2 * QEMU PowerPC PowerNV (POWER8) PHB3 model
4 * Copyright (c) 2014-2020, IBM Corporation.
6 * This code is licensed under the GPL version 2 or later. See the
7 * COPYING file in the top-level directory.
9 #include "qemu/osdep.h"
11 #include "qapi/visitor.h"
12 #include "qapi/error.h"
13 #include "qemu-common.h"
14 #include "hw/pci-host/pnv_phb3_regs.h"
15 #include "hw/pci-host/pnv_phb3.h"
16 #include "hw/pci/pcie_host.h"
17 #include "hw/pci/pcie_port.h"
18 #include "hw/ppc/pnv.h"
20 #include "hw/qdev-properties.h"
22 #define phb3_error(phb, fmt, ...) \
23 qemu_log_mask(LOG_GUEST_ERROR, "phb3[%d:%d]: " fmt "\n", \
24 (phb)->chip_id, (phb)->phb_id, ## __VA_ARGS__)
26 static PCIDevice
*pnv_phb3_find_cfg_dev(PnvPHB3
*phb
)
28 PCIHostState
*pci
= PCI_HOST_BRIDGE(phb
);
29 uint64_t addr
= phb
->regs
[PHB_CONFIG_ADDRESS
>> 3];
35 bus
= (addr
>> 52) & 0xff;
36 devfn
= (addr
>> 44) & 0xff;
38 return pci_find_device(pci
->bus
, bus
, devfn
);
42 * The CONFIG_DATA register expects little endian accesses, but as the
43 * region is big endian, we have to swap the value.
45 static void pnv_phb3_config_write(PnvPHB3
*phb
, unsigned off
,
46 unsigned size
, uint64_t val
)
48 uint32_t cfg_addr
, limit
;
51 pdev
= pnv_phb3_find_cfg_dev(phb
);
55 cfg_addr
= (phb
->regs
[PHB_CONFIG_ADDRESS
>> 3] >> 32) & 0xffc;
57 limit
= pci_config_size(pdev
);
58 if (limit
<= cfg_addr
) {
60 * conventional pci device can be behind pcie-to-pci bridge.
61 * 256 <= addr < 4K has no effects.
75 g_assert_not_reached();
77 pci_host_config_write_common(pdev
, cfg_addr
, limit
, val
, size
);
80 static uint64_t pnv_phb3_config_read(PnvPHB3
*phb
, unsigned off
,
83 uint32_t cfg_addr
, limit
;
87 pdev
= pnv_phb3_find_cfg_dev(phb
);
91 cfg_addr
= (phb
->regs
[PHB_CONFIG_ADDRESS
>> 3] >> 32) & 0xffc;
93 limit
= pci_config_size(pdev
);
94 if (limit
<= cfg_addr
) {
96 * conventional pci device can be behind pcie-to-pci bridge.
97 * 256 <= addr < 4K has no effects.
101 val
= pci_host_config_read_common(pdev
, cfg_addr
, limit
, size
);
110 g_assert_not_reached();
114 static void pnv_phb3_check_m32(PnvPHB3
*phb
)
116 uint64_t base
, start
, size
;
117 MemoryRegion
*parent
;
118 PnvPBCQState
*pbcq
= &phb
->pbcq
;
120 if (memory_region_is_mapped(&phb
->mr_m32
)) {
121 memory_region_del_subregion(phb
->mr_m32
.container
, &phb
->mr_m32
);
124 if (!(phb
->regs
[PHB_PHB3_CONFIG
>> 3] & PHB_PHB3C_M32_EN
)) {
128 /* Grab geometry from registers */
129 base
= phb
->regs
[PHB_M32_BASE_ADDR
>> 3];
130 start
= phb
->regs
[PHB_M32_START_ADDR
>> 3];
131 size
= ~(phb
->regs
[PHB_M32_BASE_MASK
>> 3] | 0xfffc000000000000ull
) + 1;
133 /* Check if it matches an enabled MMIO region in the PBCQ */
134 if (memory_region_is_mapped(&pbcq
->mmbar0
) &&
135 base
>= pbcq
->mmio0_base
&&
136 (base
+ size
) <= (pbcq
->mmio0_base
+ pbcq
->mmio0_size
)) {
137 parent
= &pbcq
->mmbar0
;
138 base
-= pbcq
->mmio0_base
;
139 } else if (memory_region_is_mapped(&pbcq
->mmbar1
) &&
140 base
>= pbcq
->mmio1_base
&&
141 (base
+ size
) <= (pbcq
->mmio1_base
+ pbcq
->mmio1_size
)) {
142 parent
= &pbcq
->mmbar1
;
143 base
-= pbcq
->mmio1_base
;
149 memory_region_init_alias(&phb
->mr_m32
, OBJECT(phb
), "phb3-m32",
150 &phb
->pci_mmio
, start
, size
);
151 memory_region_add_subregion(parent
, base
, &phb
->mr_m32
);
154 static void pnv_phb3_check_m64(PnvPHB3
*phb
, uint32_t index
)
156 uint64_t base
, start
, size
, m64
;
157 MemoryRegion
*parent
