2 * QEMU PowerPC PowerNV (POWER8) PHB3 model
4 * Copyright (c) 2014-2020, IBM Corporation.
6 * This code is licensed under the GPL version 2 or later. See the
7 * COPYING file in the top-level directory.
9 #include "qemu/osdep.h"
11 #include "qapi/visitor.h"
12 #include "qapi/error.h"
13 #include "hw/pci-host/pnv_phb3_regs.h"
14 #include "hw/pci-host/pnv_phb3.h"
15 #include "hw/pci/pcie_host.h"
16 #include "hw/pci/pcie_port.h"
17 #include "hw/ppc/pnv.h"
19 #include "hw/qdev-properties.h"
20 #include "qom/object.h"
21 #include "sysemu/sysemu.h"
23 #define phb3_error(phb, fmt, ...) \
24 qemu_log_mask(LOG_GUEST_ERROR, "phb3[%d:%d]: " fmt "\n", \
25 (phb)->chip_id, (phb)->phb_id, ## __VA_ARGS__)
27 static PCIDevice
*pnv_phb3_find_cfg_dev(PnvPHB3
*phb
)
29 PCIHostState
*pci
= PCI_HOST_BRIDGE(phb
);
30 uint64_t addr
= phb
->regs
[PHB_CONFIG_ADDRESS
>> 3];
36 bus
= (addr
>> 52) & 0xff;
37 devfn
= (addr
>> 44) & 0xff;
39 return pci_find_device(pci
->bus
, bus
, devfn
);
43 * The CONFIG_DATA register expects little endian accesses, but as the
44 * region is big endian, we have to swap the value.
46 static void pnv_phb3_config_write(PnvPHB3
*phb
, unsigned off
,
47 unsigned size
, uint64_t val
)
49 uint32_t cfg_addr
, limit
;
52 pdev
= pnv_phb3_find_cfg_dev(phb
);
56 cfg_addr
= (phb
->regs
[PHB_CONFIG_ADDRESS
>> 3] >> 32) & 0xffc;
58 limit
= pci_config_size(pdev
);
59 if (limit
<= cfg_addr
) {
61 * conventional pci device can be behind pcie-to-pci bridge.
62 * 256 <= addr < 4K has no effects.
76 g_assert_not_reached();
78 pci_host_config_write_common(pdev
, cfg_addr
, limit
, val
, size
);
81 static uint64_t pnv_phb3_config_read(PnvPHB3
*phb
, unsigned off
,
84 uint32_t cfg_addr
, limit
;
88 pdev
= pnv_phb3_find_cfg_dev(phb
);
92 cfg_addr
= (phb
->regs
[PHB_CONFIG_ADDRESS
>> 3] >> 32) & 0xffc;
94 limit
= pci_config_size(pdev
);
95 if (limit
<= cfg_addr
) {
97 * conventional pci device can be behind pcie-to-pci bridge.
98 * 256 <= addr < 4K has no effects.
102 val
= pci_host_config_read_common(pdev
, cfg_addr
, limit
, size
);
111 g_assert_not_reached();
115 static void pnv_phb3_check_m32(PnvPHB3
*phb
)
117 uint64_t base
, start
, size
;
118 MemoryRegion
*parent
;
119 PnvPBCQState
*pbcq
= &phb
->pbcq
;
121 if (memory_region_is_mapped(&phb
->mr_m32
)) {
122 memory_region_del_subregion(phb
->mr_m32
.container
, &phb
->mr_m32
);
125 if (!(phb
->regs
[PHB_PHB3_CONFIG
>> 3] & PHB_PHB3C_M32_EN
)) {
129 /* Grab geometry from registers */
130 base
= phb
->regs
[PHB_M32_BASE_ADDR
>> 3];
131 start
= phb
->regs
[PHB_M32_START_ADDR
>> 3];
132 size
= ~(phb
->regs
[PHB_M32_BASE_MASK
>> 3] | 0xfffc000000000000ull
) + 1;
134 /* Check if it matches an enabled MMIO region in the PBCQ */
135 if (memory_region_is_mapped(&pbcq
->mmbar0
) &&
136 base
>= pbcq
->mmio0_base
&&
137 (base
+ size
) <= (pbcq
->mmio0_base
+ pbcq
->mmio0_size
)) {
138 parent
= &pbcq
->mmbar0
;
139 base
-= pbcq
->mmio0_base
;
140 } else if (memory_region_is_mapped(&pbcq
->mmbar1
) &&
141 base
>= pbcq
->mmio1_base
&&
142 (base
+ size
) <= (pbcq
->mmio1_base
+ pbcq
->mmio1_size
)) {
143 parent
= &pbcq
->mmbar1
;
144 base
-= pbcq
->mmio1_base
;
150 memory_region_init_alias(&phb
->mr_m32
, OBJECT(phb
), "phb3-m32",
151 &phb
->pci_mmio
, start
, size
);
152 memory_region_add_subregion(parent
, base
, &phb
->mr_m32
);
155 static void pnv_phb3_check_m64(PnvPHB3
*phb
, uint32_t index
)
157 uint64_t base
, start
, size
, m64
;
158 MemoryRegion
