hw/pcie_aer.c

   1 /*
   2  * pcie_aer.c
   3  *
   4  * Copyright (c) 2010 Isaku Yamahata <yamahata at valinux co jp>
   5  *                    VA Linux Systems Japan K.K.
   6  *
   7  * This program is free software; you can redistribute it and/or modify
   8  * it under the terms of the GNU General Public License as published by
   9  * the Free Software Foundation; either version 2 of the License, or
  10  * (at your option) any later version.
  11  *
  12  * This program is distributed in the hope that it will be useful,
  13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15  * GNU General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU General Public License along
  18  * with this program; if not, see <http://www.gnu.org/licenses/>.
  19  */
  20
  21 #include "sysemu.h"
  22 #include "qemu-objects.h"
  23 #include "monitor.h"
  24 #include "pci_bridge.h"
  25 #include "pcie.h"
  26 #include "msix.h"
  27 #include "msi.h"
  28 #include "pci_internals.h"
  29 #include "pcie_regs.h"
  30
  31 //#define DEBUG_PCIE
  32 #ifdef DEBUG_PCIE
  33 # define PCIE_DPRINTF(fmt, ...)                                         \
  34     fprintf(stderr, "%s:%d " fmt, __func__, __LINE__, ## __VA_ARGS__)
  35 #else
  36 # define PCIE_DPRINTF(fmt, ...) do {} while (0)
  37 #endif
  38 #define PCIE_DEV_PRINTF(dev, fmt, ...)                                  \
  39     PCIE_DPRINTF("%s:%x "fmt, (dev)->name, (dev)->devfn, ## __VA_ARGS__)
  40
  41 /* From 6.2.7 Error Listing and Rules. Table 6-2, 6-3 and 6-4 */
  42 static uint32_t pcie_aer_uncor_default_severity(uint32_t status)
  43 {
  44     switch (status) {
  45     case PCI_ERR_UNC_INTN:
  46     case PCI_ERR_UNC_DLP:
  47     case PCI_ERR_UNC_SDN:
  48     case PCI_ERR_UNC_RX_OVER:
  49     case PCI_ERR_UNC_FCP:
  50     case PCI_ERR_UNC_MALF_TLP:
  51         return PCI_ERR_ROOT_CMD_FATAL_EN;
  52     case PCI_ERR_UNC_POISON_TLP:
  53     case PCI_ERR_UNC_ECRC:
  54     case PCI_ERR_UNC_UNSUP:
  55     case PCI_ERR_UNC_COMP_TIME:
  56     case PCI_ERR_UNC_COMP_ABORT:
  57     case PCI_ERR_UNC_UNX_COMP:
  58     case PCI_ERR_UNC_ACSV:
  59     case PCI_ERR_UNC_MCBTLP:
  60     case PCI_ERR_UNC_ATOP_EBLOCKED:
  61     case PCI_ERR_UNC_TLP_PRF_BLOCKED:
  62         return PCI_ERR_ROOT_CMD_NONFATAL_EN;
  63     default:
  64         abort();
  65         break;
  66     }
  67     return PCI_ERR_ROOT_CMD_FATAL_EN;
  68 }
  69
  70 static int aer_log_add_err(PCIEAERLog *aer_log, const PCIEAERErr *err)
  71 {
  72     if (aer_log->log_num == aer_log->log_max) {
  73         return -1;
  74     }
  75     memcpy(&aer_log->log[aer_log->log_num], err, sizeof *err);
  76     aer_log->log_num++;
  77     return 0;
  78 }
  79
  80 static void aer_log_del_err(PCIEAERLog *aer_log, PCIEAERErr *err)
  81 {
  82     assert(aer_log->log_num);
  83     *err = aer_log->log[0];
  84     aer_log->log_num--;
  85     memmove(&aer_log->log[0], &aer_log->log[1],
  86             aer_log->log_num * sizeof *err);
  87 }
  88
  89 static void aer_log_clear_all_err(PCIEAERLog *aer_log)
  90 {
  91     aer_log->log_num = 0;
  92 }
  93
  94 int pcie_aer_init(PCIDevice *dev, uint16_t offset)
  95 {
  96     PCIExpressDevice *exp;
  97
  98     pcie_add_capability(dev, PCI_EXT_CAP_ID_ERR, PCI_ERR_VER,
  99                         offset, PCI_ERR_SIZEOF);
 100     exp = &dev->exp;
 101     exp->aer_cap = offset;
 102
 103     /* log_max is property */
 104     if (dev->exp.aer_log.log_max == PCIE_AER_LOG_MAX_UNSET) {
 105         dev->exp.aer_log.log_max = PCIE_AER_LOG_MAX_DEFAULT;
 106     }
 107     /* clip down the value to avoid unreasobale memory usage */
 108     if (dev->exp.aer_log.log_max > PCIE_AER_LOG_MAX_LIMIT) {
 109         return -EINVAL;
 110     }
 111     dev->exp.aer_log.log = qemu_mallocz(sizeof dev->exp.aer_log.log[0] *
 112                                         dev->exp.aer_log.log_max);
 113
 114     pci_set_long(dev->w1cmask + offset + PCI_ERR_UNCOR_STATUS,
 115                  PCI_ERR_UNC_SUPPORTED);
 116
 117     pci_set_long(dev->config + offset + PCI_ERR_UNCOR_SEVER,
 118                  PCI_ERR_UNC_SEVERITY_DEFAULT);
 119     pci_set_long(dev->wmask + offset + PCI_ERR_UNCOR_SEVER,
 120                  PCI_ERR_UNC_SUPPORTED);
 121
 122     pci_long_test_and_set_mask(dev->w1cmask + offset + PCI_ERR_COR_STATUS,
 123                                PCI_ERR_COR_STATUS);
 124
 125     pci_set_long(dev->config + offset + PCI_ERR_COR_MASK,
 126                  PCI_ERR_COR_MASK_DEFAULT);