;
158 PnvPBCQState
*pbcq
= &phb
->pbcq
;
160 if (memory_region_is_mapped(&phb
->mr_m64
[index
])) {
161 /* Should we destroy it in RCU friendly way... ? */
162 memory_region_del_subregion(phb
->mr_m64
[index
].container
,
163 &phb
->mr_m64
[index
]);
166 /* Get table entry */
167 m64
= phb
->ioda_M64BT
[index
];
169 if (!(m64
& IODA2_M64BT_ENABLE
)) {
173 /* Grab geometry from registers */
174 base
= GETFIELD(IODA2_M64BT_BASE
, m64
) << 20;
175 if (m64
& IODA2_M64BT_SINGLE_PE
) {
176 base
&= ~0x1ffffffull
;
178 size
= GETFIELD(IODA2_M64BT_MASK
, m64
) << 20;
179 size
|= 0xfffc000000000000ull
;
181 start
= base
| (phb
->regs
[PHB_M64_UPPER_BITS
>> 3]);
183 /* Check if it matches an enabled MMIO region in the PBCQ */
184 if (memory_region_is_mapped(&pbcq
->mmbar0
) &&
185 base
>= pbcq
->mmio0_base
&&
186 (base
+ size
) <= (pbcq
->mmio0_base
+ pbcq
->mmio0_size
)) {
187 parent
= &pbcq
->mmbar0
;
188 base
-= pbcq
->mmio0_base
;
189 } else if (memory_region_is_mapped(&pbcq
->mmbar1
) &&
190 base
>= pbcq
->mmio1_base
&&
191 (base
+ size
) <= (pbcq
->mmio1_base
+ pbcq
->mmio1_size
)) {
192 parent
= &pbcq
->mmbar1
;
193 base
-= pbcq
->mmio1_base
;
199 memory_region_init_alias(&phb
->mr_m64
[index
], OBJECT(phb
), "phb3-m64",
200 &phb
->pci_mmio
, start
, size
);
201 memory_region_add_subregion(parent
, base
, &phb
->mr_m64
[index
]);
204 static void pnv_phb3_check_all_m64s(PnvPHB3
*phb
)
208 for (i
= 0; i
< PNV_PHB3_NUM_M64
; i
++) {
209 pnv_phb3_check_m64(phb
, i
);
213 static void pnv_phb3_lxivt_write(PnvPHB3
*phb
, unsigned idx
, uint64_t val
)
215 uint8_t server
, prio
;
217 phb
->ioda_LXIVT
[idx
] = val
& (IODA2_LXIVT_SERVER
|
218 IODA2_LXIVT_PRIORITY
|
219 IODA2_LXIVT_NODE_ID
);
220 server
= GETFIELD(IODA2_LXIVT_SERVER
, val
);
221 prio
= GETFIELD(IODA2_LXIVT_PRIORITY
, val
);
224 * The low order 2 bits are the link pointer (Type II interrupts).
225 * Shift back to get a valid IRQ server.
229 ics_write_xive(&phb
->lsis
, idx
, server
, prio
, prio
);
232 static uint64_t *pnv_phb3_ioda_access(PnvPHB3
*phb
,
233 unsigned *out_table
, unsigned *out_idx
)
235 uint64_t adreg
= phb
->regs
[PHB_IODA_ADDR
>> 3];
236 unsigned int index
= GETFIELD(PHB_IODA_AD_TADR
, adreg
);
237 unsigned int table
= GETFIELD(PHB_IODA_AD_TSEL
, adreg
);
239 uint64_t *tptr
= NULL
;
243 tptr
= phb
->ioda_LIST
;
246 case IODA2_TBL_LXIVT
:
247 tptr
= phb
->ioda_LXIVT
;
250 case IODA2_TBL_IVC_CAM
:
260 case IODA2_TBL_PESTA
:
261 case IODA2_TBL_PESTB
:
265 tptr
= phb
->ioda_TVT
;
272 case IODA2_TBL_M64BT
:
273 tptr
= phb
->ioda_M64BT
;
276 case IODA2_TBL_M32DT
:
277 tptr
= phb
->ioda_MDT
;
281 tptr
= phb
->ioda_PEEV
;
285 phb3_error(phb
, "invalid IODA table %d", table
);
298 if (adreg
& PHB_IODA_AD_AUTOINC
) {
299 index
= (index
+ 1) & mask
;
300 adreg
= SETFIELD(PHB_IODA_AD_TADR
, adreg
, index
);
302 phb
->regs
[PHB_IODA_ADDR
>> 3] = adreg
;
306 static uint64_t pnv_phb3_ioda_read(PnvPHB3
*phb
)
311 tptr
= pnv_phb3_ioda_access(phb
, &table
, NULL
);
313 /* Return 0 on unsupported tables, not ff's */
319 static void pnv_phb3_ioda_write(PnvPHB3
*phb
, uint64_t val
)
324 tptr
= pnv_phb3_ioda_access(phb
, &table
, &idx
);
329 /* Handle side effects */
331 case IODA2_TBL_LXIVT
:
332 pnv_phb3_lxivt_write(phb
, idx
, val
);
334 case IODA2_TBL_M64BT
:
336 pnv_phb3_check_m64(phb
, idx
);
344 * This is called whenever the PHB LSI, MSI source ID register or
345 * the PBCQ irq filters are written.
