ((nargs != 2) || (nret != 2)) {
150         rtas_st(rets, 0, -1);
151         return;
152     }
153 
154     size = rtas_ld(args, 1);
155     addr = rtas_ld(args, 0);
156 
157     finish_read_pci_config(spapr, 0, addr, size, rets);
158 }
159 
160 static void finish_write_pci_config(sPAPREnvironment *spapr, uint64_t buid,
161                                     uint32_t addr, uint32_t size,
162                                     uint32_t val, target_ulong rets)
163 {
164     PCIDevice *pci_dev;
165 
166     if ((size != 1) && (size != 2) && (size != 4)) {
167         /* access must be 1, 2 or 4 bytes */
168         rtas_st(rets, 0, -1);
169         return;
170     }
171 
172     pci_dev = find_dev(spapr, buid, addr);
173     addr = rtas_pci_cfgaddr(addr);
174 
175     if (!pci_dev || (addr % size) || (addr >= pci_config_size(pci_dev))) {
176         /* Access must be to a valid device, within bounds and
177          * naturally aligned */
178         rtas_st(rets, 0, -1);
179         return;
180     }
181 
182     pci_host_config_write_common(pci_dev, addr, pci_config_size(pci_dev),
183                                  val, size);
184 
185     rtas_st(rets, 0, 0);
186 }
187 
188 static void rtas_ibm_write_pci_config(PowerPCCPU *cpu, sPAPREnvironment *spapr,
189                                       uint32_t token, uint32_t nargs,
190                                       target_ulong args,
191                                       uint32_t nret, target_ulong rets)
192 {
193     uint64_t buid;
194     uint32_t val, size, addr;
195 
196     if ((nargs != 5) || (nret != 1)) {
197         rtas_st(rets, 0, -1);
198         return;
199     }
200 
201     buid = ((uint64_t)rtas_ld(args, 1) << 32) | rtas_ld(args, 2);
202     val = rtas_ld(args, 4);
203     size = rtas_ld(args, 3);
204     addr = rtas_ld(args, 0);
205 
206     finish_write_pci_config(spapr, buid, addr, size, val, rets);
207 }
208 
209 static void rtas_write_pci_config(PowerPCCPU *cpu, sPAPREnvironment *spapr,
210                                   uint32_t token, uint32_t nargs,
211                                   target_ulong args,
212                                   uint32_t nret, target_ulong rets)
213 {
214     uint32_t val, size, addr;
215 
216     if ((nargs != 3) || (nret != 1)) {
217         rtas_st(rets, 0, -1);
218         return;
219     }
220 
221 
222     val = rtas_ld(args, 2);
223     size = rtas_ld(args, 1);
224     addr = rtas_ld(args, 0);
225 
226     finish_write_pci_config(spapr, 0, addr, size, val, rets);
227 }
228 
229 /*
230  * Find an entry with config_addr or returns the empty one if not found AND
231  * alloc_new is set.
232  * At the moment the msi_table entries are never released so there is
233  * no point to look till the end of the list if we need to find the free entry.
234  */
235 static int spapr_msicfg_find(sPAPRPHBState *phb, uint32_t config_addr,
236                              bool alloc_new)
237 {
238     int i;
239 
240     for (i = 0; i < SPAPR_MSIX_MAX_DEVS; ++i) {
241         if (!phb->msi_table[i].nvec) {
242             break;
243         }
244         if (phb->msi_table[i].config_addr == config_addr) {
245             return i;
246         }
247     }
248     if ((i < SPAPR_MSIX_MAX_DEVS) && alloc_new) {
249         trace_spapr_pci_msi("Allocating new MSI config", i, config_addr);
250         return i;
251     }
252 
253     return -1;
254 }
255 
256 /*
257  * Set MSI/MSIX message data.
258  * This is required for msi_notify()/msix_notify() which
259  * will write at the addresses via spapr_msi_write().