*parent
;
159 PnvPBCQState
*pbcq
= &phb
->pbcq
;
161 if (memory_region_is_mapped(&phb
->mr_m64
[index
])) {
162 /* Should we destroy it in RCU friendly way... ? */
163 memory_region_del_subregion(phb
->mr_m64
[index
].container
,
164 &phb
->mr_m64
[index
]);
167 /* Get table entry */
168 m64
= phb
->ioda_M64BT
[index
];
170 if (!(m64
& IODA2_M64BT_ENABLE
)) {
174 /* Grab geometry from registers */
175 base
= GETFIELD(IODA2_M64BT_BASE
, m64
) << 20;
176 if (m64
& IODA2_M64BT_SINGLE_PE
) {
177 base
&= ~0x1ffffffull
;
179 size
= GETFIELD(IODA2_M64BT_MASK
, m64
) << 20;
180 size
|= 0xfffc000000000000ull
;
182 start
= base
| (phb
->regs
[PHB_M64_UPPER_BITS
>> 3]);
184 /* Check if it matches an enabled MMIO region in the PBCQ */
185 if (memory_region_is_mapped(&pbcq
->mmbar0
) &&
186 base
>= pbcq
->mmio0_base
&&
187 (base
+ size
) <= (pbcq
->mmio0_base
+ pbcq
->mmio0_size
)) {
188 parent
= &pbcq
->mmbar0
;
189 base
-= pbcq
->mmio0_base
;
190 } else if (memory_region_is_mapped(&pbcq
->mmbar1
) &&
191 base
>= pbcq
->mmio1_base
&&
192 (base
+ size
) <= (pbcq
->mmio1_base
+ pbcq
->mmio1_size
)) {
193 parent
= &pbcq
->mmbar1
;
194 base
-= pbcq
->mmio1_base
;
200 memory_region_init_alias(&phb
->mr_m64
[index
], OBJECT(phb
), "phb3-m64",
201 &phb
->pci_mmio
, start
, size
);
202 memory_region_add_subregion(parent
, base
, &phb
->mr_m64
[index
]);
205 static void pnv_phb3_check_all_m64s(PnvPHB3
*phb
)
209 for (i
= 0; i
< PNV_PHB3_NUM_M64
; i
++) {
210 pnv_phb3_check_m64(phb
, i
);
214 static void pnv_phb3_lxivt_write(PnvPHB3
*phb
, unsigned idx
, uint64_t val
)
216 uint8_t server
, prio
;
218 phb
->ioda_LXIVT
[idx
] = val
& (IODA2_LXIVT_SERVER
|
219 IODA2_LXIVT_PRIORITY
|
220 IODA2_LXIVT_NODE_ID
);
221 server
= GETFIELD(IODA2_LXIVT_SERVER
, val
);
222 prio
= GETFIELD(IODA2_LXIVT_PRIORITY
, val
);
225 * The low order 2 bits are the link pointer (Type II interrupts).
226 * Shift back to get a valid IRQ server.
230 ics_write_xive(&phb
->lsis
, idx
, server
, prio
, prio
);
233 static uint64_t *pnv_phb3_ioda_access(PnvPHB3
*phb
,
234 unsigned *out_table
, unsigned *out_idx
)
236 uint64_t adreg
= phb
->regs
[PHB_IODA_ADDR
>> 3];
237 unsigned int index
= GETFIELD(PHB_IODA_AD_TADR
, adreg
);
238 unsigned int table
= GETFIELD(PHB_IODA_AD_TSEL
, adreg
);
240 uint64_t *tptr
= NULL
;
244 tptr
= phb
->ioda_LIST
;
247 case IODA2_TBL_LXIVT
:
248 tptr
= phb
->ioda_LXIVT
;
251 case IODA2_TBL_IVC_CAM
:
261 case IODA2_TBL_PESTA
:
262 case IODA2_TBL_PESTB
:
266 tptr
= phb
->ioda_TVT
;
273 case IODA2_TBL_M64BT
:
274 tptr
= phb
->ioda_M64BT
;
277 case IODA2_TBL_M32DT
:
278 tptr
= phb
->ioda_MDT
;
282 tptr
= phb
->ioda_PEEV
;
286 phb3_error(phb
, "invalid IODA table %d", table
);
299 if (adreg
& PHB_IODA_AD_AUTOINC
) {
300 index
= (index
+ 1) & mask
;
301 adreg
= SETFIELD(PHB_IODA_AD_TADR
, adreg
, index
);
303 phb
->regs
[PHB_IODA_ADDR
>> 3] = adreg
;
307 static uint64_t pnv_phb3_ioda_read(PnvPHB3
*phb
)
312 tptr
= pnv_phb3_ioda_access(phb
, &table
, NULL
);
314 /* Return 0 on unsupported tables, not ff's */
320 static void pnv_phb3_ioda_write(PnvPHB3
*phb
, uint64_t val
)
325 tptr
= pnv_phb3_ioda_access(phb
, &table
, &idx
);
330 /* Handle side effects */
332 case IODA2_TBL_LXIVT
:
333 pnv_phb3_lxivt_write(phb
, idx
, val
);
335 case IODA2_TBL_M64BT
:
337 pnv_phb3_check_m64(phb
, idx
);
345 * This is called whenever the PHB LSI, MSI source ID register or
346 * the PBCQ irq filters are written.