347 void pnv_phb3_remap_irqs(PnvPHB3
*phb
)
349 ICSState
*ics
= &phb
->lsis
;
350 uint32_t local
, global
, count
, mask
, comp
;
352 PnvPBCQState
*pbcq
= &phb
->pbcq
;
355 * First check if we are enabled. Unlike real HW we don't separate
356 * TX and RX so we enable if both are set
358 baren
= pbcq
->nest_regs
[PBCQ_NEST_BAR_EN
];
359 if (!(baren
& PBCQ_NEST_BAR_EN_IRSN_RX
) ||
360 !(baren
& PBCQ_NEST_BAR_EN_IRSN_TX
)) {
365 /* Grab local LSI source ID */
366 local
= GETFIELD(PHB_LSI_SRC_ID
, phb
->regs
[PHB_LSI_SOURCE_ID
>> 3]) << 3;
368 /* Grab global one and compare */
369 global
= GETFIELD(PBCQ_NEST_LSI_SRC
,
370 pbcq
->nest_regs
[PBCQ_NEST_LSI_SRC_ID
]) << 3;
371 if (global
!= local
) {
373 * This happens during initialization, let's come back when we
374 * are properly configured
380 /* Get the base on the powerbus */
381 comp
= GETFIELD(PBCQ_NEST_IRSN_COMP
,
382 pbcq
->nest_regs
[PBCQ_NEST_IRSN_COMPARE
]);
383 mask
= GETFIELD(PBCQ_NEST_IRSN_COMP
,
384 pbcq
->nest_regs
[PBCQ_NEST_IRSN_MASK
]);
385 count
= ((~mask
) + 1) & 0x7ffff;
386 phb
->total_irq
= count
;
389 if ((global
+ PNV_PHB3_NUM_LSI
) > count
) {
390 phb3_error(phb
, "LSIs out of reach: LSI base=%d total irq=%d", global
,
395 phb3_error(phb
, "More interrupts than supported: %d", count
);
398 if ((comp
& mask
) != comp
) {
399 phb3_error(phb
, "IRQ compare bits not in mask: comp=0x%x mask=0x%x",
403 /* Setup LSI offset */
404 ics
->offset
= comp
+ global
;
406 /* Setup MSI offset */
407 pnv_phb3_msi_update_config(&phb
->msis
, comp
, count
- PNV_PHB3_NUM_LSI
);
410 static void pnv_phb3_lsi_src_id_write(PnvPHB3
*phb
, uint64_t val
)
412 /* Sanitize content */
413 val
&= PHB_LSI_SRC_ID
;
414 phb
->regs
[PHB_LSI_SOURCE_ID
>> 3] = val
;
415 pnv_phb3_remap_irqs(phb
);
418 static void pnv_phb3_rtc_invalidate(PnvPHB3
*phb
, uint64_t val
)
422 /* Always invalidate all for now ... */
423 QLIST_FOREACH(ds
, &phb
->dma_spaces
, list
) {
424 ds
->pe_num
= PHB_INVALID_PE
;
429 static void pnv_phb3_update_msi_regions(PnvPhb3DMASpace
*ds
)
431 uint64_t cfg
= ds
->phb
->regs
[PHB_PHB3_CONFIG
>> 3];
433 if (cfg
& PHB_PHB3C_32BIT_MSI_EN
) {
434 if (!memory_region_is_mapped(&ds
->msi32_mr
)) {
435 memory_region_add_subregion(MEMORY_REGION(&ds
->dma_mr
),
436 0xffff0000, &ds
->msi32_mr
);
439 if (memory_region_is_mapped(&ds
->msi32_mr
)) {
440 memory_region_del_subregion(MEMORY_REGION(&ds
->dma_mr
),
445 if (cfg
& PHB_PHB3C_64BIT_MSI_EN
) {
446 if (!memory_region_is_mapped(&ds
->msi64_mr
)) {
447 memory_region_add_subregion(MEMORY_REGION(&ds
->dma_mr
),
448 (1ull << 60), &ds
->msi64_mr
);
451 if (memory_region_is_mapped(&ds
->msi64_mr
)) {
452 memory_region_del_subregion(MEMORY_REGION(&ds
->dma_mr
),
458 static void pnv_phb3_update_all_msi_regions(PnvPHB3
*phb
)
462 QLIST_FOREACH(ds
, &phb
->dma_spaces
, list
) {
463 pnv_phb3_update_msi_regions(ds
);
467 void pnv_phb3_reg_write(void *opaque
, hwaddr off
, uint64_t val
, unsigned size
)
469 PnvPHB3
*phb
= opaque
;
472 /* Special case configuration data */
473 if ((off
& 0xfffc) == PHB_CONFIG_DATA
) {
474 pnv_phb3_config_write(phb
, off
& 0x3, size
, val
);
478 /* Other registers are 64-bit only */
479 if (size
!= 8 || off
& 0x7) {
480 phb3_error(phb
, "Invalid register access, offset: 0x%"PRIx64
" size: %d",
485 /* Handle masking & filtering */
487 case PHB_M64_UPPER_BITS
:
488 val
&= 0xfffc000000000000ull
;
