hw/pci-host/pnv_phb3.c

   1 /*
   2  * QEMU PowerPC PowerNV (POWER8) PHB3 model
   3  *
   4  * Copyright (c) 2014-2020, IBM Corporation.
   5  *
   6  * This code is licensed under the GPL version 2 or later. See the
   7  * COPYING file in the top-level directory.
   8  */
   9 #include "qemu/osdep.h"
  10 #include "qemu/log.h"
  11 #include "qapi/visitor.h"
  12 #include "qapi/error.h"
  13 #include "qemu-common.h"
  14 #include "hw/pci-host/pnv_phb3_regs.h"
  15 #include "hw/pci-host/pnv_phb3.h"
  16 #include "hw/pci/pcie_host.h"
  17 #include "hw/pci/pcie_port.h"
  18 #include "hw/ppc/pnv.h"
  19 #include "hw/irq.h"
  20 #include "hw/qdev-properties.h"
  21 #include "qom/object.h"
  22 #include "sysemu/sysemu.h"
  23
  24 #define phb3_error(phb, fmt, ...)                                       \
  25     qemu_log_mask(LOG_GUEST_ERROR, "phb3[%d:%d]: " fmt "\n",            \
  26                   (phb)->chip_id, (phb)->phb_id, ## __VA_ARGS__)
  27
  28 static PCIDevice *pnv_phb3_find_cfg_dev(PnvPHB3 *phb)
  29 {
  30     PCIHostState *pci = PCI_HOST_BRIDGE(phb);
  31     uint64_t addr = phb->regs[PHB_CONFIG_ADDRESS >> 3];
  32     uint8_t bus, devfn;
  33
  34     if (!(addr >> 63)) {
  35         return NULL;
  36     }
  37     bus = (addr >> 52) & 0xff;
  38     devfn = (addr >> 44) & 0xff;
  39
  40     return pci_find_device(pci->bus, bus, devfn);
  41 }
  42
  43 /*
  44  * The CONFIG_DATA register expects little endian accesses, but as the
  45  * region is big endian, we have to swap the value.
  46  */
  47 static void pnv_phb3_config_write(PnvPHB3 *phb, unsigned off,
  48                                   unsigned size, uint64_t val)
  49 {
  50     uint32_t cfg_addr, limit;
  51     PCIDevice *pdev;
  52
  53     pdev = pnv_phb3_find_cfg_dev(phb);
  54     if (!pdev) {
  55         return;
  56     }
  57     cfg_addr = (phb->regs[PHB_CONFIG_ADDRESS >> 3] >> 32) & 0xffc;
  58     cfg_addr |= off;
  59     limit = pci_config_size(pdev);
  60     if (limit <= cfg_addr) {
  61         /*
  62          * conventional pci device can be behind pcie-to-pci bridge.
  63          * 256 <= addr < 4K has no effects.
  64          */
  65         return;
  66     }
  67     switch (size) {
  68     case 1:
  69         break;
  70     case 2:
  71         val = bswap16(val);
  72         break;
  73     case 4:
  74         val = bswap32(val);
  75         break;
  76     default:
  77         g_assert_not_reached();
  78     }
  79     pci_host_config_write_common(pdev, cfg_addr, limit, val, size);
  80 }
  81
  82 static uint64_t pnv_phb3_config_read(PnvPHB3 *phb, unsigned off,
  83                                      unsigned size)
  84 {
  85     uint32_t cfg_addr, limit;
  86     PCIDevice *pdev;
  87     uint64_t val;
  88
  89     pdev = pnv_phb3_find_cfg_dev(phb);
  90     if (!pdev) {
  91         return ~0ull;
  92     }
  93     cfg_addr = (phb->regs[PHB_CONFIG_ADDRESS >> 3] >> 32) & 0xffc;
  94     cfg_addr |= off;
  95     limit = pci_config_size(pdev);
  96     if (limit <= cfg_addr) {
  97         /*
  98          * conventional pci device can be behind pcie-to-pci bridge.
  99          * 256 <= addr < 4K has no effects.
 100          */
 101         return ~0ull;
 102     }
 103     val = pci_host_config_read_common(pdev, cfg_addr, limit, size);
 104     switch (size) {
 105     case 1:
 106         return val;
 107     case 2:
 108         return bswap16(val);
 109     case 4:
 110         return bswap32(val);
 111     default:
 112         g_assert_not_reached();
 113     }
 114 }
 115
 116 static void pnv_phb3_check_m32(PnvPHB3 *phb)
 117 {
 118     uint64_t base, start, size;
 119     MemoryRegion *parent;
 120     PnvPBCQState *pbcq = &phb->pbcq;
 121
 122     if (memory_region_is_mapped(&phb->mr_m32)) {
 123         memory_region_del_subregion(phb->mr_m32.container, &phb->mr_m32);
 124     }
 125
 126     if (!(phb->regs[PHB_PHB3_CONFIG >> 3] & PHB_PHB3C_M32_EN)) {
 127         return;
 128     }
 129
 130     /* Grab geometry from registers */
 131     base = phb->regs[PHB_M32_BASE_ADDR >> 3];
 132     start = phb->regs[PHB_M32_START_ADDR >> 3];
 133     size = ~(phb->regs[PHB_M32_BASE_MASK >> 3] | 0xfffc000000000000ull) + 1;
 134
 135     /* Check if it matches an enabled MMIO region in the PBCQ */
 136     if (memory_region_is_mapped(&pbcq->mmbar0) &&
 137         base >= pbcq->mmio0_base &&
 138         (base + size) <= (pbcq->mmio0_base + pbcq->mmio0_size)) {
 139         parent = &pbcq->mmbar0;
 140         base -= pbcq->mmio0_base;
 141     } else if (memory_region_is_mapped(&pbcq->mmbar1) &&
 142                base >= pbcq->mmio1_base &&
 143                (base + size) <= (pbcq->mmio1_base + pbcq->mmio1_size)) {
 144         parent = &pbcq->mmbar1;
 145         base -= pbcq->mmio1_base;
 146     } else {
 147         return;
 148     }
 149
 150     /* Create alias */
 151     memory_region_init_alias(&phb->mr_m32, OBJECT(phb), "phb3-m32",
 152                              &phb->pci_mmio, start, size);
 153     memory_region_add_subregion(parent, base, &phb->mr_m32);
 154 }
 155
 156 static void pnv_phb3_check_m64(PnvPHB3 *phb, uint32_t index)
 157 {
 158     uint64_t base, start, size, m64;
 159     MemoryRegion *parent;
 160     PnvPBCQState *pbcq = &phb->pbcq;
 161
 162     if (memory_region_is_mapped(&phb->mr_m64[index])) {
 163         /* Should we destroy it in RCU friendly way... ? */
 164         memory_region_del_subregion(phb->mr_m64[index].container,
 165                                     &phb->mr_m64[index]);
 166     }