 127     pci_set_long(dev->wmask + offset + PCI_ERR_COR_MASK,
 128                  PCI_ERR_COR_SUPPORTED);
 129
 130     /* capabilities and control. multiple header logging is supported */
 131     if (dev->exp.aer_log.log_max > 0) {
 132         pci_set_long(dev->config + offset + PCI_ERR_CAP,
 133                      PCI_ERR_CAP_ECRC_GENC | PCI_ERR_CAP_ECRC_CHKC |
 134                      PCI_ERR_CAP_MHRC);
 135         pci_set_long(dev->wmask + offset + PCI_ERR_CAP,
 136                      PCI_ERR_CAP_ECRC_GENE | PCI_ERR_CAP_ECRC_CHKE |
 137                      PCI_ERR_CAP_MHRE);
 138     } else {
 139         pci_set_long(dev->config + offset + PCI_ERR_CAP,
 140                      PCI_ERR_CAP_ECRC_GENC | PCI_ERR_CAP_ECRC_CHKC);
 141         pci_set_long(dev->wmask + offset + PCI_ERR_CAP,
 142                      PCI_ERR_CAP_ECRC_GENE | PCI_ERR_CAP_ECRC_CHKE);
 143     }
 144
 145     switch (pcie_cap_get_type(dev)) {
 146     case PCI_EXP_TYPE_ROOT_PORT:
 147         /* this case will be set by pcie_aer_root_init() */
 148         /* fallthrough */
 149     case PCI_EXP_TYPE_DOWNSTREAM:
 150     case PCI_EXP_TYPE_UPSTREAM:
 151         pci_word_test_and_set_mask(dev->wmask + PCI_BRIDGE_CONTROL,
 152                                    PCI_BRIDGE_CTL_SERR);
 153         pci_long_test_and_set_mask(dev->w1cmask + PCI_STATUS,
 154                                    PCI_SEC_STATUS_RCV_SYSTEM_ERROR);
 155         break;
 156     default:
 157         /* nothing */
 158         break;
 159     }
 160     return 0;
 161 }
 162
 163 void pcie_aer_exit(PCIDevice *dev)
 164 {
 165     qemu_free(dev->exp.aer_log.log);
 166 }
 167
 168 static void pcie_aer_update_uncor_status(PCIDevice *dev)
 169 {
 170     uint8_t *aer_cap = dev->config + dev->exp.aer_cap;
 171     PCIEAERLog *aer_log = &dev->exp.aer_log;
 172
 173     uint16_t i;
 174     for (i = 0; i < aer_log->log_num; i++) {
 175         pci_long_test_and_set_mask(aer_cap + PCI_ERR_UNCOR_STATUS,
 176                                    dev->exp.aer_log.log[i].status);
 177     }
 178 }
 179
 180 /*
 181  * return value:
 182  * true: error message needs to be sent up
 183  * false: error message is masked
 184  *
 185  * 6.2.6 Error Message Control
 186  * Figure 6-3
 187  * all pci express devices part
 188  */
 189 static bool
 190 pcie_aer_msg_alldev(PCIDevice *dev, const PCIEAERMsg *msg)
 191 {
 192     if (!(pcie_aer_msg_is_uncor(msg) &&
 193           (pci_get_word(dev->config + PCI_COMMAND) & PCI_COMMAND_SERR))) {
 194         return false;
 195     }
 196
 197     /* Signaled System Error
 198      *
 199      * 7.5.1.1 Command register
 200      * Bit 8 SERR# Enable
 201      *
 202      * When Set, this bit enables reporting of Non-fatal and Fatal
 203      * errors detected by the Function to the Root Complex. Note that
 204      * errors are reported if enabled either through this bit or through
 205      * the PCI Express specific bits in the Device Control register (see
 206      * Section 7.8.4).
 207      */
 208     pci_word_test_and_set_mask(dev->config + PCI_STATUS,
 209                                PCI_STATUS_SIG_SYSTEM_ERROR);
 210
 211     if (!(msg->severity &
 212           pci_get_word(dev->config + dev->exp.exp_cap + PCI_EXP_DEVCTL))) {
 213         return false;
 214     }
 215
 216     /* send up error message */
 217     return true;
 218 }
 219
 220 /*
 221  * return value:
 222  * true: error message is sent up
 223  * false: error message is masked
 224  *
 225  * 6.2.6 Error Message Control
 226  * Figure 6-3
 227  * virtual pci bridge part
 228  */
 229 static bool pcie_aer_msg_vbridge(PCIDevice *dev, const PCIEAERMsg *msg)
 230 {
 231     uint16_t bridge_control = pci_get_word(dev->config + PCI_BRIDGE_CONTROL);
 232
 233     if (pcie_aer_msg_is_uncor(msg)) {
 234         /* Received System Error */
 235         pci_word_test_and_set_mask(dev->config + PCI_SEC_STATUS,
 236                                    PCI_SEC_STATUS_RCV_SYSTEM_ERROR);
 237     }
 238
 239     if (!(bridge_control & PCI_BRIDGE_CTL_SERR)) {
 240         return false;
 241     }
 242     return true;
 243 }
 244
 245 void pcie_aer_root_set_vector(PCIDevice *dev, unsigned int vector)
 246 {
 247     uint8_t *aer_cap = dev->config + dev->exp.aer_cap;
 248     assert(vector < PCI_ERR_ROOT_IRQ_MAX);
 249     pci_long_test_and_clear_mask(aer_cap + PCI_ERR_ROOT_STATUS,
 250                                  PCI_ERR_ROOT_IRQ);
 251     pci_long_test_and_set_mask(aer_cap + PCI_ERR_ROOT_STATUS,