492 * This is enough logic to make SW happy but we aren't actually
495 if (val
& PHB_Q_DMA_R_AUTORESET
) {
498 val
&= PHB_Q_DMA_R_QUIESCE_DMA
;
502 case PHB_LEM_FIR_AND_MASK
:
503 phb
->regs
[PHB_LEM_FIR_ACCUM
>> 3] &= val
;
505 case PHB_LEM_FIR_OR_MASK
:
506 phb
->regs
[PHB_LEM_FIR_ACCUM
>> 3] |= val
;
508 case PHB_LEM_ERROR_AND_MASK
:
509 phb
->regs
[PHB_LEM_ERROR_MASK
>> 3] &= val
;
511 case PHB_LEM_ERROR_OR_MASK
:
512 phb
->regs
[PHB_LEM_ERROR_MASK
>> 3] |= val
;
519 /* Record whether it changed */
520 changed
= phb
->regs
[off
>> 3] != val
;
522 /* Store in register cache first */
523 phb
->regs
[off
>> 3] = val
;
525 /* Handle side effects */
527 case PHB_PHB3_CONFIG
:
529 pnv_phb3_update_all_msi_regions(phb
);
532 case PHB_M32_BASE_ADDR
:
533 case PHB_M32_BASE_MASK
:
534 case PHB_M32_START_ADDR
:
536 pnv_phb3_check_m32(phb
);
539 case PHB_M64_UPPER_BITS
:
541 pnv_phb3_check_all_m64s(phb
);
544 case PHB_LSI_SOURCE_ID
:
546 pnv_phb3_lsi_src_id_write(phb
, val
);
550 /* IODA table accesses */
552 pnv_phb3_ioda_write(phb
, val
);
555 /* RTC invalidation */
556 case PHB_RTC_INVALIDATE
:
557 pnv_phb3_rtc_invalidate(phb
, val
);
561 case PHB_FFI_REQUEST
:
562 pnv_phb3_msi_ffi(&phb
->msis
, val
);
565 /* Silent simple writes */
566 case PHB_CONFIG_ADDRESS
:
569 case PHB_TCE_SPEC_CTL
:
576 case PHB_LEM_FIR_ACCUM
:
577 case PHB_LEM_ERROR_MASK
:
578 case PHB_LEM_ACTION0
:
579 case PHB_LEM_ACTION1
:
582 /* Noise on anything else */
584 qemu_log_mask(LOG_UNIMP
, "phb3: reg_write 0x%"PRIx64
"=%"PRIx64
"\n",
589 uint64_t pnv_phb3_reg_read(void *opaque
, hwaddr off
, unsigned size
)
591 PnvPHB3
*phb
= opaque
;
592 PCIHostState
*pci
= PCI_HOST_BRIDGE(phb
);
595 if ((off
& 0xfffc) == PHB_CONFIG_DATA
) {
596 return pnv_phb3_config_read(phb
, off
& 0x3, size
);
599 /* Other registers are 64-bit only */
600 if (size
!= 8 || off
& 0x7) {
601 phb3_error(phb
, "Invalid register access, offset: 0x%"PRIx64
" size: %d",
606 /* Default read from cache */
607 val
= phb
->regs
[off
>> 3];
610 /* Simulate venice DD2.0 */
612 return 0x000000a300000005ull
;
613 case PHB_PCIE_SYSTEM_CONFIG
:
614 return 0x441100fc30000000;
616 /* IODA table accesses */
618 return pnv_phb3_ioda_read(phb
);
620 /* Link training always appears trained */
621 case PHB_PCIE_DLP_TRAIN_CTL
:
622 if (!pci_find_device(pci
->bus
, 1, 0)) {
625 return PHB_PCIE_DLP_INBAND_PRESENCE
| PHB_PCIE_DLP_TC_DL_LINKACT
;
629 /* Set lock and return previous value */
630 phb
->regs
[off
>> 3] |= PHB_FFI_LOCK_STATE
;
633 /* DMA read sync: make it look like it's complete */
635 return PHB_DMARD_SYNC_COMPLETE
;
637 /* Silent simple reads */
638 case PHB_PHB3_CONFIG
:
639 case PHB_M32_BASE_ADDR
:
640 case PHB_M32_BASE_MASK
:
641 case PHB_M32_START_ADDR
:
642 case PHB_CONFIG_ADDRESS
:
644 case PHB_RTC_INVALIDATE
:
646 case PHB_TCE_SPEC_CTL
:
652 case PHB_M64_UPPER_BITS
:
653 case PHB_LEM_FIR_ACCUM
:
654 case PHB_LEM_ERROR_MASK
:
655 case PHB_LEM_ACTION0
:
656 case PHB_LEM_ACTION1
:
659 /* Noise on anything else */
661 qemu_log_mask(LOG_UNIMP
, "phb3: reg_read 0x%"PRIx64
"=%"PRIx64
"\n",
667 static const MemoryRegionOps pnv_phb3_reg_ops
= {
668 .read
= pnv_phb3_reg_read
,
669 .write
= pnv_phb3_reg_write
,
670 .valid
.min_access_size
= 1,
671 .valid
.max_access_size
= 8,
672 .impl
.min_access_size
= 1,
673 .impl
.max_access_size
= 8,
674 .endianness
= DEVICE_BIG_ENDIAN
,