260  */
261 static void spapr_msi_setmsg(PCIDevice *pdev, hwaddr addr,
262                              bool msix, unsigned req_num)
263 {
264     unsigned i;
265     MSIMessage msg = { .address = addr, .data = 0 };
266 
267     if (!msix) {
268         msi_set_message(pdev, msg);
269         trace_spapr_pci_msi_setup(pdev->name, 0, msg.address);
270         return;
271     }
272 
273     for (i = 0; i < req_num; ++i) {
274         msg.address = addr | (i << 2);
275         msix_set_message(pdev, i, msg);
276         trace_spapr_pci_msi_setup(pdev->name, i, msg.address);
277     }
278 }
279 
280 static void rtas_ibm_change_msi(PowerPCCPU *cpu, sPAPREnvironment *spapr,
281                                 uint32_t token, uint32_t nargs,
282                                 target_ulong args, uint32_t nret,
283                                 target_ulong rets)
284 {
285     uint32_t config_addr = rtas_ld(args, 0);
286     uint64_t buid = ((uint64_t)rtas_ld(args, 1) << 32) | rtas_ld(args, 2);
287     unsigned int func = rtas_ld(args, 3);
288     unsigned int req_num = rtas_ld(args, 4); /* 0 == remove all */
289     unsigned int seq_num = rtas_ld(args, 5);
290     unsigned int ret_intr_type;
291     int ndev, irq;
292     sPAPRPHBState *phb = NULL;
293     PCIDevice *pdev = NULL;
294 
295     switch (func) {
296     case RTAS_CHANGE_MSI_FN:
297     case RTAS_CHANGE_FN:
298         ret_intr_type = RTAS_TYPE_MSI;
299         break;
300     case RTAS_CHANGE_MSIX_FN:
301         ret_intr_type = RTAS_TYPE_MSIX;
302         break;
303     default:
304         fprintf(stderr, "rtas_ibm_change_msi(%u) is not implemented\n", func);
305         rtas_st(rets, 0, -3); /* Parameter error */
306         return;
307     }
308 
309     /* Fins sPAPRPHBState */
310     phb = find_phb(spapr, buid);
311     if (phb) {
312         pdev = find_dev(spapr, buid, config_addr);
313     }
314     if (!phb || !pdev) {
315         rtas_st(rets, 0, -3); /* Parameter error */
316         return;
317     }
318 
319     /* Releasing MSIs */
320     if (!req_num) {
321         ndev = spapr_msicfg_find(phb, config_addr, false);
322         if (ndev < 0) {
323             trace_spapr_pci_msi("MSI has not been enabled", -1, config_addr);
324             rtas_st(rets, 0, -1); /* Hardware error */
325             return;
326         }
327         trace_spapr_pci_msi("Released MSIs", ndev, config_addr);
328         rtas_st(rets, 0, 0);
329         rtas_st(rets, 1, 0);
330         return;
331     }
332 
333     /* Enabling MSI */
334 
335     /* Find a device number in the map to add or reuse the existing one */
336     ndev = spapr_msicfg_find(phb, config_addr, true);
337     if (ndev >= SPAPR_MSIX_MAX_DEVS || ndev < 0) {
338         fprintf(stderr, "No free entry for a new MSI device\n");
339         rtas_st(rets, 0, -1); /* Hardware error */
340         return;
341     }
342     trace_spapr_pci_msi("Configuring MSI", ndev, config_addr);
343 
344     /* Check if there is an old config and MSI number has not changed */
345     if (phb->msi_table[ndev].nvec && (req_num != phb->msi_table[ndev].nvec)) {
346         /* Unexpected behaviour */
347         fprintf(stderr, "Cannot reuse MSI config for device#%d", ndev);
348         rtas_st(rets, 0, -1); /* Hardware error */
349         return;
350     }
351 
352     /* There is no cached config, allocate MSIs */
353     if (!phb->msi_table[ndev].nvec) {
354         irq = spapr_allocate_irq_block(req_num, false);
355         if (irq < 0) {
356             fprintf(stderr, "Cannot allocate MSIs for device#%d", ndev);