348 void pnv_phb3_remap_irqs(PnvPHB3
*phb
)
350 ICSState
*ics
= &phb
->lsis
;
351 uint32_t local
, global
, count
, mask
, comp
;
353 PnvPBCQState
*pbcq
= &phb
->pbcq
;
356 * First check if we are enabled. Unlike real HW we don't separate
357 * TX and RX so we enable if both are set
359 baren
= pbcq
->nest_regs
[PBCQ_NEST_BAR_EN
];
360 if (!(baren
& PBCQ_NEST_BAR_EN_IRSN_RX
) ||
361 !(baren
& PBCQ_NEST_BAR_EN_IRSN_TX
)) {
366 /* Grab local LSI source ID */
367 local
= GETFIELD(PHB_LSI_SRC_ID
, phb
->regs
[PHB_LSI_SOURCE_ID
>> 3]) << 3;
369 /* Grab global one and compare */
370 global
= GETFIELD(PBCQ_NEST_LSI_SRC
,
371 pbcq
->nest_regs
[PBCQ_NEST_LSI_SRC_ID
]) << 3;
372 if (global
!= local
) {
374 * This happens during initialization, let's come back when we
375 * are properly configured
381 /* Get the base on the powerbus */
382 comp
= GETFIELD(PBCQ_NEST_IRSN_COMP
,
383 pbcq
->nest_regs
[PBCQ_NEST_IRSN_COMPARE
]);
384 mask
= GETFIELD(PBCQ_NEST_IRSN_COMP
,
385 pbcq
->nest_regs
[PBCQ_NEST_IRSN_MASK
]);
386 count
= ((~mask
) + 1) & 0x7ffff;
387 phb
->total_irq
= count
;
390 if ((global
+ PNV_PHB3_NUM_LSI
) > count
) {
391 phb3_error(phb
, "LSIs out of reach: LSI base=%d total irq=%d", global
,
396 phb3_error(phb
, "More interrupts than supported: %d", count
);
399 if ((comp
& mask
) != comp
) {
400 phb3_error(phb
, "IRQ compare bits not in mask: comp=0x%x mask=0x%x",
404 /* Setup LSI offset */
405 ics
->offset
= comp
+ global
;
407 /* Setup MSI offset */
408 pnv_phb3_msi_update_config(&phb
->msis
, comp
, count
- PNV_PHB3_NUM_LSI
);
411 static void pnv_phb3_lsi_src_id_write(PnvPHB3
*phb
, uint64_t val
)
413 /* Sanitize content */
414 val
&= PHB_LSI_SRC_ID
;
415 phb
->regs
[PHB_LSI_SOURCE_ID
>> 3] = val
;
416 pnv_phb3_remap_irqs(phb
);
419 static void pnv_phb3_rtc_invalidate(PnvPHB3
*phb
, uint64_t val
)
423 /* Always invalidate all for now ... */
424 QLIST_FOREACH(ds
, &phb
->dma_spaces
, list
) {
425 ds
->pe_num
= PHB_INVALID_PE
;
430 static void pnv_phb3_update_msi_regions(PnvPhb3DMASpace
*ds
)
432 uint64_t cfg
= ds
->phb
->regs
[PHB_PHB3_CONFIG
>> 3];
434 if (cfg
& PHB_PHB3C_32BIT_MSI_EN
) {
435 if (!memory_region_is_mapped(&ds
->msi32_mr
)) {
436 memory_region_add_subregion(MEMORY_REGION(&ds
->dma_mr
),
437 0xffff0000, &ds
->msi32_mr
);
440 if (memory_region_is_mapped(&ds
->msi32_mr
)) {
441 memory_region_del_subregion(MEMORY_REGION(&ds
->dma_mr
),
446 if (cfg
& PHB_PHB3C_64BIT_MSI_EN
) {
447 if (!memory_region_is_mapped(&ds
->msi64_mr
)) {
448 memory_region_add_subregion(MEMORY_REGION(&ds
->dma_mr
),
449 (1ull << 60), &ds
->msi64_mr
);
452 if (memory_region_is_mapped(&ds
->msi64_mr
)) {
453 memory_region_del_subregion(MEMORY_REGION(&ds
->dma_mr
),
459 static void pnv_phb3_update_all_msi_regions(PnvPHB3
*phb
)
463 QLIST_FOREACH(ds
, &phb
->dma_spaces
, list
) {
464 pnv_phb3_update_msi_regions(ds
);
468 void pnv_phb3_reg_write(void *opaque
, hwaddr off
, uint64_t val
, unsigned size
)
470 PnvPHB3
*phb
= opaque
;
473 /* Special case configuration data */
474 if ((off
& 0xfffc) == PHB_CONFIG_DATA
) {
475 pnv_phb3_config_write(phb
, off
& 0x3, size
, val
);
479 /* Other registers are 64-bit only */
480 if (size
!= 8 || off
& 0x7) {
481 phb3_error(phb
, "Invalid register access, offset: 0x%"PRIx64
" size: %d",
486 /* Handle masking & filtering */
488 case PHB_M64_UPPER_BITS
:
489 val
&= 0xfffc000000000000ull
;
493 * This is enough logic to make SW happy but we aren't actually