 252                                vector << PCI_ERR_ROOT_IRQ_SHIFT);
 253 }
 254
 255 static unsigned int pcie_aer_root_get_vector(PCIDevice *dev)
 256 {
 257     uint8_t *aer_cap = dev->config + dev->exp.aer_cap;
 258     uint32_t root_status = pci_get_long(aer_cap + PCI_ERR_ROOT_STATUS);
 259     return (root_status & PCI_ERR_ROOT_IRQ) >> PCI_ERR_ROOT_IRQ_SHIFT;
 260 }
 261
 262 /* Given a status register, get corresponding bits in the command register */
 263 static uint32_t pcie_aer_status_to_cmd(uint32_t status)
 264 {
 265     uint32_t cmd = 0;
 266     if (status & PCI_ERR_ROOT_COR_RCV) {
 267         cmd |= PCI_ERR_ROOT_CMD_COR_EN;
 268     }
 269     if (status & PCI_ERR_ROOT_NONFATAL_RCV) {
 270         cmd |= PCI_ERR_ROOT_CMD_NONFATAL_EN;
 271     }
 272     if (status & PCI_ERR_ROOT_FATAL_RCV) {
 273         cmd |= PCI_ERR_ROOT_CMD_FATAL_EN;
 274     }
 275     return cmd;
 276 }
 277
 278 static void pcie_aer_root_notify(PCIDevice *dev)
 279 {
 280     if (msix_enabled(dev)) {
 281         msix_notify(dev, pcie_aer_root_get_vector(dev));
 282     } else if (msi_enabled(dev)) {
 283         msi_notify(dev, pcie_aer_root_get_vector(dev));
 284     } else {
 285         qemu_set_irq(dev->irq[dev->exp.aer_intx], 1);
 286     }
 287 }
 288
 289 /*
 290  * 6.2.6 Error Message Control
 291  * Figure 6-3
 292  * root port part
 293  */
 294 static void pcie_aer_msg_root_port(PCIDevice *dev, const PCIEAERMsg *msg)
 295 {
 296     uint16_t cmd;
 297     uint8_t *aer_cap;
 298     uint32_t root_cmd;
 299     uint32_t root_status, prev_status;
 300
 301     cmd = pci_get_word(dev->config + PCI_COMMAND);
 302     aer_cap = dev->config + dev->exp.aer_cap;
 303     root_cmd = pci_get_long(aer_cap + PCI_ERR_ROOT_COMMAND);
 304     prev_status = root_status = pci_get_long(aer_cap + PCI_ERR_ROOT_STATUS);
 305
 306     if (cmd & PCI_COMMAND_SERR) {
 307         /* System Error.
 308          *
 309          * The way to report System Error is platform specific and
 310          * it isn't implemented in qemu right now.
 311          * So just discard the error for now.
 312          * OS which cares of aer would receive errors via
 313          * native aer mechanims, so this wouldn't matter.
 314          */
 315     }
 316
 317     /* Errro Message Received: Root Error Status register */
 318     switch (msg->severity) {
 319     case PCI_ERR_ROOT_CMD_COR_EN:
 320         if (root_status & PCI_ERR_ROOT_COR_RCV) {
 321             root_status |= PCI_ERR_ROOT_MULTI_COR_RCV;
 322         } else {
 323             pci_set_word(aer_cap + PCI_ERR_ROOT_COR_SRC, msg->source_id);
 324         }
 325         root_status |= PCI_ERR_ROOT_COR_RCV;
 326         break;
 327     case PCI_ERR_ROOT_CMD_NONFATAL_EN:
 328         root_status |= PCI_ERR_ROOT_NONFATAL_RCV;
 329         break;
 330     case PCI_ERR_ROOT_CMD_FATAL_EN:
 331         if (!(root_status & PCI_ERR_ROOT_UNCOR_RCV)) {
 332             root_status |= PCI_ERR_ROOT_FIRST_FATAL;
 333         }
 334         root_status |= PCI_ERR_ROOT_FATAL_RCV;
 335         break;
 336     default:
 337         abort();
 338         break;
 339     }
 340     if (pcie_aer_msg_is_uncor(msg)) {
 341         if (root_status & PCI_ERR_ROOT_UNCOR_RCV) {
 342             root_status |= PCI_ERR_ROOT_MULTI_UNCOR_RCV;
 343         } else {
 344             pci_set_word(aer_cap + PCI_ERR_ROOT_SRC, msg->source_id);
 345         }
 346         root_status |= PCI_ERR_ROOT_UNCOR_RCV;
 347     }
 348     pci_set_long(aer_cap + PCI_ERR_ROOT_STATUS, root_status);
 349
 350     /* 6.2.4.1.2 Interrupt Generation */
 351     /* All the above did was set some bits in the status register.
 352      * Specifically these that match message severity.
 353      * The below code relies on this fact. */
 354     if (!(root_cmd & msg->severity) ||
 355         (pcie_aer_status_to_cmd(prev_status) & root_cmd)) {
 356         /* Condition is not being set or was already true so nothing to do. */
 357         return;
 358     }
 359
 360     pcie_aer_root_notify(dev);
 361 }
 362
 363 /*
 364  * 6.2.6 Error Message Control Figure 6-3
 365  *
 366  * Walk up the bus tree from the device, propagate the error message.
 367  */
 368 static void pcie_aer_msg(PCIDevice *dev, const PCIEAERMsg *msg)
 369 {
 370     uint8_t type;
 371
 372     while (dev) {
 373         if (!pci_is_express(dev)) {
 374             /* just ignore it */
 375             /* TODO: Shouldn't we set PCI_STATUS_SIG_SYSTEM_ERROR?
