2 * QEMU PowerPC PowerNV (POWER8) PHB3 model
4 * Copyright (c) 2014-2020, IBM Corporation.
6 * This code is licensed under the GPL version 2 or later. See the
7 * COPYING file in the top-level directory.
9 #include "qemu/osdep.h"
11 #include "qapi/visitor.h"
12 #include "qapi/error.h"
13 #include "hw/pci-host/pnv_phb3_regs.h"
14 #include "hw/pci-host/pnv_phb.h"
15 #include "hw/pci-host/pnv_phb3.h"
16 #include "hw/pci/pcie_host.h"
17 #include "hw/pci/pcie_port.h"
18 #include "hw/ppc/pnv.h"
20 #include "hw/qdev-properties.h"
21 #include "qom/object.h"
22 #include "sysemu/sysemu.h"
24 #define phb3_error(phb, fmt, ...) \
25 qemu_log_mask(LOG_GUEST_ERROR, "phb3[%d:%d]: " fmt "\n", \
26 (phb)->chip_id, (phb)->phb_id, ## __VA_ARGS__)
28 static PCIDevice
*pnv_phb3_find_cfg_dev(PnvPHB3
*phb
)
30 PCIHostState
*pci
= PCI_HOST_BRIDGE(phb
->phb_base
);
31 uint64_t addr
= phb
->regs
[PHB_CONFIG_ADDRESS
>> 3];
37 bus
= (addr
>> 52) & 0xff;
38 devfn
= (addr
>> 44) & 0xff;
40 return pci_find_device(pci
->bus
, bus
, devfn
);
44 * The CONFIG_DATA register expects little endian accesses, but as the
45 * region is big endian, we have to swap the value.
47 static void pnv_phb3_config_write(PnvPHB3
*phb
, unsigned off
,
48 unsigned size
, uint64_t val
)
50 uint32_t cfg_addr
, limit
;
53 pdev
= pnv_phb3_find_cfg_dev(phb
);
57 cfg_addr
= (phb
->regs
[PHB_CONFIG_ADDRESS
>> 3] >> 32) & 0xffc;
59 limit
= pci_config_size(pdev
);
60 if (limit
<= cfg_addr
) {
62 * conventional pci device can be behind pcie-to-pci bridge.
63 * 256 <= addr < 4K has no effects.
77 g_assert_not_reached();
79 pci_host_config_write_common(pdev
, cfg_addr
, limit
, val
, size
);
82 static uint64_t pnv_phb3_config_read(PnvPHB3
*phb
, unsigned off
,
85 uint32_t cfg_addr
, limit
;
89 pdev
= pnv_phb3_find_cfg_dev(phb
);
93 cfg_addr
= (phb
->regs
[PHB_CONFIG_ADDRESS
>> 3] >> 32) & 0xffc;
95 limit
= pci_config_size(pdev
);
96 if (limit
<= cfg_addr
) {
98 * conventional pci device can be behind pcie-to-pci bridge.
99 * 256 <= addr < 4K has no effects.
103 val
= pci_host_config_read_common(pdev
, cfg_addr
, limit
, size
);
112 g_assert_not_reached();
116 static void pnv_phb3_check_m32(PnvPHB3
*phb
)
118 uint64_t base
, start
, size
;
119 MemoryRegion
*parent
;
120 PnvPBCQState
*pbcq
= &phb
->pbcq
;
122 if (memory_region_is_mapped(&phb
->mr_m32
)) {
123 memory_region_del_subregion(phb
->mr_m32
.container
, &phb
->mr_m32
);
126 if (!(phb
->regs
[PHB_PHB3_CONFIG
>> 3] & PHB_PHB3C_M32_EN
)) {
130 /* Grab geometry from registers */
131 base
= phb
->regs
[PHB_M32_BASE_ADDR
>> 3];
132 start
= phb
->regs
[PHB_M32_START_ADDR
>> 3];
133 size
= ~(phb
->regs
[PHB_M32_BASE_MASK
>> 3] | 0xfffc000000000000ull
) + 1;
135 /* Check if it matches an enabled MMIO region in the PBCQ */
136 if (memory_region_is_mapped(&pbcq
->mmbar0
) &&
137 base
>= pbcq
->mmio0_base
&&
138 (base
+ size
) <= (pbcq
->mmio0_base
+ pbcq
->mmio0_size
)) {
139 parent
= &pbcq
->mmbar0
;
140 base
-= pbcq
->mmio0_base
;
141 } else if (memory_region_is_mapped(&pbcq
->mmbar1
) &&
142 base
>= pbcq
->mmio1_base
&&
143 (base
+ size
) <= (pbcq
->mmio1_base
+ pbcq
->mmio1_size
)) {
144 parent
= &pbcq
->mmbar1
;
145 base
-= pbcq
->mmio1_base
;
151 memory_region_init_alias(&phb
->mr_m32
, OBJECT(phb
), "phb3-m32",
152 &phb
->pci_mmio
, start
, size
);
153 memory_region_add_subregion(parent
, base
, &phb
->mr_m32
);
156 static void pnv_phb3_check_m64(PnvPHB3
*phb
, uint32_t index
)
158 uint64_t base
, start