 167
 168     /* Get table entry */
 169     m64 = phb->ioda_M64BT[index];
 170
 171     if (!(m64 & IODA2_M64BT_ENABLE)) {
 172         return;
 173     }
 174
 175     /* Grab geometry from registers */
 176     base = GETFIELD(IODA2_M64BT_BASE, m64) << 20;
 177     if (m64 & IODA2_M64BT_SINGLE_PE) {
 178         base &= ~0x1ffffffull;
 179     }
 180     size = GETFIELD(IODA2_M64BT_MASK, m64) << 20;
 181     size |= 0xfffc000000000000ull;
 182     size = ~size + 1;
 183     start = base | (phb->regs[PHB_M64_UPPER_BITS >> 3]);
 184
 185     /* Check if it matches an enabled MMIO region in the PBCQ */
 186     if (memory_region_is_mapped(&pbcq->mmbar0) &&
 187         base >= pbcq->mmio0_base &&
 188         (base + size) <= (pbcq->mmio0_base + pbcq->mmio0_size)) {
 189         parent = &pbcq->mmbar0;
 190         base -= pbcq->mmio0_base;
 191     } else if (memory_region_is_mapped(&pbcq->mmbar1) &&
 192                base >= pbcq->mmio1_base &&
 193                (base + size) <= (pbcq->mmio1_base + pbcq->mmio1_size)) {
 194         parent = &pbcq->mmbar1;
 195         base -= pbcq->mmio1_base;
 196     } else {
 197         return;
 198     }
 199
 200     /* Create alias */
 201     memory_region_init_alias(&phb->mr_m64[index], OBJECT(phb), "phb3-m64",
 202                              &phb->pci_mmio, start, size);
 203     memory_region_add_subregion(parent, base, &phb->mr_m64[index]);
 204 }
 205
 206 static void pnv_phb3_check_all_m64s(PnvPHB3 *phb)
 207 {
 208     uint64_t i;
 209
 210     for (i = 0; i < PNV_PHB3_NUM_M64; i++) {
 211         pnv_phb3_check_m64(phb, i);
 212     }
 213 }
 214
 215 static void pnv_phb3_lxivt_write(PnvPHB3 *phb, unsigned idx, uint64_t val)
 216 {
 217     uint8_t server, prio;
 218
 219     phb->ioda_LXIVT[idx] = val & (IODA2_LXIVT_SERVER |
 220                                   IODA2_LXIVT_PRIORITY |
 221                                   IODA2_LXIVT_NODE_ID);
 222     server = GETFIELD(IODA2_LXIVT_SERVER, val);
 223     prio = GETFIELD(IODA2_LXIVT_PRIORITY, val);
 224
 225     /*
 226      * The low order 2 bits are the link pointer (Type II interrupts).
 227      * Shift back to get a valid IRQ server.
 228      */
 229     server >>= 2;
 230
 231     ics_write_xive(&phb->lsis, idx, server, prio, prio);
 232 }
 233
 234 static uint64_t *pnv_phb3_ioda_access(PnvPHB3 *phb,
 235                                       unsigned *out_table, unsigned *out_idx)
 236 {
 237     uint64_t adreg = phb->regs[PHB_IODA_ADDR >> 3];
 238     unsigned int index = GETFIELD(PHB_IODA_AD_TADR, adreg);
 239     unsigned int table = GETFIELD(PHB_IODA_AD_TSEL, adreg);
 240     unsigned int mask;
 241     uint64_t *tptr = NULL;
 242
 243     switch (table) {
 244     case IODA2_TBL_LIST:
 245         tptr = phb->ioda_LIST;
 246         mask = 7;
 247         break;
 248     case IODA2_TBL_LXIVT:
 249         tptr = phb->ioda_LXIVT;
 250         mask = 7;
 251         break;
 252     case IODA2_TBL_IVC_CAM:
 253     case IODA2_TBL_RBA:
 254         mask = 31;
 255         break;
 256     case IODA2_TBL_RCAM:
 257         mask = 63;
 258         break;
 259     case IODA2_TBL_MRT:
 260         mask = 7;
 261         break;
 262     case IODA2_TBL_PESTA:
 263     case IODA2_TBL_PESTB:
 264         mask = 255;
 265         break;
 266     case IODA2_TBL_TVT:
 267         tptr = phb->ioda_TVT;
 268         mask = 511;
 269         break;
 270     case IODA2_TBL_TCAM:
 271     case IODA2_TBL_TDR:
 272         mask = 63;
 273         break;
 274     case IODA2_TBL_M64BT:
 275         tptr = phb->ioda_M64BT;
 276         mask = 15;
 277         break;
 278     case IODA2_TBL_M32DT:
 279         tptr = phb->ioda_MDT;
 280         mask = 255;
 281         break;
 282     case IODA2_TBL_PEEV:
 283         tptr = phb->ioda_PEEV;
 284         mask = 3;
 285         break;
 286     default:
 287         phb3_error(phb, "invalid IODA table %d", table);
 288         return NULL;
 289     }
 290     index &= mask;
 291     if (out_idx) {
 292         *out_idx = index;
 293     }
 294     if (out_table) {
 295         *out_table = table;
 296     }
 297     if (tptr) {
 298         tptr += index;
 299     }
 300     if (adreg & PHB_IODA_AD_AUTOINC) {
 301         index = (index + 1) & mask;
 302         adreg = SETFIELD(PHB_IODA_AD_TADR, adreg, index);
 303     }
 304     phb->regs[PHB_IODA_ADDR >> 3] = adreg;
 305     return tptr;
 306 }
 307
 308 static uint64_t pnv_phb3_ioda_read(PnvPHB3 *phb)
 309 {
 310         unsigned table;
 311         uint64_t *tptr;
 312
 313         tptr = pnv_phb3_ioda_access(phb, &table, NULL);
 314         if (!tptr) {
 315             /* Return 0 on unsupported tables, not ff's */
 316             return 0;
 317         }
 318         return *tptr;
 319 }
 320
 321 static void pnv_phb3_ioda_write(PnvPHB3 *phb, uint64_t val)
 322 {
 323         unsigned table, idx;
 324         uint64_t *tptr;
 325
 326         tptr = pnv_phb3_ioda_access(phb, &table, &idx);
 327         if (!tptr) {
 328             return;
 329         }
 330
 331         /* Handle side effects */
 332         switch (table) {
 333         case IODA2_TBL_LXIVT:
 334             pnv_phb3_lxivt_write(phb, idx, val);
 335             break;
 336         case IODA2_TBL_M64BT:
 337             *tptr = val;
 338             pnv_phb3_check_m64(phb, idx);
 339             break;
 340         default:
 341             *tptr = val;
 342         }
 343 }
 344
 345 /*
 346  * This is called whenever the PHB LSI, MSI source ID register or
 347  * the PBCQ irq filters are written.