 376              * Consider e.g. a PCI bridge above a PCI Express device. */
 377             return;
 378         }
 379
 380         type = pcie_cap_get_type(dev);
 381         if ((type == PCI_EXP_TYPE_ROOT_PORT ||
 382             type == PCI_EXP_TYPE_UPSTREAM ||
 383             type == PCI_EXP_TYPE_DOWNSTREAM) &&
 384             !pcie_aer_msg_vbridge(dev, msg)) {
 385                 return;
 386         }
 387         if (!pcie_aer_msg_alldev(dev, msg)) {
 388             return;
 389         }
 390         if (type == PCI_EXP_TYPE_ROOT_PORT) {
 391             pcie_aer_msg_root_port(dev, msg);
 392             /* Root port can notify system itself,
 393                or send the error message to root complex event collector. */
 394             /*
 395              * if root port is associated with an event collector,
 396              * return the root complex event collector here.
 397              * For now root complex event collector isn't supported.
 398              */
 399             return;
 400         }
 401         dev = pci_bridge_get_device(dev->bus);
 402     }
 403 }
 404
 405 static void pcie_aer_update_log(PCIDevice *dev, const PCIEAERErr *err)
 406 {
 407     uint8_t *aer_cap = dev->config + dev->exp.aer_cap;
 408     uint8_t first_bit = ffs(err->status) - 1;
 409     uint32_t errcap = pci_get_long(aer_cap + PCI_ERR_CAP);
 410     int i;
 411
 412     assert(err->status);
 413     assert(err->status & (err->status - 1));
 414
 415     errcap &= ~(PCI_ERR_CAP_FEP_MASK | PCI_ERR_CAP_TLP);
 416     errcap |= PCI_ERR_CAP_FEP(first_bit);
 417
 418     if (err->flags & PCIE_AER_ERR_HEADER_VALID) {
 419         for (i = 0; i < ARRAY_SIZE(err->header); ++i) {
 420             /* 7.10.8 Header Log Register */
 421             uint8_t *header_log =
 422                 aer_cap + PCI_ERR_HEADER_LOG + i * sizeof err->header[0];
 423             cpu_to_be32wu((uint32_t*)header_log, err->header[i]);
 424         }
 425     } else {
 426         assert(!(err->flags & PCIE_AER_ERR_TLP_PREFIX_PRESENT));
 427         memset(aer_cap + PCI_ERR_HEADER_LOG, 0, PCI_ERR_HEADER_LOG_SIZE);
 428     }
 429
 430     if ((err->flags & PCIE_AER_ERR_TLP_PREFIX_PRESENT) &&
 431         (pci_get_long(dev->config + dev->exp.exp_cap + PCI_EXP_DEVCTL2) &
 432          PCI_EXP_DEVCAP2_EETLPP)) {
 433         for (i = 0; i < ARRAY_SIZE(err->prefix); ++i) {
 434             /* 7.10.12 tlp prefix log register */
 435             uint8_t *prefix_log =
 436                 aer_cap + PCI_ERR_TLP_PREFIX_LOG + i * sizeof err->prefix[0];
 437             cpu_to_be32wu((uint32_t*)prefix_log, err->prefix[i]);
 438         }
 439         errcap |= PCI_ERR_CAP_TLP;
 440     } else {
 441         memset(aer_cap + PCI_ERR_TLP_PREFIX_LOG, 0,
 442                PCI_ERR_TLP_PREFIX_LOG_SIZE);
 443     }
 444     pci_set_long(aer_cap + PCI_ERR_CAP, errcap);
 445 }
 446
 447 static void pcie_aer_clear_log(PCIDevice *dev)
 448 {
 449     uint8_t *aer_cap = dev->config + dev->exp.aer_cap;
 450
 451     pci_long_test_and_clear_mask(aer_cap + PCI_ERR_CAP,
 452                                  PCI_ERR_CAP_FEP_MASK | PCI_ERR_CAP_TLP);
 453
 454     memset(aer_cap + PCI_ERR_HEADER_LOG, 0, PCI_ERR_HEADER_LOG_SIZE);
 455     memset(aer_cap + PCI_ERR_TLP_PREFIX_LOG, 0, PCI_ERR_TLP_PREFIX_LOG_SIZE);
 456 }
 457
 458 static void pcie_aer_clear_error(PCIDevice *dev)
 459 {
 460     uint8_t *aer_cap = dev->config + dev->exp.aer_cap;
 461     uint32_t errcap = pci_get_long(aer_cap + PCI_ERR_CAP);
 462     PCIEAERLog *aer_log = &dev->exp.aer_log;
 463     PCIEAERErr err;
 464
 465     if (!(errcap & PCI_ERR_CAP_MHRE) || !aer_log->log_num) {
 466         pcie_aer_clear_log(dev);
 467         return;
 468     }
 469
 470     /*
 471      * If more errors are queued, set corresponding bits in uncorrectable
 472      * error status.
 473      * We emulate uncorrectable error status register as W1CS.
 474      * So set bit in uncorrectable error status here again for multiple
 475      * error recording support.