, size
, m64
;
159 MemoryRegion
*parent
;
160 PnvPBCQState
*pbcq
= &phb
->pbcq
;
162 if (memory_region_is_mapped(&phb
->mr_m64
[index
])) {
163 /* Should we destroy it in RCU friendly way... ? */
164 memory_region_del_subregion(phb
->mr_m64
[index
].container
,
165 &phb
->mr_m64
[index
]);
168 /* Get table entry */
169 m64
= phb
->ioda_M64BT
[index
];
171 if (!(m64
& IODA2_M64BT_ENABLE
)) {
175 /* Grab geometry from registers */
176 base
= GETFIELD(IODA2_M64BT_BASE
, m64
) << 20;
177 if (m64
& IODA2_M64BT_SINGLE_PE
) {
178 base
&= ~0x1ffffffull
;
180 size
= GETFIELD(IODA2_M64BT_MASK
, m64
) << 20;
181 size
|= 0xfffc000000000000ull
;
183 start
= base
| (phb
->regs
[PHB_M64_UPPER_BITS
>> 3]);
185 /* Check if it matches an enabled MMIO region in the PBCQ */
186 if (memory_region_is_mapped(&pbcq
->mmbar0
) &&
187 base
>= pbcq
->mmio0_base
&&
188 (base
+ size
) <= (pbcq
->mmio0_base
+ pbcq
->mmio0_size
)) {
189 parent
= &pbcq
->mmbar0
;
190 base
-= pbcq
->mmio0_base
;
191 } else if (memory_region_is_mapped(&pbcq
->mmbar1
) &&
192 base
>= pbcq
->mmio1_base
&&
193 (base
+ size
) <= (pbcq
->mmio1_base
+ pbcq
->mmio1_size
)) {
194 parent
= &pbcq
->mmbar1
;
195 base
-= pbcq
->mmio1_base
;
201 memory_region_init_alias(&phb
->mr_m64
[index
], OBJECT(phb
), "phb3-m64",
202 &phb
->pci_mmio
, start
, size
);
203 memory_region_add_subregion(parent
, base
, &phb
->mr_m64
[index
]);
206 static void pnv_phb3_check_all_m64s(PnvPHB3
*phb
)
210 for (i
= 0; i
< PNV_PHB3_NUM_M64
; i
++) {
211 pnv_phb3_check_m64(phb
, i
);
215 static void pnv_phb3_lxivt_write(PnvPHB3
*phb
, unsigned idx
, uint64_t val
)
217 uint8_t server
, prio
;
219 phb
->ioda_LXIVT
[idx
] = val
& (IODA2_LXIVT_SERVER
|
220 IODA2_LXIVT_PRIORITY
|
221 IODA2_LXIVT_NODE_ID
);
222 server
= GETFIELD(IODA2_LXIVT_SERVER
, val
);
223 prio
= GETFIELD(IODA2_LXIVT_PRIORITY
, val
);
226 * The low order 2 bits are the link pointer (Type II interrupts).
227 * Shift back to get a valid IRQ server.
231 ics_write_xive(&phb
->lsis
, idx
, server
, prio
, prio
);
234 static uint64_t *pnv_phb3_ioda_access(PnvPHB3
*phb
,
235 unsigned *out_table
, unsigned *out_idx
)
237 uint64_t adreg
= phb
->regs
[PHB_IODA_ADDR
>> 3];
238 unsigned int index
= GETFIELD(PHB_IODA_AD_TADR
, adreg
);
239 unsigned int table
= GETFIELD(PHB_IODA_AD_TSEL
, adreg
);
241 uint64_t *tptr
= NULL
;
245 tptr
= phb
->ioda_LIST
;
248 case IODA2_TBL_LXIVT
:
249 tptr
= phb
->ioda_LXIVT
;
252 case IODA2_TBL_IVC_CAM
:
262 case IODA2_TBL_PESTA
:
263 case IODA2_TBL_PESTB
:
267 tptr
= phb
->ioda_TVT
;
274 case IODA2_TBL_M64BT
:
275 tptr
= phb
->ioda_M64BT
;
278 case IODA2_TBL_M32DT
:
279 tptr
= phb
->ioda_MDT
;
283 tptr
= phb
->ioda_PEEV
;
287 phb3_error(phb
, "invalid IODA table %d", table
);
300 if (adreg
& PHB_IODA_AD_AUTOINC
) {
301 index
= (index
+ 1) & mask
;
302 adreg
= SETFIELD(PHB_IODA_AD_TADR
, adreg
, index
);
304 phb
->regs
[PHB_IODA_ADDR
>> 3] = adreg
;
308 static uint64_t pnv_phb3_ioda_read(PnvPHB3
*phb
)
313 tptr
= pnv_phb3_ioda_access(phb
, &table
, NULL
);
315 /* Return 0 on unsupported tables, not ff's */
321 static void pnv_phb3_ioda_write(PnvPHB3
*phb
, uint64_t val
)
326 tptr
= pnv_phb3_ioda_access(phb
, &table
, &idx
);
331 /* Handle side effects */
333 case IODA2_TBL_LXIVT
:
334 pnv_phb3_lxivt_write(phb
, idx
, val
);
336 case IODA2_TBL_M64BT
:
338 pnv_phb3_check_m64(phb
, idx
);
346 * This is called whenever the PHB LSI, MSI source ID register or
347 * the PBCQ irq filters are written.