 348  */
 349 void pnv_phb3_remap_irqs(PnvPHB3 *phb)
 350 {
 351     ICSState *ics = &phb->lsis;
 352     uint32_t local, global, count, mask, comp;
 353     uint64_t baren;
 354     PnvPBCQState *pbcq = &phb->pbcq;
 355
 356     /*
 357      * First check if we are enabled. Unlike real HW we don't separate
 358      * TX and RX so we enable if both are set
 359      */
 360     baren = pbcq->nest_regs[PBCQ_NEST_BAR_EN];
 361     if (!(baren & PBCQ_NEST_BAR_EN_IRSN_RX) ||
 362         !(baren & PBCQ_NEST_BAR_EN_IRSN_TX)) {
 363         ics->offset = 0;
 364         return;
 365     }
 366
 367     /* Grab local LSI source ID */
 368     local = GETFIELD(PHB_LSI_SRC_ID, phb->regs[PHB_LSI_SOURCE_ID >> 3]) << 3;
 369
 370     /* Grab global one and compare */
 371     global = GETFIELD(PBCQ_NEST_LSI_SRC,
 372                       pbcq->nest_regs[PBCQ_NEST_LSI_SRC_ID]) << 3;
 373     if (global != local) {
 374         /*
 375          * This happens during initialization, let's come back when we
 376          * are properly configured
 377          */
 378         ics->offset = 0;
 379         return;
 380     }
 381
 382     /* Get the base on the powerbus */
 383     comp = GETFIELD(PBCQ_NEST_IRSN_COMP,
 384                     pbcq->nest_regs[PBCQ_NEST_IRSN_COMPARE]);
 385     mask = GETFIELD(PBCQ_NEST_IRSN_COMP,
 386                     pbcq->nest_regs[PBCQ_NEST_IRSN_MASK]);
 387     count = ((~mask) + 1) & 0x7ffff;
 388     phb->total_irq = count;
 389
 390     /* Sanity checks */
 391     if ((global + PNV_PHB3_NUM_LSI) > count) {
 392         phb3_error(phb, "LSIs out of reach: LSI base=%d total irq=%d", global,
 393                    count);
 394     }
 395
 396     if (count > 2048) {
 397         phb3_error(phb, "More interrupts than supported: %d", count);
 398     }
 399
 400     if ((comp & mask) != comp) {
 401         phb3_error(phb, "IRQ compare bits not in mask: comp=0x%x mask=0x%x",
 402                    comp, mask);
 403         comp &= mask;
 404     }
 405     /* Setup LSI offset */
 406     ics->offset = comp + global;
 407
 408     /* Setup MSI offset */
 409     pnv_phb3_msi_update_config(&phb->msis, comp, count - PNV_PHB3_NUM_LSI);
 410 }
 411
 412 static void pnv_phb3_lsi_src_id_write(PnvPHB3 *phb, uint64_t val)
 413 {
 414     /* Sanitize content */
 415     val &= PHB_LSI_SRC_ID;
 416     phb->regs[PHB_LSI_SOURCE_ID >> 3] = val;
 417     pnv_phb3_remap_irqs(phb);
 418 }
 419
 420 static void pnv_phb3_rtc_invalidate(PnvPHB3 *phb, uint64_t val)
 421 {
 422     PnvPhb3DMASpace *ds;
 423
 424     /* Always invalidate all for now ... */
 425     QLIST_FOREACH(ds, &phb->dma_spaces, list) {
 426         ds->pe_num = PHB_INVALID_PE;
 427     }
 428 }
 429
 430
 431 static void pnv_phb3_update_msi_regions(PnvPhb3DMASpace *ds)
 432 {
 433     uint64_t cfg = ds->phb->regs[PHB_PHB3_CONFIG >> 3];
 434
 435     if (cfg & PHB_PHB3C_32BIT_MSI_EN) {
 436         if (!memory_region_is_mapped(&ds->msi32_mr)) {
 437             memory_region_add_subregion(MEMORY_REGION(&ds->dma_mr),
 438                                         0xffff0000, &ds->msi32_mr);
 439         }
 440     } else {
 441         if (memory_region_is_mapped(&ds->msi32_mr)) {
 442             memory_region_del_subregion(MEMORY_REGION(&ds->dma_mr),
 443                                         &ds->msi32_mr);
 444         }
 445     }
 446
 447     if (cfg & PHB_PHB3C_64BIT_MSI_EN) {
 448         if (!memory_region_is_mapped(&ds->msi64_mr)) {
 449             memory_region_add_subregion(MEMORY_REGION(&ds->dma_mr),
 450                                         (1ull << 60), &ds->msi64_mr);
 451         }
 452     } else {
 453         if (memory_region_is_mapped(&ds->msi64_mr)) {
 454             memory_region_del_subregion(MEMORY_REGION(&ds->dma_mr),
 455                                         &ds->msi64_mr);
 456         }
 457     }
 458 }
 459
 460 static void pnv_phb3_update_all_msi_regions(PnvPHB3 *phb)
 461 {
 462     PnvPhb3DMASpace *ds;
 463
 464     QLIST_FOREACH(ds, &phb->dma_spaces, list) {
 465         pnv_phb3_update_msi_regions(ds);
 466     }
 467 }
 468
 469 void pnv_phb3_reg_write(void *opaque, hwaddr off, uint64_t val, unsigned size)
 470 {
 471     PnvPHB3 *phb = opaque;
 472     bool changed;
 473
 474     /* Special case configuration data */
 475     if ((off & 0xfffc) == PHB_CONFIG_DATA) {
 476         pnv_phb3_config_write(phb, off & 0x3, size, val);