677 static int pnv_phb3_map_irq(PCIDevice
*pci_dev
, int irq_num
)
679 /* Check that out properly ... */
683 static void pnv_phb3_set_irq(void *opaque
, int irq_num
, int level
)
685 PnvPHB3
*phb
= opaque
;
689 phb3_error(phb
, "Unknown IRQ to set %d", irq_num
);
691 qemu_set_irq(phb
->qirqs
[irq_num
], level
);
694 static bool pnv_phb3_resolve_pe(PnvPhb3DMASpace
*ds
)
700 /* Already resolved ? */
701 if (ds
->pe_num
!= PHB_INVALID_PE
) {
705 /* We need to lookup the RTT */
706 rtt
= ds
->phb
->regs
[PHB_RTT_BAR
>> 3];
707 if (!(rtt
& PHB_RTT_BAR_ENABLE
)) {
708 phb3_error(ds
->phb
, "DMA with RTT BAR disabled !");
709 /* Set error bits ? fence ? ... */
714 bus_num
= pci_bus_num(ds
->bus
);
715 addr
= rtt
& PHB_RTT_BASE_ADDRESS_MASK
;
716 addr
+= 2 * ((bus_num
<< 8) | ds
->devfn
);
717 if (dma_memory_read(&address_space_memory
, addr
, &rte
, sizeof(rte
))) {
718 phb3_error(ds
->phb
, "Failed to read RTT entry at 0x%"PRIx64
, addr
);
719 /* Set error bits ? fence ? ... */
722 rte
= be16_to_cpu(rte
);
724 /* Fail upon reading of invalid PE# */
725 if (rte
>= PNV_PHB3_NUM_PE
) {
726 phb3_error(ds
->phb
, "RTE for RID 0x%x invalid (%04x", ds
->devfn
, rte
);
727 /* Set error bits ? fence ? ... */
734 static void pnv_phb3_translate_tve(PnvPhb3DMASpace
*ds
, hwaddr addr
,
735 bool is_write
, uint64_t tve
,
738 uint64_t tta
= GETFIELD(IODA2_TVT_TABLE_ADDR
, tve
);
739 int32_t lev
= GETFIELD(IODA2_TVT_NUM_LEVELS
, tve
);
740 uint32_t tts
= GETFIELD(IODA2_TVT_TCE_TABLE_SIZE
, tve
);
741 uint32_t tps
= GETFIELD(IODA2_TVT_IO_PSIZE
, tve
);
742 PnvPHB3
*phb
= ds
->phb
;
746 phb3_error(phb
, "Invalid #levels in TVE %d", lev
);
750 /* IO Page Size of 0 means untranslated, else use TCEs */
753 * We only support non-translate in top window.
755 * TODO: Venice/Murano support it on bottom window above 4G and
756 * Naples suports it on everything
758 if (!(tve
& PPC_BIT(51))) {
759 phb3_error(phb
, "xlate for invalid non-translate TVE");
762 /* TODO: Handle boundaries */
764 /* Use 4k pages like q35 ... for now */
765 tlb
->iova
= addr
& 0xfffffffffffff000ull
;
766 tlb
->translated_addr
= addr
& 0x0003fffffffff000ull
;
767 tlb
->addr_mask
= 0xfffull
;
768 tlb
->perm
= IOMMU_RW
;
770 uint32_t tce_shift
, tbl_shift
, sh
;
771 uint64_t base
, taddr
, tce
, tce_mask
;
775 phb3_error(phb
, "xlate for invalid translated TVE");
779 /* Address bits per bottom level TCE entry */
780 tce_shift
= tps
+ 11;
782 /* Address bits per table level */
785 /* Top level table base address */
788 /* Total shift to first level */
789 sh
= tbl_shift
* lev
+ tce_shift
;
791 /* TODO: Multi-level untested */
792 while ((lev
--) >= 0) {
793 /* Grab the TCE address */
794 taddr
= base
| (((addr
>> sh
) & ((1ul << tbl_shift
) - 1)) << 3);
795 if (dma_memory_read(&address_space_memory
, taddr
, &tce
,
797 phb3_error(phb
, "Failed to read TCE at 0x%"PRIx64
, taddr
);
800 tce
= be64_to_cpu(tce
);
802 /* Check permission for indirect TCE */
803 if ((lev
>= 0) && !(tce
& 3)) {
804 phb3_error(phb
, "Invalid indirect TCE at 0x%"PRIx64
, taddr
);
805 phb3_error(phb
, " xlate %"PRIx64
":%c TVE=%"PRIx64
, addr
,
806 is_write
? 'W' : 'R', tve
);
807 phb3_error(phb
, " tta=%"PRIx64
" lev=%d tts=%d tps=%d",
812 base
= tce
& ~0xfffull
;
815 /* We exit the loop with TCE being the final TCE */
816 tce_mask
= ~((1ull << tce_shift
) - 1);
817 tlb
->iova
= addr
& tce_mask
;
818 tlb
->translated_addr