357             rtas_st(rets, 0, -1); /* Hardware error */
358             return;
359         }
360         phb->msi_table[ndev].irq = irq;
361         phb->msi_table[ndev].nvec = req_num;
362         phb->msi_table[ndev].config_addr = config_addr;
363     }
364 
365     /* Setup MSI/MSIX vectors in the device (via cfgspace or MSIX BAR) */
366     spapr_msi_setmsg(pdev, phb->msi_win_addr | (ndev << 16),
367                      ret_intr_type == RTAS_TYPE_MSIX, req_num);
368 
369     rtas_st(rets, 0, 0);
370     rtas_st(rets, 1, req_num);
371     rtas_st(rets, 2, ++seq_num);
372     rtas_st(rets, 3, ret_intr_type);
373 
374     trace_spapr_pci_rtas_ibm_change_msi(func, req_num);
375 }
376 
377 static void rtas_ibm_query_interrupt_source_number(PowerPCCPU *cpu,
378                                                    sPAPREnvironment *spapr,
379                                                    uint32_t token,
380                                                    uint32_t nargs,
381                                                    target_ulong args,
382                                                    uint32_t nret,
383                                                    target_ulong rets)
384 {
385     uint32_t config_addr = rtas_ld(args, 0);
386     uint64_t buid = ((uint64_t)rtas_ld(args, 1) << 32) | rtas_ld(args, 2);
387     unsigned int intr_src_num = -1, ioa_intr_num = rtas_ld(args, 3);
388     int ndev;
389     sPAPRPHBState *phb = NULL;
390 
391     /* Fins sPAPRPHBState */
392     phb = find_phb(spapr, buid);
393     if (!phb) {
394         rtas_st(rets, 0, -3); /* Parameter error */
395         return;
396     }
397 
398     /* Find device descriptor and start IRQ */
399     ndev = spapr_msicfg_find(phb, config_addr, false);
400     if (ndev < 0) {
401         trace_spapr_pci_msi("MSI has not been enabled", -1, config_addr);
402         rtas_st(rets, 0, -1); /* Hardware error */
403         return;
404     }
405 
406     intr_src_num = phb->msi_table[ndev].irq + ioa_intr_num;
407     trace_spapr_pci_rtas_ibm_query_interrupt_source_number(ioa_intr_num,
408                                                            intr_src_num);
409 
410     rtas_st(rets, 0, 0);
411     rtas_st(rets, 1, intr_src_num);
412     rtas_st(rets, 2, 1);/* 0 == level; 1 == edge */
413 }
414 
415 static int pci_spapr_swizzle(int slot, int pin)
416 {
417     return (slot + pin) % PCI_NUM_PINS;
418 }
419 
420 static int pci_spapr_map_irq(PCIDevice *pci_dev, int irq_num)
421 {
422     /*
423      * Here we need to convert pci_dev + irq_num to some unique value
424      * which is less than number of IRQs on the specific bus (4).  We
425      * use standard PCI swizzling, that is (slot number + pin number)
426      * % 4.
427      */
428     return pci_spapr_swizzle(PCI_SLOT(pci_dev->devfn), irq_num);
429 }
430 
431 static void pci_spapr_set_irq(void *opaque, int irq_num, int level)
432 {
433     /*
434      * Here we use the number returned by pci_spapr_map_irq to find a
435      * corresponding qemu_irq.
436      */
437     sPAPRPHBState *phb = opaque;
438 
439     trace_spapr_pci_lsi_set(phb->dtbusname, irq_num, phb->lsi_table[irq_num].irq);
440     qemu_set_irq(spapr_phb_lsi_qirq(phb, irq_num), level);
441 }
442 
443 /*
444  * MSI/MSIX memory region implementation.
445  * The handler handles both MSI and MSIX.
446  * For MSI-X, the vector number is encoded as a part of the address,
447  * data is set to 0.
448  * For MSI, the vector number is encoded in least bits in data.