496 if (val
& PHB_Q_DMA_R_AUTORESET
) {
499 val
&= PHB_Q_DMA_R_QUIESCE_DMA
;
503 case PHB_LEM_FIR_AND_MASK
:
504 phb
->regs
[PHB_LEM_FIR_ACCUM
>> 3] &= val
;
506 case PHB_LEM_FIR_OR_MASK
:
507 phb
->regs
[PHB_LEM_FIR_ACCUM
>> 3] |= val
;
509 case PHB_LEM_ERROR_AND_MASK
:
510 phb
->regs
[PHB_LEM_ERROR_MASK
>> 3] &= val
;
512 case PHB_LEM_ERROR_OR_MASK
:
513 phb
->regs
[PHB_LEM_ERROR_MASK
>> 3] |= val
;
520 /* Record whether it changed */
521 changed
= phb
->regs
[off
>> 3] != val
;
523 /* Store in register cache first */
524 phb
->regs
[off
>> 3] = val
;
526 /* Handle side effects */
528 case PHB_PHB3_CONFIG
:
530 pnv_phb3_update_all_msi_regions(phb
);
533 case PHB_M32_BASE_ADDR
:
534 case PHB_M32_BASE_MASK
:
535 case PHB_M32_START_ADDR
:
537 pnv_phb3_check_m32(phb
);
540 case PHB_M64_UPPER_BITS
:
542 pnv_phb3_check_all_m64s(phb
);
545 case PHB_LSI_SOURCE_ID
:
547 pnv_phb3_lsi_src_id_write(phb
, val
);
551 /* IODA table accesses */
553 pnv_phb3_ioda_write(phb
, val
);
556 /* RTC invalidation */
557 case PHB_RTC_INVALIDATE
:
558 pnv_phb3_rtc_invalidate(phb
, val
);
562 case PHB_FFI_REQUEST
:
563 pnv_phb3_msi_ffi(&phb
->msis
, val
);
566 /* Silent simple writes */
567 case PHB_CONFIG_ADDRESS
:
570 case PHB_TCE_SPEC_CTL
:
577 case PHB_LEM_FIR_ACCUM
:
578 case PHB_LEM_ERROR_MASK
:
579 case PHB_LEM_ACTION0
:
580 case PHB_LEM_ACTION1
:
583 /* Noise on anything else */
585 qemu_log_mask(LOG_UNIMP
, "phb3: reg_write 0x%"PRIx64
"=%"PRIx64
"\n",
590 uint64_t pnv_phb3_reg_read(void *opaque
, hwaddr off
, unsigned size
)
592 PnvPHB3
*phb
= opaque
;
593 PCIHostState
*pci
= PCI_HOST_BRIDGE(phb
);
596 if ((off
& 0xfffc) == PHB_CONFIG_DATA
) {
597 return pnv_phb3_config_read(phb
, off
& 0x3, size
);
600 /* Other registers are 64-bit only */
601 if (size
!= 8 || off
& 0x7) {
602 phb3_error(phb
, "Invalid register access, offset: 0x%"PRIx64
" size: %d",
607 /* Default read from cache */
608 val
= phb
->regs
[off
>> 3];
611 /* Simulate venice DD2.0 */
613 return 0x000000a300000005ull
;
614 case PHB_PCIE_SYSTEM_CONFIG
:
615 return 0x441100fc30000000;
617 /* IODA table accesses */
619 return pnv_phb3_ioda_read(phb
);
621 /* Link training always appears trained */
622 case PHB_PCIE_DLP_TRAIN_CTL
:
623 if (!pci_find_device(pci
->bus
, 1, 0)) {
626 return PHB_PCIE_DLP_INBAND_PRESENCE
| PHB_PCIE_DLP_TC_DL_LINKACT
;
630 /* Set lock and return previous value */
631 phb
->regs
[off
>> 3] |= PHB_FFI_LOCK_STATE
;
634 /* DMA read sync: make it look like it's complete */
636 return PHB_DMARD_SYNC_COMPLETE
;
638 /* Silent simple reads */
639 case PHB_PHB3_CONFIG
:
640 case PHB_M32_BASE_ADDR
:
641 case PHB_M32_BASE_MASK
:
642 case PHB_M32_START_ADDR
:
643 case PHB_CONFIG_ADDRESS
:
645 case PHB_RTC_INVALIDATE
:
647 case PHB_TCE_SPEC_CTL
:
653 case PHB_M64_UPPER_BITS
:
654 case PHB_LEM_FIR_ACCUM
:
655 case PHB_LEM_ERROR_MASK
:
656 case PHB_LEM_ACTION0
:
657 case PHB_LEM_ACTION1
:
660 /* Noise on anything else */
662 qemu_log_mask(LOG_UNIMP
, "phb3: reg_read 0x%"PRIx64
"=%"PRIx64
"\n",
668 static const MemoryRegionOps pnv_phb3_reg_ops
= {
669 .read
= pnv_phb3_reg_read
,
670 .write
= pnv_phb3_reg_write
,
671 .valid
.min_access_size
= 1,
672 .valid
.max_access_size
= 8,
673 .impl
.min_access_size
= 1,
674 .impl
.max_access_size
= 8,
675 .endianness
= DEVICE_BIG_ENDIAN
,
678 static int pnv_phb3_map_irq(PCIDevice
*pci_dev
, int irq_num
)