 477         return;
 478     }
 479
 480     /* Other registers are 64-bit only */
 481     if (size != 8 || off & 0x7) {
 482         phb3_error(phb, "Invalid register access, offset: 0x%"PRIx64" size: %d",
 483                    off, size);
 484         return;
 485     }
 486
 487     /* Handle masking & filtering */
 488     switch (off) {
 489     case PHB_M64_UPPER_BITS:
 490         val &= 0xfffc000000000000ull;
 491         break;
 492     case PHB_Q_DMA_R:
 493         /*
 494          * This is enough logic to make SW happy but we aren't actually
 495          * quiescing the DMAs
 496          */
 497         if (val & PHB_Q_DMA_R_AUTORESET) {
 498             val = 0;
 499         } else {
 500             val &= PHB_Q_DMA_R_QUIESCE_DMA;
 501         }
 502         break;
 503     /* LEM stuff */
 504     case PHB_LEM_FIR_AND_MASK:
 505         phb->regs[PHB_LEM_FIR_ACCUM >> 3] &= val;
 506         return;
 507     case PHB_LEM_FIR_OR_MASK:
 508         phb->regs[PHB_LEM_FIR_ACCUM >> 3] |= val;
 509         return;
 510     case PHB_LEM_ERROR_AND_MASK:
 511         phb->regs[PHB_LEM_ERROR_MASK >> 3] &= val;
 512         return;
 513     case PHB_LEM_ERROR_OR_MASK:
 514         phb->regs[PHB_LEM_ERROR_MASK >> 3] |= val;
 515         return;
 516     case PHB_LEM_WOF:
 517         val = 0;
 518         break;
 519     }
 520
 521     /* Record whether it changed */
 522     changed = phb->regs[off >> 3] != val;
 523
 524     /* Store in register cache first */
 525     phb->regs[off >> 3] = val;
 526
 527     /* Handle side effects */
 528     switch (off) {
 529     case PHB_PHB3_CONFIG:
 530         if (changed) {
 531             pnv_phb3_update_all_msi_regions(phb);
 532         }
 533         /* fall through */
 534     case PHB_M32_BASE_ADDR:
 535     case PHB_M32_BASE_MASK:
 536     case PHB_M32_START_ADDR:
 537         if (changed) {
 538             pnv_phb3_check_m32(phb);
 539         }
 540         break;
 541     case PHB_M64_UPPER_BITS:
 542         if (changed) {
 543             pnv_phb3_check_all_m64s(phb);
 544         }
 545         break;
 546     case PHB_LSI_SOURCE_ID:
 547         if (changed) {
 548             pnv_phb3_lsi_src_id_write(phb, val);
 549         }
 550         break;
 551
 552     /* IODA table accesses */
 553     case PHB_IODA_DATA0:
 554         pnv_phb3_ioda_write(phb, val);
 555         break;
 556
 557     /* RTC invalidation */
 558     case PHB_RTC_INVALIDATE:
 559         pnv_phb3_rtc_invalidate(phb, val);
 560         break;
 561
 562     /* FFI request */
 563     case PHB_FFI_REQUEST:
 564         pnv_phb3_msi_ffi(&phb->msis, val);
 565         break;
 566
 567     /* Silent simple writes */
 568     case PHB_CONFIG_ADDRESS:
 569     case PHB_IODA_ADDR:
 570     case PHB_TCE_KILL:
 571     case PHB_TCE_SPEC_CTL:
 572     case PHB_PEST_BAR:
 573     case PHB_PELTV_BAR:
 574     case PHB_RTT_BAR:
 575     case PHB_RBA_BAR:
 576     case PHB_IVT_BAR:
 577     case PHB_FFI_LOCK:
 578     case PHB_LEM_FIR_ACCUM:
 579     case PHB_LEM_ERROR_MASK:
 580     case PHB_LEM_ACTION0:
 581     case PHB_LEM_ACTION1:
 582         break;
 583
 584     /* Noise on anything else */
 585     default:
 586         qemu_log_mask(LOG_UNIMP, "phb3: reg_write 0x%"PRIx64"=%"PRIx64"\n",
 587                       off, val);
 588     }
 589 }
 590
 591 uint64_t pnv_phb3_reg_read(void *opaque, hwaddr off, unsigned size)
 592 {
 593     PnvPHB3 *phb = opaque;
 594     PCIHostState *pci = PCI_HOST_BRIDGE(phb);
 595     uint64_t val;
 596
 597     if ((off & 0xfffc) == PHB_CONFIG_DATA) {
 598         return pnv_phb3_config_read(phb, off & 0x3, size);
 599     }
 600
 601     /* Other registers are 64-bit only */
 602     if (size != 8 || off & 0x7) {
 603         phb3_error(phb, "Invalid register access, offset: 0x%"PRIx64" size: %d",
 604                    off, size);
 605         return ~0ull;
 606     }
 607
 608     /* Default read from cache */
 609     val = phb->regs[off >> 3];
 610
 611     switch (off) {
 612     /* Simulate venice DD2.0 */
 613     case PHB_VERSION:
 614         return 0x000000a300000005ull;
 615     case PHB_PCIE_SYSTEM_CONFIG:
 616         return 0x441100fc30000000;
 617
 618     /* IODA table accesses */
 619     case PHB_IODA_DATA0:
 620         return pnv_phb3_ioda_read(phb);
 621
 622     /* Link training always appears trained */