349 void pnv_phb3_remap_irqs(PnvPHB3
*phb
)
351 ICSState
*ics
= &phb
->lsis
;
352 uint32_t local
, global
, count
, mask
, comp
;
354 PnvPBCQState
*pbcq
= &phb
->pbcq
;
357 * First check if we are enabled. Unlike real HW we don't separate
358 * TX and RX so we enable if both are set
360 baren
= pbcq
->nest_regs
[PBCQ_NEST_BAR_EN
];
361 if (!(baren
& PBCQ_NEST_BAR_EN_IRSN_RX
) ||
362 !(baren
& PBCQ_NEST_BAR_EN_IRSN_TX
)) {
367 /* Grab local LSI source ID */
368 local
= GETFIELD(PHB_LSI_SRC_ID
, phb
->regs
[PHB_LSI_SOURCE_ID
>> 3]) << 3;
370 /* Grab global one and compare */
371 global
= GETFIELD(PBCQ_NEST_LSI_SRC
,
372 pbcq
->nest_regs
[PBCQ_NEST_LSI_SRC_ID
]) << 3;
373 if (global
!= local
) {
375 * This happens during initialization, let's come back when we
376 * are properly configured
382 /* Get the base on the powerbus */
383 comp
= GETFIELD(PBCQ_NEST_IRSN_COMP
,
384 pbcq
->nest_regs
[PBCQ_NEST_IRSN_COMPARE
]);
385 mask
= GETFIELD(PBCQ_NEST_IRSN_COMP
,
386 pbcq
->nest_regs
[PBCQ_NEST_IRSN_MASK
]);
387 count
= ((~mask
) + 1) & 0x7ffff;
388 phb
->total_irq
= count
;
391 if ((global
+ PNV_PHB3_NUM_LSI
) > count
) {
392 phb3_error(phb
, "LSIs out of reach: LSI base=%d total irq=%d", global
,
397 phb3_error(phb
, "More interrupts than supported: %d", count
);
400 if ((comp
& mask
) != comp
) {
401 phb3_error(phb
, "IRQ compare bits not in mask: comp=0x%x mask=0x%x",
405 /* Setup LSI offset */
406 ics
->offset
= comp
+ global
;
408 /* Setup MSI offset */
409 pnv_phb3_msi_update_config(&phb
->msis
, comp
, count
- PNV_PHB3_NUM_LSI
);
412 static void pnv_phb3_lsi_src_id_write(PnvPHB3
*phb
, uint64_t val
)
414 /* Sanitize content */
415 val
&= PHB_LSI_SRC_ID
;
416 phb
->regs
[PHB_LSI_SOURCE_ID
>> 3] = val
;
417 pnv_phb3_remap_irqs(phb
);
420 static void pnv_phb3_rtc_invalidate(PnvPHB3
*phb
, uint64_t val
)
424 /* Always invalidate all for now ... */
425 QLIST_FOREACH(ds
, &phb
->dma_spaces
, list
) {
426 ds
->pe_num
= PHB_INVALID_PE
;
431 static void pnv_phb3_update_msi_regions(PnvPhb3DMASpace
*ds
)
433 uint64_t cfg
= ds
->phb
->regs
[PHB_PHB3_CONFIG
>> 3];
435 if (cfg
& PHB_PHB3C_32BIT_MSI_EN
) {
436 if (!memory_region_is_mapped(&ds
->msi32_mr
)) {
437 memory_region_add_subregion(MEMORY_REGION(&ds
->dma_mr
),
438 0xffff0000, &ds
->msi32_mr
);
441 if (memory_region_is_mapped(&ds
->msi32_mr
)) {
442 memory_region_del_subregion(MEMORY_REGION(&ds
->dma_mr
),
447 if (cfg
& PHB_PHB3C_64BIT_MSI_EN
) {
448 if (!memory_region_is_mapped(&ds
->msi64_mr
)) {
449 memory_region_add_subregion(MEMORY_REGION(&ds
->dma_mr
),
450 (1ull << 60), &ds
->msi64_mr
);
453 if (memory_region_is_mapped(&ds
->msi64_mr
)) {
454 memory_region_del_subregion(MEMORY_REGION(&ds
->dma_mr
),
460 static void pnv_phb3_update_all_msi_regions(PnvPHB3
*phb
)
464 QLIST_FOREACH(ds
, &phb
->dma_spaces
, list
) {
465 pnv_phb3_update_msi_regions(ds
);
469 void pnv_phb3_reg_write(void *opaque
, hwaddr off
, uint64_t val
, unsigned size
)
471 PnvPHB3
*phb
= opaque
;
474 /* Special case configuration data */
475 if ((off
& 0xfffc) == PHB_CONFIG_DATA
) {
476 pnv_phb3_config_write(phb