680 /* Check that out properly ... */
684 static void pnv_phb3_set_irq(void *opaque
, int irq_num
, int level
)
686 PnvPHB3
*phb
= opaque
;
690 phb3_error(phb
, "Unknown IRQ to set %d", irq_num
);
692 qemu_set_irq(phb
->qirqs
[irq_num
], level
);
695 static bool pnv_phb3_resolve_pe(PnvPhb3DMASpace
*ds
)
701 /* Already resolved ? */
702 if (ds
->pe_num
!= PHB_INVALID_PE
) {
706 /* We need to lookup the RTT */
707 rtt
= ds
->phb
->regs
[PHB_RTT_BAR
>> 3];
708 if (!(rtt
& PHB_RTT_BAR_ENABLE
)) {
709 phb3_error(ds
->phb
, "DMA with RTT BAR disabled !");
710 /* Set error bits ? fence ? ... */
715 bus_num
= pci_bus_num(ds
->bus
);
716 addr
= rtt
& PHB_RTT_BASE_ADDRESS_MASK
;
717 addr
+= 2 * ((bus_num
<< 8) | ds
->devfn
);
718 if (dma_memory_read(&address_space_memory
, addr
, &rte
,
719 sizeof(rte
), MEMTXATTRS_UNSPECIFIED
)) {
720 phb3_error(ds
->phb
, "Failed to read RTT entry at 0x%"PRIx64
, addr
);
721 /* Set error bits ? fence ? ... */
724 rte
= be16_to_cpu(rte
);
726 /* Fail upon reading of invalid PE# */
727 if (rte
>= PNV_PHB3_NUM_PE
) {
728 phb3_error(ds
->phb
, "RTE for RID 0x%x invalid (%04x", ds
->devfn
, rte
);
729 /* Set error bits ? fence ? ... */
736 static void pnv_phb3_translate_tve(PnvPhb3DMASpace
*ds
, hwaddr addr
,
737 bool is_write
, uint64_t tve
,
740 uint64_t tta
= GETFIELD(IODA2_TVT_TABLE_ADDR
, tve
);
741 int32_t lev
= GETFIELD(IODA2_TVT_NUM_LEVELS
, tve
);
742 uint32_t tts
= GETFIELD(IODA2_TVT_TCE_TABLE_SIZE
, tve
);
743 uint32_t tps
= GETFIELD(IODA2_TVT_IO_PSIZE
, tve
);
744 PnvPHB3
*phb
= ds
->phb
;
748 phb3_error(phb
, "Invalid #levels in TVE %d", lev
);
752 /* IO Page Size of 0 means untranslated, else use TCEs */
755 * We only support non-translate in top window.
757 * TODO: Venice/Murano support it on bottom window above 4G and
758 * Naples suports it on everything
760 if (!(tve
& PPC_BIT(51))) {
761 phb3_error(phb
, "xlate for invalid non-translate TVE");
764 /* TODO: Handle boundaries */
766 /* Use 4k pages like q35 ... for now */
767 tlb
->iova
= addr
& 0xfffffffffffff000ull
;
768 tlb
->translated_addr
= addr
& 0x0003fffffffff000ull
;
769 tlb
->addr_mask
= 0xfffull
;
770 tlb
->perm
= IOMMU_RW
;
772 uint32_t tce_shift
, tbl_shift
, sh
;
773 uint64_t base
, taddr
, tce
, tce_mask
;
777 phb3_error(phb
, "xlate for invalid translated TVE");
781 /* Address bits per bottom level TCE entry */
782 tce_shift
= tps
+ 11;
784 /* Address bits per table level */
787 /* Top level table base address */
790 /* Total shift to first level */
791 sh
= tbl_shift
* lev
+ tce_shift
;
793 /* TODO: Multi-level untested */
797 /* Grab the TCE address */
798 taddr
= base
| (((addr
>> sh
) & ((1ul << tbl_shift
) - 1)) << 3);
799 if (dma_memory_read(&address_space_memory
, taddr
, &tce
,
800 sizeof(tce
), MEMTXATTRS_UNSPECIFIED
)) {
801 phb3_error(phb
, "Failed to read TCE at 0x%"PRIx64
, taddr
);
804 tce
= be64_to_cpu(tce
);
806 /* Check permission for indirect TCE */
807 if ((lev
>= 0) && !(tce
& 3)) {
808 phb3_error(phb
, "Invalid indirect TCE at 0x%"PRIx64
, taddr
);
809 phb3_error(phb
, " xlate %"PRIx64
":%c TVE=%"PRIx64
, addr
,
810 is_write
? 'W' : 'R', tve
);
811 phb3_error(phb
, " tta=%"PRIx64
" lev=%d tts=%d tps=%d",
816 base
= tce
& ~0xfffull
;
819 /* We exit the loop with TCE being the final TCE */
820 if ((is_write
& !(tce
& 2)) || ((!is_write
) && !(tce
& 1))) {
821 phb3_error(phb
, "TCE access fault at 0x%"PRIx64
, taddr
);
822 phb3_error(phb