 623     case PHB_PCIE_DLP_TRAIN_CTL:
 624         if (!pci_find_device(pci->bus, 1, 0)) {
 625             return 0;
 626         }
 627         return PHB_PCIE_DLP_INBAND_PRESENCE | PHB_PCIE_DLP_TC_DL_LINKACT;
 628
 629     /* FFI Lock */
 630     case PHB_FFI_LOCK:
 631         /* Set lock and return previous value */
 632         phb->regs[off >> 3] |= PHB_FFI_LOCK_STATE;
 633         return val;
 634
 635     /* DMA read sync: make it look like it's complete */
 636     case PHB_DMARD_SYNC:
 637         return PHB_DMARD_SYNC_COMPLETE;
 638
 639     /* Silent simple reads */
 640     case PHB_PHB3_CONFIG:
 641     case PHB_M32_BASE_ADDR:
 642     case PHB_M32_BASE_MASK:
 643     case PHB_M32_START_ADDR:
 644     case PHB_CONFIG_ADDRESS:
 645     case PHB_IODA_ADDR:
 646     case PHB_RTC_INVALIDATE:
 647     case PHB_TCE_KILL:
 648     case PHB_TCE_SPEC_CTL:
 649     case PHB_PEST_BAR:
 650     case PHB_PELTV_BAR:
 651     case PHB_RTT_BAR:
 652     case PHB_RBA_BAR:
 653     case PHB_IVT_BAR:
 654     case PHB_M64_UPPER_BITS:
 655     case PHB_LEM_FIR_ACCUM:
 656     case PHB_LEM_ERROR_MASK:
 657     case PHB_LEM_ACTION0:
 658     case PHB_LEM_ACTION1:
 659         break;
 660
 661     /* Noise on anything else */
 662     default:
 663         qemu_log_mask(LOG_UNIMP, "phb3: reg_read 0x%"PRIx64"=%"PRIx64"\n",
 664                       off, val);
 665     }
 666     return val;
 667 }
 668
 669 static const MemoryRegionOps pnv_phb3_reg_ops = {
 670     .read = pnv_phb3_reg_read,
 671     .write = pnv_phb3_reg_write,
 672     .valid.min_access_size = 1,
 673     .valid.max_access_size = 8,
 674     .impl.min_access_size = 1,
 675     .impl.max_access_size = 8,
 676     .endianness = DEVICE_BIG_ENDIAN,
 677 };
 678
 679 static int pnv_phb3_map_irq(PCIDevice *pci_dev, int irq_num)
 680 {
 681     /* Check that out properly ... */
 682     return irq_num & 3;
 683 }
 684
 685 static void pnv_phb3_set_irq(void *opaque, int irq_num, int level)
 686 {
 687     PnvPHB3 *phb = opaque;
 688
 689     /* LSI only ... */
 690     if (irq_num > 3) {
 691         phb3_error(phb, "Unknown IRQ to set %d", irq_num);
 692     }
 693     qemu_set_irq(phb->qirqs[irq_num], level);
 694 }
 695
 696 static bool pnv_phb3_resolve_pe(PnvPhb3DMASpace *ds)
 697 {
 698     uint64_t rtt, addr;
 699     uint16_t rte;
 700     int bus_num;
 701
 702     /* Already resolved ? */
 703     if (ds->pe_num != PHB_INVALID_PE) {
 704         return true;
 705     }
 706
 707     /* We need to lookup the RTT */
 708     rtt = ds->phb->regs[PHB_RTT_BAR >> 3];
 709     if (!(rtt & PHB_RTT_BAR_ENABLE)) {
 710         phb3_error(ds->phb, "DMA with RTT BAR disabled !");
 711         /* Set error bits ? fence ? ... */
 712         return false;
 713     }
 714
 715     /* Read RTE */
 716     bus_num = pci_bus_num(ds->bus);
 717     addr = rtt & PHB_RTT_BASE_ADDRESS_MASK;
 718     addr += 2 * ((bus_num << 8) | ds->devfn);
 719     if (dma_memory_read(&address_space_memory, addr, &rte,
 720                         sizeof(rte), MEMTXATTRS_UNSPECIFIED)) {
 721         phb3_error(ds->phb, "Failed to read RTT entry at 0x%"PRIx64, addr);
 722         /* Set error bits ? fence ? ... */
 723         return false;
 724     }
 725     rte = be16_to_cpu(rte);
 726
 727     /* Fail upon reading of invalid PE# */
 728     if (rte >= PNV_PHB3_NUM_PE) {
 729         phb3_error(ds->phb, "RTE for RID 0x%x invalid (%04x", ds->devfn, rte);
 730         /* Set error bits ? fence ? ... */
 731         return false;
 732     }
 733     ds->pe_num = rte;
 734     return true;
 735 }
 736
 737 static void pnv_phb3_translate_tve(PnvPhb3DMASpace *ds, hwaddr addr,
 738                                    bool is_write, uint64_t tve,
 739                                    IOMMUTLBEntry *tlb)
 740 {
 741     uint64_t tta = GETFIELD(IODA2_TVT_TABLE_ADDR, tve);
 742     int32_t  lev = GETFIELD(IODA2_TVT_NUM_LEVELS, tve);
 743     uint32_t tts = GETFIELD(IODA2_TVT_TCE_TABLE_SIZE, tve);
 744     uint32_t tps = GETFIELD(IODA2_TVT_IO_PSIZE, tve);
 745     PnvPHB3 *phb = ds->phb;
 746
 747     /* Invalid levels */
 748     if (lev > 4) {
 749         phb3_error(phb, "Invalid #levels in TVE %d", lev);
 750         return;
 751     }
 752
 753     /* IO Page Size of 0 means untranslated, else use TCEs */
 754     if (tps == 0) {
 755         /*
 756          * We only support non-translate in top window.