= tce
& tce_mask
;
819 tlb
->addr_mask
= ~tce_mask
;
821 if ((is_write
& !(tce
& 2)) || ((!is_write
) && !(tce
& 1))) {
822 phb3_error(phb
, "TCE access fault at 0x%"PRIx64
, taddr
);
823 phb3_error(phb
, " xlate %"PRIx64
":%c TVE=%"PRIx64
, addr
,
824 is_write
? 'W' : 'R', tve
);
825 phb3_error(phb
, " tta=%"PRIx64
" lev=%d tts=%d tps=%d",
831 static IOMMUTLBEntry
pnv_phb3_translate_iommu(IOMMUMemoryRegion
*iommu
,
833 IOMMUAccessFlags flag
,
836 PnvPhb3DMASpace
*ds
= container_of(iommu
, PnvPhb3DMASpace
, dma_mr
);
839 IOMMUTLBEntry ret
= {
840 .target_as
= &address_space_memory
,
842 .translated_addr
= 0,
843 .addr_mask
= ~(hwaddr
)0,
846 PnvPHB3
*phb
= ds
->phb
;
849 if (!pnv_phb3_resolve_pe(ds
)) {
850 phb3_error(phb
, "Failed to resolve PE# for bus @%p (%d) devfn 0x%x",
851 ds
->bus
, pci_bus_num(ds
->bus
), ds
->devfn
);
856 switch (addr
>> 60) {
858 /* DMA or 32-bit MSI ? */
859 cfg
= ds
->phb
->regs
[PHB_PHB3_CONFIG
>> 3];
860 if ((cfg
& PHB_PHB3C_32BIT_MSI_EN
) &&
861 ((addr
& 0xffffffffffff0000ull
) == 0xffff0000ull
)) {
862 phb3_error(phb
, "xlate on 32-bit MSI region");
865 /* Choose TVE XXX Use PHB3 Control Register */
866 tve_sel
= (addr
>> 59) & 1;
867 tve
= ds
->phb
->ioda_TVT
[ds
->pe_num
* 2 + tve_sel
];
868 pnv_phb3_translate_tve(ds
, addr
, flag
& IOMMU_WO
, tve
, &ret
);
871 phb3_error(phb
, "xlate on 64-bit MSI region");
874 phb3_error(phb
, "xlate on unsupported address 0x%"PRIx64
, addr
);
879 #define TYPE_PNV_PHB3_IOMMU_MEMORY_REGION "pnv-phb3-iommu-memory-region"
880 #define PNV_PHB3_IOMMU_MEMORY_REGION(obj) \
881 OBJECT_CHECK(IOMMUMemoryRegion, (obj), TYPE_PNV_PHB3_IOMMU_MEMORY_REGION)
883 static void pnv_phb3_iommu_memory_region_class_init(ObjectClass
*klass
,
886 IOMMUMemoryRegionClass
*imrc
= IOMMU_MEMORY_REGION_CLASS(klass
);
888 imrc
->translate
= pnv_phb3_translate_iommu
;
891 static const TypeInfo pnv_phb3_iommu_memory_region_info
= {
892 .parent
= TYPE_IOMMU_MEMORY_REGION
,
893 .name
= TYPE_PNV_PHB3_IOMMU_MEMORY_REGION
,
894 .class_init
= pnv_phb3_iommu_memory_region_class_init
,
898 * MSI/MSIX memory region implementation.
899 * The handler handles both MSI and MSIX.
901 static void pnv_phb3_msi_write(void *opaque
, hwaddr addr
,
902 uint64_t data
, unsigned size
)
904 PnvPhb3DMASpace
*ds
= opaque
;
907 if (!pnv_phb3_resolve_pe(ds
)) {
908 phb3_error(ds
->phb
, "Failed to resolve PE# for bus @%p (%d) devfn 0x%x",
909 ds
->bus
, pci_bus_num(ds
->bus
), ds
->devfn
);
913 pnv_phb3_msi_send(&ds
->phb
->msis
, addr
, data
, ds
->pe_num
);
916 /* There is no .read as the read result is undefined by PCI spec */
917 static uint64_t pnv_phb3_msi_read(void *opaque
, hwaddr addr
, unsigned size
)
919 PnvPhb3DMASpace
*ds
= opaque
;
921 phb3_error(ds
->phb
, "invalid read @ 0x%" HWADDR_PRIx
, addr
);
925 static const MemoryRegionOps pnv_phb3_msi_ops
= {
926 .read
= pnv_phb3_msi_read
,
927 .write
= pnv_phb3_msi_write
,
928 .endianness
= DEVICE_LITTLE_ENDIAN
931 static AddressSpace
*pnv_phb3_dma_iommu(PCIBus
*bus
, void *opaque
, int devfn
)
933 PnvPHB3
*phb
= opaque
;
936 QLIST_FOREACH(ds
, &phb
->dma_spaces
, list
) {
937 if (ds
->bus
== bus
&& ds
->devfn
== devfn
) {
943 ds
= g_malloc0(sizeof(PnvPhb3DMASpace
));
946 ds
->pe_num
= PHB_INVALID_PE
;
948 memory_region_init_iommu(&ds
->dma_mr
, sizeof(ds
->dma_mr
),
949 TYPE_PNV_PHB3_IOMMU_MEMORY_REGION
,
950 OBJECT(phb
), "phb3_iommu", UINT64_MAX