, " xlate %"PRIx64
":%c TVE=%"PRIx64
, addr
,
823 is_write
? 'W' : 'R', tve
);
824 phb3_error(phb
, " tta=%"PRIx64
" lev=%d tts=%d tps=%d",
828 tce_mask
= ~((1ull << tce_shift
) - 1);
829 tlb
->iova
= addr
& tce_mask
;
830 tlb
->translated_addr
= tce
& tce_mask
;
831 tlb
->addr_mask
= ~tce_mask
;
836 static IOMMUTLBEntry
pnv_phb3_translate_iommu(IOMMUMemoryRegion
*iommu
,
838 IOMMUAccessFlags flag
,
841 PnvPhb3DMASpace
*ds
= container_of(iommu
, PnvPhb3DMASpace
, dma_mr
);
844 IOMMUTLBEntry ret
= {
845 .target_as
= &address_space_memory
,
847 .translated_addr
= 0,
848 .addr_mask
= ~(hwaddr
)0,
851 PnvPHB3
*phb
= ds
->phb
;
854 if (!pnv_phb3_resolve_pe(ds
)) {
855 phb3_error(phb
, "Failed to resolve PE# for bus @%p (%d) devfn 0x%x",
856 ds
->bus
, pci_bus_num(ds
->bus
), ds
->devfn
);
861 switch (addr
>> 60) {
863 /* DMA or 32-bit MSI ? */
864 cfg
= ds
->phb
->regs
[PHB_PHB3_CONFIG
>> 3];
865 if ((cfg
& PHB_PHB3C_32BIT_MSI_EN
) &&
866 ((addr
& 0xffffffffffff0000ull
) == 0xffff0000ull
)) {
867 phb3_error(phb
, "xlate on 32-bit MSI region");
870 /* Choose TVE XXX Use PHB3 Control Register */
871 tve_sel
= (addr
>> 59) & 1;
872 tve
= ds
->phb
->ioda_TVT
[ds
->pe_num
* 2 + tve_sel
];
873 pnv_phb3_translate_tve(ds
, addr
, flag
& IOMMU_WO
, tve
, &ret
);
876 phb3_error(phb
, "xlate on 64-bit MSI region");
879 phb3_error(phb
, "xlate on unsupported address 0x%"PRIx64
, addr
);
884 #define TYPE_PNV_PHB3_IOMMU_MEMORY_REGION "pnv-phb3-iommu-memory-region"
885 DECLARE_INSTANCE_CHECKER(IOMMUMemoryRegion
, PNV_PHB3_IOMMU_MEMORY_REGION
,
886 TYPE_PNV_PHB3_IOMMU_MEMORY_REGION
)
888 static void pnv_phb3_iommu_memory_region_class_init(ObjectClass
*klass
,
891 IOMMUMemoryRegionClass
*imrc
= IOMMU_MEMORY_REGION_CLASS(klass
);
893 imrc
->translate
= pnv_phb3_translate_iommu
;
896 static const TypeInfo pnv_phb3_iommu_memory_region_info
= {
897 .parent
= TYPE_IOMMU_MEMORY_REGION
,
898 .name
= TYPE_PNV_PHB3_IOMMU_MEMORY_REGION
,
899 .class_init
= pnv_phb3_iommu_memory_region_class_init
,
903 * MSI/MSIX memory region implementation.
904 * The handler handles both MSI and MSIX.
906 static void pnv_phb3_msi_write(void *opaque
, hwaddr addr
,
907 uint64_t data
, unsigned size
)
909 PnvPhb3DMASpace
*ds
= opaque
;
912 if (!pnv_phb3_resolve_pe(ds
)) {
913 phb3_error(ds
->phb
, "Failed to resolve PE# for bus @%p (%d) devfn 0x%x",
914 ds
->bus
, pci_bus_num(ds
->bus
), ds
->devfn
);
918 pnv_phb3_msi_send(&ds
->phb
->msis
, addr
, data
, ds
->pe_num
);
921 /* There is no .read as the read result is undefined by PCI spec */
922 static uint64_t pnv_phb3_msi_read(void *opaque
, hwaddr addr
, unsigned size
)
924 PnvPhb3DMASpace
*ds
= opaque
;
926 phb3_error(ds
->phb
, "invalid read @ 0x%" HWADDR_PRIx
, addr
);
930 static const MemoryRegionOps pnv_phb3_msi_ops
= {
931 .read
= pnv_phb3_msi_read
,
932 .write
= pnv_phb3_msi_write
,
933 .endianness
= DEVICE_LITTLE_ENDIAN
936 static AddressSpace
*pnv_phb3_dma_iommu(PCIBus
*bus
, void *opaque
, int devfn
)
938 PnvPHB3
*phb
= opaque
;
941 QLIST_FOREACH(ds
, &phb
->dma_spaces
, list
) {
942 if (ds
->bus
== bus
&& ds
->devfn
== devfn
) {
948 ds
= g_new0(PnvPhb3DMASpace
, 1);
951 ds
->pe_num
= PHB_INVALID_PE
;
953 memory_region_init_iommu(&ds
->dma_mr
, sizeof(ds
->dma_mr
),
954 TYPE_PNV_PHB3_IOMMU_MEMORY_REGION
,
955 OBJECT(phb
), "phb3_iommu", UINT64_MAX
);
956 address_space_init(&ds
->dma_as
, MEMORY_REGION(&ds
->dma_mr
),
958 memory_region_init_io(&ds