, off
& 0x3, size
, val
);
480 /* Other registers are 64-bit only */
481 if (size
!= 8 || off
& 0x7) {
482 phb3_error(phb
, "Invalid register access, offset: 0x%"PRIx64
" size: %d",
487 /* Handle masking & filtering */
489 case PHB_M64_UPPER_BITS
:
490 val
&= 0xfffc000000000000ull
;
494 * This is enough logic to make SW happy but we aren't actually
497 if (val
& PHB_Q_DMA_R_AUTORESET
) {
500 val
&= PHB_Q_DMA_R_QUIESCE_DMA
;
504 case PHB_LEM_FIR_AND_MASK
:
505 phb
->regs
[PHB_LEM_FIR_ACCUM
>> 3] &= val
;
507 case PHB_LEM_FIR_OR_MASK
:
508 phb
->regs
[PHB_LEM_FIR_ACCUM
>> 3] |= val
;
510 case PHB_LEM_ERROR_AND_MASK
:
511 phb
->regs
[PHB_LEM_ERROR_MASK
>> 3] &= val
;
513 case PHB_LEM_ERROR_OR_MASK
:
514 phb
->regs
[PHB_LEM_ERROR_MASK
>> 3] |= val
;
521 /* Record whether it changed */
522 changed
= phb
->regs
[off
>> 3] != val
;
524 /* Store in register cache first */
525 phb
->regs
[off
>> 3] = val
;
527 /* Handle side effects */
529 case PHB_PHB3_CONFIG
:
531 pnv_phb3_update_all_msi_regions(phb
);
534 case PHB_M32_BASE_ADDR
:
535 case PHB_M32_BASE_MASK
:
536 case PHB_M32_START_ADDR
:
538 pnv_phb3_check_m32(phb
);
541 case PHB_M64_UPPER_BITS
:
543 pnv_phb3_check_all_m64s(phb
);
546 case PHB_LSI_SOURCE_ID
:
548 pnv_phb3_lsi_src_id_write(phb
, val
);
552 /* IODA table accesses */
554 pnv_phb3_ioda_write(phb
, val
);
557 /* RTC invalidation */
558 case PHB_RTC_INVALIDATE
:
559 pnv_phb3_rtc_invalidate(phb
, val
);
563 case PHB_FFI_REQUEST
:
564 pnv_phb3_msi_ffi(&phb
->msis
, val
);
567 /* Silent simple writes */
568 case PHB_CONFIG_ADDRESS
:
571 case PHB_TCE_SPEC_CTL
:
578 case PHB_LEM_FIR_ACCUM
:
579 case PHB_LEM_ERROR_MASK
:
580 case PHB_LEM_ACTION0
:
581 case PHB_LEM_ACTION1
:
584 /* Noise on anything else */
586 qemu_log_mask(LOG_UNIMP
, "phb3: reg_write 0x%"PRIx64
"=%"PRIx64
"\n",
591 uint64_t pnv_phb3_reg_read(void *opaque
, hwaddr off
, unsigned size
)
593 PnvPHB3
*phb
= opaque
;
594 PCIHostState
*pci
= PCI_HOST_BRIDGE(phb
->phb_base
);
597 if ((off
& 0xfffc) == PHB_CONFIG_DATA
) {
598 return pnv_phb3_config_read(phb
, off
& 0x3, size
);
601 /* Other registers are 64-bit only */
602 if (size
!= 8 || off
& 0x7) {
603 phb3_error(phb
, "Invalid register access, offset: 0x%"PRIx64
" size: %d",
608 /* Default read from cache */
609 val
= phb
->regs
[off
>> 3];
612 /* Simulate venice DD2.0 */
614 return 0x000000a300000005ull
;
615 case PHB_PCIE_SYSTEM_CONFIG
:
616 return 0x441100fc30000000;
618 /* IODA table accesses */
620 return pnv_phb3_ioda_read(phb
);
622 /* Link training always appears trained */
623 case PHB_PCIE_DLP_TRAIN_CTL
:
624 if (!pci_find_device(pci
->bus
, 1, 0)) {
627 return PHB_PCIE_DLP_INBAND_PRESENCE
| PHB_PCIE_DLP_TC_DL_LINKACT
;
631 /* Set lock and return previous value */
632 phb
->regs
[off
>> 3] |= PHB_FFI_LOCK_STATE
;
635 /* DMA read sync: make it look like it's complete */
637 return PHB_DMARD_SYNC_COMPLETE
;
639 /* Silent simple reads */
640 case PHB_PHB3_CONFIG
:
641 case PHB_M32_BASE_ADDR
:
642 case PHB_M32_BASE_MASK
:
643 case PHB_M32_START_ADDR
:
644 case PHB_CONFIG_ADDRESS
:
646 case PHB_RTC_INVALIDATE