);
951 address_space_init(&ds
->dma_as
, MEMORY_REGION(&ds
->dma_mr
),
953 memory_region_init_io(&ds
->msi32_mr
, OBJECT(phb
), &pnv_phb3_msi_ops
,
954 ds
, "msi32", 0x10000);
955 memory_region_init_io(&ds
->msi64_mr
, OBJECT(phb
), &pnv_phb3_msi_ops
,
956 ds
, "msi64", 0x100000);
957 pnv_phb3_update_msi_regions(ds
);
959 QLIST_INSERT_HEAD(&phb
->dma_spaces
, ds
, list
);
964 static void pnv_phb3_instance_init(Object
*obj
)
966 PnvPHB3
*phb
= PNV_PHB3(obj
);
968 QLIST_INIT(&phb
->dma_spaces
);
971 object_initialize_child(obj
, "lsi", &phb
->lsis
, TYPE_ICS
);
973 /* Default init ... will be fixed by HW inits */
974 phb
->lsis
.offset
= 0;
977 object_initialize_child(obj
, "msi", &phb
->msis
, TYPE_PHB3_MSI
);
979 /* Power Bus Common Queue */
980 object_initialize_child(obj
, "pbcq", &phb
->pbcq
, TYPE_PNV_PBCQ
);
983 object_initialize_child(obj
, "root", &phb
->root
, TYPE_PNV_PHB3_ROOT_PORT
);
984 qdev_prop_set_int32(DEVICE(&phb
->root
), "addr", PCI_DEVFN(0, 0));
985 qdev_prop_set_bit(DEVICE(&phb
->root
), "multifunction", false);
988 static void pnv_phb3_realize(DeviceState
*dev
, Error
**errp
)
990 PnvPHB3
*phb
= PNV_PHB3(dev
);
991 PCIHostState
*pci
= PCI_HOST_BRIDGE(dev
);
992 PnvMachineState
*pnv
= PNV_MACHINE(qdev_get_machine());
995 if (phb
->phb_id
>= PNV8_CHIP_PHB3_MAX
) {
996 error_setg(errp
, "invalid PHB index: %d", phb
->phb_id
);
1001 object_property_set_link(OBJECT(&phb
->lsis
), "xics", OBJECT(pnv
),
1003 object_property_set_int(OBJECT(&phb
->lsis
), "nr-irqs", PNV_PHB3_NUM_LSI
,
1005 if (!qdev_realize(DEVICE(&phb
->lsis
), NULL
, errp
)) {
1009 for (i
= 0; i
< phb
->lsis
.nr_irqs
; i
++) {
1010 ics_set_irq_type(&phb
->lsis
, i
, true);
1013 phb
->qirqs
= qemu_allocate_irqs(ics_set_irq
, &phb
->lsis
, phb
->lsis
.nr_irqs
);
1016 object_property_set_link(OBJECT(&phb
->msis
), "phb", OBJECT(phb
),
1018 object_property_set_link(OBJECT(&phb
->msis
), "xics", OBJECT(pnv
),
1020 object_property_set_int(OBJECT(&phb
->msis
), "nr-irqs", PHB3_MAX_MSI
,
1022 if (!qdev_realize(DEVICE(&phb
->msis
), NULL
, errp
)) {
1026 /* Power Bus Common Queue */
1027 object_property_set_link(OBJECT(&phb
->pbcq
), "phb", OBJECT(phb
),
1029 if (!qdev_realize(DEVICE(&phb
->pbcq
), NULL
, errp
)) {
1033 /* Controller Registers */
1034 memory_region_init_io(&phb
->mr_regs
, OBJECT(phb
), &pnv_phb3_reg_ops
, phb
,
1035 "phb3-regs", 0x1000);
1038 * PHB3 doesn't support IO space. However, qemu gets very upset if
1039 * we don't have an IO region to anchor IO BARs onto so we just
1040 * initialize one which we never hook up to anything
1042 memory_region_init(&phb
->pci_io
, OBJECT(phb
), "pci-io", 0x10000);
1043 memory_region_init(&phb
->pci_mmio
, OBJECT(phb
), "pci-mmio",
1044 PCI_MMIO_TOTAL_SIZE
);
1046 pci
->bus
= pci_register_root_bus(dev
, "root-bus",
1047 pnv_phb3_set_irq
, pnv_phb3_map_irq
, phb
,
1048 &phb
->pci_mmio
, &phb
->pci_io
,
1049 0, 4, TYPE_PNV_PHB3_ROOT_BUS
);
1051 pci_setup_iommu(pci
->bus
, pnv_phb3_dma_iommu
, phb
);
1053 /* Add a single Root port */
1054 qdev_prop_set_uint8(DEVICE(&phb
->root
), "chassis", phb
->chip_id
);
1055 qdev_prop_set_uint16(DEVICE(&phb
->root
), "slot", phb
->phb_id
);
1056 qdev_realize(DEVICE(&phb
->root
), BUS(pci
->bus
), &error_fatal
);
1059 void pnv_phb3_update_regions(PnvPHB3
*phb
)
1061 PnvPBCQState
*pbcq
= &phb
->pbcq
;
1063 /* Unmap first always */