 757          *
 758          * TODO: Venice/Murano support it on bottom window above 4G and
 759          * Naples suports it on everything
 760          */
 761         if (!(tve & PPC_BIT(51))) {
 762             phb3_error(phb, "xlate for invalid non-translate TVE");
 763             return;
 764         }
 765         /* TODO: Handle boundaries */
 766
 767         /* Use 4k pages like q35 ... for now */
 768         tlb->iova = addr & 0xfffffffffffff000ull;
 769         tlb->translated_addr = addr & 0x0003fffffffff000ull;
 770         tlb->addr_mask = 0xfffull;
 771         tlb->perm = IOMMU_RW;
 772     } else {
 773         uint32_t tce_shift, tbl_shift, sh;
 774         uint64_t base, taddr, tce, tce_mask;
 775
 776         /* TVE disabled ? */
 777         if (tts == 0) {
 778             phb3_error(phb, "xlate for invalid translated TVE");
 779             return;
 780         }
 781
 782         /* Address bits per bottom level TCE entry */
 783         tce_shift = tps + 11;
 784
 785         /* Address bits per table level */
 786         tbl_shift = tts + 8;
 787
 788         /* Top level table base address */
 789         base = tta << 12;
 790
 791         /* Total shift to first level */
 792         sh = tbl_shift * lev + tce_shift;
 793
 794         /* TODO: Multi-level untested */
 795         do {
 796             lev--;
 797
 798             /* Grab the TCE address */
 799             taddr = base | (((addr >> sh) & ((1ul << tbl_shift) - 1)) << 3);
 800             if (dma_memory_read(&address_space_memory, taddr, &tce,
 801                                 sizeof(tce), MEMTXATTRS_UNSPECIFIED)) {
 802                 phb3_error(phb, "Failed to read TCE at 0x%"PRIx64, taddr);
 803                 return;
 804             }
 805             tce = be64_to_cpu(tce);
 806
 807             /* Check permission for indirect TCE */
 808             if ((lev >= 0) && !(tce & 3)) {
 809                 phb3_error(phb, "Invalid indirect TCE at 0x%"PRIx64, taddr);
 810                 phb3_error(phb, " xlate %"PRIx64":%c TVE=%"PRIx64, addr,
 811                            is_write ? 'W' : 'R', tve);
 812                 phb3_error(phb, " tta=%"PRIx64" lev=%d tts=%d tps=%d",
 813                            tta, lev, tts, tps);
 814                 return;
 815             }
 816             sh -= tbl_shift;
 817             base = tce & ~0xfffull;
 818         } while (lev >= 0);
 819
 820         /* We exit the loop with TCE being the final TCE */
 821         if ((is_write & !(tce & 2)) || ((!is_write) && !(tce & 1))) {
 822             phb3_error(phb, "TCE access fault at 0x%"PRIx64, taddr);
 823             phb3_error(phb, " xlate %"PRIx64":%c TVE=%"PRIx64, addr,
 824                        is_write ? 'W' : 'R', tve);
 825             phb3_error(phb, " tta=%"PRIx64" lev=%d tts=%d tps=%d",
 826                        tta, lev, tts, tps);
 827             return;
 828         }
 829         tce_mask = ~((1ull << tce_shift) - 1);
 830         tlb->iova = addr & tce_mask;
 831         tlb->translated_addr = tce & tce_mask;
 832         tlb->addr_mask = ~tce_mask;
 833         tlb->perm = tce & 3;
 834     }
 835 }
 836
 837 static IOMMUTLBEntry pnv_phb3_translate_iommu(IOMMUMemoryRegion *iommu,
 838                                               hwaddr addr,
 839                                               IOMMUAccessFlags flag,
 840                                               int iommu_idx)
 841 {
 842     PnvPhb3DMASpace *ds = container_of(iommu, PnvPhb3DMASpace, dma_mr);
 843     int tve_sel;
 844     uint64_t tve, cfg;
 845     IOMMUTLBEntry ret = {
 846         .target_as = &address_space_memory,
 847         .iova = addr,
 848         .translated_addr = 0,
 849         .addr_mask = ~(hwaddr)0,
 850         .perm = IOMMU_NONE,
 851     };
 852     PnvPHB3 *phb = ds->phb;
 853
 854     /* Resolve PE# */
 855     if (!pnv_phb3_resolve_pe(ds)) {
 856         phb3_error(phb, "Failed to resolve PE# for bus @%p (%d) devfn 0x%x",
 857                    ds->bus, pci_bus_num(ds->bus), ds->devfn);
 858         return ret;
 859     }
 860
 861     /* Check top bits */
 862     switch (addr >> 60) {
 863     case 00:
 864         /* DMA or 32-bit MSI ? */
 865         cfg = ds->phb->regs[PHB_PHB3_CONFIG >> 3];
 866         if ((cfg & PHB_PHB3C_32BIT_MSI_EN) &&
 867             ((addr & 0xffffffffffff0000ull) == 0xffff0000ull)) {
 868             phb3_error(phb, "xlate on 32-bit MSI region");
 869             return ret;
 870         }
 871         /* Choose TVE XXX Use PHB3 Control Register */
 872         tve_sel = (addr >> 59) & 1;
 873         tve = ds->phb->ioda_TVT[ds->pe_num * 2 + tve_sel];
 874         pnv_phb3_translate_tve(ds, addr, flag & IOMMU_WO, tve, &ret);
 875         break;
 876     case 01:
 877         phb3_error(phb, "xlate on 64-bit MSI region");
 878         break;
 879     default:
 880         phb3_error(phb, "xlate on unsupported address 0x%"PRIx64, addr);
 881     }
 882     return ret;
 883 }
 884
 885 #define TYPE_PNV_PHB3_IOMMU_MEMORY_REGION "pnv-phb3-iommu-memory-region"
 886 DECLARE_INSTANCE_CHECKER(IOMMUMemoryRegion, PNV_PHB3_IOMMU_MEMORY_REGION,
 887                          TYPE_PNV_PHB3_IOMMU_MEMORY_REGION)
 888
 889 static void pnv_phb3_iommu_memory_region_class_init(ObjectClass *klass,
 890                                                     void *data)
 891 {
 892     IOMMUMemoryRegionClass *imrc = IOMMU_MEMORY_REGION_CLASS(klass);
 893
 894     imrc->translate = pnv_phb3_translate_iommu;
 895 }
 896
 897 static const TypeInfo pnv_phb3_iommu_memory_region_info = {
 898     .parent = TYPE_IOMMU_MEMORY_REGION,
 899     .name = TYPE_PNV_PHB3_IOMMU_MEMORY_REGION,
 900     .class_init = pnv_phb3_iommu_memory_region_class_init,
 901 };
 902
 903 /*
 904  * MSI/MSIX memory region implementation.
 905  * The handler handles both MSI and MSIX.