:
648 case PHB_TCE_SPEC_CTL
:
654 case PHB_M64_UPPER_BITS
:
655 case PHB_LEM_FIR_ACCUM
:
656 case PHB_LEM_ERROR_MASK
:
657 case PHB_LEM_ACTION0
:
658 case PHB_LEM_ACTION1
:
661 /* Noise on anything else */
663 qemu_log_mask(LOG_UNIMP
, "phb3: reg_read 0x%"PRIx64
"=%"PRIx64
"\n",
669 static const MemoryRegionOps pnv_phb3_reg_ops
= {
670 .read
= pnv_phb3_reg_read
,
671 .write
= pnv_phb3_reg_write
,
672 .valid
.min_access_size
= 1,
673 .valid
.max_access_size
= 8,
674 .impl
.min_access_size
= 1,
675 .impl
.max_access_size
= 8,
676 .endianness
= DEVICE_BIG_ENDIAN
,
679 static int pnv_phb3_map_irq(PCIDevice
*pci_dev
, int irq_num
)
681 /* Check that out properly ... */
685 static void pnv_phb3_set_irq(void *opaque
, int irq_num
, int level
)
687 PnvPHB3
*phb
= opaque
;
691 phb3_error(phb
, "Unknown IRQ to set %d", irq_num
);
693 qemu_set_irq(phb
->qirqs
[irq_num
], level
);
696 static bool pnv_phb3_resolve_pe(PnvPhb3DMASpace
*ds
)
702 /* Already resolved ? */
703 if (ds
->pe_num
!= PHB_INVALID_PE
) {
707 /* We need to lookup the RTT */
708 rtt
= ds
->phb
->regs
[PHB_RTT_BAR
>> 3];
709 if (!(rtt
& PHB_RTT_BAR_ENABLE
)) {
710 phb3_error(ds
->phb
, "DMA with RTT BAR disabled !");
711 /* Set error bits ? fence ? ... */
716 bus_num
= pci_bus_num(ds
->bus
);
717 addr
= rtt
& PHB_RTT_BASE_ADDRESS_MASK
;
718 addr
+= 2 * ((bus_num
<< 8) | ds
->devfn
);
719 if (dma_memory_read(&address_space_memory
, addr
, &rte
,
720 sizeof(rte
), MEMTXATTRS_UNSPECIFIED
)) {
721 phb3_error(ds
->phb
, "Failed to read RTT entry at 0x%"PRIx64
, addr
);
722 /* Set error bits ? fence ? ... */
725 rte
= be16_to_cpu(rte
);
727 /* Fail upon reading of invalid PE# */
728 if (rte
>= PNV_PHB3_NUM_PE
) {
729 phb3_error(ds
->phb
, "RTE for RID 0x%x invalid (%04x", ds
->devfn
, rte
);
730 /* Set error bits ? fence ? ... */
737 static void pnv_phb3_translate_tve(PnvPhb3DMASpace
*ds
, hwaddr addr
,
738 bool is_write
, uint64_t tve
,
741 uint64_t tta
= GETFIELD(IODA2_TVT_TABLE_ADDR
, tve
);
742 int32_t lev
= GETFIELD(IODA2_TVT_NUM_LEVELS
, tve
);
743 uint32_t tts
= GETFIELD(IODA2_TVT_TCE_TABLE_SIZE
, tve
);
744 uint32_t tps
= GETFIELD(IODA2_TVT_IO_PSIZE
, tve
);
745 PnvPHB3
*phb
= ds
->phb
;
749 phb3_error(phb
, "Invalid #levels in TVE %d", lev
);
753 /* IO Page Size of 0 means untranslated, else use TCEs */
756 * We only support non-translate in top window.
758 * TODO: Venice/Murano support it on bottom window above 4G and
759 * Naples suports it on everything
761 if (!(tve
& PPC_BIT(51))) {
762 phb3_error(phb
, "xlate for invalid non-translate TVE");
765 /* TODO: Handle boundaries */
767 /* Use 4k pages like q35 ... for now */
768 tlb
->iova
= addr
& 0xfffffffffffff000ull
;
769 tlb
->translated_addr
= addr
& 0x0003fffffffff000ull
;
770 tlb
->addr_mask
= 0xfffull
;
771 tlb
->perm
= IOMMU_RW
;
773 uint32_t tce_shift
, tbl_shift
, sh
;
774 uint64_t base
, taddr
, tce
, tce_mask
;
778 phb3_error(phb
, "xlate for invalid translated TVE");
782 /* Address bits per bottom level TCE entry */
783 tce_shift
= tps
+ 11;
785 /* Address bits per table level */