449  */
450 static void spapr_msi_write(void *opaque, hwaddr addr,
451                             uint64_t data, unsigned size)
452 {
453     sPAPRPHBState *phb = opaque;
454     int ndev = addr >> 16;
455     int vec = ((addr & 0xFFFF) >> 2) | data;
456     uint32_t irq = phb->msi_table[ndev].irq + vec;
457 
458     trace_spapr_pci_msi_write(addr, data, irq);
459 
460     qemu_irq_pulse(xics_get_qirq(spapr->icp, irq));
461 }
462 
463 static const MemoryRegionOps spapr_msi_ops = {
464     /* There is no .read as the read result is undefined by PCI spec */
465     .read = NULL,
466     .write = spapr_msi_write,
467     .endianness = DEVICE_LITTLE_ENDIAN
468 };
469 
470 /*
471  * PHB PCI device
472  */
473 static AddressSpace *spapr_pci_dma_iommu(PCIBus *bus, void *opaque, int devfn)
474 {
475     sPAPRPHBState *phb = opaque;
476 
477     return &phb->iommu_as;
478 }
479 
480 static int spapr_phb_init(SysBusDevice *s)
481 {
482     sPAPRPHBState *sphb = SPAPR_PCI_HOST_BRIDGE(s);
483     PCIHostState *phb = PCI_HOST_BRIDGE(s);
484     const char *busname;
485     char *namebuf;
486     int i;
487     PCIBus *bus;
488 
489     if (sphb->index != -1) {
490         hwaddr windows_base;
491 
492         if ((sphb->buid != -1) || (sphb->dma_liobn != -1)
493             || (sphb->mem_win_addr != -1)
494             || (sphb->io_win_addr != -1)
495             || (sphb->msi_win_addr != -1)) {
496             fprintf(stderr, "Either \"index\" or other parameters must"
497                     " be specified for PAPR PHB, not both\n");
498             return -1;
499         }
500 
501         sphb->buid = SPAPR_PCI_BASE_BUID + sphb->index;
502         sphb->dma_liobn = SPAPR_PCI_BASE_LIOBN + sphb->index;
503 
504         windows_base = SPAPR_PCI_WINDOW_BASE
505             + sphb->index * SPAPR_PCI_WINDOW_SPACING;
506         sphb->mem_win_addr = windows_base + SPAPR_PCI_MMIO_WIN_OFF;
507         sphb->io_win_addr = windows_base + SPAPR_PCI_IO_WIN_OFF;
508         sphb->msi_win_addr = windows_base + SPAPR_PCI_MSI_WIN_OFF;
509     }
510 
511     if (sphb->buid == -1) {
512         fprintf(stderr, "BUID not specified for PHB\n");
513         return -1;
514     }
515 
516     if (sphb->dma_liobn == -1) {
517         fprintf(stderr, "LIOBN not specified for PHB\n");
518         return -1;
519     }
520 
521     if (sphb->mem_win_addr == -1) {
522         fprintf(stderr, "Memory window address not specified for PHB\n");
523         return -1;
524     }
525 
526     if (sphb->io_win_addr == -1) {
527         fprintf(stderr, "IO window address not specified for PHB\n");
528         return -1;
529     }
530 
531     if (sphb->msi_win_addr == -1) {
532         fprintf(stderr, "MSI window address not specified for PHB\n");
533         return -1;
534     }
535 
536     if (find_phb(spapr, sphb->buid)) {
537         fprintf(stderr, "PCI host bridges must have unique BUIDs\n");
538         return -1;
539     }
540 
541     sphb->dtbusname = g_strdup_printf("pci@%" PRIx64, sphb->buid);
542 
543     namebuf = alloca(strlen(sphb->dtbusname) + 32);
544 
545     /* Initialize memory regions */
546     sprintf(namebuf, "%s.mmio", sphb->dtbusname);
547     memory_region_init(&sphb->memspace, OBJECT(sphb), namebuf, INT64_MAX);
548 
549     sprintf(namebuf, "%s.mmio-alias", sphb->dtbusname);