 906  */
 907 static void pnv_phb3_msi_write(void *opaque, hwaddr addr,
 908                                uint64_t data, unsigned size)
 909 {
 910     PnvPhb3DMASpace *ds = opaque;
 911
 912     /* Resolve PE# */
 913     if (!pnv_phb3_resolve_pe(ds)) {
 914         phb3_error(ds->phb, "Failed to resolve PE# for bus @%p (%d) devfn 0x%x",
 915                    ds->bus, pci_bus_num(ds->bus), ds->devfn);
 916         return;
 917     }
 918
 919     pnv_phb3_msi_send(&ds->phb->msis, addr, data, ds->pe_num);
 920 }
 921
 922 /* There is no .read as the read result is undefined by PCI spec */
 923 static uint64_t pnv_phb3_msi_read(void *opaque, hwaddr addr, unsigned size)
 924 {
 925     PnvPhb3DMASpace *ds = opaque;
 926
 927     phb3_error(ds->phb, "invalid read @ 0x%" HWADDR_PRIx, addr);
 928     return -1;
 929 }
 930
 931 static const MemoryRegionOps pnv_phb3_msi_ops = {
 932     .read = pnv_phb3_msi_read,
 933     .write = pnv_phb3_msi_write,
 934     .endianness = DEVICE_LITTLE_ENDIAN
 935 };
 936
 937 static AddressSpace *pnv_phb3_dma_iommu(PCIBus *bus, void *opaque, int devfn)
 938 {
 939     PnvPHB3 *phb = opaque;
 940     PnvPhb3DMASpace *ds;
 941
 942     QLIST_FOREACH(ds, &phb->dma_spaces, list) {
 943         if (ds->bus == bus && ds->devfn == devfn) {
 944             break;
 945         }
 946     }
 947
 948     if (ds == NULL) {
 949         ds = g_malloc0(sizeof(PnvPhb3DMASpace));
 950         ds->bus = bus;
 951         ds->devfn = devfn;
 952         ds->pe_num = PHB_INVALID_PE;
 953         ds->phb = phb;
 954         memory_region_init_iommu(&ds->dma_mr, sizeof(ds->dma_mr),
 955                                  TYPE_PNV_PHB3_IOMMU_MEMORY_REGION,
 956                                  OBJECT(phb), "phb3_iommu", UINT64_MAX);
 957         address_space_init(&ds->dma_as, MEMORY_REGION(&ds->dma_mr),
 958                            "phb3_iommu");
 959         memory_region_init_io(&ds->msi32_mr, OBJECT(phb), &pnv_phb3_msi_ops,
 960                               ds, "msi32", 0x10000);
 961         memory_region_init_io(&ds->msi64_mr, OBJECT(phb), &pnv_phb3_msi_ops,
 962                               ds, "msi64", 0x100000);
 963         pnv_phb3_update_msi_regions(ds);
 964
 965         QLIST_INSERT_HEAD(&phb->dma_spaces, ds, list);
 966     }
 967     return &ds->dma_as;
 968 }
 969
 970 static void pnv_phb3_instance_init(Object *obj)
 971 {
 972     PnvPHB3 *phb = PNV_PHB3(obj);
 973
 974     QLIST_INIT(&phb->dma_spaces);
 975
 976     /* LSI sources */
 977     object_initialize_child(obj, "lsi", &phb->lsis, TYPE_ICS);
 978
 979     /* Default init ... will be fixed by HW inits */
 980     phb->lsis.offset = 0;
 981
 982     /* MSI sources */
 983     object_initialize_child(obj, "msi", &phb->msis, TYPE_PHB3_MSI);
 984
 985     /* Power Bus Common Queue */
 986     object_initialize_child(obj, "pbcq", &phb->pbcq, TYPE_PNV_PBCQ);
 987
 988 }
 989
 990 static void pnv_phb3_realize(DeviceState *dev, Error **errp)
 991 {
 992     PnvPHB3 *phb = PNV_PHB3(dev);
 993     PCIHostState *pci = PCI_HOST_BRIDGE(dev);
 994     PnvMachineState *pnv = PNV_MACHINE(qdev_get_machine());
 995     int i;
 996
 997     if (phb->phb_id >= PNV_CHIP_GET_CLASS(phb->chip)->num_phbs) {
 998         error_setg(errp, "invalid PHB index: %d", phb->phb_id);
 999         return;
1000     }
1001
1002     /* LSI sources */
1003     object_property_set_link(OBJECT(&phb->lsis), "xics", OBJECT(pnv),
1004                              &error_abort);
1005     object_property_set_int(OBJECT(&phb->lsis), "nr-irqs", PNV_PHB3_NUM_LSI,
1006                             &error_abort);
1007     if (!qdev_realize(DEVICE(&phb->lsis), NULL, errp)) {
1008         return;
1009     }
1010
1011     for (i = 0; i < phb->lsis.nr_irqs; i++) {
1012         ics_set_irq_type(&phb->lsis, i, true);
1013     }
1014
1015     phb->qirqs = qemu_allocate_irqs(ics_set_irq, &phb->lsis, phb->lsis.nr_irqs);
1016
1017     /* MSI sources */
1018     object_property_set_link(OBJECT(&phb->msis), "phb", OBJECT(phb),
1019                              &error_abort);
1020     object_property_set_link(OBJECT(&phb->msis), "xics", OBJECT(pnv),
1021                              &error_abort);
1022     object_property_set_int(OBJECT(&phb->msis), "nr-irqs", PHB3_MAX_MSI,
1023                             &error_abort);
1024     if (!qdev_realize(DEVICE(&phb->msis), NULL, errp)) {
1025         return;
1026     }
1027
1028     /* Power Bus Common Queue */
1029     object_property_set_link(OBJECT(&phb->pbcq), "phb", OBJECT(phb),
1030                              &error_abort);
1031     if (!qdev_realize(DEVICE(&phb->pbcq), NULL, errp)) {
1032         return;
1033     }
1034
1035     /* Controller Registers */
1036     memory_region_init_io(&phb->mr_regs, OBJECT(phb), &pnv_phb3_reg_ops, phb,
1037                           "phb3-regs", 0x1000);
1038
1039     /*
1040      * PHB3 doesn't support IO space. However, qemu gets very upset if
1041      * we don't have an IO region to anchor IO BARs onto so we just
1042      * initialize one which we never hook up to anything
1043      */
1044     memory_region_init(&phb->pci_io, OBJECT(phb), "pci-io", 0x10000);
1045     memory_region_init(&phb->pci_mmio, OBJECT(phb), "pci-mmio",
1046                        PCI_MMIO_TOTAL_SIZE);
1047
1048     pci->bus = pci_register_root_bus(dev,
1049                                      dev->id ? dev->id : NULL,