1064 if (memory_region_is_mapped(&phb
->mr_regs
)) {
1065 memory_region_del_subregion(&pbcq
->phbbar
, &phb
->mr_regs
);
1068 /* Map registers if enabled */
1069 if (memory_region_is_mapped(&pbcq
->phbbar
)) {
1070 /* TODO: We should use the PHB BAR 2 register but we don't ... */
1071 memory_region_add_subregion(&pbcq
->phbbar
, 0, &phb
->mr_regs
);
1074 /* Check/update m32 */
1075 if (memory_region_is_mapped(&phb
->mr_m32
)) {
1076 pnv_phb3_check_m32(phb
);
1078 pnv_phb3_check_all_m64s(phb
);
1081 static const char *pnv_phb3_root_bus_path(PCIHostState
*host_bridge
,
1084 PnvPHB3
*phb
= PNV_PHB3(host_bridge
);
1086 snprintf(phb
->bus_path
, sizeof(phb
->bus_path
), "00%02x:%02x",
1087 phb
->chip_id
, phb
->phb_id
);
1088 return phb
->bus_path
;
1091 static Property pnv_phb3_properties
[] = {
1092 DEFINE_PROP_UINT32("index", PnvPHB3
, phb_id
, 0),
1093 DEFINE_PROP_UINT32("chip-id", PnvPHB3
, chip_id
, 0),
1094 DEFINE_PROP_END_OF_LIST(),
1097 static void pnv_phb3_class_init(ObjectClass
*klass
, void *data
)
1099 PCIHostBridgeClass
*hc
= PCI_HOST_BRIDGE_CLASS(klass
);
1100 DeviceClass
*dc
= DEVICE_CLASS(klass
);
1102 hc
->root_bus_path
= pnv_phb3_root_bus_path
;
1103 dc
->realize
= pnv_phb3_realize
;
1104 device_class_set_props(dc
, pnv_phb3_properties
);
1105 set_bit(DEVICE_CATEGORY_BRIDGE
, dc
->categories
);
1106 dc
->user_creatable
= false;
1109 static const TypeInfo pnv_phb3_type_info
= {
1110 .name
= TYPE_PNV_PHB3
,
1111 .parent
= TYPE_PCIE_HOST_BRIDGE
,
1112 .instance_size
= sizeof(PnvPHB3
),
1113 .class_init
= pnv_phb3_class_init
,
1114 .instance_init
= pnv_phb3_instance_init
,
1117 static void pnv_phb3_root_bus_class_init(ObjectClass
*klass
, void *data
)
1119 BusClass
*k
= BUS_CLASS(klass
);
1122 * PHB3 has only a single root complex. Enforce the limit on the
1128 static const TypeInfo pnv_phb3_root_bus_info
= {
1129 .name
= TYPE_PNV_PHB3_ROOT_BUS
,
1130 .parent
= TYPE_PCIE_BUS
,
1131 .class_init
= pnv_phb3_root_bus_class_init
,
1132 .interfaces
= (InterfaceInfo
[]) {
1133 { INTERFACE_PCIE_DEVICE
},
1138 static void pnv_phb3_root_port_realize(DeviceState
*dev
, Error
**errp
)
1140 PCIERootPortClass
*rpc
= PCIE_ROOT_PORT_GET_CLASS(dev
);
1141 Error
*local_err
= NULL
;
1143 rpc
->parent_realize(dev
, &local_err
);
1145 error_propagate(errp
, local_err
);
1150 static void pnv_phb3_root_port_class_init(ObjectClass
*klass
, void *data
)
1152 DeviceClass
*dc
= DEVICE_CLASS(klass
);
1153 PCIDeviceClass
*k
= PCI_DEVICE_CLASS(klass
);
1154 PCIERootPortClass
*rpc
= PCIE_ROOT_PORT_CLASS(klass
);
1156 dc
->desc
= "IBM PHB3 PCIE Root Port";
1158 device_class_set_parent_realize(dc
, pnv_phb3_root_port_realize
,
1159 &rpc
->parent_realize
);
1160 dc
->user_creatable
= false;
1162 k
->vendor_id
= PCI_VENDOR_ID_IBM
;
1163 k
->device_id
= 0x03dc;
1166 rpc
->exp_offset
= 0x48;
1167 rpc
->aer_offset
= 0x100;
1170 static const TypeInfo pnv_phb3_root_port_info
= {
1171 .name
= TYPE_PNV_PHB3_ROOT_PORT
,
1172 .parent
= TYPE_PCIE_ROOT_PORT
,
1173 .instance_size
= sizeof(PnvPHB3RootPort
),
1174 .class_init
= pnv_phb3_root_port_class_init
,
1177 static void pnv_phb3_register_types(void)
1179 type_register_static(&pnv_phb3_root_bus_info
);
1180 type_register_static(&pnv_phb3_root_port_info
);
1181 type_register_static(&pnv_phb3_type_info
);
1182 type_register_static(&pnv_phb3_iommu_memory_region_info
);
1185 type_init(pnv_phb3_register_types
)