->msi32_mr
, OBJECT(phb
), &pnv_phb3_msi_ops
,
959 ds
, "msi32", 0x10000);
960 memory_region_init_io(&ds
->msi64_mr
, OBJECT(phb
), &pnv_phb3_msi_ops
,
961 ds
, "msi64", 0x100000);
962 pnv_phb3_update_msi_regions(ds
);
964 QLIST_INSERT_HEAD(&phb
->dma_spaces
, ds
, list
);
969 static void pnv_phb3_instance_init(Object
*obj
)
971 PnvPHB3
*phb
= PNV_PHB3(obj
);
973 QLIST_INIT(&phb
->dma_spaces
);
976 object_initialize_child(obj
, "lsi", &phb
->lsis
, TYPE_ICS
);
978 /* Default init ... will be fixed by HW inits */
979 phb
->lsis
.offset
= 0;
982 object_initialize_child(obj
, "msi", &phb
->msis
, TYPE_PHB3_MSI
);
984 /* Power Bus Common Queue */
985 object_initialize_child(obj
, "pbcq", &phb
->pbcq
, TYPE_PNV_PBCQ
);
989 static void pnv_phb3_realize(DeviceState
*dev
, Error
**errp
)
991 PnvPHB3
*phb
= PNV_PHB3(dev
);
992 PCIHostState
*pci
= PCI_HOST_BRIDGE(dev
);
993 PnvMachineState
*pnv
= PNV_MACHINE(qdev_get_machine());
996 if (phb
->phb_id
>= PNV_CHIP_GET_CLASS(phb
->chip
)->num_phbs
) {
997 error_setg(errp
, "invalid PHB index: %d", phb
->phb_id
);
1002 object_property_set_link(OBJECT(&phb
->lsis
), "xics", OBJECT(pnv
),
1004 object_property_set_int(OBJECT(&phb
->lsis
), "nr-irqs", PNV_PHB3_NUM_LSI
,
1006 if (!qdev_realize(DEVICE(&phb
->lsis
), NULL
, errp
)) {
1010 for (i
= 0; i
< phb
->lsis
.nr_irqs
; i
++) {
1011 ics_set_irq_type(&phb
->lsis
, i
, true);
1014 phb
->qirqs
= qemu_allocate_irqs(ics_set_irq
, &phb
->lsis
, phb
->lsis
.nr_irqs
);
1017 object_property_set_link(OBJECT(&phb
->msis
), "phb", OBJECT(phb
),
1019 object_property_set_link(OBJECT(&phb
->msis
), "xics", OBJECT(pnv
),
1021 object_property_set_int(OBJECT(&phb
->msis
), "nr-irqs", PHB3_MAX_MSI
,
1023 if (!qdev_realize(DEVICE(&phb
->msis
), NULL
, errp
)) {
1027 /* Power Bus Common Queue */
1028 object_property_set_link(OBJECT(&phb
->pbcq
), "phb", OBJECT(phb
),
1030 if (!qdev_realize(DEVICE(&phb
->pbcq
), NULL
, errp
)) {
1034 /* Controller Registers */
1035 memory_region_init_io(&phb
->mr_regs
, OBJECT(phb
), &pnv_phb3_reg_ops
, phb
,
1036 "phb3-regs", 0x1000);
1039 * PHB3 doesn't support IO space. However, qemu gets very upset if
1040 * we don't have an IO region to anchor IO BARs onto so we just
1041 * initialize one which we never hook up to anything
1043 memory_region_init(&phb
->pci_io
, OBJECT(phb
), "pci-io", 0x10000);
1044 memory_region_init(&phb
->pci_mmio
, OBJECT(phb
), "pci-mmio",
1045 PCI_MMIO_TOTAL_SIZE
);
1047 pci
->bus
= pci_register_root_bus(dev
,
1048 dev
->id
? dev
->id
: NULL
,
1049 pnv_phb3_set_irq
, pnv_phb3_map_irq
, phb
,
1050 &phb
->pci_mmio
, &phb
->pci_io
,
1051 0, 4, TYPE_PNV_PHB3_ROOT_BUS
);
1053 pci_setup_iommu(pci
->bus
, pnv_phb3_dma_iommu
, phb
);
1055 pnv_phb_attach_root_port(PCI_HOST_BRIDGE(phb
), TYPE_PNV_PHB3_ROOT_PORT
);
1058 void pnv_phb3_update_regions(PnvPHB3
*phb
)
1060 PnvPBCQState
*pbcq
= &phb
->pbcq
;
1062 /* Unmap first always */
1063 if (memory_region_is_mapped(&phb
->mr_regs
)) {
1064 memory_region_del_subregion(&pbcq
->phbbar
, &phb
->mr_regs
);
1067 /* Map registers if enabled */
1068 if (memory_region_is_mapped(&pbcq
->phbbar
)) {
1069 /* TODO: We should use the PHB BAR 2 register but we don't ... */
1070 memory_region_add_subregion(&pbcq
->phbbar
, 0, &phb
->mr_regs
);
1073 /* Check/update m32 */
1074 if (memory_region_is_mapped(&phb
->mr_m32
)) {
1075 pnv_phb3_check_m32(phb
);
1077 pnv_phb3_check_all_m64s(phb