1050                                      pnv_phb3_set_irq, pnv_phb3_map_irq, phb,
1051                                      &phb->pci_mmio, &phb->pci_io,
1052                                      0, 4, TYPE_PNV_PHB3_ROOT_BUS);
1053
1054     pci_setup_iommu(pci->bus, pnv_phb3_dma_iommu, phb);
1055
1056     pnv_phb_attach_root_port(PCI_HOST_BRIDGE(phb), TYPE_PNV_PHB3_ROOT_PORT);
1057 }
1058
1059 void pnv_phb3_update_regions(PnvPHB3 *phb)
1060 {
1061     PnvPBCQState *pbcq = &phb->pbcq;
1062
1063     /* Unmap first always */
1064     if (memory_region_is_mapped(&phb->mr_regs)) {
1065         memory_region_del_subregion(&pbcq->phbbar, &phb->mr_regs);
1066     }
1067
1068     /* Map registers if enabled */
1069     if (memory_region_is_mapped(&pbcq->phbbar)) {
1070         /* TODO: We should use the PHB BAR 2 register but we don't ... */
1071         memory_region_add_subregion(&pbcq->phbbar, 0, &phb->mr_regs);
1072     }
1073
1074     /* Check/update m32 */
1075     if (memory_region_is_mapped(&phb->mr_m32)) {
1076         pnv_phb3_check_m32(phb);
1077     }
1078     pnv_phb3_check_all_m64s(phb);
1079 }
1080
1081 static const char *pnv_phb3_root_bus_path(PCIHostState *host_bridge,
1082                                           PCIBus *rootbus)
1083 {
1084     PnvPHB3 *phb = PNV_PHB3(host_bridge);
1085
1086     snprintf(phb->bus_path, sizeof(phb->bus_path), "00%02x:%02x",
1087              phb->chip_id, phb->phb_id);
1088     return phb->bus_path;
1089 }
1090
1091 static Property pnv_phb3_properties[] = {
1092         DEFINE_PROP_UINT32("index", PnvPHB3, phb_id, 0),
1093         DEFINE_PROP_UINT32("chip-id", PnvPHB3, chip_id, 0),
1094         DEFINE_PROP_LINK("chip", PnvPHB3, chip, TYPE_PNV_CHIP, PnvChip *),
1095         DEFINE_PROP_END_OF_LIST(),
1096 };
1097
1098 static void pnv_phb3_class_init(ObjectClass *klass, void *data)
1099 {
1100     PCIHostBridgeClass *hc = PCI_HOST_BRIDGE_CLASS(klass);
1101     DeviceClass *dc = DEVICE_CLASS(klass);
1102
1103     hc->root_bus_path = pnv_phb3_root_bus_path;
1104     dc->realize = pnv_phb3_realize;
1105     device_class_set_props(dc, pnv_phb3_properties);
1106     set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
1107     dc->user_creatable = false;
1108 }
1109
1110 static const TypeInfo pnv_phb3_type_info = {
1111     .name          = TYPE_PNV_PHB3,
1112     .parent        = TYPE_PCIE_HOST_BRIDGE,
1113     .instance_size = sizeof(PnvPHB3),
1114     .class_init    = pnv_phb3_class_init,
1115     .instance_init = pnv_phb3_instance_init,
1116 };
1117
1118 static void pnv_phb3_root_bus_class_init(ObjectClass *klass, void *data)
1119 {
1120     BusClass *k = BUS_CLASS(klass);
1121
1122     /*
1123      * PHB3 has only a single root complex. Enforce the limit on the
1124      * parent bus
1125      */
1126     k->max_dev = 1;
1127 }
1128
1129 static const TypeInfo pnv_phb3_root_bus_info = {
1130     .name = TYPE_PNV_PHB3_ROOT_BUS,
1131     .parent = TYPE_PCIE_BUS,
1132     .class_init = pnv_phb3_root_bus_class_init,
1133     .interfaces = (InterfaceInfo[]) {
1134         { INTERFACE_PCIE_DEVICE },
1135         { }
1136     },
1137 };
1138
1139 static void pnv_phb3_root_port_realize(DeviceState *dev, Error **errp)
1140 {
1141     PCIERootPortClass *rpc = PCIE_ROOT_PORT_GET_CLASS(dev);
1142     PCIDevice *pci = PCI_DEVICE(dev);
1143     PCIBus *bus = pci_get_bus(pci);
1144     PnvPHB3 *phb = NULL;
1145     Error *local_err = NULL;
1146
1147     phb = (PnvPHB3 *) object_dynamic_cast(OBJECT(bus->qbus.parent),
1148                                           TYPE_PNV_PHB3);
1149
1150     if (!phb) {
1151         error_setg(errp,
1152 "pnv_phb3_root_port devices must be connected to pnv-phb3 buses");
1153         return;
1154     }
1155
1156     /* Set unique chassis/slot values for the root port */
1157     qdev_prop_set_uint8(&pci->qdev, "chassis", phb->chip_id);
1158     qdev_prop_set_uint16(&pci->qdev, "slot", phb->phb_id);
1159
1160     rpc->parent_realize(dev, &local_err);
1161     if (local_err) {
1162         error_propagate(errp, local_err);
1163         return;
1164     }
1165 }
1166
1167 static void pnv_phb3_root_port_class_init(ObjectClass *klass, void *data)
1168 {
1169     DeviceClass *dc = DEVICE_CLASS(klass);
1170     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
1171     PCIERootPortClass *rpc = PCIE_ROOT_PORT_CLASS(klass);
1172
1173     dc->desc     = "IBM PHB3 PCIE Root Port";
1174
1175     device_class_set_parent_realize(dc, pnv_phb3_root_port_realize,
1176                                     &rpc->parent_realize);
1177     dc->user_creatable = false;
1178
1179     k->vendor_id = PCI_VENDOR_ID_IBM;
1180     k->device_id = 0x03dc;
1181     k->revision  = 0;
1182
1183     rpc->exp_offset = 0x48;
1184     rpc->aer_offset = 0x100;
1185 }
1186
1187 static const TypeInfo pnv_phb3_root_port_info = {
1188     .name          = TYPE_PNV_PHB3_ROOT_PORT,
1189     .parent        = TYPE_PCIE_ROOT_PORT,
1190     .instance_size = sizeof(PnvPHB3RootPort),
1191     .class_init    = pnv_phb3_root_port_class_init,
1192 };
1193
1194 static void pnv_phb3_register_types(void)
1195 {
1196     type_register_static(&pnv_phb3_root_bus_info);
1197     type_register_static(&pnv_phb3_root_port_info);
1198     type_register_static(&pnv_phb3_type_info);
1199     type_register_static(&pnv_phb3_iommu_memory_region_info);
1200 }
1201
1202 type_init(pnv_phb3_register_types)