788 /* Top level table base address */
791 /* Total shift to first level */
792 sh
= tbl_shift
* lev
+ tce_shift
;
794 /* TODO: Multi-level untested */
798 /* Grab the TCE address */
799 taddr
= base
| (((addr
>> sh
) & ((1ul << tbl_shift
) - 1)) << 3);
800 if (dma_memory_read(&address_space_memory
, taddr
, &tce
,
801 sizeof(tce
), MEMTXATTRS_UNSPECIFIED
)) {
802 phb3_error(phb
, "Failed to read TCE at 0x%"PRIx64
, taddr
);
805 tce
= be64_to_cpu(tce
);
807 /* Check permission for indirect TCE */
808 if ((lev
>= 0) && !(tce
& 3)) {
809 phb3_error(phb
, "Invalid indirect TCE at 0x%"PRIx64
, taddr
);
810 phb3_error(phb
, " xlate %"PRIx64
":%c TVE=%"PRIx64
, addr
,
811 is_write
? 'W' : 'R', tve
);
812 phb3_error(phb
, " tta=%"PRIx64
" lev=%d tts=%d tps=%d",
817 base
= tce
& ~0xfffull
;
820 /* We exit the loop with TCE being the final TCE */
821 if ((is_write
& !(tce
& 2)) || ((!is_write
) && !(tce
& 1))) {
822 phb3_error(phb
, "TCE access fault at 0x%"PRIx64
, taddr
);
823 phb3_error(phb
, " xlate %"PRIx64
":%c TVE=%"PRIx64
, addr
,
824 is_write
? 'W' : 'R', tve
);
825 phb3_error(phb
, " tta=%"PRIx64
" lev=%d tts=%d tps=%d",
829 tce_mask
= ~((1ull << tce_shift
) - 1);
830 tlb
->iova
= addr
& tce_mask
;
831 tlb
->translated_addr
= tce
& tce_mask
;
832 tlb
->addr_mask
= ~tce_mask
;
837 static IOMMUTLBEntry
pnv_phb3_translate_iommu(IOMMUMemoryRegion
*iommu
,
839 IOMMUAccessFlags flag
,
842 PnvPhb3DMASpace
*ds
= container_of(iommu
, PnvPhb3DMASpace
, dma_mr
);
845 IOMMUTLBEntry ret
= {
846 .target_as
= &address_space_memory
,
848 .translated_addr
= 0,
849 .addr_mask
= ~(hwaddr
)0,
852 PnvPHB3
*phb
= ds
->phb
;
855 if (!pnv_phb3_resolve_pe(ds
)) {
856 phb3_error(phb
, "Failed to resolve PE# for bus @%p (%d) devfn 0x%x",
857 ds
->bus
, pci_bus_num(ds
->bus
), ds
->devfn
);
862 switch (addr
>> 60) {
864 /* DMA or 32-bit MSI ? */
865 cfg
= ds
->phb
->regs
[PHB_PHB3_CONFIG
>> 3];
866 if ((cfg
& PHB_PHB3C_32BIT_MSI_EN
) &&
867 ((addr
& 0xffffffffffff0000ull
) == 0xffff0000ull
)) {
868 phb3_error(phb
, "xlate on 32-bit MSI region");
871 /* Choose TVE XXX Use PHB3 Control Register */
872 tve_sel
= (addr
>> 59) & 1;
873 tve
= ds
->phb
->ioda_TVT
[ds
->pe_num
* 2 + tve_sel
];
874 pnv_phb3_translate_tve(ds
, addr
, flag
& IOMMU_WO
, tve
, &ret
);
877 phb3_error(phb
, "xlate on 64-bit MSI region");
880 phb3_error(phb
, "xlate on unsupported address 0x%"PRIx64
, addr
);
885 #define TYPE_PNV_PHB3_IOMMU_MEMORY_REGION "pnv-phb3-iommu-memory-region"
886 DECLARE_INSTANCE_CHECKER(IOMMUMemoryRegion
, PNV_PHB3_IOMMU_MEMORY_REGION
,
887 TYPE_PNV_PHB3_IOMMU_MEMORY_REGION
)
889 static void pnv_phb3_iommu_memory_region_class_init(ObjectClass
*klass
,
892 IOMMUMemoryRegionClass
*imrc
= IOMMU_MEMORY_REGION_CLASS(klass
);
894 imrc
->translate
= pnv_phb3_translate_iommu
;
897 static const TypeInfo pnv_phb3_iommu_memory_region_info
= {
898 .parent
= TYPE_IOMMU_MEMORY_REGION
,
899 .name
= TYPE_PNV_PHB3_IOMMU_MEMORY_REGION
,
900 .class_init
= pnv_phb3_iommu_memory_region_class_init
,
904 * MSI/MSIX memory region implementation.
905 * The handler handles both MSI and MSIX.