 476      *
 477      * 6.2.4.2 Multiple Error Handling(Advanced Error Reporting Capability)
 478      */
 479     pcie_aer_update_uncor_status(dev);
 480
 481     aer_log_del_err(aer_log, &err);
 482     pcie_aer_update_log(dev, &err);
 483 }
 484
 485 static int pcie_aer_record_error(PCIDevice *dev,
 486                                  const PCIEAERErr *err)
 487 {
 488     uint8_t *aer_cap = dev->config + dev->exp.aer_cap;
 489     uint32_t errcap = pci_get_long(aer_cap + PCI_ERR_CAP);
 490     int fep = PCI_ERR_CAP_FEP(errcap);
 491
 492     assert(err->status);
 493     assert(err->status & (err->status - 1));
 494
 495     if (errcap & PCI_ERR_CAP_MHRE &&
 496         (pci_get_long(aer_cap + PCI_ERR_UNCOR_STATUS) & (1U << fep))) {
 497         /*  Not first error. queue error */
 498         if (aer_log_add_err(&dev->exp.aer_log, err) < 0) {
 499             /* overflow */
 500             return -1;
 501         }
 502         return 0;
 503     }
 504
 505     pcie_aer_update_log(dev, err);
 506     return 0;
 507 }
 508
 509 typedef struct PCIEAERInject {
 510     PCIDevice *dev;
 511     uint8_t *aer_cap;
 512     const PCIEAERErr *err;
 513     uint16_t devctl;
 514     uint16_t devsta;
 515     uint32_t error_status;
 516     bool unsupported_request;
 517     bool log_overflow;
 518     PCIEAERMsg msg;
 519 } PCIEAERInject;
 520
 521 static bool pcie_aer_inject_cor_error(PCIEAERInject *inj,
 522                                       uint32_t uncor_status,
 523                                       bool is_advisory_nonfatal)
 524 {
 525     PCIDevice *dev = inj->dev;
 526
 527     inj->devsta |= PCI_EXP_DEVSTA_CED;
 528     if (inj->unsupported_request) {
 529         inj->devsta |= PCI_EXP_DEVSTA_URD;
 530     }
 531     pci_set_word(dev->config + dev->exp.exp_cap + PCI_EXP_DEVSTA, inj->devsta);
 532
 533     if (inj->aer_cap) {
 534         uint32_t mask;
 535         pci_long_test_and_set_mask(inj->aer_cap + PCI_ERR_COR_STATUS,
 536                                    inj->error_status);
 537         mask = pci_get_long(inj->aer_cap + PCI_ERR_COR_MASK);
 538         if (mask & inj->error_status) {
 539             return false;
 540         }
 541         if (is_advisory_nonfatal) {
 542             uint32_t uncor_mask =
 543                 pci_get_long(inj->aer_cap + PCI_ERR_UNCOR_MASK);
 544             if (!(uncor_mask & uncor_status)) {
 545                 inj->log_overflow = !!pcie_aer_record_error(dev, inj->err);
 546             }
 547             pci_long_test_and_set_mask(inj->aer_cap + PCI_ERR_UNCOR_STATUS,
 548                                        uncor_status);
 549         }
 550     }
 551
 552     if (inj->unsupported_request && !(inj->devctl & PCI_EXP_DEVCTL_URRE)) {
 553         return false;
 554     }
 555     if (!(inj->devctl & PCI_EXP_DEVCTL_CERE)) {
 556         return false;
 557     }
 558
 559     inj->msg.severity = PCI_ERR_ROOT_CMD_COR_EN;
 560     return true;
 561 }
 562
 563 static bool pcie_aer_inject_uncor_error(PCIEAERInject *inj, bool is_fatal)
 564 {
 565     PCIDevice *dev = inj->dev;
 566     uint16_t cmd;
 567
 568     if (is_fatal) {
 569         inj->devsta |= PCI_EXP_DEVSTA_FED;
 570     } else {
 571         inj->devsta |= PCI_EXP_DEVSTA_NFED;
 572     }
 573     if (inj->unsupported_request) {
 574         inj->devsta |= PCI_EXP_DEVSTA_URD;
 575     }
 576     pci_set_long(dev->config + dev->exp.exp_cap + PCI_EXP_DEVSTA, inj->devsta);
 577
 578     if (inj->aer_cap) {
 579         uint32_t mask = pci_get_long(inj->aer_cap + PCI_ERR_UNCOR_MASK);
 580         if (mask & inj->error_status) {
 581             pci_long_test_and_set_mask(inj->aer_cap + PCI_ERR_UNCOR_STATUS,
 582                                        inj->error_status);
 583             return false;
 584         }
 585
 586         inj->log_overflow = !!pcie_aer_record_error(dev, inj->err);
 587         pci_long_test_and_set_mask(inj->aer_cap + PCI_ERR_UNCOR_STATUS,
 588                                    inj->error_status);
 589     }
 590
 591     cmd = pci_get_word(dev->config + PCI_COMMAND);
 592     if (inj->unsupported_request &&
 593         !(inj->devctl & PCI_EXP_DEVCTL_URRE) && !(cmd & PCI_COMMAND_SERR)) {
 594         return false;
 595     }
 596     if (is_fatal) {
 597         if (!((cmd & PCI_COMMAND_SERR) ||
 598               (inj->devctl & PCI_EXP_DEVCTL_FERE))) {
 599             return false;
 600         }
 601         inj->msg.severity = PCI_ERR_ROOT_CMD_FATAL_EN;
 602     } else {
 603         if (!((cmd & PCI_COMMAND_SERR) ||
 604               (inj->devctl & PCI_EXP_DEVCTL_NFERE))) {
 605             return false;
 606         }
 607         inj->msg.severity = PCI_ERR_ROOT_CMD_NONFATAL_EN;
 608     }
 609     return true;
 610 }
 611
 612 /*
 613  * non-Function specific error must be recorded in all functions.
 614  * It is the responsibility of the caller of this function.
 615  * It is also caller's responsiblity to determine which function should
 616  * report the rerror.