550     memory_region_init_alias(&sphb->memwindow, OBJECT(sphb),
551                              namebuf, &sphb->memspace,
552                              SPAPR_PCI_MEM_WIN_BUS_OFFSET, sphb->mem_win_size);
553     memory_region_add_subregion(get_system_memory(), sphb->mem_win_addr,
554                                 &sphb->memwindow);
555 
556     /* On ppc, we only have MMIO no specific IO space from the CPU
557      * perspective.  In theory we ought to be able to embed the PCI IO
558      * memory region direction in the system memory space.  However,
559      * if any of the IO BAR subregions use the old_portio mechanism,
560      * that won't be processed properly unless accessed from the
561      * system io address space.  This hack to bounce things via
562      * system_io works around the problem until all the users of
563      * old_portion are updated */
564     sprintf(namebuf, "%s.io", sphb->dtbusname);
565     memory_region_init(&sphb->iospace, OBJECT(sphb),
566                        namebuf, SPAPR_PCI_IO_WIN_SIZE);
567     /* FIXME: fix to support multiple PHBs */
568     memory_region_add_subregion(get_system_io(), 0, &sphb->iospace);
569 
570     sprintf(namebuf, "%s.io-alias", sphb->dtbusname);
571     memory_region_init_alias(&sphb->iowindow, OBJECT(sphb), namebuf,
572                              get_system_io(), 0, SPAPR_PCI_IO_WIN_SIZE);
573     memory_region_add_subregion(get_system_memory(), sphb->io_win_addr,
574                                 &sphb->iowindow);
575 
576     /* As MSI/MSIX interrupts trigger by writing at MSI/MSIX vectors,
577      * we need to allocate some memory to catch those writes coming
578      * from msi_notify()/msix_notify() */
579     if (msi_supported) {
580         sprintf(namebuf, "%s.msi", sphb->dtbusname);
581         memory_region_init_io(&sphb->msiwindow, OBJECT(sphb), &spapr_msi_ops, sphb,
582                               namebuf, SPAPR_MSIX_MAX_DEVS * 0x10000);
583         memory_region_add_subregion(get_system_memory(), sphb->msi_win_addr,
584                                     &sphb->msiwindow);
585     }
586 
587     /*
588      * Selecting a busname is more complex than you'd think, due to
589      * interacting constraints.  If the user has specified an id
590      * explicitly for the phb , then we want to use the qdev default
591      * of naming the bus based on the bridge device (so the user can
592      * then assign devices to it in the way they expect).  For the
593      * first / default PCI bus (index=0) we want to use just "pci"
594      * because libvirt expects there to be a bus called, simply,
595      * "pci".  Otherwise, we use the same name as in the device tree,
596      * since it's unique by construction, and makes the guest visible
597      * BUID clear.
598      */
599     if (s->qdev.id) {
600         busname = NULL;
601     } else if (sphb->index == 0) {
602         busname = "pci";
603     } else {
604         busname = sphb->dtbusname;
605     }
606     bus = pci_register_bus(DEVICE(s), busname,
607                            pci_spapr_set_irq, pci_spapr_map_irq, sphb,
608                            &sphb->memspace, &sphb->iospace,
609                            PCI_DEVFN(0, 0), PCI_NUM_PINS, TYPE_PCI_BUS);
610     phb->bus = bus;
611 
612     sphb->dma_window_start = 0;
613     sphb->dma_window_size = 0x40000000;