907 static void pnv_phb3_msi_write(void *opaque
, hwaddr addr
,
908 uint64_t data
, unsigned size
)
910 PnvPhb3DMASpace
*ds
= opaque
;
913 if (!pnv_phb3_resolve_pe(ds
)) {
914 phb3_error(ds
->phb
, "Failed to resolve PE# for bus @%p (%d) devfn 0x%x",
915 ds
->bus
, pci_bus_num(ds
->bus
), ds
->devfn
);
919 pnv_phb3_msi_send(&ds
->phb
->msis
, addr
, data
, ds
->pe_num
);
922 /* There is no .read as the read result is undefined by PCI spec */
923 static uint64_t pnv_phb3_msi_read(void *opaque
, hwaddr addr
, unsigned size
)
925 PnvPhb3DMASpace
*ds
= opaque
;
927 phb3_error(ds
->phb
, "invalid read @ 0x%" HWADDR_PRIx
, addr
);
931 static const MemoryRegionOps pnv_phb3_msi_ops
= {
932 .read
= pnv_phb3_msi_read
,
933 .write
= pnv_phb3_msi_write
,
934 .endianness
= DEVICE_LITTLE_ENDIAN
937 static AddressSpace
*pnv_phb3_dma_iommu(PCIBus
*bus
, void *opaque
, int devfn
)
939 PnvPHB3
*phb
= opaque
;
942 QLIST_FOREACH(ds
, &phb
->dma_spaces
, list
) {
943 if (ds
->bus
== bus
&& ds
->devfn
== devfn
) {
949 ds
= g_new0(PnvPhb3DMASpace
, 1);
952 ds
->pe_num
= PHB_INVALID_PE
;
954 memory_region_init_iommu(&ds
->dma_mr
, sizeof(ds
->dma_mr
),
955 TYPE_PNV_PHB3_IOMMU_MEMORY_REGION
,
956 OBJECT(phb
), "phb3_iommu", UINT64_MAX
);
957 address_space_init(&ds
->dma_as
, MEMORY_REGION(&ds
->dma_mr
),
959 memory_region_init_io(&ds
->msi32_mr
, OBJECT(phb
), &pnv_phb3_msi_ops
,
960 ds
, "msi32", 0x10000);
961 memory_region_init_io(&ds
->msi64_mr
, OBJECT(phb
), &pnv_phb3_msi_ops
,
962 ds
, "msi64", 0x100000);
963 pnv_phb3_update_msi_regions(ds
);
965 QLIST_INSERT_HEAD(&phb
->dma_spaces
, ds
, list
);
970 static void pnv_phb3_instance_init(Object
*obj
)
972 PnvPHB3
*phb
= PNV_PHB3(obj
);
974 QLIST_INIT(&phb
->dma_spaces
);
977 object_initialize_child(obj
, "lsi", &phb
->lsis
, TYPE_ICS
);
979 /* Default init ... will be fixed by HW inits */
980 phb
->lsis
.offset
= 0;
983 object_initialize_child(obj
, "msi", &phb
->msis
, TYPE_PHB3_MSI
);
985 /* Power Bus Common Queue */
986 object_initialize_child(obj
, "pbcq", &phb
->pbcq
, TYPE_PNV_PBCQ
);
990 void pnv_phb3_bus_init(DeviceState
*dev
, PnvPHB3
*phb
)
992 PCIHostState
*pci
= PCI_HOST_BRIDGE(dev
);
995 * PHB3 doesn't support IO space. However, qemu gets very upset if
996 * we don't have an IO region to anchor IO BARs onto so we just
997 * initialize one which we never hook up to anything
999 memory_region_init(&phb
->pci_io
, OBJECT(phb
), "pci-io", 0x10000);
1000 memory_region_init(&phb
->pci_mmio
, OBJECT(phb
), "pci-mmio",
1001 PCI_MMIO_TOTAL_SIZE
);
1003 pci
->bus
= pci_register_root_bus(dev
,
1004 dev
->id
? dev
->id
: NULL
,
1005 pnv_phb3_set_irq
, pnv_phb3_map_irq
, phb
,
1006 &phb
->pci_mmio
, &phb
->pci_io
,
1007 0, 4, TYPE_PNV_PHB3_ROOT_BUS
);
1009 object_property_set_int(OBJECT(pci
->bus
), "phb-id", phb
->phb_id
,
1011 object_property_set_int(OBJECT(pci
->bus
), "chip-id", phb
->chip_id
,
1014 pci_setup_iommu(pci
->bus
, pnv_phb3_dma_iommu
, phb
);
1017 static void pnv_phb3_realize(DeviceState
*dev
, Error
**errp
)
1019 PnvPHB3
*phb
= PNV_PHB3(dev
);
1020 PnvMachineState
*pnv
= PNV_MACHINE(qdev_get_machine());
1023 if (phb
->phb_id
>= PNV_CHIP_GET_CLASS(phb
->chip
)->num_phbs
) {
1024 error_setg(errp
, "invalid PHB index: %d", phb
->phb_id
);
1029 object_property_set_link(OBJECT(&phb
->lsis
), "xics", OBJECT(pnv
),
1031 object_property_set_int(OBJECT(&phb
->lsis
), "nr-irqs", PNV_PHB3_NUM_LSI
,
1033 if (!qdev_realize(DEVICE(&phb
->lsis
), NULL
, errp
)) {
1037 for (i
= 0; i
< phb
->lsis
.nr_irqs
; i
++) {
1038 ics_set_irq_type(&phb
->lsis
, i
, true);
1041 phb
->qirqs
= qemu_allocate_irqs(ics_set_irq
, &phb