 617  *
 618  * 6.2.4 Error Logging
 619  * 6.2.5 Sqeunce of Device Error Signaling and Logging Operations
 620  * table 6-2: Flowchard Showing Sequence of Device Error Signaling and Logging
 621  *            Operations
 622  */
 623 int pcie_aer_inject_error(PCIDevice *dev, const PCIEAERErr *err)
 624 {
 625     uint8_t *aer_cap = NULL;
 626     uint16_t devctl = 0;
 627     uint16_t devsta = 0;
 628     uint32_t error_status = err->status;
 629     PCIEAERInject inj;
 630
 631     if (!pci_is_express(dev)) {
 632         return -ENOSYS;
 633     }
 634
 635     if (err->flags & PCIE_AER_ERR_IS_CORRECTABLE) {
 636         error_status &= PCI_ERR_COR_SUPPORTED;
 637     } else {
 638         error_status &= PCI_ERR_UNC_SUPPORTED;
 639     }
 640
 641     /* invalid status bit. one and only one bit must be set */
 642     if (!error_status || (error_status & (error_status - 1))) {
 643         return -EINVAL;
 644     }
 645
 646     if (dev->exp.aer_cap) {
 647         uint8_t *exp_cap = dev->config + dev->exp.exp_cap;
 648         aer_cap = dev->config + dev->exp.aer_cap;
 649         devctl = pci_get_long(exp_cap + PCI_EXP_DEVCTL);
 650         devsta = pci_get_long(exp_cap + PCI_EXP_DEVSTA);
 651     }
 652
 653     inj.dev = dev;
 654     inj.aer_cap = aer_cap;
 655     inj.err = err;
 656     inj.devctl = devctl;
 657     inj.devsta = devsta;
 658     inj.error_status = error_status;
 659     inj.unsupported_request = !(err->flags & PCIE_AER_ERR_IS_CORRECTABLE) &&
 660         err->status == PCI_ERR_UNC_UNSUP;
 661     inj.log_overflow = false;
 662
 663     if (err->flags & PCIE_AER_ERR_IS_CORRECTABLE) {
 664         if (!pcie_aer_inject_cor_error(&inj, 0, false)) {
 665             return 0;
 666         }
 667     } else {
 668         bool is_fatal =
 669             pcie_aer_uncor_default_severity(error_status) ==
 670             PCI_ERR_ROOT_CMD_FATAL_EN;
 671         if (aer_cap) {
 672             is_fatal =
 673                 error_status & pci_get_long(aer_cap + PCI_ERR_UNCOR_SEVER);
 674         }
 675         if (!is_fatal && (err->flags & PCIE_AER_ERR_MAYBE_ADVISORY)) {
 676             inj.error_status = PCI_ERR_COR_ADV_NONFATAL;
 677             if (!pcie_aer_inject_cor_error(&inj, error_status, true)) {
 678                 return 0;
 679             }
 680         } else {
 681             if (!pcie_aer_inject_uncor_error(&inj, is_fatal)) {
 682                 return 0;
 683             }
 684         }
 685     }
 686
 687     /* send up error message */
 688     inj.msg.source_id = err->source_id;
 689     pcie_aer_msg(dev, &inj.msg);
 690
 691     if (inj.log_overflow) {
 692         PCIEAERErr header_log_overflow = {
 693             .status = PCI_ERR_COR_HL_OVERFLOW,
 694             .flags = PCIE_AER_ERR_IS_CORRECTABLE,
 695         };
 696         int ret = pcie_aer_inject_error(dev, &header_log_overflow);
 697         assert(!ret);
 698     }
 699     return 0;
 700 }
 701
 702 void pcie_aer_write_config(PCIDevice *dev,
 703                            uint32_t addr, uint32_t val, int len)
 704 {
 705     uint8_t *aer_cap = dev->config + dev->exp.aer_cap;
 706     uint32_t errcap = pci_get_long(aer_cap + PCI_ERR_CAP);
 707     uint32_t first_error = 1U << PCI_ERR_CAP_FEP(errcap);
 708     uint32_t uncorsta = pci_get_long(aer_cap + PCI_ERR_UNCOR_STATUS);
 709
 710     /* uncorrectable error */
 711     if (!(uncorsta & first_error)) {
 712         /* the bit that corresponds to the first error is cleared */
 713         pcie_aer_clear_error(dev);
 714     } else if (errcap & PCI_ERR_CAP_MHRE) {
 715         /* When PCI_ERR_CAP_MHRE is enabled and the first error isn't cleared
 716          * nothing should happen. So we have to revert the modification to
 717          * the register.
 718          */
 719         pcie_aer_update_uncor_status(dev);
 720     } else {
 721         /* capability & control
 722          * PCI_ERR_CAP_MHRE might be cleared, so clear of header log.
 723          */
 724         aer_log_clear_all_err(&dev->exp.aer_log);
 725     }
 726 }
 727
 728 void pcie_aer_root_init(PCIDevice *dev)
 729 {
 730     uint16_t pos = dev->exp.aer_cap;
 731
 732     pci_set_long(dev->wmask + pos + PCI_ERR_ROOT_COMMAND,
 733                  PCI_ERR_ROOT_CMD_EN_MASK);
 734     pci_set_long(dev->w1cmask + pos + PCI_ERR_ROOT_STATUS,
 735                  PCI_ERR_ROOT_STATUS_REPORT_MASK);
 736 }
 737
 738 void pcie_aer_root_reset(PCIDevice *dev)
 739 {
 740     uint8_t* aer_cap = dev->config + dev->exp.aer_cap;
 741
 742     pci_set_long(aer_cap + PCI_ERR_ROOT_COMMAND, 0);
 743
 744     /*
 745      * Advanced Error Interrupt Message Number in Root Error Status Register
 746      * must be updated by chip dependent code because it's chip dependent
 747      * which number is used.