614     sphb->tcet = spapr_tce_new_table(DEVICE(sphb), sphb->dma_liobn,
615                                      sphb->dma_window_size);
616     if (!sphb->tcet) {
617         fprintf(stderr, "Unable to create TCE table for %s\n", sphb->dtbusname);
618         return -1;
619     }
620     address_space_init(&sphb->iommu_as, spapr_tce_get_iommu(sphb->tcet),
621                        sphb->dtbusname);
622 
623     pci_setup_iommu(bus, spapr_pci_dma_iommu, sphb);
624 
625     QLIST_INSERT_HEAD(&spapr->phbs, sphb, list);
626 
627     /* Initialize the LSI table */
628     for (i = 0; i < PCI_NUM_PINS; i++) {
629         uint32_t irq;
630 
631         irq = spapr_allocate_lsi(0);
632         if (!irq) {
633             return -1;
634         }
635 
636         sphb->lsi_table[i].irq = irq;
637     }
638 
639     return 0;
640 }
641 
642 static void spapr_phb_reset(DeviceState *qdev)
643 {
644     SysBusDevice *s = SYS_BUS_DEVICE(qdev);
645     sPAPRPHBState *sphb = SPAPR_PCI_HOST_BRIDGE(s);
646 
647     /* Reset the IOMMU state */
648     device_reset(DEVICE(sphb->tcet));
649 }
650 
651 static Property spapr_phb_properties[] = {
652     DEFINE_PROP_INT32("index", sPAPRPHBState, index, -1),
653     DEFINE_PROP_HEX64("buid", sPAPRPHBState, buid, -1),
654     DEFINE_PROP_HEX32("liobn", sPAPRPHBState, dma_liobn, -1),
655     DEFINE_PROP_HEX64("mem_win_addr", sPAPRPHBState, mem_win_addr, -1),
656     DEFINE_PROP_HEX64("mem_win_size", sPAPRPHBState, mem_win_size,
657                       SPAPR_PCI_MMIO_WIN_SIZE),
658     DEFINE_PROP_HEX64("io_win_addr", sPAPRPHBState, io_win_addr, -1),
659     DEFINE_PROP_HEX64("io_win_size", sPAPRPHBState, io_win_size,
660                       SPAPR_PCI_IO_WIN_SIZE),
661     DEFINE_PROP_HEX64("msi_win_addr", sPAPRPHBState, msi_win_addr, -1),
662     DEFINE_PROP_END_OF_LIST(),
663 };
664 
665 static const VMStateDescription vmstate_spapr_pci_lsi = {
666     .name = "spapr_pci/lsi",
667     .version_id = 1,
668     .minimum_version_id = 1,
669     .minimum_version_id_old = 1,
670     .fields      = (VMStateField []) {
671         VMSTATE_UINT32_EQUAL(irq, struct spapr_pci_lsi),
672 
673         VMSTATE_END_OF_LIST()
674     },
675 };
676 
677 static const VMStateDescription vmstate_spapr_pci_msi = {
678     .name = "spapr_pci/lsi",
679     .version_id = 1,
680     .minimum_version_id = 1,
681     .minimum_version_id_old = 1,
682     .fields      = (VMStateField []) {
683         VMSTATE_UINT32(config_addr, struct spapr_pci_msi),
684         VMSTATE_UINT32(irq, struct spapr_pci_msi),
685         VMSTATE_UINT32(nvec, struct spapr_pci_msi),
686 
687         VMSTATE_END_OF_LIST()
688     },
689 };
690 
691 static const VMStateDescription vmstate_spapr_pci = {
692     .name = "spapr_pci",
693     .version_id = 1,
694     .minimum_version_id = 1,
695     .minimum_version_id_old = 1,
696     .fields      = (VMStateField []) {
697         VMSTATE_UINT64_EQUAL(buid, sPAPRPHBState),
698         VMSTATE_UINT32_EQUAL(dma_liobn, sPAPRPHBState),
699         VMSTATE_UINT64_EQUAL(mem_win_addr, sPAPRPHBState),
700         VMSTATE_UINT64_EQUAL(mem_win_size, sPAPRPHBState),
701         VMSTATE_UINT64_EQUAL(io_win_addr, sPAPRPHBState),
702         VMSTATE_UINT64_EQUAL(io_win_size, sPAPRPHBState),
703         VMSTATE_UINT64_EQUAL(msi_win_addr, sPAPRPHBState),