->lsis
, phb
->lsis
.nr_irqs
);
1044 object_property_set_link(OBJECT(&phb
->msis
), "phb", OBJECT(phb
),
1046 object_property_set_link(OBJECT(&phb
->msis
), "xics", OBJECT(pnv
),
1048 object_property_set_int(OBJECT(&phb
->msis
), "nr-irqs", PHB3_MAX_MSI
,
1050 if (!qdev_realize(DEVICE(&phb
->msis
), NULL
, errp
)) {
1054 /* Power Bus Common Queue */
1055 object_property_set_link(OBJECT(&phb
->pbcq
), "phb", OBJECT(phb
),
1057 if (!qdev_realize(DEVICE(&phb
->pbcq
), NULL
, errp
)) {
1061 /* Controller Registers */
1062 memory_region_init_io(&phb
->mr_regs
, OBJECT(phb
), &pnv_phb3_reg_ops
, phb
,
1063 "phb3-regs", 0x1000);
1066 void pnv_phb3_update_regions(PnvPHB3
*phb
)
1068 PnvPBCQState
*pbcq
= &phb
->pbcq
;
1070 /* Unmap first always */
1071 if (memory_region_is_mapped(&phb
->mr_regs
)) {
1072 memory_region_del_subregion(&pbcq
->phbbar
, &phb
->mr_regs
);
1075 /* Map registers if enabled */
1076 if (memory_region_is_mapped(&pbcq
->phbbar
)) {
1077 /* TODO: We should use the PHB BAR 2 register but we don't ... */
1078 memory_region_add_subregion(&pbcq
->phbbar
, 0, &phb
->mr_regs
);
1081 /* Check/update m32 */
1082 if (memory_region_is_mapped(&phb
->mr_m32
)) {
1083 pnv_phb3_check_m32(phb
);
1085 pnv_phb3_check_all_m64s(phb
);
1088 static Property pnv_phb3_properties
[] = {
1089 DEFINE_PROP_UINT32("index", PnvPHB3
, phb_id
, 0),
1090 DEFINE_PROP_UINT32("chip-id", PnvPHB3
, chip_id
, 0),
1091 DEFINE_PROP_LINK("chip", PnvPHB3
, chip
, TYPE_PNV_CHIP
, PnvChip
*),
1092 DEFINE_PROP_LINK("phb-base", PnvPHB3
, phb_base
, TYPE_PNV_PHB
, PnvPHB
*),
1093 DEFINE_PROP_END_OF_LIST(),
1096 static void pnv_phb3_class_init(ObjectClass
*klass
, void *data
)
1098 DeviceClass
*dc
= DEVICE_CLASS(klass
);
1100 dc
->realize
= pnv_phb3_realize
;
1101 device_class_set_props(dc
, pnv_phb3_properties
);
1102 dc
->user_creatable
= false;
1105 static const TypeInfo pnv_phb3_type_info
= {
1106 .name
= TYPE_PNV_PHB3
,
1107 .parent
= TYPE_DEVICE
,
1108 .instance_size
= sizeof(PnvPHB3
),
1109 .class_init
= pnv_phb3_class_init
,
1110 .instance_init
= pnv_phb3_instance_init
,
1113 static void pnv_phb3_root_bus_get_prop(Object
*obj
, Visitor
*v
,
1115 void *opaque
, Error
**errp
)
1117 PnvPHB3RootBus
*bus
= PNV_PHB3_ROOT_BUS(obj
);
1120 if (strcmp(name
, "phb-id") == 0) {
1121 value
= bus
->phb_id
;
1123 value
= bus
->chip_id
;
1126 visit_type_size(v
, name
, &value
, errp
);
1129 static void pnv_phb3_root_bus_set_prop(Object
*obj
, Visitor
*v
,
1131 void *opaque
, Error
**errp
)
1134 PnvPHB3RootBus
*bus
= PNV_PHB3_ROOT_BUS(obj
);
1137 if (!visit_type_size(v
, name
, &value
, errp
)) {
1141 if (strcmp(name
, "phb-id") == 0) {
1142 bus
->phb_id
= value
;
1144 bus
->chip_id
= value
;
1148 static void pnv_phb3_root_bus_class_init(ObjectClass
*klass
, void *data
)
1150 BusClass
*k
= BUS_CLASS(klass
);
1152 object_class_property_add(klass
, "phb-id", "int",
1153 pnv_phb3_root_bus_get_prop
,
1154 pnv_phb3_root_bus_set_prop
,
1157 object_class_property_add(klass
, "chip-id", "int",
1158 pnv_phb3_root_bus_get_prop
,
1159 pnv_phb3_root_bus_set_prop
,
1163 * PHB3 has only a single root complex. Enforce the limit on the
1169 static const TypeInfo pnv_phb3_root_bus_info
= {
1170 .name
= TYPE_PNV_PHB3_ROOT_BUS
,
1171 .parent
= TYPE_PCIE_BUS
,
1172 .instance_size
= sizeof(PnvPHB3RootBus
),
1173 .class_init
= pnv_phb3_root_bus_class_init
,
1176 static void pnv_phb3_register_types(void)
1178 type_register_static(&pnv_phb3_root_bus_info
);
1179 type_register_static(&pnv_phb3_type_info
);
1180 type_register_static(&pnv_phb3_iommu_memory_region_info
);
1183 type_init(pnv_phb3_register_types
)