 748      */
 749 }
 750
 751 void pcie_aer_root_write_config(PCIDevice *dev,
 752                                 uint32_t addr, uint32_t val, int len,
 753                                 uint32_t root_cmd_prev)
 754 {
 755     uint8_t *aer_cap = dev->config + dev->exp.aer_cap;
 756     uint32_t root_status = pci_get_long(aer_cap + PCI_ERR_ROOT_STATUS);
 757     uint32_t enabled_cmd = pcie_aer_status_to_cmd(root_status);
 758     uint32_t root_cmd = pci_get_long(aer_cap + PCI_ERR_ROOT_COMMAND);
 759     /* 6.2.4.1.2 Interrupt Generation */
 760     if (!msix_enabled(dev) && !msi_enabled(dev)) {
 761         qemu_set_irq(dev->irq[dev->exp.aer_intx], !!(root_cmd & enabled_cmd));
 762         return;
 763     }
 764
 765     if ((root_cmd_prev & enabled_cmd) || !(root_cmd & enabled_cmd)) {
 766         /* Send MSI on transition from false to true. */
 767         return;
 768     }
 769
 770     pcie_aer_root_notify(dev);
 771 }
 772
 773 static const VMStateDescription vmstate_pcie_aer_err = {
 774     .name = "PCIE_AER_ERROR",
 775     .version_id = 1,
 776     .minimum_version_id = 1,
 777     .minimum_version_id_old = 1,
 778     .fields     = (VMStateField[]) {
 779         VMSTATE_UINT32(status, PCIEAERErr),
 780         VMSTATE_UINT16(source_id, PCIEAERErr),
 781         VMSTATE_UINT16(flags, PCIEAERErr),
 782         VMSTATE_UINT32_ARRAY(header, PCIEAERErr, 4),
 783         VMSTATE_UINT32_ARRAY(prefix, PCIEAERErr, 4),
 784         VMSTATE_END_OF_LIST()
 785     }
 786 };
 787
 788 #define VMSTATE_PCIE_AER_ERRS(_field, _state, _field_num, _vmsd, _type) { \
 789     .name       = (stringify(_field)),                                    \
 790     .version_id = 0,                                                      \
 791     .num_offset = vmstate_offset_value(_state, _field_num, uint16_t),     \
 792     .size       = sizeof(_type),                                          \
 793     .vmsd       = &(_vmsd),                                               \
 794     .flags      = VMS_POINTER | VMS_VARRAY_UINT16 | VMS_STRUCT,           \
 795     .offset     = vmstate_offset_pointer(_state, _field, _type),          \
 796 }
 797
 798 const VMStateDescription vmstate_pcie_aer_log = {
 799     .name = "PCIE_AER_ERROR_LOG",
 800     .version_id = 1,
 801     .minimum_version_id = 1,
 802     .minimum_version_id_old = 1,
 803     .fields     = (VMStateField[]) {
 804         VMSTATE_UINT16(log_num, PCIEAERLog),
 805         VMSTATE_UINT16(log_max, PCIEAERLog),
 806         VMSTATE_PCIE_AER_ERRS(log, PCIEAERLog, log_num,
 807                               vmstate_pcie_aer_err, PCIEAERErr),
 808         VMSTATE_END_OF_LIST()
 809     }
 810 };
 811
 812 void pcie_aer_inject_error_print(Monitor *mon, const QObject *data)
 813 {
 814     QDict *qdict;
 815     int devfn;
 816     assert(qobject_type(data) == QTYPE_QDICT);
 817     qdict = qobject_to_qdict(data);
 818
 819     devfn = (int)qdict_get_int(qdict, "devfn");
 820     monitor_printf(mon, "OK id: %s domain: %x, bus: %x devfn: %x.%x\n",
 821                    qdict_get_str(qdict, "id"),
 822                    (int) qdict_get_int(qdict, "domain"),
 823                    (int) qdict_get_int(qdict, "bus"),
 824                    PCI_SLOT(devfn), PCI_FUNC(devfn));
 825 }
 826
 827 typedef struct PCIEAERErrorName {
 828     const char *name;
 829     uint32_t val;
 830     bool correctable;
 831 } PCIEAERErrorName;
 832
 833 /*
 834  * AER error name -> value convertion table
 835  * This naming scheme is same to linux aer-injection tool.
 836  */
 837 static const struct PCIEAERErrorName pcie_aer_error_list[] = {
 838     {
 839         .name = "TRAIN",
 840         .val = PCI_ERR_UNC_TRAIN,
 841         .correctable = false,
 842     }, {
 843         .name = "DLP",
 844         .val = PCI_ERR_UNC_DLP,
 845         .correctable = false,
 846     }, {
 847         .name = "SDN",
 848         .val = PCI_ERR_UNC_SDN,
 849         .correctable = false,
 850     }, {
 851         .name = "POISON_TLP",
 852         .val = PCI_ERR_UNC_POISON_TLP,
 853         .correctable = false,
 854     }, {
 855         .name = "FCP",
 856         .val = PCI_ERR_UNC_FCP,
 857         .correctable = false,
 858     }, {
 859         .name = "COMP_TIME",
 860         .val = PCI_ERR_UNC_COMP_TIME,
 861         .correctable = false,
 862     }, {
 863         .name = "COMP_ABORT",
 864         .val = PCI_ERR_UNC_COMP_ABORT,
 865         .correctable = false,
 866     }, {
 867         .name = "UNX_COMP",
 868         .val = PCI_ERR_UNC_UNX_COMP,
 869         .correctable = false,
 870     }, {
 871         .name = "RX_OVER",
 872         .val = PCI_ERR_UNC_RX_OVER,
 873         .correctable = false,
 874     }, {
 875         .name = "MALF_TLP",
 876         .val = PCI_ERR_UNC_MALF_TLP,
 877         .correctable = false,
 878     }, {
 879         .name = "ECRC",
 880         .val = PCI_ERR_UNC_ECRC,
 881         .correctable = false,
 882     }, {
 883         .name = "UNSUP",
 884         .val = PCI_ERR_UNC_UNSUP,
 885         .correctable = false,
 886     }, {