704         VMSTATE_STRUCT_ARRAY(lsi_table, sPAPRPHBState, PCI_NUM_PINS, 0,
705                              vmstate_spapr_pci_lsi, struct spapr_pci_lsi),
706         VMSTATE_STRUCT_ARRAY(msi_table, sPAPRPHBState, SPAPR_MSIX_MAX_DEVS, 0,
707                              vmstate_spapr_pci_msi, struct spapr_pci_msi),
708 
709         VMSTATE_END_OF_LIST()
710     },
711 };
712 
713 static const char *spapr_phb_root_bus_path(PCIHostState *host_bridge,
714                                            PCIBus *rootbus)
715 {
716     sPAPRPHBState *sphb = SPAPR_PCI_HOST_BRIDGE(host_bridge);
717 
718     return sphb->dtbusname;
719 }
720 
721 static void spapr_phb_class_init(ObjectClass *klass, void *data)
722 {
723     PCIHostBridgeClass *hc = PCI_HOST_BRIDGE_CLASS(klass);
724     SysBusDeviceClass *sdc = SYS_BUS_DEVICE_CLASS(klass);
725     DeviceClass *dc = DEVICE_CLASS(klass);
726 
727     hc->root_bus_path = spapr_phb_root_bus_path;
728     sdc->init = spapr_phb_init;
729     dc->props = spapr_phb_properties;
730     dc->reset = spapr_phb_reset;
731     dc->vmsd = &vmstate_spapr_pci;
732 }
733 
734 static const TypeInfo spapr_phb_info = {
735     .name          = TYPE_SPAPR_PCI_HOST_BRIDGE,
736     .parent        = TYPE_PCI_HOST_BRIDGE,
737     .instance_size = sizeof(sPAPRPHBState),
738     .class_init    = spapr_phb_class_init,
739 };
740 
741 PCIHostState *spapr_create_phb(sPAPREnvironment *spapr, int index)
742 {
743     DeviceState *dev;
744 
745     dev = qdev_create(NULL, TYPE_SPAPR_PCI_HOST_BRIDGE);
746     qdev_prop_set_uint32(dev, "index", index);
747     qdev_init_nofail(dev);
748 
749     return PCI_HOST_BRIDGE(dev);
750 }
751 
752 /* Macros to operate with address in OF binding to PCI */
753 #define b_x(x, p, l)    (((x) & ((1<<(l))-1)) << (p))
754 #define b_n(x)          b_x((x), 31, 1) /* 0 if relocatable */
755 #define b_p(x)          b_x((x), 30, 1) /* 1 if prefetchable */
756 #define b_t(x)          b_x((x), 29, 1) /* 1 if the address is aliased */
757 #define b_ss(x)         b_x((x), 24, 2) /* the space code */
758 #define b_bbbbbbbb(x)   b_x((x), 16, 8) /* bus number */
759 #define b_ddddd(x)      b_x((x), 11, 5) /* device number */
760 #define b_fff(x)        b_x((x), 8, 3)  /* function number */
761 #define b_rrrrrrrr(x)   b_x((x), 0, 8)  /* register number */
762 
763 int spapr_populate_pci_dt(sPAPRPHBState *phb,
764                           uint32_t xics_phandle,
765                           void *fdt)
766 {
767     int bus_off, i, j;
768     char nodename[256];
769     uint32_t bus_range[] = { cpu_to_be32(0), cpu_to_be32(0xff) };
770     struct {
771         uint32_t hi;
772         uint64_t child;
773         uint64_t parent;
774         uint64_t size;
775     } QEMU_PACKED ranges[] = {
776         {
777             cpu_to_be32(b_ss(1)), cpu_to_be64(0),
778             cpu_to_be64(phb->io_win_addr),
779             cpu_to_be64(memory_region_size(&phb->iospace)),
780         },
781         {
782             cpu_to_be32(b_ss(2)), cpu_to_be64(SPAPR_PCI_MEM_WIN_BUS_OFFSET),
783             cpu_to_be64(phb->mem_win_addr),
784             cpu_to_be64(memory_region_size(&phb->memwindow)),
785         },
786     };
787     uint64_t bus_reg[] = { cpu_to_be64(phb->buid), 0 };
788     uint32_t interrupt_map_mask[] = {
789         cpu_to_be32(b_ddddd(-1)|b_fff(0)), 0x0, 0x0, cpu_to_be32(-1)};