);
1080 static const char *pnv_phb3_root_bus_path(PCIHostState
*host_bridge
,
1083 PnvPHB3
*phb
= PNV_PHB3(host_bridge
);
1085 snprintf(phb
->bus_path
, sizeof(phb
->bus_path
), "00%02x:%02x",
1086 phb
->chip_id
, phb
->phb_id
);
1087 return phb
->bus_path
;
1090 static Property pnv_phb3_properties
[] = {
1091 DEFINE_PROP_UINT32("index", PnvPHB3
, phb_id
, 0),
1092 DEFINE_PROP_UINT32("chip-id", PnvPHB3
, chip_id
, 0),
1093 DEFINE_PROP_LINK("chip", PnvPHB3
, chip
, TYPE_PNV_CHIP
, PnvChip
*),
1094 DEFINE_PROP_END_OF_LIST(),
1097 static void pnv_phb3_class_init(ObjectClass
*klass
, void *data
)
1099 PCIHostBridgeClass
*hc
= PCI_HOST_BRIDGE_CLASS(klass
);
1100 DeviceClass
*dc
= DEVICE_CLASS(klass
);
1102 hc
->root_bus_path
= pnv_phb3_root_bus_path
;
1103 dc
->realize
= pnv_phb3_realize
;
1104 device_class_set_props(dc
, pnv_phb3_properties
);
1105 set_bit(DEVICE_CATEGORY_BRIDGE
, dc
->categories
);
1106 dc
->user_creatable
= false;
1109 static const TypeInfo pnv_phb3_type_info
= {
1110 .name
= TYPE_PNV_PHB3
,
1111 .parent
= TYPE_PCIE_HOST_BRIDGE
,
1112 .instance_size
= sizeof(PnvPHB3
),
1113 .class_init
= pnv_phb3_class_init
,
1114 .instance_init
= pnv_phb3_instance_init
,
1117 static void pnv_phb3_root_bus_class_init(ObjectClass
*klass
, void *data
)
1119 BusClass
*k
= BUS_CLASS(klass
);
1122 * PHB3 has only a single root complex. Enforce the limit on the
1128 static const TypeInfo pnv_phb3_root_bus_info
= {
1129 .name
= TYPE_PNV_PHB3_ROOT_BUS
,
1130 .parent
= TYPE_PCIE_BUS
,
1131 .class_init
= pnv_phb3_root_bus_class_init
,
1132 .interfaces
= (InterfaceInfo
[]) {
1133 { INTERFACE_PCIE_DEVICE
},
1138 static void pnv_phb3_root_port_realize(DeviceState
*dev
, Error
**errp
)
1140 PCIERootPortClass
*rpc
= PCIE_ROOT_PORT_GET_CLASS(dev
);
1141 PCIDevice
*pci
= PCI_DEVICE(dev
);
1142 PCIBus
*bus
= pci_get_bus(pci
);
1143 PnvPHB3
*phb
= NULL
;
1144 Error
*local_err
= NULL
;
1146 phb
= (PnvPHB3
*) object_dynamic_cast(OBJECT(bus
->qbus
.parent
),
1151 "pnv_phb3_root_port devices must be connected to pnv-phb3 buses");
1155 /* Set unique chassis/slot values for the root port */
1156 qdev_prop_set_uint8(&pci
->qdev
, "chassis", phb
->chip_id
);
1157 qdev_prop_set_uint16(&pci
->qdev
, "slot", phb
->phb_id
);
1159 rpc
->parent_realize(dev
, &local_err
);
1161 error_propagate(errp
, local_err
);
1166 static void pnv_phb3_root_port_class_init(ObjectClass
*klass
, void *data
)
1168 DeviceClass
*dc
= DEVICE_CLASS(klass
);
1169 PCIDeviceClass
*k
= PCI_DEVICE_CLASS(klass
);
1170 PCIERootPortClass
*rpc
= PCIE_ROOT_PORT_CLASS(klass
);
1172 dc
->desc
= "IBM PHB3 PCIE Root Port";
1174 device_class_set_parent_realize(dc
, pnv_phb3_root_port_realize
,
1175 &rpc
->parent_realize
);
1176 dc
->user_creatable
= false;
1178 k
->vendor_id
= PCI_VENDOR_ID_IBM
;
1179 k
->device_id
= 0x03dc;
1182 rpc
->exp_offset
= 0x48;
1183 rpc
->aer_offset
= 0x100;
1186 static const TypeInfo pnv_phb3_root_port_info
= {
1187 .name
= TYPE_PNV_PHB3_ROOT_PORT
,
1188 .parent
= TYPE_PCIE_ROOT_PORT
,
1189 .instance_size
= sizeof(PnvPHB3RootPort
),
1190 .class_init
= pnv_phb3_root_port_class_init
,
1193 static void pnv_phb3_register_types(void)
1195 type_register_static(&pnv_phb3_root_bus_info
);
1196 type_register_static(&pnv_phb3_root_port_info
);
1197 type_register_static(&pnv_phb3_type_info
);
1198 type_register_static(&pnv_phb3_iommu_memory_region_info
);
1201 type_init(pnv_phb3_register_types
)