 887         .name = "ACSV",
 888         .val = PCI_ERR_UNC_ACSV,
 889         .correctable = false,
 890     }, {
 891         .name = "INTN",
 892         .val = PCI_ERR_UNC_INTN,
 893         .correctable = false,
 894     }, {
 895         .name = "MCBTLP",
 896         .val = PCI_ERR_UNC_MCBTLP,
 897         .correctable = false,
 898     }, {
 899         .name = "ATOP_EBLOCKED",
 900         .val = PCI_ERR_UNC_ATOP_EBLOCKED,
 901         .correctable = false,
 902     }, {
 903         .name = "TLP_PRF_BLOCKED",
 904         .val = PCI_ERR_UNC_TLP_PRF_BLOCKED,
 905         .correctable = false,
 906     }, {
 907         .name = "RCVR",
 908         .val = PCI_ERR_COR_RCVR,
 909         .correctable = true,
 910     }, {
 911         .name = "BAD_TLP",
 912         .val = PCI_ERR_COR_BAD_TLP,
 913         .correctable = true,
 914     }, {
 915         .name = "BAD_DLLP",
 916         .val = PCI_ERR_COR_BAD_DLLP,
 917         .correctable = true,
 918     }, {
 919         .name = "REP_ROLL",
 920         .val = PCI_ERR_COR_REP_ROLL,
 921         .correctable = true,
 922     }, {
 923         .name = "REP_TIMER",
 924         .val = PCI_ERR_COR_REP_TIMER,
 925         .correctable = true,
 926     }, {
 927         .name = "ADV_NONFATAL",
 928         .val = PCI_ERR_COR_ADV_NONFATAL,
 929         .correctable = true,
 930     }, {
 931         .name = "INTERNAL",
 932         .val = PCI_ERR_COR_INTERNAL,
 933         .correctable = true,
 934     }, {
 935         .name = "HL_OVERFLOW",
 936         .val = PCI_ERR_COR_HL_OVERFLOW,
 937         .correctable = true,
 938     },
 939 };
 940
 941 static int pcie_aer_parse_error_string(const char *error_name,
 942                                        uint32_t *status, bool *correctable)
 943 {
 944     int i;
 945
 946     for (i = 0; i < ARRAY_SIZE(pcie_aer_error_list); i++) {
 947         const  PCIEAERErrorName *e = &pcie_aer_error_list[i];
 948         if (strcmp(error_name, e->name)) {
 949             continue;
 950         }
 951
 952         *status = e->val;
 953         *correctable = e->correctable;
 954         return 0;
 955     }
 956     return -EINVAL;
 957 }
 958
 959 int do_pcie_aer_inejct_error(Monitor *mon,
 960                              const QDict *qdict, QObject **ret_data)
 961 {
 962     const char *id = qdict_get_str(qdict, "id");
 963     const char *error_name;
 964     uint32_t error_status;
 965     bool correctable;
 966     PCIDevice *dev;
 967     PCIEAERErr err;
 968     int ret;
 969
 970     ret = pci_qdev_find_device(id, &dev);
 971     if (ret < 0) {
 972         monitor_printf(mon,
 973                        "id or pci device path is invalid or device not "
 974                        "found. %s\n", id);
 975         return ret;
 976     }
 977     if (!pci_is_express(dev)) {
 978         monitor_printf(mon, "the device doesn't support pci express. %s\n",
 979                        id);
 980         return -ENOSYS;
 981     }
 982
 983     error_name = qdict_get_str(qdict, "error_status");
 984     if (pcie_aer_parse_error_string(error_name, &error_status, &correctable)) {
 985         char *e = NULL;
 986         error_status = strtoul(error_name, &e, 0);
 987         correctable = !!qdict_get_int(qdict, "correctable");
 988         if (!e || *e != '\0') {
 989             monitor_printf(mon, "invalid error status value. \"%s\"",
 990                            error_name);
 991             return -EINVAL;
 992         }
 993     }
 994     err.source_id = (pci_bus_num(dev->bus) << 8) | dev->devfn;
 995
 996     err.flags = 0;
 997     if (correctable) {
 998         err.flags |= PCIE_AER_ERR_IS_CORRECTABLE;
 999     }
1000     if (qdict_get_int(qdict, "advisory_non_fatal")) {
1001         err.flags |= PCIE_AER_ERR_MAYBE_ADVISORY;
1002     }
1003     if (qdict_haskey(qdict, "header0")) {
1004         err.flags |= PCIE_AER_ERR_HEADER_VALID;
1005     }
1006     if (qdict_haskey(qdict, "prefix0")) {
1007         err.flags |= PCIE_AER_ERR_TLP_PREFIX_PRESENT;
1008     }
1009
1010     err.header[0] = qdict_get_try_int(qdict, "header0", 0);
1011     err.header[1] = qdict_get_try_int(qdict, "header1", 0);
1012     err.header[2] = qdict_get_try_int(qdict, "header2", 0);
1013     err.header[3] = qdict_get_try_int(qdict, "header3", 0);
1014
1015     err.prefix[0] = qdict_get_try_int(qdict, "prefix0", 0);
1016     err.prefix[1] = qdict_get_try_int(qdict, "prefix1", 0);
1017     err.prefix[2] = qdict_get_try_int(qdict, "prefix2", 0);
1018     err.prefix[3] = qdict_get_try_int(qdict, "prefix3", 0);
1019
1020     ret = pcie_aer_inject_error(dev, &err);
1021     *ret_data = qobject_from_jsonf("{'id': %s, "
1022                                    "'domain': %d, 'bus': %d, 'devfn': %d, "
1023                                    "'ret': %d}",
1024                                    id,
1025                                    pci_find_domain(dev->bus),
1026                                    pci_bus_num(dev->bus), dev->devfn,
1027                                    ret);
1028     assert(*ret_data);
1029
1030     return 0;
1031 }