790     uint32_t interrupt_map[PCI_SLOT_MAX * PCI_NUM_PINS][7];
791 
792     /* Start populating the FDT */
793     sprintf(nodename, "pci@%" PRIx64, phb->buid);
794     bus_off = fdt_add_subnode(fdt, 0, nodename);
795     if (bus_off < 0) {
796         return bus_off;
797     }
798 
799 #define _FDT(exp) \
800     do { \
801         int ret = (exp);                                           \
802         if (ret < 0) {                                             \
803             return ret;                                            \
804         }                                                          \
805     } while (0)
806 
807     /* Write PHB properties */
808     _FDT(fdt_setprop_string(fdt, bus_off, "device_type", "pci"));
809     _FDT(fdt_setprop_string(fdt, bus_off, "compatible", "IBM,Logical_PHB"));
810     _FDT(fdt_setprop_cell(fdt, bus_off, "#address-cells", 0x3));
811     _FDT(fdt_setprop_cell(fdt, bus_off, "#size-cells", 0x2));
812     _FDT(fdt_setprop_cell(fdt, bus_off, "#interrupt-cells", 0x1));
813     _FDT(fdt_setprop(fdt, bus_off, "used-by-rtas", NULL, 0));
814     _FDT(fdt_setprop(fdt, bus_off, "bus-range", &bus_range, sizeof(bus_range)));
815     _FDT(fdt_setprop(fdt, bus_off, "ranges", &ranges, sizeof(ranges)));
816     _FDT(fdt_setprop(fdt, bus_off, "reg", &bus_reg, sizeof(bus_reg)));
817     _FDT(fdt_setprop_cell(fdt, bus_off, "ibm,pci-config-space-type", 0x1));
818 
819     /* Build the interrupt-map, this must matches what is done
820      * in pci_spapr_map_irq
821      */
822     _FDT(fdt_setprop(fdt, bus_off, "interrupt-map-mask",
823                      &interrupt_map_mask, sizeof(interrupt_map_mask)));
824     for (i = 0; i < PCI_SLOT_MAX; i++) {
825         for (j = 0; j < PCI_NUM_PINS; j++) {
826             uint32_t *irqmap = interrupt_map[i*PCI_NUM_PINS + j];
827             int lsi_num = pci_spapr_swizzle(i, j);
828 
829             irqmap[0] = cpu_to_be32(b_ddddd(i)|b_fff(0));
830             irqmap[1] = 0;
831             irqmap[2] = 0;
832             irqmap[3] = cpu_to_be32(j+1);
833             irqmap[4] = cpu_to_be32(xics_phandle);
834             irqmap[5] = cpu_to_be32(phb->lsi_table[lsi_num].irq);
835             irqmap[6] = cpu_to_be32(0x8);
836         }
837     }
838     /* Write interrupt map */
839     _FDT(fdt_setprop(fdt, bus_off, "interrupt-map", &interrupt_map,
840                      sizeof(interrupt_map)));
841 
842     spapr_dma_dt(fdt, bus_off, "ibm,dma-window",
843                  phb->dma_liobn, phb->dma_window_start,
844                  phb->dma_window_size);
845 
846     return 0;
847 }
848 
849 void spapr_pci_rtas_init(void)
850 {
851     spapr_rtas_register("read-pci-config", rtas_read_pci_config);
852     spapr_rtas_register("write-pci-config", rtas_write_pci_config);
853     spapr_rtas_register("ibm,read-pci-config", rtas_ibm_read_pci_config);
854     spapr_rtas_register("ibm,write-pci-config", rtas_ibm_write_pci_config);
855     if (msi_supported) {
856         spapr_rtas_register("ibm,query-interrupt-source-number",
857                             rtas_ibm_query_interrupt_source_number);
858         spapr_rtas_register("ibm,change-msi", rtas_ibm_change_msi);
859     }
860 }
861 
862 static void spapr_pci_register_types(void)
863 {
864     type_register_static(&spapr_phb_info);
865 }
866 
867 type_init(spapr_pci_register_types)
868